joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d9c20
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x4d9e83
sub rsp, 0xb0
mov qword [rsp + 0xa8], rbp
lea rbp, [rsp + 0xa8]
test rax, rax
je 0x4d9e67
mov qword [rsp + 0xb8], rax
mov rbx, qword [rax + 8]
mov rdx, qword [rax]
mov rcx, qword [rax + 0x10]
test rbx, rbx
jne 0x4d9c6d
xor ebx, ebx
xor ecx, ecx
jmp 0x4d9c80
mov rax, rdx
call fcn.004cb920
mov rcx, rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x48], rbx
cmp qword [rax + 0x28], 0
je 0x4d9d9b
mov rcx, qword [rax + 0x18]
mov rax, rcx
nop
call fcn.00475ce0
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x58], rbx
mov rcx, qword [rsp + 0xb8]
mov r8, qword [rcx + 0x20]
mov r9, qword [rcx + 0x28]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x00523279]
mov esi, 1
lea rax, [rsp + 0x68]
mov rbx, qword [rsp + 0x88]
call fcn.0044e260
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call fcn.00402ea0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
nop
jl 0x4d9d5e
xor eax, eax
lea rbx, [0x00523290]
mov ecx, 1
mov rdi, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x60]
lea r8, [0x00523304]
mov r9d, 2
mov r10, qword [rsp + 0x98]
mov r11, qword [rsp + 0x58]
call fcn.0044e340
jmp 0x4d9d8b
xor eax, eax
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x60]
lea rdi, [0x00523284]
mov esi, 1
mov r8, qword [rsp + 0x98]
mov r9, qword [rsp + 0x58]
call fcn.0044e260
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov rax, qword [rax + 0x18]
nop
call fcn.00475ce0
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x50], rbx
mov rcx, qword [rsp + 0x88]
mov qword [rsp], rcx
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 8], rdx
mov byte [rsp + 0x10], 0x3a
call fcn.00402ea0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x4d9e2a
xor eax, eax
lea rbx, [0x00523290]
mov ecx, 1
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x48]
lea r8, [0x00523304]
mov r9d, 2
mov r10, qword [rsp + 0x90]
mov r11, qword [rsp + 0x50]
call fcn.0044e340
jmp 0x4d9e57
xor eax, eax
mov rbx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x00523284]
mov esi, 1
mov r8, qword [rsp + 0x90]
mov r9, qword [rsp + 0x50]
call fcn.0044e260
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
lea rax, [0x005236c1]
mov ebx, 5
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov qword [rsp + 8], rax
call fcn.00460d80
mov rax, qword [rsp + 8]
jmp fcn.004d9c20
Function at 0x140011600
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x10088
call fcn.140031c10
sub rsp, rax
mov rax, qword [0x140062ef8]
xor rax, rsp
mov qword [rsp + 0x10070], rax
xor eax, eax
mov rdx, rcx
lea rcx, [rsp + 0x20]
mov word [rsp + 0x70], ax
mov word [rsp + 0x20], ax
lea r8d, [rax + 0x28]
call fcn.14002cc90
mov r8d, 0x10000
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0xffff
ja 0x14001167d
lea rcx, [rsp + 0x70]
call fcn.14003a0b4
mov rcx, qword [rsp + 0x10070]
xor rcx, rsp
call fcn.140031c70
add rsp, 0x10088
ret
xor eax, eax
mov rcx, qword [rsp + 0x10070]
xor rcx, rsp
call fcn.140031c70
add rsp, 0x10088
ret

Function at 0x140011760
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140062ef8]
xor rax, rsp
mov qword [rsp + 0x70], rax
lea rcx, [0x140048378]
call fcn.140011600
xor edi, edi
mov qword [0x140064e38], rax
lea rdx, [0x140048378]
mov word [rsp + 0x20], di
lea rcx, [rsp + 0x20]
lea r8d, [rdi + 0x28]
call fcn.14002cc90
lea rdx, [0x140048380]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rcx, str.PYTHONHOME
call fcn.140011600
mov cl, 1
mov qword [0x140064e40], rax
call fcn.14002def0
lea r8d, [rdi + 0x28]
mov word [rsp + 0x20], di
lea rdx, str.PYTHONHOME
mov rbx, rax
lea rcx, [rsp + 0x20]
call fcn.14002cc90
mov rdx, rbx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov cl, 1
call fcn.14002def0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
mov rax, qword [sym.imp.python310.dll__Py_path_config]
mov dword [rax + 0x30], 1
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140031c70
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rdi
ret
Function at 0x140011b80
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x140062ef8]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbp, rdx
mov rsi, rcx
call fcn.14001f770
lea rdx, str.environ
mov rcx, rax
call qword [sym.imp.python310.dll_PyObject_GetAttrString]
mov rcx, rsi
mov rbx, rax
call qword [sym.imp.python310.dll_PyUnicode_FromString]
mov rdx, rsi
lea rcx, [rsp + 0x20]
mov rdi, rax
xor eax, eax
mov word [rsp + 0x20], ax
lea r8d, [rax + 0x28]
call fcn.14002cc90
lea rcx, [rsp + 0x20]
test rbp, rbp
je 0x140011c41
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rdx, 0xffffffffffffffff
mov rcx, rbp
call sub.python310.dll_PyUnicode_FromWideChar
mov r8, rax
mov rdx, rdi
mov rcx, rbx
mov rsi, rax
call qword [sym.imp.python310.dll_PyObject_SetItem]
test eax, eax
je 0x140011c2f
mov ecx, 1
call qword [sym.imp.python310.dll_PyErr_PrintEx]
mov ecx, 1
call qword [sym.imp.python310.dll_Py_Exit]
int3
sub qword [rsi], 1
jne 0x140011c5e
mov rax, qword [rsi + 8]
mov rcx, rsi
call qword [rax + 0x30]
jmp 0x140011c5e
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.python310.dll_PyObject_DelItem]
test eax, eax
je 0x140011c5e
call fcn.140011230
sub qword [rdi], 1
jne 0x140011c6e
mov rax, qword [rdi + 8]
mov rcx, rdi
call qword [rax + 0x30]
sub qword [rbx], 1
jne 0x140011c7e
mov rax, qword [rbx + 8]
mov rcx, rbx
call qword [rax + 0x30]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140031c70
mov rbx, qword [rsp + 0xb0]
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret
Function at 0x14002cd40
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r8, rcx
mov eax, 0xffffffff
test edx, edx
je 0x14002ce04
mov r9d, edx
nop dword [rax]
nop word [rax + rax]
movzx edx, byte [r8]
lea r8, [r8 + 1]
xor eax, edx
mov edx, eax
and dl, 1
neg dl
sbb ecx, ecx
shr eax, 1
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
and al, 1
neg al
sbb edx, edx
shr ecx, 1
and edx, 0xedb88320
xor edx, ecx
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0xedb88320
xor ecx, edx
mov eax, ecx
and al, 1
neg al
sbb edx, edx
shr ecx, 1
and edx, 0xedb88320
xor edx, ecx
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0xedb88320
xor ecx, edx
mov eax, ecx
and al, 1
neg al
sbb edx, edx
shr ecx, 1
and edx, 0xedb88320
xor edx, ecx
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0xedb88320
xor ecx, edx
mov eax, ecx
and al, 1
neg al
sbb eax, eax
shr ecx, 1
and eax, 0xedb88320
xor eax, ecx
sub r9, 1
jne 0x14002cd60
not eax
ret
Function at 0x14003265c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400326a6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400326a6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400326a6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400326a6
cmp dword [rcx + 0x84], 0xe
jbe 0x1400326a6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400326a8
xor al, al
add rsp, 0x28
ret

Function at 0x140039980
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400397ac
Function at 0x140003aa0
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3c8], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3d0], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor edi, edi
xor ebx, ebx
xor r12d, r12d
cmp r8, 0x201
jae 0x140003b30
jmp 0x140003b1f
jae 0x140003bf0
cmp r8, 0x201
jae 0x140003b30
mov esi, 0x200
lea r13, [rbp - 0x58]
mov r15, r8
jmp 0x140003b88
sub r8, r12
sub rbx, r12
cmp rbx, r8
jae 0x140003b5f
lea rcx, [rbp + 0x3c8]
mov rdx, r12
call fcn.14001a5c0
mov rax, qword [rbp + 0x3c8]
mov qword [rbp + 0x3e8], rax
mov rdi, qword [rbp + 0x3d0]
mov eax, 0xffffffff
cmp rdi, rax
mov r12d, 0xffffffff
cmovb r12, rdi
mov qword [rbp + 0x3d8], r12
mov rbx, rdi
mov rsi, r12
mov r13, qword [rbp + 0x3e8]
mov r15, r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, r15d
mov rdx, r13
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r14d, eax
test eax, eax
jne 0x140003bb1
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140003c58
mov r8d, r14d
cmp r15, r8
jne 0x140003b10
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140003c7b
add r15, r15
mov eax, 0xffffffff
cmp r15, rax
cmovae r15, rax
mov r8, r15
cmp r8, 0x201
jb 0x140003b1f
jmp 0x140003b30
cmp rsi, r8
jb 0x140003c95
lea rcx, [rbp + 0x3a8]
mov rdx, r13
call fcn.140005ff0
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3e0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test rdi, rdi
je 0x140003c41
add rdi, rdi
mov r8d, 2
mov rcx, qword [rbp + 0x3e8]
mov rdx, rdi
call fcn.140001220
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3e0]
mov qword [rsi], rax
mov byte [rsi + 0x18], 2
test rdi, rdi
jne 0x140003c29
jmp 0x140003c41
lea rcx, str.internal_error:_entered_unreachable_code_rustc_79e9716c980570bfd1f666e3b16ac583f0168962library_alloc_src_vecmod.rs
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.14001b200
jmp 0x140003caa
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, rsi
mov r8, rax
call fcn.14001b650
ud2
Function at 0x14000ae60
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rsp + 0xe0]
movups xmm0, xmmword [0x14001ded8]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
test rcx, rcx
je 0x14000aea4
mov rdx, qword [rsp + 0xe8]
mov qword [rsp + 0x80], rdx
test rcx, rcx
mov qword [rsp + 0x78], rcx
lea rdx, [rsp + 0x80]
cmove rdx, rcx
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x14000af0a
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x14000af41
test eax, eax
js 0x14000af1b
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x14000af34
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0xa8
pop rdi
pop rsi
ret
mov byte [rsp + 0x5c], 0
mov dword [rsp + 0x58], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.140005ca0
mov rcx, rax
call fcn.140001bb0
mov ecx, 7
int 0x29
ud2
Function at 0x140018500
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test r8, r8
je 0x14001857a
mov rax, rdx
mov rdx, qword [rsp + 0x70]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x140018570
cmp r11, r10
ja 0x140018613
cmp r10, rdx
ja 0x140018627
add r11, r9
xor ebx, ebx
nop dword [rax]
cmp rdi, rbx
je 0x140018572
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x140018550
jmp 0x1400185e7
ja 0x14001857a
mov r11, r10
cmp rax, r8
jne 0x140018522
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x1400185eb
mov r8, qword [rsp + 0x78]
add rdx, r8
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x1400185c0
mov r8, r10
sub ecx, r9d
jns 0x1400185de
jmp 0x1400185ed
cmp r10, rdx
je 0x1400185f9
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x1400185ed
xor al, 1
cmp r8, rdx
jne 0x1400185a0
jmp 0x1400185ed
xor eax, eax
jmp 0x1400185ed
mov al, 1
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, str.called__Option::unwrap____on_a__None__valuefrom_str_radix_int:_must_lie_in_the_range___2__36_____found
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.14001b200
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.14001b6d0
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.14001b650
ud2

Function at 0x14001a028
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001a072
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001a072
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001a072
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001a072
cmp dword [rcx + 0x84], 0xe
jbe 0x14001a072
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14001a074
xor al, al
add rsp, 0x28
ret
Function at 0x140005abc
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x150]
sub rsp, 0x250
mov rax, qword [0x140015078]
xor rax, rsp
mov qword [rbp + 0x140], rax
and qword [rdx], 0
mov r12, rdx
mov r8, rcx
mov edi, 0x104
mov edx, edi
lea rcx, [rsp + 0x30]
xor r15d, r15d
xor r14d, r14d
call fcn.140001270
lea r8, [0x140010e88]
mov edx, edi
lea rcx, [rsp + 0x30]
call fcn.14000429c
lea r8, [rsp + 0x30]
xor edx, edx
mov ecx, 0x1f0003
call qword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
jne 0x140005b6d
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 2
je 0x140005c65
mov rcx, qword [rbp + 0x178]
lea edx, [rdi - 0x3b]
call fcn.140005928
mov esi, eax
jmp 0x140005c4b
and dword [rsp + 0x24], r14d
lea rdx, [rsp + 0x24]
and dword [rsp + 0x20], r14d
mov rcx, rbx
call fcn.140005cc8
mov esi, eax
test eax, eax
jns 0x140005bab
mov rcx, qword [rbp + 0x178]
mov r9d, eax
mov edx, 0xcf
call fcn.1400058ec
mov rcx, rbx
call fcn.140005a34
jmp 0x140005c4b
lea r8, [0x140010e90]
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.14000429c
lea r8, [rsp + 0x30]
xor edx, edx
mov ecx, 0x1f0003
call qword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
jne 0x140005bf4
mov rcx, qword [rbp + 0x178]
mov edx, 0xd5
call fcn.140005928
mov esi, eax
jmp 0x140005b9e
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.140005cc8
mov esi, eax
test eax, eax
jns 0x140005c28
mov rcx, qword [rbp + 0x178]
mov r9d, eax
mov edx, 0xd7
call fcn.1400058ec
mov rcx, rdi
call fcn.140005a34
jmp 0x140005b9e
mov rcx, rdi
call fcn.140005a34
movsxd rax, dword [rsp + 0x24]
mov rcx, rbx
movsxd r14, dword [rsp + 0x20]
shl r14, 0x1f
or r14, rax
call fcn.140005a34
xor esi, esi
test esi, esi
jns 0x140005c65
mov rcx, qword [rbp + 0x178]
mov r9d, esi
mov edx, 0x62
call fcn.1400058ec
jmp 0x140005c6a
mov r15, r14
xor esi, esi
test esi, esi
jns 0x140005c86
mov rcx, qword [rbp + 0x178]
mov r9d, esi
mov edx, 0x6b
call fcn.1400058ec
mov eax, esi
jmp 0x140005c93
mov rax, r15
shl rax, 2
mov qword [r12], rax
xor eax, eax
mov rcx, qword [rbp + 0x140]
xor rcx, rsp
call fcn.14000a1a0
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x140009c4c
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x60
lea rax, str.Threads
mov rsi, rcx
mov qword [r11 - 0x18], rax
lea r9, str.Proc.Name
lea rax, str.Handles
mov qword [r11 - 0x20], rax
lea r8, str.Process_ID
lea rax, str.Commit
mov qword [r11 - 0x28], rax
lea rdx, str._10s_20s_10s_10s_10s_10s_10s_10s_10s_r_n
lea rax, str.Pagefile
mov qword [r11 - 0x30], rax
lea rax, str.NonPgdPl
mov qword [r11 - 0x38], rax
lea rax, str.PagedPool
mov qword [r11 - 0x40], rax
lea rax, str.Wrkng.Set
mov qword [r11 - 0x48], rax
call qword [sym.imp.msvcrt.dll_fwprintf]
nop dword [rax + rax]
xor ebp, ebp
mov ebx, 0x10000
mov r8d, 0x1000
mov edx, ebx
xor ecx, ecx
lea r9d, [rbp + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
jne 0x140009d12
lea rcx, str.VirtualAlloc_Error__r_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
jmp 0x140009dd2
xor r9d, r9d
mov r8d, ebx
mov rdx, rdi
lea ecx, [r9 + 5]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
nop dword [rax + rax]
test eax, eax
jne 0x140009da5
mov ebx, ebp
lea rdx, str._10p_20ws_10Iu_10Iu_10Iu_10Iu_10Iu_10u_10u_r_n
add rbx, rdi
mov rcx, rsi
mov eax, dword [rbx + 4]
mov r9, qword [rbx + 0x40]
mov r8d, dword [rbx + 0x50]
add ebp, dword [rbx]
mov dword [rsp + 0x50], eax
mov eax, dword [rbx + 0x60]
mov dword [rsp + 0x48], eax
mov rax, qword [rbx + 0xc8]
mov qword [rsp + 0x40], rax
mov rax, qword [rbx + 0xb8]
mov qword [rsp + 0x38], rax
mov rax, qword [rbx + 0xb0]
mov qword [rsp + 0x30], rax
mov rax, qword [rbx + 0xa0]
mov qword [rsp + 0x28], rax
mov rax, qword [rbx + 0x90]
mov qword [rsp + 0x20], rax
call qword [sym.imp.msvcrt.dll_fwprintf]
nop dword [rax + rax]
cmp dword [rbx], 0
jne 0x140009d2f
jmp 0x140009dbb
lea rdx, str.NtQuerySystemInformation_call_failed__r_n
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_fwprintf]
nop dword [rax + rax]
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
nop dword [rax + rax]
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140009f90
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r15
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x1400158a0], rbx
je 0x140009fdc
cmp rax, rbx
jne 0x140009fcf
mov ebx, 1
mov esi, ebx
jmp 0x140009fe1
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140009fb4
mov ebx, 1
mov eax, dword [0x1400158a8]
cmp eax, ebx
jne 0x140009ff7
mov ecx, 0x1f
call sub.msvcrt.dll__amsg_exit
jmp 0x14000a05c
mov eax, dword [0x1400158a8]
test eax, eax
jne 0x14000a056
mov dword [0x1400158a8], ebx
lea r15, [0x14000b6b8]
lea rdi, [0x14000b6a0]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
cmp rdi, r15
jae 0x14000a048
test eax, eax
jne 0x14000a04c
cmp qword [rdi], 0
je 0x14000a03d
mov rax, qword [rdi]
mov rcx, qword [0x14000b650]
call rcx
mov dword [rsp + 0x20], eax
add rdi, 8
mov qword [rsp + 0x28], rdi
jmp 0x14000a01e
test eax, eax
je 0x14000a05c
mov eax, 0xff
jmp 0x14000a138
mov dword [0x1400150b4], ebx
mov eax, dword [0x1400158a8]
cmp eax, ebx
jne 0x14000a083
lea rdx, [0x14000b698]
lea rcx, [0x14000b658]
call sub.msvcrt.dll__initterm
mov dword [0x1400158a8], 2
test esi, esi
jne 0x14000a090
xor eax, eax
xchg qword [0x1400158a0], rax
cmp qword [0x1400158c0], 0
je 0x14000a0c4
lea rcx, [0x1400158c0]
call fcn.14000a740
test eax, eax
je 0x14000a0c4
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x1400158c0]
mov r9, qword [0x14000b650]
call r9
mov r8, qword [0x1400150c8]
mov rdx, qword [0x1400150c0]
mov ecx, dword [0x1400150b8]
call fcn.140007088
mov dword [0x1400150b0], eax
cmp dword [0x1400150d0], 0
jne 0x14000a0f4
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x1400150b4], 0
jne 0x14000a109
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x1400150b0]
jmp 0x14000a138
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r15
ret
sub rsp, 0x28
call fcn.140170000
add rsp, 0x28
jmp 0x140009f90

Function at 0x14000a62c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14000a678
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14000a670
cmp dword [rcx + 0x3c], edx
jl 0x14000a670
cmp dword [rcx + 0x3c], 0x10000000
jae 0x14000a670
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x14000a678
mov rax, rdx
add rsp, 0x18
ret
Function at 0x1400a73c0
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x24]
mov qword [0x1400cb850], rax
cmp rax, 0x10
jae 0x1400a73e5
call fcn.1400a7050
mov edx, 0x10
lea rcx, [0x1400cb858]
call fcn.1400a6f40
xor eax, eax
add rsp, 0x58
ret
Function at 0x1400a7400
Capabilities:
Encode data using xor
Encrypt data using salsa20 or chacha

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x18
test r9, r9
jne 0x1400a7433
mov ebp, 0x61707865
mov r14d, 0x3320646e
mov r15d, 0x79622d32
mov r12d, 0x6b206574
jmp 0x1400a7442
mov ebp, dword [r9]
mov r14d, dword [r9 + 4]
mov r15d, dword [r9 + 8]
mov r12d, dword [r9 + 0xc]
mov eax, dword [r8 + 4]
mov ecx, dword [r8 + 8]
mov r10d, dword [r8]
mov r13d, dword [r8 + 0x10]
mov r9d, dword [r8 + 0x18]
mov r11d, dword [rdx]
mov ebx, dword [rdx + 4]
mov edi, dword [rdx + 8]
mov esi, dword [rdx + 0xc]
mov dword [rsp], eax
mov eax, dword [r8 + 0xc]
mov dword [rsp + 0x68], ecx
mov ecx, dword [r8 + 0x14]
mov dword [rsp + 0x78], eax
mov eax, dword [r8 + 0x1c]
mov r8d, dword [rsp + 0x68]
mov dword [rsp + 0x70], eax
mov qword [rsp + 8], 0xa
nop word [rax + rax]
add r14d, dword [rsp]
add ebp, r10d
add r12d, dword [rsp + 0x78]
xor r11d, ebp
xor esi, r12d
rol r11d, 0x10
add r13d, r11d
rol esi, 0x10
xor ebx, r14d
add r15d, r8d
xor edi, r15d
rol ebx, 0x10
add ecx, ebx
rol edi, 0x10
add r9d, edi
mov eax, r13d
xor eax, r10d
rol eax, 0xc
add ebp, eax
xor r11d, ebp
rol r11d, 8
add r13d, r11d
mov r10d, r13d
xor r10d, eax
mov eax, ecx
xor eax, dword [rsp]
rol eax, 0xc
add r14d, eax
rol r10d, 7
xor ebx, r14d
rol ebx, 8
add ecx, ebx
mov edx, ecx
xor edx, eax
mov eax, r9d
xor eax, r8d
rol edx, 7
rol eax, 0xc
add ebp, edx
add r15d, eax
xor edi, r15d
rol edi, 8
add r9d, edi
mov dword [rsp + 0x68], r9d
mov r8d, r9d
mov r9d, dword [rsp + 0x70]
xor r8d, eax
add r9d, esi
rol r8d, 7
mov eax, r9d
add r14d, r8d
xor eax, dword [rsp + 0x78]
xor r11d, r14d
rol eax, 0xc
add r12d, eax
rol r11d, 0x10
xor esi, r12d
rol esi, 8
add r9d, esi
xor esi, ebp
rol esi, 0x10
mov dword [rsp + 0x70], r9d
xor r9d, eax
mov eax, dword [rsp + 0x68]
add eax, esi
rol r9d, 7
mov dword [rsp + 0x68], eax
xor eax, edx
mov edx, dword [rsp + 0x68]
rol eax, 0xc
add ebp, eax
xor esi, ebp
rol esi, 8
add edx, esi
mov dword [rsp + 0x68], edx
xor edx, eax
rol edx, 7
mov dword [rsp], edx
mov edx, dword [rsp + 0x70]
add edx, r11d
mov eax, edx
xor eax, r8d
add r12d, r10d
rol eax, 0xc
xor edi, r12d
add r14d, eax
rol edi, 0x10
add ecx, edi
add r15d, r9d
xor ebx, r15d
xor r11d, r14d
rol ebx, 0x10
add r13d, ebx
rol r11d, 8
add edx, r11d
mov r8d, edx
mov dword [rsp + 0x70], edx
xor r8d, eax
mov eax, r13d
xor eax, r9d
rol r8d, 7
mov r9d, dword [rsp + 0x68]
rol eax, 0xc
add r15d, eax
xor ebx, r15d
rol ebx, 8
add r13d, ebx
mov edx, r13d
xor edx, eax
mov eax, ecx
xor eax, r10d
rol edx, 7
rol eax, 0xc
add r12d, eax
mov dword [rsp + 0x78], edx
xor edi, r12d
rol edi, 8
add ecx, edi
mov r10d, ecx
xor r10d, eax
rol r10d, 7
sub qword [rsp + 8], 1
jne 0x1400a7490
mov rcx, qword [rsp + 0x60]
xor eax, eax
mov dword [rcx], ebp
mov dword [rcx + 4], r14d
mov dword [rcx + 8], r15d
mov dword [rcx + 0xc], r12d
mov dword [rcx + 0x10], r11d
mov dword [rcx + 0x14], ebx
mov dword [rcx + 0x18], edi
mov dword [rcx + 0x1c], esi
add rsp, 0x18
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret