joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180017fac
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x478
mov dword [rsp + 0x38], 0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, 0x7530
mov dword [rsp + 0x3c], eax
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x44], 0x64
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [rsp + 0x3c]
jae 0x1800181b0
mov dword [rsp + 0x260], 0
mov dword [rsp + 0x50], 0
mov dword [rsp + 0x34], 0
jmp 0x180018020
mov eax, dword [rsp + 0x34]
inc eax
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x260]
cmp dword [rsp + 0x34], eax
jae 0x18001804b
mov eax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x480]
mov rcx, qword [rcx + 0x20]
cmp qword [rsp + rax*8 + 0x268], rcx
jne 0x180018049
jmp 0x18001804b
jmp 0x180018016
mov eax, dword [rsp + 0x260]
cmp dword [rsp + 0x34], eax
jne 0x18001808a
cmp dword [rsp + 0x260], 0x40
jae 0x18001808a
mov eax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x480]
mov rcx, qword [rcx + 0x20]
mov qword [rsp + rax*8 + 0x268], rcx
mov eax, dword [rsp + 0x260]
inc eax
mov dword [rsp + 0x260], eax
xor eax, eax
test eax, eax
jne 0x18001800c
mov dword [rsp + 0x30], 0
jmp 0x1800180a8
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x50]
cmp dword [rsp + 0x30], eax
jae 0x1800180cd
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x480]
mov rcx, qword [rcx + 0x20]
cmp qword [rsp + rax*8 + 0x58], rcx
jne 0x1800180cb
jmp 0x1800180cd
jmp 0x18001809e
mov eax, dword [rsp + 0x50]
cmp dword [rsp + 0x30], eax
jne 0x1800180fd
cmp dword [rsp + 0x50], 0x40
jae 0x1800180fd
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x480]
mov rcx, qword [rcx + 0x20]
mov qword [rsp + rax*8 + 0x58], rcx
mov eax, dword [rsp + 0x50]
inc eax
mov dword [rsp + 0x50], eax
xor eax, eax
test eax, eax
jne 0x180018094
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x260]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_select]
lea rdx, [rsp + 0x50]
mov rax, qword [rsp + 0x480]
mov rcx, qword [rax + 0x20]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x180018142
jmp 0x1800181b0
lea rdx, [rsp + 0x260]
mov rax, qword [rsp + 0x480]
mov rcx, qword [rax + 0x20]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x1800181ab
xor r9d, r9d
mov r8d, dword [rsp + 0x490]
mov rdx, qword [rsp + 0x488]
mov rax, qword [rsp + 0x480]
mov rcx, qword [rax + 0x20]
call qword [sym.imp.WS2_32.dll_send]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0xffffffff
jne 0x1800181a9
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x1800181a9
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1800181ab
jmp 0x1800181b0
jmp 0x180017fe9
add rsp, 0x478
ret
Function at 0x180018aec
Capabilities:
Enumerate processes

Disassembly:
push rdi
sub rsp, 0x160
xor edx, edx
mov ecx, 0xa
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x180018b77
mov dword [rsp + 0x30], 0x130
lea rax, [rsp + 0x34]
mov rdi, rax
xor eax, eax
mov ecx, 0x12c
rep stosb byte [rdi], al
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_Process32First
lea rdx, str.explorer.exe
lea rcx, [rsp + 0x5c]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
je 0x180018b59
mov eax, dword [rsp + 0x38]
mov dword [0x18006207c], eax
jmp 0x180018b6c
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x180018b36
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x160
pop rdi
ret
Function at 0x180019760
Capabilities:
Terminate process

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
lea rax, [rsp + 0x38]
mov rdi, rax
xor eax, eax
mov ecx, reloc.WS2_32.dll_recv
rep stosb byte [rdi], al
mov r8d, dword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x30]
call fcn.1800168d8
lea rcx, [rsp + 0x30]
call fcn.18001691c
mov dword [rsp + 0x20], eax
mov r8d, dword [rsp + 0x20]
xor edx, edx
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1800197e5
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x1800197e5
jmp 0x1800197fc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
mov edx, dword [rsp + 0x20]
mov ecx, 0x23
call fcn.18000dc3c
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x50
pop rdi
ret
Function at 0x180019c38
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov ecx, 0x8000
call fcn.180035368
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x40]
lea r8, str._s
mov edx, 0x8000
mov rcx, qword [rsp + 0x20]
call fcn.180035818
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x20]
call fcn.180035328
cmp qword [rsp + 0x28], 0xffffffffffffffff
jne 0x180019ca1
jmp 0x180019dbf
mov rax, qword [rsp + 0x48]
mov eax, dword [rax]
and eax, 0x10
test eax, eax
je 0x180019d84
mov rax, qword [rsp + 0x48]
add rax, 0x2c
lea rcx, [0x18005e604]
sub rcx, rax
mov dl, byte [rax]
cmp dl, byte [rax + rcx]
jne 0x180019cd8
inc rax
test dl, dl
jne 0x180019cc6
xor eax, eax
jmp 0x180019cdd
sbb eax, eax
or eax, 1
test eax, eax
je 0x180019d82
mov rax, qword [rsp + 0x48]
add rax, 0x2c
lea rcx, [0x18005e608]
sub rcx, rax
mov dl, byte [rax]
cmp dl, byte [rax + rcx]
jne 0x180019d0a
inc rax
test dl, dl
jne 0x180019cf8
xor eax, eax
jmp 0x180019d0f
sbb eax, eax
or eax, 1
test eax, eax
je 0x180019d82
mov ecx, 0x8000
call fcn.180035368
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x48]
add rax, 0x2c
mov r9, rax
lea r8, [0x18005e60c]
mov edx, 0x8000
mov rcx, qword [rsp + 0x20]
call fcn.180035818
mov rax, qword [rsp + 0x48]
add rax, 0x2c
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x48]
mov rdx, rax
mov rcx, qword [rsp + 0x40]
call fcn.180019dc4
mov r8d, 1
mov rdx, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
call qword [rsp + 0x50]
mov rcx, qword [rsp + 0x20]
call fcn.180035328
jmp 0x180019d9c
mov rax, qword [rsp + 0x48]
add rax, 0x2c
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rsp + 0x40]
call qword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x180019ca1
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FindClose]
add rsp, 0x38
ret

Function at 0x180033e34
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x38], 0xffffffffffffffff
mov r9d, 4
mov r8d, 0x3000
mov edx, 0x18
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x50]
mov qword [rax], rcx
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x58]
mov qword [rax + 8], rcx
mov rax, qword [rsp + 0x30]
mov rcx, qword [sym.imp.KERNEL32.dll_VirtualFree]
mov qword [rax + 0x10], rcx
call fcn.180033fec
cmp qword [0x1800653d8], 0
je 0x180033ecf
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0x30]
mov r8, qword [0x1800653d8]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
add rsp, 0x48
ret
Function at 0x180033edc
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov eax, dword [0x1800653d0]
inc eax
mov dword [0x1800653d0], eax
mov ecx, 0x27
call fcn.180033630
movzx eax, ax
cmp eax, 1
jne 0x180033f1d
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call fcn.180033e34
jmp 0x180033f42
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0x48]
mov r8, qword [rsp + 0x40]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
add rsp, 0x38
ret

Function at 0x180033f48
Capabilities:
Create thread
Terminate process

Disassembly:
sub rsp, 0x48
mov ecx, 0x37
call fcn.180033630
movzx eax, ax
mov dword [rsp + 0x34], eax
mov ecx, 0x27
call fcn.180033630
movzx eax, ax
mov dword [rsp + 0x30], eax
call fcn.180034b40
cmp dword [rsp + 0x34], 1
jne 0x180033fa1
cmp dword [rsp + 0x30], 1
jne 0x180033f97
xor eax, eax
cmp eax, 1
je 0x180033f95
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x180033f81
jmp 0x180033f9f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitThread]
jmp 0x180033fe5
cmp dword [rsp + 0x30], 1
jne 0x180033fdd
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [sym.imp.KERNEL32.dll_ExitProcess]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x180033fe5
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
add rsp, 0x48
ret

Function at 0x180034438
Capabilities:
Get token membership

Disassembly:
sub rsp, 0x88
mov byte [rsp + 0x64], 0
mov byte [rsp + 0x65], 0
mov byte [rsp + 0x66], 0
mov byte [rsp + 0x67], 0
mov byte [rsp + 0x68], 0
mov byte [rsp + 0x69], 5
lea rax, [rsp + 0x70]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0x220
mov r8d, 0x20
mov dl, 2
lea rcx, [rsp + 0x64]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0
je 0x1800344e4
lea r8, [rsp + 0x60]
mov rdx, qword [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x1800344d9
mov dword [rsp + 0x60], 0
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [rsp + 0x60]
add rsp, 0x88
ret
Function at 0x1800344f0
Capabilities:
Impersonate user

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
call fcn.1800341e0
lea rax, [0x1800653e0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 3
mov r9d, 9
mov r8, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_LogonUserA]
test eax, eax
jne 0x180034557
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov ecx, 0x18
call fcn.18000dc18
jmp 0x180034680
mov rcx, qword [0x1800653e0]
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
jne 0x18003457f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov ecx, 0x19
call fcn.18000dc18
jmp 0x180034680
mov ecx, 0x800
call fcn.180016738
mov qword [0x180065400], rax
mov edx, 0x200
mov rcx, qword [0x180065400]
call fcn.1800169ac
mov qword [0x1800653e8], rax
mov edx, 0x200
mov rcx, qword [0x180065400]
call fcn.1800169ac
mov qword [0x1800653f0], rax
mov edx, 0x400
mov rcx, qword [0x180065400]
call fcn.1800169ac
mov qword [0x1800653f8], rax
mov r8d, 0x100
mov rdx, qword [0x1800653f0]
mov rcx, qword [rsp + 0x58]
call fcn.18000f874
mov r8d, 0x100
mov rdx, qword [0x1800653e8]
mov rcx, qword [rsp + 0x50]
call fcn.18000f874
mov r8d, 0x200
mov rdx, qword [0x1800653f8]
mov rcx, qword [rsp + 0x60]
call fcn.18000f874
mov dword [0x180065408], 1
mov r8d, 0x400
mov rdx, qword [rsp + 0x58]
mov rcx, qword [0x1800653e0]
call fcn.1800347c4
test eax, eax
je 0x180034680
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0xffffffffffffffff
inc qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
cmp byte [rax + rcx], 0
jne 0x180034655
mov rax, qword [rsp + 0x30]
mov r8d, reloc.WS2_32.dll_ntohs
mov edx, eax
mov rcx, qword [rsp + 0x58]
call qword [rsp + 0x68]
add rsp, 0x48
ret

Function at 0x180034f00
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x24], 0
mov eax, dword [rsp + 0x50]
cmp dword [rsp + 0x20], eax
jae 0x180034fca
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
xor r9d, r9d
mov r8d, 1
mov rdx, rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_recv]
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
jg 0x180034f69
mov eax, 0xffffffff
jmp 0x180034fcf
mov eax, dword [rsp + 0x24]
mov ecx, dword [rsp + 0x20]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 2
jb 0x180034fc5
mov eax, dword [rsp + 0x20]
dec eax
mov eax, eax
mov rcx, qword [rsp + 0x48]
movsx eax, byte [rcx + rax]
cmp eax, 0xa
jne 0x180034fc5
mov eax, dword [rsp + 0x20]
sub eax, 2
mov eax, eax
mov rcx, qword [rsp + 0x48]
movsx eax, byte [rcx + rax]
cmp eax, 0xd
jne 0x180034fc5
mov eax, dword [rsp + 0x20]
sub eax, 2
mov eax, eax
mov rcx, qword [rsp + 0x48]
mov byte [rcx + rax], 0
mov eax, dword [rsp + 0x20]
jmp 0x180034fcf
jmp 0x180034f23
mov eax, 0xffffffff
add rsp, 0x38
ret
Function at 0x180034fd4
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov word [rsp + 8], cx
sub rsp, 0x58
mov qword [rsp + 0x28], 0xffffffffffffffff
mov dword [rsp + 0x20], 0
call fcn.18000dee8
xor r8d, r8d
mov edx, 1
mov ecx, 2
call qword [sym.imp.WS2_32.dll_socket]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0xffffffffffffffff
jne 0x18003502d
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.WS2_32.dll_closesocket]
jmp 0x1800350cf
mov eax, 2
mov word [rsp + 0x38], ax
movzx ecx, word [rsp + 0x60]
call qword [sym.imp.WS2_32.dll_htons]
mov word [rsp + 0x3a], ax
mov dword [rsp + 0x3c], 0x100007f
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.WS2_32.dll_bind]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0xffffffff
jne 0x18003507d
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.WS2_32.dll_closesocket]
jmp 0x1800350cf
mov edx, 0x78
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.WS2_32.dll_listen]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0xffffffff
jne 0x1800350a5
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.WS2_32.dll_closesocket]
jmp 0x1800350cf
mov r8d, dword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x28]
call fcn.1800351bc
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x30]
lea rcx, [0x1800350d4]
call fcn.180033edc
add rsp, 0x58
ret

Function at 0x180035ed0
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.180035d38

Function at 0x18003ea00
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x18003ea16
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x18003ea18
xor eax, eax
test eax, eax
je 0x18003ea28
mov ecx, eax
call fcn.18003808c
or eax, 0xffffffff
jmp 0x18003ea2a
xor eax, eax
add rsp, 0x28
ret

Function at 0x18003ea30
Capabilities:
Create directory

Disassembly:
sub rsp, 0x28
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x18003ea48
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x18003ea4a
xor eax, eax
test eax, eax
je 0x18003ea5a
mov ecx, eax
call fcn.18003808c
or eax, 0xffffffff
jmp 0x18003ea5c
xor eax, eax
add rsp, 0x28
ret

Function at 0x18003ea64
Capabilities:
Delete directory

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x18003ea7a
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x18003ea7c
xor eax, eax
test eax, eax
je 0x18003ea8c
mov ecx, eax
call fcn.18003808c
or eax, 0xffffffff
jmp 0x18003ea8e
xor eax, eax
add rsp, 0x28
ret
Function at 0x180004620
Capabilities:
Check mutex on windows

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x3e0
mov rax, qword [0x18001c008]
xor rax, rsp
mov qword [rsp + 0x3d0], rax
movdqa xmm0, xmmword [str.F147EC_C7F5_F89_]
lea r8, [r11 - 0x38]
mov edx, 1
mov dword [r11 - 0x28], 0x394a2d41
xor ecx, ecx
mov dword [r11 - 0x24], 0x44353941
movdqu xmmword [r11 - 0x38], xmm0
mov word [r11 - 0x20], 0x7d
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
sete al
test rbx, rbx
je 0x18000469f
test al, al
je 0x1800046ba
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov rcx, qword [rsp + 0x3d0]
xor rcx, rsp
call fcn.1800058d0
add rsp, 0x3e0
pop rbx
ret
lea rax, [rsp + 0x30]
mov edx, 7
lea rcx, str.RemoteNetBIOSHelper
nop dword [rax + rax]
lea rax, [rax + 0x80]
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x80]
movups xmmword [rax - 0x80], xmm0
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rax - 0x70], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rax - 0x60], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rax - 0x50], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rax - 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rax - 0x30], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rax - 0x20], xmm0
movups xmmword [rax - 0x10], xmm1
sub rdx, 1
jne 0x1800046d0
xor eax, eax
lea rdx, [0x18001fef0]
nop dword [rax]
movzx ecx, byte [rsp + rax + 0xf0]
mov byte [rax + rdx], cl
inc rax
test cl, cl
jne 0x180004730
lea r9, [rsp + 0x30]
call fcn.180003bb0
mov al, 1
jmp 0x1800046a1

Function at 0x180004990
Capabilities:
Create thread

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, rcx
test rcx, rcx
je 0x180004a1b
cmp qword [0x18001fee0], 0
mov qword [rsp + 0x48], rbx
jne 0x1800049c8
mov ecx, 8
call fcn.1800058f4
lea rdx, vtable.PluginProvider.0
mov qword [0x18001fee0], rax
mov qword [rax], rdx
mov ecx, 8
call fcn.1800058f4
mov rcx, qword [0x18001fee0]
mov rbx, rax
mov qword [rax], rcx
mov ecx, 0x10
call fcn.1800058f4
xor edx, edx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x28], rcx
lea r8, [0x180004980]
xor ecx, ecx
mov dword [rsp + 0x20], edx
mov qword [rax + 8], rdi
mov r9, rax
mov qword [rax], rbx
mov dword [rsp + 0x40], edx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, qword [rsp + 0x48]
xor al, al
add rsp, 0x30
pop rdi
ret
Function at 0x140001800
Capabilities:
Terminate process

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x40
and qword [r11 - 0x18], 0
lea rax, str.SNMPTRAP
and qword [r11 - 0x10], 0
xor r9d, r9d
mov qword [r11 - 0x28], rax
xor r8d, r8d
lea rax, [0x1400010e0]
xor ecx, ecx
mov qword [r11 - 0x20], rax
lea ebx, [r9 + 1]
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_HeapSetInformation]
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x140004638], rax
test rax, rax
jne 0x140001861
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
int3
xor edx, edx
lea rcx, [0x140004680]
lea r8d, [rdx + 0x20]
call sub.msvcrt.dll_memset
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x140004698], rax
test rax, rax
jne 0x1400018a5
mov rcx, qword [0x140004638]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
int3
lea rcx, [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
mov rcx, qword [0x140004638]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x140004698]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
add rsp, 0x40
pop rbx
ret

Function at 0x1400023a0
Capabilities:
Access peb ldr_data

Disassembly:
push r12
push r14
push r15
sub r12, r12
add r12, 0x60
mov r14, qword gs:[r12]
push r11
mov r11, qword [r14 + 0x10]
add r14, 0x18
mov r15, qword [r14]
mov r12, r15
add r12, 0x10
mov r14, qword [r12]
push rax
mov r12, qword [r14 + 0x30]
cmp r12, 0
cmp esp, 0
je 0x1400023fa
mov r15, qword [r14 + 0x60]
mov rax, qword [r15]
and eax, 0xdf00df
mov r15, qword [r15 + 0xb]
add r15d, eax
shr r15d, 2
sub r15d, 0xc914cd2
cmp r15, 0
je 0x140002402
mov r14, qword [r14]
jmp 0x1400023cb
mov r14d, dword [r12 + 0x3c]
add r14, r12
add r14, 0x10
mov r15d, dword [r14 + 0x78]
add r15, r12
push r10
mov eax, dword [r15 + 0x20]
add rax, r12
mov r10d, dword [rax]
add r10, r12
mov r14d, dword [r10 + 0xb]
sub r14d, 0x746365
cmp r14d, 0
jne 0x140002437
jmp 0x140002445
inc rax
inc rax
inc rax
inc rax
jmp 0x14000241e
invalid
invalid
invalid
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1400523e0]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x1400523f0]
mov dword [rax], 1
mov rax, qword [0x140052400]
mov dword [rax], 1
mov rax, qword [0x140052390]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x1400523d0]
mov dword [0x14005500c], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010b0
mov ecx, 2
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [0x1400524a0]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg.__p__commode
mov rdx, qword [0x140052480]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x140052340]
cmp dword [rax], 1
je 0x1400010f8
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001110
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
mov rcx, qword [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a

Function at 0x140001740
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call dbg.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call dbg.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop dword [rax]