joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140174f50
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
and qword [rbp + 0x20], 0
xor eax, eax
and qword [rbp - 0x60], 0
mov rdi, rcx
lea rcx, [rbp - 0x58]
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rax
mov r15, r9
mov qword [rbp - 0x48], rax
mov rsi, r8
mov r14, rdx
call qword [sym.imp.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rbx, qword [rax + 0x1a8]
mov rcx, rbx
call qword [0x1403a2250]
lea r8, [rbp + 0x20]
mov rdx, rsi
mov rcx, rdi
call rbx
mov ebx, eax
test eax, eax
js 0x14017504f
movsd xmm1, qword [rbp - 0x48]
mov eax, SafeArrayGetElement
mov rbx, qword [rbp + 0x20]
mov word [rbp - 0x58], ax
mov qword [rbp - 0x50], r15
movups xmm0, xmmword [rbp - 0x58]
mov rax, qword [rbx]
movsd qword [rbp - 0x30], xmm1
movaps xmmword [rbp - 0x40], xmm0
mov rdi, qword [rax + 0x48]
mov rcx, rdi
call qword [0x1403a2250]
lea rdx, [rbp - 0x40]
mov rcx, rbx
call rdi
mov ebx, eax
test eax, eax
js 0x14017504f
mov rax, qword [r14]
mov rbx, qword [rax + 0x88]
mov rcx, rbx
call qword [0x1403a2250]
lea rdx, [rbp - 0x60]
mov rcx, r14
call rbx
mov ebx, eax
test eax, eax
js 0x14017504f
mov rbx, qword [rbp - 0x60]
mov rax, qword [rbx]
mov rdi, qword [rax + 0x40]
mov rcx, rdi
call qword [0x1403a2250]
mov rdx, qword [rbp + 0x20]
xor r8d, r8d
mov rcx, rbx
call rdi
mov ebx, eax
test eax, eax
jns 0x140175056
mov ecx, eax
call fcn.140078308
mov ecx, ebx
call fcn.140078324
and qword [rbp - 0x10], 0
lea rax, [0x1400434e0]
mov r14d, 3
mov qword [rbp - 0x18], rax
lea rax, [rbp - 0x60]
mov qword [rbp - 0x20], r14
mov edi, 0xb9
mov qword [rbp - 8], rax
xor r9d, r9d
lea rdx, [rbp - 0x20]
lea esi, [r14 + 0x1d]
mov ecx, edi
mov r8d, esi
call sub.ntdll.dll_NtQuerySystemInformation
and qword [rbp - 0x10], 0
lea rax, [0x1400431a0]
mov qword [rbp - 0x18], rax
lea rdx, [rbp - 0x20]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x20], r14
xor r9d, r9d
mov qword [rbp - 8], rax
mov r8d, esi
mov ecx, edi
call sub.ntdll.dll_NtQuerySystemInformation
lea r11, [rsp + 0x80]
mov eax, ebx
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1401750e8
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
and qword [rbp + 0x30], 0
xor eax, eax
and qword [rbp - 0x60], 0
mov rdi, rcx
lea rcx, [rbp - 0x58]
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rax
mov r15d, r9d
mov qword [rbp - 0x48], rax
mov rsi, r8
mov r14, rdx
call qword [sym.imp.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rbx, qword [rax + 0x1a8]
mov rcx, rbx
call qword [0x1403a2250]
lea r8, [rbp + 0x30]
mov rdx, rsi
mov rcx, rdi
call rbx
mov ebx, eax
mov r13d, 3
test eax, eax
js 0x1401751e7
movsd xmm1, qword [rbp - 0x48]
mov rbx, qword [rbp + 0x30]
mov dword [rbp - 0x50], r15d
mov word [rbp - 0x58], r13w
movups xmm0, xmmword [rbp - 0x58]
mov rax, qword [rbx]
movsd qword [rbp - 0x30], xmm1
movaps xmmword [rbp - 0x40], xmm0
mov rdi, qword [rax + 0x48]
mov rcx, rdi
call qword [0x1403a2250]
lea rdx, [rbp - 0x40]
mov rcx, rbx
call rdi
mov ebx, eax
test eax, eax
js 0x1401751e7
mov rax, qword [r14]
mov rbx, qword [rax + 0x88]
mov rcx, rbx
call qword [0x1403a2250]
lea rdx, [rbp - 0x60]
mov rcx, r14
call rbx
mov ebx, eax
test eax, eax
js 0x1401751e7
mov rbx, qword [rbp - 0x60]
mov rax, qword [rbx]
mov rdi, qword [rax + 0x40]
mov rcx, rdi
call qword [0x1403a2250]
mov rdx, qword [rbp + 0x30]
xor r8d, r8d
mov rcx, rbx
call rdi
mov ebx, eax
test eax, eax
jns 0x1401751ee
mov ecx, eax
call fcn.140078308
mov ecx, ebx
call fcn.140078324
and qword [rbp - 0x10], 0
lea rax, [0x1400434e0]
xor r9d, r9d
mov qword [rbp - 0x18], rax
lea rax, [rbp - 0x60]
mov qword [rbp - 0x20], r13
mov edi, 0xb9
mov qword [rbp - 8], rax
lea rdx, [rbp - 0x20]
mov ecx, edi
lea esi, [r9 + 0x20]
mov r8d, esi
call sub.ntdll.dll_NtQuerySystemInformation
and qword [rbp - 0x10], 0
lea rax, [0x1400431a0]
mov qword [rbp - 0x18], rax
lea rdx, [rbp - 0x20]
lea rax, [rbp + 0x30]
mov qword [rbp - 0x20], r13
xor r9d, r9d
mov qword [rbp - 8], rax
mov r8d, esi
mov ecx, edi
call sub.ntdll.dll_NtQuerySystemInformation
lea r11, [rsp + 0x80]
mov eax, ebx
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rbp
ret
Function at 0x14017568c
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x140418d28]
xor rax, rsp
mov qword [rbp - 8], rax
mov rsi, rdx
mov rbx, r8
xor edx, edx
mov rdi, rcx
lea rcx, [rbp - 0x28]
lea r8d, [rdx + 0x20]
call sub.msvcrt.dll_memset
and dword [rbp - 0x18], 0
lea r8, [rbp - 0x60]
and dword [rbp - 0x14], 0
mov rdx, rsi
and qword [rbp - 0x10], 0
mov rcx, rdi
call fcn.1401706b0
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
test al, al
je 0x140175713
movsxd rcx, dword [rbp - 0x60]
shl rcx, 5
add rcx, 0x10
add rcx, qword [rdi + 8]
call fcn.1400dcf74
mov ebx, eax
test eax, eax
jns 0x1401757b8
mov ecx, eax
jmp 0x1401757b3
movups xmm0, xmmword [rsi]
lea rcx, [rbp - 0x18]
movdqu xmmword [rbp - 0x28], xmm0
call fcn.1400dcf74
mov ebx, eax
test eax, eax
js 0x14017570c
lea r8, [rbp - 0x60]
mov rcx, rdi
lea rdx, [rbp - 0x28]
call fcn.1401706b0
test al, al
je 0x14017578a
movsxd rax, dword [rbp - 0x60]
lea rcx, [0x1400065e0]
shl rax, 5
lea rdx, [rbp - 0x58]
add rax, qword [rdi + 8]
xor r9d, r9d
mov qword [rbp - 0x50], rcx
lea rcx, [rbp - 0x30]
mov qword [rbp - 0x40], rax
lea rax, [rbp - 0x28]
mov qword [rbp - 0x48], rcx
mov ecx, 0xb9
lea r8d, [r9 + 0x28]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x58], 3
call sub.ntdll.dll_NtQuerySystemInformation
xor ebx, ebx
jmp 0x1401757a6
mov edx, dword [rbp - 0x60]
lea r8, [rbp - 0x28]
mov rcx, rdi
call fcn.140175dc8
mov ebx, eax
test eax, eax
jns 0x1401757a6
mov ecx, eax
call fcn.140078308
mov ecx, ebx
call fcn.140078324
test ebx, ebx
jns 0x1401757b8
mov ecx, ebx
call fcn.140078308
mov ecx, ebx
call fcn.140078324
lea rcx, [rbp - 0x18]
call fcn.1400673ac
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14035a4e0
mov rbx, qword [rsp + 0xb8]
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret
Function at 0x140175bbc
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov rsi, rcx
movsxd r15, edx
mov ecx, dword [rcx + 4]
mov r12, r8
test ecx, ecx
jns 0x140175be6
mov edi, 0x8000ffff
mov ecx, edi
jmp 0x140175c00
lea r8, [rsp + 0x80]
mov edx, 1
call fcn.140077a14
mov edi, eax
test eax, eax
jns 0x140175c0a
mov ecx, eax
call fcn.140078308
jmp 0x140175daa
mov edi, dword [rsi]
test edi, edi
jns 0x140175c1e
mov edi, 0x8000ffff
mov ebx, edi
mov ecx, edi
jmp 0x140175cc5
cmp edi, dword [rsp + 0x80]
jl 0x140175c2e
xor ebx, ebx
jmp 0x140175cca
mov r14d, dword [rsp + 0x80]
test edi, edi
jne 0x140175c43
mov edi, 0x20
xor ebx, ebx
jmp 0x140175c9f
js 0x140175c81
lea ecx, [rdi + rdi]
xor ebx, ebx
mov eax, ecx
shr eax, 1
cmp eax, edi
je 0x140175c60
mov ebx, 0x80070216
mov ecx, ebx
call fcn.140078308
jmp 0x140175c63
mov r14d, ecx
mov ecx, ebx
call fcn.140078324
test ebx, ebx
js 0x140175c86
test r14d, r14d
jns 0x140175c7c
mov ecx, 0x80070216
mov ebx, ecx
jmp 0x140175c88
mov edi, r14d
jmp 0x140175c8d
mov ebx, 0x80070057
mov ecx, ebx
call fcn.140078308
mov ecx, ebx
call fcn.140078324
test ebx, ebx
jns 0x140175c9f
mov ecx, ebx
call fcn.140078308
mov ecx, ebx
call fcn.140078324
test ebx, ebx
js 0x140175cde
cmp edi, dword [rsp + 0x80]
jl 0x140175c36
mov edx, edi
mov rcx, rsi
call fcn.1401717b4
mov ebx, eax
test eax, eax
jns 0x140175cca
mov ecx, eax
call fcn.140078308
mov ecx, ebx
call fcn.140078324
mov edi, ebx
test ebx, ebx
jns 0x140175ce2
mov ecx, ebx
jmp 0x140175c00
mov ecx, ebx
jmp 0x140175cc5
mov edx, dword [rsi + 4]
cmp r15d, edx
jge 0x140175d1f
mov r10, qword [rsi + 8]
test r10, r10
jne 0x140175cf8
xor r9d, r9d
jmp 0x140175cfb
mov r9, r10
sub edx, r15d
lea rcx, [r15 + r15*8]
movsxd rax, edx
lea rdx, [r10 + rcx*8]
lea rcx, [rcx + 9]
lea rcx, [r9 + rcx*8]
lea r8, [rax + rax*8]
shl r8, 3
call qword [sym.imp.msvcrt.dll_memmove]
mov rcx, qword [rsi + 8]
lea rdi, [r15 + r15*8]
xor edx, edx
lea rbx, [rcx + rdi*8]
mov rcx, rbx
lea r8d, [rdx + 0x48]
call sub.msvcrt.dll_memset
test rbx, rbx
je 0x140175d5b
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 0x48]
call sub.msvcrt.dll_memset
and qword [rbx + 0x30], 0
and qword [rbx + 0x38], 0
and qword [rbx + 0x40], 0
mov rax, qword [rsi + 8]
lea rcx, [0x1400062a0]
mov qword [rsp + 0x28], rcx
lea rdx, [rsp + 0x20]
xor r9d, r9d
mov qword [rsp + 0x20], 3
lea rcx, [rsp + 0x98]
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x30], rcx
lea rax, [rax + rdi*8]
mov ecx, 0xb9
mov qword [rsp + 0x38], rax
lea r8d, [r9 + 0x28]
call sub.ntdll.dll_NtQuerySystemInformation
inc dword [rsi + 4]
xor edi, edi
mov ecx, edi
call fcn.140078324
mov rbx, qword [rsp + 0x88]
mov eax, edi
add rsp, 0x50
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140175dc8
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov rsi, rcx
movsxd r15, edx
mov ecx, dword [rcx + 4]
mov r12, r8
test ecx, ecx
jns 0x140175df2
mov edi, 0x8000ffff
mov ecx, edi
jmp 0x140175e0c
lea r8, [rsp + 0x80]
mov edx, 1
call fcn.140077a14
mov edi, eax
test eax, eax
jns 0x140175e16
mov ecx, eax
call fcn.140078308
jmp 0x140175fb2
mov edi, dword [rsi]
test edi, edi
jns 0x140175e2a
mov edi, 0x8000ffff
mov ebx, edi
mov ecx, edi
jmp 0x140175ed1
cmp edi, dword [rsp + 0x80]
jl 0x140175e3a
xor ebx, ebx
jmp 0x140175ed6
mov r14d, dword [rsp + 0x80]
test edi, edi
jne 0x140175e4f
mov edi, 0x20
xor ebx, ebx
jmp 0x140175eab
js 0x140175e8d
lea ecx, [rdi + rdi]
xor ebx, ebx
mov eax, ecx
shr eax, 1
cmp eax, edi
je 0x140175e6c
mov ebx, 0x80070216
mov ecx, ebx
call fcn.140078308
jmp 0x140175e6f
mov r14d, ecx
mov ecx, ebx
call fcn.140078324
test ebx, ebx
js 0x140175e92
test r14d, r14d
jns 0x140175e88
mov ecx, 0x80070216
mov ebx, ecx
jmp 0x140175e94
mov edi, r14d
jmp 0x140175e99
mov ebx, 0x80070057
mov ecx, ebx
call fcn.140078308
mov ecx, ebx
call fcn.140078324
test ebx, ebx
jns 0x140175eab
mov ecx, ebx
call fcn.140078308
mov ecx, ebx
call fcn.140078324
test ebx, ebx
js 0x140175eea
cmp edi, dword [rsp + 0x80]
jl 0x140175e42
mov edx, edi
mov rcx, rsi
call fcn.140171afc
mov ebx, eax
test eax, eax
jns 0x140175ed6
mov ecx, eax
call fcn.140078308
mov ecx, ebx
call fcn.140078324
mov edi, ebx
test ebx, ebx
jns 0x140175eee
mov ecx, ebx
jmp 0x140175e0c
mov ecx, ebx
jmp 0x140175ed1
mov ecx, dword [rsi + 4]
cmp r15d, ecx
jge 0x140175f28
mov rdx, qword [rsi + 8]
test rdx, rdx
jne 0x140175f04
xor r9d, r9d
jmp 0x140175f07
mov r9, rdx
sub ecx, r15d
mov rax, r15
movsxd r8, ecx
shl rax, 5
shl r8, 5
add rdx, rax
lea rcx, [rax + 0x20]
add rcx, r9
call qword [sym.imp.msvcrt.dll_memmove]
mov rbx, qword [rsi + 8]
xor edx, edx
mov rdi, r15
shl rdi, 5
add rbx, rdi
mov rcx, rbx
lea r8d, [rdx + 0x20]
call sub.msvcrt.dll_memset
test rbx, rbx
je 0x140175f64
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 0x20]
call sub.msvcrt.dll_memset
and dword [rbx + 0x10], 0
and dword [rbx + 0x14], 0
and qword [rbx + 0x18], 0
mov rax, qword [rsi + 8]
lea rcx, [0x1400065e0]
mov qword [rsp + 0x28], rcx
lea rdx, [rsp + 0x20]
xor r9d, r9d
mov qword [rsp + 0x20], 3
lea rcx, [rsp + 0x98]
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x30], rcx
add rax, rdi
mov ecx, 0xb9
mov qword [rsp + 0x38], rax
lea r8d, [r9 + 0x28]
call sub.ntdll.dll_NtQuerySystemInformation
inc dword [rsi + 4]
xor edi, edi
mov ecx, edi
call fcn.140078324
mov rbx, qword [rsp + 0x88]
mov eax, edi
add rsp, 0x50
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140177af0
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x40
xor ebx, ebx
cmp dword [0x140422950], ebx
jne 0x140177b2c
lea rcx, [0x140421d70]
call fcn.14006e3c0
mov ebx, eax
test eax, eax
jns 0x140177b1b
mov ecx, eax
call fcn.140078308
jmp 0x140177b2c
xor edx, edx
call fcn.1401785cc
mov dword [0x140422950], 1
mov ecx, ebx
call fcn.140078324
test ebx, ebx
jns 0x140177b3b
mov ecx, ebx
jmp 0x140177b9e
mov rbx, qword [0x140422948]
test rbx, rbx
je 0x140177b91
and qword [rsp + 0x30], 0
lea rax, [0x140031a20]
xor r9d, r9d
mov qword [rsp + 0x20], 3
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov ecx, 0xb9
mov qword [rsp + 0x38], rbx
lea r8d, [r9 + 0x20]
call sub.ntdll.dll_NtQuerySystemInformation
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
call fcn.14017b558
mov ebx, eax
test eax, eax
jns 0x140177ba3
mov ecx, eax
call fcn.140078308
mov ecx, ebx
call fcn.140078324
mov eax, ebx
add rsp, 0x40
pop rbx
ret

Function at 0x140177bb4
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x40
cmp dword [0x140422950], 1
jne 0x140177c41
lea rcx, [0x140421d70]
call fcn.14006e234
or dword [0x140422950], 0xffffffff
xor edx, edx
call fcn.1401785cc
lea rcx, [0x140421d70]
call fcn.140070e60
cmp dword [0x140421d70], 0
je 0x140177c06
lea rcx, [0x140421d78]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
and dword [0x140421d70], 0
mov rcx, qword [0x140421da8]
test rcx, rcx
je 0x140177c20
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and qword [0x140421da8], 0
mov rcx, qword [0x140421da0]
test rcx, rcx
je 0x140177c3a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and qword [0x140421da0], 0
and dword [0x140422950], 0
mov rbx, qword [0x140422948]
test rbx, rbx
je 0x140177c97
and qword [rsp + 0x30], 0
lea rax, [0x140031a20]
xor r9d, r9d
mov qword [rsp + 0x20], 3
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov ecx, 0xb9
mov qword [rsp + 0x38], rbx
lea r8d, [r9 + 0x20]
call sub.ntdll.dll_NtQuerySystemInformation
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
and qword [0x140422948], 0
add rsp, 0x40
pop rbx
ret
Function at 0x14017b3e8
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
movsxd rsi, edx
xor ebx, ebx
mov rdi, rcx
cmp dword [rcx], esi
je 0x14017b532
mov r14d, dword [rcx + 4]
cmp esi, r14d
cmovl r14d, esi
test edx, edx
jle 0x14017b49f
lea rbp, [rsi + rsi*2]
movabs rax, 0xaaaaaaaaaaaaaaab
shl rbp, 3
mul rbp
shr rdx, 4
cmp rdx, rsi
je 0x14017b44c
mov ebx, 0x80070216
mov ecx, ebx
call fcn.140078308
mov rbp, qword [rsp + 0x60]
mov ecx, ebx
call fcn.140078324
test ebx, ebx
jns 0x14017b463
mov ecx, ebx
call fcn.140078308
jmp 0x14017b532
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbp
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x14017b54e
test r14d, r14d
je 0x14017b49f
mov rdx, qword [rdi + 8]
mov rcx, rbx
movsxd rax, r14d
lea r8, [rax + rax*2]
shl r8, 3
call sub.msvcrt.dll_memcpy
cmp esi, dword [rdi + 4]
jge 0x14017b4fb
mov ebp, esi
mov rdx, qword [rdi + 8]
movsxd rax, ebp
lea rcx, [rax + rax*2]
lea rax, [rdx + rcx*8]
test rax, rax
je 0x14017b4f4
and qword [rsp + 0x30], 0
lea rcx, [0x140041120]
xor r9d, r9d
mov qword [rsp + 0x28], rcx
add rax, 8
mov qword [rsp + 0x20], 3
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x38], rax
mov ecx, 0xb9
lea r8d, [r9 + 0x20]
call sub.ntdll.dll_NtQuerySystemInformation
inc ebp
cmp ebp, dword [rdi + 4]
jl 0x14017b4a6
mov rbp, qword [rdi + 8]
test rbp, rbp
je 0x14017b51d
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbp
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
and qword [rdi + 8], 0
xor eax, eax
test rbx, rbx
cmovne rax, rbx
xor ebx, ebx
mov qword [rdi + 8], rax
mov dword [rdi + 4], r14d
mov dword [rdi], esi
mov ecx, ebx
call fcn.140078324
mov rbp, qword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
mov ebx, 0x8007000e
jmp 0x14017b457
Function at 0x14017bd3c
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
cmp qword [r8], 0
mov r15, r9
mov rdi, r8
mov r14d, edx
je 0x14017bf3a
test r9, r9
je 0x14017bf3a
test edx, edx
je 0x14017bf3a
mov rbx, qword [rbp + 0x60]
cmp qword [rbx], 0
je 0x14017bd8d
mov eax, dword [r9]
mov dword [rbp + 0x50], eax
jmp 0x14017bd91
and dword [rbp + 0x50], 0
movaps xmm0, xmmword [r8]
xor dl, dl
and word [rbp + 0x40], 0
xor cl, cl
movaps xmmword [rbp - 0x10], xmm0
xor r13d, r13d
psrldq xmm0, 8
mov r12d, r14d
movd esi, xmm0
lea eax, [rsi + r14]
cmp esi, eax
jae 0x14017bdea
mov ebx, eax
mov rcx, qword [rbp - 0x10]
mov edx, esi
call fcn.14017bc10
mov cl, al
cmp al, 0x20
ja 0x14017bdd1
dec r12d
jmp 0x14017bdda
mov byte [rbp + r13 + 0x40], cl
xor r13d, 1
inc esi
cmp esi, ebx
jb 0x14017bdbb
mov cl, byte [rbp + 0x41]
mov dl, byte [rbp + 0x40]
mov rbx, qword [rbp + 0x60]
xor eax, eax
cmp cl, 0x3d
lea ecx, [r12 + r12*2]
sete al
shr ecx, 2
sub ecx, eax
xor eax, eax
cmp dl, 0x3d
sete al
sub ecx, eax
mov dword [r15], ecx
cmp ecx, dword [rbp + 0x50]
jbe 0x14017be1f
mov rax, qword [rbx]
neg rax
sbb eax, eax
and eax, 0xc004d107
jmp 0x14017bf3f
mov r13d, dword [rdi + 8]
movaps xmm0, xmmword [rbx]
add r13d, r14d
movdqu xmmword [rbp - 0x10], xmm0
xor esi, esi
mov edx, dword [rdi + 8]
cmp edx, r13d
jae 0x14017be5f
mov rcx, qword [rdi]
call fcn.14017bc10
cmp al, 0x20
jbe 0x14017be57
movzx eax, al
lea rdx, [0x1403bd750]
mov al, byte [rax + rdx]
mov byte [rbp + rsi + 0x40], al
inc esi
inc dword [rdi + 8]
cmp esi, 4
jb 0x14017be30
test esi, esi
je 0x14017bf2d
cmp esi, 4
jne 0x14017bf3a
mov eax, dword [rbp + 0x40]
mov cl, al
mov r12b, byte [rbp + 0x41]
mov r14b, byte [rbp + 0x42]
or cl, r12b
mov sil, byte [rbp + 0x43]
or cl, r14b
or cl, sil
cmp cl, 0xff
je 0x14017bf3a
movaps xmm1, xmmword [rbx]
mov r8b, r12b
inc dword [rbx + 8]
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rcx, xmm1
shl al, 2
shr r8b, 4
movd edx, xmm0
or r8b, al
call fcn.14017bc50
cmp r14b, 0x40
jae 0x14017bf23
movaps xmm1, xmmword [rbx]
mov r8b, r14b
inc dword [rbx + 8]
movdqa xmm0, xmm1
shr r8b, 2
movq rcx, xmm1
psrldq xmm0, 8
and r8b, 0xf
movd edx, xmm0
shl r12b, 4
or r8b, r12b
call fcn.14017bc50
cmp sil, 0x40
jae 0x14017bf23
movaps xmm1, xmmword [rbx]
and sil, 0x3f
inc dword [rbx + 8]
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rcx, xmm1
shl r14b, 6
or sil, r14b
movd edx, xmm0
mov r8b, sil
call fcn.14017bc50
cmp dword [rdi + 8], r13d
jb 0x14017be2e
mov eax, dword [rbx + 8]
sub eax, dword [rbp - 8]
mov dword [r15], eax
xor eax, eax
jmp 0x14017bf3f
mov eax, 0x80070057
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14017c5f8
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x150
mov rax, qword [0x140418d28]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov edi, edx
mov rbx, rcx
mov dword [rsp + 0x20], 0x114
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x14017c64a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
movzx eax, ax
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
jmp 0x14017c674
cmp dword [rsp + 0x24], 5
jb 0x14017c664
mov edx, edi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
test eax, eax
je 0x14017c633
xor eax, eax
jmp 0x14017c674
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
jmp 0x14017c660
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14035a4e0
mov rbx, qword [rsp + 0x170]
add rsp, 0x150
pop rdi
ret
Function at 0x14017fdf4
Capabilities:
Check for time delay via queryperformancecounter
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xb8]
sub rsp, 0x190
mov rax, qword [0x140418d28]
xor rax, rsp
mov qword [rbp + 0x80], rax
xor r14d, r14d
mov qword [rsp + 0x64], 2
mov qword [rsp + 0x70], r14
mov r12d, edx
mov byte [rsp + 0x60], r14b
mov r13, rcx
test edx, edx
je 0x14017ff6b
cmp qword [rcx], r14
jne 0x14017fe5f
mov r14d, 0xc004d104
jmp 0x14017ff6b
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
mov ecx, dword [rsp + 0x34]
lea r8, [rsp + 0x40]
mov r15d, dword [rsp + 0x30]
xor ecx, eax
mov dword [rsp + 0x34], ecx
lea rax, [rsp + 0x30]
mov qword [rsp + 0x50], rax
xor r15d, ecx
mov rax, qword [0x140422958]
mov r9d, 8
mov dword [rsp + 0x48], r14d
mov dl, 1
mov dword [rsp + 0x58], r14d
mov ecx, dword [rax]
lea rax, [rsp + 0x50]
add rax, rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x40], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
call fcn.140184c24
test r12d, r12d
je 0x14017ff6b
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [rsp + 0x30]
mov ecx, r15d
mov edi, dword [r13 + 8]
xor eax, r15d
mov rsi, qword [r13]
mov r15d, eax
mov al, byte [rbp + 0x78]
add edi, r14d
inc al
rol r15d, cl
mov byte [rbp + 0x78], al
movzx r8d, al
mov al, byte [rbp + 0x79]
add al, byte [rsp + r8 + 0x78]
mov byte [rbp + 0x79], al
mov cl, byte [rsp + r8 + 0x78]
movzx edx, al
mov al, byte [rsp + rdx + 0x78]
mov byte [rsp + r8 + 0x78], al
mov byte [rsp + rdx + 0x78], cl
mov edx, edi
movzx ecx, byte [rbp + 0x79]
movzx eax, byte [rbp + 0x78]
mov cl, byte [rsp + rcx + 0x78]
add cl, byte [rsp + rax + 0x78]
movzx eax, cl
mov rcx, rsi
mov bl, byte [rsp + rax + 0x78]
call fcn.14017bc10
xor al, r15b
mov edx, edi
xor al, bl
mov rcx, rsi
mov r8b, al
call fcn.14017bc50
inc r14d
cmp r14d, r12d
jb 0x14017fed7
xor r14d, r14d
lea rcx, [rsp + 0x60]
call fcn.140184ba4
mov eax, r14d
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.14035a4e0
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x140180708
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x4f]
sub rsp, 0x90
mov rax, qword [rbp + 0x7f]
movaps xmm0, xmmword [r9]
movaps xmm1, xmmword [rdx]
movdqa xmmword [rbp - 0x11], xmm0
movdqa xmmword [rbp - 0x21], xmm1
test rax, rax
jne 0x140180747
mov ebx, 0x80070057
mov ecx, ebx
call fcn.140078308
call fcn.140078324
jmp 0x14018079c
mov qword [rbp + 0x17], rcx
lea rdx, [0x14000ad60]
mov qword [rbp + 7], rdx
lea rcx, [rbp - 0x21]
mov qword [rbp + 0x27], rcx
lea rdx, [rbp + 0x7f]
lea rcx, [rbp - 0x11]
mov dword [rbp + 0x2f], r8d
xor r9d, r9d
mov qword [rbp + 0x37], rcx
mov qword [rbp + 0xf], rdx
lea rdx, [rbp - 1]
mov qword [rbp - 1], 3
mov dword [rbp + 0x1f], 0x80
lea r8d, [r9 + 0x48]
mov qword [rbp + 0x3f], rax
lea ecx, [r8 + 0x71]
call sub.ntdll.dll_NtQuerySystemInformation
mov ebx, dword [rbp + 0x7f]
mov eax, ebx
mov rbx, qword [rsp + 0xa0]
add rsp, 0x90
pop rbp
ret

Function at 0x1401807b0
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x4f]
sub rsp, 0x90
mov rax, qword [rbp + 0x7f]
movaps xmm0, xmmword [r9]
movaps xmm1, xmmword [rdx]
movdqa xmmword [rbp - 0x11], xmm0
movdqa xmmword [rbp - 0x21], xmm1
test rax, rax
jne 0x1401807ef
mov ebx, 0x80070057
mov ecx, ebx
call fcn.140078308
call fcn.140078324
jmp 0x140180844
mov qword [rbp + 0x17], rcx
lea rdx, [0x14000ad60]
mov qword [rbp + 7], rdx
lea rcx, [rbp - 0x21]
mov qword [rbp + 0x27], rcx
lea rdx, [rbp + 0x7f]
lea rcx, [rbp - 0x11]
mov dword [rbp + 0x2f], r8d
xor r9d, r9d
mov qword [rbp + 0x37], rcx
mov qword [rbp + 0xf], rdx
lea rdx, [rbp - 1]
mov qword [rbp - 1], 3
mov dword [rbp + 0x1f], 0x40
lea r8d, [r9 + 0x48]
mov qword [rbp + 0x3f], rax
lea ecx, [r8 + 0x71]
call sub.ntdll.dll_NtQuerySystemInformation
mov ebx, dword [rbp + 0x7f]
mov eax, ebx
mov rbx, qword [rsp + 0xa0]
add rsp, 0x90
pop rbp
ret