joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ff674a37db0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rdi
sub rsp, 0x28
mov rbx, rcx
mov rdi, rdx
mov ecx, dword [0x7ff674af5dc0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
xor r8d, r8d
test rax, rax
je 0x7ff674a37de0
mov r9, qword [rax + 8]
jmp 0x7ff674a37de3
mov r9, r8
cmp rdi, 0x3fc
ja 0x7ff674a37e07
test r9, r9
je 0x7ff674a37e07
mov rax, r8
cmp qword [r9 + rax*8], 0
je 0x7ff674a37e15
inc r8d
inc rax
cmp rax, 2
jl 0x7ff674a37df4
mov rcx, rbx
add rsp, 0x28
pop rdi
pop rbx
jmp case.0x7ff674a7e53b.0
movzx eax, byte [rbx + rdi]
mov byte [rbx], al
movsxd rax, r8d
mov qword [r9 + rax*8], rbx
add rsp, 0x28
pop rdi
pop rbx
ret

Function at 0x7ff674a380b0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x40
mov rax, qword [0x7ff674aed368]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rax, qword [rcx]
xor r14d, r14d
mov rbx, rcx
mov qword [rdx], r14
mov rsi, rdx
mov qword [rdx + 8], r14
mov rbp, r8
mov edx, r14d
mov rcx, qword [rax]
mov r9d, r14d
test rcx, rcx
je 0x7ff674a38117
mov rax, qword [rcx]
lea rdx, [rsp + 0x20]
call qword [rax + 8]
mov r9, qword [rax]
mov rdx, qword [rax + 8]
mov rax, qword [rbx]
mov qword [rsi], r9
mov qword [rsi + 8], rdx
mov qword [rax], r14
cmp rbp, rdx
jbe 0x7ff674a38234
mov ebx, 6
test r9, r9
je 0x7ff674a38179
mov ecx, dword [0x7ff674af5dc0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x7ff674a38141
mov rdx, qword [rax + 8]
jmp 0x7ff674a38144
mov rdx, r14
mov r9, qword [rsi + 8]
mov r8, qword [rsi]
cmp r9, 0x3fc
ja 0x7ff674a38171
test rdx, rdx
je 0x7ff674a38171
mov ecx, ebx
mov rax, rbx
nop
cmp qword [rdx + rax*8], r14
je 0x7ff674a381da
inc ecx
inc rax
cmp rax, 8
jl 0x7ff674a38160
mov rcx, r8
call case.0x7ff674a7e53b.0
mov ecx, dword [0x7ff674af5dc0]
mov qword [rsp + 0x50], rdi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
lea rdi, [rbp + 3]
shr rdi, 2
test rax, rax
je 0x7ff674a38206
mov r9, qword [rax + 8]
test r9, r9
je 0x7ff674a38206
mov ecx, ebx
lea r8, [r9 + 0x30]
mov rdx, qword [r8]
test rdx, rdx
je 0x7ff674a381b6
movzx eax, byte [rdx]
cmp rax, rdi
jae 0x7ff674a381eb
inc ecx
add r8, 8
cmp ecx, 8
jl 0x7ff674a381a6
mov rax, rbx
mov rcx, qword [r9 + rax*8]
test rcx, rcx
jne 0x7ff674a381fa
inc ebx
inc rax
cmp rax, 8
jl 0x7ff674a381c4
jmp 0x7ff674a38206
movzx eax, byte [r8 + r9]
mov byte [r8], al
movsxd rax, ecx
mov qword [rdx + rax*8], r8
jmp 0x7ff674a38179
movsxd rax, ecx
mov qword [r9 + rax*8], r14
movzx eax, byte [rdx]
mov byte [rdx + rbp], al
jmp 0x7ff674a38228
movsxd rax, ebx
mov qword [r9 + rax*8], r14
call case.0x7ff674a7e53b.0
lea rcx, [rdi*4 + 1]
call fcn.7ff674a84fe0
cmp rdi, 0xff
movzx ecx, dil
mov rdx, rax
cmova ecx, r14d
mov byte [rax + rbp], cl
mov rdi, qword [rsp + 0x50]
mov qword [rsi], rdx
mov qword [rsi + 8], rbp
mov rax, rsi
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.7ff674a84ea0
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x7ff674a39cc0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rdi, rdx
mov ecx, dword [0x7ff674af5dc0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x7ff674a39ce7
mov r8, qword [rax + 8]
jmp 0x7ff674a39cea
xor r8d, r8d
cmp rdi, 0x3fc
ja 0x7ff674a39d12
test r8, r8
je 0x7ff674a39d12
mov ecx, 2
mov eax, ecx
nop
cmp qword [r8 + rax*8], 0
je 0x7ff674a39d24
inc ecx
inc rax
cmp rax, 4
jl 0x7ff674a39d00
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp case.0x7ff674a7e53b.0
movzx eax, byte [rbx + rdi]
mov byte [rbx], al
movsxd rax, ecx
mov qword [r8 + rax*8], rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x7ff674a39d40
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov ecx, dword [0x7ff674af5dc0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
lea rbx, [rdi + 3]
xor esi, esi
shr rbx, 2
test rax, rax
je 0x7ff674a39de4
mov r10, qword [rax + 8]
test r10, r10
je 0x7ff674a39de4
mov r9d, 2
lea r8, [r10 + 0x10]
mov ecx, r9d
mov rdx, qword [r8]
test rdx, rdx
je 0x7ff674a39d93
movzx eax, byte [rdx]
cmp rax, rbx
jae 0x7ff674a39db8
inc ecx
add r8, 8
cmp ecx, 4
jl 0x7ff674a39d83
mov rax, r9
mov rcx, qword [r10 + rax*8]
test rcx, rcx
jne 0x7ff674a39dd8
inc r9d
inc rax
cmp rax, 4
jl 0x7ff674a39da1
jmp 0x7ff674a39de4
movsxd rcx, ecx
mov rax, rdx
mov qword [r10 + rcx*8], rsi
movzx ecx, byte [rdx]
mov byte [rdx + rdi], cl
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movsxd rax, r9d
mov qword [r10 + rax*8], rsi
call case.0x7ff674a7e53b.0
lea rcx, [rbx*4 + 1]
call fcn.7ff674a84fe0
cmp rbx, 0xff
movzx ecx, bl
mov rbx, qword [rsp + 0x30]
cmova ecx, esi
mov rsi, qword [rsp + 0x38]
mov byte [rax + rdi], cl
add rsp, 0x20
pop rdi
ret
Function at 0x7ff674a41210
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xf0
mov rax, qword [0x7ff674aed368]
xor rax, rsp
mov qword [rbp + 0x3f], rax
xor esi, esi
mov rax, qword [rdx]
mov qword [rdx], rsi
mov qword [rbp - 0x69], rax
lea rdx, [rbp - 0x49]
call fcn.7ff674a37ff0
nop
lea r8, [rbp - 0x49]
lea rdx, [rbp - 0x11]
call fcn.7ff674a416d0
mov rbx, rax
cmp qword [rax + 0x20], rsi
je 0x7ff674a4138a
mov rcx, qword [rax + 0x28]
mov rax, qword [rcx + 0x18]
test rax, rax
je 0x7ff674a41290
lea rcx, [0x7ff674a41b80]
mov qword [rbp - 0x59], rcx
lea rcx, [rbp - 0x69]
mov qword [rbp - 0x51], rcx
lea rdx, [rbp - 0x59]
mov rcx, rbx
call rax
jmp 0x7ff674a4132f
mov rdi, qword [rcx + 0x10]
mov rax, qword [rbp - 0x69]
mov qword [rbp - 0x69], rsi
mov qword [rbp - 0x71], rax
lea rax, [rbp - 0x71]
mov qword [rbp - 0x59], rax
lea rax, [rbp - 0x79]
mov qword [rbp + 0x27], rax
mov ecx, dword [0x7ff674af5dc0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x7ff674a412c7
mov rdx, qword [rax + 8]
jmp 0x7ff674a412ca
mov rdx, rsi
mov r8d, 0x18
call fcn.7ff674a41ba0
mov qword [rbp + 0x37], rsi
mov rcx, qword [rbp - 0x71]
mov qword [rbp - 0x71], rsi
mov qword [rax + 8], rcx
lea rcx, [0x7ff674a41d30]
mov qword [rax], rcx
mov qword [rbp - 0x61], rax
mov qword [rbp + 0x2f], rsi
lea rcx, [rbp + 0x27]
call fcn.7ff674a41ad0
nop
mov rax, qword [rbp - 0x71]
test rax, rax
je 0x7ff674a41314
mov rdx, qword [rax]
mov rcx, rdx
call qword [rdx + 8]
nop
lea rdx, [rbp - 0x61]
mov rcx, rbx
call rdi
nop
mov rcx, qword [rbp - 0x61]
test rcx, rcx
je 0x7ff674a4132f
mov rax, qword [rcx]
xor edx, edx
call rax
nop
cmp qword [rbp + 0xf], 0
je 0x7ff674a41344
mov rax, qword [rbp + 7]
mov rdx, qword [rax]
lea rcx, [rbp - 0x11]
call rdx
nop
cmp qword [rbp - 0x29], 0
je 0x7ff674a41359
mov rax, qword [rbp - 0x31]
mov rdx, qword [rax]
lea rcx, [rbp - 0x49]
call rdx
nop
mov rax, qword [rbp - 0x69]
test rax, rax
je 0x7ff674a4136b
mov rdx, qword [rax]
mov rcx, rdx
call qword [rdx + 8]
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.7ff674a84ea0
mov rbx, qword [rsp + 0x120]
add rsp, 0xf0
pop rdi
pop rsi
pop rbp
ret
lea rcx, [rbp + 0x27]
call fcn.7ff674a37e50
nop
lea rcx, [rbp + 0x27]
call fcn.7ff674a3d920
int3
Function at 0x7ff674a41ad0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rax, qword [rcx + 0x10]
mov rdi, rcx
test rax, rax
je 0x7ff674a41b00
mov rax, qword [rax + 8]
test rax, rax
je 0x7ff674a41af8
mov rax, qword [rax]
mov rcx, rax
call qword [rax + 8]
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x7ff674a41b52
mov ecx, dword [0x7ff674af5dc0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x7ff674a41b42
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x7ff674a41b42
mov ecx, 4
mov eax, ecx
nop word [rax + rax]
cmp qword [rdx + rax*8], 0
je 0x7ff674a41b5d
inc ecx
inc rax
cmp rax, 6
jl 0x7ff674a41b30
mov rcx, rbx
call case.0x7ff674a7e53b.0
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x18]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov rbx, qword [rsp + 0x30]
mov qword [rdi + 8], 0
add rsp, 0x20
pop rdi
ret

Function at 0x7ff674a42ae0
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x7ff674aed368]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdx, rcx
lea rcx, [rsp + 0x40]
call fcn.7ff674a428d0
nop
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ecx, eax
cmp eax, 1
jne 0x7ff674a42c31
mov ecx, 0x20027
call fcn.7ff674a84fe0
test rax, rax
je 0x7ff674a42c41
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
mov qword [rsp + 0x28], rbx
lea rax, [rbx + 0x20000]
mov qword [rsp + 0x38], rax
mov eax, 0x1000
xor ecx, ecx
nop dword [rax]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rcx
mov qword [rbx + 0x18], 7
mov word [rbx], cx
add rbx, 0x20
sub rax, 1
jne 0x7ff674a42b60
mov rdx, rbx
mov rcx, rbx
call fcn.7ff674a44dc0
mov qword [rsp + 0x30], rbx
mov rdx, qword [rsp + 0x28]
sub rbx, rdx
sar rbx, 5
add ebx, ebx
mov dword [rsp + 0x20], ebx
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
lea r8, [rsp + 0x20]
call qword [sym.imp.MPR.dll_WNetGetConnectionW]
lea rcx, [rsp + 0x28]
test eax, eax
je 0x7ff674a42bd6
cmp eax, 0x4b1
je 0x7ff674a42bd6
call fcn.7ff674a44790
xor bl, bl
jmp 0x7ff674a42bdd
call fcn.7ff674a44790
mov bl, 1
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x7ff674a42c1b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff674a42c16
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff674a42c47
call fcn.7ff674a8526c
movzx eax, bl
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.7ff674a84ea0
add rsp, 0x70
pop rbx
ret
dec eax
cmp eax, 3
jbe 0x7ff674a42bdb
cmp ecx, 7
jae 0x7ff674a42bdb
xor bl, bl
jmp 0x7ff674a42bdd
call fcn.7ff674a8c94c
nop
call fcn.7ff674a8c94c
int3
Function at 0x7ff674a493b0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push r13
push r14
sub rsp, 0x178
mov rax, qword [0x7ff674aed368]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor r13d, r13d
mov r14, rcx
cmp qword [rcx + 0x18], 0x10
jb 0x7ff674a493dd
mov rcx, qword [rcx]
mov qword [rsp + 0x198], rbx
mov qword [rsp + 0x1a0], rbp
mov qword [rsp + 0x1a8], rsi
mov qword [rsp + 0x170], rdi
mov qword [rsp + 0x168], r12
mov qword [rsp + 0x160], r15
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x7ff674a49599
mov rdi, qword [r14 + 0x10]
test rdi, rdi
je 0x7ff674a49628
mov rbp, r13
lea r12, [0x7ff674ad28ac]
nop dword [rax]
nop word [rax + rax]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [r12 + rbx], r13b
jne 0x7ff674a49447
mov r15, qword [r14 + 0x18]
mov rsi, r14
cmp r15, 0x10
jb 0x7ff674a49460
mov rsi, qword [r14]
test rbx, rbx
je 0x7ff674a494c6
cmp rbp, rdi
jae 0x7ff674a494c6
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x100
call fcn.7ff674a87c70
lea rdx, [rbx + r12]
mov rcx, r12
cmp r12, rdx
je 0x7ff674a494a0
nop dword [rax + rax]
movzx eax, byte [rcx]
inc rcx
mov byte [rsp + rax + 0x50], 1
cmp rcx, rdx
jne 0x7ff674a49490
lea rdx, [rdi + rsi]
lea rax, [rsi + rbp]
cmp rax, rdx
jae 0x7ff674a494c6
nop dword [rax]
movzx ecx, byte [rax]
cmp byte [rsp + rcx + 0x50], r13b
jne 0x7ff674a495e7
inc rax
cmp rax, rdx
jb 0x7ff674a494b0
mov rax, 0xffffffffffffffff
cmp rax, 0xffffffffffffffff
mov qword [rsp + 0x38], r13
mov rbx, rdi
mov qword [rsp + 0x40], r13
cmovne rbx, rax
xorps xmm0, xmm0
cmp rdi, rbx
mov r8, rbx
movups xmmword [rsp + 0x28], xmm0
cmovb r8, rdi
mov rdx, r14
cmp r15, 0x10
jb 0x7ff674a49500
mov rdx, qword [r14]
lea rcx, [rsp + 0x28]
call fcn.7ff674a36fe0
cmp qword [rsp + 0x38], r13
je 0x7ff674a4954b
cmp qword [rsp + 0x40], 0x10
lea rcx, [rsp + 0x28]
cmovae rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x7ff674a4954b
cmp qword [rsp + 0x40], 0x10
lea rcx, [rsp + 0x28]
cmovae rcx, qword [rsp + 0x28]
call fcn.7ff674a95274
test eax, eax
jne 0x7ff674a495ef
mov rdx, qword [rsp + 0x40]
lea rbp, [rbx + 1]
cmp rdx, 0x10
jb 0x7ff674a4958c
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff674a49587
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff674a4962f
call fcn.7ff674a8526c
mov rdi, qword [r14 + 0x10]
cmp rbp, rdi
jb 0x7ff674a49440
mov al, 1
mov r15, qword [rsp + 0x160]
mov r12, qword [rsp + 0x168]
mov rdi, qword [rsp + 0x170]
mov rsi, qword [rsp + 0x1a8]
mov rbp, qword [rsp + 0x1a0]
mov rbx, qword [rsp + 0x198]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.7ff674a84ea0
add rsp, 0x178
pop r14
pop r13
ret
sub rax, rsi
jmp 0x7ff674a494cd
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x7ff674a49628
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff674a49623
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff674a4962f
call fcn.7ff674a8526c
xor al, al
jmp 0x7ff674a4959b
call fcn.7ff674a8c94c
int3
Function at 0x7ff674a4c0a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0xb0
mov rax, qword [0x7ff674aed368]
xor rax, rsp
mov qword [rsp + 0xa8], rax
mov rdi, rdx
mov rsi, rcx
mov qword [r11 - 0x38], rdx
mov rdx, qword [rdx]
add rdx, 8
lea rcx, [r11 - 0x30]
call fcn.7ff674a36da0
nop
lea rdx, [rsp + 0x88]
cmp qword [rsp + 0xa0], 0x10
cmovae rdx, qword [rsp + 0x88]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
mov r8, qword [rsp + 0x98]
test r8, r8
je 0x7ff674a4c133
movabs r10, 0x100000001b3
nop dword [rax]
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x7ff674a4c120
lea r8, [rsp + 0x88]
lea rdx, [rsp + 0x20]
lea rcx, [rsi + 0xf0]
call fcn.7ff674a5c690
mov rcx, qword [rax + 8]
test rcx, rcx
jne 0x7ff674a4c15c
mov rcx, qword [rsi + 0xf8]
lea r8, [rsp + 0x88]
cmp rcx, qword [rsi + 0xf8]
jne 0x7ff674a4c251
lea rdx, [rsp + 0x30]
lea rcx, [rsi + 0xf0]
call fcn.7ff674a548b0
mov rcx, qword [rax]
add rcx, 0x30
mov rdx, rdi
call fcn.7ff674a4fae0
nop
mov rdx, qword [rsp + 0xa0]
cmp rdx, 0x10
jb 0x7ff674a4c1d1
inc rdx
mov rcx, qword [rsp + 0x88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff674a4c1cc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff674a4c24b
call fcn.7ff674a8526c
mov qword [rsp + 0x98], 0
mov qword [rsp + 0xa0], 0xf
mov byte [rsp + 0x88], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x7ff674a4c226
mov edi, 0xffffffff
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x7ff674a4c226
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x7ff674a4c226
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.7ff674a84ea0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.7ff674a8c94c
nop
lea rdx, str.logger_with_name_
lea rcx, [rsp + 0x60]
call fcn.7ff674a3d950
nop
lea r8, str._already_exists
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.7ff674a3d770
mov rcx, rax
call fcn.7ff674a492c0
int3
Function at 0x7ff674a70c30
Capabilities:
Enumerate processes on remote desktop session host

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x7ff674aed368]
xor rax, rsp
mov qword [rsp + 0x78], rax
xor r14d, r14d
lea rax, [r11 - 0x28]
lea r9, [r11 - 0x30]
mov qword [r11 - 0x30], r14
xor edx, edx
mov dword [r11 - 0x28], r14d
xor ecx, ecx
mov qword [r11 - 0x78], rax
lea r8d, [r14 + 1]
call qword [sym.imp.WTSAPI32.dll_WTSEnumerateProcessesW]
test eax, eax
je 0x7ff674a70deb
mov edi, r14d
cmp dword [rsp + 0x70], r14d
jbe 0x7ff674a70deb
lea r15, [r14 - 1]
nop dword [rax]
mov eax, edi
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r14
mov r8, r15
mov qword [rsp + 0x48], r14
lea rcx, [rax + rax*2]
mov rax, qword [rsp + 0x68]
lea rbp, [rcx*8]
mov rdx, qword [rax + rbp + 8]
nop dword [rax]
inc r8
cmp word [rdx + r8*2], r14w
jne 0x7ff674a70cd0
lea rcx, [rsp + 0x30]
call fcn.7ff674a3e3a0
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x50]
lea rcx, [0x7ff674af5e28]
call fcn.7ff674a5ce40
mov rsi, qword [rsp + 0x48]
mov r10, qword [rsp + 0x30]
mov rax, qword [rax + 0x10]
cmp byte [rax + 0x19], r14b
jne 0x7ff674a70d6e
mov r11, qword [rax + 0x30]
add rax, 0x20
cmp qword [rax + 0x18], 8
jb 0x7ff674a70d20
mov rax, qword [rax]
mov rbx, qword [rsp + 0x40]
lea r9, [rsp + 0x30]
cmp rsi, 8
mov rcx, rbx
cmovae r9, r10
cmp r11, rbx
cmovb rcx, r11
test rcx, rcx
je 0x7ff674a70d58
sub r9, rax
movzx edx, word [r9 + rax]
cmp dx, word [rax]
jne 0x7ff674a70d61
add rax, 2
sub rcx, 1
jne 0x7ff674a70d44
cmp rbx, r11
jb 0x7ff674a70d6e
mov bl, 1
jmp 0x7ff674a70d70
mov eax, 1
cmovb eax, r15d
test eax, eax
jns 0x7ff674a70d5d
xor bl, bl
cmp rsi, 8
jb 0x7ff674a70dab
lea rdx, [rsi*2 + 2]
mov rax, r10
cmp rdx, 0x1000
jb 0x7ff674a70da3
mov r10, qword [r10 - 8]
add rdx, 0x27
sub rax, r10
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff674a70e25
mov rcx, r10
call fcn.7ff674a8526c
test bl, bl
je 0x7ff674a70ddf
mov r8, qword [rsp + 0x68]
mov rdx, qword [0x7ff674af5e78]
add r8, 4
add r8, rbp
cmp rdx, qword [0x7ff674af5e80]
je 0x7ff674a70dda
mov eax, dword [r8]
mov dword [rdx], eax
add qword [0x7ff674af5e78], 4
jmp 0x7ff674a70ddf
call fcn.7ff674a71400
inc edi
cmp edi, dword [rsp + 0x70]
jb 0x7ff674a70ca0
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x7ff674a70dfb
call qword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.7ff674a84ea0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
call fcn.7ff674a8c94c
int3
Function at 0x7ff674a778f8
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x7ff674a7797c
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x7ff674ac47c0]
cmp byte [rcx + rax], 0
je 0x7ff674a7797c
dec r8
sub rdx, 1
jne 0x7ff674a77962
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x7ff674a7cbb0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
push r15
movzx eax, dl
lea r10, str.cw
movzx esi, byte [rax + r10]
mov eax, edx
shr eax, 8
movzx ecx, al
mov eax, edx
shr eax, 0x10
lea edi, [rsi + rsi]
movzx r15d, byte [rcx + r10]
movzx ecx, al
mov eax, edx
shr rax, 0x18
lea r9d, [r15 + r15]
movzx r14d, byte [rcx + r10]
mov r8d, r9d
xor r8d, r15d
movzx r10d, byte [rax + r10]
movzx eax, dil
xor al, 0x1b
movzx ebp, al
bt edi, 8
movzx eax, dil
cmovae ebp, eax
movzx eax, r8b
xor al, 0x1b
movzx ecx, al
bt r8d, 8
movzx eax, r8b
lea r8d, [r14 + r14]
cmovae ecx, eax
mov edx, r8d
xor bpl, cl
xor edx, r14d
xor bpl, r10b
movzx eax, dl
xor al, 0x1b
xor bpl, r14b
movzx r11d, al
bt edx, 8
movzx eax, dl
cmovae r11d, eax
movzx eax, r9b
xor al, 0x1b
movzx ecx, al
bt r9d, 8
movzx eax, r9b
lea r9d, [r10 + r10]
cmovae ecx, eax
mov edx, r9d
xor edx, r10d
xor r11b, cl
xor r11b, r10b
movzx eax, dl
xor al, 0x1b
xor r11b, sil
movzx r10d, al
bt edx, 8
movzx eax, dl
cmovae r10d, eax
movzx eax, r8b
xor al, 0x1b
movzx ecx, al
bt r8d, 8
movzx eax, r8b
cmovae ecx, eax
xor edi, esi
xor r10b, cl
movzx eax, dil
xor al, 0x1b
xor r10b, r15b
movzx ecx, al
xor r10b, sil
movzx eax, dil
bt edi, 8
cmovae ecx, eax
movzx eax, r9b
xor al, 0x1b
movzx r8d, cl
movzx ecx, al
movzx eax, r9b
mov rbx, qword [rsp + 0x18]
bt r9d, 8
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
cmovae ecx, eax
movzx eax, cl
xor eax, r8d
movzx ecx, r10b
xor eax, r14d
xor eax, r15d
shl eax, 8
or eax, ecx
movzx ecx, r11b
shl eax, 8
or eax, ecx
movzx ecx, bpl
mov rbp, qword [rsp + 0x20]
shl eax, 8
or eax, ecx
pop r15
pop r14
ret
Function at 0x7ff674a83380
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov r9, rdx
mov r8, rcx
mov edx, 8
lea ecx, [rdx + 6]
jmp 0x7ff674a83680
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
xor r11d, r11d
mov r10d, edx
lea esi, [rcx*4 + 4]
mov rdi, r8
lea rbp, [0x7ff674ac6420]
test edx, edx
je 0x7ff674a836f1
mov rbx, r8
lea eax, [r11*4]
inc r11d
movzx edx, byte [rax + r9 + 3]
lea rbx, [rbx + 4]
shl edx, 8
mov ecx, eax
movzx eax, byte [rax + r9 + 2]
or edx, eax
shl edx, 8
movzx eax, byte [rcx + r9 + 1]
or edx, eax
movzx eax, byte [rcx + r9]
shl edx, 8
or edx, eax
mov dword [rbx - 4], edx
cmp r11d, r10d
jb 0x7ff674a836b2
mov r9d, r10d
cmp r10d, esi
jae 0x7ff674a837d4
lea r11, [r8 + r10*4]
lea rbx, [0x7ff674ac6430]
nop dword [rax + rax]
lea eax, [r9 - 1]
xor edx, edx
mov ecx, dword [rdi + rax*4]
mov eax, r9d
div r10d
test edx, edx
jne 0x7ff674a8376c
mov r8d, ecx
movzx eax, cl
movzx ecx, byte [rax + rbx]
mov eax, r8d
shr rax, 0x18
shl ecx, 8
movzx eax, byte [rax + rbx]
or ecx, eax
mov eax, r8d
shr rax, 0x10
shl ecx, 8
movzx edx, al
shr r8, 8
movzx eax, byte [rdx + rbx]
or ecx, eax
movzx eax, r8b
shl ecx, 8
movzx edx, byte [rax + rbx]
movzx eax, byte [rbp]
or ecx, edx
xor ecx, eax
inc rbp
jmp 0x7ff674a837b8
cmp r10d, 6
jbe 0x7ff674a837b8
cmp edx, 4
jne 0x7ff674a837b8
mov r8, rcx
mov rax, rcx
shr rax, 0x10
movzx ecx, al
mov rax, r8
shr rax, 0x18
movzx ecx, byte [rcx + rbx]
movzx eax, byte [rax + rbx]
shl eax, 8
or ecx, eax
mov rax, r8
shr rax, 8
movzx edx, al
shl ecx, 8
movzx eax, byte [rdx + rbx]
or ecx, eax
movzx eax, r8b
shl ecx, 8
movzx edx, byte [rax + rbx]
or ecx, edx
mov eax, r9d
inc r9d
sub eax, r10d
xor ecx, dword [rdi + rax*4]
mov dword [r11], ecx
add r11, 4
cmp r9d, esi
jb 0x7ff674a83710
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret

Function at 0x7ff674a833a0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], r9
mov r9, rdx
mov rdx, rcx
mov qword [rsp + 0x20], r8
mov ecx, 0xe
lea r8, [0x7ff674ac6430]
call fcn.7ff674a837f0
add rsp, 0x38
ret

Function at 0x7ff674a833d0
Capabilities:
Hash data using sha256

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.7ff674a83500
movups xmm0, xmmword [0x7ff674ac63e0]
xor eax, eax
movups xmmword [rbx], xmm0
movups xmm1, xmmword [0x7ff674ac63f0]
mov qword [rbx + 0x20], rax
mov dword [rbx + 0x28], eax
movups xmmword [rbx + 0x10], xmm1
add rsp, 0x20
pop rbx
ret
Function at 0x7ff674a85d2c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x7ff674a85d76
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x7ff674a85d76
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x7ff674a85d76
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x7ff674a85d76
cmp dword [rcx + 0x84], 0xe
jbe 0x7ff674a85d76
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x7ff674a85d78
xor al, al
add rsp, 0x28
ret

Function at 0x7ff674a98544
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x7ff674a98370