joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140080310
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0xd0
mov rax, qword [0x1400ca080]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbx, qword [rcx + 0xa00]
lea rax, [rsp + 0x30]
mov rdi, qword [rcx]
mov r14, rcx
mov dword [rsp + 0x30], 0x80
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov r8d, dword [rbx + 0x15c]
mov rdx, qword [rbx + 0x168]
add r8d, 4
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [rbx + 0x150], 0
mov dword [rbx + 0x154], eax
jne 0x1400803a5
movsxd r8, dword [rsp + 0x30]
lea rcx, [rbx + 0xd0]
lea rdx, [rsp + 0x40]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rsp + 0x30]
mov dword [rbx + 0x150], eax
mov r8d, dword [rbx + 0x154]
mov qword [rsp + 0xf8], rbp
mov qword [rsp + 0x100], rsi
cmp r8d, 4
jge 0x140080406
lea rdx, str.Received_too_short_packet
mov rcx, rdi
call fcn.140049550
mov dword [rbx + 0xc], 7
xor eax, eax
mov rsi, qword [rsp + 0x100]
mov rbp, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.140094910
add rsp, 0xd0
pop r14
pop rdi
pop rbx
ret
mov rdx, qword [rbx + 0x168]
movzx eax, byte [rdx]
movzx ecx, byte [rdx + 1]
shl eax, 8
or ecx, eax
mov dword [rbx + 0xc], ecx
sub ecx, 3
je 0x1400804c1
sub ecx, 1
je 0x140080534
sub ecx, 1
je 0x140080470
cmp ecx, 1
je 0x140080453
lea r8, str.Internal_error:_Unexpected_packet
mov rcx, rdi
lea rdx, [0x1400a3a10]
call fcn.140049550
jmp 0x140080534
add r8d, 0xfffffffe
add rdx, 2
mov rcx, rbx
call fcn.140080040
test eax, eax
je 0x140080534
jmp 0x1400803da
movzx ecx, byte [rdx + 2]
lea eax, [r8 - 4]
movsxd rbp, eax
lea rsi, [rdx + 4]
movzx eax, byte [rdx + 3]
mov r8, rbp
shl ecx, 8
xor edx, edx
or ecx, eax
mov dword [rbx + 8], ecx
mov rcx, rsi
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x140080534
sub rax, rsi
cmp rax, rbp
jae 0x140080534
mov r8, rsi
lea rdx, str.TFTP_error:__s_n
mov rcx, rdi
call fcn.1400496d0
jmp 0x140080534
cmp r8d, 4
jle 0x140080534
movzx eax, byte [rdx + 3]
movzx ecx, byte [rdx + 2]
shl ecx, 8
or ecx, eax
movzx eax, word [rbx + 0x48]
inc eax
movzx eax, ax
cmp eax, ecx
jne 0x140080534
lea eax, [r8 - 4]
mov rcx, r14
lea r8, [rdx + 4]
movsxd r9, eax
mov edx, 1
call fcn.140049470
mov esi, eax
test eax, eax
je 0x140080513
mov edx, 5
mov rcx, rbx
call fcn.140081000
mov eax, esi
jmp 0x1400803da
mov eax, dword [rbx + 0x154]
mov rcx, rdi
sub eax, 4
cdqe
add qword [rdi + 0xf8], rax
mov rdx, qword [rdi + 0xf8]
call fcn.140069e50
mov rcx, r14
call fcn.14006a130
test eax, eax
je 0x1400803d8
mov edx, 5
mov rcx, rbx
call fcn.140081000
mov eax, Ordinal_46
jmp 0x1400803da
Function at 0x140086bd0
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov r8d, dword [rcx + 0x28]
mov rdi, rdx
mov rbx, rcx
cmp r8d, 0x40
jae 0x140086d88
lea ecx, [r8*8]
mov qword [rsp + 0x30], rsi
add qword [rbx], rcx
mov byte [r8 + rbx + 0x2c], 0x80
mov eax, dword [rbx + 0x28]
inc eax
mov dword [rbx + 0x28], eax
cmp eax, 0x38
jbe 0x140086c48
cmp eax, 0x40
jae 0x140086c32
nop word [rax + rax]
mov byte [rax + rbx + 0x2c], 0
mov eax, dword [rbx + 0x28]
inc eax
mov dword [rbx + 0x28], eax
cmp eax, 0x40
jb 0x140086c20
lea rsi, [rbx + 0x2c]
mov rcx, rbx
mov rdx, rsi
call fcn.140086eb0
xor eax, eax
mov dword [rbx + 0x28], eax
jmp 0x140086c50
lea rsi, [rbx + 0x2c]
jae 0x140086c62
nop
mov byte [rax + rbx + 0x2c], 0
mov eax, dword [rbx + 0x28]
inc eax
mov dword [rbx + 0x28], eax
cmp eax, 0x38
jb 0x140086c50
movzx eax, byte [rbx + 7]
mov rdx, rsi
mov byte [rbx + 0x64], al
mov rcx, rbx
movzx eax, byte [rbx + 6]
mov byte [rbx + 0x65], al
movzx eax, byte [rbx + 5]
mov byte [rbx + 0x66], al
movzx eax, byte [rbx + 4]
mov byte [rbx + 0x67], al
movzx eax, byte [rbx + 3]
mov byte [rbx + 0x68], al
movzx eax, byte [rbx + 2]
mov byte [rbx + 0x69], al
movzx eax, byte [rbx + 1]
mov byte [rbx + 0x6a], al
movzx eax, byte [rbx]
mov byte [rbx + 0x6b], al
call fcn.140086eb0
movzx eax, byte [rbx + 0xb]
mov byte [rdi], al
movzx eax, byte [rbx + 0xa]
mov byte [rdi + 1], al
movzx eax, byte [rbx + 9]
mov byte [rdi + 2], al
movzx eax, byte [rbx + 8]
mov byte [rdi + 3], al
movzx eax, byte [rbx + 0xf]
mov byte [rdi + 4], al
movzx eax, byte [rbx + 0xe]
mov byte [rdi + 5], al
movzx eax, byte [rbx + 0xd]
mov byte [rdi + 6], al
movzx eax, byte [rbx + 0xc]
mov byte [rdi + 7], al
movzx eax, byte [rbx + 0x13]
mov byte [rdi + 8], al
movzx eax, byte [rbx + 0x12]
mov byte [rdi + 9], al
movzx eax, byte [rbx + 0x11]
mov byte [rdi + 0xa], al
movzx eax, byte [rbx + 0x10]
mov byte [rdi + 0xb], al
movzx eax, byte [rbx + 0x17]
mov byte [rdi + 0xc], al
movzx eax, byte [rbx + 0x16]
mov byte [rdi + 0xd], al
movzx eax, byte [rbx + 0x15]
mov byte [rdi + 0xe], al
movzx eax, byte [rbx + 0x14]
mov byte [rdi + 0xf], al
movzx eax, byte [rbx + 0x1b]
mov byte [rdi + 0x10], al
movzx eax, byte [rbx + 0x1a]
mov byte [rdi + 0x11], al
movzx eax, byte [rbx + 0x19]
mov byte [rdi + 0x12], al
movzx eax, byte [rbx + 0x18]
mov byte [rdi + 0x13], al
movzx eax, byte [rbx + 0x1f]
mov byte [rdi + 0x14], al
movzx eax, byte [rbx + 0x1e]
mov byte [rdi + 0x15], al
movzx eax, byte [rbx + 0x1d]
mov byte [rdi + 0x16], al
movzx eax, byte [rbx + 0x1c]
mov byte [rdi + 0x17], al
movzx eax, byte [rbx + 0x23]
mov byte [rdi + 0x18], al
movzx eax, byte [rbx + 0x22]
mov byte [rdi + 0x19], al
movzx eax, byte [rbx + 0x21]
mov byte [rdi + 0x1a], al
movzx eax, byte [rbx + 0x20]
mov byte [rdi + 0x1b], al
movzx eax, byte [rbx + 0x27]
mov byte [rdi + 0x1c], al
movzx eax, byte [rbx + 0x26]
mov byte [rdi + 0x1d], al
movzx eax, byte [rbx + 0x25]
mov byte [rdi + 0x1e], al
movzx eax, byte [rbx + 0x24]
mov rsi, qword [rsp + 0x30]
mov byte [rdi + 0x1f], al
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140086da0
Capabilities:
Hash data using sha256

Disassembly:
xor eax, eax
mov qword [rcx + 0x24], 0x5be0cd19
mov qword [rcx], rax
mov dword [rcx + 8], 0x6a09e667
mov dword [rcx + 0xc], 0xbb67ae85
mov dword [rcx + 0x10], 0x3c6ef372
mov dword [rcx + 0x14], 0xa54ff53a
mov dword [rcx + 0x18], 0x510e527f
mov dword [rcx + 0x1c], 0x9b05688c
mov dword [rcx + 0x20], 0x1f83d9ab
ret
Function at 0x140093ca0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [section..data]
mov rdi, rax
test rax, rax
jne 0x140093ce2
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x140093d29
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x140093d82
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
sub rbp, 1
jne 0x140093d40
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x140093dc3
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x1400a928a]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x1400a928b]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x140093d90
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret

Function at 0x140093df0
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x140093e2a
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x140093e2f
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140093e78
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, reloc.WS2_32.dll_accept
cmp byte [rcx + rax], 0
je 0x140093e78
dec r8
sub rdx, 1
jne 0x140093e5e
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x140095910
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14009595a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14009595a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14009595a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14009595a
cmp dword [rcx + 0x84], 0xe
jbe 0x14009595a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14009595c
xor al, al
add rsp, 0x28
ret
Function at 0x140030140
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 8
movups xmm0, xmmword [rcx]
xorps xmm4, xmm4
lea rax, [r8 + 0x10]
cmp edx, 0x100
je 0x140030310
cmp edx, 0xc0
je 0x140030270
cmp edx, 0x80
jne 0x1400303e0
mov edx, 9
movdqa xmm5, xmmword [0x140449410]
mov r10d, 8
movdqa xmm4, xmmword [0x140449430]
movdqa xmm2, xmm0
movdqu xmmword [r8], xmm0
jmp 0x1400301a0
pshufb xmm0, xmm5
aesenclast xmm0, xmm4
pslld xmm4, 1
lea rax, [rax + 0x10]
movdqa xmm3, xmm2
pslldq xmm2, 4
pxor xmm3, xmm2
pslldq xmm2, 4
pxor xmm3, xmm2
pslldq xmm2, 4
pxor xmm2, xmm3
pxor xmm0, xmm2
movdqu xmmword [rax - 0x10], xmm0
movdqa xmm2, xmm0
dec r10d
jne 0x1400301a0
movdqa xmm4, xmmword [0x140449440]
pshufb xmm0, xmm5
aesenclast xmm0, xmm4
pslld xmm4, 1
movdqa xmm3, xmm2
pslldq xmm2, 4
pxor xmm3, xmm2
pslldq xmm2, 4
pxor xmm3, xmm2
pslldq xmm2, 4
pxor xmm2, xmm3
pxor xmm0, xmm2
movdqu xmmword [rax], xmm0
movdqa xmm2, xmm0
pshufb xmm0, xmm5
aesenclast xmm0, xmm4
movdqa xmm3, xmm2
pslldq xmm2, 4
pxor xmm3, xmm2
pslldq xmm2, 4
pxor xmm3, xmm2
pslldq xmm2, 4
pxor xmm2, xmm3
pxor xmm0, xmm2
movdqu xmmword [rax + 0x10], xmm0
mov dword [rax + 0x60], edx
xor eax, eax
jmp 0x1400303e7
movq xmm2, qword [rcx + 0x10]
mov edx, ntohl
movdqa xmm5, xmmword [0x140449420]
movdqa xmm4, xmmword [0x140449430]
mov r10d, 8
movdqu xmmword [r8], xmm0
jmp 0x1400302a0
movq qword [rax], xmm2
movdqa xmm1, xmm2
pshufb xmm2, xmm5
aesenclast xmm2, xmm4
pslld xmm4, 1
lea rax, [rax + 0x18]
movdqa xmm3, xmm0
pslldq xmm0, 4
pxor xmm3, xmm0
pslldq xmm0, 4
pxor xmm3, xmm0
pslldq xmm0, 4
pxor xmm0, xmm3
pshufd xmm3, xmm0, 0xff
pxor xmm3, xmm1
pslldq xmm1, 4
pxor xmm3, xmm1
pxor xmm0, xmm2
pxor xmm2, xmm3
movdqu xmmword [rax - 0x10], xmm0
dec r10d
jne 0x1400302a0
mov dword [rax + 0x20], edx
xor eax, eax
jmp 0x1400303e7
movups xmm2, xmmword [rcx + 0x10]
mov edx, ntohl
lea rax, [rax + 0x10]
movdqa xmm5, xmmword [0x140449410]
movdqa xmm4, xmmword [0x140449430]
mov r10d, 7
movdqu xmmword [r8], xmm0
movdqa xmm1, xmm2
movdqu xmmword [r8 + 0x10], xmm2
jmp 0x140030350
pshufb xmm2, xmm5
aesenclast xmm2, xmm4
movdqa xmm3, xmm0
pslldq xmm0, 4
pxor xmm3, xmm0
pslldq xmm0, 4
pxor xmm3, xmm0
pslldq xmm0, 4
pxor xmm0, xmm3
pslld xmm4, 1
pxor xmm0, xmm2
movdqu xmmword [rax], xmm0
dec r10d
je 0x1400303d2
pshufd xmm2, xmm0, 0xff
pxor xmm3, xmm3
aesenclast xmm2, xmm3
movdqa xmm3, xmm1
pslldq xmm1, 4
pxor xmm3, xmm1
pslldq xmm1, 4
pxor xmm3, xmm1
pslldq xmm1, 4
pxor xmm1, xmm3
pxor xmm2, xmm1
movdqu xmmword [rax + 0x10], xmm2
lea rax, [rax + 0x20]
movdqa xmm1, xmm2
jmp 0x140030350
mov dword [rax + 0x10], edx
xor eax, eax
jmp 0x1400303e7
mov rax, 0xfffffffffffffffe
pxor xmm0, xmm0
pxor xmm1, xmm1
pxor xmm2, xmm2
pxor xmm3, xmm3
pxor xmm4, xmm4
pxor xmm5, xmm5
add rsp, 8
ret
Function at 0x1400d4c20
Capabilities:
Check mutex on windows

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov byte [rcx], 0
mov qword [rcx + 8], 0
lea r8, str.A946A6A9_917E_4949_B9BC_6BADA8C7FD63
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsi + 8], rax
test rax, rax
je 0x1400d4c60
mov rcx, rax
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
sete byte [rsi]
mov rax, rsi
add rsp, 0x20
pop rsi
ret

Function at 0x1400da3c0
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov rbx, qword [rcx + 0x10]
cmp rbx, qword [rcx + 0x18]
je 0x1400da406
mov r15, rbx
test r15, r15
je 0x1400da4e2
mov rax, qword [rdi]
mov qword [r15], rax
add qword [rsi + 0x10], 8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r12, qword [rsi]
mov r14, qword [rsi + 8]
mov rax, r14
sub rax, r12
jbe 0x1400da462
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
add rax, rcx
inc rax
sar rax, 1
mov r12, rax
neg r12
shl rax, 3
mov r15, r14
sub r15, rax
sub rbx, r14
je 0x1400da451
mov rcx, r15
mov rdx, r14
mov r8, rbx
call fcn.1402d2020
mov r14, qword [rsi + 8]
add r15, rbx
mov qword [rsi + 0x10], r15
lea rax, [r14 + r12*8]
mov qword [rsi + 8], rax
jmp 0x1400da3e2
mov rax, rbx
sub rax, r12
sar rax, 2
cmp rbx, r12
mov r13d, 1
cmovne r13, rax
mov rax, r13
shr rax, 0x3d
jne 0x1400da4fe
lea rcx, [r13*8]
call fcn.1402965cc
mov rcx, r13
and rcx, 0xfffffffffffffffc
lea rcx, [rax + rcx*2]
mov rdx, rbx
mov r15, rcx
sub rdx, r14
je 0x1400da4c4
lea r15, [rdx + rcx]
xor r8d, r8d
mov r9, rcx
add r9, r8
je 0x1400da4e2
mov r10, qword [r14 + r8]
mov qword [r9], r10
add r8, 8
cmp rdx, r8
jne 0x1400da4ac
lea rdx, [rax + r13*8]
mov qword [rsi], rax
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], rdx
cmp rbx, r14
je 0x1400da4e4
add rbx, 0xfffffffffffffff8
jne 0x1400da4d7
ud2
test r12, r12
je 0x1400da3e2
mov rcx, r12
call fcn.140296608
mov r15, qword [rsi + 0x10]
jmp 0x1400da3e2
call fcn.1402d3510
int3
Function at 0x1400ec240
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x1404fe040]
xor rax, rsp
mov qword [rsp + 0x30], rax
xor eax, eax
mov qword [rcx], rax
mov r14, qword [rdx]
mov qword [rdx], rax
lea r15, [r14 + 1]
cmp r15, 2
jb 0x1400ec27e
call fcn.14020f940
cmp qword [rsi], r14
je 0x1400ec2b1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x1400ec372
cmp r15, 2
jb 0x1400ec2a9
mov qword [rsi], r14
call fcn.14020f940
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov qword [rsi + 8], 0xffffffffffffffff
lea r14, [rsi + 0x10]
xor eax, eax
mov qword [rsp + 0x28], rax
mov r15, qword [rdi]
mov qword [rdi], rax
cmp r15, 0xffffffffffffffff
je 0x1400ec2da
test r15, r15
je 0x1400ec2fe
call fcn.14020f940
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
lea rax, [r15 + 1]
cmp rax, 2
jb 0x1400ec2f6
mov qword [rsp + 0x28], r15
call fcn.14020f940
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rdx, [rsp + 0x28]
mov rcx, r14
call fcn.140305c80
mov rax, qword [rbx]
inc rax
cmp rax, 2
jb 0x1400ec32b
call fcn.14020f940
mov rcx, qword [rbx]
call fcn.1401fa240
mov qword [rbx], 0
mov rax, qword [rdi]
inc rax
cmp rax, 2
jb 0x1400ec34b
call fcn.14020f940
mov rcx, qword [rdi]
call fcn.1401fa240
mov qword [rdi], 0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
cmp rcx, qword [0x1404fe040]
je 0x1400ec362
call fcn.140297b50
int3
mov rax, rsi
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.14020f940
mov rcx, qword [rsi]
call fcn.1401fa240
mov qword [rsi], 0
jmp 0x1400ec29b
Function at 0x1400fbdc0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x80
mov rdi, r9
mov r14, r8
mov ebx, edx
mov rsi, rcx
mov rax, qword [0x1404fe040]
xor rax, rsp
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x70]
mov qword [rax], 0
mov qword [rsp + 0x20], rax
lea rcx, [0x1404493a0]
lea r9, [0x14048afb0]
xor edx, edx
mov r8d, 1
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x1400fbf63
xor r12d, r12d
mov qword [rsp + 0x68], r12
mov r15, qword [rsp + 0x70]
movsx rax, byte [r14 + 0x17]
test rax, rax
jns 0x1400fbe3e
mov rax, qword [r14 + 8]
mov r14, qword [r14]
lea rdx, [rsp + 0x50]
mov qword [rdx], r14
mov qword [rdx + 8], rax
lea r14, [rsp + 0x60]
mov rcx, r14
call fcn.140145550
mov rdx, qword [r14]
mov rax, qword [r15]
mov rax, qword [rax + 0x18]
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x40], rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x20], r12
mov dword [rsp + 0x28], 0
mov rcx, r15
xor r8d, r8d
xor r9d, r9d
call qword [case.0x1403053b8.0]
mov ebp, eax
mov rcx, r14
call fcn.1401455a0
test ebp, ebp
js 0x1400fbf51
test bl, bl
je 0x1400fbedd
mov rcx, qword [rsp + 0x68]
mov eax, 3
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov edx, 0xa
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x1400fbf59
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x68], 0
mov rcx, qword [rdi]
mov qword [rdi], rax
test rcx, rcx
jne 0x1400fbf6f
mov byte [rsi], 0
xor eax, eax
mov byte [rsi + 4], al
mov rcx, qword [rsp + 0x68]
test rcx, rcx
jne 0x1400fbf81
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1400fbf28
mov qword [rsp + 0x70], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x1403053b8.0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
cmp rcx, qword [0x1404fe040]
je 0x1400fbf3f
call fcn.140297b50
int3
add rsp, 0x80
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov dword [rsi], 1
jmp 0x1400fbf5f
mov dword [rsi], 2
mov al, 1
jmp 0x1400fbefb
mov dword [rsi], 0
mov byte [rsi + 4], 1
jmp 0x1400fbf08
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x1403053b8.0]
jmp 0x1400fbef6
mov qword [rsp + 0x68], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x1403053b8.0]
jmp 0x1400fbf08
Function at 0x1400fc0b0
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x158
mov rax, qword [0x1404fe040]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov eax, dword [0x1405129c8]
mov ecx, dword [0x14050f5f0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400fc117
lea rax, [0x1405129c0]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
cmp rcx, qword [0x1404fe040]
je 0x1400fc10d
call fcn.140297b50
int3
add rsp, 0x158
pop rdi
pop rsi
ret
lea rcx, [0x1405129c8]
call fcn.14029664c
cmp dword [0x1405129c8], 0xffffffff
jne 0x1400fc0ec
lea rsi, [rsp + 0x38]
mov r8d, 0x118
mov rcx, rsi
xor edx, edx
call fcn.1402d26c0
mov dword [rsi - 4], 0x11c
lea rsi, [rsp + 0x34]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
lea rdi, [rsp + 0x30]
mov dword [rdi], 0
mov ecx, dword [rsi + 4]
mov edx, dword [rsi + 8]
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetProductInfo]
mov ecx, 0x88
call fcn.1402965cc
mov rsi, rax
mov edi, dword [rdi]
mov eax, dword [0x140512a10]
mov ecx, dword [0x14050f5f0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400fc1d7
lea r8, [0x1405129e0]
lea rdx, [rsp + 0x34]
mov rcx, rsi
mov r9d, edi
call fcn.1400fc2d0
mov qword [0x1405129c0], rsi
lea rcx, [0x1405129c8]
call fcn.140296700
jmp 0x1400fc0ec
lea rcx, [0x140512a10]
call fcn.14029664c
cmp dword [0x140512a10], 0xffffffff
jne 0x1400fc1a8
xorps xmm0, xmm0
movups xmmword [0x140512a00], xmm0
movups xmmword [0x1405129f0], xmm0
movups xmmword [0x1405129e0], xmm0
lea rcx, [0x1405129e0]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rcx, [0x140512a10]
call fcn.140296700
jmp 0x1400fc1a8

Function at 0x1400fc220
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x28
mov eax, dword [0x140512a10]
mov ecx, dword [0x14050f5f0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400fc25b
movzx eax, word [0x1405129e0]
cmp eax, 9
jne 0x1400fc2a3
mov eax, 1
add rsp, 0x28
ret
lea rcx, [0x140512a10]
call fcn.14029664c
cmp dword [0x140512a10], 0xffffffff
jne 0x1400fc245
xorps xmm0, xmm0
movups xmmword [0x140512a00], xmm0
movups xmmword [0x1405129f0], xmm0
movups xmmword [0x1405129e0], xmm0
lea rcx, [0x1405129e0]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rcx, [0x140512a10]
call fcn.140296700
jmp 0x1400fc245
test eax, eax
je 0x1400fc256
cmp eax, 6
jne 0x1400fc2b3
mov eax, 2
jmp 0x1400fc256
cmp eax, 0xc
jne 0x1400fc2bf
mov eax, 3
jmp 0x1400fc256
mov eax, 4
jmp 0x1400fc256

Function at 0x1400fda70
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x38
mov rcx, qword [rcx]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
sete al
add rsp, 0x38
ret
Function at 0x1400fdaa0
Capabilities:
Delete registry key

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov rsi, rcx
mov rax, qword [0x1404fe040]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rcx, qword [rcx]
test rcx, rcx
je 0x1400fdb79
mov ebp, r8d
mov rbx, rdx
movabs r15, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x30], r15
xor eax, eax
mov qword [rsp + 0x38], rax
mov r12d, dword [rsi + 8]
mov r9d, r12d
or r9d, 0x10001
lea rdx, [rsp + 0x40]
mov qword [rdx], rax
mov qword [rsp + 0x20], rdx
mov rdx, rbx
mov r8d, 8
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400fdb4f
mov r14, qword [rsp + 0x40]
mov qword [rsp + 0x28], r14
and r12d, 0x300
mov dword [rsp + 0x30], r12d
test bpl, 1
je 0x1400fdb80
test r14, r14
je 0x1400fdb40
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8d, dword [rsi + 8]
mov rcx, qword [rsi]
mov rdx, rbx
call fcn.1400fdbf0
mov edi, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
cmp rcx, qword [0x1404fe040]
je 0x1400fdb68
call fcn.140297b50
int3
mov eax, edi
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov edi, 6
jmp 0x1400fdb51
lea rdi, [rsp + 0x40]
mov qword [rdi], r15
lea rcx, [rsp + 0x28]
mov rdx, rdi
call fcn.1400fddd0
cmp byte [rdi + 4], 0
jne 0x1400fdbb6
mov r8d, dword [rsi + 8]
lea rdx, [0x14047b3ea]
mov rcx, r14
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
mov edi, eax
jmp 0x1400fdbba
mov edi, dword [rsp + 0x40]
test r14, r14
je 0x1400fdb51
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400fdb51
mov edx, 1
call fcn.1400fe940
jmp 0x1400fdb51