joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180005200
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test rdx, rdx
je 0x1800018e2
test rcx, rcx
je 0x1800018e2
mov rcx, qword [rcx]
jmp 0x180005050
mov eax, 0x80510005
ret
je 0x1800050a0
nop word [rax + rax]
mov edx, dword [rbx]
mov ecx, r12d
add rdx, rdi
mov r8d, r12d
cmp byte [rdx], cl
je 0x18000508c
nop
inc r8d
cmp byte [r8 + rdx], cl
jne 0x180005068
test r8d, r8d
je 0x18000508c
mov r9d, r8d
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
imul ecx, r11d
add ecx, eax
sub r9, 1
jne 0x180005079
cmp ecx, ebp
je 0x18000529a
inc r10d
add rbx, 4
cmp r10d, esi
jb 0x180005058
mov rax, r12
mov r8d, 0x104
mov rdx, r13
xor ecx, ecx
call rax
mov r10, qword [0x18008eca9]
mov r8d, eax
mov ecx, dword [0x18008ece1]
lea r9d, [rax - 1]
movzx edx, word [r13 + r9*2]
cmp dx, cx
je 0x1800050f8
nop word [rax + rax]
mov eax, r8d
mov r8d, r9d
dec r9d
mov word [r13 + rax*2], r12w
movzx ecx, word [r13 + r9*2]
mov eax, dword [0x18008ece1]
cmp cx, ax
jne 0x1800050d8
mov edx, r12d
cmp byte [r10], dl
je 0x180005124
movzx eax, byte [r10]
nop dword [rax]
movsx ecx, al
inc edx
mov eax, r8d
inc r8d
mov word [r13 + rax*2], cx
mov eax, edx
movzx eax, byte [rdx + r10]
test al, al
jne 0x180005108
mov ebx, dword [0x18008ecc1]
mov r11d, r12d
mov ebp, dword [0x18008eccd]
mov eax, dword [0x18008ecb9]
movsxd rcx, dword [rdi + 0x3c]
add rcx, rdi
mov edx, dword [rcx + rax*8 + 0x88]
add rdx, rdi
mov r10d, dword [rdx + 0x20]
mov r14d, dword [rdx + 0x1c]
add r10, rdi
mov r15d, dword [rdx + 0x24]
add r14, rdi
mov esi, dword [rdx + 0x18]
add r15, rdi
test esi, esi
je 0x1800051be
nop
mov edx, dword [r10]
mov ecx, r12d
add rdx, rdi
mov r8d, r12d
cmp byte [rdx], cl
je 0x1800051aa
inc r8d
cmp byte [r8 + rdx], cl
jne 0x180005178
test r8d, r8d
je 0x1800051aa
mov r9d, r8d
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
imul ecx, ebx
add ecx, eax
sub r9, 1
jne 0x180005198
cmp ecx, ebp
je 0x1800052ae
inc r11d
add r10, 4
cmp r11d, esi
jb 0x180005168
mov r10, r12
mov eax, dword [0x18008ecd9]
xor r9d, r9d
mov qword [rsp + 0x30], r12
mov rcx, r13
mov dword [rsp + 0x28], eax
mov eax, dword [0x18008ec91]
mov edx, dword [0x18008ecb1]
lea r8d, [r9 + 1]
mov dword [rsp + 0x20], eax
call r10
mov r11d, dword [0x18008ecc1]
mov r12, rax
mov ebp, dword [0x18008ec89]
mov ecx, dword [0x18008ecb9]
invalid
or byte [rax], al
movsxd rdx, dword [rdi + 0x3c]
add rdx, rdi
mov qword [rsp + 0xb0], rax
xor eax, eax
mov r10d, eax
mov r8d, dword [rdx + rcx*8 + 0x88]
add r8, rdi
mov ebx, dword [r8 + 0x20]
mov r14d, dword [r8 + 0x1c]
add rbx, rdi
mov r15d, dword [r8 + 0x24]
add r14, rdi
mov esi, dword [r8 + 0x18]
add r15, rdi
test esi, esi
invalid
invalid
invalid
Function at 0x1800052e8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov r12d, eax
mov ebp, dword [0x18008ece5]
mov r10d, r9d
mov ecx, dword [0x18008ecb9]
movsxd rdx, dword [rdi + 0x3c]
add rdx, rdi
mov ecx, dword [rdx + rcx*8 + 0x88]
add rcx, rdi
mov ebx, dword [rcx + 0x20]
mov r14d, dword [rcx + 0x1c]
add rbx, rdi
mov r15d, dword [rcx + 0x24]
add r14, rdi
mov esi, dword [rcx + 0x18]
add r15, rdi
test esi, esi
je 0x180005371
nop
mov edx, dword [rbx]
mov ecx, r9d
add rdx, rdi
mov r8d, r9d
cmp byte [rdx], 0
je 0x18000535d
inc r8d
cmp byte [r8 + rdx], 0
jne 0x180005338
test r8d, r8d
je 0x18000535d
mov r9d, r8d
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
imul ecx, r11d
add ecx, eax
sub r9, 1
jne 0x18000534a
cmp ecx, ebp
je 0x1800056d6
inc r10d
add rbx, 4
cmp r10d, esi
jb 0x180005328
mov rax, r9
mov rcx, qword [rsp + 0xb0]
mov r8d, r12d
mov dword [rsp + 0xa8], r9d
mov rdx, r13
mov qword [rsp + 0x20], r9
lea r9, [rsp + 0xa8]
add byte [rax], al
add bh, bh
rol byte [rbp + 0x1d840fc0], 1
add eax, dword [rax]
invalid
mov r12d, dword [0x18008ecbd]
mov eax, dword [rsp + 0xa8]
add r12, r13
mov r8d, dword [r12 + 4]
mov eax, r10d
movzx ecx, word [r15 + rax*2]
mov eax, dword [r14 + rcx*4]
add rax, rdi
jmp 0x180005374
Function at 0x1400019c0
Capabilities:
Write file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x250
lea rsi, fcn.140238100
movq xmm0, rsi
mov r9, qword [r8 + 8]
mov r8, qword [r8]
lea rbx, [rsp + 0x50]
mov qword [rsp + 0x28], r9
mov rax, rcx
lea rcx, [rsp + 0x30]
movq xmm1, rbx
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x20]
punpcklqdq xmm0, xmm1
movups xmmword [rsp + 0x30], xmm0
movdqu xmm0, xmmword [0x140403ae0]
movups xmmword [rsp + 0x40], xmm0
call rax
mov rdi, qword [fcn.140225420]
mov ecx, 2
call rdi
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
mov r8d, 1
mov r9, rax
call sub.msvcrt.dll_fwrite
mov ecx, 2
call rdi
mov ecx, 0xa
mov rdx, rax
call sub.msvcrt.dll_fputc
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x30], rsi
cmp rcx, rbx
je 0x140001a65
call fcn.1403f2f80
nop
add rsp, 0x250
pop rbx
pop rsi
pop rdi
ret
Function at 0x140003e60
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x698
lea rbp, fcn.140238100
xor r9d, r9d
movq xmm0, rbp
mov r10, qword [rdx]
mov r11, qword [rdx + 8]
mov rdx, qword [r8 + 8]
mov rax, qword [r8]
lea rdi, [rsp + 0x80]
lea r13, [rsp + 0x40]
mov qword [rsp + 0x38], rdx
mov rbx, rcx
movq xmm1, rdi
lea rcx, [rsp + 0x60]
lea r8, [rsp + 0x30]
mov rdx, r13
punpcklqdq xmm0, xmm1
mov qword [rsp + 0x40], r10
movups xmmword [rsp + 0x60], xmm0
movdqu xmm0, xmmword [0x140403ae0]
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x30], rax
movups xmmword [rsp + 0x70], xmm0
call fcn.1402376d0
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__fileno_1]
mov esi, eax
mov ecx, eax
call qword [sym.imp.msvcrt.dll__isatty]
mov rcx, qword [rsp + 0x68]
mov r12, qword [rsp + 0x70]
test eax, eax
jne 0x140003f40
mov r9, rbx
mov r8, r12
mov edx, 1
call sub.msvcrt.dll_fwrite
cmp rax, r12
jb 0x140004062
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x60], rbp
cmp rcx, rdi
je 0x140003f2c
call fcn.1403f2f80
nop
add rsp, 0x698
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov qword [rsp + 0x40], rcx
mov rdx, r13
lea rcx, [rsp + 0x280]
mov qword [rsp + 0x48], r12
call fcn.140001b20
mov rax, qword [rsp + 0x290]
mov dword [rsp + 0x5c], 0
mov ecx, esi
mov r12, qword [rsp + 0x288]
lea rbx, [rax - 1]
call qword [sym.imp.msvcrt.dll__get_osfhandle]
mov rcx, rax
lea r9, [rsp + 0x5c]
mov r8d, ebx
mov rdx, r12
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
test eax, eax
je 0x140003fd1
lea rax, fcn.140238260
mov rcx, qword [rsp + 0x288]
mov qword [rsp + 0x280], rax
lea rax, [rsp + 0x2a0]
cmp rcx, rax
je 0x140003f17
call fcn.1403f2f80
jmp 0x140003f17
mov ecx, 0x10
call fcn.1403f30b0
lea rdx, str.failed_to_write_to_console
mov rcx, rax
mov rsi, rax
call fcn.1403a0a30
lea rax, [0x1404cf220]
lea r8, [0x140001730]
mov rcx, rsi
mov qword [rsi], rax
lea rdx, str.Pj_
call fcn.1403f3730
mov rbx, rax
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x60], rbp
cmp rcx, rdi
je 0x140004024
call fcn.1403f2f80
mov rcx, rbx
call fcn.140219c30
mov rcx, rsi
mov rbx, rax
call fcn.1403f33d0
lea rax, fcn.140238260
mov rcx, qword [rsp + 0x288]
mov qword [rsp + 0x280], rax
lea rax, [rsp + 0x2a0]
cmp rcx, rax
je 0x140004010
call fcn.1403f2f80
jmp 0x140004010
mov ecx, 0x18
call fcn.1403f30b0
mov rsi, rax
call qword [sym.imp.msvcrt.dll__errno]
mov edx, dword [rax]
lea rbx, str.cannot_write_to_file
mov r8, r13
mov rcx, rsi
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], 0x14
call fcn.140238070
lea r8, [0x140001770]
lea rdx, str.Pj_
mov rcx, rsi
call fcn.1403f3730
mov rbx, rax
jmp 0x140004037
Function at 0x140008a20
Capabilities:
Get hostname

Disassembly:
push rsi
push rbx
sub rsp, 0x128
mov edx, 0x100
lea rsi, [rsp + 0x20]
mov rbx, rcx
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
mov rcx, rsi
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x88], 0
mov qword [rsp + 0x90], 0
mov qword [rsp + 0x98], 0
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0xa8], 0
mov qword [rsp + 0xb0], 0
mov qword [rsp + 0xb8], 0
mov qword [rsp + 0xc0], 0
mov qword [rsp + 0xc8], 0
mov qword [rsp + 0xd0], 0
mov qword [rsp + 0xd8], 0
mov qword [rsp + 0xe0], 0
mov qword [rsp + 0xe8], 0
mov qword [rsp + 0xf0], 0
mov qword [rsp + 0xf8], 0
mov qword [rsp + 0x100], 0
mov qword [rsp + 0x108], 0
mov qword [rsp + 0x110], 0
mov qword [rsp + 0x118], 0
call qword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
je 0x140008bc0
mov rax, rbx
mov qword [rbx], 0
mov qword [rbx + 8], 0
add rsp, 0x128
pop rbx
pop rsi
ret
mov rdx, rsi
mov rcx, rbx
call fcn.140058790
mov rax, rbx
add rsp, 0x128
pop rbx
pop rsi
ret
Function at 0x1400093a0
Capabilities:
Query environment variable

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
cmp qword [0x140523168], 0
mov rbp, rcx
mov rsi, rdx
mov r12, r8
je 0x140009510
mov rbx, qword [0x140523150]
test rbx, rbx
je 0x140009460
lea r13, [0x140523148]
mov rdi, r13
nop dword [rax]
cmp qword [rbx + 0x28], 0
je 0x140009400
cmp qword [rsi + 8], 0
je 0x140009400
mov rdx, qword [rsi]
mov rcx, qword [rbx + 0x20]
call sub.msvcrt.dll_strcmp
test eax, eax
js 0x140009438
nop
mov rdi, rbx
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x1400093e0
cmp rdi, r13
je 0x140009460
cmp qword [rsi + 8], 0
jne 0x140009440
lea rdx, [rdi + 0x30]
mov rcx, rbp
call fcn.140058880
mov rax, rbp
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rbx, qword [rbx + 0x18]
jmp 0x140009407
cmp qword [rdi + 0x28], 0
je 0x140009418
mov rdx, qword [rdi + 0x20]
mov rcx, qword [rsi]
call sub.msvcrt.dll_strcmp
test eax, eax
jns 0x140009418
nop word [rax + rax]
cmp qword [r12 + 0x28], 0
je 0x140009520
mov rbx, qword [r12 + 0x10]
lea r13, [r12 + 8]
mov rdi, r13
test rbx, rbx
je 0x140009520
nop word [rax + rax]
cmp qword [rbx + 0x28], 0
je 0x1400094b0
cmp qword [rsi + 8], 0
je 0x1400094b0
mov rdx, qword [rsi]
mov rcx, qword [rbx + 0x20]
call sub.msvcrt.dll_strcmp
test eax, eax
js 0x140009500
nop word cs:[rax + rax]
mov rdi, rbx
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140009488
cmp r13, rdi
je 0x140009520
cmp qword [rsi + 8], 0
je 0x140009418
cmp qword [rdi + 0x28], 0
je 0x140009418
mov rcx, qword [rsi]
mov rdx, qword [rdi + 0x20]
mov qword [rsp + 0x28], rcx
call sub.msvcrt.dll_strcmp
mov rcx, qword [rsp + 0x28]
test eax, eax
jns 0x140009418
jmp 0x140009523
mov rbx, qword [rbx + 0x18]
jmp 0x1400094b7
call fcn.140008c50
jmp 0x1400093c3
mov rcx, qword [rsi]
call sub.msvcrt.dll_getenv
mov rcx, rbp
mov rdx, rax
call fcn.140058790
mov rax, rbp
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
Function at 0x1400110a0
Capabilities:
Set console window title

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
lea rax, [0x1404cf660]
mov qword [rcx], rax
mov rbx, rcx
mov rdi, rdx
mov qword [rcx + 8], 0
mov qword [rcx + 0x10], 0
mov ecx, 1
call fcn.140150770
cmp eax, 0xe
je 0x1400110f0
cmp eax, 7
je 0x1400110f0
mov rax, qword [0x1404c7610]
mov byte [rax], 0
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
mov ecx, 0x158
call fcn.1403f2fd0
mov qword [rbx + 8], rax
mov rsi, rax
call fcn.140144500
xor r9d, r9d
mov r8d, 1
mov rdx, rsi
mov rcx, rax
call fcn.1401608b0
test eax, eax
js 0x1400110db
mov rcx, qword [rbx + 8]
xor edx, edx
call fcn.140162820
mov rax, qword [rbx + 8]
mov ecx, 0xfffffff6
mov qword [rbx + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14001115f
mov dword [rsp + 0x20], 0
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
test eax, eax
jne 0x140011198
cmp byte [rdi], 0
je 0x1400110e5
lea rcx, [rsp + 0x20]
mov rdx, rdi
call fcn.14001c180
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x1400110e5
call fcn.1403f2f70
jmp 0x1400110e5
mov edx, dword [rsp + 0x20]
mov rcx, rbx
and edx, 0xffffffbf
mov dword [rsp + 0x20], edx
or dl, 0x80
call qword [sym.imp.KERNEL32.dll_SetConsoleMode]
jmp 0x14001115f
Function at 0x140058590
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rdi, rdx
test rdx, rdx
js 0x140058693
pxor xmm0, xmm0
mov qword [rcx + 0x10], 0
movups xmmword [rcx], xmm0
je 0x140058680
mov rcx, rdx
call fcn.1403f2fd0
mov r8, rdi
lea rbx, [rax + rdi]
mov qword [rsi], rax
lea rcx, [rax + 1]
mov qword [rsi + 0x10], rbx
mov byte [rax], 0
sub r8, 1
jne 0x140058668
mov qword [rsi + 8], rcx
xor ebx, ebx
lea rcx, [0x140523640]
jmp 0x140058644
lea rdx, [rax + 1]
mov eax, dword [rcx + rax*4]
mov qword [0x140524000], rdx
mov edx, eax
shr edx, 0xb
xor eax, edx
mov edx, eax
shl edx, 7
and edx, 0x9d2c5680
xor eax, edx
mov edx, eax
shl edx, 0xf
and edx, 0xefc60000
xor eax, edx
mov rdx, qword [rsi]
mov r8d, eax
shr r8d, 0x12
xor eax, r8d
shr rax, 0x18
mov byte [rdx + rbx], al
add rbx, 1
cmp rdi, rbx
je 0x140058688
mov rax, qword [0x140524000]
cmp rax, 0x26f
jbe 0x1400585f8
call fcn.1403af3e0
mov rax, qword [0x140524000]
jmp 0x1400585f8
xor edx, edx
call sub.msvcrt.dll_memset
mov qword [rsi + 8], rbx
jmp 0x1400585e6
mov qword [rcx + 0x10], 0
mov rax, rsi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
lea rcx, [0x140411e80]
call fcn.1403f7ce0
nop

Function at 0x1400586a0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
lea rsi, [rcx + rdx]
lea rcx, [0x140523640]
test rdx, rdx
jne 0x140058706
jmp 0x140058728
lea rdx, [rax + 1]
mov eax, dword [rcx + rax*4]
add rbx, 1
mov qword [0x140524000], rdx
mov edx, eax
shr edx, 0xb
xor eax, edx
mov edx, eax
shl edx, 7
and edx, 0x9d2c5680
xor eax, edx
mov edx, eax
shl edx, 0xf
and edx, 0xefc60000
xor eax, edx
mov edx, eax
shr edx, 0x12
xor eax, edx
shr rax, 0x18
mov byte [rbx - 1], al
cmp rsi, rbx
je 0x140058728
mov rax, qword [0x140524000]
cmp rax, 0x26f
jbe 0x1400586c0
call fcn.1403af3e0
mov rax, qword [0x140524000]
jmp 0x1400586c0
add rsp, 0x28
pop rbx
pop rsi
ret
Function at 0x1400724f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
call fcn.140012b90
cmp byte [rax + 0x10], 0
mov rsi, rax
jne 0x140072520
mov eax, 1
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
mov ecx, 0x18
call fcn.1403f2fd0
lea rdx, [rbx + 0x18]
mov rcx, rax
mov rdi, rax
call fcn.14013bfd0
mov qword [rbx + 0x38], rdi
mov ecx, 0xa8
call fcn.1403f2fd0
mov r9, qword [rbx + 0x38]
movzx r8d, word [rsi + 0x38]
lea rdx, [rsi + 0x18]
mov rcx, rax
mov rdi, rax
call fcn.14008d570
mov qword [rbx + 0x28], rdi
mov rcx, rdi
call fcn.14008d6b0
mov edi, eax
test eax, eax
js 0x140072608
lea rax, [0x140414ac9]
mov r9, qword [rsi + 0x18]
mov dword [rsp + 0x20], edi
mov r8d, 0x24
mov qword [rsp + 0x28], rax
lea rdx, str.HTTP_API
lea rcx, str.e_1_32m__e_0me_1_37m__13se_0me_1__dm_s:_d_e_1_31m_se_0m
call fcn.140011da0
mov word [rbx + 0x30], di
mov edx, 1
xor ecx, ecx
mov r8d, 3
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
je 0x14007250c
xor ecx, ecx
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14007250c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdx, rbx
xor ecx, ecx
mov qword [0x140524a08], rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov eax, eax
mov qword [0x140524a00], rax
jmp 0x14007250c
mov ecx, eax
call fcn.1401435b0
mov r9, qword [rsi + 0x18]
mov r8d, 0x24
lea rdx, str.HTTP_API
mov qword [rsp + 0x28], rax
movzx eax, word [rsi + 0x38]
lea rcx, str.e_1_32m__e_0me_1_37m__13se_0me_1__dm_s:_d_e_1_31m_se_0m
mov dword [rsp + 0x20], eax
call fcn.140011da0
mov rsi, qword [rbx + 0x28]
test rsi, rsi
je 0x140072652
mov rcx, rsi
call fcn.14008d670
mov rcx, rsi
call fcn.1403f2f80
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x140072661
mov rax, qword [rcx]
call qword [rax + 8]
xor eax, eax
mov qword [rbx + 0x28], 0
mov word [rbx + 0x30], ax
xor eax, eax
mov qword [rbx + 0x38], 0
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
Function at 0x1400c02d0
Capabilities:
Get common file path

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x140
xor r9d, r9d
mov r8d, 0x1c
lea rsi, [rsp + 0x30]
mov rbx, rcx
xor ecx, ecx
mov rdx, rsi
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x1400c0338
lea r12, [rbx + 0x10]
mov rcx, rsi
mov qword [rbx], r12
call sub.msvcrt.dll_strlen
mov qword [rsp + 0x28], rax
mov rbp, rax
cmp rax, 0xf
ja 0x1400c0370
cmp rax, 1
jne 0x1400c0368
movzx edx, byte [rsp + 0x30]
mov byte [rbx + 0x10], dl
mov qword [rbx + 8], rax
mov byte [r12 + rax], 0
jmp 0x1400c0350
lea rax, [rbx + 0x10]
mov qword [rbx + 8], 1
mov qword [rbx], rax
mov eax, 0x2e
mov word [rbx + 0x10], ax
mov rax, rbx
add rsp, 0x140
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
test rax, rax
je 0x1400c0328
jmp 0x1400c038f
lea rdx, [rsp + 0x28]
xor r8d, r8d
mov rcx, rbx
call fcn.1403bdcf0
mov qword [rbx], rax
mov r12, rax
mov rax, qword [rsp + 0x28]
mov qword [rbx + 0x10], rax
cmp ebp, 8
jae 0x1400c03d0
test bpl, 4
jne 0x1400c0401
test ebp, ebp
je 0x1400c03c0
movzx eax, byte [rsp + 0x30]
mov byte [r12], al
test bpl, 2
je 0x1400c03c0
mov ebp, ebp
movzx eax, word [rsi + rbp - 2]
mov word [r12 + rbp - 2], ax
nop word [rax + rax]
mov rax, qword [rsp + 0x28]
mov r12, qword [rbx]
jmp 0x1400c0328
mov rax, qword [rsp + 0x30]
lea rdi, [r12 + 8]
and rdi, 0xfffffffffffffff8
mov qword [r12], rax
mov eax, ebp
mov rdx, qword [rsi + rax - 8]
mov qword [r12 + rax - 8], rdx
sub r12, rdi
lea ecx, [rbp + r12]
sub rsi, r12
shr ecx, 3
rep movsq qword [rdi], qword [rsi]
jmp 0x1400c03c0
mov eax, dword [rsp + 0x30]
mov ebp, ebp
mov dword [r12], eax
mov eax, dword [rsi + rbp - 4]
mov dword [r12 + rbp - 4], eax
jmp 0x1400c03c0
Function at 0x1400d4af0
Capabilities:
Query environment variable

Disassembly:
push rdi
sub rsp, 0x130
xor eax, eax
mov ecx, 0x20
mov r8d, 0x104
lea rdi, [rsp + 0x20]
rep stosq qword [rdi], rax
lea rcx, str._PROGRAMFILES_NVIDIA_CorporationNVSMI_nvml.dll
mov dword [rdi], 0
lea rdi, [rsp + 0x20]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea rdx, [0x140525440]
mov rcx, rdi
call fcn.140145fc0
test eax, eax
sete al
add rsp, 0x130
pop rdi
ret

Function at 0x1400f4e20
Capabilities:
Get system firmware table

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rbp, qword [sym.imp.KERNEL32.dll_GetSystemFirmwareTable]
mov rdi, rcx
mov ecx, 0x52534d42
call rbp
mov r12, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov esi, eax
call r12
mov r8d, esi
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x1400f4f21
xor edx, edx
mov r9d, esi
mov r8, rax
mov ecx, 0x52534d42
call rbp
cmp esi, eax
jne 0x1400f4f10
movzx eax, byte [rbx + 1]
movzx edx, byte [rbx + 2]
lea rsi, [rsp + 0x20]
mov rcx, rdi
movq xmm0, qword [0x14045da10]
mov r8, rsi
shl edx, 8
shl eax, 0x10
add eax, edx
movzx edx, byte [rbx + 3]
add eax, edx
lea rdx, [rbx + 8]
mov dword [rdi + 0x5c], eax
mov eax, dword [rbx + 4]
mov qword [rsp + 0x28], 0
mov dword [rdi + 0x58], eax
lea rax, [0x1400f4df0]
movq xmm1, rax
mov qword [rsp + 0x20], rbx
punpcklqdq xmm0, xmm1
movups xmmword [rsp + 0x30], xmm0
call fcn.1400f4cc0
mov ebx, eax
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x1400f4efb
mov r8d, 3
mov rdx, rsi
mov rcx, rsi
call rax
mov eax, ebx
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call r12
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ebx, ebx
mov eax, ebx
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x1400f6130
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
test dl, dl
jne 0x1400f6168
mov rsi, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r9d, 0x40
mov rdx, rbx
xor ecx, ecx
mov rax, rsi
mov r8d, 0x3000
add rsp, 0x28
pop rbx
pop rsi
jmp rax
lea rax, [rcx - 1]
mov rsi, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
xor ecx, ecx
mov r9d, 0x40
and rax, 0xffffffffffe00000
mov r8d, 0x20003000
lea rdx, [rax + 0x200000]
call rsi
test rax, rax
je 0x1400f6144
add rsp, 0x28
pop rbx
pop rsi
ret
Function at 0x1400f6240
Capabilities:
Manipulate user privileges

Disassembly:
push rdi
push rsi
push rbx
add rsp, 0xffffffffffffff80
test rcx, rcx
jne 0x1400f6258
sub rsp, 0xffffffffffffff80
pop rbx
pop rsi
pop rdi
ret
call fcn.1400f6000
mov edx, eax
mov eax, 1
test edx, edx
je 0x1400f6280
mov byte [0x140525480], al
sub rsp, 0xffffffffffffff80
pop rbx
pop rsi
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov edx, 8
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400f62f2
lea rsi, [rsp + 0x50]
mov edx, 1
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x50], 0
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x20], rsi
mov rdi, qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call rdi
mov edx, dword [rsp + 0x50]
test edx, edx
jne 0x1400f6300
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
mov edx, 1
call rdi
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov byte [0x140525480], al
jmp 0x1400f626e
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x20], rsi
mov edx, 1
mov rbx, rax
mov r9d, dword [rsp + 0x50]
mov r8, rax
call rdi
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x1400f62f2
pxor xmm0, xmm0
xor ecx, ecx
lea r9, [rsp + 0x38]
mov rdx, rsi
mov r8d, 0xf0fff
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
call sub.ADVAPI32.dll_LsaOpenPolicy
test eax, eax
je 0x1400f6370
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
jmp 0x1400f62f4
lea rsi, str.SeLockMemoryPrivilege
mov rcx, rsi
call sub.msvcrt.dll_wcslen
mov r9d, 1
lea r8, [rsp + 0x40]
mov qword [rsp + 0x48], rsi
lea edx, [rax + 1]
movzx ecx, ax
mov eax, edx
mov rdx, qword [rbx]
shl eax, 0x10
or eax, ecx
mov rcx, qword [rsp + 0x38]
movd xmm0, eax
psllw xmm0, 1
movd dword [rsp + 0x40], xmm0
call sub.ADVAPI32.dll_LsaAddAccountRights
test eax, eax
je 0x1400f63c8
mov rcx, qword [rsp + 0x38]
call sub.ADVAPI32.dll_LsaClose
jmp 0x1400f6363
lea rdx, str.Huge_pages_support_was_successfully_enabled__but_reboot_required_to_use_it
mov ecx, 5
call fcn.140012100
mov rcx, qword [rsp + 0x38]
call sub.ADVAPI32.dll_LsaClose
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
call fcn.1400f6000
and eax, 1
jmp 0x1400f6268