joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001050
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov eax, 0x5a4d
mov ebp, r8d
mov r14d, edx
mov rdi, rcx
cmp word [rcx], ax
jne 0x14000115a
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x14000115a
mov ecx, 0x8664
cmp word [rax + 4], cx
jne 0x14000115a
mov ecx, 0x20b
cmp word [rax + 0x18], cx
jne 0x14000115a
cmp dword [rax + 0x84], 0
jbe 0x14000115a
cmp dword [rax + 0x8c], 0
je 0x14000115a
mov ecx, dword [rax + 0x88]
add rcx, rdi
je 0x14000115a
mov ebx, dword [rcx + 0x20]
xor r11d, r11d
mov r15d, dword [rcx + 0x24]
add rbx, rdi
mov r12d, dword [rcx + 0x1c]
add r15, rdi
mov esi, dword [rcx + 0x18]
add r12, rdi
test esi, esi
je 0x14000115a
nop dword [rax]
mov r10d, dword [rbx]
mov r9d, r14d
add r10, rdi
xor eax, eax
nop dword [rax + rax]
movsx ecx, byte [rax + r10]
movzx edx, cl
lea ecx, [rdx - 0x61]
cmp ecx, 0x19
lea r8d, [rdx - 0x20]
cmova r8d, edx
mov ecx, r8d
imul ecx, r8d
xor r9d, ecx
lea ecx, [r8 + r8*4]
rol r9d, 3
sub r9d, ecx
test r8d, r8d
je 0x140001149
inc rax
cmp rax, 0xffffffffffffffff
jne 0x140001110
cmp r9d, ebp
je 0x140001177
inc r11d
add rbx, 4
cmp r11d, esi
jb 0x140001100
xor eax, eax
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
pop r15
pop r14
pop r12
ret
movzx ecx, word [r15 + r11*2]
mov eax, dword [r12 + rcx*4]
add rax, rdi
jmp 0x14000115c

Function at 0x140002530
Capabilities:
Terminate process

Disassembly:
mov edx, 0x28
jmp 0x140002ce0

Function at 0x140002540
Capabilities:
Terminate process

Disassembly:
mov edx, 0x30
jmp 0x140002ce0
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rbx], rax
test rax, rax
jne 0x140002d0a
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov r8, rdi
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
jne 0x140002d2c
mov ecx, 0x1001
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400025d0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x58
xor r9d, r9d
lea rcx, [rsp + 0x20]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
cmp eax, 0xffffffff
je 0x140002622
nop dword [rax]
test eax, eax
je 0x14000262e
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_DispatchMessageW]
xor r9d, r9d
lea rcx, [rsp + 0x20]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
cmp eax, 0xffffffff
jne 0x1400025f0
mov ecx, 0x900
call qword [sym.imp.KERNEL32.dll_ExitProcess]
add rsp, 0x58
ret
Function at 0x140002640
Capabilities:
Read file on windows
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x140
xor esi, esi
mov rbx, rcx
mov dword [rcx + 0x28], esi
mov rcx, qword [rcx + 0x18]
cmp byte [rcx + 0x20], sil
je 0x14000272b
mov rcx, qword [rcx + 0x28]
lea r8d, [rsi + 7]
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], esi
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400026a4
mov ecx, 0x100
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea r9, [rsp + 0x150]
mov qword [rsp + 0x20], rsi
mov r8d, 0x100
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140002716
nop dword [rax]
mov ecx, dword [rsp + 0x150]
test ecx, ecx
je 0x140002722
lea rax, [rsp + 0x40]
cmp byte [rax], 0xa
jne 0x1400026e8
inc dword [rbx + 0x28]
inc rax
sub rcx, 1
jne 0x1400026e0
lea r9, [rsp + 0x150]
mov qword [rsp + 0x20], rsi
mov r8d, 0x100
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400026d0
mov ecx, 0x101
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0x140]
mov rax, rbx
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140002790
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xb0
call fcn.140002510
xor edi, edi
mov dword [rsp + 0x60], 0x50
mov rbx, rax
mov dword [rsp + 0x64], 0x23
lea rax, [0x140002d40]
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x80], rdi
call qword [sym.imp.USER32.dll_GetCursor]
vmovdqu xmm0, xmmword [0x140003140]
mov qword [rsp + 0x88], rax
lea rcx, [rsp + 0x60]
lea rax, str.window_class
mov qword [rsp + 0xa8], rdi
mov qword [rsp + 0xa0], rax
vmovdqu xmmword [rsp + 0x90], xmm0
call qword [sym.imp.USER32.dll_RegisterClassExW]
mov word [rbx + 0x10], ax
test ax, ax
jne 0x14000282b
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov qword [rsp + 0x58], rdi
lea r8, [0x14000310c]
mov qword [rsp + 0x50], rdi
mov r9d, 0xcf0000
mov qword [rsp + 0x48], rdi
mov ecx, 0x40000
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], 0x80000000
mov dword [rsp + 0x28], edi
movzx edx, ax
mov dword [rsp + 0x20], 0x80000000
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov qword [rbx + 0x18], rax
test rax, rax
jne 0x140002887
mov ecx, 0x401
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov qword [rsp + 0x58], rdi
lea r8, str.Create
mov qword [rsp + 0x50], rdi
lea rdx, str.BUTTON
mov qword [rsp + 0x48], 0x10
mov r9d, 0x50000000
mov qword [rsp + 0x40], rax
xor ecx, ecx
mov dword [rsp + 0x38], 0x14
mov dword [rsp + 0x30], 0xc8
mov dword [rsp + 0x28], 0xa
mov dword [rsp + 0x20], 0xa
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov qword [rbx + 0x20], rax
test rax, rax
jne 0x1400028f0
mov ecx, 0x402
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rax, qword [rbx + 0x18]
lea r8, [0x14000310c]
mov qword [rsp + 0x58], rdi
lea rdx, str.STATIC
mov qword [rsp + 0x50], rdi
mov r9d, 0x50000000
mov qword [rsp + 0x48], 0x20
xor ecx, ecx
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0x14
mov dword [rsp + 0x30], 0xc8
mov dword [rsp + 0x28], 0x28
mov dword [rsp + 0x20], 0xa
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov qword [rbx + 0x28], rax
test rax, rax
jne 0x14000295d
mov ecx, 0x403
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rax, rbx
mov rbx, qword [rsp + 0xc0]
add rsp, 0xb0
pop rdi
ret
Function at 0x140002c90
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
call fcn.1400024f0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
mov qword [rbx + 0x10], rax
lea rdx, [rbx + 0x18]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rbx + 0x20], rax
test rax, rax
jne 0x140002cca
mov ecx, 0x502
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x140002ce0
Capabilities:
Terminate process

Disassembly:
mov edx, 0x30
jmp 0x140002ce0
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rbx], rax
test rax, rax
jne 0x140002d0a
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov r8, rdi
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
jne 0x140002d2c
mov ecx, 0x1001
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x140037c00]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x140037c10]
mov dword [rax], 1
mov rax, qword [0x140037c20]
mov dword [rax], 1
mov rax, qword [0x140037bb0]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x140037bf0]
mov dword [0x14003f00c], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010b0
mov ecx, 2
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [0x140037ce0]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg.__p__commode
mov rdx, qword [0x140037cc0]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x140037b40]
cmp dword [rax], 1
je 0x1400010f8
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001110
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
mov rcx, qword [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a

Function at 0x1400014e4
Capabilities:
Execute command

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
lea rax, section..rdata
mov rdx, rax
lea rax, str.embedded.exe
mov rcx, rax
call sym.fopen
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
jne 0x140001529
lea rax, str.Error_while_opening_file
mov rcx, rax
call sym.puts
mov ecx, 1
call sym.exit
mov rax, qword [0x14003f030]
mov qword [rbp - 8], rax
jmp 0x14000155b
mov rax, qword [rbp - 8]
movzx eax, byte [rax]
movsx edx, al
mov rax, qword [rbp - 0x10]
mov r8d, edx
lea rdx, [0x140033029]
mov rcx, rax
call sym.fprintf
add qword [rbp - 8], 1
mov rax, qword [0x14003f038]
cmp qword [rbp - 8], rax
jne 0x140001536
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.fclose
lea rax, str.embedded.exe
mov rcx, rax
call sym.system
call sym.getchar
nop
add rsp, 0x30
pop rbp
ret

Function at 0x140001b93
Capabilities:
Create thread

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
lea r8, [sym.th_unhandledExceptionFilter]
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.msvcrt.dll__beginthreadex]
call rax
mov ecx, 0x64
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov eax, dword [0x140032a00]
add rsp, 0x30
pop rbp
ret

Function at 0x140001be6
Capabilities:
Create thread

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
lea r8, [sym.th_outputDebugString]
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.msvcrt.dll__beginthreadex]
call rax
mov ecx, 0x64
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov eax, dword [0x140032a04]
add rsp, 0x30
pop rbp
ret
Function at 0x140003008
Capabilities:
Switch active desktop

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov dword [rbp - 4], 1
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x182
mov r9d, 0
mov r8d, 0
mov edx, 0
lea rax, str.m_pcszNewDesktopName
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_CreateDesktopA]
call rax
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
jne 0x14000305e
mov eax, 0
jmp 0x14000307c
mov rax, qword [rbp - 0x10]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_SwitchDesktop]
call rax
test eax, eax
je 0x140003079
mov dword [rbp - 4], 0
mov eax, dword [rbp - 4]
add rsp, 0x40
pop rbp
ret

Function at 0x14000310f
Capabilities:
Get disk information

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rax, qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
call rax
mov dword [rbp - 8], eax
mov dword [rbp - 4], 0
jmp 0x140003188
mov eax, dword [rbp - 4]
mov edx, 1
mov ecx, eax
shl edx, cl
mov eax, edx
and eax, dword [rbp - 8]
test eax, eax
je 0x140003184
mov eax, dword [rbp - 4]
add eax, 0x41
movsx rax, al
lea rdx, [0x1400335a8]
add rax, rdx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetDriveTypeA]
call rax
cmp eax, 2
jne 0x140003184
mov eax, dword [rbp - 4]
add eax, 0x41
mov edx, eax
lea rax, str.USB_drive_detected:__c:_n
mov rcx, rax
call sym.printf_1
mov eax, 1
jmp 0x140003193
add dword [rbp - 4], 1
cmp dword [rbp - 4], 0x19
jle 0x14000312c
mov eax, 0
add rsp, 0x30
pop rbp
ret

Function at 0x1400032a7
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rdi
sub rsp, 0x458
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], rcx
mov qword [rbp + 0x3f8], rdx
mov qword [rbp + 0x400], r8
mov qword [rbp + 0x408], r9
mov qword [rbp + 0x3c8], 0
mov qword [rbp - 0x40], 0
mov qword [rbp - 0x38], 0
lea rdx, [rbp - 0x30]
mov eax, 0
mov ecx, 0x7e
mov rdi, rdx
rep stosq qword [rdi], rax
mov dword [rbp - 0x44], 0x104
mov rax, qword [rbp + 0x3f8]
lea rdx, [rbp + 0x3c8]
mov qword [rsp + 0x20], rdx
mov r9d, 0x20019
mov r8d, 0
mov rdx, rax
mov rcx, qword [rbp + 0x3f0]
mov rax, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call rax
test eax, eax
jne 0x1400033c9
mov rax, qword [rbp + 0x3c8]
mov rdx, qword [rbp + 0x400]
lea rcx, [rbp - 0x44]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp - 0x40]
mov qword [rsp + 0x20], rcx
mov r9d, 0
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call rax
test eax, eax
jne 0x1400033b6
mov rdx, qword [rbp + 0x408]
lea rax, [rbp - 0x40]
mov rcx, rax
mov rax, qword [sym.imp.SHELL32.dll_StrStrIA]
call rax
test rax, rax
je 0x1400033b6
mov rax, qword [rbp + 0x3c8]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
mov eax, 1
jmp 0x1400033ce
mov rax, qword [rbp + 0x3c8]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
mov eax, 0
add rsp, 0x458
pop rdi
pop rbp
ret
Function at 0x1400036bf
Capabilities:
Check if process is running under wine

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
lea rax, str.kernel32.dll
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x1400036ec
mov eax, 0
jmp 0x140003714
mov rax, qword [rbp - 8]
lea rdx, str.wine_get_unix_file_name
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
test rax, rax
jne 0x14000370f
mov eax, 0
jmp 0x140003714
mov eax, 1
add rsp, 0x30
pop rbp
ret

Function at 0x14000371a
Capabilities:
Check if process is running under wine

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov dword [rbp - 4], 0
lea rax, str.SOFTWAREWine
mov qword [rbp - 0x18], rax
mov word [rbp - 0xa], 1
mov dword [rbp - 8], 0
jmp 0x14000378f
mov eax, dword [rbp - 8]
cdqe
mov rax, qword [rbp + rax*8 - 0x18]
mov rdx, rax
mov rcx, 0xffffffff80000001
call sym.Is_RegKeyExists
test eax, eax
je 0x140003767
mov dword [rbp - 4], 1
mov eax, dword [rbp - 8]
cdqe
mov rax, qword [rbp + rax*8 - 0x18]
mov rdx, rax
mov rcx, 0xffffffff80000002
call sym.Is_RegKeyExists
test eax, eax
je 0x14000378b
mov dword [rbp - 4], 1
add dword [rbp - 8], 1
movzx eax, word [rbp - 0xa]
cmp dword [rbp - 8], eax
jl 0x140003743
mov eax, dword [rbp - 4]
add rsp, 0x40
pop rbp
ret
Function at 0x140004a11
Capabilities:
Enumerate processes

Disassembly:
push rbp
sub rsp, 0x160
lea rbp, [rsp + 0x80]
mov dword [rbp + 0xdc], 0
mov edx, 0
mov ecx, 2
call sym.CreateToolhelp32Snapshot
mov qword [rbp + 0xd0], rax
cmp qword [rbp + 0xd0], 0xffffffffffffffff
je 0x140004a6b
mov dword [rbp - 0x60], 0x130
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd0]
mov rcx, rax
call sym.Process32First
test eax, eax
jne 0x140004a92
jmp 0x140004a75
mov eax, 0
jmp 0x140004c24
mov rax, qword [rbp + 0xd0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
jmp 0x140004c24
lea rax, [rbp - 0x60]
add rax, 0x2c
lea rdx, str.vboxservice.exe
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_lstrcmpiA]
call rax
test eax, eax
jne 0x140004abb
mov dword [rbp + 0xdc], 1
lea rax, [rbp - 0x60]
add rax, 0x2c
lea rdx, str.vboxtray.exe
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_lstrcmpiA]
call rax
test eax, eax
jne 0x140004ae4
mov dword [rbp + 0xdc], 1
lea rax, [rbp - 0x60]
add rax, 0x2c
lea rdx, str.VGAuthService.exe
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_lstrcmpiA]
call rax
test eax, eax
jne 0x140004b0d
mov dword [rbp + 0xdc], 1
lea rax, [rbp - 0x60]
add rax, 0x2c
lea rdx, str.Vmacthlp.exe
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_lstrcmpiA]
call rax
test eax, eax
jne 0x140004b36
mov dword [rbp + 0xdc], 1
lea rax, [rbp - 0x60]
add rax, 0x2c
lea rdx, str.VMtoolsd.exe
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_lstrcmpiA]
call rax
test eax, eax
jne 0x140004b5f
mov dword [rbp + 0xdc], 1
lea rax, [rbp - 0x60]
add rax, 0x2c
lea rdx, str.VMwaretrat.exe
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_lstrcmpiA]
call rax
test eax, eax
jne 0x140004b88
mov dword [rbp + 0xdc], 1
lea rax, [rbp - 0x60]
add rax, 0x2c
lea rdx, str.VMwareUser.exe
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_lstrcmpiA]
call rax
test eax, eax
jne 0x140004bb1
mov dword [rbp + 0xdc], 1
lea rax, [rbp - 0x60]
add rax, 0x2c
lea rdx, str.VMwareService.exe
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_lstrcmpiA]
call rax
test eax, eax
jne 0x140004bda
mov dword [rbp + 0xdc], 1
lea rax, [rbp - 0x60]
add rax, 0x2c
lea rdx, str.VMwareTray.exe
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_lstrcmpiA]
call rax
test eax, eax
jne 0x140004c03
mov dword [rbp + 0xdc], 1
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd0]
mov rcx, rax
call sym.Process32Next
test eax, eax
jne 0x140004a92
mov eax, dword [rbp + 0xdc]
add rsp, 0x160
pop rbp
ret
Function at 0x140004ee5
Capabilities:
Enumerate process modules

Disassembly:
push rbp
mov eax, 0x1040
call fcn.140010ab0
sub rsp, rax
lea rbp, [rsp + 0x80]
lea rdx, [rbp - 0x54]
lea rax, [rbp - 0x50]
mov r8, rdx
mov edx, 0x1000
mov rcx, rax
call sym.K32EnumProcesses
test eax, eax
jne 0x140004f1e
mov eax, 1
jmp 0x140004f82
mov eax, dword [rbp - 0x54]
shr eax, 2
mov dword [rbp + 0xfb4], eax
mov dword [rbp + 0xfb8], 0
jmp 0x140004f6b
mov eax, dword [rbp + 0xfb8]
mov eax, dword [rbp + rax*4 - 0x50]
test eax, eax
je 0x140004f64
mov eax, dword [rbp + 0xfb8]
mov eax, dword [rbp + rax*4 - 0x50]
mov ecx, eax
call sym.checkProcessName
mov dword [rbp + 0xfbc], eax
cmp dword [rbp + 0xfbc], 0
jne 0x140004f7b
add dword [rbp + 0xfb8], 1
mov eax, dword [rbp + 0xfb8]
cmp eax, dword [rbp + 0xfb4]
jb 0x140004f36
jmp 0x140004f7c
nop
mov eax, dword [rbp + 0xfbc]
add rsp, 0x1040
pop rbp
ret

Function at 0x140005412
Capabilities:
Link many functions at runtime

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
lea rax, [0x140033e0c]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
call rax
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
lea rdx, [0x140033e16]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov rdx, qword [0x140037d20]
mov qword [rdx], rax
mov rax, qword [rbp - 8]
lea rdx, str.NtCreateFile
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [0x14003f060], rax
mov rax, qword [rbp - 8]
lea rdx, str.NtCreateEvent
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [0x14003f068], rax
mov rax, qword [rbp - 8]
lea rdx, str.NtQueryDirectoryFile
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [0x14003f070], rax
mov rax, qword [rbp - 8]
lea rdx, str.NtWaitForSingleObject
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [0x14003f078], rax
mov rax, qword [rbp - 8]
lea rdx, str.RtlUnicodeStringToAnsiString
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [0x14003f080], rax
mov rax, qword [rbp - 8]
lea rdx, str.NtClose
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [0x14003f088], rax
mov rax, qword [rbp - 8]
lea rdx, str.NtOpenFile
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [0x14003f090], rax
mov rax, qword [rbp - 8]
lea rdx, str.NtQueryAttributesFile
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [0x14003f098], rax
nop
add rsp, 0x30
pop rbp
ret
Function at 0x14000627a
Capabilities:
Get process image filename

Disassembly:
push rbp
sub rsp, 0x220
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x194], 0x1f4
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov rcx, rax
mov edx, dword [rbp + 0x194]
lea rax, [rbp - 0x60]
mov r8d, edx
mov rdx, rax
call sym.K32GetProcessImageFileNameA
mov qword [rbp + 0x198], 0
jmp 0x1400062fb
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0x198]
add rax, rdx
movzx eax, byte [rax]
movsx eax, al
mov ecx, eax
mov rax, qword [sym.imp.msvcrt.dll_toupper]
call rax
mov edx, eax
lea rcx, [rbp - 0x60]
mov rax, qword [rbp + 0x198]
add rax, rcx
mov byte [rax], dl
add qword [rbp + 0x198], 1
lea rax, [rbp - 0x60]
mov rcx, rax
call sym.strlen
cmp qword [rbp + 0x198], rax
jb 0x1400062c2
lea rax, [rbp - 0x60]
lea rdx, str.SAMPLE
mov rcx, rax
call sym.strstr
test rax, rax
je 0x14000632f
mov eax, 1
jmp 0x140006372
lea rax, [rbp - 0x60]
lea rdx, str.VIRUS
mov rcx, rax
call sym.strstr
test rax, rax
je 0x14000634e
mov eax, 1
jmp 0x140006372
lea rax, [rbp - 0x60]
lea rdx, str.SANDBOX
mov rcx, rax
call sym.strstr
test rax, rax
je 0x14000636d
mov eax, 1
jmp 0x140006372
mov eax, 0
add rsp, 0x220
pop rbp
ret

Function at 0x14000682a
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push rbp
sub rsp, 0x7d0
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x74c], 0
lea rax, [rbp + 0x530]
mov qword [rsp + 0x20], rax
mov r9d, 0
mov r8d, 0
mov edx, 8
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
call rax
test eax, eax
js 0x1400069dc
lea rdx, [rbp + 0x530]
lea rax, [rbp + 0xd0]
mov r8, rdx
mov edx, 0x104
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll_wcscpy_s]
call rax
lea rax, [rbp + 0xd0]
lea r8, [0x140034cf2]
mov edx, 0x104
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll_wcscat_s]
call rax
lea rdx, [rbp + 0x2e0]
lea rax, [rbp + 0xd0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FindFirstFileW]
call rax
mov qword [rbp + 0x740], rax
cmp qword [rbp + 0x740], 0xffffffffffffffff
je 0x1400069cc
lea rax, [rbp + 0x2e0]
lea rdx, [rax + 0x2c]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x104
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
mov r8, rdx
mov edx, 0
mov ecx, 0xfde9
mov rax, qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
call rax
mov eax, dword [rbp + 0x2e0]
and eax, 0x10
test eax, eax
jne 0x140006996
lea rax, [rbp - 0x40]
mov rcx, rax
call sym.removeExtension
lea rax, [rbp - 0x40]
mov rcx, rax
call sym.isBlacklisted
test eax, eax
je 0x140006977
lea rax, [rbp - 0x40]
mov rdx, rax
lea rax, str.Blacklisted_file:__s_n
mov rcx, rax
call sym.printf_4
mov eax, 1
jmp 0x1400069e1
lea rax, [rbp - 0x40]
mov rdx, rax
lea rax, str.Not_blacklisted_file:__s_n
mov rcx, rax
call sym.printf_4
add dword [rbp + 0x74c], 1
jmp 0x140006997
nop
lea rdx, [rbp + 0x2e0]
mov rax, qword [rbp + 0x740]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FindNextFileW]
call rax
test eax, eax
jne 0x1400068e7
mov rax, qword [rbp + 0x740]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FindClose]
call rax
cmp dword [rbp + 0x74c], 4
jg 0x1400069dc
mov eax, 1
jmp 0x1400069e1
mov eax, 0
add rsp, 0x7d0
pop rbp
ret