joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43d5e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43d842
push rbp
mov rbp, rsp
sub rsp, 0x30
jmp 0x43d5fa
inc dword [0x004f3478]
mov ecx, dword [rax + 0x18c]
cmp dword [rax + 0x188], ecx
je 0x43d64c
dec ecx
mov dword [rax + 0x18c], ecx
movzx ecx, cl
mov rcx, qword [rax + rcx*8 + 0x190]
mov rdx, qword [0x004f3468]
nop
nop
mov qword [rcx + 0xa8], rdx
mov rdx, rcx
nop
mov qword [0x004f3468], rcx
cmp qword [0x004f3470], 0
nop
jne 0x43d5f4
nop
mov qword [0x004f3470], rdx
jmp 0x43d5f4
mov rcx, qword [rax + 0x990]
test rcx, rcx
je 0x43d697
mov rdx, qword [0x004f3468]
nop
nop
nop
mov qword [rcx + 0xa8], rdx
mov rdx, rcx
nop
mov qword [0x004f3468], rcx
cmp qword [0x004f3470], 0
jne 0x43d686
nop
mov qword [0x004f3470], rdx
inc dword [0x004f3478]
mov qword [rax + 0x990], 0
mov qword [rsp + 0x40], rax
mov rcx, qword [r14 + 0x30]
mov rcx, qword [rcx + 0xa0]
lea rbx, [rax + 0x2288]
test byte [rcx], al
add rcx, 0x2288
mov rax, rcx
call fcn.0044c4a0
cmp dword [0x00536bc4], 0
je 0x43d6e6
mov rax, qword [rsp + 0x40]
call fcn.0042ac00
mov rax, qword [rsp + 0x40]
lea rcx, [rax + 0x1248]
mov rax, rcx
call fcn.0041fe60
mov rax, qword [rsp + 0x40]
lea rcx, [rax + 0x9c0]
mov ebx, 0x400
mov rax, rcx
call fcn.0045d0c0
mov rax, qword [rsp + 0x40]
mov qword [rax + 0x9b0], 0
mov qword [rax + 0x9b8], 0x80
lea rcx, [rax + 0x9c0]
cmp dword [0x00536db0], 0
je 0x43d748
call fcn.00463e20
mov qword [r11], rcx
mov rdx, qword [rax + 0x9a8]
mov qword [r11 + 8], rdx
mov rdx, qword [rax + 0x11c8]
mov qword [r11 + 0x10], rdx
mov qword [rax + 0x9a8], rcx
mov qword [rax + 0x11c8], 0
lea rcx, [rax + 0x78]
mov ebx, 0x100
mov rax, rcx
call fcn.0045d0c0
mov rcx, qword [rsp + 0x40]
mov qword [rcx + 0x68], 0
mov qword [rcx + 0x70], 0x20
lea rdx, [rcx + 0x78]
cmp dword [0x00536db0], 0
je 0x43d79d
call fcn.00463e00
mov qword [r11], rdx
mov rax, qword [rcx + 0x60]
mov qword [r11 + 8], rax
mov qword [rcx + 0x60], rdx
lea rax, [0x0043d8c0]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rcx
lea rax, [rsp + 0x20]
mov qword [rsp], rax
nop dword [rax + rax]
call fcn.00461e00
xorps xmm15, xmm15
mov r14, qword [0x00536d98]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0x38]
lea rdx, [0x0043d860]
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], rcx
lea rcx, [rsp + 0x10]
mov qword [rsp], rcx
call fcn.00461e00
xorps xmm15, xmm15
mov r14, qword [0x00536d98]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x40]
mov qword [rax + 0x38], 0
nop
call fcn.0043d200
mov rax, qword [rsp + 0x40]
mov qword [rax + 0x1220], 0
mov dword [rax + 4], 4
add rsp, 0x30
pop rbp
ret
mov qword [rsp + 8], rax
call fcn.00461f20
mov rax, qword [rsp + 8]
jmp fcn.0043d5e0
Function at 0x440160
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x44031c
push rbp
mov rbp, rsp
sub rsp, 0x10
mov edx, dword [rax + 0x188]
mov esi, dword [rax + 0x18c]
mov rdi, qword [rax + 0x990]
mov r8d, dword [rax + 0x18c]
cmp r8d, esi
jne 0x440172
cmp esi, edx
jne 0x44030a
nop dword [rax]
test rdi, rdi
jne 0x44030a
test rbx, rbx
jne 0x4401d4
mov qword [rsp + 0x20], rax
nop
call fcn.00465aa0
xorps xmm15, xmm15
mov r14, qword [0x00536d98]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbx, qword [rsp]
mov rax, qword [rsp + 0x20]
mov edx, dword [rax + 0x22a8]
test edx, edx
jne 0x440231
mov ecx, dword [rax]
mov edx, ecx
sar edx, 0x1f
shr edx, 0x1b
add edx, ecx
mov esi, edx
and edx, 0xffffffe0
sub ecx, edx
test ecx, ecx
jl 0x440305
mov rdx, qword [0x004f1df8]
sar esi, 5
mov edi, 1
shl edi, cl
movsxd rsi, esi
cmp ecx, 0x20
sbb r8d, r8d
and r8d, edi
cmp rdx, rsi
jbe 0x4402f9
mov rdx, qword [0x004f1df0]
lea rdx, [rdx + rsi*4]
not r8d
lock and dword [rdx], r8d
mov ecx, dword [rax]
mov edx, ecx
sar edx, 0x1f
shr edx, 0x1b
add edx, ecx
mov esi, edx
and edx, 0xffffffe0
sub ecx, edx
test ecx, ecx
jl 0x4402f4
mov rdx, qword [0x004f1dd8]
sar esi, 5
mov edi, 1
shl edi, cl
movsxd rsi, esi
cmp ecx, 0x20
sbb r8d, r8d
and r8d, edi
cmp rdx, rsi
jbe 0x4402e9
mov rcx, qword [0x004f1dd0]
lea rcx, [rcx + rsi*4]
lock or dword [rcx], r8d
mov rcx, qword [0x004f3450]
mov qword [rax + 8], rcx
mov rcx, rax
nop
mov qword [0x004f3450], rax
nop
mov edx, 1
lea rsi, [0x004f3458]
lock xadd dword [rsi], edx
nop
mov rdx, qword [rcx + 0x1230]
shr rdx, 0x3d
test dl, dl
jne 0x4402d8
movabs rdx, 0x1fffffffffffffff
and rdx, rbx
bts rdx, 0x3f
nop
nop
xchg qword [rcx + 0x1230], rdx
mov rax, rbx
add rsp, 0x10
pop rbp
ret
lea rax, [0x0048087e]
mov ebx, 0x28
call fcn.0045d720
mov rax, rsi
mov rcx, rdx
call fcn.004641a0
call fcn.0042ee20
mov rax, rsi
mov rcx, rdx
nop
call fcn.004641a0
call fcn.0042ee20
lea rax, [0x0047ffa4]
mov ebx, 0x23
call fcn.0045d720
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00461f20
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00440160
Function at 0x4445e0
Capabilities:
Access peb ldr_data

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rcx, r14
test rcx, rcx
je 0x444628
mov rcx, qword [rcx + 0x30]
mov rcx, qword [rcx + 0x90]
nop dword [rax + rax]
test rcx, rcx
je 0x444628
mov qword [rsp + 0x68], rcx
nop
mov rax, qword [rdi + 0x28]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
jmp 0x444638
mov eax, 1
add rsp, 0x70
pop rbp
ret
mov rax, qword [rsp + 0x60]
mov rcx, qword [sym.imp.kernel32.dll_RtlLookupFunctionEntry]
lea rdx, [rsp + 0x58]
mov rbx, qword [rax + 0xf8]
mov qword [rsp], rcx
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], 0
call fcn.0042dc60
xorps xmm15, xmm15
mov r14, qword [0x00536d98]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
nop
test rax, rax
je 0x444711
mov rcx, qword [rsp + 0x58]
mov rdx, qword [sym.imp.kernel32.dll_RtlVirtualUnwind]
mov rbx, qword [rsp + 0x60]
mov rsi, rbx
lea rdi, [rsp + 0x50]
mov r8, qword [rsi + 0xf8]
mov qword [rsp], rdx
mov qword [rsp + 8], 0
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], 0
call fcn.0042dee0
xorps xmm15, xmm15
mov r14, qword [0x00536d98]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x68]
cmp qword [rcx], rax
ja 0x444711
cmp qword [rcx + 8], rax
ja 0x444633
mov eax, 1
add rsp, 0x70
pop rbp
ret
Function at 0x457100
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4571a3
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rdi
test byte [rax], al
lea rdx, [rax + 0x10]
mov rsi, qword [rsp + 0x68]
mov rcx, rdi
mov rax, rdx
mov rbx, rsi
call fcn.00453a40
nop
test bl, bl
je 0x45719d
mov qword [rsp + 0x18], rax
lea rcx, [0x004571e0]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp], rcx
call fcn.00461e00
xorps xmm15, xmm15
mov r14, qword [0x00536d98]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x18]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00461f20
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00457100

Function at 0x45f5c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x45f737
movzx edx, byte [rax]
test edx, edx
jne 0x45f5f4
nop dword [rax]
test r8b, r8b
jne 0x45f5f4
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
add rsp, 0x10
pop rbp
ret
bt edx, 7
jae 0x45f607
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x45f6f7
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
nop dword [rax]
cmp rbx, r8
jb 0x45f6e5
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and r8, rdx
lea rdx, [rax + r8]
test rbx, rbx
jbe 0x45f6d7
movzx esi, byte [rax + r8]
bt esi, 7
jae 0x45f65d
xor eax, eax
xor esi, esi
xor r8d, r8d
jmp 0x45f6a0
mov eax, 1
cmp rax, rbx
ja 0x45f68b
add qword [rdi], rsi
sub rcx, rax
sub rbx, rax
mov rsi, rcx
neg rsi
sar rsi, 0x3f
and rax, rsi
add rax, rdx
mov edi, 1
add rsp, 0x10
pop rbp
ret
mov rcx, rbx
call fcn.00464260
lea r8d, [rcx + 7]
mov rcx, r11
mov eax, r12d
nop dword [rax]
cmp rax, rbx
jae 0x45f6cf
movzx r9d, byte [rax + rdx]
mov r10d, r9d
and r9d, 0x7f
mov r11, rcx
mov ecx, r8d
shl r9d, cl
lea r12d, [rax + 1]
or esi, r9d
test r10b, 0x80
jne 0x45f693
mov rcx, r11
mov eax, r12d
jmp 0x45f662
mov rcx, rbx
call fcn.004641a0
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.004641a0
mov eax, r8d
mov rcx, rbx
call fcn.00464260
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x45f72d
movzx r10d, byte [rdx + rax]
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
inc edx
or r8d, r10d
test r11b, 0x80
jne 0x45f6f0
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x45f60d
mov eax, edx
mov rcx, rbx
call fcn.004641a0
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.004641a0
nop
int3
Function at 0x460820
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4608cf
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [0x00451100]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.00461e00
xorps xmm15, xmm15
mov r14, qword [0x00536d98]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00461f20
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.00460820
Function at 0x465ae0
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x465b14
mov rcx, 0x28
jmp 0x465b1f
shl rcx, 3
add rcx, 0x1480
mov qword [0x00536d98], rcx
pop rbp
ret

Function at 0x140f3a058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140f3a1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140f3a089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140f3a06f
add dl, dl
jne 0x140f3a096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140f3a0f6
xor eax, eax
add dl, dl
jne 0x140f3a0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140f3a1ad
add dl, dl
jne 0x140f3a0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f3a0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f3a0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f3a0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140f3a0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140f3a07e
mov eax, 1
add dl, dl
jne 0x140f3a106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f3a113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140f3a0fb
sub eax, ebx
mov ebx, 1
jne 0x140f3a14c
mov ecx, 1
add dl, dl
jne 0x140f3a12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140f3a13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140f3a123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140f3a07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140f3a168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140f3a175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140f3a15d
cmp eax, 0x7d00
jae 0x140f3a19b
cmp eax, 0x500
jb 0x140f3a196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140f3a07e
cmp eax, 0x7f
ja 0x140f3a19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140f3a07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140f3a1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140f3a07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14110a058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x14110a1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14110a089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14110a06f
add dl, dl
jne 0x14110a096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14110a0f6
xor eax, eax
add dl, dl
jne 0x14110a0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14110a1ad
add dl, dl
jne 0x14110a0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14110a0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14110a0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14110a0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14110a0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14110a07e
mov eax, 1
add dl, dl
jne 0x14110a106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14110a113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14110a0fb
sub eax, ebx
mov ebx, 1
jne 0x14110a14c
mov ecx, 1
add dl, dl
jne 0x14110a12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14110a13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14110a123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14110a07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14110a168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14110a175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14110a15d
cmp eax, 0x7d00
jae 0x14110a19b
cmp eax, 0x500
jb 0x14110a196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14110a07e
cmp eax, 0x7f
ja 0x14110a19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14110a07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14110a1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14110a07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140011055
Capabilities:
Enumerate process modules

Disassembly:
jmp 0x1400191c0
mov qword [rsp + 8], rcx
push rbp
push rdi
mov eax, 0x1c58
call fcn.14001123a
sub rsp, rax
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x58e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1c78]
mov rax, qword [0x140034040]
xor rax, rbp
mov qword [rbp + 0x1c28], rax
lea rcx, [0x14003c107]
call fcn.140011bae
nop
lea rax, [rbp + 0x10]
mov rdi, rax
xor eax, eax
mov ecx, 0x1400
rep stosb byte [rdi], al
mov dword [rbp + 0x1424], 0
lea r8, [rbp + 0x1424]
mov edx, 0x1400
lea rcx, [rbp + 0x10]
call fcn.1400114c4
mov dword [rbp + 0x1444], eax
mov eax, dword [rbp + 0x1424]
xor edx, edx
mov ecx, 4
div rcx
mov dword [rbp + 0x1464], eax
mov dword [rbp + 0x1484], 0
jmp 0x140019275
mov eax, dword [rbp + 0x1484]
inc eax
mov dword [rbp + 0x1484], eax
mov eax, dword [rbp + 0x1464]
cmp dword [rbp + 0x1484], eax
jae 0x14001931b
mov eax, dword [rbp + 0x1484]
mov r8d, dword [rbp + rax*4 + 0x10]
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x14a8], rax
cmp qword [rbp + 0x14a8], 0
je 0x140019316
lea rax, [rbp + 0x14d0]
mov rdi, rax
xor eax, eax
mov ecx, 0x104
rep stosb byte [rdi], al
mov dword [rbp + 0x15f4], 0x104
lea r9, [rbp + 0x15f4]
lea r8, [rbp + 0x14d0]
xor edx, edx
mov rcx, qword [rbp + 0x14a8]
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameA]
mov dword [rbp + 0x1614], eax
mov rdx, qword [rbp + 0x1c50]
lea rcx, [rbp + 0x14d0]
call fcn.140011a55
movzx eax, al
test eax, eax
je 0x140019316
mov eax, dword [rbp + 0x1484]
mov eax, dword [rbp + rax*4 + 0x10]
jmp 0x14001931d
jmp 0x140019267
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14002d950]
call fcn.1400119b0
mov rax, rdi
mov rcx, qword [rbp + 0x1c28]
xor rcx, rbp
call fcn.14001159b
lea rsp, [rbp + 0x1c38]
pop rdi
pop rbp
ret
Function at 0x1400111ea
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
jmp 0x1400193b0
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x1a8
lea rbp, [rsp + 0x40]
lea rcx, [0x14003c107]
call fcn.140011bae
nop
mov dword [rbp + 4], 0
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x68], 0
mov r8d, dword [rbp + 0x180]
xor edx, edx
mov ecx, 0x42a
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
jne 0x140019417
jmp 0x14001952e
mov rcx, qword [rbp + 0x188]
call fcn.140011523
inc rax
mov dword [rsp + 0x20], 4
mov r9d, 0x1000
mov r8, rax
xor edx, edx
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rbp + 0x68], rax
cmp qword [rbp + 0x68], 0
jne 0x140019453
jmp 0x14001952e
mov rcx, qword [rbp + 0x188]
call fcn.140011523
inc rax
mov qword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rbp + 0x188]
mov rdx, qword [rbp + 0x68]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x14001948c
jmp 0x14001952e
lea rcx, str.Kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.LoadLibraryA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jne 0x1400194bc
jmp 0x14001952e
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rbp + 0x68]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x88]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0
jne 0x1400194f9
jmp 0x14001952e
cmp qword [rbp + 0x48], 0
je 0x14001950b
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp qword [rbp + 0x28], 0
je 0x14001951d
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov dword [rbp + 4], 1
xor eax, eax
test eax, eax
jne 0x1400193f3
mov eax, dword [rbp + 4]
lea rsp, [rbp + 0x168]
pop rdi
pop rbp
ret

Function at 0x140011686
Capabilities:
Terminate process

Disassembly:
jmp 0x1400246c0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret
Function at 0x140011799
Capabilities:
Get geographical location

Disassembly:
jmp 0x14001f480
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x58
mov r9d, 2
lea r8, [rsp + 0x40]
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x14001f4bd
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x40]
mov r8d, dword [rsp + 0x60]
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x48]
mov edx, eax
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax]
call fcn.140011b9f
add rsp, 0x58
ret
Function at 0x1400117fd
Capabilities:
Parse pe header

Disassembly:
jmp 0x140025a10
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140025a30
xor al, al
jmp 0x140025ab1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140025a43
xor al, al
jmp 0x140025ab1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140025a6d
xor al, al
jmp 0x140025ab1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140025a81
xor al, al
jmp 0x140025ab1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140025a93
xor al, al
jmp 0x140025ab1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140025aaf
xor al, al
jmp 0x140025ab1
mov al, 1
add rsp, 0x38
ret
Function at 0x140023300
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.140011c21
movzx eax, al
test eax, eax
jne 0x140023320
mov ecx, 7
call fcn.1400119c4
nop
mov byte [rsp + 0x20], 0
call fcn.140011a0a
mov byte [rsp + 0x21], al
cmp dword [0x140034cd8], 1
jne 0x140023344
mov ecx, 7
call fcn.1400119c4
nop
jmp 0x14002339c
cmp dword [0x140034cd8], 0
jne 0x140023397
mov dword [0x140034cd8], 1
lea rdx, [0x14002c660]
lea rcx, [0x14002c330]
call fcn.140011573
test eax, eax
je 0x140023378
mov eax, 0xff
jmp 0x1400234a1
lea rdx, [0x14002c220]
lea rcx, [section..rdata]
call fcn.1400119f1
mov dword [0x140034cd8], 2
jmp 0x14002339c
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.140011997
call fcn.140011843
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x1400233f9
mov rcx, qword [rsp + 0x30]
call fcn.14001147e
movzx eax, al
test eax, eax
je 0x1400233f9
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x14003d020]
nop
call fcn.1400118cf
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x14002342d
mov rcx, qword [rsp + 0x38]
call fcn.14001147e
movzx eax, al
test eax, eax
je 0x14002342d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.140011b6d
nop
call fcn.140023550
mov dword [rsp + 0x28], eax
call fcn.1400117fd
movzx eax, al
test eax, eax
jne 0x14002344c
mov ecx, dword [rsp + 0x28]
call fcn.140011104
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x14002345b
call fcn.140011b8b
nop
xor edx, edx
mov cl, 1
call fcn.140011429
mov eax, dword [rsp + 0x28]
jmp 0x1400234a1
add rsp, 0x68
ret