joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140094590
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rbx, rcx
mov edi, r8d
mov rcx, qword [rcx + 0x110]
mov ebp, edx
test rcx, rcx
je 0x140094766
cmp qword [rcx], 0
je 0x140094766
sub ebp, dword [rbx + 0x20]
sub edi, dword [rbx + 0x24]
js 0x140094766
cmp edi, dword [rbx + 0x2c]
jge 0x140094766
cmp dword [rbx + 0x120], 0
jne 0x140094733
xor r14d, r14d
mov edi, 3
mov esi, r14d
call fcn.140094790
mov rbx, rax
mov rax, qword [rax]
test rax, rax
je 0x140094766
mov r8d, dword [0x14012f0f0]
nop dword [rax]
mov edx, dword [rbx + 0x2c]
xorps xmm0, xmm0
mov rcx, qword [0x140135658]
mov qword [rsp + 0x20], rax
movzx eax, byte [rbx + 0x24]
mov byte [rsp + 0x48], al
movdqu xmmword [rsp + 0x28], xmm0
test edx, edx
jne 0x1400946e0
cmp dword [rbx + 0x28], r14d
jne 0x1400946e0
test rcx, rcx
je 0x140094662
mov eax, dword [rcx + 0x98]
mov dword [rsp + 0x38], eax
test rcx, rcx
je 0x140094667
mov eax, dword [rcx + 0x9c]
mov dword [rsp + 0x3c], eax
jmp 0x14009466c
mov dword [rsp + 0x38], r14d
mov dword [rsp + 0x3c], r8d
lea r8, [rsp + 0x88]
mov dword [rsp + 0x40], r14d
lea rdx, [rsp + 0x70]
mov byte [0x140133790], 1
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x70], r14d
mov dword [rsp + 0x88], r14d
call fcn.14005cee0
mov r8d, dword [0x14012f0f0]
mov eax, dword [rsp + 0x70]
mov byte [0x140133790], r14b
mov ecx, dword [rbx + 0x20]
test cl, 0xa
je 0x1400946bd
add eax, r8d
mov dword [rsp + 0x70], eax
add edi, 0x10
add edi, eax
cmp edi, ebp
jg 0x14009472f
shr ecx, 4
and ecx, 1
inc ecx
nop
mov eax, r14d
cmp qword [rbx], r14
jne 0x1400946f8
test eax, eax
je 0x140094708
dec eax
jmp 0x140094700
mov eax, dword [rbx + 0x28]
mov dword [rsp + 0x38], eax
test edx, edx
je 0x140094651
mov dword [rsp + 0x3c], edx
jmp 0x14009466c
test byte [rbx + 0x20], 0x40
je 0x140094700
inc eax
add rbx, 0x38
test eax, eax
jne 0x1400946d3
mov eax, dword [rbx + 0x20]
shr eax, 4
not eax
test al, 1
jne 0x140094719
cmp qword [rbx], r14
jne 0x14009471b
dec ecx
test ecx, ecx
jne 0x1400946d0
mov rax, qword [rbx]
inc esi
test rax, rax
jne 0x140094610
jmp 0x140094766
mov eax, esi
jmp 0x14009476b
movzx ecx, byte [rbx + 0x6e]
call fcn.140053ad0
cmp ebp, eax
jl 0x140094766
cmp ebp, dword [rbx + 0x28]
jge 0x140094766
movzx ecx, byte [rbx + 0x6e]
call fcn.140053ad0
sub edi, eax
lea eax, [rdi - 1]
cdq
idiv dword [rbx + 0x120]
test eax, eax
js 0x140094766
cmp eax, dword [rbx + 0x124]
jl 0x14009476b
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
Function at 0x14009f920
Capabilities:
Check for software breakpoints

Disassembly:
push rbx
sub rsp, 0x20
mov eax, dword [rcx + 0x24]
mov rbx, rcx
cmp eax, 0xca
jne 0x14009f956
call fcn.14009fb50
cmp byte [rbx + 0x58], 0
je 0x14009f94d
mov dword [rbx + 0x24], 0xcf
mov al, 1
add rsp, 0x20
pop rbx
ret
mov dword [rbx + 0x24], 0xcb
jmp 0x14009f961
cmp eax, 0xcb
jne 0x14009f9e5
mov rax, qword [rbx + 0x240]
cmp byte [rax + 0x20], 0
je 0x14009f9cc
nop
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x14009f97e
mov rcx, rbx
call qword [rax]
mov rax, qword [rbx + 0x240]
mov rcx, rbx
call qword [rax]
test eax, eax
je 0x14009f9c4
cmp eax, 2
je 0x14009f9cc
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x14009f970
dec eax
test eax, 0xfffffffd
jne 0x14009f970
inc dword [rcx + 8]
mov rdx, qword [rbx + 0x10]
mov r8d, dword [rdx + 0xc]
cmp dword [rcx + 8], r8d
jl 0x14009f970
mov ecx, dword [rbx + 0x190]
add ecx, r8d
mov dword [rdx + 0xc], ecx
jmp 0x14009f970
xor al, al
add rsp, 0x20
pop rbx
ret
mov eax, dword [rbx + 0x9c]
mov rcx, rbx
mov dword [rbx + 0xa4], eax
add rsp, 0x20
pop rbx
jmp 0x14009fa20
cmp eax, 0xcc
je 0x14009fa07
mov rax, qword [rcx]
mov dword [rax + 0x28], 0x15
mov rcx, qword [rcx]
mov eax, dword [rbx + 0x24]
mov dword [rcx + 0x2c], eax
mov rcx, rbx
mov rax, qword [rbx]
call qword [rax]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x14009fa20
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
xor ebp, ebp
lea rsi, [rcx + 0x98]
cmp dword [rcx + 0x24], 0xcc
mov rbx, rcx
je 0x14009fa5c
mov rax, qword [rcx + 0x220]
call qword [rax]
mov dword [rsi], ebp
mov dword [rbx + 0x24], 0xcc
mov rax, qword [rbx + 0x220]
mov qword [rsp + 0x30], rdi
cmp byte [rax + 0x10], bpl
je 0x14009fae0
nop
mov eax, dword [rsi]
cmp eax, dword [rbx + 0x78]
jae 0x14009fab8
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x14009fa96
mov dword [rcx + 8], eax
mov rcx, qword [rbx + 0x10]
mov eax, dword [rbx + 0x78]
mov dword [rcx + 0xc], eax
mov rcx, rbx
mov rax, qword [rbx + 0x10]
call qword [rax]
mov rax, qword [rbx + 0x228]
xor r9d, r9d
mov edi, dword [rsi]
mov r8, rsi
xor edx, edx
mov rcx, rbx
call qword [rax + 8]
mov eax, dword [rsi]
cmp eax, edi
je 0x14009fb0e
cmp eax, dword [rbx + 0x78]
jb 0x14009fa77
mov rax, qword [rbx + 0x220]
mov rcx, rbx
call qword [rax + 8]
mov rax, qword [rbx + 0x220]
mov rcx, rbx
call qword [rax]
mov dword [rsi], ebp
mov rax, qword [rbx + 0x220]
cmp byte [rax + 0x10], bpl
jne 0x14009fa70
cmp byte [rbx + 0x59], bpl
mov al, 1
setne bpl
add ebp, 0xcd
mov dword [rbx + 0x24], ebp
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
xor al, al
jmp 0x14009faf3
Function at 0x14009fa20
Capabilities:
Check for software breakpoints

Disassembly:
push rbx
sub rsp, 0x20
mov eax, dword [rcx + 0x24]
mov rbx, rcx
cmp eax, 0xca
jne 0x14009f956
call fcn.14009fb50
cmp byte [rbx + 0x58], 0
je 0x14009f94d
mov dword [rbx + 0x24], 0xcf
mov al, 1
add rsp, 0x20
pop rbx
ret
mov dword [rbx + 0x24], 0xcb
jmp 0x14009f961
cmp eax, 0xcb
jne 0x14009f9e5
mov rax, qword [rbx + 0x240]
cmp byte [rax + 0x20], 0
je 0x14009f9cc
nop
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x14009f97e
mov rcx, rbx
call qword [rax]
mov rax, qword [rbx + 0x240]
mov rcx, rbx
call qword [rax]
test eax, eax
je 0x14009f9c4
cmp eax, 2
je 0x14009f9cc
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x14009f970
dec eax
test eax, 0xfffffffd
jne 0x14009f970
inc dword [rcx + 8]
mov rdx, qword [rbx + 0x10]
mov r8d, dword [rdx + 0xc]
cmp dword [rcx + 8], r8d
jl 0x14009f970
mov ecx, dword [rbx + 0x190]
add ecx, r8d
mov dword [rdx + 0xc], ecx
jmp 0x14009f970
xor al, al
add rsp, 0x20
pop rbx
ret
mov eax, dword [rbx + 0x9c]
mov rcx, rbx
mov dword [rbx + 0xa4], eax
add rsp, 0x20
pop rbx
jmp 0x14009fa20
cmp eax, 0xcc
je 0x14009fa07
mov rax, qword [rcx]
mov dword [rax + 0x28], 0x15
mov rcx, qword [rcx]
mov eax, dword [rbx + 0x24]
mov dword [rcx + 0x2c], eax
mov rcx, rbx
mov rax, qword [rbx]
call qword [rax]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x14009fa20
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
xor ebp, ebp
lea rsi, [rcx + 0x98]
cmp dword [rcx + 0x24], 0xcc
mov rbx, rcx
je 0x14009fa5c
mov rax, qword [rcx + 0x220]
call qword [rax]
mov dword [rsi], ebp
mov dword [rbx + 0x24], 0xcc
mov rax, qword [rbx + 0x220]
mov qword [rsp + 0x30], rdi
cmp byte [rax + 0x10], bpl
je 0x14009fae0
nop
mov eax, dword [rsi]
cmp eax, dword [rbx + 0x78]
jae 0x14009fab8
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x14009fa96
mov dword [rcx + 8], eax
mov rcx, qword [rbx + 0x10]
mov eax, dword [rbx + 0x78]
mov dword [rcx + 0xc], eax
mov rcx, rbx
mov rax, qword [rbx + 0x10]
call qword [rax]
mov rax, qword [rbx + 0x228]
xor r9d, r9d
mov edi, dword [rsi]
mov r8, rsi
xor edx, edx
mov rcx, rbx
call qword [rax + 8]
mov eax, dword [rsi]
cmp eax, edi
je 0x14009fb0e
cmp eax, dword [rbx + 0x78]
jb 0x14009fa77
mov rax, qword [rbx + 0x220]
mov rcx, rbx
call qword [rax + 8]
mov rax, qword [rbx + 0x220]
mov rcx, rbx
call qword [rax]
mov dword [rsi], ebp
mov rax, qword [rbx + 0x220]
cmp byte [rax + 0x10], bpl
jne 0x14009fa70
cmp byte [rbx + 0x59], bpl
mov al, 1
setne bpl
add ebp, 0xcd
mov dword [rbx + 0x24], ebp
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
xor al, al
jmp 0x14009faf3
Function at 0x1400baad0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
xor eax, eax
mov rbx, r9
mov dword [r9], eax
mov edi, r8d
mov rbp, rdx
mov rsi, rcx
mov r14d, 0x40000000
mov ecx, dword [rsi + 0x1c]
mov r8d, edi
sub r8d, eax
mov edx, eax
cmp r8d, r14d
cmova r8d, r14d
add rdx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
mov edx, eax
test eax, eax
jle 0x1400bab2c
mov eax, dword [rbx]
add eax, edx
mov dword [rbx], eax
cmp eax, edi
jb 0x1400bab01
test edx, edx
jns 0x1400bab55
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, dword [rax]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_strerror]
mov edx, 0xffffffff
mov rcx, rsi
mov r8, rax
call fcn.1400ba200
mov eax, 0xffffffff
jmp 0x1400bab60
jne 0x1400bab5e
mov dword [rsi + 0x50], 1
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1400bad50
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r14, r8
mov rbp, rdx
mov rbx, rcx
test r8, r8
je 0x1400baebb
xor r13d, r13d
cmp dword [rcx + 0x70], r13d
je 0x1400bad9d
mov rdx, qword [rcx + 0x68]
mov dword [rcx + 0x70], r13d
call fcn.1400baee0
cmp eax, 0xffffffff
je 0x1400baebb
mov r15, r13
mov r12d, 0x40000000
mov eax, 0xffffffff
cmp r14, rax
mov esi, eax
mov eax, dword [rbx]
cmovb esi, r14d
test eax, eax
je 0x1400baddb
mov rdx, qword [rbx + 8]
cmp eax, esi
mov rcx, rbp
cmovae eax, esi
mov r8d, eax
mov edi, eax
call sub.VCRUNTIME140.dll_memcpy
add qword [rbx + 8], rdi
sub dword [rbx], edi
jmp 0x1400bae65
cmp dword [rbx + 0x50], r13d
je 0x1400badee
cmp dword [rbx + 0x88], r13d
je 0x1400bae91
mov ecx, dword [rbx + 0x44]
test ecx, ecx
je 0x1400bae76
mov eax, dword [rbx + 0x28]
add eax, eax
cmp esi, eax
jb 0x1400bae76
cmp ecx, 1
jne 0x1400bae46
mov edi, r13d
nop word [rax + rax]
mov ecx, dword [rbx + 0x1c]
mov r8d, esi
sub r8d, edi
mov edx, edi
cmp r8d, r12d
cmova r8d, r12d
add rdx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
test eax, eax
jle 0x1400bae37
add edi, eax
cmp edi, esi
jb 0x1400bae10
test eax, eax
js 0x1400bae9d
test eax, eax
jne 0x1400bae65
mov dword [rbx + 0x50], 1
jmp 0x1400bae65
mov rcx, rbx
mov dword [rbx + 0x98], esi
mov qword [rbx + 0x90], rbp
call fcn.1400ba8c0
cmp eax, 0xffffffff
je 0x1400baebb
mov edi, dword [rbx]
mov dword [rbx], r13d
mov eax, edi
sub r14, rax
add rbp, rax
add r15, rax
add qword [rbx + 0x10], rax
jmp 0x1400bae83
mov rcx, rbx
call fcn.1400baa20
cmp eax, 0xffffffff
je 0x1400baebb
test r14, r14
jne 0x1400bada6
mov rax, r15
jmp 0x1400baebd
mov dword [rbx + 0x54], 1
mov rax, r15
jmp 0x1400baebd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, dword [rax]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_strerror]
mov edx, 0xffffffff
mov rcx, rbx
mov r8, rax
call fcn.1400ba200
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400bb550
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r13
push r14
push r15
sub rsp, 0x30
mov r13d, dword [rdx + 0x1c]
mov r14, rdx
mov ebp, dword [rdx + 0x20]
mov rbx, qword [rdx + 0x30]
mov dword [rdx + 0x48], r13d
mov dword [rdx + 0x4c], ebp
lea eax, [r13 + 7]
cdq
and edx, 7
lea edi, [rdx + rax]
lea eax, [r13 + 0xf]
sar edi, 3
cdq
and edx, 0xf
lea esi, [rdx + rax]
sar esi, 4
add esi, esi
mov ecx, esi
imul ecx, ebp
movsxd rcx, ecx
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov r15, rax
mov r8, rax
test ebp, ebp
jle 0x1400bb602
sub esi, edi
mov r10d, ebp
movsxd r11, esi
lea rsi, [0x140130f80]
test edi, edi
jle 0x1400bb5f9
mov r9, rdi
nop
movzx edx, byte [rbx]
inc rbx
mov eax, edx
shr rdx, 4
and eax, 0xf
movzx ecx, byte [rax + rsi]
movzx eax, cl
xor al, byte [rdx + rsi]
and al, 0xf
xor al, cl
mov byte [r8], al
inc r8
sub r9, 1
jne 0x1400bb5d0
add r8, r11
sub r10, 1
jne 0x1400bb5c7
mov r9d, 1
mov qword [rsp + 0x20], r15
mov r8d, r9d
mov edx, ebp
mov ecx, r13d
call qword [sym.imp.GDI32.dll_CreateBitmap]
mov rcx, r15
mov rbx, rax
call fcn.1400466d0
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
mov qword [r14 + 0x40], rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop r15
pop r14
pop r13
ret

Function at 0x1400c2410
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
mov ecx, edx
call fcn.1400c2430
mov ecx, eax
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0xfffffffe
add rsp, 0x28
ret

Function at 0x1400c24d0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x130
mov rax, qword [0x140131048]
xor rax, rsp
mov qword [rsp + 0x120], rax
lea rcx, [rsp + 0x20]
mov ebx, edx
call qword [sym.imp.USER32.dll_GetKeyboardState]
mov ecx, ebx
call fcn.1400c2430
movsxd rcx, eax
movzx eax, byte [rsp + rcx + 0x20]
and eax, 0xfffffffe
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.1400ea730
add rsp, 0x130
pop rbx
ret
Function at 0x1400c45b0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
xor esi, esi
mov rbx, rcx
mov qword [rcx + 8], rsi
call fcn.140042b20
mov edx, 0xa0
mov dword [rsp + 0x38], eax
mov rcx, rbx
call fcn.1400d78e0
mov rdi, rax
test rax, rax
jne 0x1400c4606
mov rcx, rbx
call fcn.140043730
mov rcx, qword [rbx]
mov dword [rcx + 0x28], 0x38
mov rcx, qword [rbx]
mov dword [rcx + 0x2c], esi
mov rcx, rbx
mov rdx, qword [rbx]
call qword [rdx]
mov dword [rdi + 0x5c], 0x3b9aca00
lea rax, [fcn.1400c42d0]
mov qword [rdi], rax
lea rcx, str.JPEGMEM
lea rax, [fcn.1400c40f0]
mov qword [rdi + 8], rax
lea rax, [fcn.1400c41e0]
mov qword [rdi + 0x10], rax
lea rax, [fcn.1400c4000]
mov qword [rdi + 0x18], rax
lea rax, [0x1400c49a0]
mov qword [rdi + 0x20], rax
lea rax, [0x1400c48f0]
mov qword [rdi + 0x28], rax
lea rax, [0x1400c4720]
mov qword [rdi + 0x30], rax
lea rax, [0x1400c3d70]
mov qword [rdi + 0x38], rax
lea rax, [0x1400c3ad0]
mov qword [rdi + 0x40], rax
lea rax, [0x1400c4460]
mov qword [rdi + 0x48], rax
lea rax, [0x1400c4a50]
mov qword [rdi + 0x50], rax
mov eax, dword [rsp + 0x38]
mov dword [rdi + 0x58], eax
mov qword [rdi + 0x68], rsi
mov qword [rdi + 0x78], rsi
mov qword [rdi + 0x60], rsi
mov qword [rdi + 0x70], rsi
mov qword [rdi + 0x80], rsi
mov qword [rdi + 0x88], rsi
mov qword [rdi + 0x90], 0xa0
mov qword [rbx + 8], rdi
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x1400c470f
lea r9, [rsp + 0x30]
mov byte [rsp + 0x30], 0x78
lea r8, [rsp + 0x38]
mov rcx, rax
lea rdx, str._ld_c
call fcn.140056790
test eax, eax
jle 0x1400c470f
movzx eax, byte [rsp + 0x30]
sub al, 0x4d
test al, 0xdf
jne 0x1400c4702
imul eax, dword [rsp + 0x38], 0x3e8
jmp 0x1400c4706
mov eax, dword [rsp + 0x38]
imul eax, eax, 0x3e8
mov dword [rdi + 0x58], eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x1400cc570
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rdi
push r13
push r15
sub rsp, 0x30
mov r13d, dword [rcx + 0x64]
mov rdi, rcx
mov rbx, qword [rcx + 0x270]
cmp r13d, 1
mov r8d, 0x2fe
mov qword [rsp + 0x68], rbx
sete al
mov edx, 1
mov byte [rbx + 0x38], al
mov rax, qword [rcx + 8]
mov ecx, 0x100
mov r9d, dword [rdi + 0x7c]
cmovne r8d, ecx
mov rcx, rdi
call qword [rax + select]
mov ebp, dword [rbx + 0x28]
xor r15d, r15d
mov qword [rbx + 0x30], rax
cmp dword [rdi + 0x7c], r15d
jle 0x1400cc6f1
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x28], r12
lea r12, [rbx + 0x3c]
mov qword [rsp + 0x20], r14
xor r14d, r14d
nop dword [rax]
mov esi, dword [r12]
mov eax, ebp
cdq
idiv esi
mov ebp, eax
cmp r13d, 1
jne 0x1400cc60d
mov rax, qword [rbx + 0x30]
add qword [r14 + rax], 0xff
mov rax, qword [rbx + 0x30]
lea r11d, [rsi*2 - 2]
xor r8d, r8d
xor r10d, r10d
mov rdi, qword [r14 + rax]
lea eax, [rsi + 0xfe]
cdq
idiv r11d
xor ebx, ebx
mov r9d, eax
cmp r10d, r9d
jle 0x1400cc667
imul ecx, r8d, 0x1fe
add ecx, 0xfe
add ecx, esi
nop word [rax + rax]
add ecx, 0x1fe
inc r8d
mov eax, ecx
cdq
idiv r11d
mov r9d, eax
cmp r10d, eax
jg 0x1400cc650
movzx eax, r8b
inc r10d
movzx ecx, bpl
imul ecx, eax
mov byte [rbx + rdi], cl
inc rbx
cmp rbx, 0xff
jle 0x1400cc632
cmp r13d, 1
jne 0x1400cc6c3
mov ecx, 1
lea rdx, [rdi - 1]
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdi]
mov byte [rdx], al
lea rdx, [rdx - 1]
movzx eax, byte [rdi + 0xff]
mov byte [rdi + rcx + 0xff], al
inc rcx
cmp rcx, 0xff
jle 0x1400cc6a0
mov rax, qword [rsp + 0x60]
inc r15d
mov rbx, qword [rsp + 0x68]
add r12, 4
add r14, 8
cmp r15d, dword [rax + 0x7c]
jl 0x1400cc5f0
mov r14, qword [rsp + 0x20]
mov r12, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r13
pop rdi
pop rbp
pop rbx
ret
Function at 0x1400eb2bc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400eb306
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400eb306
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400eb306
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400eb306
cmp dword [rcx + 0x84], 0xe
jbe 0x1400eb306
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400eb308
xor al, al
add rsp, 0x28
ret

Function at 0x1400eda20
Capabilities:
Link many functions at runtime

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rcx, [0x1400fef0b]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1400eda75
mov rdi, rax
lea rdx, [0x1400fef2c]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400eda75
mov rsi, rax
lea rdx, [0x1400fef3a]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400eda75
mov r14, rax
xor edi, edi
jmp 0x1400edafd
lea rcx, [0x140103990]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1400edb68
mov rsi, rax
lea rdx, str.NtCreateKeyedEvent
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400edb68
mov rbx, rax
lea rdx, str.NtReleaseKeyedEvent
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400edb68
mov rdi, rax
lea rdx, str.NtWaitForKeyedEvent
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400edb68
mov rsi, rax
lea rcx, [rsp + 0x28]
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call rbx
test eax, eax
jne 0x1400edb68
mov r14, qword [rsp + 0x28]
mov al, byte [0x140131e68]
mov edx, 0x18
xor ecx, ecx
call fcn.14003dd50
test rax, rax
je 0x1400edb9a
mov rbx, rax
mov qword [rax], rdi
mov qword [rax + 8], rsi
mov qword [rax + 0x10], r14
xor eax, eax
lock cmpxchg qword [0x140131d40], rbx
je 0x1400edb5b
mov rsi, rax
cmp qword [rbx], 0
je 0x1400edb46
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x140131de8]
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, rsi
mov rax, rbx
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rax, str.parking_lot_requires_either_NT_Keyed_Events__WinXP__or_WaitOnAddress_WakeByAddress__Win8_
lea rcx, [rsp + 0x28]
mov qword [rcx], rax
mov qword [rcx + 8], 1
mov qword [rcx + 0x10], 8
xorps xmm0, xmm0
movups xmmword [rcx + 0x18], xmm0
lea rdx, str.G:.cargo_registry_srcmirrors.tuna.tsinghua.edu.cn_df7c3c540f42cdbdparking_lot_core_0.9.10_src_thread_parkerwindowsmod.rs
call fcn.1400ebf30
mov ecx, 8
mov edx, 0x18
call fcn.1400ebe70
int3
Function at 0x14001109b
Capabilities:
Delete user account

Disassembly:
jmp 0x140015cd6
jmp qword [sym.imp.NETAPI32.dll_NetUserDel]

Function at 0x1400110fa
Capabilities:
Add user account to group

Disassembly:
jmp 0x140015cdc
jmp qword [sym.imp.NETAPI32.dll_NetLocalGroupAddMembers]
Function at 0x140011343
Capabilities:
Terminate process

Disassembly:
jmp 0x140018000
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140011384
Capabilities:
Add user account

Disassembly:
jmp 0x140015cd0
jmp qword [sym.imp.NETAPI32.dll_NetUserAdd]

Function at 0x140011401
Capabilities:
Parse pe header

Disassembly:
jmp 0x140018b30
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140018b50
xor al, al
jmp 0x140018bd1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140018b63
xor al, al
jmp 0x140018bd1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140018b8d
xor al, al
jmp 0x140018bd1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140018ba1
xor al, al
jmp 0x140018bd1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140018bb3
xor al, al
jmp 0x140018bd1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140018bcf
xor al, al
jmp 0x140018bd1
mov al, 1
add rsp, 0x38
ret
Function at 0x180002830
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
cmp dword [0x180020a94], 0xa
jl 0x180002862
mov eax, dword [0x180020a98]
lea edx, [rax - 1]
imul edx, eax
and edx, 1
je 0x180002862
nop word cs:[rax + rax]
jmp 0x180002860
mov rax, qword gs:[0x60]
mov r11, qword [rax + 0x18]
add r11, 0x10
mov eax, dword [0x180020a80]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180020a7c], 0xa
setl r8b
or r8b, al
mov eax, dword [0x180020a9c]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180020aa0], 0xa
setl r9b
or r9b, al
lea r10, [rcx - 1]
xor eax, eax
mov r14, r11
mov r14, qword [r14]
cmp r14, r11
je 0x180002938
mov rsi, r10
test r8b, r8b
je 0x180002950
cmp byte [rsi + 1], 0
lea rsi, [rsi + 1]
jne 0x1800028d0
test r9b, r9b
je 0x180002960
sub rsi, rcx
je 0x180002934
mov r15, qword [r14 + 0x60]
xor ebx, ebx
nop
movzx r13d, word [r15 + rbx*2]
lea edi, [r13 - 0x41]
lea ebp, [r13 + 0x20]
cmp di, 0x1a
cmovae ebp, r13d
movsx edi, byte [rcx + rbx]
lea r12d, [rdi - 0x41]
lea edx, [rdi + 0x20]
cmp r12b, 0x1a
cmovae edx, edi
sub ebp, edx
test r13d, r13d
je 0x180002930
test ebp, ebp
jne 0x180002930
add rbx, 1
cmp rsi, rbx
jne 0x1800028f0
jmp 0x180002934
test ebp, ebp
jne 0x1800028bc
mov rax, qword [r14 + 0x30]
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
jmp 0x180002950
jmp 0x180002960
Function at 0x140011203
Capabilities:
Terminate process

Disassembly:
jmp 0x140012fc0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret