joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002c90
Capabilities:
Encode data using xor
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x140040020]
xor rax, rsp
mov qword [rbp + 0x28], rax
lea rdx, [rsp + 0x70]
call fcn.140002ea0
xor ebx, ebx
mov r8d, ebx
mov ecx, dword [rax]
lea r9, [rax + 4]
test ecx, ecx
je 0x140002ce5
nop dword [rax]
mov ecx, r8d
lea edx, [r8 - 0x5d]
inc r8d
xor byte [rcx + r9], dl
mov ecx, dword [rax]
cmp r8d, ecx
jb 0x140002cd0
mov eax, ecx
mov rcx, r9
mov byte [rax + r9], bl
call fcn.14000f29c
movdqa xmm0, xmmword [0x14003b340]
movdqa xmm1, xmmword [0x14003b270]
mov eax, 0x35
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x64], 0xb5bca2a1
mov dword [rsp + 0x68], 0xd8b2
movdqu xmmword [rsp + 0x34], xmm0
movdqa xmm0, xmmword [0x14003b2a0]
movdqu xmmword [rsp + 0x54], xmm0
movdqu xmmword [rsp + 0x44], xmm1
test eax, eax
je 0x140002d59
nop word [rax + rax]
mov eax, ebx
lea rcx, [rsp + 0x34]
add rcx, rax
lea eax, [rbx - 0x5d]
inc ebx
xor byte [rcx], al
mov eax, dword [rsp + 0x30]
cmp ebx, eax
jb 0x140002d40
mov byte [rsp + rax + 0x34], 0
lea rcx, str.C:Program_Files__x86_3ShapeDongle_Server_ServiceDongleServer.exe
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x140002d70
mov dword [rsp + 0x28], eax
lea r8, str.ImagePath
mov qword [rsp + 0x20], rcx
lea rdx, [rsp + 0x34]
mov rcx, 0xffffffff80000002
mov r9d, 2
call qword [sym.imp.SHLWAPI.dll_SHSetValueA]
lea rax, str.3Shape_Dongle_Server_Service
mov dword [rsp + 0x28], 0x1c
mov r9d, 1
mov qword [rsp + 0x20], rax
lea r8, str.Description
mov rcx, 0xffffffff80000002
lea rdx, [rsp + 0x34]
call qword [sym.imp.SHLWAPI.dll_SHSetValueA]
lea rax, str.3Shape_Dongle_Service
mov dword [rsp + 0x28], 0x15
mov r9d, 1
mov qword [rsp + 0x20], rax
lea r8, str.DisplayName
mov rcx, 0xffffffff80000002
lea rdx, [rsp + 0x34]
call qword [sym.imp.SHLWAPI.dll_SHSetValueA]
lea rax, [rbp + 0x20]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
lea r8, str.Start
mov dword [rbp + 0x20], 2
lea rdx, [rsp + 0x34]
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHSetValueA]
lea rax, [rbp + 0x20]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
lea r8, str.Type
mov dword [rbp + 0x20], pe_nt_image_headers64
lea rdx, [rsp + 0x34]
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov rcx, qword [rbp + 0x28]
xor rcx, rsp
call fcn.140006b20
mov rbx, qword [rsp + 0x140]
add rsp, 0x130
pop rbp
ret
Function at 0x140002fe0
Capabilities:
Encode data using xor
Set registry value

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov eax, 6
xor edx, edx
mov dword [rbp - 9], eax
mov r8d, edx
mov dword [rbp - 5], 0x96918489
mov dword [rbp - 1], 0xa99d9e
test eax, eax
je 0x14000302b
nop dword [rax]
mov eax, r8d
lea rcx, [rbp - 5]
add rcx, rax
lea eax, [r8 - 0x5d]
inc r8d
xor byte [rcx], al
mov eax, dword [rbp - 9]
cmp r8d, eax
jb 0x140003010
mov byte [rbp + rax - 5], dl
mov r8, 0xffffffffffffffff
lea rax, [rbp - 5]
nop word [rax + rax]
inc r8
cmp byte [rax + r8], dl
jne 0x140003040
movdqa xmm0, xmmword [0x14003b2e0]
xor ecx, ecx
movdqa xmm1, xmmword [0x14003b220]
mov eax, 0x3c
movdqa xmmword [rbp + 0x17], xmm0
movdqa xmm0, xmmword [0x14003b2d0]
movdqa xmmword [rbp + 0x37], xmm0
mov dword [rbp + 7], eax
mov dword [rbp + 0xb], 0xf2f6fdf0
mov dword [rbp + 0xf], 0xe9f5e5e2
mov dword [rbp + 0x13], 0xcbdfdede
movdqa xmmword [rbp + 0x27], xmm1
mov byte [rbp + 0x47], 0xdf
mov word [rbp + 0x48], cx
mov byte [rbp + 0x4a], cl
test eax, eax
je 0x1400030b7
nop
mov eax, edx
lea rcx, [rbp + 0xb]
add rcx, rax
lea eax, [rdx - 0x5d]
inc edx
xor byte [rcx], al
mov eax, dword [rbp + 7]
cmp edx, eax
jb 0x1400030a0
mov dword [rsp + 0x28], r8d
lea rdx, [rbp + 0xb]
mov byte [rbp + rax + 0xb], 0
lea r8, str.ForcedPhysicalSectorSizeInBytes
lea rax, [rbp - 5]
mov r9d, 1
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHLWAPI.dll_SHSetValueA]
add rsp, 0x90
pop rbp
ret
Function at 0x140003100
Capabilities:
Set console window title

Disassembly:
push rbx
sub rsp, 0x830
mov rax, qword [0x140040020]
xor rax, rsp
mov qword [rsp + 0x820], rax
mov edx, 0x400
mov dword [0x1400429d0], 0x210
lea rcx, [rsp + 0x420]
mov dword [0x1400429e4], 0x17
call qword [sym.imp.KERNEL32.dll_GetConsoleTitleA]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r9d, ebx
lea rdx, str._d__d
mov r8d, eax
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov ecx, 0x28
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
lea rcx, [rsp + 0x420]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
xor ecx, ecx
mov qword [0x1400429d8], rbx
mov dword [0x1400429e0], 0x6a
mov dword [0x1400429e8], 0x47e
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
mov edx, 0x6a
call qword [sym.imp.USER32.dll_LoadIconA]
movups xmm0, xmmword [str.Patch_execution_completed.]
lea rdx, [0x1400429d0]
mov qword [0x1400429f0], rax
movsd xmm1, qword [0x14003ad30]
movabs rax, 0x6f666e49443443
mov qword [0x1400429f8], rax
xor ecx, ecx
movzx eax, word [0x14003ad38]
mov word [0x140042a98], ax
movzx eax, byte [0x14003ad3a]
movaps xmmword [0x140042a80], xmm0
movups xmm0, xmmword [str.Crack4Dental_tips]
mov byte [0x140042a9a], al
movzx eax, word [0x14003ad50]
mov word [0x140042b94], ax
movsd qword [0x140042a90], xmm1
movups xmmword [0x140042b84], xmm0
mov dword [0x140042bc4], 1
mov dword [0x140042b80], 0x1388
call qword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1400429d0]
mov ecx, 2
call qword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
mov rcx, qword [rsp + 0x820]
xor rcx, rsp
call fcn.140006b20
add rsp, 0x830
pop rbx
ret

Function at 0x14000cf84
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x14000ce17
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000ce17
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000ce17
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000ce17
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000ce17
cmp dword [rcx + 0x84], 0xe
jbe 0x14000ce17
cmp dword [rcx + 0xf8], 0
je 0x14000ce17
mov ecx, ebx
call fcn.14000ceb8
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.14000cca8
cmp dword [rbp + 0x20], 0
je 0x14000ce64
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000ce6c
int3
xor r8d, r8d
xor edx, edx
jmp 0x14000cdb0
Function at 0x14000d6f0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x14000d751
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x14000d710
mov ecx, dword [r9]
jmp 0x14000d838
cmp ecx, 0x4e0
jb 0x14000d838
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x14000d770
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop dword [rax + rax]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x14000d7c0
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret

Function at 0x14000d880
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140022040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rdx
mov ecx, 8
call fcn.14000daa0
lea rcx, [0x14000c000]
mov qword [rax], rcx
mov qword [rsp + 0x30], rax
lea rdi, [rbx + 8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x14000da40]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
je 0x14000d8fa
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14000da80
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
mov dword [rdi], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x14000e570
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000e5ba
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000e5ba
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000e5ba
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000e5ba
cmp dword [rcx + 0x84], 0xe
jbe 0x14000e5ba
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000e5bc
xor al, al
add rsp, 0x28
ret
Function at 0x140002810
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
and rsp, 0xfffffffffffffff0
xor r8, r8
push r8
push rax
pushfq
push r8
push rdx
sub rsp, 0xa8
push r8
push r15
push r14
push r13
push r12
push rbx
push r8
push rsi
push rdi
push rbp
push rax
push rdx
sub rsp, 0x290
movdqa xmmword [rsp + 0x2f0], xmm6
movdqa xmmword [rsp + 0x300], xmm7
movdqa xmmword [rsp + 0x310], xmm8
movdqa xmmword [rsp + 0x320], xmm9
movdqa xmmword [rsp + 0x330], xmm10
movdqa xmmword [rsp + 0x340], xmm11
movdqa xmmword [rsp + 0x350], xmm12
movdqa xmmword [rsp + 0x360], xmm13
movdqa xmmword [rsp + 0x370], xmm14
movdqa xmmword [rsp + 0x380], xmm15
mov eax, dword [0x14016675c]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x30
add rax, rbx
lea rdx, [rsp + 0x20]
xor r8, r8
mov qword [rdx + 0x10], r8
mov byte [rdx + 0x19], 1
mov dword [rdx + 0x1c], 0xffffffff
mov byte [rdx + 0x18], 2
mov r8, qword [rax + 0x80]
mov qword [rdx], r8
mov qword [rax + 0x80], rdx
lea r8, [rsp + 0x290]
mov qword [rdx + 8], r8
call fcn.140096d70
int3
push r15
push r14
push r13
push r12
push rbx
push rsi
push rdi
push rbp
sub rsp, 0xd8
movdqa xmmword [rsp + 0x20], xmm6
movdqa xmmword [rsp + 0x30], xmm7
movdqa xmmword [rsp + 0x40], xmm8
movdqa xmmword [rsp + 0x50], xmm9
movdqa xmmword [rsp + 0x60], xmm10
movdqa xmmword [rsp + 0x70], xmm11
movdqa xmmword [rsp + 0x80], xmm12
movdqa xmmword [rsp + 0x90], xmm13
movdqa xmmword [rsp + 0xa0], xmm14
movdqa xmmword [rsp + 0xb0], xmm15
mov qword [rsp + 0x120], rcx
mov qword [rsp + 0x128], rdx
mov qword [rsp + 0x130], r8
mov qword [rsp + 0x138], r9
mov eax, dword [0x14016675c]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x30
add rax, rbx
mov qword [rsp + 0xc0], rax
cmp rcx, qword [rax + 0x88]
sete byte [rsp + 0xd0]
lock and dword [rax + 0x38], 0xffffffef
mov rax, qword [r8 + 0x18]
mov rbx, qword [rax]
mov rax, qword [r8 + 0x20]
mov rbp, qword [rax]
mov rax, qword [r8 + 0x28]
mov rsi, qword [rax]
mov rax, qword [r8 + 0x30]
mov rdi, qword [rax]
mov rax, qword [r8 + 0x58]
mov r12, qword [rax]
mov rax, qword [r8 + 0x60]
mov r13, qword [rax]
mov rax, qword [r8 + 0x68]
mov r14, qword [rax]
mov rax, qword [r8 + 0x70]
mov r15, qword [rax]
movdqa xmm6, xmmword [r8 + 0x90]
movdqa xmm7, xmmword [r8 + 0xa0]
movdqa xmm8, xmmword [r8 + 0xb0]
movdqa xmm9, xmmword [r8 + 0xc0]
movdqa xmm10, xmmword [r8 + 0xd0]
movdqa xmm11, xmmword [r8 + 0xe0]
movdqa xmm12, xmmword [r8 + 0xf0]
movdqa xmm13, xmmword [r8 + 0x100]
movdqa xmm14, xmmword [r8 + 0x110]
movdqa xmm15, xmmword [r8 + 0x120]
mov rcx, qword [r8 + 0x78]
mov rdx, qword [rsp + 0x120]
call qword [rsp + 0x128]
mov r8, qword [rsp + 0x130]
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rdx + 0x70]
cmp rcx, 0
je 0x1400029a0
mov r9, qword [rdx + 0x68]
mov qword [r9], rcx
mov qword [rdx + 0x68], 0
mov qword [rdx + 0x70], 0
mov rcx, qword [rsp + 0x138]
mov r8, qword [r8 + 0x78]
xor r9d, r9d
mov rcx, qword [rcx]
cmp rcx, r9
je 0x1400029bc
cmp rcx, r8
jl 0x1400029af
mov qword [rdx + 0x80], rcx
test dword [0x1401603c0], 1
je 0x1400029eb
cmp byte [rsp + 0xd0], 0
je 0x1400029eb
mov rcx, 0x43
mov rdx, rax
mov rsp, r8
jmp 0x140002510
mov rsp, r8
jmp rax
Function at 0x1400029f0
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rbx
push rsi
push rdi
push rbp
sub rsp, 0xc8
movdqa xmmword [rsp + 0x20], xmm6
movdqa xmmword [rsp + 0x30], xmm7
movdqa xmmword [rsp + 0x40], xmm8
movdqa xmmword [rsp + 0x50], xmm9
movdqa xmmword [rsp + 0x60], xmm10
movdqa xmmword [rsp + 0x70], xmm11
movdqa xmmword [rsp + 0x80], xmm12
movdqa xmmword [rsp + 0x90], xmm13
movdqa xmmword [rsp + 0xa0], xmm14
movdqa xmmword [rsp + 0xb0], xmm15
mov qword [rsp + 0x110], rcx
mov qword [rsp + 0x118], rdx
mov eax, dword [0x14016675c]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x30
add rax, rbx
mov qword [rsp + 0xc0], rax
lock and dword [rax + 0x38], 0xffffffef
mov rax, qword [rdx + 0x18]
mov rbx, qword [rax]
mov rax, qword [rdx + 0x20]
mov rbp, qword [rax]
mov rax, qword [rdx + 0x28]
mov rsi, qword [rax]
mov rax, qword [rdx + 0x30]
mov rdi, qword [rax]
mov rax, qword [rdx + 0x58]
mov r12, qword [rax]
mov rax, qword [rdx + 0x60]
mov r13, qword [rax]
mov rax, qword [rdx + 0x68]
mov r14, qword [rax]
mov rax, qword [rdx + 0x70]
mov r15, qword [rax]
movdqa xmm6, xmmword [rdx + 0x90]
movdqa xmm7, xmmword [rdx + 0xa0]
movdqa xmm8, xmmword [rdx + 0xb0]
movdqa xmm9, xmmword [rdx + 0xc0]
movdqa xmm10, xmmword [rdx + 0xd0]
movdqa xmm11, xmmword [rdx + 0xe0]
movdqa xmm12, xmmword [rdx + 0xf0]
movdqa xmm13, xmmword [rdx + 0x100]
movdqa xmm14, xmmword [rdx + 0x110]
movdqa xmm15, xmmword [rdx + 0x120]
mov rcx, qword [rdx + 0x78]
call qword [rsp + 0x110]
mov rdx, qword [rsp + 0x118]
mov rax, qword [rdx + 0x18]
mov qword [rax], rbx
mov rax, qword [rdx + 0x20]
mov qword [rax], rbp
mov rax, qword [rdx + 0x28]
mov qword [rax], rsi
mov rax, qword [rdx + 0x30]
mov qword [rax], rdi
mov rax, qword [rdx + 0x58]
mov qword [rax], r12
mov rax, qword [rdx + 0x60]
mov qword [rax], r13
mov rax, qword [rdx + 0x68]
mov qword [rax], r14
mov rax, qword [rdx + 0x70]
mov qword [rax], r15
movdqa xmmword [rdx + 0x90], xmm6
movdqa xmmword [rdx + 0xa0], xmm7
movdqa xmmword [rdx + 0xb0], xmm8
movdqa xmmword [rdx + 0xc0], xmm9
movdqa xmmword [rdx + 0xd0], xmm10
movdqa xmmword [rdx + 0xe0], xmm11
movdqa xmmword [rdx + 0xf0], xmm12
movdqa xmmword [rdx + 0x100], xmm13
movdqa xmmword [rdx + 0x110], xmm14
movdqa xmmword [rdx + 0x120], xmm15
mov rax, qword [rsp + 0xc0]
lock or dword [rax + 0x38], 0x10
movdqa xmm6, xmmword [rsp + 0x20]
movdqa xmm7, xmmword [rsp + 0x30]
movdqa xmm8, xmmword [rsp + 0x40]
movdqa xmm9, xmmword [rsp + 0x50]
movdqa xmm10, xmmword [rsp + 0x60]
movdqa xmm11, xmmword [rsp + 0x70]
movdqa xmm12, xmmword [rsp + 0x80]
movdqa xmm13, xmmword [rsp + 0x90]
movdqa xmm14, xmmword [rsp + 0xa0]
movdqa xmm15, xmmword [rsp + 0xb0]
add rsp, 0xc8
pop rbp
pop rdi
pop rsi
pop rbx
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14000b6d0
Capabilities:
Resume thread
Suspend thread

Disassembly:
cmp qword [rcx + 0x60], 0xffffffffffffffff
je 0x140004597
mov eax, dword [rcx + 0x38]
shr eax, 5
test al, 1
jne 0x140004597
mov eax, dword [rcx + 0x38]
shr eax, 7
test al, 1
jne 0x140004597
mov rdx, rcx
mov rcx, qword [rcx + 0x60]
jmp 0x14000b6d0
ret
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x500
mov rax, qword [0x14015b0c0]
xor rax, rsp
mov qword [rsp + 0x4f0], rax
mov rax, qword [0x14015a6b8]
mov rbx, rdx
mov rdi, rcx
cmp rax, 0xffffffffffffffff
jne 0x14000b72e
xor edx, edx
lea rcx, str.kernel32
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
lea rdx, str.QueueUserAPC2
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14015a6b8], rax
test rax, rax
je 0x14000b78a
mov rcx, rbx
call fcn.140004890
test al, al
jne 0x14000b7d8
mov dl, 1
mov rcx, rbx
call fcn.140004910
mov r9d, 0x10001
lea rcx, [0x14000b340]
mov r8, rbx
mov rdx, rdi
call qword [0x14015a6b8]
test eax, eax
jne 0x14000b7d8
xor edx, edx
mov rcx, rbx
call fcn.140004910
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x14000b7d8
mov qword [0x14015a6b8], 0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x14000b7d8
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x50], 0x40100003
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x14000b7cf
mov eax, dword [rsp + 0x50]
test eax, eax
jns 0x14000b7cf
test eax, 0x18000000
jne 0x14000b7cf
mov rdx, rbx
lea rcx, [rsp + 0x20]
call qword [0x1401604b8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsp + 0x4f0]
xor rcx, rsp
call fcn.1400600f0
mov rbx, qword [rsp + 0x520]
add rsp, 0x500
pop rdi
ret

Function at 0x14000b960
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rcx + rbx], 0
jne 0x14000b974
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], 0
mov rcx, rax
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x14000ba20
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
xor eax, eax
mov r9, rdx
mov r8, rcx
mov qword [rsp + 0x28], rax
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
jne 0x14000ba49
add rsp, 0x38
ret
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
add rsp, 0x38
ret

Function at 0x14000ba60
Capabilities:
Create thread
Resume thread

Disassembly:
push rbx
sub rsp, 0x30
mov r9, rdx
mov qword [rsp + 0x28], 0
mov r8, rcx
mov dword [rsp + 0x20], 4
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
test rax, rax
jne 0x14000ba95
add rsp, 0x30
pop rbx
ret
mov edx, 2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
add rsp, 0x30
pop rbx
ret
Function at 0x14000cef0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0xe0
mov rax, qword [0x14015b0c0]
xor rax, rsp
mov qword [rsp + 0xd0], rax
movzx ebx, r8b
mov rdi, rdx
mov r8d, 0x40
lea rdx, [rsp + 0x50]
call fcn.14000cb20
mov r8d, 0x11
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x50]
call sub.KERNEL32.dll_GetEnvironmentVariableW
mov r11d, eax
lea ecx, [rax - 1]
cmp ecx, 0xf
ja 0x14000cfb8
xor ecx, ecx
mov r9d, ecx
test eax, eax
je 0x14000cfb1
lea r10, [rsp + 0x20]
movzx r8d, word [r10]
lea eax, [r8 - 0x30]
test bl, bl
je 0x14000cf74
cmp ax, 9
ja 0x14000cfb8
lea rcx, [rcx + rcx*4]
lea rcx, [rcx - 0x18]
lea rcx, [r8 + rcx*2]
jmp 0x14000cfa5
shl rcx, 4
cmp ax, 9
ja 0x14000cf84
add rcx, 0xffffffffffffffd0
jmp 0x14000cfa2
lea eax, [r8 - 0x61]
cmp ax, 5
ja 0x14000cf94
add rcx, 0xffffffffffffffa9
jmp 0x14000cfa2
lea eax, [r8 - 0x41]
cmp ax, 5
ja 0x14000cfb8
add rcx, 0xffffffffffffffc9
add rcx, r8
inc r9d
add r10, 2
cmp r9d, r11d
jb 0x14000cf54
mov qword [rdi], rcx
mov al, 1
jmp 0x14000cfba
xor al, al
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.1400600f0
mov rbx, qword [rsp + 0x100]
add rsp, 0xe0
pop rdi
ret
Function at 0x140010e20
Capabilities:
Get memory capacity

Disassembly:
mov qword [rsp + 8], rbx
push rsi
push rdi
push r14
sub rsp, 0xc0
mov rax, qword [0x14015b0c0]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rsi, r9
mov rbx, r8
mov r14, rdx
mov rdi, rcx
test rcx, rcx
je 0x140010f0f
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8d, 0x48
lea rdx, [rsp + 0x60]
mov rcx, rax
call sub.KERNEL32.dll_K32GetProcessMemoryInfo
test eax, eax
je 0x140010f0f
mov rdx, qword [rsp + 0x70]
test r14, r14
je 0x140010eea
xorps xmm0, xmm0
test rdx, rdx
js 0x140010e91
cvtsi2ss xmm0, rdx
jmp 0x140010ea9
mov rax, rdx
mov rcx, rdx
shr rcx, 1
and eax, 1
or rcx, rax
cvtsi2ss xmm0, rcx
addss xmm0, xmm0
cvtps2pd xmm1, xmm0
xorps xmm0, xmm0
mulsd xmm1, qword [0x1401408d0]
test rdi, rdi
js 0x140010ec3
cvtsi2ss xmm0, rdi
jmp 0x140010edb
mov rax, rdi
mov rcx, rdi
shr rcx, 1
and eax, 1
or rcx, rax
cvtsi2ss xmm0, rcx
addss xmm0, xmm0
cvtps2pd xmm0, xmm0
divsd xmm1, xmm0
cvttsd2si rax, xmm1
mov dword [r14], eax
xor eax, eax
test rbx, rbx
je 0x140010f01
cmp rdx, rdi
jbe 0x140010efb
mov qword [rbx], rax
jmp 0x140010f01
sub rdi, rdx
mov qword [rbx], rdi
test rsi, rsi
je 0x140010fd8
jmp 0x140010fd5
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rdx, qword [rsp + 0x48]
cmp rdx, qword [rsp + 0x28]
jae 0x140010fb2
test r14, r14
je 0x140010fa1
mov rcx, rdx
xorps xmm0, xmm0
sub rcx, qword [rsp + 0x50]
js 0x140010f4b
cvtsi2ss xmm0, rcx
jmp 0x140010f60
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
cvtps2pd xmm1, xmm0
xorps xmm0, xmm0
mulsd xmm1, qword [0x1401408d0]
test rdx, rdx
js 0x140010f7a
cvtsi2ss xmm0, rdx
jmp 0x140010f92
mov rax, rdx
mov rcx, rdx
shr rcx, 1
and eax, 1
or rcx, rax
cvtsi2ss xmm0, rcx
addss xmm0, xmm0
cvtps2pd xmm0, xmm0
divsd xmm1, xmm0
cvttsd2si rax, xmm1
mov dword [r14], eax
test rbx, rbx
je 0x140010fa9
mov qword [rbx], rdx
test rsi, rsi
je 0x140010fd8
xor eax, eax
jmp 0x140010fd5
test r14, r14
je 0x140010fbe
mov eax, dword [rsp + 0x24]
mov dword [r14], eax
test rbx, rbx
je 0x140010fcb
mov rax, qword [rsp + 0x30]
mov qword [rbx], rax
test rsi, rsi
je 0x140010fd8
mov rax, qword [rsp + 0x40]
mov qword [rsi], rax
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1400600f0
mov rbx, qword [rsp + 0xe0]
add rsp, 0xc0
pop r14
pop rdi
pop rsi
ret