joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007cf08
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rdi, rdx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x14007cf2e
mov r8, rdx
mov rdx, qword [rbx]
call fcn.140081e24
jmp 0x14007cf95
cmp byte [0x1400f0680], 0
jne 0x14007cf72
lea rcx, [0x1400b8098]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14007cf62
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400f0678], rax
jmp 0x14007cf69
mov rax, qword [0x1400f0678]
mov byte [0x1400f0680], 1
jmp 0x14007cf79
mov rax, qword [0x1400f0678]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x14007cf8f
mov r8d, dword [rbx + 8]
xor r9d, r9d
call rax
jmp 0x14007cf95
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14007fb68
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rdi, rcx
mov ebx, 1
mov ecx, dword [rcx + 0x90]
mov sil, bl
mov eax, ecx
and eax, 0xc
cmp al, 0xc
jne 0x14007fbd6
mov rcx, qword [rdi + 8]
mov qword [rsp + 0x30], rcx
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
movsxd rcx, eax
mov qword [rsp + 0x38], rcx
mov rcx, qword [rdi + 8]
mov dword [rsp + 0x40], 0xfffffffe
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov rcx, qword [rdi + 8]
movsxd rbx, eax
call qword [sym.imp.USER32.dll_GetParent]
mov r8, rbx
lea r9, [rsp + 0x30]
mov edx, 0x4e
jmp 0x14007fc00
shr ecx, 2
test bl, cl
je 0x14007fc0b
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov rcx, qword [rdi + 8]
mov ebx, eax
call qword [sym.imp.USER32.dll_GetParent]
mov r9, qword [rdi + 8]
mov edx, VarUI4FromDisp
movzx r8d, bx
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x14007fc4b
mov r8, qword [rdi + 0x50]
lea rdx, str.open
mov dword [rsp + 0x28], ebx
xor r9d, r9d
and qword [rsp + 0x20], 0
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp rax, 0x20
seta sil
jbe 0x14007fc4b
or byte [rdi + 0x94], 2
mov r8d, ebx
mov rcx, qword [rdi + 8]
xor edx, edx
call qword [sym.imp.USER32.dll_InvalidateRect]
mov rbx, qword [rsp + 0x60]
mov al, sil
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret

Function at 0x1400800a0
Capabilities:
Log keystrokes via polling

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1400ef0c8]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, qword [rsp + 0x80]
xorps xmm0, xmm0
movsx eax, r9w
mov rbx, rcx
mov rcx, qword [rcx + 8]
xor r8d, r8d
shr r9, 0x10
mov edx, 0x1012
mov dword [rsp + 0x20], eax
movsx eax, r9w
lea r9, [r11 - 0x30]
mov dword [rsp + 0x24], eax
mov rax, qword [r11 - 0x38]
movups xmmword [rsp + 0x2c], xmm0
mov qword [r11 - 0x30], rax
call qword [sym.imp.USER32.dll_SendMessageW]
xor esi, esi
cmp eax, 0xffffffff
je 0x14008012c
cmp dword [rsp + 0x30], 8
jne 0x14008012c
lea ecx, [rsi + 0x11]
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x14008012c
mov edx, dword [rsp + 0x34]
mov rcx, rbx
call fcn.14007c8bc
mov dword [rdi], esi
mov eax, 1
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400b0f60
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x140080a14
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x30
xor ebp, ebp
mov r10, r9
mov rdi, rcx
cmp dword [rsp + 0x70], ebp
jne 0x140080b12
lea esi, [rbp + 1]
cmp r8d, esi
jne 0x140080a84
mov rdx, qword [rsp + 0x60]
mov r8d, esi
mov qword [rax - 0x18], rdx
mov rdx, qword [rcx + 8]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_CallWindowProcW]
mov rcx, qword [rdi + 8]
lea r9d, [rbp + 0x24]
xor r8d, r8d
mov edx, 0x1036
mov rbx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rsp + 0x68]
mov qword [rcx], rbx
mov eax, esi
jmp 0x140080b14
mov edx, 0x201
cmp r8d, edx
je 0x140080a98
mov edx, 0x203
cmp r8d, edx
jne 0x140080ac3
mov r9, qword [rsp + 0x60]
lea rax, [rsp + 0x70]
mov r8, r10
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x70], esi
call fcn.1400800a0
mov rcx, qword [rsp + 0x68]
mov qword [rcx], rax
cmp dword [rsp + 0x70], ebp
je 0x140080b12
jmp 0x140080a7d
cmp r8d, 0x100
jne 0x140080b12
cmp r10, 0x20
jne 0x140080b0a
mov rcx, qword [rcx + 8]
mov r9, rsi
or r8, 0xffffffffffffffff
mov edx, 0x100c
call qword [sym.imp.USER32.dll_SendMessageW]
mov rbx, rax
cmp eax, 0xffffffff
je 0x140080b0a
mov ecx, send
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x140080b0a
mov edx, ebx
mov rcx, rdi
call fcn.14007c8bc
mov rax, qword [rsp + 0x68]
mov qword [rax], rsi
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x140081e24
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x140081e87
lea rcx, [0x1400b8098]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140081e9b
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140081e9b
mov rcx, qword [rbx]
xor r9d, r9d
and qword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rdx, rdi
mov rcx, rsi
call rax
jmp 0x140081ea0
cmp dword [rcx + 8], 0
je 0x140081e9b
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x140081ea0
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1400820d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x480
mov rax, qword [0x1400ef0c8]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov r15, r9
mov r14, r8
mov rbx, rdx
xor edi, edi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x60], rdi
xor edx, edx
lea r8d, [rdi + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x140082154
xor edx, edx
lea r8d, [rdi + 2]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x140082154
call fcn.14007c330
mov ebx, eax
jmp 0x14008225f
mov r8, r15
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x140082175
call fcn.14007c330
jmp 0x14008224e
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r14, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14008216b
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, ebx
jae 0x1400821b0
mov ebx, 0x8007000e
jmp 0x140082250
mov ecx, eax
test eax, eax
je 0x1400821e2
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x140082297
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x1400821e2
lea rcx, [rsp + 0x60]
call fcn.14007c074
jmp 0x1400821ec
lea rax, [rsp + 0x68]
mov qword [rsp + 0x60], rax
jmp 0x1400821fe
cmp qword [rsp + 0x60], rdi
je 0x1400821a6
mov dword [rsp + 0x28], ebx
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, r14
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x14008216b
mov ecx, eax
mov rax, qword [rsp + 0x60]
mov word [rax + rcx*2], di
mov r8d, dword [rsp + 0x4d0]
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x48]
call fcn.140081f68
mov ebx, eax
test rsi, rsi
je 0x14008225f
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x68]
cmp qword [rsp + 0x60], rax
je 0x140082276
lea rcx, [rsp + 0x60]
call fcn.14007f434
nop
mov eax, ebx
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.1400b0f60
add rsp, 0x480
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
mov ecx, 0x80070216
call fcn.14006b6ec
int3
Function at 0x1400832f8
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
xor ebx, ebx
mov rdi, r8
mov rbp, rdx
mov r14, rcx
test r8, r8
jne 0x140083326
lea eax, [rbx + 0xd]
jmp 0x14008335c
mov rsi, rdi
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
inc eax
lea rsi, [rsi + rax*2]
lea ebx, [rbx + rax*2]
cmp eax, 1
jne 0x140083329
mov rcx, qword [r14]
lea r9d, [rax + 6]
mov dword [rsp + 0x28], ebx
xor r8d, r8d
mov rdx, rbp
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x140084e3c
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x1400ef0c8]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor edx, edx
mov dword [rsp + 0x20], VarUI4FromDisp
mov r8d, VarUI4FromDisp
lea rcx, [rsp + 0x24]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
xor ecx, ecx
test eax, eax
je 0x140084e95
cmp dword [rsp + 0x24], 5
jae 0x140084e97
cmp dword [rsp + 0x24], 4
jne 0x140084e95
cmp dword [rsp + 0x28], 0x5a
jae 0x140084e97
mov cl, 1
mov al, cl
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400b0f60
add rsp, 0x158
ret

Function at 0x140086154
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov ebx, dword [r8 + 0x18]
mov rdi, rcx
call fcn.1400924c4
mov rcx, rax
call fcn.1400922a0
test ebx, ebx
js 0x140086223
mov edx, dword [rdi + 0x5e0]
mov rcx, rax
call fcn.1400765a0
mov rcx, rax
mov edx, ebx
call fcn.140075f98
test rax, rax
je 0x140086223
mov rbx, qword [rax + 8]
cmp dword [rbx - 0xc], 0
jl 0x1400861b0
mov qword [rsp + 0x50], rbx
lock inc dword [rbx - 0xc]
jmp 0x1400861dd
mov rax, qword [0x1400ef018]
mov qword [rsp + 0x50], rax
test rbx, rbx
jne 0x1400861c5
xor eax, eax
jmp 0x1400861ce
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8, rbx
lea rcx, [rsp + 0x50]
mov edx, eax
call fcn.14006b5e4
mov rbx, qword [rsp + 0x50]
lea rdx, str.open
mov r8, rbx
mov dword [rsp + 0x28], 1
and qword [rsp + 0x20], 0
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rbx - 0xc]
cmp rcx, qword [0x1400ef010]
je 0x140086223
or eax, 0xffffffff
lock xadd dword [rcx], eax
sub eax, 1
jg 0x140086223
call fcn.1400b0a54
mov rbx, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x30
pop rdi
ret
Function at 0x140086e70
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rbx, rcx
call fcn.1400924c4
mov rcx, rax
call fcn.1400922a0
mov rcx, qword [rbx + 0x70]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1004
mov r14, rax
or esi, 0xffffffff
xor edi, edi
xor ebp, ebp
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jle 0x140086faf
mov rcx, qword [rbx + 0x70]
mov edx, 0x102c
movsxd r8, ebp
mov r9d, 2
call qword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [rdi + 1]
mov edx, 0x1004
test eax, eax
cmove ecx, edi
mov edi, ecx
mov ecx, ebp
cmove ecx, esi
xor r9d, r9d
mov esi, ecx
xor r8d, r8d
mov rcx, qword [rbx + 0x70]
inc ebp
call qword [sym.imp.USER32.dll_SendMessageW]
cmp ebp, eax
jl 0x140086eb9
cmp edi, 1
jne 0x140086faf
mov edx, dword [rbx + 0x5e0]
mov rcx, r14
call fcn.1400765a0
mov rcx, rax
mov edx, esi
call fcn.140075f98
test rax, rax
je 0x140086faf
mov rbx, qword [rax + 8]
cmp dword [rbx - 0xc], 0
jl 0x140086f3c
mov qword [rsp + 0x50], rbx
lock inc dword [rbx - 0xc]
jmp 0x140086f69
mov rax, qword [0x1400ef018]
mov qword [rsp + 0x50], rax
test rbx, rbx
jne 0x140086f51
xor eax, eax
jmp 0x140086f5a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8, rbx
lea rcx, [rsp + 0x50]
mov edx, eax
call fcn.14006b5e4
mov rbx, qword [rsp + 0x50]
lea rdx, str.open
mov r8, rbx
mov dword [rsp + 0x28], 1
and qword [rsp + 0x20], 0
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rbx - 0xc]
cmp rcx, qword [0x1400ef010]
je 0x140086faf
or eax, 0xffffffff
lock xadd dword [rcx], eax
sub eax, 1
jg 0x140086faf
call fcn.1400b0a54
mov rbx, qword [rsp + 0x58]
xor eax, eax
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x140088b18
Capabilities:
Hide graphical window

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rdi, rcx
call fcn.1400924c4
mov rbx, rax
mov rcx, rax
call fcn.1400922a0
cmp dword [rax + 0x7c], 0
je 0x140088c70
mov rcx, rbx
call fcn.1400922a0
mov rcx, rax
xor edx, edx
call fcn.1400765a0
mov rcx, rax
call fcn.140076678
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.14006d3a4
nop
mov rax, qword [0x1400ef018]
mov qword [rsp + 0x50], rax
lea r9, str.SubHeaderText
lea r8, str.MainDlg
lea rdx, [rsp + 0x48]
mov rcx, rbx
call fcn.140092500
nop
mov r8, qword [rsp + 0x40]
mov rdx, qword [rax]
lea rcx, [rsp + 0x50]
call fcn.14006d4dc
nop
mov rcx, qword [rsp + 0x48]
add rcx, 0xfffffffffffffff4
cmp rcx, qword [0x1400ef010]
je 0x140088bce
or eax, 0xffffffff
lock xadd dword [rcx], eax
sub eax, 1
jg 0x140088bce
mov rcx, qword [rsp + 0x48]
add rcx, 0xfffffffffffffff4
call fcn.1400b0a54
mov rbx, qword [rsp + 0x50]
mov rdx, rbx
mov rcx, qword [rdi + 0x78]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov edx, 5
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_ShowWindow]
mov dword [rsp + 0x30], 0x43
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_SetWindowPos]
mov edx, 1
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_FlashWindow]
nop
lea rcx, [rbx - 0xc]
cmp rcx, qword [0x1400ef010]
je 0x140088c42
or eax, 0xffffffff
lock xadd dword [rcx], eax
sub eax, 1
jg 0x140088c42
call fcn.1400b0a54
nop
mov rcx, qword [rsp + 0x40]
add rcx, 0xfffffffffffffff4
cmp rcx, qword [0x1400ef010]
je 0x140088c84
or eax, 0xffffffff
lock xadd dword [rcx], eax
sub eax, 1
jg 0x140088c84
mov rcx, qword [rsp + 0x40]
add rcx, 0xfffffffffffffff4
call fcn.1400b0a54
jmp 0x140088c84
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x140088cd0
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x760]
sub rsp, 0x860
mov rax, qword [0x1400ef0c8]
xor rax, rsp
mov qword [rbp + 0x750], rax
mov rbx, rcx
xor edx, edx
mov r8d, 0x800
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll_memset
mov rax, qword [0x1400ef018]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov edi, 0x400
mov r8d, edi
lea rdx, [rsp + 0x50]
mov rcx, qword [rbx + 0x1c0]
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r8, [rsp + 0x50]
mov edx, eax
lea rcx, [rsp + 0x38]
call fcn.14006b5e4
mov r8d, edi
lea rdx, [rsp + 0x50]
mov rcx, qword [rbx + 0x1d0]
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r8, [rsp + 0x50]
mov edx, eax
lea rcx, [rsp + 0x30]
call fcn.14006b5e4
call fcn.1400924c4
mov r14, rax
lea rax, [rsp + 0x20]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x48], rax
mov rbx, qword [rsp + 0x30]
lea rsi, [rbx - 0xc]
cmp dword [rsi], 0
jl 0x140088dbf
mov qword [rsp + 0x20], rbx
lock inc dword [rsi]
jmp 0x140088de4
mov rax, qword [0x1400ef018]
mov qword [rsp + 0x20], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8, rbx
mov edx, eax
lea rcx, [rsp + 0x20]
call fcn.14006b5e4
nop
mov rbx, qword [rsp + 0x38]
lea rdi, [rbx - 0xc]
cmp dword [rdi], 0
jl 0x140088dfc
mov qword [rsp + 0x28], rbx
lock inc dword [rdi]
jmp 0x140088e21
mov rax, qword [0x1400ef018]
mov qword [rsp + 0x28], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8, rbx
mov edx, eax
lea rcx, [rsp + 0x28]
call fcn.14006b5e4
nop
mov rcx, r14
call fcn.1400922a0
mov rcx, rax
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x28]
call fcn.14007943c
nop
or ebx, 0xffffffff
cmp rsi, qword [0x1400ef010]
je 0x140088e5d
mov eax, ebx
lock xadd dword [rsi], eax
add eax, ebx
test eax, eax
jg 0x140088e5d
mov rcx, rsi
call fcn.1400b0a54
nop
cmp rdi, qword [0x1400ef010]
je 0x140088e7a
mov eax, ebx
lock xadd dword [rdi], eax
add eax, ebx
test eax, eax
jg 0x140088e7a
mov rcx, rdi
call fcn.1400b0a54
xor eax, eax
mov rcx, qword [rbp + 0x750]
xor rcx, rsp
call fcn.1400b0f60
lea r11, [rsp + 0x860]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14008c3c0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rbp
push r14
push r15
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov rax, qword [0x1400ef0c8]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
mov r15, r8
mov rsi, rdx
mov qword [rsp + 0x38], rdx
and qword [rsp + 0x28], 0
mov rcx, r8
call fcn.14006d1f8
xor edx, edx
mov rcx, rsi
call fcn.14006dda4
mov rdx, rax
lea r8, [0x1400db91c]
lea rcx, [rsp + 0x28]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen_s]
cmp qword [rsp + 0x28], 0
jne 0x14008c45f
mov rax, qword [rsi]
add rax, 0xfffffffffffffff4
cmp rax, qword [0x1400ef010]
je 0x14008c457
or ecx, 0xffffffff
lock xadd dword [rax], ecx
sub ecx, 1
jg 0x14008c457
mov rcx, qword [rsi]
sub rcx, 0xc
call fcn.1400b0a54
or eax, 0xffffffff
jmp 0x14008c55d
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.1400a09cc
jmp 0x14008c4a5
mov r9, qword [rsp + 0x28]
mov edx, 1
mov r8d, 0x200
lea rcx, [rbp - 0x50]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
test rax, rax
je 0x14008c4a5
mov r9d, eax
lea r8, [rbp - 0x50]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.1400a1254
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_feof]
test eax, eax
je 0x14008c470
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
lea r8, [rsp + 0x40]
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x20]
call fcn.1400a0908
xor r14d, r14d
mov rax, qword [0x1400ef018]
mov qword [rsp + 0x30], rax
movzx r8d, byte [rbp + r14 - 0x60]
lea rdx, str._02x
lea rcx, [rsp + 0x30]
call fcn.14006d4dc
mov rbx, qword [rsp + 0x30]
mov r8, rbx
mov edx, dword [rbx - 8]
mov rcx, r15
call fcn.14006ce00
nop
lea rcx, [rbx - 0xc]
cmp rcx, qword [0x1400ef010]
je 0x14008c52a
or eax, 0xffffffff
lock xadd dword [rcx], eax
sub eax, 1
jg 0x14008c52a
call fcn.1400b0a54
inc r14
cmp r14, 0x10
jl 0x14008c4d5
mov rcx, qword [rsi]
add rcx, 0xfffffffffffffff4
cmp rcx, qword [0x1400ef010]
je 0x14008c55b
or eax, 0xffffffff
lock xadd dword [rcx], eax
sub eax, 1
jg 0x14008c55b
mov rcx, qword [rsi]
sub rcx, 0xc
call fcn.1400b0a54
xor eax, eax
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.1400b0f60
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1400906b4
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov dword [rcx + 0x7f8], edx
lea r8, [0x140096118]
xor edi, edi
mov rbx, rcx
mov r9, rcx
mov qword [rsp + 0x28], rdi
xor edx, edx
mov dword [rsp + 0x20], edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
mov qword [rbx + 0x5c8], rax
mov rbx, qword [rsp + 0x40]
setne dil
mov eax, edi
add rsp, 0x30
pop rdi
ret
Function at 0x14009591c
Capabilities:
Acquire debug privileges

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1400ef0c8]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor ebx, ebx
mov rdi, rcx
and qword [rbp - 0x28], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp - 0x28]
lea edx, [rbx + 0x28]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x140095986
lea rdx, str.SetDumpPrivileges:_Could_not_get_the_process_token
lea rcx, [rbp - 0x30]
call fcn.14006c728
lea rcx, [rdi + 0x5d8]
mov r9b, 1
xor r8d, r8d
mov rdx, rax
call fcn.140070150
jmp 0x1400959e6
lea r8, [rbp - 0x1c]
mov dword [rbp - 0x20], 1
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x1400959ad
lea rdx, str.SetDumpPrivileges:_Couldnt_lookup_SeDebugPrivilege_name
jmp 0x140095966
and qword [rsp + 0x28], rbx
lea r8, [rbp - 0x20]
mov rcx, qword [rbp - 0x28]
mov r9d, reloc.WS2_32.dll_recv
and qword [rsp + 0x20], rbx
xor edx, edx
mov dword [rbp - 0x14], 2
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x1400959e1
lea rdx, str.SetDumpPrivileges:_Could_not_revoke_the_debug_privilege
jmp 0x140095966
mov ebx, 1
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x1400959f5
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400b0f60
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret

Function at 0x140095f24
Capabilities:
Enumerate processes
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x1400ef0c8]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rax, qword [0x1400ef018]
mov qword [rsp + 0x20], rax
mov r8d, 0x57b
lea rdx, str.CrashSender_d.exe
lea rcx, [rsp + 0x20]
call fcn.14006d4dc
mov dword [rsp + 0x30], 0x238
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
lea rdx, [rsp + 0x30]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
mov rbx, qword [rsp + 0x20]
cmp eax, 1
jne 0x140095ff2
jmp 0x140095fe0
mov rdx, rbx
lea rcx, [rsp + 0x5c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x140095fe0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, dword [rsp + 0x38]
cmp r8d, eax
je 0x140095fe0
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
mov edx, 1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x30]
mov rcx, rsi
call sub.KERNEL32.dll_Process32NextW
cmp eax, 1
je 0x140095f99
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rbx - 0xc]
cmp rcx, qword [0x1400ef010]
je 0x14009601a
or eax, 0xffffffff
lock xadd dword [rcx], eax
sub eax, 1
jg 0x14009601a
call fcn.1400b0a54
xor eax, eax
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1400b0f60
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret