joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001070
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov ecx, 0x20
mov rdi, r9
xor bl, bl
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r8, rax
test rax, rax
jne 0x14000109d
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
movzx ecx, byte [0x1400050c0]
cmp cl, 0x24
je 0x1400010bb
nop dword [rax]
inc bl
movzx eax, bl
xor al, cl
cmp al, 0x24
jne 0x1400010b0
movdqa xmm4, xmmword [0x140003700]
lea rdx, [0x1400050df]
movsx eax, bl
lea rcx, [r8 + 0x1f]
lea r10, [0x1400050c0]
movd xmm0, eax
xor eax, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
pshufd xmm0, xmm0, 0
movdqa xmmword [rsp + 0x20], xmm0
cmp r8, rdx
ja 0x140001128
cmp rcx, r10
jb 0x140001128
nop dword [rax + rax]
movsxd rdx, eax
movzx ecx, bl
xor cl, byte [rdx + r10]
sub cl, al
inc eax
mov byte [rdx + r8], cl
cmp eax, 0x20
jb 0x140001100
mov qword [rdi], r8
movzx eax, bl
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
movdqa xmm3, xmmword [0x140003710]
mov r9d, dword [rsp + 0x20]
nop word [rax + rax]
movsxd rdx, eax
lea ecx, [rax + 4]
movd xmm1, eax
pshufd xmm1, xmm1, 0
paddd xmm1, xmm4
movd xmm0, r9d
movd xmm2, dword [rdx + r10]
andps xmm1, xmm3
xorps xmm2, xmm0
packuswb xmm1, xmm1
packuswb xmm1, xmm1
psubb xmm2, xmm1
movd xmm0, r9d
movd xmm1, dword [rdx + r10 + 4]
xorps xmm1, xmm0
movd dword [r8 + rdx], xmm2
movd xmm0, ecx
lea ecx, [rax + 8]
pshufd xmm0, xmm0, 0
paddd xmm0, xmm4
andps xmm0, xmm3
packuswb xmm0, xmm0
packuswb xmm0, xmm0
psubb xmm1, xmm0
movd xmm0, r9d
movd dword [rdx + r8 + 4], xmm1
movd xmm1, dword [rdx + r10 + 8]
xorps xmm1, xmm0
movd xmm0, ecx
pshufd xmm0, xmm0, 0
lea ecx, [rax + 0xc]
paddd xmm0, xmm4
add eax, 0x10
andps xmm0, xmm3
packuswb xmm0, xmm0
packuswb xmm0, xmm0
psubb xmm1, xmm0
movd xmm0, r9d
movd dword [rdx + r8 + 8], xmm1
movd xmm1, dword [rdx + r10 + 0xc]
xorps xmm1, xmm0
movd xmm0, ecx
pshufd xmm0, xmm0, 0
paddd xmm0, xmm4
andps xmm0, xmm3
packuswb xmm0, xmm0
packuswb xmm0, xmm0
psubb xmm1, xmm0
movd dword [rdx + r8 + 0xc], xmm1
cmp eax, 0x20
jb 0x140001140
movzx eax, bl
mov qword [rdi], r8
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x140001c81
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, dword [section..data]
syscall
ret

Function at 0x140002560
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400025aa
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400025aa
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400025aa
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400025aa
cmp dword [rcx + 0x84], 0xe
jbe 0x1400025aa
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400025ac
xor al, al
add rsp, 0x28
ret
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x00442480]
xor edx, edx
mov dword [rax], 1
mov rax, qword [0x00442490]
mov dword [rax], 1
mov rax, qword [0x004424a0]
mov dword [rax], 1
mov rax, qword [0x00442470]
mov dword [rax], 1
mov rax, qword [0x00442330]
cmp word [rax], 0x5a4d
je 0x4010d0
mov rax, qword [0x00442460]
mov dword [0x00445008], edx
mov eax, dword [rax]
test eax, eax
je 0x4010c2
mov ecx, 2
call sym.__set_app_type
mov rcx, 0xffffffffffffffff
call sym._encode_pointer
mov rdx, qword [0x004423c0]
mov qword [rdx], rax
mov rdx, qword [0x004423b0]
mov qword [rdx], rax
mov rax, qword [0x00442420]
mov edx, dword [rax]
mov rax, qword [sym.imp.msvcrt.dll__fmode]
mov rax, qword [rax]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x004422e0]
cmp dword [rax], 1
je 0x401120
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x401075
movsxd rcx, dword [rax + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x401058
movzx ecx, word [rax + 0x18]
cmp cx, 0x10b
je 0x401133
cmp cx, 0x20b
jne 0x401058
cmp dword [rax + 0x84], 0xe
jbe 0x401058
mov ecx, dword [rax + 0xf8]
xor edx, edx
test ecx, ecx
setne dl
jmp 0x401058
lea rcx, [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x401058
mov r8d, dword [rax + 0xe8]
xor edx, edx
test r8d, r8d
setne dl
jmp 0x401058
Function at 0x4022a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rsi, rcx
mov ecx, dword [0x00445624]
mov rdi, rdx
mov rbp, r8
test ecx, ecx
jle 0x4023c0
mov rax, qword [0x00445628]
xor ebx, ebx
add rax, 0x18
mov rdx, qword [rax]
cmp rsi, rdx
jb 0x4022ec
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rsi, rdx
jb 0x4023a6
add ebx, 1
add rax, 0x28
cmp ebx, ecx
jne 0x4022d0
mov rcx, rsi
call dbg.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x4023f8
movsxd rbx, ebx
lea rbx, [rbx + rbx*4]
shl rbx, 3
mov r13, rbx
add r13, qword [0x00445628]
mov qword [r13 + 0x20], rax
mov dword [r13], 0
call dbg._GetPEImageBase
mov edx, dword [r12 + 0xc]
mov r8d, 0x30
add rax, rdx
lea rdx, [rsp + 0x20]
mov qword [r13 + 0x18], rax
mov rax, qword [0x00445628]
mov rcx, qword [rax + rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x4023db
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x40239f
sub eax, 0x40
and eax, 0xffffffbf
je 0x40239f
add rbx, qword [0x00445628]
mov rcx, qword [rsp + 0x20]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov r9, rbx
mov qword [rbx + 8], rcx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x4023c7
add dword [0x00445624], 1
mov r8, rbp
mov rdx, rdi
mov rcx, rsi
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sym.memcpy
xor ebx, ebx
jmp 0x4022f7
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call dbg.__report_error
mov rax, qword [0x00445628]
mov edx, dword [r12 + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call dbg.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rsi
call dbg.__report_error
nop
nop dword [rax + rax]

Function at 0x402b50
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x00445900]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x004458e0]
test rbx, rbx
je 0x402ba4
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x402b9b
test rsi, rsi
je 0x402b9b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x402b80
lea rcx, [0x00445900]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x402de0
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
je 0x402df0
xor eax, eax
ret
jmp sym._ValidateImageBase.part.0
Function at 0x402e00
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x402e41
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x402e38
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x402e43
add rax, 0x28
cmp rax, r9
jne 0x402e24
xor eax, eax
repz ret

Function at 0x402ee0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x00442330]
xor edx, edx
mov r8, rcx
cmp word [r9], 0x5a4d
je 0x402f00
mov rax, rdx
add rsp, 0x28
ret
mov rcx, r9
call sym._ValidateImageBase.part.0
test eax, eax
je 0x402ef8
movsxd rax, dword [r9 + 0x3c]
mov rcx, r8
sub rcx, r9
add rax, r9
movzx edx, word [rax + 0x14]
lea rdx, [rax + rdx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x402f5d
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
cmp rcx, r8
mov rax, r8
jb 0x402f54
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x402ef8
add rdx, 0x28
cmp rdx, r9
jne 0x402f40
xor edx, edx
mov rax, rdx
add rsp, 0x28
ret

Function at 0x403070
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x00442330]
xor eax, eax
mov rdx, rcx
cmp word [r8], 0x5a4d
je 0x403090
add rsp, 0x28
ret
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x403088
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x4030ed
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x4030e4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x4030f4
add rax, 0x28
cmp rax, r9
jne 0x4030d0
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret

Function at 0x403110
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x00442330]
xor r9d, r9d
mov r8d, ecx
cmp word [r11], 0x5a4d
je 0x403131
mov rax, r9
add rsp, 0x28
ret
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x403129
movsxd rcx, dword [r11 + 0x3c]
add rcx, r11
mov eax, dword [rcx + 0x90]
test eax, eax
je 0x403129
movzx edx, word [rcx + 0x14]
lea rdx, [rcx + rdx + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x403129
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r10, [rdx + rcx*8 + 0x28]
nop dword [rax + rax]
mov r9d, dword [rdx + 0xc]
cmp rax, r9
mov rcx, r9
jb 0x403184
add ecx, dword [rdx + 8]
cmp rax, rcx
jb 0x4031a0
add rdx, 0x28
cmp rdx, r10
jne 0x403170
xor r9d, r9d
mov rax, r9
add rsp, 0x28
ret
add rax, r11
jne 0x4031b8
jmp 0x40318d
sub r8d, 1
add rax, 0x14
mov ecx, dword [rax + 4]
test ecx, ecx
jne 0x4031c6
mov edx, dword [rax + 0xc]
test edx, edx
je 0x40318d
test r8d, r8d
jg 0x4031b0
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
add rsp, 0x28
ret
Function at 0x140003010
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov rax, qword [rsp + 0xb0]
cmp qword [rax + 0x68], 0
je 0x14000303b
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x140003042
mov al, 1
jmp 0x14000319a
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x50], rax
call fcn.140003ae0
mov dword [rsp + 0x38], eax
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0xb0]
call qword [rsp + 0x50]
mov dword [rsp + 0x3c], eax
call fcn.140003ae0
mov dword [rsp + 0x40], eax
mov edx, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x40]
call fcn.140003af0
movzx eax, al
test eax, eax
je 0x140003097
xor al, al
jmp 0x14000319a
mov qword [rsp + 0x68], reloc.WLDAP32.dll_Ordinal_32
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax + 0x68]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x90]
mov rcx, qword [rsp + 0xb0]
add rcx, 0x74
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rsp + 0x70]
mov rdx, rcx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x140003107
cmp dword [rsp + 0x30], 1
je 0x140003113
cmp dword [rsp + 0x30], 3
je 0x140003188
jmp 0x140003198
mov rax, qword [rsp + 0xb0]
mov byte [rax + 0x71], 0
lea rax, [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jbe 0x14000315f
mov rax, qword [rsp + 0xb0]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x48]
mov edx, 1
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp qword [rsp + 0x48], rax
je 0x14000315f
xor al, al
jmp 0x14000319a
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x140003179
mov dword [rsp + 0x34], 1
jmp 0x140003181
mov dword [rsp + 0x34], 0
movzx eax, byte [rsp + 0x34]
jmp 0x14000319a
mov rax, qword [rsp + 0xb0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x14000319a
xor al, al
add rsp, 0xa8
ret
Function at 0x140004ba0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
cmp qword [rsp + 0x80], 0
jg 0x140004bc5
xor eax, eax
jmp 0x140004d8c
mov rax, qword [rsp + 0x70]
cmp qword [rax + 0x68], 0
je 0x140004bee
mov r8, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
jmp 0x140004d8c
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const___ptr64]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jbe 0x140004c8e
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x20]
call fcn.140001f30
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
mov r8, qword [rsp + 0x28]
mov rdx, rax
mov rcx, qword [rsp + 0x78]
call fcn.140003a00
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x78]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov edx, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
nop
mov rax, qword [rsp + 0x70]
cmp qword [rax + 0x80], 0
je 0x140004d7c
mov rcx, qword [rsp + 0x70]
call fcn.140003580
mov qword [rsp + 0x58], 0xfff
cmp qword [rsp + 0x20], 0xfff
jbe 0x140004d2f
mov rax, qword [rsp + 0x70]
mov r9, qword [rax + 0x80]
mov r8d, 0xfff
mov edx, 1
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x78]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x30], 0xfff
je 0x140004d2d
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
jmp 0x140004d8c
jmp 0x140004cb4
cmp qword [rsp + 0x20], 0
jbe 0x140004d7c
mov rax, qword [rsp + 0x70]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x20]
mov edx, 1
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
add rsp, 0x68
ret
Function at 0x140004da0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x68], 0
je 0x140004dd9
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x140004ec8
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x50], 0
jle 0x140004e70
cmp qword [rsp + 0x20], 0
jle 0x140004e70
mov rax, qword [rsp + 0x20]
cmp qword [rsp + 0x50], rax
jge 0x140004e19
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x48]
mov rcx, rax
call fcn.140003a00
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
nop
cmp qword [rsp + 0x50], 0
jle 0x140004eb8
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x80], 0
je 0x140004eb8
mov rax, qword [rsp + 0x40]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x50]
mov edx, 1
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
sub rcx, rax
mov rax, rcx
add rsp, 0x38
ret
Function at 0x140024270
Capabilities:
Enumerate gui resources

Disassembly:
sub rsp, 0x28
xor edx, edx
lea rcx, [0x140023610]
call qword [sym.imp.USER32.dll_EnumWindows]
nop
add rsp, 0x28
ret

Function at 0x140024530
Capabilities:
Terminate process

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov r8d, dword [rsp + 0x40]
xor edx, edx
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x140024570
xor edx, edx
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
add rsp, 0x38
ret

Function at 0x14002c390
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x448
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0x400
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x14002c3e7
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x450]
call fcn.140005a90
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x450]
jmp 0x14002c421
lea rdx, [rsp + 0x2c]
lea rcx, [rsp + 0x24]
call fcn.140021cb0
mov rcx, rax
call fcn.1400288f0
mov rdx, rax
mov rcx, qword [rsp + 0x450]
call fcn.140005a90
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x450]
add rsp, 0x448
ret
Function at 0x14002cba0
Capabilities:
Get memory capacity

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xb8
mov dword [rsp + 0x24], 0
mov dword [rsp + 0x70], 0x40
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x14002cc55
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x20]
call fcn.140021d60
mov rcx, rax
call fcn.140028770
mov qword [rsp + 0x40], rax
xor edx, edx
mov rax, qword [rsp + 0x78]
mov ecx, 0x100000
div rcx
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.14001a230
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x48], rax
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0xc0]
call fcn.140007130
mov eax, dword [rsp + 0x24]
or eax, 1
mov dword [rsp + 0x24], eax
lea rcx, [rsp + 0x50]
call fcn.1400027f0
nop
mov rax, qword [rsp + 0xc0]
add rsp, 0xb8
ret

Function at 0x14002cc60
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x2a8
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0x101
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x90]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x14002cd37
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x68]
call fcn.140005af0
nop
lea rcx, [rsp + 0x24]
call fcn.140001d20
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x68]
call fcn.14001b8c0
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x68]
call fcn.140006510
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x50], rax
mov r9, qword [rsp + 0x40]
mov r8, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x2b0]
call fcn.14001a7b0
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x68]
call fcn.140005b70
nop
mov rax, qword [rsp + 0x2b0]
jmp 0x14002cd5e
lea rdx, [0x14008a751]
mov rcx, qword [rsp + 0x2b0]
call fcn.140005a90
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x2b0]
add rsp, 0x2a8
ret
Function at 0x14002e650
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x4d8
mov dword [rsp + 0x30], 0
lea rax, [rsp + 0x2c0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, reloc.WS2_32.dll_recv
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
jne 0x14002e85a
lea rdx, [rsp + 0x2c0]
lea rcx, [rsp + 0x68]
call fcn.140005af0
nop
lea rdx, [rsp + 0x96]
lea rcx, [rsp + 0x34]
call fcn.140021d80
mov rcx, rax
call fcn.140028870
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140023140
nop
lea rcx, [rsp + 0x68]
call fcn.1400065d0
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 1
mov rdx, rax
lea rcx, [rsp + 0xb0]
call fcn.14001ff40
nop
lea rcx, [rsp + 0xb0]
call fcn.14001bb40
movzx eax, al
test eax, eax
je 0x14002e841
mov edx, 1
lea rcx, [rsp + 0x1c0]
call fcn.14000ecc0
nop
lea rax, [rsp + 0x1d0]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0xb0]
call fcn.14002e630
mov rdx, rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64____ptr64]
lea rcx, [rsp + 0xb0]
call fcn.14001b650
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x1c0]
call fcn.14001a1e0
nop
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x35]
call fcn.140022000
mov rcx, rax
call fcn.1400288b0
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.14001b970
mov r8, rax
xor edx, edx
lea rcx, [rsp + 0x48]
call fcn.140003b20
nop
lea rdx, [rsp + 0x8f]
lea rcx, [rsp + 0x36]
call fcn.140022350
mov rcx, rax
call fcn.1400288b0
mov r8, 0xffffffffffffffff
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.14001b9e0
inc rax
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.14001b930
nop
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0x4e0]
call fcn.140005970
mov eax, dword [rsp + 0x30]
or eax, 1
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x48]
call fcn.1400027f0
nop
lea rcx, [rsp + 0x1c0]
call fcn.140011120
nop
lea rcx, [rsp + 0xb0]
call fcn.14001b4c0
nop
lea rcx, [rsp + 0x68]
call fcn.140005b70
mov rax, qword [rsp + 0x4e0]
jmp 0x14002e881
lea rcx, [rsp + 0xb0]
call fcn.14001b4c0
nop
lea rcx, [rsp + 0x68]
call fcn.140005b70
nop
lea rdx, [0x14008a752]
mov rcx, qword [rsp + 0x4e0]
call fcn.140005a90
mov eax, dword [rsp + 0x30]
or eax, 1
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x4e0]
add rsp, 0x4d8
ret
Function at 0x140037270
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
cdqe
add rsp, 0x28
ret