joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000c360
Capabilities:
Clear file content
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
xor ebp, ebp
mov rbx, rdx
mov edi, ebp
mov rsi, rcx
nop
mov qword [rsp + 0x30], rbp
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x14000c3fd
call qword [sym.imp.KERNEL32.dll_GetLastError]
add eax, 0xfffffffe
cmp eax, 1
jbe 0x14000c3db
cmp edi, 0xbb8
jae 0x14000c3db
mov ecx, 0x3c
call qword [sym.imp.KERNEL32.dll_Sleep]
add edi, 0x3c
cmp edi, 0xbb8
jb 0x14000c380
mov rcx, rsi
call fcn.14000ae30
mov eax, 8
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
mov r8d, dword [rsi + 0xc]
lea r9, [rsp + 0x60]
mov rdx, qword [rsi]
mov rcx, rax
or dword [rsi + 0x50], 8
mov qword [rsi + 0x28], rax
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
test eax, eax
je 0x14000c42f
mov rcx, qword [rsi + 0x28]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov rcx, qword [rsi + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [rsi + 0x50], 0xfffffff7
mov qword [rsi + 0x28], rbp
test edi, edi
je 0x14000c3db
mov eax, dword [rsi + 0xc]
cmp dword [rsp + 0x60], eax
jne 0x14000c3db
test rbx, rbx
je 0x14000c484
lea rax, [rsi + 0x58]
test rax, rax
je 0x14000c484
mov edx, ebp
cmp word [rbx], dx
je 0x14000c481
sub rbx, rax
cmp edx, 0x3ff
jae 0x14000c481
movzx ecx, word [rbx + rax]
inc edx
mov word [rax], cx
add rax, 2
cmp word [rbx + rax], bp
jne 0x14000c466
mov word [rax], bp
xor eax, eax
jmp 0x14000c3e8

Function at 0x14000c530
Capabilities:
Query environment variable

Disassembly:
push rbx
mov eax, 0x18a0
call fcn.140027ac0
sub rsp, rax
mov rax, qword [0x1400a6410]
xor rax, rsp
mov qword [rsp + 0x1890], rax
mov rbx, rcx
mov qword [rcx], 0
lea rcx, str.PROGRAMDATA
mov r8d, 0x104
lea rdx, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x14000c63d
lea r9, [rsp + 0x90]
mov qword [rsp + 0x20], 0
lea r8, str._sNVIDIA_CorporationDrs_nvdrsdb_d.bin
mov edx, 0x400
lea rcx, [rsp + 0x890]
call fcn.14000d840
lea r9, [rsp + 0x90]
mov dword [rsp + 0x20], 1
lea r8, str._sNVIDIA_CorporationDrs_nvdrsdb_d.bin
mov edx, 0x400
lea rcx, [rsp + 0x1090]
call fcn.14000d840
lea r8, [rsp + 0x40]
xor edx, edx
lea rcx, [rsp + 0x890]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x14000c63d
lea r8, [rsp + 0x68]
xor edx, edx
lea rcx, [rsp + 0x1090]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x14000c63d
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x3c], eax
mov eax, dword [rsp + 0x7c]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x80]
mov dword [rsp + 0x34], eax
mov rcx, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rcx
cmovae rcx, qword [rsp + 0x38]
xor eax, eax
mov qword [rbx], rcx
jmp 0x14000c642
mov eax, 8
mov rcx, qword [rsp + 0x1890]
xor rcx, rsp
call fcn.140027a80
add rsp, 0x18a0
pop rbx
ret
Function at 0x14000c860
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov rsi, qword [rsp + 0x40]
xor r12d, r12d
mov word [rcx + 0x7fe], r12w
mov edi, r8d
mov dword [r9], r12d
mov r15, r9
mov r14, rcx
mov ebx, r12d
mov dword [rsi], r12d
mov r10, rcx
mov r11d, r12d
mov rdx, rcx
mov r8d, r12d
cmp word [rcx], r12w
je 0x14000c8d8
nop
cmp r8d, 0x400
jae 0x14000c8d8
movzx ecx, word [rdx]
lea eax, [rcx - 0x41]
cmp ax, 0x19
ja 0x14000c8cc
add cx, 0x20
mov word [rdx], cx
add rdx, 2
inc r8d
cmp word [rdx], bx
jne 0x14000c8b0
movzx eax, word [r14]
mov ebp, 0x2f
test ax, ax
je 0x14000c908
cmp ax, 0x5c
jne 0x14000c8f6
mov word [r10], bp
mov dword [rsi], 1
movzx eax, word [r10 + 2]
add r10, 2
test ax, ax
jne 0x14000c8e6
movzx eax, word [r14]
mov rcx, r14
test ax, ax
je 0x14000c946
cmp ax, 0x22
jne 0x14000c92a
xor r11d, 1
lea rax, [rcx + 2]
test rbx, rbx
cmovne rax, rbx
mov rbx, rax
jmp 0x14000c939
test r11d, r11d
jne 0x14000c939
cmp ax, 0x20
jne 0x14000c939
test edi, edi
jne 0x14000c946
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x14000c910
test rbx, rbx
mov r9, rbx
cmove r9, r14
cmp rcx, r9
jbe 0x14000c977
mov eax, 0xffdd
nop word [rax + rax]
movzx edx, word [rcx]
test ax, dx
jne 0x14000c998
cmp dx, 2
je 0x14000c998
sub rcx, 2
cmp rcx, r9
ja 0x14000c960
mov word [r9], r12w
xor eax, eax
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
pop r15
pop r14
pop r12
ret
lea rax, [r9 + 6]
cmp rcx, rax
jb 0x14000c9c0
cmp word [rcx - 6], 0x2e
jne 0x14000c9c0
cmp word [rcx - 4], 0x65
jne 0x14000c9c0
cmp word [rcx - 2], 0x78
jne 0x14000c9c0
cmp dx, 0x65
je 0x14000ca67
lea r10, [rcx + 0xa]
lea rax, [r14 + 0x800]
cmp r10, rax
jae 0x14000ca67
test rbx, rbx
jne 0x14000ca12
mov r8, rcx
mov r11d, 0x4c5c
cmp dx, 0x2e
je 0x14000ca3b
cmp dx, 0x22
je 0x14000ca12
cmp dx, 0x5c
mov eax, r12d
sete al
or dword [rsi], eax
cmp word [r8], r11w
jne 0x14000ca04
mov word [r8], bp
movzx edx, word [r8 + 2]
add r8, 2
test dx, dx
jne 0x14000c9e2
cmp dword [r15], r12d
jne 0x14000ca73
test byte [r14 + 0x818], 2
je 0x14000ca73
mov dword [rcx + 2], 0x65002e
mov rax, r9
mov dword [rcx + 6], 0x650078
mov word [r10], r12w
jmp 0x14000c97d
cmp word [r8 + 2], 0x65
jne 0x14000ca12
cmp word [r8 + 4], 0x78
jne 0x14000ca12
cmp word [r8 + 6], 0x65
jne 0x14000ca12
mov word [r8 + 8], r12w
mov rax, r9
mov dword [r15], 1
jmp 0x14000c97d
mov word [rcx + 2], r12w
mov dword [r15], 1
mov rax, r9
jmp 0x14000c97d
Function at 0x14000d440
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x40
lea rcx, [rsp + 0x68]
mov rbx, rdx
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov eax, dword [rsp + 0x68]
lea r9, [rsp + 0x60]
mov dword [rsp + 0x30], eax
lea rdx, [rsp + 0x30]
mov eax, dword [rsp + 0x6c]
mov r8d, 8
mov rcx, rbx
mov dword [rsp + 0x34], eax
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14000d499
cmp dword [rsp + 0x60], 8
jne 0x14000d499
xor eax, eax
add rsp, 0x40
pop rbx
ret
mov eax, 8
add rsp, 0x40
pop rbx
ret
Function at 0x140013240
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x840
mov rax, qword [0x1400a6410]
xor rax, rsp
mov qword [rsp + 0x830], rax
test byte [rcx + 0x50], 0x20
mov rbx, rcx
jne 0x14000b561
call fcn.14000aee0
test eax, eax
jne 0x14000b680
lea rax, str.nvdrssel.bin
add rbx, 0x58
mov r9, rbx
mov qword [rsp + 0x20], rax
lea r8, str._s_s
mov edx, 0x400
lea rcx, [rsp + 0x30]
call fcn.14000d840
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rax, str.nvdrswr.lk
mov r9, rbx
lea r8, str._s_s
mov qword [rsp + 0x20], rax
mov edx, 0x400
lea rcx, [rsp + 0x30]
call fcn.14000d840
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rax, str.update.bin
mov r9, rbx
lea r8, str._s_s
mov qword [rsp + 0x20], rax
mov edx, 0x400
lea rcx, [rsp + 0x30]
call fcn.14000d840
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov r9, rbx
mov qword [rsp + 0x20], 0
lea r8, str._s_nvdrsdb_d.bin
mov edx, 0x400
lea rcx, [rsp + 0x30]
call fcn.14000d840
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov r9, rbx
mov dword [rsp + 0x20], 1
lea r8, str._s_nvdrsdb_d.bin
mov edx, 0x400
lea rcx, [rsp + 0x30]
call fcn.14000d840
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rax, str.nvAppTimestamps
mov r9, rbx
lea r8, str._s_s
mov qword [rsp + 0x20], rax
mov edx, 0x400
lea rcx, [rsp + 0x30]
call fcn.14000d840
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
mov rcx, qword [rsp + 0x830]
xor rcx, rsp
call fcn.140027a80
add rsp, 0x840
pop rbx
ret
add rcx, 0x838
jmp 0x14000b530
Function at 0x140014e10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x68
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rbp, r8
mov r13, rdx
mov rsi, rcx
mov edi, 0x32f54a96
mov eax, dword [rdx + 8]
test eax, eax
je 0x140014e75
mov r9, qword [rdx]
mov r10d, eax
nop
movzx eax, word [r9]
imul ecx, eax, 0xc5
imul eax, edi, 0x34c3
add ecx, eax
mov eax, edi
shr eax, 2
mov edi, ecx
xor edi, eax
lea r9, [r9 + 2]
sub r10, 1
jne 0x140014e50
and edi, 0x3fffffff
mov ecx, dword [rsi + 8]
mov r14d, 1
mov eax, r14d
shl eax, cl
dec eax
mov dword [rsp + 0xb0], eax
mov ebx, eax
and ebx, edi
mov dword [rsp + 0xc8], ebx
nop dword [rax]
mov rdx, r13
lea rcx, [rsp + 0x38]
call fcn.140026ba0
mov qword [rsp + 0x20], rax
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140026ba0
mov r12, rax
mov qword [rsp + 0x30], rax
mov r15d, ebx
shl r15, 5
mov rdx, qword [rsi]
add rdx, r15
mov ecx, dword [rdx]
test cl, 1
jne 0x140014f2d
test cl, 2
je 0x140014ee5
dec dword [rsi + 0x10]
mov ecx, dword [rdx]
or ecx, 1
mov dword [rdx], ecx
mov rax, qword [rsi]
and dword [r15 + rax], 0xfffffffd
mov rdx, qword [rsi]
mov ecx, dword [rdx + r15]
and ecx, 3
lea eax, [rdi*4]
or ecx, eax
mov dword [rdx + r15], ecx
mov rcx, qword [rsi]
add rcx, 8
add rcx, r15
mov rdx, r12
call fcn.140026d90
mov rcx, qword [rsi]
mov eax, dword [rbp]
mov dword [r15 + rcx + 0x18], eax
inc dword [rsi + 0xc]
xor ebp, ebp
jmp 0x140014f51
add rdx, 8
mov rcx, r12
call fcn.140027000
test al, al
je 0x140014f4c
mov rcx, qword [rsi]
mov eax, dword [rbp]
mov dword [r15 + rcx + 0x18], eax
xor ebp, ebp
jmp 0x140014f51
mov ebp, 2
mov rcx, r12
call fcn.1400275a0
mov rcx, qword [rsp + 0x20]
call fcn.1400275a0
nop
cmp ebp, 2
jne 0x140014fc9
add ebx, r14d
and ebx, dword [rsp + 0xb0]
inc r14d
cmp ebx, dword [rsp + 0xc8]
mov rbp, qword [rsp + 0xc0]
jne 0x140014ea0
mov ecx, dword [rsi + 0x14]
lea eax, [rcx + 1]
mov dword [rsi + 0x14], eax
cmp ecx, 4
jbe 0x140014fbc
mov rcx, rsi
call fcn.1400215b0
test al, al
jne 0x140014fb5
mov rcx, r13
call fcn.1400275a0
nop
mov eax, 0xffffffff
jmp 0x140014fde
mov dword [rsi + 0x14], 0
mov rcx, r13
call fcn.1400275a0
nop
xor eax, eax
jmp 0x140014fde
mov edi, 0xffffffff
test ebp, ebp
cmove edi, ebx
mov rcx, r13
call fcn.1400275a0
nop
mov eax, edi
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140014ff0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x58
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov r15, rdx
mov r14, rcx
mov r9d, 0x32f54a96
mov eax, dword [rdx + 8]
test eax, eax
je 0x140015059
mov r10, qword [rdx]
mov r11d, eax
nop dword [rax]
movzx eax, word [r10]
imul ecx, eax, 0xc5
imul eax, r9d, 0x34c3
add ecx, eax
mov eax, r9d
shr eax, 2
mov r9d, ecx
xor r9d, eax
lea r10, [r10 + 2]
sub r11, 1
jne 0x140015030
mov ecx, dword [r14 + 8]
mov r13d, 1
shl r13d, cl
dec r13d
mov ebx, r13d
and ebx, r9d
and ebx, 0x3fffffff
mov dword [rsp + 0xa0], ebx
mov esi, 1
mov rdx, r15
lea rcx, [rsp + 0x30]
call fcn.140026ba0
mov r12, rax
mov qword [rsp + 0xb8], rax
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140026ba0
mov rbp, rax
mov qword [rsp + 0x28], rax
mov edi, ebx
shl rdi, 5
mov rcx, qword [r14]
test byte [rdi + rcx], 2
jne 0x1400150f2
lea rdx, [rcx + 8]
add rdx, rdi
mov rcx, rax
call fcn.140027000
test al, al
je 0x1400150f2
mov rcx, qword [r14]
test byte [rcx + rdi], 1
je 0x1400150eb
mov rax, qword [rsp + 0xb0]
mov eax, dword [rax]
mov dword [rcx + rdi + 0x18], eax
xor edi, edi
jmp 0x1400150f7
mov edi, 1
jmp 0x1400150f7
mov edi, 2
mov rcx, rbp
call fcn.1400275a0
mov rcx, r12
call fcn.1400275a0
nop
cmp edi, 2
jne 0x140015160
add ebx, esi
and ebx, r13d
inc esi
cmp ebx, dword [rsp + 0xa0]
jne 0x140015081
mov ecx, dword [r14 + 0x14]
lea eax, [rcx + 1]
mov dword [r14 + 0x14], eax
cmp ecx, 4
jbe 0x140015153
mov rcx, r14
call fcn.1400215b0
test al, al
jne 0x14001514b
mov rcx, r15
call fcn.1400275a0
nop
lea eax, [rdi - 3]
jmp 0x140015175
mov dword [r14 + 0x14], 0
mov rcx, r15
call fcn.1400275a0
nop
xor eax, eax
jmp 0x140015175
mov esi, 0xffffffff
test edi, edi
cmove esi, ebx
mov rcx, r15
call fcn.1400275a0
nop
mov eax, esi
add rsp, 0x58
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140015190
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0xa0], rbx
mov r14, rdx
mov r15, rcx
mov r8d, 0x32f54a96
mov eax, dword [rdx + 8]
test eax, eax
je 0x1400151f9
mov r9, qword [rdx]
mov r10d, eax
nop
movzx eax, word [r9]
imul ecx, eax, 0xc5
imul eax, r8d, 0x34c3
add ecx, eax
mov eax, r8d
shr eax, 2
mov r8d, ecx
xor r8d, eax
lea r9, [r9 + 2]
sub r10, 1
jne 0x1400151d0
mov ecx, dword [r15 + 8]
mov r13d, 1
shl r13d, cl
dec r13d
mov ebx, r13d
and ebx, r8d
and ebx, 0x3fffffff
mov dword [rsp + 0x90], ebx
mov esi, 1
mov rdx, r14
lea rcx, [rsp + 0x30]
call fcn.140026ba0
mov r12, rax
mov qword [rsp + 0xa8], rax
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140026ba0
mov rbp, rax
mov qword [rsp + 0x28], rax
mov edx, ebx
shl rdx, 5
mov rcx, qword [r15]
mov eax, dword [rdx + rcx]
test al, 3
jne 0x140015265
mov edi, 1
jmp 0x140015285
test al, 1
je 0x140015280
add rcx, 8
add rdx, rcx
mov rcx, rbp
call fcn.140027000
test al, al
je 0x140015280
xor edi, edi
jmp 0x140015285
mov edi, 2
mov rcx, rbp
call fcn.1400275a0
mov rcx, r12
call fcn.1400275a0
nop
cmp edi, 2
jne 0x1400152ee
add ebx, esi
and ebx, r13d
inc esi
cmp ebx, dword [rsp + 0x90]
jne 0x140015221
mov ecx, dword [r15 + 0x14]
lea eax, [rcx + 1]
mov dword [r15 + 0x14], eax
cmp ecx, 4
jbe 0x1400152e1
mov rcx, r15
call fcn.1400215b0
test al, al
jne 0x1400152d9
mov rcx, r14
call fcn.1400275a0
nop
lea eax, [rdi - 3]
jmp 0x140015303
mov dword [r15 + 0x14], 0
mov rcx, r14
call fcn.1400275a0
nop
xor eax, eax
jmp 0x140015303
mov esi, 0xffffffff
test edi, edi
cmove esi, ebx
mov rcx, r14
call fcn.1400275a0
nop
mov eax, esi
mov rbx, qword [rsp + 0xa0]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001ca50
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov r11, qword [rcx + 8]
mov rdi, rdx
mov rsi, rcx
test r11, r11
je 0x14001cb20
mov eax, dword [rdx + 8]
mov r10d, 0x811c9dc5
test eax, eax
je 0x14001ca9d
mov r8, qword [rdx]
mov r9d, eax
movzx eax, word [r8]
lea r8, [r8 + 2]
xor rax, r10
imul r10, rax, 0x1000193
sub r9, 1
jne 0x14001ca85
imul rax, r10, 0x2001
mov ebx, 1
mov rcx, rax
shr rcx, 7
xor rcx, rax
lea rdx, [rcx + rcx*8]
mov ecx, dword [rsi + 0x20]
shl rbx, cl
mov rax, rdx
shr rax, 0x11
dec rbx
xor rax, rdx
imul rax, rax, 0x21
and rbx, rax
mov rbx, qword [r11 + rbx*8]
test rbx, rbx
je 0x14001cb20
mov rdx, rdi
mov rcx, rbx
call fcn.140027000
test al, al
jne 0x14001cb0d
nop dword [rax]
mov eax, dword [rbx + 0x18]
shr eax, 0x1f
test al, al
jne 0x14001cb20
mov rbx, qword [rbx + 0x28]
mov rdx, rdi
mov rcx, rbx
call fcn.140027000
test al, al
je 0x14001caf0
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
lea rax, [rsi + 0x18]
mov rsi, qword [rsp + 0x38]
or rax, 1
add rsp, 0x20
pop rdi
ret
Function at 0x14006335c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400630dc
Function at 0x140078e84
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x140078b2a
call fcn.140067af4
mov dword [rax], 0x16
call fcn.140067948
jmp 0x140078c75
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x140078c75
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x140078c75
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x140078b59
lock or dword [rcx + 0x14], 0x10
jmp 0x140078c75
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x140078b6d
call fcn.140078e8c
mov esi, dword [rbx + 0x10]
cmp esi, 1
jne 0x140078b7d
mov rax, qword [rbx]
mov bpl, byte [rax]
jmp 0x140078b80
xor bpl, bpl
mov rdi, qword [rbx + 8]
mov rcx, rbx
mov qword [rbx], rdi
call fcn.14006a948
mov r8d, dword [rbx + 0x20]
mov ecx, eax
mov rdx, rdi
call fcn.140080ff8
mov dword [rbx + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 2
jbe 0x140078c63
mov eax, dword [rbx + 0x14]
test al, 6
jne 0x140078c11
mov rcx, rbx
call fcn.14006a948
cmp eax, 0xffffffff
je 0x140078bfc
mov rcx, rbx
call fcn.14006a948
cmp eax, 0xfffffffe
je 0x140078bfc
mov rcx, rbx
call fcn.14006a948
movsxd rdi, eax
lea r14, [0x1400a8380]
mov rcx, rbx
sar rdi, 6
call fcn.14006a948
mov rcx, qword [r14 + rdi*8]
and eax, 0x3f
shl rax, 6
lea rdx, [rax + rcx]
jmp 0x140078c03
lea rdx, [0x1400a6710]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x140078c11
lock or dword [rbx + 0x14], 0x20
cmp dword [rbx + 0x20], 0x200
jne 0x140078c35
mov eax, dword [rbx + 0x14]
shr eax, 6
test al, 1
je 0x140078c35
mov eax, dword [rbx + 0x14]
shr eax, 8
test al, 1
jne 0x140078c35
mov dword [rbx + 0x20], 0x1000
mov rax, qword [rbx]
cmp esi, 1
jne 0x140078c53
movzx ecx, byte [rax]
dec dword [rbx + 0x10]
shl cx, 8
movzx eax, bpl
or cx, ax
inc qword [rbx]
jmp 0x140078c5e
movzx ecx, word [rax]
add dword [rbx + 0x10], 0xfffffffe
add qword [rbx], 2
movzx eax, cx
jmp 0x140078c7a
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rbx + 0x14], eax
and dword [rbx + 0x10], 0
mov eax, 0xffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
jmp 0x140078af4
Function at 0x1400080e0
Capabilities:
Execute command

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x140045040]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov rbx, rcx
mov ecx, 4
mov rax, qword gs:[0x58]
mov rdx, qword [rax]
mov eax, dword [rcx + rdx]
cmp dword [0x14005e210], eax
jle 0x140008147
lea rcx, [0x14005e210]
call fcn.140018630
cmp dword [0x14005e210], 0xffffffff
jne 0x140008147
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x14005e214], eax
lea rcx, [0x14005e210]
call fcn.1400185c4
lea rax, str.echo__:_
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], SafeArrayGetLBound
mov eax, dword [0x14005e214]
mov dword [rsp + 0x58], eax
movabs rax, 0x2000000000000000
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x5c], rbx
movabs rax, 0xb000000000000004
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x20], 2
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
movaps xmm1, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm1
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x68]
call fcn.140008810
lea rcx, [rsp + 0x68]
cmp qword [rsp + 0x80], 7
cmova rcx, qword [rsp + 0x68]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wsystem]
mov rdx, qword [rsp + 0x80]
cmp rdx, 7
jbe 0x140008228
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008223
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008223
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140018070
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140018050
add rsp, 0x90
pop rbx
ret
Function at 0x1400153b0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x850
mov rax, qword [0x140045040]
xor rax, rsp
mov qword [rsp + 0x840], rax
mov rsi, r8
mov qword [rsp + 0x30], 0
mov rbx, rdx
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x800
mov rdi, r9
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x30]
mov dword [rsp + 0x38], 0x104
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001547c
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rsp + 0x40]
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140015471
mov rdx, rdi
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
je 0x140015471
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x14001547e
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.140018050
add rsp, 0x850
pop rdi
pop rsi
pop rbx
ret

Function at 0x1400154a0
Capabilities:
Get mac address on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x140045040]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rsi, rcx
mov dword [rsp + 0x20], 0x2c0
xor edi, edi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
mov r8d, 0x2c0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
jne 0x1400154fe
lea rcx, str.Error_allocating_memory_needed_to_call_GetAdaptersinfo._n
call fcn.140003790
lea eax, [rdi - 1]
jmp 0x1400155c2
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
jne 0x140015564
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ebx, dword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
jne 0x140015556
lea rcx, str.Error_allocating_memory_needed_to_call_GetAdaptersinfo_n
call fcn.140003720
lea eax, [rbx + 1]
jmp 0x1400155c2
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x1400155ac
movzx eax, byte [rsi]
movzx ecx, byte [rsi + 4]
mov byte [rsp + 0x24], al
movzx eax, byte [rsi + 2]
mov byte [rsp + 0x25], al
mov rax, rbx
movzx edx, word [rsp + 0x24]
cmp dword [rax + 0x194], 6
jne 0x14001559d
cmp dx, word [rax + 0x198]
jne 0x14001559d
cmp cl, byte [rax + 0x19a]
je 0x1400155a7
mov rax, qword [rax]
test rax, rax
jne 0x140015583
jmp 0x1400155ac
mov edi, 1
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140018050
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1400173d0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x140045040]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbx, rcx
lea rdi, [rsp + 0x20]
xor eax, eax
mov ecx, 0x238
rep stosb byte [rdi], al
lea ecx, [rax + 2]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140017427
lea rcx, [0x140040308]
call fcn.140008660
xor eax, eax
jmp 0x1400174be
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x14001745a
lea rcx, str.Process32First
call fcn.140008660
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1400174be
mov rdx, rbx
lea rcx, [rsp + 0x4c]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x1400174b1
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x1400174a4
nop
mov rdx, rbx
lea rcx, [rsp + 0x4c]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x1400174b1
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140017480
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1400174be
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140018050
mov rbx, qword [rsp + 0x288]
add rsp, 0x270
pop rdi
ret