joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001d14
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rbx, rcx
mov dword [rbp - 0x20], 0x74004e
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x1c], 0x650053
mov rsi, r8
mov dword [rbp - 0x18], 0x450074
mov r14, rdx
mov dword [rbp - 0x14], 0x460061
mov dword [rbp - 0x10], 0x6c0069
mov dword [rbp - 0xc], 0x65
call fcn.1400035a4
mov rdi, rax
test rax, rax
jne 0x140001d7a
mov eax, 0xc0000225
jmp 0x140001db3
mov rcx, qword [rbx]
mov r8, rsi
mov qword [rbp - 0x2e], r14
mov rdx, rdi
mov r14d, 0xc
mov word [rbp - 0x30], 0xb848
mov r9d, r14d
mov word [rbp - 0x26], 0xe0ff
call qword [rbx + 8]
test eax, eax
js 0x140001db3
mov rcx, qword [rbx]
lea r8, [rbp - 0x30]
mov r9d, r14d
mov rdx, rdi
call qword [rbx + 0x10]
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x140001dd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rbx, rcx
mov dword [rbp - 0x20], 0x74004e
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x1c], 0x650053
mov rdi, rdx
mov dword [rbp - 0x18], 0x450074
mov dword [rbp - 0x14], 0x460061
mov dword [rbp - 0x10], 0x6c0069
mov dword [rbp - 0xc], 0x65
call fcn.1400035a4
test rax, rax
jne 0x140001e2c
mov eax, 0xc0000225
jmp 0x140001e3e
mov rcx, qword [rbx]
mov r9d, 0xc
mov r8, rdi
mov rdx, rax
call qword [rbx + 0x10]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret

Function at 0x140001e54
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rdi, rcx
mov dword [rbp - 0x20], 0x780045
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x1c], 0x6c0041
mov rsi, rdx
mov dword [rbp - 0x18], 0x6f006c
mov dword [rbp - 0x14], 0x610063
xor ebx, ebx
mov dword [rbp - 0x10], 0x650074
mov dword [rbp - 0xc], 0x6f0050
mov dword [rbp - 8], 0x6c006f
mov dword [rbp - 4], 0x32
call fcn.1400035a4
lea r8, [rbp - 0x30]
mov rdx, rax
mov rcx, rdi
call fcn.140001d14
test eax, eax
js 0x140001eea
mov r8d, 0x656e6f4e
mov rdx, rsi
mov ecx, pe_nt_image_headers64
call qword [0x140005248]
lea rdx, [rbp - 0x30]
mov rcx, rdi
mov rbx, rax
call fcn.140001dd0
mov rsi, qword [rsp + 0x68]
mov rax, rbx
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
add rsp, 0x50
pop rbp
ret
Function at 0x140001f04
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rbx, rcx
mov dword [rbp - 0x30], 0x780045
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], 0x720046
mov rdi, rdx
mov dword [rbp - 0x28], 0x650065
mov dword [rbp - 0x24], 0x6f0050
mov dword [rbp - 0x20], 0x6c006f
mov dword [rbp - 0x1c], 0x690057
mov dword [rbp - 0x18], 0x680074
mov dword [rbp - 0x14], 0x610054
mov dword [rbp - 0x10], 0x67
call fcn.1400035a4
lea r8, [rbp - 0x40]
mov rdx, rax
mov rcx, rbx
call fcn.140001d14
test eax, eax
js 0x140001f96
mov edx, 0x656e6f4e
mov rcx, rdi
call qword [0x140005248]
lea rdx, [rbp - 0x40]
mov rcx, rbx
call fcn.140001dd0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret

Function at 0x1400032e4
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x40
mov dword [rax + 0x10], 8
mov rbp, rcx
mov rax, qword gs:[0x30]
mov edx, 8
mov r8d, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [0x1400051b0]
xor edi, edi
mov rsi, rax
mov r8d, dword [rsp + 0x58]
lea r9, [rsp + 0x58]
mov rdx, rsi
mov ecx, 0xb
mov rbx, rsi
call qword [0x140005208]
cmp eax, 0xc0000004
jne 0x140003387
mov rax, qword gs:[0x30]
mov r8, rsi
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [0x1400051c0]
mov rax, qword gs:[0x30]
mov edx, 8
mov r8d, dword [rsp + 0x58]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [0x1400051b0]
jmp 0x140003323
test eax, eax
jne 0x140003326
mov rdx, rbp
lea rcx, [rsp + 0x20]
call qword [0x1400051e0]
mov esi, edi
cmp dword [rbx], edi
jbe 0x1400033e6
mov eax, esi
lea rcx, [rsp + 0x30]
imul rbp, rax, 0x128
movzx edx, word [rbx + rbp + 0x2e]
add rdx, 0x30
add rdx, rbp
add rdx, rbx
call qword [0x1400051e0]
mov r8b, 1
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call qword [0x140005200]
cmp al, 1
je 0x1400033e1
inc esi
cmp esi, dword [rbx]
jb 0x14000339f
jmp 0x1400033e6
mov rdi, qword [rbx + rbp + 0x18]
mov rcx, qword gs:[0x30]
mov r8, rbx
xor edx, edx
mov rcx, qword [rcx + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [0x1400051c0]
mov rbx, qword [rsp + 0x50]
mov rax, rdi
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x14000346c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rbx, rcx
mov dword [rbp - 0x20], 0x74006e
xor edi, edi
mov dword [rbp - 0x1c], 0x73006f
lea rcx, [rbp - 0x30]
mov word [rbp - 8], di
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x18], 0x72006b
mov dword [rbp - 0x14], 0x6c006e
mov dword [rbp - 0x10], 0x65002e
mov dword [rbp - 0xc], 0x650078
call qword [0x140005290]
lea r9, [rbp + 0x18]
xor edx, edx
lea r8, [rbp - 0x30]
xor ecx, ecx
call qword [0x1400051f0]
mov edx, 0xc0000000
mov ecx, eax
and ecx, edx
cmp ecx, edx
jne 0x140003537
mov ecx, eax
call qword [0x140005268]
mov qword [rsp + 0x30], rdi
xor edx, edx
mov r8d, eax
mov dword [rsp + 0x28], edi
lea rax, [rbp + 0x20]
mov ecx, 0x1300
mov r9d, 0x400
mov qword [rsp + 0x20], rax
call qword [section..rdata]
mov r9, qword [rbp + 0x20]
lea r8d, [rdi + 0x58]
lea rdx, str.GetSystemRoutineAddressA
lea rcx, str._____hs__u_:__ws
call fcn.140001008
mov rcx, qword [rbp + 0x20]
call qword [0x140005010]
xor eax, eax
jmp 0x140003592
mov rcx, qword [rbp + 0x18]
mov rdx, rbx
call qword [0x140005210]
mov rcx, qword [rbp + 0x18]
mov rbx, rax
call qword [0x1400051f8]
test rbx, rbx
je 0x14000358f
sub rbx, qword [rbp + 0x18]
lea rcx, [rbp - 0x20]
call fcn.14000341c
lea rcx, [rbp - 0x20]
add rbx, rax
call fcn.14000341c
test rax, rax
jne 0x14000358f
xor r9d, r9d
lea r8d, [rax + 0x62]
lea rdx, str.E:ProjectUCMapperUCMapper_routine.c
lea rcx, str.GetSystemModuleBaseW_moduleName____0
call qword [0x140005220]
mov rax, rbx
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret

Function at 0x140003d2c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [0x140005028]
test rax, rax
je 0x140003d76
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140003d76
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140003d76
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140003d76
cmp dword [rcx + 0x84], 0xe
jbe 0x140003d76
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140003d78
xor al, al
add rsp, 0x28
ret
Function at 0x140165f06
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
sar r10, cl
mov qword [rsp + 0x10], rdi
shrd r9w, r10w, 0x92
xor edi, edi
movzx ebx, r8b
movsx r8, bp
movzx r11w, r8b
mov r11, rcx
not r10w
mov r8, rdi
nop
xchg r10w, r9w
inc r9
movsx r10, di
movzx r9d, byte [r11]
movsx r10w, bpl
movzx r10d, byte [rdx]
jmp 0x140165f50
inc r11
jmp 0x140165f58
inc rdx
jmp 0x140165f68
test bl, bl
jmp 0x140165f6f
je 0x140165fa6
mov ecx, r8d
btr ax, 0x1c
ror ah, cl
mov eax, 0x243dd499
cmc
clc
rol eax, cl
cmp r14b, 0x91
cmp eax, r11d
add al, r8b
test dl, r10b
test al, 7
xor r9b, al
inc r8
cmp r9w, 0xb88
cmp dl, bpl
test r9b, r9b
jmp 0x140165fae
je 0x140165fbd
cmp r9b, r10b
je 0x140165f3e
cmp r9b, r10b
jmp 0x140165fc5
jae 0x140165fe4
or eax, 0xffffffff
movsx rbx, r12w
movzx di, cl
mov rbx, qword [rsp + 8]
movsx edi, dx
mov rdi, qword [rsp + 0x10]
ret
mov rbx, qword [rsp + 8]
movsx ax, r10b
seta dil
mov al, r14b
mov eax, edi
mov rdi, qword [rsp + 0x10]
jmp 0x140166001
ret
Function at 0x140034810
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
movsxd rax, dword [0x1400750b0]
cmp eax, 0xe
ja case.default.0x140034837
lea rdx, [0x140000000]
mov ecx, dword [rdx + rax*4 + 0x348ec]
add rcx, rdx
jmp rcx
mov ecx, 2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x14003486d
mov rbx, qword [0x140075be0]
xorps xmm0, xmm0
mov rdx, rbx
movups xmmword [rbx], xmm0
mov ecx, dword [rbx + 0x10]
call qword [sym.imp.XINPUT1_4.dll_Ordinal_2]
mov rax, qword [rbx]
shr rax, 0x30
test al, al
je case.default.0x140034837
mov al, 1
add rsp, 0x20
pop rbx
ret
mov ecx, 1
jmp 0x14003483e
mov ecx, 5
jmp 0x14003483e
mov ecx, 6
jmp 0x14003483e
mov ecx, 0x14
jmp 0x14003483e
mov ecx, 0x10
jmp 0x14003483e
mov ecx, 0x11
jmp 0x14003483e
mov ecx, 0xa4
jmp 0x14003483e
mov ecx, 0x51
jmp 0x14003483e
mov ecx, 0x5a
jmp 0x14003483e
mov ecx, 0x58
jmp 0x14003483e
mov ecx, 0x43
jmp 0x14003483e
mov ecx, 0x56
jmp 0x14003483e
mov ecx, 0x46
jmp 0x14003483e
mov ecx, 0x47
jmp 0x14003483e
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x140042bc4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140042c0e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140042c0e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140042c0e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140042c0e
cmp dword [rcx + 0x84], 0xe
jbe 0x140042c0e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140042c10
xor al, al
add rsp, 0x28
ret
Function at 0x140008660
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rdx
mov rdx, rcx
mov rcx, rax
jmp 0x140011ab0
mov rax, qword gs:[0x30]
mov r10, rcx
mov r8, qword [rax + 0x60]
mov r9, qword [r8 + 0x18]
add r9, 0x20
mov rax, qword [r9]
nop dword [rax + rax]
cmp qword [rax + 0x20], rdx
je 0x140011aed
test rdx, rdx
je 0x140011aed
mov rax, qword [rax]
cmp rax, r9
jne 0x140011ad0
mov qword [rcx], 0
xor eax, eax
ret
mov rcx, qword [rax + 0x40]
mov qword [r10], rcx
movzx eax, word [rax + 0x38]
shr eax, 1
ret
Function at 0x1400093d0
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
and rsp, 0xfffffffffffffff0
xor r8, r8
push r8
push rax
pushfq
push r8
push rdx
sub rsp, 0xa8
push r8
push r15
push r14
push r13
push r12
push rbx
push r8
push rsi
push rdi
push rbp
push rax
push rdx
sub rsp, 0x280
movdqa xmmword [rsp + 0x2e0], xmm6
movdqa xmmword [rsp + 0x2f0], xmm7
movdqa xmmword [rsp + 0x300], xmm8
movdqa xmmword [rsp + 0x310], xmm9
movdqa xmmword [rsp + 0x320], xmm10
movdqa xmmword [rsp + 0x330], xmm11
movdqa xmmword [rsp + 0x340], xmm12
movdqa xmmword [rsp + 0x350], xmm13
movdqa xmmword [rsp + 0x360], xmm14
movdqa xmmword [rsp + 0x370], xmm15
mov eax, dword [0x140bcab18]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x30
add rax, rbx
lea rdx, [rsp + 0x20]
xor r8, r8
mov qword [rdx + 0x10], r8
mov byte [rdx + 0x19], 1
mov dword [rdx + 0x1c], 0xffffffff
mov byte [rdx + 0x18], 2
mov r8, qword [rax + 0x80]
mov qword [rdx], r8
mov qword [rax + 0x80], rdx
lea r8, [rsp + 0x280]
mov qword [rdx + 8], r8
call fcn.140200f20
int3
push r15
push r14
push r13
push r12
push rbx
push rsi
push rdi
push rbp
sub rsp, 0xd8
movdqa xmmword [rsp + 0x20], xmm6
movdqa xmmword [rsp + 0x30], xmm7
movdqa xmmword [rsp + 0x40], xmm8
movdqa xmmword [rsp + 0x50], xmm9
movdqa xmmword [rsp + 0x60], xmm10
movdqa xmmword [rsp + 0x70], xmm11
movdqa xmmword [rsp + 0x80], xmm12
movdqa xmmword [rsp + 0x90], xmm13
movdqa xmmword [rsp + 0xa0], xmm14
movdqa xmmword [rsp + 0xb0], xmm15
mov qword [rsp + 0x120], rcx
mov qword [rsp + 0x128], rdx
mov qword [rsp + 0x130], r8
mov qword [rsp + 0x138], r9
mov eax, dword [0x140bcab18]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x30
add rax, rbx
mov qword [rsp + 0xc0], rax
cmp rcx, qword [rax + 0x88]
sete byte [rsp + 0xd0]
lock and dword [rax + 0x38], 0xffffffef
mov rax, qword [r8 + 0x18]
mov rbx, qword [rax]
mov rax, qword [r8 + 0x20]
mov rbp, qword [rax]
mov rax, qword [r8 + 0x28]
mov rsi, qword [rax]
mov rax, qword [r8 + 0x30]
mov rdi, qword [rax]
mov rax, qword [r8 + 0x58]
mov r12, qword [rax]
mov rax, qword [r8 + 0x60]
mov r13, qword [rax]
mov rax, qword [r8 + 0x68]
mov r14, qword [rax]
mov rax, qword [r8 + 0x70]
mov r15, qword [rax]
movdqa xmm6, xmmword [r8 + 0x90]
movdqa xmm7, xmmword [r8 + 0xa0]
movdqa xmm8, xmmword [r8 + 0xb0]
movdqa xmm9, xmmword [r8 + 0xc0]
movdqa xmm10, xmmword [r8 + 0xd0]
movdqa xmm11, xmmword [r8 + 0xe0]
movdqa xmm12, xmmword [r8 + 0xf0]
movdqa xmm13, xmmword [r8 + 0x100]
movdqa xmm14, xmmword [r8 + 0x110]
movdqa xmm15, xmmword [r8 + 0x120]
mov rcx, qword [r8 + 0x78]
mov rdx, qword [rsp + 0x120]
call qword [rsp + 0x128]
mov r8, qword [rsp + 0x130]
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rdx + 0x70]
cmp rcx, 0
je 0x140009560
mov r9, qword [rdx + 0x68]
mov qword [r9], rcx
mov qword [rdx + 0x68], 0
mov qword [rdx + 0x70], 0
mov rcx, qword [rsp + 0x138]
mov r8, qword [r8 + 0x78]
xor r9d, r9d
mov rcx, qword [rcx]
cmp rcx, r9
je 0x14000957c
cmp rcx, r8
jl 0x14000956f
mov qword [rdx + 0x80], rcx
test dword [0x140bc09d8], 1
je 0x1400095ab
cmp byte [rsp + 0xd0], 0
je 0x1400095ab
mov rcx, 0x43
mov rdx, rax
mov rsp, r8
jmp 0x1400090d0
mov rsp, r8
jmp rax
Function at 0x1400095b0
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rbx
push rsi
push rdi
push rbp
sub rsp, 0xc8
movdqa xmmword [rsp + 0x20], xmm6
movdqa xmmword [rsp + 0x30], xmm7
movdqa xmmword [rsp + 0x40], xmm8
movdqa xmmword [rsp + 0x50], xmm9
movdqa xmmword [rsp + 0x60], xmm10
movdqa xmmword [rsp + 0x70], xmm11
movdqa xmmword [rsp + 0x80], xmm12
movdqa xmmword [rsp + 0x90], xmm13
movdqa xmmword [rsp + 0xa0], xmm14
movdqa xmmword [rsp + 0xb0], xmm15
mov qword [rsp + 0x110], rcx
mov qword [rsp + 0x118], rdx
mov eax, dword [0x140bcab18]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x30
add rax, rbx
mov qword [rsp + 0xc0], rax
lock and dword [rax + 0x38], 0xffffffef
mov rax, qword [rdx + 0x18]
mov rbx, qword [rax]
mov rax, qword [rdx + 0x20]
mov rbp, qword [rax]
mov rax, qword [rdx + 0x28]
mov rsi, qword [rax]
mov rax, qword [rdx + 0x30]
mov rdi, qword [rax]
mov rax, qword [rdx + 0x58]
mov r12, qword [rax]
mov rax, qword [rdx + 0x60]
mov r13, qword [rax]
mov rax, qword [rdx + 0x68]
mov r14, qword [rax]
mov rax, qword [rdx + 0x70]
mov r15, qword [rax]
movdqa xmm6, xmmword [rdx + 0x90]
movdqa xmm7, xmmword [rdx + 0xa0]
movdqa xmm8, xmmword [rdx + 0xb0]
movdqa xmm9, xmmword [rdx + 0xc0]
movdqa xmm10, xmmword [rdx + 0xd0]
movdqa xmm11, xmmword [rdx + 0xe0]
movdqa xmm12, xmmword [rdx + 0xf0]
movdqa xmm13, xmmword [rdx + 0x100]
movdqa xmm14, xmmword [rdx + 0x110]
movdqa xmm15, xmmword [rdx + 0x120]
mov rcx, qword [rdx + 0x78]
call qword [rsp + pe_nt_image_headers64]
mov rdx, qword [rsp + 0x118]
mov rax, qword [rdx + 0x18]
mov qword [rax], rbx
mov rax, qword [rdx + 0x20]
mov qword [rax], rbp
mov rax, qword [rdx + 0x28]
mov qword [rax], rsi
mov rax, qword [rdx + 0x30]
mov qword [rax], rdi
mov rax, qword [rdx + 0x58]
mov qword [rax], r12
mov rax, qword [rdx + 0x60]
mov qword [rax], r13
mov rax, qword [rdx + 0x68]
mov qword [rax], r14
mov rax, qword [rdx + 0x70]
mov qword [rax], r15
movdqa xmmword [rdx + 0x90], xmm6
movdqa xmmword [rdx + 0xa0], xmm7
movdqa xmmword [rdx + 0xb0], xmm8
movdqa xmmword [rdx + 0xc0], xmm9
movdqa xmmword [rdx + 0xd0], xmm10
movdqa xmmword [rdx + 0xe0], xmm11
movdqa xmmword [rdx + 0xf0], xmm12
movdqa xmmword [rdx + 0x100], xmm13
movdqa xmmword [rdx + 0x110], xmm14
movdqa xmmword [rdx + 0x120], xmm15
mov rax, qword [rsp + 0xc0]
lock or dword [rax + 0x38], 0x10
movdqa xmm6, xmmword [rsp + 0x20]
movdqa xmm7, xmmword [rsp + 0x30]
movdqa xmm8, xmmword [rsp + 0x40]
movdqa xmm9, xmmword [rsp + 0x50]
movdqa xmm10, xmmword [rsp + 0x60]
movdqa xmm11, xmmword [rsp + 0x70]
movdqa xmm12, xmmword [rsp + 0x80]
movdqa xmm13, xmmword [rsp + 0x90]
movdqa xmm14, xmmword [rsp + 0xa0]
movdqa xmm15, xmmword [rsp + 0xb0]
add rsp, 0xc8
pop rbp
pop rdi
pop rsi
pop rbx
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140011430
Capabilities:
Resume thread
Suspend thread

Disassembly:
cmp qword [rcx + 0x60], 0xffffffffffffffff
je 0x1400075a7
mov eax, dword [rcx + 0x38]
shr eax, 5
test al, 1
jne 0x1400075a7
mov eax, dword [rcx + 0x38]
shr eax, 7
test al, 1
jne 0x1400075a7
mov rdx, rcx
mov rcx, qword [rcx + 0x60]
jmp 0x140011430
ret
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x630
mov rax, qword [0x140bb0180]
xor rax, rsp
mov qword [rsp + 0x620], rax
mov rax, qword [0x140baef10]
xor r14d, r14d
mov rbx, rdx
mov rdi, rcx
cmp rax, 0xffffffffffffffff
jne 0x140011574
xor edx, edx
lea rcx, str.kernel32
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
lea rdx, str.IsWow64Process2
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
test rax, rax
je 0x14001155d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x24]
call rsi
test eax, eax
je 0x14001155d
mov eax, 0xaa64
cmp word [rsp + 0x20], ax
jne 0x14001155d
xor edx, edx
mov dword [rsp + 0x30], 0x11c
mov r8d, 0x100
mov qword [rsp + 0x3c], r14
lea rcx, [rsp + 0x44]
call fcn.1400ad260
xor eax, eax
mov word [rsp + 0x146], r14w
mov r8b, 3
mov dword [rsp + 0x148], eax
xor ecx, ecx
lea edx, [rax + 2]
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov r8b, 3
lea edx, [r14 + 1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov r8b, 3
lea edx, [r14 + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov ecx, 0x65f4
mov qword [rsp + 0x34], 0xa
mov word [rsp + 0x144], cx
lea edx, [r14 + 0x23]
lea rcx, [rsp + 0x30]
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
je 0x1400115ce
lea rdx, str.QueueUserAPC2
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140baef10], rax
test rax, rax
je 0x1400115d5
mov rcx, rbx
call fcn.1400078a0
test al, al
jne 0x140011639
mov dl, 1
mov rcx, rbx
call fcn.140007900
mov r9d, 0x10001
lea rcx, [0x1400110d0]
mov r8, rbx
mov rdx, rdi
call qword [0x140baef10]
test eax, eax
jne 0x140011639
xor edx, edx
mov rcx, rbx
call fcn.140007900
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
je 0x1400115ce
cmp eax, 0x32
jne 0x140011639
mov qword [0x140baef10], r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x140011639
lea rdx, [rsp + 0x150]
mov dword [rsp + 0x180], 0x40100003
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x140011630
mov ecx, dword [rsp + 0x180]
mov eax, ecx
shr eax, 0x1f
test ecx, ecx
jns 0x14001161b
test ecx, 0x18000000
jne 0x140011630
test al, al
je 0x140011630
mov rdx, rbx
lea rcx, [rsp + 0x150]
call qword [0x140bc0a60]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsp + 0x620]
xor rcx, rsp
call fcn.1400a8850
lea r11, [rsp + 0x630]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1400117d0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rcx + rbx], 0
jne 0x1400117e4
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], 0
mov rcx, rax
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x140011890
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
xor eax, eax
mov r9, rdx
mov r8, rcx
mov qword [rsp + 0x28], rax
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
jne 0x1400118b9
add rsp, 0x38
ret
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
add rsp, 0x38
ret

Function at 0x1400118d0
Capabilities:
Create thread
Resume thread

Disassembly:
push rbx
sub rsp, 0x30
mov r9, rdx
mov qword [rsp + 0x28], 0
mov r8, rcx
mov dword [rsp + 0x20], 4
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
test rax, rax
jne 0x140011905
add rsp, 0x30
pop rbx
ret
mov edx, 2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
add rsp, 0x30
pop rbx
ret

Function at 0x140012be0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0xe0
mov rax, qword [0x140bb0180]
xor rax, rsp
mov qword [rsp + 0xd0], rax
movzx ebx, r8b
mov rdi, rdx
mov r8d, 0x40
lea rdx, [rsp + 0x50]
call fcn.140012810
mov r8d, select
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x50]
call sub.KERNEL32.dll_GetEnvironmentVariableW
mov r11d, eax
lea ecx, [rax - 1]
cmp ecx, 0xf
ja 0x140012ca8
xor ecx, ecx
mov r9d, ecx
test eax, eax
je 0x140012ca1
lea r10, [rsp + 0x20]
movzx r8d, word [r10]
lea eax, [r8 - 0x30]
test bl, bl
je 0x140012c64
cmp ax, 9
ja 0x140012ca8
lea rcx, [rcx + rcx*4]
lea rcx, [rcx - 0x18]
lea rcx, [r8 + rcx*2]
jmp 0x140012c95
shl rcx, 4
cmp ax, 9
ja 0x140012c74
add rcx, 0xffffffffffffffd0
jmp 0x140012c92
lea eax, [r8 - 0x61]
cmp ax, 5
ja 0x140012c84
add rcx, 0xffffffffffffffa9
jmp 0x140012c92
lea eax, [r8 - 0x41]
cmp ax, 5
ja 0x140012ca8
add rcx, 0xffffffffffffffc9
add rcx, r8
inc r9d
add r10, 2
cmp r9d, r11d
jb 0x140012c44
mov qword [rdi], rcx
mov al, 1
jmp 0x140012caa
xor al, al
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.1400a8850
mov rbx, qword [rsp + 0x100]
add rsp, 0xe0
pop rdi
ret
Function at 0x1400172a0
Capabilities:
Get memory capacity

Disassembly:
mov qword [rsp + 8], rbx
push rsi
push rdi
push r14
sub rsp, 0xc0
mov rax, qword [0x140bb0180]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rsi, r9
mov rbx, r8
mov r14, rdx
mov rdi, rcx
test rcx, rcx
je 0x14001738f
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8d, 0x48
lea rdx, [rsp + 0x60]
mov rcx, rax
call sub.KERNEL32.dll_K32GetProcessMemoryInfo
test eax, eax
je 0x14001738f
mov rdx, qword [rsp + 0x70]
test r14, r14
je 0x14001736a
xorps xmm0, xmm0
test rdx, rdx
js 0x140017311
cvtsi2ss xmm0, rdx
jmp 0x140017329
mov rax, rdx
mov rcx, rdx
shr rcx, 1
and eax, 1
or rcx, rax
cvtsi2ss xmm0, rcx
addss xmm0, xmm0
cvtps2pd xmm1, xmm0
xorps xmm0, xmm0
mulsd xmm1, qword [0x140b08448]
test rdi, rdi
js 0x140017343
cvtsi2ss xmm0, rdi
jmp 0x14001735b
mov rax, rdi
mov rcx, rdi
shr rcx, 1
and eax, 1
or rcx, rax
cvtsi2ss xmm0, rcx
addss xmm0, xmm0
cvtps2pd xmm0, xmm0
divsd xmm1, xmm0
cvttsd2si rax, xmm1
mov dword [r14], eax
xor eax, eax
test rbx, rbx
je 0x140017381
cmp rdx, rdi
jbe 0x14001737b
mov qword [rbx], rax
jmp 0x140017381
sub rdi, rdx
mov qword [rbx], rdi
test rsi, rsi
je 0x140017458
jmp 0x140017455
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rdx, qword [rsp + 0x48]
cmp rdx, qword [rsp + 0x28]
jae 0x140017432
test r14, r14
je 0x140017421
mov rcx, rdx
xorps xmm0, xmm0
sub rcx, qword [rsp + 0x50]
js 0x1400173cb
cvtsi2ss xmm0, rcx
jmp 0x1400173e0
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
cvtps2pd xmm1, xmm0
xorps xmm0, xmm0
mulsd xmm1, qword [0x140b08448]
test rdx, rdx
js 0x1400173fa
cvtsi2ss xmm0, rdx
jmp 0x140017412
mov rax, rdx
mov rcx, rdx
shr rcx, 1
and eax, 1
or rcx, rax
cvtsi2ss xmm0, rcx
addss xmm0, xmm0
cvtps2pd xmm0, xmm0
divsd xmm1, xmm0
cvttsd2si rax, xmm1
mov dword [r14], eax
test rbx, rbx
je 0x140017429
mov qword [rbx], rdx
test rsi, rsi
je 0x140017458
xor eax, eax
jmp 0x140017455
test r14, r14
je 0x14001743e
mov eax, dword [rsp + 0x24]
mov dword [r14], eax
test rbx, rbx
je 0x14001744b
mov rax, qword [rsp + 0x30]
mov qword [rbx], rax
test rsi, rsi
je 0x140017458
mov rax, qword [rsp + 0x40]
mov qword [rsi], rax
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1400a8850
mov rbx, qword [rsp + 0xe0]
add rsp, 0xc0
pop r14
pop rdi
pop rsi
ret