joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140037070
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x90
mov rax, qword [0x140087040]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rax, qword [0x1400886d8]
xor edi, edi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], r8
mov r9, rdx
xor r8d, r8d
xor edx, edx
mov rcx, qword [rcx + 0x80]
call rax
mov rbx, rax
test rax, rax
jne 0x1400371a8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov byte [rsp + 0x20], 1
mov r9b, 1
lea r8d, [rdi + 0x10]
lea rcx, [rsp + 0x60]
call fcn.140021b50
nop
mov r8, rax
lea rdx, [0x1400889c0]
lea rcx, [rsp + 0x40]
call fcn.140035ea0
nop
xor r9d, r9d
mov r8b, 1
lea rdx, [0x1400887a0]
mov rcx, rax
call fcn.14001b400
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x140037153
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003714e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400371f1
call fcn.140038444
movdqa xmm0, xmmword [0x140065b00]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], di
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x1400371a4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003719f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400371eb
call fcn.140038444
xor al, al
jmp 0x1400371ca
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140038560
mov rbx, qword [rsp + 0xb8]
add rsp, 0x90
pop rdi
ret
call fcn.140040ed0
nop
call fcn.140040ed0
nop
int3
Function at 0x1400381d0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, rcx
mov ecx, 0x10
call fcn.140038408
test rax, rax
je 0x1400381f6
mov qword [rax], rbx
lea rcx, [0x140038170]
mov qword [rax + 8], rcx
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x1400338e0]
xor edx, edx
xor ecx, ecx
call fcn.1400467cc
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14003825b
cmp dword [rsp + 0x38], 0
je 0x140038250
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.14003a4f0
test eax, eax
jne 0x140038250
add rsp, 0x50
pop rbx
ret
mov ecx, 1
call fcn.14003a8b8
nop
mov dword [rsp + 0x38], 0
mov ecx, 6
call fcn.14003a8b8
int3

Function at 0x14003925c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400392a6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400392a6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400392a6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400392a6
cmp dword [rcx + 0x84], 0xe
jbe 0x1400392a6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400392a8
xor al, al
add rsp, 0x28
ret

Function at 0x140045ef0
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140045d4f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140045d4f
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140045d4f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140045d4f
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140045d4f
cmp dword [rcx + 0x84], 0xe
jbe 0x140045d4f
cmp dword [rcx + 0xf8], 0
je 0x140045d4f
mov ecx, ebx
call fcn.140045e0c
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140045bdc
nop
cmp dword [rbp + 0x20], 0
je 0x140045d9d
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140045da8
int3
xor r8d, r8d
xor edx, edx
jmp 0x140045ce0
Function at 0x140046550
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x240
mov rax, qword [0x140087040]
xor rax, rsp
mov qword [rsp + 0x230], rax
lea rdx, [0x1400729a8]
mov rbp, rcx
call fcn.140051ea8
xor edi, edi
test rax, rax
je 0x140046636
mov ebx, edi
call fcn.140046ca8
mov r14d, dword [rax]
call fcn.140046ca8
mov r8d, 0x104
lea rcx, [rsp + 0x20]
mov rdx, rbp
mov dword [rax], edi
call fcn.140051df4
mov rsi, rax
test rax, rax
je 0x1400465c7
call fcn.140046ca8
mov dword [rax], r14d
jmp 0x1400465f1
call fcn.140046ca8
cmp dword [rax], 0x22
jne 0x14004662e
call fcn.140046ca8
xor r8d, r8d
mov rdx, rbp
xor ecx, ecx
mov dword [rax], r14d
call fcn.140051df4
mov rbx, rax
mov rsi, rax
test rax, rax
je 0x14004662e
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], di
jne 0x1400465f5
cmp rax, 3
je 0x140046610
mov rcx, rsi
call fcn.1400464ac
test al, al
je 0x140046621
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x140046621
mov dil, 1
mov rcx, rbx
call fcn.140041728
mov al, dil
jmp 0x140046638
mov rcx, rbx
call fcn.140041728
xor al, al
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140038560
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140055f20
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140055fa7
mov rsi, rbx
cmp word [rax], bp
je 0x140055f66
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140055f50
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140055f4c
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14004f998
mov rdi, rax
test rax, rax
je 0x140055f94
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14005f1d0
mov rbp, rdi
xor ecx, ecx
call fcn.14004f95c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14005ec80
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14005eca8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14005eca8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x405170
Capabilities:
Set console window title

Disassembly:
push r12
push rbx
sub rsp, 0x38
lea rax, [0x00732910]
mov qword [rcx], rax
mov rbx, rcx
mov qword [rcx + 8], 0
mov qword [rcx + 0x10], 0
mov ecx, 1
call fcn.004c73f0
cmp eax, 0xe
je 0x4051c0
cmp eax, 7
je 0x4051c0
mov rax, qword [0x0072b230]
mov byte [rax], 0
add rsp, 0x38
pop rbx
pop r12
ret
mov ecx, 0x158
call fcn.006c5c70
mov qword [rbx + 8], rax
mov r12, rax
call fcn.004b95c0
xor r9d, r9d
mov r8d, 1
mov rdx, r12
mov rcx, rax
call fcn.004d72a0
test eax, eax
js 0x4051a8
mov rcx, qword [rbx + 8]
xor edx, edx
call fcn.004d9170
mov rax, qword [rbx + 8]
mov ecx, 0xfffffff6
mov qword [rbx + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x40522f
mov dword [rsp + 0x2c], 0
lea rdx, [rsp + 0x2c]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
test eax, eax
jne 0x405248
lea rcx, str.XMRig_5.5.3
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
nop
add rsp, 0x38
pop rbx
pop r12
ret
mov edx, dword [rsp + 0x2c]
mov rcx, r12
and edx, 0xffffffbf
mov dword [rsp + 0x2c], edx
or dl, 0x80
call qword [sym.imp.KERNEL32.dll_SetConsoleMode]
jmp 0x40522f
Function at 0x40b960
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
cmp qword [0x00778128], 0
mov r12, rcx
mov rsi, rdx
je 0x40ba68
mov rbx, qword [0x00778110]
mov r13, qword [rsi]
test rbx, rbx
je 0x40b9e9
lea rbp, [0x00778108]
mov rsi, rbx
mov rdi, rbp
jmp 0x40b9b4
mov rdi, rsi
mov rsi, qword [rsi + 0x10]
test rsi, rsi
je 0x40b9cd
mov rcx, qword [rsi + 0x20]
mov rdx, r13
call sub.msvcrt.dll_strcmp
test eax, eax
jns 0x40b9a8
mov rsi, qword [rsi + 0x18]
test rsi, rsi
jne 0x40b9b4
cmp rdi, rbp
je 0x40b9e9
mov rdx, qword [rdi + 0x20]
mov rcx, r13
lea rsi, [0x00778108]
call sub.msvcrt.dll_strcmp
test eax, eax
jns 0x40ba0c
mov rcx, r13
call sub.msvcrt.dll_getenv
mov rcx, r12
mov rdx, rax
call fcn.0041e030
jmp 0x40ba4e
mov rsi, rbx
mov rbx, qword [rbx + 0x10]
test rbx, rbx
je 0x40ba25
mov rcx, qword [rbx + 0x20]
mov rdx, r13
call sub.msvcrt.dll_strcmp
test eax, eax
jns 0x40ba00
mov rbx, qword [rbx + 0x18]
test rbx, rbx
jne 0x40ba0c
cmp rsi, rbp
je 0x40bbdd
mov rdx, qword [rsi + 0x20]
mov rcx, r13
call sub.msvcrt.dll_strcmp
test eax, eax
js 0x40bbdd
lea rdx, [rsi + 0x30]
mov rcx, r12
call fcn.0041e0f0
mov rax, r12
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea r13, [rsp + 0x40]
lea rdx, str.XMRIG_VERSION
mov rcx, r13
call fcn.0041e030
lea rcx, [rsp + 0x50]
lea rdx, [0x00708acc]
call fcn.0041e030
lea r14, [rsp + 0x20]
mov r8, r13
lea rdx, [0x00778100]
mov rcx, r14
call fcn.006a7860
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x40bab3
call fcn.006c5c10
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x40bac2
call fcn.006c5c10
lea r15, [rsp + 0x30]
xor edx, edx
lea r8, [0x00708ad2]
mov rcx, r15
call fcn.0040d220
lea rdx, str.XMRIG_EXE_DIR
mov rcx, r13
call fcn.0041e030
mov rax, qword [rsp + 0x30]
mov r8, r13
lea rdx, [0x00778100]
mov rcx, r14
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x58], rax
call fcn.006a7860
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x40bb2e
call fcn.006c5c10
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x40bb3d
call fcn.006c5c10
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x40bb4c
call fcn.006c5c10
mov edx, 1
mov rcx, r15
lea r8, [0x00708ad2]
call fcn.0040d220
lea rdx, str.XMRIG_CWD
mov rcx, r13
call fcn.0041e030
mov rax, qword [rsp + 0x30]
mov r8, r13
lea rdx, [0x00778100]
mov rcx, r14
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x58], rax
call fcn.006a7860
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x40bbb6
call fcn.006c5c10
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x40bbc5
call fcn.006c5c10
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x40b984
call fcn.006c5c10
jmp 0x40b984
lea rcx, [0x00708aeb]
call fcn.006c8420
mov r12, rax
jmp 0x40bbf9
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x40bc28
call fcn.006c5c10
jmp 0x40bc28
mov rcx, r12
call fcn.00523030
nop
nop
nop word cs:[rax + rax]
nop dword [rax]
Function at 0x427680
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
call fcn.00405f40
movzx r12d, byte [rax + 0x10]
mov rsi, rax
test r12b, r12b
jne 0x4276c0
mov r12d, 1
mov eax, r12d
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
mov ecx, 0x10
call fcn.006c5c70
lea rdx, [rbx + 8]
mov rcx, rax
mov r13, rax
call fcn.00431be0
mov qword [rbx + 0x18], r13
movzx edi, word [rsi + 0x38]
mov ecx, 0xa8
call fcn.006c5c70
mov r9, qword [rbx + 0x18]
lea rdx, [rsi + 0x18]
mov r8d, edi
mov rcx, rax
mov r13, rax
call fcn.004392b0
mov qword [rbx + 0x20], r13
mov rcx, r13
call fcn.00439400
mov r13d, eax
test eax, eax
js 0x4277b0
lea rax, [0x0070bc2d]
mov r8, qword [rsi + 0x18]
mov r9d, r13d
lea rdx, str.HTTP_API
mov qword [rsp + 0x20], rax
lea rcx, str.e_1_32m__e_0me_1_37m__13se_0me_1_34m_s:_de_0m_e_1_31m_se_0m
call fcn.00405530
mov word [rbx + 0x28], r13w
mov r8d, 3
xor ecx, ecx
mov edx, 1
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r13, rax
test rax, rax
je 0x4276a4
xor ecx, ecx
mov rdx, r13
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
test rax, rax
je 0x4276a4
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdx, r13
xor ecx, ecx
mov qword [0x00778228], rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov eax, eax
mov qword [0x00778220], rax
mov eax, r12d
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
mov ecx, eax
call fcn.004b8a50
movzx r9d, word [rsi + 0x38]
mov r8, qword [rsi + 0x18]
lea rdx, str.HTTP_API
mov qword [rsp + 0x20], rax
lea rcx, str.e_1_32m__e_0me_1_37m__13se_0me_1_34m_s:_de_0m_e_1_31m_se_0m
call fcn.00405530
mov r12, qword [rbx + 0x20]
test r12, r12
je 0x4277f1
mov rcx, r12
call fcn.004393c0
mov rcx, r12
call fcn.006c5c20
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x427800
mov rax, qword [rcx]
call qword [rax + 8]
xor eax, eax
xor r12d, r12d
pxor xmm0, xmm0
mov word [rbx + 0x28], ax
mov eax, r12d
movups xmmword [rbx + 0x18], xmm0
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
Function at 0x459dc0
Capabilities:
Get common file path

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x148
mov r8d, 0x1c
xor r9d, r9d
lea rsi, [rsp + 0x30]
mov r12, rcx
xor ecx, ecx
mov rdx, rsi
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov r8d, eax
lea rax, [r12 + 0x10]
mov qword [r12], rax
test r8d, r8d
je 0x459e70
mov rbx, rsi
mov ecx, dword [rbx]
add rbx, 4
lea edx, [rcx - 0x1010101]
not ecx
and edx, ecx
and edx, 0x80808080
je 0x459dfc
mov ecx, edx
shr ecx, 0x10
test edx, 0x8080
cmove edx, ecx
lea rcx, [rbx + 2]
cmove rbx, rcx
mov edi, edx
add dil, dl
sbb rbx, 3
sub rbx, rsi
mov qword [rsp + 0x28], rbx
cmp rbx, 0xf
ja 0x459ea0
cmp rbx, 1
jne 0x459e98
movzx eax, byte [rsp + 0x30]
mov byte [r12 + 0x10], al
mov rax, qword [r12]
mov qword [r12 + 8], rbx
mov byte [rax + rbx], 0
mov rax, r12
add rsp, 0x148
pop rbx
pop rsi
pop rdi
pop r12
ret
mov qword [r12 + 8], 1
mov eax, 0x2e
mov word [r12 + 0x10], ax
mov rax, r12
add rsp, 0x148
pop rbx
pop rsi
pop rdi
pop r12
ret
test rbx, rbx
je 0x459e55
jmp 0x459ebe
lea rdx, [rsp + 0x28]
xor r8d, r8d
mov rcx, r12
call fcn.00693350
mov rdx, qword [rsp + 0x28]
mov qword [r12], rax
mov qword [r12 + 0x10], rdx
mov ecx, ebx
cmp ebx, 8
jae 0x459f00
and ebx, 4
jne 0x459f2d
test ecx, ecx
je 0x459ee8
movzx edx, byte [rsi]
mov byte [rax], dl
test cl, 2
je 0x459ee8
movzx edx, word [rsi + rcx - 2]
mov word [rax + rcx - 2], dx
nop word [rax + rax]
mov rbx, qword [rsp + 0x28]
mov rax, qword [r12]
jmp 0x459e55
mov rdx, qword [rsp + 0x30]
lea rdi, [rax + 8]
and rdi, 0xfffffffffffffff8
mov qword [rax], rdx
mov edx, ebx
mov rcx, qword [rsi + rdx - 8]
mov qword [rax + rdx - 8], rcx
sub rax, rdi
lea ecx, [rbx + rax]
sub rsi, rax
shr ecx, 3
rep movsq qword [rdi], qword [rsi]
jmp 0x459ee8
mov edx, dword [rsi]
mov dword [rax], edx
mov edx, dword [rsi + rcx - 4]
mov dword [rax + rcx - 4], edx
jmp 0x459ee8
Function at 0x469680
Capabilities:
Query environment variable

Disassembly:
push r12
push rdi
sub rsp, 0x138
xor eax, eax
mov ecx, 0x1e
mov r8d, 0x104
lea rdi, [rsp + 0x30]
lea r12, [rsp + 0x20]
mov qword [rsp + 0x20], 0
rep stosq qword [rdi], rax
mov rdx, r12
mov qword [rsp + 0x28], 0
lea rcx, str._PROGRAMFILES_NVIDIA_CorporationNVSMI_nvml.dll
mov dword [rdi], 0
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea rdx, [0x007787c0]
mov rcx, r12
call fcn.004baf30
test eax, eax
sete al
add rsp, 0x138
pop rdi
pop r12
ret

Function at 0x479af0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov r9d, 0x40
mov r8d, 0x3000
mov rdx, rcx
xor ecx, ecx
jmp qword [sym.imp.KERNEL32.dll_VirtualAlloc]

Function at 0x479bf0
Capabilities:
Manipulate user privileges

Disassembly:
push r13
push r12
push rbx
add rsp, 0xffffffffffffff80
mov ebx, ecx
test cl, cl
jne 0x479c10
sub rsp, 0xffffffffffffff80
pop rbx
pop r12
pop r13
ret
call fcn.00479a20
test eax, eax
je 0x479c30
mov byte [0x00778800], bl
sub rsp, 0xffffffffffffff80
pop rbx
pop r12
pop r13
ret
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov edx, 8
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
cmp eax, 1
je 0x479c60
xor ebx, ebx
mov byte [0x00778800], bl
jmp 0x479c1f
lea r12, [rsp + 0x50]
mov edx, 1
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x50], 0
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x20], r12
mov rbx, qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call rbx
mov edx, dword [rsp + 0x50]
test edx, edx
jne 0x479cc0
mov rcx, qword [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
mov edx, 1
mov qword [rsp + 0x20], r12
call rbx
mov rcx, qword [rsp + 0x30]
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x479c50
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x20], r12
mov edx, 1
mov r13, rax
mov r9d, dword [rsp + 0x50]
mov r8, rax
call rbx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r13, r13
je 0x479c4e
xor ecx, ecx
lea r9, [rsp + 0x38]
mov r8d, 0xf0fff
mov rdx, r12
mov qword [r12], 0
mov qword [r12 + 8], 0
mov qword [r12 + 0x10], 0
mov qword [r12 + 0x18], 0
mov qword [r12 + 0x20], 0
mov qword [r12 + 0x28], 0
call sub.ADVAPI32.dll_LsaOpenPolicy
test eax, eax
je 0x479d60
mov rcx, r13
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x479c50
lea rcx, str.SeLockMemoryPrivilege
call sub.msvcrt.dll_wcslen
mov rcx, qword [rsp + 0x38]
mov r9d, 1
lea rdx, str.SeLockMemoryPrivilege
mov qword [rsp + 0x48], rdx
lea edx, [rax + rax]
lea r8, [rsp + 0x40]
mov word [rsp + 0x40], dx
mov rdx, qword [r13]
lea eax, [rax + rax + 2]
mov word [rsp + 0x42], ax
call sub.ADVAPI32.dll_LsaAddAccountRights
test eax, eax
je 0x479db2
mov rcx, qword [rsp + 0x38]
call sub.ADVAPI32.dll_LsaClose
jmp 0x479d49
lea rdx, str.Huge_pages_support_was_successfully_enabled__but_reboot_required_to_use_it
mov ecx, 5
call fcn.00405880
mov rcx, qword [rsp + 0x38]
call sub.ADVAPI32.dll_LsaClose
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LocalFree]
call fcn.00479a20
test eax, eax
setne bl
jmp 0x479c19
Function at 0x47c7b0
Capabilities:
Enumerate pe sections

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
mov ecx, dword [rcx + 0x30]
mov byte [rsp + 0x60], r8b
mov rsi, rdx
mov eax, dword [rbx + 0x38]
xor edx, edx
mov byte [rsp + 0x68], r9b
mov r8d, ecx
add r8d, eax
setb dl
add edx, dword [rbx + 0x34]
bswap edx
mov dword [rsp + 0x28], edx
mov edx, r8d
bswap edx
mov dword [rsp + 0x2c], edx
cmp eax, 0x1b8
je 0x47c9a0
cmp eax, 0x1b7
jg 0x47c948
test eax, eax
je 0x47c938
sub r8d, 0x1b8
lea rdx, [0x00712e40]
mov rcx, rbx
mov dword [rbx + 0x30], r8d
mov r8d, 0x1b8
sub r8d, eax
movsxd r8, r8d
call fcn.0047c5c0
lea rdx, [rsp + 0x68]
mov r8d, 8
mov rcx, rbx
call fcn.0047c5c0
mov eax, dword [rbx + 0x30]
sub eax, 8
sub eax, 0x40
lea rdx, [rsp + 0x28]
mov r8d, 0x40
mov rcx, rbx
mov dword [rbx + 0x30], eax
call fcn.0047c5c0
mov eax, dword [rbx]
shr eax, 0x18
mov byte [rsi], al
mov eax, dword [rbx]
shr eax, 0x10
mov byte [rsi + 1], al
mov eax, dword [rbx]
mov byte [rsi + 2], ah
mov eax, dword [rbx]
mov byte [rsi + 3], al
movzx eax, byte [rbx + 7]
mov byte [rsi + 4], al
movzx eax, word [rbx + 6]
mov byte [rsi + 5], al
mov eax, dword [rbx + 4]
mov byte [rsi + 6], ah
mov eax, dword [rbx + 4]
mov byte [rsi + 7], al
movzx eax, byte [rbx + 0xb]
mov byte [rsi + 8], al
movzx eax, word [rbx + 0xa]
mov byte [rsi + 9], al
mov eax, dword [rbx + 8]
mov byte [rsi + 0xa], ah
mov eax, dword [rbx + 8]
mov byte [rsi + 0xb], al
movzx eax, byte [rbx + 0xf]
mov byte [rsi + 0xc], al
movzx eax, word [rbx + 0xe]
mov byte [rsi + 0xd], al
mov eax, dword [rbx + 0xc]
mov byte [rsi + 0xe], ah
mov eax, dword [rbx + 0xc]
mov byte [rsi + 0xf], al
movzx eax, byte [rbx + 0x13]
mov byte [rsi + 0x10], al
movzx eax, word [rbx + 0x12]
mov byte [rsi + 0x11], al
mov eax, dword [rbx + 0x10]
mov byte [rsi + 0x12], ah
mov eax, dword [rbx + 0x10]
mov byte [rsi + 0x13], al
movzx eax, byte [rbx + 0x17]
mov byte [rsi + 0x14], al
movzx eax, word [rbx + 0x16]
mov byte [rsi + 0x15], al
mov eax, dword [rbx + 0x14]
mov byte [rsi + 0x16], ah
mov eax, dword [rbx + 0x14]
mov byte [rsi + 0x17], al
movzx eax, byte [rbx + 0x1b]
mov byte [rsi + 0x18], al
movzx eax, word [rbx + 0x1a]
mov byte [rsi + 0x19], al
mov eax, dword [rbx + 0x18]
mov byte [rsi + 0x1a], ah
mov eax, dword [rbx + 0x18]
mov byte [rsi + 0x1b], al
movzx eax, byte [rbx + 0x1f]
mov byte [rsi + 0x1c], al
movzx eax, word [rbx + 0x1e]
mov byte [rsi + 0x1d], al
mov eax, dword [rbx + 0x1c]
mov byte [rsi + 0x1e], ah
mov eax, dword [rbx + 0x1c]
mov byte [rsi + 0x1f], al
add rsp, 0x38
pop rbx
pop rsi
ret
mov dword [rbx + 0x3c], 1
jmp 0x47c807
sub r8d, 0x200
lea rdx, [0x00712e40]
mov rcx, rbx
mov dword [rbx + 0x30], r8d
mov r8d, 0x200
sub r8d, eax
movsxd r8, r8d
call fcn.0047c5c0
sub dword [rbx + 0x30], 0x1b8
mov r8d, 0x1b8
mov rcx, rbx
lea rdx, [0x00712e41]
call fcn.0047c5c0
mov dword [rbx + 0x3c], 1
jmp 0x47c82d
sub ecx, 8
lea rdx, [rsp + 0x60]
mov r8d, 8
mov dword [rbx + 0x30], ecx
mov rcx, rbx
call fcn.0047c5c0
mov eax, dword [rbx + 0x30]
jmp 0x47c846
Function at 0x47ce10
Capabilities:
Hash data using sha256

Disassembly:
push r12
push rbx
sub rsp, 0xb8
movdqa xmm0, xmmword [0x00712fd0]
movaps xmmword [rsp + 0x30], xmm0
lea r12, [rsp + 0x30]
shl r8, 3
mov rbx, rcx
movdqa xmm0, xmmword [0x00712fe0]
mov rcx, r12
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
movaps xmmword [rsp + 0x40], xmm0
pxor xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
call fcn.0047c5c0
mov ecx, dword [rsp + 0x60]
mov eax, dword [rsp + 0x68]
xor edx, edx
mov byte [rsp + 0x26], 0x81
mov r8d, ecx
mov byte [rsp + 0x27], 1
add r8d, eax
setb dl
add edx, dword [rsp + 0x64]
bswap edx
mov dword [rsp + 0x28], edx
mov edx, r8d
bswap edx
mov dword [rsp + 0x2c], edx
cmp eax, 0x1b8
je 0x47cfc8
cmp eax, 0x1b7
jg 0x47cf70
test eax, eax
je 0x47cf60
sub r8d, 0x1b8
lea rdx, [0x00712e40]
mov rcx, r12
mov dword [rsp + 0x60], r8d
mov r8d, 0x1b8
sub r8d, eax
movsxd r8, r8d
call fcn.0047c5c0
lea rdx, [rsp + 0x27]
mov r8d, 8
mov rcx, r12
call fcn.0047c5c0
mov eax, dword [rsp + 0x60]
sub eax, 8
sub eax, 0x40
lea rdx, [rsp + 0x28]
mov r8d, 0x40
mov rcx, r12
mov dword [rsp + 0x60], eax
call fcn.0047c5c0
mov eax, dword [rsp + 0x30]
bswap eax
mov dword [rbx], eax
mov eax, dword [rsp + 0x34]
bswap eax
mov dword [rbx + 4], eax
mov eax, dword [rsp + 0x38]
bswap eax
mov dword [rbx + 8], eax
mov eax, dword [rsp + 0x3c]
bswap eax
mov dword [rbx + 0xc], eax
mov eax, dword [rsp + 0x40]
bswap eax
mov dword [rbx + 0x10], eax
mov eax, dword [rsp + 0x44]
bswap eax
mov dword [rbx + 0x14], eax
mov eax, dword [rsp + 0x48]
bswap eax
mov dword [rbx + 0x18], eax
mov eax, dword [rsp + 0x4c]
bswap eax
mov dword [rbx + 0x1c], eax
add rsp, 0xb8
pop rbx
pop r12
ret
mov dword [rsp + 0x6c], 1
jmp 0x47ceb1
sub r8d, 0x200
lea rdx, [0x00712e40]
mov rcx, r12
mov dword [rsp + 0x60], r8d
mov r8d, 0x200
sub r8d, eax
movsxd r8, r8d
call fcn.0047c5c0
mov r8d, 0x1b8
mov rcx, r12
lea rdx, [0x00712e41]
sub dword [rsp + 0x60], 0x1b8
call fcn.0047c5c0
mov dword [rsp + 0x6c], 1
jmp 0x47ced8
sub ecx, 8
lea rdx, [rsp + 0x26]
mov r8d, 8
mov dword [rsp + 0x60], ecx
mov rcx, r12
call fcn.0047c5c0
mov eax, dword [rsp + 0x60]
jmp 0x47cef2
Function at 0x4a15a0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
nop word [rax + rax]
movdqu xmm0, xmmword [rcx + rax]
movdqu xmm1, xmmword [rdx + rax]
pxor xmm0, xmm1
movups xmmword [rcx + rax], xmm0
add rax, 0x10
cmp rax, 0x400
jne 0x4a15a8
ret