joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000683b
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x141b6b7c0]
jne 0x14000439e
rol rcx, 0x10
test cx, 0xffff
jne 0x14000439a
repz ret
ror rcx, 0x10
jmp 0x140006794
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x141b6f5e0]
call qword [sym.imp.kernel32.dll_RtlCaptureContext]
mov rax, qword [0x141b6f6d8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.kernel32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140006819
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x141b6f5e0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.kernel32.dll_RtlVirtualUnwind
jmp 0x14000683b
mov rax, qword [rsp + 0x88]
mov qword [0x141b6f6d8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x141b6f678], rax
mov rax, qword [0x141b6f6d8]
mov qword [0x141b6f550], rax
mov rax, qword [rsp + 0x90]
mov qword [0x141b6f660], rax
mov dword [0x141b6f540], 0xc0000409
mov dword [0x141b6f544], 1
mov rax, qword [0x141b6b7c0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x141b6b7c8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x141b6f5d8], eax
mov ecx, 1
call fcn.1400043a4
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x141b6e0e0]
call qword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x141b6f5d8], 0
jne 0x1400068c2
mov ecx, 1
call fcn.1400043a4
call qword [sym.imp.kernel32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.kernel32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x14000695c
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x141b6b7c0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.140001a5c
xor ebx, ebx
cmp qword [0x141b6fab8], rbx
mov rdi, rax
jne 0x140006a6f
lea rcx, str.USER32.DLL
call qword [sym.imp.kernel32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x140006b46
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x140006b46
mov rcx, rax
call qword [sym.imp.kernel32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x141b6fab8], rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.kernel32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x141b6fac0], rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.kernel32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x141b6fac8], rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.kernel32.dll_EncodePointer]
mov r11, rax
mov qword [0x141b6fad8], rax
test rax, rax
je 0x140006a66
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.kernel32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.kernel32.dll_EncodePointer]
mov qword [0x141b6fad0], rax
jmp 0x140006a76
mov rax, qword [0x141b6fad0]
jmp 0x140006a7d
mov rax, qword [0x141b6fad0]
mov r11, qword [0x141b6fad8]
cmp rax, rdi
je 0x140006ae4
cmp r11, rdi
je 0x140006ae4
mov rcx, rax
call qword [sym.imp.kernel32.dll_DecodePointer]
mov rcx, qword [0x141b6fad8]
mov rsi, rax
call qword [sym.imp.kernel32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x140006ae4
test rax, rax
je 0x140006ae4
call rsi
test rax, rax
je 0x140006ade
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x140006ade
test byte [rsp + 0x40], 1
jne 0x140006ae4
bts ebp, 0x15
jmp 0x140006b24
mov rcx, qword [0x141b6fac0]
cmp rcx, rdi
je 0x140006b24
call qword [sym.imp.kernel32.dll_DecodePointer]
test rax, rax
je 0x140006b24
call rax
mov rbx, rax
test rax, rax
je 0x140006b24
mov rcx, qword [0x141b6fac8]
cmp rcx, rdi
je 0x140006b24
call qword [sym.imp.kernel32.dll_DecodePointer]
test rax, rax
je 0x140006b24
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x141b6fab8]
call qword [sym.imp.kernel32.dll_DecodePointer]
test rax, rax
je 0x140006b46
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x140006b48
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140004384
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180002a10
Capabilities:
Create http request
Read data from internet
Receive data
Reference http user-agent string

Disassembly:
push rbx
push rsi
push r12
push r13
sub rsp, 0x468
mov rax, qword [0x180037008]
xor rax, rsp
mov qword [rsp + 0x440], rax
xor esi, esi
mov r13, rdx
mov rbx, rcx
mov dword [rsp + 0x20], esi
xor r9d, r9d
lea rcx, str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_119.0.0.0_Safari_537.36
xor r8d, r8d
lea edx, [rsi + 1]
call qword [sym.imp.WININET.dll_InternetOpenW]
mov r12, rax
test rax, rax
jne 0x180002a94
lea rdx, str.Failed_to_initialize_WinINet
call fcn.1800038f0
mov dl, 0xa
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call fcn.180004250
movzx edx, ax
mov rcx, rbx
call fcn.1800040a0
mov rcx, rbx
call fcn.180003f40
xor eax, eax
jmp 0x180002c1c
cmp qword [rbx + 0x18], 8
mov qword [rsp + 0x450], r15
jb 0x180002aa6
mov rbx, qword [rbx]
mov qword [rsp + 0x28], rsi
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 0x80000000
mov rdx, rbx
mov rcx, r12
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
mov r15, rax
test rax, rax
jne 0x180002b10
lea rdx, str.Failed_to_open_URL
call fcn.1800038f0
mov dl, 0xa
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call fcn.180004250
movzx edx, ax
mov rcx, rbx
call fcn.1800040a0
mov rcx, rbx
call fcn.180003f40
mov rcx, r12
call qword [sym.imp.WININET.dll_InternetCloseHandle]
xor eax, eax
jmp 0x180002c14
mov qword [rsp + 0x4a0], rbp
mov ebp, 0x100000
mov ecx, ebp
mov qword [rsp + 0x458], r14
mov dword [rsp + 0x30], esi
call fcn.180004594
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x400
mov r14, rax
call fcn.180008fd0
lea r9, [rsp + 0x30]
mov r8d, 0x400
lea rdx, [rsp + 0x40]
mov rcx, r15
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x180002beb
mov qword [rsp + 0x460], rdi
nop
mov ecx, dword [rsp + 0x30]
test ecx, ecx
je 0x180002be3
lea eax, [rsi + rcx]
mov edi, esi
cmp eax, ebp
jb 0x180002bb1
lea eax, [rbp*2]
mov ecx, eax
mov ebp, eax
call fcn.180004594
mov r8d, edi
mov rdx, r14
mov rcx, rax
mov rbx, rax
call fcn.180009390
mov rcx, r14
call fcn.180004550
mov ecx, dword [rsp + 0x30]
mov r14, rbx
mov r8d, ecx
lea rdx, [rsp + 0x40]
lea rcx, [rdi + r14]
call fcn.180009390
add esi, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
mov r8d, 0x400
lea rdx, [rsp + 0x40]
mov rcx, r15
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x180002b70
mov rdi, qword [rsp + 0x460]
mov rcx, r15
mov dword [r13], esi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r12
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rbp, qword [rsp + 0x4a0]
mov rax, r14
mov r14, qword [rsp + 0x458]
mov r15, qword [rsp + 0x450]
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.180004530
add rsp, 0x468
pop r13
pop r12
pop rsi
pop rbx
ret
Function at 0x180017ea8
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x180017ed8
xor eax, eax
jmp 0x180017f9b
mov rbp, rbx
cmp word [rax], si
je 0x180017efd
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x180017ee4
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x180017ee0
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.180017df8
movsxd r14, eax
test eax, eax
jne 0x180017f3b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x180017ed1
mov rcx, r14
call fcn.180016654
mov rdi, rax
test rax, rax
jne 0x180017f54
xor ecx, ecx
call fcn.18001466c
jmp 0x180017f30
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.180017df8
test eax, eax
jne 0x180017f85
mov rcx, rdi
call fcn.18001466c
jmp 0x180017f8f
xor ecx, ecx
call fcn.18001466c
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x18001a10c
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x180019e2e
call fcn.18000ea50
mov dword [rax], 0x16
call fcn.18000d798
jmp 0x180019f7e
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x180019f7e
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x180019f7e
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x180019e5d
lock or dword [rcx + 0x14], 0x10
jmp 0x180019f7e
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x180019e71
call fcn.18001a774
mov ebp, dword [rbx + 0x10]
cmp ebp, 1
jne 0x180019e81
mov rax, qword [rbx]
mov r14b, byte [rax]
jmp 0x180019e84
xor r14b, r14b
mov rsi, qword [rbx + 8]
mov rcx, rbx
mov edi, dword [rbx + 0x20]
mov qword [rbx], rsi
call fcn.180019dd0
mov r8d, edi
mov rdx, rsi
mov ecx, eax
call fcn.180021554
mov dword [rbx + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 2
jbe 0x180019f6c
mov eax, dword [rbx + 0x14]
test al, 6
jne 0x180019f17
mov rcx, rbx
call fcn.180019dd0
cmp eax, 0xffffffff
je 0x180019f02
mov rcx, rbx
call fcn.180019dd0
cmp eax, 0xfffffffe
je 0x180019f02
mov rcx, rbx
call fcn.180019dd0
movsxd rdi, eax
lea rsi, [0x1800393b0]
mov rcx, rbx
sar rdi, 6
call fcn.180019dd0
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [rsi + rdi*8]
lea rdx, [rax + rcx*8]
jmp 0x180019f09
lea rdx, [0x180037910]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x180019f17
lock or dword [rbx + 0x14], 0x20
cmp dword [rbx + 0x20], 0x200
jne 0x180019f3b
mov eax, dword [rbx + 0x14]
shr eax, 6
test al, 1
je 0x180019f3b
mov eax, dword [rbx + 0x14]
shr eax, 8
test al, 1
jne 0x180019f3b
mov dword [rbx + 0x20], 0x1000
mov rdx, qword [rbx]
cmp ebp, 1
jne 0x180019f59
movzx ecx, byte [rdx]
dec dword [rbx + 0x10]
shl cx, 8
movzx eax, r14b
or cx, ax
inc rdx
jmp 0x180019f64
movzx ecx, word [rdx]
add dword [rbx + 0x10], 0xfffffffe
add rdx, 2
mov qword [rbx], rdx
movzx eax, cx
jmp 0x180019f83
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rbx + 0x14], eax
and dword [rbx + 0x10], 0
mov eax, 0xffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
jmp 0x180019df8
Function at 0x18001ba8c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.180023010
sub rsp, rax
mov rax, qword [0x180037008]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.180019dd0
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x18001badb
mov rax, rbp
jmp 0x18001bbe3
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x180000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0x393b0]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.18001bf7c
mov r13, rax
lea rax, [0x180000000]
mov rcx, qword [rax + rbx*8 + 0x393b0]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x18001bbdf
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18001bbdf
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.18001bf7c
test rax, rax
js 0x18001bbdf
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x18001bbdf
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x18001bbd1
lea r8, [0x180000000]
cmp rcx, rdx
jae 0x18001bbd1
cmp byte [rcx], 0xd
jne 0x18001bbb7
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x18001bbc6
cmp byte [rcx + 1], 0xa
jne 0x18001bbc6
inc rcx
jmp 0x18001bbc6
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x37b00]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x18001bb99
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x18001bbe3
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.180004530
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800210a8
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x30
movsxd rbp, ecx
mov r9, r8
mov rax, rbp
lea rcx, [0x1800393b0]
and eax, 0x3f
mov r10, rbp
sar r10, 6
xor edi, edi
mov rsi, rdx
mov r14, rbp
lea r8, [rax + rax*8]
mov rax, qword [rcx + r10*8]
mov ecx, 4
mov qword [rsp + 0x78], rcx
mov r11, qword [rax + r8*8 + 0x28]
lea r12d, [rcx + 6]
test r9, r9
je 0x180021106
cmp word [rdx], r12w
jne 0x180021106
or byte [rax + r8*8 + 0x38], cl
jmp 0x18002110c
and byte [rax + r8*8 + 0x38], 0xfb
lea rdx, [rdx + r9*2]
mov rcx, rsi
mov rbx, rsi
cmp rsi, rdx
jae 0x180021267
mov r9d, 0x1a
lea r13d, [r9 - 0xd]
movzx eax, word [rcx]
cmp ax, r9w
je 0x180021242
lea r9, [rcx + 2]
cmp ax, r13w
je 0x180021145
mov rcx, r9
jmp 0x180021168
cmp r9, rdx
jae 0x18002117f
cmp word [r9], r12w
mov eax, 2
cmove rax, qword [rsp + 0x78]
add rcx, rax
mov eax, r12d
cmp word [r9], r12w
cmovne ax, r13w
mov word [rbx], ax
mov r9d, 0x1a
add rbx, 2
cmp rcx, rdx
jb 0x180021129
jmp 0x180021267
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rdi
mov r8d, 2
lea rdx, [rsp + 0x70]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18002123c
cmp dword [rsp + 0x80], edi
je 0x18002123c
mov rdx, r14
lea r11, [0x1800393b0]
sar rdx, 6
and r14d, 0x3f
mov rax, qword [r11 + rdx*8]
lea r8, [r14 + r14*8]
test byte [rax + r8*8 + 0x38], 0x48
je 0x180021215
movzx eax, word [rsp + 0x70]
cmp ax, r12w
jne 0x1800211e8
mov word [rbx], r12w
jmp 0x180021263
mov word [rbx], r13w
mov word [rsp + 0x78], ax
mov rax, qword [r11 + rdx*8]
lea rcx, [rax + r8*8]
mov al, byte [rsp + rdi + 0x78]
mov byte [rcx + rdi + 0x3a], al
inc rdi
cmp rdi, 2
jl 0x1800211f1
mov rax, qword [r11 + rdx*8]
mov byte [rax + r8*8 + 0x3c], r12b
jmp 0x180021263
cmp word [rsp + 0x70], r12w
jne 0x180021222
cmp rbx, rsi
je 0x1800211e2
mov rdx, 0xfffffffffffffffe
mov ecx, ebp
lea r8d, [rdx + 3]
call fcn.18001bf84
cmp word [rsp + 0x70], r12w
je 0x180021267
mov word [rbx], r13w
jmp 0x180021263
lea r11, [0x1800393b0]
mov rcx, qword [r11 + r10*8]
mov al, byte [rcx + r8*8 + 0x38]
test al, 0x40
jne 0x18002125f
or al, 2
mov byte [rcx + r8*8 + 0x38], al
jmp 0x180021267
mov word [rbx], r9w
add rbx, 2
sub rbx, rsi
sar rbx, 1
lea eax, [rbx + rbx]
add rsp, 0x30
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180023100
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x180023128
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x180023128
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140001706
Capabilities:
Create process on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x1c0
call fcn.140001686
test al, al
je 0x140001762
mov rsi, qword [0x1400c41a0]
lea rdx, str.Already_running_with_elevated_privileges.
mov r8d, 0x29
mov rcx, rsi
call fcn.1400b26a0
mov rax, qword [rsi]
mov rcx, qword [rax - 0x18]
add rcx, rsi
mov dl, 0xa
call fcn.140069280
mov rcx, rsi
mov edx, eax
call fcn.140076e20
mov rcx, rax
add rsp, 0x1c0
pop rbx
pop rdi
pop rsi
jmp fcn.140077000
lea rsi, [rsp + 0xb0]
xor ecx, ecx
mov rdx, rsi
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rbx, [rsp + 0x30]
mov qword [rbx - 0x10], rbx
lea rdx, str.Start_Process__FilePath__powershell.exe___ArgumentList__NoProfile__ExecutionPolicy_Bypass__Command____Start_Process__FilePath__
lea r8, [0x1400be140]
lea rdi, [rsp + 0x20]
mov rcx, rdi
call fcn.1400a23e0
mov rcx, rdi
mov rdx, rsi
call fcn.1400a3460
lea rdx, str.___Verb_RunAs____WindowStyle_Hidden
lea rcx, [rsp + 0x20]
call fcn.1400a3460
xorps xmm0, xmm0
lea rcx, [rsp + 0x40]
movaps xmmword [rcx], xmm0
movaps xmmword [rcx + 0x10], xmm0
movaps xmmword [rcx + 0x20], xmm0
movaps xmmword [rcx + 0x60], xmm0
movaps xmmword [rcx + 0x50], xmm0
movaps xmmword [rcx + 0x40], xmm0
movaps xmmword [rcx + 0x30], xmm0
mov dword [rcx], 0x70
lea rax, str.runas
mov qword [rcx + 0x10], rax
lea rax, str.powershell.exe
mov qword [rcx + 0x18], rax
mov rax, qword [rsp + 0x20]
mov qword [rcx + 0x20], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x140001850
mov rsi, qword [0x1400c41a0]
lea rdx, str.Failed_to_restart_with_elevated_privileges.
mov r8d, 0x2b
mov rcx, rsi
call fcn.1400b26a0
mov rax, qword [rsi]
add rsi, qword [rax - 0x18]
mov rcx, rsi
mov dl, 0xa
call fcn.140069280
mov rcx, qword [0x1400c41a0]
mov edx, eax
call fcn.140076e20
mov rcx, rax
call fcn.140077000
mov rcx, qword [rsp + 0x20]
cmp rcx, rbx
je 0x14000185f
call fcn.1400b7820
nop
add rsp, 0x1c0
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400030ec
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x50
lea rsi, [rsp + 0x20]
mov dword [rsi], 0x16b63c
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [rsi + 0x20], 2
setae al
add rsp, 0x50
pop rsi
ret

Function at 0x140003112
Capabilities:
Get memory capacity

Disassembly:
push rsi
sub rsp, 0x60
lea rsi, [rsp + 0x20]
mov dword [rsi], 0x40
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
movabs rax, 0xfffff80000000
test qword [rsi + 8], rax
setne al
add rsp, 0x60
pop rsi
ret

Function at 0x140003142
Capabilities:
Enumerate disk properties

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x60
lea rcx, [0x1400c5b90]
xor r14d, r14d
xor edx, edx
xor r8d, r8d
mov r9d, 2
call qword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsA]
mov rsi, rax
lea rdi, [rsp + 0x40]
mov dword [rdi], 0x20
mov rcx, rax
xor edx, edx
mov r8, rdi
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
lea r13, [rsp + 0x3c]
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x20], r14
mov dword [rsp + 0x28], 0
mov r12, qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyW]
mov rcx, rsi
mov rdx, rdi
mov r8d, 0xc
xor r9d, r9d
call r12
mov r15, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
call r15
mov r8d, dword [r13]
mov rcx, rax
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
mov eax, dword [r13]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov rcx, rsi
mov rdx, rdi
mov r8d, 0xc
xor r9d, r9d
call r12
mov rcx, rbx
call qword [sym.imp.USER32.dll_CharUpperW]
lea rdx, str.VBOX
mov rcx, rbx
call sub.msvcrt.dll_wcsstr
test rax, rax
sete dil
call r15
mov rcx, rax
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, rsi
call qword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
mov eax, edi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140003246
Capabilities:
Get local ipv4 addresses

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
lea rbx, [rsp + 0x3c]
mov dword [rbx], 0
mov qword [rsp + 0x20], rbx
xor ecx, ecx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, dword [rbx]
mov rcx, rax
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov sil, 1
test rax, rax
je 0x1400032f7
mov rdi, rax
mov qword [rsp + 0x20], rbx
xor ecx, ecx
xor edx, edx
xor r8d, r8d
mov r9, rax
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
cmp dword [rdi + 0x58], 6
jne 0x1400032c8
mov eax, dword [rdi + 0x50]
mov dword [rsp + 0x34], eax
movzx ecx, word [rdi + 0x54]
mov word [rsp + 0x38], cx
xor eax, 8
movzx ecx, byte [rsp + 0x36]
xor ecx, 0x27
or cx, ax
je 0x1400032e1
mov rdi, qword [rdi + 8]
test rdi, rdi
jne 0x1400032a2
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
xor r8d, r8d
jmp 0x1400032f1
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor esi, esi
mov rcx, rax
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, esi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
Function at 0x140003353
Capabilities:
Enumerate processes

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x258
mov edi, ecx
xor esi, esi
lea r14, [rsp + 0x20]
mov r8d, 0x238
mov rcx, r14
xor edx, edx
call sub.msvcrt.dll_memset
mov dword [r14], 0x238
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
mov rcx, rax
mov rdx, r14
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x1400033bd
lea r14, [rsp + 0x20]
cmp dword [rsp + 0x28], edi
je 0x1400033b9
mov rcx, rbx
mov rdx, r14
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x1400033a2
jmp 0x1400033bd
mov esi, dword [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
add rsp, 0x258
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x140003457
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rdi, [rsp + 0x28]
mov r8d, 0x238
mov rcx, rdi
xor edx, edx
call sub.msvcrt.dll_memset
mov dword [rdi], 0x238
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
mov rcx, rax
mov rdx, rdi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x14000351e
lea rdi, [rsp + 0x260]
mov ecx, 0x104
lea r15, [rsp + 0x54]
mov r12, qword [sym.imp.USER32.dll_CharUpperW]
lea rbx, str.WIRESHARK.EXE
lea r14, [rsp + 0x28]
mov rdx, r15
mov r8, rdi
mov rax, r8
movzx r9d, word [rdx]
test r9w, r9w
je 0x1400034e9
add rdx, 2
lea r8, [rax + 2]
mov word [rax], r9w
dec rcx
jne 0x1400034cb
mov word [rax], 0
mov rcx, rdi
call r12
mov rcx, rdi
mov rdx, rbx
call sub.msvcrt.dll_wcsstr
test rax, rax
jne 0x140003539
mov rcx, rsi
mov rdx, r14
call sub.KERNEL32.dll_Process32NextW
mov rdx, r15
mov ecx, 0x104
mov r8, rdi
test eax, eax
jne 0x1400034cb
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x140003947
Capabilities:
Enumerate processes

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x158
mov rsi, rcx
lea rbx, [rsp + 0x28]
mov r8d, 0x130
mov rcx, rbx
xor edx, edx
call sub.msvcrt.dll_memset
mov dword [rbx], 0x130
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdi, rax
mov rcx, rax
mov rdx, rbx
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x1400039b7
lea rbx, [rsp + 0x54]
lea r14, [rsp + 0x28]
mov rcx, rbx
mov rdx, rsi
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x1400039c4
mov rcx, rdi
mov rdx, r14
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x140003999
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1400039c6
mov al, 1
add rsp, 0x158
pop rbx
pop rdi
pop rsi
pop r14
ret