joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c9834
Capabilities:
Access peb ldr_data
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rax, qword gs:[0x30]
xor edi, edi
mov rsi, r8
mov rbp, rcx
mov r15d, edi
mov r9, qword [rax + 0x60]
mov r14, qword [r9 + 0x20]
mov r9, qword [r8 + 0x28]
mov rax, r9
test r9, r9
jne 0x1400c987d
mov r9d, edi
jmp 0x1400c9889
add r9, 2
cmp word [r9], di
jne 0x1400c9879
sub r9, rax
sar r9, 1
mov rax, qword [r8 + 0x30]
mov rcx, rax
test rax, rax
jne 0x1400c989e
mov rax, rdi
jmp 0x1400c98a9
add rax, 2
cmp word [rax], di
jne 0x1400c989a
sub rax, rcx
sar rax, 1
lea rcx, [rax + r9]
movzx eax, word [r14 + 0x38]
lea rbx, [rax + rcx*2]
test dl, dl
je 0x1400c99c5
mov rcx, rbp
call fcn.1400cb1ec
test eax, eax
jne 0x1400c98dc
mov ecx, 0x54f
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1400c9a6d
mov rax, qword gs:[0x30]
lea r8, [rbx + 0x40]
mov edx, 8
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbx, rax
test rax, rax
je 0x1400c9a62
movzx edx, word [r14 + 0x38]
mov rcx, rax
mov r8, qword [r14 + 0x40]
shr rdx, 1
mov r9, rdx
call fcn.1400cecd8
lea rdx, [0x14042d7a0]
call fcn.1400ced2c
mov rdx, qword [rsi + 0x28]
mov rcx, rbx
mov r14, rax
call fcn.1400ced2c
mov r8d, dword [rsi + 0x38]
mov rdx, rbx
mov rcx, qword [rbp + 0x10]
call fcn.1400c9ba8
test eax, eax
je 0x1400c99a4
mov word [r14], di
mov rcx, rbx
mov rdx, qword [rsi + 0x30]
call fcn.1400ced2c
mov r8d, dword [rsi + 0x3c]
mov rdx, rbx
mov rcx, qword [rbp + 0x10]
call fcn.1400c9ba8
test eax, eax
je 0x1400c99a4
mov eax, dword [rsi + 0x4c]
lea rcx, [rsi + 8]
mov r8d, dword [rsi + 0x48]
mov r9, rsi
mov rdx, qword [rsi + 0x40]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, rbx
call fcn.1400c96f4
mov r15d, eax
test eax, eax
jne 0x1400c99a4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, qword gs:[0x30]
mov r8, rbx
xor edx, edx
mov rcx, qword [rcx + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x1400c9a62
mov rax, qword gs:[0x30]
lea r8, [rbx + 0x40]
mov edx, 8
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbp, rax
test rax, rax
je 0x1400c9a62
movzx edx, word [r14 + 0x38]
mov rcx, rax
mov r8, qword [r14 + 0x40]
shr rdx, 1
mov r9, rdx
call fcn.1400cecd8
lea rdx, [0x14042d7a0]
call fcn.1400ced2c
mov rdx, qword [rsi + 0x28]
mov rcx, rbp
mov rbx, rax
call fcn.1400ced2c
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov word [rbx], di
mov rcx, rbp
mov rdx, qword [rsi + 0x30]
call fcn.1400ced2c
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rax, qword gs:[0x30]
mov r8, rbp
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov r15d, 1
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, r15d
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x1400c9a88
Capabilities:
Access pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x30
mov edi, r9d
mov r12, r8
mov r15d, edx
mov r14, rcx
xor ebx, ebx
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov rsi, rax
test rax, rax
je 0x1400c9b87
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], ebx
mov rcx, r14
call fcn.1400ceff4
mov rbp, rax
test rax, rax
je 0x1400c9b87
mov rdx, r12
mov rcx, rax
call fcn.1400cf184
test rax, rax
je 0x1400c9b76
sub eax, ebp
mov dword [rsi + 0x28], eax
test edi, edi
je 0x1400c9b08
mov eax, 0xdfff
and word [rsi + 0x16], ax
lea r8d, [r15 + 1]
mov r9, r14
shr r8d, 1
mov edx, ebx
je 0x1400c9b30
movzx eax, word [r9]
lea r9, [r9 + 2]
add edx, eax
mov ecx, edx
movzx edx, dx
shr ecx, 0x10
add edx, ecx
add r8d, 0xffffffff
jne 0x1400c9b16
mov edi, edx
mov rcx, r14
shr edi, 0x10
add di, dx
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov rcx, rax
test rax, rax
je 0x1400c9b65
movzx eax, word [rax + 0x58]
cmp di, ax
adc ax, bx
sub di, ax
movzx eax, word [rcx + 0x5a]
cmp di, ax
adc ax, bx
sub di, ax
jmp 0x1400c9b68
movzx edi, bx
movzx eax, di
mov ebx, 1
add eax, r15d
mov dword [rsi + 0x58], eax
xor edx, edx
mov r8d, 0x8000
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rbp, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
ret

Function at 0x1400c9c5c
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x440
mov rbx, rcx
mov qword [rsp + 0x20], r9
xor eax, eax
lea rdi, [rsp + 0x30]
mov esi, edx
mov r9, r8
mov ecx, 0x410
lea r8, [0x14042d7f8]
rep stosb byte [rdi], al
lea rcx, [rsp + 0x30]
mov edx, 0x208
call fcn.1400c7e14
cmp dword [rsp + 0x470], 0
je 0x1400c9cb6
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1400c9ccb
test rbx, rbx
je 0x1400c9ccb
mov r8d, esi
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.1400c9ba8
lea r11, [rsp + 0x440]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x1400c9ce0
Capabilities:
Read file via mapping

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x40
xor ebx, ebx
xor r9d, r9d
mov qword [rax - 0x18], rbx
xor r8d, r8d
mov dword [rax - 0x20], 0x80
mov edx, 0x80000000
mov dword [rax - 0x28], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400c9d6f
mov qword [rsp + 0x28], rbx
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], ebx
mov r8d, 0x1000002
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rsi, rax
test rax, rax
je 0x1400c9d66
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
lea edx, [rbx + 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rcx, rsi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x1400ca0d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
mov rbp, rsp
sub rsp, 0x30
and dword [rbp + 0x10], 0
lea rax, [rbp + 0x20]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp + 0x18], 8
lea rdx, str.HARDWARERESOURCEMAPSystem_ResourcesPhysical_Memory
mov rcx, 0xffffffff80000002
xor ebx, ebx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400ca19e
mov rcx, qword [rbp + 0x20]
lea rax, [rbp + 0x10]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x18]
and qword [rsp + 0x20], rbx
lea rdx, str..Translated
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400ca194
cmp dword [rbp + 0x18], 8
jne 0x1400ca194
mov rax, qword gs:[0x30]
lea edx, [rbx + 8]
mov r8d, dword [rbp + 0x10]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbx, rax
test rax, rax
je 0x1400ca194
mov rcx, qword [rbp + 0x20]
lea rax, [rbp + 0x10]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x18]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, str..Translated
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rbp
ret
Function at 0x1400ca888
Capabilities:
Disable driver code integrity
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x430
xor ebx, ebx
lea r14, str.g_CiEnabled
mov qword [rax + 0x10], rbx
lea rsi, str.ntoskrnl.exe
mov edx, 0x23f0
lea rax, str.g_CiOptions
cmp ecx, edx
cmovae r14, rax
lea rax, str.CI.dll
cmovae rsi, rax
call fcn.1400ce10c
test eax, eax
je 0x1400caa28
mov edx, 0x104
mov word [rsp + 0x20], bx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1400caa28
lea rax, [rsp + 0x20]
cmp word [rsp + 0x20], bx
je 0x1400ca90e
add rax, 2
cmp word [rax], bx
jne 0x1400ca905
lea rdx, [0x14042d7a0]
mov ecx, 0x5c
sub rdx, rax
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x1400ca91d
mov word [rax], bx
lea rax, [rsp + 0x20]
cmp word [rsp + 0x20], bx
je 0x1400ca945
add rax, 2
cmp word [rax], bx
jne 0x1400ca93c
movzx ecx, word [rsi]
test cx, cx
je 0x1400ca963
mov rdx, rsi
sub rdx, rax
mov word [rax], cx
add rax, 2
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x1400ca953
xor edx, edx
mov word [rax], bx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
test rax, rax
je 0x1400caa06
mov rdx, rsi
lea rcx, str.___Module___ws__loaded_for_symbols_lookup_r_n
call fcn.1400c7d58
call fcn.1400c9184
mov rdx, rdi
mov rcx, rsi
mov rbp, rax
call fcn.1400cdfb8
test eax, eax
je 0x1400ca9ea
lea rdx, [rsp + 0x458]
mov rcx, r14
call fcn.1400ce03c
test eax, eax
je 0x1400ca9e1
mov rbx, rbp
lea rdx, str.___Symbol_resolved_to_0x_llX_address_r_n
sub rbx, rdi
mov ecx, 2
add rbx, qword [rsp + 0x458]
mov r8, rbx
call fcn.1400c963c
jmp 0x1400ca9fb
lea rdx, str.____Unable_to_find_specified_symbol_r_n
jmp 0x1400ca9f1
lea rdx, str.____Unable_to_load_symbols_for_file_r_n
mov ecx, 1
call fcn.1400c963c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x1400caa23
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, rsi
lea rdx, str.____Could_not_load___ws___GetLastError__lu_r_n
mov r9d, eax
mov ecx, 1
call fcn.1400c963c
mov rax, rbx
jmp 0x1400caa2a
xor eax, eax
lea r11, [rsp + 0x430]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1400cb1ec
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [rcx + 0x40]
lea r8, [rbp + 0x20]
mov rbx, qword [rcx + 0x30]
mov r9, rcx
xor edi, edi
mov dword [rbp + 0x20], edi
mov rdx, qword [rax]
mov eax, dword [rdx + 0x18]
mov ecx, dword [rdx + 8]
mov rdx, qword [r9 + 0x10]
shr eax, 2
not al
and al, 1
mov byte [rsp + 0x20], al
call fcn.1400ced68
mov rsi, rax
test rax, rax
jne 0x1400cb298
cmp byte [0x14042e281], dil
movups xmm0, xmmword [0x14042e270]
movzx eax, word [0x14042e280]
mov word [rbp - 0x10], ax
movups xmmword [rbp - 0x20], xmm0
je 0x1400cb283
lea r8, [rbp - 0x20]
mov eax, 0x1f7047dd
mul edi
mov eax, edi
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul edx, eax, 0x39
mov al, dil
inc edi
sub al, dl
add al, 0x34
xor byte [r8], al
inc r8
cmp edi, 0x12
jl 0x1400cb257
lea rdx, [rbp - 0x20]
mov ecx, 1
call fcn.1400c963c
xor eax, eax
jmp 0x1400cb331
mov r8d, dword [rbp + 0x20]
lea rax, [rbp + 0x28]
mov rdx, rsi
mov qword [rsp + 0x28], rax
mov rcx, rbx
call fcn.1400cd480
mov rcx, qword gs:[0x30]
mov r8, rsi
xor edx, edx
mov rbx, rax
mov rcx, qword [rcx + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
cmp dword [rbp + 0x20], ebx
je 0x1400cb32c
movzx eax, word [0x14042e238]
lea r8, [rbp - 0x20]
movups xmm0, xmmword [0x14042e228]
mov word [rbp - 0x10], ax
mov al, byte [0x14042e23a]
mov byte [rbp - 0xe], al
movups xmmword [rbp - 0x20], xmm0
mov eax, 0x1f7047dd
mul edi
mov eax, edi
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, dil
inc edi
sub al, cl
add al, 0x34
xor byte [r8], al
inc r8
cmp edi, 0x13
jl 0x1400cb2f7
lea rdx, [rbp - 0x20]
jmp 0x1400cb287
mov eax, 1
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400cb344
Capabilities:
Delete file
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rax, qword [rcx + 0x40]
xor ebx, ebx
mov rdi, qword [rcx + 0x30]
mov rdx, qword [rax]
mov rsi, qword [rdx + 0x28]
call fcn.1400cb1ec
test eax, eax
je 0x1400cb409
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call fcn.1400c8dfc
test eax, eax
js 0x1400cb392
mov ebx, 1
jmp 0x1400cb407
movzx eax, word [0x14042e2c8]
lea rcx, [rsp + 0x30]
movups xmm0, xmmword [0x14042e2b8]
mov word [rsp + 0x40], ax
mov r9d, ebx
mov al, byte [0x14042e2ca]
mov byte [rsp + 0x42], al
movups xmmword [rsp + 0x30], xmm0
mov r8b, r9b
mov eax, 0x1f7047dd
mul r9d
mov eax, r9d
inc r9d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul edx, eax, 0x39
sub r8b, dl
add r8b, 0x34
xor byte [rcx], r8b
inc rcx
cmp r9d, 0x13
jl 0x1400cb3bc
lea rdx, [rsp + 0x30]
mov ecx, 1
call fcn.1400c963c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x1400cb490
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [rcx + 0x40]
xor edi, edi
mov rbx, rcx
mov qword [rsp + 0x50], rdi
mov rdx, qword [rax + 0x28]
test rdx, rdx
je 0x1400cb4b3
call rdx
mov rax, qword [rbx + 0x40]
lea r8, [rsp + 0x50]
mov edx, 0xc0140000
mov rcx, qword [rax]
mov rcx, qword [rcx + 0x30]
call fcn.1400c90a4
test eax, eax
jns 0x1400cb535
movzx eax, word [0x14042e338]
lea r8, [rsp + 0x20]
movups xmm0, xmmword [0x14042e328]
mov word [rsp + 0x30], ax
mov al, byte [0x14042e33a]
mov byte [rsp + 0x32], al
movups xmmword [rsp + 0x20], xmm0
mov eax, 0x1f7047dd
mul edi
mov eax, edi
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul edx, eax, 0x39
mov al, dil
inc edi
sub al, dl
add al, 0x34
xor byte [r8], al
inc r8
cmp edi, 0x13
jl 0x1400cb4f8
lea rdx, [rsp + 0x20]
mov ecx, 1
call fcn.1400c963c
jmp 0x1400cb550
mov rax, qword [rsp + 0x50]
mov qword [rbx + 0x28], rax
mov rax, qword [rbx + 0x40]
mov rdx, qword [rax + 0x30]
test rdx, rdx
je 0x1400cb550
mov rcx, rbx
call rdx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x1400cb7e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
xor edx, edx
lea rcx, str.api.dll
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
xor ebx, ebx
mov rdi, rax
test rax, rax
je 0x1400cb847
lea rdx, str.gProvTable
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14049ce68], rax
test rax, rax
jne 0x1400cb8a9
lea rdx, str.____Providers_table_not_found_r_n
lea ecx, [rbx + 1]
call fcn.1400c963c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edi, ebx
jmp 0x1400cb8a9
cmp byte [0x14042e351], bl
movups xmm0, xmmword [0x14042e340]
movzx eax, word [0x14042e350]
mov word [rsp + 0x30], ax
movups xmmword [rsp + 0x20], xmm0
je 0x1400cb897
lea r8, [rsp + 0x20]
mov eax, 0x1f7047dd
mul ebx
mov eax, ebx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, bl
inc ebx
sub al, cl
add al, 0x34
xor byte [r8], al
inc r8
cmp ebx, 0x12
jl 0x1400cb86c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rsp + 0x20]
call fcn.1400ca3e0
mov rbx, qword [rsp + 0x50]
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x1400cd7d4
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov dword [rsp + 8], ecx
push rbx
sub rsp, 0x20
mov r8d, 0x1000
mov edx, 8
mov dword [rsp + 0x30], r8d
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbx, rax
test rax, rax
je 0x1400cd8bf
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
mov rdx, rax
mov ecx, reloc.WS2_32.dll_inet_addr
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x1400cd887
mov rax, qword gs:[0x30]
mov r8, rbx
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rax, qword gs:[0x30]
mov edx, 8
mov r8d, dword [rsp + 0x30]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
mov rdx, rax
mov ecx, reloc.WS2_32.dll_inet_addr
mov rbx, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0x80000005
jne 0x1400cd895
cmp dword [rbx], 0
jne 0x1400cd899
jmp 0x1400cd8a3
test eax, eax
js 0x1400cd89e
mov rax, rbx
jmp 0x1400cd8c1
test rbx, rbx
je 0x1400cd8bf
mov rax, qword gs:[0x30]
mov r8, rbx
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x1400cd8c8
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], r9
push rdi
sub rsp, 0x20
and dword [rax + 0x20], 0
mov esi, ecx
mov rax, qword gs:[0x30]
mov edi, 0x1000
mov r8d, edi
mov edx, 8
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbx, rax
test rax, rax
je 0x1400cd9a0
jmp 0x1400cd95c
mov rax, qword gs:[0x30]
mov r8, rbx
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
add edi, edi
cmp edi, 0x20000000
ja 0x1400cd9a0
mov rax, qword gs:[0x30]
mov edx, 8
mov r8d, edi
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbx, rax
lea r9, [rsp + 0x48]
mov r8d, edi
mov rdx, rax
mov ecx, esi
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x1400cd914
test eax, eax
js 0x1400cd97f
mov rax, rbx
jmp 0x1400cd9a2
test rbx, rbx
je 0x1400cd9a0
mov rax, qword gs:[0x30]
mov r8, rbx
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400cda88
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
test rcx, rcx
je 0x1400cdaa8
mov byte [rcx], 0
test rdi, rdi
je 0x1400cdab0
mov byte [rdx], 0
test rbx, rbx
je 0x1400cdab9
mov byte [r8], 0
mov r8d, 8
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov dword [rsp + 0x38], r8d
lea ecx, [r8 + 0x5f]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
js 0x1400cdb20
mov eax, dword [rsp + 0x3c]
test al, 1
je 0x1400cdaee
bt eax, 0xa
jae 0x1400cdaee
mov cl, 1
jmp 0x1400cdaf0
xor cl, cl
test rsi, rsi
je 0x1400cdaf7
mov byte [rsi], cl
test rdi, rdi
je 0x1400cdb0d
cmp cl, 1
jne 0x1400cdb09
bt eax, 0xc
jae 0x1400cdb09
jmp 0x1400cdb0b
xor cl, cl
mov byte [rdi], cl
test rbx, rbx
je 0x1400cdb1c
test eax, 0x2000
seta cl
mov byte [rbx], cl
mov al, 1
jmp 0x1400cdb32
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
xor al, al
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x1400cdc74
Capabilities:
Enumerate files on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x20], rsi
mov qword [rax + 0x10], rdx
push rbp
push rdi
push r14
lea rbp, [rax - 0x5f]
sub rsp, 0x90
and qword [rbp - 9], 0
mov r14, r9
mov rsi, r8
mov rdx, rcx
test r8, r8
jne 0x1400cdcaf
mov eax, 0xc00000f2
jmp 0x1400cde0f
test rdx, rdx
je 0x1400cde0a
xor eax, eax
lea rdi, [rbp - 1]
lea ecx, [rax + 0x10]
rep stosb byte [rdi], al
lea rcx, [rbp - 1]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
and qword [rbp + 0x17], 0
lea rax, [rbp - 1]
xorps xmm0, xmm0
mov qword [rbp + 0x1f], rax
lea r8, [rbp + 0xf]
mov dword [rbp + 0xf], gethostbyaddr
mov edx, 1
mov dword [rbp + 0x27], 0x40
lea rcx, [rbp - 9]
movdqu xmmword [rbp + 0x2f], xmm0
call qword [sym.imp.ntdll.dll_NtOpenDirectoryObject]
test eax, eax
js 0x1400cde0f
and dword [rbp + 0x77], 0
jmp 0x1400cdd9b
mov rcx, qword gs:[0x30]
mov edx, 8
mov r8d, dword [rbp + 0x6f]
mov rcx, qword [rcx + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbx, rax
test rax, rax
je 0x1400cddf7
mov r8d, dword [rbp + 0x6f]
lea rax, [rbp + 0x6f]
mov rcx, qword [rbp - 9]
mov r9b, 1
mov qword [rsp + 0x30], rax
mov rdx, rbx
lea rax, [rbp + 0x77]
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x20], 0
call qword [sym.imp.ntdll.dll_NtQueryDirectoryObject]
mov edi, eax
test eax, eax
js 0x1400cdddb
mov rdx, r14
mov rcx, rbx
call rsi
mov rcx, qword gs:[0x30]
mov r8, rbx
xor edx, edx
mov edi, eax
mov rcx, qword [rcx + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
test edi, edi
jns 0x1400cddd7
mov rcx, qword [rbp - 9]
lea rax, [rbp + 0x6f]
and dword [rbp + 0x6f], 0
mov r9b, 1
mov qword [rsp + 0x30], rax
xor r8d, r8d
lea rax, [rbp + 0x77]
xor edx, edx
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x20], 0
call qword [sym.imp.ntdll.dll_NtQueryDirectoryObject]
mov edi, eax
cmp eax, 0xc0000023
je 0x1400cdd14
jmp 0x1400cddf7
xor edi, edi
jmp 0x1400cddf7
mov rax, qword gs:[0x30]
mov r8, rbx
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, qword [rbp - 9]
test rcx, rcx
je 0x1400cde06
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, edi
jmp 0x1400cde0f
mov eax, 0xc00000f0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1400ced68
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x20], r9d
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x50
xor edi, edi
mov rbx, r8
and qword [rbp + 0x30], rdi
mov rsi, rdx
mov rax, rcx
test r8, r8
je 0x1400ced93
and dword [r8], edi
xor ecx, ecx
and dword [rbp + 0x38], ecx
mov qword [rbp + 0x28], rcx
test rsi, rsi
je 0x1400cede9
and qword [rbp - 8], rcx
lea r8d, [rcx + 3]
mov rcx, rsi
mov qword [rbp - 0x18], 0xa
lea r9, [rbp - 0x20]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x18]
call qword [sym.imp.ntdll.dll_LdrFindResource_U]
test eax, eax
js 0x1400cede5
mov rdx, qword [rbp - 0x20]
lea r9, [rbp + 0x38]
lea r8, [rbp + 0x28]
mov rcx, rsi
call qword [sym.imp.ntdll.dll_LdrAccessResource]
test eax, eax
cmovns edi, dword [rbp + 0x38]
mov rcx, qword [rbp + 0x28]
test rcx, rcx
je 0x1400cee10
test edi, edi
je 0x1400cee10
mov al, byte [rbp + 0x40]
lea r8, [rbp + 0x30]
mov edx, edi
mov byte [rsp + 0x20], al
call fcn.1400cee20
test rbx, rbx
je 0x1400cee12
mov ecx, dword [rbp + 0x30]
mov dword [rbx], ecx
jmp 0x1400cee12
xor eax, eax
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret