joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180082730
Capabilities:
Resume thread

Disassembly:
push rdi
sub rsp, 0x20
mov r8, qword [rcx]
mov rdi, rcx
test r8, r8
je 0x1800827a1
mov qword [rsp + 0x30], rbx
xor ebx, ebx
cmp dword [rcx + 0xc], ebx
jbe 0x18008278d
mov qword [rsp + 0x38], rsi
mov rax, qword [rdi]
xor edx, edx
mov r8d, dword [rax + rbx*4]
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x18008277e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, dword [rdi + 0xc]
jb 0x180082752
mov r8, qword [rdi]
mov rsi, qword [rsp + 0x38]
mov rcx, qword [0x1800bb580]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180082860
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov rdi, rcx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r14, qword [rsp + 0x28]
cmp rdi, 0x40000000
jbe 0x18008289b
lea rax, [rdi - 0x40000000]
cmp r14, rax
cmovb r14, rax
mov rsi, qword [0x1800beb08]
lea r15, [rdi + 0x40000000]
cmp qword [rsp + 0x30], r15
cmovbe r15, qword [rsp + 0x30]
sub r15, 0xfff
test rsi, rsi
je 0x1800828dd
cmp rsi, r14
jb 0x1800828d5
cmp rsi, r15
jae 0x1800828d5
cmp qword [rsi + 8], 0
jne 0x180082a9d
mov rsi, qword [rsi]
test rsi, rsi
jne 0x1800828c0
mov qword [rsp + 0xa0], rbx
mov rbx, rdi
mov qword [rsp + 0xa8], rbp
cmp rdi, r14
jb 0x180082962
nop word [rax + rax]
mov ebp, dword [rsp + 0x48]
mov rax, rbx
xor edx, edx
div rbp
sub rbx, rdx
sub rbx, rbp
cmp rbx, r14
jb 0x180082959
nop word [rax + rax]
mov r8d, 0x30
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x180082959
cmp dword [rsp + 0x70], 0x10000
je 0x1800829db
mov rbx, qword [rsp + 0x58]
cmp rbx, rbp
jb 0x180082959
sub rbx, rbp
cmp rbx, r14
jae 0x180082920
test rsi, rsi
jne 0x180082a46
cmp rdi, r15
ja 0x180082a8d
nop dword [rax + rax]
mov ebp, dword [rsp + 0x48]
xor edx, edx
mov rax, rdi
mov ebx, ebp
div rbp
mov eax, ebp
sub rax, rdx
add rax, rdi
mov rdi, rax
cmp rax, r15
ja 0x180082a8d
mov r8d, 0x30
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x180082a8d
cmp dword [rsp + 0x70], 0x10000
je 0x180082a14
xor edx, edx
lea edi, [rbp - 1]
add rdi, qword [rsp + 0x68]
add rdi, qword [rsp + 0x50]
mov rax, rdi
div rbx
sub rdi, rdx
cmp rdi, r15
jbe 0x180082992
jmp 0x180082a8d
test rbx, rbx
je 0x180082959
mov edx, 0x1000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x180082a46
cmp rbx, r14
jae 0x180082900
jmp 0x180082962
test rdi, rdi
je 0x180082a8d
mov edx, 0x1000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x180082a46
cmp rdi, r15
jbe 0x180082970
jmp 0x180082a8d
xor eax, eax
lea rcx, [rsi + 0x40]
mov rdx, rcx
mov qword [rsi + 8], rax
sub rdx, rsi
mov dword [rsi + 0x10], eax
nop dword [rax]
mov rax, qword [rsi + 8]
add rdx, 0x40
mov qword [rcx], rax
mov qword [rsi + 8], rcx
add rcx, 0x40
cmp rdx, 0xfc0
jbe 0x180082a60
mov rax, qword [0x1800beb08]
mov qword [rsi], rax
mov qword [0x1800beb08], rsi
mov rbp, qword [rsp + 0xa8]
mov rbx, qword [rsp + 0xa0]
mov rax, rsi
mov rsi, qword [rsp + 0xb0]
add rsp, 0x80
pop r15
pop r14
pop rdi
ret
Function at 0x180083690
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x1800836ca
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x1800836cf
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x180083718
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x1800963d0]
cmp byte [rcx + rax], 0
je 0x180083718
dec r8
sub rdx, 1
jne 0x1800836fe
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x140080726
Capabilities:
Terminate process

Disassembly:
jmp 0x14017ca80
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x1400808f2
Capabilities:
Parse pe header

Disassembly:
jmp 0x14017ed10
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14017ed30
xor al, al
jmp 0x14017edb1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14017ed43
xor al, al
jmp 0x14017edb1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14017ed6d
xor al, al
jmp 0x14017edb1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14017ed81
xor al, al
jmp 0x14017edb1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x14017ed93
xor al, al
jmp 0x14017edb1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14017edaf
xor al, al
jmp 0x14017edb1
mov al, 1
add rsp, 0x38
ret
Function at 0x140080e8d
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
jmp 0x1400856e0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x588
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xfa
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x5a8]
mov rax, qword [0x1401b7680]
xor rax, rbp
mov qword [rbp + 0x558], rax
lea rcx, [0x1401c53d5]
call fcn.140080d02
mov r8, qword [rbp + 0x580]
lea rdx, str._s
lea rcx, [rbp + 0x10]
call fcn.140080bf4
lea rdx, [rbp + 0x140]
lea rcx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov qword [rbp + 0x298], rax
cmp qword [rbp + 0x298], 0xffffffffffffffff
je 0x14008583f
lea rdx, [0x1401a0fd8]
lea rcx, [rbp + 0x16c]
call fcn.140080e60
test eax, eax
je 0x140085816
lea rdx, [0x140186cf4]
lea rcx, [rbp + 0x16c]
call fcn.140080e60
test eax, eax
je 0x140085816
lea r9, [rbp + 0x16c]
mov r8, qword [rbp + 0x580]
lea rdx, [0x140186dc4]
lea rcx, [rbp + 0x2c0]
call fcn.140080bf4
mov eax, dword [rbp + 0x140]
and eax, 0x10
test eax, eax
je 0x1400857ec
mov r8, qword [rbp + 0x590]
mov rdx, qword [rbp + 0x588]
lea rcx, [rbp + 0x2c0]
call fcn.140080e8d
jmp 0x140085816
mov rdx, qword [rbp + 0x588]
lea rcx, [rbp + 0x16c]
call fcn.140080e60
test eax, eax
jne 0x140085816
lea rdx, [rbp + 0x2c0]
mov rcx, qword [rbp + 0x590]
call fcn.140080429
lea rdx, [rbp + 0x140]
mov rcx, qword [rbp + 0x298]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x140085770
mov rcx, qword [rbp + 0x298]
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rcx, [rbp - 0x20]
lea rdx, [0x140187ba0]
call fcn.140080ab4
mov rcx, qword [rbp + 0x558]
xor rcx, rbp
call fcn.14008064a
lea rsp, [rbp + 0x568]
pop rdi
pop rbp
ret
Function at 0x140135dc0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x118
lea rbp, [rsp + 0x30]
lea rcx, [0x1401c54bb]
call fcn.140080d02
mov rax, qword [rbp + 0x100]
mov qword [rax], 0
mov ecx, 0x28
call fcn.14011b250
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x140135e16
mov eax, 7
jmp 0x140135ed9
cmp dword [0x1401b5034], 0
jne 0x140135e32
mov r8d, 0x28
xor edx, edx
mov rcx, qword [rbp + 8]
call fcn.1400809bf
jmp 0x140135e9c
mov rax, qword [rbp + 8]
mov rcx, qword [rbp + 0x108]
mov qword [rax + 0x10], rcx
mov rax, qword [rbp + 8]
mov rcx, qword [rbp + 0x110]
mov qword [rax + 0x18], rcx
mov rax, qword [rbp + 8]
add rax, 8
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, qword [rbp + 8]
lea r8, [0x140136030]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll__beginthreadex]
mov rcx, qword [rbp + 8]
mov qword [rcx], rax
mov rax, qword [rbp + 8]
cmp qword [rax], 0
jne 0x140135e9c
mov r8d, 0x28
xor edx, edx
mov rcx, qword [rbp + 8]
call fcn.1400809bf
mov rax, qword [rbp + 8]
cmp qword [rax + 0x10], 0
jne 0x140135ec9
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rcx, qword [rbp + 8]
mov dword [rcx + 8], eax
mov rcx, qword [rbp + 0x110]
call qword [rbp + 0x108]
mov rcx, qword [rbp + 8]
mov qword [rcx + 0x20], rax
mov rax, qword [rbp + 0x100]
mov rcx, qword [rbp + 8]
mov qword [rax], rcx
xor eax, eax
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x401f1b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
sub rsp, 0x198
lea rbp, [rsp + 0x80]
mov word [rbp + 0x60], 0x5c
mov word [rbp + 0x62], 0x4b
mov word [rbp + 0x64], 0x6e
mov word [rbp + 0x66], 0x6f
mov word [rbp + 0x68], 0x77
mov word [rbp + 0x6a], 0x6e
mov word [rbp + 0x6c], 0x44
mov word [rbp + 0x6e], 0x6c
mov word [rbp + 0x70], 0x6c
mov word [rbp + 0x72], 0x73
mov word [rbp + 0x74], 0x5c
mov word [rbp + 0x76], 0x6e
mov word [rbp + 0x78], 0x74
mov word [rbp + 0x7a], 0x64
mov word [rbp + 0x7c], 0x6c
mov word [rbp + 0x7e], 0x6c
mov word [rbp + 0x80], 0x2e
mov word [rbp + 0x82], 0x64
mov word [rbp + 0x84], 0x6c
mov word [rbp + 0x86], 0x6c
mov word [rbp + 0x88], 0
lea rdx, [rbp + 0x60]
lea rax, [rbp + 0x90]
mov rcx, rax
call sub.ntdll.dll_RtlInitUnicodeString
mov dword [rbp + 0x30], 0x30
mov qword [rbp + 0x38], 0
mov dword [rbp + 0x48], 0x40
lea rax, [rbp + 0x90]
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x58], 0
mov r9, qword [0x00b67040]
lea rdx, [rbp + 0x30]
lea rax, [rbp + 0x28]
mov r8, rdx
mov edx, 0xc
mov rcx, rax
call r9
mov dword [rbp + 0x24], eax
mov eax, dword [rbp + 0x24]
test eax, eax
jns 0x402094
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov ebx, eax
lea rax, [rbp + 0xb0]
lea rdx, [rbp + 0xaf]
mov rcx, rax
call fcn.00401c78
mov rax, qword [rbp + 0xb0]
mov qword [rbp - 0x30], rax
mov rax, qword [rbp + 0xb8]
mov qword [rbp - 0x28], rax
mov rax, qword [rbp + 0xc0]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp + 0xc8]
mov qword [rbp - 0x18], rax
mov rax, qword [rbp + 0xd0]
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x30]
mov edx, ebx
mov rcx, rax
call fcn.00424c00
mov eax, 0
jmp 0x40217f
mov qword [rbp + 0x18], 0
mov qword [rbp + 0x10], 0
mov qword [rbp + 0x108], 0
mov r10, qword [0x00b67038]
mov rcx, qword [rbp + 0x28]
lea rdx, [rbp + 0x18]
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 1
lea rax, [rbp + 0x10]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8, rdx
mov rdx, 0xffffffffffffffff
call r10
mov dword [rbp + 0xc], eax
mov eax, dword [rbp + 0xc]
test eax, eax
jns 0x40217b
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov ebx, eax
lea rax, [rbp + 0xe0]
lea rdx, [rbp + 0xdf]
mov rcx, rax
call fcn.00401dca
mov rax, qword [rbp + 0xe0]
mov qword [rbp - 0x30], rax
mov rax, qword [rbp + 0xe8]
mov qword [rbp - 0x28], rax
mov rax, qword [rbp + 0xf0]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp + 0xf8]
mov qword [rbp - 0x18], rax
mov rax, qword [rbp + 0x100]
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x30]
mov edx, ebx
mov rcx, rax
call fcn.00424c00
mov eax, 0
jmp 0x40217f
mov rax, qword [rbp + 0x18]
add rsp, 0x198
pop rbx
pop rbp
ret
Function at 0x40223b
Capabilities:
Allocate or change rwx memory
Enumerate pe sections
Execute shellcode via indirect call

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xa0
mov qword [rbp + 0x10], rcx
lea rcx, str.ntdll.dll
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov qword [rbp - 8], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x10], rax
mov rdx, qword [rbp + 0x10]
mov rax, qword [rbp - 0x10]
mov eax, dword [rax + 0x3c]
cdqe
add rax, rdx
mov qword [rbp - 0x50], rax
mov rax, qword [rbp - 0x50]
test rax, rax
jne 0x4022bf
lea rax, [rbp - 0x40]
lea rdx, [rbp - 0x41]
mov rcx, rax
call fcn.0040218a
mov rax, qword [rbp - 0x40]
mov qword [rbp - 0x80], rax
mov rax, qword [rbp - 0x38]
mov qword [rbp - 0x78], rax
mov eax, dword [rbp - 0x30]
mov dword [rbp - 0x70], eax
lea rax, [rbp - 0x80]
mov rcx, rax
call fcn.004247f0
mov eax, 0
jmp 0x4023f2
mov rax, qword [rbp - 0x50]
movzx eax, word [rax + 0x14]
movzx eax, ax
mov rdx, qword [rbp - 0x50]
add rax, rdx
add rax, 0x18
mov qword [rbp - 0x18], rax
mov dword [rbp - 0x54], 0
mov word [rbp - 0x1a], 0
mov rax, qword [rbp - 0x50]
movzx eax, word [rax + 6]
cmp word [rbp - 0x1a], ax
jae 0x4023f2
mov byte [rbp - 0x5a], 0x2e
mov byte [rbp - 0x59], 0x74
mov byte [rbp - 0x58], 0x65
mov byte [rbp - 0x57], 0x78
mov byte [rbp - 0x56], 0x74
mov byte [rbp - 0x55], 0
mov rcx, qword [rbp - 0x18]
lea rax, [rbp - 0x5a]
mov rdx, rax
call sub.ntdll.dll_strcmp
test eax, eax
jne 0x4023eb
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 8]
mov edx, eax
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xc]
mov ecx, eax
mov rax, qword [rbp - 8]
add rax, rcx
mov rcx, rax
lea rax, [rbp - 0x54]
mov r9, rax
mov r8d, 0x40
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov dword [rbp - 0x20], eax
cmp dword [rbp - 0x20], 0
jne 0x40236d
mov eax, 0
jmp 0x4023f2
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 8]
mov ecx, eax
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xc]
mov edx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov rdx, rax
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xc]
mov r8d, eax
mov rax, qword [rbp - 8]
add rax, r8
mov r8, rcx
mov rcx, rax
call sub.ntdll.dll_memcpy
mov edx, dword [rbp - 0x54]
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 8]
mov r10d, eax
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xc]
mov ecx, eax
mov rax, qword [rbp - 8]
add rax, rcx
mov rcx, rax
lea rax, [rbp - 0x54]
mov r9, rax
mov r8d, edx
mov rdx, r10
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov dword [rbp - 0x24], eax
cmp dword [rbp - 0x24], 0
jne 0x4023eb
mov eax, 0
jmp 0x4023f2
mov eax, 1
jmp 0x4023f2
add rsp, 0xa0
pop rbp
ret
Function at 0x402560
Capabilities:
Enumerate processes

Disassembly:
push rbp
sub rsp, 0x1b0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x140], rcx
mov qword [rbp + 0x120], 0
mov dword [rbp - 0x10], 0x130
mov edx, 0
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rbp + 0x128], rax
lea rax, [rbp - 0x10]
mov rcx, qword [rbp + 0x128]
mov rdx, rax
call sub.KERNEL32.dll_Process32First
cmp eax, 1
sete al
test al, al
je 0x4026f0
lea rax, [rbp - 0x10]
mov rcx, qword [rbp + 0x128]
mov rdx, rax
call sub.KERNEL32.dll_Process32Next
cmp eax, 1
sete al
test al, al
je 0x4026f0
lea rax, [rbp - 0x10]
add rax, 0x2c
mov rdx, qword [rbp + 0x140]
mov rcx, rax
call sub.msvcrt.dll__stricmp
test eax, eax
sete al
test al, al
je 0x4025c0
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call rax
mov ecx, eax
lea rax, [rbp - 0x14]
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
call rax
mov eax, dword [rbp - 8]
mov ecx, eax
call fcn.0040243f
mov edx, eax
mov eax, dword [rbp - 0x14]
cmp edx, eax
sete al
test al, al
je 0x4025c0
mov qword [rbp - 0x28], 0
mov eax, dword [rbp - 8]
mov ecx, eax
call fcn.004015a4
mov qword [rbp - 0x30], rax
mov dword [rbp - 0x60], 0x30
mov qword [rbp - 0x58], 0
mov dword [rbp - 0x48], 0
mov qword [rbp - 0x50], 0
mov qword [rbp - 0x40], 0
mov qword [rbp - 0x38], 0
mov r10, qword [0x00b67090]
lea rcx, [rbp - 0x30]
lea rdx, [rbp - 0x60]
lea rax, [rbp + 0x120]
mov r9, rcx
mov r8, rdx
mov edx, 0x1fffff
mov rcx, rax
call r10
mov rax, qword [rbp + 0x120]
test rax, rax
je 0x4026d4
mov rax, qword [rbp + 0x120]
cmp rax, 0xffffffffffffffff
je 0x4026d4
mov rax, qword [0x00b67088]
mov rdx, qword [rbp + 0x128]
mov rcx, rdx
call rax
mov rax, qword [rbp + 0x120]
jmp 0x40270a
mov rax, qword [0x00b67088]
mov rdx, qword [rbp + 0x128]
mov rcx, rdx
call rax
mov rax, 0xffffffffffffffff
jmp 0x40270a
mov rax, qword [0x00b67088]
mov rdx, qword [rbp + 0x128]
mov rcx, rdx
call rax
mov rax, 0xffffffffffffffff
add rsp, 0x1b0
pop rbp
ret
Function at 0x402713
Capabilities:
Create process on windows
Create process suspended
Protect spawned processes with mitigation policies
Spoof parent pid

Disassembly:
push rbp
push rdi
push rbx
mov rbp, rsp
sub rsp, 0xd0
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
lea rdx, [rbp - 0x70]
mov eax, 0
mov ecx, 0xe
mov rdi, rdx
rep stosq qword [rdi], rax
mov rax, qword [rbp + 0x20]
mov qword [rax], 0
mov qword [rax + 8], 0
mov qword [rax + 0x10], 0
lea rax, [rbp - 0x78]
mov r9, rax
mov r8d, 0
mov edx, 2
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
call rax
mov rbx, qword [rbp - 0x78]
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
call rax
mov r8, rbx
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_HeapAlloc]
call rax
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
lea rdx, [rbp - 0x78]
mov r9, rdx
mov r8d, 0
mov edx, 2
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
call rax
movabs rax, 0x100000000000
mov qword [rbp - 0x80], rax
mov rax, qword [rbp - 8]
lea rdx, [rbp - 0x80]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 8
mov r9, rdx
mov r8d, 0x20007
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
call rax
mov rax, qword [rbp - 8]
lea rdx, [rbp + 0x30]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 8
mov r9, rdx
mov r8d, 0x20000
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
call rax
mov dword [rbp - 0x70], 0x70
mov dword [rbp - 0x34], 0x80001
mov word [rbp - 0x30], 0
mov rdx, qword [rbp + 0x28]
mov rax, qword [rbp + 0x20]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x808000c
mov dword [rsp + 0x20], 1
mov r9d, 0
mov r8d, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
test eax, eax
mov rax, qword [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_DeleteProcThreadAttributeList]
call rax
nop
mov rax, qword [rbp + 0x20]
add rsp, 0xd0
pop rbx
pop rdi
pop rbp
ret
Function at 0x413a70
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x00b676c4]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x413bf8
mov rax, qword [0x00b676c8]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x413abc
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x413b45
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x413aa0
mov rcx, rbx
call fcn.00414710
test rax, rax
mov r12, rax
je 0x413c2d
mov rax, qword [0x00b676c8]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call fcn.00414840
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x00b676c8]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x413c10
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x413b3e
sub eax, 0x40
and eax, 0xffffffbf
jne 0x413ba0
add dword [0x00b676c4], 1
cmp edi, 8
jae 0x413b73
test dil, 4
jne 0x413be4
test edi, edi
je 0x413b68
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x413bff
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x413b68
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x413b8c
jmp 0x413b68
add rsi, qword [0x00b676c8]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x413b3e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.004ab4a0
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x413b68
xor esi, esi
jmp 0x413ac7
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x413b68
mov rax, qword [0x00b676c8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call fcn.004ab4a0
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call fcn.004ab4a0
nop
nop dword [rax]

Function at 0x414380
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x00b679a0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x00b67980]
test rbx, rbx
je 0x4143d4
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x4143cb
test rsi, rsi
je 0x4143cb
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x4143b0
lea rcx, [0x00b679a0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x414710
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x00b41430]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x41477d
mov rcx, r8
call fcn.004145f0
test eax, eax
je 0x41477d
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x41477d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x414774
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x41477f
add rax, 0x28
cmp rax, r9
jne 0x414760
xor eax, eax
add rsp, 0x28
ret

Function at 0x4211a0
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [0x00b379c8], eax
je 0x4211ba
add rsp, 0x28
ret
call sub.msvcrt.dll_abort
nop

Function at 0x4216c0
Capabilities:
Print debug messages

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x90
test rcx, rcx
mov rbx, rcx
je 0x4216e3
call fcn.00421060
cmp eax, 1
je 0x4216ee
mov qword [rbx], 0xffffffffffffffff
add rsp, 0x90
pop rbx
pop rsi
pop rdi
ret
lea rdi, [rsp + 0x20]
xor eax, eax
mov ecx, 0xa
lea rsi, str.Error_cleaning_up_spin_keys_for_thread
rep movsd dword [rdi], dword [rsi]
lea rdi, [rsp + 0x48]
mov ecx, 0x43
rep stosb byte [rdi], al
lea rbx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rdx, [rbx + 0x27]
mov r8d, 0xa
mov ecx, eax
call qword [sym.imp.msvcrt.dll__ultoa]
cmp byte [rsp + 0x47], 0
je 0x421765
mov eax, 0x28
jmp 0x42174a
add rax, 1
cmp rax, 0x6b
je 0x421757
cmp byte [rbx + rax], 0
mov edx, eax
jne 0x421740
cmp eax, 0x6a
jne 0x42176a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call sub.msvcrt.dll_abort
mov edx, 0x27
movsxd rax, edx
mov byte [rsp + rax + 0x20], 0xa
lea eax, [rdx + 1]
cdqe
mov byte [rsp + rax + 0x20], 0
jmp 0x421757