joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180009390
Capabilities:
Enumerate files on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x3e8]
sub rsp, 0x4c0
mov r12, qword [rcx]
mov rbx, r8
mov r14, rdx
mov rsi, rcx
xor edx, edx
lea rcx, [rbp + 0x1b0]
mov r8d, 0x208
mov edi, r9d
call sub.ntdll.dll_memset
mov rdx, rbx
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.KERNEL32.DLL_lstrcatW]
lea rdx, [0x180058050]
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.KERNEL32.DLL_lstrcatW]
xor edx, edx
lea rcx, [rsp + 0x60]
mov r8d, 0x250
call sub.ntdll.dll_memset
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov ecx, dword [rsi + 8]
xor r13d, r13d
mov dword [rsp + 0x40], ecx
xorps xmm0, xmm0
mov rcx, qword [rsi + 0x10]
mov r15, rax
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], r13
movdqu xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x48], r13
mov dword [rsp + 0x54], 0x2072024
mov dword [rsp + 0x44], edi
mov dword [rsp + 0x50], r13d
call fcn.180003698
mov rsi, rax
test r15, r15
jne 0x1800094fa
test rax, rax
je 0x180009479
mov rcx, rax
call fcn.1800037c0
test r14, r14
je 0x180009486
mov rcx, r14
call fcn.1800037c0
lea r11, [rsp + 0x4c0]
xor eax, eax
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
cmp word [rbp - 0x74], 0x2e
jne 0x1800094c6
movzx eax, word [rbp - 0x72]
test ax, ax
je 0x1800094fa
cmp ax, 0x2e
jne 0x1800094c6
cmp word [rbp - 0x70], r13w
je 0x1800094fa
test r14, r14
je 0x1800094e9
mov rcx, r14
call qword [r14 + 0x30]
xor edx, edx
mov rcx, r14
mov ebx, eax
call qword [r14 + gethostname]
mov r8d, ebx
mov rcx, rsi
mov rdx, rax
call qword [rsi + 0x28]
mov r8d, 0x250
lea rdx, [rsp + 0x60]
mov rcx, rsi
call qword [rsi + 0x28]
lea rdx, [rsp + 0x60]
mov rcx, r15
call qword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x1800094a9
mov rcx, rsi
call qword [rsi + 0x30]
test eax, eax
jne 0x180009550
test r14, r14
je 0x18000955a
mov rcx, r14
call qword [r14 + 0x30]
xor edx, edx
mov rcx, r14
mov ebx, eax
call qword [r14 + gethostname]
mov r8d, ebx
mov rcx, rsi
mov rdx, rax
call qword [rsi + 0x28]
mov rcx, r14
call qword [r14 + 0x30]
mov rcx, rsi
mov ebx, eax
call qword [rsi + 0x30]
add ebx, eax
mov dword [rsp + 0x48], ebx
jmp 0x18000955a
mov rcx, rsi
call qword [rsi + 0x30]
mov dword [rsp + 0x48], eax
call fcn.180003698
mov r8d, gethostname
lea rdx, [rsp + 0x20]
mov rcx, rax
mov rdi, rax
call qword [rax + 0x28]
mov rcx, rsi
call qword [rsi + 0x30]
xor edx, edx
mov rcx, rsi
mov ebx, eax
call qword [rsi + gethostname]
mov r8d, ebx
mov rcx, rdi
mov rdx, rax
call qword [rdi + 0x28]
mov rcx, rdi
call qword [rdi + 0x30]
xor edx, edx
mov rcx, rdi
mov ebx, eax
call qword [rdi + gethostname]
mov r8d, ebx
mov rcx, r12
mov rdx, rax
call qword [r12 + gethostbyname]
mov rcx, rsi
call fcn.1800037c0
mov rcx, rdi
call fcn.1800037c0
test r14, r14
je 0x1800095ca
mov rcx, r14
call fcn.1800037c0
mov rcx, r15
call qword [sym.imp.KERNEL32.DLL_FindClose]
jmp 0x180009486
Function at 0x18000a1e4
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
and qword [rbp - 0x40], 0
mov rbx, rcx
and dword [rbp - 0x14], 0
xorps xmm0, xmm0
mov rcx, rdx
mov dword [rbp - 0xc], 0x2072024
movdqu xmmword [rbp - 0x38], xmm0
mov rsi, rdx
mov dword [rbp - 0x1c], 0x3004
call qword [rdx + 0x30]
and dword [rbp - 0x10], 0
mov dword [rbp - 0x18], eax
mov eax, dword [rbx + 8]
mov dword [rbp - 0x20], eax
mov rax, qword [rbx + 0x10]
mov qword [rbp - 0x28], rax
call fcn.180003698
mov r8d, gethostname
lea rdx, [rbp - 0x40]
mov rcx, rax
mov rdi, rax
call qword [rax + 0x28]
mov rcx, rsi
call qword [rsi + 0x30]
xor edx, edx
mov rcx, rsi
mov ebx, eax
call qword [rsi + gethostname]
mov r8d, ebx
mov rcx, rdi
mov rdx, rax
call qword [rdi + 0x28]
mov rcx, rsi
call fcn.1800037c0
and dword [rbp + 0x10], 0
lea rax, [rbp + 0x10]
mov qword [rsp + 0x28], rax
lea r8, [0x180009fcc]
and dword [rsp + 0x20], 0
mov r9, rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateThread]
mov rcx, qword [0x180060a18]
test rcx, rcx
je 0x18000a2b4
mov edx, dword [rbp + 0x10]
mov r8, rax
call fcn.1800106c0
lea r11, [rsp + 0x70]
xor eax, eax
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x18000b070
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rdi
sub rsp, 0x20
and dword [rax + 0x10], 0
mov rdi, rcx
and dword [rax + 0x18], 0
mov rdx, rcx
mov ebx, 4
lea rcx, [rax + 0x18]
mov r8d, ebx
call qword [sym.imp.ntdll.dll_memcpy]
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x18000b18a
lea rdx, [rax + 4]
mov r8d, ebx
add rdx, rdi
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntdll.dll_memcpy]
mov eax, dword [rsp + 0x38]
test eax, eax
je 0x18000b18a
mov edx, eax
mov r9d, ebx
xor ecx, ecx
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x18000b0eb
xor eax, eax
jmp 0x18000b18d
mov edx, dword [rsp + 0x40]
mov rcx, rbx
mov r8d, dword [rsp + 0x38]
add rdx, 8
add rdx, rdi
call qword [sym.imp.ntdll.dll_memcpy]
cmp byte [rbx], 0x4d
jne 0x18000b10f
cmp byte [rbx + 1], 0x5a
je 0x18000b128
movsxd rcx, dword [rsp + 0x38]
test rcx, rcx
jle 0x18000b128
mov rax, rbx
xor byte [rax], 0x3a
inc rax
sub rcx, 1
jne 0x18000b11c
movsxd rax, dword [rbx + 0x3c]
movzx ecx, word [rax + rbx + 4]
mov eax, 0x200
cmp cx, ax
je 0x18000b172
mov eax, 0x8664
cmp cx, ax
je 0x18000b172
mov eax, 0x14c
xor edx, edx
cmp cx, ax
mov r8d, 0x8000
mov rcx, rbx
jne 0x18000b167
call qword [sym.imp.KERNEL32.DLL_VirtualFree]
mov eax, 0x20
jmp 0x18000b18d
call qword [sym.imp.KERNEL32.DLL_VirtualFree]
jmp 0x18000b0e4
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_VirtualFree]
mov eax, 0x40
jmp 0x18000b18d
or eax, 0xffffffff
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x18000bfac
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x420
mov rdi, rcx
call qword [sym.imp.KERNEL32.DLL_lstrlenW]
xor r8d, r8d
mov rcx, rdi
lea edx, [rax*2 + 1]
call fcn.1800147a8
test eax, eax
jle 0x18000c04c
xor ecx, ecx
inc eax
movsxd rdx, eax
mov r8d, 0x1000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov rbx, rax
test rax, rax
je 0x18000c04c
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_lstrlenW]
mov r8, rbx
mov rcx, rdi
lea edx, [rax*2 + 1]
call fcn.1800147a8
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x400
call sub.ntdll.dll_memset
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_lstrlenA]
mov edi, 3
mov rcx, rbx
cmp eax, edi
jg 0x18000c064
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.DLL_VirtualFree]
or eax, 0xffffffff
lea r11, [rsp + 0x420]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
call qword [sym.imp.KERNEL32.DLL_lstrlenA]
cmp eax, edi
jle 0x18000c0ba
lea rsi, [rbx + 3]
cmp byte [rsi], 0x5c
jne 0x18000c0a8
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x400
call qword [sym.imp.ntdll.dll_memset]
movsxd r8, edi
lea rcx, [rsp + 0x20]
mov rdx, rbx
call qword [sym.imp.ntdll.dll_memcpy]
xor edx, edx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
mov rcx, rbx
inc edi
inc rsi
call qword [sym.imp.KERNEL32.DLL_lstrlenA]
cmp edi, eax
jl 0x18000c072
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_VirtualFree]
xor eax, eax
jmp 0x18000c04f
Function at 0x18000d1c4
Capabilities:
Encode data using xor
Get file size
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x1a8]
sub rsp, 0x290
mov r15, qword [rcx]
xor edx, edx
and dword [rbp + 0x1b0], 0
lea rcx, [rbp - 0x80]
mov r8d, 0x208
call sub.ntdll.dll_memset
call fcn.180003698
lea rdx, [0x180060794]
mov rsi, rax
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.DLL_lstrcatW]
lea rdx, str._temp.key
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.DLL_lstrcatW]
and qword [rsp + 0x30], 0
lea rcx, [rbp - 0x80]
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18000d2fb
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_GetFileSize]
xor ecx, ecx
mov edx, eax
mov r8d, 0x1000
mov r14d, eax
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov rdi, rax
test rax, rax
jne 0x18000d2a4
test rbx, rbx
je 0x18000d29c
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov rcx, rsi
jmp 0x18000d399
and qword [rsp + 0x20], 0
lea r9, [rbp + 0x1b0]
mov r8d, r14d
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_ReadFile]
lea r8d, [r14 - 2]
lea rdx, [rdi + 2]
test r8d, r8d
je 0x18000d2df
mov rax, rdx
mov ecx, r8d
xor byte [rax], 0x62
inc rax
sub rcx, 1
jne 0x18000d2d3
mov rcx, rsi
call qword [rsi + 0x28]
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_VirtualFree]
test rbx, rbx
je 0x18000d304
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rax
mov rcx, rsi
mov dword [rsp + 0x74], 0x2072024
mov dword [rsp + 0x64], 0xe000
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
call qword [rsi + 0x30]
and dword [rsp + 0x70], 0
mov dword [rsp + 0x68], eax
call fcn.180003698
mov r8d, gethostname
lea rdx, [rsp + 0x40]
mov rcx, rax
mov rdi, rax
call qword [rax + 0x28]
mov rcx, rsi
call qword [rsi + 0x30]
xor edx, edx
mov rcx, rsi
mov ebx, eax
call qword [rsi + gethostname]
mov r8d, ebx
mov rcx, rdi
mov rdx, rax
call qword [rdi + 0x28]
mov rcx, rdi
call qword [rdi + 0x30]
xor edx, edx
mov rcx, rdi
mov ebx, eax
call qword [rdi + gethostname]
mov r8d, ebx
mov rcx, r15
mov rdx, rax
call qword [r15 + 0x30]
mov rcx, rsi
call fcn.1800037c0
mov rcx, rdi
call fcn.1800037c0
lea r11, [rsp + 0x290]
xor eax, eax
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x18000d490
Capabilities:
Enumerate processes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x168]
sub rsp, 0x260
xor edx, edx
mov rdi, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.DLL_CreateToolhelp32Snapshot]
and dword [rbp + 0x178], 0
lea rdx, [rsp + 0x20]
mov rcx, rax
mov dword [rsp + 0x20], 0x238
mov rsi, rax
call qword [sym.imp.KERNEL32.DLL_Process32FirstW]
test eax, eax
je 0x18000d540
lea rcx, [rsp + 0x4c]
lea rbx, [rdi + 0x28]
call qword [sym.imp.KERNEL32.DLL_lstrlenW]
test eax, eax
jle 0x18000d52e
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.DLL_lstrlenW]
mov r8d, 4
lea rdx, [rbp + 0x178]
mov rcx, rdi
lea eax, [rax*2 + 2]
mov dword [rbp + 0x178], eax
call qword [rbx]
mov r8d, dword [rbp + 0x178]
lea rdx, [rsp + 0x4c]
mov rcx, rdi
call qword [rbx]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_Process32NextW]
test eax, eax
jne 0x18000d4f3
lea r11, [rsp + 0x260]
xor eax, eax
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x18001017c
Capabilities:
Create service
Persist via windows service
Start service

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x490
mov ebx, 0x208
lea rcx, [rsp + 0x280]
mov r8d, ebx
xor edx, edx
call sub.ntdll.dll_memset
lea rdx, str.tpdrivers
lea rcx, [rsp + 0x280]
call qword [sym.imp.KERNEL32.DLL_lstrcatW]
mov r8d, ebx
lea rcx, [rsp + 0x70]
xor edx, edx
call sub.ntdll.dll_memset
lea rdx, [rsp + 0x70]
call fcn.180013dec
lea rdx, str._system32drivers_tpdrivers.sys
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.DLL_lstrcatW]
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
jne 0x180010203
call qword [sym.imp.KERNEL32.DLL_GetLastError]
jmp 0x1800102a9
and qword [rsp + 0x60], 0
lea rax, str.FltMgr
and qword [rsp + 0x58], 0
lea r8, [rsp + 0x280]
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x280]
and qword [rsp + 0x48], 0
lea rax, str.FSFilter_Activity_Monitor
mov qword [rsp + 0x40], rax
mov r9d, 0xf01ff
lea rax, [rsp + 0x70]
mov rcx, rbx
mov qword [rsp + 0x38], rax
and dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 2
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov rdi, rax
test rax, rax
jne 0x180010287
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1800101f8
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
mov rbx, qword [rsp + 0x4a0]
add rsp, 0x490
pop rdi
ret
Function at 0x180013ab4
Capabilities:
Encode data using xor
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xf0
mov rdi, rcx
mov qword [0x1800609d0], rcx
mov rdx, rcx
mov ebp, 4
mov r8d, ebp
lea rcx, [0x180060a10]
call qword [sym.imp.ntdll.dll_memcpy]
mov edx, dword [0x180060a10]
mov esi, 0x3000
mov r8d, esi
mov r9d, ebp
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_VirtualAlloc]
xor ebx, ebx
mov qword [0x180060a00], rax
test rax, rax
je 0x180013c7a
mov r8d, dword [0x180060a10]
lea rdx, [rdi + 4]
mov rcx, rax
call qword [sym.imp.ntdll.dll_memcpy]
mov edx, dword [0x180060a10]
lea rcx, [0x180060a40]
add rdx, rbp
mov r8d, ebp
add rdx, rdi
call qword [sym.imp.ntdll.dll_memcpy]
mov eax, dword [0x180060a40]
test eax, eax
je 0x180013c7a
mov edx, eax
mov r9d, ebp
mov r8d, esi
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov qword [0x180060a20], rax
mov rcx, rax
test rax, rax
je 0x180013c7a
mov edx, dword [0x180060a10]
mov r8d, dword [0x180060a40]
add rdx, 8
add rdx, rdi
call qword [sym.imp.ntdll.dll_memcpy]
mov edx, dword [0x180060a40]
lea rsi, [0x18005ff30]
mov ecx, dword [0x180060a10]
add rdx, rdi
add rcx, 0xc
mov r8d, 0xa88
add rdx, rcx
mov dword [0x180060a3c], r8d
mov rcx, rsi
call qword [sym.imp.ntdll.dll_memcpy]
movsxd rax, dword [0x180060a3c]
test rax, rax
jle 0x180013bde
xor byte [rbx + rsi], 0x3a
inc rbx
cmp rbx, rax
jl 0x180013bd2
mov esi, 0xc8
lea rcx, [rsp + 0x20]
mov r8d, esi
xor edx, edx
call sub.ntdll.dll_memset
lea rbx, [0x180060794]
mov rcx, rbx
lea r8d, [rsi - 0x64]
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.DLL_ExpandEnvironmentStringsW]
mov r8d, esi
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntdll.dll_memset]
mov r8d, esi
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.ntdll.dll_memcpy]
mov ecx, dword [0x180060a3c]
mov r8, rbp
mov edx, dword [0x180060a40]
mov eax, dword [0x180060a10]
add rdx, rdi
add rdx, rcx
add rax, 0xc
add rdx, rax
lea rcx, [0x180060a38]
call qword [sym.imp.ntdll.dll_memcpy]
mov edx, dword [0x180060a3c]
add edx, dword [0x180060a40]
mov ecx, dword [0x180060a10]
add ecx, 0x10
add ecx, edx
mov dword [0x1800609d8], ecx
xor eax, eax
jmp 0x180013c7d
or eax, 0xffffffff
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x180013c98
Capabilities:
Delete file
Encode data using xor
Set file attributes

Disassembly:
push rbx
sub rsp, 0x230
mov r8d, 0xa88
lea rcx, [0x18005ff30]
mov rbx, rdx
call qword [sym.imp.ntdll.dll_memcpy]
mov rax, rbx
mov ecx, 0xa88
xor byte [rax], 0x3a
inc rax
sub rcx, 1
jne 0x180013cbf
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x208
call sub.ntdll.dll_memset
lea r9, str.install.cfg
lea r8, [0x180060794]
lea rdx, str._s_s
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_wsprintfW]
mov edx, 2
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.DLL_DeleteFileW]
mov r8d, 0xa88
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.180013d48
mov edx, 7
lea rcx, [rsp + 0x20]
mov ebx, eax
call qword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
mov eax, ebx
add rsp, 0x230
pop rbx
ret

Function at 0x180013d48
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x40
and qword [rax - 0x18], 0
mov edi, r8d
and dword [rax - 0x20], 0
mov rsi, rdx
and dword [rax + 0x20], 0
xor r8d, r8d
mov edx, 0x40000000
mov dword [rax - 0x28], 2
xor r9d, r9d
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x180013d94
call qword [sym.imp.KERNEL32.DLL_GetLastError]
jmp 0x180013ddc
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x68]
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
jne 0x180013dcc
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov edi, eax
test rbx, rbx
je 0x180013dc8
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, edi
jmp 0x180013ddc
test rbx, rbx
je 0x180013dda
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x180013dec
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x28
mov rax, rdx
test rdx, rdx
je 0x180013e15
mov edx, 0x64
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryW]
test eax, eax
jne 0x180013e15
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.DLL_GetLastError]
xor eax, eax
add rsp, 0x28
ret
Function at 0x1800145b0
Capabilities:
Get session information
Get session user name

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x40
and qword [rbp - 8], 0
lea rax, [rbp + 0x40]
and qword [rbp - 0x10], 0
lea r9, [rbp - 8]
and dword [rbp + 0x48], 0
xor esi, esi
and dword [rbp + 0x40], 0
mov rdi, rcx
and dword [rbp + 0x38], esi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
lea r8d, [rsi + 1]
call qword [sym.imp.WTSAPI32.dll_WTSEnumerateSessionsW]
test eax, eax
je 0x1800146eb
xor ebx, ebx
cmp dword [rbp + 0x40], ebx
jbe 0x1800146df
mov rdx, qword [rbp - 8]
lea rax, [rbp + 0x48]
lea r14, [rbx + rbx*2]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x10]
mov r8d, 5
xor ecx, ecx
mov edx, dword [rdx + r14*8]
call qword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationW]
test eax, eax
je 0x1800146d4
mov rcx, qword [rbp - 0x10]
lea rdx, [0x180057e44]
call qword [sym.imp.ntdll.dll_wcscmp]
test eax, eax
je 0x180014674
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.KERNEL32.DLL_lstrlenW]
mov r8d, 4
lea rdx, [rbp + 0x38]
mov rcx, rdi
lea eax, [rax*2 + 2]
mov dword [rbp + 0x38], eax
call qword [rdi + 0x28]
mov rdx, qword [rbp - 0x10]
jmp 0x1800146a2
lea rcx, str.system
call qword [sym.imp.KERNEL32.DLL_lstrlenW]
mov r8d, 4
lea rdx, [rbp + 0x38]
mov rcx, rdi
lea eax, [rax*2 + 2]
mov dword [rbp + 0x38], eax
call qword [rdi + 0x28]
lea rdx, str.system
mov r8d, dword [rbp + 0x38]
mov rcx, rdi
call qword [rdi + 0x28]
mov rax, qword [rbp - 8]
mov r8d, 4
add esi, dword [rbp + 0x38]
mov rcx, rdi
and dword [rbp + 0x38], 0
lea rdx, [rax + r14*8]
call qword [rdi + 0x28]
mov rcx, qword [rbp - 0x10]
add esi, 8
call qword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
inc ebx
cmp ebx, dword [rbp + 0x40]
jb 0x180014606
mov rcx, qword [rbp - 8]
call qword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
mov eax, esi
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x180014888
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x260
mov rsi, rdx
mov edi, ecx
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x238
call qword [sym.imp.ntdll.dll_memset]
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.DLL_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18001491a
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_Process32FirstW]
jmp 0x1800148f2
cmp dword [rsp + 0x28], edi
je 0x1800148f8
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_Process32NextW]
test eax, eax
jne 0x1800148de
jmp 0x18001490c
mov r8d, 0x208
lea rdx, [rsp + 0x4c]
mov rcx, rsi
call qword [sym.imp.ntdll.dll_memcpy]
test rbx, rbx
je 0x18001491a
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
lea r11, [rsp + 0x260]
xor eax, eax
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x180014934
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x260
xor edx, edx
mov rdi, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.DLL_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.DLL_Process32FirstW]
jmp 0x18001498a
lea rdx, [rsp + 0x4c]
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_lstrcmpiW]
test eax, eax
je 0x18001499f
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_Process32NextW]
test eax, eax
jne 0x18001496a
mov rbx, qword [rsp + 0x270]
add rsp, 0x260
pop rdi
ret
mov eax, dword [rsp + 0x28]
jmp 0x18001498e

Function at 0x1800149a8
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x260
mov ebx, edx
mov rsi, rcx
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.DLL_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.DLL_Process32FirstW]
jmp 0x180014a0b
lea rdx, [rsp + 0x4c]
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_lstrcmpiW]
test eax, eax
jne 0x1800149fd
cmp ebx, dword [rsp + 0x40]
je 0x180014a24
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_Process32NextW]
test eax, eax
jne 0x1800149e5
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
mov eax, dword [rsp + 0x28]
jmp 0x180014a0f

Function at 0x180014a2c
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x260
xor edx, edx
mov ebx, ecx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.DLL_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.DLL_Process32FirstW]
jmp 0x180014a75
cmp dword [rsp + 0x28], ebx
je 0x180014a8a
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_Process32NextW]
test eax, eax
jne 0x180014a61
mov rbx, qword [rsp + 0x270]
add rsp, 0x260
pop rdi
ret
mov eax, dword [rsp + 0x40]
jmp 0x180014a79