joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10000da30
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov dword [0x10006b730], ecx
xor eax, eax
add eax, 1
lea rdx, [0x10006b730]
movsxd rcx, eax
mov r8d, dword [rdx + rcx*4 - 4]
mov ecx, r8d
shr ecx, 0x1e
xor ecx, r8d
imul ecx, ecx, 0x6c078965
mov r8d, eax
add r8d, ecx
mov ecx, eax
mov dword [rdx + rcx*4], r8d
cmp eax, 0x26f
jl 0x10000da38
mov dword [0x100048be0], 0x270
ret

Function at 0x10000da80
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov eax, 0xffffffff
nop dword [rax]
add eax, 1
movsxd rdx, eax
lea rcx, [0x10006b730]
mov ecx, dword [rcx + rdx*4 + 4]
mov edx, eax
lea r8, [0x10006b730]
mov r8d, dword [r8 + rdx*4]
mov edx, ecx
and edx, 1
neg rdx
and edx, 0x9908b0df
and r8d, 0x80000000
and ecx, 0x7fffffff
or r8d, ecx
shr r8d, 1
xor edx, r8d
movsxd rcx, eax
lea r8, [0x10006b730]
xor edx, dword [r8 + rcx*4 + 0x634]
mov ecx, eax
lea r8, [0x10006b730]
mov dword [r8 + rcx*4], edx
cmp eax, 0xe2
jl 0x10000da88
mov eax, 0xe2
nop dword [rax]
add eax, 1
movsxd rdx, eax
lea rcx, [0x10006b730]
mov ecx, dword [rcx + rdx*4 + 4]
mov edx, eax
lea r8, [0x10006b730]
mov r8d, dword [r8 + rdx*4]
mov edx, ecx
and edx, 1
neg rdx
and edx, 0x9908b0df
and r8d, 0x80000000
and ecx, 0x7fffffff
or r8d, ecx
shr r8d, 1
xor edx, r8d
movsxd rcx, eax
lea r8, [0x10006b730]
xor edx, dword [r8 + rcx*4 - 0x38c]
mov ecx, eax
lea r8, [0x10006b730]
mov dword [r8 + rcx*4], edx
cmp eax, 0x26e
jl 0x10000daf8
mov edx, dword [0x10006b730]
mov ecx, dword [0x10006c0ec]
mov eax, edx
and eax, 1
neg rax
and eax, 0x9908b0df
and ecx, 0x80000000
and edx, 0x7fffffff
or ecx, edx
shr ecx, 1
xor eax, ecx
xor eax, dword [0x10006bd60]
mov dword [0x10006c0ec], eax
mov dword [0x100048be0], 0
ret

Function at 0x10000dbb0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push rbx
lea rsp, [rsp - 0x20]
mov ebx, dword [0x100048be0]
add dword [0x100048be0], 1
mov eax, dword [0x10006a0b0]
cmp eax, dword [0x100048630]
jne 0x10000dbd9
cmp ebx, 0x271
jb 0x10000dbfc
mov ecx, dword [0x10006a0b0]
call fcn.10000da30
not dword [0x10006a0b0]
mov eax, dword [0x10006a0b0]
mov dword [0x100048630], eax
mov ebx, 0x270
nop
cmp ebx, 0x270
jne 0x10000dc18
call fcn.10000da80
xor ebx, ebx
mov dword [0x100048be0], 1
nop dword [rax]
and ebx, ebx
lea rax, [0x10006b730]
mov edx, dword [rax + rbx*4]
mov eax, edx
shr eax, 0xb
xor eax, edx
mov edx, eax
shl edx, 7
and edx, 0x9d2c5680
xor edx, eax
mov ecx, edx
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, edx
mov eax, ecx
shr eax, 0x12
xor eax, ecx
nop
lea rsp, [rsp + 0x20]
pop rbx
ret
Function at 0x10000fc80
Capabilities:
Check for software breakpoints

Disassembly:
push rbx
push rdi
push rsi
lea rsp, [rsp - 0x20]
mov ax, word [0x100048390]
cmp ax, 0xcb
je 0x10000fdbc
cmp ax, 0xcc
je 0x10000fdbc
nop
mov rax, qword [0x10006c430]
test rax, rax
je 0x10000fcbd
mov ecx, dword [0x10006c220]
call rax
mov rbx, rax
jmp 0x10000fcc4
lea rbx, [0x10006c228]
cmp word [0x10006c210], 0
jle 0x10000fcec
lea rcx, [0x10006c1e0]
call fcn.10000ffa0
mov rcx, rbx
call fcn.10000f740
mov rcx, rbx
call fcn.10000f7d0
nop
mov rsi, qword [rbx]
jmp 0x10000fd19
mov rdi, qword [rsi + 8]
mov rax, qword [rsi]
and rax, 1
jne 0x10000fd12
mov rdx, rsi
mov rcx, rbx
call fcn.10000e9c0
jmp 0x10000fd16
and qword [rsi], 0xfffffffffffffffe
mov rsi, rdi
test rsi, rsi
jne 0x10000fcf8
mov qword [rbx], 0
mov dword [rbx + 0x90], 0
cmp word [0x10006c210], 0
jle 0x10000fdbc
lea rdx, [0x10006c0f0]
mov rcx, rbx
call fcn.10000eb40
mov rsi, rax
test rax, rax
je 0x10000fd88
mov rax, qword [0x10006c190]
mov qword [rsi + 0x18], rax
cmp qword [0x10006c190], 0
je 0x10000fd78
mov rax, qword [0x10006c190]
mov qword [rax + 0x10], rsi
nop dword [rax]
mov rax, qword [rbx + 0xa0]
mov qword [0x10006c190], rax
nop
sub word [0x10006c210], 1
cmp word [0x10006c210], 0
sete bl
lea rcx, [0x10006c1e0]
call fcn.10000ffe0
test bl, bl
je 0x10000fdbc
lea rcx, [0x10006c1e0]
call fcn.10000ff80
nop dword [rax]
nop
lea rsp, [rsp + 0x20]
pop rsi
pop rdi
pop rbx
ret
Function at 0x100012400
Capabilities:
Get common file path

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0x70]
mov qword [rbp - 0x48], rbx
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x38], rsi
mov qword [rbp - 0x30], r12
mov sil, cl
mov rdi, rdx
mov qword [rbp - 0x28], 0
mov qword [rbp - 0x20], 0
mov qword [rbp - 0x18], 0
nop
test sil, sil
je 0x10001253e
movzx eax, sil
sub eax, 0xffffffc0
mov word [rbp - 8], ax
mov word [rbp - 6], 0x3a
mov word [rbp - 4], 0
mov word [rbp - 2], 0
lea rcx, [rbp - 8]
lea r9, [rbp - 0x10]
xor r8, r8
xor edx, edx
call sub.kernel32.dll_GetFullPathNameW
mov ebx, eax
mov edx, ebx
sub rdx, 1
mov rcx, rdi
call fcn.10000a0d0
mov r8, qword [rdi]
test r8, r8
jne 0x10001248f
lea r8, [0x10006b500]
lea rcx, [rbp - 8]
lea r9, [rbp - 0x10]
mov edx, ebx
call sub.kernel32.dll_GetFullPathNameW
mov r12d, eax
test eax, eax
jne 0x1000124fb
call sub.kernel32.dll_GetLastError
mov ecx, eax
call fcn.100003560
lea rcx, [rbp - 0x18]
call fcn.100008cd0
and esi, 0xff
lea edx, [esi + 0x41]
sub edx, 1
and edx, 0xffff
lea rcx, [rbp - 0x20]
call fcn.100009330
mov rdx, qword [rbp - 0x20]
lea r8, [0x10004d104]
lea rcx, [rbp - 0x18]
call fcn.100009090
mov rdx, qword [rbp - 0x18]
mov rcx, rdi
call fcn.100009a00
jmp 0x100012590
mov eax, ebx
sub rax, 1
mov edx, r12d
cmp rax, rdx
je 0x100012514
mov edx, r12d
mov rcx, rdi
call fcn.10000a0d0
cmp byte [0x100048600], 0
jne 0x100012590
mov rdx, qword [rdi]
lea rcx, [rbp - 0x28]
call fcn.10000a840
mov rdx, qword [rbp - 0x28]
mov rcx, rdi
call fcn.100009b60
nop dword [rax]
jmp 0x100012590
xor edx, edx
xor ecx, ecx
call sub.kernel32.dll_GetCurrentDirectoryW
mov ebx, eax
mov edx, ebx
sub rdx, 1
mov rcx, rdi
call fcn.10000a0d0
mov rdx, qword [rdi]
test rdx, rdx
jne 0x100012566
lea rdx, [0x10006b500]
mov ecx, ebx
call sub.kernel32.dll_GetCurrentDirectoryW
cmp byte [0x100048600], 0
jne 0x100012590
mov rdx, qword [rdi]
lea rcx, [rbp - 0x28]
call fcn.10000a840
mov rdx, qword [rbp - 0x28]
mov rcx, rdi
call fcn.100009b60
nop
nop
mov rcx, rbp
call fcn.1000123d0
mov rbx, qword [rbp - 0x48]
mov rdi, qword [rbp - 0x40]
mov rsi, qword [rbp - 0x38]
mov r12, qword [rbp - 0x30]
lea rsp, [rbp]
pop rbp
ret
Function at 0x100012a00
Capabilities:
Accept command line arguments

Disassembly:
push rbx
push rdi
push rsi
push r12
push r13
push r14
lea rsp, [rsp - 0x128]
xor esi, esi
mov qword [0x10006b440], 0
mov dword [rsp + 0x20], 0
lea rdx, [rsp + 0x24]
mov r8d, 0x104
xor ecx, ecx
call sub.kernel32.dll_GetModuleFileNameA
mov ebx, eax
and eax, eax
mov byte [rsp + rax + 0x24], 0
mov r8d, ebx
xor edx, edx
mov rcx, rsp
call fcn.100012be0
movsxd rax, ebx
lea r8, [rax + 1]
mov rax, qword [0x10006b440]
mov rdx, qword [rax]
lea rcx, [rsp + 0x24]
call fcn.100002d40
call sub.kernel32.dll_GetCommandLineA
mov qword [0x100048400], rax
mov r14, rax
jmp 0x100012b87
add r14, 1
movzx eax, byte [r14]
sub eax, 1
cmp eax, 0x20
jb 0x100012a88
cmp byte [r14], 0
je 0x100012b91
nop
xor dil, dil
mov r12, r14
xor ebx, ebx
jmp 0x100012af0
mov al, byte [r14]
cmp al, 1
jb 0x100012ae8
sub al, 0x20
jbe 0x100012ac4
sub al, 2
je 0x100012ad0
jmp 0x100012ae8
test dil, dil
je 0x100012af6
add ebx, 1
jmp 0x100012aec
cmp byte [r14 + 1], 0x22
je 0x100012ae0
test dil, dil
sete dil
jmp 0x100012aec
add r14, 1
jmp 0x100012aec
add ebx, 1
nop
add r14, 1
cmp byte [r14], 0
jne 0x100012ab0
test esi, esi
je 0x100012b84
mov r8d, ebx
mov edx, esi
mov rcx, rsp
call fcn.100012be0
xor dil, dil
mov r14, r12
mov rdx, qword [0x10006b440]
movsxd rax, esi
mov r13, qword [rdx + rax*8]
jmp 0x100012b78
mov al, byte [r14]
cmp al, 1
jb 0x100012b68
sub al, 0x20
jbe 0x100012b3c
sub al, 2
je 0x100012b50
jmp 0x100012b68
test dil, dil
je 0x100012b7e
mov al, byte [r14]
mov byte [r13], al
add r13, 1
jmp 0x100012b74
cmp byte [r14 + 1], 0x22
je 0x100012b60
test dil, dil
sete dil
jmp 0x100012b74
add r14, 1
jmp 0x100012b74
mov al, byte [r14]
mov byte [r13], al
add r13, 1
nop
add r14, 1
cmp byte [r14], 0
jne 0x100012b28
mov byte [r13], 0
nop
add esi, 1
cmp byte [r14], 0
jne 0x100012a8c
mov dword [0x10006b430], esi
movsxd rax, esi
lea rdx, [rax + 1]
shl rdx, 3
lea rcx, [0x10006b440]
call fcn.10000fa60
mov rax, qword [0x10006b440]
movsxd rsi, esi
mov qword [rax + rsi*8], 0
nop
lea rsp, [rsp + 0x128]
pop r14
pop r13
pop r12
pop rsi
pop rdi
pop rbx
ret
Function at 0x100014bb0
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0x180]
mov qword [rbp - 0x140], rbx
mov qword [rbp - 0x138], rdi
mov qword [rbp - 0x130], rsi
mov qword [rbp - 0x128], r12
mov qword [rbp - 0x120], r13
mov rsi, rcx
mov rdi, rdx
mov r12d, r8d
mov qword [rbp - 0x18], 0
mov qword [rbp - 0x10], 0
nop
mov r13, qword [0x10004d830]
mov eax, dword [0x10004d828]
mov dword [rbp - 4], eax
mov ebx, dword [0x10004d820]
lea rcx, [rbp - 0x10]
call fcn.100007280
mov rdx, rsi
lea rcx, [rbp - 0x18]
call fcn.10002e990
mov r8, qword [rbp - 0x18]
xor r9d, r9d
lea rdx, str.filename:
lea rcx, [rbp - 0x10]
call fcn.100007420
mov rcx, qword [rbp - 0x10]
xor edx, edx
call fcn.100034650
lea rcx, [rbp - 0x18]
call fcn.100007280
mov ecx, r12d
mov r9d, 0xff
lea r8, [rbp - 0x118]
mov rdx, 0xffffffffffffffff
call fcn.100004640
xor r8d, r8d
lea rdx, [rbp - 0x118]
lea rcx, [rbp - 0x10]
call fcn.100007c80
xor r8b, r8b
xor edx, edx
lea rcx, [rbp - 0x10]
call fcn.100008b60
mov r8, qword [rbp - 0x10]
xor r9d, r9d
lea rdx, str.lenght:
lea rcx, [rbp - 0x18]
call fcn.100007420
mov rcx, qword [rbp - 0x18]
xor edx, edx
call fcn.100034650
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 2
mov rcx, rsi
xor r9, r9
xor r8d, r8d
mov edx, 0x40000000
call sub.kernel32.dll_CreateFileA
mov r13, rax
cmp r13, 0xffffffffffffffff
je 0x100014d8e
mov qword [rsp + 0x20], 0
mov rdx, rdi
lea r9, [rbp - 4]
mov r8d, r12d
mov rcx, r13
call sub.kernel32.dll_WriteFile
test eax, eax
je 0x100014d1e
cmp r12d, dword [rbp - 4]
sete al
movzx eax, al
neg eax
je 0x100014d1e
mov rcx, r13
call sub.kernel32.dll_FlushFileBuffers
mov ebx, eax
mov rcx, r13
call sub.kernel32.dll_CloseHandle
lea rcx, [rbp - 0x18]
call fcn.100007280
mov ecx, dword [rbp - 4]
mov r9d, 0xff
lea r8, [rbp - 0x118]
mov rdx, 0xffffffffffffffff
call fcn.100004640
xor r8d, r8d
lea rdx, [rbp - 0x118]
lea rcx, [rbp - 0x10]
call fcn.100007c80
xor r8b, r8b
xor edx, edx
lea rcx, [rbp - 0x10]
call fcn.100008b60
mov r8, qword [rbp - 0x10]
xor r9d, r9d
lea rdx, str.dwBytesWritten:
lea rcx, [rbp - 0x18]
call fcn.100007420
mov rcx, qword [rbp - 0x18]
xor edx, edx
call fcn.100034650
nop
mov rcx, rbp
call fcn.100014b80
mov eax, ebx
mov rbx, qword [rbp - 0x140]
mov rdi, qword [rbp - 0x138]
mov rsi, qword [rbp - 0x130]
mov r12, qword [rbp - 0x128]
mov r13, qword [rbp - 0x120]
lea rsp, [rbp]
pop rbp
ret
Function at 0x100026900
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
lea rsp, [rsp - 0x20]
xor bl, bl
cmp dword [0x10006cdd0], 2
jne 0x100026a12
cmp qword [0x100048e70], 0
jne 0x100026932
lea rcx, str.secur32.dll
call sub.kernel32.dll_LoadLibraryA
mov qword [0x100048e70], rax
cmp qword [0x100048e70], 0x20
jbe 0x100026a12
mov rcx, qword [0x100048e70]
lea rdx, str.LsaFreeReturnBuffer
call sub.kernel32.dll_GetProcAddress
mov qword [0x10006ccf0], rax
mov rcx, qword [0x100048e70]
lea rdx, str.LsaEnumerateLogonSessions
call sub.kernel32.dll_GetProcAddress
mov qword [0x10006cd00], rax
mov rcx, qword [0x100048e70]
lea rdx, str.LsaGetLogonSessionData
call sub.kernel32.dll_GetProcAddress
mov qword [0x10006cd10], rax
mov rcx, qword [0x100048e70]
lea rdx, str.LsaCallAuthenticationPackage
call sub.kernel32.dll_GetProcAddress
mov qword [0x10006cca0], rax
mov rcx, qword [0x100048e70]
lea rdx, str.LsaConnectUntrusted
call sub.kernel32.dll_GetProcAddress
mov qword [0x10006ccb0], rax
mov rcx, qword [0x100048e70]
lea rdx, str.LsaLookupAuthenticationPackage
call sub.kernel32.dll_GetProcAddress
mov qword [0x10006ccc0], rax
mov rcx, qword [0x100048e70]
lea rdx, str.LsaRegisterLogonProcess
call sub.kernel32.dll_GetProcAddress
mov qword [0x10006ccd0], rax
mov rcx, qword [0x100048e70]
lea rdx, str.LsaDeregisterLogonProcess
call sub.kernel32.dll_GetProcAddress
mov qword [0x10006cce0], rax
mov bl, 1
mov al, bl
nop
lea rsp, [rsp + 0x20]
pop rbx
ret

Function at 0x100032490
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0x2b0]
mov qword [rbp - 0x290], rbx
mov qword [rbp - 0x288], rdi
mov qword [rbp - 0x280], rsi
mov qword [rbp - 8], rcx
mov byte [rbp - 0x10], dl
mov bl, r8b
lea rdx, [0x1000578d8]
lea rcx, [rbp - 0x278]
call fcn.10000d1f0
nop
mov rcx, qword [rbp - 8]
test rcx, rcx
jne 0x1000324df
lea rcx, [0x10006b500]
call sub.kernel32.dll_GetFileAttributesW
mov esi, eax
cmp esi, 0xffffffff
jne 0x100032522
call sub.kernel32.dll_GetLastError
cmp eax, 0xa1
jbe 0x1000324fd
clc
jmp 0x100032504
bt dword [0x100056c00], eax
jb 0x10003251a
mov rcx, rbp
call fcn.1000325d0
test al, al
je 0x10003251a
mov dil, 1
jmp 0x1000325a0
xor dil, dil
jmp 0x1000325a0
mov eax, esi
and eax, 0x10
movzx ecx, byte [rbp - 0x10]
lea rdx, [0x100049e90]
cmp eax, dword [rdx + rcx*4]
sete dil
and bl, dil
je 0x1000325a0
and esi, 0x400
je 0x1000325a0
lea rbx, [rbp - 0x278]
lea rdx, [0x1000578d8]
mov rcx, rbx
call fcn.10000d2d0
mov rdx, rbx
mov rcx, qword [rbp - 8]
xor r8b, r8b
call fcn.1000320c0
test eax, eax
je 0x10003257c
sub eax, 1
je 0x100032594
jmp 0x10003259c
mov dl, byte [rbp - 0x10]
mov rcx, qword [rbp - 0x278]
xor r8b, r8b
call fcn.100032490
mov dil, al
jmp 0x1000325a0
mov dil, 1
jmp 0x1000325a0
xor dil, dil
nop
nop
mov rcx, rbp
call fcn.100032460
mov al, dil
mov rbx, qword [rbp - 0x290]
mov rdi, qword [rbp - 0x288]
mov rsi, qword [rbp - 0x280]
lea rsp, [rbp]
pop rbp
ret
Function at 0x1000326e0
Capabilities:
Get geographical location

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0x50]
mov qword [rbp - 0x30], rbx
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x18], r12
mov qword [rbp - 0x10], r13
mov rsi, rcx
mov edi, edx
mov r12d, r8d
mov r13, r9
mov qword [rbp - 8], 0
nop
mov edx, r12d
mov ecx, edi
xor r9d, r9d
xor r8, r8
call sub.kernel32.dll_GetLocaleInfoW
mov ebx, eax
test ebx, ebx
jle 0x100032761
movsxd rdx, ebx
sub rdx, 1
lea rcx, [rbp - 8]
call fcn.10000a0d0
cmp ebx, 1
jle 0x100032750
mov r8, qword [rbp - 8]
mov r9d, ebx
mov edx, r12d
mov ecx, edi
call sub.kernel32.dll_GetLocaleInfoW
mov ebx, eax
nop
mov rcx, rsi
mov rdx, qword [rbp - 8]
xor r8d, r8d
call fcn.1000098a0
jmp 0x10003276c
mov rcx, rsi
mov rdx, r13
call fcn.100007300
nop
mov rcx, rbp
call fcn.1000326c0
mov rbx, qword [rbp - 0x30]
mov rdi, qword [rbp - 0x28]
mov rsi, qword [rbp - 0x20]
mov r12, qword [rbp - 0x18]
mov r13, qword [rbp - 0x10]
lea rsp, [rbp]
pop rbp
ret

Function at 0x100032c30
Capabilities:
Get geographical location

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0x60]
mov qword [rbp - 0x28], rbx
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x18], 0
nop
xor ebx, ebx
nop dword [rax]
add ebx, 1
mov eax, ebx
lea rdx, [0x10006cf10]
lea rcx, [rdx + rax*8 - 8]
xor edx, edx
call fcn.100007300
mov eax, ebx
lea rdx, [0x10006cf50]
mov dword [rdx + rax*4 - 4], 0xffffffff
cmp ebx, 7
jl 0x100032c50
call sub.kernel32.dll_GetThreadLocale
mov esi, eax
lea r8, [rbp - 0xc]
mov ecx, esi
mov r9d, 0xb
mov edx, 0x100b
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x100032d04
nop
mov byte [rsp + 0x20], 1
lea rdx, [rbp - 0xc]
xor r9d, r9d
mov r8d, 0xa
lea rcx, [rbp - 0x18]
call fcn.100007e20
mov rcx, qword [rbp - 0x18]
mov edx, 1
call fcn.100028470
mov ebx, eax
sub eax, 3
cmp eax, 3
jae 0x100032d04
lea rcx, [0x100032ad0]
mov r8d, ebx
mov edx, esi
mov r9d, 4
call sub.kernel32.dll_EnumCalendarInfoA
lea rcx, [0x100032b80]
mov r8d, ebx
mov edx, esi
mov r9d, 3
call sub.kernel32.dll_EnumCalendarInfoA
nop dword [rax]
nop
mov rcx, rbp
call fcn.100032c10
mov rbx, qword [rbp - 0x28]
mov rsi, qword [rbp - 0x20]
lea rsp, [rbp]
pop rbp
ret
Function at 0x1000333a0
Capabilities:
Check os version

Disassembly:
lea rsp, [rsp - 0xb8]
mov qword [0x10006cf90], 0
mov dword [rsp + 0x20], 0x94
lea rcx, [rsp + 0x20]
call sub.kernel32.dll_GetVersionExA
mov eax, dword [rsp + 0x30]
mov dword [0x10006cdd0], eax
mov eax, dword [rsp + 0x24]
mov dword [0x10006cde0], eax
mov eax, dword [rsp + 0x28]
mov dword [0x10006cdf0], eax
mov eax, dword [rsp + 0x2c]
mov dword [0x10006ce00], eax
lea rdx, [0x10006ce11]
lea rcx, [rsp + 0x34]
mov r8d, pe_nt_image_headers64
call fcn.100002d40
lea rcx, [rsp + 0x34]
call fcn.100003b60
mov byte [0x10006ce10], al
lea rcx, [0x100056d10]
call sub.kernel32.dll_GetModuleHandleA
mov qword [0x10006cfa0], rax
test rax, rax
je 0x100033448
mov rcx, qword [0x10006cfa0]
lea rdx, [0x100056d20]
call sub.kernel32.dll_GetProcAddress
mov qword [0x10006cf90], rax
nop
cmp dword [0x10006cde0], 6
jae 0x10003345c
mov dword [0x100049100], 0
nop
cmp dword [0x10006cde0], 6
jb 0x100033478
cmp dword [0x10006cdf0], 1
jb 0x100033478
mov dword [0x100049110], 2
nop
lea rsp, [rsp + 0xb8]
ret

Function at 0x100034d40
Capabilities:
Get token membership

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0x80]
mov qword [rbp - 0x10], 0
nop
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea rax, [rbp - 0x10]
mov qword [rsp + 0x50], rax
lea rcx, [0x100049f00]
mov r9d, 0x220
mov r8d, 0x20
mov edx, 2
call sub.advapi32.dll_AllocateAndInitializeSid
or eax, eax
setne cl
call fcn.100026ee0
mov dl, al
lea r8, [rbp - 0x14]
mov rdx, qword [rbp - 0x10]
xor ecx, ecx
call sub.advapi32.dll_CheckTokenMembership
test eax, eax
je 0x100034dd4
mov eax, dword [rbp - 0x14]
or eax, eax
setne al
mov byte [rbp - 4], al
jmp 0x100034dd8
mov byte [rbp - 4], 0
nop
mov rcx, rbp
call fcn.100034d10
mov al, byte [rbp - 4]
nop
lea rsp, [rbp]
pop rbp
ret
Function at 0x140004350
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
mov qword [rsp + 0x58], rdx
mov rbx, r8
xor edx, edx
test rcx, rcx
je 0x140004384
cmp word [rcx], 0x5a4d
jne 0x140004384
movsxd rax, dword [rcx + 0x3c]
cmp eax, 0x400
jg 0x140004384
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140004384
mov edx, dword [rcx + 0x28]
add rdx, qword [rsp + 0x58]
mov rcx, rbx
call fcn.140004290
test eax, eax
jne 0x1400043a0
xor eax, eax
add rsp, 0x40
pop rbx
ret
mov rcx, rbx
call fcn.140004300
test rax, rax
je 0x140004395
lea rdx, [rax + 0x10]
lea rax, [rsp + 0x38]
mov rcx, qword [rbx]
mov r9d, 8
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x58]
mov qword [rsp + 0x38], 0
call fcn.140004b4c
not eax
shr eax, 0x1f
add rsp, 0x40
pop rbx
ret

Function at 0x140004a50
Capabilities:
Execute syscall

Disassembly:
pop rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov rcx, r10
call fcn.1400049f0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x140005610
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x140005633
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x140005633
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x1400056e1
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x1409aafb0]
mov r8, rcx
mov rcx, r9
call fcn.140005610
test eax, eax
je 0x14000570d
mov rdx, r8
mov rcx, r9
sub rdx, r9
add rsp, 0x28
jmp fcn.140005634
xor eax, eax
add rsp, 0x28
ret
Function at 0x140005bf0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x160
mov rax, qword [0x14010e098]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rdi, rcx
xor esi, esi
xor edx, edx
lea ecx, [rsi + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140005c7a
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x140005c7a
nop word [rax + rax]
mov rdx, rdi
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x140005c76
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140005c50
jmp 0x140005c7a
mov esi, dword [rsp + 0x28]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1400bce20
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x140005cb0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x160
mov rax, qword [0x14010e098]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor edx, edx
mov rsi, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140005d68
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x140005d68
mov qword [rsp + 0x178], rbx
nop dword [rax]
mov rdx, rsi
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x140005d4e
mov r8d, dword [rsp + 0x28]
lea ecx, [rax + 1]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140005d4e
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140005d10
mov rbx, qword [rsp + 0x178]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1400bce20
mov rsi, qword [rsp + 0x180]
add rsp, 0x160
pop rdi
ret