joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140021110
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test r9d, 0xff000000
je 0x1400212a1
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
movss xmm3, dword [rsp + 0x70]
xorps xmm0, xmm0
comiss xmm3, xmm0
mov edi, r9d
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
jbe 0x140021180
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x20], eax
call fcn.140020ad0
mov r8d, dword [rbx + 0x80]
mov r9d, edi
mov rdx, qword [rbx + 0x88]
mov rcx, rbx
call fcn.140020160
mov dword [rbx + 0x80], 0
jmp 0x14002128d
mov edx, 6
movaps xmmword [rsp + 0x30], xmm6
lea r8d, [rdx - 2]
call fcn.14001ee40
movzx edx, word [rbx + 0x48]
mov rax, qword [rbx + 0x38]
movss xmm1, dword [rsi]
movss xmm2, dword [rbp + 4]
movss xmm3, dword [rbp]
lea ecx, [rdx + 1]
movss xmm6, dword [rax + 4]
movss xmm5, dword [rax]
movss xmm4, dword [rsi + 4]
mov rax, qword [rbx + 0x58]
mov word [rax], dx
mov rax, qword [rbx + 0x58]
mov word [rax + 2], cx
lea ecx, [rdx + 2]
mov rax, qword [rbx + 0x58]
mov word [rax + 4], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 6], dx
add dx, 3
mov rax, qword [rbx + 0x58]
mov word [rax + 8], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 0xa], dx
movsd xmm0, qword [rbp]
mov rax, qword [rbx + 0x50]
movsd qword [rax], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 8], xmm5
movss dword [rax + 0xc], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x10], edi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x14], xmm1
movss dword [rax + 0x18], xmm2
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x1c], xmm5
movss dword [rax + 0x20], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x24], edi
movsd xmm0, qword [rsi]
mov rax, qword [rbx + 0x50]
movsd qword [rax + 0x28], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x30], xmm5
movss dword [rax + 0x34], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x38], edi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x3c], xmm3
movss dword [rax + 0x40], xmm4
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x44], xmm5
movss dword [rax + 0x48], xmm6
mov rax, qword [rbx + 0x50]
movaps xmm6, xmmword [rsp + 0x30]
mov dword [rax + 0x4c], edi
add qword [rbx + 0x50], 0x50
add dword [rbx + 0x48], 4
add qword [rbx + 0x58], 0xc
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140028b70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
mov rdi, rcx
movaps xmmword [rsp + 0x30], xmm7
movaps xmmword [rsp + 0x20], xmm8
movaps xmm8, xmm3
movzx esi, r8w
test rdx, rdx
je 0x140028c23
movss xmm1, dword [rsp + 0xb8]
movss xmm6, dword [rdx + 0x40]
comiss xmm6, xmm1
ja 0x140028bbf
movss xmm6, dword [rdx + 0x44]
minss xmm6, xmm1
ucomiss xmm6, xmm1
movss xmm2, dword [0x1400a39f0]
jp 0x140028bd9
jne 0x140028bd9
movss xmm7, dword [rsp + 0x88]
jmp 0x140028c07
cmp byte [rdx + 0x20], 0
movaps xmm0, xmm6
subss xmm0, xmm1
mulss xmm0, xmm2
je 0x140028bf5
cvttss2si eax, xmm0
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss xmm7, dword [rsp + 0x88]
addss xmm8, xmm0
addss xmm7, xmm0
cmp byte [rdx + 0x20], 0
je 0x140028c1c
addss xmm6, xmm2
cvttss2si eax, xmm6
movd xmm6, eax
cvtdq2ps xmm6, xmm6
addss xmm6, dword [rdx + 0x24]
jmp 0x140028c35
movss xmm6, dword [rsp + 0xb8]
movss xmm7, dword [rsp + 0x88]
mov edx, dword [rcx + 0x28]
add rcx, 0x28
inc edx
call fcn.14002a330
cmp dword [rdi + 0x28], 0
jg 0x140028c63
mov r8d, 0x594
lea rdx, [0x140035540]
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movsxd rax, dword [rdi + 0x28]
mov r9d, 0x80000000
mov r8, qword [rdi + 0x30]
movss xmm0, dword [rsp + 0x90]
movss xmm1, dword [rsp + 0x80]
lea rdx, [rax + rax*4]
mov ecx, dword [r8 + rdx*8 - 0x28]
and ecx, r9d
or ecx, esi
ucomiss xmm8, xmm7
jp 0x140028c99
je 0x140028ca0
ucomiss xmm1, xmm0
jp 0x140028ca3
jne 0x140028ca3
xor r9d, r9d
mov rbx, qword [rsp + 0x60]
btr ecx, 0x1f
mov rsi, qword [rsp + 0x68]
or ecx, r9d
movss dword [r8 + rdx*8 - 0x1c], xmm1
movss xmm1, dword [rsp + 0xa0]
movss dword [r8 + rdx*8 - 0x14], xmm0
movss xmm0, dword [rsp + 0x98]
movss dword [r8 + rdx*8 - 0xc], xmm1
movss xmm1, dword [rsp + 0xb0]
movss dword [r8 + rdx*8 - 0x10], xmm0
movss xmm0, dword [rsp + 0xa8]
movss dword [r8 + rdx*8 - 4], xmm1
movss dword [r8 + rdx*8 - 8], xmm0
mov dword [r8 + rdx*8 - 0x28], ecx
movss dword [r8 + rdx*8 - 0x20], xmm8
movaps xmm8, xmmword [rsp + 0x20]
movss dword [r8 + rdx*8 - 0x18], xmm7
movaps xmm7, xmmword [rsp + 0x30]
movss dword [r8 + rdx*8 - 0x24], xmm6
mov rax, qword [rdi + 0x40]
movaps xmm6, xmmword [rsp + 0x40]
movd xmm3, dword [rax + 0x14]
mov byte [rdi + 0x56], 1
movd xmm1, dword [rax + 0x38]
movss xmm0, dword [r8 + rdx*8 - 8]
subss xmm0, dword [r8 + rdx*8 - 0x10]
movss xmm2, dword [r8 + rdx*8 - 4]
subss xmm2, dword [r8 + rdx*8 - 0xc]
cvtdq2ps xmm1, xmm1
cvtdq2ps xmm3, xmm3
mulss xmm1, xmm0
movd xmm0, dword [rax + 0x3c]
addss xmm3, dword [0x1400a3a1c]
cvtdq2ps xmm0, xmm0
addss xmm1, xmm3
mulss xmm2, xmm0
addss xmm2, xmm3
cvttss2si ecx, xmm1
cvttss2si eax, xmm2
imul ecx, eax
add dword [rdi + 0x64], ecx
add rsp, 0x50
pop rdi
ret
Function at 0x1400344e4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14003452e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14003452e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14003452e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14003452e
cmp dword [rcx + 0x84], 0xe
jbe 0x14003452e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140034530
xor al, al
add rsp, 0x28
ret
Function at 0x140001000
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
xor edi, edi
lea r9, [rsp + 0x40]
xor r8d, r8d
mov dword [rsp + 0x40], edi
xor edx, edx
lea ecx, [rdi + 0xb]
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x1400010b1
mov edx, eax
xor ecx, ecx
mov r8d, 0x65733332
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov r8d, dword [rsp + 0x40]
lea r9, [rsp + 0x40]
mov rdx, rax
lea ecx, [rdi + 0xb]
mov r14, rax
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
test eax, eax
js 0x1400010b1
mov esi, dword [r14]
mov r15d, edi
mov ebp, edi
mov ebx, edi
test esi, esi
je 0x1400010dd
nop dword [rax]
nop dword [rax + rax]
mov ebp, ebx
lea rcx, [r14 + 0x30]
imul rax, rbp, 0x128
lea rdx, [0x1400019f0]
add rcx, rax
call sub.ntoskrnl.exe_strcmp
test eax, eax
je 0x1400010cc
inc ebx
cmp ebx, esi
jb 0x140001080
xor edx, edx
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor al, al
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
imul rax, rbp, 0x128
mov r15, qword [rax + r14 + 0x18]
mov ebp, dword [rax + r14 + 0x20]
xor edx, edx
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
test r15, r15
je 0x1400010b1
test rbp, rbp
je 0x1400010b1
lea r10, [0x140001a20]
mov r9, r15
sub r9, r10
nop
lea rdx, [0x140001a30]
mov cl, 0x78
mov rax, r10
lea r8, [r9 + rdi]
cmp cl, 0x78
jne 0x14000111e
movzx ecx, byte [rdx]
cmp byte [r8 + rax], cl
jne 0x14000118e
movzx ecx, byte [rax + 1]
inc rax
inc rdx
test cl, cl
jne 0x140001110
lea rcx, [rdi + r15]
test rcx, rcx
je 0x1400010b1
mov edi, dword [rcx + 3]
mov edx, 0xaf0
add rdi, rcx
mov r8d, 0x65733332
mov ecx, 0x200
mov rsi, qword [rdi + 7]
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
test rax, rax
je 0x1400010b1
xor edx, edx
mov r8d, 0xaf0
mov rcx, rax
call fcn.140001900
mov edx, 0x65733332
mov qword [rdi + 7], rbx
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov al, 1
jmp 0x1400010b3
inc rdi
cmp rdi, rbp
jb 0x140001100
jmp 0x1400010b1
Function at 0x1400011a0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
xor edx, edx
lea r9, [rsp + 0x60]
xor r12d, r12d
xor r8d, r8d
mov dword [rsp + 0x60], r12d
lea ecx, [rdx + 0xb]
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov edx, dword [rsp + 0x60]
xor ecx, ecx
mov r8d, 0x65733332
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov r8d, dword [rsp + 0x60]
lea r9, [rsp + 0x60]
mov rdx, rax
lea ecx, [r12 + 0xb]
mov r14, rax
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov esi, dword [r14]
mov ebp, r12d
mov qword [rsp + 0x68], r12
mov r13d, r12d
mov ebx, r12d
test esi, esi
je 0x14000124f
mov edi, ebx
lea rcx, [r14 + 0x30]
imul rax, rdi, 0x128
lea rdx, [0x1400019f0]
add rcx, rax
call sub.ntoskrnl.exe_strcmp
test eax, eax
je 0x140001239
inc ebx
cmp ebx, esi
jb 0x140001211
jmp 0x14000124f
imul rax, rdi, 0x128
mov rbp, qword [rax + r14 + 0x18]
mov r13d, dword [rax + r14 + 0x20]
mov qword [rsp + 0x68], rbp
xor edx, edx
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
lea rax, [0x140001a40]
mov rdi, 0xffffffffffffffff
nop dword [rax + rax]
inc rdi
cmp byte [rax + rdi], r12b
jne 0x140001270
sub r13, rdi
mov r15, rbp
neg r15
mov rsi, rbp
lea rcx, [0x140001a60]
test rdi, rdi
je 0x1400012d2
mov rbx, rsi
lea r14, [r15 + rcx]
lea rbp, [r15 + rax]
nop dword [rax]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x14000136a
movzx eax, byte [r14 + rbx]
cmp byte [rbx], al
je 0x1400012c4
cmp byte [rbx + rbp], 0x3f
jne 0x14000136a
inc rbx
mov rax, rbx
sub rax, rsi
cmp rax, rdi
jb 0x1400012a0
mov rcx, qword [rsp + 0x68]
add rcx, r12
je 0x14000138b
mov eax, dword [rcx + 3]
add eax, 7
movsxd rsi, eax
add rsi, rcx
je 0x14000138b
mov rdi, qword [rsi + 0x10]
add rdi, 0x20
cmp dword [rdi + 0x20], 0x5284eac3
jne 0x140001328
mov rax, qword [rdi]
cmp qword [rax + 8], rdi
jne 0x140001384
mov rcx, qword [rdi + 8]
cmp qword [rcx], rdi
jne 0x140001384
mov qword [rcx], rax
mov rdx, rdi
mov qword [rax + 8], rcx
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_RtlDeleteElementGenericTableAvl]
mov rbx, qword [rdi]
cmp rbx, qword [rdi + 8]
je 0x140001390
cmp dword [rbx + 0x20], 0x5284eac3
jne 0x14000135f
mov rax, qword [rbx]
cmp qword [rax + 8], rbx
jne 0x140001384
mov rcx, qword [rbx + 8]
cmp qword [rcx], rbx
jne 0x140001384
mov qword [rcx], rax
mov rdx, rbx
mov qword [rax + 8], rcx
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_RtlDeleteElementGenericTableAvl]
mov rbx, qword [rbx]
cmp rbx, qword [rdi + 8]
jne 0x140001331
jmp 0x140001390
inc r12
dec r15
inc rsi
cmp r12, r13
ja 0x14000138b
lea rax, [0x140001a40]
jmp 0x140001285
mov ecx, 3
int 0x29
mov eax, 0xc0000225
mov rbx, qword [rsp + 0x70]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x2fc4cfe40
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4d0842
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f3108]
test eax, eax
je 0x2fc4d08da
lea rax, [0x2fc4f30e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f3110]
mov qword [rbp - 8], rax
jmp 0x2fc4d08be
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d08b2
cmp qword [rbp - 0x10], 0
je 0x2fc4d08b2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d0878
lea rax, [0x2fc4f30e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d08db
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d09e0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d0a08
mov eax, 0
jmp 0x2fc4d0a56
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d0a31
mov eax, 0
jmp 0x2fc4d0a56
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d0a51
mov eax, 0
jmp 0x2fc4d0a56
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d0a5c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d0ada
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d0ad1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d0ad1
mov rax, qword [rbp - 8]
jmp 0x2fc4d0aef
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d0aa4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140002b50
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x2150
call fcn.1400055d0
sub rsp, rax
mov rax, qword [0x140027040]
xor rax, rsp
mov qword [rsp + 0x2140], rax
mov rsi, rdx
lea r9, [rsp + 0x20]
lea rdx, [rsp + 0x30]
mov r8d, 0x2000
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x140002c14
xor ebx, ebx
test dword [rsp + 0x20], 0xfffffff8
jbe 0x140002c14
nop dword [rax + rax]
lea rdi, [rsp + 0x30]
mov r9d, 0x104
mov rdx, qword [rdi + rbx*8]
lea rdi, [rdi + rbx*8]
lea r8, [rsp + 0x2030]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExA]
test eax, eax
je 0x140002c07
lea rax, [rsp + 0x2030]
mov r8, rsi
sub r8, rax
nop word [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140002c03
inc rax
test ecx, ecx
jne 0x140002bf0
test edx, edx
je 0x140002c3f
mov eax, dword [rsp + 0x20]
inc ebx
shr eax, 3
cmp ebx, eax
jb 0x140002bb0
xor eax, eax
mov rcx, qword [rsp + 0x2140]
xor rcx, rsp
call fcn.140004780
lea r11, [rsp + 0x2150]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov rax, qword [rdi]
jmp 0x140002c16
Function at 0x140002c50
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rbp, rcx
mov r12, r9
mov rcx, rdx
mov r15, r8
mov rsi, rdx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
jne 0x140002d0b
mov rdx, rsi
mov rcx, rbp
call fcn.140002b50
mov r14, rax
test rax, rax
jne 0x140002cc0
mov rdx, rsi
lea rcx, str.Module__s_was_not_loaded._Unable_to_call_remote_function.
call fcn.1400019d0
xor eax, eax
jmp 0x140002dfd
xor edx, edx
mov rcx, rsi
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rcx, rax
mov rdx, r15
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov rcx, rdi
sub rbx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
add r14, rbx
jne 0x140002d0b
mov r8, r15
lea rcx, str.Unable_to_get_remote_function_address__s__s_n
mov rdx, rsi
call fcn.1400019d0
xor eax, eax
jmp 0x140002dfd
mov rdi, qword [rsp + 0x80]
xor ebx, ebx
test rdi, rdi
je 0x140002d82
mov r9d, 0x1000
mov dword [rsp + 0x20], 0x40
mov r8, r12
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rbx, rax
test rax, rax
je 0x140002d72
mov r9, r12
mov qword [rsp + 0x20], 0
mov r8, rdi
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x140002d82
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rdi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
lea rcx, str.Unable_to_allocate_memory_for_parameters._n
call fcn.1400019d0
xor eax, eax
jmp 0x140002dfd
mov qword [rsp + 0x30], 0
mov r9, r14
mov dword [rsp + 0x28], 0
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rbx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov r14, rax
test rax, rax
jne 0x140002dc7
mov r8, r15
lea rcx, str.Unable_to_create_remote_thread_for__s__s_n
mov rdx, rsi
call fcn.1400019d0
xor eax, eax
jmp 0x140002dfd
mov edx, 0xffffffff
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x140002df8
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rdi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov eax, 1
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r12
ret
Function at 0x14000420c
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x140004246
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x14000424b
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140004294
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x1400234f0]
cmp byte [rcx + rax], 0
je 0x140004294
dec r8
sub rdx, 1
jne 0x14000427a
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x140005320
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000536a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000536a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000536a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000536a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000536a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000536c
xor al, al
add rsp, 0x28
ret
Function at 0x180002710
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
and rsp, 0xfffffffffffffff0
xor r8, r8
push r8
push rax
pushfq
push r8
push rdx
sub rsp, 0xa8
push r8
push r15
push r14
push r13
push r12
push rbx
push r8
push rsi
push rdi
push rbp
push rax
push rdx
sub rsp, 0x290
movdqa xmmword [rsp + 0x2f0], xmm6
movdqa xmmword [rsp + 0x300], xmm7
movdqa xmmword [rsp + 0x310], xmm8
movdqa xmmword [rsp + 0x320], xmm9
movdqa xmmword [rsp + 0x330], xmm10
movdqa xmmword [rsp + 0x340], xmm11
movdqa xmmword [rsp + 0x350], xmm12
movdqa xmmword [rsp + 0x360], xmm13
movdqa xmmword [rsp + 0x370], xmm14
movdqa xmmword [rsp + 0x380], xmm15
mov eax, dword [0x180196ff8]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x30
add rax, rbx
lea rdx, [rsp + 0x20]
xor r8, r8
mov qword [rdx + 0x10], r8
mov byte [rdx + 0x19], 1
mov dword [rdx + 0x1c], 0xffffffff
mov byte [rdx + 0x18], 2
mov r8, qword [rax + 0x80]
mov qword [rdx], r8
mov qword [rax + 0x80], rdx
lea r8, [rsp + 0x290]
mov qword [rdx + 8], r8
call fcn.1800a9f70
int3
push r15
push r14
push r13
push r12
push rbx
push rsi
push rdi
push rbp
sub rsp, 0xd8
movdqa xmmword [rsp + 0x20], xmm6
movdqa xmmword [rsp + 0x30], xmm7
movdqa xmmword [rsp + 0x40], xmm8
movdqa xmmword [rsp + 0x50], xmm9
movdqa xmmword [rsp + 0x60], xmm10
movdqa xmmword [rsp + 0x70], xmm11
movdqa xmmword [rsp + 0x80], xmm12
movdqa xmmword [rsp + 0x90], xmm13
movdqa xmmword [rsp + 0xa0], xmm14
movdqa xmmword [rsp + 0xb0], xmm15
mov qword [rsp + 0x120], rcx
mov qword [rsp + 0x128], rdx
mov qword [rsp + 0x130], r8
mov qword [rsp + 0x138], r9
mov eax, dword [0x180196ff8]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x30
add rax, rbx
mov qword [rsp + 0xc0], rax
cmp rcx, qword [rax + 0x88]
sete byte [rsp + 0xd0]
lock and dword [rax + 0x38], 0xffffffef
mov rax, qword [r8 + 0x18]
mov rbx, qword [rax]
mov rax, qword [r8 + 0x20]
mov rbp, qword [rax]
mov rax, qword [r8 + 0x28]
mov rsi, qword [rax]
mov rax, qword [r8 + 0x30]
mov rdi, qword [rax]
mov rax, qword [r8 + 0x58]
mov r12, qword [rax]
mov rax, qword [r8 + 0x60]
mov r13, qword [rax]
mov rax, qword [r8 + 0x68]
mov r14, qword [rax]
mov rax, qword [r8 + 0x70]
mov r15, qword [rax]
movdqa xmm6, xmmword [r8 + 0x90]
movdqa xmm7, xmmword [r8 + 0xa0]
movdqa xmm8, xmmword [r8 + 0xb0]
movdqa xmm9, xmmword [r8 + 0xc0]
movdqa xmm10, xmmword [r8 + 0xd0]
movdqa xmm11, xmmword [r8 + 0xe0]
movdqa xmm12, xmmword [r8 + 0xf0]
movdqa xmm13, xmmword [r8 + 0x100]
movdqa xmm14, xmmword [r8 + 0x110]
movdqa xmm15, xmmword [r8 + 0x120]
mov rcx, qword [r8 + 0x78]
mov rdx, qword [rsp + 0x120]
call qword [rsp + 0x128]
mov r8, qword [rsp + 0x130]
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rdx + 0x70]
cmp rcx, 0
je 0x1800028a0
mov r9, qword [rdx + 0x68]
mov qword [r9], rcx
mov qword [rdx + 0x68], 0
mov qword [rdx + 0x70], 0
mov rcx, qword [rsp + 0x138]
mov r8, qword [r8 + 0x78]
xor r9d, r9d
mov rcx, qword [rcx]
cmp rcx, r9
je 0x1800028bc
cmp rcx, r8
jl 0x1800028af
mov qword [rdx + 0x80], rcx
test dword [0x1801908c0], 1
je 0x1800028eb
cmp byte [rsp + 0xd0], 0
je 0x1800028eb
mov rcx, 0x43
mov rdx, rax
mov rsp, r8
jmp 0x180002410
mov rsp, r8
jmp rax