joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14008451c
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rdi, rcx
mov ecx, dword [rcx + 0x90]
mov ebx, 1
mov eax, ecx
mov sil, bl
and eax, 0xc
cmp al, 0xc
jne 0x14008458a
mov rcx, qword [rdi + 8]
mov qword [rsp + 0x30], rcx
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov dword [rsp + 0x40], 0xfffffffe
movsxd rcx, eax
mov qword [rsp + 0x38], rcx
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov rcx, qword [rdi + 8]
movsxd rbx, eax
call qword [sym.imp.USER32.dll_GetParent]
mov r8, rbx
lea r9, [rsp + 0x30]
mov edx, 0x4e
jmp 0x1400845b4
shr ecx, 2
test bl, cl
je 0x1400845bf
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov rcx, qword [rdi + 8]
mov ebx, eax
call qword [sym.imp.USER32.dll_GetParent]
mov r9, qword [rdi + 8]
movzx r8d, bx
mov edx, VarUI4FromDisp
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x140084602
mov r8, qword [rdi + 0x50]
lea rdx, str.open
xor r9d, r9d
xor ecx, ecx
mov dword [rsp + 0x28], ebx
and qword [rsp + 0x20], 0
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp rax, 0x20
seta sil
test sil, sil
je 0x140084602
mov rcx, qword [rdi + 8]
or byte [rdi + 0x94], 2
mov r8d, ebx
xor edx, edx
call qword [sym.imp.USER32.dll_InvalidateRect]
mov rbx, qword [rsp + 0x60]
mov al, sil
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret

Function at 0x140084cec
Capabilities:
Log keystrokes via polling

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1401080e0]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, qword [rsp + 0x80]
movsx eax, r9w
shr r9, 0x10
mov dword [rsp + 0x20], eax
movsx eax, r9w
mov rbx, rcx
mov rcx, qword [rcx + 8]
mov dword [rsp + 0x24], eax
xor eax, eax
mov qword [r11 - 0x2c], rax
mov qword [r11 - 0x24], rax
mov rax, qword [r11 - 0x38]
lea r9, [r11 - 0x30]
xor r8d, r8d
mov edx, 0x1012
mov qword [r11 - 0x30], rax
call qword [sym.imp.USER32.dll_SendMessageW]
xor esi, esi
cmp eax, 0xffffffff
je 0x140084d7a
cmp dword [rsp + 0x30], 8
jne 0x140084d7a
lea ecx, [rsi + 0x11]
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x140084d7a
mov edx, dword [rsp + 0x34]
mov rcx, rbx
call fcn.140080590
mov dword [rdi], esi
mov eax, 1
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400bf530
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x140085868
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x30
xor ebp, ebp
mov r10, r9
mov rdi, rcx
cmp dword [rsp + 0x70], ebp
jne 0x140085966
lea esi, [rbp + 1]
cmp r8d, esi
jne 0x1400858d8
mov rdx, qword [rsp + 0x60]
mov r8d, esi
mov qword [rax - 0x18], rdx
mov rdx, qword [rcx + 8]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_CallWindowProcW]
mov rcx, qword [rdi + 8]
lea r9d, [rbp + 0x24]
xor r8d, r8d
mov edx, 0x1036
mov rbx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rsp + 0x68]
mov qword [rcx], rbx
mov eax, esi
jmp 0x140085968
mov edx, 0x201
cmp r8d, edx
jne 0x14008590d
mov r9, qword [rsp + 0x60]
lea rax, [rsp + 0x70]
mov r8, r10
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x70], esi
call fcn.140084cec
mov rcx, qword [rsp + 0x68]
mov qword [rcx], rax
cmp dword [rsp + 0x70], ebp
je 0x140085966
jmp 0x1400858d1
mov edx, 0x203
cmp r8d, edx
je 0x1400858e2
cmp r8d, 0x100
jne 0x140085966
cmp r9, 0x20
jne 0x14008595e
mov rcx, qword [rcx + 8]
mov r9, rsi
or r8, 0xffffffffffffffff
mov edx, 0x100c
call qword [sym.imp.USER32.dll_SendMessageW]
mov rbx, rax
cmp eax, 0xffffffff
je 0x14008595e
mov ecx, send
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x14008595e
mov edx, ebx
mov rcx, rdi
call fcn.140080590
mov rax, qword [rsp + 0x68]
mov qword [rax], rsi
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x140086d44
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x140086da7
lea rcx, [0x1400c7538]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140086dbb
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140086dbb
mov rcx, qword [rbx]
and qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call rax
jmp 0x140086dc0
cmp dword [rcx + 8], 0
je 0x140086dbb
mov rdx, r8
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x140086dc0
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140086f38
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x490
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov rax, qword [0x1401080e0]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov r15, r9
mov r14, r8
mov rbx, rdx
xor edi, edi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x70], rdi
xor edx, edx
lea r8d, [rdi + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x140086fc5
xor edx, edx
lea r8d, [rdi + 2]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x140086fc5
call fcn.14007fe44
mov ebx, eax
jmp 0x1400870d6
mov r8, r15
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x140086fe6
call fcn.14007fe44
jmp 0x1400870c5
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r14, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140086fdc
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, ebx
jae 0x140087021
mov ebx, 0x8007000e
jmp 0x1400870c7
mov ecx, eax
test eax, eax
je 0x140087059
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x14008704f
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x140087059
lea rcx, [rsp + 0x70]
call fcn.14007fa58
jmp 0x140087063
mov ecx, 0x80070216
call fcn.140067430
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rax
jmp 0x140087075
cmp qword [rsp + 0x70], rdi
je 0x140087017
mov dword [rsp + 0x28], ebx
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, r14
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x140086fdc
mov ecx, eax
mov rax, qword [rsp + 0x70]
mov word [rax + rcx*2], di
mov r8d, dword [rsp + 0x4e0]
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.140086dd0
mov ebx, eax
test rsi, rsi
je 0x1400870d6
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x1400870ed
lea rcx, [rsp + 0x70]
call fcn.140083648
nop
mov eax, ebx
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.1400bf530
add rsp, 0x490
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x140088524
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
xor ebx, ebx
mov rdi, r8
mov rbp, rdx
mov r14, rcx
test r8, r8
jne 0x140088552
lea eax, [rbx + 0xd]
jmp 0x140088588
mov rsi, r8
mov rcx, rsi
call qword [sym.imp.MSVCR120.dll_wcslen]
inc eax
lea rsi, [rsi + rax*2]
lea ebx, [rbx + rax*2]
cmp eax, 1
jne 0x140088555
mov rcx, qword [r14]
lea r9d, [rax + 6]
xor r8d, r8d
mov rdx, rbp
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x14008a520
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x1401080e0]
xor rax, rsp
mov qword [rsp + 0x140], rax
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, VarUI4FromDisp
mov dword [rsp + 0x20], VarUI4FromDisp
call sub.MSVCR120.dll_memset
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
xor ecx, ecx
test eax, eax
je 0x14008a579
cmp dword [rsp + 0x24], 5
jae 0x14008a57e
cmp dword [rsp + 0x24], 4
jne 0x14008a579
cmp dword [rsp + 0x28], 0x5a
jae 0x14008a57e
mov ecx, 1
mov al, cl
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400bf530
add rsp, 0x158
ret

Function at 0x14008bb20
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov ebx, dword [r8 + 0x18]
mov rdi, rcx
call fcn.14009ac18
mov rcx, rax
call fcn.14009aa84
test ebx, ebx
js 0x14008bbe9
mov edx, dword [rdi + 0x5e0]
mov rcx, rax
call fcn.140077180
mov edx, ebx
mov rcx, rax
call fcn.140076b24
test rax, rax
je 0x14008bbe9
mov rbx, qword [rax + 8]
cmp dword [rbx - 0xc], 0
jl 0x14008bb7c
mov qword [rsp + 0x50], rbx
lock inc dword [rbx - 0xc]
jmp 0x14008bba9
mov rax, qword [0x140108018]
mov qword [rsp + 0x50], rax
test rbx, rbx
jne 0x14008bb91
xor eax, eax
jmp 0x14008bb9a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rsp + 0x50]
mov r8, rbx
mov edx, eax
call fcn.140067304
mov rbx, qword [rsp + 0x50]
lea rdx, str.open
xor r9d, r9d
xor ecx, ecx
mov r8, rbx
mov dword [rsp + 0x28], 1
and qword [rsp + 0x20], 0
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rbx - 0xc]
cmp rcx, qword [0x140108010]
je 0x14008bbe9
lock add dword [rcx], 0xffffffff
jg 0x14008bbe9
call sub.MSVCR120.dll_void___cdecl_operator_delete___void____ptr64_
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x14008c6bc
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rsi, rcx
call fcn.14009ac18
mov rcx, rax
call fcn.14009aa84
mov rcx, qword [rsi + 0x70]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1004
or ebp, 0xffffffff
mov r14, rax
xor edi, edi
xor ebx, ebx
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jle 0x14008c7ec
mov rcx, qword [rsi + 0x70]
movsxd r8, ebx
mov edx, 0x102c
mov r9d, 2
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x14008c725
mov ebp, ebx
inc edi
mov rcx, qword [rsi + 0x70]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1004
inc ebx
call qword [sym.imp.USER32.dll_SendMessageW]
cmp ebx, eax
jl 0x14008c705
cmp edi, 1
jne 0x14008c7ec
mov edx, dword [rsi + 0x5e0]
mov rcx, r14
call fcn.140077180
mov edx, ebp
mov rcx, rax
call fcn.140076b24
test rax, rax
je 0x14008c7ec
mov rbx, qword [rax + 8]
cmp dword [rbx - 0xc], 0
jl 0x14008c77f
mov qword [rsp + 0x50], rbx
lock inc dword [rbx - 0xc]
jmp 0x14008c7ac
mov rax, qword [0x140108018]
mov qword [rsp + 0x50], rax
test rbx, rbx
jne 0x14008c794
xor eax, eax
jmp 0x14008c79d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rsp + 0x50]
mov r8, rbx
mov edx, eax
call fcn.140067304
mov rbx, qword [rsp + 0x50]
lea rdx, str.open
xor r9d, r9d
xor ecx, ecx
mov r8, rbx
mov dword [rsp + 0x28], 1
and qword [rsp + 0x20], 0
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rbx - 0xc]
cmp rcx, qword [0x140108010]
je 0x14008c7ec
lock add dword [rcx], 0xffffffff
jg 0x14008c7ec
call sub.MSVCR120.dll_void___cdecl_operator_delete___void____ptr64_
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
xor eax, eax
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x14008ec80
Capabilities:
Hide graphical window

Disassembly:
push rdi
sub rsp, 0x60
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov rdi, rcx
call fcn.14009ac18
mov rbx, rax
mov rcx, rax
call fcn.14009aa84
cmp dword [rax + 0x7c], 0
je 0x14008edd0
mov rcx, rbx
call fcn.14009aa84
mov rcx, rax
xor edx, edx
call fcn.140077180
mov rcx, rax
call fcn.14007725c
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.14006938c
nop
mov rax, qword [0x140108018]
mov qword [rsp + 0x50], rax
lea r9, str.SubHeaderText
lea r8, str.MainDlg
lea rdx, [rsp + 0x48]
mov rcx, rbx
call fcn.14009ac5c
nop
mov r8, qword [rsp + 0x40]
mov rdx, qword [rax]
lea rcx, [rsp + 0x50]
call fcn.140069514
nop
mov rcx, qword [rsp + 0x48]
add rcx, 0xfffffffffffffff4
cmp rcx, qword [0x140108010]
je 0x14008ed3a
lock add dword [rcx], 0xffffffff
jg 0x14008ed3a
mov rcx, qword [rsp + 0x48]
add rcx, 0xfffffffffffffff4
call sub.MSVCR120.dll_void___cdecl_operator_delete___void____ptr64_
mov rbx, qword [rsp + 0x50]
mov rdx, rbx
mov rcx, qword [rdi + 0x78]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov edx, 5
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_ShowWindow]
mov dword [rsp + 0x30], 0x43
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_SetWindowPos]
mov edx, 1
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_FlashWindow]
nop
lea rcx, [rbx - 0xc]
cmp rcx, qword [0x140108010]
je 0x14008eda8
lock add dword [rcx], 0xffffffff
jg 0x14008eda8
call sub.MSVCR120.dll_void___cdecl_operator_delete___void____ptr64_
nop
mov rcx, qword [rsp + 0x40]
add rcx, 0xfffffffffffffff4
cmp rcx, qword [0x140108010]
je 0x14008ede4
lock add dword [rcx], 0xffffffff
jg 0x14008ede4
mov rcx, qword [rsp + 0x40]
add rcx, 0xfffffffffffffff4
call sub.MSVCR120.dll_void___cdecl_operator_delete___void____ptr64_
jmp 0x14008ede4
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x14008ee30
Capabilities:
Get graphical window text

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x788]
sub rsp, 0x870
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1401080e0]
xor rax, rsp
mov qword [rbp + 0x760], rax
mov rbx, rcx
xor r15d, r15d
mov word [rsp + 0x60], r15w
xor edx, edx
mov r8d, 0x7fe
lea rcx, [rsp + 0x62]
call sub.MSVCR120.dll_memset
mov rax, qword [0x140108018]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov edi, 0x400
mov r8d, edi
lea rdx, [rsp + 0x60]
mov rcx, qword [rbx + 0x1c0]
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r8, [rsp + 0x60]
mov edx, eax
lea rcx, [rsp + 0x30]
call fcn.140067304
mov r8d, edi
lea rdx, [rsp + 0x60]
mov rcx, qword [rbx + 0x1d0]
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r8, [rsp + 0x60]
mov edx, eax
lea rcx, [rsp + 0x38]
call fcn.140067304
call fcn.14009ac18
mov r14, rax
lea rax, [rsp + 0x20]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x48], rax
mov rbx, qword [rsp + 0x38]
lea rsi, [rbx - 0xc]
cmp dword [rsi], r15d
jl 0x14008ef36
mov qword [rsp + 0x20], rbx
lock inc dword [rsi]
jmp 0x14008ef5b
mov rax, qword [0x140108018]
mov qword [rsp + 0x20], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8, rbx
mov edx, eax
lea rcx, [rsp + 0x20]
call fcn.140067304
nop
mov rbx, qword [rsp + 0x30]
lea rdi, [rbx - 0xc]
cmp dword [rdi], r15d
jl 0x14008ef73
mov qword [rsp + 0x28], rbx
lock inc dword [rdi]
jmp 0x14008ef98
mov rax, qword [0x140108018]
mov qword [rsp + 0x28], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8, rbx
mov edx, eax
lea rcx, [rsp + 0x28]
call fcn.140067304
nop
mov rcx, r14
call fcn.14009aa84
mov rcx, rax
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x28]
call fcn.140079c88
nop
or ebx, 0xffffffff
cmp rsi, qword [0x140108010]
je 0x14008efd4
mov eax, ebx
lock xadd dword [rsi], eax
add eax, ebx
test eax, eax
jg 0x14008efd4
mov rcx, rsi
call sub.MSVCR120.dll_void___cdecl_operator_delete___void____ptr64_
nop
cmp rdi, qword [0x140108010]
je 0x14008eff1
mov eax, ebx
lock xadd dword [rdi], eax
add eax, ebx
test eax, eax
jg 0x14008eff1
mov rcx, rdi
call sub.MSVCR120.dll_void___cdecl_operator_delete___void____ptr64_
xor eax, eax
mov rcx, qword [rbp + 0x760]
xor rcx, rsp
call fcn.1400bf530
lea r11, [rsp + 0x870]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140095098
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x1e8]
sub rsp, 0x2d0
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1401080e0]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
mov r15, r8
mov rsi, rdx
mov qword [rsp + 0x40], rdx
and qword [rsp + 0x28], 0
mov rcx, r8
call fcn.140069244
xor edx, edx
mov rcx, rsi
call fcn.140069bfc
mov rdx, rax
lea r8, [0x1400eb52c]
lea rcx, [rsp + 0x28]
call qword [sym.imp.MSVCR120.dll__wfopen_s]
cmp qword [rsp + 0x28], 0
jne 0x14009513a
mov rax, qword [rsi]
add rax, 0xfffffffffffffff4
cmp rax, qword [0x140108010]
je 0x140095132
lock add dword [rax], 0xffffffff
jg 0x140095132
mov rcx, qword [rsi]
sub rcx, 0xc
call sub.MSVCR120.dll_void___cdecl_operator_delete___void____ptr64_
or eax, 0xffffffff
jmp 0x14009522c
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x20]
call fcn.1400ad980
jmp 0x140095180
mov r9, qword [rsp + 0x28]
mov edx, 1
mov r8d, 0x200
lea rcx, [rbp - 0x40]
call qword [sym.imp.MSVCR120.dll_fread]
test rax, rax
je 0x140095180
mov r9d, eax
lea r8, [rbp - 0x40]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x20]
call fcn.1400ae1f4
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.MSVCR120.dll_feof]
test eax, eax
je 0x14009514b
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.MSVCR120.dll_fclose]
lea r8, [rsp + 0x50]
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x20]
call fcn.1400ad8bc
xor r14d, r14d
mov rax, qword [0x140108018]
mov qword [rsp + 0x30], rax
movzx r8d, byte [rbp + r14 - 0x50]
lea rdx, str._02x
lea rcx, [rsp + 0x30]
call fcn.140069514
mov rbx, qword [rsp + 0x30]
mov r8, rbx
mov edx, dword [rbx - 8]
mov rcx, r15
call fcn.140068ed8
nop
lea rcx, [rbx - 0xc]
cmp rcx, qword [0x140108010]
je 0x1400951ff
lock add dword [rcx], 0xffffffff
jg 0x1400951ff
call sub.MSVCR120.dll_void___cdecl_operator_delete___void____ptr64_
inc r14
cmp r14, 0x10
jl 0x1400951b0
mov rcx, qword [rsi]
add rcx, 0xfffffffffffffff4
cmp rcx, qword [0x140108010]
je 0x14009522a
lock add dword [rcx], 0xffffffff
jg 0x14009522a
mov rcx, qword [rsi]
sub rcx, 0xc
call sub.MSVCR120.dll_void___cdecl_operator_delete___void____ptr64_
xor eax, eax
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.1400bf530
lea r11, [rsp + 0x2d0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140098fb8
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov dword [rcx + 0x7f8], edx
xor edi, edi
mov rbx, rcx
mov r9, rcx
lea r8, [0x14009e874]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
mov qword [rbx + 0x5c8], rax
mov rbx, qword [rsp + 0x40]
setne dil
mov eax, edi
add rsp, 0x30
pop rdi
ret
Function at 0x14009e0cc
Capabilities:
Acquire debug privileges

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x1401080e0]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor ebx, ebx
mov rdi, rcx
and qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
lea edx, [rbx + 0x28]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x14009e132
lea rdx, str.SetDumpPrivileges:_Could_not_get_the_process_token
lea rcx, [rsp + 0x38]
call fcn.14006874c
lea rcx, [rdi + 0x5d8]
mov r9b, 1
mov rdx, rax
xor r8d, r8d
call fcn.14006caa0
jmp 0x14009e19a
lea r8, [rsp + 0x44]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
mov dword [rsp + 0x40], 1
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x14009e15b
lea rdx, str.SetDumpPrivileges:_Couldnt_lookup_SeDebugPrivilege_name
jmp 0x14009e111
mov rcx, qword [rsp + 0x30]
and qword [rsp + 0x28], rbx
and qword [rsp + 0x20], rbx
lea r8, [rsp + 0x40]
mov r9d, reloc.WS2_32.dll_recv
xor edx, edx
mov dword [rsp + 0x4c], 2
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x14009e195
lea rdx, str.SetDumpPrivileges:_Could_not_revoke_the_debug_privilege
jmp 0x14009e111
mov ebx, 1
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14009e1aa
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400bf530
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret

Function at 0x14009e67c
Capabilities:
Enumerate processes
Terminate process

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x280
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov rax, qword [0x1401080e0]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rax, qword [0x140108018]
mov qword [rsp + 0x20], rax
mov r8d, 0x57b
lea rdx, str.CrashSender_d.exe
lea rcx, [rsp + 0x20]
call fcn.140069514
mov dword [rsp + 0x30], 0x238
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
lea rdx, [rsp + 0x30]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
mov rbx, qword [rsp + 0x20]
cmp eax, 1
jne 0x14009e754
jmp 0x14009e742
mov rdx, rbx
lea rcx, [rsp + 0x5c]
call qword [sym.imp.MSVCR120.dll__wcsicmp]
test eax, eax
jne 0x14009e742
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, dword [rsp + 0x38]
cmp r8d, eax
je 0x14009e742
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
mov edx, 1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x30]
mov rcx, rsi
call sub.KERNEL32.dll_Process32NextW
cmp eax, 1
je 0x14009e6fb
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rbx - 0xc]
cmp rcx, qword [0x140108010]
je 0x14009e776
lock add dword [rcx], 0xffffffff
jg 0x14009e776
call sub.MSVCR120.dll_void___cdecl_operator_delete___void____ptr64_
xor eax, eax
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1400bf530
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret