joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400011e8
Capabilities:
Attach user process memory

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x70
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x60], rax
movups xmm0, xmmword [rdx]
mov rbx, rcx
movdqu xmmword [rsp + 0x20], xmm0
call qword [sym.imp.ntoskrnl.exe_PsGetProcessPeb]
mov rdi, rax
test rax, rax
je 0x140001264
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov rdi, qword [rdi + 0x18]
test rdi, rdi
je 0x140001259
add rdi, 0x10
mov rbx, qword [rdi]
jmp 0x140001254
lea rcx, [rbx + 0x58]
mov r8b, 1
lea rdx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlCompareUnicodeString]
test eax, eax
je 0x140001281
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x14000123b
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140001600
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
ret
mov rbx, qword [rbx + 0x30]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov eax, ebx
jmp 0x140001266

Function at 0x140001294
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x20
and dword [rax + 0x10], 0
lea r9, [rax + 0x10]
xor edx, edx
mov rsi, rcx
xor r8d, r8d
lea ebx, [rdx + 0xb]
mov ecx, ebx
call sub.ntoskrnl.exe_ZwQuerySystemInformation
mov eax, dword [rsp + 0x38]
test eax, eax
je 0x14000135c
mov edx, eax
xor ecx, ecx
mov r8d, 0x4e554c4c
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov r8d, dword [rsp + 0x38]
lea r9, [rsp + 0x38]
mov rdx, rax
mov ecx, ebx
mov rdi, rax
call sub.ntoskrnl.exe_ZwQuerySystemInformation
test eax, eax
js 0x14000135c
lfence
mov r8d, dword [rdi]
xor ebx, ebx
xor ecx, ecx
test r8d, r8d
je 0x140001341
mov eax, ecx
mov r10, rsi
imul r11, rax, 0x128
lea rax, [rdi + 0x30]
add rax, r11
sub r10, rax
movzx edx, byte [rax]
movzx r9d, byte [rax + r10]
sub edx, r9d
jne 0x14000132f
inc rax
test r9d, r9d
jne 0x14000131a
test edx, edx
je 0x14000133c
inc ecx
cmp ecx, r8d
jb 0x140001304
jmp 0x140001341
mov rbx, qword [r11 + rdi + 0x18]
lfence
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
test rbx, rbx
je 0x14000135c
lfence
mov rax, rbx
jmp 0x14000135e
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14000139c
Capabilities:
Find process by pid

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x50
mov rbx, r9
mov rdi, r8
mov rsi, rdx
test rdx, rdx
je 0x140001408
test r8, r8
je 0x140001408
test rbx, rbx
je 0x140001408
and qword [rax + 0x10], 0
lea rdx, [rax - 0x18]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov rcx, qword [rsp + 0x40]
mov r9, rdi
mov r8, rax
mov rdx, rsi
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x28], 0
mov qword [rsp + 0x20], rbx
call sub.ntoskrnl.exe_MmCopyVirtualMemory
test eax, eax
js 0x140001408
mov al, 1
jmp 0x14000140a
xor al, al
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret

Function at 0x14000141c
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0xa0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov rbx, r9
mov rsi, r8
mov rdi, rdx
test rdx, rdx
je 0x140001510
test r8, r8
je 0x140001510
test rbx, rbx
je 0x140001510
lea rdx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
and qword [rsp + 0x28], 0
lea r9, [rsp + 0x38]
xor r8d, r8d
mov qword [rsp + 0x20], 0x30
mov rdx, rdi
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwQueryVirtualMemory]
test eax, eax
js 0x140001505
mov rcx, qword [rsp + 0x38]
lea rdx, [rbx + rdi]
add rcx, qword [rsp + 0x50]
cmp rcx, rdx
jb 0x140001505
test dword [rsp + 0x58], 0x1000
je 0x140001505
mov r9d, dword [rsp + 0x5c]
test r9d, 0x101
jne 0x140001505
test r9b, 0x40
jne 0x1400014e8
test r9b, r9b
js 0x1400014e8
lea eax, [r9*4]
test eax, eax
jne 0x1400014e8
test r9b, 8
je 0x1400014f6
mov r8, rbx
mov rdx, rsi
mov rcx, rdi
call fcn.140001740
lea rcx, [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov al, 1
jmp 0x140001512
lea rcx, [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
xor al, al
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.140001600
add rsp, 0xa0
pop rdi
pop rsi
pop rbx
ret
Function at 0x1000019f8
Capabilities:
Get token membership

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x80
mov rax, qword [0x100007110]
xor rax, rsp
mov qword [rsp + 0x78], rax
xor ebx, ebx
mov byte [rsp + 0x70], bl
mov byte [rsp + 0x71], bl
mov byte [rsp + 0x72], bl
mov byte [rsp + 0x73], bl
mov byte [rsp + 0x74], bl
mov byte [rsp + 0x75], 5
mov qword [r11 - 0x20], rbx
mov dword [rsp + 0x60], ebx
lea rax, [r11 - 0x20]
mov qword [r11 - 0x38], rax
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
lea r8d, [rbx + 0x12]
mov dl, 1
lea rcx, [r11 - 0x18]
call qword [sym.imp.ntdll.dll_RtlAllocateAndInitializeSid]
cmp eax, ebx
jl 0x100001a8b
lea r8, [rsp + 0x60]
mov rdx, qword [rsp + 0x68]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov ecx, dword [rsp + 0x60]
cmp eax, ebx
cmove ecx, ebx
mov dword [rsp + 0x60], ecx
mov rcx, qword [rsp + 0x68]
cmp rcx, rbx
je 0x100001a9b
call qword [sym.imp.ntdll.dll_RtlFreeSid]
mov eax, dword [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.100005070
add rsp, 0x80
pop rbx
ret
Function at 0x100001d34
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0xe0
mov rax, qword [0x100007110]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov r13, rdx
mov r12, rcx
xor edi, edi
lea r14d, [rdi + 0x40]
mov dword [rsp + 0x3c], edi
mov rbx, rdi
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rdi
mov dword [rsp + 0x34], edi
mov word [rsp + 0x60], di
xor edx, edx
lea r8d, [rdi + 0x62]
lea rcx, [rsp + 0x62]
call sub.msvcrt.dll_memset
mov qword [rsp + 0x58], rdi
lea rdx, [rsp + 0x3c]
mov rcx, r12
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp eax, edi
je 0x100001ec7
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rsi
lea edx, [rdi + 8]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
mov qword [rsp + 0x48], rax
cmp rax, rdi
je 0x100001ec7
mov r9, rax
mov r8d, esi
mov edx, dword [rsp + 0x3c]
mov rcx, r12
call sub.VERSION.dll_GetFileVersionInfoW
cmp eax, edi
je 0x100001ec7
lea r9, [rsp + 0x34]
lea r8, [rsp + 0x50]
lea rdx, [0x100001608]
mov rcx, rbx
call sub.VERSION.dll_VerQueryValueW
cmp eax, edi
je 0x100001ec7
mov rdx, qword [rsp + 0x50]
movzx r8d, word [rdx]
mov word [rsp + 0x38], r8w
movzx r9d, word [rdx + 2]
mov word [rsp + 0x30], r9w
mov ecx, edi
mov dword [rsp + 0x40], ecx
mov eax, dword [rsp + 0x34]
shr eax, 2
cmp ecx, eax
jae 0x100001e75
mov r10d, ecx
movzx eax, word [rdx + r10*4]
mov r11d, 0x3ff
and ax, r11w
mov r11d, 9
cmp r11w, ax
jne 0x100001e6d
mov r8w, word [rdx + r10*4]
mov word [rsp + 0x38], r8w
mov r9w, word [rdx + r10*4 + 2]
mov word [rsp + 0x30], r9w
inc ecx
mov dword [rsp + 0x40], ecx
jmp 0x100001e2d
movzx eax, r9w
movzx r9d, r8w
mov dword [rsp + 0x20], eax
lea r8, [0x100001640]
mov edx, 0x64
lea rcx, [rsp + 0x60]
call fcn.100003a80
cmp eax, edi
jl 0x100001ec7
lea r9, [rsp + 0x34]
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x60]
mov rcx, rbx
call sub.VERSION.dll_VerQueryValueW
cmp eax, edi
je 0x100001ec7
mov edx, r14d
mov r8, qword [rsp + 0x58]
mov rcx, r13
call fcn.100003a0c
nop
cmp rbx, rdi
je 0x100001ee0
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.100005070
mov rbx, qword [rsp + 0x120]
add rsp, 0xe0
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x10000201c
Capabilities:
Get common file path
Get program files directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
xor esi, esi
cmp dword [0x100007ae8], esi
je 0x100002148
lea rdi, [0x100007880]
lea edx, [rsi + 0x24]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea ebx, [rsi + 0x41]
cmp eax, esi
jl 0x1000020ca
lea r10, [0x1000077f0]
mov r9, rdi
mov rdx, rbx
mov rcx, r10
sub r9, r10
mov r8d, esi
lea rax, [rdx + 0x7fffffbd]
cmp rax, rsi
je 0x100002096
movzx eax, word [r9 + rcx]
cmp ax, si
je 0x100002096
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x100002073
cmp rdx, rsi
jne 0x1000020a5
sub rcx, 2
mov r8d, 0x8007007a
cmp r8d, esi
mov word [rcx], si
jge 0x1000020b6
mov word [0x1000077f0], si
jmp 0x1000020ca
lea r8, [0x100001530]
mov edx, 0x82
mov rcx, r10
call fcn.100003974
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 0x26]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp eax, esi
jl 0x100002148
lea r9, [0x100007760]
mov edx, esi
mov rcx, r9
sub rdi, r9
lea rax, [rbx + 0x7fffffbd]
cmp rax, rsi
je 0x100002116
movzx eax, word [rdi + rcx]
cmp ax, si
je 0x100002116
mov word [rcx], ax
add rcx, 2
sub rbx, 1
jne 0x1000020f4
cmp rbx, rsi
jne 0x100002124
sub rcx, 2
mov edx, 0x8007007a
cmp edx, esi
mov word [rcx], si
jge 0x100002134
mov word [0x100007760], si
jmp 0x100002148
lea r8, [0x100001530]
mov edx, 0x82
mov rcx, r9
call fcn.100003974
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x100002814
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x100007110]
xor rax, rsp
mov qword [rsp + 0x58], rax
xor ebp, ebp
mov rsi, rdx
mov rbx, rcx
lea edx, [rbp - 0x20]
mov qword [rsp + 0x28], rbp
call qword [sym.imp.USER32.dll_GetClassLongW]
mov ecx, 0x8002
cmp cx, ax
mov rcx, rbx
jne 0x10000285d
lea edx, [rbp - 6]
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
jmp 0x100002868
mov edx, 0xffffffe8
call qword [sym.imp.USER32.dll_GetClassLongPtrW]
mov rdi, rax
cmp rax, rbp
je 0x100002957
lea r9, [rsp + 0x24]
lea rdx, [rsp + 0x28]
mov r8d, 8
mov rcx, rsi
call sub.KERNEL32.dll_K32EnumProcessModules
cmp eax, ebp
je 0x1000029c1
mov eax, dword [rsp + 0x24]
add eax, 0x50
mov dword [rsp + 0x24], eax
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
cmp rax, rbp
je 0x100002957
mov r8d, dword [rsp + 0x24]
lea r9, [rsp + 0x20]
mov rdx, rax
mov rcx, rsi
call sub.KERNEL32.dll_K32EnumProcessModules
cmp eax, ebp
je 0x100002943
mov ecx, dword [rsp + 0x20]
mov eax, ebp
shr ecx, 3
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x24], ecx
cmp ecx, ebp
jbe 0x100002943
mov edx, eax
lea r8, [rsp + 0x30]
mov r9d, 0x18
mov rdx, qword [rbx + rdx*8]
mov rcx, rsi
call sub.KERNEL32.dll_K32GetModuleInformation
cmp eax, ebp
je 0x100002924
cmp qword [rsp + 0x30], rdi
jg 0x100002924
mov eax, dword [rsp + 0x38]
add rax, qword [rsp + 0x30]
cmp rdi, rax
jl 0x100002936
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
cmp eax, dword [rsp + 0x24]
jae 0x100002943
jmp 0x1000028f2
mov eax, dword [rsp + 0x20]
mov rcx, qword [rbx + rax*8]
mov qword [rsp + 0x28], rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x28]
cmp rbx, rbp
je 0x1000029d0
xor edx, edx
lea rcx, [rsp + 0x32]
mov word [rsp + 0x30], bp
lea r8d, [rdx + 0x26]
call sub.msvcrt.dll_memset
lea r8, [rsp + 0x30]
mov r9d, 0x14
mov rdx, rbx
mov rcx, rsi
call sub.KERNEL32.dll_K32GetModuleBaseNameW
cmp eax, ebp
je 0x1000029cb
lea rdx, [0x1000016d0]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
cmp eax, ebp
je 0x1000029bc
lea rdx, [0x1000016e8]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
cmp eax, ebp
jne 0x1000029cb
mov rbx, rbp
jmp 0x1000029d0
mov rbx, rbp
mov qword [rsp + 0x28], rbx
jmp 0x10000295c
mov rbx, qword [rsp + 0x28]
mov rax, rbx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.100005070
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
Function at 0x100003c14
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x80
mov rsi, rcx
lea r9, [0x100001800]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov edi, 1
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rbx, rax
test rax, rax
je 0x100003c68
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x100003c68
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
jmp 0x100003d2e
cmp dword [0x100007ae8], 0
je 0x100003ca0
lea rcx, [0x100007120]
xor r8d, r8d
mov edx, 0xf0403
call sub.ntdll.dll_WinSqmStartSession
lea r8, [0x100001820]
mov edx, 0x583
mov rcx, rax
mov qword [0x100007af0], rax
call sub.ntdll.dll_WinSqmSetString
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__atoi64]
mov qword [0x100007a90], rax
test rax, rax
je 0x100003d01
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
mov qword [rsp + 0x20], 0xab0
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [0x100007a88], rax
test rax, rax
je 0x100003cfc
lea rcx, [rsp + 0x30]
call fcn.100003f18
mov edx, 0x3e8
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 1]
call fcn.100004134
jmp 0x100003d01
mov edi, 0xfffffffe
test rbx, rbx
je 0x100003d0f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x100007ae8], 0
je 0x100003d2c
mov rcx, qword [0x100007af0]
call sub.ntdll.dll_WinSqmEndSession
and qword [0x100007af0], 0
mov eax, edi
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x100003d4c
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x180
mov rax, qword [0x100007110]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov r13, rdx
mov esi, ecx
mov edi, 0x3f0
xor ebx, ebx
mov word [rsp + 0x100], bx
xor edx, edx
lea r8d, [rbx + 0x62]
lea rcx, [rsp + 0x102]
call sub.msvcrt.dll_memset
mov dword [rsp + 0x90], ebx
xor edx, edx
lea r8d, [rbx + 0x60]
lea rcx, [rsp + 0x98]
call sub.msvcrt.dll_memset
mov qword [rsp + 0x70], rbx
xor eax, eax
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x60], rbx
mov r12d, ebx
mov dword [rsp + 0x68], ebx
cmp esi, 0xffffffff
je 0x100003eca
lea rdx, [rsp + 0x60]
mov ecx, esi
call sub.WTSAPI32.dll_WTSQueryUserToken
cmp eax, ebx
jne 0x100003dff
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [rsp + 0x6c], eax
jmp 0x100003eca
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
cmp eax, ebx
jne 0x100003e1f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [rsp + 0x6c], eax
jmp 0x100003eca
mov r12d, 1
mov dword [rsp + 0x68], r12d
mov r9, r13
lea r8, [0x100001850]
lea edx, [r12 + 0x31]
lea rcx, [rsp + 0x100]
call fcn.1000046cc
mov dword [rsp + 0x90], 0x68
mov dword [rsp + 0xcc], r12d
lea eax, [r12 + 6]
mov word [rsp + 0xd0], ax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, [rsp + 0x100]
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov edi, eax
cmp eax, ebx
je 0x100003eca
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp r12d, ebx
je 0x100003ed5
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov rcx, qword [rsp + 0x60]
cmp rcx, rbx
je 0x100003ee5
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.100005070
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x180005600
Capabilities:
Create process on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
push rdi
sub rsp, 0xd0
mov rax, qword [0x1800852a8]
xor rax, rsp
mov qword [rsp + 0xc8], rax
mov rbx, rcx
mov qword [r11 - 0x18], rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [r11 - 0x58], xmm0
movups xmmword [r11 - 0x48], xmm0
movups xmmword [r11 - 0x38], xmm0
movups xmmword [r11 - 0x28], xmm0
mov qword [rsp + 0x50], 0x70
xor edi, edi
mov qword [r11 - 0x80], rdi
lea rax, [0x180085f40]
cmp qword [0x180085f58], 8
cmovae rax, qword [0x180085f40]
mov qword [r11 - 0x78], rax
mov rax, rcx
cmp qword [rcx + 0x18], 8
jb 0x180005685
mov rax, qword [rcx]
mov qword [rsp + 0x68], rax
lea rax, [0x1800752c8]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rdi
mov dword [rsp + 0x80], edi
mov qword [rsp + 0x88], rdi
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x1800056dc
mov edx, 0xffffffff
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1800056f2
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.180009450
mov rcx, rax
call fcn.180005600
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x18000572d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x180005728
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18000575d
mov rcx, r8
call fcn.18002ead0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 7
mov word [rbx], di
mov rcx, qword [rsp + 0xc8]
xor rcx, rsp
call fcn.18002eab0
mov rbx, qword [rsp + 0xe8]
add rsp, 0xd0
pop rdi
ret
call fcn.1800400b8
int3
Function at 0x1800072b0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp edx, 1
jne 0x1800072d8
xor eax, eax
lea r8, [0x180006b10]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
add rsp, 0x38
ret

Function at 0x1800079d0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov r14, r8
mov rbp, rdx
mov rdi, rcx
mov rbx, r8
je 0x180007a68
test r8, r8
jle 0x180007a60
nop word [rax + rax]
mov rcx, rdi
call fcn.18000a5c0
test rax, rax
jle 0x180007a3e
mov rcx, qword [rdi + 0x40]
cmp rbx, rax
mov rsi, rbx
mov rdx, rbp
cmovge rsi, rax
mov r8, rsi
mov rcx, qword [rcx]
call fcn.180030e60
mov rax, qword [rdi + 0x58]
sub rbx, rsi
sub dword [rax], esi
mov rcx, qword [rdi + 0x40]
movsxd rax, esi
add qword [rcx], rax
jmp 0x180007a58
mov rax, qword [rdi]
mov rcx, rdi
movzx edx, byte [rbp]
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x180007a60
dec rbx
mov esi, 1
add rbp, rsi
test rbx, rbx
jg 0x180007a00
sub r14, rbx
mov rax, r14
jmp 0x180007ae6
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], r15
mov r9, qword [rax]
test r9, r9
je 0x180007a81
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x180007a83
xor ecx, ecx
movsxd rsi, ecx
test r14, r14
jle 0x180007adb
test ecx, ecx
jle 0x180007abc
cmp r14, rsi
mov rcx, r9
cmovl rsi, r14
mov r8, rsi
call fcn.180030e60
mov rax, qword [rdi + 0x58]
add rbp, rsi
sub r14, rsi
sub dword [rax], esi
mov rcx, qword [rdi + 0x40]
movsxd rax, esi
add qword [rcx], rax
test r14, r14
jle 0x180007adb
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x180007adb
mov r8, r14
mov edx, 1
mov rcx, rbp
call fcn.18004154c
sub r14, rax
mov r15, qword [rsp + 0x40]
sub rbx, r14
mov rax, rbx
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x180007b00
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x180007b22
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x180007b9c
mov rdi, r14
mov rcx, rbx
call fcn.18000a5e0
test rax, rax
jle 0x180007b74
mov rdx, qword [rbx + 0x38]
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov r8, rbp
mov rdx, qword [rdx]
call fcn.180030e60
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x180007b8c
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x180007b94
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x180007b36
sub r14, rdi
jmp 0x180007c7f
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x180007bb3
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x180007bb5
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x180007be7
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.180030e60
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x180007c7c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x180007c22
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x180007c5d
nop dword [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.180041830
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x180007c7c
cmp rbp, rax
ja 0x180007c30
test rbp, rbp
je 0x180007c7c
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.180041830
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
Function at 0x1800080a0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1800852a8]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x1800080cd
xor eax, eax
jmp 0x180008213
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x180008107
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x180008107
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x180008213
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x180008206
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x18000814a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x180008159
movsx ecx, dil
jmp 0x1800081ad
lea r8, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x51]
lea r8, [rsp + 0x78]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x48]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x50]
call qword [rax + 0x38]
test eax, eax
je 0x1800081c7
sub eax, 1
je 0x1800081c7
cmp eax, 2
jne 0x180008206
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call fcn.18004036c
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x18000820b
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x1800081f4
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call fcn.18004154c
cmp rsi, rax
jne 0x180008206
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, edi
jne 0x18000820b
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.18002eab0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret