joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400022f0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
movzx r8d, word [rcx + 6]
lea rax, [rcx + rax + 0x18]
test r8w, r8w
je 0x14000233d
lea ecx, [r8 - 1]
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rcx, r8
cmp rdx, r8
jb 0x140002334
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x14000233f
add rax, 0x28
cmp rax, r9
jne 0x140002320
xor eax, eax
ret

Function at 0x140002340
Capabilities:
Parse pe header

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, rcx
call sym.strlen
cmp rax, 8
ja 0x1400023d0
mov rdx, qword [0x1400773c0]
xor ebx, ebx
cmp word [rdx], 0x5a4d
jne 0x1400023be
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
jne 0x1400023be
cmp word [rax + 0x18], 0x20b
jne 0x1400023be
movzx edx, word [rax + 0x14]
lea rbx, [rax + rdx + 0x18]
movzx edx, word [rax + 6]
test dx, dx
je 0x1400023d0
lea eax, [rdx - 1]
lea rax, [rax + rax*4]
lea rdi, [rbx + rax*8 + 0x28]
jmp 0x1400023a9
add rbx, 0x28
cmp rbx, rdi
je 0x1400023d0
mov r8d, 8
mov rdx, rsi
mov rcx, rbx
call sym.strncmp
test eax, eax
jne 0x1400023a0
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
xor ebx, ebx
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x1400023e0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1400773c0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140002400
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140002408
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002400
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x14000245d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140002454
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140002400
add rax, 0x28
cmp rax, r9
jne 0x140002440
xor eax, eax
ret

Function at 0x140002460
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400773c0]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x14000247f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140002488
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x14000247f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x1400024a0
Capabilities:
Parse pe header

Disassembly:
mov r8, qword [0x1400773c0]
xor eax, eax
cmp word [r8], 0x5a4d
jne 0x1400024c0
movsxd rdx, dword [r8 + 0x3c]
add rdx, r8
cmp dword [rdx], 0x4550
je 0x1400024c8
ret
cmp word [rdx + 0x18], 0x20b
jne 0x1400024c0
movzx eax, word [rdx + 0x14]
movzx r8d, word [rdx + 6]
lea rax, [rdx + rax + 0x18]
test r8w, r8w
je 0x140002510
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea rdx, [rax + rdx*8 + 0x28]
nop dword [rax]
test byte [rax + 0x27], 0x20
je 0x140002507
test rcx, rcx
je 0x1400024c0
sub rcx, 1
add rax, 0x28
cmp rdx, rax
jne 0x1400024f8
xor eax, eax
ret
Function at 0x140002520
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400773c0]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x14000253f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140002548
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x140002560
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1400773c0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140002580
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140002588
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002580
sub rcx, rdx
movzx r9d, word [r8 + 6]
movzx edx, word [r8 + 0x14]
lea rdx, [r8 + rdx + 0x18]
test r9w, r9w
je 0x140002580
lea eax, [r9 - 1]
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
mov rax, r8
cmp rcx, r8
jb 0x1400025d4
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x1400025e0
add rdx, 0x28
cmp rdx, r9
jne 0x1400025c0
xor eax, eax
ret
mov eax, dword [rdx + 0x24]
not eax
shr eax, 0x1f
ret

Function at 0x1400025f0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x1400773c0]
xor r9d, r9d
cmp word [r11], 0x5a4d
jne 0x140002612
movsxd r8, dword [r11 + 0x3c]
add r8, r11
cmp dword [r8], 0x4550
je 0x140002620
mov rax, r9
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002612
mov eax, dword [r8 + 0x90]
test eax, eax
je 0x140002612
movzx edx, word [r8 + 0x14]
movzx r10d, word [r8 + 6]
lea rdx, [r8 + rdx + 0x18]
test r10w, r10w
je 0x140002612
lea r8d, [r10 - 1]
lea r8, [r8 + r8*4]
lea r10, [rdx + r8*8 + 0x28]
nop word cs:[rax + rax]
mov r9d, dword [rdx + 0xc]
mov r8, r9
cmp rax, r9
jb 0x140002675
add r8d, dword [rdx + 8]
cmp rax, r8
jb 0x140002688
add rdx, 0x28
cmp r10, rdx
jne 0x140002660
xor r9d, r9d
mov rax, r9
ret
add rax, r11
jmp 0x140002697
sub ecx, 1
add rax, 0x14
mov r8d, dword [rax + 4]
test r8d, r8d
jne 0x1400026a7
mov edx, dword [rax + 0xc]
test edx, edx
je 0x14000267e
test ecx, ecx
jg 0x140002690
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
ret
Function at 0x180003420
Capabilities:
Acquire debug privileges

Disassembly:
push rbx
sub rsp, 0x40
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x50]
lea edx, [rbx + 0x28]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1800034b0
lea r8, [rsp + 0x58]
xor ecx, ecx
lea rdx, str.SeDebugPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x1800034a5
mov rax, qword [rsp + 0x58]
lea r9d, [rbx + 0x10]
mov rcx, qword [rsp + 0x50]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x60], rdi
xor edx, edx
mov edi, 1
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x3c], 2
mov qword [rsp + 0x34], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
cmovne ebx, edi
mov rdi, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
add rsp, 0x40
pop rbx
ret
Function at 0x180003fb0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov rdi, rcx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r14, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
cmp rdi, 0x40000000
jbe 0x180003ff0
lea rax, [rdi - 0x40000000]
cmp r14, rax
cmovb r14, rax
mov rsi, qword [0x18000dad0]
lea r15, [rdi + 0x40000000]
cmp rcx, r15
cmovbe r15, rcx
sub r15, 0xfff
test rsi, rsi
je 0x18000402e
cmp rsi, r14
jb 0x180004026
cmp rsi, r15
jae 0x180004026
cmp qword [rsi + 8], 0
jne 0x1800041f7
mov rsi, qword [rsi]
test rsi, rsi
jne 0x180004011
mov qword [rsp + 0xa0], rbx
mov rbx, rdi
mov qword [rsp + 0xa8], rbp
mov qword [rsp + 0xb0], r12
mov r12d, 0x40
cmp rdi, r14
jb 0x1800040c2
nop dword [rax]
nop dword [rax + rax]
mov ebp, dword [rsp + 0x48]
mov rax, rbx
xor edx, edx
div rbp
sub rbx, rdx
sub rbx, rbp
cmp rbx, r14
jb 0x1800040b9
nop word [rax + rax]
mov r8d, 0x30
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1800040b9
cmp dword [rsp + 0x70], 0x10000
je 0x18000413b
mov rbx, qword [rsp + 0x58]
cmp rbx, rbp
jb 0x1800040b9
sub rbx, rbp
cmp rbx, r14
jae 0x180004080
test rsi, rsi
jne 0x1800041a0
cmp rdi, r15
ja 0x1800041df
nop dword [rax + rax]
mov ebp, dword [rsp + 0x48]
xor edx, edx
mov rax, rdi
mov ebx, ebp
div rbp
mov eax, ebp
sub rax, rdx
add rax, rdi
mov rdi, rax
cmp rax, r15
ja 0x1800041df
mov r8d, 0x30
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1800041df
cmp dword [rsp + 0x70], 0x10000
je 0x180004171
xor edx, edx
lea edi, [rbp - 1]
add rdi, qword [rsp + 0x68]
add rdi, qword [rsp + 0x50]
mov rax, rdi
div rbx
sub rdi, rdx
cmp rdi, r15
jbe 0x1800040f2
jmp 0x1800041df
test rbx, rbx
je 0x1800040b9
mov r9d, r12d
mov edx, 0x1000
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x1800041a0
cmp rbx, r14
jae 0x180004060
jmp 0x1800040c2
test rdi, rdi
je 0x1800041df
mov r9d, r12d
mov edx, 0x1000
mov r8d, 0x3000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x1800041a0
cmp rdi, r15
jbe 0x1800040d0
jmp 0x1800041df
xor edx, edx
lea rcx, [rsi + 0x40]
mov dword [rsi + 0x10], edx
nop dword [rax]
mov qword [rcx], rdx
mov rax, rcx
mov qword [rsi + 8], rcx
add r12, 0x40
add rcx, 0x40
mov rdx, rax
cmp r12, 0xfc0
jbe 0x1800041b0
mov rax, qword [0x18000dad0]
mov qword [rsi], rax
mov qword [0x18000dad0], rsi
mov r12, qword [rsp + 0xb0]
mov rbp, qword [rsp + 0xa8]
mov rbx, qword [rsp + 0xa0]
mov rax, rsi
mov rsi, qword [rsp + 0xb8]
add rsp, 0x80
pop r15
pop r14
pop rdi
ret
Function at 0x180004b40
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x40
xor esi, esi
mov r14d, edx
mov rbx, rcx
mov qword [rcx], rsi
mov qword [rcx + 8], rsi
xor edx, edx
mov ebp, r8d
lea ecx, [rsi + 4]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x180004c64
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x180004c5b
cmp dword [rsp + 0x20], 0x10
jb 0x180004c3d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x2c], eax
jne 0x180004c3d
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rsp + 0x28], eax
je 0x180004c3d
mov rdx, qword [rbx]
test rdx, rdx
jne 0x180004bf8
mov rcx, qword [0x180008a88]
mov r8d, 0x200
mov dword [rbx + 8], 0x80
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbx], rax
mov rdx, rax
test rax, rax
je 0x180004c5b
jmp 0x180004c2d
mov eax, dword [rbx + 8]
cmp dword [rbx + 0xc], eax
jb 0x180004c2d
mov rcx, qword [0x180008a88]
lea r9d, [rax + rax]
mov r8, rdx
shl r9, 2
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rdx, rax
test rax, rax
je 0x180004c5b
mov eax, dword [rbx + 8]
add eax, eax
mov qword [rbx], rdx
mov dword [rbx + 8], eax
mov ecx, dword [rbx + 0xc]
mov eax, dword [rsp + 0x28]
mov dword [rdx + rcx*4], eax
lea eax, [rcx + 1]
mov dword [rbx + 0xc], eax
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x180004ba2
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rbx], rsi
je 0x180004cb3
cmp dword [rbx + 0xc], esi
jbe 0x180004cb3
nop
mov r8, qword [rbx]
xor edx, edx
mov eax, esi
lea ecx, [rdx + 0x5a]
mov r8d, dword [r8 + rax*4]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rdi, rax
test rax, rax
je 0x180004cac
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov r8d, ebp
mov edx, r14d
mov rcx, rdi
call fcn.1800049b0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [rbx + 0xc]
jb 0x180004c70
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x180004cd0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov eax, ecx
lea r9, [rsp + 0x30]
imul rbx, rax, 0x38
mov esi, edx
add rbx, qword [0x18000dac0]
mov r8, qword [rbx]
movzx eax, byte [rbx + 0x20]
and al, 1
movzx ecx, al
lea rdi, [r8 - 5]
cmove rdi, r8
mov r8d, 0x40
lea rbp, [rcx*2 + 5]
mov rcx, rdi
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x180004d34
mov eax, 0xa
jmp 0x180004dc7
test esi, esi
je 0x180004d56
mov byte [rdi], 0xe9
mov eax, dword [rbx + 8]
sub eax, edi
sub eax, 5
mov dword [rdi + 1], eax
test byte [rbx + 0x20], 1
je 0x180004d79
mov rax, qword [rbx]
mov word [rax], 0xf9eb
jmp 0x180004d79
mov eax, dword [rbx + 0x18]
test byte [rbx + 0x20], 1
mov dword [rdi], eax
je 0x180004d72
movzx eax, word [rbx + 0x1c]
mov word [rdi + 4], ax
movzx eax, byte [rbx + 0x1e]
mov byte [rdi + 6], al
jmp 0x180004d79
movzx eax, byte [rbx + 0x1c]
mov byte [rdi + 4], al
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, rbp
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
movzx ecx, sil
shl sil, 2
add cl, cl
xor cl, byte [rbx + 0x20]
and cl, 2
xor cl, byte [rbx + 0x20]
xor sil, cl
and sil, 4
xor sil, cl
mov byte [rbx + 0x20], sil
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x180004de0
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov esi, ecx
mov ecx, dword [0x18000dacc]
mov ebx, edi
test ecx, ecx
je 0x180004f1b
mov rax, qword [0x18000dac0]
add rax, 0x20
nop
movzx edx, byte [rax]
shr edx, 1
and edx, 1
cmp edx, esi
jne 0x180004e38
inc ebx
add rax, 0x38
cmp ebx, ecx
jb 0x180004e10
mov eax, edi
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
cmp ebx, 0xffffffff
je 0x180004f1b
mov r8d, edi
lea rcx, [rsp + 0x20]
test esi, esi
mov edx, 0xffffffff
setne r8b
call fcn.180004b40
mov r8d, dword [0x18000dacc]
cmp ebx, r8d
jae 0x180004ea8
nop word [rax + rax]
mov eax, ebx
imul rcx, rax, 0x38
mov rax, qword [0x18000dac0]
movzx edx, byte [rcx + rax + 0x20]
shr edx, 1
and edx, 1
cmp edx, esi
je 0x180004ea1
mov edx, esi
mov ecx, ebx
call fcn.180004cd0
mov edi, eax
test eax, eax
jne 0x180004ea8
mov r8d, dword [0x18000dacc]
inc ebx
cmp ebx, r8d
jb 0x180004e70
cmp qword [rsp + 0x20], 0
je 0x180004f1b
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x180004f07
mov rbx, qword [rsp + 0x20]
mov qword [rsp + 0x40], rbp
mov ebp, eax
nop dword [rax]
nop dword [rax + rax]
mov r8d, dword [rbx]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x180004ef8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub rbp, 1
jne 0x180004ed0
mov rbp, qword [rsp + 0x40]
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x180008a88]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x48]
mov eax, edi
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x180005570
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r15
sub rsp, 0x30
xor r15d, r15d
mov esi, edx
mov ebx, r15d
xor eax, eax
mov rdi, rcx
mov ebp, 1
lock cmpxchg dword [0x180008668], ebp
je 0x1800055c7
cmp rbx, 0x20
jae 0x1800055b0
xor ecx, ecx
jmp 0x1800055b2
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
xor eax, eax
lock cmpxchg dword [0x180008668], ebp
jne 0x1800055a6
cmp qword [0x180008a88], r15
je 0x1800056c1
test rdi, rdi
jne 0x1800055e7
mov ecx, esi
call fcn.180004de0
mov ebp, eax
jmp 0x1800056c6
mov ecx, dword [0x18000dacc]
mov ebx, r15d
test ecx, ecx
je 0x18000560f
mov r8, qword [0x18000dac0]
mov rax, r8
nop
cmp rdi, qword [rax]
je 0x180005619
inc ebx
add rax, 0x38
cmp ebx, ecx
jb 0x180005600
mov ebp, 4
jmp 0x1800056c6
cmp ebx, 0xffffffff
je 0x18000560f
mov eax, ebx
imul rdx, rax, 0x38
movzx eax, byte [rdx + r8 + 0x20]
shr eax, 1
and eax, ebp
cmp eax, esi
je 0x1800056b8
mov r8d, ebp
lea rcx, [rsp + 0x20]
mov edx, ebx
call fcn.180004b40
mov edx, esi
mov ecx, ebx
call fcn.180004cd0
mov ebp, eax
cmp qword [rsp + 0x20], r15
je 0x1800056c6
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x1800056a2
mov rbx, qword [rsp + 0x20]
mov esi, eax
nop word [rax + rax]
mov r8d, dword [rbx]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rdi, rax
test rax, rax
je 0x180005698
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub rsi, 1
jne 0x180005670
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x180008a88]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1800056c6
neg esi
sbb ebp, ebp
add ebp, 6
jmp 0x1800056c6
mov ebp, 2
xchg dword [0x180008668], r15d
mov rbx, qword [rsp + 0x40]
mov eax, ebp
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r15
ret
Function at 0x180005af0
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x10c0
call fcn.180001010
sub rsp, rax
mov rdi, r8
mov rsi, rdx
mov ebp, ecx
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x60]
mov rbx, r9
call sub.msvcrt.dll_memset
mov rcx, qword [0x180008878]
lea rdx, [rsp + 0x60]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor edx, edx
lea rcx, [rsp + 0x270]
mov r8d, 0xe50
call sub.msvcrt.dll_memset
mov rdx, rbx
lea rcx, [rsp + 0x270]
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
lea rdx, str.KOMMANDER_HOOKID_NAME
lea rcx, [rsp + 0x478]
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
mov rdx, rdi
lea rcx, [rsp + 0xa90]
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
lea rdx, str.KOMMANDER_SHARE_NAME
lea rcx, [rsp + 0xc98]
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
mov rdx, rsi
lea rcx, [rsp + 0x680]
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
lea rdx, str.KOMMANDER_EVENT_NAME
lea rcx, [rsp + 0x888]
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0xea0]
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor edi, edi
mov qword [rsp + 0x10a8], rax
mov rax, qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov qword [rsp + 0x10b0], rax
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rdi
call fcn.180003420
test eax, eax
je 0x180005cf5
mov r8d, ebp
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x180005cf5
mov r9d, 0x1000
mov dword [rsp + 0x20], 0x40
mov r8d, r9d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
xor edx, edx
mov dword [rsp + 0x20], 4
mov r9d, 0x1000
mov r8d, 0xe50
mov rcx, rbx
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rsi, rax
test rbp, rbp
je 0x180005cec
test rax, rax
je 0x180005cec
lea rax, [rsp + 0x48]
mov r9d, 0x1000
lea r8, [0x1800034c0]
mov qword [rsp + 0x20], rax
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rax, [rsp + 0x50]
mov r9d, 0xe50
lea r8, [rsp + 0x270]
mov qword [rsp + 0x20], rax
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x40], edi
mov qword [rsp + 0x30], rax
mov r9, rbp
mov dword [rsp + 0x28], edi
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rdi, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0x10c0]
mov rax, rdi
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140001484
Capabilities:
Delete registry key
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x260
mov r12d, r8d
mov ebx, r8d
lea r9, [rsp + 0x48]
mov rsi, rcx
and r12d, 0x300
mov rdi, rdx
mov r8d, r12d
or r8d, 9
call fcn.140007695
test eax, eax
jne 0x140001572
test bl, 2
lea rbp, [rsp + 0x56]
je 0x140001503
xor edx, edx
xor eax, eax
mov rcx, qword [rsp + 0x48]
lea r9, [rsp + 0x44]
mov qword [rsp + 0x38], rdx
mov r8, rbp
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rdx
xor edx, edx
mov dword [rsp + 0x44], eax
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
jne 0x140001543
mov r14d, ebx
mov r13, qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
and r14d, 1
jmp 0x140001527
mov rcx, qword [rsp + 0x48]
mov r8d, ebx
mov rdx, rbp
call fcn.140001484
test eax, eax
jne 0x140001555
xor edx, edx
mov rcx, qword [rsp + 0x48]
mov r9d, 0x105
mov r8, rbp
call r13
test eax, eax
jne 0x140001555
test r14d, r14d
je 0x140001513
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x3eb
jmp 0x140001572
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor r9d, r9d
mov r8d, r12d
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
add rsp, 0x260
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret

Function at 0x140003cab
Capabilities:
Read file on windows

Disassembly:
mov r8d, edx
mov rdx, rcx
mov rcx, qword [0x14000a020]
jmp fcn.14000751c
Function at 0x140003cd3
Capabilities:
Check for time delay via gettickcount

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xc8
mov ebp, 0x8000
lea r12, [0x1400341c0]
mov qword [rsp + 0x118], rdx
mov rsi, r8
mov ebx, r9d
test r8, r8
je 0x140003d0b
mov ebp, r9d
mov r12, r8
test ecx, ecx
js 0x140003d1a
add ecx, dword [0x1400301b4]
call fcn.140003cbd
lea rcx, [rsp + 0x3c]
mov edx, 4
call fcn.140003cab
test eax, eax
je 0x140003ec4
mov eax, dword [rsp + 0x3c]
test eax, eax
jns 0x140003ed2
mov r15, qword [sym.imp.KERNEL32.dll_GetTickCount]
xor ebx, ebx
call r15
lea rcx, [0x1400441e0]
mov r13d, eax
call fcn.140008610
mov eax, dword [rsp + 0x3c]
and eax, 0x7fffffff
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x3c], eax
mov edi, dword [rsp + 0x3c]
test edi, edi
jle 0x140003efc
mov eax, 0x4000
lea rcx, [0x1400301c0]
cmp edi, eax
cmovg edi, eax
mov edx, edi
call fcn.140003cab
test eax, eax
je 0x140003ec4
lea rax, [0x1400301c0]
sub dword [rsp + 0x3c], edi
mov qword [0x1400441f8], rax
mov dword [0x140044200], edi
lea rcx, [0x1400441e0]
mov qword [0x140044208], r12
mov dword [0x140044210], ebp
call fcn.14000863c
mov r14d, eax
test eax, eax
js 0x140003ecb
mov rdi, qword [0x140044208]
call r15
mov r9d, eax
mov rax, qword [0x14000d0b0]
sub rdi, r12
test byte [rax + 0x34], 1
je 0x140003e46
mov edx, r9d
mov eax, dword [rsp + 0x3c]
sub edx, r13d
cmp edx, 0xc8
ja 0x140003e04
test eax, eax
jne 0x140003e46
mov ecx, dword [rsp + 0x28]
mov dword [rsp + 0x2c], r9d
lea r13, [rsp + 0x40]
mov edx, 0x64
mov r8d, dword [rsp + 0x28]
sub ecx, eax
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov rcx, r13
lea rdx, str....__d__
mov r8d, eax
call qword [sym.imp.USER32.dll_wsprintfW]
mov rdx, r13
xor ecx, ecx
call fcn.140006ab6
mov r13d, dword [rsp + 0x2c]
test edi, edi
je 0x140003d69
test rsi, rsi
jne 0x140003e72
mov rcx, qword [rsp + 0x118]
mov r8d, edi
mov rdx, r12
call fcn.140007549
test eax, eax
je 0x140003ef7
add ebx, edi
jmp 0x140003e7d
mov r12, qword [0x140044208]
add ebx, edi
sub ebp, edi
dec r14d
jne 0x140003dad
jmp 0x140003efc
mov rcx, qword [rsp + 0x118]
mov r8d, esi
mov rdx, rdi
call fcn.140007549
test eax, eax
je 0x140003ef7
mov eax, dword [rsp + 0x3c]
add ebx, esi
sub eax, esi
mov dword [rsp + 0x3c], eax
test eax, eax
jle 0x140003efc
cmp ebp, eax
mov rcx, rdi
cmovle eax, ebp
mov edx, eax
mov esi, eax
call fcn.140003cab
test eax, eax
jne 0x140003e88
mov ebx, 0xfffffffd
jmp 0x140003efc
mov ebx, 0xfffffffc
jmp 0x140003efc
test rsi, rsi
jne 0x140003ee2
xor ebx, ebx
lea rdi, [0x1400301c0]
jmp 0x140003eab
cmp eax, ebx
mov rcx, rsi
cmovle ebx, eax
mov edx, ebx
call fcn.140003cab
test eax, eax
jne 0x140003efc
jmp 0x140003ec4
mov ebx, 0xfffffffe
mov eax, ebx
add rsp, 0xc8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret