joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140035be0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, qword [0x14005be38]
mov r10, rcx
mov r9, qword [rcx + 0x188]
movsxd rax, edx
imul rbx, rax, 0x70
add rbx, qword [rcx + 0x18]
mov dword [rcx + 0x74], edx
test dword [rbx], 0x10000
movss xmm2, dword [rbx + 0x34]
je 0x140035c23
addss xmm2, dword [rcx + 0x90]
movaps xmm0, xmm2
lea rsi, [r9 + 0x110]
subss xmm0, dword [r9 + 0x28]
movss dword [rsi], xmm2
movss xmm1, dword [rcx + 0x88]
addss xmm1, dword [rcx + 0x7c]
movss dword [r9 + 0x128], xmm2
subss xmm0, dword [r9 + 0x154]
movss dword [r9 + 0x118], xmm2
movss dword [r9 + 0x114], xmm1
movss dword [r9 + 0x158], xmm0
mov eax, dword [rcx + 0x8c]
mov dword [r9 + 0x148], eax
movsx eax, byte [rbx + 0x6a]
mov dword [r9 + 0x168], eax
movss dword [r9 + 0x22c], xmm1
mov eax, dword [rbx + 0x34]
mov dword [r9 + 0x228], eax
mov eax, dword [rbx + 0x38]
mov dword [r9 + 0x230], eax
mov eax, dword [rbx + 0x3c]
mov dword [r9 + 0x1d0], eax
movzx eax, byte [rbx + 0x68]
mov byte [r9 + 0xc3], al
cmp byte [rbx + 0x68], 0
je 0x140035ccf
xor eax, eax
mov dword [rdi + 0x49b0], eax
mov dword [rdi + 0x49b8], eax
test dword [rcx + 4], 0x100000
je 0x140035ce3
mov r8d, 2
jmp 0x140035d63
movups xmm0, xmmword [rbx + 0x20]
mov rax, qword [r9 + 0x2a8]
movss xmm4, dword [rbx + 0x20]
movss xmm3, dword [rbx + 0x24]
movss xmm2, dword [rbx + 0x28]
movss xmm1, dword [rbx + 0x2c]
movups xmmword [r9 + 0x248], xmm0
movss dword [rsp + 0x20], xmm4
movss dword [rsp + 0x24], xmm3
movss dword [rsp + 0x28], xmm2
movss dword [rsp + 0x2c], xmm1
movss dword [rax + 0x88], xmm4
movss dword [rax + 0x8c], xmm3
movss dword [rax + 0x90], xmm2
movss dword [rax + 0x94], xmm1
mov rax, qword [r9 + 0x2a8]
movups xmm0, xmmword [rsp + 0x20]
movsxd rdx, dword [rax + 0x58]
mov rcx, qword [rax + 0x60]
add rdx, rdx
movups xmmword [rcx + rdx*8 - 0x10], xmm0
movzx r8d, word [rbx + 0x5c]
mov rdx, qword [r9 + 0x2a8]
mov rcx, qword [r10 + 0x1a0]
call fcn.140029ab0
cmp byte [rdi + 0x6008], 0
je 0x140035da1
cmp byte [rbx + 0x68], 0
jne 0x140035da1
xor r8d, r8d
lea rdx, [0x140052854]
mov rcx, rsi
call fcn.14001ab80
mov dword [rdi + 0x6038], 0x7f7fffff
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1400361f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
mov rax, qword [0x14005be38]
mov rcx, qword [rax + 0x4e18]
mov r9, qword [rax + 0x4000]
movups xmm0, xmmword [r9 + 0x248]
movups xmmword [rcx + 0x170], xmm0
mov rax, qword [r9 + 0x2a8]
movups xmm0, xmmword [rcx + 0x150]
movss xmm4, dword [rcx + 0x150]
movss xmm3, dword [rcx + 0x154]
movss xmm2, dword [rcx + 0x158]
movss xmm1, dword [rcx + 0x15c]
movups xmmword [r9 + 0x248], xmm0
movss dword [rsp + 0x20], xmm4
movss dword [rsp + 0x24], xmm3
movss dword [rsp + 0x28], xmm2
movss dword [rsp + 0x2c], xmm1
movss dword [rax + 0x88], xmm4
movss dword [rax + 0x8c], xmm3
movss dword [rax + 0x90], xmm2
movss dword [rax + 0x94], xmm1
mov rax, qword [r9 + 0x2a8]
movups xmm0, xmmword [rsp + 0x20]
movsxd r8, dword [rax + 0x58]
mov rdx, qword [rax + 0x60]
add r8, r8
movups xmmword [rdx + r8*8 - 0x10], xmm0
movzx r8d, word [rcx + 0x232]
mov rcx, qword [rcx + 0x1a0]
mov rdx, qword [r9 + 0x2a8]
add rsp, 0x38
jmp fcn.140029ab0

Function at 0x1400362d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
mov rax, qword [0x14005be38]
mov rcx, qword [rax + 0x4e18]
mov r10, qword [rax + 0x4000]
movsxd rax, dword [rcx + 0x74]
movups xmm0, xmmword [rcx + 0x170]
movss xmm4, dword [rcx + 0x170]
movss xmm3, dword [rcx + 0x174]
movss xmm2, dword [rcx + 0x178]
movss xmm1, dword [rcx + 0x17c]
movss dword [rsp + 0x20], xmm4
movss dword [rsp + 0x24], xmm3
movss dword [rsp + 0x28], xmm2
movss dword [rsp + 0x2c], xmm1
imul r9, rax, 0x70
mov rax, qword [r10 + 0x2a8]
add r9, qword [rcx + 0x18]
movups xmmword [r10 + 0x248], xmm0
movss dword [rax + 0x88], xmm4
movss dword [rax + 0x8c], xmm3
movss dword [rax + 0x90], xmm2
movss dword [rax + 0x94], xmm1
mov rax, qword [r10 + 0x2a8]
movups xmm0, xmmword [rsp + 0x20]
movsxd r8, dword [rax + 0x58]
mov rdx, qword [rax + 0x60]
add r8, r8
movups xmmword [rdx + r8*8 - 0x10], xmm0
movzx r8d, word [r9 + 0x5c]
mov rdx, qword [r10 + 0x2a8]
mov rcx, qword [rcx + 0x1a0]
add rsp, 0x38
jmp fcn.140029ab0
Function at 0x140045d50
Capabilities:
Enumerate process modules

Disassembly:
test edx, edx
je 0x140045eae
push rdi
mov eax, 0x14c0
call fcn.14004b260
sub rsp, rax
mov rax, qword [0x14005b040]
xor rax, rsp
mov qword [rsp + 0x14b0], rax
mov edi, edx
mov dword [rsp + 0x70], 0x438
xor edx, edx
lea rcx, [rsp + 0x74]
mov r8d, 0x434
call sub.VCRUNTIME140.dll_memset
cmp byte [0x14005b0d8], 0
je 0x140045e96
mov edx, edi
mov qword [rsp + 0x14d0], rbx
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140045e8e
lea rdx, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x140045f84
mov qword [rsp + 0x14e0], rsi
lea rsi, [0x14005b0b8]
nop dword [rax + rax]
lea rax, [rsp + 0x2a0]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x140045e00
inc r8
mov qword [rsp + 0x20], 0xffffffffffffffff
lea r9, [rsp + 0x2a0]
xor ecx, ecx
lea rdx, [rsp + 0x4b0]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs_s]
cmp qword [0x14005b0d0], 0xf
lea rax, [rsp + 0x4b0]
mov r8, rsi
cmova r8, qword [0x14005b0b8]
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140045e63
inc rax
test ecx, ecx
jne 0x140045e50
mov rcx, rbx
test edx, edx
je 0x140045eaf
lea rdx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x140045df0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x14e0]
mov rbx, qword [rsp + 0x14d0]
mov rcx, qword [rsp + 0x14b0]
xor rcx, rsp
call fcn.14004a3f0
add rsp, 0x14c0
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [rsp + 0x60], 0
je 0x140045e86
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140045e86
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdi, rax
test rax, rax
je 0x140045e7d
lea rdx, [0x140052af8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
test rax, rax
je 0x140045f6d
xor eax, eax
mov r9, rbx
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov qword [rsp + 0x48], rax
mov edx, 0x1fffff
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x68]
call fcn.14004a3a0
mov rcx, qword [rsp + 0x68]
lea rdx, [rcx - 1]
cmp rdx, 0xfffffffffffffffd
ja 0x140045e7d
test eax, eax
jne 0x140045e7d
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x140045e86
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140045e8e
mov edx, dword [rdx]
jmp 0x140045d50
Function at 0x140047360
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [rdx + 0x18], 0xf
mov rbx, rdx
mov rcx, rdx
jbe 0x140047376
mov rcx, qword [rdx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400473bf
test al, 0x10
jne 0x1400473bf
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x1400473bb
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x1400473b6
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140047410
mov rcx, r8
call fcn.14004a58c
mov al, 1
jmp 0x1400473f7
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x1400473f5
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x1400473f0
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140047410
mov rcx, r8
call fcn.14004a58c
xor al, al
mov byte [rbx], 0
mov qword [rbx + 0x18], 0xf
mov qword [rbx + 0x10], 0
add rsp, 0x20
pop rbx
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14004a090
Capabilities:
Enumerate process modules

Disassembly:
test edx, edx
je 0x140045eae
push rdi
mov eax, 0x14c0
call fcn.14004b260
sub rsp, rax
mov rax, qword [0x14005b040]
xor rax, rsp
mov qword [rsp + 0x14b0], rax
mov edi, edx
mov dword [rsp + 0x70], 0x438
xor edx, edx
lea rcx, [rsp + 0x74]
mov r8d, 0x434
call sub.VCRUNTIME140.dll_memset
cmp byte [0x14005b0d8], 0
je 0x140045e96
mov edx, edi
mov qword [rsp + 0x14d0], rbx
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140045e8e
lea rdx, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x140045f84
mov qword [rsp + 0x14e0], rsi
lea rsi, [0x14005b0b8]
nop dword [rax + rax]
lea rax, [rsp + 0x2a0]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x140045e00
inc r8
mov qword [rsp + 0x20], 0xffffffffffffffff
lea r9, [rsp + 0x2a0]
xor ecx, ecx
lea rdx, [rsp + 0x4b0]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs_s]
cmp qword [0x14005b0d0], 0xf
lea rax, [rsp + 0x4b0]
mov r8, rsi
cmova r8, qword [0x14005b0b8]
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140045e63
inc rax
test ecx, ecx
jne 0x140045e50
mov rcx, rbx
test edx, edx
je 0x140045eaf
lea rdx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x140045df0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x14e0]
mov rbx, qword [rsp + 0x14d0]
mov rcx, qword [rsp + 0x14b0]
xor rcx, rsp
call fcn.14004a3f0
add rsp, 0x14c0
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [rsp + 0x60], 0
je 0x140045e86
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140045e86
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdi, rax
test rax, rax
je 0x140045e7d
lea rdx, [0x140052af8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
test rax, rax
je 0x140045f6d
xor eax, eax
mov r9, rbx
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov qword [rsp + 0x48], rax
mov edx, 0x1fffff
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x68]
call fcn.14004a3a0
mov rcx, qword [rsp + 0x68]
lea rdx, [rcx - 1]
cmp rdx, 0xfffffffffffffffd
ja 0x140045e7d
test eax, eax
jne 0x140045e7d
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x140045e86
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140045e8e
mov edx, dword [rdx]
jmp 0x140045d50
Function at 0x14004a120
Capabilities:
Allocate or change rwx memory

Disassembly:
push rsi
push rdi
sub rsp, 0x88
mov rax, qword [0x14005b040]
xor rax, rsp
mov qword [rsp + 0x70], rax
cmp byte [rcx + 0x20], 0
mov esi, edx
mov rdi, rcx
jne 0x140045b45
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140045840
jmp 0x140045d2f
test esi, esi
je 0x140045d2f
mov r8d, esi
mov qword [rsp + 0xb0], rbx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140045d27
xor edx, edx
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov rcx, rax
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rcx, rbx
test rax, rax
jne 0x140045ba1
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140045d27
mov r9d, 0x8000
mov qword [rsp + 0x80], rbp
xor r8d, r8d
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebp, ebp
mov r8d, esi
xor edx, edx
mov qword [rsp + 0x68], rbp
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor edx, edx
mov dword [rsp + 0x20], 4
mov rcx, rax
mov r9d, 0x1000
mov r8d, 0x100
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rsi, rax
test rax, rax
je 0x140045d1f
cmp rbx, 0xffffffffffffffff
je 0x140045d1f
mov r9, qword [rdi + 0x10]
inc r9
cmp qword [rdi + 0x18], 0xf
jbe 0x140045c24
mov rdi, qword [rdi]
lea rax, [rsp + 0x68]
mov r8, rdi
mov rdx, rsi
mov qword [rsp + 0x20], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140045cfe
lea rcx, [0x140052ab8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140045cfe
lea rdx, [0x140052ac8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140045cfe
mov qword [rsp + 0x50], rbp
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x48], rbp
mov r9, rbx
mov qword [rsp + 0x40], rbp
xor r8d, r8d
mov qword [rsp + 0x38], rbp
mov edx, 0x1fffff
mov dword [rsp + 0x30], ebp
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x60], rbp
call fcn.14004a3a0
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx - 1]
cmp rdx, 0xfffffffffffffffd
ja 0x140045cd2
test eax, eax
jne 0x140045cd2
mov edx, 0x1f4
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov r9d, 0x1000
mov r8d, 0x300
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x140045d1f
mov r9d, 0x1000
mov r8d, 0x300
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbp, qword [rsp + 0x80]
mov rbx, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14004a3f0
add rsp, 0x88
pop rdi
pop rsi
ret
mov edx, dword [rdx]
lea rcx, [0x14005b0b8]
jmp 0x140045b10
Function at 0x14004a140
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Resolve function by parsing pe exports

Disassembly:
push r15
sub rsp, 0x10
cmp dword [0x14005dec0], 0
jne 0x14004a343
mov rax, qword gs:[0x60]
xor r15d, r15d
mov edx, r15d
mov rcx, qword [rax + 0x18]
mov r8, qword [rcx + 0x10]
mov rax, qword [r8 + 0x30]
test rax, rax
je 0x14004a34f
nop word [rax + rax]
mov r10, rax
movsxd rax, dword [rax + 0x3c]
mov ecx, dword [rax + r10 + 0x88]
test ecx, ecx
je 0x14004a1bd
lea rdx, [r10 + rcx]
mov ecx, dword [r10 + rcx + 0xc]
mov eax, dword [rcx + r10]
or eax, 0x20202020
cmp eax, 0x6c64746e
jne 0x14004a1bd
mov eax, dword [rcx + r10 + 4]
or eax, 0x20202020
cmp eax, 0x6c642e6c
je 0x14004a1c9
mov r8, qword [r8]
mov rax, qword [r8 + 0x30]
test rax, rax
jne 0x14004a180
test rdx, rdx
je 0x14004a34f
mov r11d, dword [rdx + 0x18]
mov qword [rsp + 0x20], rbx
mov ebx, r15d
mov qword [rsp + 0x28], rbp
mov ebp, dword [rdx + 0x24]
mov qword [rsp + 0x30], rsi
mov esi, dword [rdx + 0x1c]
mov qword [rsp + 0x38], rdi
add rsi, r10
mov edi, dword [rdx + 0x20]
mov qword [rsp + 8], r12
add rdi, r10
mov qword [rsp], r14
add rbp, r10
mov r12d, 0x775a
lea r14, [0x14005dec0]
nop word [rax + rax]
lea eax, [r11 - 1]
mov r9d, dword [rdi + rax*4]
add r9, r10
cmp word [r9], r12w
jne 0x14004a284
mov edx, r15d
mov r8d, 0xeb0ca24d
mov rax, r9
nop dword [rax]
movzx eax, word [rax]
mov ecx, r8d
ror ecx, 8
inc edx
add ecx, eax
mov eax, edx
add rax, r9
xor r8d, ecx
cmp byte [rax], r15b
jne 0x14004a240
mov edx, ebx
lea eax, [r11 - 1]
add rdx, rdx
inc ebx
mov dword [r14 + rdx*8 + 8], r8d
movzx eax, word [rbp + rax*2]
mov eax, dword [rsi + rax*4]
mov dword [r14 + rdx*8 + 0xc], eax
mov qword [r14 + rdx*8 + 0x10], r15
cmp ebx, 0x258
je 0x14004a28a
add r11d, 0xffffffff
jne 0x14004a220
mov r12, qword [rsp + 8]
lea eax, [rbx - 1]
mov rbp, qword [rsp + 0x28]
mov r11d, r15d
mov dword [0x14005dec0], ebx
test eax, eax
je 0x14004a330
nop dword [rax + rax]
mov ecx, ebx
mov eax, r15d
sub ecx, r11d
cmp ecx, 1
je 0x14004a325
nop dword [rax]
lea r10d, [rax + 1]
mov r9d, eax
add r9, r9
mov r8d, r10d
add r8, r8
mov esi, dword [r14 + r9*8 + 0xc]
mov edi, dword [r14 + r8*8 + 0xc]
cmp esi, edi
jbe 0x14004a316
mov eax, dword [r14 + r8*8 + 8]
mov edx, dword [r14 + r9*8 + 8]
mov rcx, qword [r14 + r9*8 + 0x10]
mov dword [r14 + r9*8 + 8], eax
mov rax, qword [r14 + r8*8 + 0x10]
mov qword [r14 + r9*8 + 0x10], rax
mov dword [r14 + r9*8 + 0xc], edi
mov dword [r14 + r8*8 + 8], edx
mov dword [r14 + r8*8 + 0xc], esi
mov qword [r14 + r8*8 + 0x10], rcx
mov ebx, dword [0x14005dec0]
mov ecx, ebx
mov eax, r10d
sub ecx, r11d
dec ecx
cmp r10d, ecx
jb 0x14004a2c0
inc r11d
lea eax, [rbx - 1]
cmp r11d, eax
jb 0x14004a2b0
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x20]
mov r14, qword [rsp]
mov eax, 1
add rsp, 0x10
pop r15
ret
xor eax, eax
add rsp, 0x10
pop r15
ret
Function at 0x14004a3a0
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x84a94afe
call fcn.14004a360
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x14004ae10
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14004ae5a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14004ae5a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14004ae5a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14004ae5a
cmp dword [rcx + 0x84], 0xe
jbe 0x14004ae5a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14004ae5c
xor al, al
add rsp, 0x28
ret
Function at 0x14048544c
Capabilities:
Encode data using xor

Disassembly:
pop r11
xchg rdx, rbx
lea r10, [r9*2 + 0x5e02d63c]
mov rbp, rdx
pop rcx
jmp 0x1404842b7
Function at 0x14001ee90
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x3d0
mov rax, qword [0x140198858]
xor rax, rsp
mov qword [rsp + 0x3c0], rax
mov edx, 0x101
xor edi, edi
mov rbx, rcx
mov dword [rsp + 0x20], edx
cmp qword [rcx + 0x10], rdx
jb 0x14001eedf
mov qword [rcx + 0x10], rdx
cmp qword [rcx + 0x18], 8
jb 0x14001eed3
mov rax, qword [rcx]
jmp 0x14001eed6
mov rax, rcx
mov word [rax + 0x202], di
jmp 0x14001eeeb
sub rdx, qword [rcx + 0x10]
xor r8d, r8d
call fcn.1400081b0
cmp qword [rbx + 0x18], 8
jb 0x14001eef7
mov rdx, qword [rbx]
jmp 0x14001eefa
mov rdx, rbx
lea r8, [rsp + 0x20]
mov ecx, 2
call sub.Secur32.dll_GetUserNameExW
test al, al
je 0x14001ef5b
mov edx, dword [rsp + 0x20]
cmp rdx, qword [rbx + 0x10]
ja 0x14001ef2b
mov qword [rbx + 0x10], rdx
cmp qword [rbx + 0x18], 8
jb 0x14001ef25
mov rbx, qword [rbx]
mov word [rbx + rdx*2], di
jmp 0x14001ef3a
sub rdx, qword [rbx + 0x10]
xor r8d, r8d
mov rcx, rbx
call fcn.1400081b0
mov rcx, qword [rsp + 0x3c0]
xor rcx, rsp
call fcn.140022430
mov rbx, qword [rsp + 0x3e8]
add rsp, 0x3d0
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, str.Failed_to_get_current_username.
mov edx, 0xf
mov r8d, eax
lea rcx, [rsp + 0x30]
call fcn.140018d38
lea rdx, [0x1401e5908]
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x140022330
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x20
mov rax, qword [0x140198858]
movabs rdi, 0x2b992ddfa23249d6
test rax, rax
je 0x140022360
mov rax, qword [0x140198858]
cmp rax, rdi
jne 0x140022421
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_HeapSetInformation]
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rbx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov eax, eax
xor rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov eax, eax
xor rbx, rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov eax, eax
lea rcx, [rsp + 0x40]
xor rbx, rax
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xor rbx, qword [rsp + 0x40]
lea r9, [rsp + 0x30]
mov edx, 8
lea rcx, [0x140198858]
lea r8d, [rdx + 0x38]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
test rbx, rbx
lea rcx, [0x140198858]
mov edx, 8
cmovne rdi, rbx
mov qword [0x140198858], rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, 8
lea rcx, [0x140198858]
call sub.KERNEL32.dll_WerRegisterMemoryBlock
mov rax, qword [0x140198858]
not rax
mov qword [0x1402723b0], rax
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x1400112f3
Capabilities:
Terminate process

Disassembly:
jmp 0x1400157b0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x1400113c5
Capabilities:
Parse pe header

Disassembly:
jmp 0x140016b00
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140016b20
xor al, al
jmp 0x140016ba1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140016b33
xor al, al
jmp 0x140016ba1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140016b5d
xor al, al
jmp 0x140016ba1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140016b71
xor al, al
jmp 0x140016ba1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140016b83
xor al, al
jmp 0x140016ba1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140016b9f
xor al, al
jmp 0x140016ba1
mov al, 1
add rsp, 0x38
ret
Function at 0x140001000
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x68
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x58], rax
xor ecx, ecx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rcx
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersion
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], rcx
xor r8d, r8d
mov qword [rsp + 0x50], rcx
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], ecx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140001092
mov rcx, qword [rsp + 0x50]
lea rax, [0x140003330]
mov dword [rsp + 0x28], 4
lea rdx, [0x140003328]
mov r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400010c0
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400012f0
add rsp, 0x68
ret

Function at 0x140001bb8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001c02
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001c02
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001c02
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001c02
cmp dword [rcx + 0x84], 0xe
jbe 0x140001c02
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001c04
xor al, al
add rsp, 0x28
ret