joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140015299
Capabilities:
Get session user name

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov edx, 0x38
call fcn.1400036ab
cmp byte [rax], 0
je 0x1400152bd
mov rcx, rax
add rsp, 0x20
pop rsi
jmp fcn.14004b6f1
mov rcx, rsi
mov edx, 0x39
call fcn.14000347e
test al, al
je 0x1400152d8
add rsp, 0x20
pop rsi
jmp fcn.14004f8da
xor eax, eax
add rsp, 0x20
pop rsi
ret
Function at 0x140031cfa
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
mov r10b, byte [rcx]
mov r9b, byte [rcx + 1]
test r8d, r8d
jle 0x140031d5a
mov r8d, r8d
neg r8
mov eax, 1
inc r10b
movzx r11d, r10b
movzx esi, byte [rcx + r11 + 2]
add r9b, sil
movzx edi, r9b
mov bl, byte [rcx + rdi + 2]
mov byte [rcx + r11 + 2], bl
mov byte [rcx + rdi + 2], sil
movzx ebx, byte [rcx + r11 + 2]
add esi, ebx
movzx ebx, sil
mov bl, byte [rcx + rbx + 2]
xor byte [rdx + rax - 1], bl
lea rbx, [r8 + rax]
inc rbx
inc rax
cmp rbx, 1
jne 0x140031d14
mov byte [rcx], r10b
mov byte [rcx + 1], r9b
pop rbx
pop rdi
pop rsi
ret

Function at 0x140032aea
Capabilities:
Check for time delay via gettickcount

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa8
mov qword [rsp + 0x58], r9
mov edi, edx
mov ebx, ecx
mov r12, qword [rsp + 0x140]
mov rax, qword [0x1400ab520]
xor rax, rsp
mov qword [rsp + 0xa0], rax
imul eax, r8d, 0x3e8
imul r14, rax, 0x10624dd3
shr r14, 0x26
mov esi, 1
mov r13, qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebp, 1
mov r15d, ebp
mov ebp, esi
call r13
mov esi, eax
mov rax, qword [rsp + 0x120]
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x90], xmm0
mov rax, qword [rsp + 0x128]
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x80], xmm0
mov rax, qword [rsp + 0x130]
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x70], xmm0
mov rax, qword [rsp + 0x138]
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x48], r12
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x118]
mov dword [rsp + 0x20], eax
mov ecx, ebx
mov edx, edi
mov r8d, ebp
mov r9d, dword [rsp + 0x110]
call fcn.140031e23
call r13
sub eax, esi
mov esi, r15d
add esi, ebp
setb cl
cmp eax, r14d
jae 0x140032c0a
test cl, cl
jne 0x140032c0a
mov rcx, r12
xor edx, edx
call fcn.14004b9f2
jmp 0x140032b43
mov rax, qword [rsp + 0x58]
mov dword [rax], ebp
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140057710
nop
add rsp, 0xa8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140032cae
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0xc28
mov rsi, rcx
mov rax, qword [0x1400ab520]
xor rax, rsp
mov qword [rsp + 0xc20], rax
xor eax, eax
mov rcx, qword [r8 + rax*8]
xor rcx, qword [rdx + rax*8]
mov qword [rsp + rax*8 + 0x820], rcx
inc rax
cmp rax, 0x80
jne 0x140032cce
xor edi, edi
lea r8, [rsp + rdi]
add r8, 0x820
lea rcx, [rsp + rdi]
add rcx, 0x420
mov edx, 2
mov r9d, 2
call fcn.140032dbc
sub rdi, 0xffffffffffffff80
cmp rdi, 0x400
jne 0x140032ceb
xor edi, edi
lea r8, [rsp + rdi]
add r8, 0x420
lea rcx, [rsp + rdi]
add rcx, 0x20
mov edx, 0x10
mov r9d, 0x10
call fcn.140032dbc
add rdi, 0x10
cmp rdi, 0x80
jne 0x140032d20
xor eax, eax
mov rcx, qword [rsp + rax*8 + 0x20]
xor rcx, qword [rsp + rax*8 + 0x820]
xor qword [rsi + rax*8], rcx
inc rax
cmp rax, 0x80
jne 0x140032d52
lea rcx, [rsp + 0x820]
mov edx, 0x400
call fcn.14004fdfc
lea rcx, [rsp + 0x420]
mov edx, 0x400
call fcn.14004fdfc
lea rcx, [rsp + 0x20]
mov edx, 0x400
call fcn.14004fdfc
mov rcx, qword [rsp + 0xc20]
xor rcx, rsp
call fcn.140057710
nop
add rsp, 0xc28
pop rdi
pop rsi
ret
Function at 0x140035943
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
movaps xmm0, xmmword [str.expand_32_byte_k]
movups xmmword [rcx], xmm0
mov eax, dword [rdx]
mov dword [rcx + 0x10], eax
mov eax, dword [rdx + 4]
mov dword [rcx + 0x14], eax
mov eax, dword [rdx + 8]
mov dword [rcx + 0x18], eax
mov eax, dword [rdx + 0xc]
mov dword [rcx + 0x1c], eax
mov eax, dword [rdx + 0x10]
mov dword [rcx + 0x20], eax
mov eax, dword [rdx + 0x14]
mov dword [rcx + 0x24], eax
mov eax, dword [rdx + 0x18]
mov dword [rcx + 0x28], eax
mov eax, dword [rdx + 0x1c]
mov dword [rcx + 0x2c], eax
mov dword [rcx + 0x80], 0x40
ret
Function at 0x140036e94
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
mov r9, qword [rdx + 8]
test r9, r9
je 0x140036ef7
mov r8, qword [rdx]
xor r10d, r10d
movzx ecx, byte [r8 + r10]
xor ecx, eax
mov eax, ecx
and eax, 0xf
shr ecx, 4
imul edx, eax, 0x11111044
xor edx, ecx
imul r11d, eax, 0x8840020
imul ecx, eax, 0x4220000
xor ecx, r11d
xor ecx, edx
and edx, 0xf
shr ecx, 4
imul eax, edx, 0x11111044
imul r11d, edx, 0x8840020
xor r11d, eax
imul eax, edx, 0x4220000
xor eax, ecx
xor eax, r11d
inc r10
cmp r9, r10
jne 0x140036ea5
ret

Function at 0x140038754
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov r9, rcx
shr r9, 0x20
mov r10d, dword [rdx + r8*4]
mov eax, r9d
rol eax, 4
xor r10d, r9d
xor eax, dword [rdx + r8*4 + 0x40]
mov r11d, eax
shr r11d, 8
mov r8d, r10d
shr r8d, 8
movd xmm0, r10d
movd xmm1, r8d
punpckldq xmm1, xmm0
movd xmm0, eax
movd xmm2, r11d
punpckldq xmm2, xmm0
punpcklqdq xmm1, xmm2
pand xmm1, xmmword [0x140086d30]
por xmm1, xmmword [0x140086d40]
pxor xmm0, xmm0
lea rdx, [0x140086b30]
movdqa xmm2, xmmword [str._b_b_b_b_b_b_b_b]
lea rsi, [0x140086d30]
movdqu xmm3, xmmword [rdx]
pshufd xmm3, xmm3, 0x1b
pand xmm3, xmm1
pxor xmm0, xmm3
paddd xmm1, xmm2
add rdx, 0x10
cmp rdx, rsi
jb 0x1400387c7
pshufd xmm1, xmm0, 0xff
movd edi, xmm1
mov ebx, edi
shl ebx, 4
mov esi, 0x40004
and eax, esi
imul edx, eax, 0x3c00
and edx, ebx
xor edx, edi
pshufd xmm1, xmm0, 0xee
movd eax, xmm1
mov edi, eax
shl edi, 4
and r11d, esi
imul r11d, r11d, 0x3c00
and r11d, edi
xor r11d, eax
pshufd xmm1, xmm0, 0x55
movd edi, xmm1
mov ebx, edi
shl ebx, 4
and r10d, esi
imul eax, r10d, 0x3c00
and eax, ebx
xor eax, edi
movd edi, xmm0
mov ebx, edi
shl ebx, 4
and r8d, esi
imul esi, r8d, 0x3c00
and esi, ebx
xor esi, edi
and esi, 0xf000f000
shr edx, 0xc
and edx, 0xf000f
shr r11d, 4
and r11d, 0xf000f00
shr eax, 8
and eax, 0xf000f0
or eax, r11d
or eax, esi
or edx, eax
shr eax, 4
xor eax, edx
and eax, 0x7030702
xor edx, eax
shl eax, 4
xor eax, edx
mov ebx, eax
shr ebx, 8
xor ebx, edx
and ebx, 0x4e009e
xor eax, ebx
shl ebx, 8
xor ebx, eax
mov eax, ebx
shr eax, 0x10
xor eax, ebx
and eax, 0xd9d3
xor ebx, eax
shl eax, 0x10
xor eax, ebx
mov edx, eax
shr edx, 4
xor edx, eax
and edx, 0x5040004
mov ebx, edx
xor ebx, eax
shl edx, 4
shr eax, 1
xor eax, ebx
and eax, 0x4045015
xor edx, ecx
xor edx, ebx
xor edx, eax
add eax, eax
xor eax, edx
shl rax, 0x20
or rax, r9
pop rbx
pop rdi
pop rsi
ret
Function at 0x14003d806
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov qword [rcx + 8], 0
mov r8, qword [rcx + 0x10]
test r8, r8
je 0x14003d875
xor ecx, ecx
sub r8, rcx
add rcx, qword [rsi]
mov edx, 1
mov r9, rdi
call fcn.140067a84
mov rbx, rax
mov rcx, rdi
call fcn.1400670a4
test eax, eax
jne 0x14003d863
mov rcx, qword [rsi + 8]
test rbx, rbx
je 0x14003d86a
add rcx, rbx
mov qword [rsi + 8], rcx
mov r8, qword [rsi + 0x10]
cmp r8, rcx
ja 0x14003d826
jmp 0x14003d86e
mov eax, 2
jmp 0x14003d8ad
mov r8, qword [rsi + 0x10]
xor eax, eax
cmp rcx, r8
jne 0x14003d88b
mov rcx, rdi
call fcn.140067424
mov ecx, eax
xor eax, eax
cmp ecx, 0xffffffff
setne al
mov rcx, qword [rsi + 8]
mov rdx, qword [rsi]
lea rbx, [rsi + 0x18]
mov qword [rsi + 0x18], rdx
mov qword [rsi + 0x28], rcx
mov qword [rsi + 0x20], 0
mov dword [rsi + 0x30], 0
mov qword [rsi + 0x38], rbx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret

Function at 0x140041e44
Capabilities:
Encode data using xor

Disassembly:
mov rcx, qword [rcx + 8]
jmp fcn.1400097e9

Function at 0x14004201d
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa8
mov rsi, r9
mov ebx, r8d
mov r14, rdx
mov r12, rcx
mov ebp, dword [rsp + 0x110]
mov rax, qword [0x1400ab520]
xor rax, rsp
mov qword [rsp + 0xa0], rax
call qword [rcx]
mov rdi, rax
test rax, rax
je 0x140042068
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 8]
test ebp, ebp
jle 0x1400420fd
movsxd r15, ebx
xor ebx, ebx
mov r13d, ebp
mov rax, qword [r12 + 0x28]
cmp rax, r13
cmovb r13, rax
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 8]
cmp qword [r12 + 0x28], 0x73
jb 0x1400420ae
lea rcx, str.h__hlen___MAX_HASH_LEN
lea rdx, str..._sshrsa.c
mov r8d, 0x393
call fcn.140065764
mov rcx, qword [rdi + 8]
mov rdx, r14
mov r8, r15
call fcn.140008178
mov rcx, qword [rdi + 8]
mov edx, ebx
call fcn.14000827c
mov rax, qword [rdi]
mov rcx, rdi
lea rdx, [rsp + 0x20]
call qword [rax + 0x18]
test r13d, r13d
jle 0x1400420ec
xor eax, eax
mov cl, byte [rsp + rax + 0x20]
xor byte [rsi + rax], cl
inc rax
cmp r13, rax
jne 0x1400420dd
inc ebx
movsxd rax, r13d
add rsi, rax
sub ebp, r13d
jg 0x140042075
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x20]
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140057710
nop
add rsp, 0xa8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140043fc7
Capabilities:
Hash data using sha1 via x86 extensions

Disassembly:
sub rsp, 0x48
movaps xmmword [rsp + 0x30], xmm9
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x10], xmm7
movaps xmmword [rsp], xmm6
movdqa xmm9, xmmword [rcx]
movdqa xmm8, xmmword [rcx + 0x10]
movdqa xmm6, xmmword [0x140084a20]
movdqu xmm5, xmmword [rdx]
movdqu xmm4, xmmword [rdx + 0x10]
movdqu xmm3, xmmword [rdx + 0x20]
movdqu xmm2, xmmword [rdx + 0x30]
pshufb xmm5, xmm6
movdqa xmm7, xmm8
paddd xmm7, xmm5
movdqa xmm1, xmm9
sha1rnds4 xmm1, xmm7, 0
pshufb xmm4, xmm6
movdqa xmm7, xmm9
sha1nexte xmm7, xmm4
movaps xmm0, xmm1
sha1rnds4 xmm0, xmm7, 0
sha1msg1 xmm5, xmm4
pshufb xmm3, xmm6
sha1nexte xmm1, xmm3
movaps xmm7, xmm0
sha1rnds4 xmm7, xmm1, 0
sha1msg1 xmm4, xmm3
pshufb xmm2, xmm6
sha1nexte xmm0, xmm2
pxor xmm5, xmm3
sha1msg2 xmm5, xmm2
movaps xmm1, xmm7
sha1rnds4 xmm1, xmm0, 0
sha1msg1 xmm3, xmm2
sha1nexte xmm7, xmm5
pxor xmm4, xmm2
sha1msg2 xmm4, xmm5
movaps xmm0, xmm1
sha1rnds4 xmm0, xmm7, 0
sha1msg1 xmm2, xmm5
xorps xmm3, xmm5
sha1nexte xmm1, xmm4
sha1msg2 xmm3, xmm4
movaps xmm6, xmm0
sha1rnds4 xmm6, xmm1, 1
sha1msg1 xmm5, xmm4
xorps xmm2, xmm4
sha1nexte xmm0, xmm3
sha1msg2 xmm2, xmm3
movaps xmm1, xmm6
sha1rnds4 xmm1, xmm0, 1
sha1msg1 xmm4, xmm3
xorps xmm5, xmm3
sha1nexte xmm6, xmm2
sha1msg2 xmm5, xmm2
movaps xmm0, xmm1
sha1rnds4 xmm0, xmm6, 1
sha1msg1 xmm3, xmm2
xorps xmm4, xmm2
sha1nexte xmm1, xmm5
sha1msg2 xmm4, xmm5
movaps xmm6, xmm0
sha1rnds4 xmm6, xmm1, 1
sha1msg1 xmm2, xmm5
xorps xmm3, xmm5
sha1nexte xmm0, xmm4
sha1msg2 xmm3, xmm4
movaps xmm1, xmm6
sha1rnds4 xmm1, xmm0, 1
sha1msg1 xmm5, xmm4
xorps xmm2, xmm4
sha1nexte xmm6, xmm3
sha1msg2 xmm2, xmm3
movaps xmm0, xmm1
sha1rnds4 xmm0, xmm6, 2
sha1msg1 xmm4, xmm3
xorps xmm5, xmm3
sha1nexte xmm1, xmm2
sha1msg2 xmm5, xmm2
movaps xmm6, xmm0
sha1rnds4 xmm6, xmm1, 2
sha1msg1 xmm3, xmm2
xorps xmm4, xmm2
sha1nexte xmm0, xmm5
sha1msg2 xmm4, xmm5
movaps xmm1, xmm6
sha1rnds4 xmm1, xmm0, 2
sha1msg1 xmm2, xmm5
xorps xmm3, xmm5
sha1nexte xmm6, xmm4
sha1msg2 xmm3, xmm4
movaps xmm0, xmm1
sha1rnds4 xmm0, xmm6, 2
sha1msg1 xmm5, xmm4
xorps xmm2, xmm4
sha1nexte xmm1, xmm3
sha1msg2 xmm2, xmm3
movaps xmm6, xmm0
sha1rnds4 xmm6, xmm1, 2
sha1msg1 xmm4, xmm3
xorps xmm5, xmm3
sha1nexte xmm0, xmm2
sha1msg2 xmm5, xmm2
movaps xmm1, xmm6
sha1rnds4 xmm1, xmm0, 3
sha1msg1 xmm3, xmm2
xorps xmm4, xmm2
sha1nexte xmm6, xmm5
sha1msg2 xmm4, xmm5
movaps xmm0, xmm1
sha1rnds4 xmm0, xmm6, 3
sha1msg1 xmm2, xmm5
xorps xmm3, xmm5
sha1nexte xmm1, xmm4
sha1msg2 xmm3, xmm4
movaps xmm5, xmm0
sha1rnds4 xmm5, xmm1, 3
xorps xmm2, xmm4
sha1nexte xmm0, xmm3
sha1msg2 xmm2, xmm3
movaps xmm1, xmm5
sha1rnds4 xmm1, xmm0, 3
sha1nexte xmm5, xmm2
movaps xmm0, xmm1
sha1rnds4 xmm0, xmm5, 3
paddd xmm0, xmm9
movdqa xmmword [rcx], xmm0
sha1nexte xmm1, xmm8
movaps xmmword [rcx + 0x10], xmm1
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
add rsp, 0x48
ret
Function at 0x14004bdb5
Capabilities:
Encode data using base64

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rax, qword [0x1400ab520]
xor rax, rsp
mov qword [rsp + 0x38], rax
xor eax, eax
movsx esi, byte [rcx + rax]
lea edi, [rsi - 0x41]
cmp dil, 0x19
ja 0x14004bddf
add esi, 0xffffffbf
jmp 0x14004be24
lea edi, [rsi - 0x61]
cmp dil, 0x19
ja 0x14004bded
add esi, 0xffffffb9
jmp 0x14004be24
lea edi, [rsi - 0x30]
cmp dil, 9
ja 0x14004bdfb
add esi, 4
jmp 0x14004be24
cmp sil, 0x2b
je 0x14004be18
cmp sil, 0x3d
je 0x14004be1f
cmp sil, 0x2f
jne 0x14004bead
mov esi, 0x3f
jmp 0x14004be24
mov esi, 0x3e
jmp 0x14004be24
mov esi, 0xffffffff
mov dword [rsp + rax*4 + 0x20], esi
inc rax
cmp rax, 4
jne 0x14004bdcd
mov esi, dword [rsp + 0x20]
xor edi, edi
cmp esi, 0xffffffff
je 0x14004beaf
mov ecx, dword [rsp + 0x24]
cmp ecx, 0xffffffff
je 0x14004beaf
mov r8d, dword [rsp + 0x28]
mov eax, dword [rsp + 0x2c]
cmp r8d, 0xffffffff
je 0x14004be9c
mov edi, 2
shl esi, 0x12
shl ecx, 0xc
or esi, ecx
mov r9d, r8d
shl r9d, 6
shr esi, 0x10
mov byte [rdx], sil
cmp eax, 0xffffffff
jne 0x14004be79
cmp r8d, 0xffffffff
je 0x14004be87
mov ebx, r9d
and ebx, 0xf00
or ebx, ecx
mov byte [rdx + 1], bh
cmp eax, 0xffffffff
je 0x14004beaf
and eax, 0x3f
or eax, r9d
mov byte [rdx + 2], al
mov edi, 3
jmp 0x14004beaf
cmp eax, 0xffffffff
jne 0x14004beaf
mov edi, 1
mov eax, 0xffffffff
jmp 0x14004be59
xor edi, edi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140057710
mov eax, edi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret

Function at 0x14004c238
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x14004c26a
xor r10d, r10d
xor r9d, r9d
mov al, byte [rdx + r10]
xor al, byte [rcx + r10]
movzx eax, al
or r9d, eax
inc r10
cmp r8, r10
jne 0x14004c243
mov eax, 0x100
sub eax, r9d
cmp eax, 0xff
seta al
ret
mov al, 1
ret
Function at 0x14004e800
Capabilities:
Create thread

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov r15d, r9d
mov rdi, r8
mov rbx, rdx
mov rbp, rcx
mov rax, qword [0x1400ab520]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov ecx, 1
mov edx, 0x1048
xor r8d, r8d
call fcn.140008864
mov rsi, rax
mov dword [rax], 0
lea r14, [rax + 8]
mov qword [rax + 8], rbp
mov rbp, qword [sym.imp.KERNEL32.dll_CreateEventA]
xor ecx, ecx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call rbp
mov qword [rsi + 0x10], rax
xor ecx, ecx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call rbp
mov qword [rsi + 0x18], rax
mov qword [rsi + 0x1040], rbx
mov byte [rsi + 0x22], 0
mov word [rsi + 0x20], 0
mov qword [rsi + 0x28], rdi
mov dword [rsi + 0x30], r15d
mov rcx, qword [0x1400ac548]
test rcx, rcx
jne 0x14004e8ac
lea rcx, [0x14004e909]
call fcn.14004a0b8
mov rcx, rax
mov qword [0x1400ac548], rax
mov rdx, rsi
call fcn.14004a180
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
lea r8, [0x14004e91f]
xor ecx, ecx
xor edx, edx
mov r9, r14
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x14004e8e8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [rsi + 0x23], 1
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140057710
mov rax, rsi
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x14004eaac
Capabilities:
Create thread

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov r15d, r9d
mov rbx, r8
mov rdi, rdx
mov rbp, rcx
mov rax, qword [0x1400ab520]
xor rax, rsp
mov qword [rsp + 0x38], rax
xor r12d, r12d
mov ecx, 1
mov edx, 0x1048
xor r8d, r8d
call fcn.140008864
mov rsi, rax
mov dword [rax], 1
lea r14, [rax + 8]
mov qword [rax + 8], rbp
mov rbp, qword [sym.imp.KERNEL32.dll_CreateEventA]
xor ecx, ecx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call rbp
mov qword [rsi + 0x10], rax
xor ecx, ecx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call rbp
mov qword [rsi + 0x18], rax
mov dword [rsi + 0x20], r12d
mov qword [rsi + 0x28], rbx
lea rcx, [rsi + 0x50]
call fcn.14004bec6
mov dword [rsi + 0x78], r12d
mov qword [rsi + 0x80], rdi
mov dword [rsi + 0x30], r15d
mov rcx, qword [0x1400ac548]
test rcx, rcx
jne 0x14004eb64
lea rcx, [0x14004e909]
call fcn.14004a0b8
mov rcx, rax
mov qword [0x1400ac548], rax
mov rdx, rsi
call fcn.14004a180
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
lea r8, [0x14004ebbf]
xor ecx, ecx
xor edx, edx
mov r9, r14
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x14004eba0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140057710
mov rax, rsi
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x14004f8da
Capabilities:
Get session user name

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rax, qword [0x1400ab520]
xor rax, rsp
mov qword [rsp + 0x30], rax
cmp byte [0x1400ac568], 0
je 0x14004f901
mov rsi, qword [0x1400ac560]
jmp 0x14004f946
lea rcx, str.secur32.dll
call fcn.14004fa15
mov rsi, rax
lea rcx, str.sspicli.dll
call fcn.14004fa15
test rsi, rsi
je 0x14004f936
lea rdx, str.GetUserNameExA
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
jmp 0x14004f938
xor esi, esi
mov qword [0x1400ac560], rsi
mov byte [0x1400ac568], 1
test rsi, rsi
je 0x14004f9a8
lea rdi, [rsp + 0x2c]
mov dword [rdi], 0
mov ecx, 8
xor edx, edx
mov r8, rdi
call rsi
mov ecx, dword [rdi]
mov edx, 1
xor r8d, r8d
call fcn.140008864
mov rsi, rax
mov ecx, 8
mov rdx, rax
mov r8, rdi
call qword [0x1400ac560]
test al, al
je 0x14004f9a0
mov rcx, rsi
mov edx, 0x40
call fcn.140058e50
test rax, rax
je 0x14004f9fe
mov byte [rax], 0
jmp 0x14004f9fe
mov rcx, rsi
call fcn.1400088de
lea rdx, [rsp + 0x2c]
mov dword [rdx], 0
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x14004f9c5
mov ecx, dword [rsp + 0x2c]
jmp 0x14004f9d2
mov dword [rsp + 0x2c], 0x100
mov ecx, 0x100
mov edx, 1
xor r8d, r8d
call fcn.140008864
mov rsi, rax
lea rdx, [rsp + 0x2c]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x14004f9fe
mov rcx, rsi
call fcn.1400088de
xor esi, esi
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140057710
mov rax, rsi
add rsp, 0x38
pop rdi
pop rsi
ret

Function at 0x14004fa15
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
cmp qword [0x1400ac5a0], 0
jne 0x14004fa92
mov edx, dword [0x1400ac5a8]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov r9d, eax
cmp qword [0x1400ac5a8], r9
ja 0x14004fa92
lea rdi, [0x1400ac5a8]
mov rbx, qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov rcx, qword [0x1400ac5a0]
mov byte [rsp + 0x28], 0
mov qword [rsp + 0x20], 1
mov r8d, 1
mov rdx, rdi
call fcn.1400088e8
mov qword [0x1400ac5a0], rax
mov edx, dword [0x1400ac5a8]
mov rcx, rax
call rbx
mov r9d, eax
cmp qword [0x1400ac5a8], r9
jbe 0x14004fa51
mov rcx, qword [0x1400ac5a0]
lea rdx, [0x140098519]
mov r8, rsi
xor r9d, r9d
call fcn.14004b732
mov rsi, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
mov rcx, rsi
call fcn.1400088de
mov rax, rdi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400527a0
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x2a8
mov r14, rcx
mov rax, qword [0x1400ab520]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
lea rdi, [rsp + 0x50]
mov rcx, rdi
mov edx, 0x107
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov rcx, rdi
call fcn.140069b40
mov word [rsp + rax + 0x50], 0x2a5c
mov byte [rsp + rax + 0x52], 0
lea rdx, [rsp + 0x160]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp rax, 0xffffffffffffffff
je 0x140052831
mov rdi, rax
lea rbx, [rsp + 0x160]
mov rsi, qword [sym.imp.KERNEL32.dll_FindNextFileA]
mov rcx, rbx
mov edx, 0x140
call r14
mov rcx, rdi
mov rdx, rbx
call rsi
test eax, eax
jne 0x140052811
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rcx, [rsp + 0x2c]
mov dword [rcx], eax
mov edx, 4
call r14
lea rcx, [rsp + 0x30]
mov edx, 0x20
call fcn.14005265c
test al, al
je 0x140052876
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov edx, 0x20
call r14
mov edx, 0x20
mov rcx, rdi
call fcn.14004fdfc
mov rcx, r14
call fcn.140055ca6
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.140057710
nop
add rsp, 0x2a8
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x14005289c
Capabilities:
Get memory capacity

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xa8
mov rax, qword [0x1400ab520]
xor rax, rsp
mov qword [rsp + 0xa0], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rsi, [rsp + 0x78]
mov qword [rsi], rax
mov ecx, 9
mov rdx, rsi
mov r8d, 8
call fcn.140040a0c
call qword [sym.imp.USER32.dll_GetCapture]
mov qword [rsi], rax
mov ecx, 0xa
mov rdx, rsi
mov r8d, 8
call fcn.140040a0c
call qword [sym.imp.USER32.dll_GetClipboardOwner]
mov qword [rsi], rax
mov ecx, 0xb
mov rdx, rsi
mov r8d, 8
call fcn.140040a0c
mov ecx, 0x1cbf
call qword [sym.imp.USER32.dll_GetQueueStatus]
lea rdx, [rsp + 0x74]
mov dword [rdx], eax
mov ecx, 0xc
mov r8d, 4
call fcn.140040a0c
lea rsi, [rsp + 0x68]
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, 0xd
mov rdx, rsi
mov r8d, 8
call fcn.140040a0c
lea rsi, [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov ecx, 6
mov rdx, rsi
mov r8d, 0x38
call fcn.140040a0c
lea rsi, [rsp + 0x98]
lea r14, [rsp + 0x90]
lea rdi, [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x20], rsi
lea rbx, [rsp + 0x80]
mov rcx, rax
mov rdx, rbx
mov r8, rdi
mov r9, r14
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
mov ecx, 0xe
mov rdx, rbx
mov r8d, 0x20
call fcn.140040a0c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x20], rsi
mov rcx, rax
mov rdx, rbx
mov r8, rdi
mov r9, r14
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov ecx, 0xf
mov rdx, rbx
mov r8d, 0x20
call fcn.140040a0c
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140057710
nop
add rsp, 0xa8
pop rbx
pop rdi
pop rsi
pop r14
ret