joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003008
Capabilities:
Switch active desktop

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov dword [rbp - 4], 1
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x182
mov r9d, 0
mov r8d, 0
mov edx, 0
lea rax, str.m_pcszNewDesktopName
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_CreateDesktopA]
call rax
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
jne 0x14000305e
mov eax, 0
jmp 0x14000307c
mov rax, qword [rbp - 0x10]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_SwitchDesktop]
call rax
test eax, eax
je 0x140003079
mov dword [rbp - 4], 0
mov eax, dword [rbp - 4]
add rsp, 0x40
pop rbp
ret

Function at 0x14000310f
Capabilities:
Get disk information

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rax, qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
call rax
mov dword [rbp - 8], eax
mov dword [rbp - 4], 0
jmp 0x140003188
mov eax, dword [rbp - 4]
mov edx, 1
mov ecx, eax
shl edx, cl
mov eax, edx
and eax, dword [rbp - 8]
test eax, eax
je 0x140003184
mov eax, dword [rbp - 4]
add eax, 0x41
movsx rax, al
lea rdx, [0x1400335a8]
add rax, rdx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetDriveTypeA]
call rax
cmp eax, 2
jne 0x140003184
mov eax, dword [rbp - 4]
add eax, 0x41
mov edx, eax
lea rax, str.USB_drive_detected:__c:_n
mov rcx, rax
call sym.printf_1
mov eax, 1
jmp 0x140003193
add dword [rbp - 4], 1
cmp dword [rbp - 4], 0x19
jle 0x14000312c
mov eax, 0
add rsp, 0x30
pop rbp
ret

Function at 0x140003257
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rdi
sub rsp, 0x458
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], rcx
mov qword [rbp + 0x3f8], rdx
mov qword [rbp + 0x400], r8
mov qword [rbp + 0x408], r9
mov qword [rbp + 0x3c8], 0
mov qword [rbp - 0x40], 0
mov qword [rbp - 0x38], 0
lea rdx, [rbp - 0x30]
mov eax, 0
mov ecx, 0x7e
mov rdi, rdx
rep stosq qword [rdi], rax
mov dword [rbp - 0x44], 0x104
mov rax, qword [rbp + 0x3f8]
lea rdx, [rbp + 0x3c8]
mov qword [rsp + 0x20], rdx
mov r9d, 0x20019
mov r8d, 0
mov rdx, rax
mov rcx, qword [rbp + 0x3f0]
mov rax, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call rax
test eax, eax
jne 0x140003379
mov rax, qword [rbp + 0x3c8]
mov rdx, qword [rbp + 0x400]
lea rcx, [rbp - 0x44]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp - 0x40]
mov qword [rsp + 0x20], rcx
mov r9d, 0
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call rax
test eax, eax
jne 0x140003366
mov rdx, qword [rbp + 0x408]
lea rax, [rbp - 0x40]
mov rcx, rax
mov rax, qword [sym.imp.SHELL32.dll_StrStrIA]
call rax
test rax, rax
je 0x140003366
mov rax, qword [rbp + 0x3c8]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
mov eax, 1
jmp 0x14000337e
mov rax, qword [rbp + 0x3c8]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
mov eax, 0
add rsp, 0x458
pop rdi
pop rbp
ret
Function at 0x14000366f
Capabilities:
Check if process is running under wine

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
lea rax, str.kernel32.dll
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x14000369c
mov eax, 0
jmp 0x1400036c4
mov rax, qword [rbp - 8]
lea rdx, str.wine_get_unix_file_name
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
test rax, rax
jne 0x1400036bf
mov eax, 0
jmp 0x1400036c4
mov eax, 1
add rsp, 0x30
pop rbp
ret

Function at 0x1400036ca
Capabilities:
Check if process is running under wine

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov dword [rbp - 4], 0
lea rax, str.SOFTWAREWine
mov qword [rbp - 0x18], rax
mov word [rbp - 0xa], 1
mov dword [rbp - 8], 0
jmp 0x14000373f
mov eax, dword [rbp - 8]
cdqe
mov rax, qword [rbp + rax*8 - 0x18]
mov rdx, rax
mov rcx, 0xffffffff80000001
call sym.Is_RegKeyExists
test eax, eax
je 0x140003717
mov dword [rbp - 4], 1
mov eax, dword [rbp - 8]
cdqe
mov rax, qword [rbp + rax*8 - 0x18]
mov rdx, rax
mov rcx, 0xffffffff80000002
call sym.Is_RegKeyExists
test eax, eax
je 0x14000373b
mov dword [rbp - 4], 1
add dword [rbp - 8], 1
movzx eax, word [rbp - 0xa]
cmp dword [rbp - 8], eax
jl 0x1400036f3
mov eax, dword [rbp - 4]
add rsp, 0x40
pop rbp
ret
Function at 0x1400049c1
Capabilities:
Enumerate processes

Disassembly:
push rbp
sub rsp, 0x160
lea rbp, [rsp + 0x80]
mov dword [rbp + 0xdc], 0
mov edx, 0
mov ecx, 2
call sym.CreateToolhelp32Snapshot
mov qword [rbp + 0xd0], rax
cmp qword [rbp + 0xd0], 0xffffffffffffffff
je 0x140004a1b
mov dword [rbp - 0x60], 0x130
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd0]
mov rcx, rax
call sym.Process32First
test eax, eax
jne 0x140004a42
jmp 0x140004a25
mov eax, 0
jmp 0x140004bd4
mov rax, qword [rbp + 0xd0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
jmp 0x140004bd4
lea rax, [rbp - 0x60]
add rax, 0x2c
lea rdx, str.vboxservice.exe
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_lstrcmpiA]
call rax
test eax, eax
jne 0x140004a6b
mov dword [rbp + 0xdc], 1
lea rax, [rbp - 0x60]
add rax, 0x2c
lea rdx, str.vboxtray.exe
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_lstrcmpiA]
call rax
test eax, eax
jne 0x140004a94
mov dword [rbp + 0xdc], 1
lea rax, [rbp - 0x60]
add rax, 0x2c
lea rdx, str.VGAuthService.exe
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_lstrcmpiA]
call rax
test eax, eax
jne 0x140004abd
mov dword [rbp + 0xdc], 1
lea rax, [rbp - 0x60]
add rax, 0x2c
lea rdx, str.Vmacthlp.exe
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_lstrcmpiA]
call rax
test eax, eax
jne 0x140004ae6
mov dword [rbp + 0xdc], 1
lea rax, [rbp - 0x60]
add rax, 0x2c
lea rdx, str.VMtoolsd.exe
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_lstrcmpiA]
call rax
test eax, eax
jne 0x140004b0f
mov dword [rbp + 0xdc], 1
lea rax, [rbp - 0x60]
add rax, 0x2c
lea rdx, str.VMwaretrat.exe
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_lstrcmpiA]
call rax
test eax, eax
jne 0x140004b38
mov dword [rbp + 0xdc], 1
lea rax, [rbp - 0x60]
add rax, 0x2c
lea rdx, str.VMwareUser.exe
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_lstrcmpiA]
call rax
test eax, eax
jne 0x140004b61
mov dword [rbp + 0xdc], 1
lea rax, [rbp - 0x60]
add rax, 0x2c
lea rdx, str.VMwareService.exe
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_lstrcmpiA]
call rax
test eax, eax
jne 0x140004b8a
mov dword [rbp + 0xdc], 1
lea rax, [rbp - 0x60]
add rax, 0x2c
lea rdx, str.VMwareTray.exe
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_lstrcmpiA]
call rax
test eax, eax
jne 0x140004bb3
mov dword [rbp + 0xdc], 1
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd0]
mov rcx, rax
call sym.Process32Next
test eax, eax
jne 0x140004a42
mov eax, dword [rbp + 0xdc]
add rsp, 0x160
pop rbp
ret
Function at 0x140004e95
Capabilities:
Enumerate process modules

Disassembly:
push rbp
mov eax, 0x1040
call fcn.140010570
sub rsp, rax
lea rbp, [rsp + 0x80]
lea rdx, [rbp - 0x54]
lea rax, [rbp - 0x50]
mov r8, rdx
mov edx, 0x1000
mov rcx, rax
call sym.K32EnumProcesses
test eax, eax
jne 0x140004ece
mov eax, 1
jmp 0x140004f32
mov eax, dword [rbp - 0x54]
shr eax, 2
mov dword [rbp + 0xfb4], eax
mov dword [rbp + 0xfb8], 0
jmp 0x140004f1b
mov eax, dword [rbp + 0xfb8]
mov eax, dword [rbp + rax*4 - 0x50]
test eax, eax
je 0x140004f14
mov eax, dword [rbp + 0xfb8]
mov eax, dword [rbp + rax*4 - 0x50]
mov ecx, eax
call sym.checkProcessName
mov dword [rbp + 0xfbc], eax
cmp dword [rbp + 0xfbc], 0
jne 0x140004f2b
add dword [rbp + 0xfb8], 1
mov eax, dword [rbp + 0xfb8]
cmp eax, dword [rbp + 0xfb4]
jb 0x140004ee6
jmp 0x140004f2c
nop
mov eax, dword [rbp + 0xfbc]
add rsp, 0x1040
pop rbp
ret

Function at 0x1400053c2
Capabilities:
Link many functions at runtime

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
lea rax, [0x140033dfc]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
call rax
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
lea rdx, [0x140033e06]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov rdx, qword [0x140037af0]
mov qword [rdx], rax
mov rax, qword [rbp - 8]
lea rdx, str.NtCreateFile
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [0x14003f060], rax
mov rax, qword [rbp - 8]
lea rdx, str.NtCreateEvent
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [0x14003f068], rax
mov rax, qword [rbp - 8]
lea rdx, str.NtQueryDirectoryFile
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [0x14003f070], rax
mov rax, qword [rbp - 8]
lea rdx, str.NtWaitForSingleObject
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [0x14003f078], rax
mov rax, qword [rbp - 8]
lea rdx, str.RtlUnicodeStringToAnsiString
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [0x14003f080], rax
mov rax, qword [rbp - 8]
lea rdx, str.NtClose
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [0x14003f088], rax
mov rax, qword [rbp - 8]
lea rdx, str.NtOpenFile
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [0x14003f090], rax
mov rax, qword [rbp - 8]
lea rdx, str.NtQueryAttributesFile
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [0x14003f098], rax
nop
add rsp, 0x30
pop rbp
ret
Function at 0x14000622a
Capabilities:
Get process image filename

Disassembly:
push rbp
sub rsp, 0x220
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x194], 0x1f4
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov rcx, rax
mov edx, dword [rbp + 0x194]
lea rax, [rbp - 0x60]
mov r8d, edx
mov rdx, rax
call sym.K32GetProcessImageFileNameA
mov qword [rbp + 0x198], 0
jmp 0x1400062ab
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0x198]
add rax, rdx
movzx eax, byte [rax]
movsx eax, al
mov ecx, eax
mov rax, qword [sym.imp.msvcrt.dll_toupper]
call rax
mov edx, eax
lea rcx, [rbp - 0x60]
mov rax, qword [rbp + 0x198]
add rax, rcx
mov byte [rax], dl
add qword [rbp + 0x198], 1
lea rax, [rbp - 0x60]
mov rcx, rax
call sym.strlen
cmp qword [rbp + 0x198], rax
jb 0x140006272
lea rax, [rbp - 0x60]
lea rdx, str.SAMPLE
mov rcx, rax
call sym.strstr
test rax, rax
je 0x1400062df
mov eax, 1
jmp 0x140006322
lea rax, [rbp - 0x60]
lea rdx, str.VIRUS
mov rcx, rax
call sym.strstr
test rax, rax
je 0x1400062fe
mov eax, 1
jmp 0x140006322
lea rax, [rbp - 0x60]
lea rdx, str.SANDBOX
mov rcx, rax
call sym.strstr
test rax, rax
je 0x14000631d
mov eax, 1
jmp 0x140006322
mov eax, 0
add rsp, 0x220
pop rbp
ret

Function at 0x1400067da
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push rbp
sub rsp, 0x7d0
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x74c], 0
lea rax, [rbp + 0x530]
mov qword [rsp + 0x20], rax
mov r9d, 0
mov r8d, 0
mov edx, 8
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
call rax
test eax, eax
js 0x14000698c
lea rdx, [rbp + 0x530]
lea rax, [rbp + 0xd0]
mov r8, rdx
mov edx, 0x104
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll_wcscpy_s]
call rax
lea rax, [rbp + 0xd0]
lea r8, [0x140034ce2]
mov edx, 0x104
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll_wcscat_s]
call rax
lea rdx, [rbp + 0x2e0]
lea rax, [rbp + 0xd0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FindFirstFileW]
call rax
mov qword [rbp + 0x740], rax
cmp qword [rbp + 0x740], 0xffffffffffffffff
je 0x14000697c
lea rax, [rbp + 0x2e0]
lea rdx, [rax + 0x2c]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x104
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
mov r8, rdx
mov edx, 0
mov ecx, 0xfde9
mov rax, qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
call rax
mov eax, dword [rbp + 0x2e0]
and eax, 0x10
test eax, eax
jne 0x140006946
lea rax, [rbp - 0x40]
mov rcx, rax
call sym.removeExtension
lea rax, [rbp - 0x40]
mov rcx, rax
call sym.isBlacklisted
test eax, eax
je 0x140006927
lea rax, [rbp - 0x40]
mov rdx, rax
lea rax, str.Blacklisted_file:__s_n
mov rcx, rax
call sym.printf_4
mov eax, 1
jmp 0x140006991
lea rax, [rbp - 0x40]
mov rdx, rax
lea rax, str.Not_blacklisted_file:__s_n
mov rcx, rax
call sym.printf_4
add dword [rbp + 0x74c], 1
jmp 0x140006947
nop
lea rdx, [rbp + 0x2e0]
mov rax, qword [rbp + 0x740]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FindNextFileW]
call rax
test eax, eax
jne 0x140006897
mov rax, qword [rbp + 0x740]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FindClose]
call rax
cmp dword [rbp + 0x74c], 4
jg 0x14000698c
mov eax, 1
jmp 0x140006991
mov eax, 0
add rsp, 0x7d0
pop rbp
ret
Function at 0x14000699a
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push rbp
sub rsp, 0x7d0
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x74c], 0
lea rax, [rbp + 0x530]
mov qword [rsp + 0x20], rax
mov r9d, 0
mov r8d, 0
mov edx, 0xa
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
call rax
test eax, eax
js 0x140006b13
lea rdx, [rbp + 0x530]
lea rax, [rbp + 0xd0]
mov r8, rdx
mov edx, 0x104
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll_wcscpy_s]
call rax
lea rax, [rbp + 0xd0]
lea r8, [0x140034ce2]
mov edx, 0x104
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll_wcscat_s]
call rax
lea rdx, [rbp + 0x2e0]
lea rax, [rbp + 0xd0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FindFirstFileW]
call rax
mov qword [rbp + 0x740], rax
cmp qword [rbp + 0x740], 0xffffffffffffffff
je 0x140006b03
lea rax, [rbp + 0x2e0]
lea rdx, [rax + 0x2c]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x104
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
mov r8, rdx
mov edx, 0
mov ecx, 0xfde9
mov rax, qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
call rax
mov eax, dword [rbp + 0x2e0]
and eax, 0x10
test eax, eax
jne 0x140006acd
lea rax, [rbp - 0x40]
mov rdx, rax
lea rax, str.Trashed_file:__s_n
mov rcx, rax
call sym.printf_4
add dword [rbp + 0x74c], 1
jmp 0x140006ace
nop
lea rdx, [rbp + 0x2e0]
mov rax, qword [rbp + 0x740]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FindNextFileW]
call rax
test eax, eax
jne 0x140006a57
mov rax, qword [rbp + 0x740]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FindClose]
call rax
cmp dword [rbp + 0x74c], 0x63
jg 0x140006b13
mov eax, 1
jmp 0x140006b18
mov eax, 0
add rsp, 0x7d0
pop rbp
ret

Function at 0x140006e94
Capabilities:
Hide thread from debugger

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov dword [rbp - 4], 0x11
lea rax, [0x140034d30]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
lea rdx, str.NtSetInformationThread
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp - 0x18], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call rax
mov rcx, rax
mov eax, dword [rbp - 4]
mov r10, qword [rbp - 0x18]
mov r9d, 0
mov r8d, 0
mov edx, eax
call r10
lea rax, [sym.UnhandledExcepFilter]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call rax
mov qword [rbp - 0x20], rax
mov r9d, 0
mov r8d, 0
mov edx, 0
mov ecx, 0xc000008e
mov rax, qword [sym.imp.KERNEL32.dll_RaiseException]
call rax
mov rax, qword [rbp - 0x20]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call rax
mov eax, dword [0x140032c40]
add rsp, 0x40
pop rbp
ret
Function at 0x1400070d3
Capabilities:
Enumerate processes

Disassembly:
push rbp
push rdi
sub rsp, 0x168
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x100], ecx
mov dword [rbp + 0xdc], 0
mov edx, 0
mov ecx, 2
call sym.CreateToolhelp32Snapshot
mov qword [rbp + 0xd0], rax
lea rdx, [rbp - 0x60]
mov eax, 0
mov ecx, 0x26
mov rdi, rdx
rep stosq qword [rdi], rax
mov dword [rbp - 0x60], 0x130
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd0]
mov rcx, rax
call sym.Process32First
test eax, eax
je 0x140007167
mov eax, dword [rbp - 0x58]
cmp dword [rbp + 0x100], eax
jne 0x140007150
mov eax, dword [rbp - 0x40]
mov dword [rbp + 0xdc], eax
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd0]
mov rcx, rax
call sym.Process32Next
test eax, eax
jne 0x14000713c
mov rax, qword [rbp + 0xd0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, dword [rbp + 0xdc]
add rsp, 0x168
pop rdi
pop rbp
ret

Function at 0x1400071da
Capabilities:
Accept command line arguments
Check mutex on windows
Create process on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xf0
lea rax, str.SelfDebugMutex
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
mov r8, rax
mov edx, 1
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateMutexA]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
cmp eax, 0xb7
jne 0x14000722d
call sym.child_process
mov eax, 0
jmp 0x140007311
mov dword [rbp - 0x34], 0
lea rax, [rbp - 0x30]
mov r8d, 0x18
mov edx, 0
mov rcx, rax
call sym.memset
lea rax, [rbp - 0xa0]
mov r8d, 0x68
mov edx, 0
mov rcx, rax
call sym.memset
lea rax, [rbp - 0xa0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call rax
mov rax, qword [sym.imp.KERNEL32.dll_GetCommandLineA]
call rax
mov rdx, rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0xa0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
mov rax, qword [rbp - 0x30]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [rbp - 0x30]
lea rdx, [rbp - 0x34]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
call rax
mov eax, dword [rbp - 0x34]
test eax, eax
je 0x14000730c
mov eax, 1
jmp 0x140007311
mov eax, 0
add rsp, 0xf0
pop rbp
ret
Function at 0x14000761e
Capabilities:
Enumerate processes

Disassembly:
push rbp
sub rsp, 0x160
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xf0], rcx
mov qword [rbp + 0xd8], 0
lea rax, [rbp - 0x60]
mov r8d, 0x130
mov edx, 0
mov rcx, rax
call sym.memset
mov edx, 0
mov ecx, 2
call sym.CreateToolhelp32Snapshot
mov qword [rbp + 0xd8], rax
cmp qword [rbp + 0xd8], 0xffffffffffffffff
jne 0x140007681
mov eax, 0
jmp 0x140007759
mov dword [rbp - 0x60], 0x130
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd8]
mov rcx, rax
call sym.Process32First
test eax, eax
jne 0x1400076bc
mov rax, qword [rbp + 0xd8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
jmp 0x140007759
lea rax, [rbp - 0x60]
add rax, 0x2c
mov rdx, qword [rbp + 0xf0]
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll__stricmp_1]
call rax
test eax, eax
jne 0x14000772a
mov rax, qword [rbp + 0xd8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, dword [rbp - 0x58]
jmp 0x140007759
lea rax, [rbp - 0x60]
add rax, 0x2c
mov rdx, qword [rbp + 0xf0]
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll__stricmp_1]
call rax
test eax, eax
jne 0x14000772a
mov rax, qword [rbp + 0xd8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, dword [rbp - 0x58]
jmp 0x140007759
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd8]
mov rcx, rax
call sym.Process32Next
test eax, eax
jne 0x1400076f3
mov rax, qword [rbp + 0xd8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
add rsp, 0x160
pop rbp
ret
Function at 0x1400078e5
Capabilities:
Check for sandbox username or hostname
Get hostname

Disassembly:
push rbp
sub rsp, 0x160
lea rbp, [rsp + 0x80]
mov dword [rbp + 0xdc], 0
lea rax, str.vbox
mov qword [rbp + 0xb0], rax
lea rax, [0x140034f84]
mov qword [rbp + 0xb8], rax
lea rax, str.virtual
mov qword [rbp + 0xc0], rax
lea rax, str.sandbox
mov qword [rbp + 0xc8], rax
lea rax, str.HAL9TH
mov qword [rbp + 0xd8], rax
mov qword [rbp - 0x50], 0
mov qword [rbp - 0x48], 0
mov qword [rbp - 0x40], 0
mov qword [rbp - 0x38], 0
mov qword [rbp - 0x30], 0
mov qword [rbp - 0x28], 0
mov qword [rbp - 0x20], 0
mov qword [rbp - 0x18], 0
mov qword [rbp - 0x10], 0
mov qword [rbp - 8], 0
mov qword [rbp], 0
mov qword [rbp + 8], 0
mov qword [rbp + 0x10], 0
mov qword [rbp + 0x18], 0
mov qword [rbp + 0x20], 0
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x78], 0
mov qword [rbp + 0x80], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0x90], 0
mov qword [rbp + 0x98], 0
mov qword [rbp + 0xa0], 0
mov qword [rbp + 0xa8], 0
mov dword [rbp - 0x54], 0x100
lea rdx, [rbp - 0x54]
lea rax, [rbp - 0x50]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetComputerNameA]
call rax
test eax, eax
je 0x140007ab0
jmp 0x140007aa7
mov eax, dword [rbp + 0xdc]
cdqe
mov rdx, qword [rbp + rax*8 + 0xb0]
lea rax, [rbp - 0x50]
mov rcx, rax
call sym.strstr
test rax, rax
je 0x140007aa0
mov eax, 1
jmp 0x140007ab5
add dword [rbp + 0xdc], 1
cmp dword [rbp + 0xdc], 4
jle 0x140007a78
mov eax, 0
add rsp, 0x160
pop rbp
ret
Function at 0x140007abe
Capabilities:
Check for sandbox username or hostname
Get session user name

Disassembly:
push rbp
mov eax, 0x8100
call fcn.140010570
sub rsp, rax
lea rbp, [rsp + 0x80]
lea rax, str.admin
mov qword [rbp + 0x7fb0], rax
lea rax, str.andy
mov qword [rbp + 0x7fb8], rax
lea rax, str.honey
mov qword [rbp + 0x7fc0], rax
lea rax, str.john
mov qword [rbp + 0x7fc8], rax
lea rax, str.john_doe
mov qword [rbp + 0x7fd0], rax
lea rax, str.malnetvm
mov qword [rbp + 0x7fd8], rax
lea rax, str.maltest
mov qword [rbp + 0x7fe0], rax
lea rax, str.malware
mov qword [rbp + 0x7fe8], rax
lea rax, [0x140034fd6]
mov qword [rbp + 0x7ff0], rax
lea rax, str.sandbox
mov qword [rbp + 0x7ff8], rax
lea rax, str.snort
mov qword [rbp + 0x8000], rax
lea rax, str.tequilaboomboom
mov qword [rbp + 0x8008], rax
lea rax, str.test
mov qword [rbp + 0x8010], rax
lea rax, str.virus
mov qword [rbp + 0x8018], rax
lea rax, str.virusclone
mov qword [rbp + 0x8020], rax
lea rax, str.wilbert
mov qword [rbp + 0x8028], rax
lea rax, str.nepenthes
mov qword [rbp + 0x8030], rax
lea rax, str.currentuser
mov qword [rbp + 0x8038], rax
lea rax, str.username
mov qword [rbp + 0x8040], rax
lea rax, str.vmware
mov qword [rbp + 0x8048], rax
lea rax, str.user
mov qword [rbp + 0x8050], rax
lea rax, str.mike
mov qword [rbp + 0x8058], rax
lea rax, str.louise
mov qword [rbp + 0x8060], rax
lea rax, str.j.seance
mov qword [rbp + 0x8068], rax
mov dword [rbp - 0x54], 0x7fff
lea rdx, [rbp - 0x54]
lea rax, [rbp - 0x50]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_GetUserNameA]
call rax
mov dword [rbp + 0x807c], 0
jmp 0x140007c84
mov eax, dword [rbp + 0x807c]
cdqe
mov rdx, qword [rbp + rax*8 + 0x7fb0]
lea rax, [rbp - 0x50]
mov r8, 0xffffffffffffffff
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll__strnicmp]
call rax
test eax, eax
je 0x140007c7d
mov eax, 1
jmp 0x140007c92
add dword [rbp + 0x807c], 1
cmp dword [rbp + 0x807c], 0x17
jle 0x140007c4b
mov eax, 0
add rsp, 0x8100
pop rbp
ret

Function at 0x140007c9b
Capabilities:
Get system information on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
lea rax, [rbp - 0x30]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call rax
mov eax, dword [rbp - 0x10]
cmp eax, 1
setbe al
movzx eax, al
add rsp, 0x50
pop rbp
ret

Function at 0x140007ce3
Capabilities:
Enumerate gui resources

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov edx, 0
lea rax, [sym.EnumWindowsProc]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_EnumWindows]
call rax
mov eax, dword [0x14003f0b0]
mov edx, eax
lea rax, str.total_windows_found:__d_n
mov rcx, rax
call sym.printf_7
mov eax, dword [0x14003f0b0]
cmp eax, 0xb
setle al
movzx eax, al
add rsp, 0x20
pop rbp
ret