joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41d3a0
Capabilities:
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [0x004dd4d8]
mov edi, edx
test rcx, rcx
je 0x41d480
call sym.pthread_mutex_lock
mov rcx, rbx
call sym.__pthread_get_pointer
test rax, rax
je 0x41d3da
mov rsi, qword [rax + 0x1c8]
cmp rsi, rbx
je 0x41d400
mov rcx, qword [0x004dd4d8]
test rcx, rcx
je 0x41d450
mov ebx, 3
call sym.pthread_mutex_unlock
mov eax, ebx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
test byte [rax + 0x40], 0xc
jne 0x41d3da
mov ebx, dword [rax + 0xb4]
test ebx, ebx
jne 0x41d3da
mov rax, qword [rax + 0x28]
sub rax, 1
cmp rax, 0xfffffffffffffffd
ja 0x41d3da
mov rcx, qword [0x004dd4d8]
test rcx, rcx
je 0x41d4a7
call sym.pthread_mutex_unlock
test edi, edi
je 0x41d3f0
sub edi, 2
mov ebx, 0x16
cmp edi, 0x15
ja 0x41d3f0
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp sym.pthread_cancel
lea rcx, str.mtx_pthr_locked_shmem
lea r8, [sym.__shmem_winpthreads_init_mtx_pthr_locked_shmem]
mov edx, 8
call sym.__shmem_winpthreads_grab
mov rcx, rax
mov qword [0x004dd4d8], rax
jmp 0x41d3e6
lea rcx, str.mtx_pthr_locked_shmem
lea r8, [sym.__shmem_winpthreads_init_mtx_pthr_locked_shmem]
mov edx, 8
call sym.__shmem_winpthreads_grab
mov rcx, rax
mov qword [0x004dd4d8], rax
jmp 0x41d3bc
lea rcx, str.mtx_pthr_locked_shmem
lea r8, [sym.__shmem_winpthreads_init_mtx_pthr_locked_shmem]
mov edx, 8
call sym.__shmem_winpthreads_grab
mov rcx, rax
mov qword [0x004dd4d8], rax
jmp 0x41d42a
Function at 0x41d720
Capabilities:
Create thread
Resume thread

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov r14, rcx
mov r12, rdx
mov rsi, r8
mov rdi, r9
call sym.pop_pthread_mem
test rax, rax
mov rbx, rax
je 0x41d8d1
test r14, r14
je 0x41d75a
mov rax, qword [rax + 0x1c8]
mov qword [r14], rax
mov r13, qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rbx + 8], rdi
mov rdi, qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rbx + 0x10], rsi
mov esi, 1
mov dword [rbx + 0xb4], 0
mov dword [rbx + 0x44], 1
mov qword [rbx + 0x28], 0xffffffffffffffff
mov rbp, r13
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov edx, 1
call rdi
test rax, rax
mov qword [rbx + 0x30], rax
jne 0x41d980
cmp esi, 1
jne 0x41d7c0
xor ecx, ecx
call r13
add esi, 1
jmp 0x41d791
mov ecx, 0x14
call rbp
cmp esi, 5
jne 0x41d7b7
mov rax, qword [rbx + 0x30]
mov qword [rbx + 0x38], 0xffffffffffffffff
mov qword [rbx + 0x60], 0xffffffffffffffff
mov dword [rbx], 0xbab1f00d
mov dword [rbx + 0xb8], 0
mov dword [rbx + 0xb0], 0
test rax, rax
je 0x41d8b7
test r12, r12
je 0x41d9c0
mov eax, dword [r12]
mov rsi, qword [r12 + 0x10]
test al, 8
mov dword [rbx + 0x44], eax
jne 0x41d950
mov eax, dword [r12 + 0x18]
mov edx, esi
mov dword [rbx + 0xb8], eax
xor ecx, ecx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 4
mov r9, rbx
lea r8, [sym.pthread_create_wrapper]
call qword [sym.imp.msvcrt.dll__beginthreadex]
mov rsi, rax
lea rax, [rax - 1]
cmp rax, 0xfffffffffffffffd
ja 0x41d887
mov edx, dword [rbx + 0xb8]
cmp edx, 0xfffffff2
jl 0x41d8e5
cmp edx, 0xffffffff
jl 0x41d970
cmp edx, 0xe
jg 0x41d9b0
cmp edx, 2
mov eax, 2
cmovge edx, eax
jmp 0x41d8ea
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x41d896
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbx + 0x38]
call sym.pthread_mutex_destroy
mov qword [rbx + 0x60], 0xffffffffffffffff
mov qword [rbx + 0x30], 0
mov qword [rbx + 0x28], 0
test r14, r14
je 0x41d8c3
mov qword [r14], 0
cmp qword [rbx + 0x1c0], 0
je 0x41d9c7
mov eax, 0xb
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov edx, 0xfffffff1
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
test byte [rbx + 0x44], 4
je 0x41d940
mov rcx, rsi
mov qword [rbx + 0x28], 0
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov qword [rbx + 0x28], rsi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x41d91d
call sym.__pthread_self_lite
mov eax, dword [rax + 0xb8]
mov edx, esi
mov dword [rbx + 0xb8], eax
jmp 0x41d82d
mov edx, 0xfffffffe
jmp 0x41d8ea
mov qword [rbx + 0x38], 0xffffffffffffffff
mov qword [rbx + 0x60], 0xffffffffffffffff
mov dword [rbx], 0xbab1f00d
mov dword [rbx + 0xb8], 0
mov dword [rbx + 0xb0], 0
jmp 0x41d803
mov edx, 0xf
jmp 0x41d8ea
xor edx, edx
jmp 0x41d82d
mov rcx, rbx
call sym.push_pthread_mem.part.0
jmp 0x41d8d1
Function at 0x41df00
Capabilities:
Check mutex on windows

Disassembly:
lea rcx, str.dummy_concurrency_level_shmem
xor r8d, r8d
mov edx, 4
jmp sym.__shmem_winpthreads_grab

Function at 0x41e2e0
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [sym.__shmem_winpthreads_init_mutex_global_shmem]
lea rcx, str.mutex_global_shmem
mov edx, 8
jmp sym.__shmem_winpthreads_grab

Function at 0x41e300
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [sym.__shmem_winpthreads_init_mutex_global_static_shmem]
lea rcx, str.mutex_global_static_shmem
mov edx, 8
jmp sym.__shmem_winpthreads_grab

Function at 0x41e400
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [sym.__shmem_winpthreads_init_mxattr_recursive_shmem]
lea rcx, str.mxattr_recursive_shmem
mov edx, 4
jmp sym.__shmem_winpthreads_grab

Function at 0x41e420
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [sym.__shmem_winpthreads_init_mxattr_errorcheck_shmem]
lea rcx, str.mxattr_errorcheck_shmem
mov edx, 4
jmp sym.__shmem_winpthreads_grab

Function at 0x41f050
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [sym.__shmem_winpthreads_init_cond_locked_shmem_cond]
lea rcx, str.cond_locked_shmem_cond
mov edx, 8
jmp sym.__shmem_winpthreads_grab
Function at 0x420040
Capabilities:
Check mutex on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x80]
mov rdi, rcx
movsxd r12, edx
mov r13, r8
call sym.strlen
mov r14, rax
lea ebx, [rax + 0xf]
lea eax, [rax + 0x51]
cdqe
add rax, 0xf
and rax, 0xfffffffffffffff0
call fcn.0040f510
sub rsp, rax
movsxd r15, r14d
movabs rax, 0x656d68732d636367
lea rsi, [rsp + 0x20]
lea rcx, [rsp + 0x2f]
mov r8, r15
mov rdx, rdi
mov qword [rsp + 0x20], rax
mov eax, 0x326d
mov dword [rsp + 0x28], 0x64742d6d
mov word [rsp + 0x2c], ax
movsxd rbx, ebx
mov byte [rsp + 0x2e], 0x2d
call sym.memcpy
lea rax, [rsi + r15 + 0x10]
lea r15d, [r14 + 0x50]
movabs rdx, 0x6161616161616161
xor ecx, ecx
mov r8, rsi
mov qword [rax], rdx
mov qword [rax + 8], rdx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], rdx
mov qword [rax + 0x20], rdx
mov qword [rax + 0x28], rdx
mov qword [rax + 0x30], rdx
mov qword [rax + 0x38], rdx
movsxd rax, r15d
xor edx, edx
mov byte [rsp + rax + 0x20], 0
mov byte [rsp + rbx + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov byte [rsp + rbx + 0x20], 0x2d
mov rdi, rax
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x420129
int3
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindAtomA]
test ax, ax
jne 0x4201c2
mov rcx, r12
add r14d, 0x10
call sym.malloc
mov r10d, 0x40
mov rbx, rax
bt rbx, r10
jae 0x420164
mov r11d, r15d
sub r11d, r10d
movsxd r11, r11d
mov byte [rsi + r11], 0x41
sub r10d, 1
jne 0x420150
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_AddAtomA]
test ax, ax
je 0x4201bf
mov rdx, rsi
movzx ecx, ax
mov r9d, r14d
mov r8d, r15d
call sym.get_ptr_from_atom_1
cmp rax, rbx
mov rsi, rax
je 0x4201d9
mov rcx, rbx
call sym.free
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rsi
lea rsp, [rbp - 0x58]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
int3
lea r9d, [r14 + 0x10]
mov rdx, rsi
movzx ecx, ax
mov r8d, r15d
call sym.get_ptr_from_atom_1
mov rsi, rax
jmp 0x420199
xor edx, edx
mov r8, r12
mov rcx, rbx
call sym.memset
test r13, r13
je 0x420199
mov rcx, rbx
call r13
jmp 0x420199

Function at 0x420330
Capabilities:
Check mutex on windows

Disassembly:
lea rcx, str.global_lock_spinlock
xor r8d, r8d
mov edx, 4
jmp sym.__shmem_winpthreads_grab

Function at 0x420b20
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [sym.__shmem_winpthreads_init_rwl_global_shmem]
lea rcx, str.rwl_global_shmem
mov edx, 8
jmp sym.__shmem_winpthreads_grab

Function at 0x420bf0
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [sym.__shmem_winpthreads_init_cond_locked_shmem_rwlock]
lea rcx, str.cond_locked_shmem_rwlock
mov edx, 8
jmp sym.__shmem_winpthreads_grab

Function at 0x421730
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [sym.__shmem_init_init]
lea rcx, str.init
mov edx, 8
jmp dbg.__shmem_grab

Function at 0x421750
Capabilities:
Check mutex on windows

Disassembly:
lea rcx, str.eh_globals
xor r8d, r8d
mov edx, 0x10
jmp dbg.__shmem_grab
Function at 0x421e00
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [sym.__shmem_init___terminate_handler_sh]
lea rcx, str.__terminate_handler_sh
mov edx, 8
jmp dbg.__shmem_grab

Function at 0x421e20
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [sym.__shmem_init___unexpected_handler_sh]
lea rcx, str.__unexpected_handler_sh
mov edx, 8
jmp dbg.__shmem_grab

Function at 0x423110
Capabilities:
Read file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov r9, qword [rcx + 0x40]
mov rsi, rdx
mov rbx, rcx
mov edx, 1
mov rcx, rsi
call sym.fread
test rax, rax
jle 0x423141
movzx edx, byte [rsi + rax - 1]
mov dword [rbx + 0x48], edx
add rsp, 0x28
pop rbx
pop rsi
ret
mov dword [rbx + 0x48], 0xffffffff
add rsp, 0x28
pop rbx
pop rsi
ret

Function at 0x423a90
Capabilities:
Write file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
cmp byte [0x004bbe50], 0
jne 0x423b57
mov byte [0x004bbe50], 1
call sym.__cxa_current_exception_type
test rax, rax
je 0x423bea
mov rbx, qword [rax + 8]
xor eax, eax
lea r9, [rsp + 0x2c]
cmp byte [rbx], 0x2a
mov dword [rsp + 0x2c], 0xffffffff
sete al
xor r8d, r8d
xor edx, edx
add rbx, rax
mov rcx, rbx
call sym.__cxa_demangle
mov rsi, qword [sym.imp.msvcrt.dll___iob_func]
mov rdi, rax
call rsi
lea rcx, str.terminate_called_after_throwing_an_instance_of_
lea r9, [rax + 0x60]
mov r8d, 0x30
mov edx, 1
call sym.fwrite
cmp dword [rsp + 0x2c], 0
je 0x423b47
call rsi
lea rdx, [rax + 0x60]
mov rcx, rbx
call sym.fputs
call rsi
lea rcx, [0x004bd111]
lea r9, [rax + 0x60]
mov r8d, 2
mov edx, 1
call sym.fwrite
cmp dword [rsp + 0x2c], 0
je 0x423b7d
call sym.__cxa_rethrow
call rsi
lea rdx, [rax + 0x60]
mov rcx, rdi
call sym.fputs
jmp 0x423b1e
call qword [sym.imp.msvcrt.dll___iob_func]
lea rcx, str.terminate_called_recursively_n
lea r9, [rax + 0x60]
mov r8d, 0x1d
mov edx, 1
call sym.fwrite
call sym.abort
mov rcx, rdi
call sym.free
jmp 0x423b42
call sym.abort
call qword [sym.imp.msvcrt.dll___iob_func]
lea rcx, str.terminate_called_without_an_active_exception_n
lea r9, [rax + 0x60]
mov r8d, 0x2d
mov edx, 1
call sym.fwrite
jmp 0x423be5

Function at 0x4522f0
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r12, qword [sym.imp.msvcrt.dll__errno]
mov rbp, rcx
mov rdi, rdx
mov esi, r8d
mov rcx, rbp
call method.std::__basic_file_char_.fd__
mov r8d, esi
mov rdx, rdi
mov ecx, eax
call sym.read
movsxd rbx, eax
cmp rbx, 0xffffffffffffffff
je 0x452340
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call r12
cmp dword [rax], 4
je 0x45230a
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x140001570
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x140015c60], rbx
je 0x1400015d7
cmp rax, rbx
jne 0x1400015ca
mov edi, 1
mov esi, edi
jmp 0x1400015dc
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x1400015af
mov edi, 1
mov eax, dword [0x140015c68]
cmp eax, edi
jne 0x1400015f4
mov ebx, 0x1f
mov ecx, ebx
call sub.msvcrt.dll__amsg_exit
jmp 0x14000166a
mov eax, dword [0x140015c68]
test eax, eax
jne 0x14000165f
mov dword [0x140015c68], edi
lea r15, [0x140010c08]
lea rbx, [0x140010bf0]
mov qword [rsp + 0x30], rbx
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rbx, r15
jae 0x140001651
test eax, eax
jne 0x140001655
cmp qword [rbx], r14
je 0x140001646
movabs r10, 0xd30527475e523070
mov rax, qword [rbx]
mov rcx, qword [0x140010b98]
call rcx
mov dword [rsp + 0x24], eax
add rbx, 8
mov qword [rsp + 0x30], rbx
jmp 0x14000161e
test eax, eax
je 0x140001665
mov eax, 0xff
jmp 0x1400017cb
mov dword [0x1400153e4], edi
mov ebx, 0x1f
mov eax, dword [0x140015c68]
cmp eax, edi
jne 0x140001691
lea rdx, [0x140010be8]
lea rcx, [0x140010bb0]
call sub.msvcrt.dll__initterm
mov dword [0x140015c68], 2
test esi, esi
jne 0x14000169f
mov rax, r14
xchg qword [0x140015c60], rax
cmp qword [0x140015c80], r14
je 0x1400016dc
lea rcx, [0x140015c80]
call fcn.140001c80
test eax, eax
je 0x1400016dc
movabs r10, 0x99012e4578d92870
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140015c80]
mov r9, qword [0x140010b98]
call r9
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x1400016f5
mov eax, 0xff
jmp 0x1400017cb
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
movzx eax, word [rcx]
cmp ax, 0x20
ja 0x14000177c
test ax, ax
je 0x140001710
test edx, edx
jne 0x14000177c
sub ax, di
cmp ax, bx
ja 0x140001726
add rcx, 2
mov qword [rsp + 0x28], rcx
movzx eax, word [rcx]
jmp 0x140001710
test byte [rsp + 0x7c], dil
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.14000702c
mov dword [0x1400153e0], eax
cmp dword [0x140015400], r14d
jne 0x140001765
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x1400153e4], r14d
jne 0x14000177a
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x1400153e0]
jmp 0x1400017cb
cmp ax, 0x22
jne 0x140001790
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x1400016fe
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call fcn.14012e000
add rsp, 0x28
jmp 0x140001570
Function at 0x1400013f0
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
sub rsp, 0x68
mov rax, qword [0x140047f48]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor edx, edx
mov ecx, 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0xffffffffffffffff
je 0x1400014bc
mov dword [rsp + 0x30], 0x1c
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x1400014b1
mov eax, dword [rsp + 0x30]
cmp rax, 0x10
jb 0x140001496
mov eax, dword [rsp + 0x78]
cmp dword [rsp + 0x38], eax
je 0x140001496
mov eax, dword [rsp + 0x70]
cmp dword [rsp + 0x3c], eax
jne 0x140001496
mov r8d, dword [rsp + 0x38]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x140001496
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x30], 0x1c
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x140001443
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14000fe10
add rsp, 0x68
ret

Function at 0x1400014e0
Capabilities:
Enumerate threads
Resume thread

Disassembly:
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
sub rsp, 0x68
mov rax, qword [0x140047f48]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor edx, edx
mov ecx, 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0xffffffffffffffff
je 0x1400015ac
mov dword [rsp + 0x30], 0x1c
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x1400015a1
mov eax, dword [rsp + 0x30]
cmp rax, 0x10
jb 0x140001586
mov eax, dword [rsp + 0x78]
cmp dword [rsp + 0x38], eax
je 0x140001586
mov eax, dword [rsp + 0x70]
cmp dword [rsp + 0x3c], eax
jne 0x140001586
mov r8d, dword [rsp + 0x38]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x140001586
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x30], 0x1c
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x140001533
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14000fe10
add rsp, 0x68
ret
Function at 0x140001740
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x178
mov rax, qword [0x140047f48]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov byte [rsp + 0x20], 0
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x14000178b
xor eax, eax
jmp 0x1400017cc
lea rdx, [rsp + 0x5c]
mov rcx, qword [rsp + 0x180]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x1400017a9
mov byte [rsp + 0x20], 1
jmp 0x1400017bc
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x14000178b
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, byte [rsp + 0x20]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.14000fe10
add rsp, 0x178
ret

Function at 0x1400017f0
Capabilities:
Get hostname
Initialize winsock library

Disassembly:
sub rsp, 0x2d8
mov rax, qword [0x140047f48]
xor rax, rsp
mov qword [rsp + 0x2c0], rax
lea rdx, [rsp + 0x20]
mov cx, 0x101
call sub.WS2_32.dll_WSAStartup
test eax, eax
je 0x14000181d
jmp 0x14000183d
mov edx, pe_nt_image_headers64
lea rcx, [rsp + 0x1c0]
call sub.WS2_32.dll_gethostname
test eax, eax
jne 0x14000183d
lea rax, [rsp + 0x1c0]
jmp 0x140001842
call sub.WS2_32.dll_WSACleanup
mov rcx, qword [rsp + 0x2c0]
xor rcx, rsp
call fcn.14000fe10
add rsp, 0x2d8
ret
Function at 0x140001890
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xc8
mov rax, qword [0x140047f48]
xor rax, rsp
mov qword [rsp + 0xb8], rax
mov edx, 0x18
lea rcx, [rsp + 0x60]
call fcn.1400097a0
lea rcx, [rsp + 0x60]
call fcn.140004e00
mov ecx, 0x18
call fcn.140014754
mov qword [rsp + 0x20], rax
lea rcx, str.DNSAPI.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rsp + 0x30], rax
mov byte [rsp + 0xa0], 0x44
mov byte [rsp + 0xa1], WSAStartup
mov byte [rsp + 0xa2], reloc.WS2_32.dll_WSAStartup
mov byte [rsp + 0xa3], 0x47
mov byte [rsp + 0xa4], 0x65
mov byte [rsp + 0xa5], reloc.WS2_32.dll_WSACleanup
mov byte [rsp + 0xa6], 0x43
mov byte [rsp + 0xa7], 0x61
mov byte [rsp + 0xa8], 0x63
mov byte [rsp + 0xa9], 0x68
mov byte [rsp + 0xaa], 0x65
mov byte [rsp + 0xab], 0x44
mov byte [rsp + 0xac], 0x61
mov byte [rsp + 0xad], reloc.WS2_32.dll_WSACleanup
mov byte [rsp + 0xae], 0x61
mov byte [rsp + 0xaf], 0x54
mov byte [rsp + 0xb0], 0x61
mov byte [rsp + 0xb1], 0x62
mov byte [rsp + 0xb2], WSAStartup
mov byte [rsp + 0xb3], 0x65
mov byte [rsp + 0xb4], 0
lea rdx, [rsp + 0xa0]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x20]
call qword [rsp + gethostname]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x140001a36
lea rcx, [rsp + 0x78]
call fcn.140004ea0
mov rax, qword [rsp + 0x20]
mov rdx, qword [rax + 8]
lea rcx, [rsp + 0x40]
call fcn.140004bf0
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.140005e10
lea rcx, [rsp + 0x40]
call fcn.1400058d0
mov rax, qword [rsp + 0x20]
movzx eax, word [rax + 0x10]
mov dword [rsp + 0x98], eax
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x60]
call fcn.14000bc90
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x78]
call fcn.140005a20
jmp 0x1400019c2
mov rcx, qword [rsp + 0x20]
call fcn.140014740
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0xd0]
call fcn.140004d90
lea rcx, [rsp + 0x60]
call fcn.140005a00
mov rax, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.14000fe10
add rsp, 0xc8
ret
Function at 0x140001f80
Capabilities:
Hide thread from debugger

Disassembly:
sub rsp, 0x48
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rsp + 0x28], rax
lea rdx, str.NtSetInformationThread
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x11
mov rcx, rax
call qword [rsp + 0x30]
mov dword [rsp + 0x20], eax
add rsp, 0x48
ret

Function at 0x140001fe0
Capabilities:
Get mac address on windows

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x80
mov rax, qword [0x140047f48]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov ecx, 0x2c0
call fcn.14000fa00
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x14000202d
mov rdi, qword [rsp + 0x30]
xor eax, eax
mov ecx, 0x2c0
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
jmp 0x140002036
mov qword [rsp + 0x38], 0
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x68], 8
lea rdx, [rsp + 0x68]
mov rcx, qword [rsp + 0x20]
call sub.IPHLPAPI.DLL_GetAdaptersInfo
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0x6f
jne 0x1400020ce
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x40], rax
mov edx, 0x2c0
mov rcx, qword [rsp + 0x40]
call fcn.14000fa3c
cmp qword [rsp + 0x40], 0
jne 0x14000208e
mov qword [rsp + 0x50], 0
jmp 0x1400020a1
mov qword [rsp + 0x20], 0x8123
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x50], rax
mov eax, dword [rsp + 0x68]
mov ecx, eax
call fcn.14000fa44
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x68]
mov rcx, qword [rsp + 0x20]
call sub.IPHLPAPI.DLL_GetAdaptersInfo
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
jne 0x140002102
cmp qword [rsp + 0x20], 0
je 0x140002102
mov rax, qword [rsp + 0x20]
add rax, 0x198
mov r8d, 8
mov rdx, rax
mov rcx, qword [rsp + 0x90]
call fcn.140010ab0
jmp 0x140002102
cmp qword [rsp + 0x20], 0
je 0x140002149
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x48], rax
mov edx, 0x2c0
mov rcx, qword [rsp + 0x48]
call fcn.14000fa3c
cmp qword [rsp + 0x48], 0
jne 0x140002136
mov qword [rsp + 0x60], 0
jmp 0x140002149
mov qword [rsp + 0x20], 0x8123
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14000fe10
add rsp, 0x80
pop rdi
ret