joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bb3a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4bb4e6
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x78], rdi
nop dword [rax]
cmp rcx, r9
jb 0x4bb4d6
mov qword [rsp + 0x90], r9
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x60], rax
mov qword [rsp], rax
mov qword [rsp + 8], r9
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], r8
call fcn.004c53e0
xorps xmm15, xmm15
mov r14, qword [0x007206e8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x4bb4bb
mov rbx, qword [rsp + 0x90]
mov rsi, rbx
sar rbx, 1
lea rcx, [rsi + rbx]
mov rdx, qword [rsp + 0x70]
cmp rdx, rcx
jb 0x4bb4d1
cmp rsi, rcx
ja 0x4bb4c9
sub rdx, rsi
mov rdi, rdx
neg rdx
mov r8, rsi
shl rsi, 3
sar rdx, 0x3f
and rsi, rdx
mov rdx, qword [rsp + 0x60]
add rdx, rsi
mov rcx, qword [rsp + 0x68]
cmp rcx, r8
jb 0x4bb4c1
mov qword [rsp], rdx
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov qword [rsp + 0x18], rdx
sub rcx, r8
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x30], rax
call fcn.004c5520
xorps xmm15, xmm15
mov r14, qword [0x007206e8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
add rsp, 0x50
pop rbp
ret
mov rax, r8
call fcn.0046a9a0
mov rax, rsi
call fcn.0046a9a0
call fcn.0046a960
mov rdx, rcx
mov rcx, r9
nop dword [rax]
call fcn.0046a960
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.00468600
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp fcn.004bb3a0
Function at 0x4ca900
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4caa30
push rbp
mov rbp, rsp
sub rsp, 0x68
mov qword [rsp + 0x80], rbx
mov rcx, qword [rax]
mov qword [rsp + 0x18], rcx
movups xmm0, xmmword [rax + 8]
movups xmmword [rsp + 0x20], xmm0
movups xmm0, xmmword [rax + 0x18]
movups xmmword [rsp + 0x30], xmm0
lea rax, [rsp + 0x18]
call fcn.004ca620
movups xmmword [rsp + 0x40], xmm15
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x58], xmm15
mov rcx, qword [rsp + 0x18]
mov qword [rsp + 0x40], rcx
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x48], rcx
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x50], rcx
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x58], rcx
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x60], rcx
mov rcx, qword [rsp + 0x80]
xor eax, eax
jmp 0x4ca994
inc rax
mov rcx, rbx
cmp rax, 5
jge 0x4ca9d7
mov rdx, qword [rsp + rax*8 + 0x40]
imul rsi, rax, 0x33
mov rdi, rsi
sar rsi, 0x3f
shr rsi, 0x3d
add rsi, rdi
mov r8, rsi
and rsi, 0xfffffffffffffff8
sub rdi, rsi
mov rbx, rcx
mov rcx, rdi
shl rdx, cl
cmp rcx, 0x40
sbb rsi, rsi
and rdx, rsi
mov qword [rsp + 0x10], rdx
xor ecx, ecx
jmp 0x4caa03
test byte [rcx], al
mov rax, rcx
mov ebx, 0x20
mov rcx, rbx
add rsp, 0x68
pop rbp
ret
test byte [rbx], al
movzx edi, byte [rsp + rcx + 0x10]
movzx r9d, byte [rbx + rsi]
or r9d, edi
mov byte [rbx + rsi], r9b
inc rcx
mov r8, rdx
cmp rcx, 8
jge 0x4ca98e
mov rdx, r8
sar r8, 3
lea rsi, [r8 + rcx]
cmp rsi, 0x20
jge 0x4ca98e
nop
jb 0x4ca9ea
mov rax, rsi
mov ecx, 0x20
call fcn.0046a8e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00468600
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004ca900
Function at 0x4cbde0
Capabilities:
Hash data using sha384
Hash data using sha512

Disassembly:
mov rcx, qword [rax + 0xd0]
cmp rcx, 6
jne 0x4cbe65
movabs rcx, 0xcbbb9d5dc1059ed8
mov qword [rax], rcx
movabs rcx, 0x629a292a367cd507
mov qword [rax + 8], rcx
movabs rcx, 0x9159015a3070dd17
mov qword [rax + 0x10], rcx
movabs rcx, 0x152fecd8f70e5939
mov qword [rax + 0x18], rcx
movabs rcx, 0x67332667ffc00b31
mov qword [rax + 0x20], rcx
movabs rcx, 0x8eb44a8768581511
mov qword [rax + 0x28], rcx
movabs rcx, 0xdb0c2e0d64f98fa7
mov qword [rax + 0x30], rcx
movabs rcx, 0x47b5481dbefa4fa4
mov qword [rax + 0x38], rcx
nop dword [rax]
jmp 0x4cbfc6
cmp rcx, 0xe
jne 0x4cbee0
movabs rcx, 0x8c3d37c819544da2
mov qword [rax], rcx
movabs rcx, 0x73e1996689dcd4d6
mov qword [rax + 8], rcx
movabs rcx, 0x1dfab7ae32ff9c82
mov qword [rax + 0x10], rcx
movabs rcx, 0x679dd514582f9fcf
mov qword [rax + 0x18], rcx
movabs rcx, 0xf6d2b697bd44da8
mov qword [rax + 0x20], rcx
movabs rcx, 0x77e36f7304c48942
mov qword [rax + 0x28], rcx
movabs rcx, 0x3f9d85a86a1d36c8
mov qword [rax + 0x30], rcx
movabs rcx, 0x1112e6ad91d692a1
mov qword [rax + 0x38], rcx
jmp 0x4cbfc6
cmp rcx, 0xf
jne 0x4cbf57
movabs rcx, 0x22312194fc2bf72c
mov qword [rax], rcx
movabs rcx, 0x9f555fa3c84c64c2
mov qword [rax + 8], rcx
movabs rcx, 0x2393b86b6f53b151
mov qword [rax + 0x10], rcx
movabs rcx, 0x963877195940eabd
mov qword [rax + 0x18], rcx
movabs rcx, 0x96283ee2a88effe3
mov qword [rax + 0x20], rcx
movabs rcx, 0xbe5e1e2553863992
mov qword [rax + 0x28], rcx
movabs rcx, 0x2b0199fc2c85b8aa
mov qword [rax + 0x30], rcx
movabs rcx, 0xeb72ddc81c52ca2
mov qword [rax + 0x38], rcx
jmp 0x4cbfc6
movabs rcx, 0x6a09e667f3bcc908
mov qword [rax], rcx
movabs rcx, 0xbb67ae8584caa73b
mov qword [rax + 8], rcx
movabs rcx, 0x3c6ef372fe94f82b
mov qword [rax + 0x10], rcx
movabs rcx, 0xa54ff53a5f1d36f1
mov qword [rax + 0x18], rcx
movabs rcx, 0x510e527fade682d1
mov qword [rax + 0x20], rcx
movabs rcx, 0x9b05688c2b3e6c1f
mov qword [rax + 0x28], rcx
movabs rcx, 0x1f83d9abfb41bd6b
mov qword [rax + 0x30], rcx
movabs rcx, 0x5be0cd19137e2179
mov qword [rax + 0x38], rcx
movups xmmword [rax + 0xc0], xmm15
ret
Function at 0x4e02a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e03ee
push rbp
mov rbp, rsp
sub rsp, 0x68
movups xmmword [rsp + 0x40], xmm15
mov qword [rsp + 0x30], 0
mov rax, qword [0x00690de0]
call fcn.004b5700
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], rbx
movups xmmword [rsp + 0x50], xmm15
mov qword [rsp + 0x60], 0
lea rcx, [0x004e0400]
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x58], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x2b
call fcn.00403900
xorps xmm15, xmm15
mov r14, qword [0x007206e8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x18]
cmp rcx, 0xffffffffffffffff
je 0x4e03b2
mov rdx, qword [rsp + 0x28]
nop dword [rax + rax]
cmp rdx, rcx
jb 0x4e03e8
mov qword [rsp + 0x20], rcx
mov rsi, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rbx, rcx
lea rdx, [rsp + 0x50]
call rsi
mov rax, qword [rsp + 0x20]
lea rcx, [rax + 1]
mov rbx, qword [rsp + 0x28]
cmp rbx, rcx
jb 0x4e03dd
mov rsi, qword [rsp + 0x50]
sub rbx, rax
dec rbx
mov rdi, rbx
neg rdi
sar rdi, 0x3f
and rcx, rdi
mov rdi, qword [rsp + 0x38]
lea rax, [rdi + rcx]
lea rdx, [rsp + 0x50]
call rsi
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x68
pop rbp
ret
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x28]
lea rdx, [rsp + 0x50]
call rcx
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x68
pop rbp
ret
mov rax, rcx
mov rcx, rbx
call fcn.0046a9a0
call fcn.0046a920
nop
call fcn.00468600
jmp fcn.004e02a0
Function at 0x4fdea0
Capabilities:
Parse credit card information

Disassembly:
lea ecx, [rax - 0x61]
cmp cl, 0x19
jbe 0x4fdeb8
lea ecx, [rax - 0x41]
cmp cl, 0x19
jbe 0x4fdeb8
lea ecx, [rax - 0x30]
cmp cl, 9
ja 0x4fdec0
xor eax, eax
ret
cmp rbx, 3
je 0x4fdecc
cmp rbx, 4
jne 0x4fdef9
cmp al, 0x2c
ja 0x4fdee6
lea ecx, [rax - 0x21]
cmp cl, 1
jbe 0x4fdef6
cmp al, 0x24
je 0x4fdef6
nop dword [rax]
cmp al, 0x26
jae 0x4fdef6
jmp 0x4fdef9
lea ecx, [rax - 0x3a]
cmp cl, 4
jbe 0x4fdef6
cmp al, 0x5b
je 0x4fdef6
cmp al, 0x5d
jne 0x4fdef9
xor eax, eax
ret
cmp al, 0x2f
ja 0x4fdf32
nop dword [rax]
cmp al, 0x26
ja 0x4fdf11
cmp al, 0x24
je 0x4fdf51
cmp al, 0x26
je 0x4fdf51
jmp 0x4fdfcb
lea ecx, [rax - 0x2b]
cmp cl, 1
jbe 0x4fdf51
lea ecx, [rax - 0x2d]
nop dword [rax]
cmp cl, 1
jbe 0x4fdfc8
cmp al, 0x2f
je 0x4fdf51
jmp 0x4fdfcb
cmp al, 0x3d
ja 0x4fdf49
lea ecx, [rax - 0x3a]
cmp cl, 1
jbe 0x4fdf51
nop
cmp al, 0x3d
je 0x4fdf51
jmp 0x4fdfcb
lea ecx, [rax - 0x3f]
cmp cl, 1
ja 0x4fdfc0
cmp rbx, 2
jg 0x4fdf87
cmp rbx, 1
je 0x4fdf81
nop dword [rax]
cmp rbx, 2
jne 0x4fdfcb
cmp al, 0x2f
je 0x4fdf72
cmp al, 0x3b
je 0x4fdf72
cmp al, 0x2c
jne 0x4fdf79
mov ecx, 1
jmp 0x4fdf7e
cmp al, 0x3f
sete cl
mov eax, ecx
ret
cmp al, 0x3f
sete al
ret
cmp rbx, 5
jne 0x4fdfaa
cmp al, 0x40
je 0x4fdf99
cmp al, 0x2f
je 0x4fdf99
cmp al, 0x3f
jne 0x4fdfa2
mov ecx, 1
nop
jmp 0x4fdfa7
cmp al, 0x3a
sete cl
mov eax, ecx
ret
cmp rbx, 6
je 0x4fdfb9
cmp rbx, 7
jne 0x4fdfcb
xor eax, eax
ret
mov eax, 1
ret
cmp al, 0x5f
je 0x4fdfc8
cmp al, 0x7e
jne 0x4fdfcb
xor eax, eax
ret
cmp rbx, 7
jne 0x4fdfe1
cmp al, 0x21
je 0x4fdfdd
lea ecx, [rax - 0x28]
cmp cl, 2
ja 0x4fdfe1
xor eax, eax
nop
ret
mov eax, 1
ret
Function at 0x14002bd20
Capabilities:
Check for peb beingdebugged flag
Check os version

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x1b8]
sub rsp, 0x280
mov qword [rbp + 0xa0], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x1400481f8]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov r12, rdx
mov rsi, rcx
mov ecx, 8
mov rax, qword gs:[0x58]
mov r8, qword [rax]
lea rax, str.CTieredVolume::ProcessVolumeTables
mov qword [rcx + r8], rax
lea rcx, [rsp + 0x48]
call fcn.14000865c
nop
xor r14d, r14d
mov byte [rsp + 0x40], r14b
mov byte [rsp + 0x41], r14b
mov r13d, r14d
mov qword [rsp + 0x68], r14
mov qword [rbp - 0x80], r14
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x70], r14
mov byte [rbp - 0x20], r14b
mov word [rbp], r14w
mov byte [rbp + 2], r14b
mov qword [rbp + 8], r14
mov byte [rbp + 0x10], r14b
mov byte [rbp + 0xb0], r14b
mov word [rbp + 0xd0], r14w
mov byte [rbp + 0xd2], r14b
mov qword [rbp + 0xd8], r14
mov byte [rbp + 0xe0], r14b
mov byte [rbp + 0x40], r14b
mov word [rbp + 0x60], r14w
mov byte [rbp + 0x62], r14b
mov qword [rbp + 0x68], r14
mov byte [rbp + 0x70], r14b
mov byte [rbp - 0x60], r14b
mov word [rbp - 0x40], r14w
mov byte [rbp - 0x3e], r14b
mov qword [rbp - 0x38], r14
mov byte [rbp - 0x30], r14b
mov qword [rsi + 0x210], r14
Function at 0x14003b60c
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x140048cc8], rbx
je 0x14003b673
cmp rax, rbx
jne 0x14003b666
mov ebx, 1
mov esi, ebx
jmp 0x14003b678
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x14003b64b
mov ebx, 1
mov eax, dword [0x140048cd0]
cmp eax, ebx
jne 0x14003b690
mov edi, 0x1f
mov ecx, edi
call sub.msvcrt.dll__amsg_exit
jmp 0x14003b6fc
mov eax, dword [0x140048cd0]
test eax, eax
jne 0x14003b6f1
mov dword [0x140048cd0], ebx
lea r15, [0x14003e288]
lea rdi, [0x14003e270]
mov qword [rsp + 0x30], rdi
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rdi, r15
jae 0x14003b6e3
test eax, eax
jne 0x14003b6e7
cmp qword [rdi], r14
je 0x14003b6d8
mov rax, qword [rdi]
mov rcx, qword [0x14003e230]
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x14003b6ba
test eax, eax
je 0x14003b6f7
mov eax, 0xff
jmp 0x14003b852
mov dword [0x140048284], ebx
mov edi, 0x1f
mov eax, dword [0x140048cd0]
cmp eax, ebx
jne 0x14003b723
lea rdx, [0x14003e268]
lea rcx, [0x14003e238]
call sub.msvcrt.dll__initterm
mov dword [0x140048cd0], 2
test esi, esi
jne 0x14003b731
mov rax, r14
xchg qword [0x140048cc8], rax
cmp qword [0x140048ce8], r14
je 0x14003b764
lea rcx, [0x140048ce8]
call fcn.14003bbf0
test eax, eax
je 0x14003b764
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140048ce8]
mov r9, qword [0x14003e230]
call r9
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x14003b77d
mov eax, 0xff
jmp 0x14003b852
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
movzx eax, word [rcx]
cmp ax, 0x20
ja 0x14003b803
test ax, ax
je 0x14003b798
test edx, edx
jne 0x14003b803
sub ax, bx
cmp ax, di
ja 0x14003b7ae
add rcx, 2
mov qword [rsp + 0x28], rcx
movzx eax, word [rcx]
jmp 0x14003b798
test byte [rsp + 0x7c], bl
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140001fc0
mov dword [0x140048280], eax
cmp dword [0x1400482a0], r14d
jne 0x14003b7ec
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x140048284], r14d
jne 0x14003b801
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x140048280]
jmp 0x14003b852
cmp ax, 0x22
jne 0x14003b817
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x14003b786
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call fcn.1401c2000
add rsp, 0x28
jmp 0x14003b60c
Function at 0x1400010c0
Capabilities:
Find process by pid

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx], 0x85b3e12
mov rbx, rcx
jne 0x140001117
movsxd rax, dword [rcx + 4]
test eax, eax
je 0x140001117
and qword [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140001117
call sub.ntoskrnl.exe_PsGetProcessSectionBaseAddress
test rax, rax
je 0x140001117
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
xor eax, eax
jmp 0x14000111c
mov eax, 0xc0000001
add rsp, 0x20
pop rbx
ret

Function at 0x140001124
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp dword [rcx], 0x85b3e12
mov rsi, rcx
je 0x140001148
mov eax, 0xc0000001
jmp 0x1400011fd
xor ebx, ebx
lea r9, [rsp + 0x20]
xor r8d, r8d
mov dword [rsp + 0x20], ebx
lea rdx, [rsp + 0x20]
mov edi, ebx
lea ecx, [rbx + 0x42]
call sub.ntoskrnl.exe_ZwQuerySystemInformation
cmp eax, 0xc0000004
jne 0x1400011fb
test rdi, rdi
je 0x140001180
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov edx, dword [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rax
mov ecx, 0x42
mov rdi, rax
call sub.ntoskrnl.exe_ZwQuerySystemInformation
cmp eax, 0xc0000004
je 0x140001170
test rdi, rdi
je 0x1400011fb
mov r8d, dword [rdi]
test r8d, r8d
je 0x1400011f0
lea rdx, [rdi + 0x18]
test byte [rdx - 8], 1
je 0x1400011e5
cmp qword [rdx], 0x200000
jne 0x1400011e5
mov ecx, dword [0x140001e00]
mov r9b, byte [0x140001e04]
cmp dword [rdx + 8], ecx
jne 0x1400011e5
cmp byte [rdx + 0xc], r9b
je 0x14000120d
inc ebx
add rdx, 0x20
cmp ebx, r8d
jb 0x1400011be
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rsi + 8]
mov rax, qword [rdx - 0x10]
mov qword [rcx], rax
jmp 0x1400011fb
Function at 0x14000121c
Capabilities:
Find process by pid

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x20
cmp dword [rcx], 0x85b3e12
mov rdi, rcx
jne 0x1400012c0
movsxd rax, dword [rcx + 4]
test eax, eax
je 0x1400012c0
and qword [r11 + 8], 0
lea rdx, [r11 + 8]
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400012c0
call fcn.1400012d8
mov rcx, qword [rsp + 0x30]
mov rbx, rax
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rdx, qword [rdi + 8]
mov rcx, rbx
mov rsi, qword [rdi + 0x18]
call fcn.140001524
test rax, rax
je 0x1400012c0
mov ecx, eax
lea r9, [rsp + 0x38]
and ecx, 0xfff
mov edx, 0x1000
sub edx, ecx
mov rcx, rax
cmp edx, esi
cmovl esi, edx
cmp byte [rdi + 0x20], 0
mov rdx, qword [rdi + 0x10]
movsxd r8, esi
je 0x1400012b7
call fcn.1400016d4
jmp 0x1400012bc
call fcn.140001010
xor eax, eax
jmp 0x1400012c5
mov eax, 0xc0000001
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x140001d30
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001d7a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001d7a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001d7a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001d7a
cmp dword [rcx + 0x84], 0xe
jbe 0x140001d7a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001d7c
xor al, al
add rsp, 0x28
ret

Function at 0x140008720
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14000851c
Function at 0x14000da68
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14000da98
xor eax, eax
jmp 0x14000db5b
mov rbp, rbx
cmp word [rax], si
je 0x14000dabd
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x14000daa4
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14000daa0
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.14000d988
movsxd r14, eax
test eax, eax
jne 0x14000dafb
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x14000da91
mov rcx, r14
call fcn.14000a21c
mov rdi, rax
test rax, rax
jne 0x14000db14
xor ecx, ecx
call fcn.1400095a4
jmp 0x14000daf0
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.14000d988
test eax, eax
jne 0x14000db45
mov rcx, rdi
call fcn.1400095a4
jmp 0x14000db4f
xor ecx, ecx
call fcn.1400095a4
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x140011e7c
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x140011e92
mov al, 1
jmp 0x140011ef2
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x140011ea3
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x140011ef0
mov ecx, dword [rcx + 0x18]
nop
call fcn.14000e388
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140011ef0
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140011ef0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140011ef0
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x140011ef2
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x140012f30
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.14000ca58
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x140012fba
cmp byte [rbp - 0x21], r15b
je 0x140012fb5
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x140012ff0
call fcn.1400097f4
test eax, eax
jne 0x140012fdc
cmp byte [rbp - 0x21], r15b
je 0x140012fd4
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x140012ff0
cmp byte [rbp - 0x21], r15b
je 0x140012fed
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.14000c038
test eax, eax
jne 0x140013090
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.14000ca58
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x14001302f
cmp byte [rbp - 0x21], r15b
je 0x140013064
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x140013064
call fcn.1400097f4
test eax, eax
jne 0x140013050
cmp byte [rbp - 0x21], r15b
je 0x140013049
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x140013064
cmp byte [rbp - 0x21], r15b
je 0x140013061
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.14000c038
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x140013090
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x140013093
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x1400130a1
mov rcx, rdi
call fcn.1400095a4
cmp byte [rbp + 0x3f], r15b
je 0x1400130b0
mov rcx, qword [rbp + 0x27]
call fcn.1400095a4
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x140015620
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140015648
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140015648
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret