joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18004ef10
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
push r14
push r15
sub rsp, 0x98
mov rax, qword [0x180097010]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rdi, rcx
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r14, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
cmp rdi, 0x40000000
jbe 0x18004ef5f
lea rax, [rdi - 0x40000000]
cmp r14, rax
cmovb r14, rax
mov rsi, qword [0x1800aa6c0]
lea r15, [rdi + 0x40000000]
cmp rcx, r15
cmovbe r15, rcx
sub r15, 0xfff
test rsi, rsi
je 0x18004ef9d
cmp rsi, r14
jb 0x18004ef95
cmp rsi, r15
jae 0x18004ef95
cmp qword [rsi + 8], 0
jne 0x18004f167
mov rsi, qword [rsi]
test rsi, rsi
jne 0x18004ef80
mov qword [rsp + 0xc8], rbx
mov rbx, rdi
mov qword [rsp + 0xd0], rbp
mov qword [rsp + 0x90], r12
mov r12d, 0x40
cmp rdi, r14
jb 0x18004f032
nop dword [rax]
nop word [rax + rax]
mov ebp, dword [rsp + 0x78]
mov rax, rbx
xor edx, edx
div rbp
sub rbx, rdx
sub rbx, rbp
cmp rbx, r14
jb 0x18004f029
nop word [rax + rax]
mov r8d, 0x30
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x18004f029
cmp dword [rsp + 0x40], 0x10000
je 0x18004f0ab
mov rbx, qword [rsp + 0x28]
cmp rbx, rbp
jb 0x18004f029
sub rbx, rbp
cmp rbx, r14
jae 0x18004eff0
test rsi, rsi
jne 0x18004f110
cmp rdi, r15
ja 0x18004f14f
nop dword [rax + rax]
mov ebp, dword [rsp + 0x78]
xor edx, edx
mov rax, rdi
mov ebx, ebp
div rbp
mov eax, ebp
sub rax, rdx
add rax, rdi
mov rdi, rax
cmp rax, r15
ja 0x18004f14f
mov r8d, 0x30
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x18004f14f
cmp dword [rsp + 0x40], 0x10000
je 0x18004f0e1
xor edx, edx
lea edi, [rbp - 1]
add rdi, qword [rsp + 0x38]
add rdi, qword [rsp + 0x20]
mov rax, rdi
div rbx
sub rdi, rdx
cmp rdi, r15
jbe 0x18004f062
jmp 0x18004f14f
test rbx, rbx
je 0x18004f029
mov r9d, r12d
mov edx, 0x1000
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x18004f110
cmp rbx, r14
jae 0x18004efd0
jmp 0x18004f032
test rdi, rdi
je 0x18004f14f
mov r9d, r12d
mov edx, 0x1000
mov r8d, 0x3000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x18004f110
cmp rdi, r15
jbe 0x18004f040
jmp 0x18004f14f
xor edx, edx
lea rcx, [rsi + 0x40]
mov dword [rsi + 0x10], edx
nop dword [rax]
mov qword [rcx], rdx
mov rax, rcx
mov qword [rsi + 8], rcx
add r12, 0x40
add rcx, 0x40
mov rdx, rax
cmp r12, 0xfc0
jbe 0x18004f120
mov rax, qword [0x1800aa6c0]
mov qword [rsi], rax
mov qword [0x1800aa6c0], rsi
mov r12, qword [rsp + 0x90]
mov rbp, qword [rsp + 0xd0]
mov rbx, qword [rsp + 0xc8]
mov rax, rsi
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.18005d7a0
add rsp, 0x98
pop r15
pop r14
pop rdi
pop rsi
ret
Function at 0x18004fb80
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x180097010]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor r15d, r15d
mov r14d, edx
xor edx, edx
mov qword [rcx], r15
mov rbx, rcx
mov qword [rcx + 8], r15
mov ebp, r8d
mov edi, r15d
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x18004fd29
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x18004fcc6
lea edi, [r15 + 1]
nop
cmp dword [rsp + 0x20], 0x10
jb 0x18004fc80
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x2c], eax
jne 0x18004fc80
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rsp + 0x28], eax
je 0x18004fc80
mov rdx, qword [rbx]
test rdx, rdx
jne 0x18004fc42
mov rcx, qword [0x180097c60]
mov r8d, 0x200
mov dword [rbx + 8], 0x80
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbx], rax
mov rdx, rax
test rax, rax
je 0x18004fca9
jmp 0x18004fc73
mov eax, dword [rbx + 8]
cmp dword [rbx + 0xc], eax
jb 0x18004fc73
mov rcx, qword [0x180097c60]
add eax, eax
mov r9d, eax
mov r8, rdx
shl r9, 2
xor edx, edx
mov dword [rbx + 8], eax
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rdx, rax
test rax, rax
je 0x18004fca9
mov qword [rbx], rax
mov ecx, dword [rbx + 0xc]
mov eax, dword [rsp + 0x28]
mov dword [rdx + rcx*4], eax
inc dword [rbx + 0xc]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x18004fbf0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x18004fcc6
mov r8, qword [rbx]
mov edi, r15d
test r8, r8
je 0x18004fcc6
mov rcx, qword [0x180097c60]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rbx], r15
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x18004fd29
cmp qword [rbx], r15
je 0x18004fd24
mov edi, r15d
cmp dword [rbx + 0xc], r15d
jbe 0x18004fd24
mov rax, qword [rbx]
xor edx, edx
mov ecx, edi
mov r8d, dword [rax + rcx*4]
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x18004fd1d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov r8d, ebp
mov edx, r14d
mov rcx, rsi
call fcn.18004f9d0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [rbx + 0xc]
jb 0x18004fce1
mov eax, r15d
jmp 0x18004fd2e
mov eax, 9
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.18005d7a0
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x18004fd50
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x180097010]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov eax, ecx
lea r9, [rsp + 0x20]
imul rbx, rax, 0x38
mov r8d, 0x40
add rbx, qword [0x1800aa6b0]
mov rdx, qword [rbx]
movzx eax, byte [rbx + 0x20]
and al, 1
movzx ecx, al
lea rdi, [rdx - 5]
cmove rdi, rdx
lea rsi, [rcx*2 + 5]
mov rcx, rdi
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x18004fdb9
mov eax, 0xa
jmp 0x18004fe06
mov byte [rdi], 0xe9
mov eax, dword [rbx + 8]
sub eax, edi
sub eax, 5
mov dword [rdi + 1], eax
test byte [rbx + 0x20], 1
je 0x18004fdd5
mov rax, qword [rbx]
mov word [rax], 0xf9eb
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, rsi
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
or byte [rbx + 0x20], 6
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.18005d7a0
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x18004fe30
Capabilities:
Resume thread

Disassembly:
push rbx
sub rsp, 0x30
mov edx, dword [0x1800aa6bc]
xor ebx, ebx
test edx, edx
je 0x18004fe5f
mov rcx, qword [0x1800aa6b0]
add rcx, 0x20
nop dword [rax]
test byte [rcx], 2
je 0x18004fe67
inc ebx
add rcx, 0x38
cmp ebx, edx
jb 0x18004fe50
xor eax, eax
add rsp, 0x30
pop rbx
ret
cmp ebx, 0xffffffff
je 0x18004fe5f
mov edx, 0xffffffff
mov qword [rsp + 0x50], rdi
mov r8d, 1
lea rcx, [rsp + 0x20]
call fcn.18004fb80
mov edi, eax
test eax, eax
jne 0x18004ff42
mov eax, dword [0x1800aa6bc]
cmp ebx, eax
jae 0x18004fecd
nop word [rax + rax]
mov ecx, ebx
imul rdx, rcx, 0x38
mov rcx, qword [0x1800aa6b0]
test byte [rdx + rcx + 0x20], 2
jne 0x18004fec7
mov ecx, ebx
call fcn.18004fd50
mov edi, eax
test eax, eax
jne 0x18004fecd
mov eax, dword [0x1800aa6bc]
inc ebx
cmp ebx, eax
jb 0x18004fea0
cmp qword [rsp + 0x20], 0
je 0x18004ff40
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x18004ff2c
mov rbx, qword [rsp + 0x20]
mov qword [rsp + 0x40], rbp
mov ebp, eax
mov qword [rsp + 0x48], rsi
nop
mov r8d, dword [rbx]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x18004ff18
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub rbp, 1
jne 0x18004fef0
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x180097c60]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop rbx
ret
Function at 0x180052fa0
Capabilities:
Resume thread

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.18004fff0
test eax, eax
jne 0x180052fbf
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.1800502d0
add rsp, 0x20
pop rbx
ret
Function at 0x140005770
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x18], r8
push rdi
push r12
push r13
push r14
push r15
mov r14, qword [rsp + 0x50]
xor ebp, ebp
mov rax, qword [rsp + 0x58]
mov r13, r9
mov rbx, qword [rsp + 0x68]
mov r12, rdx
mov qword [r14], r8
mov qword [rbx], rax
mov rax, qword [r14]
cmp rax, r9
je 0x140005901
mov r15, qword [rsp + 0x60]
lea r8d, [rbp + 1]
mov rdi, qword [rbx]
mov r11d, 0x2800
mov r9d, 0x3ff
mov r10d, 0x2400
cmp rdi, r15
je 0x140005901
movzx edx, word [r12]
xor sil, sil
movzx ecx, word [rax]
cmp r8w, dx
jae 0x14000580b
lea eax, [r10 + rcx]
cmp ax, r9w
ja 0x140005928
mov eax, edx
sub ecx, 0xdc00
shl eax, 0xa
or eax, ecx
jmp 0x140005822
mov eax, ecx
add cx, r11w
cmp cx, r9w
ja 0x140005822
shl eax, 0xa
mov sil, 1
sub eax, 0x35f0000
cmp eax, 0x80
jae 0x140005835
movzx r9d, al
mov r10d, ebp
mov r11d, ebp
jmp 0x140005882
mov r9d, eax
cmp eax, 0x800
jae 0x14000584f
shr r9d, 6
mov r10d, r8d
or r9b, 0xc0
mov r11d, r8d
jmp 0x140005882
cmp eax, 0x10000
jae 0x140005869
shr r9d, 0xc
mov r10d, 2
or r9b, 0xe0
mov r11d, r10d
jmp 0x140005882
shr r9d, 0x12
mov r10d, 3
movzx r11d, sil
or r9b, 0xf0
xor r11d, 1
add r11d, r11d
lea r8d, [r11 + 1]
mov rdx, r15
sub rdx, rdi
mov ecx, r8d
cmp rdx, rcx
jl 0x140005901
add qword [r14], 2
test sil, sil
jne 0x1400058a3
cmp r10d, 3
jae 0x1400058af
mov rcx, qword [rbx]
mov r8d, r11d
mov byte [rcx], r9b
inc qword [rbx]
mov r9, qword [rbx]
test r8d, r8d
jle 0x1400058de
lea ecx, [r10 + r10*2]
add ecx, ecx
nop dword [rax]
sub ecx, 6
mov edx, eax
shr edx, cl
dec r8d
and dl, 0x3f
or dl, 0x80
mov byte [r9], dl
inc qword [rbx]
mov r9, qword [rbx]
test r8d, r8d
jg 0x1400058c0
shr eax, 0xa
mov r8d, 1
test sil, sil
mov ecx, r8d
cmovne ecx, eax
mov word [r12], cx
mov rax, qword [r14]
cmp rax, r13
jne 0x1400057bf
mov rax, qword [rsp + 0x40]
cmp rax, qword [r14]
sete bpl
mov eax, ebp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov eax, 2
jmp 0x14000590f
Function at 0x140014d0c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140014d56
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140014d56
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140014d56
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140014d56
cmp dword [rcx + 0x84], 0xe
jbe 0x140014d56
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140014d58
xor al, al
add rsp, 0x28
ret
Function at 0x4027e0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x004111a0]
xor edx, edx
mov r8, rcx
cmp word [r9], 0x5a4d
je 0x402800
mov rax, rdx
add rsp, 0x28
ret
mov rcx, r9
call fcn.004026c0
test eax, eax
je 0x4027f8
movsxd rax, dword [r9 + 0x3c]
mov rcx, r8
sub rcx, r9
add rax, r9
movzx edx, word [rax + 0x14]
lea rdx, [rax + rdx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x40285d
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
cmp rcx, r8
mov rax, r8
jb 0x402854
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x4027f8
add rdx, 0x28
cmp rdx, r9
jne 0x402840
xor edx, edx
mov rax, rdx
add rsp, 0x28
ret

Function at 0x4076a0
Capabilities:
Query environment variable

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r12d, 1
sub r8d, 1
mov edi, ecx
mov ecx, 0x66666667
mov eax, r8d
mov rbp, rdx
movsxd rsi, r8d
imul ecx
sar r8d, 0x1f
mov rbx, r9
mov ecx, edx
sar ecx, 2
sub ecx, r8d
je 0x4076f5
mov r8d, 0x66666667
nop dword [rax]
mov eax, ecx
sar ecx, 0x1f
add r12d, 1
imul r8d
sar edx, 2
sub edx, ecx
mov ecx, edx
jne 0x4076e0
mov edx, dword [rbx + 0x2c]
cmp edx, 0xffffffff
je 0x407770
mov ecx, dword [rbx + 0xc]
cmp r12d, edx
mov r9, rbx
cmovl r12d, edx
mov r8d, 1
lea edx, [r12 + 2]
mov eax, ecx
sub eax, edx
cmp ecx, edx
mov edx, 0xffffffff
cmovle eax, edx
mov ecx, edi
mov rdx, rbp
mov dword [rbx + 0xc], eax
add r12d, 1
call fcn.00406f60
mov ecx, dword [rbx + 8]
mov eax, dword [rbx + 0x2c]
mov rdx, rbx
mov dword [rbx + 0x10], eax
mov eax, ecx
and ecx, 0x20
or eax, 0x1c0
or ecx, 0x45
mov dword [rbx + 8], eax
call fcn.00406b10
add dword [rbx + 0xc], r12d
mov rdx, rbx
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.004073d0
mov eax, dword [0x0040f0a0]
cmp eax, 0xffffffff
je 0x40779c
test eax, eax
je 0x40778c
mov edx, 2
mov dword [rbx + 0x2c], edx
jmp 0x4076fd
call fcn.0040e850
test al, 1
mov edx, 3
jne 0x40777f
jmp 0x407784
lea rcx, str.PRINTF_EXPONENT_DIGITS
call sub.msvcrt.dll_getenv
test rax, rax
je 0x4077c4
movsx eax, byte [rax]
sub eax, 0x30
cmp eax, 2
setbe al
movzx eax, al
mov dword [0x0040f0a0], eax
jmp 0x40777b
xor eax, eax
jmp 0x4077b9
Function at 0x140001920
Capabilities:
Enumerate gui resources

Disassembly:
sub rsp, 0x28
nop dword [rax]
nop dword [rax + rax]
xor edx, edx
lea rcx, [0x140001670]
call qword [sym.imp.USER32.dll_EnumWindows]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140001930

Function at 0x140002ca4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002cee
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002cee
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002cee
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002cee
cmp dword [rcx + 0x84], 0xe
jbe 0x140002cee
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002cf0
xor al, al
add rsp, 0x28
ret
Function at 0x140001c40
Capabilities:
Lock the desktop

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, rcx
call qword [sym.imp.USER32.dll_LockWorkStation]
test eax, eax
je 0x140001c5b
mov al, 1
add rsp, 0x30
pop rdi
ret
mov qword [rsp + 0x40], rbx
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140001c73
xor ecx, ecx
call sym.KuramaCHEAT01.exe_PhGetNtMessage
jmp 0x140001c7a
mov ecx, eax
call sym.KuramaCHEAT01.exe_PhGetWin32Message
lea r9, str.Unable_to_lock_the_computer
mov rbx, rax
mov edx, 0x10
mov rcx, rdi
test rax, rax
jne 0x140001caa
lea r8, [0x1401339b8]
call sym.KuramaCHEAT01.exe_PhShowMessage
mov rbx, qword [rsp + 0x40]
xor al, al
add rsp, 0x30
pop rdi
ret
mov rax, qword [rbx + 8]
lea r8, str._s:__s
mov qword [rsp + 0x20], rax
call sym.KuramaCHEAT01.exe_PhShowMessage
lea rcx, [rbx - 0x10]
or eax, 0xffffffff
lock xadd dword [rcx + 8], eax
sub eax, 1
jne 0x140001cd5
call fcn.1400ae900
xor al, al
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x140001cf0
Capabilities:
Shutdown system

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, rcx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
je 0x140001d0f
mov al, 1
add rsp, 0x30
pop rdi
ret
mov qword [rsp + 0x40], rbx
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140001d27
xor ecx, ecx
call sym.KuramaCHEAT01.exe_PhGetNtMessage
jmp 0x140001d2e
mov ecx, eax
call sym.KuramaCHEAT01.exe_PhGetWin32Message
lea r9, str.Unable_to_log_off_the_computer
mov rbx, rax
mov edx, 0x10
mov rcx, rdi
test rax, rax
jne 0x140001d5e
lea r8, [0x1401339b8]
call sym.KuramaCHEAT01.exe_PhShowMessage
mov rbx, qword [rsp + 0x40]
xor al, al
add rsp, 0x30
pop rdi
ret
mov rax, qword [rbx + 8]
lea r8, str._s:__s
mov qword [rsp + 0x20], rax
call sym.KuramaCHEAT01.exe_PhShowMessage
lea rcx, [rbx - 0x10]
or eax, 0xffffffff
lock xadd dword [rcx + 8], eax
sub eax, 1
jne 0x140001d89
call fcn.1400ae900
xor al, al
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x140001e40
Capabilities:
Shutdown system

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
mov ebx, edx
lea rcx, str.EnableWarnings
call sym.KuramaCHEAT01.exe_PhGetIntegerSetting
test eax, eax
je 0x140001e85
xor r9d, r9d
mov byte [rsp + 0x20], 0
lea r8, str.the_computer
mov rcx, rdi
lea rdx, str.restart
call sym.KuramaCHEAT01.exe_PhShowConfirmMessage
test al, al
je 0x140001f18
or ebx, 2
xor edx, edx
mov ecx, ebx
call qword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
je 0x140001ea3
mov al, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140001eb6
xor ecx, ecx
call sym.KuramaCHEAT01.exe_PhGetNtMessage
jmp 0x140001ebd
mov ecx, eax
call sym.KuramaCHEAT01.exe_PhGetWin32Message
lea r9, str.Unable_to_restart_the_computer
mov rbx, rax
mov edx, 0x10
mov rcx, rdi
test rax, rax
jne 0x140001eed
lea r8, [0x1401339b8]
call sym.KuramaCHEAT01.exe_PhShowMessage
xor al, al
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rax, qword [rbx + 8]
lea r8, str._s:__s
mov qword [rsp + 0x20], rax
call sym.KuramaCHEAT01.exe_PhShowMessage
lea rcx, [rbx - 0x10]
or eax, 0xffffffff
lock xadd dword [rcx + 8], eax
sub eax, 1
jne 0x140001f18
call fcn.1400ae900
xor al, al
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x140001f30
Capabilities:
Shutdown system

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
mov ebx, edx
lea rcx, str.EnableWarnings
call sym.KuramaCHEAT01.exe_PhGetIntegerSetting
test eax, eax
je 0x140001f75
xor r9d, r9d
mov byte [rsp + 0x20], 0
lea r8, str.the_computer
mov rcx, rdi
lea rdx, str.shut_down
call sym.KuramaCHEAT01.exe_PhShowConfirmMessage
test al, al
je 0x140002019
mov ecx, ebx
xor edx, edx
or ecx, 8
call qword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
je 0x140001f93
mov al, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
or ebx, 1
xor edx, edx
mov ecx, ebx
call qword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x140001f86
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140001fb7
xor ecx, ecx
call sym.KuramaCHEAT01.exe_PhGetNtMessage
jmp 0x140001fbe
mov ecx, eax
call sym.KuramaCHEAT01.exe_PhGetWin32Message
lea r9, str.Unable_to_shut_down_the_computer
mov rbx, rax
mov edx, 0x10
mov rcx, rdi
test rax, rax
jne 0x140001fee
lea r8, [0x1401339b8]
call sym.KuramaCHEAT01.exe_PhShowMessage
xor al, al
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rax, qword [rbx + 8]
lea r8, str._s:__s
mov qword [rsp + 0x20], rax
call sym.KuramaCHEAT01.exe_PhShowMessage
lea rcx, [rbx - 0x10]
or eax, 0xffffffff
lock xadd dword [rcx + 8], eax
sub eax, 1
jne 0x140002019
call fcn.1400ae900
xor al, al
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x140002bd0
Capabilities:
Terminate process

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], r9
mov qword [r11 + 0x18], r8
mov qword [r11 + 8], rcx
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x78
mov rax, qword [rdx + 0x20]
lea r8, [r11 - 0x60]
mov dword [rsp + 0x38], 0x30
mov rsi, r9
mov qword [r11 - 0x70], rax
lea r9, [r11 - 0x70]
xor eax, eax
mov rbp, rdx
mov qword [r11 - 0x58], rax
mov rdi, rcx
mov dword [rsp + 0x50], eax
lea rcx, [r11 - 0x78]
xorps xmm0, xmm0
mov qword [r11 - 0x50], rax
lea edx, [rax + 1]
mov qword [r11 - 0x68], rax
movdqu xmmword [rsp + 0x58], xmm0
call qword [sym.imp.ntdll.dll_NtOpenProcess]
mov ebx, eax
cmp eax, 0xc0000022
jne 0x140002c58
cmp byte [0x14015e000], 0
je 0x140002c58
lea r8, [rsp + 0x28]
mov edx, 1
lea rcx, [rsp + 0x20]
call fcn.1400c02c0
mov ebx, eax
test ebx, ebx
js 0x140002ca7
cmp byte [0x14015e000], 0
mov rdi, qword [rsp + 0x20]
je 0x140002c80
mov edx, 1
mov rcx, rdi
call fcn.1400c0500
mov ebx, eax
cmp eax, 0xc00000bb
jne 0x140002c90
mov edx, 1
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtTerminateProcess]
mov ebx, eax
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
jns 0x140002cf8
mov rdi, qword [rsp + 0xa0]
cmp qword [rbp + 0x20], 0
lea rdx, str.terminate
mov r8, qword [rbp + 0x30]
mov byte [rsi], 0
mov r8, qword [r8 + 8]
jl 0x140002cd2
mov r9d, dword [rbp + 0x20]
lea rcx, str.Unable_to__s__s__PID__u_
call fcn.1400015b0
jmp 0x140002cde
lea rcx, str.Unable_to__s__s
call fcn.1400015b0
mov rdx, qword [rax + 8]
xor r9d, r9d
mov r8d, ebx
mov rcx, rdi
call sym.KuramaCHEAT01.exe_PhShowContinueStatus
test al, al
je 0x140002d8f
mov rbx, qword [rsp + 0xb0]
or esi, 0xffffffff
mov rcx, qword [rbx + 0x50]
mov rax, qword [rbp + 0x20]
cmp rcx, rax
je 0x140002d66
cmp qword [rbx + 0x58], rax
jne 0x140002d66
call sym.KuramaCHEAT01.exe_PhReferenceProcessItem
mov rdi, rax
test rax, rax
je 0x140002d66
mov rcx, qword [rbp + 0x40]
cmp qword [rax + 0x40], rcx
jl 0x140002d51
mov r9, qword [rsp + 0xb8]
mov rdx, rax
mov r8, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0xa0]
call fcn.140002bd0
test al, al
je 0x140002d7c
lea rcx, [rdi - 0x10]
mov eax, esi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140002d66
call fcn.1400ae900
mov eax, dword [rbx]
test eax, eax
je 0x140002d71
add rbx, rax
jne 0x140002d03
mov al, 1
add rsp, 0x78
pop rdi
pop rsi
pop rbp
pop rbx
ret
lea rcx, [rdi - 0x10]
lock xadd dword [rcx + 8], esi
cmp esi, 1
jne 0x140002d8f
call fcn.1400ae900
xor al, al
add rsp, 0x78
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140004810
Capabilities:
Start service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rax, qword [rdx + 0x10]
mov rsi, rdx
mov r14, rcx
mov r15d, 1
mov r8d, r15d
xor edx, edx
xor ecx, ecx
xor bl, bl
mov rbp, qword [rax + 8]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x14000489c
lea r8d, [r15 + 0xf]
mov rdx, rbp
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rcx, rdi
mov rbp, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rbp, rbp
je 0x14000489c
xor r8d, r8d
xor edx, edx
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
movzx ebx, bl
mov rcx, rbp
test eax, eax
cmovne ebx, r15d
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test bl, bl
jne 0x140004972
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test eax, eax
jle 0x1400048b1
movzx edi, ax
or edi, 0xc0070000
mov rax, qword [rsi + 0x10]
lea rcx, str.Unable_to_start
mov rdx, qword [rax + 8]
call sym.KuramaCHEAT01.exe_PhConcatStrings2
mov rcx, rax
call sym.KuramaCHEAT01.exe_PhAutoDereferenceObject
lea r9, [rsp + 0x48]
mov r8d, edi
mov rcx, r14
mov rdx, qword [rax + 8]
call fcn.140001780
test al, al
je 0x140004945
cmp byte [rsp + 0x48], 0
je 0x140004972
mov rcx, qword [rsi + 0x10]
mov edx, r15d
mov rcx, qword [rcx + 8]
call fcn.140060a70
mov edi, eax
test eax, eax
js 0x140004911
movzx ebx, r15b
call sym.KuramaCHEAT01.exe_PhUiDisconnectFromPhSvc
jmp 0x140004972
mov r8, qword [rsi + 0x10]
lea rdx, str.start
lea rcx, str.Unable_to__s__s
mov r8, qword [r8 + 8]
call fcn.1400015b0
xor r9d, r9d
mov r8d, edi
mov rcx, r14
mov rdx, qword [rax + 8]
call sym.KuramaCHEAT01.exe_PhShowStatus
call sym.KuramaCHEAT01.exe_PhUiDisconnectFromPhSvc
jmp 0x140004972
mov r8, qword [rsi + 0x10]
lea rdx, str.start
lea rcx, str.Unable_to__s__s
mov r8, qword [r8 + 8]
call fcn.1400015b0
xor r9d, r9d
mov r8d, edi
mov rcx, r14
mov rdx, qword [rax + 8]
call sym.KuramaCHEAT01.exe_PhShowStatus
mov rbp, qword [rsp + 0x50]
movzx eax, bl
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret