joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000b9a0
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x60
mov rbx, rdx
lea rax, [rsp + 0x88]
lea rdx, str.SOFTWARE
mov r9d, 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14000ba91
mov rcx, qword [rsp + 0x88]
lea rax, [rsp + 0x80]
lea r9, [0x1400fca4c]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
lea rdx, str.FLEXlm_License_Manager
mov qword [rsp + 0x38], rax
xor eax, eax
xor r8d, r8d
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14000ba83
or rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rbx + rax], 0
jne 0x14000ba30
mov rcx, qword [rsp + 0x50]
inc eax
lea rdx, str.Service
mov dword [rsp + 0x28], eax
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
add rsp, 0x60
pop rbx
ret
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
add rsp, 0x60
pop rbx
ret

Function at 0x1400125a4
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.14001240c
Function at 0x1400254c0
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x40
mov rdi, rcx
mov r14, rdx
lea rcx, [rsp + 0x20]
xor edx, edx
mov rbx, r9
mov esi, r8d
call fcn.140026c40
test rbx, rbx
jne 0x14002555f
mov rcx, qword [rdi + 0x60]
mov qword [rsp + 0x50], rbp
test rcx, rcx
jne 0x140025505
mov rax, rdi
jmp 0x14002550a
call fcn.140025180
mov rbp, qword [rax + 0xb0]
test rbp, rbp
je 0x14002555a
mov rcx, rbp
call qword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea rcx, [rsp + 0x20]
lea edx, [rax + 0xa]
mov ebx, eax
call fcn.140027040
lea r8d, [rbx + 2]
mov rcx, rbp
mov rdx, rax
call qword [sym.imp.USER32.dll_GetWindowTextA]
lea rcx, [rsp + 0x20]
or edx, 0xffffffff
call fcn.1400272f0
lea rcx, [rsp + 0x20]
xor edx, edx
call fcn.140027040
mov rbx, rax
mov rbp, qword [rsp + 0x50]
mov rcx, qword [rdi + 0xb0]
bts esi, 0x10
mov r8, rbx
mov r9d, esi
mov rdx, r14
call qword [sym.imp.USER32.dll_MessageBoxA]
lea rcx, [rsp + 0x20]
mov ebx, eax
call fcn.140026cc0
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop r14
ret

Function at 0x140027ae0
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x40
mov rdi, rcx
mov rbp, rdx
lea rcx, [rsp + 0x20]
xor edx, edx
call fcn.140026c40
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x140027b67
mov qword [rsp + 0x58], rsi
call fcn.1400251a0
mov edx, dword [rdi + 0x10]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rsi, rax
test rax, rax
je 0x140027b62
mov rcx, rax
mov qword [rsp + 0x50], rbx
call qword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea rcx, [rsp + 0x20]
lea edx, [rax + 0xa]
mov ebx, eax
call fcn.140027040
lea r8d, [rbx + 5]
mov rcx, rsi
mov rdx, rax
call qword [sym.imp.USER32.dll_GetWindowTextA]
lea rcx, [rsp + 0x20]
or edx, 0xffffffff
call fcn.1400272f0
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
lea rcx, [rsp + 0x20]
mov rdx, rbp
call fcn.140026e50
lea rcx, [rsp + 0x20]
call fcn.1400270a0
lea rcx, [rsp + 0x20]
xor edx, edx
call fcn.140027040
mov rcx, rdi
mov rdx, rax
call fcn.140028470
lea rcx, [rsp + 0x20]
call fcn.140026cc0
mov rbp, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x140028090
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x18]
mov rsi, rdx
test rcx, rcx
je 0x1400280fd
mov qword [rsp + 0x30], rdi
call fcn.1400251a0
mov edx, dword [rbx + 0x10]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rdi, rax
test rax, rax
je 0x1400280f8
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov rcx, rsi
lea edx, [rax + 0xa]
mov ebx, eax
call fcn.140027040
lea r8d, [rbx + 5]
mov rcx, rdi
mov rdx, rax
call qword [sym.imp.USER32.dll_GetWindowTextA]
or edx, 0xffffffff
mov rcx, rsi
call fcn.1400272f0
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
Function at 0x14002adb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x28
mov rax, r8
test rcx, rcx
je 0x14002adca
test rdx, rdx
je 0x14002adca
add rsp, 0x28
jmp 0x14003ef30
test rax, rax
je 0x14002adeb
mov r10, qword [r8 + 8]
test r10, r10
je 0x14002adeb
mov rcx, qword [rax]
xor r8d, r8d
mov r9d, 0x187
lea edx, [r8 + 0x17]
call r10
xor eax, eax
add rsp, 0x28
ret
sub rsp, 0x58
mov rax, qword [0x14012bc80]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor eax, eax
mov r10, rdx
mov r9, rcx
cmp rax, 0x20
jae 0x14003efcb
mov byte [rsp + rax + 0x20], 0
inc rax
cmp rax, 0x20
jl 0x14003ef4f
mov al, byte [rdx]
jmp 0x14003ef85
movzx r8d, al
movzx eax, al
mov edx, 1
and eax, 7
shr r8, 3
mov cl, al
shl dl, cl
or byte [rsp + r8 + 0x20], dl
inc r10
mov al, byte [r10]
test al, al
jne 0x14003ef63
jmp 0x14003efaa
movzx ecx, r8b
movzx eax, r8b
mov edx, 1
and ecx, 7
shr rax, 3
shl edx, cl
test byte [rsp + rax + 0x20], dl
jne 0x14003efc6
inc r9
mov r8b, byte [r9]
test r8b, r8b
jne 0x14003ef8b
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14000c9f0
add rsp, 0x58
ret
mov rax, r9
jmp 0x14003efb4
call fcn.14000d948
int3
Function at 0x14002b020
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r13
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov rax, qword [0x14012bc80]
xor rax, rsp
mov qword [rbp + 0x27], rax
xor eax, eax
mov r13, rcx
lea rcx, [rbp - 0x21]
mov rdi, rdx
mov qword [rbp - 0x29], 0
mov byte [rbp + 7], 0
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rax
mov dword [rbp + 0x20], eax
mov word [rbp + 0x24], ax
mov byte [rbp + 0x26], al
mov byte [rbp - 0x19], al
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rax
mov dword [rbp], eax
mov word [rbp + 4], ax
mov byte [rbp + 6], al
call fcn.14001d008
mov r12d, dword [rbp - 0x21]
lea rdx, [0x14010e8e0]
lea rcx, [rbp - 0x19]
mov r8d, 1
call fcn.14000ca3c
lea rdx, [0x14010e8e0]
lea rcx, [rbp + 7]
mov r8d, r12d
call fcn.14000ca3c
or rbx, 0xffffffffffffffff
lea rax, [rbp - 0x19]
mov rcx, rbx
inc rcx
cmp byte [rax + rcx], 0
jne 0x14002b0d0
lea rdx, [rbp + 7]
mov rax, rbx
inc rax
cmp byte [rdx + rax], 0
jne 0x14002b0e0
add eax, 0x11
mov edx, 1
add ecx, eax
call fcn.140022b68
lea rdx, str.___TPMProps
mov r8, rdi
mov rcx, rax
mov r14, rax
call fcn.14002a840
lea rdx, [rbp - 0x19]
mov r8, rdi
mov rcx, r14
call fcn.14002a5f0
lea rdx, [rbp + 7]
mov r8, rdi
mov rcx, r14
call fcn.14002a5f0
nop dword [rax + rax]
inc rbx
cmp byte [r14 + rbx], 0
jne 0x14002b130
lea rcx, [rbp - 0x29]
mov rdx, rdi
call fcn.14002bbc0
mov esi, eax
test eax, eax
jne 0x14002b212
mov rcx, qword [rbp - 0x29]
lea r9, [rbp - 0x1d]
mov r8d, ebx
mov rdx, r14
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14002b1af
lea esi, [rax + 2]
test rdi, rdi
je 0x14002b1af
mov rax, qword [rdi + 8]
test rax, rax
je 0x14002b18f
mov rcx, qword [rdi]
lea edx, [rsi + 0x17]
mov r9d, 0xb1
mov r8d, esi
call rax
mov rax, qword [rdi + 0x10]
test rax, rax
je 0x14002b1af
mov rcx, qword [rdi]
lea r8, str.Not_able_to_write_to_the_named_pipe
mov r9d, 0xb2
mov edx, reloc.WS2_32.dll_inet_ntoa
call rax
test esi, esi
jne 0x14002b212
mov rcx, qword [rbp - 0x29]
xor r9d, r9d
mov r8, r13
mov edx, r12d
mov qword [rsp + 0x20], rdi
call fcn.14002c100
mov esi, eax
test eax, eax
je 0x14002b212
test rdi, rdi
je 0x14002b212
mov rax, qword [rdi + 8]
test rax, rax
je 0x14002b1f2
mov rcx, qword [rdi]
mov edx, 0x19
mov r9d, 0x1e9
lea r8d, [rdx - 0x15]
call rax
mov rax, qword [rdi + 0x10]
test rax, rax
je 0x14002b212
mov rcx, qword [rdi]
lea r8, str.TPM_Properties_not_available___incompatible_version_of_the_service
mov r9d, 0x1ea
mov edx, reloc.WS2_32.dll_inet_ntoa
call rax
mov rcx, r14
call fcn.1400108e4
mov rcx, qword [rbp - 0x29]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.14000c9f0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret
Function at 0x14002b250
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r13
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov rax, qword [0x14012bc80]
xor rax, rsp
mov qword [rbp + 0x27], rax
xor eax, eax
mov r13, rcx
lea rcx, [rbp - 0x21]
mov rdi, rdx
mov qword [rbp - 0x29], 0
mov byte [rbp + 7], 0
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rax
mov dword [rbp + 0x20], eax
mov word [rbp + 0x24], ax
mov byte [rbp + 0x26], al
mov byte [rbp - 0x19], al
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rax
mov dword [rbp], eax
mov word [rbp + 4], ax
mov byte [rbp + 6], al
call fcn.14001d008
mov r12d, dword [rbp - 0x21]
lea rdx, [0x14010e8e0]
lea rcx, [rbp - 0x19]
mov r8d, 1
call fcn.14000ca3c
lea rdx, [0x14010e8e0]
lea rcx, [rbp + 7]
mov r8d, r12d
call fcn.14000ca3c
or rbx, 0xffffffffffffffff
lea rax, [rbp - 0x19]
mov rcx, rbx
inc rcx
cmp byte [rax + rcx], 0
jne 0x14002b300
lea rdx, [rbp + 7]
mov rax, rbx
inc rax
cmp byte [rdx + rax], 0
jne 0x14002b310
add eax, 0x10
mov edx, 1
add ecx, eax
call fcn.140022b68
lea rdx, str.___VMAttrs
mov r8, rdi
mov rcx, rax
mov r14, rax
call fcn.14002a840
lea rdx, [rbp - 0x19]
mov r8, rdi
mov rcx, r14
call fcn.14002a5f0
lea rdx, [rbp + 7]
mov r8, rdi
mov rcx, r14
call fcn.14002a5f0
nop dword [rax + rax]
inc rbx
cmp byte [r14 + rbx], 0
jne 0x14002b360
lea rcx, [rbp - 0x29]
mov rdx, rdi
call fcn.14002bbc0
mov esi, eax
test eax, eax
jne 0x14002b442
mov rcx, qword [rbp - 0x29]
lea r9, [rbp - 0x1d]
mov r8d, ebx
mov rdx, r14
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14002b3df
lea esi, [rax + 2]
test rdi, rdi
je 0x14002b3df
mov rax, qword [rdi + 8]
test rax, rax
je 0x14002b3bf
mov rcx, qword [rdi]
lea edx, [rsi + 0x17]
mov r9d, 0xb1
mov r8d, esi
call rax
mov rax, qword [rdi + 0x10]
test rax, rax
je 0x14002b3df
mov rcx, qword [rdi]
lea r8, str.Not_able_to_write_to_the_named_pipe
mov r9d, 0xb2
mov edx, reloc.WS2_32.dll_inet_ntoa
call rax
test esi, esi
jne 0x14002b442
mov rcx, qword [rbp - 0x29]
xor r9d, r9d
mov r8, r13
mov edx, r12d
mov qword [rsp + 0x20], rdi
call fcn.14002c3f0
mov esi, eax
test eax, eax
je 0x14002b442
test rdi, rdi
je 0x14002b442
mov rax, qword [rdi + 8]
test rax, rax
je 0x14002b422
mov rcx, qword [rdi]
mov edx, 0x19
mov r9d, 0x188
lea r8d, [rdx - 0x15]
call rax
mov rax, qword [rdi + 0x10]
test rax, rax
je 0x14002b442
mov rcx, qword [rdi]
lea r8, str.VM_Attributes_not_available___incompatible_version_of_the_service
mov r9d, 0x189
mov edx, reloc.WS2_32.dll_inet_ntoa
call rax
mov rcx, r14
call fcn.1400108e4
mov rcx, qword [rbp - 0x29]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.14000c9f0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret
Function at 0x14002bab0
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x160
mov rax, qword [0x14012bc80]
xor rax, rsp
mov qword [rsp + 0x150], rax
lea rcx, [rsp + 0x41]
xor ebx, ebx
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x40], bl
call fcn.14000cbf0
lea rdi, [0x14013aa50]
or rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rdi + rax], bl
jne 0x14002bb00
test rax, rax
jne 0x14002bb21
lea r8, str.FlexNet_Licensing_Service_64
mov edx, 0x104
mov rcx, rdi
call fcn.1400179cc
lea rcx, [rsp + 0x40]
mov r8, rdi
mov edx, 0x104
call fcn.1400179cc
mov ebp, 1
xor edx, edx
mov r8d, ebp
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rsi, rax
test rax, rax
je 0x14002bb93
lea r8d, [rbp + 3]
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rdi, rax
test rax, rax
je 0x14002bb8a
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x14002bb81
cmp dword [rsp + 0x24], 4
cmove ebx, ebp
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.14000c9f0
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14002cf20
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push rsi
push rdi
push r12
push r13
sub rsp, 0x30
movzx r9d, word [rcx + 4]
mov rsi, rdx
mov eax, 0x66666667
lea r8d, [r9 - 1]
mov r13, rcx
lea rcx, [rsi + 4]
imul r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
inc eax
add eax, edx
xor edx, edx
movsxd rdi, eax
lea rbx, [rdi + rdi*4]
shl rbx, 2
mov r12, rbx
mov qword [rsp + 0x60], rbx
sub r12, r9
xor r9d, r9d
lea r8d, [r9 + 0x18]
call fcn.14002a5a0
movzx eax, word [r13 + 4]
cmp r12, rax
ja 0x14002d0db
mov qword [rsp + 0x70], rbp
mov rcx, rbx
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
call fcn.140010258
movzx r8d, word [r13 + 4]
mov rdx, qword [r13 + 8]
mov rcx, rax
xor r9d, r9d
mov r14, rax
xor ebx, ebx
xor ebp, ebp
xor r15b, r15b
call fcn.14002a480
test r12, r12
je 0x14002cfda
movzx ecx, word [r13 + 4]
mov rdx, qword [r13 + 8]
xor r9d, r9d
add rcx, r14
mov r8, r12
call fcn.14002a480
mov r10, qword [rsp + 0x60]
xor r9d, r9d
test r10, r10
je 0x14002d0a5
movabs r11, 0xcccccccccccccccd
nop word [rax + rax]
mov rax, r11
xor r8b, r8b
mul rbp
shr rdx, 2
lea rcx, [rdx + rdx*4]
cmp rbp, rcx
jne 0x14002d028
lea rax, [rbp - 1]
cmp rax, 0x15
ja 0x14002d028
mov byte [rsi + rbx + 4], 0x2d
inc rbx
xor ecx, ecx
test rdi, rdi
je 0x14002d040
nop
lea rax, [rcx + r14]
inc rcx
xor r8b, byte [rax + r9]
cmp rcx, rdi
jb 0x14002d030
movzx eax, r15b
and eax, 0x80000003
jge 0x14002d052
dec eax
or eax, 0xfffffffc
inc eax
movzx ecx, al
movzx r15d, r8b
ror r15b, cl
movzx ecx, r15b
mov eax, ecx
shr eax, 3
xor eax, ecx
and eax, 0x8000001f
jge 0x14002d075
dec eax
or eax, 0xffffffe0
inc eax
cmp al, 8
jae 0x14002d07d
add al, 0x32
jmp 0x14002d08f
cmp al, 0x10
jae 0x14002d085
add al, 0x39
jmp 0x14002d08f
cmp al, 0x15
jae 0x14002d08d
add al, 0x3a
jmp 0x14002d08f
add al, 0x3b
add r9, rdi
mov byte [rsi + rbx + 4], al
inc rbx
inc rbp
cmp r9, r10
jb 0x14002d000
mov rcx, r14
call fcn.1400108e4
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x70]
test rbx, rbx
je 0x14002d0cc
mov rax, qword [rsp + 0x68]
mov dword [rax], 0
mov rax, rbx
add rsp, 0x30
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
xor eax, eax
add rsp, 0x30
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret

Function at 0x14002d290
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edi, edi
mov rbx, rcx
test rcx, rcx
je 0x14002d2cc
cmp byte [rcx], 0xbc
jne 0x14002d2da
cmp byte [rcx + 1], 0xbd
jne 0x14002d2da
add rcx, 2
xor edx, edx
call fcn.14002a950
xor edx, edx
mov rcx, rbx
mov rdi, rax
call fcn.14002a9d0
mov byte [rax + rdi - 4], 0
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
xor edx, edx
call fcn.14002a9d0
lea rcx, [rax + 1]
call fcn.140010258
mov r8, rax
movzx eax, byte [rbx]
xor al, 0x23
mov byte [r8], al
cmp byte [rbx], dil
je 0x14002d31a
mov rdx, r8
sub rdx, rbx
movzx ecx, byte [rbx + 1]
movzx eax, byte [rdx + rbx]
lea rbx, [rbx + 1]
dec cl
inc edi
xor al, cl
mov byte [rdx + rbx], al
cmp byte [rbx], 0
jne 0x14002d300
mov rbx, qword [rsp + 0x30]
movsxd rax, edi
mov byte [rax + r8], 0
mov rax, r8
add rsp, 0x20
pop rdi
ret
Function at 0x140032ee0
Capabilities:
Query environment variable

Disassembly:
mov r11, rsp
push rbx
push rsi
sub rsp, 0xc8
mov rax, qword [0x14012bc80]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov qword [r11 + 0x18], rdi
mov qword [r11 + 0x20], r14
mov qword [r11 - 0x18], r15
xor r15d, r15d
mov rbx, rcx
mov esi, 1
mov r14d, r15d
mov edi, r15d
test rcx, rcx
je 0x140032f3c
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x140032f3c
mov rcx, qword [rcx]
lea r9d, [rsi + 0x39]
lea r8, str.Fake_Vm_Detection_Mechanism
lea edx, [rsi + 8]
call rax
lea rcx, str.FNP_FAKE_VM
call fcn.140020944
test rax, rax
jne 0x140032f7f
test rbx, rbx
je 0x1400330bd
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x1400330bd
mov r9d, 0x44
mov rcx, qword [rbx]
lea r8, str.Fake_Vm_Detection_Mechanism_negative_result
mov edx, 9
call rax
jmp 0x1400330bd
mov rdx, rbx
mov rcx, rax
call fcn.14002a950
mov r14, rax
test rax, rax
jne 0x140032fae
test rbx, rbx
je 0x1400330bd
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x1400330bd
lea r9d, [r14 + 0x4b]
jmp 0x140032f69
lea rdx, [0x14010512c]
xor r8d, r8d
mov rcx, rax
mov qword [rsp + 0xe8], rbp
call fcn.14002aee0
lea rdx, [0x14010512c]
xor r8d, r8d
xor ecx, ecx
mov rbp, rax
call fcn.14002aee0
test rbp, rbp
je 0x1400330b5
test rax, rax
je 0x1400330b5
lea rdx, [rsp + 0x40]
xor ecx, ecx
call fcn.1400c6350
test eax, eax
jne 0x1400330b5
mov rdx, rbx
mov rcx, rbp
call fcn.14002a9d0
lea r9, [rsp + 0x40]
mov r8, rbp
mov rdx, rax
xor ecx, ecx
call fcn.1400c63d0
test eax, eax
jne 0x1400330b5
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x40]
xor ecx, ecx
call fcn.1400c64b0
test eax, eax
jne 0x1400330b5
mov ebp, dword [rsp + 0x20]
lea rcx, [rbp*2 + 1]
call fcn.140010258
mov rdi, rax
test rax, rax
je 0x1400330b5
mov rdx, r15
test rbp, rbp
je 0x140033099
nop dword [rax]
movzx eax, byte [rsp + rdx + 0x24]
lea r8, [rdx + rdx]
movzx ecx, al
and al, 0xf
shr cl, 4
cmp cl, 0xa
jae 0x14003307b
add cl, 0x30
jmp 0x14003307e
add cl, 0x57
mov byte [r8 + rdi], cl
cmp al, 0xa
jae 0x14003308a
add al, 0x30
jmp 0x14003308c
add al, 0x57
inc rdx
mov byte [r8 + rdi + 1], al
cmp rdx, rbp
jb 0x140033060
mov byte [rdi + rdx*2], r15b
lea rdx, str.cca6e10f064c06c49acf44bd0317aed73000818f
mov r8, rbx
mov rcx, rdi
call fcn.14002a750
test eax, eax
cmove esi, r15d
mov rbp, qword [rsp + 0xe8]
mov rcx, rdi
call fcn.1400108e4
mov rcx, r14
call fcn.1400108e4
mov r15, qword [rsp + 0xc0]
mov r14, qword [rsp + 0xf8]
mov rdi, qword [rsp + 0xf0]
test esi, esi
jne 0x14003310d
test rbx, rbx
je 0x140033131
mov r10, qword [rbx + 0x10]
test r10, r10
je 0x140033131
mov rcx, qword [rbx]
lea r9d, [rsi + 0x72]
lea r8, str.Fake_Vm_Detection_Mechanism_positive_result
lea edx, [rsi + 9]
call r10
jmp 0x140033131
test rbx, rbx
je 0x140033131
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140033131
mov rcx, qword [rbx]
mov r9d, reloc.WS2_32.dll_WSACleanup
lea r8, str.Fake_Vm_Detection_Mechanism_negative_result
lea edx, [r9 - 0x6b]
call rax
mov eax, esi
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.14000c9f0
add rsp, 0xc8
pop rsi
pop rbx
ret
Function at 0x1400335d0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x440
mov rax, qword [0x14012bc80]
xor rax, rsp
mov qword [rsp + 0x430], rax
xor edi, edi
mov rsi, rdx
mov rbx, rcx
test rcx, rcx
je 0x1400336fc
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x400
mov qword [rsp + 0x478], r14
mov byte [rsp + 0x20], dil
call fcn.14000cbf0
mov rdx, rsi
mov rcx, rbx
call fcn.14002a9d0
mov r14, rax
cmp rax, 2
jbe 0x1400336ef
cmp byte [rbx], 0x7c
jne 0x1400336ef
cmp byte [rbx + rax - 1], 0x7c
jne 0x1400336ef
lea rcx, [rbx + 1]
mov rdx, rsi
mov qword [rsp + 0x470], rbp
call fcn.14002a950
lea rdx, [0x140104d24]
mov rcx, rax
mov rbp, rax
mov byte [r14 + rax - 2], dil
call fcn.14000e490
mov r14, rax
test rax, rax
je 0x1400336af
lea edx, [rdi + 1]
lea rcx, [rsp + 0x20]
mov r9, rax
mov r8d, 0x400
call fcn.14003e258
test rax, rax
je 0x1400336a7
lea rcx, [rsp + 0x20]
mov rdx, rsi
call fcn.14002a950
mov rdi, rax
mov rcx, r14
call fcn.14000e350
test rbp, rbp
je 0x1400336bc
mov rcx, rbp
call fcn.1400108e4
mov rbp, qword [rsp + 0x470]
test rdi, rdi
je 0x1400336ef
mov rax, rdi
mov r14, qword [rsp + 0x478]
mov rcx, qword [rsp + 0x430]
xor rcx, rsp
call fcn.14000c9f0
add rsp, 0x440
pop rdi
pop rsi
pop rbx
ret
mov rdx, rsi
mov rcx, rbx
call fcn.14002a950
jmp 0x1400336cc
mov rax, rdi
jmp 0x1400336d4
Function at 0x140034230
Capabilities:
Reference wmi statements

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
xor ebp, ebp
mov rbx, rcx
mov esi, ebp
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rbp
call fcn.140038890
mov rdi, rax
test rax, rax
jne 0x140034288
test rbx, rbx
je 0x1400343ab
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x1400343ab
mov rcx, qword [rbx]
lea r9d, [rbp + 0x59]
lea r8, str.Failed_to_create_WMI_object
lea edx, [rbp + 9]
call rax
jmp 0x1400343ab
lea rdx, str.SELECT__FROM_Win32_NetworkAdapter
mov r8, rbx
mov rcx, rax
call fcn.140038ce0
test eax, eax
jne 0x140034386
mov rdx, rbx
mov rcx, rdi
call fcn.140038cb0
test eax, eax
je 0x1400343ab
lea r8, [rsp + 0x50]
lea rdx, str.PNPDeviceID
mov rcx, rdi
call fcn.140038cd0
test eax, eax
jne 0x140034365
mov rcx, qword [rsp + 0x50]
lea r8d, [rax + 6]
lea rdx, str.VMBUS_
mov r9, rbx
call fcn.14002abb0
test eax, eax
jne 0x140034365
lea r8, [rsp + 0x48]
lea rdx, str.Guid
mov rcx, rdi
call fcn.140038cd0
test eax, eax
jne 0x140034356
mov rcx, qword [rsp + 0x48]
call fcn.140034100
test eax, eax
je 0x140034356
mov esi, 1
test rbx, rbx
je 0x140034356
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140034339
mov rcx, qword [rbx]
lea r9d, [rsi + 0x6a]
lea r8, str.Azure_detected_on_the_following_NIC:
lea edx, [rsi + 8]
call rax
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140034356
mov r8, qword [rsp + 0x48]
mov rcx, qword [rbx]
mov r9d, WSAGetLastError
lea edx, [r9 - 0x63]
call rax
mov rcx, qword [rsp + 0x48]
call fcn.1400108e4
mov qword [rsp + 0x48], rbp
mov rcx, qword [rsp + 0x50]
call fcn.1400108e4
mov rcx, rdi
mov qword [rsp + 0x50], rbp
call fcn.140038cf0
test esi, esi
je 0x1400342a2
jmp 0x1400343ab
test rbx, rbx
je 0x1400343ab
mov r10, qword [rbx + 0x10]
test r10, r10
je 0x1400343ab
mov rcx, qword [rbx]
mov r9d, 0x7a
lea r8, str.Error:_Cmn_Wmi_query_failed
lea edx, [r9 - 0x71]
call r10
mov rcx, rdi
call fcn.140038c20
mov rbx, qword [rsp + 0x40]
mov eax, esi
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
Function at 0x140035260
Capabilities:
Reference wmi statements

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
xor ebp, ebp
mov rbx, rcx
mov esi, 1
mov qword [rsp + 0x38], rbp
call fcn.140038890
mov rdi, rax
test rax, rax
jne 0x1400352c0
test rbx, rbx
je 0x140035374
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140035374
mov rcx, qword [rbx]
lea r8, str.Failed_to_create_WMI_object
lea edx, [rsi + 8]
mov r9d, 0xf5
call rax
jmp 0x140035374
lea rdx, str.SELECT__FROM_Win32_BIOS
mov r8, rbx
mov rcx, rax
call fcn.140038ce0
test eax, eax
jne 0x14003534e
mov rdx, rbx
mov rcx, rdi
call fcn.140038cb0
test eax, eax
je 0x140035374
nop dword [rax]
lea r8, [rsp + 0x38]
lea rdx, str.SerialNumber
mov rcx, rdi
call fcn.140038cd0
mov rcx, qword [rsp + 0x38]
test eax, eax
jne 0x140035318
cmp byte [rcx], 0x65
jne 0x140035318
cmp byte [rcx + 1], 0x45
je 0x140035340
test rcx, rcx
je 0x140035327
call fcn.1400108e4
mov qword [rsp + 0x38], rbp
mov rcx, rdi
call fcn.140038cf0
mov rdx, rbx
mov rcx, rdi
call fcn.140038cb0
test eax, eax
jne 0x1400352f0
jmp 0x140035374
mov esi, ebp
call fcn.1400108e4
mov qword [rsp + 0x38], rbp
jmp 0x140035374
test rbx, rbx
je 0x140035374
mov r10, qword [rbx + 0x10]
test r10, r10
je 0x140035374
mov rcx, qword [rbx]
lea r8, str.Error:_Cmn_Wmi_query_failed
mov r9d, 0x119
mov edx, 9
call r10
mov rcx, rdi
call fcn.140038c20
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
mov eax, esi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret