joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140098320
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
push r15
sub rsp, 0x268
mov rax, qword [0x1401737a8]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rbx, rdx
mov rdi, rcx
mov rcx, qword [rcx]
mov edx, 0x58
mov rsi, r8
call fcn.1400e0fb8
xor r15d, r15d
mov qword [rdi], r15
test rbx, rbx
je 0x14009837f
lea r8, [rsp + 0x38]
mov rdx, 0xffffffff80000004
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
test eax, eax
jne 0x140098515
jmp 0x140098388
mov qword [rsp + 0x38], 0xffffffff80000004
mov edx, 0xffffffff
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_IsBadStringPtrW]
test eax, eax
jne 0x140098515
mov rcx, rsi
mov qword [rsp + 0x260], r14
call fcn.1400e81d8
lea r8, [rsp + 0x40]
mov qword [rsp + 0x40], r15
lea rdx, [0x1401270b8]
mov rcx, rax
mov r14, rax
lea rbx, [rsp + 0x50]
call fcn.1400fdba8
mov rsi, rax
test rax, rax
je 0x14009844b
mov qword [rsp + 0x2a8], rbp
nop
mov rcx, qword [rdi + 8]
mov rdx, rsi
call fcn.140067960
lea rdx, [rsp + 0x250]
mov rcx, rbx
sub rdx, rbx
sar rdx, 1
test eax, eax
je 0x140098412
mov r9d, eax
lea r8, [0x1401351d0]
call fcn.1400192b0
jmp 0x140098421
mov r9, rsi
lea r8, [0x1401351d8]
call fcn.1400192b0
lea r8, [rsp + 0x40]
movsxd rbp, eax
lea rdx, [0x1401270b8]
xor ecx, ecx
call fcn.1400fdba8
lea rbx, [rbx + rbp*2]
mov rsi, rax
test rax, rax
jne 0x1400983e0
mov rbp, qword [rsp + 0x2a8]
mov rcx, r14
call fcn.1400e825c
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x20], r15
xor r8d, r8d
mov dword [rsp + 0x30], r15d
mov ebx, r15d
mov qword [rdi], r15
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r14, qword [rsp + 0x260]
test eax, eax
je 0x1400984f1
nop
cmp eax, 0xea
jne 0x14009850a
mov rcx, qword [rdi]
call fcn.1400e0fb8
mov eax, dword [rsp + 0x30]
cmp eax, ebx
jbe 0x1400984af
lea ebx, [rax + 0x1000]
jmp 0x1400984b5
add ebx, 0x1000
mov ecx, ebx
call fcn.1400e17ec
mov qword [rdi], rax
test rax, rax
je 0x14009850a
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], rcx
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x38]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140098490
mov rax, qword [rdi]
movabs rcx, 0x46005200450050
cmp qword [rax], rcx
jne 0x14009850a
mov eax, 1
jmp 0x140098517
mov rcx, qword [rdi]
call fcn.1400e0fb8
mov qword [rdi], r15
xor eax, eax
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400e17a0
add rsp, 0x268
pop r15
pop rdi
pop rsi
pop rbx
ret
Function at 0x140099d00
Capabilities:
Hide graphical window

Disassembly:
sub rsp, 0x68
mov rax, qword [0x1401737a8]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rcx, qword [0x14018ec78]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], gethostbyaddr
call qword [sym.imp.USER32.dll_GetWindowPlacement]
cmp dword [rsp + 0x28], 2
mov edx, 5
mov rcx, qword [0x14018ec78]
mov eax, 9
cmove edx, eax
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x14018ec78]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov rcx, qword [0x14018ec78]
call qword [sym.imp.USER32.dll_SetFocus]
xor eax, eax
mov byte [0x14018ed1e], 1
mov byte [0x14018ed19], 0
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400e17a0
add rsp, 0x68
ret

Function at 0x14009d930
Capabilities:
Create thread

Disassembly:
sub rsp, 0x28
mov rcx, qword [0x14018eca8]
test rcx, rcx
je 0x14009d96c
mov edx, 9
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x14018eca8]
call qword [sym.imp.USER32.dll_SetFocus]
mov rcx, qword [0x14018eca8]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
xor eax, eax
add rsp, 0x28
ret
mov edx, 0x7f02
mov qword [rsp + 0x20], rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetCursor]
xor r8d, r8d
lea rcx, [0x1400a1f40]
xor edx, edx
mov rbx, rax
call fcn.1400f7c20
mov rcx, qword [0x14018f238]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetCursor]
mov rbx, qword [rsp + 0x20]
xor eax, eax
add rsp, 0x28
ret
Function at 0x14009f230
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x10], edx
push rdi
push r14
push r15
sub rsp, 0x60
mov rbx, r8
mov edi, edx
mov r14, rcx
call fcn.140033570
mov rcx, rax
test rax, rax
je 0x14009f3b5
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rsi, [rax + 0x18]
mov qword [rsp + 0x20], rsi
test rbx, rbx
je 0x14009f295
mov r8, rbx
mov ebx, 0xffffffff
mov edx, ebx
mov rcx, qword [r14 + 0x48]
call qword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
mov ebp, eax
mov dword [rsp + 0x28], eax
jmp 0x14009f2a0
mov ebx, 0xffffffff
mov ebp, ebx
mov dword [rsp + 0x28], ebx
movzx edx, dil
movabs rax, 0xcbf29ce484222325
xor rdx, rax
movabs rcx, 0x100000001b3
imul rdx, rcx
movzx eax, byte [rsp + 0x89]
xor rdx, rax
imul rdx, rcx
movzx eax, byte [rsp + 0x8a]
xor rdx, rax
imul rdx, rcx
movzx eax, byte [rsp + 0x8b]
xor rdx, rax
imul rdx, rcx
mov rcx, qword [r14 + 0x38]
and rcx, rdx
shl rcx, 4
add rcx, qword [r14 + 0x20]
mov rax, qword [rcx + 8]
mov rdx, qword [r14 + 0x10]
cmp rax, rdx
je 0x14009f320
mov rcx, qword [rcx]
cmp edi, dword [rax + 0x10]
je 0x14009f322
cmp rax, rcx
je 0x14009f320
mov rax, qword [rax + 8]
cmp edi, dword [rax + 0x10]
jne 0x14009f310
jmp 0x14009f322
xor eax, eax
test rax, rax
cmove rax, rdx
cmp rax, rdx
je 0x14009f333
mov dword [rax + 0x20], ebp
jmp 0x14009f384
mov dword [rsp + 0x40], edi
lea rcx, [rsi - 0x18]
call fcn.140044a60
add rax, 0x18
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], ebp
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x30]
lea rcx, [r14 + 8]
call fcn.140073f80
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14009f37f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rsi, qword [rsp + 0x20]
lea rdx, [rsi - 0x18]
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x14009f39b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
mov ecx, 0x80004005
call fcn.140032b30
int3
Function at 0x14009f3c0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x60
mov rbx, r8
mov esi, edx
mov rdi, rcx
call fcn.140033570
mov rcx, rax
test rax, rax
je 0x14009f567
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x20], rax
lea rbp, [rdi + 8]
movzx edx, sil
movabs rax, 0xcbf29ce484222325
xor rdx, rax
movabs rcx, 0x100000001b3
imul rdx, rcx
movzx eax, byte [rsp + 0x79]
xor rdx, rax
imul rdx, rcx
movzx eax, byte [rsp + 0x7a]
xor rdx, rax
imul rdx, rcx
movzx eax, byte [rsp + 0x7b]
xor rdx, rax
imul rdx, rcx
and rdx, qword [rdi + 0x38]
shl rdx, 4
add rdx, qword [rdi + 0x20]
mov rax, qword [rdx + 8]
mov r8, qword [rdi + 0x10]
xor ecx, ecx
cmp rax, r8
je 0x14009f480
mov rdx, qword [rdx]
cmp esi, dword [rax + 0x10]
je 0x14009f483
nop word [rax + rax]
cmp rax, rdx
je 0x14009f480
mov rax, qword [rax + 8]
cmp esi, dword [rax + 0x10]
jne 0x14009f470
jmp 0x14009f483
mov rax, rcx
test rax, rax
cmove rax, r8
mov rdi, 0xffffffffffffffff
cmp rax, r8
je 0x14009f4bd
lea r9, [rax + 0x18]
test rbx, rbx
je 0x14009f4ad
mov rax, rdi
inc rax
cmp word [rbx + rax*2], cx
jne 0x14009f4a2
mov ecx, eax
mov r8d, ecx
mov rdx, rbx
mov rcx, r9
call fcn.140035250
jmp 0x14009f535
test rbx, rbx
je 0x14009f4d0
mov rax, rdi
inc rax
cmp word [rbx + rax*2], cx
jne 0x14009f4c5
mov ecx, eax
mov r8d, ecx
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.140035250
mov dword [rsp + 0x40], esi
mov rcx, qword [rsp + 0x20]
add rcx, 0xffffffffffffffe8
call fcn.140044a60
add rax, 0x18
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x28]
mov dword [rsp + 0x50], eax
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x30]
mov rcx, rbp
call fcn.140073f80
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14009f535
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x14009f551
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov ecx, 0x80004005
call fcn.140032b30
int3
Function at 0x1400a2620
Capabilities:
Get file version info

Disassembly:
push rbp
sub rsp, 0x30
xor ebp, ebp
mov qword [rsp + 0x50], rsi
mov rsi, rcx
mov dword [rsp + 0x48], ebp
lea rdx, [0x14018e1ce]
lea rcx, str.srv
lea r8d, [rbp + 4]
call fcn.1400e8bbc
test eax, eax
jne 0x1400a26dc
mov qword [rsp + 0x40], rbx
lea rdx, [rsp + 0x48]
lea rcx, [0x14018dfc4]
mov qword [rsp + 0x58], rdi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ecx, eax
mov ebx, eax
call fcn.1400e8270
mov r9, rax
lea rcx, [0x14018dfc4]
mov r8d, ebx
xor edx, edx
mov rdi, rax
call sub.VERSION.dll_GetFileVersionInfoW
mov rbx, qword [rsp + 0x40]
test eax, eax
je 0x1400a26cf
cmp dword [rdi + 0x30], 0x60000
jae 0x1400a26cf
mov rcx, qword [0x1401896c0]
lea r9, [0x14005f720]
xor r8d, r8d
mov qword [rsp + 0x20], rbp
lea rdx, str.SYMBOLCONFIGWARNING
test rsi, rsi
je 0x1400a26c9
lea rdx, [0x140135f50]
call qword [sym.imp.USER32.dll_DialogBoxParamW]
mov rcx, rdi
call fcn.1400e825c
mov rdi, qword [rsp + 0x58]
cmp byte [0x14018e1cc], bpl
mov rsi, qword [rsp + 0x50]
jne 0x1400a2734
cmp qword [0x1401940a8], rbp
je 0x1400a26fc
cmp word [0x14018e1ce], bp
jne 0x1400a2734
mov rcx, qword [0x1401896c0]
lea r9, [0x14005f720]
xor r8d, r8d
mov qword [rsp + 0x20], rbp
lea rdx, str.SYMBOLCONFIGWARNING
call qword [sym.imp.USER32.dll_DialogBoxParamW]
mov rcx, qword [0x14018ec78]
mov dl, 1
mov byte [0x14018e1cc], 1
call fcn.1400840b0
add rsp, 0x30
pop rbp
ret

Function at 0x1400a49a0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x1401737a8]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov r14, rcx
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
xor edi, edi
movzx ebp, ax
cmp ax, 1
jbe 0x1400a49e9
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetThreadGroupAffinity]
movzx ebx, di
nop dword [rax]
mov sil, 1
cmp bx, bp
jae 0x1400a4a71
cmp bp, 1
jbe 0x1400a4a36
cmp edi, dword [0x14018ed70]
jge 0x1400a4a77
xor eax, eax
mov qword [rsp + 0x20], 0xffffffffffffffff
mov dword [rsp + 0x2a], eax
mov word [rsp + 0x2e], ax
mov word [rsp + 0x28], bx
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor r8d, r8d
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetThreadGroupAffinity]
movzx ecx, bx
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
movsxd rcx, edi
xor r9d, r9d
mov esi, eax
lea r8d, [rax + rax*2]
lea rdx, [rcx + rcx*2]
shl r8d, 4
shl rdx, 4
lea ecx, [r9 + 8]
add rdx, r14
call sub.ntdll.dll_NtQuerySystemInformation
test eax, eax
jne 0x1400a4a6e
add edi, esi
inc bx
jmp 0x1400a49f0
xor sil, sil
cmp bp, 1
jbe 0x1400a4a8e
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetThreadGroupAffinity]
movzx eax, sil
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400e17a0
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
Function at 0x1400a4ac0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x1401737a8]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov r14, rcx
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
xor edi, edi
movzx ebp, ax
cmp ax, 1
jbe 0x1400a4b09
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetThreadGroupAffinity]
movzx ebx, di
nop dword [rax]
mov sil, 1
cmp bx, bp
jae 0x1400a4b8e
cmp bp, 1
jbe 0x1400a4b56
cmp edi, dword [0x14018ed70]
jge 0x1400a4b94
xor eax, eax
mov qword [rsp + 0x20], 0xffffffffffffffff
mov dword [rsp + 0x2a], eax
mov word [rsp + 0x2e], ax
mov word [rsp + 0x28], bx
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor r8d, r8d
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetThreadGroupAffinity]
movzx ecx, bx
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
movsxd rcx, edi
xor r9d, r9d
mov esi, eax
lea r8d, [rax + rax*2]
lea rdx, [rcx + rcx*2]
shl r8d, 3
lea rdx, [r14 + rdx*8]
lea ecx, [r9 + 0x17]
call sub.ntdll.dll_NtQuerySystemInformation
test eax, eax
jne 0x1400a4b8b
add edi, esi
inc bx
jmp 0x1400a4b10
xor sil, sil
cmp bp, 1
jbe 0x1400a4bab
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetThreadGroupAffinity]
movzx eax, sil
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400e17a0
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
Function at 0x1400a4be0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x1401737a8]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov r14, rcx
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
xor edi, edi
movzx ebp, ax
cmp ax, 1
jbe 0x1400a4c29
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetThreadGroupAffinity]
movzx ebx, di
nop dword [rax]
mov sil, 1
cmp bx, bp
jae 0x1400a4caa
cmp bp, 1
jbe 0x1400a4c76
cmp edi, dword [0x14018ed70]
jge 0x1400a4cb0
xor eax, eax
mov qword [rsp + 0x20], 0xffffffffffffffff
mov dword [rsp + 0x2a], eax
mov word [rsp + 0x2e], ax
mov word [rsp + 0x28], bx
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor r8d, r8d
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetThreadGroupAffinity]
movzx ecx, bx
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
movsxd rcx, edi
xor r9d, r9d
mov esi, eax
lea r8d, [rax*8]
lea rdx, [r14 + rcx*8]
lea ecx, [r9 + 0x6c]
call sub.ntdll.dll_NtQuerySystemInformation
test eax, eax
jne 0x1400a4ca7
add edi, esi
inc bx
jmp 0x1400a4c30
xor sil, sil
cmp bp, 1
jbe 0x1400a4cc7
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetThreadGroupAffinity]
movzx eax, sil
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400e17a0
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
Function at 0x1400a9570
Capabilities:
Get file system object information

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x330
mov rax, qword [0x1401737a8]
xor rax, rsp
mov qword [rsp + 0x320], rax
mov r14d, edx
mov rbp, rcx
mov qword [rsp + 0x40], 0
test rcx, rcx
je 0x1400a9722
call qword [sym.imp.SHLWAPI.dll_PathIsNetworkPathW]
test eax, eax
jne 0x1400a9722
mov rdx, rbp
lea rcx, [rsp + 0x300]
call fcn.1400431f0
nop
lea rax, [0x14018f690]
lea rsi, [0x14018f6a0]
cmp r14d, 1
cmove rsi, rax
mov rdi, qword [rsi]
mov rbx, qword [rdi + 8]
cmp byte [rbx + 0x19], 0
jne 0x1400a9634
lea rcx, [rbx + 0x20]
lea rdx, [rsp + 0x300]
cmp qword [rsp + 0x318], 8
cmovae rdx, qword [rsp + 0x300]
cmp qword [rcx + 0x18], 8
jb 0x1400a9619
mov rcx, qword [rcx]
call fcn.1400e89f4
test eax, eax
jns 0x1400a9628
mov rbx, qword [rbx + 0x10]
jmp 0x1400a962e
mov rdi, rbx
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
je 0x1400a95f1
cmp byte [rdi + 0x19], 0
jne 0x1400a9693
lea rdx, [rdi + 0x20]
cmp qword [rdx + 0x18], 8
jb 0x1400a9648
mov rdx, qword [rdx]
lea rcx, [rsp + 0x300]
cmp qword [rsp + 0x318], 8
cmovae rcx, qword [rsp + 0x300]
call fcn.1400e89f4
test eax, eax
js 0x1400a9693
cmp rdi, qword [rsi]
je 0x1400a9693
lea r8, [rsp + 0x300]
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.1400a4db0
mov rcx, qword [rax]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rax
jmp 0x1400a96de
bts r14d, 8
mov dword [rsp + 0x20], r14d
mov r9d, 0x2b8
lea r8, [rsp + 0x40]
xor edx, edx
mov rcx, rbp
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
cmp qword [rsi + 8], 0x3e8
jae 0x1400a96de
lea r8, [rsp + 0x300]
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.1400a4db0
mov rcx, qword [rax]
mov rax, qword [rsp + 0x40]
mov qword [rcx + 0x40], rax
mov rdx, qword [rsp + 0x318]
cmp rdx, 8
jb 0x1400a9722
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x300]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a971d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a974f
call fcn.1400e0fb8
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x320]
xor rcx, rsp
call fcn.1400e17a0
lea r11, [rsp + 0x330]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.1400e8160
int3
Function at 0x1400aa550
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
test rdx, rdx
mov dword [rsp + 0x20], 0x3e8
lea rbx, [rsp + 0x20]
mov rdi, rcx
cmovne rbx, rdx
cmp qword [rcx], 0
jne 0x1400aa589
mov dword [rbx], 0x3e8
mov ecx, dword [rsp + 0x20]
call fcn.1400e8270
mov qword [rdi], rax
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov r8d, dword [rbx]
lea r9, [rsp + 0x40]
mov rdx, qword [rdi]
mov ecx, 5
call sub.ntdll.dll_NtQuerySystemInformation
test eax, eax
je 0x1400aa5ee
nop dword [rax]
mov rcx, qword [rdi]
call fcn.1400e825c
mov ecx, dword [rbx]
mov eax, dword [rsp + 0x40]
add ecx, 0x2710
cmp ecx, eax
cmova eax, ecx
mov ecx, eax
mov dword [rbx], ecx
call fcn.1400e8270
mov qword [rdi], rax
lea r9, [rsp + 0x40]
mov r8d, dword [rbx]
mov rdx, rax
mov ecx, 5
call sub.ntdll.dll_NtQuerySystemInformation
test eax, eax
jne 0x1400aa5b0
mov rax, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1400aa810
Capabilities:
Enumerate services

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x50
lea rcx, [0x1401a0860]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [0x14018f9b0]
lea rax, [rsp + 0x60]
xor ebx, ebx
lea rdi, [0x1401a0844]
mov qword [rsp + 0x48], rbx
xor edx, edx
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rax
lea r9d, [rbx + 1]
mov eax, dword [0x1401941c4]
lea r8d, [rbx + 0x30]
mov dword [rsp + 0x28], eax
mov rax, qword [0x1401a0888]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x60], ebx
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusExW]
test eax, eax
jne 0x1400aa918
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x1400aa918
mov rcx, qword [0x1401a0888]
mov dword [rsp + 0x60], ebx
test rcx, rcx
je 0x1400aa8ad
call fcn.1400e825c
mov eax, dword [0x1401941c4]
add eax, 0x4000
mov ecx, eax
mov dword [0x1401941c4], eax
call fcn.1400e8270
mov edx, dword [0x1401941c4]
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rcx
mov rcx, qword [0x14018f9b0]
mov dword [rsp + 0x28], edx
xor edx, edx
mov qword [0x1401a0888], rax
mov qword [rsp + 0x20], rax
lea r9d, [rdx + 1]
lea r8d, [rdx + 0x30]
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusExW]
test eax, eax
je 0x1400aa887
lea rcx, [0x1401a0860]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x1400acd70
Capabilities:
Enumerate process modules
Query environment variable

Disassembly:
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x480
mov rax, qword [0x1401737a8]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov r13, qword [rsp + 0x4d0]
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
mov r12, r9
mov r15, r8
mov r14d, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x1400acdbe
xor al, al
jmp 0x1400acf59
mov qword [rsp + 0x4b0], rbx
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x478], rsi
mov rcx, rbp
mov qword [rsp + 0x470], rdi
mov dword [rsp + 0x20], 0x438
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
je 0x1400acf36
mov r8d, 4
lea rdx, [0x14011f338]
lea rcx, [rsp + 0x250]
call fcn.1400e8940
test eax, eax
jne 0x1400ace1e
lea rcx, [rsp + 0x258]
jmp 0x1400acead
mov r8d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea rdx, str.Systemroot_
lea rcx, [rsp + 0x250]
call fcn.1400e8bbc
test eax, eax
jne 0x1400acea5
xor r8d, r8d
lea rcx, str._SystemRoot_
xor edx, edx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ecx, eax
lea rdx, [rsp + 0x250]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [rdx + rax*2], 0
jne 0x1400ace60
lea rbx, [rcx + 1]
add rbx, rax
lea rcx, [rbx + rbx]
call fcn.1400e8270
mov r8d, ebx
lea rcx, str._SystemRoot_
mov rdx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea r8, [rsp + 0x266]
mov rdx, rbx
mov rcx, rdi
call fcn.1400f7f64
jmp 0x1400aceb5
lea rcx, [rsp + 0x250]
call fcn.1400e81d8
mov rdi, rax
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
je 0x1400acefe
lea esi, [rax + 1]
movsxd rcx, esi
add rcx, rcx
call fcn.1400e8270
mov r8d, esi
mov rdx, rax
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
mov rcx, rdi
call fcn.1400e825c
mov edx, 2
xor ecx, ecx
mov rdi, rbx
call fcn.1400e0fb8
cmp dword [rsp + 0x28], r14d
jne 0x1400acf14
mov rdx, rdi
mov rcx, r15
call fcn.1400e89f4
test eax, eax
je 0x1400acf7a
mov edx, 2
mov rcx, rdi
call fcn.1400e0fb8
lea rdx, [rsp + 0x20]
mov rcx, rbp
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x1400acdf3
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov rsi, qword [rsp + 0x478]
mov rbx, qword [rsp + 0x4b0]
mov rdi, qword [rsp + 0x470]
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.1400e17a0
add rsp, 0x480
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rax, qword [rsp + 0x38]
mov edx, 2
mov qword [r12], rax
mov rcx, rdi
mov eax, dword [rsp + 0x40]
mov qword [r13], rax
call fcn.1400e0fb8
mov al, 1
jmp 0x1400acf41
Function at 0x1400c28b0
Capabilities:
Create thread

Disassembly:
lock inc dword [rcx + 0x20]
mov r8, rcx
xor edx, edx
lea rcx, [0x1400b3f40]
jmp fcn.1400f7c20

Function at 0x1400c2ad0
Capabilities:
Check for process debug object

Disassembly:
sub rsp, 0x38
mov eax, dword [0x1401896c8]
cmp eax, 2
jl 0x1400c2ae6
mov al, 1
add rsp, 0x38
ret
mov qword [rsp + 0x30], rdi
cmp eax, 1
jge 0x1400c2b76
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call fcn.1400ba360
mov rdi, rax
test rax, rax
je 0x1400c2b76
mov qword [rsp + 0x50], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 4
lea r8, [rsp + 0x48]
mov rcx, rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea edx, [r9 + 0x1e]
call sub.ntdll.dll_NtQueryInformationProcess
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x1400c2b65
cmp ebx, 0xc000000d
je 0x1400c2b65
mov rbx, qword [rsp + 0x50]
xor eax, eax
mov rdi, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rbx, qword [rsp + 0x50]
mov al, 1
mov rdi, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rdi, qword [rsp + 0x30]
xor al, al
add rsp, 0x38
ret