joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140022fd0
Capabilities:
Hash data with crc32

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov esi, edx
mov rax, qword [0x140071c00]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, qword [0x140071db0]
cmp byte [rbx + 0x4d4d], 0
jne 0x140023003
mov edi, ecx
cmp byte [rbx + 0x4d4e], 0
je 0x14002305e
vbroadcastss xmm0, dword [rbx + 0x39bc]
vmovsd xmm1, qword [rbx + 0xe40]
vfmadd231ps xmm1, xmm0, xmmword [0x14005a890]
vmovlps qword [rbx + 0x4a10], xmm1
mov qword [rbx + 0x4a18], 0
mov dword [rbx + 0x4a04], 1
vmovss xmm0, dword [rbx + 0x3a18]
or byte [rbx + 0x4a00], 0x41
vmulss xmm0, xmm0, dword [0x14005a908]
vmovss dword [rbx + 0x4a60], xmm0
mov edi, 2
movsx r9d, word [rbx + 0x5eb8]
lea r8, str.Tooltip__02d
lea rcx, [rsp + 0x20]
mov edx, 0x10
call fcn.1400069a0
test dil, 2
je 0x14002319d
movzx ecx, byte [rsp + 0x20]
test cl, cl
je 0x1400230e9
mov edx, 0xffffffff
lea r8, [rsp + 0x22]
lea r9, [0x140059570]
mov eax, 0xffffffff
jmp 0x1400230c9
movzx r10d, r10b
movzx r11d, al
shr eax, 8
xor r11d, r10d
xor eax, dword [r9 + r11*4]
inc r8
test cl, cl
je 0x1400230e5
mov r10d, ecx
movzx ecx, byte [r8 - 1]
cmp r10b, 0x23
jne 0x1400230b0
cmp cl, 0x23
jne 0x1400230b0
cmp byte [r8], 0x23
cmove eax, edx
jmp 0x1400230b0
not eax
jmp 0x1400230eb
xor eax, eax
mov rdx, qword [0x140071db0]
mov rcx, qword [rdx + 0x3fe8]
movsxd r8, dword [rdx + 0x3fe0]
test r8, r8
je 0x140023137
mov rdx, rcx
mov r10, r8
mov r9, r8
jmp 0x140023118
mov r10, r9
test r9, r9
je 0x14002313d
shr r9, 1
mov r11, r9
shl r11, 4
cmp dword [rdx + r11], eax
jae 0x140023110
not r9
add r9, r10
add rdx, r11
add rdx, 0x10
jmp 0x140023110
xor r8d, r8d
mov rdx, rcx
shl r8, 4
add rcx, r8
cmp rdx, rcx
je 0x14002319d
cmp dword [rdx], eax
jne 0x14002319d
mov rax, qword [rdx + 8]
test rax, rax
je 0x14002319d
cmp byte [rax + 0xbe], 0
je 0x14002319d
mov byte [rax + 0xc3], 1
mov byte [rax + 0xc5], 1
mov byte [rax + 0xe4], 1
mov eax, dword [rbx + 0x5eb8]
inc eax
mov word [rbx + 0x5eb8], ax
movsx r9d, ax
lea r8, str.Tooltip__02d
lea rcx, [rsp + 0x20]
mov edx, 0x10
call fcn.1400069a0
or esi, 0x2030347
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, esi
call fcn.140017b50
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140056c60
mov al, 1
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
Function at 0x140024300
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x30
mov qword [rsp + 0x78], r9
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x68], rdx
mov rax, qword [0x140071c00]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov r14, qword [0x140071db0]
cmp byte [r14 + 0x6008], 0
je 0x1400243b8
mov rsi, rcx
lea rdi, [rsp + 0x68]
mov qword [rsp + 0x20], rdi
lea rbx, [r14 + 0x6018]
cmp qword [r14 + 0x6010], 0
je 0x1400243aa
xor ebp, ebp
mov rcx, rbx
xor edx, edx
call fcn.140007ad0
mov rcx, rbx
mov rdx, rsi
mov r8, rdi
call fcn.140007cd0
mov r9, qword [r14 + 0x6010]
mov eax, dword [r14 + 0x6018]
sub eax, 1
cmovb eax, ebp
movsxd r8, eax
mov rax, qword [r14 + 0x6020]
test rax, rax
lea rcx, [0x140071db8]
cmovne rcx, rax
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
jmp 0x1400243b8
mov rcx, rbx
mov rdx, rsi
mov r8, rdi
call fcn.140007cd0
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140056c60
nop
add rsp, 0x30
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x140024ae0
Capabilities:
Hash data with crc32

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rbx, qword [0x140071db0]
cmp byte [rbx + 0x7c], 0
jne 0x140024b10
lea rdx, [0x140064f3e]
mov rcx, rsi
call sub.VCRUNTIME140.dll_strstr
test rax, rax
cmovne rsi, rax
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rdi, rax
lea rcx, [rbx + 0x5f90]
movsxd r14, dword [rbx + 0x5f90]
and eax, 0xfffffffc
lea edx, [rax + r14]
add edx, 0x18
mov ebp, eax
add ebp, 0x18
call fcn.140007ad0
mov rax, qword [rbx + 0x5f98]
mov dword [rax + r14], ebp
mov rax, qword [rbx + 0x5f98]
lea rcx, [rax + r14]
lea rbx, [rax + r14]
add rbx, 4
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rax + r14 + 4], xmm0
test rdi, rdi
je 0x140024bd6
lea rax, [rdi - 1]
lea rdx, [rsi + 2]
mov r8d, 0xffffffff
lea r9, [0x140059570]
mov r11d, 0xffffffff
jmp 0x140024bb6
movzx ebp, r10b
mov r10d, r11d
shr r10d, 8
movzx r11d, r11b
xor r11d, ebp
xor r10d, dword [r9 + r11*4]
inc rdx
mov r11d, r10d
add rax, 0xffffffffffffffff
jae 0x140024c40
movzx r10d, byte [rdx - 2]
cmp rax, 2
jb 0x140024b90
cmp r10b, 0x23
jne 0x140024b90
cmp byte [rdx - 1], 0x23
jne 0x140024b90
cmp byte [rdx], 0x23
cmove r11d, r8d
jmp 0x140024b90
movzx eax, byte [rsi]
test al, al
je 0x140024c3a
lea rdx, [rsi + 2]
mov r8d, 0xffffffff
lea r9, [0x140059570]
mov r11d, 0xffffffff
jmp 0x140024c20
movzx ebp, r10b
mov r10d, r11d
shr r10d, 8
movzx r11d, r11b
xor r11d, ebp
xor r10d, dword [r9 + r11*4]
inc rdx
mov r11d, r10d
test al, al
je 0x140024c40
mov r10d, eax
movzx eax, byte [rdx - 1]
cmp r10b, 0x23
jne 0x140024c00
cmp al, 0x23
jne 0x140024c00
cmp byte [rdx], 0x23
cmove r11d, r8d
jmp 0x140024c00
mov r10d, 0xffffffff
not r10d
mov dword [rcx + 4], r10d
add rcx, 0x14
inc rdi
mov rdx, rsi
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, rbx
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x14002f1a0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
vmovaps xmmword [rsp + 0x30], xmm6
mov rsi, r9
vmovaps xmm6, xmm2
mov rbx, rdx
mov rdi, rcx
mov r15, qword [rsp + 0x90]
mov rcx, rdx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add eax, 4
cdqe
imul rax, rax, 0x66666667
mov rcx, rax
shr rcx, 0x3f
shr rax, 0x21
add eax, ecx
shl eax, 2
movsxd rcx, eax
call fcn.140006590
mov r14, rax
movzx ecx, byte [rbx]
test cl, cl
je 0x14002f2a9
add rbx, 5
mov rax, r14
nop word [rax + rax]
movsx edx, cl
xor ecx, ecx
cmp dl, 0x5c
setge cl
xor ecx, 0xffffffdd
add ecx, edx
movsx r8d, byte [rbx - 4]
xor edx, edx
cmp r8d, 0x5c
setge dl
xor edx, 0xffffffdd
add edx, r8d
movsx r9d, byte [rbx - 3]
xor r8d, r8d
cmp r9d, 0x5c
setge r8b
xor r8d, 0xffffffdd
add r8d, r9d
movsx r9d, byte [rbx - 2]
xor r10d, r10d
cmp r9d, 0x5c
setge r10b
xor r10d, 0xffffffdd
add r10d, r9d
movsx r9d, byte [rbx - 1]
xor r11d, r11d
cmp r9d, 0x5c
setge r11b
xor r11d, 0xffffffdd
add r11d, r9d
imul r9d, r11d, 0x55
add r9d, r10d
imul r9d, r9d, 0x55
add r9d, r8d
imul r8d, r9d, 0x55
add r8d, edx
imul edx, r8d, 0x55
add edx, ecx
mov dword [rax], edx
add rax, 4
movzx ecx, byte [rbx]
add rbx, 5
test cl, cl
jne 0x14002f210
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rsi
mov rcx, rdi
mov rdx, r14
vmovaps xmm3, xmm6
call fcn.14002f540
mov rsi, rax
mov rcx, r14
call fcn.140006820
mov rax, rsi
vmovaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14003da20
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
jmp 0x14003da30
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rdi, rcx
call fcn.140010aa0
mov rbx, rax
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x14003dacc
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x14003dacc
mov ecx, 0x50
call fcn.140006590
mov rsi, rax
vxorps xmm0, xmm0, xmm0
vmovups ymmword [rax], ymm0
vmovups ymmword [rax + 0x20], ymm0
vmovups ymmword [rax + 0x30], ymm0
mov qword [rbx + 0x88], rax
lea rax, str.imgui_impl_win32
mov qword [rbx + 0x78], rax
or byte [rbx + 4], 6
mov qword [rsi], rdi
mov rax, qword [rsp + 0x28]
mov qword [rsi + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rsi + 0x18], rax
mov dword [rsi + 0x28], 9
vzeroupper
call fcn.140008220
test rax, rax
je 0x14003dad3
call fcn.140010aa0
mov rbx, qword [rax + 0x88]
jmp 0x14003dad5
xor eax, eax
jmp 0x14003dba7
xor ebx, ebx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
shr eax, 0x10
add rbx, 0x2c
mov ecx, eax
mov edx, 0x20001004
mov r8, rbx
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x14003db04
mov dword [rbx], 0
call fcn.14001d0d0
mov qword [rax + 0x28], rdi
mov byte [rsi + 0x31], 1
lea rcx, str.xinput1_4.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
jne 0x14003db7a
lea rcx, str.xinput1_3.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
jne 0x14003db7a
lea rcx, str.xinput9_1_0.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
jne 0x14003db7a
lea rcx, str.xinput1_2.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
jne 0x14003db7a
lea rcx, str.xinput1_1.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x14003dba5
mov qword [rsi + 0x38], rdi
lea rdx, str.XInputGetCapabilities
mov rbx, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rdi
call rbx
mov qword [rsi + 0x40], rax
lea rdx, str.XInputGetState
mov rcx, rdi
call rbx
mov qword [rsi + 0x48], rax
mov al, 1
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
Function at 0x14003da30
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
jmp 0x14003da30
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rdi, rcx
call fcn.140010aa0
mov rbx, rax
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x14003dacc
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x14003dacc
mov ecx, 0x50
call fcn.140006590
mov rsi, rax
vxorps xmm0, xmm0, xmm0
vmovups ymmword [rax], ymm0
vmovups ymmword [rax + 0x20], ymm0
vmovups ymmword [rax + 0x30], ymm0
mov qword [rbx + 0x88], rax
lea rax, str.imgui_impl_win32
mov qword [rbx + 0x78], rax
or byte [rbx + 4], 6
mov qword [rsi], rdi
mov rax, qword [rsp + 0x28]
mov qword [rsi + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rsi + 0x18], rax
mov dword [rsi + 0x28], 9
vzeroupper
call fcn.140008220
test rax, rax
je 0x14003dad3
call fcn.140010aa0
mov rbx, qword [rax + 0x88]
jmp 0x14003dad5
xor eax, eax
jmp 0x14003dba7
xor ebx, ebx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
shr eax, 0x10
add rbx, 0x2c
mov ecx, eax
mov edx, 0x20001004
mov r8, rbx
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x14003db04
mov dword [rbx], 0
call fcn.14001d0d0
mov qword [rax + 0x28], rdi
mov byte [rsi + 0x31], 1
lea rcx, str.xinput1_4.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
jne 0x14003db7a
lea rcx, str.xinput1_3.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
jne 0x14003db7a
lea rcx, str.xinput9_1_0.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
jne 0x14003db7a
lea rcx, str.xinput1_2.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
jne 0x14003db7a
lea rcx, str.xinput1_1.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x14003dba5
mov qword [rsi + 0x38], rdi
lea rdx, str.XInputGetCapabilities
mov rbx, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rdi
call rbx
mov qword [rsi + 0x40], rax
lea rdx, str.XInputGetState
mov rcx, rdi
call rbx
mov qword [rsi + 0x48], rax
mov al, 1
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
Function at 0x14004c1e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov esi, edx
mov rdi, rcx
mov r14d, edx
mov ebp, edx
sar ebp, 0x1f
and ebp, edx
dec ebp
mov r15d, 0xfffffffe
add r15, r14
dec r14
jmp 0x14004c239
call fcn.14004c8c0
or r13b, bl
and r13b, r12b
xor bl, 1
movzx ecx, r13b
movzx edx, bl
test al, al
cmove edx, ecx
movzx eax, dl
dec r15
dec esi
dec r14
test eax, eax
jne 0x14004c2ad
test esi, esi
jle 0x14004c2ab
xor eax, eax
test r14d, r14d
je 0x14004c22d
mov ecx, dword [rdi + 0xe88]
mov edx, 0x8000
and ecx, edx
jne 0x14004c22d
mov r12, qword [rdi + 0x20]
mov eax, r15d
movzx ecx, word [r12 + rax*2]
mov r13b, 1
cmp ecx, 9
je 0x14004c277
cmp ecx, 0x20
je 0x14004c277
cmp ecx, 0x3000
je 0x14004c277
xor r13d, r13d
call fcn.14004c8c0
mov ebx, eax
mov eax, r14d
movzx ecx, word [r12 + rax*2]
xor r12d, r12d
cmp ecx, 9
je 0x14004c210
cmp ecx, 0x20
je 0x14004c210
cmp ecx, 0x3000
je 0x14004c210
mov r12b, 1
jmp 0x14004c210
mov esi, ebp
mov eax, esi
sar eax, 0x1f
andn eax, eax, esi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x14004c2d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov edi, edx
mov rbx, rcx
mov rax, qword [rcx]
cmp byte [rax + 0x59], 0
mov esi, dword [rcx + 0xc]
je 0x14004c395
inc edi
cmp edi, esi
jge 0x14004c448
mov r14d, dword [rbx + 0xe88]
jmp 0x14004c338
or r15b, al
call fcn.14004c8c0
movzx ecx, r15b
movzx edx, bpl
test al, al
cmove edx, ecx
cmp dl, 1
jne 0x14004c448
inc edi
cmp esi, edi
je 0x14004c441
test r14w, r14w
js 0x14004c32e
mov r12d, edi
dec r12d
js 0x14004c32e
mov r13, qword [rbx + 0x20]
mov eax, edi
movzx ecx, word [r13 + rax*2]
xor r15d, r15d
cmp ecx, 9
je 0x14004c36a
cmp ecx, 0x20
je 0x14004c36a
cmp ecx, 0x3000
je 0x14004c36a
mov r15b, 1
call fcn.14004c8c0
mov ebp, eax
mov eax, r12d
movzx ecx, word [r13 + rax*2]
mov al, 1
cmp ecx, 9
je 0x14004c310
cmp ecx, 0x20
je 0x14004c310
cmp ecx, 0x3000
je 0x14004c310
xor eax, eax
jmp 0x14004c310
lea r14d, [rdi + 1]
cmp esi, r14d
cmovg r14d, esi
mov r15d, 0x8000
jmp 0x14004c3d3
call fcn.14004c8c0
or r12b, bpl
and r12b, r13b
xor bpl, 1
movzx ecx, r12b
movzx edx, bpl
test al, al
cmove edx, ecx
movzx ecx, dl
test ecx, ecx
jne 0x14004c448
mov eax, edi
lea edi, [rax + 1]
cmp edi, esi
jge 0x14004c445
xor ecx, ecx
test eax, eax
js 0x14004c3cf
mov edx, dword [rbx + 0xe88]
and edx, r15d
jne 0x14004c3cf
mov r13, qword [rbx + 0x20]
mov eax, eax
movzx ecx, word [r13 + rax*2]
mov r12b, 1
cmp ecx, 9
je 0x14004c411
cmp ecx, 0x20
je 0x14004c411
cmp ecx, 0x3000
je 0x14004c411
xor r12d, r12d
call fcn.14004c8c0
mov ebp, eax
mov eax, edi
movzx ecx, word [r13 + rax*2]
xor r13d, r13d
cmp ecx, 9
je 0x14004c3b0
cmp ecx, 0x20
je 0x14004c3b0
cmp ecx, 0x3000
je 0x14004c3b0
mov r13b, 1
jmp 0x14004c3b0
mov edi, esi
jmp 0x14004c448
mov edi, r14d
cmp edi, esi
cmovl esi, edi
mov eax, esi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14004ec40
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rsi, rdx
mov dword [rsp + 0x2c], 0
xor edi, edi
lea r9, [rsp + 0x2c]
mov ecx, 0xb
xor edx, edx
xor r8d, r8d
call sub.ntdll.dll_NtQuerySystemInformation
cmp eax, 0xc0000004
jne 0x14004ecd2
xor edi, edi
mov r14, qword [sym.imp.KERNEL32.dll_VirtualFree]
mov r15, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea rbx, [rsp + 0x2c]
nop dword [rax]
mov rcx, rdi
xor edx, edx
mov r8d, 0x8000
call r14
mov edx, dword [rsp + 0x2c]
xor ecx, ecx
mov r8d, 0x3000
mov r9d, 4
call r15
mov rdi, rax
mov r8d, dword [rsp + 0x2c]
mov ecx, 0xb
mov rdx, rax
mov r9, rbx
call sub.ntdll.dll_NtQuerySystemInformation
cmp eax, 0xc0000004
je 0x14004ec90
test eax, eax
js 0x14004ee71
cmp dword [rdi], 0
je 0x14004ee71
lea rbx, [rdi + 0x30]
xor r14d, r14d
lea r13, [rsp + 0x30]
mov qword [rsp + 0x60], rsi
nop word cs:[rax + rax]
movzx r12d, word [rbx - 2]
add r12, rbx
vxorps xmm0, xmm0, xmm0
vmovups ymmword [rsp + 0x30], ymm0
mov rcx, r12
vzeroupper
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
test rax, rax
js 0x14004ee9f
mov r15, rax
cmp rax, 0xf
ja 0x14004ed60
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], 0xf
mov rcx, r13
mov rdx, r12
mov r8, r15
call sub.VCRUNTIME140.dll_memcpy
add r15, rsp
add r15, 0x30
jmp 0x14004edd4
mov rsi, r13
mov qword [rsp + 0x48], 0xf
mov rbp, r15
or rbp, 0xf
cmp rbp, 0x17
mov eax, 0x16
cmovb rbp, rax
cmp rbp, 0xfff
jb 0x14004eda0
lea rcx, [rbp + 0x28]
call fcn.140056a8c
lea r13, [rax + 0x27]
and r13, 0xffffffffffffffe0
mov qword [r13 - 8], rax
jmp 0x14004edac
lea rcx, [rbp + 1]
call fcn.140056a8c
mov r13, rax
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], rbp
mov rcx, r13
mov rdx, r12
mov r8, r15
call sub.VCRUNTIME140.dll_memcpy
add r15, r13
mov r13, rsi
mov rsi, qword [rsp + 0x60]
mov byte [r15], 0
cmp qword [rsi + 0x18], 0x10
mov rdx, rsi
jb 0x14004ede5
mov rdx, qword [rsi]
cmp qword [rsp + 0x48], 0x10
mov rcx, r13
jb 0x14004edf5
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
mov ebp, eax
test eax, eax
jne 0x14004ee1b
mov rax, qword [rbx - 0x18]
mov qword [rsp + 0x58], rax
mov rcx, rdi
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, qword [rsp + 0x48]
cmp rax, 0x10
jb 0x14004ee58
mov rcx, qword [rsp + 0x30]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14004ee53
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14004eea4
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140056ad0
test ebp, ebp
je 0x14004ee98
inc r14
mov eax, dword [rdi]
add rbx, 0x128
cmp r14, rax
jb 0x14004ed00
xor esi, esi
mov rcx, rdi
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, rsi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rsi, qword [rsp + 0x58]
jmp 0x14004ee84
call fcn.140002290
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140051800
Capabilities:
Enumerate processes

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x268
mov rdi, rdx
mov rax, qword [0x140071c00]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov dword [rsp + 0x28], 0x238
xor esi, esi
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp rax, 0xffffffffffffffff
je 0x1400518c0
mov rbx, rax
lea rdx, [rsp + 0x28]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
cmp qword [rdi + 0x18], 8
mov rdx, rdi
jb 0x14005185e
mov rdx, qword [rdi]
lea r14, [rsp + 0x54]
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
test eax, eax
je 0x1400518a8
lea r15, [rsp + 0x28]
mov r12, qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
jmp 0x14005188a
mov rcx, r14
call r12
test eax, eax
je 0x1400518a8
mov rcx, rbx
mov rdx, r15
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x1400518b7
cmp qword [rdi + 0x18], 8
mov rdx, rdi
jb 0x140051880
mov rdx, qword [rdi]
jmp 0x140051880
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [rsp + 0x30]
jmp 0x1400518c0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140056c60
mov eax, esi
add rsp, 0x268
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x1400520d0
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process filename
Get uefi variable

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x98
mov rsi, r9
mov rdi, rcx
mov rax, qword [0x140071c00]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rax, qword [rcx + 0x30]
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], r9
mov qword [rsp + 0x50], 2
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0x89210
mov qword [rsp + 0x30], 0
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x58], rcx
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov r14, qword [rcx + 0x20]
mov qword [r14 + 0x18], rax
lea rax, [rsp + 0x38]
mov qword [r14 + 0x10], rax
lea rdx, str.uefi_interface
lea rbx, [rsp + 0x80]
mov rcx, rbx
call sub.ntdll.dll_RtlInitUnicodeString
mov byte [rsp + 0x7f], 0
mov dword [rsp + 0x78], 1
mov dword [rsp + 0x74], 0
lea rax, [rsp + 0x74]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x7f]
lea r9, [rsp + 0x78]
mov rcx, rbx
mov rdx, rdi
call sub.ntdll.dll_NtQuerySystemEnvironmentValueEx
test eax, eax
js 0x1400521ad
test eax, eax
jns 0x1400521c6
mov rax, qword [rsp + 0x30]
jmp 0x1400521c8
mov rcx, qword [r14 + 0x18]
mov qword [rdi + 0x268], rcx
vxorps xmm0, xmm0, xmm0
vmovups xmmword [r14 + 0x10], xmm0
test eax, eax
js 0x1400521a6
xor eax, eax
cmp rax, rsi
sete bl
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140056c60
mov eax, ebx
add rsp, 0x98
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1400521f0
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process filename
Get uefi variable

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x98
mov rsi, r9
mov rdi, rcx
mov rax, qword [0x140071c00]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rax, qword [rcx + 0x30]
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], r9
mov qword [rsp + 0x50], 1
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0x89210
mov qword [rsp + 0x30], 0
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x58], rcx
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov r14, qword [rcx + 0x20]
mov qword [r14 + 0x18], rax
lea rax, [rsp + 0x38]
mov qword [r14 + 0x10], rax
lea rdx, str.uefi_interface
lea rbx, [rsp + 0x80]
mov rcx, rbx
call sub.ntdll.dll_RtlInitUnicodeString
mov byte [rsp + 0x7f], 0
mov dword [rsp + 0x78], 1
mov dword [rsp + 0x74], 0
lea rax, [rsp + 0x74]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x7f]
lea r9, [rsp + 0x78]
mov rcx, rbx
mov rdx, rdi
call sub.ntdll.dll_NtQuerySystemEnvironmentValueEx
test eax, eax
js 0x1400522cd
test eax, eax
jns 0x1400522e6
mov rax, qword [rsp + 0x30]
jmp 0x1400522e8
mov rcx, qword [r14 + 0x18]
mov qword [rdi + 0x268], rcx
vxorps xmm0, xmm0, xmm0
vmovups xmmword [r14 + 0x10], xmm0
test eax, eax
js 0x1400522c6
xor eax, eax
cmp rax, rsi
sete bl
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140056c60
mov eax, ebx
add rsp, 0x98
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x140052310
Capabilities:
Get uefi variable

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
movabs rax, 0x7ffffffffffe
cmp rdx, rax
ja 0x14005237a
mov rsi, r8
test r8, r8
je 0x14005237a
mov rdi, r9
mov rbx, rcx
mov r9, qword [rcx + 0x18]
test r9, r9
je 0x14005237a
mov rcx, rbx
mov r8, rdx
call fcn.140051f40
test rax, rax
je 0x14005237a
mov ecx, eax
and ecx, 0xfff
mov r9d, 0x1000
sub r9, rcx
cmp r9, rdi
cmovae r9, rdi
mov rcx, rbx
mov rdx, rax
mov r8, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.1400521f0
xor eax, eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x140055240
Capabilities:
Get graphical window text

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xc28
mov rcx, r8
mov rsi, rdx
lea rdi, [rsp + 0x420]
mov rdx, rdi
mov r8d, 0x400
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rbx, [rsp + 0x20]
mov r8d, 0x400
mov rcx, rbx
mov rdx, rdi
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs]
vxorps xmm0, xmm0, xmm0
vmovups ymmword [rsi], ymm0
mov rcx, rbx
vzeroupper
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
test rax, rax
js 0x140055340
mov rdi, rax
cmp rax, 0xf
ja 0x1400552c6
mov qword [rsi + 0x10], rdi
mov qword [rsi + 0x18], 0xf
lea rdx, [rsp + 0x20]
mov rcx, rsi
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
add rdi, rsi
jmp 0x14005532d
mov qword [rsi + 0x18], 0xf
mov rax, rdi
or rax, 0xf
cmp rax, 0x17
mov r14d, 0x16
cmovae r14, rax
cmp r14, 0xfff
jb 0x140055303
lea rcx, [r14 + 0x28]
call fcn.140056a8c
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x14005530f
lea rcx, [r14 + 1]
call fcn.140056a8c
mov rbx, rax
mov qword [rsi], rbx
mov qword [rsi + 0x10], rdi
mov qword [rsi + 0x18], r14
lea rdx, [rsp + 0x20]
mov rcx, rbx
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
add rdi, rbx
mov byte [rdi], 0
mov rax, rsi
add rsp, 0xc28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.140002290
int3