joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140023d40
Capabilities:
Access peb ldr_data

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x140023fae
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
nop
lea rax, [0x14022f010]
mov qword [rsp], rax
call fcn.140009f00
lea rax, [0x14022ef80]
mov qword [rsp], rax
call fcn.140016d80
mov rax, qword [rsp + 8]
mov qword [rsp + 0x48], rax
nop
nop
lea rcx, [0x14022f010]
mov qword [rsp], rcx
call fcn.14000a160
mov rax, qword [rsp + 0x48]
mov byte [rax + 0xa], 1
lea rdi, [rax + 0x10]
cmp dword [0x1402469e0], 0
jne 0x140023f9f
mov rcx, qword [rsp + 0x68]
mov qword [rax + 0x10], rcx
mov qword [rsp + 0x40], rdi
mov rcx, qword [rsp + 0x70]
mov qword [rax + 0x18], rcx
cmp dword [0x1402469e0], 0
nop dword [rax]
jne 0x140023f78
mov rcx, qword [rsp + 0x78]
mov qword [rax + 0x20], rcx
mov rcx, qword [rsp + 0x80]
mov qword [rax + 0x28], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.1400238a0
cmp byte [rsp + 0x10], 0
je 0x140023f16
cmp dword [0x1402467f0], 0
jne 0x140023e34
mov byte [rsp + 0x88], 1
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rax, qword [rsp + 0x60]
mov qword [rsp], rax
xorps xmm0, xmm0
movups xmmword [rsp + 8], xmm0
call fcn.140011c40
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rcx, qword [rax + 0x30]
mov rdx, qword [rsp + 0x18]
nop
inc dword [rcx + 0xd8]
mov rcx, qword [rax + 0x30]
mov qword [rsp + 0x30], rcx
mov rbx, qword [rcx + 0xa0]
test byte [rbx], al
test byte [rax], al
mov qword [rsp], rdx
lea rax, [rbx + 0x1698]
mov qword [rsp + 0x38], rax
mov qword [rsp + 8], rax
call fcn.14001c880
mov rax, qword [rsp + 0x40]
mov qword [rsp], rax
mov qword [rsp + 8], 8
lea rax, [0x1400b6021]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], 0
call fcn.14001c6e0
nop
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x30]
mov edx, dword [rcx + 0xd8]
lea ebx, [rdx - 1]
mov dword [rcx + 0xd8], ebx
cmp edx, 1
jne 0x140023e22
cmp byte [rax + 0xb1], 0
je 0x140023e22
mov qword [rax + 0x10], 0xfffffffffffffade
jmp 0x140023e22
nop
nop
lea rax, [0x14022f010]
mov qword [rsp], rax
call fcn.140009f00
nop
mov rax, qword [0x14022efb0]
sub rax, qword [0x14022ef80]
mov qword [0x14022efb0], rax
mov rax, qword [0x14022ef98]
mov rcx, qword [rsp + 0x48]
mov qword [rcx], rax
mov qword [0x14022ef98], rcx
nop
nop
lea rax, [0x14022f010]
mov qword [rsp], rax
call fcn.14000a160
mov byte [rsp + 0x88], 0
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
lea rcx, [rax + 0x20]
mov rdi, rcx
mov rbx, qword [rsp + 0x78]
call fcn.1400598c0
lea rdi, [rax + 0x28]
mov rcx, qword [rsp + 0x80]
call fcn.140059880
jmp 0x140023dfb
mov rcx, qword [rsp + 0x68]
call fcn.140059880
jmp 0x140023dc8
call fcn.140057a20
jmp fcn.140023d40
Function at 0x140059600
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x140002b40
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
mov rax, qword [rax + 8]
mov qword [rsp], rcx
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rax
call fcn.1400086a0
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
call fcn.140057a20
jmp 0x140002ae0
cmp byte [0x1402467b2], 0
je 0x14005961f
mov rax, qword [rsp + 8]
mov rcx, qword [rax + 8]
mov rax, qword [rax]
lea rdx, [rsp + 0x18]
jmp 0x140056a40
jmp 0x140002ae0

Function at 0x140059640
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [0x140246a20]
nop
mov rcx, qword [rsp + 8]
mov ecx, dword [rcx]
mov rdx, qword [rsp + 0x10]
lea rax, [rdx + rax*4]
xor rax, rcx
shl rcx, 0x20
xor rcx, rax
movabs rax, 0xea38ec9079f01541
imul rax, rcx
rol rax, 0x1f
movabs rcx, 0x2723a30d96da1399
imul rcx, rax
mov rax, rcx
shr rcx, 0x1d
xor rcx, rax
movabs rax, 0x83cf8eadf876d2d7
imul rax, rcx
mov rcx, rax
shr rax, 0x20
xor rax, rcx
mov qword [rsp + 0x18], rax
ret
cmp byte [0x1402467b2], 0
je 0x14005967c
mov rax, qword [rsp + 8]
movq xmm0, qword [rsp + 0x10]
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x140246ca0]
aesenc xmm0, xmmword [0x140246cb0]
aesenc xmm0, xmmword [0x140246cc0]
movq qword [rsp + 0x18], xmm0
ret
jmp 0x140008920

Function at 0x1400596a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [0x140246a20]
mov rcx, qword [rsp + 8]
mov rcx, qword [rcx]
mov rdx, qword [rsp + 0x10]
lea rax, [rdx + rax*8]
xor rcx, rax
movabs rax, 0xea38ec9079f01541
imul rax, rcx
rol rax, 0x1f
movabs rcx, 0x2723a30d96da1399
imul rcx, rax
mov rax, rcx
shr rcx, 0x1d
xor rax, rcx
movabs rcx, 0x83cf8eadf876d2d7
imul rcx, rax
mov rax, rcx
shr rcx, 0x20
xor rax, rcx
mov qword [rsp + 0x18], rax
ret
cmp byte [0x1402467b2], 0
je 0x1400596dd
mov rax, qword [rsp + 8]
movq xmm0, qword [rsp + 0x10]
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x140246ca0]
aesenc xmm0, xmmword [0x140246cb0]
aesenc xmm0, xmmword [0x140246cc0]
movq qword [rsp + 0x18], xmm0
ret
jmp 0x1400089a0
Function at 0x14007fec0
Capabilities:
Hash data using fnv

Disassembly:
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov edx, dword [rsp + 8]
xor ebx, ebx
jmp 0x14007fee1
movzx esi, byte [rax + rbx]
inc rbx
imul edx, edx, 0x1000193
xor edx, esi
cmp rcx, rbx
jg 0x14007fed2
mov dword [rsp + 0x28], edx
ret

Function at 0x14009f980
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x14009faa0
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0xaea674bf32787b71
mov qword [rsp + 0x2d], rdx
movabs rdx, 0x7caf7faea674bf32
mov qword [rsp + 0x30], rdx
movabs rdx, 0x707070605000905
mov qword [rsp + 0x38], rdx
movabs rdx, 0x20208010a060406
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x14009fa05
add edi, 0xffffffcb
movzx r8d, byte [rsp + rsi + 0x2d]
mov byte [rsp + rsi + 0x2d], dil
sub r8d, edx
lea edx, [r8 - 0x35]
mov byte [rsp + rbx + 0x2d], dl
add rax, 2
cmp rax, 0x10
jge 0x14009fa3a
movzx edx, byte [rsp + rax + 0x38]
lea rbx, [rax + 1]
cmp rbx, 0x10
jae 0x14009fa91
movzx ebx, byte [rsp + rax + 0x39]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rbx, 0xb
jae 0x14009fa85
movzx edi, byte [rsp + rbx + 0x2d]
sub edi, edx
cmp rsi, 0xb
jb 0x14009f9e8
jmp 0x14009fa78
mov qword [rsp], 0
lea rax, [rsp + 0x2d]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0xb
call fcn.140043fe0
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rcx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0xb
nop
call fcn.140059c20
mov eax, ebx
mov ecx, 0xb
call fcn.140059c20
mov rax, rbx
mov ecx, 0x10
call fcn.140059c20
nop
nop
call fcn.140057a20
jmp fcn.14009f980

Function at 0x1400a00e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x1400a01e6
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov dword [rsp + 0x29], 0x2e902ef4
mov dword [rsp + 0x2c], 0x902ef22e
movabs rdx, 0x40406020004
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x1400a0145
movzx r8d, byte [rsp + rsi + 0x29]
mov byte [rsp + rsi + 0x29], dil
lea edx, [r8 + rdx]
lea edx, [rdx - 0x66]
mov byte [rsp + rbx + 0x29], dl
add rax, 2
cmp rax, 8
jge 0x1400a017e
movzx edx, byte [rsp + rax + 0x30]
lea rbx, [rax + 1]
cmp rbx, 8
jae 0x1400a01d4
movzx ebx, byte [rsp + rax + 0x31]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rbx, 7
jae 0x1400a01c8
movzx edi, byte [rsp + rbx + 0x29]
lea edi, [rdi + rdx]
lea edi, [rdi - 0x66]
cmp rsi, 7
jb 0x1400a012b
jmp 0x1400a01bc
mov qword [rsp], 0
lea rax, [rsp + 0x29]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 7
call fcn.140043fe0
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rcx
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 7
call fcn.140059c20
mov eax, ebx
mov ecx, 7
call fcn.140059c20
mov rax, rbx
mov ecx, 8
nop dword [rax]
call fcn.140059c20
nop
call fcn.140057a20
jmp fcn.1400a00e0
Function at 0x1400a0c10
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Populate syswhispers2 syscall list
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov esi, dword [0x14024c080]
test esi, esi
jne 0x1400a0e1d
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rdx, qword [rax + 0x10]
mov rax, qword [rdx + 0x30]
test rax, rax
je 0x1400a0e33
xor r9d, r9d
nop
mov rbx, rax
movsxd rax, dword [rax + 0x3c]
mov eax, dword [rbx + rax + 0x88]
test eax, eax
je 0x1400a0c8c
lea r9, [rbx + rax]
mov eax, dword [r9 + 0xc]
add rax, rbx
mov ecx, dword [rax]
or ecx, 0x20202020
cmp ecx, 0x6c64746e
jne 0x1400a0c8c
mov eax, dword [rax + 4]
or eax, 0x20202020
cmp eax, 0x6c642e6c
je 0x1400a0ca1
mov rdx, qword [rdx]
mov rax, qword [rdx + 0x30]
test rax, rax
jne 0x1400a0c50
test r9, r9
je 0x1400a0e33
mov ebp, dword [r9 + 0x1c]
mov r8d, dword [r9 + 0x24]
xor edi, edi
lea r12, [0x14024c088]
lea rax, [rbp + rbx]
lea rbp, [r8 + rbx]
mov qword [rsp + 0x28], rax
mov eax, dword [r9 + 0x18]
lea edx, [rax - 1]
mov eax, dword [r9 + 0x20]
lea r13, [rbp + rdx*2]
add rax, rbx
lea r14, [rax + rdx*4]
jmp 0x1400a0cf4
sub r14, 4
lea rax, [r13 - 2]
cmp rbp, r13
je 0x1400a0d90
mov r13, rax
mov eax, dword [r14]
add rax, rbx
cmp word [rax], 0x775a
jne 0x1400a0ce0
mov r15d, edi
shl r15, 4
add r15, r12
cmp byte [rax], 0
je 0x1400a0e37
cmp byte [rax + 1], 0
mov ecx, 0x93723eb9
mov edx, 1
mov r9d, 1
je 0x1400a0d4d
nop word [rax + rax]
mov r10d, ecx
movzx edx, word [rax + rdx]
add r9d, 1
ror r10d, 8
add edx, r10d
xor ecx, edx
mov edx, r9d
cmp byte [rax + rdx], 0
jne 0x1400a0d30
mov dword [r15], ecx
movzx eax, word [r13]
add edi, 1
mov rcx, qword [rsp + 0x28]
mov eax, dword [rcx + rax*4]
mov dword [r15 + 4], eax
lea rcx, [rax + rbx]
call fcn.1400a0b20
mov qword [r15 + 8], rax
cmp edi, 0x1f4
jne 0x1400a0ce0
mov dword [0x14024c080], 0x1f4
mov r9d, 0x1f3
jmp 0x1400a0d9f
mov dword [0x14024c080], edi
lea r9d, [rdi - 1]
cmp edi, 1
je 0x1400a0e1d
lea r11d, [rdi - 2]
lea r10, [0x14024c098]
nop word [rax + rax]
mov eax, edi
sub eax, esi
cmp eax, 1
je 0x1400a0e15
mov r8d, r11d
lea rax, [0x14024c088]
sub r8d, esi
shl r8, 4
add r8, r10
nop dword [rax]
mov edx, dword [rax + 4]
mov ecx, dword [rax + 0x14]
cmp ecx, edx
jae 0x1400a0e0c
movd xmm2, edx
movd xmm3, ecx
mov rdx, qword [rax + 8]
mov rcx, qword [rax + 0x18]
movd xmm0, dword [rax]
movd xmm1, dword [rax + 0x10]
mov qword [rax + 8], rcx
mov qword [rax + 0x18], rdx
punpckldq xmm0, xmm2
punpckldq xmm1, xmm3
movq qword [rax], xmm1
movq qword [rax + 0x10], xmm0
add rax, 0x10
cmp r8, rax
jne 0x1400a0dd0
add esi, 1
cmp esi, r9d
jb 0x1400a0db0
mov eax, 1
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
xor eax, eax
jmp 0x1400a0e22
mov ecx, 0x8dfc4d1e
jmp 0x1400a0d4d
Function at 0x1400aad60
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push r14
push rdi
push rsi
push rbx
movzx eax, word [r8 + 0x100]
mov edi, eax
movzx ebx, ah
mov r10d, eax
mov esi, edx
test edx, edx
jle 0x1400aadcd
movsxd r11, edx
sub r10d, ecx
add r11, rcx
add r10d, 1
nop dword [rax + rax]
lea edx, [r10 + rcx]
movzx edx, dl
add rdx, r8
movzx eax, byte [rdx]
add ebx, eax
movzx r9d, bl
add r9, r8
movzx r14d, byte [r9]
mov byte [rdx], r14b
mov byte [r9], al
add al, byte [rdx]
movzx edx, al
add al, byte [r8 + rdx]
xor byte [rcx], al
add rcx, 1
cmp rcx, r11
jne 0x1400aad90
movzx eax, sil
add al, dil
mov ah, bl
mov word [r8 + 0x100], ax
pop rbx
pop rsi
pop rdi
pop r14
ret
Function at 0x1400ab1e0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x290
xor r8d, r8d
movabs rax, 0x63ef6bbe42ad28de
mov qword [rsp + 0x50], rax
mov r12, rcx
mov ecx, 0x20
mov rbp, rdx
movabs rax, 0x985cfe73d514f215
mov byte [rsp + 0x60], 0
lea rsi, [rsp + 0x30]
lea rbx, [rsp + 0x180]
mov qword [rsp + 0x24], rax
mov rdi, rbx
xor eax, eax
movabs rdx, 0x7882c5fb07a585af
rep stosq qword [rdi], rax
mov qword [rsp + 0x58], rdx
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x2c], 0xddb1fe
mov dword [rdi], 0
lea rdi, [rsp + 0x70]
mov rdx, rdi
call fcn.1400aaa10
movzx eax, byte [rsp + 0x170]
lea rcx, [rsp + 0x24]
movzx r9d, byte [rsp + 0x171]
lea r10d, [rax + 1]
sub r10d, ecx
nop
lea edx, [r10 + rcx]
movzx edx, dl
add rdx, rdi
movzx eax, byte [rdx]
add r9d, eax
movzx r8d, r9b
add r8, rdi
movzx r11d, byte [r8]
mov byte [rdx], r11b
mov byte [r8], al
add al, byte [rdx]
movzx edx, al
add al, byte [rsp + rdx + 0x70]
xor byte [rcx], al
add rcx, 1
cmp rsi, rcx
jne 0x1400ab280
mov rax, qword [rsp + 0x24]
mov qword [rsp + 0x180], rax
mov eax, dword [rsp + 0x2c]
mov dword [rsp + 0x188], eax
mov rax, qword [rbp + 0x10]
test rax, rax
je 0x1400ab340
test r12, r12
je 0x1400ab330
mov rcx, r12
call sub.msvcrt.dll_wcslen
mov edx, 0xfffc
add rax, rax
cmp rax, rdx
cmova rax, rdx
mov word [rsp + 0x70], ax
add eax, 2
mov word [rsp + 0x72], ax
mov rax, qword [rbp + 0x10]
mov qword [rsp + 0x78], r12
lea r9, [rbp + 0x30]
mov r8, rdi
xor edx, edx
xor ecx, ecx
call rax
mov rax, qword [rbp + 0x30]
add rsp, 0x290
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov dword [rsp + 0x70], 0
jmp 0x1400ab303
test r12, r12
je 0x1400ab400
mov rcx, r12
call sub.msvcrt.dll_wcslen
mov edx, 0xfffc
add rax, rax
cmp rax, rdx
cmova rax, rdx
mov edx, eax
add eax, 2
movdqu xmm0, xmmword [rbp]
movdqu xmm1, xmmword [rbp + 0x10]
mov word [rsp + 0x32], ax
mov rcx, rbx
movdqu xmm2, xmmword [rbp + 0x20]
mov rax, qword [rbp + 0x30]
mov word [rsp + 0x30], dx
mov rdi, qword [rbp + 0x28]
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x80], xmm1
movaps xmmword [rsp + 0x90], xmm2
mov qword [rsp + 0x38], r12
mov qword [rsp + 0xa0], rax
call sub.msvcrt.dll_strlen
lea rdx, [rsp + 0x40]
xor r8d, r8d
mov rcx, rdi
mov word [rsp + 0x40], ax
add eax, 1
lea r9, [rsp + 0x88]
mov word [rsp + 0x42], ax
mov qword [rsp + 0x48], rbx
call qword [rsp + 0x78]
mov rax, qword [rsp + 0x88]
xor edx, edx
xor ecx, ecx
lea r9, [rbp + 0x30]
mov r8, rsi
mov qword [rbp + 0x10], rax
call rax
jmp 0x1400ab315
xor edx, edx
xor eax, eax
jmp 0x1400ab365
Function at 0x1400ac420
Capabilities:
Get hostname
Get session user name

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x5d0
xor eax, eax
mov ecx, 0x41
movdqa xmm0, xmmword [0x1401fcc90]
movaps xmmword [rsp + 0x30], xmm0
lea rdi, [rsp + 0x1b0]
movdqa xmm0, xmmword [0x1401fccb0]
lea rbp, [rsp + 0x1b0]
rep stosq qword [rdi], rax
lea rdi, [rsp + 0xa0]
mov ecx, 0x20
lea rbx, [rsp + 0x3c0]
rep stosq qword [rdi], rax
movaps xmmword [rsp + 0x50], xmm0
movdqa xmm0, xmmword [0x1401fccc0]
mov ecx, 0x41
lea rdx, [rsp + 0x24]
mov dword [rsp + 0x24], 0x104
lea r12, [rsp + 0x30]
movaps xmmword [rsp + 0x60], xmm0
movdqa xmm0, xmmword [0x1401fccd0]
mov dword [rsp + 0x28], 0
movaps xmmword [rsp + 0x70], xmm0
movdqa xmm0, xmmword [0x1401fcce0]
mov dword [rsp + 0x2c], 0x104
mov dword [rdi], 0
lea rdi, [rsp + 0x3c0]
rep stosq qword [rdi], rax
mov rcx, rbp
lea rdi, [rsp + 0x4c]
mov rax, qword [0x1401fcca0]
movaps xmmword [rsp + 0x80], xmm0
mov qword [rsp + 0x40], rax
mov rax, qword [0x1401fccf0]
mov dword [rsp + 0x48], 0x14ce66d1
mov qword [rsp + 0x90], rax
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0xa0]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea rdx, [rsp + 0x2c]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov rsi, qword [sym.imp.KERNEL32.dll_lstrlenW]
nop dword [rax]
mov rcx, rbp
call rsi
test eax, eax
jle 0x1400ac62a
cdqe
xor edx, edx
mov rcx, rbp
lea r9, [rbp + rax*2]
nop dword [rax]
movzx eax, word [rcx]
add rcx, 2
lea r8d, [rax - 0x20]
cmp ax, 0x60
cmova eax, r8d
imul edx, edx, 0x83
movzx eax, ax
add edx, eax
cmp r9, rcx
jne 0x1400ac558
and edx, 0x7fffffff
cmp dword [r12], edx
je 0x1400ac617
add r12, 4
cmp rdi, r12
jne 0x1400ac538
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x98]
nop dword [rax]
mov rcx, rbx
call rsi
test eax, eax
jle 0x1400ac610
cdqe
xor edx, edx
mov rcx, rbx
lea r9, [rbx + rax*2]
nop dword [rax]
movzx eax, word [rcx]
add rcx, 2
lea r8d, [rax - 0x20]
cmp ax, 0x60
cmova eax, r8d
imul edx, edx, 0x83
movzx eax, ax
add edx, eax
cmp rcx, r9
jne 0x1400ac5c0
and edx, 0x7fffffff
cmp dword [rbp], edx
je 0x1400ac617
add rbp, 4
cmp rdi, rbp
jne 0x1400ac5a8
xor eax, eax
add rsp, 0x5d0
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
xor edx, edx
cmp dword [rbp], edx
jne 0x1400ac5ee
mov eax, 1
add rsp, 0x5d0
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
xor edx, edx
jmp 0x1400ac581
Function at 0x1400ac640
Capabilities:
Get hostname

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x650
xor eax, eax
mov ecx, 0x41
lea rsi, str.WINDOWS_
lea rdi, [rsp + 0x30]
lea rbx, [rsp + 0x30]
mov dword [rsp + 0x2c], 0
rep stosq qword [rdi], rax
lea rdx, [rsp + 0x2c]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
cmp dword [rsp + 0x2c], 0xf
mov ecx, 0x82
lea rdx, [rsp + 0x240]
mov rdi, rdx
rep movsq qword [rdi], qword [rsi]
je 0x1400ac6a8
xor eax, eax
add rsp, 0x650
pop rbx
pop rsi
pop rdi
ret
mov rcx, rbx
call sub.SHELL32.dll_StrStrW
test eax, eax
jne 0x1400ac6de
cmp dword [rsp + 0x2c], 0xf
jne 0x1400ac695
lea rdx, [rsp + 0x448]
mov rcx, rbx
call sub.SHELL32.dll_StrStrW
test eax, eax
setne al
movzx eax, al
add rsp, 0x650
pop rbx
pop rsi
pop rdi
ret
mov eax, 1
jmp 0x1400ac697

Function at 0x1400ac870
Capabilities:
Parse pe header

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
test rcx, rcx
je 0x1400ac8c0
test rdx, rdx
je 0x1400ac8d0
add rdx, rcx
lea rax, [rcx + 0x40]
cmp rdx, rax
jb 0x1400ac8c0
cmp word [rcx], 0x5a4d
jne 0x1400ac8c0
movsxd rsi, dword [rcx + 0x3c]
cmp esi, 0x400
jg 0x1400ac8c0
add rsi, rcx
lea rax, [rsi + 0xf8]
cmp rdx, rax
jb 0x1400ac8c0
cmp rsi, rcx
jb 0x1400ac8c0
cmp dword [rsi], 0x4550
je 0x1400ac8c2
nop
xor esi, esi
mov rax, rsi
add rsp, 0x28
pop rbx
pop rsi
ret
mov edx, 0x40
call fcn.1400ac770
test eax, eax
jne 0x1400ac8c0
cmp word [rbx], 0x5a4d
jne 0x1400ac8c0
movsxd rsi, dword [rbx + 0x3c]
cmp esi, 0x400
jg 0x1400ac8c0
add rsi, rbx
mov edx, 0xf8
mov rcx, rsi
call fcn.1400ac770
test eax, eax
je 0x1400ac8b6
jmp 0x1400ac8c0

Function at 0x1400ac910
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x1400ac978
mov edx, 0x40
call fcn.1400ac770
test eax, eax
jne 0x1400ac978
cmp word [rbx], 0x5a4d
jne 0x1400ac978
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x1400ac978
add rbx, rax
mov edx, 0xf8
mov rcx, rbx
call fcn.1400ac770
test eax, eax
jne 0x1400ac978
cmp dword [rbx], 0x4550
jne 0x1400ac978
mov edx, 0xf8
mov rcx, rbx
call fcn.1400ac770
test eax, eax
jne 0x1400ac978
movzx eax, word [rbx + 0x18]
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x1400ae0f0
Capabilities:
Parse pe header

Disassembly:
xor edx, edx
test rcx, rcx
je 0x1400ae117
cmp word [rcx], 0x5a4d
jne 0x1400ae117
movsxd rax, dword [rcx + 0x3c]
cmp eax, 0x400
jg 0x1400ae117
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400ae117
mov edx, dword [rcx + 0x28]
mov eax, edx
ret
Function at 0x1400ae2d0
Capabilities:
Inspect section memory permissions

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xc8
pxor xmm0, xmm0
mov rbp, rcx
lea rcx, [rsp + 0x80]
movaps xmmword [rsp + 0x80], xmm0
mov r12, rdx
movaps xmmword [rsp + 0x90], xmm0
mov r13, r8
lea r14, [rsp + 0x6c]
movaps xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0xb0], 0
call fcn.1400ab410
lea r9, [rsp + 0x20]
movabs rax, 0x8c54fe69ed14ff0f
movdqa xmm1, xmmword [rsp + 0x80]
movdqa xmm2, xmmword [rsp + 0x90]
mov qword [rsp + 0x70], rax
movabs rdx, 0x4e22b0a9b2e0
mov r8d, 0x10
movdqa xmm3, xmmword [rsp + 0xa0]
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x78], rdx
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0xa0]
movaps xmmword [rsp + 0x20], xmm1
movaps xmmword [rsp + 0x30], xmm2
movaps xmmword [rsp + 0x40], xmm3
mov qword [rsp + 0x50], rax
call fcn.1400ab070
mov r9, r14
mov edx, 0x1000
mov rcx, rbp
mov dword [rsp + 0x6c], 0
mov rdi, rax
mov r8d, 2
call rax
mov esi, eax
test eax, eax
jne 0x1400ae3d8
mov eax, esi
add rsp, 0xc8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rdx, r13
mov rcx, r12
call fcn.1400acb80
test rax, rax
je 0x1400ae490
movzx r15d, word [rax + 2]
test r15, r15
je 0x1400ae490
xor ebx, ebx
mov esi, 1
jmp 0x1400ae457
mov r8d, 0x20
test edx, 0x20000000
jne 0x1400ae432
mov r8d, 4
test edx, 0x40000000
je 0x1400ae432
sar edx, 0x1f
mov r8d, edx
and r8d, 2
add r8d, 2
mov ecx, dword [rax + 0xc]
mov edx, dword [rax + 8]
mov r9, r14
add rcx, rbp
call rdi
test eax, eax
mov eax, 0
cmove esi, eax
add rbx, 1
cmp rbx, r15
je 0x1400ae3bc
mov r8, rbx
mov rdx, r13
mov rcx, r12
call fcn.1400acc80
test rax, rax
je 0x1400ae3bc
mov edx, dword [rax + 0x24]
mov ecx, edx
not ecx
and ecx, 0x60000000
jne 0x1400ae408
sar edx, 0x1f
mov r8d, edx
and r8d, 0x20
add r8d, 0x20
jmp 0x1400ae432
mov esi, 1
jmp 0x1400ae3bc

Function at 0x1400b4480
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.1400b5520
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.1400b5520
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]
Function at 0x1400b44f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x14024eab4]
mov rbx, rcx
test esi, esi
jle 0x1400b4620
mov rax, qword [0x14024eab8]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x1400b453b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x1400b45c5
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x1400b4520
mov rcx, rbx
call fcn.1400b4f60
mov rdi, rax
test rax, rax
je 0x1400b4642
mov rax, qword [0x14024eab8]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.1400b50a0
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x14024eab8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1400b4627
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x1400b45be
lea edx, [rax - 0x40]
and edx, 0xffffffbf
jne 0x1400b45d0
add dword [0x14024eab4], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x14024eab8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1400b45be
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.1400b4480
nop dword [rax]
xor esi, esi
jmp 0x1400b4548
mov rax, qword [0x14024eab8]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.1400b4480
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.1400b4480
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x1400b4bd0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x14024eb20]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14024eb00]
test rbx, rbx
je 0x1400b4c2c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test rsi, rsi
je 0x1400b4c23
test eax, eax
jne 0x1400b4c23
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x1400b4c08
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]