joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6deca0
Capabilities:
Log keystrokes via application hook

Disassembly:
push rbp
sub rsp, 0xc0
mov rbp, rsp
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x78], rbp
mov qword [rbp + 0xd0], rcx
nop
mov rax, qword [rbp + 0xd0]
mov rcx, qword [rax + 0x368]
call fcn.0040feb0
mov rcx, rax
xor rdx, rdx
xor r8, r8
mov r9d, 0x2000000
call sub.user32.dll_OpenDesktopW
mov qword [rbp + 0xb8], rax
cmp qword [rbp + 0xb8], 0
jne 0x6ded8d
call sub.kernel32.dll_GetLastError_2
mov dword [rbp + 0xb4], eax
lea rcx, [rbp + 0x68]
mov edx, dword [rbp + 0xb4]
call fcn.00435d20
lea rcx, [rbp + 0x70]
mov edx, 4
lea r8, [0x006df004]
mov rax, qword [rbp + 0xd0]
mov r9, qword [rax + 0x368]
lea rax, [0x006df040]
mov qword [rsp + 0x20], rax
mov rax, qword [rbp + 0x68]
mov qword [rsp + 0x28], rax
call fcn.00410420
mov cx, 1
mov rdx, qword [rbp + 0x70]
call fcn.0047cfa0
jmp 0x6def37
nop
mov rcx, qword [rbp + 0xb8]
call sub.user32.dll_SetThreadDesktop
test eax, eax
setne al
test al, al
jne 0x6dee2c
call sub.kernel32.dll_GetLastError_2
mov dword [rbp + 0xb4], eax
call fcn.0047d380
lea rcx, [rbp + 0x58]
mov edx, eax
call fcn.0042bdf0
lea rcx, [rbp + 0x50]
mov edx, dword [rbp + 0xb4]
call fcn.00435d20
lea rcx, [rbp + 0x60]
mov edx, 6
lea r8, [0x006df050]
mov r9, qword [rbp + 0x58]
lea rax, [0x006df0a4]
mov qword [rsp + 0x20], rax
mov rax, qword [rbp + 0xd0]
mov rax, qword [rax + 0x368]
mov qword [rsp + 0x28], rax
lea rax, [0x006df040]
mov qword [rsp + 0x30], rax
mov rax, qword [rbp + 0x50]
mov qword [rsp + 0x38], rax
call fcn.00410420
mov cx, 1
mov rdx, qword [rbp + 0x60]
call fcn.0047cfa0
mov rax, qword [0x00a8dbf0]
cmp byte [rax], 0
jne 0x6deec1
mov ecx, 0xd
mov rax, qword [rbp + 0xd0]
mov rdx, qword [rax + 0x348]
mov r8, qword [0x00a93d68]
xor r9, r9
call sub.user32.dll_SetWindowsHookExW
mov rcx, qword [rbp + 0xd0]
mov qword [rcx + 8], rax
mov rax, qword [rbp + 0xd0]
cmp qword [rax + 8], 0
jne 0x6deed0
call sub.kernel32.dll_GetLastError_2
mov dword [rbp + 0xb4], eax
lea rcx, [rbp + 0x40]
mov edx, dword [rbp + 0xb4]
call fcn.00435d20
lea rcx, [rbp + 0x48]
lea rdx, [0x006df0b8]
mov r8, qword [rbp + 0x40]
call fcn.004102f0
mov cx, 2
mov rdx, qword [rbp + 0x48]
call fcn.0047cfa0
xor rcx, rcx
mov rdx, qword [rbp + 0x78]
call fcn.006defa0
jmp 0x6def37
mov rax, qword [rbp + 0xd0]
mov qword [rax + 8], 0
nop
jmp 0x6deeeb
lea rcx, [rbp + 0x80]
call sub.user32.dll_TranslateMessage
lea rcx, [rbp + 0x80]
call sub.user32.dll_DispatchMessageW
lea rcx, [rbp + 0x80]
xor rdx, rdx
xor r8, r8
xor r9, r9
call sub.user32.dll_GetMessageW
test eax, eax
setne al
cmp al, 1
je 0x6deed3
nop
mov rax, qword [rbp + 0xd0]
cmp qword [rax + 8], 0
je 0x6def29
mov rax, qword [rbp + 0xd0]
mov rcx, qword [rax + 8]
call sub.user32.dll_UnhookWindowsHookEx
nop
mov rcx, qword [rbp + 0xb8]
call sub.user32.dll_CloseDesktop
nop
lea rcx, [rbp + 0x40]
mov edx, 7
call fcn.0040e160
lea rsp, [rbp + 0xc0]
pop rbp
ret
Function at 0x6e0bd0
Capabilities:
Enumerate process modules

Disassembly:
push rbp
push rbx
sub rsp, 0x538
mov rbp, rsp
mov qword [rbp + 0xd0], 0
mov qword [rbp + 0x38], rbp
mov qword [rbp + 0x550], rcx
mov dword [rbp + 0x558], edx
mov qword [rbp + 0x560], r8
nop
cmp qword [0x009bae48], 0
je 0x6e0da3
cmp qword [0x009bae50], 0
je 0x6e0da3
cmp qword [0x009bae58], 0
je 0x6e0da3
mov rcx, qword [rbp + 0x550]
xor rdx, rdx
xor r8, r8
lea r9, [rbp + 0xcc]
mov dword [rsp + 0x20], 3
call qword [0x009bae48]
test eax, eax
setne al
cmp al, 1
jne 0x6e0d93
lea rcx, [rbp + 0xd0]
mov r8, qword [0x006e0b90]
mov r9d, 1
mov r10d, 8
mov eax, dword [rbp + 0xcc]
xor edx, edx
div r10d
mov eax, eax
mov rdx, r8
mov r8, r9
mov r9, rax
call fcn.00411ea0
mov rcx, qword [rbp + 0x550]
mov rdx, qword [rbp + 0xd0]
mov r8d, dword [rbp + 0xcc]
lea r9, [rbp + 0xcc]
mov dword [rsp + 0x20], 3
call qword [0x009bae48]
test eax, eax
setne al
cmp al, 1
jne 0x6e0d93
xor rcx, rcx
mov r8d, 8
mov eax, dword [rbp + 0xcc]
xor edx, edx
div r8d
mov rbx, rax
sub ebx, 1
mov dword [rbp + 0xc8], ecx
cmp dword [rbp + 0xc8], ebx
jg 0x6e0d92
add ebx, 1
mov rcx, qword [rbp + 0x550]
mov rax, qword [rbp + 0xd0]
movsxd rdx, dword [rbp + 0xc8]
mov rdx, qword [rax + rdx*8]
lea r8, [rbp + 0x62]
mov r9d, 0x32
call qword [0x009bae50]
test eax, eax
jbe 0x6e0d7f
lea rcx, [rbp + 0x62]
mov rdx, qword [rbp + 0x560]
call sub.kernel32.dll_lstrcmpiW
test eax, eax
jne 0x6e0d7f
mov rcx, qword [rbp + 0x550]
mov rax, qword [rbp + 0xd0]
movsxd rdx, dword [rbp + 0xc8]
mov rdx, qword [rax + rdx*8]
lea r8, [rbp + 0x48]
mov r9d, 0x18
call qword [0x009bae58]
test eax, eax
setne al
cmp al, 1
jne 0x6e0d92
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0x518], rax
jmp 0x6e0e91
add dword [rbp + 0xc8], 1
cmp dword [rbp + 0xc8], ebx
jne 0x6e0cf9
nop
mov qword [rbp + 0x518], 0
jmp 0x6e0e91
mov ecx, 0x18
mov edx, dword [rbp + 0x558]
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov qword [rbp + 0x520], rax
cmp qword [rbp + 0x520], 0xffffffffffffffff
jne 0x6e0dd5
mov qword [rbp + 0x518], 0
jmp 0x6e0e91
nop
mov dword [rbp + 0xe0], 0x438
mov rcx, qword [rbp + 0x520]
lea rdx, [rbp + 0xe0]
call sub.kernel32.dll_Module32FirstW
test eax, eax
setne al
mov byte [rbp + 0xdf], al
cmp byte [rbp + 0xdf], 1
jne 0x6e0e61
mov rcx, qword [rbp + 0x560]
lea rdx, [rbp + 0x110]
call sub.kernel32.dll_lstrcmpiW
test eax, eax
jne 0x6e0e3a
mov rax, qword [rbp + 0x108]
mov qword [rbp + 0x518], rax
xor rcx, rcx
mov rdx, qword [rbp + 0x38]
call fcn.006e0ec0
jmp 0x6e0e91
mov rcx, qword [rbp + 0x520]
lea rdx, [rbp + 0xe0]
call sub.kernel32.dll_Module32NextW
test eax, eax
setne al
mov byte [rbp + 0xdf], al
cmp byte [rbp + 0xdf], 1
je 0x6e0e07
nop
mov qword [rbp + 0x518], 0
nop
call sub.kernel32.dll_GetLastError_2
mov dword [rbp + 0x52c], eax
mov rcx, qword [rbp + 0x520]
call sub.kernel32.dll_CloseHandle_1
mov ecx, dword [rbp + 0x52c]
call sub.kernel32.dll_SetLastError
nop
lea rcx, [rbp + 0xd0]
mov rdx, qword [0x006e0b90]
call fcn.00412080
mov rax, qword [rbp + 0x518]
lea rsp, [rbp + 0x538]
pop rbx
pop rbp
ret
Function at 0x6e1370
Capabilities:
Resume thread

Disassembly:
push rbp
push rbx
sub rsp, 0x68
mov rbp, rsp
mov dword [rbp + 0x48], edx
mov qword [rbp + 0x40], r8
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x80], rcx
mov rcx, qword [rbp + 0x80]
call fcn.0040e210
nop
lea rcx, [rbp + 0x50]
mov rdx, qword [rbp + 0x80]
call fcn.006e0ac0
mov rcx, qword [rbp + 0x50]
call fcn.0040feb0
mov rcx, qword [rbp + 0x40]
mov edx, dword [rbp + 0x48]
mov r8, rax
call fcn.006e0bd0
mov rbx, rax
test rbx, rbx
jne 0x6e13d9
call sub.kernel32.dll_GetLastError_2
mov dword [rbp + 0x4c], eax
jmp 0x6e1489
mov rcx, qword [rbp + 0x40]
mov edx, dword [rbp + 0x48]
lea r8, [0x006e14ec]
call fcn.006e0bd0
test rax, rax
jne 0x6e13fe
call sub.kernel32.dll_GetLastError_2
mov dword [rbp + 0x4c], eax
jmp 0x6e1489
mov rcx, qword [rbp + 0x40]
mov rdx, rax
lea r8, [0x006e1506]
call fcn.006e0770
test rax, rax
jne 0x6e1420
call sub.kernel32.dll_GetLastError_2
mov dword [rbp + 0x4c], eax
jmp 0x6e1489
mov rcx, qword [rbp + 0x40]
xor rdx, rdx
xor r8, r8
mov r9, rax
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x5c]
mov qword [rsp + 0x30], rax
call qword [0x009bae40]
mov rbx, rax
test rbx, rbx
jne 0x6e145b
call sub.kernel32.dll_GetLastError_2
mov dword [rbp + 0x4c], eax
jmp 0x6e1489
cmp qword [0x009bae60], 0
je 0x6e147a
mov rcx, rbx
mov edx, 0x11
xor r8, r8
xor r9, r9
call qword [0x009bae60]
mov rcx, rbx
call sub.kernel32.dll_ResumeThread
xor rax, rax
mov dword [rbp + 0x4c], eax
nop
lea rcx, [rbp + 0x50]
call fcn.0040e080
lea rcx, [rbp + 0x80]
call fcn.0040e080
mov eax, dword [rbp + 0x4c]
lea rsp, [rbp + 0x68]
pop rbx
pop rbp
ret
Function at 0x6e1a00
Capabilities:
Acquire debug privileges

Disassembly:
push rbp
push rbx
sub rsp, 0x38
mov rbp, rsp
mov qword [rbp + 0x28], rbp
mov qword [rbp + 0x50], rcx
mov byte [rbp + 0x58], dl
cmp byte [rbp + 0x58], 0
je 0x6e1a2c
mov rcx, qword [rbp + 0x50]
movzx rdx, byte [rbp + 0x58]
call fcn.0040b750
mov qword [rbp + 0x50], rax
nop
mov rcx, qword [rbp + 0x50]
xor rdx, rdx
call fcn.0040ad50
call fcn.0047d380
mov rcx, qword [rbp + 0x50]
mov dword [rcx + 0x20], eax
mov rax, qword [rbp + 0x50]
mov qword [rax + 0x10], 0
call fcn.0047d3e0
mov rcx, qword [rbp + 0x50]
mov byte [rcx + 0x24], al
mov rcx, qword [0x00457e40]
mov dl, 1
call fcn.0040ad50
mov rcx, qword [rbp + 0x50]
mov qword [rcx + 0x28], rax
mov rcx, qword [0x0045caf0]
mov dl, 1
call fcn.0046e750
mov rcx, qword [rbp + 0x50]
mov qword [rcx + 0x70], rax
mov rax, qword [rbp + 0x50]
mov dword [rax + 0x50], 0x3e8
mov rax, qword [rbp + 0x50]
mov dword [rax + 0x54], 0x3e8
mov rax, qword [rbp + 0x50]
mov byte [rax + 0x58], 1
mov rax, qword [rbp + 0x50]
mov byte [rax + 0x59], 1
mov rax, qword [rbp + 0x50]
mov byte [rax + 0x5a], 0
mov rax, qword [rbp + 0x50]
mov dword [rax + 0x38], 0x4000
mov rax, qword [rbp + 0x50]
mov ecx, dword [rax + 0x38]
call fcn.00405da0
mov rcx, qword [rbp + 0x50]
mov qword [rcx + 0x30], rax
call sub.kernel32.dll_GetCurrentProcess
mov rcx, rax
lea rdx, [0x006e1b5c]
mov r8b, 1
call fcn.0068f770
cmp byte [rbp + 0x58], 0
je 0x6e1b30
mov rcx, qword [rbp + 0x50]
call fcn.0040b790
mov qword [rbp + 0x50], rax
jmp 0x6e1b30
mov rax, qword [rbp + 0x50]
lea rsp, [rbp + 0x38]
pop rbx
pop rbp
ret
Function at 0x6e4470
Capabilities:
Get graphical window text

Disassembly:
push rbp
sub rsp, 0x70
mov rbp, rsp
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x38], rbp
mov qword [rbp + 0x80], rcx
nop
nop
lea rcx, [0x006e46a0]
xor rdx, rdx
call sub.user32.dll_FindWindowW
mov qword [rbp + 0x60], rax
cmp qword [rbp + 0x60], 0
je 0x6e460a
lea rcx, [rbp + 0x58]
mov edx, 0x400
call fcn.00410140
mov rcx, qword [rbp + 0x58]
call fcn.0040feb0
mov rcx, qword [rbp + 0x60]
mov rdx, rax
mov r8d, 0x400
call sub.user32.dll_GetWindowTextW
mov dword [rbp + 0x4c], eax
cmp dword [rbp + 0x4c], 1
jl 0x6e460a
lea rcx, [rbp + 0x58]
mov edx, dword [rbp + 0x4c]
call fcn.00410140
mov rax, qword [rbp + 0x80]
mov rcx, qword [rax + 0x230]
mov rdx, qword [rbp + 0x58]
call fcn.004104f0
test eax, eax
je 0x6e4609
lea rcx, [0x006e46ce]
xor rdx, rdx
call sub.user32.dll_FindWindowW
mov qword [rbp + 0x60], rax
cmp qword [rbp + 0x60], 0
je 0x6e458b
lea rcx, [rbp + 0x50]
mov edx, 0x400
call fcn.00410140
mov rcx, qword [rbp + 0x50]
call fcn.0040feb0
mov rcx, qword [rbp + 0x60]
mov rdx, rax
mov r8d, 0x400
call sub.user32.dll_GetWindowTextW
mov dword [rbp + 0x4c], eax
cmp dword [rbp + 0x4c], 1
jle 0x6e4582
lea rcx, [rbp + 0x50]
mov edx, dword [rbp + 0x4c]
call fcn.00410140
jmp 0x6e458b
lea rcx, [rbp + 0x50]
call fcn.0040e080
mov rcx, qword [rbp + 0x60]
lea rdx, [rbp + 0x48]
call sub.user32.dll_GetWindowThreadProcessId
lea rcx, [rbp + 0x30]
mov rdx, qword [rbp + 0x58]
call fcn.00414550
mov rcx, qword [rbp + 0x80]
mov rdx, qword [rbp + 0x30]
mov r8, qword [rbp + 0x50]
mov r9d, dword [rbp + 0x48]
call fcn.006e4230
mov rcx, qword [rbp + 0x80]
add rcx, 0x230
mov rdx, qword [rbp + 0x58]
call fcn.0040e6f0
jmp 0x6e4609
nop
lea rcx, [rbp + 0x28]
call fcn.0040e080
lea rcx, [rbp + 0x30]
call fcn.0040e0d0
lea rcx, [rbp + 0x50]
mov edx, 2
call fcn.0040e160
lea rsp, [rbp + 0x70]
pop rbp
ret
Function at 0x6e7b30
Capabilities:
Acquire debug privileges

Disassembly:
push rbp
sub rsp, 0xa0
mov rbp, rsp
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x58], rbp
mov dword [rbp + 0xb0], ecx
nop
mov dword [rbp + 0x8c], 0
lea rcx, [0x006e7e08]
call sub.kernel32.dll_LoadLibraryW
mov rcx, rax
lea rdx, [0x006e7e1c]
call sub.kernel32.dll_GetProcAddress_2
mov qword [rbp + 0x80], rax
cmp qword [rbp + 0x80], 0
jne 0x6e7be6
call sub.kernel32.dll_GetLastError_2
mov dword [rbp + 0x70], eax
lea rcx, [rbp + 0x48]
mov edx, dword [rbp + 0x70]
call fcn.00435d20
lea rcx, [rbp + 0x50]
lea rdx, [0x006e7e44]
mov r8, qword [rbp + 0x48]
call fcn.004102f0
mov cx, 1
mov rdx, qword [rbp + 0x50]
call fcn.0047cfa0
jmp 0x6e7d8e
mov dword [rbp + 0x74], 0x4000
mov ecx, dword [rbp + 0x74]
call fcn.00405da0
mov qword [rbp + 0x78], rax
call sub.kernel32.dll_GetCurrentProcess
mov rcx, rax
lea rdx, [0x006e7e84]
mov r8b, 1
call fcn.0068f770
mov dword [rbp + 0x70], eax
cmp dword [rbp + 0x70], 0
je 0x6e7c4b
lea rcx, [rbp + 0x38]
mov edx, dword [rbp + 0x70]
call fcn.00435d20
lea rcx, [rbp + 0x40]
lea rdx, [0x006e7eb4]
mov r8, qword [rbp + 0x38]
call fcn.004102f0
mov cx, 1
mov rdx, qword [rbp + 0x40]
call fcn.0047cfa0
jmp 0x6e7d8e
mov ecx, 5
mov rdx, qword [rbp + 0x78]
mov r8d, dword [rbp + 0x74]
lea r9, [rbp + 0x6c]
call qword [rbp + 0x80]
mov dword [rbp + 0x88], eax
cmp dword [rbp + 0x88], 0xc0000004
jne 0x6e7cbc
mov rcx, qword [rbp + 0x78]
call fcn.00405dd0
mov eax, dword [rbp + 0x74]
add eax, eax
mov dword [rbp + 0x74], eax
mov ecx, dword [rbp + 0x74]
call fcn.00405da0
mov qword [rbp + 0x78], rax
mov ecx, 5
mov rdx, qword [rbp + 0x78]
mov r8d, dword [rbp + 0x74]
lea r9, [rbp + 0x6c]
call qword [rbp + 0x80]
mov dword [rbp + 0x88], eax
cmp dword [rbp + 0x88], 0xc0000004
je 0x6e7c75
nop
cmp dword [rbp + 0x88], 0
je 0x6e7d09
call sub.kernel32.dll_GetLastError_2
mov dword [rbp + 0x70], eax
lea rcx, [rbp + 0x28]
mov edx, dword [rbp + 0x70]
call fcn.00435d20
lea rcx, [rbp + 0x30]
lea rdx, [0x006e7f00]
mov r8, qword [rbp + 0x28]
call fcn.004102f0
mov cx, 1
mov rdx, qword [rbp + 0x30]
call fcn.0047cfa0
mov rcx, qword [rbp + 0x78]
call fcn.00405dd0
jmp 0x6e7d8e
mov qword [rbp + 0x98], 0
mov rax, qword [rbp + 0x78]
add rax, qword [rbp + 0x98]
mov qword [rbp + 0x90], rax
nop
mov rax, qword [rbp + 0x90]
mov ecx, dword [rbp + 0xb0]
cmp qword [rax + 0x50], rcx
je 0x6e7d48
xor rcx, rcx
mov rdx, qword [rbp + 0x58]
call fcn.006e7db0
jmp 0x6e7d77
mov rax, qword [rbp + 0x90]
mov eax, dword [rax + 0x58]
mov dword [rbp + 0x8c], eax
xor rcx, rcx
mov rdx, qword [rbp + 0x58]
call fcn.006e7db0
jmp 0x6e7d83
mov rax, qword [rbp + 0x90]
cmp dword [rax], 0
jne 0x6e7d14
nop
mov rcx, qword [rbp + 0x78]
call fcn.00405dd0
nop
lea rcx, [rbp + 0x28]
mov edx, 6
call fcn.0040e160
mov eax, dword [rbp + 0x8c]
lea rsp, [rbp + 0xa0]
pop rbp
ret
Function at 0x6ea630
Capabilities:
Create process on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x148
mov rbp, rsp
mov qword [rbp + 0x70], rdx
mov qword [rbp + 0x80], 0
mov qword [rbp + 0x78], 0
mov qword [rbp + 0x90], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0x98], 0
mov qword [rbp + 0xa8], 0
mov qword [rbp + 0xa0], 0
mov qword [rbp + 0x180], r8
mov rcx, qword [rbp + 0x180]
call fcn.0040e210
nop
xor rax, rax
mov qword [rbp + 0x68], rax
mov qword [rbp + 0xb8], 0
lea rcx, [rbp + 0xb8]
mov rdx, qword [rbp + 0x70]
or r8d, 0xffffffff
call sub.userenv.dll_CreateEnvironmentBlock
test eax, eax
setne al
test al, al
jne 0x6ea711
call sub.kernel32.dll_GetLastError_2
lea rcx, [rbp + 0xa0]
mov edx, eax
call fcn.00435d20
lea rcx, [rbp + 0xa8]
lea rdx, [0x006ea91c]
mov r8, qword [rbp + 0xa0]
call fcn.004102f0
mov cx, 1
mov rdx, qword [rbp + 0xa8]
call fcn.0047cfa0
xor rbx, rbx
jmp 0x6ea717
mov ebx, 0x400
lea rcx, [rbp + 0x128]
mov edx, 0x18
xor r8, r8
call fcn.00408d50
lea rcx, [rbp + 0xc0]
mov edx, 0x68
xor r8, r8
call fcn.00408d50
mov dword [rbp + 0xc0], 0x68
mov rcx, qword [rbp + 0x180]
call fcn.0040feb0
mov rsi, rax
mov rcx, qword [rbp + 0x180]
call fcn.0040feb0
mov rdi, rax
lea rcx, [rbp + 0x98]
mov rdx, qword [rbp + 0x180]
call fcn.0042d440
mov rcx, qword [rbp + 0x98]
call fcn.0040feb0
mov rcx, qword [rbp + 0x70]
mov rdx, rsi
mov r8, rdi
xor r9, r9
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
or ebx, 0x28
mov dword [rsp + 0x30], ebx
mov r10, qword [rbp + 0xb8]
mov qword [rsp + 0x38], r10
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0xc0]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x128]
mov qword [rsp + 0x50], rax
call sub.advapi32.dll_CreateProcessAsUserW
test eax, eax
setne al
test al, al
jne 0x6ea874
call sub.kernel32.dll_GetLastError_2
mov rcx, qword [0x00a8dd30]
cmp byte [rcx], 0xd
jae 0x6ea840
cmp eax, 0xe9
je 0x6ea87f
cmp eax, 2
je 0x6ea87f
lea rcx, [rbp + 0x88]
mov edx, eax
call fcn.00435d20
lea rcx, [rbp + 0x90]
lea rdx, [0x006ea974]
mov r8, qword [rbp + 0x88]
call fcn.004102f0
mov cx, 1
mov rdx, qword [rbp + 0x90]
call fcn.0047cfa0
jmp 0x6ea87f
lea rcx, [rbp + 0x78]
mov edx, eax
call fcn.00435d20
lea rcx, [rbp + 0x80]
lea rdx, [0x006ea974]
mov r8, qword [rbp + 0x78]
call fcn.004102f0
mov cx, 1
mov rdx, qword [rbp + 0x80]
call fcn.0047cfa0
jmp 0x6ea87f
mov rax, qword [rbp + 0x128]
mov qword [rbp + 0x68], rax
cmp qword [rbp + 0xb8], 0
je 0x6ea895
mov rcx, qword [rbp + 0xb8]
call sub.userenv.dll_DestroyEnvironmentBlock
nop
lea rcx, [rbp + 0x78]
mov edx, 7
call fcn.0040e160
lea rcx, [rbp + 0x180]
call fcn.0040e080
mov rax, qword [rbp + 0x68]
lea rsp, [rbp + 0x148]
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x6fbc60
Capabilities:
Connect network resource

Disassembly:
push rbp
push rbx
sub rsp, 0x4a8
mov rbp, rsp
mov qword [rbp + 0x30], rcx
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x4c8], rdx
mov qword [rbp + 0x4d0], r8
mov qword [rbp + 0x4d8], r9
mov rcx, qword [rbp + 0x4c8]
call fcn.0040e210
mov rcx, qword [rbp + 0x4d0]
call fcn.0040e210
mov rcx, qword [rbp + 0x4d8]
call fcn.0040e210
nop
lea rcx, [rbp + 0x468]
mov edx, 0x30
xor r8, r8
call fcn.00408d50
mov dword [rbp + 0x468], 2
mov dword [rbp + 0x474], 1
mov rcx, qword [rbp + 0x4d8]
call fcn.0040feb0
mov qword [rbp + 0x480], rax
mov qword [rbp + 0x478], 0
mov dword [rbp + 0x46c], 1
mov qword [rbp + 0x490], 0
cmp qword [rbp + 0x4c8], 0
jne 0x6fbd45
lea rcx, [rbp + 0x468]
xor rdx, rdx
xor r8, r8
xor r9, r9
call sub.mpr.dll_WNetAddConnection2W
mov dword [rbp + 0x49c], eax
jmp 0x6fbd7b
mov rcx, qword [rbp + 0x4d0]
call fcn.0040feb0
mov rbx, rax
mov rcx, qword [rbp + 0x4c8]
call fcn.0040feb0
lea rcx, [rbp + 0x468]
mov rdx, rbx
mov r8, rax
xor r9, r9
call sub.mpr.dll_WNetAddConnection2W
mov dword [rbp + 0x49c], eax
cmp dword [rbp + 0x49c], 0
je 0x6fbe5b
call sub.kernel32.dll_GetLastError_2
mov ebx, eax
cmp ebx, 0x4b8
jne 0x6fbe3a
lea rcx, [rbp + 0x25e]
mov edx, 0x20a
xor r8, r8
call fcn.00408d50
lea rcx, [rbp + 0x54]
mov edx, 0x20a
xor r8, r8
call fcn.00408d50
lea rcx, [rbp + 0x49c]
lea rdx, [rbp + 0x25e]
mov r8d, 0x104
lea r9, [rbp + 0x54]
mov dword [rsp + 0x20], 0x104
call sub.mpr.dll_WNetGetLastErrorW
test eax, eax
je 0x6fbe19
lea rcx, [rbp + 0x48]
lea rdx, [rbp + 0x25e]
mov r8d, 0x105
call fcn.0040ffb0
mov rcx, qword [rbp + 0x30]
lea rdx, [0x006fbef4]
mov r8, qword [rbp + 0x48]
call fcn.004102f0
jmp 0x6fbe64
lea rcx, [rbp + 0x40]
mov edx, ebx
call fcn.00435d20
mov rcx, qword [rbp + 0x30]
lea rdx, [0x006fbef4]
mov r8, qword [rbp + 0x40]
call fcn.004102f0
jmp 0x6fbe64
lea rcx, [rbp + 0x38]
mov edx, ebx
call fcn.00435d20
mov rcx, qword [rbp + 0x30]
lea rdx, [0x006fbef4]
mov r8, qword [rbp + 0x38]
call fcn.004102f0
jmp 0x6fbe64
mov rcx, qword [rbp + 0x30]
call fcn.0040e080
nop
lea rcx, [rbp + 0x38]
mov edx, 3
call fcn.0040e160
lea rcx, [rbp + 0x4c8]
mov edx, 3
call fcn.0040e160
mov rax, qword [rbp + 0x30]
lea rsp, [rbp + 0x4a8]
pop rbx
pop rbp
ret
Function at 0x6fc790
Capabilities:
Get file size
Read file on windows

Disassembly:
push rbp
sub rsp, 0x70
mov rbp, rsp
mov qword [rbp + 0x48], rbp
mov qword [rbp + 0x80], rcx
mov rcx, qword [rbp + 0x80]
call fcn.0040e210
nop
mov byte [rbp + 0x67], 0
mov rcx, qword [rbp + 0x80]
mov dl, 1
call fcn.0042cb00
test al, al
je 0x6fc8a1
mov rcx, qword [rbp + 0x80]
call fcn.0040feb0
mov rcx, rax
mov edx, 0x80000000
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW_1
mov qword [rbp + 0x68], rax
cmp qword [rbp + 0x68], 0xffffffffffffffff
je 0x6fc8a1
nop
mov rcx, qword [rbp + 0x68]
xor rdx, rdx
call sub.kernel32.dll_GetFileSize_1
cmp eax, 2
jae 0x6fc832
xor rcx, rcx
mov rdx, qword [rbp + 0x48]
call fcn.006fc8c0
jmp 0x6fc8a1
mov rcx, qword [rbp + 0x68]
lea rdx, [rbp + 0x5e]
mov r8d, 2
lea r9, [rbp + 0x60]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_ReadFile_1
test eax, eax
setne al
test al, al
jne 0x6fc86a
xor rcx, rcx
mov rdx, qword [rbp + 0x48]
call fcn.006fc8c0
jmp 0x6fc8a1
cmp byte [rbp + 0x5e], 0x50
je 0x6fc87e
xor rcx, rcx
mov rdx, qword [rbp + 0x48]
call fcn.006fc8c0
jmp 0x6fc8a1
cmp byte [rbp + 0x5f], 0x4b
je 0x6fc892
xor rcx, rcx
mov rdx, qword [rbp + 0x48]
call fcn.006fc8c0
jmp 0x6fc8a1
mov byte [rbp + 0x67], 1
nop
mov rcx, qword [rbp + 0x68]
call sub.kernel32.dll_CloseHandle_1
nop
lea rcx, [rbp + 0x80]
call fcn.0040e080
movzx rax, byte [rbp + 0x67]
lea rsp, [rbp + 0x70]
pop rbp
ret

Function at 0x7107b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
movzx rcx, byte [rdx]
xor rax, rax
test rdx, rdx
je 0x7107c7
mov eax, dword [rdx - 4]
mov r8b, 2
mov r9d, eax
mov eax, r8d
cmp al, r9b
ja 0x7107ea
add r9b, 1
movzx r8, al
xor cl, byte [rdx + r8*2 - 2]
add al, 1
cmp al, r9b
jne 0x7107d9
nop
mov rax, rbx
movzx rdx, cl
mov r8d, 2
mov rcx, rax
call fcn.0042bf90
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x710e10
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0xc0
mov rbp, rsp
mov qword [rbp + 0x30], rcx
mov qword [rbp + 0x38], rdx
mov qword [rbp + 0x40], r8
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x78], 0
mov qword [rbp + 0x70], 0
nop
mov rcx, qword [rbp + 0x30]
call fcn.0040e080
mov ebx, 0x11
lea rcx, [0x00a9a433]
mov edx, ebx
xor r8, r8
call fcn.00408d50
mov dword [rbp + 0x9c], 0
mov rcx, qword [rbp + 0x40]
call sub.kernel32.dll_ResetEvent
lea rcx, [rbp + 0xa0]
mov edx, 0x20
xor r8, r8
call fcn.00408d50
mov rax, qword [rbp + 0x40]
mov qword [rbp + 0xb8], rax
mov rcx, qword [rbp + 0x38]
lea rdx, [0x00a9a433]
mov r8d, ebx
sub r8d, 1
lea r9, [rbp + 0x9c]
lea rax, [rbp + 0xa0]
mov qword [rsp + 0x20], rax
call sub.kernel32.dll_ReadFile_1
test eax, eax
setne al
test al, al
jne 0x711050
call sub.kernel32.dll_GetLastError_2
mov esi, eax
cmp esi, 0x3e5
jne 0x71101b
mov rax, qword [rbp + 0x40]
mov qword [rbp + 0x88], rax
mov rax, qword [0x009be978]
mov qword [rbp + 0x90], rax
mov ecx, 2
lea rdx, [rbp + 0x88]
xor r8, r8
mov r9d, 0xbb8
call sub.kernel32.dll_WaitForMultipleObjects
mov ebx, eax
mov eax, ebx
sub eax, 1
cmp eax, 0xffffffff
je 0x710f53
test eax, eax
je 0x710fb2
sub eax, 0x101
test eax, eax
jne 0x710fc0
jmp 0x71106a
mov rcx, qword [rbp + 0x38]
lea rdx, [rbp + 0xa0]
lea r8, [rbp + 0x9c]
xor r9, r9
call sub.kernel32.dll_GetOverlappedResult
test eax, eax
setne al
test al, al
jne 0x711050
call sub.kernel32.dll_GetLastError_2
mov esi, eax
lea rcx, [rbp + 0x70]
mov edx, esi
call fcn.00435d20
lea rcx, [rbp + 0x78]
lea rdx, [0x007110c4]
mov r8, qword [rbp + 0x70]
call fcn.004102f0
mov cx, 1
mov rdx, qword [rbp + 0x78]
call fcn.0047cfa0
jmp 0x71106a
mov rcx, qword [rbp + 0x38]
call sub.kernel32.dll_CancelIo
jmp 0x71106a
call sub.kernel32.dll_GetLastError_2
mov esi, eax
lea rcx, [rbp + 0x60]
mov edx, ebx
call fcn.0042bdf0
lea rcx, [rbp + 0x58]
mov edx, esi
call fcn.00435d20
lea rcx, [rbp + 0x68]
mov edx, 4
lea r8, [0x00711110]
mov r9, qword [rbp + 0x60]
lea rax, [0x00711160]
mov qword [rsp + 0x20], rax
mov rax, qword [rbp + 0x58]
mov qword [rsp + 0x28], rax
call fcn.00410420
mov cx, 1
mov rdx, qword [rbp + 0x68]
call fcn.0047cfa0
jmp 0x71106a
call sub.kernel32.dll_GetLastError_2
mov esi, eax
lea rcx, [rbp + 0x48]
mov edx, esi
call fcn.00435d20
lea rcx, [rbp + 0x50]
lea rdx, [0x00711174]
mov r8, qword [rbp + 0x48]
call fcn.004102f0
mov cx, 1
mov rdx, qword [rbp + 0x50]
call fcn.0047cfa0
jmp 0x71106a
cmp dword [rbp + 0x9c], 0
jbe 0x711069
mov rcx, qword [rbp + 0x30]
lea rdx, [0x00a9a433]
call fcn.0040ff20
nop
lea rcx, [rbp + 0x48]
mov edx, 7
call fcn.0040e160
mov rax, qword [rbp + 0x30]
lea rsp, [rbp + 0xc0]
pop rbx
pop rsi
pop rbp
ret