joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14012ecc0
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0xb8
lea rbp, [rsp + 0xf0]
xor eax, eax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x50], rax
mov qword [rbp + 0x10], rcx
mov rsi, rdx
mov edi, r8d
mov rbx, r9
mov r15, qword [rbp + 0x30]
mov r14, qword [rbp + 0x50]
xor edx, edx
mov dword [rbp - 0x40], edx
lea rdx, [rbp - 0x40]
cmp dword [rcx], ecx
call fcn.1400eaa20
mov rcx, qword [rbp + 0x10]
mov rdx, qword [rcx + 8]
test r15, r15
jne 0x14012ed1b
xor eax, eax
jmp 0x14012ed1f
lea rax, [r15 + 0x10]
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x50], r14
mov r8d, edi
mov r9, rbx
mov edi, dword [rbp + 0x38]
mov rbx, qword [rbp + 0x40]
mov r15d, dword [rbp + 0x48]
mov r12d, dword [rbp + 0x58]
mov dword [rsp + 0x48], r12d
mov rcx, rdx
mov qword [rbp - 0x5c], rcx
mov rdx, rsi
mov qword [rbp - 0x64], rdx
mov dword [rbp - 0x54], r8d
mov qword [rbp - 0x6c], r9
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x40], r14
lea rcx, [rbp - 0x98]
call fcn.140004070
mov rcx, qword [rbp - 0x5c]
mov rdx, qword [rbp - 0x64]
mov r8d, dword [rbp - 0x54]
mov r9, qword [rbp - 0x6c]
call sub.bcrypt.dll_BCryptDecrypt
mov esi, eax
lea rcx, [rbp - 0x98]
call fcn.1400040c0
nop
xor ecx, ecx
mov qword [rbp - 0x50], rcx
xor ecx, ecx
mov qword [rbp - 0x48], rcx
cmp byte [rbp - 0x40], 0
je 0x14012edbc
mov rcx, qword [rbp + 0x10]
xor edx, edx
call fcn.1400eaa90
mov eax, esi
add rsp, 0xb8
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x1401308a0
Capabilities:
Generate random numbers via winapi

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0xa0]
mov r8d, edx
mov dword [rbp - 0x3c], r8d
mov rdx, rcx
mov qword [rbp - 0x48], rdx
xor ecx, ecx
mov qword [rbp - 0x50], rcx
mov r9d, 2
mov dword [rbp - 0x40], r9d
lea rcx, [rbp - 0x78]
call fcn.140004070
mov r8d, dword [rbp - 0x3c]
mov rdx, qword [rbp - 0x48]
mov rcx, qword [rbp - 0x50]
mov r9d, dword [rbp - 0x40]
call sub.bcrypt.dll_BCryptGenRandom
mov esi, eax
lea rcx, [rbp - 0x78]
call fcn.1400040c0
mov ecx, esi
test ecx, ecx
jne 0x140130916
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
or ecx, 0x1000000
call fcn.14012fec0
mov rcx, rax
call fcn.140004b10
int3
Function at 0x1401326d0
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0xb0]
mov rsi, rcx
mov dword [rbp - 0x40], 0x41
lea rdi, [rbp - 0x44]
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
xor edx, edx
mov qword [rsp + 0x20], rdx
lea rdx, [rbp - 0x40]
mov qword [rbp - 0x50], rdx
mov rcx, rsi
mov qword [rbp - 0x58], rcx
mov r9, rdi
mov qword [rbp - 0x60], r9
xor r8d, r8d
mov dword [rbp - 0x48], r8d
lea rcx, [rbp - 0x88]
call fcn.140004070
mov rdx, qword [rbp - 0x50]
mov rcx, qword [rbp - 0x58]
mov r9, qword [rbp - 0x60]
mov r8d, dword [rbp - 0x48]
call sub.KERNEL32.dll_WriteFile
mov esi, eax
lea rcx, [rbp - 0x88]
call fcn.1400040c0
call sub.KERNEL32.dll_GetLastError
mov edi, eax
call fcn.140002bd7
mov dword [rax + 8], edi
xor eax, eax
test esi, esi
setne al
movzx eax, al
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x1401328b0
Capabilities:
Read file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0xc0]
xor eax, eax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x50], rax
mov rdi, rcx
mov rsi, r9
mov rbx, qword [rdx]
mov r14d, dword [rdx + 8]
test r14d, r14d
jne 0x1401328f2
xor ecx, ecx
mov dword [rsi], ecx
xor eax, eax
jmp 0x140132a38
mov qword [rbp - 0x40], rbx
cmp byte [rbp + 0x30], 0
je 0x140132987
mov qword [rbp - 0x50], rsi
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
xor ecx, ecx
mov qword [rsp + 0x20], rcx
mov rcx, rdi
mov qword [rbp - 0x5c], rcx
mov rdx, rbx
mov qword [rbp - 0x64], rdx
mov r8d, r14d
mov dword [rbp - 0x54], r8d
mov r9, rsi
mov qword [rbp - 0x6c], r9
lea rcx, [rbp - 0x98]
call fcn.140004070
mov rcx, qword [rbp - 0x5c]
mov rdx, qword [rbp - 0x64]
mov r8d, dword [rbp - 0x54]
mov r9, qword [rbp - 0x6c]
call sub.KERNEL32.dll_ReadFile
mov r14d, eax
lea rcx, [rbp - 0x98]
call fcn.1400040c0
call sub.KERNEL32.dll_GetLastError
mov edi, eax
xor eax, eax
mov qword [rbp - 0x50], rax
call fcn.140002bd7
mov dword [rax + 8], edi
xor ecx, ecx
mov qword [rbp - 0x50], rcx
xor esi, esi
test r14d, r14d
setne sil
jmp 0x140132a19
mov qword [rbp + 0x28], rsi
mov r15d, r14d
shr r15d, 0x1f
add r14d, r15d
sar r14d, 1
lea r15, [rbp - 0x44]
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
xor ecx, ecx
mov qword [rsp + 0x20], rcx
mov rcx, rdi
mov qword [rbp - 0x6c], rcx
mov rdx, rbx
mov qword [rbp - 0x64], rdx
mov r8d, r14d
mov dword [rbp - 0x54], r8d
mov r9, r15
mov qword [rbp - 0x5c], r9
lea rcx, [rbp - 0x98]
call fcn.140004070
mov rcx, qword [rbp - 0x6c]
mov rdx, qword [rbp - 0x64]
mov r8d, dword [rbp - 0x54]
mov r9, qword [rbp - 0x5c]
call sub.KERNEL32.dll_ReadConsoleW
mov esi, eax
lea rcx, [rbp - 0x98]
call fcn.1400040c0
call sub.KERNEL32.dll_GetLastError
mov edi, eax
test esi, esi
setne sil
movzx esi, sil
call fcn.140002bd7
mov dword [rax + 8], edi
mov edx, dword [rbp - 0x44]
add edx, edx
mov rdi, qword [rbp + 0x28]
mov dword [rdi], edx
xor edx, edx
mov qword [rbp - 0x40], rdx
test esi, esi
je 0x140132a27
xor eax, eax
jmp 0x140132a38
mov eax, dword [rax + 8]
cmp eax, 0xe8
je 0x140132a36
cmp eax, 0x6d
jne 0x140132a38
xor eax, eax
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x140132a50
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0xc0]
xor eax, eax
mov qword [rbp - 0x40], rax
mov rsi, rcx
mov rdi, qword [rdx]
mov ebx, dword [rdx + 8]
test ebx, ebx
jne 0x140132a85
xor eax, eax
jmp 0x140132ba8
mov qword [rbp - 0x40], rdi
test r8b, r8b
je 0x140132b07
lea r14, [rbp - 0x44]
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
xor ecx, ecx
mov qword [rsp + 0x20], rcx
mov rcx, rsi
mov qword [rbp - 0x54], rcx
mov rdx, rdi
mov qword [rbp - 0x5c], rdx
mov r8d, ebx
mov dword [rbp - 0x4c], r8d
mov r9, r14
mov qword [rbp - 0x64], r9
lea rcx, [rbp - 0x90]
call fcn.140004070
mov rcx, qword [rbp - 0x54]
mov rdx, qword [rbp - 0x5c]
mov r8d, dword [rbp - 0x4c]
mov r9, qword [rbp - 0x64]
call sub.KERNEL32.dll_WriteFile
mov ebx, eax
lea rcx, [rbp - 0x90]
call fcn.1400040c0
call sub.KERNEL32.dll_GetLastError
mov esi, eax
call fcn.140002bd7
mov dword [rax + 8], esi
xor esi, esi
test ebx, ebx
setne sil
jmp 0x140132b89
mov r14d, ebx
shr r14d, 0x1f
add ebx, r14d
sar ebx, 1
lea r14, [rbp - 0x48]
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
xor ecx, ecx
mov qword [rsp + 0x20], rcx
mov rcx, rsi
mov qword [rbp - 0x64], rcx
mov rdx, rdi
mov qword [rbp - 0x5c], rdx
mov r8d, ebx
mov dword [rbp - 0x4c], r8d
mov r9, r14
mov qword [rbp - 0x54], r9
lea rcx, [rbp - 0x90]
call fcn.140004070
mov rcx, qword [rbp - 0x64]
mov rdx, qword [rbp - 0x5c]
mov r8d, dword [rbp - 0x4c]
mov r9, qword [rbp - 0x54]
call sub.KERNEL32.dll_WriteConsoleW
mov esi, eax
lea rcx, [rbp - 0x90]
call fcn.1400040c0
call sub.KERNEL32.dll_GetLastError
mov edi, eax
test esi, esi
setne sil
movzx esi, sil
call fcn.140002bd7
mov dword [rax + 8], edi
xor edx, edx
mov qword [rbp - 0x40], rdx
test esi, esi
je 0x140132b97
xor eax, eax
jmp 0x140132ba8
mov eax, dword [rax + 8]
cmp eax, 0xe8
je 0x140132ba6
cmp eax, 0x6d
jne 0x140132ba8
xor eax, eax
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x14015c6b0
Capabilities:
Hash data using murmur3

Disassembly:
push r14
push rdi
push rsi
push rbp
push rbx
sub rsp, 0x20
mov esi, ecx
cmp edx, 0xffffffff
jne 0x14015c6cb
mov edi, 0xd5313557
jmp 0x14015c77b
mov ecx, edx
call fcn.14015c5b0
mov rdi, rax
test rdi, rdi
je 0x14015c798
mov ebx, dword [rdi + 8]
test ebx, ebx
je 0x14015c798
lea edx, [rbx + 0x14]
lea rcx, [0x140212f80]
call fcn.140003cc0
mov rbp, rax
mov r14d, dword [rbp + 8]
cmp r14d, 0x12
jl 0x14015c800
lea rcx, [rbp + 0xc]
lea rdx, [0x1402cd3f8]
add rdx, 0xc
mov r8d, 0x24
call fcn.14007c750
lea r8d, [r14 - 0x12]
cmp ebx, r8d
jg 0x14015c81f
lea rcx, [rbp + 0x30]
lea rdx, [rdi + 0xc]
mov r8d, ebx
add r8, r8
call fcn.14007c750
add ebx, 0x12
sub r14d, ebx
cmp r14d, 2
jl 0x14015c83e
movsxd rcx, ebx
lea rcx, [rbp + rcx*2 + 0xc]
lea rdx, [0x1402cfcb8]
add rdx, 0xc
mov r8d, 4
call fcn.14007c750
mov rcx, rbp
call fcn.14015c540
mov edi, eax
mov eax, edi
rol eax, 0xd
add eax, edi
mov edi, eax
xor edi, esi
mov eax, edi
rol eax, 0xf
add eax, edi
add rsp, 0x20
pop rbx
pop rbp
pop rsi
pop rdi
pop r14
ret
lea rcx, [0x140212f80]
mov edx, 0x14
call fcn.140003cc0
mov rbx, rax
mov edi, dword [rbx + 8]
cmp edi, 0x12
jl 0x14015c85d
lea rcx, [rbx + 0xc]
lea rdx, [0x1402cd3f8]
add rdx, 0xc
mov r8d, 0x24
call fcn.14007c750
sub edi, 0x12
cmp edi, 2
jl 0x14015c87c
lea rcx, [rbx + 0x30]
lea rdx, [0x1402cfcb8]
add rdx, 0xc
mov r8d, 4
call fcn.14007c750
mov rcx, rbx
jmp 0x14015c774
lea rcx, [0x140214990]
call fcn.140003c00
mov rsi, rax
mov rcx, rsi
call fcn.140099f10
mov rcx, rsi
call fcn.140004b10
lea rcx, [0x140214990]
call fcn.140003c00
mov rsi, rax
mov rcx, rsi
call fcn.140099f10
mov rcx, rsi
call fcn.140004b10
lea rcx, [0x140214990]
call fcn.140003c00
mov rsi, rax
mov rcx, rsi
call fcn.140099f10
mov rcx, rsi
call fcn.140004b10
lea rcx, [0x140214990]
call fcn.140003c00
mov rsi, rax
mov rcx, rsi
call fcn.140099f10
mov rcx, rsi
call fcn.140004b10
lea rcx, [0x140214990]
call fcn.140003c00
mov rsi, rax
mov rcx, rsi
call fcn.140099f10
mov rcx, rsi
call fcn.140004b10
int3

Function at 0x14018eae0
Capabilities:
Hash data using murmur3

Disassembly:
xor eax, eax
mov r8d, dword [rdx + 8]
test r8d, r8d
jle 0x14018eb1e
mov r9d, eax
lea r9, [rdx + r9*8 + 0x10]
mov r9, qword [r9]
mov r10, r9
test r10, r10
jne 0x14018eb03
xor r10d, r10d
jmp 0x14018eb07
mov r10d, dword [r9 + 0x14]
mov r9d, ecx
rol r9d, 0xd
add r9d, ecx
mov ecx, r9d
xor ecx, r10d
inc eax
cmp r8d, eax
jg 0x14018eaeb
mov eax, ecx
rol eax, 0xf
add eax, ecx
ret

Function at 0x1401925b0
Capabilities:
Hash data using murmur3

Disassembly:
push rdi
push rsi
sub rsp, 0x28
mov esi, ecx
mov edi, edx
call fcn.1400010f3
mov eax, dword [rax]
add eax, 0x165667b1
add eax, 8
imul edx, esi, 0xc2b2ae3d
add edx, eax
rol edx, 0x11
imul eax, edx, 0x27d4eb2f
imul edx, edi, 0xc2b2ae3d
add edx, eax
rol edx, 0x11
imul eax, edx, 0x27d4eb2f
mov edx, eax
shr edx, 0xf
xor eax, edx
imul eax, eax, 0x85ebca77
mov edx, eax
shr edx, 0xd
xor eax, edx
imul eax, eax, 0xc2b2ae3d
mov edx, eax
shr edx, 0x10
xor eax, edx
add rsp, 0x28
pop rsi
pop rdi
ret
Function at 0x140192620
Capabilities:
Hash data using murmur3

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov esi, ecx
mov edi, edx
mov ebx, r8d
call fcn.1400010f3
mov eax, dword [rax]
add eax, 0x165667b1
add eax, 0xc
imul edx, esi, 0xc2b2ae3d
add edx, eax
rol edx, 0x11
imul eax, edx, 0x27d4eb2f
imul edx, edi, 0xc2b2ae3d
add edx, eax
rol edx, 0x11
imul eax, edx, 0x27d4eb2f
imul edx, ebx, 0xc2b2ae3d
add edx, eax
rol edx, 0x11
imul eax, edx, 0x27d4eb2f
mov edx, eax
shr edx, 0xf
xor eax, edx
imul eax, eax, 0x85ebca77
mov edx, eax
shr edx, 0xd
xor eax, edx
imul eax, eax, 0xc2b2ae3d
mov edx, eax
shr edx, 0x10
xor eax, edx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x140195420
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push rdi
push rsi
push rbp
push rbx
sub rsp, 0x28
mov rsi, r8
mov edi, edx
xor ebx, ebx
mov ebp, dword [rsi + 8]
test ebp, ebp
jle 0x140195454
mov ecx, ebx
mov rcx, qword [rsi + rcx*8 + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x28]
mov edx, edi
rol edx, 0xd
add edx, edi
mov edi, eax
xor edi, edx
inc ebx
cmp ebp, ebx
jg 0x140195436
mov eax, edi
rol eax, 0xf
add eax, edi
add rsp, 0x28
pop rbx
pop rbp
pop rsi
pop rdi
ret

Function at 0x140195470
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push rdi
push rsi
push rbp
push rbx
sub rsp, 0x28
mov rsi, r8
mov edi, edx
xor ebx, ebx
mov ebp, dword [rsi + 8]
test ebp, ebp
jle 0x1401954a4
mov ecx, ebx
mov rcx, qword [rsi + rcx*8 + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x28]
mov edx, edi
rol edx, 0xd
add edx, edi
mov edi, eax
xor edi, edx
inc ebx
cmp ebp, ebx
jg 0x140195486
mov eax, edi
rol eax, 0xf
add eax, edi
add rsp, 0x28
pop rbx
pop rbp
pop rsi
pop rdi
ret
Function at 0x1400069b0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov dword [rsp + 0x20], 0
lea rcx, str.HOME
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x1400069f0
lea rcx, str.USERPROFILE
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x140006a2d
mov rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x78]
call fcn.14000d1a0
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x30], rax
jmp 0x140006a58
lea rdx, [0x1401966a5]
lea rcx, [rsp + 0x58]
call fcn.14000d1a0
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x20]
or eax, 2
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0xb0]
call fcn.14000d0d0
mov eax, dword [rsp + 0x20]
or eax, 4
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
and eax, 2
test eax, eax
je 0x140006a9a
and dword [rsp + 0x20], 0xfffffffd
lea rcx, [rsp + 0x58]
call fcn.14000d0a0
nop
mov eax, dword [rsp + 0x20]
and eax, 1
test eax, eax
je 0x140006ab5
and dword [rsp + 0x20], 0xfffffffe
lea rcx, [rsp + 0x78]
call fcn.14000d0a0
nop
mov rax, qword [rsp + 0xb0]
add rsp, 0xa8
ret
Function at 0x140007360
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [0x1401af080]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x24], reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x24]
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x1400073bd
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
call fcn.14000d1a0
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x50]
jmp 0x1400073de
lea rdx, [0x1401967a0]
mov rcx, qword [rsp + 0x50]
call fcn.14000d1a0
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1401823c0
add rsp, 0x48
ret

Function at 0x1400073f0
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x158
mov rax, qword [0x1401af080]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x24], 0x101
lea rdx, [rsp + 0x24]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x140007459
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x160]
call fcn.14000d1a0
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x160]
jmp 0x140007480
lea rdx, str.Unknown
mov rcx, qword [rsp + 0x160]
call fcn.14000d1a0
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x160]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1401823c0
add rsp, 0x158
ret
Function at 0x1400074a0
Capabilities:
Get storage device properties

Disassembly:
mov byte [rsp + 0x10], dl
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x4c0
mov rax, qword [0x1401af080]
xor rax, rsp
mov qword [rsp + 0x4b0], rax
mov dword [rsp + 0x40], 0
lea rdx, str.._
lea rcx, [rsp + 0x70]
call fcn.14000d1a0
nop
movzx edx, byte [rsp + 0x4d8]
lea rcx, [rsp + 0x70]
call fcn.14000cfe0
lea rdx, [0x1401967b8]
lea rcx, [rsp + 0x70]
call fcn.14000d010
lea rcx, [rsp + 0x70]
call fcn.14000cd70
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 3
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0xffffffffffffffff
jne 0x14000757a
lea rdx, str.Error_opening_device
mov rcx, qword [rsp + 0x4d0]
call fcn.14000d1a0
mov eax, dword [rsp + 0x40]
or eax, 1
mov dword [rsp + 0x40], eax
lea rcx, [rsp + 0x70]
call fcn.14000d0a0
mov rax, qword [rsp + 0x4d0]
jmp 0x1400076ac
lea rax, [rsp + 0x58]
mov rdi, rax
xor eax, eax
mov ecx, listen
rep stosb byte [rdi], al
mov dword [rsp + 0x58], 0
mov dword [rsp + 0x5c], 0
lea rax, [rsp + 0xb0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x400
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
mov r9d, listen
lea r8, [rsp + 0x58]
mov edx, 0x2d1400
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x140007634
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.Error_querying_device_property
mov rcx, qword [rsp + 0x4d0]
call fcn.14000d1a0
mov eax, dword [rsp + 0x40]
or eax, 1
mov dword [rsp + 0x40], eax
lea rcx, [rsp + 0x70]
call fcn.14000d0a0
mov rax, qword [rsp + 0x4d0]
jmp 0x1400076ac
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x10]
lea rax, [rsp + rax + 0xb0]
mov rdx, rax
lea rcx, [rsp + 0x90]
call fcn.14000d1a0
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x90]
mov rcx, qword [rsp + 0x4d0]
call fcn.14000d0d0
mov eax, dword [rsp + 0x40]
or eax, 1
mov dword [rsp + 0x40], eax
lea rcx, [rsp + 0x90]
call fcn.14000d0a0
nop
lea rcx, [rsp + 0x70]
call fcn.14000d0a0
mov rax, qword [rsp + 0x4d0]
mov rcx, qword [rsp + 0x4b0]
xor rcx, rsp
call fcn.1401823c0
add rsp, 0x4c0
pop rdi
ret
Function at 0x1400076d0
Capabilities:
Get cpu information
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x178
mov rax, qword [0x1401af080]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov dword [rsp + 0x30], 0
lea rax, str.HARDWAREDESCRIPTIONSystemCentralProcessor0
mov qword [rsp + 0x38], rax
lea rax, str.ProcessorNameString
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], 0x100
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rsp + 0x38]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14000776b
lea rdx, str.Error_opening_registry_key
mov rcx, qword [rsp + 0x180]
call fcn.14000d1a0
mov eax, dword [rsp + 0x30]
or eax, 1
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x180]
jmp 0x140007808
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x1400077cd
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.Error_reading_registry_value
mov rcx, qword [rsp + 0x180]
call fcn.14000d1a0
mov eax, dword [rsp + 0x30]
or eax, 1
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x180]
jmp 0x140007808
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x48]
dec eax
mov eax, eax
mov r8d, eax
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x180]
call fcn.14000d200
mov eax, dword [rsp + 0x30]
or eax, 1
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x180]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1401823c0
add rsp, 0x178
ret
Function at 0x140009000
Capabilities:
Capture screenshot

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xd8
mov rax, qword [0x1401af080]
xor rax, rsp
mov qword [rsp + 0xc0], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str.DISPLAY
call qword [sym.imp.GDI32.dll_CreateDCW]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov qword [rsp + 0x60], rax
mov edx, 8
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov dword [rsp + 0x5c], eax
mov edx, 0xa
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov dword [rsp + 0x58], eax
mov r8d, dword [rsp + 0x58]
mov edx, dword [rsp + 0x5c]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov qword [rsp + 0x78], rax
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.GDI32.dll_SelectObject]
mov qword [rsp + 0x90], rax
mov dword [rsp + 0x40], 0xcc0020
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x5c]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.GDI32.dll_BitBlt]
mov rdx, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.GDI32.dll_SelectObject]
nop
mov ecx, Ordinal_27
call fcn.140004cc0
mov qword [rsp + 0x68], rax
cmp qword [rsp + 0x68], 0
je 0x140009136
mov edx, Ordinal_27
mov rcx, qword [rsp + 0x68]
call fcn.1400036a0
xor r8d, r8d
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x68]
call fcn.140004f90
mov qword [rsp + 0x80], rax
jmp 0x140009142
mov qword [rsp + 0x80], 0
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x88], rax
lea rdx, [rsp + 0xb0]
lea rcx, str.image_png
call fcn.140008ee0
xor r9d, r9d
lea r8, [rsp + 0xb0]
mov rdx, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0x88]
call fcn.140004ed0
nop
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x70], rax
cmp qword [rsp + 0x70], 0
je 0x1400091da
mov rax, qword [rsp + 0x70]
mov rax, qword [rax]
mov rax, qword [rax]
mov qword [rsp + 0xa0], rax
mov edx, 1
mov rcx, qword [rsp + 0x70]
call qword [rsp + 0xa0]
mov qword [rsp + 0xa8], rax
jmp 0x1400091e6
mov qword [rsp + 0xa8], 0
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.GDI32.dll_DeleteDC]
mov al, 1
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1401823c0
add rsp, 0xd8
ret