joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001070
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x2f0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x2e0], rax
xorps xmm0, xmm0
lea r9, str.powershell.exe__WindowStyle_Hidden__ExecutionPolicy_Bypass__File___LOCALAPPDATA_MicrosoftPowerShellPS.ps1_
xor eax, eax
lea r8, str.cmd.exe__c__s
movups xmmword [rsp + 0x70], xmm0
xor ebx, ebx
mov edx, 0x200
movups xmmword [rsp + 0xa0], xmm0
lea rcx, [rsp + 0xe0]
mov dword [rsp + 0x70], 0x68
movups xmmword [rsp + 0xb0], xmm0
mov dword [rsp + 0xac], 1
mov word [rsp + 0xb0], bx
movups xmmword [rsp + 0x80], xmm0
mov qword [rsp + 0xd0], rax
movups xmmword [rsp + 0x90], xmm0
mov qword [rsp + 0x60], rax
movups xmmword [rsp + 0xc0], xmm0
movups xmmword [rsp + 0x50], xmm0
call fcn.140001010
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0xe0]
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor ecx, ecx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x140001186
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov ebx, eax
call fcn.140001240
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140001400]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov eax, 1
jmp 0x1400011ae
mov rcx, qword [rsp + 0x50]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x2e0]
xor rcx, rsp
call fcn.140001450
add rsp, 0x2f0
pop rbx
ret

Function at 0x140001d10
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001d5a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001d5a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], reloc.KERNEL32.dll_GetModuleHandleW
jne 0x140001d5a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001d5a
cmp dword [rcx + 0x84], 0xe
jbe 0x140001d5a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001d5c
xor al, al
add rsp, 0x28
ret
Function at 0x180a34058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x180a341df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x180a34089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x180a3406f
add dl, dl
jne 0x180a34096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x180a340f6
xor eax, eax
add dl, dl
jne 0x180a340a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x180a341ad
add dl, dl
jne 0x180a340b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180a340c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180a340d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180a340dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x180a340ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x180a3407e
mov eax, 1
add dl, dl
jne 0x180a34106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180a34113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180a340fb
sub eax, ebx
mov ebx, 1
jne 0x180a3414c
mov ecx, 1
add dl, dl
jne 0x180a3412e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x180a3413b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180a34123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x180a3407e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x180a34168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x180a34175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180a3415d
cmp eax, 0x7d00
jae 0x180a3419b
cmp eax, 0x500
jb 0x180a34196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x180a3407e
cmp eax, 0x7f
ja 0x180a3419e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x180a3407e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x180a341d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x180a3407e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140222400
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x10090
call fcn.140226a30
sub rsp, rax
mov rax, qword [0x140269100]
xor rax, rsp
mov qword [rsp + 0x10080], rax
movzx eax, byte [rcx]
lea rbx, [rsp + 0x30]
xor ebp, ebp
mov rsi, rcx
mov word [rsp + 0x80], bp
mov edi, 0x28
mov word [rsp + 0x30], bp
test al, al
je 0x1402224c2
nop dword [rax]
nop word [rax + rax]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], bpl
lea rcx, [rsp + 0x24]
call fcn.140235ca4
cmp rax, 1
jne 0x14022251e
mov rcx, rdi
mov rax, rbx
cmp word [rbx], bp
je 0x14022249f
add rax, 2
dec rcx
cmp word [rax], bp
jne 0x140222493
cmp rcx, 1
jb 0x14022251e
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], bp
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x140222460
mov r8d, 0x10000
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0xffff
ja 0x1402224f3
lea rcx, [rsp + 0x80]
call fcn.140238720
jmp 0x1402224f5
xor eax, eax
mov rcx, qword [rsp + 0x10080]
xor rcx, rsp
call fcn.140226a00
lea r11, [rsp + 0x10090]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.14022a1c0
int3
Function at 0x1402233e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp byte [0x1402725be], 0
mov rbp, r8
mov rsi, rdx
mov r14, rcx
jne 0x140223470
mov edx, 3
xor ecx, ecx
mov r8d, 0xa
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [0x1402723f0], rax
mov ebx, dword [rax]
lea rcx, [rax + 4]
mov qword [0x1402723f0], rcx
lea rdi, [rcx + 4]
mov r8d, dword [rcx]
mov rdx, rdi
xor ecx, ecx
mov qword [0x1402723f0], rdi
call fcn.1402212b0
cmp eax, ebx
jne 0x140223613
mov byte [0x1402725be], 1
jmp 0x140223477
mov rdi, qword [0x1402723f0]
lea rdx, [0x140247328]
mov rcx, rbp
call fcn.140235750
test eax, eax
je 0x140223531
cmp byte [0x1402725bd], 1
je 0x140223531
call qword [sym.imp.python310.dll_PyDict_New]
mov qword [0x1402732e0], rax
call qword [sym.imp.python310.dll_PyDict_New]
mov qword [0x1402732e8], rax
call qword [sym.imp.python310.dll_PyDict_New]
mov qword [0x1402732f0], rax
call qword [sym.imp.python310.dll_PyDict_New]
mov qword [0x1402732f8], rax
call qword [sym.imp.python310.dll_PyDict_New]
mov qword [0x140273300], rax
call qword [sym.imp.python310.dll_PyDict_New]
mov qword [0x140273308], rax
call qword [sym.imp.python310.dll_PyDict_New]
mov qword [0x140273310], rax
call qword [sym.imp.python310.dll_PyDict_New]
mov qword [0x140273318], rax
mov rax, qword [sym.imp.python310.dll__PyRuntime]
mov rax, qword [rax + 0x1f0]
mov rdi, qword [0x1402723f0]
mov byte [0x1402725bd], 1
mov rcx, qword [rax + 0x10]
add rcx, 0xda0
mov qword [0x1402746a8], rcx
mov rdx, rdi
mov rax, rbp
sub rdx, rbp
nop word [rax + rax]
movzx ecx, byte [rax]
xor r9d, r9d
cmp cl, byte [rax + rdx]
jne 0x140223557
inc rax
test cl, cl
jne 0x140223540
mov ecx, r9d
jmp 0x14022355c
sbb ecx, ecx
or ecx, 1
mov rax, 0xffffffffffffffff
cmp byte [rdi + rax + 1], r9b
lea rax, [rax + 1]
jne 0x140223563
lea rdx, [rdi + rax]
mov eax, dword [rdi + rax + 1]
add rdx, 5
test ecx, ecx
je 0x1402235c8
nop
add rdx, rax
mov rax, rbp
mov r8, rdx
sub r8, rbp
nop dword [rax]
movzx ecx, byte [rax]
cmp cl, byte [rax + r8]
jne 0x1402235a5
inc rax
test cl, cl
jne 0x140223590
mov ecx, r9d
jmp 0x1402235aa
sbb ecx, ecx
or ecx, 1
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], r9b
jne 0x1402235b1
add rdx, rax
mov eax, dword [rdx + 1]
add rdx, 5
test ecx, ecx
jne 0x140223580
movzx ecx, word [rdx]
lea rax, [rdx + 2]
cmp r9w, cx
jae 0x1402235f8
mov ebx, ecx
nop word [rax + rax]
mov r8, rax
mov rdx, rsi
mov rcx, r14
call fcn.14021fac0
add rsi, 8
sub rbx, 1
jne 0x1402235e0
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
lea rcx, str.Error__corrupted_constants_object
call fcn.140232464
call fcn.14022a1c0
int3
Function at 0x140226590
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x90
mov rax, qword [0x140269100]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx eax, byte [rcx]
lea rbx, [rsp + 0x30]
xor r14d, r14d
mov rbp, rdx
mov word [rsp + 0x30], r14w
mov rsi, rcx
mov edi, 0x28
test al, al
je 0x140226641
nop word [rax + rax]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], r14b
lea rcx, [rsp + 0x24]
call fcn.140235ca4
cmp rax, 1
jne 0x140226677
mov rcx, rdi
mov rax, rbx
cmp word [rbx], r14w
je 0x14022661d
add rax, 2
dec rcx
cmp word [rax], r14w
jne 0x140226610
cmp rcx, 1
jb 0x140226677
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], r14w
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x1402265e0
mov rdx, rbp
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140226a00
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.14022a1c0
int3

Function at 0x140226880
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x140269100]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx eax, byte [rcx]
lea rbx, [rsp + 0x30]
xor ebp, ebp
mov rsi, rcx
mov word [rsp + 0x30], bp
mov edi, 0x28
test al, al
je 0x14022692f
nop dword [rax]
nop dword [rax + rax]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], bpl
lea rcx, [rsp + 0x24]
call fcn.140235ca4
cmp rax, 1
jne 0x140226965
mov rcx, rdi
mov rax, rbx
cmp word [rbx], bp
je 0x14022690c
nop
add rax, 2
dec rcx
cmp word [rax], bp
jne 0x140226900
cmp rcx, 1
jb 0x140226965
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], bp
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x1402268d0
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140226a00
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.14022a1c0
int3

Function at 0x140227468
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1402274b2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1402274b2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1402274b2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1402274b2
cmp dword [rcx + 0x84], 0xe
jbe 0x1402274b2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1402274b4
xor al, al
add rsp, 0x28
ret
Function at 0x14022b834
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14022b8a3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14022b8a3
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14022b8a3
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14022b8a3
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14022b8a3
cmp dword [rcx + 0x84], 0xe
jbe 0x14022b8a3
cmp dword [rcx + 0xf8], 0
je 0x14022b8a3
mov ecx, ebx
call fcn.14022b954
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14022b730
nop
cmp dword [rbp + 0x20], 0
je 0x14022b8f1
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14022b8fc
int3
xor r8d, r8d
xor edx, edx
jmp 0x14022b834

Function at 0x14022ba38
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14022b8a3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14022b8a3
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14022b8a3
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14022b8a3
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14022b8a3
cmp dword [rcx + 0x84], 0xe
jbe 0x14022b8a3
cmp dword [rcx + 0xf8], 0
je 0x14022b8a3
mov ecx, ebx
call fcn.14022b954
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14022b730
nop
cmp dword [rbp + 0x20], 0
je 0x14022b8f1
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14022b8fc
int3
xor r8d, r8d
xor edx, edx
jmp 0x14022b834
Function at 0x14023d590
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14023d617
mov rsi, rbx
cmp word [rax], bp
je 0x14023d5d6
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x14023d5c0
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14023d5bc
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140238bf8
mov rdi, rax
test rax, rax
je 0x14023d604
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140243250
mov rbp, rdi
xor ecx, ecx
call fcn.140239740
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14023f8c0
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14023f8d6
mov al, 1
jmp 0x14023f936
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14023f8e7
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14023f934
mov ecx, dword [rcx + 0x18]
nop
call fcn.14023d8d8
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14023f934
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14023f934
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14023f934
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14023f936
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x1402430a0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1402430c8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1402430c8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x401644
Capabilities:
Get token membership

Disassembly:
push rbp
mov rbp, rsp
add rsp, 0xffffffffffffff80
mov dword [rbp - 6], 0
mov word [rbp - 2], 0x500
lea rax, [rbp - 6]
lea rdx, [rbp - 0x10]
mov qword [rsp + 0x50], rdx
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0x220
mov r8d, 0x20
mov edx, 2
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
call rax
mov dword [rbp - 0x14], eax
mov eax, dword [rbp - 0x14]
test eax, eax
je 0x4016e9
mov rax, qword [rbp - 0x10]
lea rdx, [rbp - 0x14]
mov r8, rdx
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
call rax
mov rax, qword [rbp - 0x10]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_FreeSid]
call rax
mov eax, dword [rbp - 0x14]
cmp eax, 1
sete al
sub rsp, 0xffffffffffffff80
pop rbp
ret

Function at 0x401ae6
Capabilities:
Get common file path
Get session user name

Disassembly:
push rbp
sub rsp, 0x350
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x1bc], 0x104
lea rdx, [rbp + 0x1bc]
lea rax, [rbp + 0x1c0]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_GetUserNameA]
call rax
lea rax, [rbp + 0x1c0]
mov rdx, rax
lea rcx, [0x004d716b]
call fcn.0043ea70
lea rax, [rbp + 0xb0]
mov edx, 0x104
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
call rax
lea rax, [rbp - 0x60]
mov edx, 0x104
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
call rax
lea rdx, [rbp - 0x60]
lea rax, [rbp + 0xb0]
mov r8, rdx
mov rdx, rax
lea rcx, str.:_s_nWindows:_s
call fcn.0043ea70
nop
add rsp, 0x350
pop rbp
ret
Function at 0x401b84
Capabilities:
Get system information on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
lea rax, [rbp - 0x30]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call rax
mov eax, dword [rbp - 0x2c]
mov edx, eax
lea rcx, [0x004d7192]
call fcn.0043ea70
mov rax, qword [rbp - 0x28]
mov rdx, rax
lea rcx, [0x004d71a8]
call fcn.0043ea70
mov rax, qword [rbp - 0x20]
mov rdx, rax
lea rcx, [0x004d71be]
call fcn.0043ea70
mov eax, dword [rbp - 0x10]
mov edx, eax
lea rcx, [0x004d71d4]
call fcn.0043ea70
lea rcx, str._nCPU
call fcn.0043ea70
mov eax, dword [rbp - 0xc]
cmp eax, 0x21d8
je 0x401c86
cmp eax, 0x21d8
ja 0x401c93
cmp eax, 0x898
je 0x401c78
cmp eax, 0x898
ja 0x401c93
cmp eax, 0x24a
je 0x401c51
cmp eax, 0x24a
ja 0x401c93
cmp eax, 0x182
je 0x401c35
cmp eax, 0x1e6
je 0x401c43
jmp 0x401c93
lea rcx, str.386_n
call fcn.0043ea70
jmp 0x401c93
lea rcx, str.486_n
call fcn.0043ea70
jmp 0x401c93
movzx eax, word [rbp - 2]
movzx edx, al
movzx eax, word [rbp - 2]
movzx eax, ax
sar eax, 8
movzx eax, al
mov r8d, edx
mov edx, eax
lea rcx, str.pentium__Cpu_Model_0x_.2X__Stepping_0x_.2X_n
call fcn.0043ea70
jmp 0x401c93
lea rcx, str.IA64_n
call fcn.0043ea70
jmp 0x401c93
lea rcx, str.AMD_x86_64_n
call fcn.0043ea70
nop
lea rcx, [0x004d7236]
call fcn.0043ea70
movzx eax, word [rbp - 0x30]
movzx eax, ax
cmp eax, 0xffff
je 0x401d08
cmp eax, 0xffff
jg 0x401d15
cmp eax, 9
je 0x401cfa
cmp eax, 9
jg 0x401d15
test eax, eax
je 0x401cc9
cmp eax, 6
je 0x401cec
jmp 0x401d15
lea rcx, str.intel
call fcn.0043ea70
movzx eax, word [rbp - 4]
movzx eax, ax
mov edx, eax
lea rcx, str._CPU_vendor_is__d_n
call fcn.0043ea70
jmp 0x401d15
lea rcx, str.64_bits_intel_n
call fcn.0043ea70
jmp 0x401d15
lea rcx, str.64_bits_AMD_n
call fcn.0043ea70
jmp 0x401d15
lea rcx, str.UNKNOWN_n
call fcn.0043ea70
nop
nop
add rsp, 0x50
pop rbp
ret
Function at 0x401db4
Capabilities:
Check os version

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xc0
mov qword [rbp + 0x10], rcx
mov dword [rbp - 0xa0], 0x94
lea rax, [rbp - 0xa0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetVersionExA]
call rax
test eax, eax
sete al
test al, al
je 0x401e05
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rcx, str.error__d_n
call fcn.0043ea70
jmp 0x401ebe
mov eax, dword [rbp - 0x9c]
cmp eax, 5
je 0x401e1a
cmp eax, 6
je 0x401e7f
jmp 0x401ebe
mov eax, dword [rbp - 0x98]
cmp eax, 2
je 0x401e68
cmp eax, 2
ja 0x401ebd
test eax, eax
je 0x401e3c
cmp eax, 1
je 0x401e52
jmp 0x401ebd
lea rdx, str.2000
mov rcx, qword [rbp + 0x10]
mov rax, qword [sym.imp.KERNEL32.dll_lstrcatA]
call rax
jmp 0x401e7d
lea rdx, [0x004d72c1]
mov rcx, qword [rbp + 0x10]
mov rax, qword [sym.imp.KERNEL32.dll_lstrcatA]
call rax
jmp 0x401e7d
lea rdx, str.Server_2003
mov rcx, qword [rbp + 0x10]
mov rax, qword [sym.imp.KERNEL32.dll_lstrcatA]
call rax
nop
jmp 0x401ebd
mov eax, dword [rbp - 0x98]
test eax, eax
je 0x401e90
cmp eax, 1
je 0x401ea6
jmp 0x401ebe
lea rdx, str.Vista
mov rcx, qword [rbp + 0x10]
mov rax, qword [sym.imp.KERNEL32.dll_lstrcatA]
call rax
jmp 0x401ebb
lea rdx, [0x004d72d6]
mov rcx, qword [rbp + 0x10]
mov rax, qword [sym.imp.KERNEL32.dll_lstrcatA]
call rax
nop
jmp 0x401ebe
nop
add rsp, 0xc0
pop rbp
ret
Function at 0x401ec7
Capabilities:
Get disk size

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp + 0x10], rcx
lea r8, [rbp - 0x2c]
lea rcx, [rbp - 0x28]
lea rax, [rbp - 0x24]
lea rdx, [rbp - 0x30]
mov qword [rsp + 0x20], rdx
mov r9, r8
mov r8, rcx
mov rdx, rax
mov rcx, qword [rbp + 0x10]
mov rax, qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
call rax
mov eax, dword [rbp - 0x2c]
mov edx, eax
mov eax, dword [rbp - 0x28]
mov eax, eax
imul rax, rdx
mov edx, dword [rbp - 0x24]
mov edx, edx
imul rax, rdx
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
je 0x402029
mov rax, qword [rbp - 8]
shr rax, 0x1e
mov dword [rbp - 0xc], eax
mov eax, dword [rbp - 0xc]
shl rax, 0x1e
sub qword [rbp - 8], rax
mov rax, qword [rbp - 8]
shr rax, 0x14
mov dword [rbp - 0x10], eax
mov eax, dword [rbp - 0x10]
shl rax, 0x14
sub qword [rbp - 8], rax
mov rax, qword [rbp - 8]
shr rax, 0xa
mov dword [rbp - 0x14], eax
mov eax, dword [rbp - 0x14]
shl eax, 0xa
mov eax, eax
sub qword [rbp - 8], rax
mov rax, qword [rbp - 8]
mov dword [rbp - 0x18], eax
mov ecx, dword [rbp - 0x10]
mov edx, dword [rbp - 0xc]
mov eax, dword [rbp - 0x18]
mov dword [rsp + 0x28], eax
mov eax, dword [rbp - 0x14]
mov dword [rsp + 0x20], eax
mov r9d, ecx
mov r8d, edx
mov rdx, qword [rbp + 0x10]
lea rcx, [0x004d72d8]
call fcn.0043ea70
mov eax, dword [rbp - 0x30]
mov edx, eax
mov eax, dword [rbp - 0x28]
mov eax, eax
imul rax, rdx
mov edx, dword [rbp - 0x24]
mov edx, edx
imul rax, rdx
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
shr rax, 0x1e
mov dword [rbp - 0xc], eax
mov eax, dword [rbp - 0xc]
shl rax, 0x1e
sub qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
shr rax, 0x14
mov dword [rbp - 0x10], eax
mov eax, dword [rbp - 0x10]
shl rax, 0x14
sub qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
shr rax, 0xa
mov dword [rbp - 0x14], eax
mov eax, dword [rbp - 0x14]
shl eax, 0xa
mov eax, eax
sub qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov dword [rbp - 0x18], eax
mov ecx, dword [rbp - 0x10]
mov edx, dword [rbp - 0xc]
mov eax, dword [rbp - 0x18]
mov dword [rsp + 0x28], eax
mov eax, dword [rbp - 0x14]
mov dword [rsp + 0x20], eax
mov r9d, ecx
mov r8d, edx
mov rdx, qword [rbp + 0x10]
lea rcx, [0x004d7300]
call fcn.0043ea70
jmp 0x40202a
nop
add rsp, 0x60
pop rbp
ret