joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140029250
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x3090], 0
lea rbx, [rcx + 0x3098]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x1400292f6
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x1400292aa
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.14002aee0
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.140019c80
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x3090]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x30a0]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x1400febe2]
cmovne rcx, rax
call fcn.140092974
mov r14, qword [rsp + 0x30]
jmp 0x1400292fe
mov rcx, rbx
call fcn.140019c80
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x14003cb30
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x1400ec0a0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rcx, qword [0x1400fef58]
lea rdx, [rsp + 0x38]
mov rdi, qword [0x1400febf0]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
call qword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [rsp + 0x40]
lea rcx, [rsp + 0x30]
sub eax, dword [rsp + 0x38]
mov qword [rsp + 0x30], 0
movd xmm1, eax
mov eax, dword [rsp + 0x44]
sub eax, dword [rsp + 0x3c]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [rdi + 0x10], xmm1
movss dword [rdi + 0x14], xmm0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rcx, qword [rsp + 0x30]
xorps xmm1, xmm1
mov rax, rcx
xorps xmm0, xmm0
sub rax, qword [0x1400fef60]
cvtsi2ss xmm0, qword [0x1400fef68]
cvtsi2ss xmm1, rax
divss xmm1, xmm0
movss dword [rdi + 0x18], xmm1
mov qword [0x1400fef60], rcx
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, 0x10
and al, 1
mov byte [rdi + 0x140], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, 0x12
and al, 1
mov byte [rdi + 0x141], al
call qword [sym.imp.USER32.dll_GetKeyState]
mov rbx, qword [0x1400febf0]
shr eax, 0xf
and al, 1
mov byte [rdi + 0x143], 0
mov byte [rdi + 0x142], al
cmp byte [rbx + 0x39b], 0
je 0x14003cc6f
cvttss2si eax, dword [rbx + 0x128]
mov rcx, qword [0x1400fef58]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], eax
cvttss2si eax, dword [rbx + 0x12c]
mov dword [rsp + 0x24], eax
call qword [sym.imp.USER32.dll_ClientToScreen]
test eax, eax
je 0x14003cc6f
mov edx, dword [rsp + 0x24]
mov ecx, dword [rsp + 0x20]
call qword [sym.imp.USER32.dll_SetCursorPos]
mov dword [rbx + 0x128], 0xff7fffff
mov dword [rbx + 0x12c], 0xff7fffff
call qword [sym.imp.USER32.dll_GetForegroundWindow]
test rax, rax
je 0x14003ccee
mov rdx, qword [0x1400fef58]
cmp rax, rdx
je 0x14003cca7
mov rcx, rax
call qword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x14003ccee
lea rcx, [rsp + 0x28]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x14003ccee
mov rcx, qword [0x1400fef58]
lea rdx, [rsp + 0x28]
call qword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x14003ccee
movd xmm0, dword [rsp + 0x28]
movd xmm1, dword [rsp + 0x2c]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [rbx + 0x128], xmm0
movss dword [rbx + 0x12c], xmm1
cmp byte [rdi + 0xc8], 0
je 0x14003ccfe
mov eax, 0xffffffff
jmp 0x14003cd0b
mov rax, qword [0x1400febf0]
mov eax, dword [rax + 0x1f48]
cmp dword [0x1400f65dc], eax
je 0x14003cd1e
mov dword [0x1400f65dc], eax
call fcn.14003c6e0
call fcn.14003c860
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140045970
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x140045d34
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x1400670a4
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x1400670b7
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.1400676b8
lea rdx, [0x1400e9ed8]
lea rcx, [rsp + 0x20]
call fcn.1400821dc
int3

Function at 0x140071954
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x1400fdbd0]
xor edx, edx
jmp fcn.1400670a4

Function at 0x1400722e4
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x1400fdbd0]
jmp fcn.1400670a4

Function at 0x14007dc34
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x14007dcf0]
mov r9, qword [r9 + 8]
jmp fcn.14006f304

Function at 0x14007dcc8
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x14007dd00]
mov r9, qword [r9 + 8]
jmp fcn.14006f304
Function at 0x14009d5cc
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14009d3f8

Function at 0x180d36f02
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea rsp, [rsp + 0x10]
je 0x180d4b70a
push r9
mov r9d, 0xbd1dec3d
mov edx, r9d
lea r9, [0x180d3f940]

Function at 0x180d48fc8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp], rsi
mov esi, 0x1e1e46b1
push r10
movzx r10d, si
lea rsi, [0x180d37378]
mov r10d, 0x1790ef9e
movzx r10d, byte [rcx + r10*2 - 0x2f21df3c]
push 0xfffffffff424efb8
xor r10d, r9d
and r10d, 0xff
mov r10d, dword [rsi + r10*4]
shr r9d, 8
xor r9d, r10d
inc rcx
xor r9d, 0x84073e21
dec rbp
push 0xffffffff863088a6
push 0xffffffff97331402
lea rsp, [rsp + 0x18]
jne 0x180d48fde
pop r10
pop rsi
Function at 0x14000b0d0
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
test rcx, rcx
je 0x14000b26e
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140005090]
xor rax, rsp
mov qword [rbp - 0x10], rax
and qword [rbp - 0x50], 0
mov rbx, rcx
and qword [rbp - 0x48], 0
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov r14d, 2
cmp rax, qword [rbx]
jne 0x14000b122
lea edi, [r14 - 1]
jmp 0x14000b151
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov rcx, qword [rbx]
lea rdx, [rbp - 0x48]
xor edi, edi
cmp rax, qword [rbx + 0x10]
cmove edi, r14d
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x14000b18d
mov rcx, qword [rbp - 0x48]
lea rdx, [rbp - 0x40]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14000b164
mov rdx, qword [rbx + 0x28]
call qword [sym.imp.ntoskrnl.exe_MmUnmapLockedPages]
lea rdx, [rbx + 0x38]
mov cl, 1
call fcn.14000b028
cmp edi, 1
je 0x14000b17e
lea rcx, [rbp - 0x40]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x14000b18d
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
cmp edi, r14d
je 0x14000b1b8
mov rcx, qword [rbx + 0x10]
lea rdx, [rbp - 0x50]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x14000b1fe
mov rcx, qword [rbp - 0x50]
lea rdx, [rbp - 0x40]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov rax, qword [rbp - 0x50]
jmp 0x14000b1be
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov rdx, qword [rbx + 0x30]
mov r8b, 1
mov rcx, rax
call fcn.14000b310
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x14000b1e0
mov rdx, qword [rbx + 0x28]
call qword [sym.imp.ntoskrnl.exe_MmUnmapLockedPages]
cmp edi, r14d
je 0x14000b1ef
lea rcx, [rbp - 0x40]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x14000b1fe
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x14000b232
mov rax, qword [rbx + 0x28]
test rax, rax
je 0x14000b222
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_IoFreeMdl]
and qword [rbx + 0x28], 0
mov rcx, qword [rbx + 0x20]
mov edx, 0x41645973
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
and qword [rbx + 0x20], 0
lea rdx, [rbx + 0x38]
xor ecx, ecx
call fcn.14000b028
mov rdx, rbx
lea rcx, [0x140005140]
call qword [sym.imp.ntoskrnl.exe_RtlDeleteElementGenericTableAvl]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140002ae0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140009450
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xf0
mov rax, qword [0x140061740]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rax, qword [rcx]
mov rbx, rcx
lea rdx, [rbp - 0x39]
mov qword [rbp - 0x79], rax
mov rax, qword [rcx + 8]
xor r8d, r8d
mov qword [rbp - 0x71], rax
mov rax, qword [rcx + 0x10]
mov qword [rbp - 0x69], rax
mov rax, qword [rcx + 0x18]
mov qword [rbp - 0x61], rax
mov rax, qword [rcx + 0x20]
mov qword [rbp - 0x59], rax
mov rax, qword [rcx + 0x28]
mov qword [rbp - 0x51], rax
mov rax, qword [rcx + 0x30]
mov qword [rbp - 0x49], rax
mov rax, qword [rcx + 0x38]
lea rcx, [rbp - 0x79]
mov qword [rbp - 0x41], rax
call fcn.140007b20
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x39]
mov r8d, 1
call fcn.140007b20
lea rdx, [rbp - 0x39]
lea rcx, [rbp + 7]
mov r8d, 2
call fcn.140007b20
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x39]
mov r8d, 3
call fcn.140007b20
mov edi, 4
lea rdx, [rbp - 0x39]
lea rcx, [rbp + 7]
mov r8d, edi
call fcn.140007b20
lea r8d, [rdi + 1]
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x39]
call fcn.140007b20
lea r8d, [rdi + 2]
lea rdx, [rbp - 0x39]
lea rcx, [rbp + 7]
call fcn.140007b20
lea r8d, [rdi + 3]
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x39]
call fcn.140007b20
lea r8d, [rdi + 4]
lea rdx, [rbp - 0x39]
lea rcx, [rbp + 7]
call fcn.140007b20
lea r8d, [rdi + 5]
lea rdx, [rbp - 0x79]
lea rcx, [rbp - 0x39]
call fcn.140007b20
lea rdx, [rbp - 0x79]
lea r8, [rbp - 0x75]
sub rdx, rbx
lea rax, [rbx + 8]
sub r8, rbx
nop dword [rax]
mov ecx, dword [rdx + rax - 8]
lea rax, [rax + 0x10]
xor dword [rax - 0x18], ecx
mov ecx, dword [r8 + rax - 0x18]
xor dword [rax - 0x14], ecx
mov ecx, dword [rdx + rax - 0x10]
xor dword [rax - 0x10], ecx
mov ecx, dword [r8 + rax - 0x10]
xor dword [rax - 0xc], ecx
dec rdi
jne 0x140009580
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.14002e450
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140009700
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov ecx, dword [rcx + 0x8c]
xor ebp, ebp
mov rsi, rdx
test ecx, ecx
je 0x140009770
movsxd r9, dword [rbx + 0x88]
mov r10d, 1
mov eax, 8
sub eax, ecx
mov r8d, r10d
shl r8b, cl
movzx ecx, al
dec r8b
shl r8b, cl
mov ecx, 7
and byte [r9 + rbx + 0x47], r8b
sub ecx, dword [rbx + 0x8c]
movsxd rdx, dword [rbx + 0x88]
shl r10b, cl
xor byte [rdx + rbx + 0x47], r10b
mov dword [rbx + 0x8c], ebp
jmp 0x140009782
movsxd rax, dword [rbx + 0x88]
mov byte [rax + rbx + 0x48], 0x80
inc dword [rbx + 0x88]
mov eax, dword [rbx + 0x88]
cmp eax, 0x38
jle 0x1400097c5
cmp eax, 0x40
jge 0x1400097ad
movsxd rax, dword [rbx + 0x88]
mov byte [rax + rbx + 0x48], bpl
inc dword [rbx + 0x88]
cmp dword [rbx + 0x88], 0x40
jl 0x140009792
lea rdx, [rbx + 0x48]
mov r8d, 0x40
mov rcx, rbx
call fcn.1400090e0
mov dword [rbx + 0x88], ebp
cmp dword [rbx + 0x88], 0x38
jge 0x1400097eb
nop
movsxd rax, dword [rbx + 0x88]
mov byte [rax + rbx + 0x48], bpl
inc dword [rbx + 0x88]
cmp dword [rbx + 0x88], 0x38
jl 0x1400097d0
inc dword [rbx + 0x40]
jne 0x1400097f3
inc dword [rbx + 0x44]
mov dword [rbx + 0x88], 0x40
nop dword [rax]
dec dword [rbx + 0x88]
movzx eax, byte [rbx + 0x40]
movsxd rcx, dword [rbx + 0x88]
mov byte [rcx + rbx + 0x48], al
shr dword [rbx + 0x40], 8
cmp dword [rbx + 0x88], 0x3c
jg 0x140009800
cmp dword [rbx + 0x88], 0x38
jle 0x140009852
nop dword [rax + rax]
dec dword [rbx + 0x88]
movzx eax, byte [rbx + 0x44]
movsxd rcx, dword [rbx + 0x88]
mov byte [rcx + rbx + 0x48], al
shr dword [rbx + 0x44], 8
cmp dword [rbx + 0x88], 0x38
jg 0x140009830
lea rdx, [rbx + 0x48]
mov r8d, 0x40
mov rcx, rbx
call fcn.1400090e0
mov rcx, rbx
call fcn.140009450
lea rcx, [rbx + 0x20]
sub rsi, rbx
mov edx, 0x20
nop dword [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
mov byte [rsi + rcx - 0x21], al
dec rdx
jne 0x140009880
mov rsi, qword [rsp + 0x40]
mov qword [rbx], rbp
mov qword [rbx + 8], rbp
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], rbp
mov qword [rbx + 0x48], rbp
mov qword [rbx + 0x50], rbp
mov qword [rbx + 0x58], rbp
mov qword [rbx + 0x60], rbp
mov qword [rbx + 0x68], rbp
mov qword [rbx + 0x70], rbp
mov qword [rbx + 0x78], rbp
mov qword [rbx + 0x80], rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14000aee0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rax, qword [0x140061740]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rbx, rcx
lea rsi, reloc.WS2_32.dll_accept
lea r14, sym.NsGpuCNMiner.exe_8_e_FT___30Dcpnn_XO00j_y7o3WE34G6t9IPnCn
lea r15, [0x1400536e0]
nop
mov rax, qword [rbx + 0x28]
mov r9d, 4
mov r10, rbx
xor rax, qword [rbx + 0xa0]
lea r11d, [r9 + 1]
xor rax, qword [rbx + 0x50]
xor rax, qword [rbx]
xor rax, qword [rbx + 0x78]
mov qword [rsp], rax
mov rax, qword [rbx + 0x80]
xor rax, qword [rbx + 0x30]
xor rax, qword [rbx + 8]
xor rax, qword [rbx + 0xa8]
xor rax, qword [rbx + 0x58]
mov qword [rsp + 8], rax
mov rax, qword [rbx + 0x38]
xor rax, qword [rbx + 0xb0]
xor rax, qword [rbx + 0x60]
xor rax, qword [rbx + 0x88]
xor rax, qword [rbx + 0x10]
mov qword [rsp + 0x10], rax
mov rax, qword [rbx + 0xb8]
xor rax, qword [rbx + 0x68]
xor rax, qword [rbx + 0x90]
xor rax, qword [rbx + 0x18]
xor rax, qword [rbx + 0x40]
mov qword [rsp + 0x18], rax
mov rax, qword [rbx + 0x98]
xor rax, qword [rbx + 0x20]
xor rax, qword [rbx + 0x48]
xor rax, qword [rbx + 0xc0]
xor rax, qword [rbx + 0x70]
mov qword [rsp + 0x20], rax
nop word [rax + rax]
lea ecx, [r9 - 3]
mov eax, 0x66666667
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
sub ecx, eax
movsxd rax, ecx
mov ecx, r9d
mov r8, qword [rsp + rax*8]
mov eax, 0x66666667
rol r8, 1
imul r9d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
sub ecx, eax
movsxd rax, ecx
mov ecx, 5
xor r8, qword [rsp + rax*8]
mov rax, r10
nop dword [rax + rax]
xor qword [rax], r8
lea rax, [rax + 0x28]
dec rcx
jne 0x14000b020
inc r9d
add r10, 8
dec r11
jne 0x14000afd0
mov r9, qword [rbx + 8]
xor r8d, r8d
nop
movsxd rax, dword [r8 + r14 + 0x535c0]
mov ecx, dword [r8 + r14 + 0x53560]
add r8, 4
mov rdx, qword [rbx + rax*8]
rol r9, cl
mov qword [rbx + rax*8], r9
mov r9, rdx
cmp r8, 0x60
jl 0x14000b040
lea r11, [rbx + 0x10]
mov edi, 5
mov r10, qword [r11 - 0x10]
mov r9, qword [r11 - 8]
mov rcx, qword [r11]
mov rdx, qword [r11 + 8]
mov r8, qword [r11 + 0x10]
mov rax, r9
not rax
lea r11, [r11 + 0x28]
and rax, rcx
not rcx
and rcx, rdx
xor rax, r10
not rdx
mov qword [r11 - 0x38], rax
xor qword [r11 - 0x30], rcx
and rdx, r8
xor qword [r11 - 0x28], rdx
not r8
and r8, r10
not r10
xor qword [r11 - 0x20], r8
and r10, r9
xor qword [r11 - 0x18], r10
dec rdi
jne 0x14000b071
mov rax, qword [rsi]
add rsi, 8
xor qword [rbx], rax
cmp rsi, r15
jl 0x14000af20
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14002e450
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x14000ee60
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
mov eax, 0x8080
call fcn.14003a960
sub rsp, rax
mov rax, qword [0x140061740]
xor rax, rsp
mov qword [rsp + 0x8060], rax
mov ebx, ecx
lea r8, [rsp + 0x80a0]
lea rcx, [rsp + 0x60]
call fcn.14002f81c
cmp ebx, dword [0x140065470]
jg 0x14000eeb5
lea rcx, [rsp + 0x60]
call fcn.14000ecc0
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
lea rcx, [0x14006cd08]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rsp + 0x48]
lea rcx, [0x14006cd08]
mov qword [0x140065460], rax
mov rax, qword [rsp + 0x50]
mov qword [0x140065468], rax
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp byte [0x140065360], 0
je 0x14000f02b
or rbx, 0xffffffffffffffff
lea rcx, [rsp + 0x60]
mov rax, rbx
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x14000ef10
dec eax
movsxd rcx, eax
cmp rcx, 0x4000
jae 0x14000f044
mov qword [rsp + 0x8078], rdi
mov byte [rsp + rcx + 0x60], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
movzx ecx, word [rsp + 0x56]
movzx edx, word [rsp + 0x54]
movzx r9d, word [rsp + 0x52]
movzx r8d, word [rsp + 0x50]
lea r10, [rsp + 0x60]
mov qword [rsp + 0x38], r10
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], edx
lea rcx, [rsp + 0x4060]
lea rdx, str._.2d:_.2d:_.2d:_.3d_t_x_t_s_r_n
call fcn.14002ecd0
lea rcx, [0x14006cd08]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor r9d, r9d
mov qword [rsp + 0x30], 0
lea rcx, [0x140065360]
lea r8d, [r9 + 1]
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14000f016
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea rax, [rsp + 0x4060]
inc rbx
cmp byte [rax + rbx], 0
jne 0x14000efe2
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x4060]
mov r8, rbx
mov rcx, rdi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x14006cd08]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rdi, qword [rsp + 0x8078]
mov rcx, qword [rsp + 0x8060]
xor rcx, rsp
call fcn.14002e450
add rsp, 0x8080
pop rbx
ret
call fcn.14002f174
int3

Function at 0x14000f3a0
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x438
mov rax, qword [0x140061740]
xor rax, rsp
mov qword [rsp + 0x420], rax
lea rdx, [rsp + 0x20]
mov ecx, 0x3e8
mov byte [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea rax, [rsp + 0x20]
or rcx, 0xffffffffffffffff
inc rcx
cmp byte [rax + rcx], 0
jne 0x14000f3d7
mov eax, 0x2086296b
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 0xaa8e3da1
lea r8d, [rdx + rdx*2]
imul ecx
add edx, ecx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx*4 + 7]
add eax, edx
add eax, r8d
mov rcx, qword [rsp + 0x420]
xor rcx, rsp
call fcn.14002e450
add rsp, 0x438
ret
Function at 0x140012660
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov rdi, rcx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r14, qword [rsp + 0x28]
mov r15, qword [rsp + 0x30]
cmp rdi, 0x40000000
jbe 0x1400126a0
lea rax, [rdi - 0x40000000]
cmp r14, rax
cmovb r14, rax
mov rsi, qword [0x14009edb0]
lea rax, [rdi + 0x40000000]
cmp r15, rax
cmova r15, rax
sub r15, 0xfff
test rsi, rsi
je 0x1400126de
cmp rsi, r14
jb 0x1400126d6
cmp rsi, r15
jae 0x1400126d6
cmp qword [rsi + 8], 0
jne 0x14001289d
mov rsi, qword [rsi]
test rsi, rsi
jne 0x1400126c1
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xa8], rbp
mov rbx, rdi
cmp rdi, r14
jb 0x140012759
nop word [rax + rax]
mov ebp, dword [rsp + 0x48]
mov rax, rbx
xor edx, edx
div rbp
sub rbx, rdx
sub rbx, rbp
cmp rbx, r14
jb 0x140012759
nop word [rax + rax]
lea rdx, [rsp + 0x50]
mov r8d, gethostbyname
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140012759
cmp dword [rsp + 0x70], 0x10000
je 0x1400127db
mov rbx, qword [rsp + 0x58]
cmp rbx, rbp
jb 0x140012759
sub rbx, rbp
cmp rbx, r14
jae 0x140012720
test rsi, rsi
jne 0x140012846
cmp rdi, r15
ja 0x14001288d
nop dword [rax + rax]
mov ebp, dword [rsp + 0x48]
xor edx, edx
mov rax, rdi
div rbp
mov eax, ebp
mov ebx, ebp
sub rax, rdx
add rax, rdi
mov rdi, rax
cmp rax, r15
ja 0x14001288d
lea rdx, [rsp + 0x50]
mov r8d, gethostbyname
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x14001288d
cmp dword [rsp + 0x70], 0x10000
je 0x140012814
xor edx, edx
lea edi, [rbp - 1]
add rdi, qword [rsp + 0x68]
add rdi, qword [rsp + 0x50]
mov rax, rdi
div rbx
sub rdi, rdx
cmp rdi, r15
jbe 0x140012792
jmp 0x14001288d
test rbx, rbx
je 0x140012759
mov edx, 0x1000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x140012846
cmp rbx, r14
jae 0x140012700
jmp 0x140012762
test rdi, rdi
je 0x14001288d
mov edx, 0x1000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x140012846
cmp rdi, r15
jbe 0x140012770
jmp 0x14001288d
xor eax, eax
lea rcx, [rsi + 0x40]
mov rdx, rcx
mov qword [rsi + 8], rax
mov dword [rsi + 0x10], eax
sub rdx, rsi
nop dword [rax]
mov rax, qword [rsi + 8]
add rdx, 0x40
mov qword [rcx], rax
mov qword [rsi + 8], rcx
add rcx, 0x40
cmp rdx, 0xfc0
jbe 0x140012860
mov rax, qword [0x14009edb0]
mov qword [0x14009edb0], rsi
mov qword [rsi], rax
mov rbp, qword [rsp + 0xa8]
mov rbx, qword [rsp + 0xa0]
mov rax, rsi
mov rsi, qword [rsp + 0xb0]
add rsp, 0x80
pop r15
pop r14
pop rdi
ret