joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000169d
Capabilities:
Execute command

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov dword [rbp + 0x10], ecx
mov qword [rbp + 0x18], rdx
call dbg.__main
call sym.ensure_console
mov ecx, 1
mov rax, qword [dbg.__acrt_iob_func]
call rax
lea r8, str.windows
lea rdx, str.Determined_platform_is__s_n
mov rcx, rax
call sym.fprintf
lea rcx, str.dotnet___version__nul_2_1
call sym.system
test eax, eax
je 0x140001711
mov ecx, 2
mov rax, qword [dbg.__acrt_iob_func]
call rax
lea rdx, str.Error:_dotnet_runtime_not_found._n
mov rcx, rax
call sym.fprintf
mov eax, 1
jmp 0x14000189a
lea rax, str.OpenSim.dll
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov rcx, rax
call sym.strlen
add rax, 8
mov qword [rbp - 0x10], rax
mov dword [rbp - 4], 1
jmp 0x14000176b
mov eax, dword [rbp - 4]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x18]
add rax, rdx
mov rax, qword [rax]
mov rcx, rax
call sym.strlen
mov rdx, qword [rbp - 0x10]
add rax, rdx
add rax, 1
mov qword [rbp - 0x10], rax
add dword [rbp - 4], 1
mov eax, dword [rbp - 4]
cmp eax, dword [rbp + 0x10]
jl 0x140001739
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.malloc
mov qword [rbp - 0x28], rax
cmp qword [rbp - 0x28], 0
jne 0x1400017b1
mov ecx, 2
mov rax, qword [dbg.__acrt_iob_func]
call rax
lea rdx, str.Error:_Memory_allocation_failed._n
mov rcx, rax
call sym.fprintf
mov eax, 1
jmp 0x14000189a
mov rcx, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x10]
mov rax, qword [rbp - 0x28]
mov r9, rcx
lea r8, str.dotnet__s
mov rcx, rax
call sym.snprintf
mov dword [rbp - 0x14], 1
jmp 0x14000181a
mov rax, qword [rbp - 0x28]
mov rcx, rax
call sym.strlen
mov rdx, rax
mov rax, qword [rbp - 0x28]
add rax, rdx
mov word [rax], 0x20
mov eax, dword [rbp - 0x14]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x18]
add rax, rdx
mov rdx, qword [rax]
mov rax, qword [rbp - 0x28]
mov rcx, rax
call sym.strcat
add dword [rbp - 0x14], 1
mov eax, dword [rbp - 0x14]
cmp eax, dword [rbp + 0x10]
jl 0x1400017d8
mov rax, qword [rbp - 0x28]
mov rcx, rax
call sym.system
mov dword [rbp - 0x2c], eax
mov rax, qword [rbp - 0x28]
mov rcx, rax
call sub.msvcrt.dll_free
cmp dword [rbp - 0x2c], 0
je 0x140001867
mov ecx, 2
mov rax, qword [dbg.__acrt_iob_func]
call rax
mov rdx, qword [rbp - 0x20]
mov r8, rdx
lea rdx, str.Error:_Failed_to_run_dotnet_with__s_n
mov rcx, rax
call sym.fprintf
mov rax, qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
call rax
test rax, rax
je 0x140001897
mov ecx, 1
mov rax, qword [dbg.__acrt_iob_func]
call rax
lea rdx, str.Press_Enter_to_exit..._n
mov rcx, rax
call sym.fprintf
call sym.getchar
mov eax, dword [rbp - 0x2c]
add rsp, 0x50
pop rbp
ret

Function at 0x140001b70
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call dbg.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call dbg.__acrt_iob_func
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sym.vfprintf
call sym.abort
nop
nop word [rax + rax]
Function at 0x140002300
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x14000c100]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14000c0e0]
test rbx, rbx
je 0x140002354
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x14000234b
test r12, r12
je 0x14000234b
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140002330
lea rcx, [0x14000c100]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x140002580
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
jne 0x140002590
jmp sym._ValidateImageBase.part.0
xor eax, eax
ret

Function at 0x1400025a0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x1400025e5
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
nop dword [rax]
mov r8d, dword [rax + 0xc]
mov rcx, r8
cmp r8, rdx
ja 0x1400025dc
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x1400025e7
add rax, 0x28
cmp rax, r9
jne 0x1400025c8
xor eax, eax
ret

Function at 0x140002690
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r10, qword [0x1400097c0]
xor r8d, r8d
cmp word [r10], 0x5a4d
mov r9, rcx
jne 0x140002709
mov rcx, r10
call sym._ValidateImageBase.part.0
test eax, eax
je 0x140002709
movsxd rax, dword [r10 + 0x3c]
mov rcx, r9
sub rcx, r10
add r10, rax
movzx eax, word [r10 + 0x14]
lea r8, [r10 + rax + 0x18]
movzx eax, word [r10 + 6]
test eax, eax
je 0x140002706
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [r8 + rax*8 + 0x28]
nop dword [rax]
mov edx, dword [r8 + 0xc]
mov rax, rdx
cmp rcx, rdx
jb 0x1400026fd
add eax, dword [r8 + 8]
cmp rcx, rax
jb 0x140002709
add r8, 0x28
cmp r8, r9
jne 0x1400026e8
xor r8d, r8d
mov rax, r8
add rsp, 0x28
ret

Function at 0x1400027f0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x1400097c0]
xor eax, eax
cmp word [r9], 0x5a4d
mov r8, rcx
jne 0x14000285f
mov rcx, r9
call sym._ValidateImageBase.part.0
test eax, eax
je 0x14000285f
movsxd rax, dword [r9 + 0x3c]
mov rcx, r8
sub rcx, r9
add r9, rax
movzx eax, word [r9 + 0x14]
movzx edx, word [r9 + 6]
lea rax, [r9 + rax + 0x18]
test edx, edx
je 0x14000285d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140002854
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140002868
add rax, 0x28
cmp rax, r9
jne 0x140002840
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret
Function at 0x140002880
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x1400097c0]
xor r9d, r9d
cmp word [r11], 0x5a4d
mov r8d, ecx
jne 0x1400028f8
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x1400028f8
movsxd rcx, dword [r11 + 0x3c]
add rcx, r11
mov eax, dword [rcx + 0x90]
test eax, eax
je 0x1400028f8
movzx edx, word [rcx + 0x14]
lea rdx, [rcx + rdx + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x1400028f8
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r10, [rdx + rcx*8 + 0x28]
nop dword [rax + rax]
mov r9d, dword [rdx + 0xc]
mov rcx, r9
cmp rax, r9
jb 0x1400028ec
add ecx, dword [rdx + 8]
cmp rax, rcx
jb 0x140002900
add rdx, 0x28
cmp rdx, r10
jne 0x1400028d8
xor r9d, r9d
mov rax, r9
add rsp, 0x28
ret
add rax, r11
jmp 0x140002910
sub r8d, 1
add rax, 0x14
mov ecx, dword [rax + 4]
test ecx, ecx
jne 0x14000291e
mov edx, dword [rax + 0xc]
test edx, edx
je 0x1400028f5
test r8d, r8d
jg 0x140002908
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
add rsp, 0x28
ret
Function at 0x140001160
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
mov rsi, qword [0x140044048]
xor eax, eax
lock cmpxchg qword [rsi], rdi
sete bl
je 0x1400011b9
cmp rdi, rax
je 0x1400011b9
mov r14, qword [sym.imp.KERNEL32.dll_Sleep]
nop word [rax + rax]
mov ecx, 0x3e8
call r14
xor eax, eax
lock cmpxchg qword [rsi], rdi
sete bl
je 0x1400011b9
cmp rdi, rax
jne 0x1400011a0
mov rdi, qword [0x140044050]
mov eax, dword [rdi]
cmp eax, 1
jne 0x1400011d3
mov ecx, 0x1f
call fcn.140023550
jmp 0x1400011fa
cmp dword [rdi], 0
je 0x1400011e1
mov byte [0x1402c3960], 1
jmp 0x1400011fa
mov dword [rdi], 1
mov rcx, qword [str.0T_]
mov rdx, qword [0x140044070]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
mov eax, dword [rdi]
cmp eax, 1
jne 0x14000121a
mov rcx, qword [0x140044058]
mov rdx, qword [0x140044060]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
mov dword [rdi], 2
test bl, bl
je 0x140001223
xor eax, eax
xchg qword [rsi], rax
mov rax, qword [0x140044010]
mov rax, qword [rax]
test rax, rax
je 0x140001242
xor ecx, ecx
mov edx, 2
xor r8d, r8d
call qword [0x1402c7008]
call fcn.14001e010
lea rcx, [0x14001e5a0]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [str.0:__]
mov qword [rcx], rax
lea rcx, [0x140001390]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__set_invalid_parameter_handler
call fcn.14001e000
movsxd rdi, dword [0x1402c394c]
lea rcx, [rdi*8 + 8]
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov rsi, rax
test rdi, rdi
jle 0x1400012d2
mov ebx, edi
mov r14, qword [0x1402c3950]
xor r15d, r15d
nop word [rax + rax]
mov rcx, qword [r14 + r15*8]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
lea rdi, [rax + 1]
mov rcx, rdi
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov qword [rsi + r15*8], rax
mov rdx, qword [r14 + r15*8]
mov rcx, rax
mov r8, rdi
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
inc r15
cmp rbx, r15
jne 0x1400012a0
jmp 0x1400012d4
xor ebx, ebx
mov qword [rsi + rbx*8], 0
mov qword [0x1402c3950], rsi
call fcn.14001de50
mov rax, qword [0x1402c3958]
mov rcx, qword [str.8:__]
mov rcx, qword [rcx]
mov qword [rcx], rax
mov ecx, dword [0x1402c394c]
mov rdx, qword [0x1402c3950]
mov r8, qword [0x1402c3958]
call fcn.14001dca0
mov dword [0x1402c3964], eax
cmp dword [0x1402c3944], 0
je 0x140001344
cmp byte [0x1402c3960], 0
jne 0x140001338
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
mov eax, dword [0x1402c3964]
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov ecx, eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
int3
Function at 0x140004cf0
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rbx, rdx
mov rsi, rcx
mov dword [rsp + 0x20], 0xf0000000
xor edi, edi
lea rcx, [rsp + 0x30]
xor edx, edx
xor r8d, r8d
mov r9d, 0x18
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x140004e3f
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov edx, 0x800c
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x140004e30
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rbx + 8]
test rdx, rdx
jne 0x140004d62
mov rdx, qword [sym.imp.Qt6Core.dll_QByteArray::_empty]
mov r8d, dword [rbx + 0x10]
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x140004e25
mov rcx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x38]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov edx, 0x6610
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x140004e25
mov rdx, qword [rsi + 0x10]
mov dword [rsp + 0x44], edx
mov rdi, qword [rsp + 0x48]
mov rax, qword [rsi]
test rax, rax
je 0x140004dbd
mov eax, dword [rax]
cmp eax, 2
jl 0x140004dcc
mov rcx, rsi
mov r8d, 1
call qword [method.QByteArray.reallocData_long_long__QArrayData::AllocationOption_]
mov rax, qword [rsi + 8]
lea rcx, [rsp + 0x44]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
mov rcx, rdi
xor edx, edx
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
setne dil
je 0x140004e08
mov edx, dword [rsp + 0x44]
mov rcx, rsi
call qword [method.QByteArray.resize_long_long_]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x30]
jmp 0x140004e37
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x30]
xor edi, edi
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, edi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
Function at 0x140004e50
Capabilities:
Allocate or change rwx memory
Enumerate pe sections

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
call fcn.1400055a0
test rax, rax
je 0x140004eca
mov rsi, rax
lea rcx, [0x1400442d0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdi, rax
movsxd rax, dword [rsi + 0x3c]
movzx r15d, word [rax + rsi + 6]
test r15, r15
je 0x140004f1b
lea rcx, [rsi + rax]
movzx eax, word [rsi + rax + 0x14]
lea rbx, [rax + rcx]
add rbx, 0x18
lea r14, str..text
nop word cs:[rax + rax]
mov rcx, rbx
mov rdx, r14
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x140004ece
add rbx, 0x28
dec r15
jne 0x140004eb0
jmp 0x140004f1b
xor edi, edi
jmp 0x140004f32
mov edx, dword [rbx + 8]
mov ecx, dword [rbx + 0xc]
add rcx, rdi
lea r9, [rsp + 0x2c]
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x140004f40
mov r8d, dword [rbx + 8]
mov eax, dword [rbx + 0xc]
lea rcx, [rax + rdi]
mov rdx, rsi
add rdx, rax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [rbx + 8]
mov ecx, dword [rbx + 0xc]
add rcx, rdi
mov r8d, dword [rsp + 0x2c]
lea r9, [rsp + 0x2c]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov dil, 1
mov eax, edi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edi, edi
mov rcx, rax
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x140004f32
Function at 0x140004f60
Capabilities:
Accept command line arguments

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
movaps xmmword [rsp + 0x40], xmm6
lea r8, str.vLoader.exe
mov qword [0x1402c3970], r8
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rsi, qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, 0xfde9
xor edx, edx
mov r9d, 0xffffffff
call rsi
movsxd rdi, eax
lea rax, [rdi + rdi]
test edi, edi
mov rcx, 0xffffffffffffffff
cmovns rcx, rax
call fcn.1400206d0
mov qword [0x1402c3978], rax
mov r8, qword [0x1402c3970]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
xor edx, edx
mov r9d, 0xffffffff
call rsi
mov rcx, qword [0x1402c3978]
lea rdx, [0x1402c3990]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [0x1402c3988], rax
movsxd rdx, dword [0x1402c3990]
shl rdx, 3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [0x1402c3980], rax
cmp dword [0x1402c3990], 0
jle 0x1400050cc
xor edi, edi
xorps xmm6, xmm6
mov rbx, qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov r14, qword [sym.imp.KERNEL32.dll_LocalAlloc]
nop word [rax + rax]
mov rax, qword [0x1402c3988]
mov r8, qword [rax + rdi*8]
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov ecx, 0xfde9
xor edx, edx
mov r9d, 0xffffffff
call rbx
movsxd rsi, eax
xor ecx, ecx
mov rdx, rsi
call r14
mov rcx, qword [0x1402c3980]
mov qword [rcx + rdi*8], rax
mov rax, qword [0x1402c3988]
mov r8, qword [rax + rdi*8]
mov rax, qword [0x1402c3980]
mov rax, qword [rax + rdi*8]
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
xor edx, edx
mov r9d, 0xffffffff
call rbx
inc rdi
movsxd rax, dword [0x1402c3990]
cmp rdi, rax
jl 0x140005040
mov byte [0x1402c3968], 1
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140005260
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
test rcx, rcx
je 0x1400052da
mov rdi, rcx
movzx eax, word [rcx]
cmp eax, 0x5a4d
jne 0x1400052da
movsxd rax, dword [rdi + 0x3c]
cmp rax, 0x400
jg 0x1400052da
cmp dword [rdi + rax], 0x4550
jne 0x1400052da
mov ecx, dword [rdi + rax + 0x90]
test rcx, rcx
je 0x1400052da
mov edx, dword [rdi + rax + 0x94]
mov al, 1
mov qword [rsp + 0x28], rdx
test rdx, rdx
je 0x1400052dc
add rcx, rdi
xor edx, edx
movabs r14, 0x8000000080000000
mov r12, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x20], rcx
jmp 0x140005309
xor eax, eax
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rdx, qword [rsp + 0x30]
add rdx, 0x14
cmp rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
jae 0x14000549b
mov r15d, dword [rcx + rdx]
mov ebx, dword [rcx + rdx + 0x10]
mov eax, ebx
or eax, r15d
je 0x14000549b
mov qword [rsp + 0x30], rdx
mov ebp, dword [rdx + rcx + 0xc]
add rbp, rdi
test r15, r15
cmove r15, rbx
add rbx, rdi
add r15, rdi
jmp 0x140005350
mov rcx, rbp
call r12
mov rcx, rax
mov rdx, r13
call rsi
mov qword [rbx], rax
add rbx, 8
add r15, 8
test qword [r15], r14
je 0x140005370
mov rcx, rbp
call r12
movzx edx, word [r15]
mov rcx, rax
call rsi
mov qword [rbx], rax
test rax, rax
jne 0x14000537c
jmp 0x1400052f0
mov rax, qword [rbx]
test rax, rax
je 0x1400052f0
cmp rax, qword [r15]
jne 0x140005348
lea r13, [rax + rdi]
add r13, 2
cmp byte [0x1402c3968], 0
je 0x140005337
mov rcx, r13
lea rdx, str.GetCommandLineA
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
mov ecx, eax
lea rax, [0x140005500]
test ecx, ecx
je 0x140005345
mov rcx, r13
lea rdx, [0x1400442ff]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
mov ecx, eax
lea rax, [0x140005510]
test ecx, ecx
je 0x140005345
mov rcx, r13
lea rdx, str.__wgetmainargs
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
mov ecx, eax
lea rax, [0x140005520]
test ecx, ecx
je 0x140005345
mov rcx, r13
lea rdx, str.__getmainargs
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
mov ecx, eax
lea rax, [0x140005540]
test ecx, ecx
je 0x140005345
mov rcx, r13
lea rdx, [0x14004432c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
mov ecx, eax
lea rax, [0x140005560]
test ecx, ecx
je 0x140005345
mov rcx, r13
lea rdx, [0x140044337]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
mov ecx, eax
lea rax, [0x140005570]
test ecx, ecx
je 0x140005345
mov rcx, r13
lea rdx, [0x140044343]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
mov ecx, eax
lea rax, [0x140005580]
test ecx, ecx
je 0x140005345
mov rcx, r13
lea rdx, [0x14004434e]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
mov ecx, eax
lea rax, [0x140005590]
test ecx, ecx
jne 0x140005337
jmp 0x140005345
mov al, 1
jmp 0x1400052dc
Function at 0x1400055a0
Capabilities:
Create process on windows
Create process suspended
Terminate process

Disassembly:
push rsi
sub rsp, 0x100
xorps xmm0, xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0xb0], xmm0
movaps xmmword [rsp + 0xc0], xmm0
movaps xmmword [rsp + 0xd0], xmm0
movaps xmmword [rsp + 0xe0], xmm0
mov qword [rsp + 0xf0], 0
movaps xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], 0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x40], rax
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 1
lea rcx, str.C:WindowsSystem32_notepad.exe
xor esi, esi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x1400056d1
lea rcx, [0x1400442d0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x70]
mov rcx, rax
mov rdx, rsi
mov r9d, 0x18
call sub.KERNEL32.dll_K32GetModuleInformation
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, dword [rsp + 0x78]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x70]
mov r9d, dword [rsp + 0x78]
lea rax, [rsp + 0x88]
mov qword [rsp + 0x20], rax
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x1400056c4
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor esi, esi
mov rcx, qword [rsp + 0x50]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rax, rsi
add rsp, 0x100
pop rsi
ret
Function at 0x140005790
Capabilities:
Capture network configuration via ipconfig
Execute command

Disassembly:
sub rsp, 0x28
call fcn.1400057f0
call fcn.140005970
lea rcx, str.ipconfig__flushdns
call sub.api_ms_win_crt_runtime_l1_1_0.dll_system
lea rcx, str.arp__d_
call sub.api_ms_win_crt_runtime_l1_1_0.dll_system
lea rcx, str.netsh_interface_ip_delete_arpcache
call sub.api_ms_win_crt_runtime_l1_1_0.dll_system
lea rcx, str.netsh_interface_ip_delete_destinationcache
call sub.api_ms_win_crt_runtime_l1_1_0.dll_system
call fcn.140005a60
call fcn.140005b20
nop
add rsp, 0x28
jmp 0x140005bf0
push rsi
push rdi
sub rsp, 0x28
mov rdi, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rdi
mov rsi, rax
mov rcx, rax
mov rdx, 0xffffffffffffffff
mov r8, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
mov rcx, rsi
call sub.KERNEL32.dll_K32EmptyWorkingSet
call rdi
mov rcx, rax
call sub.KERNEL32.dll_K32EmptyWorkingSet
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapCompact]
lea rcx, [0x140044390]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140005c84
lea rdx, str.NtSetSystemInformation
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1402c39a0], rax
test rax, rax
je 0x140005c84
mov dword [rsp + 0x20], 4
lea rdx, [rsp + 0x20]
mov ecx, 0x50
mov r8d, 4
call rax
lea rcx, [0x140044390]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140005ccc
lea rdx, str.NtSetSystemInformation
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1402c39a0], rax
test rax, rax
je 0x140005ccc
mov dword [rsp + 0x24], 5
lea rdx, [rsp + 0x24]
mov ecx, 0x50
mov r8d, 4
call rax
nop
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x1400057f0
Capabilities:
Enumerate process modules

Disassembly:
push rsi
push rdi
mov eax, 0x2038
call fcn.140022010
sub rsp, rax
mov rdi, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rdi
mov rsi, rax
mov rcx, rax
mov rdx, 0xffffffffffffffff
mov r8, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
mov rcx, rsi
call sub.KERNEL32.dll_K32EmptyWorkingSet
call rdi
mov rcx, rax
call sub.KERNEL32.dll_K32EmptyWorkingSet
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapCompact]
lea rcx, [0x140044390]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000588d
lea rdx, str.NtSetSystemInformation
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1402c39a0], rax
test rax, rax
je 0x14000588d
mov dword [rsp + 0x30], 4
lea rdx, [rsp + 0x30]
mov ecx, 0x50
mov r8d, 4
call rax
lea rcx, [0x140044390]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400058d5
lea rdx, str.NtSetSystemInformation
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1402c39a0], rax
test rax, rax
je 0x1400058d5
mov dword [rsp + 0x30], 5
lea rdx, [rsp + 0x30]
mov ecx, 0x50
mov r8d, 4
call rax
mov rax, qword gs:[0x60]
test rax, rax
je 0x1400058f5
mov rdi, qword [rax + 0x20]
test rdi, rdi
je 0x1400058f5
mov ecx, 0x80
xor eax, eax
rep stosb byte [rdi], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x30]
lea r9, [rsp + 0x2c]
mov rcx, rax
mov r8d, 0x2000
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x140005946
cmp dword [rsp + 0x2c], 8
jb 0x140005946
xor esi, esi
mov rdi, qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop word [rax + rax]
mov rcx, qword [rsp + rsi*8 + 0x30]
call rdi
inc rsi
mov eax, dword [rsp + 0x2c]
shr eax, 3
cmp rsi, rax
jb 0x140005930
mov rax, qword gs:[0x60]
test rax, rax
je 0x140005966
mov rdi, qword [rax + 0x18]
test rdi, rdi
je 0x140005966
mov ecx, 0x30
xor eax, eax
rep stosb byte [rdi], al
add rsp, 0x2038
pop rdi
pop rsi
ret