joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c3950
Capabilities:
Get memory capacity

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x110
movaps xmmword [r11 - 0x28], xmm6
mov rax, qword [0x1401737a8]
xor rax, rsp
mov qword [rsp + 0xb8], rax
mov qword [r11 + 8], rbp
mov rbx, r9
mov qword [r11 - 0x10], rsi
mov rbp, rcx
mov qword [r11 - 0x18], rdi
lea rcx, [r11 - 0x98]
movaps xmmword [r11 - 0x38], xmm7
mov rdi, r8
movaps xmmword [r11 - 0x48], xmm8
mov rsi, rdx
movaps xmmword [r11 - 0x58], xmm9
xorps xmm7, xmm7
xorps xmm9, xmm9
mov dword [rsp + 0x80], reloc.WS2_32.dll_getservbyport
xorps xmm8, xmm8
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rsp + 0x58]
test rbp, rbp
je 0x1400c3a02
xorps xmm6, xmm6
cvtsi2sd xmm6, rbp
divsd xmm6, xmm0
mulsd xmm6, qword [0x140130d88]
jmp 0x1400c3b0f
mov rax, qword [0x14018f9d8]
xorps xmm8, xmm8
movsd xmm1, qword [0x140130d68]
mulsd xmm0, xmm1
movsd qword [rax + 0x40], xmm0
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rsp + 0x48]
mov rax, qword [0x14018fa00]
mulsd xmm0, xmm1
movsd qword [rax + 0x40], xmm0
mov rcx, qword [rsp + 0x48]
sub rcx, qword [rsp + 0x50]
js 0x1400c3a4b
cvtsi2sd xmm8, rcx
jmp 0x1400c3a61
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2sd xmm8, rax
addsd xmm8, xmm8
mov rcx, qword [rsp + 0x58]
xorps xmm7, xmm7
movsd xmm2, qword [0x140130d88]
mov rax, rcx
sub rax, qword [rsp + 0x60]
xorps xmm0, xmm0
mulsd xmm8, xmm1
cvtsi2sd xmm0, rcx
cvtsi2sd xmm7, rax
movaps xmm6, xmm7
mulsd xmm7, xmm1
mulsd xmm6, xmm2
comisd xmm9, xmm7
divsd xmm6, xmm0
jbe 0x1400c3ad4
mov rcx, qword [rsp + 0x98]
xorps xmm7, xmm7
shr rcx, 0xa
test rcx, rcx
js 0x1400c3abc
cvtsi2sd xmm7, rcx
jmp 0x1400c3ad1
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2sd xmm7, rax
addsd xmm7, xmm7
movaps xmm6, xmm2
mov rdx, qword [rsp + 0x30]
xor ebp, ebp
mov rcx, qword [0x14018fa00]
xorps xmm3, xmm3
movaps xmm2, xmm8
mov qword [rsp + 0x20], rbp
call fcn.140065670
mov rdx, qword [rsp + 0x30]
xorps xmm3, xmm3
mov rcx, qword [0x14018f9d8]
movaps xmm2, xmm7
mov qword [rsp + 0x20], rbp
call fcn.140065670
movaps xmm9, xmmword [rsp + 0xc0]
mov rbp, qword [rsp + 0x120]
test rsi, rsi
je 0x1400c3b29
movsd qword [rsi], xmm7
movaps xmm7, xmmword [rsp + 0xe0]
mov rsi, qword [rsp + 0x108]
test rdi, rdi
je 0x1400c3b43
movsd qword [rdi], xmm8
movaps xmm8, xmmword [rsp + 0xd0]
movaps xmm0, xmm6
mov rdi, qword [rsp + 0x100]
test rbx, rbx
je 0x1400c3b6a
mov rax, qword [0x14018fa00]
mov rcx, qword [rax + 0x40]
mov qword [rbx], rcx
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.1400e17a0
movaps xmm6, xmmword [rsp + 0xf0]
add rsp, 0x110
pop rbx
ret
Function at 0x1400c4250
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
test ecx, ecx
jne 0x1400c43dd
mov rcx, qword [0x140194200]
test rcx, rcx
je 0x1400c4273
call fcn.1400e825c
mov eax, dword [0x140170720]
cmp dword [0x14017072c], eax
mov qword [0x140194200], 0
jne 0x1400c429c
mov rax, qword [0x1401941f8]
mov qword [0x140194200], rax
jmp 0x1400c42b9
mov rcx, qword [0x1401941f8]
test rcx, rcx
je 0x1400c42b3
call fcn.1400e825c
mov eax, dword [0x140170720]
mov dword [0x14017072c], eax
mov ecx, dword [0x140173250]
call fcn.1400e8270
cmp byte [0x14018f99e], 0
lea r9, [rsp + 0x30]
mov r8d, dword [0x140173250]
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
mov edi, 0x40
mov qword [0x1401941f8], rax
cmovne ecx, edi
mov rdx, rax
call sub.ntdll.dll_NtQuerySystemInformation
test eax, eax
je 0x1400c44b2
nop dword [rax + rax]
cmp eax, 0xc0000022
je 0x1400c43bb
cmp eax, 0xc000009a
je 0x1400c436c
mov rcx, qword [0x1401941f8]
call fcn.1400e825c
mov eax, dword [0x140173250]
add eax, eax
mov ecx, eax
mov dword [0x140173250], eax
call fcn.1400e8270
cmp byte [0x14018f99e], 0
lea r9, [rsp + 0x30]
mov r8d, dword [0x140173250]
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
cmovne ecx, edi
mov qword [0x1401941f8], rax
mov rdx, rax
call sub.ntdll.dll_NtQuerySystemInformation
test eax, eax
jne 0x1400c4300
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetDim
lea r8, [0x14011f590]
lea rdx, str.Insufficient_system_resources_to_get_handle_information.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov ebx, dword [0x140173250]
xor edx, edx
mov rcx, qword [0x1401941f8]
mov r8d, ebx
call fcn.1400e36c0
mov rcx, qword [0x1401941f8]
xor edx, edx
mov r8d, ebx
call fcn.1400e36c0
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov ebx, dword [0x140173250]
xor edx, edx
mov rcx, qword [0x1401941f8]
mov r8d, ebx
call fcn.1400e36c0
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [0x1401941f0]
test rcx, rcx
je 0x1400c43ee
call fcn.1400e825c
mov ecx, dword [0x140173250]
call fcn.1400e8270
cmp byte [0x14018f99e], 0
lea r9, [rsp + 0x30]
mov r8d, dword [0x140173250]
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
mov edi, 0x40
mov qword [0x1401941f0], rax
cmovne ecx, edi
mov rdx, rax
call sub.ntdll.dll_NtQuerySystemInformation
test eax, eax
je 0x1400c44b2
mov rcx, qword [0x1401941f0]
cmp eax, 0xc0000022
je 0x1400c44a4
call fcn.1400e825c
mov eax, dword [0x140173250]
add eax, eax
mov ecx, eax
mov dword [0x140173250], eax
call fcn.1400e8270
mov ebx, dword [0x140173250]
xor edx, edx
mov r8d, ebx
mov qword [0x1401941f0], rax
mov rcx, rax
call fcn.1400e36c0
cmp byte [0x14018f99e], 0
lea r9, [rsp + 0x30]
mov rdx, qword [0x1401941f0]
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
cmovne ecx, edi
mov r8d, ebx
call sub.ntdll.dll_NtQuerySystemInformation
test eax, eax
jne 0x1400c4430
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov r8d, dword [0x140173250]
xor edx, edx
call fcn.1400e36c0
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400c4c80
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x830
mov rax, qword [0x1401737a8]
xor rax, rsp
mov qword [rsp + 0x820], rax
cmp byte [0x14018df9f], 0
mov ebx, edx
je 0x1400c4cef
mov r8, rcx
lea rdx, str.Are_you_sure_you_want_to_kill__s_
lea rcx, [rsp + 0x20]
call fcn.140055830
mov rcx, qword [0x14018ec78]
lea r8, [0x14011f590]
mov r9d, gethostbyaddr
lea rdx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 2
jne 0x1400c4cef
mov rcx, qword [0x14018ec80]
call qword [sym.imp.USER32.dll_SetFocus]
xor al, al
jmp 0x1400c4d64
xor edx, edx
mov r8d, ebx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
jne 0x1400c4d1c
mov rdx, qword [0x14018ec78]
lea rcx, str.Error_opening_process
call fcn.1400c56e0
xor al, al
jmp 0x1400c4d64
mov edx, 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x1400c4d4e
mov rdx, qword [0x14018ec78]
lea rcx, str.Error_terminating_process
call fcn.1400c56e0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x1400c4d64
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0xfa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov al, 1
mov rcx, qword [rsp + 0x820]
xor rcx, rsp
call fcn.1400e17a0
add rsp, 0x830
pop rbx
ret
Function at 0x1400c4d80
Capabilities:
Terminate process

Disassembly:
push rsi
sub rsp, 0xa60
mov rax, qword [0x1401737a8]
xor rax, rsp
mov qword [rsp + 0xa50], rax
cmp byte [0x14018df9f], 0
mov esi, edx
je 0x1400c4df6
mov r8, rcx
lea rdx, str.Are_you_sure_you_want_to_kill__s_and_its_descendants_
lea rcx, [rsp + 0x250]
call fcn.140055830
mov rcx, qword [0x14018ec78]
lea r8, [0x14011f590]
mov r9d, gethostbyaddr
lea rdx, [rsp + 0x250]
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 2
jne 0x1400c4df6
mov rcx, qword [0x14018ec80]
call qword [sym.imp.USER32.dll_SetFocus]
jmp 0x1400c4f87
mov qword [rsp + 0xa78], rbx
mov rbx, qword [0x140189c38]
test rbx, rbx
je 0x1400c4f74
mov qword [rsp + 0xa80], rbp
xor ebp, ebp
mov qword [rsp + 0xa88], rdi
mov rax, rbx
cmp dword [rax + 0x24], esi
je 0x1400c4e39
mov rax, qword [rax + 0x138]
test rax, rax
jne 0x1400c4e23
jmp 0x1400c4f54
mov r8d, dword [rbx + 0x24]
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
jne 0x1400c4f0a
mov r8, qword [rbx + 0x118]
lea rdx, str.Error_opening__s
lea rcx, [rsp + 0x250]
call fcn.140055830
mov rdi, qword [0x14018ec78]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1400c4ed4
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], ebp
mov r9d, 0x400
mov qword [rsp + 0x20], rcx
mov r8d, eax
mov ecx, 0x1100
xor edx, edx
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
mov r9, qword [rsp + 0x40]
lea r8, [rsp + 0x250]
lea rdx, str._s:__s
lea rcx, [rsp + 0x50]
call fcn.140074260
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1400c4eed
lea r8, [rsp + 0x250]
lea rdx, [0x1401378e8]
lea rcx, [rsp + 0x50]
call fcn.140074260
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetDim
lea r8, [0x14011f590]
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x1400c4f54
mov edx, 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x1400c4f4b
mov r8, qword [rbx + 0x118]
lea rdx, str.Error_terminating__s
lea rcx, [rsp + 0x250]
call fcn.140055830
mov rdx, qword [0x14018ec78]
lea rcx, [rsp + 0x250]
call fcn.1400c56e0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rbx + 0x6b0]
test rbx, rbx
jne 0x1400c4e20
mov rdi, qword [rsp + 0xa88]
mov rbp, qword [rsp + 0xa80]
mov ecx, 0xfa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rbx, qword [rsp + 0xa78]
mov rcx, qword [rsp + 0xa50]
xor rcx, rsp
call fcn.1400e17a0
add rsp, 0xa60
pop rsi
ret
Function at 0x1400c5430
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x250]
sub rsp, 0x350
mov rax, qword [0x1401737a8]
xor rax, rsp
mov qword [rbp + 0x240], rax
xor r15d, r15d
lea r14, [0x14019d610]
mov esi, r15d
lea r13, [0x14019d410]
movzx ebx, r15w
mov r12d, 0x104
nop word [rax + rax]
movzx edi, bx
lea rdx, str._c:_
lea rcx, [rbp - 0x80]
lea r8d, [rdi + 0x41]
call fcn.1400a50d0
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
je 0x1400c54c9
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
jne 0x1400c5661
lea r8d, [rdi + 0x41]
lea rdx, str.DosDevices_c:
lea rcx, [rbp + 0x1c0]
call fcn.1400a5310
mov rax, qword [0x140189688]
mov dword [rsp + gethostbyaddr], 0x30
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x48], 0x40
test rax, rax
jne 0x1400c5525
lea rcx, [0x14011ece0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.RtlInitUnicodeString
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140189688], rax
lea rdx, [rbp + 0x1c0]
lea rcx, [rsp + 0x60]
call rax
lea rax, [rsp + 0x60]
xorps xmm0, xmm0
lea r8, [rsp + 0x30]
mov qword [rsp + 0x40], rax
mov edx, 0x20001
lea rcx, [rsp + 0x20]
movdqu xmmword [rsp + 0x50], xmm0
call sub.ntdll.dll_NtOpenSymbolicLinkObject
test eax, eax
jne 0x1400c5661
mov rcx, qword [rsp + 0x20]
lea rax, [rbp - 0x50]
lea r8, [rsp + 0x28]
mov qword [rbp - 0x58], rax
lea rdx, [rbp - 0x60]
mov word [rbp - 0x5e], r12w
call sub.ntdll.dll_NtQuerySymbolicLinkObject
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x140189688]
mov rdi, qword [rbp - 0x58]
mov dword [rsp + gethostbyaddr], 0x30
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x48], 0x40
test rax, rax
jne 0x1400c55d6
lea rcx, [0x14011ece0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.RtlInitUnicodeString
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140189688], rax
mov rdx, rdi
lea rcx, [rsp + 0x70]
call rax
lea rax, [rsp + 0x70]
xorps xmm0, xmm0
lea r8, [rsp + 0x30]
mov qword [rsp + 0x40], rax
mov edx, 0x20001
lea rcx, [rsp + 0x20]
movdqu xmmword [rsp + 0x50], xmm0
call sub.ntdll.dll_NtOpenSymbolicLinkObject
test eax, eax
jne 0x1400c5636
mov rcx, qword [rsp + 0x20]
lea rax, [rbp - 0x50]
lea r8, [rsp + 0x28]
mov qword [rbp - 0x58], rax
lea rdx, [rbp - 0x60]
mov word [rbp - 0x5e], r12w
call sub.ntdll.dll_NtQuerySymbolicLinkObject
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8, qword [rbp - 0x58]
mov edx, 0x100
movsxd rax, esi
imul rcx, rax, 0x202
add rcx, r13
call fcn.1400e86e4
lea eax, [rbx + 0x41]
inc esi
mov word [r14], ax
add r14, 0x202
inc bx
cmp bx, 0x1a
jb 0x1400c5490
movsxd rax, esi
imul rcx, rax, 0x202
mov word [rcx + r13], r15w
mov rcx, qword [rbp + 0x240]
xor rcx, rsp
call fcn.1400e17a0
lea r11, [rsp + 0x350]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x1400ccaf0
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x20
movzx r15d, cl
mov ebp, 0x3e8
xor r12d, r12d
mov ecx, ebp
mov r14, r8
mov dword [r8], r12d
mov esi, edx
call fcn.1400e8270
lea rcx, [rsp + 0x60]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea r9, [rsp + 0x50]
mov r8d, ebp
mov rdx, rdi
lea ecx, [r12 + 5]
call sub.ntdll.dll_NtQuerySystemInformation
test eax, eax
je 0x1400ccb86
mov rcx, rdi
call fcn.1400e825c
mov eax, dword [rsp + 0x50]
lea ecx, [rbp + 0x2710]
cmp ecx, eax
cmova eax, ecx
mov ecx, eax
mov ebx, eax
call fcn.1400e8270
lea r9, [rsp + 0x50]
mov r8d, ebx
mov rdx, rax
mov ecx, 5
mov rdi, rax
mov ebp, ebx
call sub.ntdll.dll_NtQuerySystemInformation
test eax, eax
jne 0x1400ccb48
mov ebx, 0x57
mov rax, rdi
cmp dword [rdi + 0x50], esi
je 0x1400ccba1
mov ecx, dword [rax]
test ecx, ecx
je 0x1400ccbf6
add rax, rcx
cmp dword [rax + 0x50], esi
jne 0x1400ccb93
mov r8d, dword [rax + 0x50]
xor edx, edx
mov ecx, 0x800
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
jne 0x1400ccbc4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x1400ccbe3
mov rcx, rsi
test r15b, r15b
je 0x1400ccbd3
call sub.ntdll.dll_NtSuspendProcess
jmp 0x1400ccbd8
call sub.ntdll.dll_NtResumeProcess
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x1400ccbef
cmp ebx, 0x770
jne 0x1400ccbf6
mov dword [r14], 1
test r15b, r15b
je 0x1400ccc06
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rdi
call fcn.1400e825c
cmp dword [r14], r12d
mov rbp, qword [rsp + 0x68]
cmovne ebx, r12d
mov eax, ebx
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1400ccc30
Capabilities:
Link many functions at runtime
Set environment variable

Disassembly:
push rbx
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
lea rdx, str.SymInitialize
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.EnumerateLoadedModulesW64
mov rcx, rbx
mov qword [0x1401940a8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymRegisterCallback64
mov rcx, rbx
mov qword [0x140194110], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymGetModuleInfoW64
mov rcx, rbx
mov qword [0x140194118], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymCleanup
mov rcx, rbx
mov qword [0x140194108], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymFromAddrW
mov rcx, rbx
mov qword [0x1401940d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymGetSymFromName
mov rcx, rbx
mov qword [0x1401940c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MiniDumpWriteDump
mov rcx, rbx
mov qword [0x1401940c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymSetOptions
mov rcx, rbx
mov qword [0x1401a08f8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymGetOptions
mov rcx, rbx
mov qword [0x1401940d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymLoadModuleExW
mov rcx, rbx
mov qword [0x1401940b0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401940f8], rax
test rax, rax
je 0x1400ccd4a
lea rcx, [0x1400bcb60]
jmp 0x1400ccd71
lea rdx, str.SymLoadModule64
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ecx, ecx
lea rdx, [0x1400bcb90]
test rax, rax
mov qword [0x1401940f0], rax
cmovne rcx, rdx
mov qword [0x1401940e8], rcx
lea rdx, str.SymUnloadModule64
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ImageNtHeader
mov rcx, rbx
mov qword [0x140194100], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.StackWalk64
mov rcx, rbx
mov qword [0x140194130], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymGetModuleBase64
mov rcx, rbx
mov qword [0x1401940e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymFunctionTableAccess64
mov rcx, rbx
mov qword [0x140194128], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp byte [0x14018e1cc], 0
mov qword [0x1401940b8], rax
jne 0x1400cce0a
mov rax, qword [0x1401940a8]
test rax, rax
je 0x1400cce28
cmp word [0x14018e1ce], 0
je 0x1400cce25
lea rdx, [0x14018e1ce]
lea rcx, str._NT_SYMBOL_PATH
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rax, qword [0x1401940a8]
test rax, rax
setne al
add rsp, 0x20
pop rbx
ret
Function at 0x1400d2d80
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call
Terminate thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
xor dil, dil
mov rbx, rdx
cmp qword [0x1401940a8], 0
mov rsi, rcx
je 0x1400d2f01
mov ecx, 0x10037
mov qword [rsp + 0x50], rbp
call qword [0x1401940d8]
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1400d2dd4
mov rax, qword [0x1401940a8]
xor edx, edx
lea r8d, [rdx + 1]
call rax
test eax, eax
setne dil
cmp qword [rbx + 0x18], 0
jne 0x1400d2e49
mov ecx, 0x1000
mov dword [rsp + 0x60], 0x1000
call fcn.1400e8270
mov r8d, dword [rsp + 0x60]
lea r9, [rsp + 0x60]
mov rdx, rax
mov qword [rbx + 0x18], rax
mov ecx, ntohs
call sub.ntdll.dll_NtQuerySystemInformation
test eax, eax
je 0x1400d2e49
nop dword [rax]
mov rcx, qword [rbx + 0x18]
call fcn.1400e825c
mov eax, dword [rsp + 0x60]
add eax, eax
mov ecx, eax
mov dword [rsp + 0x60], eax
call fcn.1400e8270
mov r8d, dword [rsp + 0x60]
lea r9, [rsp + 0x60]
mov rdx, rax
mov qword [rbx + 0x18], rax
mov ecx, ntohs
call sub.ntdll.dll_NtQuerySystemInformation
test eax, eax
jne 0x1400d2e10
xor ebp, ebp
mov qword [rbx + 0x20], rbp
test byte [rsi + 0xf8], 0x10
jne 0x1400d2ee8
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlCreateQueryDebugBuffer]
mov qword [rbx + 0x20], rax
test rax, rax
je 0x1400d2ee8
mov ecx, dword [rsi + 0x24]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x30], rcx
lea r8, [0x1400a8c00]
xor ecx, ecx
mov qword [rsp + 0x28], rbp
xor edx, edx
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x20], ebp
call fcn.1400f7ce8
mov edx, 0xfa0
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1400d2ebe
lea edx, [rbp + 1]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rdx, [rsp + 0x60]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [rsp + 0x60], ebp
je 0x1400d2edf
mov rcx, qword [rbx + 0x20]
call sub.ntdll.dll_RtlDestroyQueryDebugBuffer
mov qword [rbx + 0x20], rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbp, qword [rsp + 0x50]
movzx eax, dil
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
mov rbx, qword [rsp + 0x58]
movzx eax, dil
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x1400d5190
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x1400d5341
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x40], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.1400551e0
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x1400d5306
mov qword [rsp + 0x38], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax]
nop dword [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r9d, byte [rax + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rcx, qword [rcx]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x12]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x13]
imul r9, rdi
xor r9, rdx
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x1400d5280
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x1400d52f5
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x1400d52bd
mov r10, qword [rdx]
cmp r10, rax
je 0x1400d52b7
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x1400d52f5
cmp r9, rdx
je 0x1400d52d1
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x1400d531b
cmp r9, rdx
jne 0x1400d52c2
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x1400d5230
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x1400d52f5
lea rcx, str.invalid_hash_bucket_count
call fcn.1400df1dc
int3