joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003201
Capabilities:
Switch active desktop

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov dword [rbp - 4], 1
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x182
mov r9d, 0
mov r8d, 0
mov edx, 0
lea rax, str.m_pcszNewDesktopName
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_CreateDesktopA]
call rax
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
jne 0x140003257
mov eax, 0
jmp 0x140003275
mov rax, qword [rbp - 0x10]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_SwitchDesktop]
call rax
test eax, eax
je 0x140003272
mov dword [rbp - 4], 0
mov eax, dword [rbp - 4]
add rsp, 0x40
pop rbp
ret

Function at 0x140003308
Capabilities:
Get disk information

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rax, qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
call rax
mov dword [rbp - 8], eax
mov dword [rbp - 4], 0
jmp 0x140003381
mov eax, dword [rbp - 4]
mov edx, 1
mov ecx, eax
shl edx, cl
mov eax, edx
and eax, dword [rbp - 8]
test eax, eax
je 0x14000337d
mov eax, dword [rbp - 4]
add eax, 0x41
movsx rax, al
lea rdx, [0x1400415e0]
add rax, rdx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetDriveTypeA]
call rax
cmp eax, 2
jne 0x14000337d
mov eax, dword [rbp - 4]
add eax, 0x41
mov edx, eax
lea rax, str.USB_drive_detected:__c:_n
mov rcx, rax
call sym.printf_1
mov eax, 1
jmp 0x14000338c
add dword [rbp - 4], 1
cmp dword [rbp - 4], 0x19
jle 0x140003325
mov eax, 0
add rsp, 0x30
pop rbp
ret

Function at 0x1400034a7
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rdi
sub rsp, 0x458
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], rcx
mov qword [rbp + 0x3f8], rdx
mov qword [rbp + 0x400], r8
mov qword [rbp + 0x408], r9
mov qword [rbp + 0x3c8], 0
mov qword [rbp - 0x40], 0
mov qword [rbp - 0x38], 0
lea rdx, [rbp - 0x30]
mov eax, 0
mov ecx, 0x7e
mov rdi, rdx
rep stosq qword [rdi], rax
mov dword [rbp - 0x44], 0x104
mov rax, qword [rbp + 0x3f8]
lea rdx, [rbp + 0x3c8]
mov qword [rsp + 0x20], rdx
mov r9d, 0x20019
mov r8d, 0
mov rdx, rax
mov rcx, qword [rbp + 0x3f0]
mov rax, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call rax
test eax, eax
jne 0x1400035c9
mov rax, qword [rbp + 0x3c8]
mov rdx, qword [rbp + 0x400]
lea rcx, [rbp - 0x44]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp - 0x40]
mov qword [rsp + 0x20], rcx
mov r9d, 0
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call rax
test eax, eax
jne 0x1400035b6
mov rdx, qword [rbp + 0x408]
lea rax, [rbp - 0x40]
mov rcx, rax
mov rax, qword [sym.imp.SHELL32.dll_StrStrIA]
call rax
test rax, rax
je 0x1400035b6
mov rax, qword [rbp + 0x3c8]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
mov eax, 1
jmp 0x1400035ce
mov rax, qword [rbp + 0x3c8]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
mov eax, 0
add rsp, 0x458
pop rdi
pop rbp
ret
Function at 0x1400038bf
Capabilities:
Check if process is running under wine

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
lea rax, str.kernel32.dll
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x1400038ec
mov eax, 0
jmp 0x140003914
mov rax, qword [rbp - 8]
lea rdx, str.wine_get_unix_file_name
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
test rax, rax
jne 0x14000390f
mov eax, 0
jmp 0x140003914
mov eax, 1
add rsp, 0x30
pop rbp
ret

Function at 0x14000391a
Capabilities:
Check if process is running under wine

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov dword [rbp - 4], 0
lea rax, str.SOFTWAREWine
mov qword [rbp - 0x18], rax
mov word [rbp - 0xa], 1
mov dword [rbp - 8], 0
jmp 0x14000398f
mov eax, dword [rbp - 8]
cdqe
mov rax, qword [rbp + rax*8 - 0x18]
mov rdx, rax
mov rcx, 0xffffffff80000001
call dbg.Is_RegKeyExists
test eax, eax
je 0x140003967
mov dword [rbp - 4], 1
mov eax, dword [rbp - 8]
cdqe
mov rax, qword [rbp + rax*8 - 0x18]
mov rdx, rax
mov rcx, 0xffffffff80000002
call dbg.Is_RegKeyExists
test eax, eax
je 0x14000398b
mov dword [rbp - 4], 1
add dword [rbp - 8], 1
movzx eax, word [rbp - 0xa]
cmp dword [rbp - 8], eax
jl 0x140003943
mov eax, dword [rbp - 4]
add rsp, 0x40
pop rbp
ret
Function at 0x140004c11
Capabilities:
Enumerate processes

Disassembly:
push rbp
sub rsp, 0x160
lea rbp, [rsp + 0x80]
mov dword [rbp + 0xdc], 0
mov edx, 0
mov ecx, 2
call sym.CreateToolhelp32Snapshot
mov qword [rbp + 0xd0], rax
cmp qword [rbp + 0xd0], 0xffffffffffffffff
je 0x140004c6b
mov dword [rbp - 0x60], 0x130
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd0]
mov rcx, rax
call sym.Process32First
test eax, eax
jne 0x140004c92
jmp 0x140004c75
mov eax, 0
jmp 0x140004e24
mov rax, qword [rbp + 0xd0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
jmp 0x140004e24
lea rax, [rbp - 0x60]
add rax, 0x2c
lea rdx, str.vboxservice.exe
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_lstrcmpiA]
call rax
test eax, eax
jne 0x140004cbb
mov dword [rbp + 0xdc], 1
lea rax, [rbp - 0x60]
add rax, 0x2c
lea rdx, str.vboxtray.exe
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_lstrcmpiA]
call rax
test eax, eax
jne 0x140004ce4
mov dword [rbp + 0xdc], 1
lea rax, [rbp - 0x60]
add rax, 0x2c
lea rdx, str.VGAuthService.exe
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_lstrcmpiA]
call rax
test eax, eax
jne 0x140004d0d
mov dword [rbp + 0xdc], 1
lea rax, [rbp - 0x60]
add rax, 0x2c
lea rdx, str.Vmacthlp.exe
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_lstrcmpiA]
call rax
test eax, eax
jne 0x140004d36
mov dword [rbp + 0xdc], 1
lea rax, [rbp - 0x60]
add rax, 0x2c
lea rdx, str.VMtoolsd.exe
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_lstrcmpiA]
call rax
test eax, eax
jne 0x140004d5f
mov dword [rbp + 0xdc], 1
lea rax, [rbp - 0x60]
add rax, 0x2c
lea rdx, str.VMwaretrat.exe
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_lstrcmpiA]
call rax
test eax, eax
jne 0x140004d88
mov dword [rbp + 0xdc], 1
lea rax, [rbp - 0x60]
add rax, 0x2c
lea rdx, str.VMwareUser.exe
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_lstrcmpiA]
call rax
test eax, eax
jne 0x140004db1
mov dword [rbp + 0xdc], 1
lea rax, [rbp - 0x60]
add rax, 0x2c
lea rdx, str.VMwareService.exe
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_lstrcmpiA]
call rax
test eax, eax
jne 0x140004dda
mov dword [rbp + 0xdc], 1
lea rax, [rbp - 0x60]
add rax, 0x2c
lea rdx, str.VMwareTray.exe
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_lstrcmpiA]
call rax
test eax, eax
jne 0x140004e03
mov dword [rbp + 0xdc], 1
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd0]
mov rcx, rax
call sym.Process32Next
test eax, eax
jne 0x140004c92
mov eax, dword [rbp + 0xdc]
add rsp, 0x160
pop rbp
ret
Function at 0x1400050e5
Capabilities:
Enumerate process modules

Disassembly:
push rbp
mov eax, 0x1040
call fcn.140011910
sub rsp, rax
lea rbp, [rsp + 0x80]
lea rdx, [rbp - 0x54]
lea rax, [rbp - 0x50]
mov r8, rdx
mov edx, 0x1000
mov rcx, rax
call sym.K32EnumProcesses
test eax, eax
jne 0x14000511e
mov eax, 1
jmp 0x140005182
mov eax, dword [rbp - 0x54]
shr eax, 2
mov dword [rbp + 0xfb4], eax
mov dword [rbp + 0xfb8], 0
jmp 0x14000516b
mov eax, dword [rbp + 0xfb8]
mov eax, dword [rbp + rax*4 - 0x50]
test eax, eax
je 0x140005164
mov eax, dword [rbp + 0xfb8]
mov eax, dword [rbp + rax*4 - 0x50]
mov ecx, eax
call dbg.checkProcessName
mov dword [rbp + 0xfbc], eax
cmp dword [rbp + 0xfbc], 0
jne 0x14000517b
add dword [rbp + 0xfb8], 1
mov eax, dword [rbp + 0xfb8]
cmp eax, dword [rbp + 0xfb4]
jb 0x140005136
jmp 0x14000517c
nop
mov eax, dword [rbp + 0xfbc]
add rsp, 0x1040
pop rbp
ret

Function at 0x140005655
Capabilities:
Link many functions at runtime

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
lea rax, [0x140041e4c]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
call rax
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
lea rdx, [0x140041e56]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov rdx, qword [0x140047100]
mov qword [rdx], rax
mov rax, qword [rbp - 8]
lea rdx, str.NtCreateFile
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [0x14004f050], rax
mov rax, qword [rbp - 8]
lea rdx, str.NtCreateEvent
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [0x14004f058], rax
mov rax, qword [rbp - 8]
lea rdx, str.NtQueryDirectoryFile
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [0x14004f060], rax
mov rax, qword [rbp - 8]
lea rdx, str.NtWaitForSingleObject
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [0x14004f068], rax
mov rax, qword [rbp - 8]
lea rdx, str.RtlUnicodeStringToAnsiString
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [0x14004f070], rax
mov rax, qword [rbp - 8]
lea rdx, str.NtClose
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [0x14004f078], rax
mov rax, qword [rbp - 8]
lea rdx, str.NtOpenFile
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [0x14004f080], rax
mov rax, qword [rbp - 8]
lea rdx, str.NtQueryAttributesFile
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [0x14004f088], rax
nop
add rsp, 0x30
pop rbp
ret
Function at 0x1400064c9
Capabilities:
Get process image filename

Disassembly:
push rbp
sub rsp, 0x220
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x194], 0x1f4
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov rcx, rax
mov edx, dword [rbp + 0x194]
lea rax, [rbp - 0x60]
mov r8d, edx
mov rdx, rax
call sym.K32GetProcessImageFileNameA
lea rax, [rbp - 0x60]
mov rcx, rax
call sym.puts
mov qword [rbp + 0x198], 0
jmp 0x140006556
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0x198]
add rax, rdx
movzx eax, byte [rax]
movsx eax, al
mov ecx, eax
mov rax, qword [sym.imp.msvcrt.dll_toupper]
call rax
mov edx, eax
lea rcx, [rbp - 0x60]
mov rax, qword [rbp + 0x198]
add rax, rcx
mov byte [rax], dl
add qword [rbp + 0x198], 1
lea rax, [rbp - 0x60]
mov rcx, rax
call sym.strlen
cmp qword [rbp + 0x198], rax
jb 0x14000651d
lea rax, [rbp - 0x60]
lea rdx, str.SAMPLE
mov rcx, rax
call sym.strstr
test rax, rax
je 0x14000658a
mov eax, 1
jmp 0x1400065cd
lea rax, [rbp - 0x60]
lea rdx, str.VIRUS
mov rcx, rax
call sym.strstr
test rax, rax
je 0x1400065a9
mov eax, 1
jmp 0x1400065cd
lea rax, [rbp - 0x60]
lea rdx, str.SANDBOX
mov rcx, rax
call sym.strstr
test rax, rax
je 0x1400065c8
mov eax, 1
jmp 0x1400065cd
mov eax, 0
add rsp, 0x220
pop rbp
ret
Function at 0x140006b32
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push rbp
sub rsp, 0x7d0
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x74c], 0
lea rax, [rbp + 0x530]
mov qword [rsp + 0x20], rax
mov r9d, 0
mov r8d, 0
mov edx, 8
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
call rax
test eax, eax
js 0x140006ce4
lea rdx, [rbp + 0x530]
lea rax, [rbp + 0xd0]
mov r8, rdx
mov edx, 0x104
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll_wcscpy_s]
call rax
lea rax, [rbp + 0xd0]
lea r8, [0x140042d78]
mov edx, 0x104
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll_wcscat_s]
call rax
lea rdx, [rbp + 0x2e0]
lea rax, [rbp + 0xd0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FindFirstFileW]
call rax
mov qword [rbp + 0x740], rax
cmp qword [rbp + 0x740], 0xffffffffffffffff
je 0x140006cd4
lea rax, [rbp + 0x2e0]
lea rdx, [rax + 0x2c]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x104
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
mov r8, rdx
mov edx, 0
mov ecx, 0xfde9
mov rax, qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
call rax
mov eax, dword [rbp + 0x2e0]
and eax, 0x10
test eax, eax
jne 0x140006c9e
lea rax, [rbp - 0x40]
mov rcx, rax
call dbg.removeExtension
lea rax, [rbp - 0x40]
mov rcx, rax
call dbg.isBlacklisted
test eax, eax
je 0x140006c7f
lea rax, [rbp - 0x40]
mov rdx, rax
lea rax, str.Blacklisted_file:__s_n
mov rcx, rax
call sym.printf_4
mov eax, 1
jmp 0x140006ce9
lea rax, [rbp - 0x40]
mov rdx, rax
lea rax, str.Not_blacklisted_file:__s_n
mov rcx, rax
call sym.printf_4
add dword [rbp + 0x74c], 1
jmp 0x140006c9f
nop
lea rdx, [rbp + 0x2e0]
mov rax, qword [rbp + 0x740]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FindNextFileW]
call rax
test eax, eax
jne 0x140006bef
mov rax, qword [rbp + 0x740]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FindClose]
call rax
cmp dword [rbp + 0x74c], 4
jg 0x140006ce4
mov eax, 1
jmp 0x140006ce9
mov eax, 0
add rsp, 0x7d0
pop rbp
ret
Function at 0x140006cf2
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push rbp
sub rsp, 0x7d0
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x74c], 0
lea rax, [rbp + 0x530]
mov qword [rsp + 0x20], rax
mov r9d, 0
mov r8d, 0
mov edx, 0xa
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
call rax
test eax, eax
js 0x140006e6b
lea rdx, [rbp + 0x530]
lea rax, [rbp + 0xd0]
mov r8, rdx
mov edx, 0x104
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll_wcscpy_s]
call rax
lea rax, [rbp + 0xd0]
lea r8, [0x140042d78]
mov edx, 0x104
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll_wcscat_s]
call rax
lea rdx, [rbp + 0x2e0]
lea rax, [rbp + 0xd0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FindFirstFileW]
call rax
mov qword [rbp + 0x740], rax
cmp qword [rbp + 0x740], 0xffffffffffffffff
je 0x140006e5b
lea rax, [rbp + 0x2e0]
lea rdx, [rax + 0x2c]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x104
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
mov r8, rdx
mov edx, 0
mov ecx, 0xfde9
mov rax, qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
call rax
mov eax, dword [rbp + 0x2e0]
and eax, 0x10
test eax, eax
jne 0x140006e25
lea rax, [rbp - 0x40]
mov rdx, rax
lea rax, str.Trashed_file:__s_n
mov rcx, rax
call sym.printf_4
add dword [rbp + 0x74c], 1
jmp 0x140006e26
nop
lea rdx, [rbp + 0x2e0]
mov rax, qword [rbp + 0x740]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FindNextFileW]
call rax
test eax, eax
jne 0x140006daf
mov rax, qword [rbp + 0x740]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FindClose]
call rax
cmp dword [rbp + 0x74c], 0x63
jg 0x140006e6b
mov eax, 1
jmp 0x140006e70
mov eax, 0
add rsp, 0x7d0
pop rbp
ret
Function at 0x1400077b2
Capabilities:
Enumerate processes

Disassembly:
push rbp
push rdi
sub rsp, 0x168
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x100], ecx
mov dword [rbp + 0xdc], 0
mov edx, 0
mov ecx, 2
call sym.CreateToolhelp32Snapshot
mov qword [rbp + 0xd0], rax
lea rdx, [rbp - 0x60]
mov eax, 0
mov ecx, 0x26
mov rdi, rdx
rep stosq qword [rdi], rax
mov dword [rbp - 0x60], 0x130
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd0]
mov rcx, rax
call sym.Process32First
test eax, eax
je 0x140007846
mov eax, dword [rbp - 0x58]
cmp dword [rbp + 0x100], eax
jne 0x14000782f
mov eax, dword [rbp - 0x40]
mov dword [rbp + 0xdc], eax
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd0]
mov rcx, rax
call sym.Process32Next
test eax, eax
jne 0x14000781b
mov rax, qword [rbp + 0xd0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, dword [rbp + 0xdc]
add rsp, 0x168
pop rdi
pop rbp
ret

Function at 0x1400078b9
Capabilities:
Accept command line arguments
Check mutex on windows
Create process on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xf0
lea rax, str.SelfDebugMutex
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
mov r8, rax
mov edx, 1
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateMutexA]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
cmp eax, 0xb7
jne 0x14000790c
call dbg.child_process
mov eax, 0
jmp 0x1400079f0
mov dword [rbp - 0x34], 0
lea rax, [rbp - 0x30]
mov r8d, 0x18
mov edx, 0
mov rcx, rax
call sym.memset
lea rax, [rbp - 0xa0]
mov r8d, 0x68
mov edx, 0
mov rcx, rax
call sym.memset
lea rax, [rbp - 0xa0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call rax
mov rax, qword [sym.imp.KERNEL32.dll_GetCommandLineA]
call rax
mov rdx, rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0xa0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
mov rax, qword [rbp - 0x30]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [rbp - 0x30]
lea rdx, [rbp - 0x34]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
call rax
mov eax, dword [rbp - 0x34]
test eax, eax
je 0x1400079eb
mov eax, 1
jmp 0x1400079f0
mov eax, 0
add rsp, 0xf0
pop rbp
ret

Function at 0x1400079f9
Capabilities:
Check for sandbox and av modules

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov word [rbp - 6], 0xe
mov dword [rbp - 4], 0
jmp 0x140007a59
mov eax, dword [rbp - 4]
cdqe
lea rdx, [rax*8]
lea rax, str.sbiedll.dll
mov rax, qword [rdx + rax]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
je 0x140007a55
lea rax, str.found_blacklisted_module
mov rcx, rax
call sym.printf_5
mov eax, 1
jmp 0x140007a67
add dword [rbp - 4], 1
movzx eax, word [rbp - 6]
cmp dword [rbp - 4], eax
jl 0x140007a10
mov eax, 0
add rsp, 0x30
pop rbp
ret
Function at 0x140007cfd
Capabilities:
Enumerate processes

Disassembly:
push rbp
sub rsp, 0x160
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xf0], rcx
mov qword [rbp + 0xd8], 0
lea rax, [rbp - 0x60]
mov r8d, 0x130
mov edx, 0
mov rcx, rax
call sym.memset
mov edx, 0
mov ecx, 2
call sym.CreateToolhelp32Snapshot
mov qword [rbp + 0xd8], rax
cmp qword [rbp + 0xd8], 0xffffffffffffffff
jne 0x140007d60
mov eax, 0
jmp 0x140007e38
mov dword [rbp - 0x60], 0x130
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd8]
mov rcx, rax
call sym.Process32First
test eax, eax
jne 0x140007d9b
mov rax, qword [rbp + 0xd8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
jmp 0x140007e38
lea rax, [rbp - 0x60]
add rax, 0x2c
mov rdx, qword [rbp + 0xf0]
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll__stricmp]
call rax
test eax, eax
jne 0x140007e09
mov rax, qword [rbp + 0xd8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, dword [rbp - 0x58]
jmp 0x140007e38
lea rax, [rbp - 0x60]
add rax, 0x2c
mov rdx, qword [rbp + 0xf0]
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll__stricmp]
call rax
test eax, eax
jne 0x140007e09
mov rax, qword [rbp + 0xd8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, dword [rbp - 0x58]
jmp 0x140007e38
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd8]
mov rcx, rax
call sym.Process32Next
test eax, eax
jne 0x140007dd2
mov rax, qword [rbp + 0xd8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
add rsp, 0x160
pop rbp
ret
Function at 0x140007fc5
Capabilities:
Check for sandbox username or hostname
Get hostname

Disassembly:
push rbp
sub rsp, 0x160
lea rbp, [rsp + 0x80]
mov dword [rbp + 0xdc], 0
lea rax, str.vbox
mov qword [rbp + 0xb0], rax
lea rax, [0x1400430e4]
mov qword [rbp + 0xb8], rax
lea rax, str.virtual
mov qword [rbp + 0xc0], rax
lea rax, str.sandbox
mov qword [rbp + 0xc8], rax
lea rax, str.HAL9TH
mov qword [rbp + 0xd8], rax
mov qword [rbp - 0x50], 0
mov qword [rbp - 0x48], 0
mov qword [rbp - 0x40], 0
mov qword [rbp - 0x38], 0
mov qword [rbp - 0x30], 0
mov qword [rbp - 0x28], 0
mov qword [rbp - 0x20], 0
mov qword [rbp - 0x18], 0
mov qword [rbp - 0x10], 0
mov qword [rbp - 8], 0
mov qword [rbp], 0
mov qword [rbp + 8], 0
mov qword [rbp + 0x10], 0
mov qword [rbp + 0x18], 0
mov qword [rbp + 0x20], 0
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x78], 0
mov qword [rbp + 0x80], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0x90], 0
mov qword [rbp + 0x98], 0
mov qword [rbp + 0xa0], 0
mov qword [rbp + 0xa8], 0
mov dword [rbp - 0x54], 0x100
lea rdx, [rbp - 0x54]
lea rax, [rbp - 0x50]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetComputerNameA]
call rax
test eax, eax
je 0x140008190
jmp 0x140008187
mov eax, dword [rbp + 0xdc]
cdqe
mov rdx, qword [rbp + rax*8 + 0xb0]
lea rax, [rbp - 0x50]
mov rcx, rax
call sym.strstr
test rax, rax
je 0x140008180
mov eax, 1
jmp 0x140008195
add dword [rbp + 0xdc], 1
cmp dword [rbp + 0xdc], 4
jle 0x140008158
mov eax, 0
add rsp, 0x160
pop rbp
ret
Function at 0x14000819e
Capabilities:
Check for sandbox username or hostname
Get session user name

Disassembly:
push rbp
mov eax, 0x8100
call fcn.140011910
sub rsp, rax
lea rbp, [rsp + 0x80]
lea rax, str.admin
mov qword [rbp + 0x7fb0], rax
lea rax, str.andy
mov qword [rbp + 0x7fb8], rax
lea rax, str.honey
mov qword [rbp + 0x7fc0], rax
lea rax, str.john
mov qword [rbp + 0x7fc8], rax
lea rax, str.john_doe
mov qword [rbp + 0x7fd0], rax
lea rax, str.malnetvm
mov qword [rbp + 0x7fd8], rax
lea rax, str.maltest
mov qword [rbp + 0x7fe0], rax
lea rax, str.malware
mov qword [rbp + 0x7fe8], rax
lea rax, [0x140043136]
mov qword [rbp + 0x7ff0], rax
lea rax, str.sandbox
mov qword [rbp + 0x7ff8], rax
lea rax, str.snort
mov qword [rbp + 0x8000], rax
lea rax, str.tequilaboomboom
mov qword [rbp + 0x8008], rax
lea rax, str.test
mov qword [rbp + 0x8010], rax
lea rax, str.virus
mov qword [rbp + 0x8018], rax
lea rax, str.virusclone
mov qword [rbp + 0x8020], rax
lea rax, str.wilbert
mov qword [rbp + 0x8028], rax
lea rax, str.nepenthes
mov qword [rbp + 0x8030], rax
lea rax, str.currentuser
mov qword [rbp + 0x8038], rax
lea rax, str.username
mov qword [rbp + 0x8040], rax
lea rax, str.vmware
mov qword [rbp + 0x8048], rax
lea rax, str.user
mov qword [rbp + 0x8050], rax
lea rax, str.mike
mov qword [rbp + 0x8058], rax
lea rax, str.louise
mov qword [rbp + 0x8060], rax
lea rax, str.j.seance
mov qword [rbp + 0x8068], rax
mov dword [rbp - 0x54], 0x7fff
lea rdx, [rbp - 0x54]
lea rax, [rbp - 0x50]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_GetUserNameA]
call rax
mov dword [rbp + 0x807c], 0
jmp 0x14000838d
mov eax, dword [rbp + 0x807c]
cdqe
mov rdx, qword [rbp + rax*8 + 0x7fb0]
lea rax, [rbp - 0x50]
mov r8, 0xffffffffffffffff
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll__strnicmp]
call rax
test eax, eax
jne 0x140008386
mov eax, dword [rbp + 0x807c]
cdqe
mov rdx, qword [rbp + rax*8 + 0x7fb0]
lea rax, [rbp - 0x50]
mov r8, rdx
mov rdx, rax
lea rax, str._nComputer_name:_s_Username__s_n
mov rcx, rax
call sym.printf_7
mov eax, 1
jmp 0x14000839b
add dword [rbp + 0x807c], 1
cmp dword [rbp + 0x807c], 0x17
jle 0x14000832b
mov eax, 0
add rsp, 0x8100
pop rbp
ret

Function at 0x1400083a4
Capabilities:
Get system information on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
lea rax, [rbp - 0x30]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call rax
mov eax, dword [rbp - 0x10]
cmp eax, 1
setbe al
movzx eax, al
add rsp, 0x50
pop rbp
ret

Function at 0x1400083ec
Capabilities:
Enumerate gui resources

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov edx, 0
lea rax, [dbg.EnumWindowsProc]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_EnumWindows]
call rax
mov eax, dword [0x14004f0a0]
mov edx, eax
lea rax, str.total_windows_found:__d_n
mov rcx, rax
call sym.printf_7
mov eax, dword [0x14004f0a0]
cmp eax, 0xb
setle al
movzx eax, al
add rsp, 0x20
pop rbp
ret