joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6db700
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
push rbx
mov byte [rsp - 0x58], 0
mov byte [rsp - 0x1058], 0
sub rsp, 0x1058
mov rbp, rsp
mov qword [rbp + 0x28], rbp
mov qword [rbp + 0x1070], rcx
mov rcx, qword [rbp + 0x1070]
call fcn.006da310
nop
mov byte [rbp + 0x104f], 0
mov rax, qword [rbp + 0x1070]
cmp qword [rax + 0x18], 0
je 0x6db8da
mov rax, qword [rbp + 0x1070]
cmp qword [rax + 8], 0xffffffffffffffff
je 0x6db8e9
mov rax, qword [rbp + 0x1070]
cmp byte [rax + 0x10], 0
je 0x6db8e9
mov rax, qword [rbp + 0x1070]
mov rcx, qword [rax + 0x18]
call fcn.00508d10
mov dword [rbp + 0x48], eax
mov rax, qword [rbp + 0x1070]
mov rax, qword [rax + 0x18]
mov rcx, rax
lea rdx, [rbp + 0x4f]
mov r8d, 0x1000
mov rax, qword [rax]
call qword [rax + 0x18]
mov dword [rbp + 0x44], eax
cmp dword [rbp + 0x44], 0
jle 0x6db8ca
mov rax, qword [rbp + 0x1070]
mov rcx, qword [rax + 8]
lea rdx, [rbp + 0x4f]
mov r8d, dword [rbp + 0x44]
xor r9, r9
call sub.wsock32.dll_send
mov dword [rbp + 0x40], eax
cmp dword [rbp + 0x40], 0xffffffff
jne 0x6db86b
call sub.wsock32.dll_WSAGetLastError
mov dword [rbp + 0x3c], eax
cmp dword [rbp + 0x3c], 0x2733
je 0x6db855
mov rcx, qword [rbp + 0x1070]
mov dx, 0xfffe
call fcn.0040c1a0
mov rbx, rax
mov rcx, qword [rbp + 0x1070]
mov rdx, qword [rbp + 0x1070]
mov r8b, 1
lea r9, [rbp + 0x3c]
call rbx
mov rcx, qword [rbp + 0x1070]
mov rax, qword [rbp + 0x1070]
mov rdx, qword [rax + 8]
mov rax, qword [rbp + 0x1070]
mov rbx, qword [rax]
call qword [rbx + 0x10]
mov rcx, rbp
call fcn.006db650
mov rax, qword [rbp + 0x1070]
movzx rax, byte [rax + 0x40]
cmp al, byte [0x006db938]
je 0x6db8d2
call fcn.0043a700
jmp 0x6db8d2
mov rax, qword [rbp + 0x1070]
mov rcx, qword [rax + 0x18]
movsxd rdx, dword [rbp + 0x48]
call fcn.00508d30
jmp 0x6db8d2
mov eax, dword [rbp + 0x44]
cmp eax, dword [rbp + 0x40]
jle 0x6db891
mov rax, qword [rbp + 0x1070]
mov rcx, qword [rax + 0x18]
mov edx, dword [rbp + 0x48]
add edx, dword [rbp + 0x40]
movsxd rdx, edx
call fcn.00508d30
jmp 0x6db76d
mov rax, qword [rbp + 0x1070]
mov rcx, qword [rax + 0x18]
call fcn.00508d10
mov rbx, rax
mov rax, qword [rbp + 0x1070]
mov rax, qword [rax + 0x18]
mov rcx, rax
mov rax, qword [rax]
call qword [rax]
cmp rbx, rax
jne 0x6db76d
mov rcx, rbp
call fcn.006db650
jmp 0x6db8d2
mov rcx, rbp
call fcn.006db650
nop
mov byte [rbp + 0x104f], 1
nop
mov rcx, qword [rbp + 0x1070]
call fcn.006da330
jmp 0x6db8f5
xor rcx, rcx
mov rdx, qword [rbp + 0x28]
call fcn.006db910
movzx rax, byte [rbp + 0x104f]
lea rsp, [rbp + 0x1058]
pop rbx
pop rbp
ret
Function at 0x6db990
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
push rbx
sub rsp, 0x88
mov rbp, rsp
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x68], rbp
mov qword [rbp + 0xa0], rcx
mov qword [rbp + 0xa8], rdx
mov dword [rbp + 0xb0], r8d
nop
mov rcx, qword [rbp + 0xa0]
call fcn.006da310
nop
mov dword [rbp + 0x7c], 0
mov rax, qword [rbp + 0xa0]
cmp byte [rax + 0x10], 0
je 0x6dbade
mov rax, qword [rbp + 0xa0]
mov rcx, qword [rax + 8]
mov rdx, qword [rbp + 0xa8]
mov r8d, dword [rbp + 0xb0]
xor r9, r9
call sub.wsock32.dll_send
mov dword [rbp + 0x7c], eax
cmp dword [rbp + 0x7c], 0xffffffff
jne 0x6dbacf
call sub.wsock32.dll_WSAGetLastError
mov dword [rbp + 0x78], eax
cmp dword [rbp + 0x78], 0x2733
je 0x6dbacf
mov rcx, qword [rbp + 0xa0]
mov dx, 0xfffe
call fcn.0040c1a0
mov rbx, rax
mov rcx, qword [rbp + 0xa0]
mov rdx, qword [rbp + 0xa0]
mov r8b, 1
lea r9, [rbp + 0x78]
call rbx
mov rcx, qword [rbp + 0xa0]
mov rax, qword [rbp + 0xa0]
mov rdx, qword [rax + 8]
mov rax, qword [rbp + 0xa0]
mov rbx, qword [rax]
call qword [rbx + 0x10]
cmp dword [rbp + 0x78], 0
je 0x6dbacf
lea rcx, [rbp + 0x30]
mov edx, dword [rbp + 0x78]
call fcn.00438ad0
mov rax, qword [rbp + 0x30]
mov qword [rbp + 0x38], rax
mov byte [rbp + 0x40], 0x11
mov eax, dword [rbp + 0x78]
mov dword [rbp + 0x48], eax
mov byte [rbp + 0x50], 0
lea rax, [0x006dbb70]
mov qword [rbp + 0x58], rax
mov byte [rbp + 0x60], 0x11
mov rcx, qword [0x006d7590]
mov dl, 1
mov r8, qword [0x00733240]
lea r9, [rbp + 0x38]
mov dword [rsp + 0x20], 2
call fcn.0043abb0
mov rcx, rax
call fcn.0040e0b0
nop
mov rcx, qword [rbp + 0xa0]
call fcn.006da330
jmp 0x6dbaec
xor rcx, rcx
mov rdx, qword [rbp + 0x68]
call fcn.006dbb10
jmp 0x6dbaed
nop
lea rcx, [rbp + 0x30]
call fcn.0040ee40
mov eax, dword [rbp + 0x7c]
lea rsp, [rbp + 0x88]
pop rbx
pop rbp
ret
Function at 0x6dbbf0
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push rbp
push rbx
sub rsp, 0x88
mov rbp, rsp
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x68], rbp
mov qword [rbp + 0xa0], rcx
mov qword [rbp + 0xa8], rdx
mov dword [rbp + 0xb0], r8d
nop
mov rcx, qword [rbp + 0xa0]
call fcn.006da310
nop
mov dword [rbp + 0x7c], 0
cmp dword [rbp + 0xb0], 0xffffffff
jne 0x6dbc67
mov rax, qword [rbp + 0xa0]
cmp byte [rax + 0x10], 0
je 0x6dbc67
mov rax, qword [rbp + 0xa0]
mov rcx, qword [rax + 8]
mov edx, 0x4004667f
lea r8, [rbp + 0x7c]
call sub.wsock32.dll_ioctlsocket
jmp 0x6dbd9c
mov rax, qword [rbp + 0xa0]
cmp byte [rax + 0x10], 0
je 0x6dbdab
mov rax, qword [rbp + 0xa0]
mov rcx, qword [rax + 8]
mov edx, 0x4004667f
lea r8, [rbp + 0x74]
call sub.wsock32.dll_ioctlsocket
test eax, eax
jne 0x6dbcb0
cmp dword [rbp + 0x74], 0
jle 0x6dbcb0
mov eax, dword [rbp + 0x74]
cmp eax, dword [rbp + 0xb0]
jge 0x6dbcb0
mov eax, dword [rbp + 0x74]
mov dword [rbp + 0xb0], eax
mov rax, qword [rbp + 0xa0]
mov rcx, qword [rax + 8]
mov rdx, qword [rbp + 0xa8]
mov r8d, dword [rbp + 0xb0]
xor r9, r9
call sub.wsock32.dll_recv
mov dword [rbp + 0x7c], eax
cmp dword [rbp + 0x7c], 0xffffffff
jne 0x6dbd9c
call sub.wsock32.dll_WSAGetLastError
mov dword [rbp + 0x78], eax
cmp dword [rbp + 0x78], 0x2733
je 0x6dbd9c
mov rcx, qword [rbp + 0xa0]
mov dx, 0xfffe
call fcn.0040c1a0
mov rbx, rax
mov rcx, qword [rbp + 0xa0]
mov rdx, qword [rbp + 0xa0]
mov r8b, 2
lea r9, [rbp + 0x78]
call rbx
mov rcx, qword [rbp + 0xa0]
mov rax, qword [rbp + 0xa0]
mov rdx, qword [rax + 8]
mov rax, qword [rbp + 0xa0]
mov rbx, qword [rax]
call qword [rbx + 0x10]
cmp dword [rbp + 0x78], 0
je 0x6dbd9c
lea rcx, [rbp + 0x30]
mov edx, dword [rbp + 0x78]
call fcn.00438ad0
mov rax, qword [rbp + 0x30]
mov qword [rbp + 0x38], rax
mov byte [rbp + 0x40], 0x11
mov eax, dword [rbp + 0x78]
mov dword [rbp + 0x48], eax
mov byte [rbp + 0x50], 0
lea rax, [0x006dbe30]
mov qword [rbp + 0x58], rax
mov byte [rbp + 0x60], 0x11
mov rcx, qword [0x006d7590]
mov dl, 1
mov r8, qword [0x00733240]
lea r9, [rbp + 0x38]
mov dword [rsp + 0x20], 2
call fcn.0043abb0
mov rcx, rax
call fcn.0040e0b0
nop
mov rcx, qword [rbp + 0xa0]
call fcn.006da330
jmp 0x6dbdb9
xor rcx, rcx
mov rdx, qword [rbp + 0x68]
call fcn.006dbdd0
jmp 0x6dbdba
nop
lea rcx, [rbp + 0x30]
call fcn.0040ee40
mov eax, dword [rbp + 0x7c]
lea rsp, [rbp + 0x88]
pop rbx
pop rbp
ret
Function at 0x6dcab0
Capabilities:
Create a process with modified i/o handles and window
Create process on windows

Disassembly:
push rbp
push rbx
sub rsp, 0xf8
mov rbp, rsp
mov dword [rbp + 0x5c], r8d
mov qword [rbp + 0xe0], 0
mov qword [rbp + 0x110], rcx
mov qword [rbp + 0x118], rdx
mov rcx, qword [rbp + 0x110]
call fcn.0040efd0
mov rcx, qword [rbp + 0x118]
call fcn.0040efd0
nop
lea rcx, [rbp + 0xe0]
mov edx, 0x104
call fcn.00410890
xor rax, rax
mov byte [rbp + 0x5b], al
mov rcx, qword [rbp + 0x110]
call fcn.00410600
mov rbx, rax
mov rcx, qword [rbp + 0xe0]
call fcn.00410600
mov rcx, rbx
xor rdx, rdx
mov r8, rax
call sub.shell32.dll_FindExecutableW
mov dword [rbp + 0xec], eax
cmp dword [rbp + 0xec], 0x20
jb 0x6dcc48
mov rcx, qword [rbp + 0xe0]
call fcn.00410600
mov rcx, rax
call fcn.006dcaa0
lea rcx, [rbp + 0xe0]
mov edx, eax
call fcn.00410890
lea rcx, [rbp + 0x60]
mov edx, 0x68
xor r8, r8
call fcn.0040aa60
mov dword [rbp + 0x60], 0x68
mov dword [rbp + 0x9c], 0x101
mov eax, dword [rbp + 0x5c]
mov word [rbp + 0xa0], ax
mov rcx, qword [rbp + 0xe0]
call fcn.00410600
mov rbx, rax
mov rcx, qword [rbp + 0x118]
call fcn.00410600
mov rcx, rbx
mov rdx, rax
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0x20
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
lea rax, [rbp + 0x60]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0xc8]
mov qword [rsp + 0x48], rax
call sub.kernel32.dll_CreateProcessW
test eax, eax
je 0x6dcc3d
mov rcx, qword [rbp + 0xc8]
or edx, 0xffffffff
call sub.kernel32.dll_WaitForSingleObject_1
mov rcx, qword [rbp + 0xc8]
lea rdx, [rbp + 0xec]
call sub.kernel32.dll_GetExitCodeProcess
mov rcx, qword [rbp + 0xc8]
call sub.kernel32.dll_CloseHandle_2
mov rcx, qword [rbp + 0xd0]
call sub.kernel32.dll_CloseHandle_2
mov al, 1
mov byte [rbp + 0x5b], al
jmp 0x6dcc48
call sub.kernel32.dll_GetLastError
mov dword [rbp + 0xec], eax
nop
lea rcx, [rbp + 0xe0]
call fcn.0040ee40
lea rcx, [rbp + 0x110]
mov edx, 2
call fcn.0040ef20
movzx rax, byte [rbp + 0x5b]
lea rsp, [rbp + 0xf8]
pop rbx
pop rbp
ret
Function at 0x6dd690
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
cmp qword [0x0073e6e0], 0
jne 0x6dd779
lea rcx, [0x006dd79c]
call sub.kernel32.dll_GetModuleHandleW_3
mov qword [0x0073e6e0], rax
cmp qword [0x0073e6e0], 0
je 0x6dd779
mov rcx, qword [0x0073e6e0]
lea rdx, [0x006dd7b6]
call sub.kernel32.dll_GetProcAddress_3
mov qword [0x0073e6e8], rax
mov rcx, qword [0x0073e6e0]
lea rdx, [0x006dd7cf]
call sub.kernel32.dll_GetProcAddress_3
mov qword [0x0073e700], rax
mov rcx, qword [0x0073e6e0]
lea rdx, [0x006dd7de]
call sub.kernel32.dll_GetProcAddress_3
mov qword [0x0073e708], rax
mov rcx, qword [0x0073e6e0]
lea rdx, [0x006dd7ec]
call sub.kernel32.dll_GetProcAddress_3
mov qword [0x0073e710], rax
mov rcx, qword [0x0073e6e0]
lea rdx, [0x006dd7fc]
call sub.kernel32.dll_GetProcAddress_3
mov qword [0x0073e718], rax
mov rcx, qword [0x0073e6e0]
lea rdx, [0x006dd7ec]
call sub.kernel32.dll_GetProcAddress_3
mov qword [0x0073e6f0], rax
mov rcx, qword [0x0073e6e0]
lea rdx, [0x006dd7fc]
call sub.kernel32.dll_GetProcAddress_3
mov qword [0x0073e6f8], rax
cmp qword [0x0073e6e0], 0
je 0x6dd78d
cmp qword [0x0073e6e8], 0
jne 0x6dd792
xor rax, rax
jmp 0x6dd794
mov al, 1
add rsp, 0x28
ret

Function at 0x6dda70
Capabilities:
Create process on windows

Disassembly:
push rbp
push r13
push rdi
push rsi
push rbx
sub rsp, 0x100
mov rbp, rsp
mov rbx, rcx
mov rsi, rdx
mov rdi, r8
mov r13d, r9d
xor rax, rax
mov byte [rbp + 0x6f], al
call sub.kernel32.dll_GetCurrentProcess_1
mov rcx, rax
mov edx, 0x20028
lea r8, [rbp + 0xf8]
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x6ddba9
lea rcx, [rbp + 0x88]
mov edx, 0x68
xor r8, r8
call fcn.0040aa60
mov dword [rbp + 0x88], 0x68
lea rax, [0x006ddbbc]
mov qword [rbp + 0x98], rax
mov word [rbp + 0xc8], r13w
call sub.kernel32.dll_WTSGetActiveConsoleSessionId
mov ecx, eax
lea rdx, [rbp + 0xf8]
call sub.wtsapi32.dll_WTSQueryUserToken
test eax, eax
je 0x6ddb91
mov rcx, qword [rbp + 0xf8]
mov edx, 0x2000000
xor r8, r8
mov r9b, 2
mov byte [rsp + 0x20], 1
lea rax, [rbp + 0xf0]
mov qword [rsp + 0x28], rax
call sub.advapi32.dll_DuplicateTokenEx
test eax, eax
je 0x6ddb91
mov rcx, qword [rbp + 0xf0]
mov rdx, rbx
mov r8, rsi
xor r9, r9
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x30], 0x20
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], rdi
lea rax, [rbp + 0x88]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x70]
mov qword [rsp + 0x50], rax
call sub.advapi32.dll_CreateProcessAsUserW
test eax, eax
setne al
cmp al, 1
jne 0x6ddb91
mov al, 1
mov byte [rbp + 0x6f], al
mov rcx, qword [rbp + 0xf8]
call sub.kernel32.dll_CloseHandle_3
mov rcx, qword [rbp + 0xf0]
call sub.kernel32.dll_CloseHandle_3
movzx rax, byte [rbp + 0x6f]
lea rsp, [rbp + 0x100]
pop rbx
pop rsi
pop rdi
pop r13
pop rbp
ret
Function at 0x6ddbe0
Capabilities:
Create process on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x138
mov rbp, rsp
mov qword [rbp + 0x70], rcx
mov qword [rbp + 0x78], rdx
mov qword [rbp + 0x68], r8
mov qword [rbp + 0x88], 0
mov qword [rbp + 0x80], 0
nop
xor rax, rax
mov byte [rbp + 0x67], al
lea rcx, [rbp + 0x80]
xor rdx, rdx
call fcn.004090c0
lea rcx, [rbp + 0x88]
mov rdx, qword [rbp + 0x80]
call fcn.00431ec0
mov rcx, qword [rbp + 0x88]
call fcn.006dd8a0
mov ebx, eax
lea rcx, [rbp + 0xb8]
mov edx, 0x68
xor r8, r8
call fcn.0040aa60
mov dword [rbp + 0xb8], 0x68
lea rax, [0x006dddbc]
mov qword [rbp + 0xc8], rax
mov word [rbp + 0xf8], 0
call sub.kernel32.dll_WTSGetActiveConsoleSessionId
mov ecx, eax
lea rdx, [rbp + 0x120]
call sub.wtsapi32.dll_WTSQueryUserToken
test eax, eax
je 0x6ddd45
mov ecx, 0x1fffff
xor rdx, rdx
mov r8d, ebx
call sub.kernel32.dll_OpenProcess
mov rcx, rax
mov edx, 0x2000000
lea r8, [rbp + 0x128]
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x6ddd45
lea rcx, [rbp + 0x98]
mov rdx, qword [rbp + 0x120]
or r8d, 0xffffffff
call sub.userenv.dll_CreateEnvironmentBlock
test eax, eax
je 0x6ddd45
mov rcx, qword [rbp + 0x128]
mov rdx, qword [rbp + 0x70]
mov r8, qword [rbp + 0x78]
xor r9, r9
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x30], 0x400
mov rax, qword [rbp + 0x98]
mov qword [rsp + 0x38], rax
mov rax, qword [rbp + 0x68]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0xb8]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0xa0]
mov qword [rsp + 0x50], rax
call sub.advapi32.dll_CreateProcessAsUserW
test eax, eax
je 0x6ddd45
mov al, 1
mov byte [rbp + 0x67], al
mov rcx, qword [rbp + 0x128]
call sub.kernel32.dll_CloseHandle_3
mov rcx, qword [rbp + 0x120]
call sub.kernel32.dll_CloseHandle_3
mov rcx, qword [rbp + 0x98]
call sub.userenv.dll_DestroyEnvironmentBlock
nop
lea rcx, [rbp + 0x80]
mov edx, 2
call fcn.0040ef20
movzx rax, byte [rbp + 0x67]
lea rsp, [rbp + 0x138]
pop rbx
pop rbp
ret
Function at 0x6ddde0
Capabilities:
Create process on windows

Disassembly:
push rbp
push r13
push rdi
push rsi
push rbx
sub rsp, 0x110
mov rbp, rsp
mov rbx, rcx
mov rsi, rdx
mov rdi, r8
xor rax, rax
mov byte [rbp + 0x6f], al
lea rcx, [0x006ddf40]
call fcn.006dd8a0
mov r13d, eax
lea rcx, [rbp + 0x98]
mov edx, 0x68
xor r8, r8
call fcn.0040aa60
mov dword [rbp + 0x98], 0x68
lea rax, [0x006ddf5a]
mov qword [rbp + 0xa8], rax
mov word [rbp + 0xd8], 1
call sub.kernel32.dll_WTSGetActiveConsoleSessionId
mov ecx, eax
lea rdx, [rbp + 0x100]
call sub.wtsapi32.dll_WTSQueryUserToken
test eax, eax
je 0x6ddefe
mov ecx, 0x1fffff
xor rdx, rdx
mov r8d, r13d
call sub.kernel32.dll_OpenProcess
mov rcx, rax
mov edx, 0x2000000
lea r8, [rbp + 0x108]
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x6ddefe
lea rcx, [rbp + 0x78]
mov rdx, qword [rbp + 0x100]
or r8d, 0xffffffff
call sub.userenv.dll_CreateEnvironmentBlock
test eax, eax
je 0x6ddefe
mov rcx, qword [rbp + 0x108]
mov rdx, rbx
mov r8, rsi
xor r9, r9
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x30], 0x400
mov rax, qword [rbp + 0x78]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rdi
lea rax, [rbp + 0x98]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x80]
mov qword [rsp + 0x50], rax
call sub.advapi32.dll_CreateProcessAsUserW
test eax, eax
je 0x6ddefe
mov al, 1
mov byte [rbp + 0x6f], al
mov rcx, qword [rbp + 0x108]
call sub.kernel32.dll_CloseHandle_3
mov rcx, qword [rbp + 0x100]
call sub.kernel32.dll_CloseHandle_3
mov rcx, qword [rbp + 0x78]
call sub.userenv.dll_DestroyEnvironmentBlock
movzx rax, byte [rbp + 0x6f]
lea rsp, [rbp + 0x110]
pop rbx
pop rsi
pop rdi
pop r13
pop rbp
ret
Function at 0x6dfef0
Capabilities:
Create process on windows

Disassembly:
push rbp
sub rsp, 0x3a0
mov rbp, rsp
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x78], 0
mov qword [rbp + 0x80], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0xa0], 0
mov qword [rbp + 0x98], 0
mov qword [rbp + 0x90], 0
mov qword [rbp + 0x3b0], rcx
mov qword [rbp + 0x3b8], rdx
mov rcx, qword [rbp + 0x3b0]
call fcn.0040efd0
mov rcx, qword [rbp + 0x3b8]
call fcn.0040efd0
nop
lea rcx, [rbp + 0x88]
lea rdx, [0x00730f90]
mov r8d, 3
call fcn.006de850
lea rcx, [rbp + 0xa0]
mov rdx, qword [rbp + 0x88]
call fcn.00410750
lea rcx, [rbp + 0x80]
lea rdx, [0x00730fb0]
mov r8d, 7
call fcn.006de850
lea rcx, [rbp + 0x98]
mov rdx, qword [rbp + 0x80]
call fcn.00410750
lea rcx, [rbp + 0x78]
mov rdx, qword [rbp + 0x3b0]
mov r8, qword [rbp + 0x98]
call fcn.00410a60
lea rcx, [rbp + 0xa8]
mov rdx, qword [rbp + 0x78]
xor r8, r8
call fcn.0040a870
call fcn.00408cf0
lea rcx, [rbp + 0xa8]
call fcn.0040a410
call fcn.00408cf0
lea rcx, [rbp + 0x70]
lea rdx, [0x00730ff0]
mov r8d, 0x33
call fcn.006de850
lea rcx, [rbp + 0x90]
mov rdx, qword [rbp + 0x70]
call fcn.00410750
lea rcx, [rbp + 0xa8]
mov rdx, qword [rbp + 0x90]
call fcn.0040b2c0
mov rcx, rax
call fcn.0040b430
call fcn.00408cf0
lea rcx, [rbp + 0x68]
lea rdx, [0x00731190]
mov r8d, 0x15
call fcn.006de850
lea rcx, [rbp + 0x90]
mov rdx, qword [rbp + 0x68]
call fcn.00410750
lea rcx, [rbp + 0x60]
mov edx, 3
mov r8, qword [rbp + 0x90]
mov r9, qword [rbp + 0x3b8]
lea rax, [0x006e0390]
mov qword [rsp + 0x20], rax
call fcn.00410b80
lea rcx, [rbp + 0xa8]
mov rdx, qword [rbp + 0x60]
call fcn.0040b2c0
mov rcx, rax
call fcn.0040b430
call fcn.00408cf0
lea rcx, [rbp + 0x58]
lea rdx, [0x00731240]
mov r8d, 0x34
call fcn.006de850
lea rcx, [rbp + 0x90]
mov rdx, qword [rbp + 0x58]
call fcn.00410750
lea rcx, [rbp + 0xa8]
mov rdx, qword [rbp + 0x90]
call fcn.0040b2c0
mov rcx, rax
call fcn.0040b430
call fcn.00408cf0
lea rcx, [rbp + 0x50]
lea rdx, [0x007313e8]
mov r8d, 0x31
call fcn.006de850
lea rcx, [rbp + 0x90]
mov rdx, qword [rbp + 0x50]
call fcn.00410750
lea rcx, [rbp + 0xa8]
mov rdx, qword [rbp + 0x90]
call fcn.0040b2c0
mov rcx, rax
call fcn.0040b430
call fcn.00408cf0
lea rcx, [rbp + 0xa8]
call fcn.0040a9f0
call fcn.00408cf0
lea rcx, [rbp + 0x48]
mov rdx, qword [rbp + 0xa0]
call fcn.004107b0
lea rcx, [rbp + 0x40]
mov rdx, qword [rbp + 0x3b0]
mov r8, qword [rbp + 0x98]
call fcn.00410a60
mov rcx, qword [rbp + 0x40]
call fcn.00410600
lea rcx, [rbp + 0x38]
mov rdx, rax
call fcn.00410220
xor rcx, rcx
mov rdx, qword [rbp + 0x48]
mov r8, qword [rbp + 0x38]
xor r9, r9
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
call sub.shell32.dll_ShellExecuteW
nop
lea rcx, [rbp + 0x38]
call fcn.0040eee0
lea rcx, [rbp + 0x40]
call fcn.0040ee40
lea rcx, [rbp + 0x48]
call fcn.0040eee0
lea rcx, [rbp + 0x50]
mov edx, 2
call fcn.0040ef50
lea rcx, [rbp + 0x60]
call fcn.0040ee40
lea rcx, [rbp + 0x68]
push 0x2c2c7
add byte [rax], al
Function at 0x1400115c8
Capabilities:
Terminate process

Disassembly:
jmp 0x140021ea0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret

Function at 0x14001171c
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400229d0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400229f0
xor al, al
jmp 0x140022a71
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140022a03
xor al, al
jmp 0x140022a71
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140022a2d
xor al, al
jmp 0x140022a71
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140022a41
xor al, al
jmp 0x140022a71
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140022a53
xor al, al
jmp 0x140022a71
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140022a6f
xor al, al
jmp 0x140022a71
mov al, 1
add rsp, 0x38
ret
Function at 0x14001195b
Capabilities:
Write file on windows

Disassembly:
jmp 0x14001a970
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1a8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x2e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1c8]
mov rax, qword [0x140031040]
xor rax, rbp
mov qword [rbp + 0x168], rax
lea rcx, [0x1400390f2]
call fcn.1400119e7
nop
mov rax, qword [rbp + 0x190]
cmp qword [rax + 0x68], 0
je 0x14001a9d7
mov rax, qword [rbp + 0x190]
movzx eax, byte [rax + 0x72]
test eax, eax
jne 0x14001a9de
mov al, 1
jmp 0x14001ab33
call fcn.140011398
mov rcx, qword [rbp + 0x190]
mov rcx, qword [rcx]
mov qword [rbp + 0x158], rcx
movzx edx, ax
mov rcx, qword [rbp + 0x190]
mov rax, qword [rbp + 0x158]
call qword [rax + 0x18]
mov word [rbp + 0x160], ax
call fcn.140011398
movzx ecx, word [rbp + 0x160]
movzx edx, cx
movzx ecx, ax
call fcn.140011429
movzx eax, al
test eax, eax
je 0x14001aa34
xor al, al
jmp 0x14001ab33
mov qword [rbp + 8], 0x20
lea rax, [rbp + 0x48]
mov rcx, qword [rbp + 0x190]
add rcx, 0x74
lea rdx, [rbp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rbp + 0x28]
mov rdx, rcx
mov rax, qword [rbp + 0x190]
mov rcx, qword [rax + 0x68]
call qword [sym.imp.MSVCP140D.dll_public:_int___cdecl_std::codecvt_wchar_t__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rbp + 0x154], eax
cmp dword [rbp + 0x154], 0
je 0x14001aa99
cmp dword [rbp + 0x154], 1
je 0x14001aaa4
cmp dword [rbp + 0x154], 3
je 0x14001ab22
jmp 0x14001ab31
mov rax, qword [rbp + 0x190]
mov byte [rax + 0x72], 0
lea rax, [rbp + 0x28]
mov rcx, qword [rbp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jbe 0x14001aaf4
mov rax, qword [rbp + 0x190]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x88]
mov edx, 1
lea rcx, [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_fwrite]
cmp qword [rbp + 0x88], rax
je 0x14001aaf4
xor al, al
jmp 0x14001ab33
mov rax, qword [rbp + 0x190]
movzx eax, byte [rax + 0x72]
test eax, eax
jne 0x14001ab0f
mov dword [rbp + 0x154], 1
jmp 0x14001ab19
mov dword [rbp + 0x154], 0
movzx eax, byte [rbp + 0x154]
jmp 0x14001ab33
mov rax, qword [rbp + 0x190]
mov byte [rax + 0x72], 0
mov al, 1
jmp 0x14001ab33
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x14002a790]
call fcn.140011857
mov rax, rdi
mov rcx, qword [rbp + 0x168]
xor rcx, rbp
call fcn.1400114ce
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret
Function at 0x140020280
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.140011a55
movzx eax, al
test eax, eax
jne 0x1400202a0
mov ecx, 7
call fcn.14001186b
nop
mov byte [rsp + 0x20], 0
call fcn.1400118c0
mov byte [rsp + 0x21], al
cmp dword [0x140031770], 1
jne 0x1400202c4
mov ecx, 7
call fcn.14001186b
nop
jmp 0x14002031c
cmp dword [0x140031770], 0
jne 0x140020317
mov dword [0x140031770], 1
lea rdx, [0x140029770]
lea rcx, [0x140029440]
call fcn.1400114a6
test eax, eax
je 0x1400202f8
mov eax, 0xff
jmp 0x140020421
lea rdx, [0x140029330]
lea rcx, [section..rdata]
call fcn.1400118a7
mov dword [0x140031770], 2
jmp 0x14002031c
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.14001184d
call fcn.140011749
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140020379
mov rcx, qword [rsp + 0x30]
call fcn.1400113d9
movzx eax, al
test eax, eax
je 0x140020379
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x14003a020]
nop
call fcn.1400117b2
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x1400203ad
mov rcx, qword [rsp + 0x38]
call fcn.1400113d9
movzx eax, al
test eax, eax
je 0x1400203ad
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.1400119b0
nop
call fcn.1400204d0
mov dword [rsp + 0x28], eax
call fcn.14001171c
movzx eax, al
test eax, eax
jne 0x1400203cc
mov ecx, dword [rsp + 0x28]
call fcn.1400110c8
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x1400203db
call fcn.1400119ce
nop
xor edx, edx
mov cl, 1
call fcn.140011393
mov eax, dword [rsp + 0x28]
jmp 0x140020421
add rsp, 0x68
ret