joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007e000
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rdi, rcx
lea r14, [0x140000000]
mov ecx, dword [rcx + 0xa8]
mov eax, ecx
and eax, 0xfff0000
cmp eax, 0x3ff0000
je 0x14007e0b8
bt ecx, 0x10
jb 0x14007e058
movzx eax, byte [rdi + 0xbd]
test byte [rax + r14 + 0x110810], 0x60
jne 0x14007e058
mov rcx, rdi
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp fcn.14007d9c0
mov eax, ecx
and eax, 0xb0000
cmp eax, 0xb0000
je 0x14007e094
movzx edx, byte [rdi + 0xbd]
movzx eax, byte [rdx + r14 + 0x110810]
and al, 0x60
cmp al, 0x40
jne 0x14007e094
cmp dl, 0x47
je 0x14007e094
mov rcx, rdi
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp fcn.14007a710
and ecx, 0x110000
cmp ecx, 0x110000
je 0x14007e0b8
movzx eax, byte [rdi + 0xbd]
movzx eax, byte [rax + r14 + 0x110810]
and al, 0x60
cmp al, 0x60
je 0x14007e081
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbp
mov ebp, 0x7ffd
mov qword [rsp + 0x40], rsi
nop dword [rax]
movzx r8d, byte [rdi + 0xbd]
movzx ecx, word [rdi + 0xb8]
mov r9d, dword [rdi + 0x28]
shl r8d, 0x11
cmp ecx, r9d
jb 0x14007e120
mov r10, qword [rdi + 0x20]
lea rdx, [rcx*8]
movzx eax, byte [rdx + r10 + 5]
shl eax, 0xa
add r8d, eax
mov rax, qword [rdx + r10]
mov qword [rdi + 0xc0], rax
cmp cx, bp
jae 0x14007e120
mov rax, qword [rdx + r10 + 8]
mov qword [rdi + 0xc8], rax
movzx edx, word [rdi + 0xba]
cmp edx, r9d
jb 0x14007e154
mov r9, qword [rdi + 0x20]
mov rax, qword [r9 + rdx*8]
movzx ecx, byte [r9 + rdx*8 + 5]
mov qword [rdi + 0xd0], rax
cmp dx, bp
jae 0x14007e15c
mov rax, qword [r9 + rdx*8 + 8]
mov qword [rdi + 0xd8], rax
jmp 0x14007e15c
mov ecx, edx
and ecx, 0x3ff
lea esi, [rcx + r8]
xor ebx, ebx
nop dword [rax]
nop word [rax + rax]
mov r8d, ebx
mov eax, 0x5e1d27b
and r8d, 0x1ffff
or r8d, esi
mov ecx, r8d
ror ecx, 0xb
sub ecx, r8d
rol ecx, 0xe
mul ecx
mov eax, ecx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 9
imul eax, eax, 0x3e9
sub ecx, eax
mov edx, dword [r14 + rcx*4 + 0x111390]
mov eax, edx
and eax, 0xffffff
cmp eax, r8d
je 0x14007e1ce
lea eax, [rcx + 1]
mov edx, dword [r14 + rax*4 + 0x111390]
mov eax, edx
and eax, 0xffffff
cmp eax, r8d
jne 0x14007e1e6
mov eax, edx
mov rcx, rdi
shr rax, 0x18
call qword [r14 + rax*8 + 0x110ea0]
movzx edx, ax
test edx, edx
jne 0x14007e200
cmp ebx, 0xfffff
je 0x14007e223
mov eax, ebx
shr eax, 0xa
or ebx, eax
xor ebx, 0xffc00
jmp 0x14007e170
cmp edx, 5
jae 0x14007e239
cmp edx, 1
je 0x14007e0d0
cmp edx, 2
jne 0x14007e22d
mov edx, dword [rdi + 0xb8]
mov rcx, rdi
call fcn.14007ab80
jmp 0x14007e247
mov rcx, rdi
call fcn.14007d9c0
jmp 0x14007e247
cmp edx, 3
je 0x14007e262
mov eax, 0xffff
jmp 0x14007e247
mov rax, qword [rdi + 0x20]
movzx eax, byte [rax + rdx*8 + 4]
shl eax, 0x18
add eax, edx
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov edx, 0x18
mov rcx, rdi
call fcn.1400877d0
int3
Function at 0x14007e640
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
movzx eax, byte [rcx + 0xd4]
lea rsi, [rcx + 0xb8]
movzx r12d, word [rsi]
and al, 0x1f
mov r15, rcx
cmp al, 0xe
jne 0x14007e6a8
movzx edx, word [rcx + 0x208]
cmp edx, r12d
jbe 0x14007e6a8
movzx eax, word [rcx + 0x226]
cmp eax, r12d
jbe 0x14007e6a8
nop
cmp eax, edx
jb 0x14007e7fb
mov ecx, eax
mov rax, qword [r15 + 0x20]
movzx eax, word [rax + rcx*8 + 6]
cmp eax, r12d
ja 0x14007e690
movzx eax, word [r15 + 0x228]
cmp eax, r12d
jbe 0x14007e7ff
mov rbx, qword [r15 + 0x20]
mov ebp, 0x8000
mov dword [rsp + 0x50], ebp
nop word [rax + rax]
lea r13, [rbx + rax*8]
movzx eax, word [rbx + rax*8]
movzx ecx, word [rbx + rax*8 + 2]
lea rdx, [rbx + rax*8]
cmp rsi, rdx
je 0x14007e7fb
movzx r9d, word [rsi + 2]
cmp byte [rbx + r9*8 + 5], 0x1e
lea r8, [rbx + r9*8]
jne 0x14007e703
movzx r9d, word [r8]
lea r8, [rbx + r9*8]
cmp byte [rbx + rcx*8 + 5], 0x1e
lea r10, [rbx + rcx*8]
jne 0x14007e716
movzx ecx, word [r10]
lea r10, [rbx + rcx*8]
movzx r11d, byte [rsi + 5]
lea eax, [r11 - 0x38]
cmp al, 1
jbe 0x14007e728
movzx eax, word [rsi]
jmp 0x14007e72f
movzx eax, word [rsi]
movzx eax, word [rbx + rax*8]
movzx r14d, ax
movzx eax, byte [rdx + 5]
sub al, 0x38
cmp al, 1
jbe 0x14007e742
movzx eax, word [rdx]
jmp 0x14007e749
movzx eax, word [rdx]
movzx eax, word [rbx + rax*8]
movzx edi, ax
cmp r9d, ecx
je 0x14007e7d0
cmp r9d, ebp
jae 0x14007e75e
cmp ecx, ebp
jb 0x14007e7e7
cmp r11b, 0x38
jne 0x14007e7c3
xor r11d, r11d
xor edx, edx
cmp byte [r8 + 5], 0x29
mov ebp, r9d
jne 0x14007e790
movzx eax, word [r8 + 2]
cmp ax, word [rsp + 0x50]
jae 0x14007e790
movzx ebp, word [r8]
mov r11d, dword [rbx + rax*8]
cmp ebp, ecx
jne 0x14007e790
test r11d, r11d
jne 0x14007e7e7
cmp byte [r10 + 5], 0x29
jne 0x14007e7b8
movzx eax, word [r10 + 2]
mov r8d, 0x8000
cmp ax, r8w
jae 0x14007e7b8
movzx ecx, word [r10]
mov edx, dword [rbx + rax*8]
cmp r9d, ecx
jne 0x14007e7b8
test edx, edx
jne 0x14007e7e7
cmp ebp, ecx
jne 0x14007e7d0
cmp r11d, edx
je 0x14007e7d0
jmp 0x14007e7e7
movzx eax, byte [r10 + 4]
xor al, byte [r8 + 4]
test al, 0x1f
jne 0x14007e7e7
cmp r14d, edi
je 0x14007e7fb
mov r8d, edi
mov edx, r14d
mov rcx, r15
call fcn.140047990
test eax, eax
jne 0x14007e7fb
movzx eax, word [r13 + 6]
cmp eax, r12d
jbe 0x14007e7ff
mov ebp, 0x8000
jmp 0x14007e6d0
xor eax, eax
jmp 0x14007e804
mov eax, 1
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140089720
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
movzx eax, byte [rdx]
xor r15d, r15d
mov rbp, r9
mov r14, r8
mov rbx, rdx
mov rsi, rcx
mov edi, 0xa
test al, al
je 0x140089785
movsx edx, al
inc rbx
cmp edx, 0x66
je 0x14008976c
cmp edx, 0x69
je 0x140089859
cmp edx, 0x6c
jne 0x14008977e
mov rax, qword [rsi + 0x10]
mov rcx, rsi
mov dword [rax + 0xefc], edx
call fcn.140087c10
movzx eax, byte [rbx]
test al, al
jne 0x140089753
cmp qword [0x1401370d0], r15
je 0x1400897a3
mov rcx, rsi
call sym.luvi.exe_luaJIT_profile_stop
cmp qword [0x1401370d0], r15
jne 0x1400898cc
cmp qword [0x140137118], r15
mov rax, qword [rsi + 0x10]
mov qword [0x1401370d0], rax
mov dword [0x140137108], edi
mov qword [0x1401370d8], r14
mov qword [0x1401370e0], rbp
mov dword [0x14013710c], r15d
mov qword [0x140137100], rsi
mov qword [0x1401370f8], r15
mov qword [0x1401370f0], r15
mov qword [0x1401370e8], r15
jne 0x14008988f
xor r8d, r8d
lea rcx, str.winmm.dll
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov qword [0x140137118], rax
test rax, rax
je 0x14008988f
lea rdx, str.timeBeginPeriod
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140137118]
lea rdx, str.timeEndPeriod
mov qword [0x140137120], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [0x140137120], r15
mov qword [0x140137128], rax
je 0x140089850
test rax, rax
jne 0x14008988f
mov qword [0x140137118], r15
jmp 0x1400898cc
movzx eax, byte [rbx]
mov edi, r15d
cmp al, 0x30
jl 0x140089885
cmp al, 0x39
ja 0x14008987d
inc rbx
movzx ecx, al
lea edi, [rdi + rdi*4]
lea edi, [rdi - 0x18]
movzx eax, byte [rbx]
lea edi, [rcx + rdi*2]
cmp al, 0x30
jge 0x140089863
test edi, edi
jg 0x14008977e
mov edi, 1
jmp 0x14008977e
lea rcx, [0x140137130]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea r9, [0x1401370d0]
mov qword [rsp + 0x28], r15
lea r8, [0x140095390]
mov dword [0x140137160], r15d
xor edx, edx
mov dword [rsp + 0x20], r15d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x140137158], rax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x140090ed0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r12
push r14
push r15
sub rsp, 0x20
mov r10, qword [rcx + 0x20]
mov esi, r9d
movzx r14d, dx
mov r12d, r8d
mov r9d, edx
mov rbp, rcx
movzx r15d, byte [r10 + r14*8 + 5]
cmp r15d, 0x35
jb 0x14009100f
cmp r15d, r8d
jg 0x14009100f
xor edx, edx
add rcx, 0xb24
nop word [rax + rax]
cmp word [rcx], r14w
jne 0x140090f3a
mov eax, dword [rcx + 4]
cmp eax, esi
jb 0x140090f3a
xor eax, esi
test eax, 0xfff
je 0x140090ffe
inc rdx
add rcx, 8
cmp rdx, 0x10
jl 0x140090f20
movzx edx, word [r10 + r14*8]
mov r9d, esi
mov qword [rsp + 0x40], rbx
mov rcx, rbp
movzx ebx, word [r10 + r14*8 + 2]
mov qword [rsp + 0x48], rdi
call fcn.140090ed0
mov r9d, esi
mov r8d, r12d
mov edx, ebx
mov rcx, rbp
mov edi, eax
call fcn.140090ed0
mov ecx, 0xf4
mov word [rbp + 0xb8], di
add r15w, cx
mov word [rbp + 0xba], ax
movzx edx, r15w
mov ecx, 0x100
imul edx, ecx
mov r8d, esi
shr r8d, 5
mov rcx, rbp
and r8w, 0x1f
or r8w, dx
mov word [rbp + 0xbc], r8w
call fcn.14007e000
mov ecx, dword [rbp + 0xba4]
mov r9d, eax
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
lea rdx, [rcx*8]
lea eax, [rcx + 1]
and eax, 0xf
mov dword [rbp + 0xba4], eax
mov word [rdx + rbp + 0xb24], r14w
mov word [rdx + rbp + 0xb26], r9w
mov dword [rdx + rbp + 0xb28], esi
jmp 0x140091050
movzx ecx, word [rcx + 2]
movzx eax, byte [r10 + rcx*8 + 4]
shl eax, 0x18
add eax, ecx
jmp 0x140091053
bt esi, 0xb
jae 0x140091050
movzx ecx, byte [r10 + r14*8 + 4]
mov edx, 0x605fd9
and ecx, 0x1f
shr edx, cl
test dl, 1
jne 0x140091050
mov eax, 0x5b15
mov word [rbp + 0xb8], r14w
mov rcx, rbp
mov word [rbp + 0xbc], ax
mov word [rbp + 0xba], si
call fcn.14007e000
mov r9d, eax
mov eax, r9d
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x140091180
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
xor r11d, r11d
mov r10d, edx
mov edi, r8d
mov rbx, rcx
mov esi, 0xffffffff
test edx, edx
jne 0x1400911c1
mov eax, dword [rcx]
test eax, eax
je 0x1400911b1
bsf ecx, eax
cmp ecx, r8d
jb 0x1400911bb
mov ecx, r8d
shr eax, cl
mov dword [rbx], eax
xor eax, eax
mov rbx, qword [rsp + 0x30]
pop rdi
pop rsi
ret
shr eax, cl
mov dword [rbx], eax
sub edi, ecx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], r14
mov qword [rsp + 0x28], r15
mov r15d, 1
cmp edi, 0x12
jbe 0x140091263
mov edx, r9d
and r9b, 0x30
shr edx, 0x18
lea r8d, [rdx - 1]
cmp r9b, 0x20
jne 0x14009120f
mov eax, 0x38e38e39
mov r14d, 0x3f
imul r8d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
sub r14d, edx
jmp 0x140091270
bsr ecx, dword [rbx + r10*4]
imul eax, r10d, 0x1d
mov esi, r10d
sub eax, edi
add eax, ecx
mov ecx, r15d
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mulsd xmm0, qword [0x140114c40]
cvttsd2si eax, xmm0
sub ecx, eax
mov eax, 0x38e38e39
sub ecx, edx
imul ecx
mov eax, r8d
sar edx, 1
mov r14d, edx
add edx, 0x3e
shr r14d, 0x1f
add r14d, edx
cdq
and edx, 7
add eax, edx
sar eax, 3
sub esi, eax
add esi, 0x3d
jmp 0x140091270
mov r14d, esi
cmp edi, 9
jb 0x14009130d
nop
mov ecx, dword [rbx + r10*4]
mov r8d, r10d
mov eax, ecx
and ecx, 0x1ff
shr eax, 9
imul r9d, ecx, 0x1dcd65
mov dword [rbx + r10*4], eax
cmp r10d, r11d
je 0x1400912c9
nop dword [rax]
nop word [rax + rax]
dec r8d
and r8d, 0x3f
mov edx, dword [rbx + r8*4]
mov eax, edx
shr eax, 9
and edx, 0x1ff
add eax, r9d
imul r9d, edx, 0x1dcd65
mov dword [rbx + r8*4], eax
cmp r8d, r11d
jne 0x1400912a0
cmp r11d, r14d
je 0x1400912ec
cmp r11d, esi
je 0x1400912ec
test r9d, r9d
je 0x1400912e3
dec r11d
and r11d, 0x3f
mov dword [rbx + r11*4], r9d
cmp dword [rbx + r10*4], 0
jne 0x140091301
jmp 0x1400912f8
cmp dword [rbx + r10*4], 0
jne 0x140091301
cmp r10d, r11d
je 0x140091377
dec r10d
and r10d, 0x3f
dec esi
add edi, 0xfffffff7
cmp edi, 9
jae 0x140091270
test edi, edi
je 0x140091377
mov r9d, dword [rbx + r10*4]
mov ecx, edi
mov eax, r9d
shl r15d, cl
dec r15d
shr eax, cl
and r9d, r15d
mov dword [rbx + r10*4], eax
mov esi, 0x3b9aca00
sar esi, cl
imul r9d, esi
cmp r10d, r11d
je 0x140091367
nop dword [rax]
dec r10d
mov ecx, edi
and r10d, 0x3f
mov edx, dword [rbx + r10*4]
mov eax, edx
shr eax, cl
add eax, r9d
mov r9d, edx
and r9d, r15d
mov dword [rbx + r10*4], eax
imul r9d, esi
cmp r10d, r11d
jne 0x140091340
test r9d, r9d
je 0x140091377
dec r11d
and r11d, 0x3f
mov dword [rbx + r11*4], r9d
mov r14, qword [rsp + 0x20]
mov eax, r11d
mov rbp, qword [rsp + 0x18]
mov r15, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
pop rdi
pop rsi
ret
Function at 0x1400a9050
Capabilities:
Set socket configuration

Disassembly:
mov r8, rdx
mov edx, 0x1002
jmp 0x1400b4a60

Function at 0x1400a9100
Capabilities:
Set socket configuration

Disassembly:
mov r8, rdx
mov edx, 0x1001
jmp 0x1400b4a60
sub rsp, 0x38
test rcx, rcx
je 0x1400b4aed
test r8, r8
je 0x1400b4aed
mov eax, dword [rcx + 0x10]
cmp eax, 0xc
jne 0x1400b4a83
mov rcx, qword [rcx + 0x110]
jmp 0x1400b4a8c
cmp eax, 0xf
jne 0x1400b4ae3
mov rcx, qword [rcx + 0x70]
cmp dword [r8], 0
mov r9, r8
mov r8d, edx
mov dword [rsp + 0x40], 4
mov edx, 0xffff
jne 0x1400b4ab7
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_getsockopt]
jmp 0x1400b4ac5
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x1400b4adc
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.1400b5700
add rsp, 0x38
ret
xor eax, eax
add rsp, 0x38
ret
mov eax, 0xfffff02f
add rsp, 0x38
ret
mov eax, 0xfffff019
add rsp, 0x38
ret

Function at 0x1400a9b80
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push r15
sub rsp, 0x20
mov r14, rdx
mov r15, rcx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
test eax, eax
je 0x1400a9be5
mov ecx, esi
add rcx, rcx
call fcn.1400a8170
mov rdi, rax
test rax, rax
je 0x1400a9c35
mov rdx, rax
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ebx, eax
test eax, eax
je 0x1400a9bd7
cmp eax, esi
jb 0x1400a9c0d
mov rcx, rdi
call fcn.1400a7f70
mov esi, ebx
test ebx, ebx
jne 0x1400a9bb0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400b5700
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
lea ecx, [rax - 1]
cmp word [rdi + rcx*2], 0x5c
jne 0x1400a9c2b
cmp ebx, 3
jne 0x1400a9c23
cmp word [rdi + 2], 0x3a
je 0x1400a9c2b
xor edx, edx
mov ebx, ecx
mov word [rdi + rcx*2], dx
mov qword [r15], rdi
xor eax, eax
mov dword [r14], ebx
jmp 0x1400a9bf2
mov eax, 0xfffff027
jmp 0x1400a9bf2
Function at 0x1400a9d50
Capabilities:
Get common file path
Get session user name

Disassembly:
push rbx
sub rsp, 0x260
mov rax, qword [0x140136348]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
test rcx, rcx
jne 0x1400a9d7d
mov eax, 0xfffff019
jmp 0x1400a9f32
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x28]
mov edx, 0x20008
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1400a9dac
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400b5700
jmp 0x1400a9f32
mov rcx, qword [rsp + 0x28]
lea r8, [rsp + 0x20]
mov qword [rsp + 0x250], r14
xor edx, edx
xor r14d, r14d
mov dword [rsp + 0x20], r14d
call qword [sym.imp.USERENV.dll_GetUserProfileDirectoryW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x1400a9df8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x28]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, ebx
call fcn.1400b5700
jmp 0x1400a9f2a
mov ecx, dword [rsp + 0x20]
add rcx, rcx
mov qword [rsp + 0x258], rdi
call fcn.1400a8170
mov rcx, qword [rsp + 0x28]
mov rdi, rax
test rax, rax
jne 0x1400a9e29
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xfffff027
jmp 0x1400a9f22
lea r8, [rsp + 0x20]
mov rdx, rdi
call qword [sym.imp.USERENV.dll_GetUserProfileDirectoryW]
test eax, eax
jne 0x1400a9e62
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x28]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call fcn.1400a7f70
mov ecx, ebx
call fcn.1400b5700
jmp 0x1400a9f22
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x101
lea rcx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x1400a9ea5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
mov ebx, eax
call fcn.1400a7f70
cmp ebx, 0x7a
jne 0x1400a9e56
mov eax, 0xfffff027
jmp 0x1400a9f22
mov qword [rsp + 0x278], rbp
lea r8, [rbx + 0x18]
mov edx, 0xffffffff
mov qword [rsp + 0x280], rsi
mov rcx, rdi
mov qword [rbx + 0x18], r14
call fcn.1400a99b0
mov rcx, rdi
mov ebp, eax
call fcn.1400a7f70
test ebp, ebp
je 0x1400a9edc
mov eax, ebp
jmp 0x1400a9f12
mov r8, rbx
mov qword [rbx], r14
mov edx, 0xffffffff
lea rcx, [rsp + 0x30]
call fcn.1400a99b0
mov edi, eax
test eax, eax
je 0x1400a9f04
mov rcx, qword [rbx + 0x18]
call fcn.1400a7f70
mov eax, edi
jmp 0x1400a9f12
mov qword [rbx + 0x10], r14
xor eax, eax
mov qword [rbx + 8], 0xffffffffffffffff
mov rsi, qword [rsp + 0x280]
mov rbp, qword [rsp + 0x278]
mov rdi, qword [rsp + 0x258]
mov r14, qword [rsp + 0x250]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1400cb6d0
add rsp, 0x260
pop rbx
ret

Function at 0x1400aa000
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
sub rsp, 0x28
test rdx, rdx
je 0x1400aa01c
call sub.ADVAPI32.dll_SystemFunction036
test al, al
jne 0x1400aa01c
mov eax, 0xfffff01a
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret
Function at 0x1400aa080
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x40]
mov ecx, 1
cmp eax, ecx
cmovb eax, ecx
add rsp, 0x58
ret

Function at 0x1400aa0b0
Capabilities:
Set current directory
Set environment variable

Disassembly:
push rdi
sub rsp, 0x50
mov rax, qword [0x140136348]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, rcx
test rcx, rcx
jne 0x1400aa0e5
mov eax, 0xfffff019
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400cb6d0
add rsp, 0x50
pop rdi
ret
mov qword [rsp + 0x70], rbp
mov r8, rdi
xor ebp, ebp
mov qword [rsp + 0x78], rsi
mov dword [rsp + 0x28], ebp
xor edx, edx
mov ecx, 0xfde9
mov qword [rsp + 0x20], rbp
lea r9d, [rbp - 1]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, eax
mov dword [rsp + 0x30], esi
test eax, eax
jne 0x1400aa12a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400b5700
jmp 0x1400aa21c
mov rcx, rsi
mov qword [rsp + 0x68], rbx
add rcx, rcx
call fcn.1400a8170
mov rbx, rax
test rax, rax
jne 0x1400aa14c
mov eax, 0xfffff027
jmp 0x1400aa217
mov dword [rsp + 0x28], esi
mov r9d, 0xffffffff
mov r8, rdi
mov qword [rsp + 0x20], rbx
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rcx, rbx
test eax, eax
je 0x1400aa17f
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov rcx, rbx
test eax, eax
jne 0x1400aa196
call fcn.1400a7f70
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400b5700
jmp 0x1400aa217
call fcn.1400a7f70
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x38], rbp
lea rcx, [rsp + 0x38]
call fcn.1400a9b80
cmp eax, 0xfffff027
je 0x1400aa215
test eax, eax
js 0x1400aa217
cmp dword [rsp + 0x30], 2
mov rbx, qword [rsp + 0x38]
jb 0x1400aa20d
cmp word [rbx + 2], 0x3a
jne 0x1400aa20d
movzx ecx, word [rbx]
lea eax, [rcx - 0x41]
cmp ax, 0x19
jbe 0x1400aa1e8
lea eax, [rcx - 0x61]
cmp ax, 0x19
ja 0x1400aa20d
sub cx, 0x20
je 0x1400aa20d
mov eax, 0x3d
mov word [rsp + 0x42], cx
lea rcx, [rsp + 0x40]
mov word [rsp + 0x40], ax
mov rdx, rbx
mov dword [rsp + 0x44], 0x3a
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, rbx
call fcn.1400a7f70
xor eax, eax
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400cb6d0
add rsp, 0x50
pop rdi
ret
Function at 0x1400aa5f0
Capabilities:
Get common file path

Disassembly:
push rbp
push r14
sub rsp, 0x48
mov r14, rdx
mov rbp, rcx
test rcx, rcx
je 0x1400aa787
test rdx, rdx
je 0x1400aa787
mov qword [rsp + 0x68], rbx
xor edx, edx
mov qword [rsp + 0x70], rsi
xor ecx, ecx
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x40], r15
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor r15d, r15d
mov esi, eax
test eax, eax
je 0x1400aa67d
nop word [rax + rax]
mov ecx, esi
add rcx, rcx
call fcn.1400a8170
mov rdi, rax
test rax, rax
je 0x1400aa711
mov rdx, rax
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ebx, eax
test eax, eax
je 0x1400aa66f
cmp eax, esi
jb 0x1400aa6f5
mov rcx, rdi
call fcn.1400a7f70
mov esi, ebx
test ebx, ebx
jne 0x1400aa640
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400b5700
test eax, eax
js 0x1400aa6d9
mov rdi, qword [rsp + 0x60]
mov qword [rsp + 0x38], r15
mov r9d, 0xffffffff
mov qword [rsp + 0x30], r15
mov r8, rdi
mov dword [rsp + 0x28], r15d
xor edx, edx
mov ecx, 0xfde9
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rbx, eax
test eax, eax
jne 0x1400aa718
mov rcx, rdi
call fcn.1400a7f70
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400b5700
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x68]
mov r15, qword [rsp + 0x40]
add rsp, 0x48
pop r14
pop rbp
ret
dec eax
cmp word [rdi + rax*2], 0x5c
jne 0x1400aa693
cmp ebx, 3
jne 0x1400aa70a
cmp word [rdi + 2], 0x3a
je 0x1400aa693
mov word [rdi + rax*2], r15w
jmp 0x1400aa693
mov eax, 0xfffff027
jmp 0x1400aa6d9
mov eax, dword [r14]
cmp ebx, eax
jle 0x1400aa731
mov rcx, rdi
call fcn.1400a7f70
mov eax, 0xfffff024
mov qword [r14], rbx
jmp 0x1400aa6d9
mov edx, 0x7fffffff
mov qword [rsp + 0x38], r15
cmp qword [r14], rdx
mov r9d, 0xffffffff
mov qword [rsp + 0x30], r15
mov r8, rdi
cmova eax, edx
mov ecx, 0xfde9
mov dword [rsp + 0x28], eax
xor edx, edx
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rcx, rdi
mov ebx, eax
call fcn.1400a7f70
test ebx, ebx
je 0x1400aa6cc
lea eax, [rbx - 1]
movsxd rcx, eax
xor eax, eax
mov qword [r14], rcx
jmp 0x1400aa6d9
mov eax, 0xfffff019
add rsp, 0x48
pop r14
pop rbp
ret

Function at 0x1400aa8b0
Capabilities:
Get memory capacity

Disassembly:
sub rsp, 0x78
mov rax, qword [0x140136348]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rcx, qword [rsp + 0x30]
xor edx, edx
test eax, eax
cmove rcx, rdx
mov rax, rcx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400cb6d0
add rsp, 0x78
ret

Function at 0x1400aa9f0
Capabilities:
Get memory capacity

Disassembly:
sub rsp, 0x78
mov rax, qword [0x140136348]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rcx, qword [rsp + 0x28]
xor edx, edx
test eax, eax
cmove rcx, rdx
mov rax, rcx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400cb6d0
add rsp, 0x78
ret