joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001000
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x18], r8
push rdi
sub rsp, 0x60
cmp rcx, qword [0x140005030]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov edi, r9d
mov rsi, rdx
movups xmmword [rsp + 0x40], xmm0
mov rbx, rcx
movups xmmword [rsp + 0x50], xmm0
je 0x140001061
lea rdx, [0x140005028]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jne 0x1400010e5
mov rcx, qword [0x140005028]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov qword [0x140005030], rbx
mov rcx, qword [0x140005028]
lea rdx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov eax, dword [rsp + 0x90]
lea r9, [rsp + 0x80]
xor r8d, r8d
mov dword [rsp + 0x28], eax
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x70], rsi
mov dword [rsp + 0x20], edi
lea rcx, [r8 - 1]
call qword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
mov ebx, eax
test eax, eax
js 0x1400010d8
mov r8, qword [rsp + 0x80]
xor edx, edx
mov rcx, qword [rsp + 0x70]
call fcn.140003840
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x70]
mov qword [rdx], rcx
jmp 0x1400010e3
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov eax, ebx
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
ret
Function at 0x140001650
Capabilities:
Attach user process memory
Find process by pid
Resolve function by parsing pe exports

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r13
sub rsp, 0x50
xor ebp, ebp
mov r13, r9
cmp rcx, qword [0x140005030]
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
je 0x14000169b
lea rdx, [0x140005028]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jne 0x140001807
mov rcx, qword [0x140005028]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov qword [0x140005030], rdi
mov qword [rsp + 0x80], r12
mov edx, 0x100
mov qword [rsp + 0x88], r14
xor ecx, ecx
mov qword [rsp + 0x90], r15
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rdi, rax
test rax, rax
je 0x1400017ea
xor edx, edx
mov r8d, 0x100
mov rcx, rax
call fcn.140003840
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rbx + r8], bpl
jne 0x1400016e3
mov rdx, rbx
mov rcx, rdi
call fcn.140003580
mov rcx, qword [0x140005028]
lea rdx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov eax, 0x5a4d
cmp word [rsi], ax
jne 0x1400017ea
movsxd rax, dword [rsi + 0x3c]
mov ecx, 0x20b
cmp word [rax + rsi + 0x18], cx
jne 0x140001730
mov ecx, dword [rax + rsi + 0x88]
jmp 0x140001734
mov ecx, dword [rax + rsi + 0x78]
mov r11d, ecx
mov r8d, ebp
add r11, rsi
mov r14d, dword [r11 + 0x24]
mov r15d, dword [r11 + 0x20]
add r14, rsi
mov r12d, dword [r11 + 0x1c]
add r15, rsi
mov ebx, dword [r11 + 0x14]
add r12, rsi
test ebx, ebx
je 0x1400017cc
nop word [rax + rax]
cmp rdi, 0xffff
ja 0x14000177b
movzx r10d, r8w
mov ecx, r10d
movzx eax, di
add ecx, dword [r11 + 0x10]
cmp eax, ecx
jmp 0x1400017b5
cmp r8d, dword [r11 + 0x18]
jae 0x1400017ea
mov eax, r8d
mov r9, rdi
movzx r10d, word [r14 + rax*2]
mov eax, dword [r15 + rax*4]
add rax, rsi
sub r9, rax
nop word [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r9]
sub edx, ecx
jne 0x1400017b3
inc rax
test ecx, ecx
jne 0x1400017a0
test edx, edx
je 0x1400017c1
inc r8d
cmp r8d, ebx
jb 0x140001760
jmp 0x1400017cc
movzx eax, r10w
mov ebp, dword [r12 + rax*4]
add rbp, rsi
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
xor edx, edx
mov qword [r13], rbp
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor eax, eax
jmp 0x1400017ef
mov eax, 0xc0000001
mov r14, qword [rsp + 0x88]
mov r12, qword [rsp + 0x80]
mov r15, qword [rsp + 0x90]
add rsp, 0x50
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140001820
Capabilities:
Map section object

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
lea rbp, [rsp - 0x4f]
sub rsp, 0xe8
xor edi, edi
lea rdx, [0x140003930]
lea rcx, [rbp - 0x41]
mov qword [rbp + 0x6f], rdi
mov qword [rbp - 0x49], rdi
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [rbp - 0x41]
mov dword [rsp + 0x28], 0x20
xorps xmm0, xmm0
mov qword [rbp - 0x11], rax
lea r9, [rbp - 0x31]
mov dword [rbp - 0x21], 0x30
lea r8, [rbp - 0x21]
mov qword [rbp - 0x19], rdi
mov edx, 0x120089
mov dword [rbp - 9], 0x240
lea rcx, [rbp + 0x7f]
mov dword [rsp + 0x20], 1
movdqu xmmword [rbp - 1], xmm0
call qword [sym.imp.ntoskrnl.exe_ZwOpenFile]
test eax, eax
js 0x140001a06
mov rax, qword [rbp + 0x7f]
lea r8, [rbp - 0x21]
mov qword [rsp + 0x30], rax
lea rcx, [rbp + 0x77]
mov dword [rsp + 0x28], 0x1000000
xor r9d, r9d
mov edx, 0xf001f
mov dword [rsp + 0x20], 2
mov qword [rbp - 0x11], rdi
call qword [sym.imp.ntoskrnl.exe_ZwCreateSection]
test eax, eax
js 0x1400019fc
mov rcx, qword [rbp + 0x77]
lea rax, [rbp - 0x49]
mov dword [rsp + 0x48], 2
lea r8, [rbp + 0x6f]
mov dword [rsp + 0x40], 0x100000
lea rdx, [rdi - 1]
mov dword [rsp + 0x38], 1
xor r9d, r9d
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ntoskrnl.exe_ZwMapViewOfSection]
test eax, eax
js 0x1400019f2
mov rdx, qword [rbp + 0x6f]
mov qword [rsp + 0xe0], rbx
mov ebx, edi
mov qword [rsp + 0xd8], rsi
mov qword [rsp + 0xd0], r12
movsxd rax, dword [rdx + 0x3c]
mov qword [rsp + 0xc8], r13
mov qword [rsp + 0xb8], r15
mov esi, dword [rax + rdx + 0x78]
add rsi, rdx
mov r15d, dword [rsi + 0x1c]
mov r12d, dword [rsi + 0x20]
add r15, rdx
mov r13d, dword [rsi + 0x24]
add r12, rdx
add r13, rdx
cmp dword [rsi + 0x14], ebx
jbe 0x1400019bd
mov qword [rsp + 0xc0], r14
nop dword [rax]
mov eax, ebx
mov ecx, dword [r12 + rax*4]
movzx eax, word [r13 + rax*2]
add rcx, rdx
mov r14d, dword [r15 + rax*4]
add r14, rdx
mov rdx, qword [rbp + 0x67]
call sub.ntoskrnl.exe__stricmp
mov rdx, qword [rbp + 0x6f]
test eax, eax
je 0x1400019b0
inc ebx
cmp ebx, dword [rsi + 0x14]
jb 0x140001980
jmp 0x1400019b5
movzx edi, word [r14 + 1]
mov r14, qword [rsp + 0xc0]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwUnmapViewOfSection]
mov r15, qword [rsp + 0xb8]
mov r13, qword [rsp + 0xc8]
mov r12, qword [rsp + 0xd0]
mov rsi, qword [rsp + 0xd8]
mov rbx, qword [rsp + 0xe0]
mov rcx, qword [rbp + 0x77]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, qword [rbp + 0x7f]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, edi
add rsp, 0xe8
pop rdi
pop rbp
ret
Function at 0x140001a20
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
cmp rcx, qword [0x140005030]
xorps xmm0, xmm0
xorps xmm1, xmm1
mov rsi, r8
movups xmmword [rbp + 0x27], xmm0
mov rbx, rdx
mov rdi, rcx
movups xmmword [rbp + 0x37], xmm0
movups xmmword [rbp + 0x47], xmm0
movups xmmword [rbp - 9], xmm0
movups xmmword [rbp + 7], xmm1
movups xmmword [rbp - 0x19], xmm0
je 0x140001a95
lea rdx, [0x140005028]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jne 0x140001bc9
mov rcx, qword [0x140005028]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov qword [0x140005030], rdi
mov qword [rbp - 1], rbx
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rbx + rax], 0
jne 0x140001aa0
mov r8b, 1
mov word [rbp - 7], ax
lea rdx, [rbp - 9]
mov word [rbp - 9], ax
lea rcx, [rbp + 7]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rcx, qword [0x140005028]
lea rdx, [rbp + 0x27]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov rcx, qword [0x140005028]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessWow64Process]
test rax, rax
jne 0x140001b58
mov rcx, qword [0x140005028]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessPeb]
mov rdi, qword [rax + 0x18]
test rdi, rdi
je 0x140001bb6
mov rbx, qword [rdi + 0x10]
add rdi, 0x10
cmp rdi, rbx
je 0x140001bb6
xorps xmm0, xmm0
lea rcx, [rbp + 0x17]
movups xmmword [rbp + 0x17], xmm0
mov rdx, qword [rbx + 0x60]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
cmp word [rbx + 0x58], 0
je 0x140001b41
mov r8b, 1
lea rdx, [rbp + 0x17]
lea rcx, [rbp + 7]
call qword [sym.imp.ntoskrnl.exe_RtlEqualUnicodeString]
test al, al
jne 0x140001b4b
mov rbx, qword [rbx]
cmp rdi, rbx
jne 0x140001b10
jmp 0x140001bb6
mov rax, qword [rbx + 0x30]
mov qword [rbp - 0x19], rax
mov eax, dword [rbx + 0x40]
jmp 0x140001bb3
mov edi, dword [rax + 0xc]
test rdi, rdi
je 0x140001bb6
mov ebx, dword [rdi + 0xc]
add rdi, 0xc
cmp rdi, rbx
je 0x140001bb6
nop dword [rax]
xorps xmm0, xmm0
lea rcx, [rbp + 0x17]
movups xmmword [rbp + 0x17], xmm0
mov edx, dword [rbx + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
cmp word [rbx + 0x2c], 0
je 0x140001ba0
mov r8b, 1
lea rdx, [rbp + 0x17]
lea rcx, [rbp + 7]
call qword [sym.imp.ntoskrnl.exe_RtlEqualUnicodeString]
test al, al
jne 0x140001ba9
mov ebx, dword [rbx]
cmp rdi, rbx
jne 0x140001b70
jmp 0x140001bb6
mov eax, dword [rbx + 0x18]
mov qword [rbp - 0x19], rax
mov eax, dword [rbx + 0x20]
mov dword [rbp - 0x11], eax
lea rcx, [rbp + 0x27]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
movups xmm0, xmmword [rbp - 0x19]
xor eax, eax
movups xmmword [rsi], xmm0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140002fc0
Capabilities:
Access pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov r15, r8
mov r14, rdx
mov rbp, rcx
test rcx, rcx
je 0x140003078
call qword [sym.imp.ntoskrnl.exe_RtlImageNtHeader]
mov rdi, rax
test rax, rax
je 0x140003078
movzx edx, word [rax + 6]
lea rsi, [rax + 0x108]
mov rbx, rsi
lea rcx, [rdx + rdx*4]
lea rdx, [rsi + rcx*8]
cmp rsi, rdx
jae 0x140003078
nop word [rax + rax]
mov rdx, r14
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
mov rdx, rbx
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlCompareString]
test eax, eax
je 0x14000306a
movzx eax, word [rdi + 6]
add rbx, 0x28
lea rcx, [rax + rax*4]
lea rax, [rsi + rcx*8]
cmp rbx, rax
jb 0x140003020
jmp 0x140003078
mov eax, dword [rbx + 0xc]
mov ecx, dword [rbx + 8]
mov dword [r15], ecx
add rax, rbp
jne 0x14000307a
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x140003260
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x90]
sub rsp, 0x190
xor ebx, ebx
mov dword [rbp + 0xa0], ebx
call fcn.1400030a0
lea r8, [rbp + 0xa0]
mov rcx, rax
lea rdx, [0x140003980]
call fcn.140002fc0
mov rdi, rax
test rax, rax
je 0x14000350c
xor edx, edx
lea rcx, [rsp + 0x74]
mov r8d, 0x110
call fcn.140003840
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x70], 0x114
call qword [sym.imp.ntoskrnl.exe_RtlGetVersion]
mov eax, dword [rsp + 0x7c]
cmp eax, 0x47ba
ja 0x140003422
je 0x140003415
cmp eax, 0x3ad7
ja 0x1400033f8
je 0x14000330d
cmp eax, 0x1db1
je 0x14000339d
cmp eax, 0x2580
je 0x14000334d
cmp eax, 0x3839
jne 0x140003509
mov dword [rsp + 0x3c], 0x6520ec83
mov dword [rsp + 0x38], 0x48571824
lea r8, [rsp + 0x30]
mov dword [rsp + 0x34], 0x74894808
mov r9d, 0x13
mov dword [rsp + 0x30], 0x245c8948
mov word [rsp + 0x40], 0x8b48
mov byte [rsp + 0x42], 0x34
mov byte [rsp + 0x20], bl
jmp 0x1400034f8
mov dword [rsp + 0x30], 0x245c8948
lea r8, [rsp + 0x30]
mov dword [rsp + 0x34], 0x6c894808
mov r9d, 0x1b
mov dword [rsp + 0x38], 0x89481024
mov dword [rsp + 0x3c], 0x57182474
mov dword [rsp + 0x40], 0x20ec8348
mov dword [rsp + 0x44], 0x8bd98b48
mov word [rsp + 0x48], 0x48f2
mov byte [rsp + 0x4a], 0x8d
mov byte [rsp + 0x20], bl
jmp 0x1400034f8
mov dword [rsp + 0x30], 0x245c8948
lea r8, [rsp + 0x30]
mov dword [rsp + 0x34], 0x6c894808
mov r9d, 0x22
mov dword [rsp + 0x38], 0x89481824
mov dword [rsp + 0x3c], 0x57202474
mov dword [rsp + 0x40], 0x55415441
mov dword [rsp + 0x44], 0x57415641
mov dword [rsp + 0x48], 0x30ec8348
mov dword [rsp + 0x4c], 0x44f98b48
mov word [rsp + 0x50], 0xf28b
mov byte [rsp + 0x20], bl
jmp 0x1400034f8
cmp eax, 0x3fab
je 0x14000330d
cmp eax, 0x42ee
je 0x140003415
cmp eax, 0x4563
jne 0x140003509
mov dword [rsp + 0x3c], 0x6530ec83
jmp 0x140003315
cmp eax, 0x4a63
ja 0x140003456
je 0x140003442
sub eax, 0x47bb
je 0x140003415
sub eax, 0x2a6
je 0x140003442
cmp eax, 1
jne 0x140003509
mov word [rsp + 0x58], 0xf98b
lea r8, [rsp + 0x30]
mov r9d, 0x2a
jmp 0x1400034a3
cmp eax, 0x4a64
je 0x140003468
cmp eax, 0x55f0
jne 0x140003509
lea r8, [rsp + 0x30]
mov dword [rsp + 0x6c], 0x833f3f3f
mov r9d, 0x40
mov dword [rsp + 0x68], 0x3fe83f3f
mov dword [rsp + 0x64], 0x3f3f3f3f
mov dword [rsp + 0x60], 0x483fb23f
mov dword [rsp + 0x5c], 0x3f3f3f3f
mov dword [rsp + 0x58], 0x166f98b
mov dword [rsp + 0x30], 0x48c48b48
mov dword [rsp + 0x34], 0x483f3f89
mov dword [rsp + 0x38], 0x483f3f89
mov dword [rsp + 0x3c], 0x573f3f89
mov dword [rsp + 0x40], 0x3f3f3f48
mov dword [rsp + 0x44], 0x3f3f3f65
mov dword [rsp + 0x48], 0x3f3f3f3f
mov dword [rsp + 0x4c], 0x3f3f483f
mov dword [rsp + 0x50], 0xc6da8b3f
mov dword [rsp + 0x54], 0x483f3f40
mov byte [rsp + 0x20], 1
mov edx, dword [rbp + 0xa0]
mov rcx, rdi
call fcn.1400031d0
mov rbx, rax
mov rax, rbx
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x14000d250
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
mov rcx, qword [0x14012b378]
test rcx, rcx
je 0x14000d292
cmp byte [0x14012b380], 1
jne 0x14000d294
xor ecx, ecx
xor edx, edx
mov r8d, 0x12
xor r9d, r9d
call qword [0x14012b370]
mov rcx, qword [0x14012b378]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, qword [0x14012b378]
jmp 0x14000d294
xor ecx, ecx
call fcn.140042f50
mov qword [0x14012b378], 0
mov byte [0x14012b380], 0
add rsp, 0x28
ret
Function at 0x14002c540
Capabilities:
Check for time delay via gettickcount

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov r14, r8
mov rbx, rdx
mov edi, ecx
cmp qword [0x14012c520], 0
jne 0x14002c58d
lea rcx, [0x14002c7a0]
call fcn.1400443e0
mov qword [0x14012c520], rax
lea rcx, [0x14002c800]
call fcn.1400443e0
mov qword [0x14012c528], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x14012c518], eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x14012c518], eax
test edi, edi
mov esi, 1
cmovne esi, edi
add esi, eax
mov ecx, 1
mov edx, 0x18
xor r8d, r8d
call fcn.140042eb0
mov rdi, rax
mov qword [rax], rbx
mov qword [rax + 8], r14
mov dword [rax + 0x10], esi
mov eax, dword [0x14012c518]
mov dword [rdi + 0x14], eax
mov rcx, qword [0x14012c520]
mov rdx, rdi
call fcn.1400444c0
cmp rdi, rax
je 0x14002c5eb
mov rcx, rdi
call fcn.140042f50
jmp 0x14002c5fb
mov rdx, qword [rdi + 8]
mov rcx, qword [0x14012c528]
call fcn.1400444c0
mov rcx, qword [0x14012c520]
xor edx, edx
call fcn.140044c30
cmp rax, rdi
jne 0x14002c616
mov ecx, dword [rdi + 0x10]
call fcn.140007000
mov eax, esi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x14002ff60
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x2a8
mov r14, rcx
mov rax, qword [0x140129050]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
lea rdi, [rsp + 0x50]
mov rcx, rdi
mov edx, 0x107
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov rcx, rdi
call fcn.1400ce950
mov word [rsp + rax + 0x50], 0x2a5c
mov byte [rsp + rax + 0x52], 0
lea rdx, [rsp + 0x160]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp rax, 0xffffffffffffffff
je 0x140030000
mov rdi, rax
lea rbx, [rsp + 0x160]
mov rsi, qword [sym.imp.KERNEL32.dll_FindNextFileA]
nop word cs:[rax + rax]
nop dword [rax + rax]
mov rcx, rbx
mov edx, 0x140
call r14
mov rcx, rdi
mov rdx, rbx
call rsi
test eax, eax
jne 0x14002ffe0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x2c], eax
lea rcx, [rsp + 0x2c]
mov edx, 4
call r14
lea rcx, [rsp + 0x30]
mov edx, 0x20
call fcn.14002fe10
test al, al
je 0x140030047
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov edx, 0x20
call r14
mov edx, 0x20
mov rcx, rdi
call fcn.1400778a0
mov rcx, r14
call fcn.14003d390
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.1400b8cc0
nop
add rsp, 0x2a8
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140030070
Capabilities:
Get memory capacity

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xa8
mov rax, qword [0x140129050]
xor rax, rsp
mov qword [rsp + 0xa0], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rsp + 0x78], rax
lea rsi, [rsp + 0x78]
mov ecx, 9
mov rdx, rsi
mov r8d, 8
call fcn.14002fb40
call qword [sym.imp.USER32.dll_GetCapture]
mov qword [rsp + 0x78], rax
mov ecx, 0xa
mov rdx, rsi
mov r8d, 8
call fcn.14002fb40
call qword [sym.imp.USER32.dll_GetClipboardOwner]
mov qword [rsp + 0x78], rax
mov ecx, 0xb
mov rdx, rsi
mov r8d, 8
call fcn.14002fb40
mov ecx, 0x1cbf
call qword [sym.imp.USER32.dll_GetQueueStatus]
mov dword [rsp + 0x74], eax
lea rdx, [rsp + 0x74]
mov ecx, 0xc
mov r8d, 4
call fcn.14002fb40
lea rsi, [rsp + 0x68]
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, 0xd
mov rdx, rsi
mov r8d, 8
call fcn.14002fb40
lea rsi, [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov ecx, 6
mov rdx, rsi
mov r8d, 0x38
call fcn.14002fb40
lea rsi, [rsp + 0x98]
lea r14, [rsp + 0x90]
lea rdi, [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x20], rsi
lea rbx, [rsp + 0x80]
mov rcx, rax
mov rdx, rbx
mov r8, rdi
mov r9, r14
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
mov ecx, 0xe
mov rdx, rbx
mov r8d, 0x20
call fcn.14002fb40
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x20], rsi
mov rcx, rax
mov rdx, rbx
mov r8, rdi
mov r9, r14
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov ecx, 0xf
mov rdx, rbx
mov r8d, 0x20
call fcn.14002fb40
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1400b8cc0
nop
add rsp, 0xa8
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x1400369a0
Capabilities:
Get session user name

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov edx, 0x3a
call fcn.140040eb0
cmp byte [rax], 0
je 0x1400369c4
mov rcx, rax
add rsp, 0x20
pop rsi
jmp fcn.140049d50
mov rcx, rsi
mov edx, 0x3b
call fcn.140040c60
test al, al
je 0x1400369df
add rsp, 0x20
pop rsi
jmp fcn.140078e30
xor eax, eax
add rsp, 0x20
pop rsi
ret
Function at 0x14003c720
Capabilities:
Query or enumerate registry value

Disassembly:
test rcx, rcx
je 0x14003c72d
mov rcx, qword [rcx]
jmp fcn.140046100
xor eax, eax
ret
Function at 0x14003d390
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x440
mov rsi, rcx
mov rax, qword [0x140129050]
xor rax, rsp
mov qword [rsp + 0x438], rax
mov ecx, 1
call fcn.14003d470
cmp rax, 0xffffffffffffffff
je 0x14003d445
mov rdi, rax
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x30]
lea r9, [rsp + 0x2c]
mov rcx, rax
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14003d43c
mov edx, dword [rsp + 0x2c]
test edx, edx
je 0x14003d43c
lea rbx, [rsp + 0x30]
lea r14, [rsp + 0x2c]
mov r15, qword [sym.imp.KERNEL32.dll_ReadFile]
nop dword [rax]
mov rcx, rbx
call rsi
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov rdx, rbx
mov r8d, 0x400
mov r9, r14
call r15
test eax, eax
je 0x14003d43c
mov edx, dword [rsp + 0x2c]
test edx, edx
jne 0x14003d410
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x438]
xor rcx, rsp
call fcn.1400b8cc0
nop
add rsp, 0x440
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14003d710
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov esi, edx
mov rdi, rcx
mov rax, qword [0x140129050]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov ecx, 2
call fcn.14003d470
cmp rax, 0xffffffffffffffff
je 0x14003d764
mov rbx, rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x34]
mov rcx, rax
mov rdx, rdi
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400b8cc0
nop
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret

Function at 0x14003dbd0
Capabilities:
Check if file exists
Delete file

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rsi, r8
mov rdi, rcx
test edx, edx
je 0x14003dc2f
xor eax, eax
xor ecx, ecx
cmp edx, 2
setne al
sete cl
lea r8d, [rax + rax*2]
mov eax, 0x40000000
mov edx, 0x80000000
cmove edx, eax
mov eax, ecx
shl eax, 7
xor ecx, 3
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
mov qword [rsp + 0x30], 0
mov rcx, rdi
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsi], rax
cmp rax, 0xffffffffffffffff
setne al
jmp 0x14003dc6f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x14003dc66
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x14003dc66
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140047480
lea rcx, str.Unable_to_delete__s:__s
mov rdx, rdi
mov r8, rax
call fcn.1400071e0
mov qword [rsi], 0xffffffffffffffff
xor eax, eax
add rsp, 0x38
pop rdi
pop rsi
ret

Function at 0x140045f70
Capabilities:
Query or enumerate registry key

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov ebp, edx
mov rbx, rcx
mov rax, qword [0x140129050]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0x105
mov edi, 0x105
mov ecx, 0x105
mov edx, 1
xor r8d, r8d
call fcn.140042eb0
mov rsi, rax
mov r15, qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
lea r14, [rsp + 0x38]
nop
mov rcx, rbx
mov edx, ebp
mov r8, rsi
mov r9d, edi
call r15
cmp eax, 0xea
jne 0x140046003
mov r9, qword [rsp + 0x38]
mov byte [rsp + 0x28], 0
mov qword [rsp + 0x20], 1
mov r8d, 1
mov rcx, rsi
mov rdx, r14
call fcn.140042f60
mov rsi, rax
mov rdi, qword [rsp + 0x38]
jmp 0x140045fc0
test eax, eax
je 0x140046011
mov rcx, rsi
call fcn.140042f50
xor esi, esi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400b8cc0
mov rax, rsi
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x140046030
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x140129050]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 4
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
lea r9, [rsp + 0x34]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [rsp + 0x30]
xor ecx, 4
or ecx, eax
mov eax, dword [rsp + 0x34]
xor eax, 4
or eax, ecx
sete bl
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400b8cc0
mov eax, ebx
add rsp, 0x40
pop rbx
ret