joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18082b11d
Capabilities:
Encode data using xor

Disassembly:
movzx r13d, word [rsp + 0x29]
cmove r9, r13
mov word [rsp + 0x28], 0x6120
neg r10w
test word [rsp + 0x28], 0x2e3a
lea r10, [r10 + r13*2 + 0x6c922481]
not word [rsp + 0x28]
not r10d
jbe 0x18082b123
dec dword [rcx - 9]
ret 0x2323
test r10, 0x44dc2323
jns 0x180e787c0
xlatb
mov edi, 0xa7e3dc41
fsubr st(3), st(0)
cmpsd dword [rsi], dword [rdi]
jnp 0x18082b14e
lodsb al, byte [rsi]
int1
jno 0x18082b196
invalid
sahf
js 0x18082b15e
xor eax, 0x5b3fbf07
invalid
movzx r10d, r9w

Function at 0x18085f7fd
Capabilities:
Encode data using base64
Parse pe header

Disassembly:
mov r15, qword [rsp + 0x48]
jns 0x180d5ca86
call fcn.180d9c5d8
Function at 0x180863340
Capabilities:
Encode data using base64

Disassembly:
lea rcx, [rcx*2 + 0x63723f17]
xor r8w, cx
not ebp
or rbx, 0x204219b1
jbe 0x180e79233
push r9
not esi
movabs r9, 0x7fbe723877c72b54
and r9, 0x4c8e51f2
call fcn.1807a3fb9
and byte [rbp - 0x27], dh
sahf
pop rsp
mov esi, 0x47ff782
inc byte [rsi + 0x6f1c1dff]
or dword [rax], eax
retf
call fcn.18077a1a9
add cx, 0x4e6c
add byte [rsp + 0x10], cl
movsx edx, dx
movzx r13d, byte [rsp + 0x32]
sub dword [rsp + 0x30], r15d
mov r15, qword [rsp + 0x10]
movabs r11, 0x326d6fa70f9a01cc
movsx r11d, word [rsp + 0x14]
sub r14, qword [rsp + 0x10]
jge 0x180e5d233
bswap r11
not r14
add rbp, rbp
sub r14b, 0x3f
movzx r15w, r14b
movzx r11w, bpl
pop r11
setns r15b
sub word [rsp + 8], 0x6e46
and qword [rsp + 8], 0x68704f8f
test r15d, ebp
setae r15b
neg rbp
mov rbp, qword [rsp + 0x10]
movzx r15w, r15b
xor r14w, 0x888
mov dword [rsp + 8], 0x1c705afe
movzx r15d, byte [rsp + 8]
pop r15
test qword [rsp], 0x7e655fa9
not r14b
jb 0x180d5ca61
jg 0x18086fd0e
call fcn.180830540
setg r15b
neg r15
setne r15b
bswap r15d
add r15b, 0xa4
neg r15
test r15, r15
jno 0x180e604ea
movabs eax, dword [0x6cf4e3399b902076]
fisubr word [0x1701e8369]
invalid
or ebp, 0x1ab80cd9
push r15
not dword [rsp + 8]
mov r9d, dword [rsp + 0xa]
xor r9d, r9d
movzx r9w, word [rsp + 8]
mov r9b, 0x81
test qword [rsp + 8], r9
push r11
mov r9, qword [rsp + 0x28]
jae 0x180d5c9de
sub r15w, 0x4d32
and r15, 0x58e020fb
mov r9, r15
sub r15, 0x424a79b8
not r9d
lea r9, [r9 + r9 + 0xb844745]
sub r15b, 0xce
test r15w, r15w
mov r9d, 0x4e496ead
push r14
setbe r9b
neg r15d
neg r15d
mov r15, qword [rsp + 0x18]
mov qword [rsp + 0x18], 0xffffffffe01ed9d9
push rbp
movabs r14, 0x69a96246469e2877
push r14
movabs rbp, 0x2a7f61a67b0e4aeb
not rbp
sub bp, word [rsp + 3]
jl 0x180e5c79e
mov r13, qword [rsp + 0x10]
not r10d
test dx, 0x6a97
setns r10b
test byte [rsp + 0x1f], dil
lea rdx, [rdi + rdi*8 + 0x60290298]
not rdi
jae 0x180e47336
invalid
setge cl
jbe 0x180d62533
movzx r11d, r11b
push r8
movabs r8, 0x4b36016f367626b8
setbe cl
je 0x18075c5ec
jo 0x180fc90e7
test bl, 0xd6
push r14
je fcn.180d7ad3d
mov r11d, r8d
movabs r14, 0x3903032f3b56770b
and rcx, 0x1e475adb
xor r8d, 0x775f5459
not r11d
setle r8b
and r14d, 0x320b64ae
neg r11d
mov r11, qword [rsp + 0x30]
mov qword [rsp + 0x30], 0xffffffffc8d9098a
movsx r8d, r14w
xor rbx, 0x50ea5b84
and r8w, 0x550a
push rbp
mov rbp, r8
neg rcx
je 0x180780196
lea rbx, [rbx*4 + 0xf861a21]
push rbx
sete byte [rsp]
push r14
mov bpl, byte [rsp + 1]
mov byte [rsp], bpl
test cl, 0x35
jle 0x180780181
and ecx, 0x115c74ca
mov bx, cx
call 0x180e7923c
push r8
movabs r8, 0x631360e57ce816e5
push rcx
pushfq
sub r8w, 0x4992
movzx r8w, r8w
setbe r8b
neg r8w
mov rcx, r8
test rcx, 0x5b842c1d
push rbp
push 0x18580741
call fcn.180e4ccbb
rol dword [rcx + rsi*4], 0x41
push rdi
movabs r15, 0x3a2b57316a1f5686
pushfq
and r15w, r15w
test r15d, 0x488350d0
push r9
mov r15b, 0x48
jo 0x180e5c7b9
jns 0x180e5d211
syscall
push r13
movabs r13, 0x18fd058177987a9e
call fcn.18087cd58
invalid
Function at 0x180869e99
Capabilities:
Execute anti-debugging instructions

Disassembly:
add bp, 0x3ac4
lea r8, [r8*8 + 0x54512285]
movzx ecx, byte [rsp + 0x11]
neg r13w
test byte [rsp + 0x10], 0xa
jne 0x18082a44b
setae dil
push r12
sub r13w, cx
mov r13, qword [rsp + 0x48]
mov qword [rsp + 0x48], 0xffffffffa4538aab
cmp cl, 0x37
not cl
push rbx
call fcn.180d97789
movsx ecx, byte [rsp + 0x14]
xor r8d, dword [rsp + 0x14]
mov r8, qword [rsp + 0x78]
jbe fcn.180d38813
setge bpl
lea rbp, [r9*2 + 0x69a3861]
sub r13d, dword [rsp + 0x7b]
xor r9w, word [rsp + 0x14]
and r15, 0x6dd97b1a
bswap ebp
cmp byte [rsp + 0x78], 0xc1
jge 0x180e53432
movabs rdx, 0x6ef65d9312cb2aa8
neg r13b
cmp r9, qword [rsp + 0x78]
not r11d
jo 0x180e7d195
mov rdx, qword [rsp + 0x60]
and word [rsp + 0x10], 0xc99
not bpl
not bpl
or dword [rsp + 0x10], r8d
sub r8d, r8d
lea r13, [r9*2 + 0x2a822c4c]
setg byte [rsp + 0x78]
setne byte [rsp + 0x78]
and rcx, r13
cmp cl, 0x1a
jne 0x1807a3ebc

Function at 0x180d3b913
Capabilities:
Encode data using base64
Parse pe header

Disassembly:
push qword [rsp + 0x50]
popfq
lea rsp, [rsp + 0x58]
call fcn.180f4c847

Function at 0x180d81f8c
Capabilities:
Encode data using xor

Disassembly:
add r13d, r11d
movzx r11, r13w
neg r11b
setb r11b
jno 0x180e4e708
adc eax, 0xef861f9f
adc ah, byte [rdx - 0x3a36e73e]
invalid

Function at 0x180e490de
Capabilities:
Encode data using xor

Disassembly:
pushfq
movabs rbp, 0x6087527e2fb65763
movsx bp, bpl
add rbp, 0x65df257b
jae 0x180848794

Function at 0x180e4a2d9
Capabilities:
Encode data using xor

Disassembly:
cmp bl, r11b
mov dword [rsp + 0x30], 0x1925640
call fcn.180837385
lea rcx, [r14 + 0x70550ae7]
lea rdi, [rbx + rdi*4 + 0x1d361e8d]
movzx cx, r14b
mov rbx, qword [rsp + 8]
setbe dil
xor cl, byte [rsp + 0x16]
js 0x180e4a2fd
cmp di, word [rsp + 0x11]
setae dil
or di, 0x118d
add qword [rsp], 0x6ca2ad
call fcn.180e7a077

Function at 0x180e554a4
Capabilities:
Encode data using base64
Parse pe header

Disassembly:
jg 0x180e6417b
sub r15, 0x5722178f
test r15b, r15b
jo 0x180d3ba43
test r15b, 0x43
call fcn.18086565f
push rsp
add dword [rcx + 0x20], ebp
pop rbx
enter 0xffffffffffffbc7b, 0x70
mov ch, 0x35
invalid

Function at 0x180e6068a
Capabilities:
Encode data using xor

Disassembly:
push qword [rsp + 0x30]
popfq
lea rsp, [rsp + 0x40]
call fcn.180eeb59b

Function at 0x180e64932
Capabilities:
Encode data using base64
Parse pe header

Disassembly:
neg r14w
jo fcn.180e640d3
lea rcx, [rcx*2 + 0x4f6141cd]
movabs rcx, 0x3e114a35142d5149
lea rbx, [rbx + r14*2 + 0x1e5752ab]
not rcx
movzx r14w, cx
add r14w, cx
bswap r14d
sub r14d, 0x7e7e2187
xor cl, 0xff
cmp r14b, 0x9e
not r14
mov r14w, 0x1ac8
setbe r14b
mov rbx, qword [rsp + 8]
sub r14, 0x46cf6b69
add rsi, r14
add r14w, 0x3f5b
setl r14b
neg esi
mov sil, r14b
xor rcx, 0x34512641
lea rcx, [rcx + r14 + 0x3c961882]
mov esi, 0xfd103e9
neg rsi
test cl, r14b
lea rcx, [r14*8 + 0x19a201ba]
mov rsi, r14
movsx rsi, sil
setg r14b
call fcn.180d3e404
adc eax, 0x44e7193d
invalid
Function at 0x180e6fd23
Capabilities:
Encode data using xor

Disassembly:
and r10b, 0x44
movsx r15, r10b
bswap r10
add r10b, 0xbc
sub r15b, 0xee
add r15b, r15b
add qword [rsp], 0x7f292783
cmp r15d, r10d
bswap r15
movsx r10d, r10w
cmovl r10d, r15d
cmp r10w, 0x2b2a
call fcn.180893f30
lea r10, [r10*2 + 0x69c31a5]
or r10b, 0x8a
and r10b, r15b
lea r15, [r15*8 + 0x64f273e5]
cmp r15w, 0x3752
call fcn.1807775aa
movzx r15d, r15b
jb 0x18077abde
jl 0x180daa005
loop 0x180e6fd63
jrcxz 0x180e6fd9f
xor bl, bh
invalid
cld
xchg bh, al
pop rsi
invalid
jmp rdx

Function at 0x180e729ee
Capabilities:
Encode data using xor

Disassembly:
lea rsp, [rsp + 8]
call fcn.180eebcda
Function at 0x14001f2f8
Capabilities:
Get process image filename

Disassembly:
jmp 0x14005a6c9
jmp qword [sym.imp.KERNEL32.dll_K32GetProcessImageFileNameW]

Function at 0x14001f50a
Capabilities:
Enumerate processes

Disassembly:
jmp 0x140054e90
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x428
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xa2
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x448]
mov rax, qword [0x1400a6e78]
xor rax, rbp
mov qword [rbp + 0x3f8], rax
lea rcx, [0x1400b33a0]
call fcn.140020883
mov qword [rbp + 0x268], 0
mov edx, 0x238
lea rcx, [rbp + 0x10]
call fcn.1400200a9
xor edx, edx
mov ecx, 2
call fcn.14001fb0e
mov qword [rbp + 0x268], rax
cmp qword [rbp + 0x268], 0xffffffffffffffff
jne 0x140054f22
lea rcx, str.CreateToolhelp32Snapshot
call fcn.14001fd66
xor eax, eax
jmp 0x140054fcd
mov dword [rbp + 0x10], 0x238
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x268]
call fcn.14001fe7e
test eax, eax
jne 0x140054f5a
lea rcx, str.Process32First
call fcn.14001fd66
mov rcx, qword [rbp + 0x268]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x140054fcd
mov rdx, qword [rbp + 0x420]
lea rcx, [rbp + 0x3c]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x140054f81
mov rcx, qword [rbp + 0x268]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp + 0x18]
jmp 0x140054fcd
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x268]
call fcn.140020491
test eax, eax
je 0x140054fbe
mov rdx, qword [rbp + 0x420]
lea rcx, [rbp + 0x3c]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x140054fbc
mov rcx, qword [rbp + 0x268]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp + 0x18]
jmp 0x140054fcd
jmp 0x140054f81
mov rcx, qword [rbp + 0x268]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14007bff0]
call fcn.1400203ce
mov rax, rdi
mov rcx, qword [rbp + 0x3f8]
xor rcx, rbp
call fcn.14001fb4f
lea rsp, [rbp + 0x408]
pop rdi
pop rbp
ret
Function at 0x14001f677
Capabilities:
Terminate process

Disassembly:
jmp 0x140050d00
push rbp
push rdi
sub rsp, 0x228
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x52
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x1400a6e78]
xor rax, rbp
mov qword [rbp + 0x1f8], rax
lea rcx, [0x1400b338b]
call fcn.140020883
mov qword [rbp + 8], 0
xor ecx, ecx
call fcn.140051050
mov qword [rbp + 0xc8], rax
lea rax, [rbp + 0xe8]
mov rdi, rax
xor eax, eax
mov ecx, 0x24
rep stosb byte [rdi], al
lea rdx, [rbp + 0xc8]
lea rcx, [rbp + 0xe8]
call fcn.140050ff0
mov dword [rbp + 0x44], eax
cmp dword [rbp + 0x44], 0
je 0x140050d99
lea rcx, str.localtime_s
call fcn.14001fd66
mov ecx, 1
call qword [sym.imp.ucrtbased.dll_exit]
lea r8, [rbp + 0xe8]
mov edx, 0x20
lea rcx, [rbp + 0x70]
call qword [sym.imp.ucrtbased.dll__wasctime_s]
mov dword [rbp + 0x44], eax
cmp dword [rbp + 0x44], 0
je 0x140050dcf
lea rcx, str._tasctime_s
call fcn.14001fd66
mov ecx, 1
call qword [sym.imp.ucrtbased.dll_exit]
lea rcx, [rbp + 0x70]
call qword [sym.imp.ucrtbased.dll_wcslen]
lea rax, [rax + rax - 2]
mov qword [rbp + 0x1e8], rax
cmp qword [rbp + 0x1e8], 0x40
jae 0x140050df1
jmp 0x140050df6
call fcn.140020117
xor eax, eax
mov rcx, qword [rbp + 0x1e8]
mov word [rbp + rcx + 0x70], ax
lea rcx, [rbp + 0x70]
call qword [sym.imp.ucrtbased.dll_wcslen]
lea rax, [rax + rax + 6]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 8]
call qword [sym.imp.ucrtbased.dll_malloc]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
je 0x140050e60
mov r8, qword [rbp + 8]
xor edx, edx
mov rcx, qword [rbp + 0x28]
call fcn.1400201f8
xor edx, edx
mov rax, qword [rbp + 8]
mov ecx, 2
div rcx
lea r9, [rbp + 0x70]
lea r8, str.__s_
mov rdx, rax
mov rcx, qword [rbp + 0x28]
call fcn.14001f703
mov rax, qword [rbp + 0x28]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14007b4a0]
call fcn.1400203ce
mov rax, rdi
mov rcx, qword [rbp + 0x1f8]
xor rcx, rbp
call fcn.14001fb4f
lea rsp, [rbp + 0x208]
pop rdi
pop rbp
ret

Function at 0x14001f6a4
Capabilities:
Get process heap flags

Disassembly:
jmp 0x140036820
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x1400b30c7]
call fcn.140020883
mov qword [rbp + 8], 0
mov qword [rbp + 0x28], 0
call fcn.14001f69a
movzx eax, al
test eax, eax
je 0x140036879
mov rax, qword gs:[0x60]
add rax, 0x30
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov rax, qword [rax]
add rax, 0x70
mov qword [rbp + 0x28], rax
jmp 0x140036899
mov rax, qword gs:[0x60]
add rax, 0x30
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov rax, qword [rax]
add rax, 0x14
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x14001f708
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x140055a30
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xc58
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x21a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xc78]
mov rax, qword [0x1400a6e78]
xor rax, rbp
mov qword [rbp + 0xc18], rax
lea rcx, [0x1400b33a0]
call fcn.140020883
mov qword [rbp + 8], 0
lea rax, [rbp + 0x30]
mov rdi, rax
xor eax, eax
mov ecx, 0x800
rep stosb byte [rdi], al
mov dword [rbp + 0x844], 0x104
lea rax, [rbp + 8]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp + 0xc48]
mov rcx, qword [rbp + 0xc40]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140055b35
lea rax, [rbp + 0x844]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbp + 0xc50]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140055b2b
mov rdx, qword [rbp + 0xc58]
lea rcx, [rbp + 0x30]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
je 0x140055b2b
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x140055b37
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x14007b7d0]
call fcn.1400203ce
mov rax, rdi
mov rcx, qword [rbp + 0xc18]
xor rcx, rbp
call fcn.14001fb4f
lea rsp, [rbp + 0xc28]
pop rdi
pop rbp
ret
Function at 0x14001f726
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
jmp 0x140055060
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x158
lea rbp, [rsp + 0x50]
lea rcx, [0x1400b33a0]
call fcn.140020883
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jge 0x1400550af
lea rcx, str.CoInitializeEx
call fcn.14001fd66
xor eax, eax
jmp 0x1400552b0
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 0xffffffff
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jge 0x14005510e
lea rcx, str.CoInitializeSecurity
call fcn.14001fd66
call qword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
jmp 0x1400552b0
mov rcx, qword [rbp + 0x128]
call fcn.14001f942
mov qword [rsp + 0x20], rax
lea r9, [0x14007d8c8]
mov r8d, 1
xor edx, edx
lea rcx, [0x14007f7c0]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jge 0x14005515d
lea rcx, str.CoCreateInstance
call fcn.14001fd66
call qword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
jmp 0x1400552b0
mov rcx, qword [rbp + 0x130]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
je 0x14005521c
mov rax, qword [rbp + 0x128]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x128]
mov rcx, qword [rcx]
mov rax, qword [rax]
mov rdx, qword [rbp + 0x120]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbp + 0x28]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jge 0x140055212
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
lea rcx, str.ConnectServer
call fcn.14001fd66
mov rax, qword [rbp + 0x128]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x128]
mov rcx, qword [rcx]
mov rax, qword [rax]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
jmp 0x1400552b0
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xa
mov rax, qword [rbp + 0x120]
mov rcx, qword [rax]
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jge 0x1400552ab
lea rcx, str.CoSetProxyBlanket
call fcn.14001fd66
mov rax, qword [rbp + 0x120]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x120]
mov rcx, qword [rcx]
mov rax, qword [rax]
call qword [rax + 0x10]
mov rax, qword [rbp + 0x128]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x128]
mov rcx, qword [rcx]
mov rax, qword [rax]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
jmp 0x1400552b0
mov eax, 1
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x14001f73a
Capabilities:
Get system information on windows

Disassembly:
jmp 0x14002a8f0
push rbp
push rdi
sub rsp, 0x258
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x5e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x1400a6e78]
xor rax, rbp
mov qword [rbp + 0x228], rax
lea rcx, [0x1400b307b]
call fcn.140020883
lea rcx, [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rbp + 0xc]
mov qword [rbp + 0x58], rax
lea rax, [rbp + 0xc8]
mov rdi, rax
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
lea r8, [rbp + 0x78]
lea rdx, [0x1400209af]
mov ecx, 4
call qword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
je 0x14002aa7b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetElement
lea r8, [rbp + 0x98]
mov rdx, qword [rbp + 0x78]
mov rcx, rax
call fcn.14001f66d
test eax, eax
je 0x14002aa7b
mov rax, qword [rbp + 0x98]
mov qword [rbp + 0x118], rax
mov qword [rbp + 0x138], 0
jmp 0x14002a9c9
mov rax, qword [rbp + 0x58]
mov rcx, qword [rbp + 0x138]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x138], rax
mov eax, dword [rbp + 0xa0]
cmp qword [rbp + 0x138], rax
jae 0x14002aa7b
mov rax, qword [rbp + 0x138]
mov rcx, qword [rbp + 0x118]
add rcx, rax
mov rax, rcx
mov r8d, 0x30
lea rdx, [rbp + 0xc8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
cmp rax, 0x30
jb 0x14002aa76
mov eax, dword [rbp + 0xec]
and eax, 0x10
cmp eax, 0x10
je 0x14002aa48
mov eax, dword [rbp + 0xec]
and eax, 0x20
cmp eax, 0x20
je 0x14002aa48
mov eax, dword [rbp + 0xec]
and eax, 0x80
cmp eax, 0x80
je 0x14002aa48
mov eax, dword [rbp + 0xec]
and eax, 0x40
cmp eax, 0x40
jne 0x14002aa76
mov rax, qword [rbp + 0x138]
mov rcx, qword [rbp + 0x118]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x218], rax
lea rdx, [rbp + 0x218]
lea rcx, [0x1400a7480]
call fcn.14001f519
jmp 0x14002a9b1
lea rcx, [rbp - 0x20]
lea rdx, [0x14006a710]
call fcn.1400203ce
mov rcx, qword [rbp + 0x228]
xor rcx, rbp
call fcn.14001fb4f
lea rsp, [rbp + 0x238]
pop rdi
pop rbp
ret

Function at 0x14001f7df
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap force flags

Disassembly:
jmp 0x140036930
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x1400b30cd]
call fcn.140020883
mov qword [rbp + 8], 0
mov qword [rbp + 0x28], 0
call fcn.14001f69a
movzx eax, al
test eax, eax
je 0x140036989
mov rax, qword gs:[0x60]
add rax, 0x30
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov rax, qword [rax]
add rax, 0x74
mov qword [rbp + 0x28], rax
jmp 0x1400369a9
mov rax, qword gs:[0x60]
add rax, 0x30
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov rax, qword [rax]
add rax, 0x18
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x14001fa00
Capabilities:
Acquire debug privileges

Disassembly:
jmp 0x140055bc0
push rbp
push rdi
sub rsp, 0x168
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x1e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x1400a6e78]
xor rax, rbp
mov qword [rbp + 0x128], rax
lea rcx, [0x1400b33a0]
call fcn.140020883
lea rax, [rbp + 8]
mov rdi, rax
xor eax, eax
mov ecx, SafeArrayLock
rep stosb byte [rdi], al
mov qword [rbp + 0x38], 0
mov dword [rbp + 0x54], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp + 0x38]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x140055c4c
lea rcx, str.OpenProcessToken
call fcn.14001fd66
mov eax, dword [rbp + 0x54]
jmp 0x140055cdd
mov dword [rbp + 8], 1
mov eax, 0xc
imul rax, rax, 0
mov dword [rbp + rax + 0x14], 2
mov eax, 0xc
imul rax, rax, 0
lea rax, [rbp + rax + 0xc]
mov r8, rax
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x140055cc4
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rbp + 8]
xor edx, edx
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov dword [rbp + 0x54], eax
cmp dword [rbp + 0x54], 0
jne 0x140055cc2
lea rcx, str.AdjustTokenPrivileges
call fcn.14001fd66
jmp 0x140055cd0
lea rcx, str.LookupPrivilegeValue
call fcn.14001fd66
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp + 0x54]
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.1400203ce
mov rax, rdi
mov rcx, qword [rbp + 0x128]
xor rcx, rbp
call fcn.14001fb4f
lea rsp, [rbp + 0x138]
pop rdi
pop rbp
ret

Function at 0x14001faf5
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
jmp 0x1400421c0
push rbp
push rdi
sub rsp, 0x168
lea rbp, [rsp + 0x20]
lea rcx, [0x1400b3135]
call fcn.140020883
mov rax, qword gs:[0x60]
mov qword [rbp + 8], rax
lea rcx, str.___Increasing_SizeOfImage_in_PE_Header_to:_0x100000_n
call fcn.14001f0d7
mov rax, qword [rbp + 8]
mov rax, qword [rax + 0x18]
mov ecx, 8
imul rcx, rcx, 1
mov rax, qword [rax + rcx + 8]
mov qword [rbp + 0x28], rax
xor eax, eax
mov ecx, 8
imul rcx, rcx, 0
add rax, rcx
mov rcx, qword [rbp + 0x28]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x48], rax
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rbp + 0x48]
lea rax, [rcx + rax + 0x38]
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x48]
mov rax, qword [rax + 0x30]
add rax, 0x100000
mov rcx, qword [rbp + 0x68]
mov dword [rcx], eax
lea rsp, [rbp + 0x148]
pop rdi
pop rbp
ret