joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4984c0
Capabilities:
Hash data using fnv

Disassembly:
test byte [rax], al
mov rcx, rbx
and ebx, 0x7f
shl rbx, 5
lea rdx, [rax + rbx]
xor eax, eax
jmp 0x4984d7
inc rax
cmp rax, 4
jge 0x4984ef
lea rbx, [rdx + rax*8]
mov rbx, qword [rbx]
cmp rbx, rcx
jne 0x4984d4
mov eax, 1
ret
xor eax, eax
movabs rbx, 0xcbf29ce484222325
jmp 0x498500
inc rax
cmp rax, 4
jge 0x49850e
mov rsi, qword [rdx + rax*8]
xor edi, edi
jmp 0x498537
and ebx, 3
lea rdx, [rdx + rbx*8]
xchg qword [rdx], rcx
xor eax, eax
ret
movzx r8d, sil
xor rbx, r8
inc rdi
shr rsi, 8
movabs r8, 0x100000001b3
imul rbx, r8
cmp rdi, 8
jl 0x49851b
jmp 0x4984fd

Function at 0x140001b24
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001b6e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001b6e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001b6e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001b6e
cmp dword [rcx + 0x84], 0xe
jbe 0x140001b6e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001b70
xor al, al
add rsp, 0x28
ret
Function at 0x180002100
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
jl 0x180002141
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x20]
call fcn.180001cb0
add rsp, 0x38
ret

Function at 0x180002380
Capabilities:
Register minifilter driver
Start minifilter driver

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rcx, qword [rsp + 0x48]
call fcn.180002160
mov dword [rsp + 0x20], 0xc0000001
lea r8, [0x1800e6e90]
lea rdx, [0x180060920]
mov rcx, qword [rsp + 0x40]
call sub.FLTMGR.SYS_FltRegisterFilter
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jl 0x1800023e6
mov rcx, qword [0x1800e6e90]
call sub.FLTMGR.SYS_FltStartFiltering
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jge 0x1800023e6
mov rcx, qword [0x1800e6e90]
call sub.FLTMGR.SYS_FltUnregisterFilter
mov eax, dword [rsp + 0x20]
add rsp, 0x38
ret
Function at 0x18005e540
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x50]
xor r8d, r8d
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx]
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
add rsp, 0x38
ret

Function at 0x18005e950
Capabilities:
Create thread

Disassembly:
sub rsp, 0x58
movzx eax, byte [0x1800e6e84]
cmp eax, 1
jne 0x18005e994
mov qword [rsp + 0x30], 0
lea rax, [0x18005e9e0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1fffff
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
add rsp, 0x58
ret
Function at 0x18005f210
Capabilities:
Find process by pid

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rsi
push rdi
sub rsp, 0x88
mov byte [rsp + 0x58], 0
mov dword [rsp + 0x68], 0xc0000001
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x60], 0
cmp qword [rsp + 0xb0], 0
je 0x18005f272
cmp dword [rsp + 0xb8], 0
jne 0x18005f277
jmp 0x18005f3a8
mov ecx, dword [rsp + 0xa0]
lea rdx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov dword [rsp + 0x74], eax
cmp dword [rsp + 0x74], 0
jge 0x18005f299
jmp 0x18005f3a8
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0x10000000
xor r8d, r8d
mov edx, 0x200
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_ObOpenObjectByPointer]
mov dword [rsp + 0x74], eax
cmp dword [rsp + 0x74], 0
je 0x18005f2da
jmp 0x18005f3a8
mov eax, dword [rsp + 0xb8]
mov qword [rsp + 0x60], rax
mov r8d, 0x71756572
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x18005f30b
jmp 0x18005f3a8
mov dword [rsp + 0x70], 0
mov dword [rsp + 0x6c], 0
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0xb8]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x40]
mov r8d, dword [rsp + 0x6c]
mov rdx, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0x48]
call fcn.18005f120
mov dword [rsp + 0x74], eax
cmp dword [rsp + 0x74], 0
jge 0x18005f359
jmp 0x18005f3a8
mov r8d, 1
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.ntoskrnl.exe_ProbeForWrite]
mov rdi, qword [rsp + 0xb0]
mov rsi, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x60]
rep movsb byte [rdi], byte [rsi]
jmp 0x18005f390
cmp dword [rsp + 0x74], 0
jge 0x18005f399
jmp 0x18005f3a8
mov byte [rsp + 0x58], 1
xor eax, eax
test eax, eax
jne 0x18005f25d
cmp qword [rsp + 0x40], 0
je 0x18005f3c6
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov qword [rsp + 0x40], 0
cmp qword [rsp + 0x48], 0
je 0x18005f3d9
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
cmp qword [rsp + 0x50], 0
je 0x18005f3ec
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov al, byte [rsp + 0x58]
add rsp, 0x88
pop rdi
pop rsi
ret
Function at 0x1802d0a53
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
xor bl, bpl
mov qword [rsp + 0x10], rsi
push rdi
stc
btr bx, 0x1a
sub rsp, 0x20
mov rsi, r8
mov rdi, rdx
btc dx, di
mov rbx, rcx
shl dh, 0x98
bt dx, ax
and dh, 0xb3
nop
stc
sal rdx, cl
cmp dword [rbx + 0x44], 0
cdq
mov rdx, rdi
jmp 0x1802d0a94
jne 0x1802d0ad0
mov r8d, dword [rbx + 0xc]
bsf rcx, r11
mov rcx, qword [rbx + 0x30]
mov rax, rdi
sub r8d, dword [rbx + 0x40]
test edi, r12d
clc
sub rax, rcx
stc
cmp rax, r8
jmp 0x1802d0abd
jbe 0x1802d0ad0
lea rdx, [r8 + rcx]
movzx cx, r10b
movsx ecx, r13w
mov r8, rsi
movzx cx, r15b
xchg ecx, ecx
movsx ecx, r10w
mov rcx, rbx
jmp 0x1802d0ae6
call fcn.1802ceb77
test eax, eax
jne 0x1802d0b79
mov eax, dword [rbx + 0xc]
jmp 0x1802d0aff
cmp dword [rbx + 0x40], eax
jmp 0x1802d0b07
jb 0x1802d0b19
mov dword [rbx + 0x44], eax
movsx rdx, r15w
not dh
cmovg ecx, ebp
mov rdx, rdi
movzx ecx, r13w
mov rcx, rbx
call fcn.1802d08b6
cmp qword [rbx + 0x30], rdi
jmp 0x1802d0b31
jae 0x1802d0b58
cmp qword [rbx + 0x20], rsi
jmp 0x1802d0b40
jae 0x1802d0b58
cmp dword [rbx + 0x5c], 0x112
jmp 0x1802d0b52
jb 0x1802d0a87
cmp dword [rbx + 0x5c], 0x112
jbe 0x1802d0b6c
mov dword [rbx + 0x5c], 0x112
sub eax, eax
cmp r12w, 0x7673
btc di, r14w
mov rbx, qword [rsp + 0x30]
movzx rsi, r13w
mov rsi, qword [rsp + 0x38]
ror dil, cl
bswap rdi
add rsp, 0x20
movzx edi, r12w
cmovb rdi, rax
pop rdi
jmp 0x1802d0b9f
ret

Function at 0x1802d243f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
stc
mov qword [rsp + 0x10], rdi
sbb r10b, 0x8e
and r9b, 0x2e
sub edi, edi
cmovns bx, sp
jmp 0x1802d245d
movzx ebx, r8b
movsx r8, r9w
mov r11, rcx
mov r8, rdi
dec r9b
nop
xchg r9b, r9b
movzx r9w, r9b
movsx r9, r10w
movzx r9d, byte [r11]
xchg r10b, r10b
movzx r10d, byte [rdx]
jmp 0x1802d248b
inc r11
jmp 0x1802d2493
inc rdx
stc
clc
cmc
test bl, bl
jmp 0x1802d24a0
je 0x1802d24ca
mov ecx, r8d
movsx rax, si
mov eax, 0x460854d4
rol eax, cl
test r13d, 0xd52821
clc
add al, r8b
xor r9b, al
jmp 0x1802d24c7
inc r8
test r9b, r9b
jmp 0x1802d24d2
je 0x1802d24e6
cmp r9b, r10b
jmp 0x1802d24e0
je 0x1802d247b
cmp r9b, r10b
jmp 0x1802d24ee
jae 0x1802d250c
or eax, 0xffffffff
mov rbx, qword [rsp + 8]
cmovae di, r8w
mov rdi, qword [rsp + 0x10]
jmp 0x1802d250b
ret
mov rbx, qword [rsp + 8]
jmp 0x1802d2516
seta dil
cwde
mov eax, edi
xchg di, di
mov rdi, qword [rsp + 0x10]
jmp 0x1802d252a
ret
Function at 0x1400027f0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x20], 0
call fcn.140003c50
movzx eax, al
test eax, eax
jne 0x140002865
call fcn.14000bf20
movzx eax, al
test eax, eax
jne 0x140002865
call fcn.14000c910
movzx eax, al
test eax, eax
jne 0x140002865
mov rcx, qword [rsp + 0x20]
call fcn.14000c260
movzx eax, al
test eax, eax
jne 0x140002865
call fcn.1400089d0
movzx eax, al
test eax, eax
jne 0x140002865
mov ecx, 0x5f
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x140002865
call fcn.14000ccd0
movzx eax, al
test eax, eax
jne 0x140002865
call fcn.14000c110
movzx eax, al
test eax, eax
je 0x140002897
lea rdx, str.VM_detected_
mov rcx, qword [0x14001a330]
call fcn.1400021f0
mov qword [rsp + 0x28], rax
lea rdx, [0x140002590]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
add rsp, 0x38
ret
Function at 0x14000c260
Capabilities:
Enumerate network shares

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xa0
mov dword [rsp + 0x3c], 0xffffffff
mov dword [rsp + 0x38], 0x4000
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0xb0]
xor r8d, r8d
xor edx, edx
mov ecx, 2
call sub.MPR.dll_WNetOpenEnumA
mov dword [rsp + 0x58], eax
cmp dword [rsp + 0x58], 0
je 0x14000c2b0
xor al, al
jmp 0x14000c452
mov eax, dword [rsp + 0x38]
mov edx, eax
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jne 0x14000c2d5
xor al, al
jmp 0x14000c452
mov eax, dword [rsp + 0x38]
mov qword [rsp + 0x70], rax
mov rdi, qword [rsp + 0x48]
xor eax, eax
mov rcx, qword [rsp + 0x70]
rep stosb byte [rdi], al
lea r9, [rsp + 0x38]
mov r8, qword [rsp + 0x48]
lea rdx, [rsp + 0x3c]
mov rcx, qword [rsp + 0x68]
call sub.MPR.dll_WNetEnumResourceA
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jne 0x14000c421
mov dword [rsp + 0x34], 0
jmp 0x14000c328
mov eax, dword [rsp + 0x34]
inc eax
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x3c]
cmp dword [rsp + 0x34], eax
jae 0x14000c41f
lea rax, [0x140820368]
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.1400031c0
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x60]
call fcn.140004380
mov qword [rsp + 0x78], rax
jmp 0x14000c370
mov rax, qword [rsp + 0x50]
add rax, 0x20
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x78]
cmp qword [rsp + 0x50], rax
je 0x14000c3df
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x80]
call fcn.140006bd0
mov eax, dword [rsp + 0x34]
imul rax, rax, 0x30
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rcx + rax + 0x28]
lea rcx, [rsp + 0x80]
call fcn.14000c230
movzx eax, al
test eax, eax
je 0x14000c3d0
mov byte [rsp + 0x30], 1
lea rcx, [rsp + 0x80]
call fcn.140007b70
movzx eax, byte [rsp + 0x30]
jmp 0x14000c452
lea rcx, [rsp + 0x80]
call fcn.140007b70
jmp 0x14000c362
mov eax, dword [rsp + 0x34]
imul rax, rax, 0x30
mov rcx, qword [rsp + 0x48]
mov eax, dword [rcx + rax + 0xc]
and eax, 2
cmp eax, 2
jne 0x14000c41a
cmp dword [rsp + 0x3c], 0
jbe 0x14000c41a
mov eax, dword [rsp + 0x34]
imul rax, rax, 0x30
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.14000c260
jmp 0x14000c31e
jmp 0x14000c42d
cmp dword [rsp + 0x40], 0x103
je 0x14000c42d
jmp 0x14000c43b
cmp dword [rsp + 0x40], 0x103
jne 0x14000c2d5
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rcx, qword [rsp + 0x68]
call sub.MPR.dll_WNetCloseEnum
xor al, al
add rsp, 0xa0
pop rdi
ret
Function at 0x140011c40
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x30]
call fcn.140012930
lea rax, [0x140011be0]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x60]
add rax, 8
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x30]
call fcn.1400031c0
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rsp + 0x40]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov rcx, qword [rsp + 0x60]
mov qword [rcx], rax
mov rax, qword [rsp + 0x60]
cmp qword [rax], 0
je 0x140011cc4
lea rcx, [rsp + 0x30]
call fcn.140016450
jmp 0x140011cda
mov rax, qword [rsp + 0x60]
mov dword [rax + 8], 0
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
lea rcx, [rsp + 0x30]
call fcn.140013200
add rsp, 0x58
ret

Function at 0x140013c20
Capabilities:
Execute command

Disassembly:
sub rsp, 0x28
lea rcx, [0x14001aac4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add rsp, 0x28
ret

Function at 0x140013c40
Capabilities:
Get system information on windows

Disassembly:
push rdi
sub rsp, 0x30
lea rax, [rsp + 0x28]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
mov dword [rsp + 0x28], 8
xor r9d, r9d
mov r8d, 8
lea rdx, [rsp + 0x28]
mov ecx, 0x67
call sub.ntdll.dll_NtQuerySystemInformation
mov eax, dword [rsp + 0x2c]
and eax, 2
test eax, eax
jne 0x140013c99
mov eax, dword [rsp + 0x2c]
and eax, 0x80
test eax, eax
jne 0x140013c99
mov dword [rsp + 0x24], 0
jmp 0x140013ca1
mov dword [rsp + 0x24], 1
movzx eax, byte [rsp + 0x24]
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + 0x20]
add rsp, 0x30
pop rdi
ret

Function at 0x140013cc0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x78
mov qword [rsp + 0x30], 0
mov rax, qword gs:[0x60]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x18]
lea rcx, [rsp + 0x48]
mov rdi, rcx
lea rsi, [rax + 0x20]
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x58]
lea rcx, [rsp + 0x48]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x38]
lea rcx, [rsp + 0x48]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
jmp 0x140013d42
lea rax, [rsp + 0x38]
mov rdi, rax
mov rsi, qword [rsp + 0x38]
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x18]
add rax, 0x20
cmp qword [rsp + 0x38], rax
je 0x140013d99
mov rax, qword [rsp + 0x38]
sub rax, 0x10
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
cmp qword [rax + 0x60], 0
je 0x140013d97
mov rax, qword [rsp + 0x20]
mov rdx, qword [rax + 0x60]
mov rcx, qword [rsp + 0x90]
call fcn.140016e50
test rax, rax
je 0x140013d97
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x30], rax
jmp 0x140013d99
jmp 0x140013d2e
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x30]
add rsp, 0x78
pop rdi
pop rsi
ret
Function at 0x140013db0
Capabilities:
Check os version

Disassembly:
sub rsp, 0x28
call fcn.140013ff0
cmp eax, 0xa
jl 0x140013dc7
mov eax, dword [0x7ffe0260]
jmp 0x140013dd6
mov rax, qword gs:[0x60]
mov eax, dword [rax + 0x120]
add rsp, 0x28
ret

Function at 0x140013de0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
cmp qword [rsp + 0x70], 0
jne 0x140013dfd
xor eax, eax
jmp 0x140013f3c
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140013e1d
xor eax, eax
jmp 0x140013f3c
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp dword [rax], 0x4550
je 0x140013e49
xor eax, eax
jmp 0x140013f3c
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x38]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x140013e7d
xor eax, eax
jmp 0x140013f3c
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x20], 0
jmp 0x140013ed9
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x14]
cmp dword [rsp + 0x20], eax
jae 0x140013f3c
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x48]
call fcn.140016a10
test eax, eax
jne 0x140013f3a
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
movzx eax, word [rcx + rax*2]
mov rcx, qword [rsp + 0x58]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
jmp 0x140013f3c
jmp 0x140013ecf
invalid
invalid
invalid
Function at 0x1400141c0
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
mov byte [rsp + 0x20], 0
mov r9d, 4
mov r8d, 0x3000
mov edx, 0x100000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x1400141f6
xor al, al
jmp 0x1400142ef
xor r9d, r9d
mov r8d, 0x100000
mov rdx, qword [rsp + 0x38]
mov ecx, 0x16
call sub.ntdll.dll_NtQuerySystemInformation
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
jge 0x140014233
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor al, al
jmp 0x1400142ef
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
add rax, 8
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x24], 0
jmp 0x14001425f
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
cmp dword [rsp + 0x24], eax
jae 0x1400142c9
mov rax, qword [rsp + 0x30]
lea rdx, str.Hyhd
mov rcx, rax
call fcn.140016ab0
test eax, eax
jne 0x1400142b9
mov rax, qword [rsp + 0x30]
cmp dword [rax + 4], 0
jne 0x14001429a
mov rax, qword [rsp + 0x30]
cmp dword [rax + 0x18], 0
je 0x1400142b9
mov rax, qword [rsp + 0x30]
cmp qword [rax + 0x20], 0xa
ja 0x1400142b2
mov rax, qword [rsp + 0x30]
cmp qword [rax + 0x10], 0xa
jbe 0x1400142b9
mov byte [rsp + 0x20], 1
jmp 0x1400142c9
mov rax, qword [rsp + 0x30]
add rax, 0x28
mov qword [rsp + 0x30], rax
jmp 0x140014255
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
movzx eax, byte [rsp + 0x20]
test eax, eax
je 0x1400142ea
call fcn.140015090
movzx eax, byte [rsp + 0x20]
add rsp, 0x58
ret

Function at 0x1400143e0
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
sub rsp, 0x160
mov byte [rsp + 0x30], 0
lea rax, [rsp + 0x50]
mov rdi, rax
xor eax, eax
mov ecx, 0x104
rep stosb byte [rdi], al
mov dword [rsp + 0x38], 0x104
mov dword [rsp + 0x3c], 1
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControl
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jne 0x1400144a0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3c]
xor r8d, r8d
lea rdx, str.SystemStartOptions
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jne 0x140014495
lea rdx, str.TESTSIGNING
lea rcx, [rsp + 0x50]
call fcn.140016be0
test rax, rax
je 0x140014495
mov byte [rsp + 0x30], 1
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, byte [rsp + 0x30]
add rsp, 0x160
pop rdi
ret
Function at 0x140014a00
Capabilities:
Enumerate pe sections

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov rax, qword [rsp + 0x20]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x20]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 8], rax
mov dword [rsp], 0
jmp 0x140014a3c
mov eax, dword [rsp]
inc eax
mov dword [rsp], eax
mov rax, qword [rsp + 0x20]
movzx eax, word [rax + 6]
cmp dword [rsp], eax
jae 0x140014a85
mov rax, qword [rsp + 8]
mov eax, dword [rax + 0xc]
cmp dword [rsp + 0x30], eax
jb 0x140014a75
mov rax, qword [rsp + 8]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 8]
add eax, dword [rcx + 0x10]
cmp dword [rsp + 0x30], eax
jae 0x140014a75
mov rax, qword [rsp + 8]
jmp 0x140014a87
mov rax, qword [rsp + 8]
add rax, 0x28
mov qword [rsp + 8], rax
jmp 0x140014a34
xor eax, eax
add rsp, 0x18
ret

Function at 0x140014c40
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x28
cmp qword [rsp + 0x48], 0
jne 0x140014c69
mov eax, 0xc000000d
jmp 0x140014d9a
mov rax, qword [rsp + 0x48]
mov qword [rax], 0
mov eax, dword [rsp + 0x30]
and eax, 0xfffffffe
test eax, eax
je 0x140014c8a
mov eax, 0xc000000d
jmp 0x140014d9a
cmp qword [rsp + 0x38], 0
je 0x140014c9a
cmp qword [rsp + 0x38], 0xffffffffffffffff
jne 0x140014ca4
mov eax, 0xc000000d
jmp 0x140014d9a
mov eax, dword [rsp + 0x30]
and eax, 1
test eax, eax
jne 0x140014cb5
mov byte [rsp], 1
jmp 0x140014cb9
mov byte [rsp], 0
movzx eax, byte [rsp]
mov byte [rsp + 1], al
movzx eax, byte [rsp + 1]
test eax, eax
je 0x140014cdc
cmp qword [rsp + 0x40], 0x40
jae 0x140014cdc
mov eax, 0xc000007b
jmp 0x140014d9a
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x10]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014cff
mov eax, 0xc000007b
jmp 0x140014d9a
mov rax, qword [rsp + 0x10]
mov eax, dword [rax + 0x3c]
mov dword [rsp + 4], eax
cmp dword [rsp + 4], 0x10000000
jb 0x140014d1c
mov eax, 0xc000007b
jmp 0x140014d9a
movzx eax, byte [rsp + 1]
test eax, eax
je 0x140014d3b
mov eax, dword [rsp + 4]
add rax, 0x18
cmp rax, qword [rsp + 0x40]
jb 0x140014d3b
mov eax, 0xc000007b
jmp 0x140014d9a
mov eax, dword [rsp + 4]
mov rcx, qword [rsp + 0x38]
add rcx, rax
mov rax, rcx
mov qword [rsp + 8], rax
mov eax, 0xffffffff
cmp qword [rsp + 0x38], rax
ja 0x140014d77
mov rax, qword [rsp + 8]
add rax, 0x108
mov ecx, 0xffffffff
cmp rax, rcx
jbe 0x140014d77
mov eax, 0xc000007b
jmp 0x140014d9a
mov rax, qword [rsp + 8]
cmp dword [rax], 0x4550
je 0x140014d8b
mov eax, 0xc000007b
jmp 0x140014d9a
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 8]
mov qword [rax], rcx
xor eax, eax
add rsp, 0x28
ret