joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400cd7f8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rax, rdx
add rdx, 8
cmp qword [rax], 0
je 0x1400cd840
cmp qword [rax + 0x38], 0xffffffffffffffff
mov r8, qword [rax + 0x48]
mov r9, qword [rax + 0x50]
mov r10, qword [rax + 0x58]
mov rax, qword [rax + 0x60]
je 0x1400cd92e
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r10
mov byte [rsp + 0x30], 0
jmp 0x1400cd93d
mov bl, byte [rax + 0x1a]
mov r8, qword [rax + 8]
mov r10, qword [rax + 0x48]
mov r9, qword [rax + 0x50]
mov sil, byte [rax + 0x18]
xor r11d, r11d
test bl, bl
jne 0x1400cd963
mov edi, esi
xor dil, 1
mov byte [rax + 0x18], dil
test r8, r8
je 0x1400cd884
cmp r8, r9
jae 0x1400cd87e
cmp byte [r10 + r8], 0xbf
jg 0x1400cd884
jmp 0x1400cd973
jne 0x1400cd973
cmp r8, r9
je 0x1400cd944
mov r14b, byte [r10 + r8]
movzx edi, r14b
test dil, dil
jns 0x1400cd8f2
mov ebp, edi
and ebp, 0x1f
movzx r15d, byte [r10 + r8 + 1]
and r15d, 0x3f
cmp dil, 0xdf
jbe 0x1400cd8e3
movzx edi, byte [r10 + r8 + 2]
shl r15d, 6
and edi, 0x3f
or edi, r15d
cmp r14b, 0xf0
jb 0x1400cd8ed
movzx r14d, byte [r10 + r8 + 3]
and ebp, 7
shl ebp, 0x12
shl edi, 6
and r14d, 0x3f
or r14d, edi
or r14d, ebp
mov edi, r14d
jmp 0x1400cd8f2
shl ebp, 6
or ebp, r15d
mov edi, ebp
jmp 0x1400cd8f2
shl ebp, 0xc
or edi, ebp
test sil, sil
jne 0x1400cd952
mov esi, 1
cmp edi, 0x80
jb 0x1400cd920
mov esi, 2
cmp edi, 0x800
jb 0x1400cd920
cmp edi, 0x10000
mov esi, 4
sbb rsi, 0
add r8, rsi
mov qword [rdx], r8
mov sil, 1
jmp 0x1400cd856
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r10
mov byte [rsp + 0x30], 1
call fcn.14000bc74
jmp 0x1400cd966
test sil, sil
jne 0x1400cd955
mov byte [rax + 0x1a], 1
xor r11d, r11d
jmp 0x1400cd963
mov r9, r8
mov qword [rcx + 8], r9
mov qword [rcx + 0x10], r9
mov r11d, 1
mov qword [rcx], r11
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
lea rax, str._rustc_eeb90cda1969383f56a2637cbd3037bdf598841clibrarycore_src_strpattern.rsError_rustc_eeb90cda1969383f56a2637cbd3037bdf598841clibrary_alloc_src_vecmod.rsD
mov qword [rsp + 0x20], rax
mov rcx, r10
mov rdx, r9
call fcn.1402daa80
int3

Function at 0x1400cdce7
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
mov eax, edx
lea r9, [rsp + 0x34]
mov dword [r9], r8d
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, eax
call sub.WS2_32.dll_setsockopt
cmp eax, 0xffffffff
je 0x1400cdd13
xor eax, eax
jmp 0x1400cdd18
call fcn.1400cb5f5
nop
add rsp, 0x38
ret
Function at 0x1400ce737
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x248
movaps xmmword [rsp + 0x230], xmm6
mov r12, r8
mov rsi, rdx
mov qword [rsp + 0x130], rcx
lea rax, [r8 + 0x18]
mov qword [rsp + 0x60], rax
lea rax, [r8 + 0x6d8]
mov qword [rsp + 0xc0], rax
lea rax, [r8 + 0x400]
mov qword [rsp + 0x88], rax
lea rax, [r8 + 0x418]
mov qword [rsp + 0x1c0], rax
lea rax, [r8 + 0x654]
mov qword [rsp + 0x218], rax
lea r15, [r8 + 0x2c0]
lea rbp, [r8 + 0x3e0]
lea rax, [r8 + 0x690]
mov qword [rsp + 0x1b8], rax
lea rax, [r8 + 0x40]
mov qword [rsp + 0x210], rax
mov byte [rsp + 0x37], r9b
and r9b, 0xfb
mov byte [rsp + 0x57], r9b
lea rax, [r8 + 0x6a8]
mov qword [rsp + 0x1d8], rax
xorps xmm6, xmm6
xor eax, eax
mov qword [rsp + 0x128], rax
mov qword [rsp + 0x58], r8
mov qword [rsp + 0x80], r15
mov qword [rsp + 0x48], rbp
Function at 0x1401069f0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rdx, rcx
cmp rdx, 0x20
jae 0x140106a03
pop rbp
jmp fcn.14006f6a0
nop
pop rbp
jmp fcn.140066640

Function at 0x14010b050
Capabilities:
Get remote cert context via schannel

Disassembly:
sub rsp, 0x28
lea r8, [rsp + 0x20]

Function at 0x140115a20
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov rsi, rcx
movups xmm0, xmmword [0x1403a3588]
movaps xmmword [rbp], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
mov rax, rbp
mov qword [rsp + 0x20], rax
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x140115a91
mov rcx, rsi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rbp]
cmp eax, 0x103
je 0x140115abe
test eax, eax
js 0x140115a9d
mov rdx, qword [rbp + 8]
xor eax, eax
jmp 0x140115ab4
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xa8
pop rsi
pop rbp
ret
mov dword [rbp + 0x18], 0
mov byte [rbp + 0x1c], 0
lea rax, [0x1403a35e8]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
lea rax, [rbp + 0x20]
mov qword [rbp - 0x28], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rcx, [rbp + 0x18]
lea rdx, [rbp - 0x38]
call case.0x1400fac08.365
mov qword [rbp - 8], rax
lea rcx, [rbp - 8]
call fcn.140115220
mov ecx, 7
int 0x29
ud2

Function at 0x140119f50
Capabilities:
Query environment variable

Disassembly:
push rbp
push r15
push r14
push rsi
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x4a8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x420], 0xfffffffffffffffe
mov dword [rbp + 0x420], 0xfffffffe

Function at 0x14011d190
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
mov rcx, qword [rcx]
mov ecx, dword [rcx]
Function at 0x140120970
Capabilities:
Resolve dns

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x1e8
lea rbp, [rsp + 0x80]
mov rax, rdx
mov rsi, rcx
mov rdx, qword [rdx]
mov rdi, qword [rax + 8]
movzx eax, word [rax + 0x10]
mov word [rbp + 0x166], ax
mov eax, dword [0x14041a968]
cmp eax, 4
jne 0x140120b61
lea rax, [rbp + 0x166]
mov qword [rbp + 0x150], rax
cmp rdi, 0x17f
ja 0x140120b71
lea rbx, [rbp - 0x60]
mov rcx, rbx
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rdi - 0x60], 0
lea rax, [rdi + 1]
cmp rdi, 0xe
ja 0x140120a08
xor edx, edx
nop word cs:[rax + rax]
cmp byte [rbp + rdx - 0x60], 0
je 0x140120ac4
inc rdx
cmp rax, rdx
jne 0x1401209f0
jmp 0x140120b2c
lea rcx, [rbp - 0x59]
and rcx, 0xfffffffffffffff8
sub rcx, rbx
je 0x140120a3e
xor edx, edx
nop word [rax + rax]
cmp byte [rbp + rdx - 0x60], 0
je 0x140120ac4
inc rdx
cmp rcx, rdx
jne 0x140120a20
lea rdx, [rdi - 0xf]
cmp rcx, rdx
jbe 0x140120a42
jmp 0x140120a8e
lea rdx, [rdi - 0xf]
movdqa xmm0, xmmword [0x1402e1eb0]
movabs r8, 0x8080808080808080
nop word cs:[rax + rax]
movdqu xmm1, xmmword [rbp + rcx - 0x60]
movdqa xmm2, xmm1
paddq xmm2, xmm0
pandn xmm1, xmm2
pshufd xmm2, xmm1, 0xee
por xmm2, xmm1
movq r9, xmm2
test r9, r8
jne 0x140120a8e
add rcx, 0x10
cmp rcx, rdx
jbe 0x140120a60
sub rax, rcx
je 0x140120b2c
lea r8, [rcx + rbp]
add r8, 0xffffffffffffffa0
xor edx, edx
nop word cs:[rax + rax]
cmp byte [r8 + rdx], 0
je 0x140120ac1
inc rdx
cmp rax, rdx
jne 0x140120ab0
jmp 0x140120b2c
add rdx, rcx
cmp rdx, rdi
jne 0x140120b2c
pxor xmm0, xmm0
movdqa xmmword [rbp + 0x120], xmm0
movdqa xmmword [rbp + 0x140], xmm0
movdqa xmmword [rbp + 0x130], xmm0
mov dword [rbp + 0x128], 1
mov qword [rbp + 0x158], 0
lea rcx, [rbp - 0x60]
lea r8, [rbp + 0x120]
lea r9, [rbp + 0x158]
xor edx, edx
call qword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
je 0x140120b40
call sub.WS2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
mov ecx, 1
jmp 0x140120b58
lea rax, str.i:_
mov qword [rsi + 8], rax
mov qword [rsi], 1
jmp 0x140120b83
mov rax, qword [rbp + 0x158]
movzx ecx, word [rbp + 0x166]
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], cx
xor ecx, ecx
mov qword [rsi + 8], rax
mov qword [rsi], rcx
jmp 0x140120b83
mov rbx, rdx
call case.0x14011e4eb.164
mov rdx, rbx
jmp 0x1401209aa
lea r9, [rbp + 0x150]
mov rcx, rsi
mov r8, rdi
call fcn.1402debe0
nop
add rsp, 0x1e8
pop rbx
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401218b0
Capabilities:
Create thread

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, r8
mov r14, rdx
mov rsi, rcx
movzx eax, byte [0x14041aa10]
mov edx, reloc.WS2_32.dll_recv
xor ecx, ecx
call fcn.1401222c0
test rax, rax
je 0x14012198f
mov rbx, rax
mov qword [rax], r14
mov qword [rax + 8], rdi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x140121a30]
xor edi, edi
xor ecx, ecx
mov rdx, rsi
mov r9, rax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x140121981
mov rax, qword [rbx]
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x20], rbx
mov rax, qword [rbx + 8]
mov qword [rbp - 0x10], rax
mov rax, qword [rax]
test rax, rax
je 0x140121947
mov rcx, qword [rbp - 0x18]
call rax
mov rcx, qword [rbp - 0x18]
mov rax, qword [rbp - 0x10]
cmp qword [rax + 8], 0
je 0x14012195f
mov rdx, qword [rax + 0x10]
call fcn.140055ea0
mov edx, 8
mov rcx, qword [rbp - 0x20]
call fcn.140055ea0
call sub.KERNEL32.dll_GetLastError
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov edi, 1
mov rax, rdi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov qword [rbp - 0x10], r14
mov qword [rbp - 0x18], rdi
mov ecx, 8
mov edx, reloc.WS2_32.dll_recv
call fcn.1402d9fb0
ud2

Function at 0x140125dc0
Capabilities:
Check if file exists

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x2e8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x260], 0xfffffffffffffffe
mov rsi, rcx
test r8, r8
je 0x140125f51
js 0x1401260f8
mov rdi, r8
mov rbx, rdx
movzx eax, byte [0x14041aa10]
xor ecx, ecx
mov rdx, r8
call fcn.1401222c0
test rax, rax
je case.0x14011bdec.555
mov qword [rbp + 0x250], rax
mov rcx, rax
mov rdx, rbx
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
movzx eax, byte [0x14041aa10]
xor ecx, ecx
mov rdx, rdi
call fcn.1401222c0
test rax, rax
je 0x14012610a
mov r14, rax
mov rcx, rax
mov rdx, rbx
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp - 0x58], rdi
mov qword [rbp - 0x50], r14
mov qword [rbp - 0x48], rdi
mov byte [rbp - 0x40], 0
lea rdx, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
lea rcx, [rbp - 0x58]
mov r8d, 1
call case.0x14011c02b.204
mov rax, qword [rbp - 0x58]
mov qword [rbp + 0x240], rax
mov rdx, qword [rbp - 0x50]
mov r8, qword [rbp - 0x48]
mov r8d, 0x25e85c6
add byte [rax], al
add dword [rax - 0x73], ecx
lea edx, [rax]
add al, byte [rax]
invalid
movabs rax, 0x300000002
call fcn.140063030
Function at 0x140126f50
Capabilities:
Copy file

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x90
lea rbp, [rsp + 0x80]
mov qword [rbp + 8], 0xfffffffffffffffe
mov rsi, r9
mov rdi, r8
mov r8, rdx
mov rdx, rcx
lea rcx, [rbp - 0x38]
call fcn.14011a380
mov rax, qword [rbp - 0x38]
mov rdx, qword [rbp - 0x30]
movabs rbx, 0x8000000000000000
cmp rax, rbx
je 0x140126fc3
mov rcx, qword [rbp - 0x28]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov qword [rbp - 0x10], rcx
lea rcx, [rbp - 0x50]
lea rdx, [rbp - 0x20]
call fcn.14011c3f0
mov rax, qword [rbp - 0x50]
mov rdx, qword [rbp - 0x48]
cmp rax, rbx
jne 0x140126fd6
mov eax, 1
add rsp, 0x90
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov qword [rbp - 8], rax
mov qword [rbp], rdx
lea rcx, [rbp - 0x38]
mov rdx, rdi
mov r8, rsi
call fcn.14011a380
mov rax, qword [rbp - 0x38]
mov rsi, qword [rbp - 0x30]
cmp rax, rbx
je 0x140127024
mov rcx, qword [rbp - 0x28]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rsi
mov qword [rbp - 0x10], rcx
lea rcx, [rbp - 0x50]
lea rdx, [rbp - 0x20]
call fcn.14011c3f0
mov rdi, qword [rbp - 0x50]
mov rsi, qword [rbp - 0x48]
cmp rdi, rbx
jne 0x140127053
mov rcx, qword [rbp]
mov r14, qword [rbp - 8]
mov rdx, rsi
mov eax, 1
test r14, r14
je 0x140126fc8
mov rsi, rdx
mov edx, 2
call fcn.140055ea0
mov eax, 1
mov rdx, rsi
jmp 0x140126fc8
mov qword [rbp - 0x20], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r8, [0x140127140]
lea r9, [rbp - 0x20]
mov rcx, qword [rbp]
mov rbx, rcx
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_CopyFileExW]
test eax, eax
mov r14, qword [rbp - 8]
je 0x1401270ca
mov rdx, qword [rbp - 0x20]
test rdi, rdi
je 0x1401270ab
mov rdi, rdx
mov edx, 2
mov rcx, rsi
call fcn.140055ea0
mov rdx, rdi
test r14, r14
je 0x1401270c3
mov rsi, rdx
mov edx, 2
mov rcx, rbx
call fcn.140055ea0
mov rdx, rsi
xor eax, eax
jmp 0x140126fc8
call sub.KERNEL32.dll_GetLastError
mov edx, eax
shl rdx, 0x20
or rdx, 2
test rdi, rdi
je 0x1401270f1
mov rdi, rdx
mov edx, 2
mov rcx, rsi
call fcn.140055ea0
mov rdx, rdi
mov rcx, rbx
jmp 0x14012702f
Function at 0x140127490
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov eax, 1
test rcx, rcx
jne 0x140127628
mov eax, dword [0x14041a968]
cmp eax, 4
jne 0x1401275f9
mov rdi, rdx
cmp word [rdx], 0
mov eax, 2
mov esi, reloc.WS2_32.dll_socket
cmove esi, eax
mov dword [rsp + 0x28], 0x81
mov dword [rsp + 0x20], 0
mov ecx, esi
mov edx, 2
xor r8d, r8d
xor r9d, r9d
call sub.WS2_32.dll_WSASocketW
cmp rax, 0xffffffffffffffff
je 0x14012751e
cmp word [rdi], 0
je 0x14012758b
movups xmm0, xmmword [rdi + 4]
mov ecx, dword [rdi + 0x14]
mov r9d, dword [rdi + 0x18]
movzx edx, word [rdi + 0x1c]
mov r8d, 0x1c
mov r10w, reloc.WS2_32.dll_socket
jmp 0x1401275a0
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x2739
je 0x140127537
mov edx, eax
cmp eax, 0x2726
jne 0x14012761b
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0
mov ecx, esi
mov edx, 2
xor r8d, r8d
xor r9d, r9d
call sub.WS2_32.dll_WSASocketW
cmp rax, 0xffffffffffffffff
je 0x1401275f0
mov rsi, rax
mov rcx, rax
mov edx, 1
xor r8d, r8d
call sub.KERNEL32.dll_SetHandleInformation
test eax, eax
je 0x140127609
mov rax, rsi
cmp word [rdi], 0
jne 0x1401274ff
mov ecx, dword [rdi + 2]
movzx edx, word [rdi + 6]
xorps xmm0, xmm0
mov r8d, reloc.WS2_32.dll_recv
mov r10w, 2
rol dx, 8
mov word [rbp - 0x1c], r10w
mov word [rbp - 0x1a], dx
mov dword [rbp - 0x18], ecx
movups xmmword [rbp - 0x14], xmm0
mov dword [rbp - 4], r9d
lea rdx, [rbp - 0x1c]
mov rsi, rax
mov rcx, rax
call sub.WS2_32.dll_bind
cmp eax, 0xffffffff
je 0x1401275d3
xor eax, eax
mov rdx, rsi
jmp 0x140127628
call sub.WS2_32.dll_WSAGetLastError
mov edi, eax
shl rdi, 0x20
or rdi, 2
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_closesocket]
mov rdx, rdi
jmp 0x140127623
call sub.WS2_32.dll_WSAGetLastError
mov edx, eax
jmp 0x14012761b
mov rsi, rdx
call case.0x14011e4eb.164
mov rdx, rsi
jmp 0x1401274b9
call sub.KERNEL32.dll_GetLastError
mov edi, eax
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_closesocket]
mov edx, edi
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x14012be6a
Capabilities:
Accept command line arguments

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rax, rdx
mov rsi, rcx
lea rdx, [rsp + 0x2c]
mov rcx, rax
call sub.shell32.dll_CommandLineToArgvW
test rax, rax
je 0x14012bf07
mov rdi, rax
lea rbx, [rsp + 0x30]
and qword [rbx], 0
mov qword [rbx + 8], 8
and qword [rbx + 0x10], 0
movsxd r12, dword [rsp + 0x2c]
shl r12, 3
xor r13d, r13d
lea r14, [rsp + 0x48]
cmp r12, r13
je 0x14012beeb
mov r15, qword [rdi + r13]
mov rcx, r15
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
mov rcx, r14
mov rdx, r15
mov r8, rax
call fcn.140129917
mov rcx, rbx
mov rdx, r14
call fcn.14012c112
add r13, 8
jmp 0x14012bebb
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm0
mov rax, qword [rsp + 0x40]
mov qword [rsi + 0x10], rax
jmp 0x14012bf18
and qword [rsi], 0
mov qword [rsi + 8], 8
and qword [rsi + 0x10], 0
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x14012d03e
Capabilities:
Get memory capacity

Disassembly:
push rsi
push rdi
sub rsp, 0xe8
movaps xmmword [rsp + 0xd0], xmm6
mov rsi, rcx
xorps xmm6, xmm6
lea rdi, [rsp + 0x90]
movaps xmmword [rdi], xmm6
movaps xmmword [rdi + 0x30], xmm6
movaps xmmword [rdi + 0x20], xmm6
movaps xmmword [rdi + 0x10], xmm6
mov dword [rdi], 0x40
mov rcx, rdi
call sub.KERNEL32.dll_GlobalMemoryStatusEx
mov rax, qword [rdi + 8]
mov qword [rsi + 0x138], rax
mov rax, qword [rdi + 0x10]
mov qword [rsi + 0x140], rax
lea rcx, [rsp + 0x20]
movaps xmmword [rcx + 0x50], xmm6
movaps xmmword [rcx + 0x40], xmm6
movaps xmmword [rcx + 0x30], xmm6
movaps xmmword [rcx + 0x20], xmm6
movaps xmmword [rcx + 0x10], xmm6
movaps xmmword [rcx], xmm6
and qword [rcx + 0x60], 0
mov edx, 0x68
call sub.PSAPI.DLL_GetPerformanceInfo
cmp eax, 1
jne 0x14012d111
mov rdx, qword [rsp + 0x30]
mov r9, qword [rsp + 0x40]
xor r10d, r10d
sub rdx, r9
cmovb rdx, r10
mov rcx, qword [rsp + 0x70]
mov rax, rcx
mul rdx
mov r8, rax
mov r11, 0xffffffffffffffff
cmovo r8, r11
mov rdx, qword [rsp + 0x28]
sub rdx, r9
cmovb rdx, r10
mov rax, rcx
mul rdx
cmovo rax, r11
mov qword [rsi + 0x148], r8
mov qword [rsi + 0x150], rax
movaps xmm6, xmmword [rsp + 0xd0]
add rsp, 0xe8
pop rdi
pop rsi
ret
Function at 0x14012d8af
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x3b8
mov esi, edx
mov rbx, rcx
mov word [rsp + 0x44], si
mov eax, edx
shr eax, 0x10
mov byte [rsp + 0x46], al
lea r15, [rsp + 0xe8]
mov r14d, 0x80000
mov edx, 0x80000
mov rcx, r15
call fcn.140015e0e
lea r12, [rsp + 0x190]
mov r13, qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
and dword [rsp + 0x190], 0
mov rcx, r15
mov rdx, r14
call fcn.14012c8a6
mov rdi, qword [rsp + 0xf0]
mov ecx, 5
mov rdx, rdi
mov r8d, r14d
mov r9, r12
call r13
cmp eax, 0xc0000004
jne 0x14012d94a
mov eax, dword [rsp + 0x190]
add r14, r14
lea ecx, [rax + 0x2800]
test eax, eax
cmovne r14, rcx
jmp 0x14012d8ff
test eax, eax
jne 0x14012d9f3
mov qword [rsp + 0xf8], r14
mov ecx, 8
mov edx, 0xfa0
call fcn.140057a2b
test rax, rax
je 0x14012e063
lea r14, [rsp + 0x90]
mov qword [r14], 0x1f4
mov qword [r14 + 8], rax
and qword [r14 + 0x10], 0
xor r15d, r15d
xor r12d, r12d
cmp r15, qword [rsp + 0x90]
jne 0x14012d9aa
mov rcx, r14
call fcn.14016a1f9
mov rax, qword [rsp + 0x98]
lea rcx, [rdi + r12]
mov qword [rax + r15*8], rcx
inc r15
mov qword [rsp + 0xa0], r15
mov ecx, dword [rcx]
add r12, rcx
test rcx, rcx
jne 0x14012d990
lea rax, [rbx + 0xd8]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x100], rax
test sil, sil
je 0x14012da03
mov rcx, rbx
xor edx, edx
call fcn.14012e276
mov rax, qword [rbx + 0x80]
jmp 0x14012da05
mov rcx, qword [rsp + 0xe8]
mov rdx, rdi
jmp 0x14012e038
xor eax, eax
mov qword [rsp + 0x108], rax
call fcn.140122220
mov r8d, edx
lea rsi, [rsp + 0x190]
mov rcx, rsi
mov edx, eax
call fcn.140122250
cmp qword [rsi], 0
jne 0x14012da37
mov rax, qword [rsp + 0x198]
xor eax, eax
mov ecx, 8
mov edx, 0xfa0
call fcn.1402d9f90

Function at 0x14012e0b3
Capabilities:
Get disk size

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
imul rbx, rdx, 0x90
xor r14d, r14d
lea rdi, [rsp + 0x28]
mov r15, rcx
cmp rbx, r14
je 0x14012e118
cmp qword [r15 + 0x78], 0
je 0x14012e108
and qword [rsp + 0x28], 0
mov rcx, qword [rsi + r14 + 0x50]
xor edx, edx
xor r8d, r8d
mov r9, rdi
call sub.KERNEL32.dll_GetDiskFreeSpaceExW
test eax, eax
je 0x14012e108
mov rax, qword [rsp + 0x28]
mov qword [rsi + r14 + 0x80], rax
add r15, 0x90
add r14, 0x90
jmp 0x14012e0d3
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14012e276
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x178
cmp qword [rcx + 0x80], 0
jne 0x14012e888
mov r13d, edx
mov rbx, rcx
xorps xmm0, xmm0
lea rcx, [rsp + 0x140]
movaps xmmword [rcx + 0x20], xmm0
movaps xmmword [rcx + 0x10], xmm0
movaps xmmword [rcx], xmm0
call sub.KERNEL32.dll_GetSystemInfo
mov eax, 0x80000000
xor ecx, ecx
mov r8, rbx
cpuid
xchg rbx, r8
cmp eax, 0x80000003
mov byte [rsp + 0x2f], r13b
mov qword [rsp + 0x68], rbx
jbe 0x14012e384
mov dword [rsp + 0x30], eax
mov ecx, 4
mov edx, 0x50
call fcn.140057a2b
test rax, rax
je 0x14012e8a9
mov r8, rax
lea rax, [rsp + 0x38]
mov qword [rax], 5
mov qword [rax + 8], r8
mov eax, 0x80000000
mov r12d, listen
xor r15d, r15d
xor r13d, r13d
mov r9d, dword [rsp + 0x30]
mov qword [rsp + 0x48], r15
test r13b, 1
jne 0x14012e39e
cmp eax, r9d
ja 0x14012e39e
setae r13b
mov edi, eax
adc edi, 0
xor ecx, ecx
mov rsi, rbx
cpuid
xchg rbx, rsi
mov ebx, ecx
mov ebp, edx
mov r14d, eax
cmp r15, qword [rsp + 0x38]
jne 0x14012e366
lea rcx, [rsp + 0x38]
call fcn.14012c8bd
mov r9d, dword [rsp + 0x30]
mov r8, qword [rsp + 0x40]
mov dword [r8 + r12 - 0xc], r14d
mov dword [r8 + r12 - 8], esi
mov dword [r8 + r12 - 4], ebx
mov dword [r8 + r12], ebp
inc r15
add r12, 0x10
mov eax, edi
jmp 0x14012e321
and qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 1
and qword [rsp + 0x60], 0
jmp 0x14012e4fa
lea rdi, [rsp + 0x88]
mov edx, 0x30
mov rcx, rdi
call fcn.140015e0e
mov rsi, qword [rsp + 0x40]
shl r15, 4
add r15, rsi
mov eax, 2
mov ebx, 5
xor ecx, ecx
mov r14, rsi
mov r13b, byte [rsp + 0x2f]
test cl, 1
je 0x14012e3e7
test rbx, rbx
je 0x14012e447
cmp r14, r15
je 0x14012e447
dec rbx
jmp 0x14012e40b
cmp rbx, rax
jbe 0x14012e447
mov rcx, r15
sub rcx, r14
shr rcx, 4
cmp rcx, rax
jbe 0x14012e447
mov rcx, rax
not rcx
add rbx, rcx
shl rax, 4
add r14, rax
lea r12, [r14 + 0x10]
mov edx, dword [r14]
mov rcx, rdi
call fcn.14012e8b9
mov edx, dword [r14 + 4]
mov rcx, rdi
call fcn.14012e8b9
mov edx, dword [r14 + 8]
mov rcx, rdi
call fcn.14012e8b9
mov edx, dword [r14 + 0xc]
mov rcx, rdi
call fcn.14012e8b9
mov cl, 1
mov r14, r12
xor eax, eax
jmp 0x14012e3d3
mov rdi, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x98]
add byte [rax], al
add byte [rbp + 0x31], al
invalid
Function at 0x14012ee34
Capabilities:
Reference wmi statements

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
and qword [rsp + 0x38], 0
mov rsi, rdx
mov rdi, rcx
cmp qword [rdx + 0x10], 0
je 0x14012eef8
lea rcx, [0x1403a4d50]
call sub.oleaut32.dll_SysAllocString
mov rbx, rax
lea rcx, str.SELECT__FROM_MSAcpi_ThermalZoneTemperature
call sub.oleaut32.dll_SysAllocString
mov r14, rax
mov rcx, qword [rsi + 0x18]
mov rax, qword [rcx]
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x28], rdx
and qword [rsp + 0x20], 0
mov rdx, rbx
mov r8, r14
mov r9d, 0x30
call qword [rax + 0xa0]
mov ebp, eax
mov rcx, rbx
call sub.oleaut32.dll_SysFreeString
mov rcx, r14
call sub.oleaut32.dll_SysFreeString
test ebp, ebp
js 0x14012eef8
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rsi + 0x20]
mov rdx, qword [rsi + 0x28]
call fcn.14012cb70
mov qword [rsi + 0x20], 1
mov qword [rsi + 0x28], rbx
mov rax, qword [rsi + 0x30]
mov qword [rdi + 0x30], rax
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movups xmmword [rdi + 0x10], xmm1
movups xmmword [rdi], xmm0
mov rax, qword [rsi + 0x20]
mov qword [rdi + 0x20], rax
mov rax, qword [rsi + 0x28]
mov qword [rdi + 0x28], rax
jmp 0x14012ef07
mov qword [rdi], 2
mov rcx, rsi
call fcn.14012caf4
nop
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x14012f993
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x38
lea rax, [rsp + 0x34]
and dword [rax], 0
mov qword [rsp + 0x28], r9
mov qword [rsp + 0x20], r8
xor r8d, r8d
mov r9, rax
call sub.ADVAPI32.dll_RegQueryValueExW
nop
add rsp, 0x38
ret
Function at 0x14013491d
Capabilities:
Decrypt data via sspi

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rdi, rdx
mov rsi, rcx
mov r8, qword [rdx + 0xa0]
mov rcx, qword [rdx + 0x90]
add byte [rax], al
add byte [rax - 0x75], cl
xchg edx, eax
cwde
add byte [rax], al
add byte [rbp + rcx*4 + 0xd], cl
invalid
push rsp
invalid
add al, ch
invalid
in eax, dx
invalid
push qword [rcx]
leave
test rax, rax
cmove edx, ecx
xorps xmm0, xmm0
push rdi
ror byte [rax - 0x73], 0x4c
and al, 0x20
Function at 0x14014fa91
Capabilities:
Check for software breakpoints

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x1b08
call fcn.1402d84a0
sub rsp, rax
movaps xmmword [rsp + 0x1af0], xmm7
movaps xmmword [rsp + 0x1ae0], xmm6
mov rbx, rcx
mov rsi, qword [rdx + 8]
test rsi, rsi
je 0x140150830
mov r14, r8
mov r12, rdx
mov qword [rsp + 0x148], r9
mov rax, qword [0x140414448]
lea rdi, [rsp + 0x1e0]
and qword [rdi], 0
mov qword [rdi + 0x18], rax
sbb byte [r8 - 0x7d], r9b
sal byte [rax], 0x4c
lea edi, [rsp + 0xe60]

Function at 0x1401565f8
Capabilities:
Encrypt data via sspi

Disassembly:
cmp dword [rcx], 2
jne fcn.1401540d8
add rcx, 8
jmp fcn.140134c84