joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140005970
Capabilities:
Access the windows event log
Capture network configuration via ipconfig
Clear windows event logs
Execute command

Disassembly:
push rsi
sub rsp, 0x20
lea rcx, str.ipconfig__flushdns
call sub.api_ms_win_crt_runtime_l1_1_0.dll_system
lea rcx, str.arp__d_
call sub.api_ms_win_crt_runtime_l1_1_0.dll_system
lea rcx, str.nbtstat__R
call sub.api_ms_win_crt_runtime_l1_1_0.dll_system
lea rcx, str.nbtstat__RR
call sub.api_ms_win_crt_runtime_l1_1_0.dll_system
lea rcx, str.route__f
call sub.api_ms_win_crt_runtime_l1_1_0.dll_system
call fcn.140005f80
lea rdx, str.Security
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenEventLogW]
test rax, rax
je 0x1400059e1
mov rsi, rax
mov rcx, rax
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_ClearEventLogW]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseEventLog]
call fcn.140005f80
lea rdx, str.Security
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenEventLogW]
test rax, rax
je 0x140005a17
mov rsi, rax
mov rcx, rax
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_ClearEventLogW]
mov rcx, rsi
add rsp, 0x20
pop rsi
jmp qword [sym.imp.ADVAPI32.dll_CloseEventLog]
nop
add rsp, 0x20
pop rsi
ret

Function at 0x140005a60
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x6a0
call fcn.140006240
call fcn.140006310
lea rdx, str.C:WindowsPrefetch.
lea rsi, [rsp + 0x490]
mov r8d, 0x208
mov rcx, rsi
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
lea rdx, [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
je 0x140005b0c
mov rsi, rax
lea r15, [rsp + 0x5c]
lea rdi, str.C:WindowsPrefetch_s
lea rbx, [rsp + 0x280]
mov r12, qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea r14, [rsp + 0x30]
mov r13, qword [sym.imp.KERNEL32.dll_FindNextFileW]
nop word [rax + rax]
mov qword [rsp + 0x20], r15
mov rcx, rbx
mov r9, rdi
call fcn.140006590
mov rcx, rbx
call r12
mov rcx, rsi
mov rdx, r14
call r13
test eax, eax
jne 0x140005ae0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
add rsp, 0x6a0
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140005b20
Capabilities:
Delete registry key

Disassembly:
push rsi
sub rsp, 0x30
lea rsi, [rsp + 0x28]
mov qword [rsp + 0x20], rsi
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerUserAssist
mov rcx, 0xffffffff80000001
xor r8d, r8d
mov r9d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140005b68
mov rcx, qword [rsp + 0x28]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x20], rsi
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerRunMRU
mov rcx, 0xffffffff80000001
xor r8d, r8d
mov r9d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140005ba6
mov rcx, qword [rsp + 0x28]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x20], rsi
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerRunMRU
mov rcx, 0xffffffff80000001
xor r8d, r8d
mov r9d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140005be4
mov rcx, qword [rsp + 0x28]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
add rsp, 0x30
pop rsi
ret

Function at 0x140005f80
Capabilities:
Access the windows event log
Clear windows event logs

Disassembly:
push rsi
sub rsp, 0x20
lea rdx, str.Application
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenEventLogW]
test rax, rax
je 0x140005fb0
mov rsi, rax
mov rcx, rax
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_ClearEventLogW]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseEventLog]
lea rdx, str.Security
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenEventLogW]
test rax, rax
je 0x140005fdb
mov rsi, rax
mov rcx, rax
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_ClearEventLogW]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseEventLog]
lea rdx, str.System
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenEventLogW]
test rax, rax
je 0x140006006
mov rsi, rax
mov rcx, rax
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_ClearEventLogW]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseEventLog]
lea rdx, str.Internet_Explorer
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenEventLogW]
test rax, rax
je 0x140006031
mov rsi, rax
mov rcx, rax
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_ClearEventLogW]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseEventLog]
lea rdx, str.Windows_PowerShell
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenEventLogW]
test rax, rax
je 0x140006062
mov rsi, rax
mov rcx, rax
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_ClearEventLogW]
mov rcx, rsi
add rsp, 0x20
pop rsi
jmp qword [sym.imp.ADVAPI32.dll_CloseEventLog]
nop
add rsp, 0x20
pop rsi
ret
Function at 0x140006240
Capabilities:
Delete file
Enumerate files on windows
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x698
lea rsi, [rsp + 0x490]
mov ecx, 0x104
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea r8, [0x1400444fc]
mov edx, 0x104
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea rdx, [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
je 0x1400062f0
mov rdi, rax
lea r12, [rsp + 0x5c]
lea rbx, [0x140044504]
lea r14, [rsp + 0x280]
mov r13, qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea r15, [rsp + 0x30]
mov rbp, qword [sym.imp.KERNEL32.dll_FindNextFileW]
nop dword [rax]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rsi
mov rcx, r14
mov r9, rbx
call fcn.140006590
mov rcx, r14
call r13
mov rcx, rdi
mov rdx, r15
call rbp
test eax, eax
jne 0x1400062c0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
add rsp, 0x698
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140006310
Capabilities:
Delete file
Enumerate files on windows
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x698
lea rsi, [rsp + 0x490]
mov qword [rsp + 0x20], rsi
xor ecx, ecx
mov edx, 8
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea r8, [0x14004450e]
mov edx, 0x104
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea rdx, [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
je 0x1400063d0
mov rdi, rax
lea r12, [rsp + 0x5c]
lea rbx, [0x140044504]
lea r14, [rsp + 0x280]
mov r13, qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea r15, [rsp + 0x30]
mov rbp, qword [sym.imp.KERNEL32.dll_FindNextFileW]
nop word cs:[rax + rax]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rsi
mov rcx, r14
mov r9, rbx
call fcn.140006590
mov rcx, r14
call r13
mov rcx, rdi
mov rdx, r15
call rbp
test eax, eax
jne 0x1400063a0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
add rsp, 0x698
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x1400065e0
Capabilities:
Set environment variable

Disassembly:
push rsi
sub rsp, 0x20
call fcn.140006240
call fcn.140005b20
lea rcx, str.VLOADER_PATH
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rcx, str.VLOADER_CONFIG
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rcx, str.VLOADER_TEMP
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov sil, 1
call fcn.140006680
mov eax, esi
add rsp, 0x20
pop rsi
ret
Function at 0x140006ca0
Capabilities:
Enumerate process modules

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
mov eax, 0x2040
call fcn.140022010
sub rsp, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x40]
lea r9, [rsp + 0x20]
mov rcx, rax
mov r8d, 0x2000
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x140006d43
cmp dword [rsp + 0x20], 8
jb 0x140006d43
xor ebx, ebx
mov r14, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rsi, [rsp + 0x28]
lea rdi, [rsp + 0x24]
mov r15, qword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x140006d0f
inc rbx
mov eax, dword [rsp + 0x20]
shr eax, 3
cmp rbx, rax
jae 0x140006d43
call r14
mov rdx, qword [rsp + rbx*8 + 0x40]
mov rcx, rax
mov r8, rsi
mov r9d, 0x18
call sub.KERNEL32.dll_K32GetModuleInformation
test eax, eax
je 0x140006d00
mov rcx, qword [rsp + 0x28]
mov edx, dword [rsp + 0x30]
mov r8d, 0x20
mov r9, rdi
call r15
jmp 0x140006d00
add rsp, 0x2040
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x140006e40
Capabilities:
Get system information on windows
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x870
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [rsp + 0x60], 2
setb bl
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMControlSet001ServicesDiskEnum
mov rcx, 0xffffffff80000002
xor r8d, r8d
mov r9d, 0x20019
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140006f11
mov dword [rsp + 0x34], 0x800
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea rdx, [0x140044950]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140006f06
lea rdx, [0x140044954]
lea rcx, [rsp + 0x70]
call sub.api_ms_win_crt_private_l1_1_0.dll_wcsstr
test rax, rax
jne 0x140006f04
lea rdx, str.VBOX
lea rcx, [rsp + 0x70]
call sub.api_ms_win_crt_private_l1_1_0.dll_wcsstr
test rax, rax
jne 0x140006f04
lea rdx, str.QEMU
lea rcx, [rsp + 0x70]
call sub.api_ms_win_crt_private_l1_1_0.dll_wcsstr
test rax, rax
je 0x140006f06
mov bl, 1
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x870
pop rbx
ret

Function at 0x140006f20
Capabilities:
Check for debugger via api
Check for process debug object

Disassembly:
sub rsp, 0x38
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov ecx, eax
mov al, 1
test ecx, ecx
jne 0x140006f97
mov dword [rsp + 0x2c], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x2c]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
mov al, 1
cmp dword [rsp + 0x2c], 0
jne 0x140006f97
mov qword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x30]
mov rcx, rax
mov edx, 0x1e
mov r9d, 8
call sub.ntdll.dll_NtQueryInformationProcess
test eax, eax
setns cl
cmp qword [rsp + 0x30], 0
setne al
and al, cl
add rsp, 0x38
ret
Function at 0x140006fa0
Capabilities:
Enumerate processes

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x4b0
lea rcx, str.C:_sandbox
lea rdx, [rsp + 0x260]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
je 0x140006fda
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
mov sil, 1
jmp 0x140006fdc
xor esi, esi
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp rax, 0xffffffffffffffff
je 0x14000706c
mov rdi, rax
mov dword [rsp + 0x28], 0x238
lea rdx, [rsp + 0x28]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x14000705f
lea rbx, [rsp + 0x54]
lea r14, str.sandbox
lea r15, str.sbie
lea r12, [rsp + 0x28]
mov bpl, 1
nop word cs:[rax + rax]
mov rcx, rbx
mov rdx, r14
call sub.api_ms_win_crt_private_l1_1_0.dll_wcsstr
test rax, rax
jne 0x140007061
mov rcx, rbx
mov rdx, r15
call sub.api_ms_win_crt_private_l1_1_0.dll_wcsstr
test rax, rax
jne 0x140007061
mov rcx, rdi
mov rdx, r12
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x140007030
mov ebp, esi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, ebp
mov eax, esi
add rsp, 0x4b0
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x140007080
Capabilities:
Enumerate processes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x260
xor edi, edi
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp rax, 0xffffffffffffffff
je 0x14000713d
mov rsi, rax
mov dword [rsp + 0x28], 0x238
lea rdx, [rsp + 0x28]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x140007132
lea rbx, [rsp + 0x54]
lea r14, str.procmon
lea r15, str.wireshark
lea r12, str.fiddler
lea r13, [rsp + 0x28]
nop word cs:[rax + rax]
mov rcx, rbx
mov rdx, r14
call sub.api_ms_win_crt_private_l1_1_0.dll_wcsstr
mov dil, 1
test rax, rax
jne 0x140007134
mov rcx, rbx
mov rdx, r15
call sub.api_ms_win_crt_private_l1_1_0.dll_wcsstr
test rax, rax
jne 0x140007134
mov rcx, rbx
mov rdx, r12
call sub.api_ms_win_crt_private_l1_1_0.dll_wcsstr
test rax, rax
jne 0x140007134
mov rcx, rsi
mov rdx, r13
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x1400070f0
xor edi, edi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
add rsp, 0x260
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140007160
Capabilities:
Acquire debug privileges

Disassembly:
sub rsp, 0x58
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x38]
mov rcx, rax
mov edx, 0x28
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400071de
lea rdx, str.SeDebugPrivilege
lea r8, [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x1400071d3
mov dword [rsp + 0x48], 1
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x4c], rax
mov dword [rsp + 0x54], 2
mov rcx, qword [rsp + 0x38]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
lea r8, [rsp + 0x48]
xor edx, edx
mov r9d, 0x10
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
add rsp, 0x58
ret
Function at 0x140007210
Capabilities:
Delete file
Enumerate files on windows
Get common file path
Set environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x6a0
lea rcx, str.USERNAME
mov rsi, qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
xor edx, edx
call rsi
lea rcx, str.COMPUTERNAME
xor edx, edx
call rsi
lea rcx, str.USERDOMAIN
xor edx, edx
call rsi
lea rcx, str.USERPROFILE
xor edx, edx
call rsi
lea rsi, [rsp + 0x490]
mov ecx, 0x104
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea r8, [0x140044a5a]
mov edx, 0x104
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea rdx, [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
je 0x1400072ee
mov rdi, rax
lea r15, [rsp + 0x5c]
lea rbx, [rsp + 0x280]
mov r12, qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea r14, [rsp + 0x30]
mov r13, qword [sym.imp.KERNEL32.dll_FindNextFileW]
nop word [rax + rax]
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rsi
mov rcx, rbx
call fcn.140007310
mov rcx, rbx
call r12
mov rcx, rdi
mov rdx, r14
call r13
test eax, eax
jne 0x1400072c0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
add rsp, 0x6a0
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x1400075a0
Capabilities:
Check for debugger via api

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x24], 0
lea rdx, [rsp + 0x24]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp dword [rsp + 0x24], 0
je 0x1400075ce
xor eax, eax
add rsp, 0x28
ret
mov rax, qword gs:[0x60]
test rax, rax
je 0x1400075c7
cmp byte [rax + 2], 0
jne 0x1400075c7
cmp qword [rax + 0x18], 0
je 0x1400075c7
cmp qword [rax + 0x20], 0
je 0x1400075c7
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x1400075c7
call fcn.140006f20
test al, al
jne 0x1400075c7
call fcn.140006e40
test al, al
jne 0x1400075c7
call fcn.140006fa0
test al, al
jne 0x1400075c7
call fcn.140007080
xor al, 1
jmp 0x1400075c9

Function at 0x140007620
Capabilities:
Check for debugger via api
Check for process debug object

Disassembly:
push rbx
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov bl, 1
test eax, eax
jne 0x1400076a0
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x1400076a0
mov dword [rsp + 0x34], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x34]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
mov bl, 1
cmp dword [rsp + 0x34], 0
jne 0x1400076a0
mov qword [rsp + 0x38], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x38]
mov rcx, rax
mov edx, 0x1e
mov r9d, 8
call sub.ntdll.dll_NtQueryInformationProcess
test eax, eax
setns al
cmp qword [rsp + 0x38], 0
setne bl
and bl, al
mov eax, ebx
add rsp, 0x40
pop rbx
ret
Function at 0x14000a350
Capabilities:
Enumerate processes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x258
lea rsi, [rsp + 0x4c]
xor r15d, r15d
lea r12, str.obs64.exe
lea rdi, [rsp + 0x20]
mov r13, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbp, qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
jmp 0x14000a39f
mov rcx, r14
call r13
inc r15
cmp r15, 0x28
je 0x14000a40c
mov rbx, qword [r12 + r15*8]
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp rax, 0xffffffffffffffff
je 0x14000a396
mov r14, rax
mov dword [rsp + 0x20], 0x238
mov rcx, rax
mov rdx, rdi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x14000a390
nop
mov rcx, rsi
mov rdx, rbx
call rbp
test eax, eax
je 0x14000a3ed
mov rcx, r14
mov rdx, rdi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x14000a3d0
jmp 0x14000a390
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
add rsp, 0x258
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.14000a4c0
jmp 0x14000a3f8
Function at 0x14001e4d0
Capabilities:
Write file on windows

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x58], r9
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
lea rcx, str.Mingw_w64_runtime_failure:_n
mov edx, 0x1b
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r8, qword [rsp + 0x28]
mov rcx, rax
mov rdx, rsi
call fcn.140023ef0
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
int3
Function at 0x140023c40
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rax, qword [0x140044008]
movzx edx, word [rax]
cmp edx, 0x5a4d
jne 0x140023cac
movsxd rdx, dword [rax + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x140023cac
add rax, rdx
movzx edx, word [rax + 0x18]
cmp edx, 0x20b
jne 0x140023cac
movzx edx, word [rax + 6]
test edx, edx
je 0x140023cac
sub rcx, qword [0x140044008]
movzx r8d, word [rax + 0x14]
add rax, r8
add rax, 0x18
jmp 0x140023c98
add rax, 0x28
dec edx
je 0x140023cac
mov r8d, dword [rax + 0xc]
cmp rcx, r8
jb 0x140023c90
add r8d, dword [rax + 8]
cmp rcx, r8
jae 0x140023c90
jmp 0x140023cae
xor eax, eax
ret

Function at 0x140023cb0
Capabilities:
Parse pe header

Disassembly:
mov rcx, qword [0x140044008]
movzx edx, word [rcx]
xor eax, eax
cmp edx, 0x5a4d
jne 0x140023ce5
movsxd rdx, dword [rcx + 0x3c]
cmp dword [rcx + rdx], 0x4550
jne 0x140023ce5
movzx r8d, word [rcx + rdx + 0x18]
cmp r8d, 0x20b
jne 0x140023ce5
movzx eax, word [rcx + rdx + 6]
ret

Function at 0x140023d60
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140044008]
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x140023d8c
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x140023d8c
movzx ecx, word [rax + rcx + 0x18]
cmp ecx, 0x20b
je 0x140023d8e
xor eax, eax
ret

Function at 0x140024380
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x58], r9
mov rdi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rdi
lea rcx, str.libcabi:
mov edx, 0xb
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov ecx, 2
call rdi
mov r8, qword [rsp + 0x20]
mov rcx, rax
mov rdx, rsi
call fcn.140023ef0
mov ecx, 2
call rdi
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
int3

Function at 0x140024d00
Capabilities:
Query environment variable

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r8
mov edi, edx
mov rbx, rcx
call fcn.1400250a0
test al, al
je 0x140024d53
mov r14, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call r14
mov qword [rsp + 0x20], rsi
lea rdx, str.libunwind:__Unwind_SetGR_context_p__reg_d__value0x_0llx__n
mov rcx, rax
mov r8, rbx
mov r9d, edi
call fcn.140023b00
mov ecx, 2
call r14
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fflush
mov rcx, rbx
mov edx, edi
mov r8, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.1400251b0
Function at 0x140024de0
Capabilities:
Query environment variable

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
call fcn.1400250a0
test al, al
je 0x140024e28
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rbx
lea rdx, str.libunwind:__Unwind_SetIP_context_p__value0x_0llx__n
mov rcx, rax
mov r8, rdi
mov r9, rsi
call fcn.140023b00
mov ecx, 2
call rbx
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fflush
mov rcx, rdi
mov edx, 0xffffffff
mov r8, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.1400251b0