joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d3390
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x170
mov rax, qword [0x1402ba4e0]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov ebx, r8d
mov rdi, rdx
mov rsi, rcx
test rdx, rdx
je 0x1400d34f8
cmp byte [rdx], 0
je 0x1400d34f8
lea rax, [rsp + 0x48]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test ebx, ebx
je 0x1400d3408
test eax, eax
je 0x1400d3410
lea rax, [rsp + 0x48]
mov r9d, 0xf013f
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400d34d3
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x1a0], rbp
mov qword [rsp + 0x38], rax
xor ebp, ebp
lea r9, [rsp + 0x40]
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x60]
xor edx, edx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x40], 0x100
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x1400d34b4
nop word [rax + rax]
mov rcx, qword [rsp + 0x48]
lea rdx, [rsp + 0x60]
xor r8d, r8d
call fcn.1400d3390
mov rcx, qword [rsp + 0x48]
mov ebx, eax
test eax, eax
jne 0x1400d34ee
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
xor edx, edx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x40], 0x100
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x1400d3460
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov rbp, qword [rsp + 0x1a0]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.14010d170
add rsp, 0x170
pop rdi
pop rsi
pop rbx
ret
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x1400d34cb
mov eax, 0x32
jmp 0x1400d34d3
Function at 0x1400d35d0
Capabilities:
Get hostname

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x2a0
mov rax, qword [0x1402ba4e0]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rsi, qword [rsp + 0x2f8]
mov rbp, r9
mov rbx, r8
mov r12, rdx
mov rdi, rcx
test rdx, rdx
je 0x1400d3741
test rcx, rcx
je 0x1400d3741
test rbx, rbx
je 0x1400d3741
lea rcx, [rsp + 0x61]
xor edx, edx
mov r8d, 0x103
mov qword [rsp + 0x298], r13
mov dword [rsp + 0x54], 0x103
mov byte [rsp + 0x60], 0
call fcn.14010da60
lea rcx, [rsp + 0x171]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x170], 0
call fcn.14010da60
lea rdx, [rsp + 0x54]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
xor r13d, r13d
cmp byte [rsp + 0x60], 0x5c
jne 0x1400d3695
mov ecx, r13d
movzx eax, byte [rsp + rcx + 0x60]
inc rcx
mov byte [rsp + rcx + 0x16f], al
test al, al
jne 0x1400d3680
jmp 0x1400d36ae
lea r8, [rsp + 0x60]
lea rdx, [0x140230a1c]
lea rcx, [rsp + 0x170]
call fcn.14010d754
lea rdx, [rsp + 0x170]
mov rcx, rdi
call fcn.14010feb4
mov r8, rsi
mov rdx, r12
test eax, eax
mov qword [rsi], r13
cmove rdi, r13
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegConnectRegistryA]
test eax, eax
jne 0x1400d3737
mov rcx, qword [rsi]
xor r8d, r8d
mov rdx, rbx
cmp dword [rsp + 0x2f0], r13d
je 0x1400d3726
lea rax, [rsp + 0x50]
xor r9d, r9d
mov dword [rsp + 0x50], r13d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], r13d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov r13, qword [rsp + 0x298]
jmp 0x1400d3746
mov r9d, 0xf003f
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov r13, qword [rsp + 0x298]
jmp 0x1400d3746
mov eax, 0x32
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.14010d170
add rsp, 0x2a0
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400d3770
Capabilities:
Get hostname

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x4b8
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov rax, qword [0x1402ba4e0]
xor rax, rsp
mov qword [rsp + 0x4a0], rax
mov rsi, r9
mov rbx, r8
mov r13, rdx
mov r12, rcx
mov rdi, qword [rsp + 0x518]
mov dword [rsp + 0x50], 0x32
test rdx, rdx
je 0x1400d38d9
test rcx, rcx
je 0x1400d38d9
test rbx, rbx
je 0x1400d38d9
mov byte [rsp + 0x70], 0
mov dword [rsp + 0x54], 0x103
mov byte [rsp + 0x390], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0x391]
call fcn.14010da60
mov byte [rsp + 0x280], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0x281]
call fcn.14010da60
lea rdx, [rsp + 0x54]
lea rcx, [rsp + 0x390]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea rdx, [rsp + 0x280]
lea rcx, [rsp + 0x390]
call fcn.1400cf140
lea rdx, [rsp + 0x280]
mov rcx, r12
call fcn.14010feb4
xor r14d, r14d
test eax, eax
cmove r12, r14
mov qword [rdi], r14
mov r8, rdi
mov rdx, r13
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegConnectRegistryA]
mov dword [rsp + 0x50], eax
test eax, eax
jne 0x1400d38d1
xor r8d, r8d
mov rdx, rbx
cmp dword [rsp + 0x510], r14d
je 0x1400d38b9
mov dword [rsp + 0x58], r14d
lea rax, [rsp + 0x58]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r14d
xor r9d, r9d
mov rcx, qword [rdi]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
jmp 0x1400d38cd
mov qword [rsp + 0x20], rsi
mov r9d, 0xf013f
mov rcx, qword [rdi]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [rsp + 0x50], eax
jmp 0x1400d38de
mov eax, 0x32
mov rcx, qword [rsp + 0x4a0]
xor rcx, rsp
call fcn.14010d170
add rsp, 0x4b8
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret

Function at 0x1400d3a60
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x40
mov rdi, r9
test rdx, rdx
je 0x1400d3b10
test rcx, rcx
je 0x1400d3b10
test r8, r8
je 0x1400d3b10
test r9, r9
je 0x1400d3b10
xor r9d, r9d
lea rax, [r11 - 0x18]
mov qword [r11 + 8], rbx
mov qword [r11 - 0x20], rax
mov dword [r11 - 0x28], r9d
mov qword [r11 - 0x18], r9
mov qword [r11 + 0x10], r9
lea r9, [r11 + 0x10]
call fcn.1400d35d0
mov ebx, eax
test eax, eax
jne 0x1400d3af3
mov rax, qword [rsp + 0x80]
mov r9, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x78]
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x58]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400d3b03
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
mov eax, 0x32
add rsp, 0x40
pop rdi
ret
Function at 0x1400d3c20
Capabilities:
Set registry value

Disassembly:
push rdi
sub rsp, 0x40
mov rdi, r9
test rdx, rdx
je 0x1400d3ccf
test rcx, rcx
je 0x1400d3ccf
test r8, r8
je 0x1400d3ccf
xor eax, eax
lea r9, [rsp + 0x58]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x88]
mov dword [rsp + 0x20], eax
call fcn.1400d35d0
mov ebx, eax
test eax, eax
jne 0x1400d3cb2
mov eax, dword [rsp + 0x78]
mov r9d, dword [rsp + 0x80]
mov rcx, qword [rsp + 0x58]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x70]
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400d3cc2
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
mov eax, 0x32
add rsp, 0x40
pop rdi
ret
Function at 0x1400d3eb0
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x3a0
mov rax, qword [0x1402ba4e0]
xor rax, rsp
mov qword [rsp + 0x390], rax
mov rsi, rcx
mov qword [rsp + 0x20], rcx
mov ebp, 1
test rcx, rcx
je 0x1400d40a1
cmp byte [rcx], 0
je 0x1400d40a1
call fcn.1400cfaf0
test eax, eax
jne 0x1400d3efe
mov eax, ebp
jmp 0x1400d40a3
lea rdx, [rsp + 0x280]
mov qword [rsp + 0x3c0], rdi
mov rcx, rsi
sub rdx, rsi
nop word [rax + rax]
movzx eax, byte [rcx]
inc rcx
mov byte [rdx + rcx - 1], al
test al, al
jne 0x1400d3f20
lea rcx, [rsp + 0x280]
call fcn.1400c9bc0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x280]
lea rdx, [rsp + 0x30]
repne scasb al, byte [rdi]
mov eax, dword [0x1401eefbc]
lea rcx, [rsp + 0x280]
mov dword [rdi - 1], eax
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov qword [rsp + 0x28], rax
cmp rax, 0xffffffffffffffff
je 0x1400d4067
mov qword [rsp + 0x3b8], rbx
lea rbx, [rsp + 0x170]
sub rbx, rsi
nop dword [rax]
mov rcx, rsi
nop word [rax + rax]
movzx eax, byte [rcx]
inc rcx
mov byte [rbx + rcx - 1], al
test al, al
jne 0x1400d3fa0
lea rcx, [rsp + 0x170]
call fcn.1400c9bc0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x170]
lea rdx, [rsp + 0x5c]
repne scasb al, byte [rdi]
xor ecx, ecx
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x1400d3fe0
test byte [rsp + 0x30], 0x10
je 0x1400d407c
lea rsi, [rsp + 0x5c]
lea rdi, [0x1401ee614]
mov ecx, 2
repe cmpsb byte [rsi], byte [rdi]
je 0x1400d4033
lea rsi, [rsp + 0x5c]
lea rdi, [0x1401eefb8]
mov ecx, 3
repe cmpsb byte [rsi], byte [rdi]
je 0x1400d4033
lea rcx, [rsp + 0x170]
call fcn.1400d3eb0
mov ebp, eax
mov rsi, qword [rsp + 0x20]
test ebp, ebp
je 0x1400d4054
mov rcx, qword [rsp + 0x28]
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1400d3f90
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rbx, qword [rsp + 0x3b8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov rdi, qword [rsp + 0x3c0]
mov eax, ebp
jmp 0x1400d40a3
lea rcx, [rsp + 0x170]
mov edx, 0x80
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ebp, eax
jmp 0x1400d4038
xor eax, eax
mov rcx, qword [rsp + 0x390]
xor rcx, rsp
call fcn.14010d170
mov rbp, qword [rsp + 0x3c8]
add rsp, 0x3a0
pop rsi
ret
Function at 0x1400d5560
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x1402ba4e0]
xor rax, rsp
mov qword [rbp + 0x170], rax
xor r12d, r12d
mov edi, r8d
mov rsi, rdx
mov rbx, rcx
test rcx, rcx
je 0x1400d5747
lea rcx, [rsp + 0x51]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x50], r12b
call fcn.14010da60
cmp byte [rbx], 0x5c
lea rcx, [rsp + 0x50]
jne 0x1400d55e0
sub rcx, rbx
nop word [rax + rax]
movzx eax, byte [rbx]
inc rbx
mov byte [rcx + rbx - 1], al
test al, al
jne 0x1400d55d0
jmp 0x1400d55ef
lea rdx, [0x140230a1c]
mov r8, rbx
call fcn.14010d754
lea rcx, [rbp + 0x61]
xor edx, edx
mov r8d, 0x103
mov byte [rbp + 0x60], r12b
call fcn.14010da60
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
lea r8, str.SoftwareMicrosoftWindows_NTCurrentVersion
lea rcx, [rsp + 0x50]
mov rdx, 0xffffffff80000002
mov dword [rsp + 0x20], r12d
mov dword [rsp + 0x44], 0x104
mov dword [rsp + 0x40], 1
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
call fcn.1400d35d0
mov ebx, eax
test eax, eax
jne 0x1400d568a
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x44]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x60]
lea rdx, str.SystemRoot
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x30]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400d569a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x1400d5730
test ebx, ebx
je 0x1400d5734
lea rax, [rsp + 0x38]
lea r9, [rsp + 0x30]
lea r8, str.SoftwareMicrosoftWindowsCurrentVersion
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x50]
mov rdx, 0xffffffff80000002
mov dword [rsp + 0x20], r12d
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
call fcn.1400d35d0
mov ebx, eax
test eax, eax
jne 0x1400d5720
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x44]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x60]
lea rdx, str.SystemRoot
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x30]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400d5730
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x1400d5747
lea rdx, [rbp + 0x60]
mov rcx, rsi
call fcn.1400ca6a0
mov eax, 1
jmp 0x1400d574a
mov eax, r12d
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.14010d170
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rbp
ret
Function at 0x1400d5780
Capabilities:
Check for foreground window switch
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x110
mov rbx, rdx
mov rdi, rcx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor edx, edx
lea rcx, [rsp + 0x70]
mov rbp, rax
lea r8d, [rdx + 0x68]
call fcn.14010da60
xor r11d, r11d
xor esi, esi
mov eax, 5
xor r9d, r9d
xor r8d, r8d
mov word [rsp + 0xb0], ax
lea rax, [rsp + 0x58]
mov rdx, rbx
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov rcx, rdi
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x20
mov qword [rsp + 0x58], r11
mov qword [rsp + 0x60], r11
mov dword [rsp + 0x20], esi
mov qword [rsp + 0x68], r11
mov dword [rsp + 0x70], 0x68
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov edi, eax
test eax, eax
jne 0x1400d582d
xor ecx, ecx
call fcn.1400d2d50
jmp 0x1400d58e7
mov dword [rsp + 0x138], esi
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rdx, [rsp + 0x138]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r11d, dword [rsp + 0x68]
cmp dword [rsp + 0x138], r11d
je 0x1400d586f
inc esi
cmp esi, 0x64
jb 0x1400d5834
mov rcx, qword [rsp + 0x58]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1400d58e7
lea rcx, [rsp + 0xe0]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 1
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x1400d58cb
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x50], eax
jne 0x1400d58cb
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rsp + 0x58]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x1400d5880
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbp
call qword [sym.imp.USER32.dll_SetForegroundWindow]
lea r11, [rsp + 0x110]
mov eax, edi
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400d5930
Capabilities:
Create process on windows
Terminate process

Disassembly:
mov r11, rsp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x140
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov rax, qword [0x1402ba4e0]
xor rax, rsp
mov qword [rsp + 0x130], rax
movzx esi, r9w
mov edi, r8d
mov r13, rdx
mov r12, rcx
xor ebx, ebx
mov dword [rsp + 0x50], ebx
mov rax, qword [str.landesk0]
mov qword [r11 - 0x58], rax
movzx eax, byte [0x140231590]
mov byte [r11 - 0x50], al
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0x10000000
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [r11 - 0x58]
call qword [sym.imp.USER32.dll_CreateDesktopA]
mov r14, rax
xor edx, edx
lea r8d, [rbx + 0x68]
lea rcx, [rsp + 0x80]
call fcn.14010da60
xor r11d, r11d
mov qword [rsp + 0x58], r11
mov qword [rsp + 0x60], r11
mov qword [rsp + 0x68], r11
mov dword [rsp + 0x80], 0x68
mov word [rsp + 0xc0], si
lea rax, [rsp + 0x120]
mov qword [rsp + 0x90], rax
mov r8d, dword [rsp + 0xbc]
mov eax, 5
mov r15d, 1
cmp ax, si
cmovne r8d, r15d
mov dword [rsp + 0xbc], r8d
lea rax, [rsp + 0x58]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
mov rdx, r13
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esi, eax
mov dword [rsp + 0x50], eax
test eax, eax
jne 0x1400d5a67
xor ecx, ecx
call fcn.1400d2d50
jmp 0x1400d5ac7
mov dword [rsp + 0x54], ebx
nop dword [rax + rax]
xor edx, edx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1400d5ac7
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0xf0]
call qword [sym.imp.USER32.dll_PeekMessageA]
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
add ebx, 0x32
mov dword [rsp + 0x54], ebx
test edi, edi
je 0x1400d5ac5
cmp ebx, edi
jb 0x1400d5ac5
xor edx, edx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x1400d5ac7
jmp 0x1400d5a70
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
call qword [sym.imp.USER32.dll_CloseDesktop]
nop
mov eax, esi
jmp 0x1400d5aef
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.14010d170
add rsp, 0x140
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400d5b20
Capabilities:
Create process on windows
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x110
mov rsi, r9
mov rbx, rdx
mov rdi, rcx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor edx, edx
lea rcx, [rsp + 0x70]
lea r8d, [rdx + 0x68]
mov r12, rax
call fcn.14010da60
mov ecx, dword [rsp + 0xac]
movzx edx, word [rsp + 0x150]
xor r11d, r11d
mov eax, 5
mov word [rsp + 0xb0], dx
cmp ax, dx
lea rax, [rsp + 0x50]
mov r13d, 1
mov qword [rsp + 0x48], rax
cmovne ecx, r13d
xor r14d, r14d
lea rax, [rsp + 0x70]
mov dword [rsp + 0xac], ecx
mov rdx, rbx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x28], 0x20
mov qword [rsp + 0x50], r11
mov qword [rsp + 0x58], r11
mov dword [rsp + 0x20], r14d
mov qword [rsp + 0x60], r11
mov dword [rsp + 0x70], 0x68
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ebp, eax
test eax, eax
jne 0x1400d5bff
xor ecx, ecx
call fcn.1400d2d50
jmp 0x1400d5c9c
mov rcx, qword [rsp + 0x50]
xor edx, edx
mov ebx, r14d
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1400d5c71
mov edi, dword [rsp + 0x158]
nop word [rax + rax]
lea rcx, [rsp + 0xe0]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], r13d
call qword [sym.imp.USER32.dll_PeekMessageA]
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
add ebx, 0x32
test edi, edi
je 0x1400d5c51
cmp ebx, edi
jae 0x1400d5c64
mov rcx, qword [rsp + 0x50]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x1400d5c20
jmp 0x1400d5c71
mov rcx, qword [rsp + 0x50]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test rsi, rsi
je 0x1400d5c9c
mov rcx, qword [rsp + 0x50]
lea rdx, [rsp + 0x150]
mov dword [rsp + 0x150], r14d
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov r11d, dword [rsp + 0x150]
mov dword [rsi], r11d
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r12
call qword [sym.imp.USER32.dll_SetForegroundWindow]
lea r11, [rsp + 0x110]
mov eax, ebp
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
ret
Function at 0x1400d6860
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
sub rsp, 0x170
mov rax, qword [0x1402ba4e0]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rdi, rdx
mov r12, rcx
mov rcx, rdx
lea rdx, [rsp + 0x40]
mov r13d, r9d
mov ebx, r8d
sub rdx, rcx
mov dword [rsp + 0x30], 0
movzx eax, byte [rcx]
inc rcx
mov byte [rdx + rcx - 1], al
test al, al
jne 0x1400d68a0
lea r8, [rsp + 0x30]
mov r9d, 1
mov edx, r13d
mov rcx, rdi
call fcn.1400d2410
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1400d6990
mov eax, dword [rsp + 0x30]
test eax, eax
jne 0x1400d6a07
lea r8, str.RT_RCDATA
movzx edx, bx
mov rcx, r12
mov qword [rsp + 0x168], rbp
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rbp, rax
test rax, rax
je 0x1400d6972
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, rbp
mov rcx, r12
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400d6978
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
je 0x1400d6978
lea r9, [rsp + 0x30]
mov r8d, ebx
mov rdx, rax
mov rcx, rsi
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400d6960
cmp dword [rsp + 0x30], ebx
jne 0x1400d6960
xor ebx, ebx
jmp 0x1400d697d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, 0x70
test eax, eax
cmovne ebx, eax
jmp 0x1400d697d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, 0x714
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbp, qword [rsp + 0x168]
jmp 0x1400d6994
mov ebx, dword [rsp + 0x30]
test ebx, ebx
jne 0x1400d6a05
test r13d, r13d
je 0x1400d6a05
lea rcx, [rsp + 0x40]
mov rdx, rdi
call fcn.14010d534
test eax, eax
je 0x1400d6a05
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x1400d69f4
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1400d6a01
lea rdx, str.MoveFileExA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400d6a01
lea r8d, [rbx + 5]
lea rdx, [rsp + 0x40]
mov rcx, rdi
call rax
xor eax, eax
jmp 0x1400d6a07
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.1400d49e0
xor eax, eax
jmp 0x1400d6a07
mov eax, ebx
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.14010d170
add rsp, 0x170
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret