joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140036950
Capabilities:
Get token membership
Query or enumerate registry value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x90
mov rsi, rcx
mov rax, qword [0x140062030]
xor rax, rsp
mov qword [rsp + 0x88], rax
lea rdi, [rsp + 0x3c]
mov dword [rdi], 0x44
lea r8, [rsp + 0x40]
mov ecx, 0x1a
xor edx, edx
mov r9, rdi
call qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
test eax, eax
je 0x140036a28
lea rbx, [rsp + 0x40]
lea r8, [rsp + 0x38]
xor ecx, ecx
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x140036a71
cmp dword [rsp + 0x38], 0
je 0x140036a8c
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], 0
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
lea r8, str.EnableLUA
mov rcx, 0xffffffff80000002
mov r9d, 0x18
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x140036a95
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov byte [rsi + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_toolkit_xre_WinTokenUtils.cpp
mov qword [rsi], rax
mov dword [rsi + 8], 0x26
jmp 0x140036a52
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov eax, 0x14
mov byte [rsi + 0x10], 1
lea rdx, str._builds_worker_checkouts_gecko_toolkit_xre_WinTokenUtils.cpp
mov qword [rsi], rdx
mov dword [rsi + 8], eax
mov dword [rsi + 0xc], ecx
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.14002ef70
nop
add rsp, 0x90
pop rbx
pop rdi
pop rsi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov eax, 0x19
jmp 0x140036a41
xor eax, eax
mov byte [rsi + 0x10], al
mov byte [rsi], al
jmp 0x140036a55
cmp dword [rsp + 0x3c], 0
mov byte [rsi + 0x10], 0
sete byte [rsi]
jmp 0x140036a55

Function at 0x140036ec0
Capabilities:
Delete file

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
cmp byte [rcx + 9], 0
je 0x140036f38
mov rcx, qword [rsi + 0x30]
lea rax, [rcx + 1]
cmp rax, 2
jb 0x140036ee2
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsi + 0x28]
cmp rax, 8
jb 0x140036f1c
mov rcx, qword [rsi + 0x10]
inc rax
movabs rdx, 0x7ffffffffffff800
test rax, rdx
je 0x140036f16
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x140036f70
mov rcx, rax
call qword [sym.imp.mozglue.dll_free]
mov qword [rsi + 0x20], 0
mov qword [rsi + 0x28], 7
mov word [rsi + 0x10], 0
add rsp, 0x20
pop rsi
ret
mov rcx, qword [rsi + 0x30]
lea rax, [rcx + 1]
cmp rax, 2
jb 0x140036f4c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsi + 0x30], 0
cmp qword [rsi + 0x28], 8
jb 0x140036f61
mov rcx, qword [rsi + 0x10]
jmp 0x140036f65
lea rcx, [rsi + 0x10]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x140036ece
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140037710
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
sub rsp, 0x50
mov rsi, rcx
mov rax, qword [0x140062030]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x40], 4
cmp qword [r8 + 0x18], 8
jb 0x140037739
mov r8, qword [r8]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3c]
mov rcx, rdx
mov rdx, r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140037790
cmp dword [rsp + 0x3c], 4
jne 0x1400377a2
mov eax, dword [rsp + 0x44]
mov byte [rsi + 0x10], 0
bts rax, 0x20
mov qword [rsi], rax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14002ef70
nop
add rsp, 0x50
pop rsi
ret
cmp eax, 2
jne 0x1400377c0
mov byte [rsi + 0x10], 0
mov qword [rsi], 0
jmp 0x14003777c
mov byte [rsi + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsi], rax
movabs rax, 0x8007065d00000043
mov qword [rsi + 8], rax
jmp 0x14003777c
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov byte [rsi + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsi], rax
mov dword [rsi + 8], 0x3f
mov dword [rsi + 0xc], ecx
jmp 0x14003777c

Function at 0x1400377f0
Capabilities:
Set registry value

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, rcx
mov rax, qword [0x140062030]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
cmp qword [r8 + 0x18], 8
jb 0x14003781b
mov r8, qword [r8]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 8
xor edi, edi
mov rcx, rdx
mov rdx, r8
xor r8d, r8d
mov r9d, 0xb
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14003786d
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
lea rax, str._builds_worker_checkouts_gecko_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsi], rax
mov dword [rsi + 8], 0x79
mov dword [rsi + 0xc], ecx
mov dil, 1
mov byte [rsi + 0x10], dil
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14002ef70
nop
add rsp, 0x48
pop rdi
pop rsi
ret
Function at 0x140038470
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov rbx, r8
mov r14, rdx
mov rsi, rcx
mov rax, qword [0x140062030]
xor rax, rsp
mov qword [rsp + 0x70], rax
lea r12, [rsp + 0x48]
mov dword [r12], 0
mov qword [rsp + 0x30], r12
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers
mov rcx, r14
mov r9d, 0x10002
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x1400384e1
cmp eax, 2
jne 0x140038563
xor eax, eax
mov byte [rsi + 0x10], al
mov byte [rsi], al
jmp 0x140038589
mov r15d, dword [rsp + 0x48]
add r15, r15
mov rcx, r15
call qword [sym.imp.mozglue.dll_moz_xmalloc]
mov rdi, rax
mov rcx, rax
xor edx, edx
mov r8, r15
call sub.ntdll.dll_memset
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], 0
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers
mov rcx, r14
mov r8, rbx
mov r9d, 0x10002
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x1400385a8
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov byte [rsi + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_browser_app_winlauncher_LaunchUnelevated.cpp
mov qword [rsi], rax
mov dword [rsi + 8], 0x68
mov dword [rsi + 0xc], ecx
mov rcx, rdi
call qword [sym.imp.mozglue.dll_free]
jmp 0x140038589
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov byte [rsi + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_browser_app_winlauncher_LaunchUnelevated.cpp
mov qword [rsi], rax
mov dword [rsi + 8], 0x5c
mov dword [rsi + 0xc], ecx
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14002ef70
nop
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movaps xmm0, xmmword [str.RUNASADMIN]
movaps xmmword [rsp + 0x50], xmm0
movabs rax, 0x4e0049004d
mov qword [rsp + 0x5e], rax
lea rdx, [rsp + 0x4c]
mov dword [rdx], 0x20
lea r8, [rsp + 0x40]
mov qword [r8], 0
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcstok_s]
test rax, rax
je 0x14003862c
lea rbx, [rsp + 0x50]
mov r12, qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
lea r14, [rsp + 0x4c]
lea r15, [rsp + 0x40]
mov r13, qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcstok_s]
mov r8d, 0xb
mov rcx, rax
mov rdx, rbx
call r12
test eax, eax
je 0x14003863a
xor ebp, ebp
xor ecx, ecx
mov rdx, r14
mov r8, r15
call r13
test rax, rax
jne 0x140038605
jmp 0x14003862e
xor ebp, ebp
mov byte [rsi + 0x10], 0
mov byte [rsi], bpl
jmp 0x140038558
mov bpl, 1
jmp 0x14003862e
Function at 0x1400388d0
Capabilities:
Print debug messages

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x860
mov qword [rsp + 0x888], rdx
mov qword [rsp + 0x890], r8
mov qword [rsp + 0x898], r9
mov rax, qword [0x140062030]
xor rax, rsp
mov qword [rsp + 0x858], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x140038975
lea rsi, [rsp + 0x888]
mov qword [rsp + 0x28], rsi
lea rdi, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.mozglue.dll_protected:_void___cdecl_mozilla::PrintfTarget::constructor_void____ptr64]
lea rax, [0x1400535e8]
mov qword [rdi], rax
lea rbx, [rsp + 0x50]
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], 0x800
lea rdx, str._n_nBROWSERBROWSERBROWSERBROWSER_n__debug_me____lu_n_n
mov rcx, rdi
mov r8, rsi
call qword [sym.imp.mozglue.dll_public:_bool___cdecl_mozilla::PrintfTarget::vprint_char_const____ptr64__char____ptr64____ptr64]
mov rax, qword [rdi + 8]
mov ecx, 0x7ff
cmp rax, rcx
cmovb rcx, rax
mov byte [rsp + rcx + 0x50], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fileno]
cmp eax, 0xfffffffe
je 0x1400389e3
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__dup]
lea rdx, [0x140057448]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_math_l1_1_0.dll__fdopen]
test rax, rax
je 0x1400389e3
mov rsi, rax
lea rdi, [rsp + 0x888]
mov qword [rsp + 0x50], rdi
call fcn.140007420
mov rcx, qword [rax]
mov qword [rsp + 0x20], rdi
lea r8, str._n_nBROWSERBROWSERBROWSERBROWSER_n__debug_me____lu_n_n
mov rdx, rsi
xor r9d, r9d
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vfprintf]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, qword [rsp + 0x858]
xor rcx, rsp
call fcn.14002ef70
nop
add rsp, 0x860
pop rbx
pop rdi
pop rsi
ret
Function at 0x14003b900
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rsi
sub rsp, 0x140
mov rax, qword [0x140062030]
xor rax, rsp
mov qword [rsp + 0x138], rax
mov edx, 0x10
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x14003b942
mov rcx, qword [rsp + 0x138]
xor rcx, rsp
call fcn.14002ef70
nop
add rsp, 0x140
pop rsi
ret
lea rsi, [rsp + 0x28]
mov dword [rsi - 8], 3
mov rcx, rsi
call fcn.1400266f0
lea rax, str._builds_worker_checkouts_gecko_security_sandbox_chromium_base_rand_util_win.cc
mov qword [rsi + 0xf0], rax
mov dword [rsi + 0xf8], 0x20
lea rcx, [rsp + 0x130]
call fcn.14003b990
lea rcx, [rsp + 0x20]
call fcn.140039960
jmp 0x14003b928

Function at 0x14003ce20
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x140062080]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14003ce50
movsxd rcx, dword [rsi]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [rsi + 4]
jne 0x14003ce50
mov rax, qword [rax + rcx]
jmp 0x14003ce52
xor eax, eax
add rsp, 0x20
pop rsi
ret

Function at 0x14003d1e0
Capabilities:
Parse pe header

Disassembly:
movzx eax, word [rcx]
cmp eax, 0x5a4d
jne 0x14003d212
movsxd rax, dword [rcx + 0x3c]
cmp dword [rcx + rax], 0x4550
jne 0x14003d212
movzx edx, word [rcx + rax + 0x14]
cmp edx, 0xf0
jne 0x14003d212
movzx eax, word [rcx + rax + 0x18]
cmp eax, 0x20b
sete al
ret
xor eax, eax
jmp 0x14003d211

Function at 0x140044790
Capabilities:
Create pipe

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
mov r14, qword [rsp + 0xc8]
mov rax, qword [0x140062030]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov qword [r14], 0xffffffffffffffff
mov esi, 5
cmp ecx, 3
jne 0x140044874
mov edi, dword [rsp + 0xc0]
mov r11d, dword [rsp + 0xb8]
mov ecx, dword [rsp + 0xb0]
mov eax, dword [rsp + 0xa8]
mov r10d, dword [rsp + 0xa0]
cmp qword [r8 + 0x18], 8
jb 0x1400447f6
mov r8, qword [r8]
mov rsi, qword [rdx]
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], r11d
mov dword [rsp + 0x20], ecx
mov qword [rsp + 0x38], 0
mov rcx, r8
mov edx, r9d
mov r8d, r10d
mov r9d, eax
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
cmp rax, 0xffffffffffffffff
je 0x14004488f
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor r15d, r15d
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
mov dword [rsp + 0x30], 3
lea rbx, [rsp + 0x40]
mov rcx, rax
mov rdx, rdi
mov r8, rsi
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
cmp eax, 1
sbb r15, r15
or r15, qword [rbx]
mov qword [r14], r15
xor eax, eax
cmp r15, 0xffffffffffffffff
sete al
lea esi, [rax + rax*4]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14002ef70
mov eax, esi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov r15, 0xffffffffffffffff
jmp 0x140044865
Function at 0x140046610
Capabilities:
Read file via mapping

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov edi, edx
mov rsi, rcx
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov dword [rsp + 0x20], edx
mov qword [rsp + 0x28], 0
mov rcx, 0xffffffffffffffff
xor edx, edx
mov r8d, 0x8000004
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rcx, rsi
mov rdx, rax
call fcn.14000cb00
mov rcx, qword [rsi]
lea rax, [rcx + 1]
cmp rax, 2
jb 0x14004667a
mov eax, edi
mov qword [rsp + 0x20], rax
mov edx, 6
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsi + 8], rax
mov rax, rsi
add rsp, 0x38
pop rdi
pop rsi
ret

Function at 0x140049410
Capabilities:
Create process on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc8
mov edi, ecx
mov rax, qword [0x140062030]
xor rax, rsp
mov qword [rsp + 0xc0], rax
lea eax, [rdi - 7]
mov ebp, 5
cmp eax, 0xfffffffe
jae 0x14004946a
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14002ef70
mov eax, ebp
add rsp, 0xc8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r14, r8
mov r15, rdx
mov r12, qword [rsp + 0x130]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
xor r13d, r13d
mov qword [rsp + 0xb0], r13
mov dword [rsp + 0x50], 0x68
cmp qword [r9 + 0x18], 8
jb 0x1400494bf
mov r9, qword [r9]
mov rcx, r9
call qword [sym.imp.mozglue.dll__wcsdup]
mov rsi, rax
mov rax, qword [r12 + 0x10]
cmp qword [r12 + 0x18], 8
jb 0x1400494dc
mov r12, qword [r12]
mov rbx, qword [rsp + 0x138]
test rax, rax
cmove r12, rax
cmp qword [r14 + 0x18], 8
jb 0x1400494f5
mov r14, qword [r14]
mov r15, qword [r15]
mov qword [rsp + 0x48], rbx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
mov rcx, r14
mov rdx, rsi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ebp, 5
test eax, eax
je 0x1400495cb
cmp edi, 6
mov r12d, 0x1fffff
mov r13d, 0x101c01
cmove r13d, r12d
mov r14, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x20], r13d
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 0
mov rcx, rax
mov rdx, r14
mov r8, r15
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x1400495e2
cmp edi, 6
mov ebp, 0x100c43
cmove ebp, r12d
mov rdi, qword [rbx + 8]
add rbx, 8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 0
mov rcx, rax
mov rdx, rdi
mov r8, r15
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor ecx, ecx
test eax, eax
sete cl
lea ebp, [rcx + rcx*4]
test rsi, rsi
je 0x140049444
mov rcx, rsi
call qword [sym.imp.mozglue.dll_free]
jmp 0x140049444
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400495cb
Function at 0x1400495f0
Capabilities:
Create thread

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rax, r8
mov r8, rdx
mov rdi, rcx
mov rsi, qword [rsp + 0x88]
mov edx, dword [rsp + 0x80]
xor r14d, r14d
mov qword [rsi], r14
mov rcx, qword [rcx]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], r9
xor edx, edx
mov r9, rax
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test rax, rax
je 0x14004967c
mov rbx, rax
mov rdi, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
mov dword [rsp + 0x30], 3
mov rcx, rax
mov rdx, rbx
mov r8, rdi
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor ecx, ecx
test eax, eax
sete cl
lea eax, [rcx + rcx*4]
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
jmp qword [sym.imp.KERNEL32.dll_GetLastError]

Function at 0x140050660
Capabilities:
Parse pe header

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x140064a50]
test rax, rax
je 0x1400506a3
mov rax, qword [0x140064a50]
test rax, rax
je 0x1400506f0
mov rcx, qword [0x140064a50]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi], rax
test rax, rax
je 0x1400506f3
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x140055aa0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
movzx eax, word [rax]
cmp eax, 0x5a4d
jne 0x1400506f6
movsxd rax, dword [rcx + 0x3c]
cmp dword [rcx + rax], 0x4550
jne 0x1400506f6
movzx edx, word [rcx + rax + 0x14]
cmp edx, 0xf0
jne 0x1400506f6
movzx eax, word [rcx + rax + 0x18]
cmp eax, 0x20b
jne 0x1400506f6
xor eax, eax
lock cmpxchg qword [0x140064a50], rcx
jmp 0x140050678
int3
int3
int3

Function at 0x140050e00
Capabilities:
Get system information on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov rcx, qword [rcx + 0x20]
test rcx, rcx
je 0x140050e66
mov rsi, r9
mov rdi, r8
mov r14, rdx
mov esi, edx

Function at 0x1400514a0
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rsi, rcx
mov rax, qword [0x140062030]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov eax, dword [0x140064af4]
mov ecx, dword [0x1400624b8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140051543
mov r14, qword [rsi + 0x10]
test r14, r14
je 0x14005151f
mov r15, qword [rsi + 8]
shl r14, 4
add r14, r15
mov edi, dword [0x140064af0]
lea rbx, [rsp + 0x20]
mov r12, qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, dword [r15]
mov rcx, qword [r15 + 8]
mov rdx, rdi
mov r9, rbx
call r12
add r15, 0x10
cmp r15, r14
jne 0x140051506
mov qword [rsi + 0x10], 0
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14002ef70
nop
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rcx, [0x140064af4]
call fcn.14002de38
cmp dword [0x140064af4], 0xffffffff
jne 0x1400514e0
lea rdi, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rdi + 4]
mov dword [0x140064af0], eax
lea rcx, [0x140064af4]
call fcn.14002ddd8
jmp 0x1400514e0
Function at 0x140051580
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get system information on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
mov r14, qword [rcx + 8]
lea rbx, [r14 + 2]
call fcn.1400265f0
mov r8d, eax
mov rax, r14
xor edx, edx
div r8
mov rcx, rax
mov rax, rbx
xor edx, edx
div r8
cmp rcx, rax
je 0x1400515c3
mov rcx, rbx
call fcn.140050e80
test al, al
je 0x140051616
mov rdx, qword [rdi]
mov r8, qword [rdi + 8]
add r8, 2
mov qword [rsi], rdx
mov qword [rsi + 8], r8
mov qword [rsi + 0x10], 8
xor eax, eax
mov qword [rsi + 0x18], rax
mov qword [rsi + 0x28], rax
mov qword [rsi + 0x30], 0x20
lea rax, [rsi + 0x38]
mov qword [rsi + 0x20], rax
mov byte [rsi + 0x58], 1
add rsi, 0x60
mov r9d, 8
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.140006f40
mov rax, qword [rdi]
mov qword [rsi], rax
xor ecx, ecx
mov qword [rsi + 0x28], rcx
xorps xmm0, xmm0
movups xmmword [rsi + 8], xmm0
mov qword [rsi + 0x18], rcx
mov qword [rsi + 0x30], 0x20
lea rdx, [rsi + 0x38]
mov qword [rsi + 0x20], rdx
mov byte [rsi + 0x58], 0
mov qword [rsi + 0x60], rax
mov qword [rsi + 0x70], rcx
mov qword [rsi + 0x78], 2
lea rax, [rsi + 0x80]
mov qword [rsi + 0x68], rax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140001690
Capabilities:
Encode data using xor

Disassembly:
int3
mov qword [rsp + 0x18], rbx
cmpsd dword [rsi], dword [rdi]
push rsi
push rdi
lea rbp, [rsp - 0x74]
sub rsp, 0xb501c7
or rax, 0x3f398205
add byte [rcx], al
xor esi, dword [rcx + 0x48]
fadd dword [rbp + 0xc690]
mov bl, 0x89
jo 0x140001705
mov eax, dword [rbp + 0x48]
sub al, 5
fisub dword [rax + 3]
add byte [rax - 0x75], cl
stc
test eax, eax
je 0x14000170f
cmpsb byte [rsi], byte [rdi]
sal byte [rbx + 2], cl
mov dword [rdx], eax
xor ebp, dword [rdx + 0x48]
mov edi, 0x7b6c8
add byte [rax], al
lea rdx, [0x14002ef57]
mov qword [rcx], rbx
sbb byte [rdx + rbp*2], dl
sbb rax, 0xffffffff89ffffc0
dec dword [rax - 0x77]
pop rcx
adc byte [rsi - 0x77], ah
jo 0x14000168b
pavgw mm0, qword [rax + rax]
inc r8
cmp word [rdx + r8*2 + 0x75], bx
cmp dword [rdx + rax*2 + 0x75], ebx
imul cl
movabs dword [0x608205484800f020], eax
add ebp, dword [rax]
add rax, 0x28036082
xor ebx, ebx
lodsb al, byte [rsi]
sal byte [rbp + 0x73], 0xa
lea ecx, [rbp + 0x37]
mov dword [rbp + 0x76], 0x6c64746e
int1
je 0x140001798
insb byte [rdi], dx
cwd
push r15
insb byte [rdi], dx
add bh, al
test dword [rax + 0x52000000], eax
mov ebx, 0xafd056c
test byte [rax], al
add byte [rax], al
je 0x14000179e
mov dword gs:[rbp + 0x1b90], 0x6f697372
xor bh, al
test dword [rsp + rsi*4 + 0x6e0095], ecx
imul ebp, ebp, 0x300239ee
pop rsp
in eax, 0xc0
je 0x140001780
lea r12d, [r11]
xor ch, 0x9f
add byte [rax - 0x75], cl
enter 0x1515, 0x22
cmp dword [rdx], eax
add byte [rax - 0x77], cl
add eax, 0x2b03601a
fidiv word [rcx]
mov rsi, qword [rdx]
mul byte [rax + 3]
notrack jmp 0x1910fd811
xchg ebp, eax
sbb al, 1
add byte [rax], al
int1
and ebx, dword [rax - 0x357a3440]
add dword [rax], eax
add byte [rbx - 0x7cab09bc], cl
call 0x1988426b5
add dword [rbx], ebp
or ebp, 1
mov esi, edi
lodsd eax, dword [rsi]
add byte [rax], al
add byte [rbx + 0x287401d2], al
xor dword [rax], 0xf
jne 0x14000db1e
call 0x1580015f0
test al, al
mov ecx, 0xb6000049
pop rsi
adc al, byte [rax]
rol dword [rsi], 0xf
retf 0x4689
and byte [rcx + 0x2b], cl
leave
sub rax, qword [r9 + 0x30c1034d]
cmp eax, 0x100
jbe 0x14000dbd8
invalid
invalid
add byte [rax], al
invalid
cmp r8, 0xfffffffffe180000
ja 0x1403adc80
nop word [rax + rax - 0x37000000]
vmovdqu ymm1, ymmword [rdx]
vmovdqu ymm2, ymmword [rdx + 0x20]
pop rsp
invalid
add rcx, 0xc700
xor qword [rdx], 0x2a11
mov dword [rax], 0x32814800
adc dword [rdx], ebp
add byte [rax], al
ja 0x14000dc07
call 0x14000dd53
in eax, 0x81
clc
add byte [rcx], al
add byte [rax], al
jae 0x14000dbb6
lea r9, [r8 + 0x1f]
and r9, 0xffffffffffffffe0
mov r11, r9
shr r11, 5
adc byte [rax - 0x60], cl
mov edi, 0x7003a040
fiadd dword [rcx + 0x4c]
jrcxz 0x14000dbba
stosb byte [rdi], al
mov bl, 0x6f
mov edi, cs
add bh, bh
inc esp
movabs byte [0xffffff00528c7f7e], al
invalid
invalid