joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000a8a0
Capabilities:
Accept command line arguments

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rdx
call fcn.140016ff0
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rdx
lea rcx, [rsp + 0x28]
call fcn.140021fb0
mov rdx, qword [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.shell32.dll_CommandLineToArgvW]
nop
add rsp, 0x48
ret

Function at 0x14001dc50
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x48
mov dword [rsp + 0x2c], ecx
mov qword [rsp + 0x30], rdx
mov dword [rsp + 0x3c], r8d
mov qword [rsp + 0x40], r9
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
nop
add rsp, 0x48
ret

Function at 0x14002e4f0
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x20], rcx
call qword [sym.imp.kernel32.dll_GetSystemInfo]
nop
add rsp, 0x28
ret

Function at 0x14002e510
Capabilities:
Get memory capacity

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], rdx
mov rax, rcx
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rcx
call qword [sym.imp.kernel32.dll_GlobalMemoryStatusEx]
mov rcx, qword [rsp + 0x30]
mov edx, eax
call fcn.140021c40
mov rax, qword [rsp + 0x38]
add rsp, 0x48
ret

Function at 0x1400682c0
Capabilities:
Get system information on windows

Disassembly:
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x50]
xorps xmm0, xmm0
movaps xmmword [rbp - 0x10], xmm0
movaps xmmword [rbp - 0x20], xmm0
movaps xmmword [rbp - 0x30], xmm0
lea rcx, [rbp - 0x30]
call qword [sym.imp.kernel32.dll_GetSystemInfo]
mov ecx, dword [rbp - 0x10]
xor eax, eax
test rcx, rcx
sete al
lea rdx, str.The_number_of_hardware_threads_is_not_known_for_the_target_platform
cmovne rdx, rcx
add rsp, 0x50
pop rbp
ret
Function at 0x140068300
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3d0], rcx
mov qword [rbp + 0x3d8], 0
mov qword [rbp + 0x3e0], 2
mov qword [rbp + 0x3e8], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3c8], rax
xor esi, esi
xor edi, edi
xor ebx, ebx
cmp r8, 0x201
jae 0x1400683a0
jmp 0x14006838f
jae 0x14006845f
cmp r8, 0x201
jae 0x1400683a0
mov r14d, 0x200
lea r15, [rbp - 0x58]
mov r12, r8
jmp 0x1400683f7
sub r8, rbx
sub rdi, rbx
cmp r8, rdi
jbe 0x1400683cf
lea rcx, [rbp + 0x3d8]
mov rdx, rbx
call fcn.14007eba0
mov rsi, qword [rbp + 0x3d8]
mov rax, qword [rbp + 0x3e0]
mov qword [rbp + 0x3c8], rax
mov eax, 0xffffffff
cmp rsi, rax
mov ebx, 0xffffffff
cmovb rbx, rsi
mov qword [rbp + 0x3e8], rbx
mov rdi, rsi
mov r14, rbx
mov r15, qword [rbp + 0x3c8]
mov r12, rbx
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov ecx, r12d
mov rdx, r15
call qword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
mov r13d, eax
test eax, eax
jne 0x140068420
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x1400684cb
mov r8d, r13d
cmp r12, r8
jne 0x140068380
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400684ff
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x14006838f
jmp 0x1400683a0
cmp r14, r8
jb 0x140068519
lea rcx, [rbp + 0x3a8]
mov rdx, r15
call fcn.14006b000
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3d0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rdx, qword [rbp + 0x3d8]
test rdx, rdx
je 0x1400684b4
mov rcx, qword [rbp + 0x3e0]
add rdx, rdx
mov r8d, 2
call fcn.140002d70
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3d0]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov rdx, qword [rbp + 0x3d8]
test rdx, rdx
jne 0x14006849f
jmp 0x1400684b4
lea rcx, str.internal_error:_entered_unreachable_code_rustc_eeb90cda1969383f56a2637cbd3037bdf598841clibrary_alloc_src_vecmod.rs
lea r8, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.14007feb0
jmp 0x14006852e
lea rax, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, r14
mov r8, rax
call fcn.140080320
ud2
Function at 0x14006f870
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov rsi, rcx
movups xmm0, xmmword [0x1401015e8]
movaps xmmword [rbp], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
test r9, r9
je 0x14006f8a8
mov rcx, qword [rbp + 0x60]
mov qword [rbp - 0x30], rcx
test r9, r9
mov qword [rbp - 0x38], r9
lea rcx, [rbp - 0x30]
cmove rcx, r9
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
mov rax, rbp
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x14006f906
mov rcx, rsi
mov edx, 0xffffffff
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [rbp]
cmp eax, 0x103
je 0x14006f933
test eax, eax
js 0x14006f912
mov rdx, qword [rbp + 8]
xor eax, eax
jmp 0x14006f929
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xa8
pop rsi
pop rbp
ret
mov dword [rbp + 0x18], 0
mov byte [rbp + 0x1c], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
lea rax, [rbp + 0x20]
mov qword [rbp - 0x28], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rcx, [rbp + 0x18]
lea rdx, [rbp - 0x38]
call fcn.14006aca0
mov qword [rbp - 8], rax
lea rcx, [rbp - 8]
call fcn.140066690
mov ecx, 7
int 0x29
ud2
Function at 0x14007cc20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
test r8, r8
je 0x14007ccaa
mov rax, rdx
mov rdx, qword [rbp + 0x50]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x14007cca0
cmp r10, r11
jb 0x14007cd26
cmp r10, rdx
ja 0x14007cd38
add r11, r9
xor ebx, ebx
nop word cs:[rax + rax]
cmp rdi, rbx
je 0x14007cca2
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x14007cc80
jmp 0x14007cd07
ja 0x14007ccaa
mov r11, r10
cmp rax, r8
jne 0x14007cc47
mov rdx, qword [rbp + 0x60]
test rdx, rdx
je 0x14007cd0b
mov r8, qword [rbp + 0x58]
add rdx, r8
movzx ecx, cx
mov al, 1
nop
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x14007cce0
mov r8, r10
sub ecx, r9d
jns 0x14007ccfe
jmp 0x14007cd0d
cmp r10, rdx
je 0x14007cd1a
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x14007cd0d
xor al, 1
cmp r8, rdx
jne 0x14007ccc0
jmp 0x14007cd0d
xor eax, eax
jmp 0x14007cd0d
mov al, 1
and al, 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
lea rcx, str.librarycore_srcunicodeprintable.rs
call fcn.14007fd90
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.140080390
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.140080320
int3

Function at 0x14007e568
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
test rax, rax
je 0x14007e5b2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14007e5b2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14007e5b2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14007e5b2
cmp dword [rcx + 0x84], 0xe
jbe 0x14007e5b2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14007e5b4
xor al, al
add rsp, 0x28
ret
Function at 0x140001370
Capabilities:
Delete file
Set file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov edx, 0x80
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x140001399
mov al, 1
add rsp, 0x20
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x1400013cc
mov rcx, rbx
call fcn.1400040d0
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp eax, 1
sete al
add rsp, 0x20
pop rbx
ret
xor al, al
add rsp, 0x20
pop rbx
ret
push rbx
sub rsp, 0x20
mov rbx, rcx
mov byte [rsp + 0x30], 0
test rcx, rcx
je 0x1400036ad
lea rdx, [rsp + 0x30]
call fcn.1400013e0
test al, al
jne 0x1400036b5
lea rcx, str.File_Not_Found_n
call fcn.140004290
xor al, al
add rsp, 0x20
pop rbx
ret
lea r9, str._Replace
lea r8, [0x14000e404]
xor edx, edx
mov rcx, rbx
call fcn.1400026d0
cmp byte [rsp + 0x30], 0
mov rcx, rbx
je 0x1400036fe
call fcn.140001020
mov rdx, rbx
lea rcx, str._s_Deleted_n
test al, al
jne 0x1400036f1
lea rcx, str.Fail_To_Delete__s_n
call fcn.140004290
xor al, al
add rsp, 0x20
pop rbx
ret
add rsp, 0x20
pop rbx
jmp 0x140001370
Function at 0x1400031d0
Capabilities:
Enumerate files on windows

Disassembly:
push rsi
sub rsp, 0x490
mov rax, qword [0x140012008]
xor rax, rsp
mov qword [rsp + 0x480], rax
xor eax, eax
mov rsi, rcx
lea rcx, [rsp + 0x181]
xor edx, edx
mov r8d, 0xff
mov byte [rsp + 0x170], 0
mov dword [rsp + 0x171], eax
mov word [rsp + 0x175], ax
mov byte [rsp + 0x177], al
mov byte [rsp + 0x180], al
call fcn.1400043b0
lea rcx, [rsp + 0x281]
xor edx, edx
mov r8d, 0x1ff
mov byte [rsp + 0x280], 0
call fcn.1400043b0
test rsi, rsi
je 0x1400033a2
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x4b0], rdi
xor eax, eax
mov rdi, rsi
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp rcx, 3
jne 0x14000328a
cmp byte [rsi + 1], 0x3a
jne 0x14000328a
cmp byte [rsi + 2], 0x5c
jne 0x14000328a
mov rcx, rsi
call fcn.140003140
xor al, al
jmp 0x14000337d
lea r8, [rsp + 0x180]
lea rdx, [rsp + 0x170]
xor r9d, r9d
mov rcx, rsi
mov qword [rsp + 0x4a8], rbx
mov qword [rsp + 0x20], rax
call fcn.140004bb4
lea rdx, [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000339e
nop dword [rax]
lea rsi, [rsp + 0x5c]
lea rdi, [0x14000e3d8]
mov ecx, 2
repe cmpsb byte [rsi], byte [rdi]
je 0x140003354
lea rsi, [rsp + 0x5c]
lea rdi, [0x14000e3d4]
mov ecx, 3
repe cmpsb byte [rsi], byte [rdi]
je 0x140003354
lea rcx, [rsp + 0x280]
xor edx, edx
mov r8d, 0x200
call fcn.1400043b0
lea rdx, [rsp + 0x5c]
lea rax, [rsp + 0x180]
mov qword [rsp + 0x28], rdx
lea r9, [rsp + 0x170]
lea r8, str._s_s_s
lea rcx, [rsp + 0x280]
mov edx, 0x1fe
mov qword [rsp + 0x20], rax
call fcn.140004614
lea rcx, [rsp + 0x280]
call fcn.140003140
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1400032d0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov al, 1
mov rbx, qword [rsp + 0x4a8]
mov rdi, qword [rsp + 0x4b0]
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.140004380
add rsp, 0x490
pop rsi
ret
xor al, al
jmp 0x140003375
xor al, al
jmp 0x140003385
Function at 0x1400033b0
Capabilities:
Enumerate files on windows

Disassembly:
push rbp
push rdi
push r12
push r13
sub rsp, 0x4a8
mov rax, qword [0x140012008]
xor rax, rsp
mov qword [rsp + 0x480], rax
xor eax, eax
mov rdi, rcx
mov r12, r8
mov rbp, rdx
lea rcx, [rsp + 0x181]
mov r8d, 0xff
xor edx, edx
mov r13, r9
mov byte [rsp + 0x170], 0
mov dword [rsp + 0x171], eax
mov word [rsp + 0x175], ax
mov byte [rsp + 0x177], al
mov byte [rsp + 0x180], al
call fcn.1400043b0
lea rcx, [rsp + 0x281]
xor edx, edx
mov r8d, 0x1ff
mov byte [rsp + 0x280], 0
call fcn.1400043b0
test rdi, rdi
je 0x1400035c6
test rbp, rbp
je 0x1400035c6
test r12, r12
je 0x1400035c6
test r13, r13
je 0x1400035c6
lea r8, [rsp + 0x180]
lea rdx, [rsp + 0x170]
xor r9d, r9d
mov rcx, rdi
mov qword [rsp + 0x4a0], rbx
mov qword [rsp + 0x20], 0
call fcn.140004bb4
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400035c2
mov qword [rsp + 0x498], rsi
nop dword [rax + rax]
lea rsi, [rsp + 0x5c]
lea rdi, [0x14000e3d8]
mov ecx, 2
repe cmpsb byte [rsi], byte [rdi]
je 0x140003573
lea rsi, [rsp + 0x5c]
lea rdi, [0x14000e3d4]
mov ecx, 3
repe cmpsb byte [rsi], byte [rdi]
je 0x140003573
lea rcx, [rsp + 0x280]
xor edx, edx
mov r8d, 0x200
call fcn.1400043b0
lea rdx, [rsp + 0x5c]
lea rax, [rsp + 0x180]
mov qword [rsp + 0x28], rdx
lea r9, [rsp + 0x170]
lea r8, str._s_s_s
lea rcx, [rsp + 0x280]
mov edx, 0x1fe
mov qword [rsp + 0x20], rax
call fcn.140004614
lea rcx, [rsp + 0x280]
mov r9, r13
mov r8, r12
mov rdx, rbp
call fcn.1400026d0
test al, al
je 0x14000355f
lea rdx, [rsp + 0x280]
lea rcx, str.Set_Access_Successfully__s_n
call fcn.140004290
jmp 0x140003573
lea rdx, [rsp + 0x280]
lea rcx, str.Fail_To_Set_Acccess__s_n
call fcn.140004290
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1400034b0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rsi, qword [rsp + 0x498]
mov al, 1
mov rbx, qword [rsp + 0x4a0]
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.140004380
add rsp, 0x4a8
pop r13
pop r12
pop rdi
pop rbp
ret
xor al, al
jmp 0x14000359c
xor al, al
jmp 0x1400035a4
Function at 0x140003680
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x20
mov edx, 0x80
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x140001399
mov al, 1
add rsp, 0x20
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x1400013cc
mov rcx, rbx
call fcn.1400040d0
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp eax, 1
sete al
add rsp, 0x20
pop rbx
ret
xor al, al
add rsp, 0x20
pop rbx
ret
push rbx
sub rsp, 0x20
mov rbx, rcx
mov byte [rsp + 0x30], 0
test rcx, rcx
je 0x1400036ad
lea rdx, [rsp + 0x30]
call fcn.1400013e0
test al, al
jne 0x1400036b5
lea rcx, str.File_Not_Found_n
call fcn.140004290
xor al, al
add rsp, 0x20
pop rbx
ret
lea r9, str._Replace
lea r8, [0x14000e404]
xor edx, edx
mov rcx, rbx
call fcn.1400026d0
cmp byte [rsp + 0x30], 0
mov rcx, rbx
je 0x1400036fe
call fcn.140001020
mov rdx, rbx
lea rcx, str._s_Deleted_n
test al, al
jne 0x1400036f1
lea rcx, str.Fail_To_Delete__s_n
call fcn.140004290
xor al, al
add rsp, 0x20
pop rbx
ret
add rsp, 0x20
pop rbx
jmp 0x140001370

Function at 0x140003710
Capabilities:
Impersonate user

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rax, rdx
xor edx, edx
xor bl, bl
mov esi, r9d
mov rdi, rcx
mov qword [rsp + 0x40], rdx
test rcx, rcx
je 0x1400037c6
test rax, rax
je 0x1400037c6
test r8, r8
je 0x1400037c6
lea rcx, [rsp + 0x40]
lea r9d, [rdx + 3]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edx
lea rdx, [0x14000e3d8]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_LogonUserA]
test eax, eax
jne 0x140003784
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.LogonUserA___d_n
mov edx, eax
call fcn.140004290
jmp 0x1400037b6
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
jne 0x1400037a9
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ImpersonateLoggedOnUser___d_n
mov edx, eax
call fcn.140004290
jmp 0x1400037b6
mov edx, esi
mov rcx, rdi
call fcn.140002d70
movzx ebx, al
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400037c6
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x50]
mov al, bl
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x140003b10
Capabilities:
Check os version

Disassembly:
sub rsp, 0xd8
mov rax, qword [0x140012008]
xor rax, rsp
mov qword [rsp + 0xc0], rax
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x9c
call fcn.1400043b0
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x9c
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
mov r11d, dword [rsp + 0x24]
cmp r11d, 5
jne 0x140003b7a
cmp dword [rsp + 0x28], 1
jb 0x140003b7c
mov al, 1
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.140004380
add rsp, 0xd8
ret
ja 0x140003b60
xor al, al
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.140004380
add rsp, 0xd8
ret
Function at 0x140003ba0
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x240
mov rax, qword [0x140012008]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rdi, rcx
mov bl, 0x41
nop word [rax + rax]
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0x1ff
mov byte [rsp + 0x20], bl
mov byte [rsp + 0x21], 0x3a
mov byte [rsp + 0x22], 0
mov byte [rsp + 0x30], 0
call fcn.1400043b0
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
mov r8d, 0x1ff
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
je 0x140003c20
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.1400050dc
test eax, eax
je 0x140003c4a
inc bl
cmp bl, 0x5a
jle 0x140003bd0
xor al, al
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140004380
mov rbx, qword [rsp + 0x258]
add rsp, 0x240
pop rdi
ret
mov al, bl
jmp 0x140003c29

Function at 0x140003d60
Capabilities:
Get process image filename

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x430
mov rax, qword [0x140012008]
xor rax, rsp
mov qword [rsp + 0x420], rax
mov ebx, r8d
mov rdi, rdx
mov rsi, rcx
test rdx, rdx
je 0x140003e1a
test r8d, r8d
je 0x140003e1a
call fcn.140003b10
test al, al
je 0x140003e1a
mov r8d, ebx
mov rdx, rdi
mov rcx, rsi
call sub.PSAPI.DLL_GetProcessImageFileNameA
test eax, eax
je 0x140003e1a
lea rdx, str.DeviceHarddiskVolume
mov r8d, 0x16
mov rcx, rdi
call fcn.140004dac
test eax, eax
jne 0x140003e16
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x3ff
mov byte [rsp + 0x20], al
call fcn.1400043b0
lea rdx, [rsp + 0x20]
mov r8d, 0x400
mov rcx, rdi
call fcn.140003c50
test al, al
je 0x140003e16
mov r8, rbx
xor edx, edx
mov rcx, rdi
call fcn.1400043b0
lea rdx, [rsp + 0x20]
mov r8, rbx
mov rcx, rdi
call fcn.1400044b0
mov al, 1
jmp 0x140003e1c
xor al, al
mov rcx, qword [rsp + 0x420]
xor rcx, rsp
call fcn.140004380
add rsp, 0x430
pop rdi
pop rsi
pop rbx
ret
Function at 0x140003e40
Capabilities:
Get process image filename

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x540
mov rax, qword [0x140012008]
xor rax, rsp
mov qword [rsp + 0x530], rax
mov rax, qword [str._unknown_]
mov rbp, rcx
lea rcx, [rsp + 0x20]
mov qword [rcx], rax
movzx eax, word [0x14000ea18]
mov edi, edx
mov word [rcx + 8], ax
lea rcx, [rsp + 0x2a]
xor edx, edx
mov r8d, 0xfa
call fcn.1400043b0
mov r8d, edi
xor edx, edx
mov ecx, 0x410
xor bl, bl
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x140004032
lea r8, [rsp + 0x20]
mov r9d, 0x104
xor edx, edx
mov rcx, rax
call sub.PSAPI.DLL_GetModuleFileNameExA
test eax, eax
jne 0x140003fab
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12b
jne 0x140003f7e
lea r8d, [rax - 0x27]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call sub.PSAPI.DLL_GetProcessImageFileNameA
lea rcx, [rsp + 0x20]
test eax, eax
je 0x140003f83
lea rdx, str.DeviceHarddiskVolume
mov r8d, 0x16
call fcn.140004dac
test eax, eax
jne 0x140004027
lea rcx, [rsp + 0x131]
xor edx, edx
mov r8d, 0x3ff
mov byte [rsp + 0x130], al
call fcn.1400043b0
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8d, 0x400
call fcn.140003c50
test al, al
je 0x140004027
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x104
call fcn.1400043b0
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.1400044b0
jmp 0x140003fab
lea rcx, [rsp + 0x20]
mov r8d, 0x104
xor edx, edx
call fcn.1400043b0
lea rdx, [rsp + 0x20]
mov r8d, 0x104
mov rcx, rsi
call fcn.140003d60
test al, al
je 0x140004027
lea rdx, [0x14000ea08]
mov rcx, rbp
call fcn.1400041b0
test rax, rax
je 0x140003fd4
lea rdx, [rsp + 0x20]
mov rcx, rbp
call fcn.1400050dc
test eax, eax
jne 0x140004027
mov bl, 1
jmp 0x140004027
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x20]
repne scasb al, byte [rdi]
mov rdx, rax
not rcx
sub rcx, 1
je 0x140004001
nop dword [rax]
cmp byte [rsp + rax + 0x20], 0x5c
cmove rdx, rax
inc rax
cmp rax, rcx
jb 0x140003ff0
lea rax, [rcx - 1]
cmp rdx, rax
jae 0x14000400d
inc rdx
lea rcx, [rsp + rdx + 0x20]
mov rdx, rbp
call fcn.1400050dc
movzx ebx, bl
mov ecx, 1
test eax, eax
cmove ebx, ecx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
mov rcx, qword [rsp + 0x530]
xor rcx, rsp
call fcn.140004380
mov rbx, qword [rsp + 0x570]
add rsp, 0x540
pop rdi
pop rsi
pop rbp
ret

Function at 0x140004060
Capabilities:
Acquire debug privileges
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, ecx
lea rcx, str.SeDebugPrivilege
mov edx, 1
call fcn.140003a60
xor edx, edx
mov r8d, ebx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x1400040b0
cmp rax, 0xffffffffffffffff
je 0x1400040b0
mov edx, 1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
test eax, eax
jne 0x1400040b8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
add rsp, 0x20
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
add rsp, 0x20
pop rbx
ret
Function at 0x1400040d0
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x4020
call fcn.14000d250
sub rsp, rax
xor edi, edi
xor sil, sil
mov rbp, rcx
mov dword [rsp + 0x4030], edi
test rcx, rcx
jne 0x140004103
xor al, al
jmp 0x140004186
lea r8, [rsp + 0x4030]
lea rcx, [rsp + 0x20]
mov edx, 0x4000
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x1400040fc
mov eax, dword [rsp + 0x4030]
shr eax, 2
mov dword [rsp + 0x4030], eax
test eax, eax
je 0x140004183
mov qword [rsp + 0x4038], rbx
lea rbx, [rsp + 0x20]
mov edx, dword [rbx]
test edx, edx
je 0x140004171
cmp edx, 4
je 0x140004171
cmp edx, 8
je 0x140004171
mov rcx, rbp
call fcn.140003e40
test al, al
je 0x14000416a
mov ecx, dword [rbx]
call fcn.140004060
movzx esi, al
test al, al
jne 0x14000417b
mov eax, dword [rsp + 0x4030]
inc edi
add rbx, 4
cmp edi, eax
jb 0x140004140
mov rbx, qword [rsp + 0x4038]
mov al, sil
lea r11, [rsp + 0x4020]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x140006537
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140012008]
jne 0x14000439a
rol rcx, 0x10
test cx, 0xffff
jne 0x140004396
repz ret
ror rcx, 0x10
jmp 0x140006490
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140013500]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x1400135f8]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140006515
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140013500]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140006537
mov rax, qword [rsp + 0x88]
mov qword [0x1400135f8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x140013598], rax
mov rax, qword [0x1400135f8]
mov qword [0x140013470], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140013580], rax
mov dword [0x140013460], 0xc0000409
mov dword [0x140013464], 1
mov rax, qword [0x140012008]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140012010]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x1400134f8], eax
mov ecx, 1
call fcn.14000a124
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x14000eab0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x1400134f8], 0
jne 0x1400065be
mov ecx, 1
call fcn.14000a124
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret