joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000f720
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140061040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14000f74d
xor eax, eax
jmp 0x14000f8b9
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x14000f787
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x14000f787
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x14000f8b9
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14000f8ac
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14000f7ca
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14000f7f5
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14000f8b1
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14000f864
sub eax, 1
je 0x14000f864
cmp eax, 2
jne 0x14000f8ac
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14000f8b1
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x14000f892
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14000f8ac
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x14000f8b1
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140025710
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140011e40
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140061040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140011f13
cmp byte [rcx + 0x71], 0
je 0x140011f13
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140011f0f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140011ed4
sub eax, 1
je 0x140011ed8
cmp eax, 2
jne 0x140011f0f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140025710
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140011f06
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140011f0f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x140011ebc
xor al, al
jmp 0x140011ebc
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140025710
add rsp, 0x60
pop rbx
ret
Function at 0x140025034
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1400250b8
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, reloc.WS2_32.dll_accept
cmp byte [rcx + rax], 0
je 0x1400250b8
dec r8
sub rdx, 1
jne 0x14002509e
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x1400264a8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400264f2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400264f2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400264f2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400264f2
cmp dword [rcx + 0x84], 0xe
jbe 0x1400264f2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400264f4
xor al, al
add rsp, 0x28
ret

Function at 0x14002e430
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x90
mov rax, qword [0x140061040]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, r8
mov rdi, rdx
mov ecx, dword [0x14006443c]
mov rax, qword gs:[0x58]
mov edx, 4
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x1400644b0], ecx
jg 0x14002e512
mov eax, ebx
cmp rbx, rax
jne 0x14002e4d4
xor ecx, ecx
mov eax, ecx
test rbx, rbx
setne al
test ebx, ebx
setne cl
cmp eax, ecx
jne 0x14002e4d4
xor r9d, r9d
mov r8d, ebx
mov rdx, rdi
mov rcx, qword [0x1400644a8]
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
js 0x14002e555
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140025710
mov rbx, qword [rsp + 0xa0]
add rsp, 0x90
pop rdi
ret
mov ecx, 0x5b6
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rdx, str.GenerateBlock_size
lea rcx, [rsp + 0x20]
call fcn.140002660
nop
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.14002e040
lea rdx, [0x14005dee8]
lea rcx, [rsp + 0x40]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
lea rcx, [0x1400644b0]
call fcn.140025ac4
cmp dword [0x1400644b0], 0xffffffff
jne 0x14002e47c
lea rcx, [0x1400644a8]
call fcn.14002df30
lea rcx, [0x140046fe0]
call fcn.140025e54
nop
lea rcx, [0x1400644b0]
call fcn.140025a58
jmp 0x14002e47c
mov ecx, eax
call fcn.14002e5a0
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rdx, [0x14004b1d0]
lea rcx, [rsp + 0x20]
call fcn.140002660
nop
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.14002e040
lea rdx, [0x14005dee8]
lea rcx, [rsp + 0x40]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x14003d310
Capabilities:
Encode data using xor

Disassembly:
mov r9, r8
xor r11d, r11d
mov r10, rdx
mov r8d, r11d
cmp r9, 8
jb 0x14003d347
mov rdx, r9
shr rdx, 3
imul rax, rdx, 0xfffffffffffffff8
add r9, rax
mov rax, qword [rcx]
add rcx, 8
xor rax, qword [r10]
add r10, 8
or r8, rax
sub rdx, 1
jne 0x14003d330
mov rdx, r8
shr rdx, 0x20
or edx, r8d
mov r8d, edx
mov eax, edx
shr r8d, 8
or r8d, edx
shr eax, 0x10
and r8d, 0xff00
or r8d, eax
movzx eax, dl
shr r8d, 8
or r8d, eax
test r9, r9
je 0x14003d438
sub rcx, r10
cmp r9, 8
jb 0x14003d419
mov rax, r9
lea rdx, [r10 + 4]
and rax, 0xfffffffffffffff8
xorps xmm4, xmm4
xorps xmm3, xmm3
nop dword [rax + rax]
movd xmm2, dword [rcx + rdx - 4]
xorps xmm0, xmm0
movd xmm1, dword [rdx - 4]
lea rdx, [rdx + 8]
punpcklbw xmm2, xmm0
add r11, 8
punpcklwd xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
xorps xmm2, xmm1
movd xmm1, dword [rdx - 8]
punpcklbw xmm1, xmm0
orps xmm4, xmm2
movd xmm2, dword [rcx + rdx - 8]
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
xorps xmm2, xmm1
orps xmm3, xmm2
cmp r11, rax
jb 0x14003d3a0
orps xmm3, xmm4
movdqa xmm0, xmm3
psrldq xmm0, 8
orps xmm3, xmm0
movdqa xmm0, xmm3
psrldq xmm0, 4
orps xmm3, xmm0
movd eax, xmm3
or r8d, eax
cmp r11, r9
jae 0x14003d438
add r10, r11
sub r9, r11
nop
movzx edx, byte [rcx + r10]
movzx eax, byte [r10]
lea r10, [r10 + 1]
xor edx, eax
or r8d, edx
sub r9, 1
jne 0x14003d420
test r8d, r8d
sete al
ret
Function at 0x14003d440
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r10, rdx
test r9, r9
je 0x14003d5e4
cmp r9, 4
jb 0x14003d48a
mov rdx, r9
shr rdx, 2
imul rax, rdx, 0xfffffffffffffffc
add r9, rax
nop dword [rax]
nop dword [rax + rax]
mov eax, dword [r10]
add r10, 4
xor eax, dword [r8]
add r8, 4
mov dword [rcx], eax
add rcx, 4
sub rdx, 1
jne 0x14003d470
xor r11d, r11d
test r9, r9
je 0x14003d5e4
cmp r9, 8
jb 0x14003d5bd
lea rdx, [rcx - 1]
lea rax, [r8 - 1]
add rdx, r9
add rax, r9
cmp rcx, rax
ja 0x14003d4bc
cmp rdx, r8
jae 0x14003d5bd
lea rax, [r10 - 1]
add rax, r9
cmp rcx, rax
ja 0x14003d4d1
cmp rdx, r10
jae 0x14003d5bd
mov rdx, r10
mov qword [rsp + 0x10], rbx
sub rdx, r8
mov qword [rsp], rdi
cmp r9, 0x40
jb 0x14003d577
mov rdi, r9
mov qword [rsp + 0x18], rsi
and edi, 0x3f
mov rsi, r9
sub rsi, rdi
mov rbx, rcx
lea rax, [r8 + 0x10]
sub rbx, r8
nop word [rax + rax]
movdqu xmm0, xmmword [rax - 0x10]
add r11, 0x40
movdqu xmm1, xmmword [rdx + rax - 0x10]
movdqu xmm2, xmmword [rdx + rax]
lea rax, [rax + 0x40]
xorps xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x40]
movdqu xmmword [rbx + rax - 0x50], xmm1
xorps xmm2, xmm0
movdqu xmm0, xmmword [rax - 0x30]
movdqu xmm1, xmmword [rdx + rax - 0x30]
movdqu xmmword [rbx + rax - 0x40], xmm2
xorps xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x20]
movdqu xmm2, xmmword [rdx + rax - 0x20]
movdqu xmmword [rbx + rax - 0x30], xmm1
xorps xmm2, xmm0
movdqu xmmword [rbx + rax - 0x20], xmm2
cmp r11, rsi
jb 0x14003d510
mov rsi, qword [rsp + 0x18]
cmp rdi, 8
jb 0x14003d5af
mov rbx, r9
and rbx, 0xfffffffffffffff8
mov rdi, rcx
lea rax, [r11 + r8]
sub rdi, r8
nop dword [rax + rax]
movq xmm1, qword [rax + rdx]
add r11, 8
movq xmm0, qword [rax]
lea rax, [rax + 8]
xorps xmm1, xmm0
movq qword [rax + rdi - 8], xmm1
cmp r11, rbx
jb 0x14003d590
mov rdi, qword [rsp]
mov rbx, qword [rsp + 0x10]
cmp r11, r9
jae 0x14003d5e4
sub r10, r8
lea rdx, [r11 + r8]
sub rcx, r8
sub r9, r11
nop word [rax + rax]
movzx eax, byte [rdx + r10]
xor al, byte [rdx]
mov byte [rdx + rcx], al
lea rdx, [rdx + 1]
sub r9, 1
jne 0x14003d5d0
add rsp, 8
ret
Function at 0x1400438d0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x18
movdqu xmm5, xmmword [rcx]
xor ecx, ecx
movaps xmmword [rsp], xmm6
movdqa xmm6, xmmword [0x14004ca40]
pshufb xmm5, xmmword [0x140048bb0]
movdqa xmm4, xmm5
add r8d, 0xffffffe0
je 0x140043a0d
nop dword [rax]
movq qword [rcx + rdx], xmm4
movdqa xmm2, xmm4
pclmulqdq xmm2, xmm5, 0
movdqa xmm1, xmm2
movdqa xmm3, xmm4
movdqa xmm0, xmm4
pslldq xmm1, 8
pclmulqdq xmm0, xmm5, 1
pclmulqdq xmm3, xmm5, 0x10
xorps xmm3, xmm0
movdqa xmm0, xmm2
psrldq xmm2, 8
xorps xmm3, xmm1
pclmulqdq xmm0, xmm6, 0x10
xorps xmm3, xmm0
movdqa xmm0, xmm4
xorps xmm2, xmm3
movdqa xmm1, xmm3
psllq xmm2, 1
pclmulqdq xmm2, xmm6, 0
pclmulqdq xmm0, xmm5, 0x11
xorps xmm2, xmm0
psrldq xmm1, 8
xorps xmm2, xmm1
punpcklqdq xmm3, xmm2
psllq xmm2, 1
psrlq xmm3, 0x3f
xorps xmm3, xmm2
movdqu xmmword [rcx + rdx + 0x10], xmm3
movdqu xmmword [rcx + rdx + 8], xmm4
movdqa xmm2, xmm3
movq qword [rcx + rdx + 8], xmm3
pclmulqdq xmm2, xmm5, 0
movdqa xmm1, xmm2
movdqa xmm4, xmm3
pclmulqdq xmm4, xmm5, 0x10
movdqa xmm0, xmm3
pslldq xmm1, 8
pclmulqdq xmm0, xmm5, 1
xorps xmm4, xmm0
add ecx, 0x20
movdqa xmm0, xmm2
psrldq xmm2, 8
xorps xmm4, xmm1
pclmulqdq xmm0, xmm6, 0x10
xorps xmm4, xmm0
xorps xmm2, xmm4
movdqa xmm0, xmm4
psllq xmm2, 1
psrldq xmm0, 8
pclmulqdq xmm2, xmm6, 0
pclmulqdq xmm3, xmm5, 0x11
xorps xmm2, xmm3
xorps xmm2, xmm0
punpcklqdq xmm4, xmm2
psrlq xmm4, 0x3f
psllq xmm2, 1
xorps xmm4, xmm2
cmp ecx, r8d
jb 0x140043900
movq qword [rcx + rdx], xmm4
movdqa xmm2, xmm4
pclmulqdq xmm2, xmm5, 0
movdqa xmm1, xmm2
movdqa xmm3, xmm4
pclmulqdq xmm3, xmm5, 0x10
pslldq xmm1, 8
movdqa xmm0, xmm4
pclmulqdq xmm0, xmm5, 1
xorps xmm3, xmm0
movdqa xmm0, xmm2
xorps xmm3, xmm1
psrldq xmm2, 8
pclmulqdq xmm0, xmm6, 0x10
xorps xmm3, xmm0
movdqa xmm0, xmm4
xorps xmm2, xmm3
movdqa xmm1, xmm3
psllq xmm2, 1
pclmulqdq xmm2, xmm6, 0
movaps xmm6, xmmword [rsp]
pclmulqdq xmm0, xmm5, 0x11
xorps xmm2, xmm0
psrldq xmm1, 8
xorps xmm2, xmm1
punpcklqdq xmm3, xmm2
psrlq xmm3, 0x3f
psllq xmm2, 1
xorps xmm3, xmm2
movdqu xmmword [rcx + rdx + 0x10], xmm3
movdqu xmmword [rcx + rdx + 8], xmm4
movq qword [rcx + rdx + 8], xmm3
add rsp, 0x18
ret
Function at 0x140ba60b0
Capabilities:
Decompress data using aplib

Disassembly:
call 0x140ba6237
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140ba60e1
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140ba60c7
add dl, dl
jne 0x140ba60ee
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140ba614e
xor eax, eax
add dl, dl
jne 0x140ba60fd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140ba6205
add dl, dl
jne 0x140ba610e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140ba611b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140ba6128
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140ba6135
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140ba6142
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140ba60d6
mov eax, 1
add dl, dl
jne 0x140ba615e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140ba616b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140ba6153
sub eax, ebx
mov ebx, 1
jne 0x140ba61a4
mov ecx, 1
add dl, dl
jne 0x140ba6186
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140ba6193
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140ba617b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140ba60d6
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140ba61c0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140ba61cd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140ba61b5
cmp eax, 0x7d00
jae 0x140ba61f3
cmp eax, 0x500
jb 0x140ba61ee
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140ba60d6
cmp eax, 0x7f
ja 0x140ba61f6
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140ba60d6
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140ba622a
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140ba60d6
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140004870
Capabilities:
Enumerate threads
Hide thread from debugger

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
call sub.kernel32.dll_GetCurrentProcessId
mov esi, eax
mov ecx, 0xc
mov edx, eax
call sub.kernel32.dll_CreateToolhelp32Snapshot
cmp rax, 0xffffffffffffffff
je 0x140004931
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x24], 0x1c
lea rdx, [rsp + 0x24]
mov rcx, rax
call sub.kernel32.dll_Thread32First
test eax, eax
je 0x140004929
mov r15, qword [sym.imp.ntdll.dll_NtSetInformationThread]
lea rbx, [rsp + 0x24]
jmp 0x1400048ef
mov rcx, rdi
mov rdx, rbx
call sub.kernel32.dll_Thread32Next
test eax, eax
je 0x140004929
cmp dword [rsp + 0x30], esi
jne 0x1400048e0
mov r8d, dword [rsp + 0x2c]
mov ecx, 0x60
xor edx, edx
call sub.kernel32.dll_OpenThread
test rax, rax
je 0x1400048e0
mov r14, rax
mov rcx, rax
mov edx, 0x11
xor r8d, r8d
xor r9d, r9d
call r15
mov rcx, r14
call sub.kernel32.dll_CloseHandle
jmp 0x1400048e0
mov rcx, rdi
call sub.kernel32.dll_CloseHandle
nop
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x1400056c0
Capabilities:
Get hostname

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x70
lea rbp, [rsp + 0x70]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rsi, rcx
movzx eax, byte [0x140063181]
mov ecx, 0x20a
mov edx, 2
call fcn.14000c030
test rax, rax
je 0x140005812
mov dword [rbp - 0x14], 0x105
lea rdx, [rbp - 0x14]
mov qword [rbp - 0x10], rax
mov rcx, rax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x140005791
mov r8d, dword [rbp - 0x14]
lea rcx, [rbp - 0x50]
mov rdx, qword [rbp - 0x10]
call fcn.140015920
lea rcx, [rbp - 0x50]
call fcn.140025550
mov r8, rdx
lea rcx, [rbp - 0x30]
mov rdx, rax
call fcn.140025790
mov rdi, qword [rbp - 0x30]
movabs rax, 0x8000000000000000
cmp rdi, rax
jne 0x1400057af
mov r14, qword [rbp - 0x28]
mov rdi, qword [rbp - 0x20]
test rdi, rdi
je 0x1400057b9
js 0x140005821
movzx eax, byte [0x140063181]
mov edx, 1
mov rcx, rdi
call fcn.14000c030
mov rbx, rax
test rax, rax
jne 0x1400057be
mov ecx, 1
mov rdx, rdi
call fcn.1400361a0
jmp 0x140005826
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov edx, 0x20a
mov r8d, 2
mov rcx, qword [rbp - 0x10]
jmp 0x140005801
mov rbx, qword [rbp - 0x28]
mov rax, qword [rbp - 0x20]
jmp 0x1400057cf
mov ebx, 1
mov rcx, rbx
mov rdx, r14
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, rdi
mov rcx, qword [rbp - 0x10]
mov qword [rsi], rdi
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], rax
mov edx, 0x20a
mov r8d, 2
call fcn.14000c040
mov rdx, qword [rbp - 0x50]
test rdx, rdx
je 0x140005806
mov rcx, qword [rbp - 0x48]
mov r8d, 1
call fcn.14000c040
nop
add rsp, 0x70
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov ecx, 2
mov edx, 0x20a
call fcn.1400361a0
call fcn.14002e5e0
ud2
Function at 0x1400058c0
Capabilities:
Get hostname

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rsi, rcx
mov dword [rbp - 0xc], 0
xor edi, edi
lea rdx, [rbp - 0xc]
xor ecx, ecx
call sub.kernel32.dll_GetComputerNameW
mov ebx, dword [rbp - 0xc]
test rbx, rbx
mov qword [rbp - 0x18], rbx
je 0x140005929
lea rdi, [rbx + rbx]
movzx eax, byte [0x140063181]
mov edx, 2
mov rcx, rdi
call fcn.14000c030
test rax, rax
je 0x140005a4b
mov rcx, rax
mov edi, dword [rbp - 0xc]
jmp 0x14000592e
mov ecx, 2
lea rdx, [rbp - 0xc]
mov qword [rbp - 0x20], rcx
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x1400059bb
mov r8d, edi
lea rcx, [rbp - 0x58]
mov rdx, qword [rbp - 0x20]
call fcn.140015920
lea rcx, [rbp - 0x58]
call fcn.140025550
mov r8, rdx
lea rcx, [rbp - 0x38]
mov rdx, rax
call fcn.140025790
mov rdi, qword [rbp - 0x38]
movabs rax, 0x8000000000000000
cmp rdi, rax
jne 0x1400059df
mov r14, qword [rbp - 0x30]
mov rdi, qword [rbp - 0x28]
test rdi, rdi
je 0x1400059e9
js 0x140005a58
movzx eax, byte [0x140063181]
mov edx, 1
mov rcx, rdi
call fcn.14000c030
mov rbx, rax
test rax, rax
jne 0x1400059ee
mov ecx, 1
mov rdx, rdi
call fcn.1400361a0
jmp 0x140005a5d
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov rdx, qword [rbp - 0x18]
test edx, edx
je 0x140005a3c
add rdx, rdx
mov r8d, 2
mov rcx, qword [rbp - 0x20]
jmp 0x140005a37
mov rbx, qword [rbp - 0x30]
mov rax, qword [rbp - 0x28]
jmp 0x1400059ff
mov ebx, 1
mov rcx, rbx
mov rdx, r14
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, rdi
mov qword [rsi], rdi
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], rax
mov rdx, qword [rbp - 0x18]
test edx, edx
je 0x140005a24
add rdx, rdx
mov r8d, 2
mov rcx, qword [rbp - 0x20]
call fcn.14000c040
mov rdx, qword [rbp - 0x58]
test rdx, rdx
je 0x140005a3c
mov rcx, qword [rbp - 0x50]
mov r8d, 1
call fcn.14000c040
nop
add rsp, 0x80
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov ecx, 2
mov rdx, rdi
call fcn.1400361a0
call fcn.14002e5e0
ud2
Function at 0x1400064a0
Capabilities:
Get session user name

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x70
lea rbp, [rsp + 0x70]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rsi, rcx
movzx eax, byte [0x140063181]
mov ecx, 0x202
mov edx, 2
call fcn.14000c030
test rax, rax
je 0x1400065f9
mov dword [rbp - 0x14], 0x101
lea rdx, [rbp - 0x14]
mov qword [rbp - 0x10], rax
mov rcx, rax
call sub.advapi32.dll_GetUserNameW
test eax, eax
je 0x140006578
mov r8d, dword [rbp - 0x14]
dec r8
lea rcx, [rbp - 0x50]
mov rdx, qword [rbp - 0x10]
call fcn.140015920
lea rcx, [rbp - 0x50]
call fcn.140025550
mov r8, rdx
lea rcx, [rbp - 0x30]
mov rdx, rax
call fcn.140025790
mov rdi, qword [rbp - 0x30]
movabs rax, 0x8000000000000000
cmp rdi, rax
jne 0x140006596
mov r14, qword [rbp - 0x28]
mov rdi, qword [rbp - 0x20]
test rdi, rdi
je 0x1400065a0
js 0x140006608
movzx eax, byte [0x140063181]
mov edx, 1
mov rcx, rdi
call fcn.14000c030
mov rbx, rax
test rax, rax
jne 0x1400065a5
mov ecx, 1
mov rdx, rdi
call fcn.1400361a0
jmp 0x14000660d
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov edx, 0x202
mov r8d, 2
mov rcx, qword [rbp - 0x10]
jmp 0x1400065e8
mov rbx, qword [rbp - 0x28]
mov rax, qword [rbp - 0x20]
jmp 0x1400065b6
mov ebx, 1
mov rcx, rbx
mov rdx, r14
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, rdi
mov rcx, qword [rbp - 0x10]
mov qword [rsi], rdi
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], rax
mov edx, 0x202
mov r8d, 2
call fcn.14000c040
mov rdx, qword [rbp - 0x50]
test rdx, rdx
je 0x1400065ed
mov rcx, qword [rbp - 0x48]
mov r8d, 1
call fcn.14000c040
nop
add rsp, 0x70
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov ecx, 2
mov edx, 0x202
call fcn.1400361a0
call fcn.14002e5e0
ud2
Function at 0x14000b740
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x20], 0xfffffffffffffffe
mov qword [rbp - 0x28], rcx
mov r14, qword [rdx]
add r9, r8
mov qword [rbp - 0x20], r8
mov qword [rbp - 0x18], r9
mov word [rbp - 0x10], 0
mov dword [rbp - 8], 1
lea rcx, [rbp - 0x48]
lea rdx, [rbp - 0x20]
call fcn.14000acd0
mov dword [rbp + 0x1c], 0x800
mov dword [rbp + 0x18], 0
movzx eax, byte [0x140063181]
mov ecx, 0x800
mov edx, 1
call fcn.14000c030
test rax, rax
je 0x14000b921
mov rbx, rax
mov qword [rbp], 0x800
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], 0
mov rdi, qword [rbp - 0x40]
lea r12, [rbp + 0x1c]
lea r15, [rbp + 0x18]
mov rsi, qword [sym.imp.advapi32.dll_RegQueryValueExW]
mov r13, qword [rbp]
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x30], rax
sub r13, rax
nop word cs:[rax + rax]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rbx
mov rcx, r14
mov rdx, rdi
xor r8d, r8d
mov r9, r15
call rsi
cmp eax, 0xea
jne 0x14000b83a
mov r8d, dword [rbp + 0x1c]
cmp r13, r8
jae 0x14000b800
mov rcx, rbp
mov rdx, qword [rbp - 0x30]
call fcn.1400356c0
mov rbx, qword [rbp + 8]
jmp 0x14000b7e6
movabs r14, 0x8000000000000000
test eax, eax
jne 0x14000b86b
mov eax, dword [rbp + 0x1c]
mov qword [rbp + 0x10], rax
mov eax, dword [rbp + 0x18]
cmp eax, 0xb
mov rsi, qword [rbp - 0x28]
jbe 0x14000b903
movabs rax, 0xde00000002
jmp 0x14000b877
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp - 0x28]
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x20], r14
mov rdx, qword [rbp]
test rdx, rdx
je 0x14000b896
mov r8d, 1
mov rcx, rbx
call fcn.14000c040
mov rdx, qword [rbp - 0x48]
test rdx, rdx
je 0x14000b8b0
add rdx, rdx
mov r8d, 2
mov rcx, rdi
call fcn.14000c040
mov rdi, qword [rbp - 0x20]
cmp rdi, r14
jne 0x14000b8c9
mov rax, qword [rbp - 0x18]
mov qword [rsi + 8], rax
mov dword [rsi], 1
jmp 0x14000b8ec
lea rdx, [rbp - 0x20]
mov rcx, rsi
call fcn.14000c1c0
test rdi, rdi
je 0x14000b8ec
mov rcx, qword [rbp - 0x18]
mov r8d, 1
mov rdx, rdi
call fcn.14000c040
mov rax, rsi
add rsp, 0xa8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rcx, qword [rbp + 0x10]
mov qword [rbp - 0x10], rcx
movups xmm0, xmmword [rbp]
movaps xmmword [rbp - 0x20], xmm0
mov byte [rbp - 8], al
mov rdx, qword [rbp - 0x48]
test rdx, rdx
jne 0x14000b89f
jmp 0x14000b8b0
mov ecx, 1
mov edx, 0x800
call fcn.1400361a0
ud2