joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43d300
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43d467
push rbp
mov rbp, rsp
sub rsp, 0x18
mov ecx, dword [rax + 0x190]
mov edx, dword [rax + 0x194]
mov rsi, qword [rax + 0x998]
mov edi, dword [rax + 0x194]
cmp edi, edx
jne 0x43d312
cmp edx, ecx
jne 0x43d455
nop word [rax + rax]
test rsi, rsi
jne 0x43d455
mov qword [rsp + 0x28], rax
test rbx, rbx
jne 0x43d374
nop
call fcn.00458e60
xorps xmm15, xmm15
mov r14, qword [0x00532f58]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbx, qword [rsp]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x10], rbx
call fcn.0043d220
mov rcx, qword [rsp + 0x28]
mov edx, dword [rcx]
mov ebx, edx
sar edx, 0x1f
shr edx, 0x1b
add edx, ebx
mov esi, edx
and edx, 0xffffffe0
sub ebx, edx
test ebx, ebx
jl 0x43d450
mov rdx, qword [0x004dff78]
sar esi, 5
mov rax, rcx
mov ecx, ebx
mov edi, 1
shl edi, cl
movsxd rsi, esi
cmp ecx, 0x20
sbb r8d, r8d
and edi, r8d
cmp rdx, rsi
jbe 0x43d445
mov rcx, qword [0x004dff70]
lea rcx, [rcx + rsi*4]
lock or dword [rcx], edi
mov rcx, qword [0x004e09d0]
mov qword [rax + 8], rcx
mov rcx, rax
nop
mov qword [0x004e09d0], rax
nop
mov edx, 1
lea rsi, [0x004e09d8]
lock xadd dword [rsi], edx
mov rdx, qword [rcx + 0x1228]
shr rdx, 0x3d
test dl, dl
jne 0x43d433
mov rax, qword [rsp + 0x10]
movabs rdx, 0x1fffffffffffffff
and rdx, rax
bts rdx, 0x3f
nop
nop
xchg qword [rcx + 0x1228], rdx
add rsp, 0x18
pop rbp
ret
lea rax, [0x00477b96]
mov ebx, 0x28
nop
call fcn.0042eb40
mov rax, rsi
mov rcx, rdx
call fcn.00457600
call fcn.0042d280
lea rax, [0x004772c7]
mov ebx, 0x23
call fcn.0042eb40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004553a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0043d300
Function at 0x44e960
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x44ea0f
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [0x0044ea60]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.00455260
xorps xmm15, xmm15
mov r14, qword [0x00532f58]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004553a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.0044e960
Function at 0x4571e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x00532fc0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x00532d48], 0
je 0x457216
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x00533280]
aesenc xmm0, xmmword [0x00533290]
aesenc xmm0, xmmword [0x005332a0]
movq rax, xmm0
ret
jmp 0x407e20

Function at 0x458ec0
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x458ef4
mov rcx, 0x28
jmp 0x458eff
shl rcx, 3
add rcx, 0x1480
mov qword [0x00532f58], rcx
pop rbp
ret

Function at 0x45e040
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45e10a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.00402840
xorps xmm15, xmm15
mov r14, qword [0x00532f58]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x45e0ef
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x00467120]
xor ebx, ebx
mov rcx, rdx
call fcn.00441380
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.0045e3a0
inc rbx
cmp rcx, rbx
jae 0x45e0de
mov edi, 1
lea rsi, [0x00467120]
call fcn.00441460
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x0048c1c8]
lea rsi, [0x0048bf28]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004553a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0045e040
Function at 0x140001a10
Capabilities:
Set registry value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rdx
mov rbx, rcx
mov rax, qword [0x14013aa80]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], 0
lea rdx, str.SoftwareKiwiCheatsLoader
xor edi, edi
mov rcx, 0xffffffff80000001
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x140001af1
mov eax, dword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140001a85
mov rbx, qword [rbx]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
lea rdx, str.username
xor edi, edi
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x140001ae6
mov eax, dword [rsi + 0x10]
cmp qword [rsi + 0x18], 0x10
jb 0x140001abc
mov rsi, qword [rsi]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
lea rdx, [0x14011d8fa]
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
sete dil
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400d2000
mov eax, edi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
Function at 0x140009cd0
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
movabs rax, 0x800000000000001
cmp rdx, rax
jae 0x140009eae
mov rsi, rcx
dec rdx
or rdx, 1
bsr rcx, rdx
xor ecx, 0x3f
neg cl
mov ebx, 1
shl rbx, cl
lea rax, [rsi + 0x18]
mov rdi, qword [rsi + 8]
mov edx, 2
shl rdx, cl
mov rcx, rax
mov r8, rdi
call fcn.140003600
lea rax, [rbx - 1]
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], rbx
mov rax, qword [rsi + 8]
mov r8, qword [rax]
cmp r8, rdi
je 0x140009ea2
movabs rax, 0x100000001b3
movabs rcx, 0xcbf29ce484222325
jmp 0x140009d71
mov qword [r9 + r10*8], rdx
mov qword [r9 + rbx*8], rdx
cmp r8, rdi
je 0x140009ea2
mov rdx, r8
movzx r8d, byte [r8 + 0x10]
xor r8, rcx
imul r8, rax
movzx r9d, byte [rdx + 0x11]
xor r9, r8
imul r9, rax
movzx r8d, byte [rdx + 0x12]
xor r8, r9
imul r8, rax
movzx r9d, byte [rdx + 0x13]
xor r9, r8
imul r9, rax
movzx r8d, byte [rdx + 0x14]
xor r8, r9
imul r8, rax
movzx r9d, byte [rdx + 0x15]
xor r9, r8
imul r9, rax
movzx r8d, byte [rdx + 0x16]
xor r8, r9
imul r8, rax
movzx r11d, byte [rdx + 0x17]
xor r11, r8
imul r11, rax
and r11, qword [rsi + 0x30]
mov r8, qword [rdx]
mov r9, qword [rsi + 0x18]
lea r10, [r11 + r11]
lea rbx, [r11 + r11]
inc rbx
shl r11, 4
mov r11, qword [r9 + r11]
cmp r11, rdi
je 0x140009d60
mov r14, qword [r9 + rbx*8]
mov r15, qword [rdx + 0x10]
cmp r15, qword [r14 + 0x10]
jne 0x140009e40
mov r10, qword [r14]
cmp r10, rdx
je 0x140009d64
mov r11, qword [rdx + 8]
mov qword [r11], r8
mov r14, qword [r8 + 8]
mov qword [r14], r10
mov r15, qword [r10 + 8]
mov qword [r15], rdx
mov qword [r10 + 8], r14
mov qword [r8 + 8], r11
mov qword [rdx + 8], r15
jmp 0x140009d64
cmp r11, r14
je 0x140009e78
mov r14, qword [r14 + 8]
cmp r15, qword [r14 + 0x10]
jne 0x140009e40
mov r9, qword [r14]
mov r10, qword [rdx + 8]
mov qword [r10], r8
mov r11, qword [r8 + 8]
mov qword [r11], r9
mov rbx, qword [r9 + 8]
mov qword [rbx], rdx
mov qword [r9 + 8], r11
mov qword [r8 + 8], r10
mov qword [rdx + 8], rbx
jmp 0x140009d68
mov rbx, qword [rdx + 8]
mov qword [rbx], r8
mov r14, qword [r8 + 8]
mov qword [r14], r11
mov r15, qword [r11 + 8]
mov qword [r15], rdx
mov qword [r11 + 8], r14
mov qword [r8 + 8], rbx
mov qword [rdx + 8], r15
mov qword [r9 + r10*8], rdx
jmp 0x140009d68
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
lea rcx, str.invalid_hash_bucket_count
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_
int3
Function at 0x14001f3a0
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov r15, qword [rdx + 0x10]
lea rax, [r15 + 2]
movabs rcx, 0xaaaaaaaaaaaaaaab
mul rcx
mov rbx, rdx
add rbx, rdx
xorps xmm0, xmm0
movups xmmword [rsi + 0x10], xmm0
movups xmmword [rsi], xmm0
and rbx, 0xfffffffffffffffc
js 0x14001f5ea
cmp rbx, 0xf
ja 0x14001f409
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], reloc.WS2_32.dll_ntohs
mov rcx, rsi
xor edx, edx
mov r8, rbx
call sub.VCRUNTIME140.dll_memset
add rbx, rsi
mov r14, rbx
jmp 0x14001f467
mov rax, rbx
or rax, 0xf
cmp rax, 0x17
mov r12d, socket
cmovae r12, rax
cmp r12, 0xfff
jb 0x14001f43f
lea rcx, [r12 + 0x28]
call fcn.1400d1e28
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x14001f44c
lea rcx, [r12 + 1]
call fcn.1400d1e28
mov r14, rax
mov qword [rsi], r14
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], r12
mov rcx, r14
xor edx, edx
mov r8, rbx
call sub.VCRUNTIME140.dll_memset
add r14, rbx
mov byte [r14], 0
cmp qword [rsi + 0x18], 0x10
mov rax, rsi
jb 0x14001f478
mov rax, qword [rsi]
mov rdx, r15
xor ecx, ecx
add rdx, 0xfffffffffffffffe
je 0x14001f546
lea r8, [0x1400dae60]
jmp 0x14001f4b4
movzx r9d, byte [r9 + rcx + 2]
and r9d, 0x3f
movzx r9d, byte [r9 + r8]
mov byte [rax + 3], r9b
add rax, 4
add rcx, 3
cmp rcx, rdx
jae 0x14001f546
cmp qword [rdi + 0x18], 0x10
mov r9, rdi
jb 0x14001f4c1
mov r9, qword [rdi]
movzx r9d, byte [r9 + rcx]
shr r9, 2
movzx r9d, byte [r9 + r8]
mov byte [rax], r9b
cmp qword [rdi + 0x18], 0x10
mov r9, rdi
jb 0x14001f4df
mov r9, qword [rdi]
movzx r10d, byte [r9 + rcx]
shl r10d, 4
and r10d, 0x30
movzx r9d, byte [r9 + rcx + 1]
shr r9, 4
or r9, r10
movzx r9d, byte [r8 + r9]
mov byte [rax + 1], r9b
cmp qword [rdi + 0x18], 0x10
mov r9, rdi
jb 0x14001f50f
mov r9, qword [rdi]
movzx r10d, byte [r9 + rcx + 1]
and r10d, 0xf
movzx r9d, byte [r9 + rcx + 2]
shr r9, 6
lea r9, [r9 + r10*4]
movzx r9d, byte [r8 + r9]
mov byte [rax + 2], r9b
cmp qword [rdi + 0x18], 0x10
mov r9, rdi
jb 0x14001f490
mov r9, qword [rdi]
jmp 0x14001f490
cmp rcx, r15
jae 0x14001f5d9
cmp qword [rdi + 0x18], 0x10
mov rdx, rdi
jb 0x14001f55c
mov rdx, qword [rdi]
movzx r8d, byte [rdx + rcx]
shr r8, 2
lea rdx, [0x1400dae60]
movzx r8d, byte [r8 + rdx]
mov byte [rax], r8b
dec r15
cmp qword [rdi + 0x18], 0x10
mov r8, rdi
jb 0x14001f584
mov r8, qword [rdi]
movzx r9d, byte [r8 + rcx]
shl r9d, 4
and r9d, 0x30
cmp rcx, r15
jne 0x14001f5a2
movzx ecx, byte [r9 + rdx]
mov byte [rax + 1], cl
mov cl, 0x3d
jmp 0x14001f5d2
movzx r8d, byte [r8 + rcx + 1]
shr r8, 4
movzx r9d, r9b
or r9, r8
movzx r8d, byte [r9 + rdx]
mov byte [rax + 1], r8b
cmp qword [rdi + 0x18], 0x10
jb 0x14001f5c6
mov rdi, qword [rdi]
movzx ecx, byte [rdi + rcx + 1]
and ecx, 0xf
movzx ecx, byte [rdx + rcx*4]
mov byte [rax + 2], cl
mov byte [rax + 3], 0x3d
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
call fcn.140001300
int3
Function at 0x140031f40
Capabilities:
Get disk information

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x278
mov rax, qword [0x14013aa80]
xor rax, rsp
mov qword [rsp + 0x270], rax
lea rsi, [rsp + 0x60]
mov r8d, 0x208
mov rcx, rsi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x28], 0
mov ecx, 0x60
call fcn.1400d1e28
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rsp + 0x20], rax
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
lea rdx, [0x140122d64]
lea rdi, [rsp + 0x40]
mov r8d, 2
mov rcx, rdi
call fcn.14002fbb0
mov bp, 0x41
mov r13, qword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
lea r14, [rsp + 0x30]
jmp 0x140031ffa
mov rcx, r15
mov rdx, r12
mov r9, rsi
call fcn.1400329e0
inc ebp
cmp bp, 0x5b
je 0x140032085
cmp qword [rsp + 0x58], 8
mov rax, rdi
jb 0x14003200a
mov rax, qword [rsp + 0x40]
mov word [rax], bp
cmp qword [rsp + 0x58], 8
mov rcx, rdi
jb 0x14003201d
mov rcx, qword [rsp + 0x40]
mov rdx, rsi
mov r8d, 0x104
call r13
test eax, eax
je 0x140031fee
lea rcx, [rsp + 0x20]
mov rdx, r14
mov r8, rdi
call fcn.1400326f0
mov rbx, qword [rsp + 0x30]
lea r15, [rbx + 0x40]
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
mov r12, rax
mov rax, qword [rbx + 0x58]
cmp rax, r12
jb 0x140031fe0
cmp rax, 8
jb 0x140032064
mov r15, qword [rbx + 0x40]
mov qword [rbx + 0x50], r12
mov r8, r12
add r8, r12
mov rcx, r15
mov rdx, rsi
call sub.VCRUNTIME140.dll_memmove
mov word [r15 + r12*2], 0
jmp 0x140031fee
xorps xmm0, xmm0
movups xmmword [0x14013b8e8], xmm0
mov ecx, 0x60
call fcn.1400d1e28
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
movups xmm0, xmmword [rsp + 0x20]
mov rcx, qword [0x14013b8f0]
movups xmmword [0x14013b8e8], xmm0
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rcx
mov r8, qword [rsp + 0x58]
cmp r8, 8
jb 0x140032110
mov rcx, qword [rsp + 0x40]
lea rdx, [r8 + r8]
add rdx, 2
cmp rdx, 0x1000
jb 0x140032106
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x140032155
add r8, r8
add r8, 0x29
mov rdx, r8
mov rcx, rax
call fcn.1400d1e6c
mov rax, qword [rsp + 0x20]
mov r8, qword [rax + 8]
lea rcx, [rsp + 0x20]
mov rdx, rcx
call fcn.140032b10
mov rcx, qword [rsp + 0x20]
mov edx, 0x60
call fcn.1400d1e6c
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1400d2000
nop
add rsp, 0x278
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14003d820
Capabilities:
Enumerate processes

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x268
mov rsi, rcx
mov rax, qword [0x14013aa80]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov dword [rsp + 0x28], 0x238
xor ebx, ebx
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp rax, 0xffffffffffffffff
je 0x14003d8fd
mov rdi, rax
lea rdx, [rsp + 0x28]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x14003d8f4
lea rbx, [rsp + 0x54]
lea r14, [rsp + 0x28]
jmp 0x14003d89f
mov rcx, rdi
mov rdx, r14
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x14003d91c
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
cmp qword [rsi + 0x10], rax
jne 0x14003d890
test rax, rax
je 0x14003d8e5
cmp qword [rsi + 0x18], 8
mov rcx, rsi
jb 0x14003d8bf
mov rcx, qword [rsi]
xor edx, edx
nop word cs:[rax + rax]
movzx r8d, word [rcx + rdx*2]
cmp r8w, word [rsp + rdx*2 + 0x54]
jne 0x14003d890
inc rdx
cmp rax, rdx
jne 0x14003d8d0
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtClose]
mov ebx, dword [rsp + 0x30]
jmp 0x14003d8fd
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1400d2000
mov eax, ebx
add rsp, 0x268
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtClose]
xor ebx, ebx
jmp 0x14003d8fd
Function at 0x14003dab0
Capabilities:
Get system information on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x18
lea rbp, [rsp + 0x10]
mov rdi, r8
mov qword [rbp - 0x10], rdx
mov ebx, ecx
mov rax, qword [0x14013aa80]
xor rax, rbp
mov qword [rbp], rax
mov rax, qword [r8 + 8]
test rax, rax
mov r15d, 0x20
cmovne r15d, eax
mov rsi, rsp
mov dword [rbp - 4], r15d
lea rax, [r15 + 0xf]
and rax, 0xfffffffffffffff0
call fcn.1400d1fa0
sub rsp, rax
mov r12, rsp
mov r8, qword [r8 + 8]
test r8, r8
je 0x14003db33
mov rdx, qword [rdi]
sub rsp, 0x20
mov rcx, r12
call sub.VCRUNTIME140.dll_memcpy
add rsp, 0x20
cmp ebx, 0x4c
jne 0x14003db33
cmp r15d, 0x20
jb 0x14003db33
mov dword [r12 + 0xc], r15d
sub rsp, 0x20
lea r14, [rbp - 4]
mov ecx, ebx
mov rdx, r12
mov r8d, r15d
mov r9, r14
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
add rsp, 0x20
mov rsp, rsi
mov rsi, qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
nop word [rax + rax]
mov r13, qword [rdi + 8]
mov r12d, dword [rbp - 4]
test r13, r13
je 0x14003dbc0
cmp r13, r12
ja 0x14003dc13
sub rsp, 0x20
mov rcx, r12
call rsi
add rsp, 0x20
test rax, rax
je 0x14003dc13
mov r15, rax
mov rdx, qword [rdi]
sub rsp, 0x20
mov rcx, rax
mov r8, r13
call sub.VCRUNTIME140.dll_memcpy
add rsp, 0x20
cmp ebx, 0x4c
jne 0x14003dbd5
cmp r12d, 0x20
jb 0x14003dbd5
mov dword [r15 + 0xc], r12d
jmp 0x14003dbd5
sub rsp, 0x20
mov rcx, r12
call rsi
add rsp, 0x20
mov r15, rax
test rax, rax
je 0x14003dc13
sub rsp, 0x20
mov ecx, ebx
mov rdx, r15
mov r8d, r12d
mov r9, r14
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
add rsp, 0x20
test eax, eax
jns 0x14003dc3e
mov r12d, eax
sub rsp, 0x20
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add rsp, 0x20
cmp r12d, 0xc0000004
je 0x14003db60
xor r15d, r15d
mov rcx, qword [rbp]
xor rcx, rbp
sub rsp, 0x20
call fcn.1400d2000
add rsp, 0x20
mov rax, r15
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x14003dc16
mov eax, dword [rbp - 4]
mov qword [rcx], rax
jmp 0x14003dc16

Function at 0x14003dda0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rsi
sub rsp, 0x50
mov rax, qword [0x14013aa80]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x38], rdx
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x28], r9d
mov dword [rsp + 0x20], 0x3000
xor esi, esi
lea rdx, [rsp + 0x38]
lea r9, [rsp + 0x40]
xor r8d, r8d
call qword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
test eax, eax
js 0x14003dded
mov rsi, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400d2000
mov rax, rsi
add rsp, 0x50
pop rsi
ret

Function at 0x14003f230
Capabilities:
Create thread

Disassembly:
push rsi
sub rsp, 0x40
mov r9, rdx
mov rax, qword [rcx + 8]
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rsi, rax
mov rcx, rax
call qword [sym.imp.ntdll.dll_NtClose]
test rsi, rsi
setne al
add rsp, 0x40
pop rsi
ret
Function at 0x140047c60
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov rax, qword [0x14013aa80]
xor rax, rsp
mov qword [rsp + 0x80], rax
cmp edx, 0xffffffff
je 0x140047d8d
mov esi, edx
mov rdi, rcx
mov rax, qword [rcx + 0x40]
cmp qword [rax], 0
je 0x140047cbd
mov rax, qword [rdi + 0x58]
mov ecx, dword [rax]
test ecx, ecx
jle 0x140047cbd
dec ecx
mov dword [rax], ecx
mov rax, qword [rdi + 0x40]
mov rcx, qword [rax]
lea rdx, [rcx + 1]
mov qword [rax], rdx
mov byte [rcx], sil
jmp 0x140047dd2
cmp qword [rdi + 0x80], 0
je 0x140047d91
mov rax, qword [rdi + 0x18]
lea rcx, [rdi + 0x70]
cmp qword [rax], rcx
jne 0x140047cf7
mov ecx, dword [rdi + 0x90]
mov rdx, qword [rdi + 0x88]
mov qword [rax], rdx
mov rax, qword [rdi + 0x38]
mov qword [rax], rdx
sub ecx, edx
mov rax, qword [rdi + 0x50]
mov dword [rax], ecx
mov rcx, qword [rdi + 0x68]
test rcx, rcx
je 0x140047d98
mov byte [rsp + 0x5f], sil
lea rax, [rsp + 0x80]
lea r9, [rsp + 0x60]
lea rdx, [rdi + 0x74]
mov r10, qword [rcx]
lea r8, [rsp + 0x48]
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rax
lea r14, [rsp + 0x60]
mov qword [rsp + 0x28], r14
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea rbx, [rsp + 0x5f]
mov r8, rbx
call qword [r10 + 0x38]
mov ebp, 0xffffffff
cmp eax, 2
jae 0x140047db1
mov r15, qword [rsp + 0x48]
sub r15, r14
je 0x140047d7d
mov r9, qword [rdi + 0x80]
mov edx, 1
mov rcx, r14
mov r8, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp r15, rax
jne 0x140047dd0
mov byte [rdi + 0x71], 1
cmp qword [rsp + 0x50], rbx
mov eax, 0xffffffff
jmp 0x140047dcb
xor esi, esi
jmp 0x140047dd2
mov esi, 0xffffffff
jmp 0x140047dd2
mov rdx, qword [rdi + 0x80]
movsx ecx, sil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
cmp eax, 0xffffffff
cmove esi, eax
jmp 0x140047dd2
cmp eax, 3
jne 0x140047dd0
mov rdx, qword [rdi + 0x80]
movsx ecx, byte [rsp + 0x5f]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
cmp eax, 0xffffffff
cmove esi, eax
mov ebp, esi
mov esi, ebp
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400d2000
mov eax, esi
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140048220
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
test r8, r8
jle 0x14004825b
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0x68], 0
je 0x140048262
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
xor esi, esi
jmp 0x140048359
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x1400482b5
mov rax, qword [rbx + 0x50]
movsxd r15, dword [rax]
test r15, r15
je 0x1400482b5
cmp r15, rsi
cmovae r15, rsi
mov rcx, rdi
mov r8, r15
call sub.VCRUNTIME140.dll_memcpy
add rdi, r15
mov r14, rsi
sub r14, r15
mov rax, qword [rbx + 0x50]
sub dword [rax], r15d
mov rax, qword [rbx + 0x38]
movsxd rcx, r15d
add qword [rax], rcx
cmp qword [rbx + 0x80], 0
jne 0x1400482c6
jmp 0x140048356
mov r14, rsi
cmp qword [rbx + 0x80], 0
je 0x140048356
mov rax, qword [rbx + 0x18]
lea rcx, [rbx + 0x70]
cmp qword [rax], rcx
jne 0x1400482f2
mov ecx, dword [rbx + 0x90]
mov rdx, qword [rbx + 0x88]
mov qword [rax], rdx
mov rax, qword [rbx + 0x38]
mov qword [rax], rdx
sub ecx, edx
mov rax, qword [rbx + 0x50]
mov dword [rax], ecx
mov r15, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
nop dword [rax]
cmp r14, 0x1000
jb 0x140048331
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rdi
call r15
add rdi, rax
sub r14, rax
cmp rax, 0xfff
je 0x140048300
jmp 0x140048356
test r14, r14
je 0x140048353
mov r9, qword [rbx + 0x80]
mov edx, 1
mov rcx, rdi
mov r8, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub r14, rax
jmp 0x140048356
xor r14d, r14d
sub rsi, r14
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x140048370
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0x68], 0
je 0x1400483a6
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rbx + 0x40]
mov rcx, qword [rax]
test rcx, rcx
je 0x1400483f3
test rsi, rsi
jle 0x1400483f3
mov rax, qword [rbx + 0x58]
mov r15d, dword [rax]
test r15d, r15d
jle 0x1400483f3
cmp r15, rsi
cmovae r15, rsi
mov rdx, rdi
mov r8, r15
call sub.VCRUNTIME140.dll_memcpy
add rdi, r15
mov r14, rsi
sub r14, r15
mov rax, qword [rbx + 0x58]
sub dword [rax], r15d
mov rax, qword [rbx + 0x40]
add qword [rax], r15
test r14, r14
jg 0x1400483fb
jmp 0x14004841b
mov r14, rsi
test r14, r14
jle 0x14004841b
mov r9, qword [rbx + 0x80]
test r9, r9
je 0x14004841b
mov edx, 1
mov rcx, rdi
mov r8, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub r14, rax
sub rsi, r14
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret