joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003f161
Capabilities:
Write file on windows

Disassembly:
jmp 0x140077a40
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x32
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1d8]
mov rax, qword [0x1400dd040]
xor rax, rbp
mov qword [rbp + 0x170], rax
lea rcx, [0x1400ed068]
call fcn.14003f1f2
nop
mov rax, qword [rbp + 0x1a0]
cmp qword [rax + 0x68], 0
je 0x140077aa7
mov rax, qword [rbp + 0x1a0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x140077aae
mov al, 1
jmp 0x140077c1e
mov rax, qword [rbp + 0x1a0]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov qword [rbp + 0x158], rax
call fcn.14003d91a
mov dword [rbp + 0x160], eax
mov edx, dword [rbp + 0x160]
mov rcx, qword [rbp + 0x1a0]
call qword [rbp + 0x158]
mov dword [rbp + 0x164], eax
call fcn.14003d91a
mov dword [rbp + 0x168], eax
mov edx, dword [rbp + 0x164]
mov ecx, dword [rbp + 0x168]
call fcn.14003ea45
movzx eax, al
test eax, eax
je 0x140077b11
xor al, al
jmp 0x140077c1e
mov qword [rbp + 8], 0x20
mov rax, qword [rbp + 0x1a0]
mov rax, qword [rax + 0x68]
mov qword [rbp + 0x158], rax
lea rax, [rbp + 0x48]
mov rcx, qword [rbp + 0x1a0]
add rcx, 0x74
lea rdx, [rbp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rbp + 0x28]
mov rdx, rcx
mov rcx, qword [rbp + 0x158]
call qword [sym.imp.MSVCP140D.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rbp + 0x160], eax
cmp dword [rbp + 0x160], 0
je 0x140077b84
cmp dword [rbp + 0x160], 1
je 0x140077b8f
cmp dword [rbp + 0x160], 3
je 0x140077c0d
jmp 0x140077c1c
mov rax, qword [rbp + 0x1a0]
mov byte [rax + 0x71], 0
lea rax, [rbp + 0x28]
mov rcx, qword [rbp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jbe 0x140077bdf
mov rax, qword [rbp + 0x1a0]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x88]
mov edx, 1
lea rcx, [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_fwrite]
cmp qword [rbp + 0x88], rax
je 0x140077bdf
xor al, al
jmp 0x140077c1e
mov rax, qword [rbp + 0x1a0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x140077bfa
mov dword [rbp + 0x154], 1
jmp 0x140077c04
mov dword [rbp + 0x154], 0
movzx eax, byte [rbp + 0x154]
jmp 0x140077c1e
mov rax, qword [rbp + 0x1a0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x140077c1e
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x1400c4610]
call fcn.14003ebcb
mov rax, rdi
mov rcx, qword [rbp + 0x170]
xor rcx, rbp
call fcn.14003e004
lea rsp, [rbp + 0x188]
pop rdi
pop rbp
ret
Function at 0x1400b2ba0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.14003f337
movzx eax, al
test eax, eax
jne 0x1400b2bc0
mov ecx, 7
call fcn.14003ec0c
nop
mov byte [rsp + 0x20], 0
call fcn.14003ecb1
mov byte [rsp + 0x21], al
cmp dword [0x1400ddcc8], 1
jne 0x1400b2be4
mov ecx, 7
call fcn.14003ec0c
nop
jmp 0x1400b2c3c
cmp dword [0x1400ddcc8], 0
jne 0x1400b2c37
mov dword [0x1400ddcc8], 1
lea rdx, [0x1400c1770]
lea rcx, [0x1400c1440]
call fcn.14003df9b
test eax, eax
je 0x1400b2c18
mov eax, 0xff
jmp 0x1400b2d41
lea rdx, [0x1400c1330]
lea rcx, [section..rdata]
call fcn.14003ec7f
mov dword [0x1400ddcc8], 2
jmp 0x1400b2c3c
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.14003eba8
call fcn.14003e7f7
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x1400b2c99
mov rcx, qword [rsp + 0x30]
call fcn.14003dcb7
movzx eax, al
test eax, eax
je 0x1400b2c99
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x1400ee020]
nop
call fcn.14003e973
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x1400b2ccd
mov rcx, qword [rsp + 0x38]
call fcn.14003dcb7
movzx eax, al
test eax, eax
je 0x1400b2ccd
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.14003f0c6
nop
call fcn.1400b2df0
mov dword [rsp + 0x28], eax
call fcn.14003e702
movzx eax, al
test eax, eax
jne 0x1400b2cec
mov ecx, dword [rsp + 0x28]
call fcn.14003d258
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x1400b2cfb
call fcn.14003f12f
nop
xor edx, edx
mov cl, 1
call fcn.14003dc03
mov eax, dword [rsp + 0x28]
jmp 0x1400b2d41
add rsp, 0x68
ret
Function at 0x403152
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov eax, ecx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov byte [rbp + 0x10], al
mov byte [rbp - 1], 0
jmp 0x4031eb
mov byte [rbp - 2], 0
jmp 0x4031e1
movzx eax, byte [rbp - 1]
movzx edx, byte [rbp - 2]
mov rcx, qword [rbp + 0x18]
movsxd rdx, edx
cdqe
shl rax, 2
add rax, rcx
add rax, rdx
movzx r8d, byte [rax]
movzx eax, byte [rbp + 0x10]
lea edx, [rax*4]
movzx eax, byte [rbp - 1]
add eax, edx
lea edx, [rax*4]
movzx eax, byte [rbp - 2]
add eax, edx
cdqe
mov rdx, qword [rbp + 0x20]
add rax, rdx
movzx ecx, byte [rax]
movzx eax, byte [rbp - 1]
movzx edx, byte [rbp - 2]
xor r8d, ecx
mov rcx, qword [rbp + 0x18]
movsxd rdx, edx
cdqe
shl rax, 2
add rax, rcx
add rax, rdx
mov byte [rax], r8b
add byte [rbp - 2], 1
cmp byte [rbp - 2], 3
jbe 0x403173
add byte [rbp - 1], 1
cmp byte [rbp - 1], 3
jbe 0x40316d
nop
add rsp, 0x10
pop rbp
ret

Function at 0x4031fc
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rbp + 0x10], rcx
mov byte [rbp - 1], 0
jmp 0x40326f
mov byte [rbp - 2], 0
jmp 0x403265
movzx eax, byte [rbp - 2]
movzx edx, byte [rbp - 1]
mov rcx, qword [rbp + 0x10]
movsxd rdx, edx
cdqe
shl rax, 2
add rax, rcx
add rax, rdx
movzx eax, byte [rax]
movzx eax, al
movzx r8d, byte [rbp - 2]
movzx ecx, byte [rbp - 1]
cdqe
lea rdx, str.cw
movzx edx, byte [rax + rdx]
mov r9, qword [rbp + 0x10]
movsxd rcx, ecx
movsxd rax, r8d
shl rax, 2
add rax, r9
add rax, rcx
mov byte [rax], dl
add byte [rbp - 2], 1
cmp byte [rbp - 2], 3
jbe 0x403214
add byte [rbp - 1], 1
cmp byte [rbp - 1], 3
jbe 0x40320e
nop
add rsp, 0x10
pop rbp
ret

Function at 0x403d11
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rbp + 0x10], rcx
mov byte [rbp - 1], 0
jmp 0x403d84
mov byte [rbp - 2], 0
jmp 0x403d7a
movzx eax, byte [rbp - 2]
movzx edx, byte [rbp - 1]
mov rcx, qword [rbp + 0x10]
movsxd rdx, edx
cdqe
shl rax, 2
add rax, rcx
add rax, rdx
movzx eax, byte [rax]
movzx eax, al
movzx r8d, byte [rbp - 2]
movzx ecx, byte [rbp - 1]
cdqe
lea rdx, [0x00407b60]
movzx edx, byte [rax + rdx]
mov r9, qword [rbp + 0x10]
movsxd rcx, ecx
movsxd rax, r8d
shl rax, 2
add rax, r9
add rax, rcx
mov byte [rax], dl
add byte [rbp - 2], 1
cmp byte [rbp - 2], 3
jbe 0x403d29
add byte [rbp - 1], 1
cmp byte [rbp - 1], 3
jbe 0x403d23
nop
add rsp, 0x10
pop rbp
ret

Function at 0x403fbb
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov byte [rbp - 1], 0
jmp 0x404004
movzx eax, byte [rbp - 1]
mov rdx, qword [rbp + 0x10]
add rax, rdx
movzx r8d, byte [rax]
movzx eax, byte [rbp - 1]
mov rdx, qword [rbp + 0x18]
add rax, rdx
movzx ecx, byte [rax]
movzx eax, byte [rbp - 1]
mov rdx, qword [rbp + 0x10]
add rax, rdx
mov edx, r8d
xor edx, ecx
mov byte [rax], dl
add byte [rbp - 1], 1
cmp byte [rbp - 1], 0xf
jbe 0x403fd1
nop
add rsp, 0x10
pop rbp
ret
Function at 0x405410
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x00407fc0]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x40547d
mov rcx, r8
call fcn.004052f0
test eax, eax
je 0x40547d
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x40547d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x405474
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x40547f
add rax, 0x28
cmp rax, r9
jne 0x405460
xor eax, eax
add rsp, 0x28
ret

Function at 0x405910
Capabilities:
Write file on windows

Disassembly:
lea rcx, [0x00401540]
jmp 0x401510
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.004057d0
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.004057d0
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
jmp 0x401530
Function at 0x140001000
Capabilities:
Create process on windows
Create process suspended

Disassembly:
sub rsp, 0xe8
xor edx, edx
lea rcx, [rsp + 0x70]
lea r8d, [rdx + 0x68]
call sub.VCRUNTIME140.dll_memset
mov rax, qword [0x140003630]
lea rcx, str.C:WindowsSystem32calc.exe
mov qword [rsp + 0xd0], rax
xor r9d, r9d
mov qword [rsp + 0xc8], rax
xor r8d, r8d
mov rax, qword [0x140003648]
xor edx, edx
mov qword [rsp + 0xc0], rax
xor eax, eax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 1
mov dword [rsp + 0x70], 0x68
mov dword [rsp + 0xac], pe_nt_image_headers64
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rax, qword [rsp + 0x50]
add rsp, 0xe8
ret

Function at 0x1400010c0
Capabilities:
Create process on windows
Spoof parent pid
Terminate process

Disassembly:
push rbx
sub rsp, 0xe0
call fcn.140001000
xor edx, edx
mov qword [rsp + 0xf8], rax
lea rcx, [rsp + 0x50]
lea r8d, [rdx + 0x70]
call sub.VCRUNTIME140.dll_memset
xor r8d, r8d
lea r9, [rsp + 0xf0]
xor ecx, ecx
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rsp + 0xf0]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r8d, r8d
lea r9, [rsp + 0xf0]
mov rcx, rax
mov qword [rsp + 0xb8], rax
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
mov rcx, qword [rsp + 0xb8]
lea r9, [rsp + 0xf8]
xor ebx, ebx
xor edx, edx
mov qword [rsp + 0x30], rbx
mov r8d, 0x20000
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], 8
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
lea rax, [rsp + 0xc0]
mov dword [rsp + 0x50], 0x70
mov qword [rsp + 0x48], rax
lea rdx, str.notepad
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov qword [rsp + 0x38], rbx
xor ecx, ecx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x80000
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
or ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x140001000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
lea rcx, str._JAVA_LAUNCHER_DEBUG
call qword [sym.imp.MSVCR100.dll_getenv]
test rax, rax
je 0x140001066
lea rcx, str.Windows_original_main_args:_n
call qword [sym.imp.MSVCR100.dll_printf]
mov rax, qword [sym.imp.MSVCR100.dll___argc]
xor ebx, ebx
cmp dword [rax], ebx
jle 0x140001066
xor edi, edi
mov rax, qword [sym.imp.MSVCR100.dll___argv]
lea rcx, str.wwwd_args__d____s_n
mov edx, ebx
mov r8, qword [rax]
mov r8, qword [r8 + rdi]
call qword [sym.imp.MSVCR100.dll_printf]
mov rax, qword [sym.imp.MSVCR100.dll___argc]
inc ebx
add rdi, 8
cmp ebx, dword [rax]
jl 0x140001038
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rcx, rax
call sub.jli.dll_JLI_CmdToArgs
call sub.jli.dll_JLI_GetStdArgc
movsxd rdi, eax
lea ecx, [rdi + 1]
movsxd rcx, ecx
shl rcx, 3
call sub.jli.dll_JLI_MemAlloc
mov rbx, rax
call sub.jli.dll_JLI_GetStdArgs
xor r9d, r9d
xor edx, edx
test edi, edi
jle 0x1400010b2
mov r9d, edi
mov rcx, qword [rax]
add rax, 0x10
mov qword [rbx + rdx*8], rcx
inc rdx
cmp rdx, rdi
jl 0x14000109f
mov rcx, qword [str.java]
movsxd rax, r9d
and qword [rbx + rax*8], 0
test rcx, rcx
jne 0x1400010c9
mov rcx, qword [rbx]
mov rax, qword [str.java]
test rax, rax
jne 0x1400010d8
mov rax, qword [rbx]
and dword [rsp + 0x68], 0
mov byte [rsp + 0x60], 0
mov byte [rsp + 0x58], 0
mov byte [rsp + 0x50], 1
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rax
lea rax, [0x140002250]
mov r8d, 2
lea r9, str._J_ms8m
mov qword [rsp + 0x38], rax
lea rax, [0x140002240]
mov rdx, rbx
mov qword [rsp + 0x30], rax
lea rax, str._lib_tools.jar
mov ecx, edi
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r8d
call sub.jli.dll_JLI_Launch
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret

Function at 0x1407ab8e0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1407ab8ea
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x1407ab913
pop rbp
sub rbp, 0x33
sub rbp, 0x7ab8e0
sub rsp, 0x20
jmp 0x1407ab932
add al, 0
add byte [rax], al
ja 0x1407ab975
and byte [eax - 0x39], cl
shl al, 0xb8
jp 0x1407ab939
mov rax, 0x7ab8e0
add rax, rbp
add rax, 0x84
mov rcx, 0x647
mov rdx, 0x1d510cbd
xor byte [rax], dl
inc rax
dec rcx
jne 0x1407ab951
jmp 0x1407ab968
cmc
xor al, 0x54
xor al, 0x81
mov ebp, 0x3cf5bdbd
jl 0x1407ab92a
mov esp, 0xbcf5bdbd
push rsp
cmc
jp 0x1407ab9fb
mov ch, 0xbd
mov ebp, 0x7f7af5bd
xchg ebp, eax
mov ebp, 0x4af5bdbd
pop rdi
cmc
mov esp, 0xb13c367c
mov ebp, 0xbcf5bdbd
push rbp
in eax, dx
in eax, dx
cmc
add eax, 0xbdabf0c5
mov ebp, 0xf5bdbdbd
add al, 0xda
invalid
push rsp
xor byte [rdi + 0x55efbdbd], bh
sar byte [rbp - 0x15184243], 0xf5
xor al, 0x6a
cmc
invalid
Function at 0x14024eb54
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.1402438d8
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x14024ebf5
cmp ebx, dword [rsp + 0x30]
je 0x14024ebee
test esi, esi
je 0x14024ebee
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x14024ebc9
sub r8w, 0x61
cmp r8w, 0x19
ja 0x14024ebd6
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x14024ebb3
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x14024ebda
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x14024ebf7
mov eax, 1
jmp 0x14024ebf7
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140253370
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140253398
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140253398
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x100403a20
Capabilities:
Encode data using xor

Disassembly:
xor al, 0x6c
xor al, 0x64
xor al, 0x67
xor al, 0x41
xor al, 0x3e
xor al, 0x7d
xor al, 0xa2
xor al, 0x9a
xor al, 0xa3
xor al, 0x88
xor al, 0x9d
xor al, 0xa4
xor al, 0x71
xor al, 0x74
xor al, 0x59
xor al, 0x87
xchg dword [rbp*4 - 0x57cb58cc], esi
xor al, 0x99
xor al, 0xa1
xor al, 0x86
xor al, 0xa3
xor al, 0xa3
movabs dword [0xa73490345934a834], eax
xor al, 0xad
xor al, 0xa7
xor al, 0xa8
xor al, 0x99
cdq
xor al, 0xa1
xor al, 0x67
xor al, 0x66
xor al, 0x90
xor al, 0xa7
xor al, 0x9c
xor al, 0x99
xor al, 0xa0
xor al, 0xa0
xor al, 0x67
xor al, 0x66
xor al, 0x62
Function at 0x1400016d8
Capabilities:
Check os version
Create process on windows
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], rbx
push rbp
push rsi
push rdi
lea rbp, [rax - 0x548]
sub rsp, 0x630
movaps xmmword [rax - 0x28], xmm6
mov rax, qword [0x14002b460]
xor rax, rsp
mov qword [rbp + 0x510], rax
mov rdi, rdx
mov rbx, rcx
xor edx, edx
lea rcx, [rbp - 0x1c]
mov r8d, 0x118
movaps xmm6, xmm2
call sub.msvcrt.dll_memset
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rbp - 0x1c], 6
jb 0x140001826
jne 0x140001749
cmp dword [rbp - 0x14], 0x1bbc
jb 0x140001826
xor eax, eax
lea rcx, [rsp + 0x70]
xor edx, edx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
lea esi, [rax + 0x68]
mov r8d, esi
call sub.msvcrt.dll_memset
or dword [rbp - 0x54], 1
lea rcx, [rbp + 0x100]
mov dword [rsp + 0x70], esi
xor edx, edx
xor esi, esi
mov r8d, 0x410
mov word [rbp - 0x50], si
call sub.msvcrt.dll_memset
mov r9, rbx
mov qword [rsp + 0x20], rdi
lea r8, str.__s____s_
mov edx, 0x208
lea rcx, [rbp + 0x100]
call fcn.140006960
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rdx, [rbp + 0x100]
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor ecx, ecx
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140001826
mov rcx, qword [rsp + 0x50]
mov edx, 0x1388
call qword [sym.imp.USER32.dll_WaitForInputIdle]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
movaps xmm2, xmm6
mov rdx, rbx
call fcn.140001528
mov rcx, qword [rsp + 0x50]
xor edx, edx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, ebx
jmp 0x140001828
xor eax, eax
mov rcx, qword [rbp + 0x510]
xor rcx, rsp
call fcn.14001a4a0
lea r11, [rsp + 0x630]
mov rbx, qword [r11 + 0x38]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400018b8
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov ecx, dword [0x14002dac0]
or eax, 0xffffffff
mov esi, edx
cmp ecx, eax
je 0x14000196c
cmp dword [0x14002dac4], eax
je 0x14000196c
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
xor ebx, ebx
mov rdi, rax
test esi, esi
je 0x140001932
mov qword [rsp + 0x30], rbx
test edi, edi
jne 0x140001968
mov rax, qword [0x14002dac8]
test rax, rax
je 0x140001968
lea rcx, [rsp + 0x30]
call rax
mov ecx, dword [0x14002dac0]
movsxd rdx, eax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rdx, qword [rsp + 0x30]
mov ecx, dword [0x14002dac4]
jmp 0x140001962
test edi, edi
je 0x140001968
cmp qword [0x14002dad0], rbx
je 0x140001968
mov ecx, dword [0x14002dac4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, rax
call qword [0x14002dad0]
mov ecx, dword [0x14002dac0]
test eax, eax
sete bl
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, edi
jmp 0x14000196e
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140003538
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x14002b460]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov ebx, ecx
mov ebp, 0x208
mov r8d, ebp
lea rcx, [rsp + 0x50]
xor edx, edx
call sub.msvcrt.dll_memset
mov r8d, 0x104
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor esi, esi
lea rcx, [rsp + 0x50]
cmp word [rsp + 0x50], si
je 0x1400035a1
add rcx, 2
cmp word [rcx], si
jne 0x140003598
lea rdx, [rsp + 0x50]
mov rax, rcx
sub rax, rdx
and rax, 0xfffffffffffffffe
cmp rax, 0x20
jle 0x1400035c9
jmp 0x1400035bc
sub rcx, 2
cmp word [rcx], 0x5c
jne 0x1400035b8
add rcx, 2
mov word [rcx], si
lea rdx, str.ExplorerExt64.dll
mov eax, 0x45
sub rdx, rcx
mov word [rcx], ax
lea rcx, [rcx + 2]
movzx eax, word [rdx + rcx]
test ax, ax
jne 0x1400035d8
mov word [rcx], si
lea rcx, [rsp + 0x50]
call fcn.14000bc54
test eax, eax
je 0x1400036bc
mov r8d, ebx
xor edx, edx
mov ecx, 0xf00ff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x1400036bc
mov r9d, 0x1000
mov dword [rsp + 0x20], 4
mov r8, rbp
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r9, rbp
mov qword [rsp + 0x20], rsi
mov rdx, rax
lea r8, [rsp + 0x50]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rcx, str.Kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [0x1400249d8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x30], rsi
xor r8d, r8d
mov r9, rax
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rbx, rax
test rax, rax
je 0x1400036bc
or edx, 0xffffffff
mov dword [rsp + 0x40], esi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.14001a4a0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140006a74
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xa60
mov rax, qword [0x14002b460]
xor rax, rsp
mov qword [rsp + 0xa50], rax
mov rdi, r9
mov rsi, r8
cmp rdx, 0xffffffff80000000
je 0x140006ae6
cmp rdx, 0xffffffff80000001
je 0x140006add
cmp rdx, 0xffffffff80000002
je 0x140006ad4
cmp rdx, 0xffffffff80000003
jne 0x140006b98
lea rbx, str.USERS
jmp 0x140006aed
lea rbx, str.MACHINE
jmp 0x140006aed
lea rbx, str.CURRENT_USER
jmp 0x140006aed
lea rbx, str.CLASSES_ROOT
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x202
call sub.msvcrt.dll_memset
xor edx, edx
lea rcx, [rsp + 0x250]
mov r8d, 0x800
call sub.msvcrt.dll_memset
xor ebp, ebp
test rdi, rdi
je 0x140006b41
or rax, 0xffffffffffffffff
inc rax
cmp word [rdi + rax*2], bp
jne 0x140006b1f
test rax, rax
je 0x140006b41
mov r8, rdi
lea rcx, [rsp + 0x40]
mov edx, 0x101
call fcn.140006d60
jmp 0x140006b5d
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x101
lea rcx, [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x140006b98
mov r9, rbx
mov qword [rsp + 0x20], rsi
lea r8, str._s_s
mov edx, 0x400
lea rcx, [rsp + 0x250]
call fcn.140006e48
lea r9, [rsp + 0x40]
mov r8d, 4
lea rdx, [rsp + 0x250]
call fcn.140006bc4
jmp 0x140006b9a
xor eax, eax
mov rcx, qword [rsp + 0xa50]
xor rcx, rsp
call fcn.14001a4a0
lea r11, [rsp + 0xa60]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret