joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140243c0c
Capabilities:
Copy file

Disassembly:
mov bh, 0xf8
or edi, 0x80072200
mov eax, edi
pop r12
and al, 0x60
mov rbp, qword [rsp - 0x48]
add r12, 0x40
pop r14
pop rdi
pop rsi
ret
mov r11, rsp
mov qword [rcx + 0x6b89d6fe], r13
je 0x140243c61
mov dword [rbx + 0x18], esi
push rdi
push r14
mov r11b, 0x20
jae 0x140243be7
xor edi, edi
lea rax, [r11 + 0x20]
imul ecx, dword [rbx + 0x438949f0], 0xfa8b4c09
mov qword [r11 - 0x30], rdi
mov rbp, rcx
jns 0x140243cb9
movsb byte [rdi], byte [rsi]
js 0x140243c84
lea ecx, [rdi + 2]
mov qword [r11 - 0x38], rdi
lea r8, [0x140333897]
mov rdx, r14
invalid
sub eax, 0xfd30b4d
add al, 0x44
add byte [rax], al
cmp eax, 0xffffffe3
fiadd dword [rdi]
xor eax, eax
jmp 0x140d83d3b
invalid
clc
jrcxz 0x140243c3e
invalid
js 0x140243cce
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
jb 0x140243c57
xor edx, esp
loop 0x140243c5b
enter 0xffffffffffffff48, 0x15
invalid
je 0x140243d21
or bh, byte [rdi - 0x7ff8c6f2]
cmp al, 0x82
add byte [rax], al
add byte [rax - 0x73], cl
and al, 0xac
mov r9d, 2
fisttp dword [rcx + 0x4c302444]
lea eax, [0x1412e3880]
and al, 0x30
lea r8, [0x1412e3880]
xlatb
je 0x140243cf6
sub byte [rcx + 0x6b], cl
invalid
repne insd dword [rdi], dx
add byte [rax], al
test r14, r14
je 0x140243d1f
call qword [sym.imp.api_ms_win_core_file_l2_1_2.dll_CopyFileW]
punpckhbw mm6, qword [rax]
add byte [rax], al
invalid
ja 0x140243caa
xchg ebp, eax
and byte [rdi], al
add byte [rax], al
test ebx, ebx
je 0x140243da4
jg 0x140243d30
mov edi, ebx
jmp 0x140243cc5
movzx edi, bx
bswap edi
add byte [rcx + 0x48c78b80], spl
mov ecx, dword [rdi + 0x24]
mov al, reloc.OLEAUT32.dll_SafeArrayGetElement
mov ebp, dword [rbx + rdi + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
jmp 0x14282a704
adc eax, 0xb4b89
invalid

Function at 0x140270964
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + rdx*2 - 0x40], rbx
pcmpeqb mm4, qword [rax + rdx]
push rdi
sub rsp, 0x20
mov rdi, rcx
test rcx, rcx
jne 0x140270986
mov ecx, 0xc0ca0051
clc
invalid
mov rsi, qword [rcx + 8]
mov bl, reloc.SHELL32.dll_DAD_DragLeave
je 0x1402709b5
xor cl, byte [rsi + 8]
mov rax, qword [rsi]
call qword [0x1222f9c88]
mov rbx, qword [rbp + 0x18ba10]
add byte [rax], al
mov rcx, rsi
call 0x1070a501c
mov rsi, rbx
test rbx, rbx
jne 0x14027098f
or dl, dil
or byte [rax], al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
iretq

Function at 0x1402a1d94
Capabilities:
Encode data using xor

Disassembly:
jmp qword [rax]
push rbx
sub rsp, 0x70
xor edx, edx
jg 0x1402a1d7e
clc
lea ecx, [rsp + 0x54]
lea r8d, [rdx - 0x2b]
call fcn.1400a39fc
int 0x8d
add eax, 0x6e642c
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x60], rax
mov ecx, 4
lea rax, [0x1408e1ea7]
mov dword [rsp + 0x34], reloc.dwmapi.dll_Ordinal_114
mov dword [rsp + 0x28], r8d
call qword [0x140935c40]
or al, 0x1f
add byte [rdx + 0x321f8d48], r13b
cmpsd dword [rsi], dword [rdi]
mov qword [rsp + 0x50], rax
xor ah, byte [rdi + 0x24448948]
push rax
call qword [0x14060f790]
sgdt [rax + rax + 0x15]
jrcxz 0x1402a1de6
jo 0x1402a1e59
ret
xor edx, edx
mov rcx, rsi
ret
Function at 0x140006a60
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x14000f970], rbx
je 0x140006ac7
cmp rax, rbx
jne 0x140006aba
mov edi, 1
mov esi, edi
jmp 0x140006acc
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x140006a9f
mov edi, 1
mov eax, dword [0x14000f978]
cmp eax, edi
jne 0x140006ae4
mov ebx, 0x1f
mov ecx, ebx
call sub.msvcrt.dll__amsg_exit
jmp 0x140006b5a
mov eax, dword [0x14000f978]
test eax, eax
jne 0x140006b4f
mov dword [0x14000f978], edi
lea r15, [0x140008a00]
lea rbx, [0x1400089e8]
mov qword [rsp + 0x30], rbx
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rbx, r15
jae 0x140006b41
test eax, eax
jne 0x140006b45
cmp qword [rbx], r14
je 0x140006b36
movabs r10, 0xd30527475e523070
mov rax, qword [rbx]
mov rcx, qword [0x140008958]
call rcx
mov dword [rsp + 0x24], eax
add rbx, 8
mov qword [rsp + 0x30], rbx
jmp 0x140006b0e
test eax, eax
je 0x140006b55
mov eax, 0xff
jmp 0x140006cbb
mov dword [0x14000d2a4], edi
mov ebx, 0x1f
mov eax, dword [0x14000f978]
cmp eax, edi
jne 0x140006b81
lea rdx, [0x1400089e0]
lea rcx, [0x140008970]
call sub.msvcrt.dll__initterm
mov dword [0x14000f978], 2
test esi, esi
jne 0x140006b8f
mov rax, r14
xchg qword [0x14000f970], rax
cmp qword [0x14000f980], r14
je 0x140006bcc
lea rcx, [0x14000f980]
call fcn.140006f00
test eax, eax
je 0x140006bcc
movabs r10, 0x99012e4578d92870
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x14000f980]
mov r9, qword [0x140008958]
call r9
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x140006be5
mov eax, 0xff
jmp 0x140006cbb
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
movzx eax, word [rcx]
cmp ax, 0x20
ja 0x140006c6c
test ax, ax
je 0x140006c00
test edx, edx
jne 0x140006c6c
sub ax, di
cmp ax, bx
ja 0x140006c16
add rcx, 2
mov qword [rsp + 0x28], rcx
movzx eax, word [rcx]
jmp 0x140006c00
test byte [rsp + 0x7c], dil
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140001304
mov dword [0x14000d2a0], eax
cmp dword [0x14000d2c0], r14d
jne 0x140006c55
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x14000d2a4], r14d
jne 0x140006c6a
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x14000d2a0]
jmp 0x140006cbb
cmp ax, 0x22
jne 0x140006c80
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x140006bee
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call fcn.1400b8000
add rsp, 0x28
jmp 0x140006a60
Function at 0x140011208
Capabilities:
Terminate process

Disassembly:
jmp 0x140015120
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140011285
Capabilities:
Parse pe header

Disassembly:
jmp 0x140012e30
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140012e50
xor al, al
jmp 0x140012ed1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140012e63
xor al, al
jmp 0x140012ed1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140012e8d
xor al, al
jmp 0x140012ed1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140012ea1
xor al, al
jmp 0x140012ed1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140012eb3
xor al, al
jmp 0x140012ed1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140012ecf
xor al, al
jmp 0x140012ed1
mov al, 1
add rsp, 0x38
ret
Function at 0x14000f040
Capabilities:
Print debug messages

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
push rbx
push rdi
sub rsp, 0x448
mov rax, qword [0x14002a010]
xor rax, rsp
mov qword [rsp + 0x430], rax
mov rbx, rcx
lea rdi, [r11 + 0x10]
call fcn.14000ee40
mov qword [rsp + 0x28], rdi
lea rdx, [rsp + 0x30]
mov r9, rbx
mov qword [rsp + 0x20], 0
mov r8d, 0x3fc
mov rcx, qword [rax]
or rcx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vswprintf]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rsp + 0x430]
xor rcx, rsp
call fcn.14001ef00
add rsp, 0x448
pop rdi
pop rbx
ret

Function at 0x14000f200
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x18], r8
push rdi
push r12
push r13
push r14
push r15
mov r14, qword [rsp + 0x50]
xor ebp, ebp
mov rax, qword [rsp + 0x58]
mov r13, r9
mov rbx, qword [rsp + 0x68]
mov r12, rdx
mov qword [r14], r8
mov qword [rbx], rax
mov rax, qword [r14]
cmp rax, r9
je 0x14000f394
mov r15, qword [rsp + 0x60]
lea r9d, [rbp + 1]
mov rdi, qword [rbx]
mov r11d, 0x2800
mov r8d, 0x3ff
mov r10d, 0x2400
cmp rdi, r15
je 0x14000f394
movzx edx, word [r12]
xor sil, sil
movzx ecx, word [rax]
cmp r9w, dx
jae 0x14000f29b
lea eax, [r10 + rcx]
cmp ax, r8w
ja 0x14000f3bb
mov eax, edx
sub ecx, 0xdc00
shl eax, 0xa
or eax, ecx
jmp 0x14000f2b2
mov eax, ecx
add cx, r11w
cmp cx, r8w
ja 0x14000f2b2
shl eax, 0xa
mov sil, 1
sub eax, 0x35f0000
cmp eax, 0x80
jae 0x14000f2c5
movzx r8d, al
mov r10d, ebp
mov r11d, ebp
jmp 0x14000f312
mov r8d, eax
cmp eax, 0x800
jae 0x14000f2df
shr r8d, 6
mov r10d, r9d
or r8b, 0xc0
mov r11d, r9d
jmp 0x14000f312
cmp eax, 0x10000
jae 0x14000f2f9
shr r8d, 0xc
mov r10d, 2
or r8b, 0xe0
mov r11d, r10d
jmp 0x14000f312
shr r8d, 0x12
mov r10d, 3
movzx r11d, sil
or r8b, 0xf0
xor r11d, 1
add r11d, r11d
lea r9d, [r11 + 1]
mov rdx, r15
sub rdx, rdi
mov ecx, r9d
cmp rdx, rcx
jl 0x14000f394
add qword [r14], 2
test sil, sil
jne 0x14000f333
cmp r10d, 3
jae 0x14000f33f
mov rcx, qword [rbx]
mov r9d, r11d
mov byte [rcx], r8b
inc qword [rbx]
test r9d, r9d
je 0x14000f371
lea r8d, [r10 + r10*2]
add r8d, r8d
nop dword [rax + rax]
sub r8d, 6
mov edx, eax
mov ecx, r8d
dec r9d
shr edx, cl
mov rcx, qword [rbx]
and dl, 0x3f
or dl, 0x80
mov byte [rcx], dl
inc qword [rbx]
test r9d, r9d
jg 0x14000f350
shr eax, 0xa
mov r9d, 1
test sil, sil
mov ecx, r9d
cmovne ecx, eax
mov word [r12], cx
mov rax, qword [r14]
cmp rax, r13
jne 0x14000f24f
mov rax, qword [rsp + 0x40]
cmp rax, qword [r14]
sete bpl
mov eax, ebp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov eax, 2
jmp 0x14000f3a2
Function at 0x1400108d0
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0xd0
mov rax, qword [0x14002a010]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rdi, rdx
mov rbp, rcx
mov edx, 0x2930
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14001092a
mov edx, 0x2930
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualLock]
nop
mov edx, pe_nt_image_headers64
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x14001095d
mov edx, pe_nt_image_headers64
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualLock]
nop
test rsi, rsi
je 0x140010a1b
test rbx, rbx
je 0x140010a1b
mov r9d, 2
lea r8d, [r9 + 0x3e]
lea rdx, [rsp + 0x80]
xor ecx, ecx
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
mov rax, qword [rbp + 8]
mov rdx, qword [rax + 0x28]
movsxd r8, dword [rdx]
add rdx, 4
mov qword [rsp + 0x28], rbx
lea r9, [rsp + 0x80]
call fcn.1400152e0
mov r8, rsi
mov edx, dword [rdi + 0x52]
mov rcx, rbx
call fcn.14001a550
mov qword [rsp + 0x20], rsi
xor r9d, r9d
mov r8d, 0x800
mov rdx, rdi
mov rcx, rdi
call qword [rsi + 0x2920]
movaps xmm0, xmmword [rsp + 0x80]
movups xmmword [rdi], xmm0
movaps xmm1, xmmword [rsp + 0x90]
movups xmmword [rdi + 0x10], xmm1
movaps xmm0, xmmword [rsp + 0xa0]
movups xmmword [rdi + 0x20], xmm0
movaps xmm1, xmmword [rsp + 0xb0]
movups xmmword [rdi + 0x30], xmm1
mov rcx, qword [rbp + 0x10]
mov rax, qword [rcx]
xor r9d, r9d
mov r8d, 0x800
mov rdx, rdi
call qword [rax + 0x30]
xor ebp, ebp
jmp 0x140010a2c
lea rcx, str.Malloc_Failed_n
call fcn.14000f040
mov ebp, 0xd
test rbx, rbx
je 0x140010a85
mov r8d, 0x30
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
cmp rax, 0x30
jne 0x140010a73
cmp qword [rsp + 0x50], rbx
jne 0x140010a73
cmp qword [rsp + 0x58], rbx
jne 0x140010a73
mov rdi, rbx
xor eax, eax
mov rcx, qword [rsp + 0x68]
rep stosb byte [rdi], al
mov rdx, qword [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualUnlock]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
nop
test rsi, rsi
je 0x140010add
mov r8d, 0x30
lea rdx, [rsp + 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
cmp rax, 0x30
jne 0x140010acc
cmp qword [rsp + 0x50], rsi
jne 0x140010acc
cmp qword [rsp + 0x58], rsi
jne 0x140010acc
mov rdi, rsi
xor eax, eax
mov rcx, qword [rsp + 0x68]
rep stosb byte [rdi], al
mov rdx, qword [rsp + 0x68]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualUnlock]
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, ebp
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14001ef00
mov rbx, qword [rsp + 0x100]
add rsp, 0xd0
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001a820
Capabilities:
Encrypt data using aes via x86 extensions
Reference processor manufacturer constants

Disassembly:
push rbx
sub rsp, 0x10
xor ecx, ecx
mov r8d, 1
mov eax, r8d
cpuid
mov dword [rsp + 0xc], edx
bt ecx, 0x19
jb 0x14001a8a0
test ecx, ecx
jns 0x14001a8a9
xor ecx, ecx
mov eax, 0x40000000
cpuid
cmp ebx, 0x7263694d
jne 0x14001a8a9
cmp ecx, 0x666f736f
jne 0x14001a8a9
cmp edx, 0x76482074
jne 0x14001a8a9
movdqa xmm0, xmmword [0x140024f00]
movabs rcx, 0x5f77774d4b7b7b54
aesenc xmm0, xmmword [0x140024f10]
movq rax, xmm0
movdqa xmmword [rsp], xmm0
cmp rax, rcx
jne 0x14001a89d
movabs rax, 0x63636367427c7c58
cmp qword [rsp + 8], rax
je 0x14001a8a0
xor r8d, r8d
mov eax, r8d
add rsp, 0x10
pop rbx
ret
xor eax, eax
add rsp, 0x10
pop rbx
ret

Function at 0x14001aae0
Capabilities:
Get file size

Disassembly:
sub rsp, 0x38
mov rax, qword [0x14002a010]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rax, qword [rcx + 8]
mov rcx, qword [rax + 0x28]
cmp rcx, 0xffffffffffffffff
jne 0x14001ab15
xor al, al
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14001ef00
add rsp, 0x38
ret
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14001ef00
add rsp, 0x38
ret
Function at 0x14001ae10
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x14002a010]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
mov rax, r9
mov rcx, qword [rcx + 8]
mov esi, r8d
mov rdi, rdx
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rcx + 0x28]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov rcx, qword [rbx + 8]
lea r9, [rsp + 0x30]
mov r8d, esi
mov qword [rsp + 0x20], 0
mov rdx, rdi
mov rcx, qword [rcx + 0x28]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
setne al
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14001ef00
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x14001ae90
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x14002a010]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
mov rax, r9
mov rcx, qword [rcx + 8]
mov esi, r8d
mov rdi, rdx
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rcx + 0x28]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov rcx, qword [rbx + 8]
lea r9, [rsp + 0x30]
mov r8d, esi
mov qword [rsp + 0x20], 0
mov rdx, rdi
mov rcx, qword [rcx + 0x28]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
setne al
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14001ef00
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x14001df10
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x14002a010]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, rcx
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x4c], 2
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdx, qword [rbx + 8]
lea r8, [rsp + 0x30]
mov qword [rdx + 0x30], rax
mov edx, 0x20
mov rcx, qword [rbx + 8]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14001e0b5
lea r8, [rsp + 0x44]
xor ecx, ecx
lea rdx, str.SeLockMemoryPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x14001e0b5
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x40]
xor eax, eax
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x14001e0b5
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14001e0b5
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntdll.dll_NtClose]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r8, qword [rbx + 8]
xor edx, edx
mov eax, dword [r8 + 8]
div dword [rsp + 0x54]
mov ecx, eax
mov qword [r8 + 0x38], rcx
test eax, eax
jne 0x14001dff7
mov eax, 7
jmp 0x14001e0ba
mov r8, qword [rbx + 8]
lea r9, [rsp + 0x38]
xor edx, edx
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x3000
movsxd rcx, dword [r8 + 8]
movsxd rax, dword [r8 + 0xc]
add rax, qword [r8]
div rcx
mov qword [r8 + 0x18], rax
xor r8d, r8d
mov rdx, qword [rbx + 8]
lea rcx, [r8 - 1]
mov rax, qword [rdx + 0x38]
imul rax, qword [rdx + 0x18]
add rdx, 0x40
shl rax, 3
mov qword [rsp + 0x38], rax
call qword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
mov rdx, qword [rbx + 8]
lea r9, [rsp + 0x38]
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x3000
mov rax, qword [rdx + 0x18]
add rdx, 0x28
lea rcx, [r8 - 1]
mov qword [rsp + 0x38], rax
call qword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
mov rdx, qword [rbx + 8]
lea r9, [rsp + 0x38]
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x402000
movsxd rax, dword [rdx + 8]
add rdx, 0x20
lea rcx, [r8 - 1]
mov qword [rsp + 0x38], rax
call qword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
xor eax, eax
jmp 0x14001e0ba
mov eax, 6
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14001ef00
add rsp, 0x90
pop rbx
ret
Function at 0x14001e0e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14002a010]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rax, qword [rcx + 8]
mov rbx, rcx
cmp rdx, qword [rax]
jbe 0x14001e247
mov qword [rax], rdx
lea r9, [rsp + 0x48]
mov r8, qword [rcx + 8]
xor edx, edx
mov qword [rsp + 0x78], rdi
xor edi, edi
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x3000
mov rax, qword [r8 + 0x18]
mov qword [rsp + 0x40], rax
mov rax, qword [r8 + 0x40]
mov qword [rsp + 0x30], rax
mov rax, qword [r8 + 0x28]
mov qword [rsp + 0x38], rax
movsxd rcx, dword [r8 + 8]
movsxd rax, dword [r8 + 0xc]
add rax, qword [r8]
div rcx
lea rcx, [rdi - 1]
mov qword [r8 + 0x18], rax
xor r8d, r8d
mov rax, qword [rbx + 8]
mov qword [rax + 0x40], rdi
mov rdx, qword [rbx + 8]
mov rax, qword [rdx + 0x38]
imul rax, qword [rdx + 0x18]
add rdx, 0x40
shl rax, 3
mov qword [rsp + 0x48], rax
call qword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
mov rax, qword [rbx + 8]
lea r9, [rsp + 0x48]
mov dword [rsp + 0x28], 4
lea rcx, [rdi - 1]
xor r8d, r8d
mov dword [rsp + 0x20], 0x3000
mov qword [rax + 0x28], rdi
mov rdx, qword [rbx + 8]
mov rax, qword [rdx + 0x18]
add rdx, 0x28
mov qword [rsp + 0x48], rax
call qword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
mov rcx, qword [rbx + 8]
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x30]
imul r8, qword [rcx + 0x38]
mov rcx, qword [rcx + 0x40]
shl r8, 3
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [rbx + 8]
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rcx + 0x28]
call sub.VCRUNTIME140.dll_memcpy
mov r9d, 0x8000
mov qword [rsp + 0x40], rdi
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x30]
lea rcx, [rdi - 1]
call qword [sym.imp.ntdll.dll_NtFreeVirtualMemory]
mov r9d, 0x8000
mov qword [rsp + 0x40], rdi
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x38]
lea rcx, [rdi - 1]
call qword [sym.imp.ntdll.dll_NtFreeVirtualMemory]
lea rcx, str.Physical_RAM_Disk_resized_n
call fcn.14000f040
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14001ef00
add rsp, 0x60
pop rbx
ret
Function at 0x14001e950
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x14002a010]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rax, qword [rcx + 8]
mov rbx, rcx
cmp rdx, qword [rax]
jbe 0x14001ea36
mov qword [rax], rdx
lea r9, [rsp + 0x40]
mov r8, qword [rcx + 8]
xor edx, edx
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x3000
mov rax, qword [r8 + 0x18]
mov qword [rsp + 0x38], rax
mov rax, qword [r8 + 0x20]
mov qword [rsp + 0x30], rax
movsxd rcx, dword [r8 + 8]
movsxd rax, dword [r8 + 0xc]
add rax, qword [r8]
div rcx
mov qword [r8 + 0x18], rax
xor r8d, r8d
mov rax, qword [rbx + 8]
lea rcx, [r8 - 1]
mov qword [rax + 0x20], 0
mov rdx, qword [rbx + 8]
mov rax, qword [rdx + 0x18]
add rdx, 0x20
shl rax, 3
mov qword [rsp + 0x40], rax
call qword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
mov r8, qword [rsp + 0x38]
mov rcx, qword [rbx + 8]
mov rdx, qword [rsp + 0x30]
lea r8, [r8*8]
mov rcx, qword [rcx + 0x20]
call sub.VCRUNTIME140.dll_memcpy
mov r9d, 0x8000
mov qword [rsp + 0x38], 0
lea r8, [rsp + 0x38]
mov rcx, 0xffffffffffffffff
lea rdx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_NtFreeVirtualMemory]
lea rcx, str.Virtual_RAM_Disk_resized_n
call fcn.14000f040
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14001ef00
add rsp, 0x50
pop rbx
ret