joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c0ec0
Capabilities:
Log keystrokes
Manipulate console buffer

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x70
mov rbx, rcx
mov ecx, dword [rcx + 0x58]
mov eax, dword [rbx + 0x7c]
mov edx, ecx
and dh, 0xef
sub eax, 1
mov dword [rbx + 0x58], edx
mov dword [rbx + 0x7c], eax
jne 0x1400c0f40
test cl, 1
je 0x1400c0f20
test edx, 0x10000
je 0x1400c0f07
test edx, 0x2000000
jne 0x1400c0f78
and edx, 0x200000
je 0x1400c0fd8
xor r12d, r12d
mov eax, r12d
add rsp, 0x70
pop rbx
pop r12
pop r13
ret
test cl, 4
je 0x1400c0ee7
mov edx, ecx
and edx, 0xffffeffb
and ecx, 8
mov dword [rbx + 0x58], edx
je 0x1400c0ee7
mov rax, qword [rbx + 8]
sub dword [rax + 8], 1
mov eax, dword [rbx + 0x7c]
test eax, eax
js 0x1400c0f50
mov edx, dword [rbx + 0x58]
jmp 0x1400c0ee7
lea rdx, str.src_win_tty.c
mov r8d, 0x423
lea rcx, [0x14029f9d7]
call qword [sym.imp.msvcrt.dll__assert]
mov edx, dword [rbx + 0x58]
jmp 0x1400c0ee7
mov r9d, 0x10
mov dword [rsp + 0x60], 0
mov rcx, qword [rbx + 0x110]
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x50], 0
mov r8d, 1
mov word [rsp + 0x50], r9w
lea r9, [rsp + 0x4c]
mov qword [rsp + 0x58], 0
call qword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
test eax, eax
jne 0x1400c0f07
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
jmp 0x1400c0f0a
lea r12, [0x140588078]
mov rcx, r12
call fcn.1400bc4b0
mov eax, 2
xchg dword [0x1405880cc], eax
cmp eax, 1
je 0x1400c1010
mov rcx, r12
call fcn.1400bc480
or dword [rbx + 0x58], 0x200000
jmp 0x1400c0f07
mov dword [rsp + 0x28], pe_nt_image_headers64
xor r9d, r9d
mov r8d, 3
mov edx, 0xc0000000
mov qword [rsp + 0x30], 0
lea rcx, str.conout_
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x1400c10e0
lea rdx, [0x1405880b0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
jne 0x1400c1178
mov ecx, 1
xor edx, edx
movabs rax, 0xd000100000001
mov word [rsp + 0x50], cx
mov ecx, 0xd
mov qword [rsp + 0x54], rax
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov r8d, 0xd
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x60], 0
mov word [rsp + 0x5e], r8w
lea r9, [rsp + 0x4c]
mov rcx, qword [rbx + 0x110]
mov r8d, 1
mov word [rsp + 0x5c], ax
call qword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
test eax, eax
je 0x1400c1160
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400c0fff
mov eax, 1
xor edx, edx
mov ecx, 0xd
mov word [rsp + 0x50], ax
movabs rax, 0xd000100000001
mov qword [rsp + 0x54], rax
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov edx, 0xd
lea r9, [rsp + 0x4c]
mov dword [rsp + 0x60], 0
mov word [rsp + 0x5e], dx
mov rcx, qword [rbx + 0x110]
lea rdx, [rsp + 0x50]
mov r8d, 1
mov word [rsp + 0x5c], ax
call qword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
test eax, eax
jne 0x1400c0fff
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
test r12d, r12d
jne 0x1400c0f0a
jmp 0x1400c0fff
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, r13
mov r12d, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400c114b
lock or dword [0x1405880c8], 1
jmp 0x1400c1069
Function at 0x1400c1af0
Capabilities:
Set socket configuration

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x2d8
cmp qword [rdx + 0x70], 0xffffffffffffffff
mov rbp, rcx
mov rsi, rdx
mov rbx, r8
mov edi, r9d
mov dword [rsp + 0x48], 1
jne 0x1400c1c90
lea r8, [rsp + 0x48]
mov edx, 0x8004667e
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
je 0x1400c1bd8
xor r8d, r8d
mov edx, 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x1400c1bc0
xor r9d, r9d
mov rdx, qword [rbp + 0x38]
mov r8, rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
test rax, rax
je 0x1400c1bc0
lea rax, [rsp + 0x4c]
lea r9, [rsp + 0x50]
mov edx, 0xffff
mov dword [rsp + 0x4c], 0x274
mov qword [rsp + 0x20], rax
mov r8d, 0x2005
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getsockopt]
cmp eax, 0xffffffff
je 0x1400c1bc0
cmp dword [rsp + 0x78], 1
je 0x1400c1c30
mov edx, dword [rsi + 0x58]
mov qword [rsi + 0x70], rbx
cmp edi, 0x17
je 0x1400c1c18
xor eax, eax
and edx, 0x400000
jne 0x1400c1bf0
add rsp, 0x2d8
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x2d8
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
add rsp, 0x2d8
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov dword [rsp + 0x3c], eax
mov r8d, 0x79
lea rdx, str.src_win_udp.c
lea rcx, str.__handle__flags__UV_HANDLE_IPV6_
call qword [sym.imp.msvcrt.dll__assert]
mov eax, dword [rsp + 0x3c]
jmp 0x1400c1bb4
or edx, 0x400000
xor eax, eax
mov dword [rsi + 0x58], edx
add rsp, 0x2d8
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov edx, 3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileCompletionNotificationModes]
test eax, eax
je 0x1400c1c70
mov rax, qword [0x1402b0f50]
mov edx, dword [rsi + 0x58]
mov qword [rsi + 0x198], rax
mov rax, qword [0x1402b0f60]
or edx, 0x20000
mov dword [rsi + 0x58], edx
mov qword [rsi + 0x1a0], rax
jmp 0x1400c1ba1
mov rbp, qword [sym.imp.KERNEL32.dll_GetLastError]
call rbp
cmp eax, 1
je 0x1400c1b9e
call rbp
jmp 0x1400c1bb4
mov eax, 0xfffff00e
jmp 0x1400c1bb4
Function at 0x1400c1ca0
Capabilities:
Set socket configuration

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
xor r12d, r12d
mov rbx, rcx
mov r13, rdx
mov edi, r8d
mov esi, r9d
mov dword [rsp + 0x38], 0
test byte [rcx + 0x59], 0x20
jne 0x1400c1d19
mov ebp, r9d
and ebp, 1
je 0x1400c1cdf
cmp word [rdx], 0x17
mov r12d, 0x57
jne 0x1400c1d19
mov rcx, qword [rbx + 0x70]
cmp rcx, 0xffffffffffffffff
je 0x1400c1db0
and esi, 4
jne 0x1400c1d30
cmp word [r13], 0x17
je 0x1400c1d6b
mov r8d, edi
mov rdx, r13
call qword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x1400c1df0
or dword [rbx + 0x58], 0x2000
xor r12d, r12d
mov eax, r12d
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
lea r9, [rsp + 0x3c]
mov dword [rsp + 0x3c], 1
mov edx, 0xffff
mov r8d, 4
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x1400c1df0
cmp word [r13], 0x17
mov rcx, qword [rbx + 0x70]
jne 0x1400c1cfa
or dword [rbx + 0x58], 0x400000
cmp word [r13], 0x17
jne 0x1400c1cfa
test ebp, ebp
jne 0x1400c1cfa
lea r9, [rsp + 0x38]
mov r8d, 0x1b
mov edx, 0x29
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, qword [rbx + 0x70]
jmp 0x1400c1cfa
movzx ecx, word [r13]
xor r8d, r8d
mov edx, 2
call qword [sym.imp.WS2_32.dll_socket]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x1400c1df0
mov rcx, qword [rbx + 8]
movzx r9d, word [r13]
mov r8, rax
mov rdx, rbx
call fcn.1400c1af0
mov r12d, eax
test eax, eax
jne 0x1400c1e00
mov rcx, qword [rbx + 0x70]
jmp 0x1400c1ced
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r12d, eax
jmp 0x1400c1d19
mov rcx, r14
call qword [sym.imp.WS2_32.dll_closesocket]
jmp 0x1400c1d19
Function at 0x1400c2030
Capabilities:
Set socket configuration

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x168
xor eax, eax
mov ebp, dword [rsp + 0x1c0]
lea r13, [rsp + 0x50]
mov r12, rcx
mov ecx, 0x21
mov rsi, rdx
mov rdi, r13
mov r10, r8
mov rbx, r9
rep stosq qword [rdi], rax
test r8, r8
je 0x1400c2084
xor edx, edx
lea r8, [rsp + 0x30]
mov rcx, r10
call fcn.1400a1990
test eax, eax
jne 0x1400c20f4
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x50], eax
mov rax, qword [rsi + 0x10]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rbx]
mov qword [rsp + 0x68], rax
mov eax, dword [rsi + 0x18]
movups xmmword [rsp + 0x58], xmm0
mov dword [rsp + 0x70], eax
mov rax, qword [rbx + 0x10]
movups xmmword [rsp + 0xd8], xmm1
mov qword [rsp + 0xe8], rax
mov eax, dword [rbx + 0x18]
mov dword [rsp + 0xf0], eax
cmp ebp, 1
je 0x1400c2120
test ebp, ebp
jne 0x1400c2128
mov r8d, 0x2e
mov dword [rsp + 0x20], 0x108
mov rcx, qword [r12 + 0x70]
mov r9, r13
mov edx, 0x29
call qword [sym.imp.WS2_32.dll_setsockopt]
mov r8d, eax
xor eax, eax
cmp r8d, 0xffffffff
je 0x1400c2108
add rsp, 0x168
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.1400a4200
jmp 0x1400c20f4
mov r8d, 0x2d
jmp 0x1400c20ce
mov eax, 0xfffff019
jmp 0x1400c20f4
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x20
mov eax, dword [rcx + 0x58]
mov edi, dword [rsp + 0x70]
and eax, 0x402000
mov r12, rcx
mov r13, rdx
mov rbx, r8
mov rsi, r9
cmp eax, 0x2000
je 0x1400c2cf8
mov rdx, qword [0x1402b0f80]
mov r9d, 4
mov r8d, 0x1c
call fcn.1400c1ca0
test eax, eax
jne 0x1400c2ce0
mov r9, rsi
mov r8, rbx
mov rdx, r13
mov rcx, r12
mov dword [rsp + 0x70], edi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop r12
pop r13
jmp 0x1400c2030
mov ecx, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop r12
pop r13
jmp fcn.1400a4200
mov eax, 0xfffff019
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
Function at 0x1400c2b50
Capabilities:
Set socket configuration

Disassembly:
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x70
mov eax, dword [rcx + 0x58]
and eax, 0x402000
mov rbx, rcx
mov rdi, rdx
mov r13, r8
mov esi, r9d
cmp eax, 0x2000
je 0x1400c2c20
mov rdx, qword [0x1402b0f80]
mov r9d, 4
mov r8d, 0x1c
call fcn.1400c1ca0
mov r12d, eax
test eax, eax
jne 0x1400c2c40
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x40], 0
test r13, r13
je 0x1400c2bd7
xor edx, edx
lea r8, [rsp + 0x50]
mov rcx, r13
call fcn.1400a1990
test eax, eax
jne 0x1400c2c20
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x40], eax
movdqu xmm0, xmmword [rdi + 8]
movups xmmword [rsp + 0x30], xmm0
test esi, esi
je 0x1400c2c38
mov r8d, 0xc
cmp esi, 1
jne 0x1400c2c20
mov rcx, qword [rbx + 0x70]
lea r9, [rsp + 0x30]
mov edx, 0x29
mov dword [rsp + 0x20], 0x14
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x1400c2c58
mov eax, r12d
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
mov r12d, 0xfffff019
mov eax, r12d
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
mov r8d, 0xd
jmp 0x1400c2bf0
mov ecx, eax
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop r12
pop r13
jmp fcn.1400a4200
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.1400a4200
mov r12d, eax
jmp 0x1400c2c11
Function at 0x1400c2c70
Capabilities:
Set socket configuration

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x168
xor eax, eax
mov ebp, dword [rsp + 0x1c0]
lea r13, [rsp + 0x50]
mov r12, rcx
mov ecx, 0x21
mov rsi, rdx
mov rdi, r13
mov r10, r8
mov rbx, r9
rep stosq qword [rdi], rax
test r8, r8
je 0x1400c2084
xor edx, edx
lea r8, [rsp + 0x30]
mov rcx, r10
call fcn.1400a1990
test eax, eax
jne 0x1400c20f4
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x50], eax
mov rax, qword [rsi + 0x10]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rbx]
mov qword [rsp + 0x68], rax
mov eax, dword [rsi + 0x18]
movups xmmword [rsp + 0x58], xmm0
mov dword [rsp + 0x70], eax
mov rax, qword [rbx + 0x10]
movups xmmword [rsp + 0xd8], xmm1
mov qword [rsp + 0xe8], rax
mov eax, dword [rbx + 0x18]
mov dword [rsp + 0xf0], eax
cmp ebp, 1
je 0x1400c2120
test ebp, ebp
jne 0x1400c2128
mov r8d, 0x2e
mov dword [rsp + 0x20], 0x108
mov rcx, qword [r12 + 0x70]
mov r9, r13
mov edx, 0x29
call qword [sym.imp.WS2_32.dll_setsockopt]
mov r8d, eax
xor eax, eax
cmp r8d, 0xffffffff
je 0x1400c2108
add rsp, 0x168
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.1400a4200
jmp 0x1400c20f4
mov r8d, 0x2d
jmp 0x1400c20ce
mov eax, 0xfffff019
jmp 0x1400c20f4
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x20
mov eax, dword [rcx + 0x58]
mov edi, dword [rsp + 0x70]
and eax, 0x402000
mov r12, rcx
mov r13, rdx
mov rbx, r8
mov rsi, r9
cmp eax, 0x2000
je 0x1400c2cf8
mov rdx, qword [0x1402b0f80]
mov r9d, 4
mov r8d, 0x1c
call fcn.1400c1ca0
test eax, eax
jne 0x1400c2ce0
mov r9, rsi
mov r8, rbx
mov rdx, r13
mov rcx, r12
mov dword [rsp + 0x70], edi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop r12
pop r13
jmp 0x1400c2030
mov ecx, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop r12
pop r13
jmp fcn.1400a4200
mov eax, 0xfffff019
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
Function at 0x1400c38e0
Capabilities:
Send data
Send data on socket

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xe8
mov esi, dword [rsp + 0x140]
mov rbx, rcx
mov r13, rdx
mov edi, r8d
mov r12, r9
test r8d, r8d
je 0x1400c39e0
test r12, r12
je 0x1400c392b
lea rbp, [rsp + 0x60]
mov rcx, r12
mov rdx, rbp
call fcn.1400c7100
test eax, eax
jne 0x1400c39ab
mov r12, rbp
cmp qword [rbx + 0x68], 0
jne 0x1400c3a13
test byte [rbx + 0x59], 0x20
jne 0x1400c3967
cmp esi, 0x10
je 0x1400c3a00
cmp esi, 0x1c
jne 0x1400c3a0c
mov rdx, qword [0x1402b0f80]
xor r9d, r9d
mov r8d, esi
mov rcx, rbx
call fcn.1400c1ca0
test eax, eax
jne 0x1400c39c6
mov r8d, edi
mov dword [rsp + 0x30], esi
mov rcx, qword [rbx + 0x70]
lea r9, [rsp + 0x5c]
mov qword [rsp + 0x40], 0
mov rdx, r13
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], 0
call qword [sym.imp.WS2_32.dll_WSASendTo]
mov r8d, eax
mov eax, dword [rsp + 0x5c]
test r8d, r8d
jne 0x1400c39c0
add rsp, 0xe8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.1400a4200
add rsp, 0xe8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov r8d, 0x477
lea rdx, str.src_win_udp.c
lea rcx, str.nbufs___0
call qword [sym.imp.msvcrt.dll__assert]
jmp 0x1400c390b
mov rdx, qword [0x1402b0f70]
jmp 0x1400c3955
mov eax, 0xfffff019
jmp 0x1400c39ab
mov eax, 0xfffff008
jmp 0x1400c39ab
Function at 0x1400c3cd0
Capabilities:
Get common file path

Disassembly:
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rsi, rcx
mov rbx, rdx
test rcx, rcx
je 0x1400c3e40
test rdx, rdx
je 0x1400c3e40
mov rdi, qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor edx, edx
xor ecx, ecx
call rdi
mov r13d, eax
test eax, eax
je 0x1400c3e08
mov ecx, eax
add rcx, rcx
call fcn.14009f970
mov r12, rax
test rax, rax
je 0x1400c3e47
mov rdx, rax
mov ecx, r13d
call rdi
test eax, eax
je 0x1400c3e00
mov edx, eax
xor ecx, ecx
mov word [r12 + rdx*2], cx
lea edx, [rax - 1]
lea rdx, [r12 + rdx*2]
cmp word [rdx], 0x5c
je 0x1400c3e20
xor edx, edx
mov r9d, 0xffffffff
mov r8, r12
mov ecx, 0xfde9
mov qword [rsp + 0x38], 0
mov rdi, qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call rdi
test eax, eax
je 0x1400c3e00
mov rdx, qword [rbx]
mov ecx, edx
cmp edx, eax
jl 0x1400c3e4e
cmp rdx, 0x7fffffff
mov eax, 0x7fffffff
mov r8, r12
mov qword [rsp + 0x20], rsi
cmova ecx, eax
mov r9d, 0xffffffff
xor edx, edx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], ecx
mov ecx, 0xfde9
call rdi
mov rcx, r12
mov esi, eax
call fcn.14009f990
test esi, esi
je 0x1400c3e08
sub esi, 1
xor eax, eax
movsxd rsi, esi
mov qword [rbx], rsi
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
mov rcx, r12
call fcn.14009f990
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop r12
pop r13
jmp fcn.1400a4200
cmp eax, 3
je 0x1400c3e30
xor eax, eax
mov word [rdx], ax
jmp 0x1400c3d4b
cmp word [r12 + 2], 0x3a
jne 0x1400c3e25
jmp 0x1400c3d4b
mov eax, 0xfffff019
jmp 0x1400c3ded
mov eax, 0xfffff027
jmp 0x1400c3ded
mov rcx, r12
mov dword [rsp + 0x4c], eax
call fcn.14009f990
movsxd rax, dword [rsp + 0x4c]
mov qword [rbx], rax
mov eax, 0xfffff024
jmp 0x1400c3ded
Function at 0x1400c3e70
Capabilities:
Get common file path
Set current directory
Set environment variable

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rbx, rcx
test rcx, rcx
je 0x1400c4018
mov r8, rcx
mov rsi, qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor edx, edx
mov ecx, 0xfde9
mov dword [rsp + 0x28], 0
mov r9d, 0xffffffff
mov qword [rsp + 0x20], 0
call rsi
movsxd rdi, eax
test rdi, rdi
je 0x1400c3f58
lea rbp, [rdi + rdi]
mov rcx, rbp
call fcn.14009f970
mov r12, rax
test rax, rax
je 0x1400c4022
mov ecx, 0xfde9
mov dword [rsp + 0x28], edi
mov r8, rbx
xor edx, edx
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
call rsi
mov rcx, r12
test eax, eax
je 0x1400c3f53
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x1400c3f50
mov rsi, qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov rdx, r12
mov ecx, edi
call rsi
mov ebx, eax
cmp rdi, rbx
jb 0x1400c3f78
cmp word [r12 + rbp - 2], 0x5c
je 0x1400c3fa0
cmp rdi, 1
jbe 0x1400c3f37
cmp word [r12 + 2], 0x3a
je 0x1400c3fd0
mov rcx, r12
call fcn.14009f990
xor eax, eax
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rcx, r12
call fcn.14009f990
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp fcn.1400a4200
mov rcx, r12
call fcn.14009f990
lea rcx, [rbx + rbx]
call fcn.14009f970
mov r12, rax
xor eax, eax
test r12, r12
je 0x1400c3f41
mov rdx, r12
mov ecx, ebx
call rsi
jmp 0x1400c3f17
cmp rdi, 3
je 0x1400c3fc0
sub rdi, 1
xor ecx, ecx
mov word [r12 + rdi*2], cx
jmp 0x1400c3f24
cmp word [r12 + 2], 0x3a
jne 0x1400c3fa6
nop dword [rax]
movzx eax, word [r12]
lea edx, [rax - 0x41]
cmp dx, 0x19
jbe 0x1400c3fee
lea edx, [rax - 0x61]
cmp dx, 0x19
ja 0x1400c3f37
sub eax, 0x20
mov edx, 0x3d
mov word [rsp + 0x3a], ax
lea rcx, [rsp + 0x38]
mov word [rsp + 0x38], dx
mov rdx, r12
mov dword [rsp + 0x3c], 0x3a
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
jmp 0x1400c3f37
mov eax, 0xfffff019
jmp 0x1400c3f41
mov eax, 0xfffff027
jmp 0x1400c3f41

Function at 0x1400c4050
Capabilities:
Get memory capacity

Disassembly:
sub rsp, 0x68
mov dword [rsp + 0x20], 0x40
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
mov rax, 0xffffffffffffffff
cmovne rax, qword [rsp + 0x30]
add rsp, 0x68
ret

Function at 0x1400c4080
Capabilities:
Get memory capacity

Disassembly:
sub rsp, 0x68
mov dword [rsp + 0x20], 0x40
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
mov rax, 0xffffffffffffffff
cmovne rax, qword [rsp + 0x28]
add rsp, 0x68
ret
Function at 0x1400c40d0
Capabilities:
Enumerate processes

Disassembly:
push r13
push r12
push rsi
push rbx
sub rsp, 0x158
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov ecx, 2
mov ebx, eax
mov dword [rsp + 0x20], 0x130
lea rsi, [rsp + 0x20]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdx, rsi
mov rcx, rax
mov r12, rax
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x1400c4127
jmp 0x1400c4150
mov rdx, rsi
mov rcx, r12
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x1400c4150
cmp dword [rsp + 0x28], ebx
jne 0x1400c4118
mov r13d, dword [rsp + 0x40]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, r13d
add rsp, 0x158
pop rbx
pop rsi
pop r12
pop r13
ret
mov r13d, 0xffffffff
jmp 0x1400c4132

Function at 0x1400c4c60
Capabilities:
Get common file path

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rdi, rcx
mov rsi, rdx
test rcx, rcx
je 0x1400c4dd0
test rdx, rdx
je 0x1400c4dd0
cmp qword [rdx], 0
je 0x1400c4dd0
mov rbp, qword [sym.imp.KERNEL32.dll_GetTempPathW]
xor edx, edx
xor ecx, ecx
call rbp
mov ebx, eax
mov eax, eax
test rax, rax
je 0x1400c4d88
lea rcx, [rax + rax + 2]
call fcn.14009f970
mov r12, rax
test rax, rax
je 0x1400c4dd7
lea ecx, [rbx + 1]
mov rdx, rax
call rbp
mov eax, eax
test rax, rax
je 0x1400c4d80
cmp word [r12 + rax*2 - 2], 0x5c
je 0x1400c4da0
xor edx, edx
mov r9d, 0xffffffff
mov r8, r12
mov ecx, 0xfde9
mov qword [rsp + 0x38], 0
mov rbx, qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call rbx
test eax, eax
je 0x1400c4d80
mov rdx, qword [rsi]
mov eax, eax
cmp rax, rdx
ja 0x1400c4dde
mov dword [rsp + 0x28], edx
mov ecx, 0xfde9
xor edx, edx
mov r8, r12
mov qword [rsp + 0x38], 0
mov r9d, 0xffffffff
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rdi
call rbx
mov rcx, r12
mov ebx, eax
call fcn.14009f990
test ebx, ebx
je 0x1400c4d88
lea eax, [rbx - 1]
mov qword [rsi], rax
xor eax, eax
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, r12
call fcn.14009f990
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.1400a4200
cmp rax, 3
je 0x1400c4db8
xor edx, edx
mov word [r12 + rax*2 - 2], dx
jmp 0x1400c4cdc
cmp word [r12 + 2], 0x3a
jne 0x1400c4da6
jmp 0x1400c4cdc
mov eax, 0xfffff019
jmp 0x1400c4d6d
mov eax, 0xfffff027
jmp 0x1400c4d6d
mov rcx, r12
mov qword [rsp + 0x48], rax
call fcn.14009f990
mov rax, qword [rsp + 0x48]
mov qword [rsi], rax
mov eax, 0xfffff024
jmp 0x1400c4d6d
Function at 0x1400c54e0
Capabilities:
Get common file path
Get session user name

Disassembly:
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x258
mov rbx, rcx
test rcx, rcx
je 0x1400c56ae
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x38]
mov edx, 0x20008
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400c55f8
lea r13, [rsp + 0x34]
xor edx, edx
mov dword [rsp + 0x34], 0
mov rcx, qword [rsp + 0x38]
mov rdi, qword [sym.imp.USERENV.dll_GetUserProfileDirectoryW]
mov r8, r13
call rdi
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
call rsi
cmp eax, 0x7a
jne 0x1400c55c8
mov ecx, dword [rsp + 0x34]
add rcx, rcx
call fcn.14009f970
mov r12, rax
test rax, rax
je 0x1400c56c2
mov rcx, qword [rsp + 0x38]
mov r8, r13
mov rdx, rax
call rdi
test eax, eax
je 0x1400c5670
lea r14, [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x34], 0x101
mov rdx, r13
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x1400c5610
call rsi
mov rcx, r12
mov r13d, eax
call fcn.14009f990
cmp r13d, 0x7a
je 0x1400c56b8
mov ecx, r13d
call fcn.1400a4200
jmp 0x1400c55e0
call rsi
mov rcx, qword [rsp + 0x38]
mov r12d, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, r12d
call fcn.1400a4200
add rsp, 0x258
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400a4200
jmp 0x1400c55e0
mov qword [rbx + 0x18], 0
lea r8, [rbx + 0x18]
mov edx, 0xffffffff
mov rcx, r12
call fcn.1400c4e40
mov rcx, r12
mov dword [rsp + 0x2c], eax
call fcn.14009f990
mov eax, dword [rsp + 0x2c]
test eax, eax
jne 0x1400c55e0
mov qword [rbx], 0
mov r8, rbx
mov edx, 0xffffffff
mov rcx, r14
call fcn.1400c4e40
test eax, eax
jne 0x1400c5698
mov qword [rbx + 8], 0xffffffffffffffff
mov qword [rbx + 0x10], 0
jmp 0x1400c55e0
call rsi
mov rcx, qword [rsp + 0x38]
mov r13d, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r12
call fcn.14009f990
mov ecx, r13d
call fcn.1400a4200
jmp 0x1400c55e0
mov rcx, qword [rbx + 0x18]
mov dword [rsp + 0x2c], eax
call fcn.14009f990
mov eax, dword [rsp + 0x2c]
jmp 0x1400c55e0
mov eax, 0xfffff019
jmp 0x1400c55e0
mov eax, 0xfffff027
jmp 0x1400c55e0
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xfffff027
jmp 0x1400c55e0