joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001d30
Capabilities:
Create process on windows
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x330
mov rax, qword [0x140007010]
xor rax, rsp
mov qword [rsp + 0x320], rax
xor edi, edi
mov dword [rsp + 0xe0], 0x238
xor edx, edx
mov ebx, edi
lea ecx, [rdi + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140001dd8
lea rdx, [rsp + 0xe0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140001dc4
nop dword [rax]
lea rdx, str.PlantsVsZombies.exe
lea rcx, [rsp + 0x10c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
lea rdx, [rsp + 0xe0]
mov rcx, rsi
test eax, eax
cmove ebx, dword [rsp + 0xe8]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140001d90
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x140001dd8
mov eax, ebx
jmp 0x140001eb1
lea rdx, str.Plants_vs._Zombies
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
lea rdx, [rsp + 0x68]
mov dword [rsp + 0x68], edi
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [rsp + 0x68]
test eax, eax
jne 0x140001eb1
lea rcx, [0x140005470]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wchdir]
xorps xmm0, xmm0
lea rcx, str.PlantsVsZombies.exe
xor eax, eax
xor r9d, r9d
mov qword [rsp + 0xd0], rax
xor r8d, r8d
mov qword [rsp + 0x60], rax
xor edx, edx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xa0], xmm0
movups xmmword [rsp + 0xb0], xmm0
movups xmmword [rsp + 0xc0], xmm0
movups xmmword [rsp + 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140001eaf
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [rsp + 0x60]
mov eax, edi
mov rcx, qword [rsp + 0x320]
xor rcx, rsp
call fcn.140003650
lea r11, [rsp + 0x330]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x140001fc0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x140007010]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, rcx
mov dword [0x140007dac], edx
mov r8d, edx
mov ecx, 0x1fffff
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor edi, edi
lea r8, [rsp + 0x38]
mov edx, 0x6a9ec0
mov qword [0x140007da0], rax
mov rcx, rax
mov dword [rsp + 0x38], edi
mov qword [rsp + 0x20], rdi
lea r9d, [rdi + 4]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [rsp + 0x38]
lea r9d, [rdi + 8]
mov rcx, qword [0x140007da0]
lea r8, [rsp + 0x30]
add eax, 0x350
mov qword [rsp + 0x30], rdi
movsxd rdx, eax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140007da0]
xor edx, edx
mov r9d, 0x1000
mov dword [rsp + 0x20], 0x40
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [0x140007da8], eax
mov rax, rbx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140003650
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x403152
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov eax, ecx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov byte [rbp + 0x10], al
mov byte [rbp - 1], 0
jmp 0x4031eb
mov byte [rbp - 2], 0
jmp 0x4031e1
movzx eax, byte [rbp - 1]
movzx edx, byte [rbp - 2]
mov rcx, qword [rbp + 0x18]
movsxd rdx, edx
cdqe
shl rax, 2
add rax, rcx
add rax, rdx
movzx r8d, byte [rax]
movzx eax, byte [rbp + 0x10]
lea edx, [rax*4]
movzx eax, byte [rbp - 1]
add eax, edx
lea edx, [rax*4]
movzx eax, byte [rbp - 2]
add eax, edx
cdqe
mov rdx, qword [rbp + 0x20]
add rax, rdx
movzx ecx, byte [rax]
movzx eax, byte [rbp - 1]
movzx edx, byte [rbp - 2]
xor r8d, ecx
mov rcx, qword [rbp + 0x18]
movsxd rdx, edx
cdqe
shl rax, 2
add rax, rcx
add rax, rdx
mov byte [rax], r8b
add byte [rbp - 2], 1
cmp byte [rbp - 2], 3
jbe 0x403173
add byte [rbp - 1], 1
cmp byte [rbp - 1], 3
jbe 0x40316d
nop
add rsp, 0x10
pop rbp
ret

Function at 0x4031fc
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rbp + 0x10], rcx
mov byte [rbp - 1], 0
jmp 0x40326f
mov byte [rbp - 2], 0
jmp 0x403265
movzx eax, byte [rbp - 2]
movzx edx, byte [rbp - 1]
mov rcx, qword [rbp + 0x10]
movsxd rdx, edx
cdqe
shl rax, 2
add rax, rcx
add rax, rdx
movzx eax, byte [rax]
movzx eax, al
movzx r8d, byte [rbp - 2]
movzx ecx, byte [rbp - 1]
cdqe
lea rdx, str.cw
movzx edx, byte [rax + rdx]
mov r9, qword [rbp + 0x10]
movsxd rcx, ecx
movsxd rax, r8d
shl rax, 2
add rax, r9
add rax, rcx
mov byte [rax], dl
add byte [rbp - 2], 1
cmp byte [rbp - 2], 3
jbe 0x403214
add byte [rbp - 1], 1
cmp byte [rbp - 1], 3
jbe 0x40320e
nop
add rsp, 0x10
pop rbp
ret

Function at 0x403d11
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rbp + 0x10], rcx
mov byte [rbp - 1], 0
jmp 0x403d84
mov byte [rbp - 2], 0
jmp 0x403d7a
movzx eax, byte [rbp - 2]
movzx edx, byte [rbp - 1]
mov rcx, qword [rbp + 0x10]
movsxd rdx, edx
cdqe
shl rax, 2
add rax, rcx
add rax, rdx
movzx eax, byte [rax]
movzx eax, al
movzx r8d, byte [rbp - 2]
movzx ecx, byte [rbp - 1]
cdqe
lea rdx, [0x00407aa0]
movzx edx, byte [rax + rdx]
mov r9, qword [rbp + 0x10]
movsxd rcx, ecx
movsxd rax, r8d
shl rax, 2
add rax, r9
add rax, rcx
mov byte [rax], dl
add byte [rbp - 2], 1
cmp byte [rbp - 2], 3
jbe 0x403d29
add byte [rbp - 1], 1
cmp byte [rbp - 1], 3
jbe 0x403d23
nop
add rsp, 0x10
pop rbp
ret

Function at 0x403fbb
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov byte [rbp - 1], 0
jmp 0x404004
movzx eax, byte [rbp - 1]
mov rdx, qword [rbp + 0x10]
add rax, rdx
movzx r8d, byte [rax]
movzx eax, byte [rbp - 1]
mov rdx, qword [rbp + 0x18]
add rax, rdx
movzx ecx, byte [rax]
movzx eax, byte [rbp - 1]
mov rdx, qword [rbp + 0x10]
add rax, rdx
mov edx, r8d
xor edx, ecx
mov byte [rax], dl
add byte [rbp - 1], 1
cmp byte [rbp - 1], 0xf
jbe 0x403fd1
nop
add rsp, 0x10
pop rbp
ret
Function at 0x404770
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x0040b624]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x4048f8
mov rax, qword [0x0040b628]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x4047bc
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x404845
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x4047a0
mov rcx, rbx
call fcn.00405410
test rax, rax
mov r12, rax
je 0x40492d
mov rax, qword [0x0040b628]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call fcn.00405540
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x0040b628]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x404910
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x40483e
sub eax, 0x40
and eax, 0xffffffbf
jne 0x4048a0
add dword [0x0040b624], 1
cmp edi, 8
jae 0x404873
test dil, 4
jne 0x4048e4
test edi, edi
je 0x404868
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x4048ff
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x404868
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x40488c
jmp 0x404868
add rsi, qword [0x0040b628]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x40483e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.00405910
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x404868
xor esi, esi
jmp 0x4047c7
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x404868
mov rax, qword [0x0040b628]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call fcn.00405910
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call fcn.00405910
nop
nop dword [rax]

Function at 0x405080
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x0040b900]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x0040b8e0]
test rbx, rbx
je 0x4050d4
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x4050cb
test rsi, rsi
je 0x4050cb
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x4050b0
lea rcx, [0x0040b900]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x405410
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x00407f00]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x40547d
mov rcx, r8
call fcn.004052f0
test eax, eax
je 0x40547d
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x40547d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x405474
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x40547f
add rax, 0x28
cmp rax, r9
jne 0x405460
xor eax, eax
add rsp, 0x28
ret

Function at 0x405910
Capabilities:
Write file on windows

Disassembly:
lea rcx, [0x00401540]
jmp 0x401510
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.004057d0
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.004057d0
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
jmp 0x401530
Function at 0x14000b948
Capabilities:
Create service
Modify service
Persist via windows service
Start service

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x2a0
mov rax, qword [0x14012bab8]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov rdi, rcx
mov qword [rsp + 0x70], rdx
xor edx, edx
lea rcx, [rsp + 0x80]
mov r8d, 0x208
call sub.msvcrt.dll_memset
mov r8d, 0x104
lea rdx, [rsp + 0x80]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
test eax, eax
jne 0x14000b9d4
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
lea rcx, str.Service:_Cannot_install_service___u__n
mov edx, eax
call qword [sym.imp.msvcrt.dll_wprintf_s]
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.1400cb420
mov rbx, qword [rsp + 0x2c0]
add rsp, 0x2a0
pop rdi
ret
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
jne 0x14000b9fb
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
lea rcx, str.Service:_OpenSCManager_failed___u__n
jmp 0x14000b9ab
and qword [rsp + 0x60], 0
lea rax, [rsp + 0x80]
and qword [rsp + 0x58], 0
lea rdx, str.SensorDataService
and qword [rsp + 0x50], 0
mov r9d, 0xf01ff
and qword [rsp + 0x48], 0
mov r8, rdi
and qword [rsp + 0x40], 0
mov rcx, rbx
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0x10
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CreateServiceW]
mov rdi, rax
test rax, rax
jne 0x14000ba86
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edx, eax
lea rcx, str.Service:_CreateService_failed___u__n
call qword [sym.imp.msvcrt.dll_wprintf_s]
mov rcx, rbx
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
test eax, eax
je 0x14000baec
jmp 0x14000b9b3
lea rcx, str.Service:_Installed_successfully_n
call qword [sym.imp.msvcrt.dll_wprintf_s]
lea r8, [rsp + 0x70]
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_management_l2_1_0.dll_ChangeServiceConfig2W]
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_StartServiceW]
test eax, eax
jne 0x14000bac5
lea rcx, str.Service:_Failed_to_start_n
call qword [sym.imp.msvcrt.dll_wprintf_s]
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
test eax, eax
jne 0x14000ba74
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.14000cd28
int3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.14000cd28
int3
Function at 0x14000bb0c
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x14012bab8]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor edx, edx
lea rcx, [rsp + 0x38]
lea r8d, [rdx + 0x24]
call sub.msvcrt.dll_memset
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount64]
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
mov rsi, rax
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
jne 0x14000bb8f
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edx, eax
lea rcx, str.Service:_OpenSCManager_failed___u__n
call qword [sym.imp.msvcrt.dll_wprintf_s]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400cb420
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
mov r8d, 0xf01ff
lea rdx, str.SensorDataService
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenServiceW]
mov rbx, rax
test rax, rax
jne 0x14000bbd5
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edx, eax
lea rcx, str.Service:_OpenService_failed___u__n
call qword [sym.imp.msvcrt.dll_wprintf_s]
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
test eax, eax
je 0x14000bc96
jmp 0x14000bb70
lea r8, [rsp + 0x38]
mov edx, 1
mov rcx, rbx
call qword [sym.imp.api_ms_win_service_winsvc_l1_1_0.dll_ControlService]
test eax, eax
je 0x14000bc3a
cmp dword [rsp + 0x3c], 1
je 0x14000bc3a
add rsi, 0x3a98
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount64]
cmp rax, rsi
ja 0x14000bc3a
lea rax, [rsp + 0x30]
mov r9d, 0x24
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rbx
call qword [sym.imp.api_ms_win_service_management_l2_1_0.dll_QueryServiceStatusEx]
test eax, eax
je 0x14000bc3a
cmp dword [rsp + 0x3c], 1
jne 0x14000bbfa
mov rcx, rbx
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_DeleteService]
test eax, eax
jne 0x14000bc5e
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edx, eax
lea rcx, str.Service:_DeleteService_failed___u__n
call qword [sym.imp.msvcrt.dll_wprintf_s]
jmp 0x14000bc6b
lea rcx, str.Service:_Uninstalled_successfully_n
call qword [sym.imp.msvcrt.dll_wprintf_s]
mov rcx, rbx
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
test eax, eax
jne 0x14000bbc2
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.14000cd28
int3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.14000cd28
int3
Function at 0x14000e63c
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x168]
sub rsp, 0x250
mov rax, qword [0x14012bab8]
xor rax, rsp
mov qword [rbp + 0x140], rax
xor r15d, r15d
lea rax, [rsp + 0x30]
mov qword [r8], r15
lea rdx, [rsp + 0x30]
sub rcx, rax
mov r14, r8
mov r9d, 0x104
lea rax, [r9 + 0x7ffffefa]
test rax, rax
je 0x14000e6ad
movzx eax, word [rcx + rdx]
test ax, ax
je 0x14000e6ad
mov word [rdx], ax
add rdx, 2
sub r9, 1
jne 0x14000e68b
test r9, r9
lea rax, [rdx - 2]
lea r8, [0x1400dc208]
cmovne rax, rdx
lea rcx, [rsp + 0x30]
mov word [rax], r15w
call fcn.14000cd60
mov ebx, 0x1f0003
lea r8, [rsp + 0x30]
mov ecx, ebx
xor edx, edx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_OpenSemaphoreW]
mov rdi, rax
test rax, rax
jne 0x14000e717
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 2
je 0x14000e7e4
mov edx, 0xc0
mov rcx, qword [rbp + 0x168]
lea r8, [0x1400dc174]
call fcn.14000e3c0
mov esi, eax
jmp 0x14000e7e7
lea rdx, [rsp + 0x24]
mov dword [rsp + 0x24], r15d
mov rcx, rdi
mov dword [rsp + 0x20], r15d
call fcn.14000e4e8
mov esi, eax
test eax, eax
jns 0x14000e754
mov rcx, qword [rbp + 0x168]
lea r8, [0x1400dc174]
mov r9d, eax
mov edx, 0xc6
call fcn.14000e38c
jmp 0x14000e7e7
lea r8, [0x1400dc210]
lea rcx, [rsp + 0x30]
call fcn.14000cd60
lea r8, [rsp + 0x30]
xor edx, edx
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_OpenSemaphoreW]
mov rbx, rax
test rax, rax
jne 0x14000e786
mov edx, 0xcc
jmp 0x14000e6fd
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14000e4e8
mov esi, eax
test eax, eax
jns 0x14000e7c3
mov rcx, qword [rbp + 0x168]
lea r8, [0x1400dc174]
mov r9d, eax
mov edx, 0xce
call fcn.14000e38c
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
test eax, eax
je 0x14000e839
jmp 0x14000e7e7
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
test eax, eax
je 0x14000e84b
movsxd rcx, dword [rsp + 0x20]
movsxd rax, dword [rsp + 0x24]
shl rcx, 0x1f
or rax, rcx
mov qword [r14], rax
mov esi, r15d
test rdi, rdi
je 0x14000e7f9
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
test eax, eax
je 0x14000e827
mov eax, esi
mov rcx, qword [rbp + 0x140]
xor rcx, rsp
call fcn.1400cb420
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov rcx, qword [rbp + 0x168]
mov edx, 0x8f0
call fcn.14000e3e0
int3
mov rcx, qword [rbp + 0x168]
mov edx, 0x8f0
call fcn.14000e3e0
int3
mov rcx, qword [rbp + 0x168]
mov edx, 0x8f0
call fcn.14000e3e0
int3
Function at 0x140043c6c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x20
mov r12, rdx
mov rdi, rcx
lea rdx, [rsp + 0x50]
mov r15, r9
mov rbx, r8
mov rcx, qword [r12]
call qword [sym.imp.api_ms_win_core_winrt_string_l1_1_0.dll_WindowsGetStringRawBuffer]
mov r10d, dword [rsp + 0x50]
mov r9d, 0
mov r11, rax
mov eax, 0x811c9dc5
add r10, r10
je 0x140043cca
movzx ecx, byte [r9 + r11]
inc r9
xor ecx, eax
imul eax, ecx, 0x1000193
cmp r9, r10
jb 0x140043cb5
xor edx, edx
mov dword [r15], eax
div dword [rdi + 0x18]
mov rdi, qword [rdi + 8]
mov dword [rbx], edx
test rdi, rdi
je 0x140043d55
mov r14, qword [rsp + 0x70]
xor esi, esi
mov rdi, qword [rdi + rdx*8]
and qword [r14], rsi
test rdi, rdi
je 0x140043d55
mov eax, dword [r15]
cmp dword [rdi + 0x18], eax
jne 0x140043d3f
mov rcx, qword [rdi]
lea rdx, [rsp + 0x58]
mov rbx, qword [r12]
call qword [sym.imp.api_ms_win_core_winrt_string_l1_1_0.dll_WindowsGetStringRawBuffer]
lea rdx, [rsp + 0x50]
mov rcx, rbx
mov rbp, rax
call qword [sym.imp.api_ms_win_core_winrt_string_l1_1_0.dll_WindowsGetStringRawBuffer]
mov ecx, dword [rsp + 0x50]
cmp dword [rsp + 0x58], ecx
jne 0x140043d3f
mov r8d, ecx
mov rdx, rax
add r8, r8
mov rcx, rbp
call sub.msvcrt.dll_memcmp
test eax, eax
sete al
test al, al
jne 0x140043d48
mov rsi, rdi
mov rdi, qword [rdi + 0x10]
jmp 0x140043ceb
mov rax, qword [rsp + 0x78]
mov qword [r14], rsi
mov qword [rax], rdi
jmp 0x140043d5e
mov rax, qword [rsp + 0x78]
and qword [rax], 0
mov rbx, qword [rsp + 0x60]
xor eax, eax
mov rbp, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140057d9c
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
push rdi
push r14
push r15
sub rsp, 0x60
mov qword [rax - 0x58], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov edi, edx
mov r15, rcx
test edx, edx
jne 0x140057dec
lea r8d, [rdx + 0x30]
lea rcx, [rax - 0x50]
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x28]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemInfo]
mov edi, dword [rsp + 0x48]
cmp edi, 1
jae 0x140057dec
mov eax, 0x80070057
jmp 0x140057f9c
xor ebx, ebx
mov qword [rsp + 0x90], rbx
lea ecx, [rbx + 0x38]
call fcn.1400cade8
test rax, rax
je 0x140057e33
lea rcx, [0x1400d7948]
mov qword [rax], rcx
and qword [rax + 8], rbx
lea rcx, [0x1400d7d70]
mov qword [rax + 0x10], rcx
and qword [rax + 0x18], rbx
lea rcx, [0x1400d7d78]
mov qword [rax + 0x20], rcx
and qword [rax + 0x28], rbx
and qword [rax + 0x30], rbx
test rax, rax
je 0x140057e50
mov rdx, rax
lea rcx, [rsp + 0x90]
call fcn.140058004
mov rbx, qword [rsp + 0x90]
lea r8, [rbx + 8]
lea rdx, [0x140057fc0]
mov ecx, 4
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
jne 0x140057e8d
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov esi, 0x80004005
test ebx, ebx
cmovns ebx, esi
jmp 0x140057f34
xor r8d, r8d
mov rdx, rbx
lea rcx, [0x140057fc0]
call qword [sym.imp.api_ms_win_core_threadpool_l1_2_0.dll_CreateThreadpoolWork]
mov rsi, rax
mov rcx, qword [rbx + 0x28]
cmp rax, rcx
je 0x140057ebb
test rcx, rcx
je 0x140057eb7
call qword [sym.imp.api_ms_win_core_threadpool_l1_2_0.dll_CloseThreadpoolWork]
mov qword [rbx + 0x28], rsi
cmp qword [rbx + 0x28], 0
jne 0x140057ee6
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov esi, 0x80004005
test ecx, ecx
cmovns ecx, esi
test ecx, ecx
jns 0x140057eeb
jmp 0x140057f32
mov esi, 0x80004005
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_threadpool_l1_2_0.dll_CreateThreadpool]
mov r14, rax
mov rcx, qword [rbx + 0x18]
cmp rax, rcx
je 0x140057f0e
test rcx, rcx
je 0x140057f0a
call qword [sym.imp.api_ms_win_core_threadpool_l1_2_0.dll_CloseThreadpool]
mov qword [rbx + 0x18], r14
cmp qword [rbx + 0x18], 0
jne 0x140057f45
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
cmovns ecx, esi
test ecx, ecx
jns 0x140057f45
mov ebx, ecx
lea rcx, [rsp + 0x90]
call fcn.1400580a0
mov eax, ebx
jmp 0x140057f9c
mov edx, edi
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.api_ms_win_core_threadpool_l1_2_0.dll_SetThreadpoolThreadMaximum]
lea rcx, [r15 + 0x10]
lea rax, [rsp + 0x90]
cmp rcx, rax
je 0x140057f79
and qword [rsp + 0x90], 0
cmp rbx, qword [rcx]
je 0x140057f79
mov rdx, rbx
call fcn.140058004
nop
lea rcx, [rsp + 0x90]
call fcn.1400580a0
xor eax, eax
jmp 0x140057f9c
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r15
pop r14
pop rdi
ret