joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180048b90
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x180064040]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor r15d, r15d
mov r14d, edx
mov qword [rcx], r15
mov rbx, rcx
mov qword [rcx + 8], r15
xor edx, edx
mov ecx, 4
mov ebp, r8d
mov edi, r15d
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x180048d4a
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x180048cd8
mov edi, 1
cmp dword [rsp + 0x20], 0x10
jb 0x180048c92
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x2c], eax
jne 0x180048c92
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rsp + 0x28], eax
je 0x180048c92
mov rdx, qword [rbx]
test rdx, rdx
jne 0x180048c54
mov rcx, qword [0x1800650c8]
mov r8d, 0x200
mov dword [rbx + 8], 0x80
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbx], rax
mov rdx, rax
test rax, rax
je 0x180048cbb
jmp 0x180048c85
mov eax, dword [rbx + 8]
cmp dword [rbx + 0xc], eax
jb 0x180048c85
mov rcx, qword [0x1800650c8]
add eax, eax
mov r9d, eax
mov r8, rdx
shl r9, 2
xor edx, edx
mov dword [rbx + 8], eax
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rdx, rax
test rax, rax
je 0x180048cbb
mov qword [rbx], rax
mov ecx, dword [rbx + 0xc]
mov eax, dword [rsp + 0x28]
mov dword [rdx + rcx*4], eax
inc dword [rbx + 0xc]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x180048c02
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x180048cd8
mov r8, qword [rbx]
mov edi, r15d
test r8, r8
je 0x180048cd8
mov rcx, qword [0x1800650c8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rbx], r15
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x180048d4a
cmp qword [rbx], r15
je 0x180048d45
mov edi, r15d
cmp dword [rbx + 0xc], r15d
jbe 0x180048d45
nop dword [rax]
nop word [rax + rax]
mov r8, qword [rbx]
xor edx, edx
mov eax, edi
mov ecx, 0x5a
mov r8d, dword [r8 + rax*4]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x180048d3e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov r8d, ebp
mov edx, r14d
mov rcx, rsi
call fcn.1800489e0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [rbx + 0xc]
jb 0x180048d00
mov eax, r15d
jmp 0x180048d4f
mov eax, 9
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.18004e910
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x180048d70
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x180064040]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov eax, ecx
lea r9, [rsp + 0x20]
imul rbx, rax, 0x38
mov esi, edx
add rbx, qword [0x1800652b0]
mov r8, qword [rbx]
movzx eax, byte [rbx + 0x20]
and al, 1
movzx ecx, al
lea rdi, [r8 - 5]
cmove rdi, r8
mov r8d, 0x40
lea rbp, [rcx*2 + 5]
mov rcx, rdi
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x180048de3
mov eax, 0xa
jmp 0x180048e76
test esi, esi
je 0x180048e05
mov byte [rdi], 0xe9
mov eax, dword [rbx + 8]
sub eax, edi
sub eax, 5
mov dword [rdi + 1], eax
test byte [rbx + 0x20], 1
je 0x180048e28
mov rax, qword [rbx]
mov word [rax], 0xf9eb
jmp 0x180048e28
mov eax, dword [rbx + 0x18]
test byte [rbx + 0x20], 1
mov dword [rdi], eax
je 0x180048e21
movzx eax, word [rbx + 0x1c]
mov word [rdi + 4], ax
movzx eax, byte [rbx + 0x1e]
mov byte [rdi + 6], al
jmp 0x180048e28
movzx eax, byte [rbx + 0x1c]
mov byte [rdi + 4], al
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, rbp
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
movzx ecx, sil
shl sil, 2
add cl, cl
xor cl, byte [rbx + 0x20]
and cl, 2
xor cl, byte [rbx + 0x20]
xor sil, cl
and sil, 4
xor sil, cl
mov byte [rbx + 0x20], sil
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.18004e910
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x180048ea0
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x30
mov r8d, dword [0x1800652bc]
mov esi, ecx
xor ecx, ecx
mov ebx, ecx
test r8d, r8d
je 0x180048ee7
mov rax, qword [0x1800652b0]
add rax, 0x20
nop word [rax + rax]
movzx edx, byte [rax]
shr edx, 1
and edx, 1
cmp edx, esi
jne 0x180048ef4
inc ebx
add rax, 0x38
cmp ebx, r8d
jb 0x180048ed0
mov eax, ecx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rsi
ret
cmp ebx, 0xffffffff
je 0x180048ee7
test esi, esi
mov qword [rsp + 0x48], rdi
mov edx, 0xffffffff
setne cl
mov r8d, ecx
lea rcx, [rsp + 0x20]
call fcn.180048b90
mov edi, eax
test eax, eax
jne 0x180048fdf
mov r9d, dword [0x1800652bc]
cmp ebx, r9d
jae 0x180048f6c
nop dword [rax + rax]
mov ecx, ebx
imul rdx, rcx, 0x38
mov rcx, qword [0x1800652b0]
movzx r8d, byte [rdx + rcx + 0x20]
shr r8d, 1
and r8d, 1
cmp r8d, esi
je 0x180048f65
mov edx, esi
mov ecx, ebx
call fcn.180048d70
mov edi, eax
test eax, eax
jne 0x180048f6c
mov r9d, dword [0x1800652bc]
inc ebx
cmp ebx, r9d
jb 0x180048f30
cmp qword [rsp + 0x20], 0
je 0x180048fdd
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x180048fc9
mov rbx, qword [rsp + 0x20]
mov qword [rsp + 0x40], rbp
mov ebp, eax
nop dword [rax + rax]
mov r8d, dword [rbx]
xor edx, edx
mov ecx, 0x5a
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x180048fba
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub rbp, 1
jne 0x180048f90
mov rbp, qword [rsp + 0x40]
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x1800650c8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rsi
ret
Function at 0x180049370
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rdi
push r14
sub rsp, 0x30
xor r14d, r14d
mov edi, 1
mov ebp, r14d
mov ebx, r14d
xor eax, eax
lock cmpxchg dword [0x1800650c0], edi
je 0x1800493b8
cmp rbx, 0x20
jae 0x1800493a1
xor ecx, ecx
jmp 0x1800493a3
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
xor eax, eax
lock cmpxchg dword [0x1800650c0], edi
jne 0x180049397
cmp qword [0x1800650c8], rbp
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x60], r15
je 0x180049558
mov ecx, dword [0x1800652bc]
mov ebx, r14d
test ecx, ecx
je 0x1800493f5
mov rdx, qword [0x1800652b0]
mov rax, rdx
cmp qword [rax], rbp
je 0x1800493ff
inc ebx
add rax, 0x38
cmp ebx, ecx
jb 0x1800493e6
mov ebp, 4
jmp 0x18004955d
cmp ebx, 0xffffffff
je 0x1800493f5
mov eax, ebx
mov r15d, ebx
imul r13, rax, 0x38
test byte [rdx + r13 + 0x20], 2
je 0x1800494bc
xor r8d, r8d
lea rcx, [rsp + 0x20]
mov edx, ebx
call fcn.180048b90
mov ebp, eax
test eax, eax
jne 0x18004955d
xor edx, edx
mov ecx, ebx
call fcn.180048d70
mov ebp, eax
cmp qword [rsp + 0x20], r14
je 0x1800494ad
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x180049499
mov rdi, qword [rsp + 0x20]
mov qword [rsp + 0x50], rsi
mov esi, eax
nop dword [rax + rax]
mov r8d, dword [rdi]
xor edx, edx
mov ecx, 0x5a
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rbx, rax
test rax, rax
je 0x18004948a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rdi, 4
sub rsi, 1
jne 0x180049460
mov rsi, qword [rsp + 0x50]
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x1800650c8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
test ebp, ebp
jne 0x18004955d
mov rdx, qword [0x1800652b0]
mov rcx, qword [rdx + r13 + 0x10]
call fcn.1800481a0
mov edx, dword [0x1800652bc]
dec edx
cmp r15d, edx
jae 0x18004950c
mov eax, edx
imul rcx, rax, 0x38
mov rax, qword [0x1800652b0]
movups xmm0, xmmword [rcx + rax]
movups xmmword [rax + r13], xmm0
movups xmm1, xmmword [rcx + rax + 0x10]
movups xmmword [rax + r13 + 0x10], xmm1
movups xmm0, xmmword [rcx + rax + 0x20]
movups xmmword [rax + r13 + 0x20], xmm0
movsd xmm1, qword [rcx + rax + 0x30]
movsd qword [rax + r13 + 0x30], xmm1
mov ecx, dword [0x1800652b8]
mov eax, ecx
mov dword [0x1800652bc], edx
shr eax, 1
cmp eax, 0x20
jb 0x18004955d
cmp eax, edx
jb 0x18004955d
mov r8, qword [0x1800652b0]
mov eax, ecx
mov rcx, qword [0x1800650c8]
xor edx, edx
shr rax, 1
imul r9, rax, 0x38
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
test rax, rax
je 0x18004955d
shr dword [0x1800652b8], 1
mov qword [0x1800652b0], rax
jmp 0x18004955d
mov ebp, 2
xchg dword [0x1800650c0], r14d
mov r15, qword [rsp + 0x60]
mov eax, ebp
mov r13, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop rdi
pop rbp
ret
Function at 0x18004ac90
Capabilities:
Resume thread

Disassembly:
push rbx
sub rsp, 0x20
mov r8d, 0x1b
lea rdx, str.fusion_internal__rip_lunar
lea rcx, [0x180064350]
call fcn.18000a7b0
lea rcx, str.opengl32.dll
mov byte [0x180065280], 0
mov byte [0x180065090], 0
mov dword [0x180065284], 0x2d
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.wglSwapBuffers
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
mov rbx, rax
call fcn.180049080
mov edx, 1
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.180049580
Function at 0x18004ddb0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
cmp edx, 1
jne 0x18004ddf8
mov qword [0x1800652a0], rcx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
xor eax, eax
lea r8, [0x18004dd80]
mov qword [rsp + 0x28], rax
mov r9, rbx
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x18004ddf8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add rsp, 0x30
pop rbx
ret
Function at 0x140001410
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x1415dbbb0]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edx, edx
mov rdi, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400014a3
lea rdx, [rsp + 0x20]
mov rcx, rax
mov dword [rsp + 0x20], 0x238
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000149a
lea rax, [rsp + 0x4c]
mov r8, rdi
sub r8, rax
nop dword [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140001484
add rax, 2
test ecx, ecx
jne 0x140001470
mov rcx, rbx
test edx, edx
je 0x1400014c6
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140001460
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1400af490
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x28]
jmp 0x1400014a5
Function at 0x140001b90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
mov qword [rbp - 0x31], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov rax, qword [0x1415dbbb0]
xor rax, rsp
mov qword [rbp + 0x4f], rax
mov eax, 0x6e
mov word [rbp + 0x3f], ax
mov eax, 0x74
mov word [rbp + 0x41], ax
mov eax, WSAAsyncSelect
mov word [rbp + 0x43], ax
mov dword [rbp + 0x45], 0x6c006c
xor edi, edi
mov word [rbp + 0x49], di
mov dword [rbp + 0x27], 0x416c7452
mov dword [rbp + 0x2b], 0x73756a64
mov dword [rbp + 0x2f], 0x69725074
mov dword [rbp + 0x33], 0x656c6976
mov word [rbp + 0x37], 0x6567
mov byte [rbp + 0x39], dil
lea rdx, [rbp + 0x27]
lea rcx, [rbp - 0x29]
call fcn.140001620
mov rbx, rax
lea rdx, [rbp + 0x3f]
lea rcx, [rbp - 1]
call fcn.1400014e0
cmp qword [rbx + 0x18], 0x10
jb 0x140001c32
mov rbx, qword [rbx]
cmp qword [rax + 0x18], 8
jb 0x140001c3c
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
cmp qword [rbp + 0x17], 8
jb 0x140001c64
mov rcx, qword [rbp - 1]
call fcn.1400ae120
mov qword [rbp + 0x17], 7
mov qword [rbp + 0xf], rdi
mov word [rbp - 1], di
cmp qword [rbp - 0x11], 0x10
jb 0x140001c84
mov rcx, qword [rbp - 0x29]
call fcn.1400ae120
mov qword [rbp - 0x11], 0xf
mov qword [rbp - 0x19], rdi
mov byte [rbp - 0x29], 0
lea r9, [rbp - 0x39]
xor r8d, r8d
lea edx, [r8 + 1]
lea ecx, [rdx + 0x13]
call rbx
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.1400af490
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x140002c60
Capabilities:
Enumerate process modules

Disassembly:
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xf70]
mov eax, 0x1070
call fcn.1400af990
sub rsp, rax
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x10a0], rbx
mov qword [rsp + 0x10b0], rsi
mov qword [rsp + 0x10b8], rdi
mov rax, qword [0x1415dbbb0]
xor rax, rsp
mov qword [rbp + 0xf68], rax
mov rdi, rdx
mov eax, 0x33
mov word [rbp + 0xf50], ax
mov eax, 0x36
mov word [rbp + 0xf52], ax
mov eax, 0x30
mov word [rbp + 0xf54], ax
mov eax, 0x74
mov word [rbp + 0xf56], ax
mov dword [rbp + 0xf58], 0x610072
mov dword [rbp + 0xf5c], 0x2e0079
mov dword [rbp + 0xf60], 0x780065
xor esi, esi
mov dword [rbp + 0xf64], reloc.WS2_32.dll_WSAAsyncSelect
lea rcx, [rbp + 0xf50]
call fcn.140001410
mov ebx, eax
test eax, eax
je 0x140002de0
lea r8, [rsp + 0x20]
mov edx, 0x1000
lea rcx, [rsp + 0x50]
call qword [sym.imp.PSAPI.DLL_EnumProcesses]
test eax, eax
je 0x140002de0
mov edx, dword [rsp + 0x20]
shr edx, 2
mov ecx, esi
test edx, edx
je 0x140002de0
lea rax, [rsp + 0x50]
cmp dword [rax], ebx
je 0x140002d67
inc ecx
add rax, 4
cmp ecx, edx
jb 0x140002d57
jmp 0x140002de0
cmp qword [rdi + 0x10], rsi
je 0x140002de0
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.1400019c0
nop
call fcn.140001b90
mov dword [rbp + 0xf50], 0x73006c
mov dword [rbp + 0xf54], 0x730061
mov dword [rbp + 0xf58], 0x2e0073
mov dword [rbp + 0xf5c], 0x780065
mov dword [rbp + 0xf60], reloc.WS2_32.dll_WSAAsyncSelect
lea rcx, [rbp + 0xf50]
call fcn.140001690
test eax, eax
jne 0x140002dc4
jmp 0x140002dd1
lea rdx, [rsp + 0x30]
mov ecx, eax
call fcn.140001cd0
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140002de0
call fcn.1400ae120
mov rcx, qword [rbp + 0xf68]
xor rcx, rsp
call fcn.1400af490
lea r11, [rsp + 0x1070]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x1400080c0
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x280
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1415dbbb0]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rsi, rcx
mov qword [rsp + 0x50], rcx
mov dword [rsp + 0x20], 0
mov edx, 0x104
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x1400081ba
cmp eax, 0x104
ja 0x1400081ba
or r8d, 0xffffffff
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x30]
call fcn.140016c40
mov rbx, rax
lea rcx, [rsp + 0x24]
call fcn.14001c120
movzx r8d, word [rax]
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.140007360
nop
lea r8, [0x1415365fc]
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.1400073b0
nop
mov rax, qword [rsp + 0x38]
lock dec dword [rax]
jne 0x14000817d
mov rcx, qword [rsp + 0x38]
call fcn.140012a00
nop
mov rax, qword [rsp + 0x30]
lock dec dword [rax]
jne 0x140008191
mov rcx, qword [rsp + 0x30]
call fcn.140012a00
mov rcx, qword [rsp + 0x28]
mov qword [rsi], rcx
lock inc dword [rcx]
mov dword [rsp + 0x20], 1
mov rcx, qword [rsp + 0x28]
lock dec dword [rcx]
jne 0x140008229
mov rcx, qword [rsp + 0x28]
call fcn.140012a00
jmp 0x140008229
lea rcx, [rsp + 0x48]
call fcn.140003810
mov rbx, rax
or r8d, 0xffffffff
lea rdx, [0x1415365d8]
lea rcx, [rsp + 0x40]
call fcn.140014790
nop
mov rdx, rax
mov rcx, qword [rbx]
call fcn.14001a6b0
nop
mov rax, qword [rsp + 0x40]
lock dec dword [rax]
jne 0x1400081fd
mov rcx, qword [rsp + 0x40]
call fcn.140012a00
mov rcx, qword [rbx]
cmp byte [rcx + 0x20], 0
je 0x14000820e
mov dl, 0x20
call fcn.14001a460
nop
lea rcx, [rsp + 0x48]
call fcn.1400011d0
lea r11, [0x1415d9378]
mov qword [rsi], r11
lock inc dword [0x1415d9378]
mov rax, rsi
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1400af490
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140008260
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x290
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
mov rax, qword [0x1415dbbb0]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbp, rcx
xor ebx, ebx
mov dword [rsp + 0x20], ebx
movsd xmm6, qword [0x141536688]
or esi, 0xffffffff
movsd xmm7, qword [0x141536680]
nop word [rax + rax]
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
mulsd xmm0, xmm7
subsd xmm6, xmm0
lea rcx, [rsp + 0x30]
call fcn.140003810
mov rdi, rax
mov r8d, esi
lea rdx, [0x141536658]
lea rcx, [rsp + 0x20]
call fcn.140014790
nop
mov rdx, rax
mov rcx, qword [rdi]
call fcn.14001a6b0
nop
mov rax, qword [rsp + 0x20]
lock dec dword [rax]
jne 0x140008312
mov rcx, qword [rsp + 0x20]
call fcn.140012a00
mov rcx, qword [rdi]
cmp byte [rcx + 0x20], 0
je 0x140008322
mov dl, 0x20
call fcn.14001a460
movapd xmm1, xmm6
mov rcx, qword [rdi]
call fcn.14001a580
mov rcx, qword [rdi]
cmp byte [rcx + 0x20], 0
je 0x14000833f
mov dl, 0x20
call fcn.14001a460
nop
lea rcx, [rsp + 0x30]
call fcn.1400011d0
inc ebx
cmp ebx, 0x1e
jl 0x1400082c0
mov edx, 0x104
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
test eax, eax
jne 0x1400083d9
lea rcx, [rsp + 0x38]
call fcn.140003810
mov rbx, rax
mov r8d, esi
lea rdx, [0x141536630]
lea rcx, [rsp + 0x28]
call fcn.140014790
nop
mov rdx, rax
mov rcx, qword [rbx]
call fcn.14001a6b0
nop
mov rax, qword [rsp + 0x28]
lock dec dword [rax]
jne 0x1400083aa
mov rcx, qword [rsp + 0x28]
call fcn.140012a00
mov rcx, qword [rbx]
cmp byte [rcx + 0x20], 0
je 0x1400083bb
mov dl, 0x20
call fcn.14001a460
nop
lea rcx, [rsp + 0x38]
call fcn.1400011d0
lea r11, [0x1415d9378]
mov qword [rbp], r11
lock inc dword [0x1415d9378]
jmp 0x1400083e9
mov r8d, esi
lea rdx, [rsp + 0x50]
mov rcx, rbp
call fcn.140016c40
mov rax, rbp
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1400af490
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14000c2d0
Capabilities:
Enumerate process modules

Disassembly:
push r13
mov eax, 0x1270
call fcn.1400af990
sub rsp, rax
mov rax, qword [0x1415dbbb0]
xor rax, rsp
mov qword [rsp + 0x1250], rax
mov r13, rcx
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x40]
mov edx, 0x1000
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x14000c48d
mov qword [rsp + 0x1280], rbx
mov qword [rsp + 0x1288], rbp
mov qword [rsp + 0x1290], rsi
mov qword [rsp + 0x1298], rdi
mov qword [rsp + 0x1268], r12
mov r12d, dword [rsp + 0x20]
shr r12d, 2
xor esi, esi
mov qword [rsp + 0x1260], r14
test r12d, r12d
je 0x14000c45b
lea rbp, [rsp + 0x40]
or r14, 0xffffffffffffffff
nop dword [rax]
mov r8d, dword [rbp]
test r8d, r8d
je 0x14000c44c
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14000c44c
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
mov rcx, rax
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x14000c443
mov rdx, qword [rsp + 0x28]
lea r8, [rsp + 0x1040]
mov r9d, 0x104
mov rcx, rbx
call sub.PSAPI.DLL_GetModuleBaseNameW
test eax, eax
je 0x14000c443
mov r8, qword [r13 + 0x10]
xor eax, eax
lea rdi, [rsp + 0x1040]
mov rcx, r14
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp r8, r8
cmp qword [r13 + 0x18], 8
mov r9, rcx
jb 0x14000c3f2
mov rdx, qword [r13]
jmp 0x14000c3f5
mov rdx, r13
cmp r8, rcx
mov rdi, rcx
lea rcx, [rsp + 0x1040]
cmovb rdi, r8
test rdi, rdi
je 0x14000c429
nop dword [rax]
movzx eax, word [rcx]
cmp word [rdx], ax
jne 0x14000c4a7
add rdx, 2
add rcx, 2
dec rdi
jne 0x14000c410
xor edi, edi
movsxd rax, edi
test edi, edi
jne 0x14000c43f
cmp r8, r9
jb 0x14000c443
xor eax, eax
cmp r8, r9
setne al
test eax, eax
je 0x14000c4b8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
add rbp, 4
cmp esi, r12d
jb 0x14000c360
xor al, al
mov r12, qword [rsp + 0x1268]
mov rdi, qword [rsp + 0x1298]
mov rsi, qword [rsp + 0x1290]
mov rbp, qword [rsp + 0x1288]
mov rbx, qword [rsp + 0x1280]
mov r14, qword [rsp + 0x1260]
mov rcx, qword [rsp + 0x1250]
xor rcx, rsp
call fcn.1400af490
add rsp, 0x1270
pop r13
ret
cmp word [rdx], ax
mov edi, 1
cmovb edi, r14d
jmp 0x14000c42b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x14000c45d
Function at 0x14001b540
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x1415dbbb0]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov eax, dword [0x1415dd8f4]
test eax, eax
jne 0x14001b632
mov qword [rsp + 0x150], rbx
lea rcx, [rsp + 0x20]
mov ebx, 0x10
mov dword [0x1415dd8f4], ebx
mov dword [rsp + 0x20], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov r11d, dword [rsp + 0x30]
test r11d, r11d
je 0x14001b61d
dec r11d
je 0x14001b602
mov edx, dword [rsp + 0x24]
cmp edx, 5
jb 0x14001b622
mov r8d, dword [rsp + 0x28]
jne 0x14001b5d3
test r8d, r8d
jne 0x14001b5bb
lea ebx, [r8 + 0x20]
jmp 0x14001b622
cmp r8d, 1
jne 0x14001b5c7
lea ebx, [r8 + 0x2f]
jmp 0x14001b622
cmp r8d, 2
jne 0x14001b5ef
lea ebx, [r8 + 0x3e]
jmp 0x14001b622
cmp edx, 6
jne 0x14001b5ef
test r8d, r8d
jne 0x14001b5e2
lea ebx, [rdx + 0x7a]
jmp 0x14001b622
cmp r8d, 1
jne 0x14001b5ef
mov ebx, 0x90
jmp 0x14001b622
lea rcx, [0x141556890]
call fcn.14001b2c0
mov ebx, 0xf0
jmp 0x14001b622
mov eax, dword [rsp + 0x28]
cmp eax, 0x5a
jne 0x14001b610
lea ebx, [rax - 0x56]
jmp 0x14001b622
xor ebx, ebx
cmp eax, 0xa
sete bl
add ebx, 2
jmp 0x14001b622
mov ebx, 1
mov dword [0x1415dd8f4], ebx
mov eax, ebx
mov rbx, qword [rsp + 0x150]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400af490
add rsp, 0x158
ret