joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400aa660
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rax, qword gs:[0x30]
mov rbx, rcx
mov r14, rdx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x110]
call qword [0x1401020d0]
mov rax, qword gs:[0x30]
xor esi, esi
mov r8, qword [rax + 0x60]
mov rax, qword [r8 + 0x18]
add rax, 0x10
mov rcx, qword [rax]
cmp rcx, rax
je 0x1400aa6c3
nop
test rbx, rbx
je 0x1400aa6f8
cmp qword [rcx + 0x30], rbx
je 0x1400aa6f8
mov rcx, qword [rcx]
cmp rcx, rax
jne 0x1400aa6b0
mov rbx, rsi
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x110]
call qword [0x1401020c0]
test rbx, rbx
jne 0x1400aa70f
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
test rcx, rcx
je 0x1400aa6c3
movzx edx, word [rcx + 0x48]
mov rcx, qword [rcx + 0x50]
call sym.ProcessHacker.exe_PhCreateStringEx
mov rbx, rax
jmp 0x1400aa6c6
mov rcx, rbx
mov qword [rsp + 0x30], rdi
call sym.ProcessHacker.exe_PhGetFileName
mov rdi, rax
lea rcx, [rbx - 0x10]
or edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x1400aa735
call fcn.1400ae580
test r14, r14
je 0x1400aa759
mov edx, 0x5c
xor r8d, r8d
mov rcx, rdi
call sym.ProcessHacker.exe_PhFindLastCharInStringRef
cmp rax, 0xffffffffffffffff
lea rcx, [rax + 1]
cmovne rsi, rcx
mov dword [r14], esi
mov rbx, qword [rsp + 0x38]
mov rax, rdi
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x1400ad2a0
Capabilities:
Hash data using sha1

Disassembly:
sub rsp, 0x28
mov dword [rcx], edx
test edx, edx
je 0x1400ad2f8
sub edx, 1
je 0x1400ad2ca
cmp edx, 1
je 0x1400ad2c0
mov ecx, 0xc00000f0
call qword [0x140102170]
int3
xor eax, eax
mov dword [rcx + 4], eax
add rsp, 0x28
ret
xor eax, eax
mov dword [rcx + 0x1c], 0x67452301
mov qword [rcx + 0x30], rax
mov dword [rcx + 0x20], 0xefcdab89
mov dword [rcx + 0x24], 0x98badcfe
mov dword [rcx + 0x28], 0x10325476
mov dword [rcx + 0x2c], 0xc3d2e1f0
add rsp, 0x28
ret
xor eax, eax
mov dword [rcx + 0xc], 0x67452301
mov qword [rcx + 4], rax
mov dword [rcx + 0x10], 0xefcdab89
mov dword [rcx + 0x14], 0x98badcfe
mov dword [rcx + 0x18], 0x10325476
add rsp, 0x28
ret

Function at 0x1400ad320
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 0x28
mov r9, rdx
mov r11, rcx
mov edx, dword [rcx]
test edx, edx
je 0x1400ad3a3
sub edx, 1
je 0x1400ad393
cmp edx, 1
je 0x1400ad346
mov ecx, 0xc000000d
call qword [0x140102170]
int3
mov r10d, r8d
mov r8d, dword [rcx + 4]
not r8d
test r10, r10
je 0x1400ad387
mov qword [rsp + 0x20], rbx
lea rbx, [0x140136840]
movsx ecx, byte [r9]
lea r9, [r9 + 1]
mov eax, r8d
xor rcx, rax
shr eax, 8
movzx edx, cl
mov r8d, dword [rbx + rdx*4]
xor r8d, eax
sub r10, 1
jne 0x1400ad361
mov rbx, qword [rsp + 0x20]
not r8d
mov dword [r11 + 4], r8d
add rsp, 0x28
ret
add rcx, 4
mov rdx, r9
add rsp, 0x28
jmp fcn.1400e1f70
add rcx, 4
mov rdx, r9
add rsp, 0x28
jmp fcn.1400e0160
Function at 0x1400b3760
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
xor eax, eax
mov r8, rcx
test rdx, rdx
je 0x1400b3786
nop word [rax + rax]
movzx ecx, byte [r8]
lea r8, [r8 + 1]
xor eax, ecx
imul eax, eax, 0x1000193
sub rdx, 1
jne 0x1400b3770
ret

Function at 0x1400b3790
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
mov r8, qword [rcx]
xor ebx, ebx
test r8, r8
jne 0x1400b37a8
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov qword [rsp + 0x30], rsi
mov rsi, r8
shr rsi, 1
mov qword [rsp + 0x38], rdi
mov rdi, qword [rcx + 8]
test dl, dl
jne 0x1400b37f0
movzx eax, byte [rdi]
lea rdi, [rdi + 1]
xor ebx, eax
imul ebx, ebx, 0x1000193
sub r8, 1
jne 0x1400b37c0
mov rsi, qword [rsp + 0x30]
mov eax, ebx
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
movzx ecx, word [rdi]
lea rdi, [rdi + 2]
call qword [0x140101db8]
movzx eax, ax
xor eax, ebx
imul ebx, eax, 0x1000193
sub rsi, 1
jne 0x1400b37f0
mov rsi, qword [rsp + 0x30]
mov eax, ebx
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
Function at 0x1400b9c30
Capabilities:
Get windows directory from kuser_shared_data

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push r12
push r14
push r15
sub rsp, 0xc0
xor r12d, r12d
mov r15, r8
mov rbp, rdx
mov qword [rsp + 0x20], r12
lea r8, [rsp + 0x108]
mov rsi, rcx
xor r14b, r14b
xor bl, bl
lea r9d, [r12 + 8]
lea edx, [r12 + 0x1a]
call qword [0x140101f28]
test eax, eax
js 0x1400b9c82
cmp qword [rsp + 0x108], r12
setne r14b
cmp dword [sym.ProcessHacker.exe_WindowsVersion], 0x3e
mov qword [rsp + 0xf0], rdi
jae 0x1400b9d8c
lea r8, [rsp + 0x58]
mov dword [rsp + 0x58], 0xc0000135
lea rdx, [0x1400bba00]
mov qword [rsp + 0x60], rbp
mov rcx, rsi
mov dword [rsp + 0x68], 1
call fcn.1400bb5f0
mov edi, dword [rsp + 0x58]
test eax, eax
cmovs edi, eax
test r14b, r14b
je 0x1400b9d0d
cmp edi, 0xc0000135
jne 0x1400b9d0d
lea r8, [rsp + 0x70]
mov dword [rsp + 0x70], edi
lea rdx, [0x1400bbf80]
mov qword [rsp + 0x78], rbp
mov rcx, rsi
mov dword [rsp + 0x80], 1
call fcn.1400bba50
mov edi, dword [rsp + 0x70]
test eax, eax
cmovs edi, eax
test edi, edi
js 0x1400b9d11
mov bl, 1
test edi, edi
jns 0x1400b9d18
mov eax, edi
jmp 0x1400b9e8d
test bl, bl
je 0x1400b9d93
mov rax, qword [0x14015c3b8]
test rax, rax
jne 0x1400b9dba
lea rdx, str.SysWow64_ntdll.dll
mov ecx, 0x7ffe0030
call sym.ProcessHacker.exe_PhConcatStrings2
mov rbx, rax
mov qword [rsp + 0x28], r12
lea rax, [0x14015c3b8]
xor r9d, r9d
lea r8, [0x140135258]
mov qword [rsp + 0x20], rax
mov rcx, rsi
mov rdx, qword [rbx + 8]
call sym.ProcessHacker.exe_PhGetProcedureAddressRemote
mov edi, eax
lea rcx, [rbx - 0x10]
or eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400b9d7f
call fcn.1400ae580
test edi, edi
js 0x1400b9d11
mov rax, qword [0x14015c3b8]
jmp 0x1400b9dba
mov edi, dword [rsp + 0x108]
lea rcx, [0x140126260]
call qword [0x1401012a8]
test rax, rax
je 0x1400b9db7
lea rdx, [0x140135258]
mov rcx, rax
call qword [0x1401012b0]
jmp 0x1400b9dba
mov rax, r12
xor edx, edx
cmp dword [sym.ProcessHacker.exe_WindowsVersion], 0x3c
jb 0x1400b9dfb
mov qword [rsp + 0x48], r12
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x40], rcx
xor r9d, r9d
mov qword [rsp + 0x38], rbp
xor r8d, r8d
mov qword [rsp + 0x30], rax
mov rcx, rsi
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
call qword [0x140101e70]
mov edi, eax
jmp 0x1400b9e38
mov qword [rsp + 0x30], r12
mov r9, rax
mov dword [rsp + 0x28], r12d
xor r8d, r8d
mov rcx, rsi
mov qword [rsp + 0x20], rbp
call qword [0x1401014c8]
mov qword [rsp + 0x50], rax
test rax, rax
jne 0x1400b9e38
call qword [0x1401012b8]
mov edi, eax
test eax, eax
jle 0x1400b9e38
movzx edi, ax
or edi, 0xc0070000
test edi, edi
js 0x1400b9d11
mov rcx, qword [rsp + 0x50]
mov r8, r15
xor edx, edx
call qword [0x140102150]
mov ebx, eax
test eax, eax
jne 0x1400b9e80
mov rcx, qword [rsp + 0x50]
lea r9d, [rax + 0x30]
lea r8, [rsp + 0x88]
mov qword [rsp + 0x20], r12
xor edx, edx
call qword [0x140102140]
test eax, eax
mov ebx, eax
cmovns ebx, dword [rsp + 0x88]
mov rcx, qword [rsp + 0x50]
call qword [0x140101f48]
mov eax, ebx
mov rdi, qword [rsp + 0xf0]
mov rbx, qword [rsp + 0xf8]
add rsp, 0xc0
pop r15
pop r14
pop r12
pop rsi
pop rbp
ret
Function at 0x1400de490
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov qword [rcx], rdx
mov qword [rcx + 8], r8
mov r8d, 0x40
call fcn.1400de730
nop
mov eax, 0x5a4d
cmp word [rdi], ax
je 0x1400de4cf
mov eax, 0xc000012f
jmp 0x1400de567
mov eax, dword [rdi + 0x3c]
test eax, eax
jne 0x1400de4e0
mov eax, 0xc000007b
jmp 0x1400de567
cmp eax, 0x10000000
jae 0x1400de4d6
cmp rax, rsi
jae 0x1400de4d6
lea rdx, [rax + rdi]
mov qword [rbx + 0x10], rdx
mov r8d, 0x18
mov rcx, rbx
call fcn.1400de730
mov rdx, qword [rbx + 0x10]
movzx eax, word [rdx + 0x14]
add eax, 0x18
movsxd r8, eax
movzx eax, word [rdx + 6]
lea rcx, [rax + rax*4]
lea r8, [r8 + rcx*8]
mov rcx, rbx
call fcn.1400de730
nop
mov rcx, qword [rbx + 0x10]
cmp dword [rcx], 0x4550
jne 0x1400de4d6
movzx eax, word [rcx + 0x18]
mov word [rbx + 0x28], ax
mov edx, 0x10b
sub ax, dx
mov edx, 0xfeff
test dx, ax
jne 0x1400de4d6
movzx eax, word [rcx + 6]
mov dword [rbx + 0x18], eax
movzx eax, word [rcx + 0x14]
add rcx, 0x18
add rcx, rax
mov qword [rbx + 0x20], rcx
xor eax, eax
jmp 0x1400de567
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400de7e0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r15
sub rsp, 0x1d0
xor r15d, r15d
mov qword [r8], rdx
mov rdi, r8
mov qword [rsp + 0x20], r15
lea r8, [rsp + 0x90]
mov rsi, rdx
mov rbp, rcx
lea r9d, [r15 + 0x40]
call qword [0x140101cd0]
cmp eax, 0xc0000022
jne 0x1400de88e
mov rcx, qword [0x14015c480]
test rcx, rcx
je 0x1400de9b1
mov dword [rsp + 0x48], r15d
lea rax, [rsp + 0x90]
mov qword [rsp + 0x40], r15
xor r9d, r9d
mov qword [rsp + 0x60], rax
xor r8d, r8d
mov dword [rsp + 0x38], 0x28
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rsp + 0x78]
mov dword [rsp + 0x28], 0x999920e3
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x68], 0x40
mov qword [rsp + 0x70], r15
call qword [0x140101c48]
test eax, eax
js 0x1400de9b1
mov eax, 0x5a4d
cmp word [rsp + 0x90], ax
je 0x1400de8af
mov eax, 0xc000012f
jmp 0x1400de9b1
mov ecx, dword [rsp + 0xcc]
lea eax, [rcx - 1]
cmp eax, 0xffffffe
ja 0x1400de9dd
lea rdx, [rcx + rsi]
mov qword [rsp + 0x1f8], r14
mov r14d, ecx
mov qword [rsp + 0x20], r15
mov rcx, rbp
lea r8, [rsp + 0xd0]
mov r9d, 0xf8
call sym.ProcessHacker.exe_PhReadVirtualMemory
test eax, eax
js 0x1400de9a9
cmp dword [rsp + 0xd0], 0x4550
jne 0x1400de945
movzx eax, word [rsp + 0xe8]
mov ecx, 0x10b
mov word [rdi + 0x20], ax
sub ax, cx
mov ecx, 0xfeff
test cx, ax
jne 0x1400de945
movzx eax, word [rsp + 0xd6]
mov dword [rdi + 0x10], eax
lea edx, [rax + rax*4]
movzx eax, word [rsp + 0xe4]
lea edx, [rdx + 3]
lea edx, [rax + rdx*8]
cmp edx, 0x100000
jbe 0x1400de94c
mov eax, 0xc000007b
jmp 0x1400de9a9
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
mov r8d, edx
mov qword [rsp + 0x1f0], rbx
mov ebx, edx
mov edx, 4
call qword [0x140102040]
lea rdx, [r14 + rsi]
mov qword [rsp + 0x20], r15
mov r8, rax
mov qword [rdi + 8], rax
mov r9d, ebx
mov rcx, rbp
call sym.ProcessHacker.exe_PhReadVirtualMemory
mov ebx, eax
test eax, eax
jns 0x1400de9c5
mov r8, qword [rdi + 8]
xor edx, edx
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
call qword [0x140102038]
mov eax, ebx
mov rbx, qword [rsp + 0x1f0]
mov r14, qword [rsp + 0x1f8]
mov rbp, qword [rsp + 0x200]
add rsp, 0x1d0
pop r15
pop rdi
pop rsi
ret
movzx ecx, word [rsp + 0xe4]
add rcx, 0x18
add rcx, qword [rdi + 8]
mov qword [rdi + 0x18], rcx
xor eax, eax
jmp 0x1400de9a1
mov eax, 0xc000007b
jmp 0x1400de9b1
Function at 0x1400e2050
Capabilities:
Hash data using sha1

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x70
mov edi, dword [rcx + 0x30]
mov r14, rdx
mov eax, edi
mov rbp, rcx
and eax, 0x3f
mov esi, 0x78
cmp eax, 0x38
jae 0x1400e2087
mov esi, 0x38
sub esi, eax
mov ebx, edi
mov eax, dword [rcx + 0x2c]
lea edi, [rdi*8]
shl eax, 3
lea rcx, [rsp + 0x21]
shr ebx, 0x1d
xor edx, edx
or ebx, eax
lea eax, [rsi - 1]
movsxd r8, eax
call fcn.1400e3c20
movsxd rax, esi
lea rdx, [rsp + 0x20]
add rdx, rax
mov byte [rsp + 0x20], 0x80
mov eax, ebx
lea r8d, [rsi + 8]
shr eax, 0x10
mov ecx, ebx
and ecx, 0xff0000
or ecx, eax
mov eax, ebx
and eax, 0xff00
shr ecx, 8
shl ebx, 0x10
or eax, ebx
shl eax, 8
or ecx, eax
mov eax, edi
mov dword [rdx], ecx
mov ecx, edi
shr eax, 0x10
and ecx, 0xff0000
or ecx, eax
mov eax, edi
and eax, 0xff00
shr ecx, 8
shl edi, 0x10
or eax, edi
shl eax, 8
or ecx, eax
mov dword [rdx + 4], ecx
lea rdx, [rsp + 0x20]
mov rcx, rbp
call fcn.1400e1f70
mov ecx, dword [rbp + 0x18]
mov edx, ecx
shl edx, 0x10
mov eax, ecx
and eax, 0xff00
shr ecx, 8
or edx, eax
and ecx, 0xff00
movzx eax, byte [rbp + 0x1b]
shl edx, 8
or edx, ecx
or edx, eax
mov dword [r14], edx
mov ecx, dword [rbp + 0x1c]
mov edx, ecx
shl edx, 0x10
mov eax, ecx
and eax, 0xff00
shr ecx, 8
or edx, eax
and ecx, 0xff00
movzx eax, byte [rbp + 0x1f]
shl edx, 8
or edx, ecx
or edx, eax
mov dword [r14 + 4], edx
mov ecx, dword [rbp + 0x20]
mov edx, ecx
mov eax, ecx
shl edx, 0x10
and eax, 0xff00
shr ecx, 8
or edx, eax
shl edx, 8
and ecx, 0xff00
movzx eax, byte [rbp + 0x23]
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
or edx, ecx
mov rsi, qword [r11 + 0x20]
or edx, eax
mov rdi, qword [r11 + 0x28]
mov dword [r14 + 8], edx
mov ecx, dword [rbp + 0x24]
mov eax, ecx
and eax, 0xff00
mov edx, ecx
shl edx, 0x10
or edx, eax
shr ecx, 8
movzx eax, byte [rbp + 0x27]
and ecx, 0xff00
shl edx, 8
or edx, ecx
or edx, eax
mov dword [r14 + 0xc], edx
mov ecx, dword [rbp + 0x28]
mov eax, ecx
and eax, 0xff00
mov edx, ecx
shl edx, 0x10
or edx, eax
shr ecx, 8
movzx eax, byte [rbp + 0x2b]
and ecx, 0xff00
shl edx, 8
or edx, ecx
or edx, eax
mov dword [r14 + 0x10], edx
xor eax, eax
mov qword [rbp + 0x2c], rax
mov dword [rbp + 0x18], 0x67452301
mov dword [rbp + 0x1c], 0xefcdab89
mov dword [rbp + 0x20], 0x98badcfe
mov dword [rbp + 0x24], 0x10325476
mov dword [rbp + 0x28], 0xc3d2e1f0
mov rbp, qword [r11 + 0x18]
mov rsp, r11
pop r14
ret
Function at 0x1400e28bc
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
mov r8, rcx
mov eax, 0x5a4d
cmp word [0x140000000], ax
jne 0x1400e294d
movsxd rax, dword [0x14000003c]
lea rdx, [0x140000000]
lea rcx, [rax + rdx]
cmp dword [rcx], 0x4550
jne 0x1400e294d
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400e294d
sub r8, rdx
movzx eax, word [rcx + 0x14]
lea rdx, [rcx + 0x18]
add rdx, rax
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
mov qword [rsp], rdx
cmp rdx, r9
je 0x1400e2931
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x1400e292b
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x1400e2933
add rdx, 0x28
jmp 0x1400e2910
xor edx, edx
test rdx, rdx
jne 0x1400e293c
xor al, al
jmp 0x1400e2953
test dword [rdx + 0x24], 0x80000000
je 0x1400e2949
xor al, al
jmp 0x1400e2953
mov al, 1
jmp 0x1400e2953
xor al, al
jmp 0x1400e2953
add rsp, 0x18
ret

Function at 0x1400f0ce0
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x1400f0ab4
xor ecx, ecx
call qword [0x1401012a8]
test rax, rax
je 0x1400f0ab4
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400f0ab4
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400f0ab4
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400f0ab4
cmp dword [rcx + 0x84], 0xe
jbe 0x1400f0ab4
cmp dword [rcx + 0xf8], esi
je 0x1400f0ab4
mov ecx, r14d
call fcn.1400f0bfc
mov ecx, 2
call fcn.1400f85c8
nop
cmp byte [0x140159d50], 0
jne 0x1400f0b7e
mov r15d, 1
mov eax, r15d
xchg dword [0x140159d44], eax
test ebx, ebx
jne 0x1400f0b27
mov rdi, qword [0x140153018]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x140159d48]
cmp rcx, rax
je 0x1400f0b1e
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [sym.ProcessHacker.exe_PhDeleteCallback]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x140159d60]
jmp 0x1400f0b33
cmp ebx, r15d
jne 0x1400f0b39
lea rcx, [0x140159d78]
call fcn.1400f1240
nop
test ebx, ebx
jne 0x1400f0b50
lea rdx, [0x140102240]
lea rcx, [0x140102220]
call fcn.1400f0974
lea rdx, [0x140102250]
lea rcx, [0x140102248]
call fcn.1400f0974
movzx eax, byte [0x140159d50]
test esi, esi
cmove eax, r15d
mov byte [0x140159d50], al
jmp 0x1400f0b7e
mov ecx, 2
call fcn.1400f861c
test esi, esi
jne 0x1400f0b95
mov ecx, r14d
call fcn.1400f0bb0
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x1400f0a44
Function at 0x1400010d0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub rsp, 0x38
lea rax, [rsp + 0x50]
lea rdx, str.SYSTEMControlSet001ControlSession_ManagerPower
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x48], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x40], 0
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140001182
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x48]
lea rdx, str.HiberbootEnabled
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp dword [rsp + 0x40], 1
jne 0x140001177
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
lea rdx, str.HiberbootEnabled
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x40], 0
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x38
ret

Function at 0x140001230
Capabilities:
Check os version
Create thread

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x1a0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov rdi, rcx
mov rbp, r8
mov rsi, rdx
lea rcx, [rsp + 0x70]
xor ebx, ebx
xor edx, edx
mov r8d, 0x114
mov qword [rsp + 0x60], rbx
call sub.MSVCR90.dll_memset
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x70], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x74], 6
jb 0x1400012ee
lea rcx, [0x140004350]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x140004390]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400012ea
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], ebx
lea rcx, [rsp + 0x60]
mov r9, rdi
xor r8d, r8d
mov edx, 0x1fffff
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rsi
call rax
mov rax, qword [rsp + 0x60]
test rax, rax
jne 0x140001317
xor eax, eax
jmp 0x14000132b
mov qword [rsp + 0x30], rbx
mov r9, rsi
xor r8d, r8d
xor edx, edx
mov rcx, rdi
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [rsp + 0x60], rax
test rax, rax
je 0x14000132b
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
setne bl
mov eax, ebx
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.140002890
mov rbx, qword [rsp + 0x1d8]
add rsp, 0x1a0
pop rdi
pop rsi
pop rbp
ret
Function at 0x140001590
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x270
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edx, edx
mov rsi, r8
mov dword [rsp + 0x20], 0x238
lea ecx, [rdx + 0xf]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1400015d4
xor eax, eax
jmp 0x140001657
lea rdx, [rsp + 0x20]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x140001649
mov qword [rsp + 0x280], rdi
nop dword [rax]
mov edi, dword [rsp + 0x28]
lea rdx, [0x140004408]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.MSVCR90.dll__wcsicmp]
test eax, eax
je 0x14000161d
lea rdx, [rsp + 0x20]
mov rcx, rbx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x1400015f0
jmp 0x140001641
cmp dword [0x1400069e4], 0
je 0x140001637
call fcn.1400010d0
mov rdx, rsi
mov ecx, edi
call fcn.140001470
jmp 0x140001641
mov rdx, rsi
mov ecx, edi
call fcn.140001350
mov rdi, qword [rsp + 0x280]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140002890
mov rbx, qword [rsp + 0x288]
add rsp, 0x270
pop rsi
ret

Function at 0x140001680
Capabilities:
Get common file path

Disassembly:
push rdi
sub rsp, 0x240
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x230], rax
xor eax, eax
lea rcx, [rsp + 0x22]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x20], ax
call sub.MSVCR90.dll_memset
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x20]
lea r8, [rsp + 0x20]
xor edx, edx
repne scasw ax, word [rdi]
mov eax, dword [0x1400043d8]
or rcx, 0xffffffffffffffff
mov dword [rdi - 2], eax
xor eax, eax
lea rdi, [rsp + 0x20]
repne scasw ax, word [rdi]
mov rax, qword [0x1400043e0]
lea rcx, [0x140004408]
mov qword [rdi - 2], rax
mov rax, qword [0x1400043e8]
mov qword [rdi + 6], rax
mov rax, qword [0x1400043f0]
mov qword [rdi + 0xe], rax
mov rax, qword [0x1400043f8]
mov qword [rdi + 0x16], rax
call fcn.140001590
xor eax, eax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140002890
add rsp, 0x240
pop rdi
ret
Function at 0x140001750
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x380
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x370], rax
mov rax, qword [str.SYSTEMControlSet001_servicesV3_Service]
mov rbx, rcx
lea rcx, [rsp + 0x150]
mov qword [rcx], rax
mov rax, qword [0x140004440]
xor edx, edx
mov qword [rcx + 8], rax
mov rax, qword [0x140004448]
mov r8d, 0xda
mov qword [rcx + 0x10], rax
mov rax, qword [0x140004450]
xor edi, edi
mov qword [rcx + 0x18], rax
mov rax, qword [0x140004458]
mov qword [rcx + 0x20], rax
movzx eax, word [0x140004460]
mov word [rcx + 0x28], ax
lea rcx, [rsp + 0x17a]
call sub.MSVCR90.dll_memset
lea r11, [rsp + 0x38]
lea rdx, [rsp + 0x150]
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400018a3
lea rdx, [rsp + 0x260]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rcx, [rsp + 0x41]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x40], dil
call sub.MSVCR90.dll_memset
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
lea rdx, str.ImagePath
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], 0x104
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400018a3
lea edx, [rdi + 0x22]
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCR90.dll_strrchr]
test rax, rax
je 0x14000187d
mov byte [rax], dil
lea rax, [rsp + 0x41]
lea rcx, [rsp + 0x41]
sub rbx, rax
nop word [rax + rax]
movzx eax, byte [rcx]
inc rcx
mov byte [rbx + rcx - 1], al
test al, al
jne 0x140001890
mov edi, 1
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400018b3
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rcx, qword [rsp + 0x370]
xor rcx, rsp
call fcn.140002890
mov rbx, qword [rsp + 0x398]
add rsp, 0x380
pop rdi
ret