joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400240f0
Capabilities:
Create process on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc8
mov edi, ecx
mov rax, qword [0x14003f010]
xor rax, rsp
mov qword [rsp + 0xc0], rax
lea eax, [rdi - 5]
mov ebp, 5
cmp eax, 1
jbe 0x14002414a
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1400365a0
mov eax, ebp
add rsp, 0xc8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rsi, r8
mov r15, rdx
mov rbp, qword [rsp + 0x130]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0xb0], 0
mov dword [rsp + 0x50], 0x68
cmp qword [r9 + 0x18], 7
jbe 0x1400241a0
mov r9, qword [r9]
mov rcx, r9
call qword [sym.imp.mozglue.dll__wcsdup]
mov r14, rax
mov rax, qword [rbp + 0x10]
cmp qword [rbp + 0x18], 7
jbe 0x1400241bb
mov rbp, qword [rbp]
mov rbx, qword [rsp + 0x138]
test rax, rax
cmove rbp, rax
cmp qword [rsi + 0x18], 7
jbe 0x1400241d4
mov rsi, qword [rsi]
mov r15, qword [r15]
mov qword [rsp + 0x48], rbx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rsi
mov rdx, r14
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ebp, 5
test eax, eax
je 0x1400242b2
cmp edi, 6
mov r12d, 0x1fffff
mov esi, 0x101c01
cmove esi, r12d
mov r13, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x20], esi
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 0
mov rcx, rax
mov rdx, r13
mov r8, r15
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rsi, qword [rbx + 8]
test eax, eax
je 0x1400242c9
add rbx, 8
cmp edi, 6
mov edi, 0x100c43
cmove edi, r12d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x20], edi
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 0
mov rcx, rax
mov rdx, rsi
mov r8, r15
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor ecx, ecx
test eax, eax
sete cl
lea ebp, [rcx + rcx*4]
test r14, r14
je 0x140024124
mov rcx, r14
call qword [sym.imp.mozglue.dll_free]
jmp 0x140024124
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14, r14
jne 0x1400242bb
jmp 0x140024124
Function at 0x1400242e0
Capabilities:
Create thread

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rax, r8
mov r8, rdx
mov rdi, rcx
mov rsi, qword [rsp + 0x90]
mov edx, dword [rsp + 0x80]
mov rbx, qword [rsp + 0x88]
mov qword [rsi], 0
mov rcx, qword [rcx]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], r9
xor edx, edx
mov r9, rax
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test rax, rax
je 0x140024377
mov rbx, rax
mov rdi, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rax
mov rdx, rbx
mov r8, rdi
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor ecx, ecx
test eax, eax
sete cl
lea eax, [rcx + rcx*4]
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
add rsp, 0x40
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_GetLastError]

Function at 0x1400261b0
Capabilities:
Compare security identifiers

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov rax, qword [0x14003f010]
xor rax, rsp
mov qword [rsp + 0x80], rax
cmp byte [rcx + 0x54], 0
je 0x140026222
mov rsi, rdx
mov r12, rcx
lea rdx, [rcx + 0x48]
lea rcx, [rsp + 0x30]
lea r9, [rsp + 0x24]
mov r8d, 2
call fcn.140026370
mov r13, qword [rsp + 0x30]
test r13, r13
je 0x14002622c
cmp dword [r13], 0
je 0x140026338
lea rbx, [r13 + 8]
xor r14d, r14d
lea rax, [r12 + 0x30]
mov qword [rsp + 0x28], rax
jmp 0x140026261
mov esi, 0x3f0
jmp 0x140026342
mov esi, dword [rsp + 0x24]
jmp 0x140026342
mov rcx, qword [rsp + 0x28]
lea r8, [rsp + 0x38]
call fcn.14000e7c0
nop word cs:[rax + rax]
nop
add r14, 1
mov eax, dword [r13]
cmp r14, rax
jae 0x140026338
mov rbp, r14
shl rbp, 4
test dword [rbx + rbp + 8], 0xc0000020
jne 0x140026250
add rbp, rbx
test rsi, rsi
je 0x140026283
mov rax, qword [rsi]
cmp qword [rsi + 8], rax
jne 0x1400262d5
mov rdx, qword [rbp]
lea rcx, [rsp + 0x38]
call fcn.14002b9c0
mov rax, qword [r12 + 0x38]
mov rdx, qword [r12 + 0x40]
cmp rdx, rax
je 0x140026235
mov ecx, dword [rsp + 0x78]
mov dword [rax + 0x40], ecx
movups xmm0, xmmword [rsp + 0x38]
movups xmm1, xmmword [rsp + 0x48]
movups xmm2, xmmword [rsp + 0x58]
movups xmm3, xmmword [rsp + 0x68]
movups xmmword [rax + 0x30], xmm3
movups xmmword [rax + 0x20], xmm2
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
add qword [r12 + 0x38], 0x44
jmp 0x140026250
mov r15d, 1
xor ecx, ecx
nop dword [rax]
mov rdi, qword [rbp]
mov rdx, rcx
shl rdx, 6
lea rcx, [rdx + rcx*4]
add rcx, rax
call fcn.14002bdf0
mov rcx, rax
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x140026250
mov ecx, r15d
mov rax, qword [rsi]
mov rdx, qword [rsi + 8]
sub rdx, rax
sar rdx, 2
movabs rdi, 0xf0f0f0f0f0f0f0f1
imul rdx, rdi
add r15d, 1
cmp rdx, rcx
ja 0x1400262e0
jmp 0x140026283
mov rcx, r13
call sub.mozglue.dll_void___cdecl_operator_delete___void____ptr64_
xor esi, esi
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400365a0
mov eax, esi
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14002a690
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
sub rsp, 0x28
mov edx, 4
call sub.ADVAPI32.dll_SystemFunction036
test al, al
setne al
add rsp, 0x28
ret

Function at 0x14002d450
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
call fcn.14000cdc0
test al, al
je 0x14002d47e
mov rcx, qword [rsi]
mov edx, 0x32
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsi]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rdi, qword [rsi + 0x38]
mov qword [rsi + 0x38], 0
test rdi, rdi
je 0x14002d49f
mov rcx, rdi
call fcn.14002b0e0
mov rcx, rdi
call sub.mozglue.dll_void___cdecl_operator_delete_void____ptr64_
lea rcx, [rsi + 0x58]
call fcn.140003590
mov rcx, qword [rsi + 0x50]
test rcx, rcx
je 0x14002d4b7
call qword [sym.imp.mozglue.dll_free]
mov rdi, qword [rsi + 0x38]
test rdi, rdi
je 0x14002d4d0
mov rcx, rdi
call fcn.14002b0e0
mov rcx, rdi
call sub.mozglue.dll_void___cdecl_operator_delete_void____ptr64_
lea rcx, [rsi + 0x28]
call fcn.140006ad0
lea rcx, [rsi + 0x20]
call fcn.140006ad0
lea rcx, [rsi + 0x18]
call fcn.140006ad0
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.14000cd80
Function at 0x14002dd00
Capabilities:
Terminate process

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call fcn.14000cdc0
test al, al
je 0x14002dd22
mov rcx, qword [rsi]
xor edx, edx
add rsp, 0x20
pop rsi
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x20
pop rsi
ret
Function at 0x14002eb80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x250
mov rdi, rcx
mov rax, qword [0x14003f010]
xor rax, rsp
mov qword [rsp + 0x248], rax
call fcn.14002e810
mov ebx, 0x1126
test al, al
jne 0x14002ee04
movaps xmm0, xmmword [0x140037140]
movups xmmword [rsp + 0x238], xmm0
mov word [rsp + 0x228], 0
lea rsi, [rsp + 0x228]
mov rcx, rdi
mov rdx, rsi
call fcn.14002ee80
mov ebx, eax
cmp qword [rsp + 0x238], 3
jae 0x14002ec7e
xor ebp, ebp
lea rdi, [rsp + 0x228]
mov rcx, rdi
mov rdx, rdi
call fcn.14002ef70
mov esi, eax
mov eax, ebp
or al, sil
or bl, al
cmp bl, 1
jne 0x14002ee2c
test bpl, bpl
je 0x14002ee33
cmp qword [rsp + 0x240], 7
jbe 0x14002ec38
mov rdi, qword [rsp + 0x228]
lea rdx, [rsp + 0x20]
mov rcx, rdi
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
test eax, eax
je 0x14002ee63
lea rdi, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
mov rsi, rax
add rsi, 0xffffffffffffffff
cmp qword [rsp + 0x240], 7
jbe 0x14002ecbd
mov rcx, qword [rsp + 0x228]
jmp 0x14002ecc5
cmp qword [rsp + 0x240], 7
jbe 0x14002ec91
mov rsi, qword [rsp + 0x228]
cmp word [rsi + 2], 0x3a
jne 0x14002ebf5
cmp word [rsi + 4], 0x5c
jne 0x14002ebf5
movzx eax, word [rsi]
and eax, 0xffffffdf
add eax, 0xffffffbf
cmp ax, 0x1a
setb bpl
jmp 0x14002ebf7
lea rcx, [rsp + 0x228]
mov rdx, rdi
mov r8, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x14002ee2c
lea r12, [rsp + 0x228]
mov r14, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov r15, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
cmp qword [rsp + 0x240], 7
mov rcx, r12
jbe 0x14002ed06
mov rcx, qword [rsp + 0x228]
call r14
cmp eax, 0xffffffff
je 0x14002ed90
test eax, 0x400
jne 0x14002ee28
mov rcx, qword [rsp + 0x238]
cmp qword [rsp + 0x240], 7
mov rax, r12
jbe 0x14002ed3b
mov rax, qword [rsp + 0x228]
mov rbx, 0xffffffffffffffff
test rcx, rcx
je 0x14002ed60
lea rdx, [rax + rcx*2]
add rdx, 0xfffffffffffffffe
cmp word [rax + rcx*2 - 2], 0x5c
jne 0x14002edb0
sub rdx, rax
sar rdx, 1
mov rbx, rdx
mov rdx, rbx
sub rdx, rcx
ja 0x14002edd9
mov qword [rsp + 0x238], rbx
mov word [rax + rbx*2], 0
cmp qword [rsp + 0x238], rsi
ja 0x14002ecf0
jmp 0x14002edf2
call r15
mov ebx, eax
lea eax, [rbx - 1]
cmp eax, 3
jb 0x14002ed1d
cmp ebx, 0x7b
je 0x14002ed1d
jmp 0x14002edf7
lea rdi, [rcx + rcx]
mov ebp, 2
sub rbp, rdi
nop dword [rax]
test rbp, rbp
je 0x14002ed60
add rbp, 2
cmp word [rdx - 2], 0x5c
lea rdx, [rdx - 2]
jne 0x14002edc0
jmp 0x14002ed57
mov rcx, r12
xor r8d, r8d
call fcn.140008430
cmp qword [rsp + 0x238], rsi
ja 0x14002ecf0
mov ebx, 0x1126
lea rcx, [rsp + 0x228]
call fcn.140001520
mov rcx, qword [rsp + 0x248]
xor rcx, rsp
call fcn.1400365a0
mov eax, ebx
add rsp, 0x250
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
xor ebx, ebx
jmp 0x14002edf7
mov ebx, 0x7b
jmp 0x14002edf7
lea r8, [0x140037fc0]
lea rcx, [rsp + 0x228]
mov r9d, 4
xor edx, edx
call fcn.140014d20
cmp qword [rsp + 0x240], 7
ja 0x14002ec30
jmp 0x14002ec38
test sil, sil
mov eax, 0x1126
mov ebx, 0x7b
cmovne ebx, eax
jmp 0x14002edf7
Function at 0x140030960
Capabilities:
Query environment variable

Disassembly:
push rsi
sub rsp, 0x60
mov rax, qword [0x14003f010]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea rcx, str.MOZ_ENABLE_HANDLE_VERIFIER
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x140030a7f
movaps xmm0, xmmword [str.kernel32]
movaps xmmword [rsp + 0x30], xmm0
movabs rax, 0x6c006c0064002e
mov qword [rsp + 0x40], rax
mov word [rsp + 0x48], 0
cmp qword [0x140040f30], 0
jne 0x1400309c8
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x140040f30], rax
lea rax, [0x140040f78]
mov qword [rsp + 0x30], rax
lea rsi, [0x140040f18]
mov qword [rsp + 0x38], rsi
lea rax, [0x1400388e2]
mov qword [rsp + 0x40], rax
lea rax, [0x140030ab0]
mov qword [rsp + 0x48], rax
mov byte [rsp + 0x50], 0
lea rcx, [0x140040f80]
lea rdx, [0x140030b50]
lea r8, [rsp + 0x30]
lea r9, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x140030a7f
cmp qword [rsp + 0x28], 0
je 0x140030a7f
lea rax, [0x140040f88]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rsi
lea rax, [0x1400388d2]
mov qword [rsp + 0x40], rax
lea rax, [0x140030ae0]
mov qword [rsp + 0x48], rax
mov byte [rsp + 0x50], 0
lea rcx, [0x140040f90]
lea rdx, [0x140030b50]
lea r8, [rsp + 0x30]
lea r9, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x140030a7f
cmp qword [rsp + 0x28], 0
jne 0x140030a8d
call sym.plugin_container.exe_GetHandleVerifier
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400365a0
nop
add rsp, 0x60
pop rsi
ret
Function at 0x140030c20
Capabilities:
Allocate or change rwx memory

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r14, r9
mov r15, r8
mov rbx, rdx
mov rsi, rcx
cmp byte [rcx + 0x14], 0
jne 0x140030c03
mov rdi, qword [rsi + 0x18]
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp byte [rsi + 0x14], 0
jne 0x140030c03
xor ecx, ecx
cmp rdi, rax
sete cl
mov dword [rsi + 0x10], ecx
mov byte [rsi + 0x14], 1
mov rcx, rsi
mov rdx, rbx
mov r8, r15
mov r9, r14
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp 0x140030c20
push r14
push rsi
push rdi
push rbx
sub rsp, 0xd8
mov rsi, r9
mov r14, r8
mov r8, rdx
mov rdi, rcx
mov rax, qword [0x14003f010]
xor rax, rsp
mov qword [rsp + 0xd0], rax
lea rdx, [rsp + 0x68]
call fcn.140030e10
mov r8d, dword [rdi + 0x10]
and r8d, 1
shl r8, 0x1e
lea rdx, [rsp + 0xb8]
mov rcx, rdi
mov r9d, r8d
call fcn.140033250
cmp byte [rsp + 0xc8], 0
je 0x140030dc9
call fcn.1400334d0
lea rbx, [0x140040fc8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rsp + 0xc0]
lea rdx, [rsp + 0x80]
call fcn.140034030
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp byte [rsp + 0xb0], 0
je 0x140030dcd
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0x88]
mov dword [rsp + 0x40], eax
movups xmm0, xmmword [rsp + 0x90]
movups xmmword [rsp + 0x48], xmm0
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0x58], eax
mov rax, qword [rsp + 0xa4]
mov qword [rsp + 0x5c], rax
mov al, byte [rsp + 0xac]
mov byte [rsp + 0x64], al
mov dword [rsp + 0x88], 0
mov byte [rsp + 0xac], 0
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], r14
lea rdx, [rsp + 0x68]
lea r8, [rsp + 0xb8]
lea r9, [rsp + 0x38]
mov rcx, rdi
call fcn.140030f20
cmp qword [rsi], 0
setne sil
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140030d76
mov r8d, dword [rsp + 0x40]
test r8d, r8d
je 0x140030d76
lea r9, [rsp + 0x40]
mov edx, dword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp byte [rsp + 0xb0], 0
je 0x140030d98
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x140030d90
mov r8d, dword [rsp + 0x88]
test r8d, r8d
jne 0x140030ddb
mov byte [rsp + 0xb0], 0
cmp byte [rsp + 0xc8], 0
je 0x140030daa
mov byte [rsp + 0xc8], 0
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.1400365a0
mov eax, esi
add rsp, 0xd8
pop rbx
pop rdi
pop rsi
pop r14
ret
xor esi, esi
jmp 0x140030daa
xor esi, esi
cmp byte [rsp + 0xc8], 0
jne 0x140030da2
jmp 0x140030daa
lea rdi, [rsp + 0x88]
mov edx, dword [rsp + 0xa8]
mov r9, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [rsp + 0x88], 0
mov byte [rsp + 0xac], 0
xorps xmm0, xmm0
movups xmmword [rdi + 8], xmm0
jmp 0x140030d90
Function at 0x140033150
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x60
mov rax, qword [0x14003f010]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov eax, dword [0x140040f9c]
mov ecx, dword [0x14003f180]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400331a0
mov esi, dword [0x140040f98]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400365a0
mov eax, esi
add rsp, 0x60
pop rsi
ret
lea rcx, [0x140040f9c]
call fcn.1400352c0
cmp dword [0x140040f9c], 0xffffffff
jne 0x140033185
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x2c]
mov dword [0x140040f98], eax
lea rcx, [0x140040f9c]
call fcn.140035328
jmp 0x140033185

Function at 0x140033340
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x60
mov rax, qword [0x14003f010]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov eax, dword [0x140040fac]
mov ecx, dword [0x14003f180]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140033390
mov esi, dword [0x140040fa8]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400365a0
mov eax, esi
add rsp, 0x60
pop rsi
ret
lea rcx, [0x140040fac]
call fcn.1400352c0
cmp dword [0x140040fac], 0xffffffff
jne 0x140033375
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x50]
mov dword [0x140040fa8], eax
lea rcx, [0x140040fac]
call fcn.140035328
jmp 0x140033375

Function at 0x140033760
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x60
mov rax, qword [0x14003f010]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov eax, dword [0x140040fb8]
mov ecx, dword [0x14003f180]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jle 0x1400337cd
lea rcx, [0x140040fb8]
call fcn.1400352c0
cmp dword [0x140040fb8], 0xffffffff
jne 0x1400337cd
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x38]
mov qword [0x140040fb0], rax
lea rcx, [0x140040fb8]
call fcn.140035328
mov rsi, qword [0x140040fb0]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400365a0
mov rax, rsi
add rsp, 0x60
pop rsi
ret
Function at 0x140034030
Capabilities:
Allocate or change rwx memory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x14003f010]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov ebx, dword [rcx + 0x10]
shl ebx, 7
mov edx, ebx
call fcn.140034150
test al, al
je 0x140034121
mov ecx, ebx
add rcx, qword [rdi]
mov qword [rsp + 0x28], rdi
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x50], 0x80
mov byte [rsp + 0x54], 1
mov edx, 0x80
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x140034127
mov r8, qword [rsp + 0x28]
test r8, r8
je 0x140034134
mov rdx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov eax, dword [rsp + 0x30]
mov cl, byte [rsp + 0x54]
test cl, cl
je 0x1400340df
test rdx, rdx
je 0x1400340df
test rbx, rbx
je 0x1400340df
test eax, eax
je 0x1400340df
add dword [rdi + 0x10], 1
mov qword [rsi], r8
mov dword [rsi + 8], eax
mov qword [rsi + 0x10], rdx
mov qword [rsi + 0x18], rbx
mov eax, dword [rsp + 0x48]
mov dword [rsi + 0x20], eax
mov eax, dword [rsp + 0x4c]
mov dword [rsi + 0x24], eax
mov eax, dword [rsp + 0x50]
mov dword [rsi + 0x28], eax
mov byte [rsi + 0x2c], cl
mov byte [rsi + 0x30], 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400365a0
mov rax, rsi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
mov byte [rsi + 0x30], 0
jmp 0x140034109
mov dword [rsp + 0x30], 0
jmp 0x1400340ad
mov eax, dword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov cl, byte [rsp + 0x54]
jmp 0x1400340db

Function at 0x140034b50
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rbx, r9
mov rdi, r8
mov rsi, rcx
mov rax, qword [0x14003f010]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov qword [rcx], rdx
movaps xmm0, xmmword [0x140038050]
movups xmmword [rcx + 0x10], xmm0
lea rax, [rcx + 0x20]
mov qword [rcx + 8], rax
call fcn.140033150
lea rcx, [rdi + rbx]
add rcx, 0xffffffffffffffff
mov r14d, eax
mov rax, rcx
xor edx, edx
div r14
mov r13, rax
mov rax, rdi
xor edx, edx
div r14
sub r13, rax
inc r13
je 0x140034c1d
mov rdi, rax
imul rdi, r14
xor ebx, ebx
lea r15, [rsp + 0x2c]
mov rbp, qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rax, [rsi + 8]
mov qword [rsp + 0x20], rax
mov rcx, rdi
mov rdx, r14
mov r8d, 0x40
mov r9, r15
call rbp
test eax, eax
je 0x140034c3e
mov r12d, dword [rsp + 0x2c]
mov rax, qword [rsi + 0x10]
cmp rax, qword [rsi + 0x18]
je 0x140034c50
mov rcx, qword [rsi + 8]
shl rax, 4
mov dword [rcx + rax], r12d
mov qword [rcx + rax + 8], rdi
add qword [rsi + 0x10], 1
add rbx, 1
add rdi, r14
cmp rbx, r13
jb 0x140034bd7
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400365a0
mov rax, rsi
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov dword [rsp + 0x2c], 0
mov rcx, rsi
call fcn.140034c70
jmp 0x140034c1d
mov rcx, qword [rsp + 0x20]
call fcn.140034d40
test al, al
je 0x140034c46
mov rax, qword [rsi + 0x10]
jmp 0x140034bfb
Function at 0x100019988
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
jne 0x1000199be
lea r8, [0x100002a88]
lea rcx, [0x100002a50]
mov edx, 0x1676
call fcn.100099ad8
xor eax, eax
test rbx, rbx
setne al
test eax, eax
jne 0x1000199ed
lea r8, [0x100002a30]
lea rcx, [0x100002a50]
mov edx, 0x1677
call fcn.100099ad8
mov ecx, 0x80004005
call fcn.100019658
int3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rdi]
mov r9d, 1
lea eax, [rax + rax + 2]
xor r8d, r8d
mov rdx, rsi
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x10014af90
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [0x10016664b], 0
movdqu xmm0, xmmword [0x100001fe0]
mov rbx, rcx
movdqu xmmword [rcx], xmm0
je 0x10014afc7
mov ecx, dword [0x1001666b8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x10014afc7
movdqu xmm0, xmmword [rax]
movdqu xmmword [rbx], xmm0
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x10014e480
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x100165138]
jne 0x10014e49b
rol rcx, 0x10
test cx, 0xffff
jne 0x10014e497
ret 0
ror rcx, 0x10
jmp 0x10014ebec
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x100165f80]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov r11, qword [0x100166078]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.ntdll.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x10014ec71
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x100165f80]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.ntdll.dll_RtlVirtualUnwind
jmp 0x10014ec93
mov rax, qword [rsp + 0x88]
mov qword [0x100166078], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x100166018], rax
mov rax, qword [0x100166078]
mov qword [0x100165ef0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x100166000], rax
mov dword [0x100165ee0], 0xc0000409
mov dword [0x100165ee4], 1
mov rax, qword [0x100165138]
mov qword [rsp + 0x68], rax
mov rax, qword [0x100165140]
mov qword [rsp + 0x70], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x100001f98]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x140001b9c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001be6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001be6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001be6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001be6
cmp dword [rcx + 0x84], 0xe
jbe 0x140001be6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001be8
xor al, al
add rsp, 0x28
ret