joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800a4b60
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x530
mov rax, qword [0x180116980]
xor rax, rsp
mov qword [rsp + 0x520], rax
xor ebx, ebx
mov rdi, rdx
mov esi, ecx
test rdx, rdx
je 0x1800a4bcc
lea edx, [rbx + 0x2d]
mov rcx, rdi
call sub.msvcrt.dll_strchr
test rax, rax
je 0x1800a4bcc
mov ecx, ebx
lea r8, [rsp + 0x120]
mov rdx, rdi
nop dword [rax]
movsx eax, byte [rdx]
test al, al
je 0x1800a4c1f
mov word [r8], ax
inc ecx
add r8, 2
inc rdx
cmp ecx, 0x100
jne 0x1800a4bb0
mov rcx, qword [0x1801b8ae8]
test rcx, rcx
jne 0x1800a4c02
call fcn.1800a69e0
mov rcx, rax
lea rdx, str.setlocale
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov rcx, 0xffffffffffffffff
cmovne rcx, rax
mov qword [0x1801b8ae8], rcx
cmp rcx, 0xffffffffffffffff
cmovne rbx, rcx
test rbx, rbx
je 0x1800a4d03
mov rdx, rdi
mov ecx, esi
call rbx
jmp 0x1800a4d05
movsxd rax, ecx
add rax, rax
cmp rax, 0x200
jae 0x1800a4d2a
mov edx, 0x2d
mov word [rsp + rax + 0x120], bx
lea rcx, [rsp + 0x120]
call sub.msvcrt.dll_wcsrchr
test rax, rax
je 0x1800a4bcc
mov r9d, 0xff
lea r8, [rsp + 0x320]
mov edx, 0x1001
lea rcx, [rsp + 0x120]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
je 0x1800a4bcc
lea ecx, [rax - 1]
mov r9d, 0x100
movsxd rdx, ecx
lea r8, [rsp + 0x320]
sub r9d, eax
mov ecx, 0x5f
cdqe
mov word [rsp + rdx*2 + 0x320], cx
mov edx, 0x1002
lea rcx, [rsp + 0x120]
lea r8, [r8 + rax*2]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
je 0x1800a4bcc
lea rcx, [rsp + 0x320]
mov eax, ebx
lea rdx, [rsp + 0x20]
movzx r8d, word [rcx]
test r8w, r8w
je 0x1800a4cf3
mov byte [rdx], r8b
inc eax
inc rdx
add rcx, 2
cmp eax, 0x100
jne 0x1800a4cd1
jmp 0x1800a4bcc
cdqe
lea rdi, [rsp + 0x20]
mov byte [rsp + rax + 0x20], bl
jmp 0x1800a4bcc
xor eax, eax
mov rcx, qword [rsp + 0x520]
xor rcx, rsp
call fcn.180096700
lea r11, [rsp + 0x530]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.180096e20
int3
Function at 0x1400331b8
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
jmp 0x1400660d0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x218
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x4e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x238]
mov rax, qword [0x1400c2040]
xor rax, rbp
mov qword [rbp + 0x1e8], rax
lea rcx, [0x1400cf6f4]
call fcn.14003484c
nop
mov qword [rbp + 8], 0
mov dword [rbp + 0x24], 0
lea r9, [rbp + 0x24]
mov r8d, dword [rbp + 0x24]
mov rdx, qword [rbp + 8]
mov ecx, 0xb
call fcn.1400341f3
mov dword [rbp + 0x44], eax
cmp dword [rbp + 0x44], 0xc0000004
jne 0x14006619d
cmp qword [rbp + 8], 0
je 0x140066165
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
nop
mov eax, dword [rbp + 0x24]
mov r9d, 4
mov r8d, 0x3000
mov edx, eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp + 8], rax
lea r9, [rbp + 0x24]
mov r8d, dword [rbp + 0x24]
mov rdx, qword [rbp + 8]
mov ecx, 0xb
call fcn.1400341f3
mov dword [rbp + 0x44], eax
jmp 0x140066142
cmp dword [rbp + 0x44], 0
jge 0x1400661c4
cmp qword [rbp + 8], 0
je 0x1400661bd
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
nop
xor eax, eax
jmp 0x1400662ff
mov rax, qword [rbp + 8]
mov qword [rbp + 0x68], rax
cmp qword [rbp + 0x68], 0
jne 0x1400661da
xor eax, eax
jmp 0x1400662ff
mov dword [rbp + 0x84], 0
jmp 0x1400661f4
mov eax, dword [rbp + 0x84]
inc eax
mov dword [rbp + 0x84], eax
mov rax, qword [rbp + 0x68]
mov eax, dword [rax]
cmp dword [rbp + 0x84], eax
jae 0x1400662ea
mov eax, dword [rbp + 0x84]
imul rax, rax, 0x128
mov rcx, qword [rbp + 0x68]
lea rax, [rcx + rax + 8]
mov ecx, dword [rbp + 0x84]
imul rcx, rcx, 0x128
mov rdx, qword [rbp + 0x68]
movzx ecx, word [rdx + rcx + 0x2e]
lea rax, [rax + rcx + 0x28]
mov rdx, rax
lea rcx, [rbp + 0xa8]
call fcn.140033af5
nop
mov rcx, qword [rbp + 0x210]
call fcn.140033299
mov qword [rbp + 0x1d8], rax
lea rcx, [rbp + 0xa8]
call fcn.140033299
mov qword [rbp + 0x1e0], rax
mov rdx, qword [rbp + 0x1d8]
mov rcx, qword [rbp + 0x1e0]
call qword [sym.imp.ucrtbased.dll__stricmp]
test eax, eax
jne 0x1400662d8
mov eax, dword [rbp + 0x84]
imul rax, rax, 0x128
mov rcx, qword [rbp + 0x68]
mov rax, qword [rcx + rax + 0x18]
mov qword [rbp + 0xe8], rax
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
nop
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x1c8], rax
lea rcx, [rbp + 0xa8]
call fcn.1400334b5
mov rax, qword [rbp + 0x1c8]
jmp 0x1400662ff
lea rcx, [rbp + 0xa8]
call fcn.1400334b5
nop
jmp 0x1400661e6
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
nop
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x1400b6090]
call fcn.140034400
mov rax, rdi
mov rcx, qword [rbp + 0x1e8]
xor rcx, rbp
call fcn.140033bc2
lea rsp, [rbp + 0x1f8]
pop rdi
pop rbp
ret
Function at 0x1400332b2
Capabilities:
Write file on windows

Disassembly:
jmp 0x14004e870
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x1400cf0fc]
call fcn.14003484c
nop
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x68], 0
je 0x14004e8c8
mov r8, qword [rbp + 0x130]
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x14004e9da
mov rax, qword [rbp + 0x130]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x130], 0
jle 0x14004e973
cmp qword [rbp + 0x28], 0
jle 0x14004e973
mov rax, qword [rbp + 0x28]
cmp qword [rbp + 0x130], rax
jge 0x14004e911
mov rax, qword [rbp + 0x130]
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x128]
mov rcx, rax
call fcn.14003469e
nop
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x128]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov edx, dword [rbp + 0x28]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
nop
cmp qword [rbp + 0x130], 0
jle 0x14004e9c9
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x80], 0
je 0x14004e9c9
mov rax, qword [rbp + 0x120]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x130]
mov edx, 1
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.ucrtbased.dll_fwrite]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x130]
mov rcx, qword [rbp + 8]
sub rcx, rax
mov rax, rcx
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x1400336e0
Capabilities:
Get common file path

Disassembly:
jmp 0x140065ee0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x448
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xaa
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x468]
mov rax, qword [0x1400c2040]
xor rax, rbp
mov qword [rbp + 0x410], rax
mov dword [rbp + 0x3f4], 0
lea rcx, [0x1400cf6f4]
call fcn.14003484c
nop
lea rax, [rbp + 0x10]
mov rdi, rax
xor eax, eax
mov ecx, 0x20a
rep stosb byte [rdi], al
lea rdx, [rbp + 0x10]
mov ecx, 0x105
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov dword [rbp + 0x234], eax
cmp dword [rbp + 0x234], 0
je 0x140065f6e
cmp dword [rbp + 0x234], 0x105
jbe 0x140065fc8
lea rdx, str.____Failed_to_get_temp_path
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140033c71
mov qword [rbp + 0x408], rax
lea rdx, [0x140033bd6]
mov rcx, qword [rbp + 0x408]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
lea rdx, [0x1400aee4c]
mov rcx, qword [rbp + 0x440]
call fcn.140033820
mov eax, dword [rbp + 0x3f4]
or eax, 1
mov dword [rbp + 0x3f4], eax
mov rax, qword [rbp + 0x440]
jmp 0x14006603b
lea rcx, [rbp + 0x10]
call qword [sym.imp.ucrtbased.dll_wcslen]
movzx eax, word [rbp + rax*2 + 0xe]
cmp eax, 0x5c
jne 0x140066015
lea rcx, [rbp + 0x10]
call qword [sym.imp.ucrtbased.dll_wcslen]
lea rax, [rax + rax - 2]
mov qword [rbp + 0x3d8], rax
cmp qword [rbp + 0x3d8], 0x20a
jae 0x140066001
jmp 0x140066007
call fcn.140034180
nop
xor eax, eax
mov rcx, qword [rbp + 0x3d8]
mov word [rbp + rcx + 0x10], ax
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x440]
call fcn.140033820
mov eax, dword [rbp + 0x3f4]
or eax, 1
mov dword [rbp + 0x3f4], eax
mov rax, qword [rbp + 0x440]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x1400b5eb0]
call fcn.140034400
mov rax, rdi
mov rcx, qword [rbp + 0x410]
xor rcx, rbp
call fcn.140033bc2
lea rsp, [rbp + 0x428]
pop rdi
pop rbp
ret
Function at 0x140033825
Capabilities:
Enumerate pe sections

Disassembly:
jmp 0x140065d60
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x188
lea rbp, [rsp + 0x20]
lea rcx, [0x1400cf6f4]
call fcn.14003484c
nop
mov rcx, qword [rbp + 0x180]
call fcn.140033adc
mov qword [rbp + 8], rax
mov rax, qword [rbp + 0x188]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rbp + 0x188]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
movzx eax, word [rax + 0x14]
mov rcx, qword [rbp + 0x28]
lea rax, [rcx + rax + 0x18]
mov qword [rbp + 0x48], rax
mov dword [rbp + 0x64], 0
jmp 0x140065ddc
mov eax, dword [rbp + 0x64]
inc eax
mov dword [rbp + 0x64], eax
mov rax, qword [rbp + 0x28]
movzx eax, word [rax + 6]
cmp dword [rbp + 0x64], eax
jae 0x140065e84
mov eax, dword [rbp + 0x64]
imul rax, rax, 0x28
mov rcx, qword [rbp + 0x48]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
mov rax, qword [rbp + 0x88]
mov r8, qword [rbp + 8]
mov rdx, qword [rbp + 0x180]
mov rcx, rax
call fcn.140033924
test eax, eax
jne 0x140065e7f
mov rax, qword [rbp + 0x88]
mov rcx, rax
call fcn.140033adc
cmp qword [rbp + 8], rax
jne 0x140065e7f
mov rax, qword [rbp + 0x88]
cmp dword [rax + 0xc], 0
jne 0x140065e49
xor eax, eax
jmp 0x140065e86
cmp qword [rbp + 0x190], 0
je 0x140065e66
mov rax, qword [rbp + 0x190]
mov rcx, qword [rbp + 0x88]
mov ecx, dword [rcx + 8]
mov dword [rax], ecx
mov rax, qword [rbp + 0x88]
mov eax, dword [rax + 0xc]
mov rcx, qword [rbp + 0x188]
add rcx, rax
mov rax, rcx
jmp 0x140065e86
jmp 0x140065dd4
xor eax, eax
lea rsp, [rbp + 0x168]
pop rdi
pop rbp
ret

Function at 0x140033db1
Capabilities:
Terminate process

Disassembly:
jmp 0x140094b00
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret
Function at 0x140033fb4
Capabilities:
Get geographical location

Disassembly:
jmp 0x140090ae0
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x58
mov r9d, 2
lea r8, [rsp + 0x40]
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x140090b1d
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x40]
mov r8d, dword [rsp + 0x60]
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x48]
mov edx, eax
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax]
call fcn.14003482e
add rsp, 0x58
ret
Function at 0x1400340c7
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400979e0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140097a00
xor al, al
jmp 0x140097a81
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140097a13
xor al, al
jmp 0x140097a81
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140097a3d
xor al, al
jmp 0x140097a81
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140097a51
xor al, al
jmp 0x140097a81
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140097a63
xor al, al
jmp 0x140097a81
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140097a7f
xor al, al
jmp 0x140097a81
mov al, 1
add rsp, 0x38
ret
Function at 0x140034572
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400616c0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x1400cf492]
call fcn.14003484c
nop
mov rax, qword [rbp + 0x120]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400616fd
xor eax, eax
jmp 0x14006172a
mov rax, qword [rbp + 8]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rbp + 0x120]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
cmp dword [rax], 0x4550
je 0x140061726
xor eax, eax
jmp 0x14006172a
mov rax, qword [rbp + 0x28]
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x1400346a3
Capabilities:
Get explorer pid

Disassembly:
jmp 0x140054b40
push rbp
push rdi
sub rsp, 0x138
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x16
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x1400c2040]
xor rax, rbp
mov qword [rbp + 0x100], rax
lea rcx, [0x1400cf247]
call fcn.14003484c
nop
mov dword [rbp + 4], 0
call qword [sym.imp.USER32.dll_GetShellWindow]
lea rdx, [rbp + 4]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
nop
call fcn.140034a04
mov dword [rbp + 0x24], eax
mov eax, dword [rbp + 4]
cmp dword [rbp + 0x24], eax
jne 0x140054c15
lea rdx, str.___Pausing_to_allow_for_debugging
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140033c71
mov qword [rbp + 0xf8], rax
lea rdx, [0x140033bd6]
mov rcx, qword [rbp + 0xf8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
lea rdx, str.___Press_enter_to_close
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140033c71
mov qword [rbp + 0xf8], rax
lea rdx, [0x140033bd6]
mov rcx, qword [rbp + 0xf8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140D.dll_public:_int___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_void____ptr64]
nop
lea rcx, [rbp - 0x20]
lea rdx, [0x1400b28a0]
call fcn.140034400
mov rcx, qword [rbp + 0x100]
xor rcx, rbp
call fcn.140033bc2
lea rsp, [rbp + 0x118]
pop rdi
pop rbp
ret
Function at 0x1400347de
Capabilities:
Write file on windows

Disassembly:
jmp 0x1400495f0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x32
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1d8]
mov rax, qword [0x1400c2040]
xor rax, rbp
mov qword [rbp + 0x170], rax
lea rcx, [0x1400cf0fc]
call fcn.14003484c
nop
mov rax, qword [rbp + 0x1a0]
cmp qword [rax + 0x68], 0
je 0x140049657
mov rax, qword [rbp + 0x1a0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14004965e
mov al, 1
jmp 0x1400497ce
mov rax, qword [rbp + 0x1a0]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov qword [rbp + 0x158], rax
call fcn.1400336f4
mov dword [rbp + 0x160], eax
mov edx, dword [rbp + 0x160]
mov rcx, qword [rbp + 0x1a0]
call qword [rbp + 0x158]
mov dword [rbp + 0x164], eax
call fcn.1400336f4
mov dword [rbp + 0x168], eax
mov edx, dword [rbp + 0x164]
mov ecx, dword [rbp + 0x168]
call fcn.14003431a
movzx eax, al
test eax, eax
je 0x1400496c1
xor al, al
jmp 0x1400497ce
mov qword [rbp + 8], 0x20
mov rax, qword [rbp + 0x1a0]
mov rax, qword [rax + 0x68]
mov qword [rbp + 0x158], rax
lea rax, [rbp + 0x48]
mov rcx, qword [rbp + 0x1a0]
add rcx, 0x74
lea rdx, [rbp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rbp + 0x28]
mov rdx, rcx
mov rcx, qword [rbp + 0x158]
call qword [sym.imp.MSVCP140D.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rbp + 0x160], eax
cmp dword [rbp + 0x160], 0
je 0x140049734
cmp dword [rbp + 0x160], 1
je 0x14004973f
cmp dword [rbp + 0x160], 3
je 0x1400497bd
jmp 0x1400497cc
mov rax, qword [rbp + 0x1a0]
mov byte [rax + 0x71], 0
lea rax, [rbp + 0x28]
mov rcx, qword [rbp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jbe 0x14004978f
mov rax, qword [rbp + 0x1a0]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x88]
mov edx, 1
lea rcx, [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_fwrite]
cmp qword [rbp + 0x88], rax
je 0x14004978f
xor al, al
jmp 0x1400497ce
mov rax, qword [rbp + 0x1a0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x1400497aa
mov dword [rbp + 0x154], 1
jmp 0x1400497b4
mov dword [rbp + 0x154], 0
movzx eax, byte [rbp + 0x154]
jmp 0x1400497ce
mov rax, qword [rbp + 0x1a0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x1400497ce
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x1400adb80]
call fcn.140034400
mov rax, rdi
mov rcx, qword [rbp + 0x170]
xor rcx, rbp
call fcn.140033bc2
lea rsp, [rbp + 0x188]
pop rdi
pop rbp
ret
Function at 0x140034a04
Capabilities:
Enumerate processes

Disassembly:
jmp 0x140057ce0
push rbp
push rdi
sub rsp, 0x468
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xb2
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x1400c2040]
xor rax, rbp
mov qword [rbp + 0x438], rax
lea rcx, [0x1400cf247]
call fcn.14003484c
nop
mov dword [rbp + 0x284], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rbp + 0x2a4], eax
xor edx, edx
mov ecx, 2
call fcn.140033b81
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0xffffffffffffffff
jne 0x140057d4d
jmp 0x140057da0
mov r8d, 0x238
xor edx, edx
lea rcx, [rbp + 0x30]
call fcn.14003422f
nop
mov dword [rbp + 0x30], 0x238
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.140033ec9
test eax, eax
jne 0x140057d79
jmp 0x140057da0
mov eax, dword [rbp + 0x2a4]
cmp dword [rbp + 0x38], eax
jne 0x140057d8f
mov eax, dword [rbp + 0x50]
mov dword [rbp + 0x284], eax
jmp 0x140057da0
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.1400344af
test eax, eax
jne 0x140057d79
cmp qword [rbp + 8], 0xffffffffffffffff
je 0x140057db2
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov eax, dword [rbp + 0x284]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x1400b2820]
call fcn.140034400
mov rax, rdi
mov rcx, qword [rbp + 0x438]
xor rcx, rbp
call fcn.140033bc2
lea rsp, [rbp + 0x448]
pop rdi
pop rbp
ret

Function at 0x1400951b0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.14003490f
movzx eax, al
test eax, eax
jne 0x1400951d0
mov ecx, 7
call fcn.14003442d
nop
mov byte [rsp + 0x20], 0
call fcn.140034496
mov byte [rsp + 0x21], al
cmp dword [0x1400c31e8], 1
jne 0x1400951f4
mov ecx, 7
call fcn.14003442d
nop
jmp 0x14009524c
cmp dword [0x1400c31e8], 0
jne 0x140095247
mov dword [0x1400c31e8], 1
lea rdx, [0x1400a0770]
lea rcx, [0x1400a0440]
call fcn.140033b6d
test eax, eax
je 0x140095228
mov eax, 0xff
jmp 0x140095351
lea rdx, [0x1400a0330]
lea rcx, [section..rdata]
call fcn.140034478
mov dword [0x1400c31e8], 2
jmp 0x14009524c
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.1400343dd
call fcn.14003416c
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x1400952a9
mov rcx, qword [rsp + 0x30]
call fcn.14003395b
movzx eax, al
test eax, eax
je 0x1400952a9
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x1400d1020]
nop
call fcn.140034270
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x1400952dd
mov rcx, qword [rsp + 0x38]
call fcn.14003395b
movzx eax, al
test eax, eax
je 0x1400952dd
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.14003476b
nop
call fcn.140095400
mov dword [rsp + 0x28], eax
call fcn.1400340c7
movzx eax, al
test eax, eax
jne 0x1400952fc
mov ecx, dword [rsp + 0x28]
call fcn.140033212
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x14009530b
call fcn.1400347b6
nop
xor edx, edx
mov cl, 1
call fcn.1400338e3
mov eax, dword [rsp + 0x28]
jmp 0x140095351
add rsp, 0x68
ret
Function at 0x180011177
Capabilities:
Create thread

Disassembly:
jmp 0x1800117a0
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x30]
lea rcx, [0x180055001]
call fcn.1800112e9
mov eax, dword [rbp + 0xf8]
mov dword [rbp + 0xc0], eax
cmp dword [rbp + 0xc0], 1
je 0x1800117df
jmp 0x18001181d
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x1800112c1]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
lea r8, [0x18004d088]
lea rdx, str.Injected_DLL
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov eax, 1
lea rsp, [rbp + 0xd8]
pop rdi
pop rbp
ret

Function at 0x1800111a4
Capabilities:
Terminate process

Disassembly:
jmp 0x180012e20
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret