joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a7790
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
call fcn.1400a7810
mov eax, 0xffffffff
cmp rbx, rax
jbe 0x1400a77b4
call fcn.1400a7050
mov edx, ebx
mov rcx, rdi
call sub.ADVAPI32.dll_SystemFunction036
test al, al
jne 0x1400a77c7
call fcn.1400a7050
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400a8830
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov dword [rcx], 0x61707865
mov dword [rcx + 4], 0x3320646e
mov dword [rcx + 8], 0x79622d32
mov dword [rcx + 0xc], 0x6b206574
mov eax, dword [rdx]
mov dword [rcx + 0x10], eax
mov eax, dword [rdx + 4]
mov dword [rcx + 0x14], eax
mov eax, dword [rdx + 8]
mov dword [rcx + 0x18], eax
mov eax, dword [rdx + 0xc]
mov dword [rcx + 0x1c], eax
mov eax, dword [rdx + 0x10]
mov dword [rcx + 0x20], eax
mov eax, dword [rdx + 0x14]
mov dword [rcx + 0x24], eax
mov eax, dword [rdx + 0x18]
mov dword [rcx + 0x28], eax
mov eax, dword [rdx + 0x1c]
mov dword [rcx + 0x2c], eax
ret
Function at 0x1400abc30
Capabilities:
Hash data using sha512

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movabs rax, 0x6a09e667f3bcc908
mov rbx, rdx
mov qword [rcx], rax
mov rdi, rcx
movabs rax, 0xbb67ae8584caa73b
xor edx, edx
mov qword [rcx + 8], rax
mov r8d, 0x129
movabs rax, 0x3c6ef372fe94f82b
mov qword [rcx + 0x10], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rcx + 0x18], rax
movabs rax, 0x510e527fade682d1
mov qword [rcx + 0x20], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rcx + 0x28], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rcx + 0x30], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rcx + 0x38], rax
add rcx, 0x40
call sub.VCRUNTIME140.dll_memset
mov rax, qword [rbx]
xor qword [rdi], rax
mov rax, qword [rbx + 8]
xor qword [rdi + 8], rax
mov rax, qword [rbx + 0x10]
xor qword [rdi + 0x10], rax
mov rax, qword [rbx + 0x18]
xor qword [rdi + 0x18], rax
mov rax, qword [rbx + 0x20]
xor qword [rdi + 0x20], rax
mov rax, qword [rbx + 0x28]
xor qword [rdi + 0x28], rax
mov rax, qword [rbx + 0x30]
xor qword [rdi + 0x30], rax
mov rax, qword [rbx + 0x38]
xor qword [rdi + 0x38], rax
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x1400b1ce0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x10
mov rax, qword [0x1400cb008]
xor rax, rsp
mov qword [rsp + 8], rax
xor r8d, r8d
lea r15, [0x1400c02a0]
mov dword [rsp], r8d
mov r9, rcx
movzx edi, byte [rsp + 3]
xor eax, eax
movzx esi, byte [rsp + 2]
movzx ebx, r8b
movzx ebp, byte [rsp + 1]
movzx r14d, r8b
mov word [rsp + 4], r8w
movzx r11d, byte [rsp + 5]
nop dword [rax]
movzx edx, byte [r9 + rax]
movzx ecx, byte [rax + r15]
movzx r10d, byte [rax + r15 + 0xc0]
xor cl, dl
or cl, r14b
xor r10b, dl
movzx r14d, cl
or r10b, r8b
movzx ecx, byte [rax + r15 + 0x20]
movzx r8d, r10b
xor cl, dl
or cl, bpl
movzx ebp, cl
movzx ecx, byte [rax + r15 + 0x40]
xor cl, dl
or cl, sil
movzx esi, cl
movzx ecx, byte [rax + r15 + 0x60]
xor cl, dl
or cl, dil
movzx edi, cl
movzx ecx, byte [rax + r15 + 0x80]
xor cl, dl
or cl, bl
movzx ebx, cl
movzx ecx, byte [rax + r15 + 0xa0]
inc rax
xor cl, dl
or cl, r11b
movzx r11d, cl
cmp rax, 0x1f
jb 0x1400b1d40
movzx ecx, byte [rax + r9]
movzx r9d, byte [rax + r15 + 0xc0]
and cl, 0x7f
movzx edx, byte [rax + r15 + 0xa0]
movzx r8d, cl
xor edx, r8d
movzx ecx, r10b
or edx, r11d
xor r9d, r8d
dec edx
or r9d, ecx
dec r9d
or r9d, edx
movzx edx, byte [rax + r15 + 0x80]
xor edx, r8d
or edx, ebx
dec edx
or r9d, edx
movzx edx, byte [rax + r15]
xor edx, r8d
or edx, r14d
dec edx
or r9d, edx
movzx edx, byte [rax + r15 + 0x20]
xor edx, r8d
or edx, ebp
dec edx
or r9d, edx
movzx edx, byte [rax + r15 + 0x40]
movzx eax, byte [rax + r15 + 0x60]
xor edx, r8d
xor eax, r8d
or edx, esi
or eax, edi
dec edx
dec eax
or r9d, edx
or eax, r9d
shr eax, 8
and eax, 1
mov rcx, qword [rsp + 8]
xor rcx, rsp
call fcn.1400a7320
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x10
pop r15
pop r14
pop rdi
ret

Function at 0x1400b2780
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov eax, dword [rdx]
mov dword [rcx + 0x14], eax
mov eax, dword [rdx + 4]
mov dword [rcx + 0x28], eax
mov eax, dword [rdx + 8]
mov dword [rcx + 0x3c], eax
mov eax, dword [rdx + 0xc]
mov dword [rcx + 0x30], eax
mov eax, dword [rdx + 0x10]
mov dword [rcx + 0x1c], eax
mov eax, dword [rdx + 0x14]
mov dword [rcx + 0x10], eax
mov eax, dword [rdx + 0x18]
mov dword [rcx + 0x24], eax
mov eax, dword [rdx + 0x1c]
mov dword [rcx + 0x38], eax
mov dword [rcx], 0x61707865
mov dword [rcx + 4], 0x3320646e
mov dword [rcx + 8], 0x79622d32
mov dword [rcx + 0xc], 0x6b206574
ret
Function at 0x1400b5890
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rcx
xor eax, eax
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], eax
mov rcx, qword [rsp + 0x10]
movzx edx, byte [rcx + rax]
mov rcx, qword [rsp + 0x18]
movzx r9d, byte [rcx + rax]
inc rax
mov ecx, dword [rsp + 8]
xor r9d, edx
or ecx, r9d
mov dword [rsp + 8], ecx
cmp rax, 0x10
jl 0x1400b58a0
mov eax, dword [rsp + 8]
dec eax
shr eax, 8
and eax, 1
dec eax
ret
Function at 0x1400013f0
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
sub rsp, 0x68
mov rax, qword [0x140047f48]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor edx, edx
mov ecx, 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0xffffffffffffffff
je 0x1400014bc
mov dword [rsp + 0x30], 0x1c
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x1400014b1
mov eax, dword [rsp + 0x30]
cmp rax, 0x10
jb 0x140001496
mov eax, dword [rsp + 0x78]
cmp dword [rsp + 0x38], eax
je 0x140001496
mov eax, dword [rsp + 0x70]
cmp dword [rsp + 0x3c], eax
jne 0x140001496
mov r8d, dword [rsp + 0x38]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x140001496
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x30], 0x1c
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x140001443
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14000fe40
add rsp, 0x68
ret

Function at 0x1400014e0
Capabilities:
Enumerate threads
Resume thread

Disassembly:
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
sub rsp, 0x68
mov rax, qword [0x140047f48]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor edx, edx
mov ecx, 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0xffffffffffffffff
je 0x1400015ac
mov dword [rsp + 0x30], 0x1c
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x1400015a1
mov eax, dword [rsp + 0x30]
cmp rax, 0x10
jb 0x140001586
mov eax, dword [rsp + 0x78]
cmp dword [rsp + 0x38], eax
je 0x140001586
mov eax, dword [rsp + 0x70]
cmp dword [rsp + 0x3c], eax
jne 0x140001586
mov r8d, dword [rsp + 0x38]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x140001586
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x30], 0x1c
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x140001533
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14000fe40
add rsp, 0x68
ret
Function at 0x140001740
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x178
mov rax, qword [0x140047f48]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov byte [rsp + 0x20], 0
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x14000178b
xor eax, eax
jmp 0x1400017cc
lea rdx, [rsp + 0x5c]
mov rcx, qword [rsp + 0x180]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x1400017a9
mov byte [rsp + 0x20], 1
jmp 0x1400017bc
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x14000178b
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, byte [rsp + 0x20]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.14000fe40
add rsp, 0x178
ret

Function at 0x1400017f0
Capabilities:
Get hostname
Initialize winsock library

Disassembly:
sub rsp, 0x2d8
mov rax, qword [0x140047f48]
xor rax, rsp
mov qword [rsp + 0x2c0], rax
lea rdx, [rsp + 0x20]
mov cx, 0x101
call sub.WS2_32.dll_WSAStartup
test eax, eax
je 0x14000181d
jmp 0x14000183d
mov edx, 0x100
lea rcx, [rsp + 0x1c0]
call sub.WS2_32.dll_gethostname
test eax, eax
jne 0x14000183d
lea rax, [rsp + 0x1c0]
jmp 0x140001842
call sub.WS2_32.dll_WSACleanup
mov rcx, qword [rsp + 0x2c0]
xor rcx, rsp
call fcn.14000fe40
add rsp, 0x2d8
ret
Function at 0x140001890
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xc8
mov rax, qword [0x140047f48]
xor rax, rsp
mov qword [rsp + 0xb8], rax
mov edx, 0x18
lea rcx, [rsp + 0x60]
call fcn.1400097e0
lea rcx, [rsp + 0x60]
call fcn.140004e40
mov ecx, 0x18
call fcn.140014784
mov qword [rsp + 0x20], rax
lea rcx, str.DNSAPI.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rsp + 0x30], rax
mov byte [rsp + 0xa0], 0x44
mov byte [rsp + 0xa1], WSAStartup
mov byte [rsp + 0xa2], reloc.WS2_32.dll_WSAStartup
mov byte [rsp + 0xa3], 0x47
mov byte [rsp + 0xa4], 0x65
mov byte [rsp + 0xa5], reloc.WS2_32.dll_WSACleanup
mov byte [rsp + 0xa6], 0x43
mov byte [rsp + 0xa7], 0x61
mov byte [rsp + 0xa8], 0x63
mov byte [rsp + 0xa9], 0x68
mov byte [rsp + 0xaa], 0x65
mov byte [rsp + 0xab], 0x44
mov byte [rsp + 0xac], 0x61
mov byte [rsp + 0xad], reloc.WS2_32.dll_WSACleanup
mov byte [rsp + 0xae], 0x61
mov byte [rsp + 0xaf], 0x54
mov byte [rsp + 0xb0], 0x61
mov byte [rsp + 0xb1], 0x62
mov byte [rsp + 0xb2], WSAStartup
mov byte [rsp + 0xb3], 0x65
mov byte [rsp + 0xb4], 0
lea rdx, [rsp + 0xa0]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x20]
call qword [rsp + gethostname]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x140001a36
lea rcx, [rsp + 0x78]
call fcn.140004ee0
mov rax, qword [rsp + 0x20]
mov rdx, qword [rax + 8]
lea rcx, [rsp + 0x40]
call fcn.140004c30
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.140005e50
lea rcx, [rsp + 0x40]
call fcn.140005910
mov rax, qword [rsp + 0x20]
movzx eax, word [rax + 0x10]
mov dword [rsp + 0x98], eax
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x60]
call fcn.14000bcd0
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x78]
call fcn.140005a60
jmp 0x1400019c2
mov rcx, qword [rsp + 0x20]
call fcn.140014770
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0xd0]
call fcn.140004dd0
lea rcx, [rsp + 0x60]
call fcn.140005a40
mov rax, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.14000fe40
add rsp, 0xc8
ret
Function at 0x1400020b0
Capabilities:
Hide thread from debugger

Disassembly:
sub rsp, 0x48
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rsp + 0x28], rax
lea rdx, str.NtSetInformationThread
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x11
mov rcx, rax
call qword [rsp + 0x30]
mov dword [rsp + 0x20], eax
add rsp, 0x48
ret

Function at 0x140002110
Capabilities:
Enumerate services

Disassembly:
sub rsp, 0x78
mov rax, qword [0x140047f48]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x58], 0
mov r8d, 4
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
jne 0x140002181
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x1400492f0]
call fcn.140005f40
lea rdx, [0x140004420]
mov rcx, rax
call fcn.140006130
lea rcx, [0x140030520]
call fcn.14000c3f0
mov eax, 0xffffffff
jmp 0x1400022a0
mov dword [rsp + 0x64], 0
mov dword [rsp + 0x5c], 0
mov dword [rsp + 0x60], 0
mov edx, 0x10000
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x64]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x10000
mov r9, qword [rsp + 0x48]
mov r8d, 3
mov edx, 0x30
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
test eax, eax
je 0x1400021fa
mov byte [rsp + 0x40], 1
jmp 0x1400021ff
mov byte [rsp + 0x40], 0
movzx eax, byte [rsp + 0x40]
mov byte [rsp + 0x41], al
movzx eax, byte [rsp + 0x41]
test eax, eax
jne 0x140002224
lea rcx, [0x140030538]
call fcn.14000c3f0
mov eax, 0xffffffff
jmp 0x1400022a0
mov dword [rsp + 0x44], 0
jmp 0x140002238
mov eax, dword [rsp + 0x44]
inc eax
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x5c]
cmp dword [rsp + 0x44], eax
jae 0x140002293
movsxd rax, dword [rsp + 0x44]
imul rax, rax, 0x30
lea rdx, str.VMware_Tools
mov rcx, qword [rsp + 0x48]
mov rcx, qword [rcx + rax + 8]
call fcn.14000c080
test rax, rax
jne 0x14000228a
movsxd rax, dword [rsp + 0x44]
imul rax, rax, 0x30
lea rdx, str.VMware
mov rcx, qword [rsp + 0x48]
mov rcx, qword [rcx + rax + 8]
call fcn.14000c080
test rax, rax
je 0x140002291
mov eax, 1
jmp 0x1400022a0
jmp 0x14000222e
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14000fe40
add rsp, 0x78
ret
Function at 0x1400022c0
Capabilities:
Enumerate services

Disassembly:
sub rsp, 0x78
mov rax, qword [0x140047f48]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x58], 0
mov r8d, 4
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jne 0x140002331
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x1400492f0]
call fcn.140005f40
lea rdx, [0x140004420]
mov rcx, rax
call fcn.140006130
lea rcx, str.OpenSCManager_Eorror_n
call fcn.14000c3f0
mov eax, 0xffffffff
jmp 0x14000242c
mov dword [rsp + 0x64], 0
mov dword [rsp + 0x5c], 0
mov dword [rsp + 0x60], 0
mov edx, 0x10000
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x64]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x10000
mov r9, qword [rsp + 0x50]
mov r8d, 3
mov edx, 0x30
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
test eax, eax
je 0x1400023aa
mov byte [rsp + 0x40], 1
jmp 0x1400023af
mov byte [rsp + 0x40], 0
movzx eax, byte [rsp + 0x40]
mov byte [rsp + 0x41], al
movzx eax, byte [rsp + 0x41]
test eax, eax
jne 0x1400023d4
lea rcx, str.EnumServicesStatus_Eorror_n
call fcn.14000c3f0
mov eax, 0xffffffff
jmp 0x14000242c
mov dword [rsp + 0x44], 0
jmp 0x1400023e8
mov eax, dword [rsp + 0x44]
inc eax
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x5c]
cmp dword [rsp + 0x44], eax
jae 0x14000241f
movsxd rax, dword [rsp + 0x44]
imul rax, rax, 0x30
lea rdx, str.Virtual_Machine
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + rax + 8]
call fcn.14000c080
test rax, rax
je 0x14000241d
mov eax, 1
jmp 0x14000242c
jmp 0x1400023de
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14000fe40
add rsp, 0x78
ret
Function at 0x140002450
Capabilities:
Move file

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x98
mov rax, qword [0x140047f48]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x28], 0
call fcn.1400017f0
mov qword [rsp + 0x28], rax
lea rdx, str.DESKTOP_H9URB7T
lea rcx, [rsp + 0x60]
call fcn.140004ab0
lea rdx, str.BUXF_O02J2Q
lea rcx, [rsp + 0x40]
call fcn.140004ab0
call fcn.140002110
mov dword [rsp + 0x20], eax
call fcn.1400022c0
mov dword [rsp + 0x24], eax
cmp dword [0x14004907c], 2
jbe 0x14000259d
cmp dword [rsp + 0x20], 0
jne 0x140002581
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x28]
call fcn.140002890
movzx eax, al
test eax, eax
je 0x140002581
cmp dword [rsp + 0x24], 0
jne 0x140002581
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
call fcn.140002890
movzx eax, al
test eax, eax
je 0x140002581
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8d, 1
xor edx, edx
mov rcx, rax
call qword [sym.imp.dbghelp.dll_SymInitializeW]
call fcn.1400020b0
mov r9d, 0x10
lea r8, [0x1400305e8]
lea rdx, [0x140030600]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0xa8]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x38], rax
lea rax, [0x140030698]
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_MoveFileA]
call fcn.140001b40
jmp 0x14000259d
mov r9d, 0x10
lea r8, str.Microsoft_Office
lea rdx, str.Word
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
lea rcx, [rsp + 0x40]
call fcn.1400058e0
lea rcx, [rsp + 0x60]
call fcn.1400058e0
xor eax, eax
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14000fe40
add rsp, 0x98
ret
Function at 0x14000c530
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov edx, 0x40
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x14000c56b
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14000c572
xor eax, eax
jmp 0x14000c634
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov edx, pe_nt_image_headers64
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x14000c5ac
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x14000c5b3
xor eax, eax
jmp 0x14000c634
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0xc], 0
je 0x14000c620
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x38]
call fcn.140016da4
test eax, eax
jne 0x14000c610
jmp 0x14000c620
mov rax, qword [rsp + 0x28]
add rax, 0x14
mov qword [rsp + 0x28], rax
jmp 0x14000c5d8
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0xc], 0
jne 0x14000c62f
xor eax, eax
jmp 0x14000c634
mov rax, qword [rsp + 0x28]
add rsp, 0x48
ret

Function at 0x14000c970
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x290
mov rax, qword [0x140047f48]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov dword [rsp + 0x40], 0x238
lea rax, [rsp + 0x44]
mov rdi, rax
xor eax, eax
mov ecx, 0x234
rep stosb byte [rdi], al
cmp qword [rsp + 0x2a0], 0
je 0x14000c9cd
cmp qword [rsp + 0x2a8], 0
jne 0x14000c9d1
xor eax, eax
jmp 0x14000ca45
xor edx, edx
mov ecx, 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
call sub.KERNEL32.dll_Module32First
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x14000ca40
mov rax, qword [rsp + 0x2b8]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x2b0]
mov r8, qword [rsp + 0x2a8]
mov rdx, qword [rsp + 0x2a0]
mov rcx, qword [rsp + 0x68]
call fcn.14000c6d0
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
call sub.KERNEL32.dll_Module32Next
mov dword [rsp + 0x30], eax
jmp 0x14000c9f5
mov eax, 1
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.14000fe40
add rsp, 0x290
pop rdi
ret

Function at 0x14001c3cc
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14001c1f8
Function at 0x414c60
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x414deb
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.004321e0
xorps xmm15, xmm15
mov r14, qword [0x00656fd0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x414cc5
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x414cd4
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x414cf3
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x414d03
cmp rbx, 0x1000
jae 0x414ccb
jmp 0x414d6d
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x414d15
xor edx, edx
jmp 0x414d64
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.004321e0
xorps xmm15, xmm15
mov r14, qword [0x00656fd0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x414cf9
jmp 0x414ce8
call fcn.00462aa0
xorps xmm15, xmm15
mov r14, qword [0x00656fd0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.004365e0
lea rax, [0x004e5249]
mov ebx, 0x18
nop dword [rax]
call fcn.00436e60
mov rax, qword [rsp + 0x38]
call fcn.00436ba0
lea rax, [0x004e58f2]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00436e60
mov rax, qword [rsp + 0x30]
call fcn.00436ba0
call fcn.00436820
call fcn.00436640
lea rax, [0x004e8194]
mov ebx, 0x21
call fcn.00434c40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045f3e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00414c60