joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400ce7d0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push r12
push r13
sub rsp, 0x78
mov rax, qword [0x1401e7270]
xor rax, rsp
mov qword [rsp + 0x50], rax
movzx r9d, byte [rcx]
mov r13, r8
movzx eax, byte [0x1401bab7c]
mov r12, rdx
sub r9d, eax
jne 0x1400ce80f
movzx r9d, byte [rcx + 1]
movzx eax, byte [0x1401bab7d]
sub r9d, eax
mov qword [rsp + 0xb8], rsi
lea rbx, str._dev_stdin
test r9d, r9d
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x68], r14
lea rdx, [0x140197774]
cmovne rbx, rcx
mov qword [rsp + 0x60], r15
mov rcx, rbx
call fcn.1400fe9e0
mov rbp, rax
test rax, rax
je 0x1400ce919
lea rdx, [rsp + 0x20]
mov rcx, rbx
mov edi, 0x1000
call fcn.140108aa8
test eax, eax
jne 0x1400ce87a
mov eax, 0x8000
test word [rsp + 0x26], ax
je 0x1400ce87a
mov eax, dword [rsp + 0x34]
inc eax
movsxd rdi, eax
lea rcx, [rdi + 1]
call fcn.1400f8010
mov rsi, rax
test rax, rax
je 0x1400ce911
mov r9, rbp
mov r8, rdi
mov edx, 1
mov rcx, rax
call fcn.1400fed44
mov r15, rax
mov byte [rax + rsi], 0
cmp rax, rdi
jne 0x1400ce8f1
nop
add rdi, rdi
mov rcx, rsi
lea rdx, [rdi + 1]
call fcn.1400f7d28
mov r14, rax
test rax, rax
je 0x1400ce909
mov rbx, rdi
lea rcx, [rax + r15]
shr rbx, 1
mov r9, rbp
mov r8, rbx
mov edx, 1
mov rsi, rax
call fcn.1400fed44
add r15, rax
mov byte [rsi + r15], 0
cmp rax, rbx
je 0x1400ce8b0
mov rcx, rbp
call fcn.1400fda5c
lea rax, [r15 + 1]
mov qword [r12], rsi
mov qword [r13], rax
xor eax, eax
jmp 0x1400ce91c
mov rcx, rsi
call fcn.1400f7d30
mov rcx, rbp
call fcn.1400fda5c
or eax, 0xffffffff
mov r15, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400d5050
add rsp, 0x78
pop r13
pop r12
pop rbp
pop rbx
ret

Function at 0x1400d8f8c
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.DLL_TlsSetValue]
test eax, eax
je 0x1400d8f9f
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.DLL_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.1400d9604
lea rdx, [0x1401e41c8]
lea rcx, [rsp + 0x20]
call fcn.1400f6584
int3

Function at 0x1400e3ae4
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x1404b40e8]
xor edx, edx
jmp fcn.1400d8f8c

Function at 0x1400e44c4
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x1404b40e8]
jmp fcn.1400d8f8c

Function at 0x1400ffec4
Capabilities:
Delete directory

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.DLL_RemoveDirectoryW]
test eax, eax
jne 0x1400ffee4
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, eax
call fcn.1400fdf24
or eax, 0xffffffff
jmp 0x1400ffee6
xor eax, eax
add rsp, 0x28
ret
Function at 0x140108140
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x140107f14
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
test rax, rax
je 0x140107f14
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140107f14
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140107f14
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140107f14
cmp dword [rcx + 0x84], 0xe
jbe 0x140107f14
cmp dword [rcx + 0xf8], esi
je 0x140107f14
mov ecx, r14d
call fcn.14010805c
mov ecx, 2
call fcn.140109d2c
nop
cmp byte [0x1404b4400], 0
jne 0x140107fde
mov r15d, 1
mov eax, r15d
xchg dword [0x1404b43f0], eax
test ebx, ebx
jne 0x140107f87
mov rdi, qword [0x1401e7270]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x1404b43f8]
cmp rcx, rax
je 0x140107f7e
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [fcn.140002b30]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x1404b4758]
jmp 0x140107f93
cmp ebx, r15d
jne 0x140107f99
lea rcx, [0x1404b4770]
call fcn.14010df98
nop
test ebx, ebx
jne 0x140107fb0
lea rdx, [0x140192b38]
lea rcx, [0x140192b10]
call fcn.14010e260
lea rdx, [0x140192b48]
lea rcx, [0x140192b40]
call fcn.14010e260
movzx eax, byte [0x1404b4400]
test esi, esi
cmove eax, r15d
mov byte [0x1404b4400], al
jmp 0x140107fde
mov ecx, 2
call fcn.140109d80
test esi, esi
jne 0x140107ff5
mov ecx, r14d
call fcn.140108010
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x140107ea4
Function at 0x14011410c
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x140113fac
call fcn.1400fdf94
mov dword [rax], reloc.WS2_32.dll_shutdown
call fcn.1400f7f44
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x140113f94
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x140113f94
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x140113fde
lock or dword [rax + 0x14], 0x10
jmp 0x140113f94
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x140113ffb
mov rcx, qword [rbp + 0x10]
call fcn.1401145e0
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.140111578
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.14010068c
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x140114052
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x140113f94
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x1401140be
mov rcx, qword [rbp + 0x10]
call fcn.140111578
cmp eax, 0xffffffff
je 0x1401140a5
mov rcx, qword [rbp + 0x10]
call fcn.140111578
cmp eax, 0xfffffffe
je 0x1401140a5
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.140111578
movsxd rdi, eax
lea rsi, [0x1404b4960]
mov rcx, rbx
sar rdi, 6
call fcn.140111578
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x1401140ac
lea rax, [0x1401e76f0]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x1401140be
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x1401140f4
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x1401140f0
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x1401140f0
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x140113f97
jmp 0x140113f64
Function at 0x14013bc40
Capabilities:
Create directory

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x1401e7270]
xor rax, rsp
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x48]
call fcn.14013bda0
nop
lea r8, str._xmrig
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.14000dab0
nop
mov rax, qword [rsp + 0x60]
cmp rax, 0x10
jb 0x14013bcd4
inc rax
mov rcx, qword [rsp + 0x48]
cmp rax, 0x1000
jb 0x14013bccf
test cl, 0x1f
je 0x14013bca2
call fcn.1400f7f64
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x14013bcb1
call fcn.1400f7f64
int3
sub rcx, rax
cmp rcx, 8
jae 0x14013bcc0
call fcn.1400f7f64
int3
cmp rcx, 0x27
jbe 0x14013bccc
call fcn.1400f7f64
int3
mov rcx, rax
call fcn.1400cd710
mov qword [rsp + 0x60], socket
mov qword [rsp + 0x58], 0
mov byte [rsp + 0x48], 0
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 0x10
cmovae rcx, qword [rsp + 0x28]
call fcn.1400fe7d0
mov r8d, 7
lea rdx, str._.cache
lea rcx, [rsp + 0x28]
call fcn.140005ce0
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 0x10
cmovae rcx, qword [rsp + 0x28]
call fcn.1400fe7d0
nop
mov rax, qword [rsp + 0x40]
cmp rax, 0x10
jb 0x14013bd87
inc rax
mov rcx, qword [rsp + 0x28]
cmp rax, 0x1000
jb 0x14013bd82
test cl, 0x1f
je 0x14013bd55
call fcn.1400f7f64
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x14013bd64
call fcn.1400f7f64
int3
sub rcx, rax
cmp rcx, 8
jae 0x14013bd73
call fcn.1400f7f64
int3
cmp rcx, 0x27
jbe 0x14013bd7f
call fcn.1400f7f64
int3
mov rcx, rax
call fcn.1400cd710
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400d5050
add rsp, 0x78
ret

Function at 0x14013bda0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x150
mov rax, qword [0x1401e7270]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor ebx, ebx
lea rdx, [rsp + 0x30]
mov rdi, rcx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor ecx, ecx
lea r8d, [rbx + 0x1c]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov qword [rdi + 0x18], setsockopt
mov qword [rdi + 0x10], rbx
mov byte [rdi], bl
test eax, eax
je 0x14013be13
cmp byte [rsp + 0x30], bl
je 0x14013be09
lea rax, [rsp + 0x30]
or rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x14013be00
mov r8, rbx
lea rdx, [rsp + 0x30]
jmp 0x14013be20
mov r8d, 1
lea rdx, [0x1401ad23c]
mov rcx, rdi
call fcn.140005180
mov rax, rdi
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400d5050
mov rbx, qword [rsp + 0x168]
add rsp, 0x150
pop rdi
ret
Function at 0x1401453f0
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x148
mov rax, qword [0x1401e7270]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rcx, qword [0x1404b7f00]
lea rdx, [0x1404baae0]
test rcx, rcx
jne 0x14014547c
lea rcx, str.nvml.dll
call fcn.1400b2790
test eax, eax
jne 0x140145446
mov al, 1
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1400d5050
add rsp, 0x148
ret
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.1400f62a0
mov r8d, 0x104
lea rdx, [rsp + 0x20]
lea rcx, str._PROGRAMFILES_NVIDIA_CorporationNVSMI_nvml.dll
call qword [sym.imp.KERNEL32.DLL_ExpandEnvironmentStringsA]
lea rdx, [0x1404baae0]
lea rcx, [rsp + 0x20]
call fcn.1400b2790
test eax, eax
sete al
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1400d5050
add rsp, 0x148
ret
Function at 0x14014c7d0
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x1e0
mov rax, qword [0x1401e7270]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov ecx, 0x202
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov edx, 1
mov edi, 2
mov ecx, edi
lea r8d, [rdx + 5]
call qword [sym.imp.WS2_32.dll_socket]
mov rbx, rax
cmp eax, 0xffffffff
jne 0x14014c835
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
lea rcx, str.socket_failed:__d_n
call fcn.140006c30
xor al, al
jmp 0x14014c8b0
lea rcx, str.0.0.0.0
call qword [sym.imp.WS2_32.dll_inet_addr]
mov ecx, 0x8040
mov dword [rsp + 0x24], eax
call qword [sym.imp.WS2_32.dll_htons]
movsxd rbx, ebx
lea rdx, [rsp + 0x20]
mov rcx, rbx
mov word [rsp + 0x22], ax
mov r8d, setsockopt
mov word [rsp + 0x20], di
call qword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x14014c88f
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
lea rcx, str.bind_failed:__d_n
call fcn.140006c30
xor al, al
jmp 0x14014c8b0
mov edx, 0xa
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_listen]
mov edx, 0x8040
lea rcx, str.hold_port:__d_n
call fcn.140006c30
mov al, 1
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.1400d5050
mov rbx, qword [rsp + 0x1f0]
add rsp, 0x1e0
pop rdi
ret
Function at 0x14014c8e0
Capabilities:
Get cpu information
Get system information on windows
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0xe0]
sub rsp, 0x1e0
mov rax, qword [0x1401e7270]
xor rax, rsp
mov qword [rbp + 0xd0], rax
mov rsi, rdx
mov rdi, rcx
xor ebx, ebx
lea rcx, [rbp - 0x80]
xor edx, edx
mov dword [rsp + 0x40], ebx
mov r8d, 0x100
call fcn.1400f62a0
lea rax, [rsp + 0x38]
mov dword [rsp + 0x34], ebx
lea r9d, [rbx + 1]
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x30], 0x50
lea rdx, str.HARDWAREDESCRIPTIONSystemCentralProcessor0
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14014c96c
movups xmm0, xmmword [0x1401b1520]
mov eax, dword [0x1401b1530]
jmp 0x14014ca1a
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, str.ProcessorNameString
lea rax, [rbp + 0x80]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14014ca0d
cmp dword [rsp + 0x30], 0x50
ja 0x14014ca0d
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.DLL_GetSystemInfo]
mov eax, dword [rsp + 0x68]
lea r9, [rbp + 0x80]
lea r8, str._s____d
mov dword [rsp + 0x20], eax
mov edx, 0xff
lea rcx, [rbp - 0x80]
call fcn.140004770
test rsi, rsi
je 0x14014c9df
mov eax, dword [rsp + 0x68]
mov dword [rsi], eax
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, str.MHz
lea rax, [rsp + 0x34]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
jmp 0x14014ca21
movups xmm0, xmmword [0x1401b14d8]
mov eax, dword [0x1401b14e8]
mov dword [rbp - 0x70], eax
movaps xmmword [rbp - 0x80], xmm0
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rdi + 0x18], setsockopt
mov qword [rdi + 0x10], rbx
mov byte [rdi], bl
cmp byte [rbp - 0x80], bl
je 0x14014ca50
lea rax, [rbp - 0x80]
or rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x14014ca47
mov r8, rbx
lea rdx, [rbp - 0x80]
mov rcx, rdi
call fcn.140005180
mov rax, rdi
mov rcx, qword [rbp + 0xd0]
xor rcx, rsp
call fcn.1400d5050
mov rbx, qword [rsp + 0x210]
add rsp, 0x1e0
pop rdi
pop rsi
pop rbp
ret
Function at 0x14014ca90
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rsi, rdx
mov rdi, rcx
mov rcx, rsi
mov rdx, r8
mov rbx, r8
call qword [sym.imp.KERNEL32.DLL_LoadResource]
test rax, rax
jne 0x14014caec
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov rdx, rdi
lea rcx, str.LoadResource_failed_rcName:__s_erorr:__d_n
mov r8d, eax
call fcn.140006c30
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
xor al, al
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
mov rcx, rax
mov qword [rsp + 0x50], rbp
call qword [sym.imp.KERNEL32.DLL_LockResource]
mov rdx, rbx
mov rcx, rsi
mov rbp, rax
call qword [sym.imp.KERNEL32.DLL_SizeofResource]
mov qword [rsp + 0x30], 0
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
mov rcx, rdi
mov dword [rsp + 0x68], 0
mov esi, eax
call qword [sym.imp.KERNEL32.DLL_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14014cb79
lea r9, [rsp + 0x68]
mov qword [rsp + 0x20], 0
mov r8d, esi
mov rdx, rbp
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_WriteFile]
mov rcx, rbx
cmp dword [rsp + 0x68], esi
jne 0x14014cb95
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov al, 1
jmp 0x14014cb9d
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov rdx, rdi
lea rcx, str.CreateFile_failed_rcName:__s_erorr:__d_n
mov r8d, eax
call fcn.140006c30
or rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
xor al, al
mov rbp, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14014cc00
Capabilities:
Enumerate processes

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x1401e7270]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbx, rdx
mov dword [rsp + 0x20], 0x238
mov rsi, rcx
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x234
call fcn.1400f62a0
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.DLL_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14014cc58
xor eax, eax
jmp 0x14014cd43
mov qword [rsp + 0x2a0], rbp
lea rdx, [rsp + 0x20]
mov rcx, rdi
xor ebp, ebp
call qword [sym.imp.KERNEL32.DLL_Process32FirstW]
test eax, eax
je 0x14014cd30
nop dword [rax + rax]
mov rdx, rsi
lea rcx, [rsp + 0x4c]
call fcn.14010f7b8
test eax, eax
je 0x14014cca8
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_Process32NextW]
test eax, eax
jne 0x14014cc80
jmp 0x14014cd30
mov ebp, 1
lea rcx, [rsp + 0x20]
lea eax, [rbp + 3]
nop word [rax + rax]
lea rbx, [rbx + 0x80]
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x80]
movups xmmword [rbx - 0x80], xmm0
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rbx - 0x70], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rbx - 0x60], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rbx - 0x50], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rbx - 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rbx - 0x30], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rbx - 0x20], xmm0
movups xmmword [rbx - 0x10], xmm1
sub rax, rbp
jne 0x14014ccc0
movups xmm0, xmmword [rcx]
mov rdx, qword [rcx + 0x30]
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rbx], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rbx + 0x10], xmm1
movups xmmword [rbx + 0x20], xmm0
mov qword [rbx + 0x30], rdx
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, ebp
mov rbp, qword [rsp + 0x2a0]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1400d5050
add rsp, 0x270
pop rdi
pop rsi
pop rbx
ret
Function at 0x14014d920
Capabilities:
Manipulate user privileges

Disassembly:
push rbp
push rbx
push rdi
mov rbp, rsp
sub rsp, 0x70
xor edi, edi
mov ebx, edi
call qword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp + 0x28]
lea edx, [rdi + 8]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
cmp eax, 1
jne 0x14014da52
mov rcx, qword [rbp + 0x28]
lea rax, [rbp + 0x20]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp + 0x20], edi
lea edx, [rdi + 1]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov r9d, dword [rbp + 0x20]
test r9d, r9d
je 0x14014d989
mov edx, r9d
lea ecx, [rdi + 0x40]
call qword [sym.imp.KERNEL32.DLL_LocalAlloc]
mov r9d, dword [rbp + 0x20]
mov rbx, rax
mov rcx, qword [rbp + 0x28]
lea rax, [rbp + 0x20]
mov r8, rbx
mov qword [rsp + 0x20], rax
mov edx, 1
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
test rbx, rbx
je 0x14014da52
xor eax, eax
lea r9, [rbp + 0x30]
mov r8d, 0xf0fff
mov qword [rbp - 0x30], rax
lea rdx, [rbp - 0x30]
mov qword [rbp - 0x28], rax
xor ecx, ecx
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rax
call qword [sym.imp.ADVAPI32.dll_LsaOpenPolicy]
test eax, eax
jne 0x14014da3f
mov rdx, qword [rbx]
lea rax, [0x1401b17c8]
mov rcx, qword [rbp + 0x30]
lea r8, [rbp - 0x40]
mov qword [rbp - 0x38], rax
mov r9d, 1
mov dword [rbp - 0x40], 0x2c002a
movaps xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp - 0x40], xmm0
call qword [sym.imp.ADVAPI32.dll_LsaAddAccountRights]
test eax, eax
jne 0x14014da35
lea rdx, str.Huge_pages_support_was_successfully_enabled__but_reboot_required_to_use_it
lea ecx, [rax + 5]
call fcn.1401200c0
mov edi, 1
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.ADVAPI32.dll_LsaClose]
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_LocalFree]
mov eax, edi
add rsp, 0x70
pop rdi
pop rbx
pop rbp
ret
xor eax, eax
add rsp, 0x70
pop rdi
pop rbx
pop rbp
ret
Function at 0x14014fe20
Capabilities:
Hash data using sha256

Disassembly:
push rbx
sub rsp, 0xb0
mov rax, qword [0x1401e7270]
xor rax, rsp
mov qword [rsp + 0xa0], rax
xor eax, eax
mov dword [rsp + 0x20], 0x6a09e667
mov rbx, rcx
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x50], rax
lea r8, [r8*8]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x24], 0xbb67ae85
mov dword [rsp + 0x28], 0x3c6ef372
mov dword [rsp + 0x2c], 0xa54ff53a
mov dword [rsp + 0x30], 0x510e527f
mov dword [rsp + 0x34], 0x9b05688c
mov dword [rsp + 0x38], 0x1f83d9ab
mov qword [rsp + 0x3c], 0x5be0cd19
call fcn.14014f660
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.14014f400
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1400d5050
add rsp, 0xb0
pop rbx
ret

Function at 0x140150300
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x100
mov rax, qword [0x1401e7270]
xor rax, rsp
mov qword [rbp + 0x47], rax
movups xmm0, xmmword [rcx]
mov rdi, rcx
xor r8d, r8d
movups xmm1, xmmword [rcx + 0x10]
lea rdx, [rbp - 0x39]
movups xmmword [rsp + 0x20], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rbp - 0x79], xmm1
movups xmm1, xmmword [rcx + 0x30]
lea rcx, [rsp + 0x20]
movups xmmword [rbp - 0x69], xmm0
movups xmmword [rbp - 0x59], xmm1
call fcn.1401512b0
mov r8d, 1
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x39]
call fcn.1401512b0
mov ebx, 2
lea rdx, [rbp - 0x39]
mov r8d, ebx
lea rcx, [rbp + 7]
call fcn.1401512b0
lea r8d, [rbx + 1]
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x39]
call fcn.1401512b0
lea r8d, [rbx + 2]
lea rdx, [rbp - 0x39]
lea rcx, [rbp + 7]
call fcn.1401512b0
lea r8d, [rbx + 3]
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x39]
call fcn.1401512b0
lea r8d, [rbx + 4]
lea rdx, [rbp - 0x39]
lea rcx, [rbp + 7]
call fcn.1401512b0
lea r8d, [rbx + 5]
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x39]
call fcn.1401512b0
lea r8d, [rbx + 6]
lea rdx, [rbp - 0x39]
lea rcx, [rbp + 7]
call fcn.1401512b0
lea r8d, [rbx + 7]
lea rdx, [rsp + 0x20]
lea rcx, [rbp - 0x39]
call fcn.1401512b0
xor r9d, r9d
lea rcx, [rbp - 0x4d]
lea rax, [rdi + 0x3c]
lea edx, [rbx + 0xe]
cmp rdi, rcx
ja 0x140150416
lea rcx, [rsp + 0x20]
cmp rax, rcx
jae 0x140150462
lea r8, [rsp + 0x20]
mov r9d, edx
sub r8, rdi
lea rax, [rsp + 0x20]
sub rax, rdi
lea rcx, [rdi + 0x10]
nop dword [rax]
movdqu xmm0, xmmword [rcx - 0x10]
movdqu xmm1, xmmword [r8 + rcx - 0x10]
movdqu xmm2, xmmword [rax + rcx]
lea rcx, [rcx + 0x20]
pxor xmm1, xmm0
movdqu xmmword [rcx - 0x30], xmm1
movdqu xmm0, xmmword [rcx - 0x20]
pxor xmm2, xmm0
movdqu xmmword [rcx - 0x20], xmm2
sub rbx, 1
jne 0x140150430
movsxd rcx, r9d
cmp rcx, rdx
jge 0x140150490
lea r8, [rsp + 0x20]
sub r8, rdi
lea rax, [rdi + rcx*4]
sub rdx, rcx
nop dword [rax]
mov ecx, dword [rax + r8]
xor dword [rax], ecx
lea rax, [rax + 4]
sub rdx, 1
jne 0x140150480
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1400d5050
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140154b50
Capabilities:
Allocate or change rwx memory

Disassembly:
test r9, r9
je 0x140154bf3
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rbp, r9
mov qword [rsp + 0x40], rbx
mov r14, r8
mov rsi, rdx
mov r15, rcx
xor edi, edi
nop
mov edx, 0x1000
mov ecx, 0x130
call fcn.1400fee90
xor ecx, ecx
mov edx, 0x4000
mov r8d, 0x3000
mov rbx, rax
mov qword [rax + 0xe0], rsi
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov dword [rbx + 0x120], 0xffffffff
add rsi, r14
mov qword [rbx + 0x118], rax
mov qword [rbx + 0x128], 0xffffffffffffffff
mov qword [r15 + rdi*8], rbx
inc rdi
cmp rdi, rbp
jb 0x140154b80
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret