joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140004db0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x58
mov rdi, rsp
mov ecx, 0x16
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x70]
mov rax, qword [rsp + 0x70]
cmp qword [rax + 0x68], 0
je 0x140004e02
mov r8, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x140004f78
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x70]
mov rax, qword [rax + 0x40]
cmp qword [rax], 0
je 0x140004e2f
mov rax, qword [rsp + 0x70]
mov rax, qword [rax + 0x58]
mov eax, dword [rax]
mov dword [rsp + 0x40], eax
jmp 0x140004e37
mov dword [rsp + 0x40], 0
movsxd rax, dword [rsp + 0x40]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x80], 0
jle 0x140004f11
cmp qword [rsp + 0x28], 0
jle 0x140004f11
mov rax, qword [rsp + 0x28]
cmp qword [rsp + 0x80], rax
jge 0x140004e78
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x70]
mov rax, qword [rax + 0x40]
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x28]
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x78]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x80]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x80], rax
mov rcx, qword [rsp + 0x28]
call fcn.14000c818
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0x70]
mov rax, qword [rax + 0x58]
mov ecx, dword [rsp + 0x38]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx + 0x58]
mov dword [rcx], eax
movsxd rax, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx + 0x40]
add rax, qword [rcx]
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx + 0x40]
mov qword [rcx], rax
cmp qword [rsp + 0x80], 0
jle 0x140004f65
mov rax, qword [rsp + 0x70]
cmp qword [rax + 0x80], 0
je 0x140004f65
mov rax, qword [rsp + 0x70]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x80]
mov edx, 1
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, qword [rsp + 0x80]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x20]
sub rcx, rax
mov rax, rcx
add rsp, 0x58
pop rdi
pop rsi
ret
Function at 0x140004f80
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x58
mov rdi, rsp
mov ecx, 0x16
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x70]
mov rax, qword [rsp + 0x70]
cmp qword [rax + 0x68], 0
je 0x140004fd2
mov r8, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
jmp 0x140005152
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x70]
mov rax, qword [rax + 0x38]
cmp qword [rax], 0
je 0x140004fff
mov rax, qword [rsp + 0x70]
mov rax, qword [rax + 0x50]
mov eax, dword [rax]
mov dword [rsp + 0x48], eax
jmp 0x140005007
mov dword [rsp + 0x48], 0
movsxd rax, dword [rsp + 0x48]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x80], 0
jle 0x1400050e1
cmp qword [rsp + 0x28], 0
jle 0x1400050e1
mov rax, qword [rsp + 0x28]
cmp qword [rsp + 0x80], rax
jge 0x140005048
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x70]
mov rax, qword [rax + 0x38]
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x78]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x80]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x80], rax
mov rcx, qword [rsp + 0x28]
call fcn.14000c818
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0x70]
mov rax, qword [rax + 0x50]
mov ecx, dword [rsp + 0x38]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx + 0x50]
mov dword [rcx], eax
movsxd rax, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx + 0x38]
add rax, qword [rcx]
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx + 0x38]
mov qword [rcx], rax
cmp qword [rsp + 0x80], 0
jle 0x14000513f
mov rax, qword [rsp + 0x70]
cmp qword [rax + 0x80], 0
je 0x14000513f
mov rcx, qword [rsp + 0x70]
call fcn.1400077b0
mov rax, qword [rsp + 0x70]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x80]
mov edx, 1
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, qword [rsp + 0x80]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x20]
sub rcx, rax
mov rax, rcx
add rsp, 0x58
pop rdi
pop rsi
ret
Function at 0x1400078e0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xf0
mov rdi, rsp
mov ecx, 0x3c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x100]
mov rax, qword [0x140016010]
xor rax, rsp
mov qword [rsp + 0xe0], rax
mov rax, qword [rsp + 0x100]
cmp qword [rax + 0x68], 0
je 0x140007935
mov rax, qword [rsp + 0x100]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14000793c
mov al, 1
jmp 0x140007b04
mov rax, qword [rsp + 0x100]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0xb0], rax
mov dword [rsp + 0xb8], 0xffffffff
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0xc0], rax
mov edx, dword [rsp + 0xb8]
mov rcx, qword [rsp + 0x100]
mov rax, qword [rsp + 0xc0]
call qword [0x14000f658]
mov dword [rsp + 0xa8], eax
mov dword [rsp + 0xac], 0xffffffff
mov eax, dword [rsp + 0xa8]
cmp dword [rsp + 0xac], eax
jne 0x1400079ba
mov dword [rsp + 0xc8], 1
jmp 0x1400079c5
mov dword [rsp + 0xc8], 0
mov ecx, dword [rsp + 0xc8]
call fcn.14000c740
movzx eax, al
test eax, eax
je 0x1400079df
xor al, al
jmp 0x140007b04
mov qword [rsp + 0x30], 0x20
mov rax, qword [rsp + 0x100]
mov rax, qword [rax + 0x68]
mov qword [rsp + 0xd0], rax
lea rax, [rsp + 0x68]
mov rcx, qword [rsp + 0x100]
add rcx, 0x74
lea rdx, [rsp + 0x88]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rsp + 0x48]
mov rdx, rcx
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rsp + 0xd8], eax
cmp dword [rsp + 0xd8], 0
je 0x140007a61
cmp dword [rsp + 0xd8], 1
je 0x140007a6d
cmp dword [rsp + 0xd8], 3
je 0x140007afe
jmp 0x140007b02
mov rax, qword [rsp + 0x100]
mov byte [rax + 0x71], 0
lea rax, [rsp + 0x48]
mov rcx, qword [rsp + 0x88]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x98], rax
cmp qword [rsp + 0x98], 0
jbe 0x140007ac8
mov rax, qword [rsp + 0x100]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x98]
mov edx, 1
lea rcx, [rsp + 0x48]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp qword [rsp + 0x98], rax
je 0x140007ac8
xor al, al
jmp 0x140007b04
mov rax, qword [rsp + 0x100]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x140007ae5
mov dword [rsp + 0xdc], 1
jmp 0x140007af0
mov dword [rsp + 0xdc], 0
mov ecx, dword [rsp + 0xdc]
call fcn.14000c740
jmp 0x140007b04
mov al, 1
jmp 0x140007b04
xor al, al
mov rdi, rax
mov rcx, rsp
lea rdx, [0x1400102f0]
call fcn.14000c5b4
mov rax, rdi
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.14000afd0
add rsp, 0xf0
pop rdi
ret
Function at 0x180142160
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x180142264
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x1801422d3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1801422d3
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1801422d3
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1801422d3
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1801422d3
cmp dword [rcx + 0x84], 0xe
jbe 0x1801422d3
cmp dword [rcx + 0xf8], 0
je 0x1801422d3
mov ecx, ebx
call fcn.180142190
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.1801423f8
nop
cmp dword [rbp + 0x20], 0
je 0x180142321
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.180142230
int3
Function at 0x180147768
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x180147798
xor eax, eax
jmp 0x18014785b
mov rbp, rbx
cmp word [rax], si
je 0x1801477bd
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1801477a4
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1801477a0
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1801476b8
movsxd r14, eax
test eax, eax
jne 0x1801477fb
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x180147791
mov rcx, r14
call fcn.180147878
mov rdi, rax
test rax, rax
jne 0x180147814
xor ecx, ecx
call fcn.180145404
jmp 0x1801477f0
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1801476b8
test eax, eax
jne 0x180147845
mov rcx, rdi
call fcn.180145404
jmp 0x18014784f
xor ecx, ecx
call fcn.180145404
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x1400097a0
Capabilities:
Create directory
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rdi, rcx
mov rax, qword [0x140036030]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea rcx, [0x140027010]
xor esi, esi
lea r9, [rsp + 0x20]
mov edx, 0x8000
xor r8d, r8d
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
js 0x1400097f6
mov rbx, qword [rsp + 0x20]
mov rcx, rbx
call fcn.14000aff8
cmp rax, 0x105
jb 0x14000980d
mov rcx, rbx
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140018ef0
mov eax, esi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
mov r8d, 0x105
mov rcx, rdi
mov rdx, rbx
call fcn.14000b134
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea rdx, str.Mozilla_Maintenance_Service
mov rcx, rdi
call int.140026480
test eax, eax
je 0x1400097f6
xor esi, esi
mov rcx, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14000985a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1400097f6
lea rdx, str.UpdateLogs
mov rcx, rdi
call int.140026480
test eax, eax
je 0x1400097f6
xor esi, esi
mov rcx, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14000988f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1400097f6
mov esi, 1
jmp 0x1400097f6
Function at 0x14000a1c0
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x468
mov esi, edx
mov rbx, rcx
mov rax, qword [0x140036030]
xor rax, rsp
mov qword [rsp + 0x460], rax
xor edi, edi
lea r14, [rsp + 0x40]
mov r8d, 0x20a
mov rcx, r14
xor edx, edx
call fcn.14000c620
mov rcx, r14
call fcn.1400097a0
test eax, eax
je 0x14000a236
xor edi, edi
lea r14, [rsp + 0x250]
mov r8d, 0x20a
mov rcx, r14
xor edx, edx
call fcn.14000c620
lea rdx, str..status
mov rcx, rbx
mov r8, r14
call fcn.1400098a0
test eax, eax
jne 0x14000a255
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.140018ef0
mov eax, edi
add rsp, 0x468
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [rsp + 0x40]
lea rdx, [rsp + 0x250]
call int.140026480
test eax, eax
je 0x14000a236
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 2
xor edi, edi
lea rcx, [rsp + 0x40]
mov edx, 0x40000000
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x14000a236
mov rbx, rax
lea rdi, [rsp + 0x250]
mov rcx, rdi
mov r8d, esi
call fcn.140026410
mov rcx, rdi
call fcn.140014650
mov rsi, rax
mov qword [rsp + 0x20], 0
lea r14, [rsp + 0x3c]
mov rcx, rbx
mov rdx, rdi
mov r8d, esi
mov r9, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
setne al
cmp dword [r14], esi
sete cl
and cl, al
movzx edi, cl
jmp 0x14000a236

Function at 0x14000a310
Capabilities:
Enumerate processes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x268
mov rax, qword [0x140036030]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov esi, 0x102
test edx, edx
je 0x14000a3ef
mov edi, edx
mov rbx, rcx
xor r13d, r13d
lea r14, [rsp + 0x54]
mov rsi, qword [sym.imp.KERNEL32.dll_Sleep]
lea r15, [rsp + 0x28]
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp rax, 0xffffffffffffffff
je 0x14000a3ac
mov r12, rax
mov dword [rsp + 0x28], 0x238
mov rcx, rax
mov rdx, r15
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x14000a3b6
mov rcx, rbx
mov rdx, r14
call fcn.140012670
test eax, eax
je 0x14000a3c0
mov rcx, r12
mov rdx, r15
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x14000a387
mov ebp, 0x490
jmp 0x14000a3c2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
jmp 0x14000a3cb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
jmp 0x14000a3c2
xor ebp, ebp
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebp, 0x490
je 0x14000a3ed
mov ecx, 0x3e8
call rsi
inc r13d
cmp r13d, edi
jne 0x14000a35b
mov esi, 0x102
jmp 0x14000a3ef
xor esi, esi
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140018ef0
mov eax, esi
add rsp, 0x268
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x180001e60
Capabilities:
Check if file exists
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov eax, 0x1070
call fcn.18000b860
sub rsp, rax
mov rax, qword [0x18003c0b0]
xor rax, rsp
mov qword [rsp + 0x1060], rax
mov rsi, rcx
mov rdi, rdx
xor ecx, ecx
call fcn.1800133f8
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x58], rax
call fcn.180013318
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [rbx]
lea rdx, str.__d__d__d__d__d__d___d_:_s
mov r9d, dword [rbx + 0x10]
mov r8d, dword [rbx + 0x14]
inc r9d
mov qword [rsp + 0x48], rdi
add r8d, 0x76c
mov dword [rsp + 0x40], eax
mov eax, dword [rbx + 0xc]
mov dword [rsp + 0x38], ecx
mov ecx, dword [rbx + 4]
mov dword [rsp + 0x30], ecx
mov ecx, dword [rbx + 8]
mov dword [rsp + 0x28], ecx
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x20], eax
call fcn.180001cc0
mov rcx, rsi
xor edi, edi
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ebp, 1
lea rdx, [0x1800276b8]
test eax, eax
mov rcx, rsi
cmovne edi, ebp
call fcn.180012ff0
mov rbx, rax
test rax, rax
je 0x180001fb3
test edi, edi
jne 0x180001f44
mov eax, 0xfeff
lea r8d, [rbp + 1]
mov r9, rbx
mov word [rsp + 0x54], ax
mov edx, ebp
lea rcx, [rsp + 0x54]
call fcn.18000fee8
lea rcx, [rsp + 0x60]
or rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x180001f50
add eax, eax
lea rcx, [rsp + 0x60]
movsxd r8, eax
mov r9, rbx
mov rdx, rbp
call fcn.18000fee8
mov eax, 0xd
lea rcx, [rsp + 0x50]
mov r9, rbx
mov word [rsp + 0x50], ax
mov rdx, rbp
lea r8d, [rax - 0xb]
call fcn.18000fee8
mov eax, 0xa
lea rcx, [rsp + 0x50]
mov r9, rbx
mov word [rsp + 0x50], ax
mov rdx, rbp
lea r8d, [rax - 8]
call fcn.18000fee8
mov rcx, rbx
call fcn.18000fc3c
mov rcx, qword [rsp + 0x1060]
xor rcx, rsp
call fcn.18000b7f0
mov rbx, qword [rsp + 0x10a0]
add rsp, 0x1070
pop rdi
pop rsi
pop rbp
ret
Function at 0x180003890
Capabilities:
Create thread

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x3a8]
sub rsp, 0x490
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x18003c0b0]
xor rax, rsp
mov qword [rbp + 0x380], rax
mov r15, r9
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
cmp byte [rcx + 0x4f4], 0
jne 0x180003ae3
call fcn.1800051d0
xor edx, edx
test eax, eax
je 0x180003a4e
mov r8d, 0x208
lea rcx, [rsp + 0x60]
call fcn.18000e710
cmp qword [rbx + 0x18], 8
jb 0x18000390e
mov rbx, qword [rbx]
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.180001c00
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x170]
call fcn.18000e710
cmp qword [rdi + 0x18], 8
jb 0x18000393b
mov rdx, qword [rdi]
jmp 0x18000393e
mov rdx, rdi
lea rcx, [rbp + 0x170]
call fcn.180001c00
cmp qword [rdi + 0x10], 0
jne 0x180003963
lea rdx, [rsp + 0x60]
mov rcx, rsi
call fcn.180003b10
jmp 0x180003ae3
mov qword [rsp + 0x58], 7
xor ebx, ebx
mov qword [rsp + 0x50], rbx
mov word [rsp + 0x40], bx
lea r8d, [rbx + 1]
lea rdx, [0x1800277fc]
lea rcx, [rsp + 0x40]
call fcn.180001980
cmp word [rsp + 0x60], bx
jne 0x180003999
mov r8d, ebx
jmp 0x1800039ad
lea rax, [rsp + 0x60]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x1800039a2
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.1800016d0
mov r8d, 2
lea rdx, [0x180027800]
lea rcx, [rsp + 0x40]
call fcn.1800016d0
cmp word [rbp + 0x170], 0
je 0x1800039fa
lea rax, [rbp + 0x170]
or rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1800039f0
mov r8, rbx
lea rdx, [rbp + 0x170]
lea rcx, [rsp + 0x40]
call fcn.1800016d0
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rdx, qword [rsp + 0x40]
mov rcx, rsi
call fcn.180003b10
nop
mov r8, qword [rsp + 0x58]
cmp r8, 8
jb 0x180003ae3
inc r8
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x40]
call fcn.180001ad0
jmp 0x180003ae3
mov byte [rsi + 0x4f4], 1
mov r8d, 0x104
lea rcx, [rsi + 0xe0]
call fcn.18000e710
cmp qword [rbx + 0x18], 8
jb 0x180003a71
mov rbx, qword [rbx]
mov rdx, rbx
lea rcx, [rsi + 0xe0]
call fcn.180001c00
xor edx, edx
mov r8d, 0x104
lea rcx, [rsi + 0x2e8]
call fcn.18000e710
cmp qword [rdi + 0x18], 8
jb 0x180003a9e
mov rdi, qword [rdi]
mov rdx, rdi
lea rcx, [rsi + 0x2e8]
call fcn.180001c00
mov eax, dword [r15]
mov dword [rsi + 0x4f0], eax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
xor ebx, ebx
mov dword [rsp + 0x20], ebx
mov r9, rsi
lea r8, [0x180003bb0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x380]
xor rcx, rsp
call fcn.18000b7f0
lea r11, [rsp + 0x490]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x180003b10
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0xe0
mov rbx, rdx
lea rcx, [rsp + 0x70]
xor edx, edx
lea r8d, [rdx + 0x68]
call fcn.18000e710
xor eax, eax
mov dword [rsp + 0x70], 0x68
mov qword [rsp + 0x50], rax
xor r9d, r9d
mov qword [rsp + 0x58], rax
xor r8d, r8d
mov qword [rsp + 0x60], rax
mov rdx, rbx
lea rax, [rsp + 0x50]
xor ecx, ecx
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x180003b9c
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0xe0
pop rbx
ret
Function at 0x180004060
Capabilities:
Enumerate processes

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x1d8]
sub rsp, 0x2c0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x18003c0b0]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
mov r15, rcx
test rdx, rdx
jne 0x1800040ab
xor eax, eax
jmp 0x180004240
mov qword [rsp + 0x60], 7
xor ebx, ebx
mov qword [rsp + 0x58], rbx
mov word [rsp + 0x48], bx
cmp word [rdx], bx
jne 0x1800040ca
mov r8d, ebx
jmp 0x1800040da
or r8, 0xffffffffffffffff
nop
inc r8
cmp word [rdx + r8*2], bx
jne 0x1800040d0
lea rcx, [rsp + 0x48]
call fcn.180001980
nop
lea rdx, [rsp + 0x48]
mov rcx, r15
call fcn.180005260
xor edx, edx
mov r8d, 0x238
lea rcx, [rsp + 0x70]
call fcn.18000e710
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x180004221
mov dword [rsp + 0x70], 0x238
lea rdx, [rsp + 0x70]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x180004217
mov qword [rsp + 0x40], 7
mov qword [rsp + 0x38], rbx
mov word [rsp + 0x28], bx
cmp word [rbp - 0x64], 0
jne 0x180004157
mov r8, rbx
jmp 0x18000416b
lea rax, [rbp - 0x64]
or r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x180004160
lea rdx, [rbp - 0x64]
lea rcx, [rsp + 0x28]
call fcn.180001980
nop
lea rdx, [rsp + 0x28]
mov rcx, r15
call fcn.180005260
lea r8, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae r8, qword [rsp + 0x48]
lea rcx, [rsp + 0x28]
mov r14, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x40]
cmp rdi, 8
cmovae rcx, r14
mov r9, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x38]
call fcn.180001490
test eax, eax
je 0x1800041eb
cmp rdi, 8
jb 0x1800041d9
lea r8, [rdi + 1]
mov rdx, r14
lea rcx, [rsp + 0x28]
call fcn.180001ad0
lea rdx, [rsp + 0x70]
mov rcx, rsi
call sub.KERNEL32.dll_Process32NextW
jmp 0x180004130
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [rsp + 0x78]
mov r8, qword [rsp + 0x40]
cmp r8, 8
jb 0x180004221
inc r8
mov rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x28]
call fcn.180001ad0
jmp 0x180004221
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov r8, qword [rsp + 0x60]
cmp r8, 8
jb 0x18000423e
inc r8
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x48]
call fcn.180001ad0
mov eax, ebx
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.18000b7f0
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1800051d0
Capabilities:
Check os version
Get system information on windows

Disassembly:
sub rsp, 0x188
mov rax, qword [0x18003c0b0]
xor rax, rsp
mov qword [rsp + 0x170], rax
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x11c
call fcn.18000e710
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x54], 5
jg 0x180005244
cmp dword [rsp + 0x58], 2
jg 0x180005244
mov eax, 1
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.18000b7f0
add rsp, 0x188
ret
xor eax, eax
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.18000b7f0
add rsp, 0x188
ret