joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006ca70
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x28
call fcn.14006d760
mov qword [0x140286950], rax
test rax, rax
je 0x14006cc2c
mov rax, qword gs:[0x60]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x20], rdi
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14006cb27
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14006cb27
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xfaef205
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x14006cb22
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x14006cb00
cmp r8d, 0xa39ce436
je 0x14006cb2c
test r9d, r9d
jne 0x14006cae0
mov rax, qword [rax]
jmp 0x14006cab0
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rdx, [0x140286960]
mov rcx, qword [0x140286950]
add rax, r10
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14006cbe7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14006cbe7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xaacab8f
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14006cbe2
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x14006cbc0
cmp r8d, 0x99c2c95c
je 0x14006cbec
test r9d, r9d
jne 0x14006cba0
mov rax, qword [rax]
jmp 0x14006cb70
mov ecx, dword [rbx + 0x24]
lea r8, [0x140286960]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov r9d, 2
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor edx, edx
mov rcx, qword [0x140286950]
add rax, r10
call rax
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x30]
mov byte [0x140286872], 1
add rsp, 0x28
ret
Function at 0x14006d760
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x90
mov rax, qword [0x140276040]
xor rax, rsp
mov qword [rsp + 0x80], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
xor edi, edi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], di
mov dword [rsp + 0x40], ecx
movabs rdx, 0x99ffbbee3189da0b
mov qword [rsp + 0x20], rdx
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x30], rax
movabs rcx, 0xee6713d3bb2c3b08
mov qword [rsp + 0x20], rcx
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rdx
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x20], rcx
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x78], rax
movdqa xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x30], xmm0
lea rax, [rsp + 0x30]
mov rdx, 0xffffffffffffffff
nop dword [rax]
inc rdx
cmp word [rax + rdx*2], 0
jne 0x14006d810
lea rcx, [rsp + 0x48]
cmp rdx, 7
ja 0x14006d842
mov qword [rsp + 0x58], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
lea rdx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memcpy
mov word [rsp + rbx + 0x48], di
jmp 0x14006d84c
lea r9, [rsp + 0x30]
call fcn.14006e600
mov qword [rsp + 0x68], rdi
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14006d8e6
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14006d8e6
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
mov r8d, 0x6ca5f996
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x14006d8e1
nop
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x14006d8c0
cmp r8d, 0x3b61e3ac
je 0x14006d8eb
test r9d, r9d
jne 0x14006d8a0
mov rax, qword [rax]
jmp 0x14006d870
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rbx + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov r8d, dword [rcx + rax*4]
add r8, r10
lea rdx, [rsp + 0x40]
lea rcx, [0x14006d3f0]
call r8
mov rbx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
cmp rdx, 7
jbe 0x14006d95c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006d957
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006d957
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006fbc4
mov rax, rbx
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14006f920
mov rbx, qword [rsp + 0xa8]
add rsp, 0x90
pop rdi
ret
Function at 0x14006f3a8
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x14006f3e2
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x14006f3e7
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x14006f430
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x140074900]
cmp byte [rcx + rax], 0
je 0x14006f430
dec r8
sub rdx, 1
jne 0x14006f416
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x14007063c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140070686
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140070686
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140070686
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140070686
cmp dword [rcx + 0x84], 0xe
jbe 0x140070686
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140070688
xor al, al
add rsp, 0x28
ret
Function at 0x14001120d
Capabilities:
Terminate process

Disassembly:
jmp 0x1400131e0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140011285
Capabilities:
Create thread

Disassembly:
jmp 0x1400118a0
push rbp
push rdi
sub rsp, 0x118
lea rbp, [rsp + 0x30]
lea rcx, [0x1400230f4]
call fcn.140011398
mov dword [rbp + 4], 0
jmp 0x1400118cc
mov eax, dword [rbp + 4]
inc eax
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0x12c
jge 0x14001190a
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140011127]
mov edx, 0x1000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400118c4
call fcn.140011073
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret

Function at 0x140011294
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014530
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014550
xor al, al
jmp 0x1400145d1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014563
xor al, al
jmp 0x1400145d1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001458d
xor al, al
jmp 0x1400145d1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1400145a1
xor al, al
jmp 0x1400145d1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1400145b3
xor al, al
jmp 0x1400145d1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1400145cf
xor al, al
jmp 0x1400145d1
mov al, 1
add rsp, 0x38
ret
Function at 0x1400112d5
Capabilities:
Generate random numbers via winapi
Terminate process

Disassembly:
jmp 0x140011c90
push rbp
push rdi
sub rsp, 0x118
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0xa
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14001d018]
xor rax, rbp
mov qword [rbp + 0xd8], rax
lea rcx, [0x1400231c6]
call fcn.140011398
cmp qword [0x14001d190], 0
jne 0x140011d06
mov dword [rsp + 0x20], 0xf0000040
mov r9d, 1
xor r8d, r8d
xor edx, edx
lea rcx, [0x14001d190]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x140011d06
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea r8, [rbp + 4]
mov edx, 4
mov rcx, qword [0x14001d190]
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov eax, dword [rbp + 4]
btr eax, 0x1f
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x14001ad20]
call fcn.14001132a
mov rax, rdi
mov rcx, qword [rbp + 0xd8]
xor rcx, rbp
call fcn.1400111cc
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x180003dd0
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
and rsp, 0xfffffffffffffff0
xor r8, r8
push r8
push rax
pushfq
push r8
push rdx
sub rsp, 0xa8
push r8
push r15
push r14
push r13
push r12
push rbx
push r8
push rsi
push rdi
push rbp
push rax
push rdx
sub rsp, 0x290
movdqa xmmword [rsp + 0x2f0], xmm6
movdqa xmmword [rsp + 0x300], xmm7
movdqa xmmword [rsp + 0x310], xmm8
movdqa xmmword [rsp + 0x320], xmm9
movdqa xmmword [rsp + 0x330], xmm10
movdqa xmmword [rsp + 0x340], xmm11
movdqa xmmword [rsp + 0x350], xmm12
movdqa xmmword [rsp + 0x360], xmm13
movdqa xmmword [rsp + 0x370], xmm14
movdqa xmmword [rsp + 0x380], xmm15
mov eax, dword [0x1802ac838]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x30
add rax, rbx
lea rdx, [rsp + 0x20]
xor r8, r8
mov qword [rdx + 0x10], r8
mov byte [rdx + 0x19], 1
mov dword [rdx + 0x1c], 0xffffffff
mov byte [rdx + 0x18], 2
mov r8, qword [rax + 0x80]
mov qword [rdx], r8
mov qword [rax + 0x80], rdx
lea r8, [rsp + 0x290]
mov qword [rdx + 8], r8
call fcn.1800ccf10
int3
push r15
push r14
push r13
push r12
push rbx
push rsi
push rdi
push rbp
sub rsp, 0xd8
movdqa xmmword [rsp + 0x20], xmm6
movdqa xmmword [rsp + 0x30], xmm7
movdqa xmmword [rsp + 0x40], xmm8
movdqa xmmword [rsp + 0x50], xmm9
movdqa xmmword [rsp + 0x60], xmm10
movdqa xmmword [rsp + 0x70], xmm11
movdqa xmmword [rsp + 0x80], xmm12
movdqa xmmword [rsp + 0x90], xmm13
movdqa xmmword [rsp + 0xa0], xmm14
movdqa xmmword [rsp + 0xb0], xmm15
mov qword [rsp + 0x120], rcx
mov qword [rsp + 0x128], rdx
mov qword [rsp + 0x130], r8
mov qword [rsp + 0x138], r9
mov eax, dword [0x1802ac838]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x30
add rax, rbx
mov qword [rsp + 0xc0], rax
cmp rcx, qword [rax + 0x88]
sete byte [rsp + 0xd0]
lock and dword [rax + 0x38], 0xffffffef
mov rax, qword [r8 + 0x18]
mov rbx, qword [rax]
mov rax, qword [r8 + 0x20]
mov rbp, qword [rax]
mov rax, qword [r8 + 0x28]
mov rsi, qword [rax]
mov rax, qword [r8 + 0x30]
mov rdi, qword [rax]
mov rax, qword [r8 + 0x58]
mov r12, qword [rax]
mov rax, qword [r8 + 0x60]
mov r13, qword [rax]
mov rax, qword [r8 + 0x68]
mov r14, qword [rax]
mov rax, qword [r8 + 0x70]
mov r15, qword [rax]
movdqa xmm6, xmmword [r8 + 0x90]
movdqa xmm7, xmmword [r8 + 0xa0]
movdqa xmm8, xmmword [r8 + 0xb0]
movdqa xmm9, xmmword [r8 + 0xc0]
movdqa xmm10, xmmword [r8 + 0xd0]
movdqa xmm11, xmmword [r8 + 0xe0]
movdqa xmm12, xmmword [r8 + 0xf0]
movdqa xmm13, xmmword [r8 + 0x100]
movdqa xmm14, xmmword [r8 + 0x110]
movdqa xmm15, xmmword [r8 + 0x120]
mov rcx, qword [r8 + 0x78]
mov rdx, qword [rsp + 0x120]
call qword [rsp + 0x128]
mov r8, qword [rsp + 0x130]
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rdx + 0x70]
cmp rcx, 0
je 0x180003f60
mov r9, qword [rdx + 0x68]
mov qword [r9], rcx
mov qword [rdx + 0x68], 0
mov qword [rdx + 0x70], 0
mov rcx, qword [rsp + 0x138]
mov r8, qword [r8 + 0x78]
xor r9d, r9d
mov rcx, qword [rcx]
cmp rcx, r9
je 0x180003f7c
cmp rcx, r8
jl 0x180003f6f
mov qword [rdx + 0x80], rcx
test dword [0x1802a6080], 1
je 0x180003fab
cmp byte [rsp + 0xd0], 0
je 0x180003fab
mov rcx, 0x43
mov rdx, rax
mov rsp, r8
jmp 0x180003ad0
mov rsp, r8
jmp rax
Function at 0x180003fb0
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rbx
push rsi
push rdi
push rbp
sub rsp, 0xc8
movdqa xmmword [rsp + 0x20], xmm6
movdqa xmmword [rsp + 0x30], xmm7
movdqa xmmword [rsp + 0x40], xmm8
movdqa xmmword [rsp + 0x50], xmm9
movdqa xmmword [rsp + 0x60], xmm10
movdqa xmmword [rsp + 0x70], xmm11
movdqa xmmword [rsp + 0x80], xmm12
movdqa xmmword [rsp + 0x90], xmm13
movdqa xmmword [rsp + 0xa0], xmm14
movdqa xmmword [rsp + 0xb0], xmm15
mov qword [rsp + 0x110], rcx
mov qword [rsp + 0x118], rdx
mov eax, dword [0x1802ac838]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x30
add rax, rbx
mov qword [rsp + 0xc0], rax
lock and dword [rax + 0x38], 0xffffffef
mov rax, qword [rdx + 0x18]
mov rbx, qword [rax]
mov rax, qword [rdx + 0x20]
mov rbp, qword [rax]
mov rax, qword [rdx + 0x28]
mov rsi, qword [rax]
mov rax, qword [rdx + 0x30]
mov rdi, qword [rax]
mov rax, qword [rdx + 0x58]
mov r12, qword [rax]
mov rax, qword [rdx + 0x60]
mov r13, qword [rax]
mov rax, qword [rdx + 0x68]
mov r14, qword [rax]
mov rax, qword [rdx + 0x70]
mov r15, qword [rax]
movdqa xmm6, xmmword [rdx + 0x90]
movdqa xmm7, xmmword [rdx + 0xa0]
movdqa xmm8, xmmword [rdx + 0xb0]
movdqa xmm9, xmmword [rdx + 0xc0]
movdqa xmm10, xmmword [rdx + 0xd0]
movdqa xmm11, xmmword [rdx + 0xe0]
movdqa xmm12, xmmword [rdx + 0xf0]
movdqa xmm13, xmmword [rdx + 0x100]
movdqa xmm14, xmmword [rdx + 0x110]
movdqa xmm15, xmmword [rdx + 0x120]
mov rcx, qword [rdx + 0x78]
call qword [rsp + 0x110]
mov rdx, qword [rsp + 0x118]
mov rax, qword [rdx + 0x18]
mov qword [rax], rbx
mov rax, qword [rdx + 0x20]
mov qword [rax], rbp
mov rax, qword [rdx + 0x28]
mov qword [rax], rsi
mov rax, qword [rdx + 0x30]
mov qword [rax], rdi
mov rax, qword [rdx + 0x58]
mov qword [rax], r12
mov rax, qword [rdx + 0x60]
mov qword [rax], r13
mov rax, qword [rdx + 0x68]
mov qword [rax], r14
mov rax, qword [rdx + 0x70]
mov qword [rax], r15
movdqa xmmword [rdx + 0x90], xmm6
movdqa xmmword [rdx + 0xa0], xmm7
movdqa xmmword [rdx + 0xb0], xmm8
movdqa xmmword [rdx + 0xc0], xmm9
movdqa xmmword [rdx + 0xd0], xmm10
movdqa xmmword [rdx + 0xe0], xmm11
movdqa xmmword [rdx + 0xf0], xmm12
movdqa xmmword [rdx + 0x100], xmm13
movdqa xmmword [rdx + 0x110], xmm14
movdqa xmmword [rdx + 0x120], xmm15
mov rax, qword [rsp + 0xc0]
lock or dword [rax + 0x38], 0x10
movdqa xmm6, xmmword [rsp + 0x20]
movdqa xmm7, xmmword [rsp + 0x30]
movdqa xmm8, xmmword [rsp + 0x40]
movdqa xmm9, xmmword [rsp + 0x50]
movdqa xmm10, xmmword [rsp + 0x60]
movdqa xmm11, xmmword [rsp + 0x70]
movdqa xmm12, xmmword [rsp + 0x80]
movdqa xmm13, xmmword [rsp + 0x90]
movdqa xmm14, xmmword [rsp + 0xa0]
movdqa xmm15, xmmword [rsp + 0xb0]
add rsp, 0xc8
pop rbp
pop rdi
pop rsi
pop rbx
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x18000c1d0
Capabilities:
Resume thread
Suspend thread

Disassembly:
cmp qword [rcx + 0x60], 0xffffffffffffffff
je 0x1800032d7
mov eax, dword [rcx + 0x38]
shr eax, 5
test al, 1
jne 0x1800032d7
mov eax, dword [rcx + 0x38]
shr eax, 7
test al, 1
jne 0x1800032d7
mov rdx, rcx
mov rcx, qword [rcx + 0x60]
jmp 0x18000c1d0
ret
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x500
mov rax, qword [0x18029dec0]
xor rax, rsp
mov qword [rsp + 0x4f0], rax
mov rax, qword [0x18029d348]
mov rbx, rdx
mov rdi, rcx
cmp rax, 0xffffffffffffffff
jne 0x18000c22e
xor edx, edx
lea rcx, str.kernel32
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
lea rdx, str.QueueUserAPC2
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18029d348], rax
test rax, rax
je 0x18000c28a
mov rcx, rbx
call fcn.1800035d0
test al, al
jne 0x18000c2d8
mov dl, 1
mov rcx, rbx
call fcn.180003650
mov r9d, 0x10001
lea rcx, [0x18000be40]
mov r8, rbx
mov rdx, rdi
call qword [0x18029d348]
test eax, eax
jne 0x18000c2d8
xor edx, edx
mov rcx, rbx
call fcn.180003650
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x18000c2d8
mov qword [0x18029d348], 0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x18000c2d8
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x50], 0x40100003
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x18000c2cf
mov eax, dword [rsp + 0x50]
test eax, eax
jns 0x18000c2cf
test eax, 0x18000000
jne 0x18000c2cf
mov rdx, rbx
lea rcx, [rsp + 0x20]
call qword [0x1802a6178]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsp + 0x4f0]
xor rcx, rsp
call fcn.18006bf20
mov rbx, qword [rsp + 0x520]
add rsp, 0x500
pop rdi
ret

Function at 0x18000c460
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rcx + rbx], 0
jne 0x18000c474
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], 0
mov rcx, rax
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x18000c520
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
xor eax, eax
mov r9, rdx
mov r8, rcx
mov qword [rsp + 0x28], rax
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
jne 0x18000c549
add rsp, 0x38
ret
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
add rsp, 0x38
ret

Function at 0x18000c560
Capabilities:
Create thread
Resume thread

Disassembly:
push rbx
sub rsp, 0x30
mov r9, rdx
mov qword [rsp + 0x28], 0
mov r8, rcx
mov dword [rsp + 0x20], 4
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
test rax, rax
jne 0x18000c595
add rsp, 0x30
pop rbx
ret
mov edx, 2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
add rsp, 0x30
pop rbx
ret
Function at 0x18000e260
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0xe0
mov rax, qword [0x18029dec0]
xor rax, rsp
mov qword [rsp + 0xd0], rax
movzx ebx, r8b
mov rdi, rdx
mov r8d, 0x40
lea rdx, [rsp + 0x50]
call fcn.18000de90
mov r8d, 0x11
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x50]
call sub.KERNEL32.dll_GetEnvironmentVariableW
mov r10d, eax
lea ecx, [rax - 1]
cmp ecx, 0xf
ja 0x18000e325
xor ecx, ecx
mov r9d, ecx
test eax, eax
je 0x18000e31e
nop
mov edx, r9d
movzx r8d, word [rsp + rdx*2 + 0x20]
lea eax, [r8 - 0x30]
test bl, bl
je 0x18000e2e5
cmp ax, 9
ja 0x18000e325
lea rcx, [rcx + rcx*4]
lea rcx, [rcx - 0x18]
lea rcx, [r8 + rcx*2]
jmp 0x18000e316
shl rcx, 4
cmp ax, 9
ja 0x18000e2f5
add rcx, 0xffffffffffffffd0
jmp 0x18000e313
lea eax, [r8 - 0x61]
cmp ax, 5
ja 0x18000e305
add rcx, 0xffffffffffffffa9
jmp 0x18000e313
lea eax, [r8 - 0x41]
cmp ax, 5
ja 0x18000e325
add rcx, 0xffffffffffffffc9
add rcx, r8
inc r9d
cmp r9d, r10d
jb 0x18000e2c0
mov qword [rdi], rcx
mov al, 1
jmp 0x18000e327
xor al, al
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.18006bf20
mov rbx, qword [rsp + 0x100]
add rsp, 0xe0
pop rdi
ret
Function at 0x180011940
Capabilities:
Get memory capacity

Disassembly:
mov qword [rsp + 8], rbx
push rsi
push rdi
push r14
sub rsp, 0xc0
mov rax, qword [0x18029dec0]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rsi, r9
mov rbx, r8
mov r14, rdx
mov rdi, rcx
test rcx, rcx
je 0x180011a2f
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8d, 0x48
lea rdx, [rsp + 0x60]
mov rcx, rax
call sub.KERNEL32.dll_K32GetProcessMemoryInfo
test eax, eax
je 0x180011a2f
mov rdx, qword [rsp + 0x70]
test r14, r14
je 0x180011a0a
xorps xmm0, xmm0
test rdx, rdx
js 0x1800119b1
cvtsi2ss xmm0, rdx
jmp 0x1800119c9
mov rax, rdx
mov rcx, rdx
shr rcx, 1
and eax, 1
or rcx, rax
cvtsi2ss xmm0, rcx
addss xmm0, xmm0
cvtps2pd xmm1, xmm0
xorps xmm0, xmm0
mulsd xmm1, qword [0x180268c00]
test rdi, rdi
js 0x1800119e3
cvtsi2ss xmm0, rdi
jmp 0x1800119fb
mov rax, rdi
mov rcx, rdi
shr rcx, 1
and eax, 1
or rcx, rax
cvtsi2ss xmm0, rcx
addss xmm0, xmm0
cvtps2pd xmm0, xmm0
divsd xmm1, xmm0
cvttsd2si rax, xmm1
mov dword [r14], eax
xor eax, eax
test rbx, rbx
je 0x180011a21
cmp rdx, rdi
jbe 0x180011a1b
mov qword [rbx], rax
jmp 0x180011a21
sub rdi, rdx
mov qword [rbx], rdi
test rsi, rsi
je 0x180011af8
jmp 0x180011af5
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rdx, qword [rsp + 0x48]
cmp rdx, qword [rsp + 0x28]
jae 0x180011ad2
test r14, r14
je 0x180011ac1
mov rcx, rdx
xorps xmm0, xmm0
sub rcx, qword [rsp + 0x50]
js 0x180011a6b
cvtsi2ss xmm0, rcx
jmp 0x180011a80
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
cvtps2pd xmm1, xmm0
xorps xmm0, xmm0
mulsd xmm1, qword [0x180268c00]
test rdx, rdx
js 0x180011a9a
cvtsi2ss xmm0, rdx
jmp 0x180011ab2
mov rax, rdx
mov rcx, rdx
shr rcx, 1
and eax, 1
or rcx, rax
cvtsi2ss xmm0, rcx
addss xmm0, xmm0
cvtps2pd xmm0, xmm0
divsd xmm1, xmm0
cvttsd2si rax, xmm1
mov dword [r14], eax
test rbx, rbx
je 0x180011ac9
mov qword [rbx], rdx
test rsi, rsi
je 0x180011af8
xor eax, eax
jmp 0x180011af5
test r14, r14
je 0x180011ade
mov eax, dword [rsp + 0x24]
mov dword [r14], eax
test rbx, rbx
je 0x180011aeb
mov rax, qword [rsp + 0x30]
mov qword [rbx], rax
test rsi, rsi
je 0x180011af8
mov rax, qword [rsp + 0x40]
mov qword [rsi], rax
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.18006bf20
mov rbx, qword [rsp + 0xe0]
add rsp, 0xc0
pop r14
pop rdi
pop rsi
ret

Function at 0x180011d00
Capabilities:
Get memory capacity

Disassembly:
sub rsp, 0x78
mov rax, qword [0x18029dec0]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.18006bf20
add rsp, 0x78
ret