joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140082460
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbp
push rbx
mov qword [rsp + 0x60], r9
mov r10, qword [rcx]
mov ecx, dword [rcx + 8]
mov r11, qword [rdx]
mov ebx, ecx
and ebx, 0xfffffffc
mov esi, dword [rdx + 8]
xor edi, edi
xor ebp, ebp
test ecx, ecx
je 0x140082684
lea r14, [0x1401c14b0]
mov eax, ebx
sar eax, 2
lea eax, [rax + rax*2]
cmp esi, eax
jl 0x1400824a7
lea r15d, [rbx - 4]
jmp 0x1400824be
mov edx, 0x55555556
mov eax, edx
imul esi
mov r15d, edx
shr r15d, 0x1f
add r15d, edx
shl r15d, 2
test r15d, r15d
jle 0x140082564
movsxd rax, edi
lea rax, [r10 + rax*2]
movzx edx, word [rax]
movzx r13d, word [rax + 2]
movzx r12d, word [rax + 4]
movzx eax, word [rax + 6]
mov r9d, edx
or r9d, r13d
or r9d, r12d
or r9d, eax
test r9d, 0xffffff00
je 0x1400824fc
mov r9d, 0xffffffff
jmp 0x140082531
movsxd rdx, edx
movsx rdx, byte [r14 + rdx]
movsxd r9, r13d
movsx r13, byte [r14 + r9]
movsxd r9, r12d
movsx r12, byte [r14 + r9]
cdqe
movsx rax, byte [r14 + rax]
shl edx, 0x12
or eax, edx
shl r13d, 0xc
or eax, r13d
shl r12d, 6
mov r9d, eax
or r9d, r12d
test r9d, r9d
jl 0x1400826a1
movsxd rax, ebp
add rax, r11
mov edx, r9d
sar edx, 0x10
mov byte [rax], dl
mov edx, r9d
sar edx, 8
mov byte [rax + 1], dl
mov byte [rax + 2], r9b
add ebp, 3
add edi, 4
cmp edi, r15d
jl 0x1400824c7
lea eax, [rbx - 4]
cmp r15d, eax
jne 0x1400826a1
cmp edi, ebx
je 0x1400826a1
lea eax, [rbx - 4]
cdqe
movzx eax, word [r10 + rax*2]
lea edx, [rbx - 3]
movsxd rdx, edx
movzx edx, word [r10 + rdx*2]
lea r9d, [rbx - 2]
movsxd r9, r9d
movzx r9d, word [r10 + r9*2]
lea r15d, [rbx - 1]
movsxd r15, r15d
movzx r10d, word [r10 + r15*2]
mov r15d, eax
or r15d, edx
or r15d, r9d
or r15d, r10d
test r15d, 0xffffff00
jne 0x1400826a1
cdqe
movsx rax, byte [r14 + rax]
movsxd rdx, edx
movsx rdx, byte [r14 + rdx]
shl eax, 0x12
shl edx, 0xc
or eax, edx
cmp r10d, 0x3d
je 0x140082629
movsxd r9, r9d
movsx r9, byte [r14 + r9]
movsxd r10, r10d
movsx r10, byte [r14 + r10]
or r10d, eax
shl r9d, 6
mov eax, r10d
or eax, r9d
jl 0x1400826a1
add esi, 0xfffffffd
cmp ebp, esi
jg 0x1400826a1
movsxd rdx, ebp
add r11, rdx
mov edx, eax
sar edx, 0x10
mov byte [r11], dl
mov edx, eax
sar edx, 8
mov byte [r11 + 1], dl
mov byte [r11 + 2], al
add ebp, 3
jmp 0x14008267d
cmp r9d, 0x3d
je 0x140082666
movsxd r9, r9d
movsx r9, byte [r14 + r9]
mov edx, r9d
shl edx, 6
or eax, edx
jl 0x1400826a1
lea edx, [rsi - 2]
cmp ebp, edx
jg 0x1400826a1
mov edx, eax
sar edx, 0x10
movsxd r10, ebp
mov byte [r11 + r10], dl
sar eax, 8
lea edx, [rbp + 1]
movsxd rdx, edx
mov byte [r11 + rdx], al
add ebp, 2
jmp 0x14008267d
test eax, eax
jl 0x1400826a1
lea edx, [rsi - 1]
cmp ebp, edx
jg 0x1400826a1
sar eax, 0x10
movsxd rdx, ebp
mov byte [r11 + rdx], al
inc ebp
add edi, 4
cmp ebx, ecx
jne 0x1400826a1
mov dword [r8], edi
mov r9, qword [rsp + 0x60]
mov dword [r9], ebp
mov eax, 1
pop rbx
pop rbp
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
ret
mov dword [r8], edi
mov r9, qword [rsp + 0x60]
mov dword [r9], ebp
xor eax, eax
pop rbx
pop rbp
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400bff50
Capabilities:
Delete file

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x90]
xor eax, eax
mov qword [rbp - 0x40], rax
test rcx, rcx
je 0x1400bff7c
add rcx, 0xc
mov rbx, rcx
jmp 0x1400bff7e
xor ebx, ebx
mov qword [rbp - 0x40], rbx
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rcx, rbx
mov qword [rbp - 0x48], rcx
lea rcx, [rbp - 0x70]
call fcn.140002ae0
mov rcx, qword [rbp - 0x48]
call sub.KERNEL32.dll_DeleteFileW
mov ebx, eax
lea rcx, [rbp - 0x70]
call fcn.140002b30
call sub.KERNEL32.dll_GetLastError
mov esi, eax
xor eax, eax
mov qword [rbp - 0x40], rax
test ebx, ebx
setne bl
movzx ebx, bl
call fcn.140001da8
mov dword [rax + 0x98], esi
movzx eax, bl
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x1400c0380
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0xa0]
xor eax, eax
mov qword [rbp - 0x40], rax
mov ebx, ecx
mov qword [rbp - 0x40], rdx
mov rsi, rdx
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov ecx, ebx
mov dword [rbp - 0x44], ecx
mov rdx, rsi
mov qword [rbp - 0x4c], rdx
lea rcx, [rbp - 0x78]
call fcn.140002ae0
mov ecx, dword [rbp - 0x44]
mov rdx, qword [rbp - 0x4c]
call sub.KERNEL32.dll_GetCurrentDirectoryW
mov ebx, eax
lea rcx, [rbp - 0x78]
call fcn.140002b30
call sub.KERNEL32.dll_GetLastError
mov esi, eax
xor eax, eax
mov qword [rbp - 0x40], rax
call fcn.140001da8
mov dword [rax + 0x98], esi
mov eax, ebx
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x1400c0bd0
Capabilities:
Create thread

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x98
lea rbp, [rsp + 0xd0]
xor eax, eax
mov qword [rbp - 0x48], rax
mov rbx, rcx
mov rsi, rdx
mov rdi, r8
mov r14, r9
mov r15, qword [rbp + 0x38]
xor ecx, ecx
mov dword [rbp - 0x3c], ecx
mov byte [rbp - 0x4c], 0
lea rcx, [0x1401439a0]
call fcn.140113870
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x48], r15
mov rcx, rbx
mov rdx, rsi
mov r8, rdi
mov r9, r14
mov ebx, dword [rbp + 0x30]
mov qword [rbp - 0x60], rcx
mov qword [rbp - 0x68], rdx
mov qword [rbp - 0x70], r8
mov qword [rbp - 0x78], r9
mov dword [rsp + 0x20], ebx
mov qword [rsp + 0x28], r15
lea rcx, [rbp - 0xa0]
call fcn.140002ae0
mov rcx, qword [rbp - 0x60]
mov rdx, qword [rbp - 0x68]
mov r8, qword [rbp - 0x70]
mov r9, qword [rbp - 0x78]
call sub.KERNEL32.dll_CreateThread
mov rbx, rax
lea rcx, [rbp - 0xa0]
call fcn.140002b30
nop
xor eax, eax
mov qword [rbp - 0x48], rax
mov dword [rbp - 0x3c], 1
mov byte [rbp - 0x4c], 1
mov rax, qword [rbp - 0x58]
mov qword [rax + 8], rbx
mov rcx, rax
mov rax, rcx
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x1400c0d20
Capabilities:
Resume thread

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0xa0]
xor eax, eax
mov qword [rbp - 0x48], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x48], rcx
lea rdx, [rbp - 0x40]
cmp dword [rcx], ecx
call fcn.1400b6080
mov rcx, qword [rbp - 0x48]
mov rcx, qword [rcx + 8]
mov qword [rbp - 0x50], rcx
lea rcx, [rbp - 0x78]
call fcn.140002ae0
mov rcx, qword [rbp - 0x50]
call sub.KERNEL32.dll_ResumeThread
mov ebx, eax
lea rcx, [rbp - 0x78]
call fcn.140002b30
nop
cmp byte [rbp - 0x40], 0
je 0x1400c0d91
mov rcx, qword [rbp - 0x48]
cmp byte [rcx], cl
xor edx, edx
call fcn.1400b60c0
mov eax, ebx
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x1400c10d0
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0xb0]
xor eax, eax
mov qword [rbp - 0x40], rax
mov rbx, rcx
mov rsi, rdx
mov edi, r8d
mov qword [rbp - 0x40], r9
mov r14, r9
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov r15, qword [rbp + 0x30]
mov qword [rsp + 0x20], r15
mov rcx, rbx
mov qword [rbp - 0x4c], rcx
mov rdx, rsi
mov qword [rbp - 0x54], rdx
mov r8d, edi
mov dword [rbp - 0x44], r8d
mov r9, r14
mov qword [rbp - 0x5c], r9
lea rcx, [rbp - 0x88]
call fcn.140002ae0
mov rcx, qword [rbp - 0x4c]
mov rdx, qword [rbp - 0x54]
mov r8d, dword [rbp - 0x44]
mov r9, qword [rbp - 0x5c]
call sub.KERNEL32.dll_WriteFile
mov ebx, eax
lea rcx, [rbp - 0x88]
call fcn.140002b30
call sub.KERNEL32.dll_GetLastError
mov esi, eax
xor eax, eax
mov qword [rbp - 0x40], rax
call fcn.140001da8
mov dword [rax + 0x98], esi
mov eax, ebx
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x1400c1190
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0xc0]
xor eax, eax
mov qword [rbp - 0x48], rax
mov rbx, rdx
mov esi, r8d
mov rdi, r9
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x48], rcx
lea rdx, [rbp - 0x40]
cmp dword [rcx], ecx
call fcn.1400b6080
mov rcx, qword [rbp - 0x48]
mov r14, qword [rcx + 8]
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov r15, qword [rbp + 0x30]
mov qword [rsp + 0x20], r15
mov rcx, r14
mov qword [rbp - 0x54], rcx
mov rdx, rbx
mov qword [rbp - 0x5c], rdx
mov r8d, esi
mov dword [rbp - 0x4c], r8d
mov r9, rdi
mov qword [rbp - 0x64], r9
lea rcx, [rbp - 0x90]
call fcn.140002ae0
mov rcx, qword [rbp - 0x54]
mov rdx, qword [rbp - 0x5c]
mov r8d, dword [rbp - 0x4c]
mov r9, qword [rbp - 0x64]
call sub.KERNEL32.dll_WriteFile
mov ebx, eax
lea rcx, [rbp - 0x90]
call fcn.140002b30
call sub.KERNEL32.dll_GetLastError
mov esi, eax
cmp byte [rbp - 0x40], 0
je 0x1400c124d
mov rcx, qword [rbp - 0x48]
cmp byte [rcx], cl
xor edx, edx
call fcn.1400b60c0
call fcn.140001da8
mov dword [rax + 0x98], esi
mov eax, ebx
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x1400c12b0
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0xc0]
xorps xmm4, xmm4
movaps xmmword [rbp - 0x50], xmm4
xor eax, eax
mov qword [rbp - 0x40], rax
mov rsi, rdx
mov edi, r8d
mov rbx, r9
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x48], rcx
lea rdx, [rbp - 0x40]
cmp dword [rcx], ecx
call fcn.1400b6080
nop
mov qword [rbp - 0x50], rbx
mov rcx, qword [rbp - 0x48]
mov r14, qword [rcx + 8]
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov r15, qword [rbp + 0x30]
mov qword [rsp + 0x20], r15
mov rcx, r14
mov qword [rbp - 0x5c], rcx
mov rdx, rsi
mov qword [rbp - 0x64], rdx
mov r8d, edi
mov dword [rbp - 0x54], r8d
mov r9, rbx
mov qword [rbp - 0x6c], r9
lea rcx, [rbp - 0x98]
call fcn.140002ae0
mov rcx, qword [rbp - 0x5c]
mov rdx, qword [rbp - 0x64]
mov r8d, dword [rbp - 0x54]
mov r9, qword [rbp - 0x6c]
call sub.KERNEL32.dll_WriteFile
mov ebx, eax
lea rcx, [rbp - 0x98]
call fcn.140002b30
call sub.KERNEL32.dll_GetLastError
mov esi, eax
xor ecx, ecx
mov qword [rbp - 0x50], rcx
cmp byte [rbp - 0x40], 0
je 0x1400c137f
mov rcx, qword [rbp - 0x48]
cmp byte [rcx], cl
xor edx, edx
call fcn.1400b60c0
call fcn.140001da8
mov dword [rax + 0x98], esi
mov eax, ebx
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x180004cd0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov rax, qword [0x180041080]
xor rax, rsp
mov qword [rbp + 0x50], rax
mov rsi, r8
mov rdi, rcx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], r8
mov r8, rcx
cmp qword [rcx + 0x18], 0x10
jb 0x180004d0e
mov r8, qword [rcx]
movzx edx, dx
mov rcx, qword [0x180043980]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rbx, rax
mov rdx, rax
mov rcx, qword [0x180043980]
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r14d, eax
mov rdx, rbx
mov rcx, qword [0x180043980]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
xor edx, edx
mov r8d, 0x108
lea rcx, [rsp + 0x40]
call fcn.18000fd40
mov rdx, rsi
cmp qword [rsi + 0x18], 0x10
jb 0x180004d6f
mov rdx, qword [rsi]
lea rcx, [rsp + 0x40]
call fcn.18000a038
mov rax, qword [rsp + 0x40]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x40], rax
mov rax, qword [rsp + 0x40]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rsp + rcx + 0x3c], edx
cmp qword [rbp - 0x38], 0
je 0x180004e1c
mov r8, r14
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.18000a334
cmp qword [rbp - 0x38], 0
je 0x180004de3
lea r14, [rsp + 0x48]
lea rcx, [rsp + 0x48]
call fcn.18000ab50
neg al
sbb rbx, rbx
and rbx, r14
mov rcx, qword [rbp - 0x38]
call fcn.18001451c
test eax, eax
je 0x180004de5
xor ebx, ebx
mov r14d, 2
mov r8d, r14d
xor edx, edx
lea rcx, [rsp + 0x48]
call fcn.18000ac18
test rbx, rbx
jne 0x180004e1c
mov rax, qword [rsp + 0x40]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x40]
add rcx, rax
xor r8d, r8d
mov edx, r14d
call fcn.18000ad0c
nop
lea rcx, [rbp - 0x18]
call fcn.180009fb8
nop
lea rax, vtable.std::ios_base.0
mov qword [rbp - 0x18], rax
lea rcx, [rbp - 0x18]
call fcn.18000caec
nop
mov rdx, qword [rdi + 0x18]
mov r14d, 0x1000
cmp rdx, 0x10
jb 0x180004e73
mov rcx, qword [rdi]
inc rdx
cmp rdx, r14
jb 0x180004e6e
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180004edc
mov rcx, r8
call fcn.18000d720
and qword [rdi + 0x10], 0
mov ebx, 0xf
mov qword [rdi + 0x18], rbx
mov byte [rdi], 0
mov rdx, qword [rsi + 0x18]
cmp rdx, 0x10
jb 0x180004eb6
inc rdx
mov rcx, qword [rsi]
cmp rdx, r14
jb 0x180004eb1
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180004ee2
mov rcx, r8
call fcn.18000d720
and qword [rsi + 0x10], 0
mov qword [rsi + 0x18], rbx
mov byte [rsi], 0
mov rcx, qword [rbp + 0x50]
xor rcx, rsp
call fcn.18000d700
add rsp, 0x160
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.18001639c
nop
call fcn.18001639c
int3
Function at 0x180004f28
Capabilities:
Access firewall policy via inetfwpolicy2

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x180041080]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov edx, 2
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
xor ebx, ebx
test eax, eax
js 0x180004fb9
lea rax, [rsp + 0x30]
mov qword [rsp + 0x30], rbx
lea r9, [0x18003bbb0]
mov qword [rsp + 0x20], rax
xor edx, edx
lea r8d, [rbx + 1]
lea rcx, [0x18003bd08]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x180004fb3
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x38]
lea edx, [rbx + 4]
mov rax, qword [rcx]
call qword [rax + 0x40]
cmp word [rsp + 0x38], bx
je 0x180004fa8
mov rcx, qword [rsp + 0x30]
lea edx, [rbx + 4]
xor r8d, r8d
mov rax, qword [rcx]
call qword [rax + 0x48]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.18000d700
add rsp, 0x50
pop rbx
ret

Function at 0x180004fcc
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
sub rsp, 0x78
mov rax, qword [0x180041080]
xor rax, rsp
mov qword [rsp + 0x60], rax
and qword [r11 - 0x38], 0
lea rax, [r11 - 0x28]
mov qword [r11 - 0x40], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
and qword [r11 - 0x48], 0
xor r9d, r9d
mov dword [rsp + 0x28], 0x20006
xor r8d, r8d
and dword [rsp + 0x20], 0
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
and dword [rsp + 0x58], 0
lea rax, [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
lea rdx, str.ConsentPromptBehaviorAdmin
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.18000d700
add rsp, 0x78
ret
Function at 0x18000505c
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x180041080]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor r14d, r14d
mov dword [rsp + 0x20], r14d
mov esi, r14d
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1800050f4
mov dword [rsp + 0x30], 0x238
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1800050eb
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x38], eax
je 0x1800050e7
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
jmp 0x1800050c7
mov esi, dword [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx], r14
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 7
mov word [rbx], r14w
mov dword [rsp + 0x20], 1
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x180005169
mov dword [rsp + 0x30], 0x238
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x180005160
cmp dword [rsp + 0x38], esi
je 0x180005153
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
jmp 0x180005139
lea rdx, [rsp + 0x5c]
mov rcx, rbx
call fcn.18000ae14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rbx
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.18000d700
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret

Function at 0x180005194
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x180041080]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x234
xor ebx, ebx
call fcn.18000fd40
xor edx, edx
mov dword [rsp + 0x20], 0x238
lea ecx, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x20]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x180005212
lea rdx, str.newwps.exe
lea rcx, [rsp + 0x4c]
call fcn.180013fd4
test eax, eax
jne 0x180005204
inc ebx
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1800051ed
mov eax, ebx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.18000d700
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rdi
ret
Function at 0x18000523c
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x180041080]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rsi, rcx
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x234
xor ebx, ebx
call fcn.18000fd40
xor edx, edx
mov dword [rsp + 0x20], 0x238
lea ecx, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x20]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1800052c4
mov rdx, rsi
lea rcx, [rsp + 0x4c]
call fcn.180013fd4
test eax, eax
je 0x1800052c0
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
jmp 0x18000529b
mov ebx, dword [rsp + 0x28]
mov eax, ebx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.18000d700
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x1800052ec
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x160
mov rax, qword [0x180041080]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rbx, rcx
mov qword [rsp + 0x30], rcx
lea rax, [rsp + 0x40]
xor ecx, ecx
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor edx, edx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
xor ecx, ecx
mov qword [rbx + 0x18], 0xf
mov qword [rbx], rcx
lea rdx, [rsp + 0x40]
mov qword [rbx + 0x10], rcx
mov byte [rbx], cl
mov rcx, rbx
test eax, eax
jns 0x18000534f
lea rdx, [0x18003b55b]
call fcn.18000b044
mov rax, rbx
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.18000d700
add rsp, 0x160
pop rbx
ret

Function at 0x180005eb8
Capabilities:
Enumerate processes
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x180041080]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edx, edx
mov rsi, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x180005eff
xor al, al
jmp 0x180005f83
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
xor ebx, ebx
test eax, eax
je 0x180005f78
mov bpl, bl
jmp 0x180005f31
mov rdx, rsi
lea rcx, [rsp + 0x4c]
call fcn.180013fd4
test eax, eax
je 0x180005f45
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x180005f20
jmp 0x180005f75
mov r8d, dword [rsp + 0x28]
mov ebp, 1
mov ecx, ebp
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x180005f75
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, bpl
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.18000d700
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x180005fac
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x200
mov rax, qword [0x180041080]
xor rax, rsp
mov qword [rsp + 0x1f0], rax
xor edx, edx
mov rbx, rcx
lea rcx, [rsp + 0x70]
lea r8d, [rdx + 0x68]
call fcn.18000fd40
cmp qword [rbx + 0x18], 0x10
mov rdx, rbx
mov dword [rsp + 0x70], 0x68
mov dword [rsp + 0xac], 1
jb 0x180005ffa
mov rdx, qword [rbx]
lea rcx, [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0xe0]
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor edx, edx
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20
and dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x180006081
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x18000607c
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1800060aa
mov rcx, r8
call fcn.18000d720
and qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rcx, qword [rsp + 0x1f0]
xor rcx, rsp
call fcn.18000d700
add rsp, 0x200
pop rbx
ret
call fcn.18001639c
int3

Function at 0x1800060b0
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x200
mov rax, qword [0x180041080]
xor rax, rsp
mov qword [rsp + 0x1f0], rax
xor edx, edx
mov rbx, rcx
lea rcx, [rsp + 0x50]
lea r8d, [rdx + 0x68]
call fcn.18000fd40
cmp qword [rbx + 0x18], 0x10
mov eax, 3
mov word [rsp + 0x90], ax
mov rdx, rbx
mov dword [rsp + 0x50], 0x68
mov dword [rsp + 0x8c], 1
jb 0x18000610b
mov rdx, qword [rbx]
lea rcx, [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rax, [rsp + 0xc0]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0xe0]
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor edx, edx
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20
and dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x180006195
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x180006190
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1800061be
mov rcx, r8
call fcn.18000d720
and qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rcx, qword [rsp + 0x1f0]
xor rcx, rsp
call fcn.18000d700
add rsp, 0x200
pop rbx
ret
call fcn.18001639c
int3