joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140093080
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x58
mov rax, qword [0x1400f9b40]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, qword [rsp + 0xc0]
mov rbp, rdx
mov rbx, qword [rsp + 0xb0]
xor edx, edx
mov r15, qword [rsp + 0xd0]
mov rsi, rcx
mov r14, qword [rsp + 0xd8]
call fcn.1400935c0
test eax, eax
jne 0x140093247
mov r8, qword [rsp + 0xb8]
mov rdx, rbx
mov rcx, rsi
call fcn.140093a20
test eax, eax
jne 0x140093247
lea rax, [rsp + 0x30]
mov r9, r14
mov qword [rsp + 0x28], rax
mov r8, rbp
mov rdx, r15
mov qword [rsp + 0x20], rbp
mov rcx, rsi
call fcn.1400937d0
test eax, eax
jne 0x140093247
mov rbx, qword [rsp + 0xc8]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rbx
lea r9, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rsi
call fcn.140093320
test eax, eax
jne 0x140093247
xor ecx, ecx
mov eax, ecx
test rbx, rbx
je 0x140093245
cmp rbx, 8
jb 0x1400931f6
lea r8, [rsp + 0x38]
mov rdx, rdi
sub rdx, r8
lea r9, [rsp + 0x3c]
mov rcx, rbx
lea r8, [rsp + 0x3c]
and rcx, 0xfffffffffffffff8
xorps xmm4, xmm4
add r8, rdx
xorps xmm3, xmm3
movd xmm2, dword [rdi + rax]
xorps xmm0, xmm0
movd xmm1, dword [rsp + rax + 0x38]
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
xorps xmm2, xmm1
movd xmm1, dword [r8 + rax]
orps xmm4, xmm2
punpcklbw xmm1, xmm0
movd xmm2, dword [r9 + rax]
add rax, 8
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
xorps xmm2, xmm1
orps xmm3, xmm2
cmp rax, rcx
jb 0x140093181
orps xmm3, xmm4
movdqa xmm0, xmm3
psrldq xmm0, 8
orps xmm3, xmm0
movdqa xmm0, xmm3
psrldq xmm0, 4
orps xmm3, xmm0
movd ecx, xmm3
cmp rax, rbx
jae 0x14009322f
jmp 0x140093210
lea rdx, [rsp + 0x38]
sub rdi, rdx
mov rdx, rdi
nop dword [rax]
nop word [rax + rax]
lea r8, [rsp + 0x38]
add r8, rax
inc rax
movzx r9d, byte [rdx + r8]
movzx r8d, byte [r8]
xor r9d, r8d
or ecx, r9d
cmp rax, rbx
jb 0x140093210
test ecx, ecx
je 0x140093245
mov rdx, rbp
mov rcx, r14
call fcn.140071030
mov eax, 0xffffffee
jmp 0x140093247
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14009a250
add rsp, 0x58
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400935c0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push r12
push r14
sub rsp, 0x68
mov rax, qword [0x1400f9b40]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor r12d, r12d
mov rdi, r9
mov qword [rsp + 0x30], r12
mov r14, r8
mov rsi, rcx
test r9, r9
je 0x1400937b1
movabs rax, 0x2000000000000000
cmp r9, rax
jae 0x1400937b1
mov qword [rsp + 0x58], rbp
xorps xmm0, xmm0
lea rbp, [rcx + 0x180]
movups xmmword [rbp], xmm0
movups xmmword [rcx + 0x190], xmm0
mov dword [rcx + 0x1a0], edx
mov qword [rcx + 0x160], r12
mov qword [rcx + 0x168], r12
cmp r9, 0xc
jne 0x140093658
movsd xmm0, qword [r8]
movsd qword [rbp], xmm0
mov eax, dword [r8 + 8]
mov dword [rbp + 8], eax
mov byte [rcx + 0x18f], 1
jmp 0x140093788
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x50], r15
lea r15, [r9*8]
bswap r15
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], r12
nop word [rax + rax]
mov ebx, reloc.WS2_32.dll_recv
cmp rdi, rbx
cmovb rbx, rdi
test rbx, rbx
je 0x1400936b5
mov r8, r14
mov rax, rbp
sub r8, rsi
mov rdx, rbx
nop dword [rax]
movzx ecx, byte [r8 + rax - 0x180]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x1400936a0
mov r8, rbp
mov rdx, rbp
mov rcx, rsi
call fcn.140092b20
add r14, rbx
sub rdi, rbx
jne 0x140093680
xor byte [rbp], r12b
mov r8, rbp
movzx eax, byte [rsp + 0x39]
mov rdx, rbp
xor byte [rsi + 0x181], al
mov rcx, rsi
movzx eax, byte [rsp + 0x3a]
xor byte [rsi + 0x182], al
movzx eax, byte [rsp + 0x3b]
xor byte [rsi + 0x183], al
movzx eax, byte [rsp + 0x3c]
xor byte [rsi + 0x184], al
movzx eax, byte [rsp + 0x3d]
xor byte [rsi + 0x185], al
movzx eax, byte [rsp + 0x3e]
xor byte [rsi + 0x186], al
movzx eax, byte [rsp + 0x3f]
xor byte [rsi + 0x187], al
xor byte [rsi + 0x188], r15b
movzx eax, byte [rsp + 0x41]
xor byte [rsi + 0x189], al
movzx eax, byte [rsp + 0x42]
xor byte [rsi + 0x18a], al
movzx eax, byte [rsp + 0x43]
xor byte [rsi + 0x18b], al
movzx eax, byte [rsp + 0x44]
xor byte [rsi + 0x18c], al
movzx eax, byte [rsp + 0x45]
xor byte [rsi + 0x18d], al
movzx eax, byte [rsp + 0x46]
xor byte [rsi + 0x18e], al
movzx eax, byte [rsp + 0x47]
xor byte [rsi + 0x18f], al
mov rbx, qword [rsp + 0x60]
call fcn.140092b20
mov r15, qword [rsp + 0x50]
lea rax, [rsp + 0x30]
mov r8d, reloc.WS2_32.dll_recv
lea r9, [rsi + 0x170]
mov qword [rsp + 0x20], rax
mov rdx, rbp
mov rcx, rsi
call fcn.14008fe80
mov rbp, qword [rsp + 0x58]
jmp 0x1400937b6
mov eax, 0xffffffec
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14009a250
add rsp, 0x68
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140093a20
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x20
movabs rax, 0x2000000000000000
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
cmp r8, rax
jb 0x140093a4d
mov eax, 0xffffffec
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret
mov rax, qword [rcx + 0x168]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x50], r15
mov r15, rax
and r15d, 0xf
je 0x140093ac5
mov r14d, reloc.WS2_32.dll_recv
mov r8, rdi
sub r14, r15
cmp r14, rsi
cmova r14, rsi
add rcx, 0x190
add rcx, r15
mov r9, r14
mov rdx, rcx
call fcn.14006dc40
lea rax, [r14 + r15]
lea rbp, [rbx + 0x190]
cmp rax, 0x10
jne 0x140093ab3
mov r8, rbp
mov rdx, rbp
mov rcx, rbx
call fcn.140092b20
mov rax, qword [rbx + 0x168]
sub rsi, r14
add rdi, r14
add rax, r14
jmp 0x140093acc
lea rbp, [rcx + 0x190]
mov r15, qword [rsp + 0x50]
add rax, rsi
mov qword [rbx + 0x168], rax
cmp rsi, 0x10
jb 0x140093bb8
mov r14, rsi
shr r14, 4
imul rax, r14, 0xfffffffffffffff0
add rsi, rax
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdi]
mov r8, rbp
xor byte [rbp], al
mov rdx, rbp
movzx eax, byte [rdi + 1]
mov rcx, rbx
xor byte [rbx + 0x191], al
movzx eax, byte [rdi + 2]
xor byte [rbx + 0x192], al
movzx eax, byte [rdi + 3]
xor byte [rbx + 0x193], al
movzx eax, byte [rdi + 4]
xor byte [rbx + 0x194], al
movzx eax, byte [rdi + 5]
xor byte [rbx + 0x195], al
movzx eax, byte [rdi + 6]
xor byte [rbx + 0x196], al
movzx eax, byte [rdi + 7]
xor byte [rbx + 0x197], al
movzx eax, byte [rdi + 8]
xor byte [rbx + 0x198], al
movzx eax, byte [rdi + 9]
xor byte [rbx + 0x199], al
movzx eax, byte [rdi + 0xa]
xor byte [rbx + 0x19a], al
movzx eax, byte [rdi + 0xb]
xor byte [rbx + 0x19b], al
movzx eax, byte [rdi + 0xc]
xor byte [rbx + 0x19c], al
movzx eax, byte [rdi + 0xd]
xor byte [rbx + 0x19d], al
movzx eax, byte [rdi + 0xe]
xor byte [rbx + 0x19e], al
movzx eax, byte [rdi + 0xf]
xor byte [rbx + 0x19f], al
call fcn.140092b20
add rdi, 0x10
sub r14, 1
jne 0x140093b00
mov r14, qword [rsp + 0x48]
test rsi, rsi
je 0x140093bd3
mov r9, rsi
mov r8, rdi
mov rdx, rbp
mov rcx, rbp
call fcn.14006dc40
mov rbp, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret
Function at 0x140093f60
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
push rbx
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x1400f9b40]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0xd8]
lea r10, [r11 - 0x38]
mov rbx, qword [rsp + 0xf0]
mov rdi, r8
mov r8, qword [rsp + 0xc8]
mov rsi, qword [rsp + 0xe0]
mov qword [r11 - 0x48], rbx
mov qword [r11 - 0x50], r10
mov qword [r11 - 0x58], rsi
mov qword [r11 - 0x60], rax
mov rax, qword [rsp + 0xd0]
mov qword [r11 - 0x68], rax
mov rax, qword [rsp + 0xc0]
mov qword [r11 - 0x70], r8
mov r8, rdi
mov qword [r11 - 0x78], rax
call fcn.140093bf0
test eax, eax
jne 0x1400940c3
mov r10, qword [rsp + 0xe8]
xor ecx, ecx
xor dl, dl
cmp rbx, 8
jb 0x140094087
mov r8, rbx
xorps xmm4, xmm4
and r8, 0xfffffffffffffff8
xorps xmm3, xmm3
nop dword [rax]
nop word [rax + rax]
movd xmm2, dword [rcx + r10]
lea eax, [rdx + 4]
movd xmm1, dword [rsp + rcx + 0x60]
xorps xmm0, xmm0
punpcklbw xmm2, xmm0
add dl, 8
punpcklwd xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
xorps xmm2, xmm1
movzx ecx, al
orps xmm4, xmm2
movd xmm2, dword [rcx + r10]
movd xmm1, dword [rsp + rcx + 0x60]
punpcklbw xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
movzx ecx, dl
xorps xmm2, xmm1
orps xmm3, xmm2
cmp rcx, r8
jb 0x140094010
orps xmm3, xmm4
movdqa xmm0, xmm3
psrldq xmm0, 8
orps xmm3, xmm0
movdqa xmm0, xmm3
psrldq xmm0, 4
orps xmm3, xmm0
movd ecx, xmm3
movzx eax, dl
cmp rax, rbx
jae 0x1400940ab
nop
movzx r9d, byte [rax + r10]
inc dl
movzx r8d, byte [rsp + rax + 0x60]
xor r9d, r8d
movzx eax, dl
or ecx, r9d
cmp rax, rbx
jb 0x140094090
test ecx, ecx
je 0x1400940c1
mov rdx, rdi
mov rcx, rsi
call fcn.140071030
mov eax, 0xfffffff1
jmp 0x1400940c3
xor eax, eax
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14009a250
add rsp, 0x80
pop rdi
pop rsi
pop rbx
ret

Function at 0x1400987b0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
movzx eax, r9b
mov rdi, r8
movzx r11d, al
mov rbx, rdx
and r11b, 0x1f
shr eax, 5
mov r10, rcx
and eax, 0x80000003
jge 0x1400987ea
dec eax
or eax, 0xfffffffc
inc eax
movzx ecx, al
movzx ebp, r11b
mov r9d, dword [r8 + rcx*4]
mov ecx, 0x20
sub cl, r11b
movzx edx, cl
xor ecx, ecx
test r11b, r11b
bswap r9d
cmove edx, ecx
sub rbx, r10
movzx esi, dl
lea r11d, [rcx + 4]
nop word [rax + rax]
inc al
lea r10, [r10 + 4]
and al, 3
movzx ecx, al
mov r8d, dword [rdi + rcx*4]
mov ecx, esi
bswap r8d
mov edx, r8d
shr edx, cl
mov ecx, ebp
shl r9d, cl
or edx, r9d
mov r9d, r8d
bswap edx
xor edx, dword [rbx + r10 - 4]
mov dword [r10 - 4], edx
sub r11, 1
jne 0x140098820
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
Function at 0x1400999b4
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x1400999ee
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x1400999f3
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140099a3c
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, reloc.WS2_32.dll_accept
cmp byte [rcx + rax], 0
je 0x140099a3c
dec r8
sub rdx, 1
jne 0x140099a22
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x14009ac2c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14009ac76
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14009ac76
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14009ac76
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14009ac76
cmp dword [rcx + 0x84], 0xe
jbe 0x14009ac76
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14009ac78
xor al, al
add rsp, 0x28
ret
Function at 0x14009e390
Capabilities:
Hash data with md5

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x70]
add rcx, 0x460
call fcn.140072550
mov rcx, qword [rbx + 0x70]
add rcx, 0x460
call fcn.1400719b0
mov ecx, 4
call fcn.140072a90
mov rcx, qword [rbx + 0x70]
mov rdx, rax
add rcx, 0x460
xor r8d, r8d
call fcn.140072b10
test eax, eax
jne 0x14009e44a
mov rcx, qword [rbx + 0x70]
add rcx, 0x460
call fcn.140072d30
test eax, eax
jne 0x14009e44a
mov rcx, qword [rbx + 0x70]
add rcx, 0x478
call fcn.140072550
mov rcx, qword [rbx + 0x70]
add rcx, 0x478
call fcn.1400719b0
mov ecx, 5
call fcn.140072a90
mov rcx, qword [rbx + 0x70]
mov rdx, rax
add rcx, 0x478
xor r8d, r8d
call fcn.140072b10
test eax, eax
jne 0x14009e44a
mov rcx, qword [rbx + 0x70]
add rcx, 0x478
add rsp, 0x20
pop rbx
jmp fcn.140072d30
add rsp, 0x20
pop rbx
ret
Function at 0x1400011d8
Capabilities:
Attach user process memory

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x70
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x60], rax
movups xmm0, xmmword [rdx]
mov rbx, rcx
movdqu xmmword [rsp + 0x20], xmm0
call qword [sym.imp.ntoskrnl.exe_PsGetProcessPeb]
mov rdi, rax
test rax, rax
je 0x140001259
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov rdi, qword [rdi + 0x18]
test rdi, rdi
je 0x140001249
add rdi, 0x10
mov rbx, qword [rdi]
jmp 0x140001244
lea rcx, [rbx + 0x58]
mov r8b, 1
lea rdx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlCompareUnicodeString]
test eax, eax
je 0x140001274
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x14000122b
xor ebx, ebx
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rax, rbx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140001680
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
ret
mov rbx, qword [rbx + 0x30]
jmp 0x14000124b

Function at 0x14000127c
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x20
and dword [rax + 0x10], 0
lea r9, [rax + 0x10]
xor edx, edx
mov rsi, rcx
xor r8d, r8d
lea ebx, [rdx + 0xb]
mov ecx, ebx
call sub.ntoskrnl.exe_ZwQuerySystemInformation
mov eax, dword [rsp + 0x38]
test eax, eax
je 0x140001344
mov edx, eax
xor ecx, ecx
mov r8d, 0x4e554c4c
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov r8d, dword [rsp + 0x38]
lea r9, [rsp + 0x38]
mov rdx, rax
mov ecx, ebx
mov rdi, rax
call sub.ntoskrnl.exe_ZwQuerySystemInformation
test eax, eax
js 0x140001344
lfence
mov r8d, dword [rdi]
xor ebx, ebx
xor ecx, ecx
test r8d, r8d
je 0x140001329
mov eax, ecx
mov r10, rsi
imul r11, rax, 0x128
lea rax, [rdi + 0x30]
add rax, r11
sub r10, rax
movzx edx, byte [rax]
movzx r9d, byte [rax + r10]
sub edx, r9d
jne 0x140001317
inc rax
test r9d, r9d
jne 0x140001302
test edx, edx
je 0x140001324
inc ecx
cmp ecx, r8d
jb 0x1400012ec
jmp 0x140001329
mov rbx, qword [r11 + rdi + 0x18]
lfence
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
test rbx, rbx
je 0x140001344
lfence
mov rax, rbx
jmp 0x140001346
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140001384
Capabilities:
Find process by pid

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x50
mov rbx, r9
mov rdi, r8
mov rsi, rdx
test rdx, rdx
je 0x1400013f0
test r8, r8
je 0x1400013f0
test rbx, rbx
je 0x1400013f0
and qword [rax + 0x10], 0
lea rdx, [rax - 0x18]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
lea rcx, [rsp + 0x68]
mov r9, rdi
mov qword [rsp + 0x30], rcx
mov r8, rax
mov rcx, qword [rsp + 0x40]
mov rdx, rsi
mov byte [rsp + 0x28], 0
mov qword [rsp + 0x20], rbx
call sub.ntoskrnl.exe_MmCopyVirtualMemory
test eax, eax
js 0x1400013f0
mov al, 1
jmp 0x1400013f2
xor al, al
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x140001404
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0xa0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov rbx, r9
mov rsi, r8
mov rdi, rdx
test rdx, rdx
je 0x1400014e8
test r8, r8
je 0x1400014e8
test rbx, rbx
je 0x1400014e8
lea rdx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
and qword [rsp + 0x28], 0
lea r9, [rsp + 0x38]
xor r8d, r8d
mov qword [rsp + 0x20], 0x30
mov rdx, rdi
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwQueryVirtualMemory]
test eax, eax
js 0x1400014dd
mov rcx, qword [rsp + 0x50]
lea rdx, [rbx + rdi]
add rcx, qword [rsp + 0x38]
cmp rcx, rdx
jb 0x1400014dd
test dword [rsp + 0x58], 0x1000
je 0x1400014dd
mov eax, dword [rsp + 0x5c]
test eax, 0x101
jne 0x1400014dd
test al, 0x40
jne 0x1400014c0
test al, al
js 0x1400014c0
test al, 4
jne 0x1400014c0
test al, 8
je 0x1400014ce
mov r8, rbx
mov rdx, rsi
mov rcx, rdi
call fcn.140001700
lea rcx, [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov al, 1
jmp 0x1400014ea
lea rcx, [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
xor al, al
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.140001680
add rsp, 0xa0
pop rdi
pop rsi
pop rbx
ret
Function at 0x140027c84
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001b594
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001b594
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x140027dd4
cmp rax, 0xffffffffffffffff
je 0x140027dd4
xor edi, edi
test rbp, rbp
jle 0x140027d7f
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001dea8
mov rbx, rax
test rax, rax
jne 0x140027d0c
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x140027d75
mov edx, 0x8000
mov ecx, r14d
call fcn.140018f00
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001c270
cmp eax, 0xffffffff
je 0x140027d55
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140027d1c
mov edx, r15d
mov ecx, r14d
call fcn.140018f00
jmp 0x140027d75
cmp byte [rsi + 0x38], dil
je 0x140027d6c
cmp dword [rsi + 0x34], 5
jne 0x140027d6c
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x140027d75
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.140019c58
jmp 0x140027de8
jns 0x140027de8
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001b594
cmp rax, 0xffffffffffffffff
jne 0x140027da0
cmp byte [rsi + 0x30], dil
je 0x140027de8
mov edi, dword [rsi + 0x2c]
jmp 0x140027de8
mov ecx, r14d
call fcn.140017a2c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140027de8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140027de8
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140027de1
mov eax, dword [rsi + 0x2c]
jmp 0x140027de6
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001b594
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x140028ee0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140028f08
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140028f08
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x140003b64
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140003990
Function at 0x140008350
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x140082010]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, dword [rsp + 0x20]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rcx, rax
xor edx, edx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140076100
add rsp, 0x30
pop rbx
ret

Function at 0x14000ad30
Capabilities:
Execute command

Disassembly:
push rbx
sub rsp, 0x60
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
movabs rax, 0x7fffffffffffffff
sub rax, rcx
cmp rax, 6
jb 0x14000ae32
mov rax, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x14000ad61
mov rax, qword [rbx]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 6
lea r9, str.start
lea rcx, [rsp + 0x40]
call fcn.1400755a0
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rcx, qword [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x14000addc
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000add7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000add7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140076120
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x14000ae12
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x14000ae0d
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000ae2b
mov rcx, r8
call fcn.140076120
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
add rsp, 0x60
pop rbx
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400075b0
int3

Function at 0x14000b7e0
Capabilities:
Get session user name

Disassembly:
push rbx
sub rsp, 0x140
mov rax, qword [0x140082010]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rbx, rcx
mov dword [rsp + 0x20], 0x100
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
xor eax, eax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], rax
lea rax, [rsp + 0x30]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x14000b832
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140074f70
mov rax, rbx
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.140076100
add rsp, 0x140
pop rbx
ret