joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001b240
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov rax, qword [rcx + 0x28]
mov r8, rcx
xor edx, edx
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001b27d
mov edx, dword [rax + 0x3c]
cmp edx, 0x800
jbe 0x14001b27d
mov al, byte [2]
inc al
mov byte [2], al
int3
mov r9d, edx
add r9, rax
mov qword [r8 + 0x30], r9
cmp dword [r9], 0x4550
je 0x14001b2a1
mov al, byte [3]
inc al
mov byte [3], al
int3
mov eax, 0xf0
cmp word [r9 + 0x14], ax
je 0x14001b2be
mov al, byte [4]
inc al
mov byte [4], al
int3
mov eax, 0x20b
cmp word [r9 + 0x18], ax
je 0x14001b2db
mov al, byte [5]
inc al
mov byte [5], al
int3
cmp dword [r9 + 0x84], 0x10
je 0x14001b2f6
mov al, byte [6]
inc al
mov byte [6], al
int3
mov dword [r8 + 0x38], edx
movzx eax, word [r9 + 6]
lea ecx, [rax*4 + 0x21]
add ecx, eax
lea eax, [rdx + rcx*8]
mov edx, eax
mov dword [r8 + 0x3c], eax
mov eax, dword [r9 + 0x50]
mov dword [r8 + 0x40], eax
mov rax, qword [r9 + 0x88]
mov rcx, rax
shr rcx, 0x20
cmp ecx, 0x28
jb 0x14001b33e
cmp eax, edx
jb 0x14001b33e
mov edx, dword [r9 + 0x50]
cmp eax, edx
jae 0x14001b33e
add ecx, eax
cmp ecx, edx
jbe 0x14001b34f
mov cl, byte [7]
inc cl
mov byte [7], cl
int3
mov r10d, eax
mov rcx, rax
add r10, qword [r8 + 0x28]
shr rcx, 0x20
mov dword [r8 + 0x44], eax
mov dword [r8 + 0x48], ecx
mov eax, dword [r10 + 0x14]
dec eax
cmp eax, 0xffffe
ja 0x14001b382
mov eax, dword [r10 + 0x18]
cmp eax, 0x100000
jae 0x14001b382
cmp eax, 1
jae 0x14001b397
mov al, byte [8]
inc al
mov byte [8], al
int3
mov edi, dword [r8 + 0x3c]
mov dword [r8 + 0x5c], eax
mov ecx, dword [r10 + 0x18]
cmp ecx, dword [r10 + 0x14]
cmovb ecx, dword [r10 + 0x14]
mov dword [r8 + 0x58], ecx
mov r11d, dword [r10 + 0x1c]
cmp r11d, edi
jb 0x14001b3cb
mov ebx, dword [r9 + 0x50]
cmp r11d, ebx
jae 0x14001b3cb
lea rdx, [r11 + rcx*4]
cmp rdx, rbx
jbe 0x14001b3e4
mov al, byte [9]
inc al
mov byte [9], al
int3
mov rbx, qword [r8 + 0x28]
mov eax, r11d
add rax, rbx
mov qword [r8 + 0x50], rax
mov r11d, dword [r10 + 0x20]
cmp r11d, edi
jb 0x14001b412
cmp r11d, dword [r9 + 0x50]
jae 0x14001b412
mov ecx, dword [r10 + 0x18]
mov eax, dword [r9 + 0x50]
lea rdx, [r11 + rcx*4]
cmp rdx, rax
jbe 0x14001b42f
mov al, byte [0xa]
inc al
mov byte [0xa], al
int3
mov eax, r11d
add rax, rbx
mov qword [r8 + 0x60], rax
mov r11d, dword [r10 + 0x24]
cmp r11d, edi
jb 0x14001b458
mov r9d, dword [r9 + 0x50]
cmp r11d, r9d
jae 0x14001b458
mov ecx, dword [r10 + 0x18]
lea rdx, [r11 + rcx*4]
cmp rdx, r9
jbe 0x14001b471
mov al, byte [0xb]
inc al
mov byte [0xb], al
int3
mov rdi, qword [rsp + 0x10]
mov eax, r11d
add rax, rbx
mov rbx, qword [rsp + 8]
mov qword [r8 + 0x68], rax
ret
Function at 0x1400202f0
Capabilities:
Parse pe header

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x48
mov rsi, r9
mov edi, r8d
mov ebp, edx
mov rbx, rcx
cmp r8d, 2
jne 0x140020311
call fcn.140024880
mov edi, eax
mov rax, qword [rbx + 8]
lea rdx, [rsp + 0x80]
xor r9d, r9d
mov rcx, rbx
lea r8d, [r9 + 4]
call qword [case.0x14002098f.0]
test eax, eax
js 0x1400204f0
mov eax, dword [rsp + 0x80]
mov qword [rsp + 0x78], r12
mov qword [rsp + 0x40], r13
mov r13d, 0x5a4d
mov qword [rsp + 0x38], r14
mov r14d, 0x584c
mov qword [rsp + 0x30], r15
cmp ax, r13w
je 0x1400203a1
cmp eax, 0x4550
je 0x1400203a1
cmp eax, 0x464c457f
je 0x1400203a1
cmp ax, r14w
je 0x1400203a1
lea ecx, [rax + 0x1120532]
cmp ecx, 1
jbe 0x1400203a1
cmp eax, 0xfefaedfe
je 0x1400203a1
cmp eax, 0xcefaedfe
je 0x1400203a1
cmp eax, 0xcafebabe
je 0x1400203a1
cmp eax, 0xbebafeca
jne 0x14002042d
mov dword [rsp + 0x70], 0
mov r12d, 0x454c
lea r15d, [r12 + 2]
cmp ax, r13w
jne 0x140020437
mov rax, qword [rbx + 8]
lea rdx, [rsp + 0x70]
mov r9d, 0x3c
mov rcx, rbx
lea r8d, [r9 - 0x38]
call qword [case.0x14002098f.0]
test eax, eax
js 0x1400204dc
mov eax, dword [rsp + 0x70]
cmp eax, 0x40
jbe 0x14002042d
mov r9d, eax
lea rdx, [rsp + 0x80]
mov rax, qword [rbx + 8]
mov r8d, 4
mov rcx, rbx
call qword [case.0x14002098f.0]
test eax, eax
js 0x1400204dc
mov eax, dword [rsp + 0x80]
cmp eax, 0x4550
je 0x14002043e
cmp ax, r14w
je 0x140020437
cmp ax, r12w
je 0x140020437
cmp ax, r15w
je 0x140020437
mov eax, 0xfffffda8
jmp 0x1400204dc
cmp eax, 0x4550
jne 0x140020466
mov rax, qword [rsp + 0x90]
mov r8d, edi
mov r9d, dword [rsp + 0x70]
mov edx, ebp
mov qword [rsp + 0x28], rax
mov rcx, rbx
mov qword [rsp + 0x20], rsi
call fcn.140041220
mov ecx, eax
jmp 0x1400204da
cmp eax, 0x464c457f
jne 0x140020474
mov ecx, 0xfffffda7
jmp 0x1400204da
lea ecx, [rax + 0x1120532]
cmp ecx, 1
jbe 0x1400204d5
cmp eax, 0xfefaedfe
je 0x1400204d5
cmp eax, 0xcefaedfe
je 0x1400204d5
cmp eax, 0xcafebabe
je 0x1400204d5
cmp eax, 0xbebafeca
je 0x1400204d5
cmp ax, r14w
jne 0x1400204a8
mov ecx, 0xfffffda5
jmp 0x1400204da
cmp ax, r12w
jne 0x1400204b5
mov ecx, 0xfffffda4
jmp 0x1400204da
cmp ax, r15w
jne 0x1400204c2
mov ecx, 0xfffffda3
jmp 0x1400204da
cmp ax, r13w
mov ecx, 0xfffffda8
mov edx, 0xfffffda2
cmove ecx, edx
jmp 0x1400204da
mov ecx, 0xfffffda8
mov eax, ecx
mov r14, qword [rsp + 0x38]
mov r13, qword [rsp + 0x40]
mov r12, qword [rsp + 0x78]
mov r15, qword [rsp + 0x30]
add rsp, 0x48
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140024600
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
sub rsp, 0x28
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax - 8], rdi
mov qword [rax - 0x10], r12
mov r12, r9
mov qword [rax - 0x18], r13
xor r9d, r9d
mov qword [rax - 0x20], r14
mov r13, rdx
mov rax, rcx
mov qword [rsp], r15
movzx ecx, r8b
mov edx, r9d
shr r8d, 8
test r8d, r8d
jne 0x140024649
mov r8d, 0xffffffff
cmp ecx, 0x24
mov r10b, 1
cmovb edx, ecx
movzx ecx, byte [rax]
cmp cl, 0x2b
jne 0x14002465f
mov r10b, 1
jmp 0x140024668
cmp cl, 0x2d
jne 0x140024671
xor r10b, 1
inc rax
add r8d, 0xffffffff
jne 0x140024652
lea rbx, [0x140000000]
test edx, edx
jne 0x1400246c6
cmp byte [rax], 0x30
lea edi, [rdx + 0xa]
jne 0x1400246fe
cmp r8d, 1
jbe 0x1400246b1
movzx ecx, byte [rax + 1]
sub cl, 0x58
test cl, 0xdf
jne 0x1400246b1
movzx ecx, byte [rax + 2]
cmp byte [rcx + rbx + 0xa78d0], 0x10
jae 0x1400246b1
add rax, 2
lea edi, [rdx + 0x10]
add r8d, 0xfffffffe
jmp 0x1400246fe
movzx ecx, byte [rax + 1]
cmp byte [rcx + rbx + 0xa78d0], 8
jae 0x1400246fe
mov edi, 8
jmp 0x1400246fe
mov edi, edx
cmp edx, 0x10
jne 0x1400246fe
cmp byte [rax], 0x30
jne 0x1400246fe
cmp r8d, 1
jbe 0x1400246fe
movzx ecx, byte [rax + 1]
cmp cl, 0x78
je 0x1400246e6
cmp cl, 0x58
jne 0x1400246fe
movzx ecx, byte [rax + 2]
mov edi, edx
cmp byte [rcx + rbx + 0xa78d0], 0x10
jae 0x1400246fe
add r8d, 0xfffffffe
add rax, 2
mov r14d, edi
mov r15, rax
movsx ebp, byte [r14 + rbx + 0xa79d0]
mov rbx, r9
test r8d, r8d
je 0x140024767
lea r13, [0x140000000]
mov qword [rsp + 0x48], rsi
movzx ecx, byte [rax]
test cl, cl
je 0x14002475d
movzx esi, byte [rcx + r13 + 0xa78d0]
cmp esi, edi
jae 0x14002475d
mov r11, rbx
imul rbx, r14
add rbx, rsi
cmp r11, rbx
ja 0x14002474e
mov ecx, ebp
shr r11, cl
test r11, r11
je 0x140024754
mov r9d, 0x37
inc rax
add r8d, 0xffffffff
jne 0x140024721
mov r13, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
mov r14, qword [rsp + 8]
mov rdi, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x40]
test r10b, r10b
jne 0x14002478a
test r9d, r9d
mov ecx, 0x39
cmove r9d, ecx
neg rbx
test r12, r12
je 0x140024793
mov qword [r12], rbx
mov r12, qword [rsp + 0x18]
cmp rax, r15
mov r15, qword [rsp]
mov ecx, 0xffffffc8
mov rbx, qword [rsp + 0x30]
cmove r9d, ecx
test r13, r13
je 0x1400247b6
mov qword [r13], rax
mov r13, qword [rsp + 0x10]
test r9d, r9d
jne 0x140024803
cmp byte [rax], r9b
je 0x140024803
test r8d, r8d
je 0x140024803
nop word [rax + rax]
movzx ecx, byte [rax]
cmp cl, 0x20
je 0x1400247dd
cmp cl, 9
jne 0x1400247f0
inc rax
add r8d, 0xffffffff
jne 0x1400247d0
mov eax, 0x4d
add rsp, 0x28
ret
test r8d, r8d
je 0x1400247e6
test cl, cl
je 0x1400247e6
mov eax, 0x4c
add rsp, 0x28
ret
mov eax, r9d
add rsp, 0x28
ret
Function at 0x14003d370
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [rcx + 0xb8]
mov qword [rcx + 0x130], rax
mov eax, dword [rcx + 0xb4]
mov qword [rcx + 0x128], rax
mov eax, dword [rcx + 0xb0]
mov qword [rcx + 0x120], rax
mov eax, dword [rcx + 0xac]
mov qword [rcx + 0x118], rax
mov eax, dword [rcx + 0xa8]
mov qword [rcx + 0x110], rax
mov eax, dword [rcx + 0xa4]
mov qword [rcx + 0x108], rax
mov eax, dword [rcx + 0xa0]
mov qword [rcx + 0x100], rax
mov eax, dword [rcx + 0x9c]
mov qword [rcx + 0xf8], rax
mov eax, dword [rcx + 0x98]
mov dword [rcx + 0xf4], eax
mov eax, dword [rcx + 0x94]
mov dword [rcx + 0xf0], eax
mov eax, dword [rcx + 0x90]
mov qword [rcx + 0xe8], rax
movzx eax, word [rcx + 0x8e]
mov word [rcx + 0xe6], ax
movzx eax, word [rcx + 0x8c]
mov word [rcx + 0xe4], ax
mov eax, dword [rcx + 0x88]
mov dword [rcx + 0xe0], eax
mov eax, dword [rcx + 0x84]
mov qword [rcx + 0xd8], rax
mov eax, dword [rcx + 0x80]
mov qword [rcx + 0xd0], rax
mov eax, dword [rcx + 0x7c]
mov qword [rcx + 0xc8], rax
mov eax, dword [rcx + 0x78]
mov qword [rcx + 0xc0], rax
mov eax, dword [rcx + 0x74]
mov qword [rcx + 0xb8], rax
mov eax, dword [rcx + 0x70]
mov qword [rcx + 0xb0], rax
mov eax, dword [rcx + 0x6c]
mov qword [rcx + 0xa8], rax
mov eax, dword [rcx + 0x68]
mov qword [rcx + 0xa0], rax
mov eax, dword [rcx + 0x64]
mov dword [rcx + 0x9c], eax
mov eax, dword [rcx + 0x60]
mov dword [rcx + 0x98], eax
movzx eax, word [rcx + 0x5e]
mov word [rcx + 0x96], ax
movzx eax, word [rcx + 0x5c]
mov word [rcx + 0x94], ax
mov eax, dword [rcx + 0x58]
mov dword [rcx + 0x90], eax
mov eax, dword [rcx + 0x54]
mov qword [rcx + 0x88], rax
mov eax, dword [rcx + 0x50]
mov qword [rcx + 0x80], rax
mov eax, dword [rcx + 0x4c]
mov qword [rcx + 0x78], rax
mov eax, dword [rcx + 0x48]
mov qword [rcx + 0x70], rax
mov eax, dword [rcx + 0x44]
mov qword [rcx + 0x68], rax
mov eax, dword [rcx + 0x40]
mov qword [rcx + 0x60], rax
mov eax, dword [rcx + 0x3c]
mov qword [rcx + 0x58], rax
mov eax, dword [rcx + 0x38]
mov qword [rcx + 0x50], rax
movzx eax, word [rcx + 0x36]
mov word [rcx + 0x4e], ax
movzx eax, word [rcx + 0x34]
mov word [rcx + 0x4c], ax
mov eax, dword [rcx + 0x2c]
mov dword [rcx + 0x48], eax
mov eax, dword [rcx + 0x30]
mov qword [rcx + 0x40], rax
mov eax, dword [rcx + 0x28]
mov qword [rcx + 0x38], rax
mov eax, dword [rcx + 0x24]
mov qword [rcx + 0x30], rax
mov eax, dword [rcx + 0x20]
mov qword [rcx + 0x28], rax
mov eax, dword [rcx + 0x1c]
mov qword [rcx + 0x20], rax
mov eax, dword [rcx + 0x18]
mov qword [rcx + 0x18], rax
ret
Function at 0x140064750
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rdx + 0xf]
and rax, 0xfffffffffffffff0
jbe 0x14006477d
mov rdx, qword [0x1400bf9d0]
dec rax
shr rax, 3
inc rax
nop dword [rax + rax]
xor qword [rcx], rdx
lea rcx, [rcx + 8]
sub rax, 1
jne 0x140064770
xor eax, eax
ret
Function at 0x1400010ca
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor eax, eax
cpuid
mov eax, 1
cpuid
movabs r9, 0xb2d05e00
cpuid
rdtsc
shl rdx, 0x20
or rax, rdx
mov rcx, rax
fldpi
frndint
rdtsc
shl rdx, 0x20
or rax, rdx
sub rax, rcx
cmp rax, r9
jb 0x1400010ed
push rbp
mov rbp, rsp
sub rsp, 8
mov r10, 0xa
mov rcx, 0xffffffff9f345678
dec rcx
xor r9, r9
mov rax, rcx
jne 0x140001118
xor rax, rax
mov rax, rbx
add rax, rdx
nop
nop
nop
dec r10
xor r11, r11
jne 0x140001111
xor rax, rax
mov rax, 0xa
dec rax
nop
nop
add rsp, 8
pop rbp
ret

Function at 0x14000364c
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.1400034bc
Function at 0x1400054f8
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x14000b470]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.140004530
xor ebx, ebx
cmp qword [0x14000c9f8], rbx
mov rdi, rax
jne 0x14000560b
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x1400056e2
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400056e2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x14000c9f8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x14000ca00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x14000ca08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x14000ca18], rax
test rax, rax
je 0x140005602
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x14000ca10], rax
jmp 0x140005612
mov rax, qword [0x14000ca10]
jmp 0x140005619
mov rax, qword [0x14000ca10]
mov r11, qword [0x14000ca18]
cmp rax, rdi
je 0x140005680
cmp r11, rdi
je 0x140005680
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x14000ca18]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x140005680
test rax, rax
je 0x140005680
call rsi
test rax, rax
je 0x14000567a
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x14000567a
test byte [rsp + 0x40], 1
jne 0x140005680
bts ebp, 0x15
jmp 0x1400056c0
mov rcx, qword [0x14000ca00]
cmp rcx, rdi
je 0x1400056c0
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x1400056c0
call rax
mov rbx, rax
test rax, rax
je 0x1400056c0
mov rcx, qword [0x14000ca08]
cmp rcx, rdi
je 0x1400056c0
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x1400056c0
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x14000c9f8]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x1400056e2
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x1400056e4
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140005930
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140006d7b
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x14000b470]
jne 0x14000594a
rol rcx, 0x10
test cx, 0xffff
jne 0x140005946
repz ret
ror rcx, 0x10
jmp 0x140006cd4
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x14000caf0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x14000cbe8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140006d59
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x14000caf0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140006d7b
mov rax, qword [rsp + 0x88]
mov qword [0x14000cbe8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x14000cb88], rax
mov rax, qword [0x14000cbe8]
mov qword [0x14000ca60], rax
mov rax, qword [rsp + 0x90]
mov qword [0x14000cb70], rax
mov dword [0x14000ca50], 0xc0000409
mov dword [0x14000ca54], 1
mov rax, qword [0x14000b470]
mov qword [rsp + 0x68], rax
mov rax, qword [0x14000b478]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x14000cae8], eax
mov ecx, 1
call fcn.140006b7c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140009320]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x14000cae8], 0
jne 0x140006e02
mov ecx, 1
call fcn.140006b7c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x10001e024
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rdi
push r12
sub rsp, 0xb0
and dword [rsp + 0x20], 0
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x1000301f8], rdi
je 0x10001e07d
cmp rax, rdi
jne 0x10001e070
mov esi, 1
jmp 0x10001e07d
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10001e057
mov eax, dword [0x1000301f0]
cmp eax, 1
jne 0x10001e092
lea ecx, [rax + 0x1e]
call sub.msvcrt.dll__amsg_exit
jmp 0x10001e0f7
mov eax, dword [0x1000301f0]
test eax, eax
jne 0x10001e0ed
mov dword [0x1000301f0], 1
lea r12, [0x100001690]
lea rdi, [0x100001678]
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], eax
cmp rdi, r12
jae 0x10001e0df
test eax, eax
jne 0x10001e0df
mov rcx, qword [rdi]
test rcx, rcx
je 0x10001e0d4
call rcx
mov dword [rsp + 0x30], eax
add rdi, 8
mov qword [rsp + 0x38], rdi
jmp 0x10001e0bd
test eax, eax
je 0x10001e0f7
mov eax, 0xff
jmp 0x10001e241
mov dword [0x10002f924], 1
mov eax, dword [0x1000301f0]
cmp eax, 1
jne 0x10001e11f
lea rdx, [0x100001670]
lea rcx, [0x1000015f8]
call sub.msvcrt.dll__initterm
mov dword [0x1000301f0], 2
test esi, esi
jne 0x10001e12c
xor eax, eax
xchg qword [0x1000301f8], rax
cmp qword [0x100030210], 0
je 0x10001e155
lea rcx, [0x100030210]
call fcn.10001e5dc
test eax, eax
je 0x10001e155
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x100030210]
mov rax, qword [sym.imp.msvcrt.dll__acmdln]
mov rdi, qword [rax]
mov qword [rsp + 0x28], rdi
mov esi, dword [rsp + 0x20]
cmp byte [rdi], 0x20
ja 0x10001e1e0
cmp byte [rdi], 0
je 0x10001e176
test esi, esi
jne 0x10001e1e0
cmp byte [rdi], 0
je 0x10001e18a
cmp byte [rdi], 0x20
ja 0x10001e18a
inc rdi
mov qword [rsp + 0x28], rdi
jmp 0x10001e176
test byte [rsp + 0x7c], 1
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rdi
xor edx, edx
lea rcx, [0x100000000]
call fcn.100008db4
mov dword [0x10002f920], eax
cmp dword [0x10002f904], 0
jne 0x10001e1c9
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x10002f924], 0
jne 0x10001e1de
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x10002f920]
jmp 0x10001e241
cmp byte [rdi], 0x22
jne 0x10001e1f2
xor eax, eax
test esi, esi
sete al
mov esi, eax
mov dword [rsp + 0x20], eax
movzx ecx, byte [rdi]
call qword [sym.imp.msvcrt.dll__ismbblead]
test eax, eax
je 0x10001e207
inc rdi
mov qword [rsp + 0x28], rdi
inc rdi
mov qword [rsp + 0x28], rdi
jmp 0x10001e168
lea r11, [rsp + 0xb0]
mov rsi, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop r12
ret
sub rsp, 0x28
call 0x1000c2000
add rsp, 0x28
jmp 0x10001e024
Function at 0x140001000
Capabilities:
Terminate process
Write file on windows

Disassembly:
sub rsp, 0x268
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x250], rax
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x200
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x30], 0
lea rcx, str..PhysicalDrive0
mov dword [rsp + 0x28], 0
xor r9d, r9d
mov edx, 0x10000000
mov dword [rsp + 0x20], 3
mov r8d, 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
lea r9, [rsp + 0x44]
mov qword [rsp + 0x20], 0
mov rcx, rax
lea rdx, [rsp + 0x50]
mov r8d, 0x200
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x140001978
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400019c2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400019c2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400019c2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400019c2
cmp dword [rcx + 0x84], 0xe
jbe 0x1400019c2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400019c4
xor al, al
add rsp, 0x28
ret
Function at 0x1800013b0
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x90
xor r15d, r15d
mov edi, ecx
cmp qword [0x180005238], r15
mov rbp, r9
mov esi, r8d
mov qword [rsp + 0x58], r15
mov r14, rdx
mov qword [rsp + 0x50], rdi
je 0x180001419
lea rdx, [rsp + 0x48]
mov ecx, edi
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x180001419
mov rcx, qword [rsp + 0x48]
call qword [0x180005238]
mov rcx, qword [rsp + 0x48]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
test ebx, ebx
jne 0x180001447
lea rdx, [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x180001451
mov rax, qword [sym.imp.ntoskrnl.exe_PsInitialSystemProcess]
mov rcx, qword [rsp + 0x48]
cmp qword [rax], rcx
sete bl
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
test bl, bl
je 0x180001451
mov eax, 0xc0000022
jmp 0x1800014e2
xorps xmm0, xmm0
mov dword [rsp + 0x60], 0x30
lea r9, [rsp + 0x50]
mov qword [rsp + 0x68], r15
lea r8, [rsp + 0x60]
mov dword [rsp + 0x78], 0x200
mov edx, 0x40
mov qword [rsp + 0x70], r15
lea rcx, [rsp + 0x40]
movdqu xmmword [rsp + 0x80], xmm0
call qword [sym.imp.ntoskrnl.exe_ZwOpenProcess]
test eax, eax
js 0x1800014e2
mov rcx, qword [rsp + 0x40]
mov eax, 2
test esi, esi
mov r9, rbp
mov r8, 0xffffffffffffffff
mov rdx, r14
cmovne eax, r15d
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], esi
call qword [sym.imp.ntoskrnl.exe_ZwDuplicateObject]
mov rcx, qword [rsp + 0x40]
mov ebx, eax
test eax, eax
jns 0x1800014da
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
jmp 0x1800014e2
call qword [sym.imp.ntoskrnl.exe_ZwClose]
xor eax, eax
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x180001500
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x60
mov rdi, rcx
mov esi, dword [rcx]
cmp qword [0x180005238], 0
je 0x18000155a
lea rdx, [rsp + 0x88]
mov ecx, esi
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x18000155a
mov rcx, qword [rsp + 0x88]
call qword [0x180005238]
mov ebx, eax
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
test ebx, ebx
je 0x18000155a
mov eax, 0xc0000022
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret
lea rdx, [rsp + 0x80]
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x180001604
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
lea rax, [rsp + 0x98]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9b, 1
xor r8d, r8d
xor edx, edx
mov rcx, qword [rdi + 0x18]
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov ebx, eax
test eax, eax
js 0x1800015e1
mov rcx, qword [rsp + 0x90]
cmp rcx, qword [rdi + 8]
jne 0x1800015da
mov dl, 1
mov rcx, qword [rdi + 0x18]
call qword [sym.imp.ntoskrnl.exe_ObCloseHandle]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
nop
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, ebx
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret
Function at 0x180002730
Capabilities:
Find process by pid

Disassembly:
sub rsp, 0x28
cmp qword [0x180005238], 0
je 0x180002776
lea rdx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x180002776
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x20], rbx
call qword [0x180005238]
mov rcx, qword [rsp + 0x38]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, ebx
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret