joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401641
Capabilities:
Delete registry value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rbp, qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
xor ebx, ebx
lea r12, str.DriveSize
mov word [rsp + 0x20], cx
mov word [rsp + 0x22], 0x5f
mov rdx, qword [r12 + rbx*8]
lea rdi, [rsp + 0x20]
inc rbx
lea rsi, [rdi + 4]
mov rcx, rsi
call sub.msvcrt.dll_wcscpy
mov rdx, rdi
mov rcx, qword [0x0040c758]
call rbp
cmp rbx, 0x11
jne 0x401667
lea r12, str.ImageFile
xor ebx, ebx
mov rdx, qword [r12 + rbx*8]
mov rcx, rsi
inc rbx
call sub.msvcrt.dll_wcscpy
mov rdx, rdi
mov rcx, qword [0x0040c758]
call rbp
cmp rbx, 5
jne 0x40169a
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x4016c6
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x298
lea r9, [0x0040c4a0]
mov edx, 0x118
lea r8, str.imdisk__D__m___s_
lea rbp, [0x0040c4a0]
lea rbx, [rsp + 0x60]
lea rsi, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__snwprintf]
mov edx, 1
mov rcx, rbx
call fcn.004010c8
lea rcx, [rsi + 4]
mov word [rsp + 0x42], 0x5f
lea rdx, str.RDMountPoint
call sub.msvcrt.dll_wcscpy
lea rdi, [rsp + 0x3c]
mov word [rsp + 0x40], 0x30
cmp word [rsp + 0x40], 0x39
ja 0x401782
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], rdi
mov rdx, rsi
mov dword [rsp + 0x3c], 0x230
mov rcx, qword [0x0040c758]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40177b
mov rdx, rbp
mov rcx, rbx
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x40177b
movzx ecx, word [rsp + 0x40]
call fcn.00401641
inc word [rsp + 0x40]
jmp 0x40172e
add rsp, 0x298
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x40185e
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x268
xor r9d, r9d
mov r8d, 0x14b
mov edx, 0x130
mov rcx, qword [0x0040b6f0]
mov rbx, qword [sym.imp.USER32.dll_SendDlgItemMessageW]
mov qword [rsp + 0x20], 0
lea rsi, [rsp + 0x38]
call rbx
lea rcx, [rsi + 4]
mov word [rsp + 0x3a], 0x5f
lea rdx, str.RDMountPoint
call sub.msvcrt.dll_wcscpy
lea rbp, [rsp + 0x34]
mov word [rsp + 0x38], 0x30
lea rdi, [rsp + 0x58]
cmp word [rsp + 0x38], 0x39
ja 0x401914
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], rbp
mov rdx, rsi
mov dword [rsp + 0x34], 0x208
mov rcx, qword [0x0040c758]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40190d
mov qword [rsp + 0x20], rdi
xor r9d, r9d
mov r8d, 0x143
mov edx, 0x130
mov rcx, qword [0x0040b6f0]
call rbx
inc word [rsp + 0x38]
jmp 0x4018bd
lea r8, [0x0040c4a0]
mov edx, 0x130
mov rcx, qword [0x0040b6f0]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
call fcn.0040108c
mov rcx, qword [0x0040b640]
mov edx, eax
call qword [sym.imp.USER32.dll_EnableWindow]
nop
add rsp, 0x268
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x4019a0
Capabilities:
Manipulate user privileges
Shutdown system

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x118
or rax, 0xffffffffffffffff
xor ebx, ebx
mov ecx, 0xb
lea rsi, str.SeLockMemoryPrivilege
mov qword [rsp + 0x38], rax
lea rdi, [rsp + 0x6c]
rep movsd dword [rdi], dword [rsi]
mov qword [rsp + 0x40], rax
xor eax, eax
cmp dword [0x0040c720], 0
mov ecx, 0xc
mov dword [rsp + 0x34], 0x44
lea rdi, [rsp + 0x98]
mov dword [rsp + 0x48], 0x2c002a
rep stosd dword [rdi], eax
lea rbp, [rsp + 0x6c]
mov qword [rsp + 0x50], rbp
je 0x401ba0
cmp dword [0x0040c714], 0
je 0x401ba0
mov dword [rsp + 0x5c], 1
mov dword [rsp + 0x68], 2
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x38]
mov edx, 0x20
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x401a9f
lea r8, [rsp + 0x60]
xor ecx, ecx
mov rdx, rbp
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
lea rdi, [rsp + 0x5c]
test eax, eax
je 0x401a9f
xor r9d, r9d
xor edx, edx
mov r8, rdi
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x401a9f
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x401a9f
mov rcx, qword [rsp + 0x38]
call rsi
jmp 0x401ba0
mov rcx, qword [rsp + 0x38]
mov ebx, 1
call rsi
mov r9d, 0x31
mov rdx, qword [0x0040b1e8]
lea r8, [0x0040818e]
mov rcx, qword [0x0040b6e0]
mov rsi, qword [sym.imp.USER32.dll_MessageBoxW]
call rsi
dec eax
jne 0x401ba0
lea rbx, [rsp + 0xcc]
xor edx, edx
mov ecx, 0x1a
lea r9, [rsp + 0x34]
mov r8, rbx
call qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
test eax, eax
je 0x401b63
lea r9, [rsp + 0x40]
xor ecx, ecx
mov r8d, 0x800
lea rdx, [rsp + 0x98]
call sub.ADVAPI32.dll_LsaOpenPolicy
test eax, eax
jne 0x401b63
mov rcx, qword [rsp + 0x40]
mov r9d, 1
mov rdx, rbx
lea r8, [rsp + 0x48]
call sub.ADVAPI32.dll_LsaAddAccountRights
test eax, eax
jne 0x401b63
mov r9d, 0x34
mov rdx, qword [0x0040b1f0]
lea r8, [0x0040818e]
mov rcx, qword [0x0040b6e0]
call rsi
cmp eax, 6
jne 0x401b91
mov edx, 0x80020004
xor ecx, ecx
call qword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0x401b91
mov rdx, qword [0x0040b1f8]
mov r9d, 0x10
mov rcx, qword [0x0040b6e0]
lea r8, [0x0040818e]
call rsi
mov rdx, qword [0x0040b1f8]
mov ecx, 0xff
call fcn.004012a3
mov rcx, qword [rsp + 0x40]
mov ebx, 1
call sub.ADVAPI32.dll_LsaClose
mov eax, ebx
add rsp, 0x118
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x403801
Capabilities:
Check for software breakpoints
Check if file exists
Create service
Delete service
Modify service
Persist via windows service
Start service
Stop service
Terminate process

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
add rsp, 0xffffffffffffff80
xor ebx, ebx
test byte [0x0040bc58], 1
mov esi, dword [0x0040c70c]
je 0x403828
xor ebx, ebx
cmp dword [0x0040bc5c], 0
setne bl
mov dword [0x0040b700], 0x5f0030
lea rdi, [0x0040b700]
mov r12d, 1
lea rbp, [rsp + 0x74]
cmp word [rdi], 0x5a
ja 0x40388e
lea rcx, str.Awealloc
mov rdx, rbp
call fcn.00401036
lea rcx, str.SyncFlags
mov rdx, rbp
test eax, eax
cmove esi, r12d
call fcn.00401036
test eax, eax
mov eax, dword [rdi]
cmove ebx, r12d
cmp ax, 0x39
jne 0x403887
mov word [0x0040b700], 0x41
jmp 0x403844
inc eax
mov word [rdi], ax
jmp 0x403844
test esi, esi
jne 0x40389f
mov rcx, qword [0x0040c898]
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov rcx, qword [0x0040c898]
mov rsi, qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call rsi
mov rcx, qword [0x0040c8a0]
mov r8d, 0x10032
lea rdx, str.ImDiskTk_svc
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test ebx, ebx
mov rcx, rax
mov qword [0x0040c898], rax
je 0x403a2a
lea rdx, [0x0040861a]
test rax, rax
lea rax, [0x0040b720]
je 0x40393f
mov qword [rsp + 0x38], rdx
mov r9d, 1
or r8d, 0xffffffff
mov edx, 0x10
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
jmp 0x403a16
mov qword [rsp + 0x50], rdx
mov r9d, 0x12
mov rcx, qword [0x0040c8a0]
mov qword [rsp + 0x60], 0
lea r8, str.ImDisk_Toolkit_helper_service
mov qword [rsp + 0x58], 0
lea rdx, str.ImDiskTk_svc
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0x10
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
test rax, rax
mov qword [0x0040c898], rax
je 0x4039fa
lea rdi, str.Service_used_for_data_synchronization_at_system_shutdown.
mov edx, 1
mov rcx, rax
mov rbx, qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
mov qword [rsp + 0x78], rdi
lea r8, [rsp + 0x78]
call rbx
cmp dword [0x0040c784], 5
jbe 0x403a16
mov dword [rsp + 0x70], 0x36ee80
lea r8, [rsp + 0x70]
mov edx, 7
mov rcx, qword [0x0040c898]
call rbx
jmp 0x403a16
mov r9d, 0x10
mov rdx, qword [0x0040b2a0]
xor ecx, ecx
lea r8, [0x0040818e]
call qword [sym.imp.USER32.dll_MessageBoxW]
xor r8d, r8d
xor edx, edx
mov rcx, qword [0x0040c898]
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
jmp 0x403a49
lea r8, [0x00407130]
mov edx, 1
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov rcx, qword [0x0040c898]
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov rcx, qword [0x0040c898]
call rsi
mov rcx, qword [0x0040c8a0]
call rsi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x14000117b
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor eax, eax
cpuid
mov eax, 1
cpuid
movabs r9, 0xb2d05e00
cpuid
rdtsc
shl rdx, 0x20
or rax, rdx
mov rcx, rax
fldpi
frndint
rdtsc
shl rdx, 0x20
or rax, rdx
sub rax, rcx
cmp rax, r9
jb 0x14000119e
push rbp
mov rbp, rsp
sub rsp, 8
mov r10, 0xa
mov rcx, 0xffffffff9f345678
dec rcx
xor r9, r9
mov rax, rcx
jne 0x1400011c9
xor rax, rax
mov rax, rbx
add rax, rdx
nop
nop
nop
dec r10
xor r11, r11
jne 0x1400011c2
xor rax, rax
mov rax, 0xa
dec rax
nop
nop
add rsp, 8
pop rbp
ret
Function at 0x1400039b0
Capabilities:
Print debug messages

Disassembly:
mov edx, dword [0x14002bfd8]
mov byte [0x14002bf31], 0
mov byte [0x14002bf30], 0
test edx, edx
jle 0x140003a4f
mov r9, qword [0x14002bf20]
test r9, r9
je 0x140003a4f
xor ecx, ecx
mov r8d, ecx
test edx, edx
jle 0x140003a35
lea rax, [r9 + 0x114]
cmp dword [rax], 0x3ea
jne 0x140003a00
inc r8d
add rax, 0x624
cmp r8d, edx
jl 0x1400039e8
jmp 0x140003a07
mov byte [0x14002bf31], 1
test edx, edx
jle 0x140003a35
lea rax, [r9 + 0x108]
cmp dword [rax + 0x210], 0
jne 0x140003a20
cmp dword [rax], 0
jge 0x140003a2e
inc ecx
add rax, 0x624
cmp ecx, edx
jge 0x140003a35
jmp 0x140003a12
mov byte [0x14002bf30], 1
lea r8, [0x14002bf30]
lea rdx, [0x14002bf31]
lea rcx, str.hasPX_d_linked_d
jmp fcn.140007150
ret
Function at 0x1400061a0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x460
mov rax, qword [0x140029008]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov rdi, rdx
mov r9d, ecx
lea r8, str..pipe__atiPipeDDV
lea rdx, str._ws_d
lea rcx, [rsp + 0x50]
xor esi, esi
mov dword [rsp + 0x40], esi
call qword [sym.imp.USER32.dll_wsprintfW]
lea r8, [rsp + 0x50]
lea rcx, str.WriteToPipe:_writing__d_bytes_to_pipe__ws
mov edx, 0xe1c
call fcn.140007150
mov qword [rsp + 0x30], rsi
lea rcx, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
lea rcx, [rax - 1]
mov rbx, rax
cmp rcx, 0xfffffffffffffffd
ja 0x1400062c5
lea r9, [rsp + 0x40]
mov r8d, 0xe1c
mov rdx, rdi
mov rcx, rax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14000627c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [rsp + 0x50]
lea rcx, str.WriteToPipe:_WriteFile__ws_failed_0x_x
mov r8d, eax
call fcn.140007150
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400062df
mov edx, dword [rsp + 0x40]
cmp edx, 0xe1c
je 0x1400062a5
lea rcx, str.WriteToPipe:_WriteFile_wrote_only__d_of__d_requested
mov r8d, 0xe1c
call fcn.140007150
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400062df
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [rsp + 0x40]
lea rcx, str.WriteToPipe:_wrote__d_bytes_to_pipe
call fcn.140007150
mov eax, 1
jmp 0x1400062e1
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [rsp + 0x50]
lea rcx, str.WriteToPipe:_CreateFile__ws_failed_0x_x
mov r8d, eax
call fcn.140007150
xor eax, eax
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.140007480
lea r11, [rsp + 0x460]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x1400063c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
push rdi
sub rsp, 0x30
mov rbx, rcx
mov rdi, rdx
lea rcx, str.WriteToPipe2:_writing__d_bytes_to_pipe
mov edx, 0xe1c
mov dword [rsp + 0x50], 0
call fcn.140007150
lea rax, [rbx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14000648d
lea r9, [rsp + 0x50]
mov r8d, 0xe1c
mov rdx, rdi
mov rcx, rbx
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140006441
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.WriteToPipe2:_WriteFile_failed_0x_x
mov edx, eax
call fcn.140007150
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov edx, dword [rsp + 0x50]
cmp edx, 0xe1c
je 0x14000646c
lea rcx, str.WriteToPipe2:_WriteFile_wrote_only__d_of__d_requested
mov r8d, 0xe1c
call fcn.140007150
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
lea rcx, str.WriteToPipe2:_wrote__d_bytes_to_pipe
mov edx, 0xe1c
call fcn.140007150
mov eax, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
lea rcx, str.WriteToPipe2:_invalid_pipe_handle
call fcn.140007150
mov rbx, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x30
pop rdi
ret
Function at 0x140006c00
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
lea rcx, str.usage:
call fcn.140007150
lea rcx, str.ataiw_____________u___adapter_________________to_get_current_utilization
call fcn.140007150
lea rcx, str.ataiw_____________sv__adapter___vsyncMode_____to_set_VSYNC_to_a_specific_mode
call fcn.140007150
lea rcx, str.ataiw_____________gv__adapter_________________to_get_VSYNC_mode
call fcn.140007150
lea rcx, str.ataiw_____________t___adapter_________________to_get_temperature
call fcn.140007150
lea rcx, str.atapi__p_pipenum__i__adapter__________________to_read_GPU_information
call fcn.140007150
lea rcx, str.atapi__p_pipenum__continuous__________________to_use_bi_directional_pipe_and_respond_to_command
add rsp, 0x28
jmp fcn.140007150
Function at 0x140007150
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
sub rsp, 0x860
mov rax, qword [0x140029008]
xor rax, rsp
mov qword [rsp + 0x850], rax
lea rcx, [rsp + 0x52]
xor ebx, ebx
xor edx, edx
mov r8d, 0x7fe
mov word [rsp + 0x50], bx
call fcn.14000a2f0
mov qword [rsp + 0x40], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, 0x400
lea r8, str._lu:
lea rcx, [rsp + 0x50]
mov r9d, eax
mov edx, ebx
call fcn.140003160
test eax, eax
js 0x140007234
mov ecx, ebx
lea rax, [rsp + 0x50]
cmp word [rax], 0
je 0x1400071d9
add rax, 2
dec rcx
jne 0x1400071c8
jmp 0x140007234
test rcx, rcx
je 0x140007234
mov rax, rbx
sub rax, rcx
sub rbx, rax
cmp rbx, 1
jbe 0x140007234
lea rdx, [rsp + 0x878]
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x30], rdx
lea rcx, [rcx + rax*2]
mov rax, qword [rsp + 0x870]
mov rdx, rbx
mov qword [rsp + 0x28], rax
call fcn.140003030
test eax, eax
js 0x140007234
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rcx, [0x140025c04]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rsp + 0x850]
xor rcx, rsp
call fcn.140007480
add rsp, 0x860
pop rbx
ret

Function at 0x14000aafc
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.14000a964
Function at 0x140009330
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x1402b7008]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edx, edx
mov rdi, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400093ba
nop word [rax + rax]
lea rcx, [rsp + 0x4c]
mov r8, rdi
sub r8, rcx
nop dword [rax + rax]
movzx edx, word [rcx]
movzx eax, word [rcx + r8]
sub edx, eax
jne 0x1400093a4
add rcx, 2
test eax, eax
jne 0x140009390
mov rcx, rbx
test edx, edx
je 0x1400093e6
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140009380
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140281dc0
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, dword [rsp + 0x28]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
jmp 0x1400093c5

Function at 0x140009400
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x1402b7008]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edx, edx
mov rdi, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000948a
nop word [rax + rax]
lea rcx, [rsp + 0x4c]
mov r8, rdi
sub r8, rcx
nop dword [rax + rax]
movzx edx, word [rcx]
movzx eax, word [rcx + r8]
sub edx, eax
jne 0x140009474
add rcx, 2
test eax, eax
jne 0x140009460
mov rcx, rbx
test edx, edx
je 0x1400094b6
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140009450
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140281dc0
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x28]
jmp 0x140009495

Function at 0x1400094d0
Capabilities:
Acquire debug privileges

Disassembly:
sub rsp, 0x68
mov rax, qword [0x1402b7008]
xor rax, rsp
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea r8, [rsp + 0x38]
xor ecx, ecx
lea rdx, str.SeDebugPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rax, qword [rsp + 0x38]
lea r8, [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
xor edx, edx
mov qword [rsp + 0x44], rax
xor eax, eax
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x4c], 2
lea r9d, [rax + 0x10]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140281dc0
add rsp, 0x68
ret
Function at 0x14000b670
Capabilities:
Initialize winhttp library
Reference http user-agent string

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x80
mov qword [r11 - 0x58], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov rax, qword [0x1402b7008]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rsi, rdx
mov rdi, rcx
mov qword [r11 - 0x48], rcx
xor ebp, ebp
mov qword [rcx + 0x18], 7
mov qword [rcx + 0x10], rbp
cmp qword [rcx + 0x18], 8
jb 0x14000b6c2
mov rax, qword [rcx]
jmp 0x14000b6c5
mov rax, rdi
mov word [rax], bp
lea rax, [rcx + 0x20]
mov qword [rax + 0x18], 7
mov qword [rax + 0x10], rbp
cmp qword [rax + 0x18], 8
jb 0x14000b6e2
mov rax, qword [rax]
mov word [rax], bp
lea rax, [rcx + 0x40]
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], rbp
cmp qword [rax + 0x18], 0x10
jb 0x14000b6ff
mov rax, qword [rax]
mov byte [rax], 0
lea rax, [rcx + 0x60]
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], rbp
cmp qword [rax + 0x18], 0x10
jb 0x14000b71c
mov rax, qword [rax]
mov byte [rax], 0
mov qword [rcx + 0x80], rbp
mov qword [rcx + 0x88], rbp
mov qword [rcx + 0x90], rbp
mov rdx, qword [rdx + 0x18]
cmp rdx, 0x10
jb 0x14000b743
mov rcx, qword [rsi]
jmp 0x14000b746
mov rcx, rsi
mov rbx, qword [rsi + 0x10]
add rbx, rcx
cmp rdx, 0x10
jb 0x14000b756
mov rsi, qword [rsi]
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], rbp
mov word [rsp + 0x50], bp
mov rdx, rbx
sub rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.140009e10
mov r8, rbx
mov rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.140009ee0
nop
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.14000bf40
nop
mov r8, qword [rsp + 0x68]
cmp r8, 8
jb 0x14000b7b0
inc r8
mov rdx, qword [rsp + 0x50]
call fcn.140003c30
mov dword [rsp + 0x20], ebp
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_114.0.0.0_Safari_537.36
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov qword [rdi + 0x80], rax
test rax, rax
je 0x14000b7fd
cmp qword [rdi + 0x18], 8
jb 0x14000b7e1
mov rdx, qword [rdi]
jmp 0x14000b7e4
mov rdx, rdi
mov r8d, CDataRecoveryHandler::CDataRecoveryHandler
xor r9d, r9d
mov rcx, rax
call qword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov qword [rdi + 0x88], rax
mov rax, rdi
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140281dc0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14000bd50
Capabilities:
Prepare http request
Receive http response

Disassembly:
push rsi
push r14
sub rsp, 0x58
mov rsi, rcx
mov r14, rdx
mov rcx, qword [rcx + 0x88]
test rcx, rcx
jne 0x14000bd74
xor al, al
add rsp, 0x58
pop r14
pop rsi
ret
cmp qword [rsi + 0x38], 8
lea r8, [rsi + 0x20]
mov qword [rsp + 0x40], r15
jb 0x14000bd87
mov r8, qword [r8]
xor r15d, r15d
mov dword [rsp + 0x30], 0x800000
mov qword [rsp + 0x28], r15
lea rdx, [0x140297de0]
xor r9d, r9d
mov qword [rsp + 0x20], r15
call qword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov qword [rsi + 0x90], rax
test rax, rax
jne 0x14000bdc5
mov r15, qword [rsp + 0x40]
add rsp, 0x58
pop r14
pop rsi
ret
mov qword [rsp + 0x30], r15
xor r9d, r9d
mov dword [rsp + 0x28], r15d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], r15d
mov rcx, rax
mov qword [rsp + 0x50], rbp
call qword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
mov ebp, eax
test eax, eax
je 0x14000bf1a
mov rcx, qword [rsi + 0x90]
xor edx, edx
call qword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
mov ebp, eax
test eax, eax
je 0x14000bf1a
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x78], rbx
mov dword [rsp + 0x80], r15d
nop
mov rcx, qword [rsi + 0x90]
lea rdx, [rsp + 0x70]
mov dword [rsp + 0x70], r15d
call qword [sym.imp.WINHTTP.dll_WinHttpQueryDataAvailable]
test eax, eax
jne 0x14000be70
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x140297da8]
mov ebx, eax
call fcn.1400144a0
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, str._in_WinHttpQueryDataAvailable._n
call fcn.1400144a0
mov ecx, dword [rsp + 0x70]
inc ecx
call qword [sym.imp.mfc140u.dll_operator_1]
mov r8d, dword [rsp + 0x70]
xor edx, edx
inc r8d
mov rcx, rax
mov rdi, rax
call sub.VCRUNTIME140.dll_memset
mov r8d, dword [rsp + 0x70]
lea r9, [rsp + 0x80]
mov rcx, qword [rsi + 0x90]
mov rdx, rdi
call qword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
jne 0x14000bee9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x140297da8]
mov ebx, eax
call fcn.1400144a0
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, str._in_WinHttpReadData._n
call fcn.1400144a0
jmp 0x14000befc
mov r8d, dword [rsp + 0x80]
mov rdx, rdi
mov rcx, r14
call fcn.1400120c0
mov rcx, rdi
call qword [sym.imp.mfc140u.dll_operator]
cmp dword [rsp + 0x70], r15d
ja 0x14000be20
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x78]
mov r15, qword [rsp + 0x40]
test ebp, ebp
mov rbp, qword [rsp + 0x50]
setne al
add rsp, 0x58
pop r14
pop rsi
ret
Function at 0x1400122d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub r8, rdx
movabs rax, 0xcbf29ce484222325
sar r8, 1
mov r9d, 0
add r8, r8
je 0x140012314
movabs r10, 0x100000001b3
nop word [rax + rax]
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x140012300
ret