joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001f20
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x140006010]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov r15, r9
mov ebx, r8d
mov rsi, rdx
mov edi, ecx
mov dword [rsp + 0x38], ebx
mov qword [rsp + 0x50], r9
and qword [rsp + 0x30], 0
xor edx, edx
lea r8d, [rdx + 0x30]
lea rcx, [rsp + 0x58]
call fcn.140004480
mov r14d, ebx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rsi
mov ecx, edi
lea rdx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov ebx, eax
test eax, eax
jns 0x140001fa4
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
jne 0x140001fa4
mov eax, 0xc0000001
jmp 0x140002036
lea rdx, [rsp + 0x58]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov r8d, 1
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
mov rax, qword [0x1400060b0]
and qword [rsp + 0x20], 0
mov r9d, 0x80
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x48]
or rcx, 0xffffffffffffffff
call qword [0x140005278]
mov r8, r14
mov rdx, rsi
mov rcx, r15
call fcn.140004140
lea rcx, [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
jmp 0x140002029
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, ebx
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140003f00
add rsp, 0x90
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret

Function at 0x140002058
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
push rbx
push rsi
push rdi
push r14
sub rsp, 0x98
mov rax, qword [0x140006010]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov esi, r9d
mov rdi, r8
mov ebx, ecx
mov qword [rsp + 0x48], rdx
mov r14, qword [rsp + 0xe0]
and qword [rsp + 0x30], 0
xor edx, edx
lea r8d, [rdx + 0x30]
lea rcx, [rsp + 0x50]
call fcn.140004480
mov qword [rsp + 0x40], rdi
mov ecx, ebx
lea rdx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x1400020d1
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
jne 0x1400020d1
mov eax, 0xc0000001
jmp 0x14000215a
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov r8d, 1
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
mov rax, qword [0x1400060b0]
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
mov r9d, esi
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x48]
or rcx, 0xffffffffffffffff
call qword [0x140005278]
mov ebx, eax
mov dword [rsp + 0x3c], eax
mov ecx, dword [rsp + 0x38]
mov dword [r14], ecx
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
jmp 0x14000214d
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, ebx
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140003f00
add rsp, 0x98
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x140002178
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x140006010]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r15, r9
mov r14d, r8d
mov rsi, rdx
mov ebx, ecx
and qword [rsp + 0x20], 0
xor edx, edx
lea r8d, [rdx + 0x30]
lea rcx, [rsp + 0x28]
call fcn.140004480
mov ecx, ebx
lea rdx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov edi, eax
test eax, eax
jns 0x1400021dd
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
jne 0x1400021dd
mov eax, 0xc0000001
jmp 0x140002237
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov r8d, 1
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ProbeForWrite]
mov r8, r14
mov rdx, r15
mov rcx, rsi
call fcn.140004140
lea rcx, [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
jmp 0x14000222a
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, edi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140003f00
add rsp, 0x60
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400022e4
Capabilities:
Print debug messages
Reference http user-agent string

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0xd8
mov rax, qword [0x140006010]
xor rax, rsp
mov qword [rbp - 0x11], rax
mov rax, qword [rbp + 0x8f]
mov r12d, ecx
mov rdi, qword [rbp + 0x87]
mov ebx, r9d
mov rsi, qword [rbp + 0x6f]
mov rcx, rdi
mov r15, qword [rbp + 0x77]
mov r13d, edx
mov r14, qword [rbp + 0x97]
mov dword [rsp + 0x20], r8d
mov qword [rsp + 0x28], rax
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x140002534
xor edx, edx
lea rcx, [rsp + 0x50]
lea r8d, [rdx + 0x64]
call fcn.140004480
mov rdx, r15
lea rcx, [0x1400047b0]
call fcn.1400027e8
lea rdx, [0x1400047c0]
mov rcx, rax
call fcn.1400027e8
lea rdx, [0x1400047d0]
mov rcx, rax
call fcn.1400027e8
mov rdx, rsi
mov rcx, rax
call fcn.1400027e8
lea rdx, [0x1400047e0]
mov rcx, rax
call fcn.1400027e8
lea rdx, [0x1400047f0]
mov rcx, rax
call fcn.1400027e8
lea rdx, [0x140004810]
mov rcx, rax
call fcn.1400027e8
or rsi, 0xffffffffffffffff
mov r15, rax
mov r8, rsi
inc r8
cmp byte [rdi + r8], 0
jne 0x1400023cb
lea rdx, [0x1400048a0]
lea rcx, [rsp + 0x50]
call sub.ntoskrnl.exe_sprintf
lea rdx, [rsp + 0x50]
mov rcx, r15
call fcn.1400027e8
mov rdx, qword [rsp + 0x28]
mov rcx, rax
call fcn.1400027e8
lea rdx, [0x1400048c0]
mov rcx, rax
call fcn.1400027e8
mov rdx, rdi
mov rcx, rax
call fcn.1400027e8
mov r15, rax
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rax
lea edx, [rax + 1]
mov qword [rsp + 0x38], rax
lea eax, [rdx + 1]
mov ecx, eax
lea r8d, [rdx + 5]
mov r9d, eax
call fcn.1400039f0
mov rdi, rax
test rax, rax
jne 0x140002466
lea r8, [0x140004900]
xor edx, edx
lea ecx, [rax + 0x4d]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
jmp 0x140002534
and dword [rsp + 0x44], 0
lea rdx, [rsp + 0x40]
mov eax, 2
mov rcx, rdi
mov word [rsp + 0x40], ax
call fcn.1400037c8
test eax, eax
jns 0x1400024a0
xor edx, edx
lea r8, [0x140004910]
mov r9d, eax
lea ecx, [rdx + 0x4d]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
jmp 0x14000252c
shl ebx, 8
lea rdx, [rsp + 0x30]
or ebx, dword [rsp + 0x20]
mov eax, 2
shl ebx, 8
mov rcx, rdi
mov word [rsp + 0x30], ax
or ebx, r13d
movzx eax, word [rbp + 0x7f]
rol ax, 8
shl ebx, 8
or ebx, r12d
mov word [rsp + 0x32], ax
mov dword [rsp + 0x34], ebx
call fcn.14000393c
test eax, eax
jns 0x1400024ef
mov edx, eax
lea rcx, [0x140004930]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x14000252c
inc rsi
cmp byte [r15 + rsi], 0
jne 0x1400024ef
mov r8, rsi
xor r9d, r9d
mov rdx, r15
mov rcx, rdi
call fcn.140003cdc
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x14000252c
mov r8d, dword [rbp + 0x9f]
xor r9d, r9d
mov rdx, r14
mov rcx, rdi
call fcn.140003bc4
mov rcx, rdi
call fcn.14000387c
mov rcx, qword [rbp - 0x11]
xor rcx, rsp
call fcn.140003f00
add rsp, 0xd8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140002870
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r13
push r14
sub rsp, 0x130
mov rax, qword [0x140006010]
xor rax, rsp
mov qword [rsp + 0x120], rax
or r13, 0xffffffffffffffff
mov rbp, rcx
mov rsi, r13
inc rsi
cmp byte [rsi + rcx], 0
jne 0x1400028a7
mov r8, r13
inc r8
cmp byte [rdx + r8], 0
jne 0x1400028b3
lea rcx, [rsp + 0x20]
call fcn.140002974
xor ebx, ebx
xor edi, edi
test esi, esi
je 0x140002945
mov r14, rbp
mov esi, esi
inc ebx
and ebx, 0x800000ff
jge 0x1400028e8
dec ebx
or ebx, 0xffffff00
inc ebx
movsxd r8, ebx
movzx edx, byte [rsp + r8 + 0x20]
add edi, edx
and edi, 0x800000ff
jge 0x140002905
dec edi
or edi, 0xffffff00
inc edi
movsxd rcx, edi
mov al, byte [rsp + rcx + 0x20]
mov byte [rsp + r8 + 0x20], al
mov byte [rsp + rcx + 0x20], dl
movzx eax, byte [rsp + r8 + 0x20]
add rdx, rax
movzx eax, dl
mov rdx, r13
mov cl, byte [rsp + rax + 0x20]
xor byte [r14], cl
inc rdx
cmp byte [rdx + rbp], 0
jne 0x14000292b
mov rcx, rbp
call fcn.140002678
inc r14
sub rsi, 1
jne 0x1400028d4
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.140003f00
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop rdi
ret
Function at 0x140002db8
Capabilities:
Map section object

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xb0
and qword [rbp + 0x67], 0
xor eax, eax
and qword [rbp - 0x11], rax
mov rdi, r9
and qword [rbp - 9], rax
lea r9, [rbp - 1]
and qword [rbp + 0x17], rax
mov rsi, r8
and qword [rbp - 0x19], 0
lea r8, [rbp + 0xf]
and dword [rbp + 0x13], 0
mov r14, rdx
and dword [rbp + 0x2b], 0
xorps xmm0, xmm0
mov qword [rbp + 0x1f], rcx
mov edx, 0x80000000
lea rcx, [rbp + 0x67]
mov dword [rsp + 0x28], 0x20
mov qword [rbp - 1], rax
mov qword [rbp + 7], rax
movdqu xmmword [rbp + 0x2f], xmm0
mov dword [rbp + 0xf], 0x30
mov dword [rbp + 0x27], 0x240
mov dword [rsp + 0x20], 1
call qword [sym.imp.ntoskrnl.exe_ZwOpenFile]
test eax, eax
js 0x140002ef9
mov rax, qword [rbp + 0x67]
lea rcx, [rbp - 0x19]
mov qword [rsp + 0x30], rax
xor r9d, r9d
mov dword [rsp + 0x28], 0x1000000
xor r8d, r8d
mov dword [rsp + 0x20], 4
lea edx, [r9 + 6]
call qword [sym.imp.ntoskrnl.exe_ZwCreateSection]
mov ebx, eax
test eax, eax
jns 0x140002e8b
mov rcx, qword [rbp + 0x67]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x140002ef7
mov rcx, qword [rbp - 0x19]
lea rax, [rbp - 9]
mov dword [rsp + 0x48], 4
lea r8, [rbp - 0x11]
mov dword [rsp + 0x40], 0x100000
xor r9d, r9d
mov dword [rsp + 0x38], 1
or rdx, 0xffffffffffffffff
mov qword [rsp + 0x30], rax
and qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0x400
call qword [sym.imp.ntoskrnl.exe_ZwMapViewOfSection]
mov ebx, eax
test eax, eax
jns 0x140002ee2
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x140002e7f
mov rax, qword [rbp + 0x67]
mov qword [r14], rax
mov rax, qword [rbp - 0x19]
mov qword [rsi], rax
mov rax, qword [rbp - 0x11]
mov qword [rdi], rax
mov eax, ebx
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1400030ec
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x20
and dword [rax + 0x18], 0
lea r9, [rax + 0x18]
mov rsi, rdx
mov rbp, rcx
xor edi, edi
xor r8d, r8d
xor edx, edx
lea ecx, [rdi + 0xb]
call sub.ntoskrnl.exe_ZwQuerySystemInformation
cmp eax, 0xc0000004
jne 0x140003161
mov edx, dword [rsp + 0x40]
lea r8d, [rdi + 0xa]
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
test rax, rax
je 0x140003161
mov r8d, dword [rsp + 0x40]
lea r9, [rsp + 0x40]
mov rdx, rax
lea ecx, [rdi + 0xb]
call sub.ntoskrnl.exe_ZwQuerySystemInformation
test eax, eax
je 0x140003178
lea edx, [rdi + 0xa]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
test rbp, rbp
jne 0x140003184
test rsi, rsi
jne 0x140003184
mov edi, dword [rbx]
mov r9d, dword [rbx]
xor edx, edx
test r9d, r9d
je 0x1400031ed
lea rcx, [rbx + 0x20]
test rbp, rbp
je 0x1400031af
test rsi, rsi
je 0x1400031af
mov r8, qword [rcx - 8]
cmp rbp, r8
jb 0x1400031af
mov eax, dword [rcx]
add rax, r8
cmp rbp, rax
jbe 0x1400031bf
inc edx
add rcx, 0x128
cmp edx, r9d
jae 0x1400031ed
jmp 0x140003192
mov eax, edx
mov rdx, rsi
imul rcx, rax, 0x128
movzx eax, word [rcx + rbx + 0x2e]
add rax, rcx
lea rcx, [rbx + 0x30]
add rcx, rax
mov al, byte [rcx]
inc rcx
mov byte [rdx], al
inc rdx
test al, al
jne 0x1400031da
mov edi, 1
mov edx, 0xa
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
test edi, edi
jne 0x140003216
test rsi, rsi
je 0x140003216
test rbp, rbp
je 0x140003216
movabs rax, 0x6e776f6e6b6e55
mov qword [rsi], rax
mov eax, edi
jmp 0x140003163

Function at 0x140003220
Capabilities:
Find process by pid

Disassembly:
push rbx
sub rsp, 0x20
xor ebx, ebx
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x38], rbx
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
cmovns rbx, qword [rsp + 0x38]
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x140003278
Capabilities:
Attach user process memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [0x140006010]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor r14d, r14d
mov rsi, r8
mov ebx, r14d
mov rdi, rdx
call fcn.140003220
mov rbp, rax
test rax, rax
je 0x1400033c4
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_PsGetProcessWow64Process]
mov rcx, rbp
test rax, rax
je 0x140003334
call qword [sym.imp.ntoskrnl.exe_PsGetProcessWow64Process]
test rax, rax
je 0x1400033c4
mov r8d, dword [rax + 0xc]
add r8, 0xc
mov ecx, dword [r8]
cmp rcx, r8
je 0x140003393
test rdi, rdi
je 0x140003315
test rsi, rsi
je 0x140003315
mov edx, dword [rcx + 0x18]
cmp rdi, rdx
jb 0x140003315
mov eax, dword [rcx + 0x20]
add rax, rdx
cmp rdi, rax
jbe 0x140003319
mov ecx, dword [rcx]
jmp 0x1400032ef
mov edx, dword [rcx + 0x30]
mov rcx, rsi
movzx eax, word [rdx]
lea rdx, [rdx + 2]
mov word [rcx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x14000331f
jmp 0x14000338e
call qword [sym.imp.ntoskrnl.exe_PsGetProcessPeb]
test rax, rax
je 0x1400033c4
mov r8, qword [rax + 0x18]
add r8, 0x10
mov rdx, qword [r8]
cmp rdx, r8
je 0x140003393
test rdi, rdi
je 0x14000336f
test rsi, rsi
je 0x14000336f
mov rcx, qword [rdx + 0x30]
cmp rdi, rcx
jb 0x14000336f
add rcx, qword [rdx + 0x40]
cmp rdi, rcx
jbe 0x140003374
mov rdx, qword [rdx]
jmp 0x14000334e
mov rcx, qword [rdx + 0x60]
mov rdx, rsi
movzx eax, word [rcx]
lea rcx, [rcx + 2]
mov word [rdx], ax
lea rdx, [rdx + 2]
test ax, ax
jne 0x14000337b
mov ebx, 1
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
test ebx, ebx
jne 0x1400033c0
test rsi, rsi
je 0x1400033c0
test rdi, rdi
je 0x1400033c0
movups xmm0, xmmword [0x1400049c0]
movdqu xmmword [rsi], xmm0
mov eax, ebx
jmp 0x1400033c6
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140003f00
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140003470
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x288]
sub rsp, 0x360
mov rax, qword [0x140006010]
xor rax, rsp
mov qword [rbp + 0x250], rax
xor edi, edi
lea r9, [rsp + 0x20]
mov r12, rcx
mov dword [rsp + 0x20], edi
xor r8d, r8d
xor edx, edx
mov r13d, edi
lea ebx, [rdi + 5]
mov ecx, ebx
call sub.ntoskrnl.exe_ZwQuerySystemInformation
cmp eax, 0xc0000004
jne 0x140003611
cmp dword [rsp + 0x20], edi
je 0x140003611
mov edx, dword [rsp + 0x20]
lea r8d, [rdi + 0xc]
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov r14, rax
test rax, rax
je 0x140003611
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rax
mov ecx, ebx
call sub.ntoskrnl.exe_ZwQuerySystemInformation
test eax, eax
jne 0x1400035ff
mov rsi, r14
cmp qword [r14 + 0x50], r12
je 0x140003530
mov eax, dword [rsi]
test eax, eax
je 0x1400035fc
add rsi, rax
cmp qword [rsi + 0x50], r12
jne 0x14000351d
mov r13d, dword [rsi + 4]
mov r15d, edi
test r13d, r13d
je 0x1400035fc
mov eax, r15d
lea rcx, [rax + rax*4]
add rcx, rcx
mov rbx, qword [rsi + rcx*8 + 0x130]
mov rcx, rbx
call fcn.1400033e8
cmp r12, 4
je 0x14000359c
lea r8, [rbp + 0x40]
mov rdx, rax
mov rcx, r12
call fcn.140003278
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x40]
call fcn.140003778
lea rdx, [0x1400049d0]
lea rcx, [rsp + 0x30]
call sub.ntoskrnl.exe_strcmp
test eax, eax
jne 0x1400035ef
mov rcx, rbx
call fcn.140003644
jmp 0x1400035ef
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.1400030ec
lea rdx, [0x1400049e0]
lea rcx, [rsp + 0x30]
call sub.ntoskrnl.exe_strcmp
test eax, eax
je 0x1400035d3
lea rdx, [0x1400049f0]
lea rcx, [rsp + 0x30]
call sub.ntoskrnl.exe_strcmp
test eax, eax
jne 0x1400035ef
mov rcx, rbx
call fcn.14000324c
mov rcx, rax
mov rbx, rax
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, rbx
call fcn.1400036bc
inc r15d
cmp r15d, dword [rsi + 4]
jb 0x140003540
mov edi, r13d
mov edx, 0xc
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, edi
jmp 0x140003613
xor eax, eax
mov rcx, qword [rbp + 0x250]
xor rcx, rsp
call fcn.140003f00
lea r11, [rsp + 0x360]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x140001f00
Capabilities:
Set console window title

Disassembly:
sub rsp, 0x48
lea rcx, str.flexflexflex
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor ecx, ecx
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], ecx
xor r9d, r9d
mov dword [rsp + 0x20], ecx
xor r8d, r8d
mov rcx, rax
mov rdx, 0xffffffffffffffff
call qword [sym.imp.USER32.dll_SetWindowPos]
call fcn.14000a260
lea rcx, str._debug_:_press_enter_to_close_console__this_might_show_up_if_theres_an_issue_
call fcn.140001ea0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_void____ptr64]
xor eax, eax
add rsp, 0x48
ret
Function at 0x1400075f0
Capabilities:
Persist via windows service
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x140107080]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, rdx
mov rbx, rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
mov r8d, Ordinal_35
lea rdx, str.SystemCurrentControlSetServices_
lea rcx, [rsp + 0x40]
call fcn.1400029f0
nop
mov r8, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 0xf
jbe 0x140007646
mov rdi, qword [rdi]
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.140003b90
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0xf
cmova rdx, qword [rsp + 0x40]
lea r8, [rsp + 0x30]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x14000776b
mov byte [rsp + 0x38], 1
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Type
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x14000776b
mov byte [rsp + 0x39], 3
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x39]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.ErrorControl
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x14000776b
mov byte [rsp + 0x3a], 3
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x3a]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Start
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x14000776b
mov eax, dword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x140007731
mov rbx, qword [rbx]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, str.ImagePath
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x14000776b
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
sete bl
jmp 0x14000776d
xor bl, bl
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x1400077ad
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400077a8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400077a8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400cecc4
movzx eax, bl
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400cec60
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
ret
Function at 0x140009c10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov rax, qword [0x140107080]
xor rax, rsp
mov qword [rbp + 0x37], rax
movdqa xmm0, xmmword [0x1400f1c90]
movdqu xmmword [rbp - 0x29], xmm0
mov dword [rbp - 0x19], 0x64323566
mov dword [rbp - 0x15], 0x63323437
mov word [rbp - 0x11], Ordinal_50
xorps xmm0, xmm0
movups xmmword [rbp - 9], xmm0
mov qword [rbp + 7], 0
mov qword [rbp + 0xf], 0
lea rax, [rbp - 0x28]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140009c81
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 9]
call fcn.1400029f0
nop
lea rcx, [rbp + 0x17]
call fcn.140009900
lea rdx, [rbp - 9]
mov rbx, qword [rbp - 9]
mov r15, qword [rbp + 0xf]
cmp r15, 0xf
cmova rdx, rbx
lea rcx, [rbp + 0x17]
mov rdi, qword [rbp + 0x17]
mov r14, qword [rbp + 0x2f]
cmp r14, 0xf
cmova rcx, rdi
mov r8, qword [rbp + 0x27]
cmp r8, qword [rbp + 7]
jne 0x140009ce2
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140009ce2
mov sil, 1
jmp 0x140009ce5
xor sil, sil
cmp r14, 0xf
jbe 0x140009d1f
lea rdx, [r14 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140009d17
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009d17
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.1400cecc4
mov qword [rbp + 0x27], 0
mov qword [rbp + 0x2f], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x17], 0
cmp r15, 0xf
jbe 0x140009d6d
lea rdx, [r15 + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140009d65
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009d65
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.1400cecc4
movzx eax, sil
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1400cec60
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret