joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400042a0
Capabilities:
Reference wmi statements

Disassembly:
sub rsp, 0xa8
mov rax, qword [0x140017040]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x58], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x34], 0
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x68]
call fcn.140001f40
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x140004458
lea rax, str.SELECT__FROM_Win32_PnPEntity
mov qword [rsp + 0x40], rax
mov r9, qword [rsp + 0x40]
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x68]
call fcn.140002190
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x140004458
mov qword [rsp + 0x60], 0
mov dword [rsp + 0x90], 0
cmp qword [rsp + 0x58], 0
je 0x140004422
mov rax, qword [rsp + 0x58]
mov rax, qword [rax]
mov rax, qword [rax + 0x20]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x60]
mov r8d, 1
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x58]
call qword [rsp + 0x48]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x90], 0
jne 0x1400043a0
jmp 0x140004422
mov rax, qword [rsp + 0x60]
mov rax, qword [rax]
mov rax, qword [rax + 0x20]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x78]
xor r8d, r8d
lea rdx, str.DeviceId
mov rcx, qword [rsp + 0x60]
call qword [rsp + 0x50]
mov dword [rsp + 0x38], eax
lea rdx, str.PCIVEN_80EEDEV_CAFE
mov rcx, qword [rsp + 0x80]
call fcn.1400010b0
test rax, rax
je 0x140004402
mov dword [rsp + 0x34], 1
jmp 0x140004422
lea rcx, [rsp + 0x78]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rax, qword [rsp + 0x60]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x60]
call qword [rax + 0x10]
jmp 0x14000434a
mov rax, qword [rsp + 0x68]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x68]
call qword [rax + 0x10]
mov rax, qword [rsp + 0x70]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x70]
call qword [rax + 0x10]
mov rax, qword [rsp + 0x58]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x58]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.14000e450
add rsp, 0xa8
ret
Function at 0x140004480
Capabilities:
Reference wmi statements

Disassembly:
sub rsp, 0xa8
mov rax, qword [0x140017040]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x50], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x34], 0
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x60]
call fcn.140001f40
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x140004635
lea r9, str.SELECT__FROM_Win32_NetworkAdapterConfiguration
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x60]
call fcn.140002190
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x140004635
mov qword [rsp + 0x58], 0
mov dword [rsp + 0x88], 0
cmp qword [rsp + 0x50], 0
je 0x1400045ff
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
mov rax, qword [rax + 0x20]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x88]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
mov r8d, 1
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x50]
call qword [rsp + 0x40]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x88], 0
jne 0x140004576
jmp 0x1400045ff
mov rax, qword [rsp + 0x58]
mov rax, qword [rax]
mov rax, qword [rax + 0x20]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x70]
xor r8d, r8d
lea rdx, str.MACAddress
mov rcx, qword [rsp + 0x58]
call qword [rsp + 0x48]
mov dword [rsp + 0x38], eax
movzx eax, word [rsp + 0x70]
cmp eax, 1
je 0x1400045fa
lea rdx, str.08:00:27
mov rcx, qword [rsp + 0x78]
call fcn.1400010b0
test rax, rax
je 0x1400045df
mov dword [rsp + 0x34], 1
jmp 0x1400045ff
lea rcx, [rsp + 0x70]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rax, qword [rsp + 0x58]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x58]
call qword [rax + 0x10]
jmp 0x140004520
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x50]
call qword [rax + 0x10]
mov rax, qword [rsp + 0x60]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x60]
call qword [rax + 0x10]
mov rax, qword [rsp + 0x68]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x68]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.14000e450
add rsp, 0xa8
ret
Function at 0x140004b30
Capabilities:
Get common file path

Disassembly:
push rdi
sub rsp, 0x470
mov rax, qword [0x140017040]
xor rax, rsp
mov qword [rsp + 0x460], rax
lea rax, str.system32drivers_vmmouse.sys
mov qword [rsp + 0x28], rax
lea rax, str.system32drivers_vmhgfs.sys
mov qword [rsp + 0x30], rax
mov eax, 2
mov word [rsp + 0x24], ax
movzx eax, word [0x140012bc0]
mov word [rsp + 0x40], ax
lea rax, [rsp + 0x42]
mov rdi, rax
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
movzx eax, word [0x140012bc4]
mov word [rsp + 0x250], ax
lea rax, [rsp + 0x252]
mov rdi, rax
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
mov edx, 0x104
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov dword [rsp + 0x20], 0
jmp 0x140004bd1
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
movzx eax, word [rsp + 0x24]
cmp dword [rsp + 0x20], eax
jge 0x140004c10
movsxd rax, dword [rsp + 0x20]
mov r8, qword [rsp + rax*8 + 0x28]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x250]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
lea rcx, [rsp + 0x250]
call fcn.140002540
test eax, eax
je 0x140004c0e
mov al, 1
jmp 0x140004c12
jmp 0x140004bc7
xor al, al
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.14000e450
add rsp, 0x470
pop rdi
ret

Function at 0x140004c30
Capabilities:
Get common file path
Get program files directory
Query environment variable

Disassembly:
push rsi
push rdi
sub rsp, 0x668
mov rax, qword [0x140017040]
xor rax, rsp
mov qword [rsp + 0x650], rax
movzx eax, word [0x140012bc8]
mov word [rsp + 0x20], ax
lea rax, [rsp + 0x22]
mov rdi, rax
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
lea rax, [rsp + 0x230]
lea rcx, str.VMWare_
mov rdi, rax
mov rsi, rcx
mov ecx, SafeArrayGetLBound
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x240]
mov rdi, rax
xor eax, eax
mov ecx, 0x1f8
rep stosb byte [rdi], al
call fcn.140002310
test eax, eax
je 0x140004cbf
mov r8d, 0x104
lea rdx, [rsp + 0x440]
lea rcx, str._ProgramW6432_
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x140004cd8
xor r9d, r9d
mov r8d, 0x26
lea rdx, [rsp + 0x440]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea r8, [rsp + 0x230]
lea rdx, [rsp + 0x440]
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
lea rcx, [rsp + 0x20]
call fcn.140002590
mov rcx, qword [rsp + 0x650]
xor rcx, rsp
call fcn.14000e450
add rsp, 0x668
pop rdi
pop rsi
ret

Function at 0x140004ea0
Capabilities:
Check if process is running under wine

Disassembly:
sub rsp, 0x38
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140004ec2
xor eax, eax
jmp 0x140004ee2
lea rdx, str.wine_get_unix_file_name
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140004edd
xor eax, eax
jmp 0x140004ee2
mov eax, 1
add rsp, 0x38
ret
Function at 0x140004ef0
Capabilities:
Check if process is running under wine

Disassembly:
sub rsp, 0x38
lea rax, str.SOFTWAREWine
mov qword [rsp + 0x28], rax
mov eax, 1
mov word [rsp + 0x20], ax
mov dword [rsp + 0x24], 0
jmp 0x140004f1e
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
movzx eax, word [rsp + 0x20]
cmp dword [rsp + 0x24], eax
jge 0x140004f49
movsxd rax, dword [rsp + 0x24]
mov rdx, qword [rsp + rax*8 + 0x28]
mov rcx, 0xffffffff80000001
call fcn.140002490
test eax, eax
je 0x140004f47
mov al, 1
jmp 0x140004f4b
jmp 0x140004f14
xor al, al
add rsp, 0x38
ret

Function at 0x1400054d0
Capabilities:
Check for debugger via api

Disassembly:
sub rsp, 0x38
mov rax, qword [0x140017040]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14000e450
add rsp, 0x38
ret

Function at 0x1400056f0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get system information on windows

Disassembly:
push rdi
sub rsp, 0x80
mov rax, qword [0x140017040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x40]
mov rdi, rax
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
mov dword [rsp + 0x70], 0
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x44]
mov r9d, 0x40
mov r8d, 0x3000
mov edx, eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140005769
xor eax, eax
jmp 0x1400057d3
mov rdi, qword [rsp + 0x20]
mov eax, 0xc3
mov ecx, 1
rep stosb byte [rdi], al
mov eax, dword [rsp + 0x44]
lea r9, [rsp + 0x70]
mov r8d, 0x140
mov edx, eax
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14000579e
xor eax, eax
jmp 0x1400057d3
call qword [rsp + 0x20]
jmp 0x1400057bb
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, 1
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14000e450
add rsp, 0x80
pop rdi
ret
Function at 0x140005e10
Capabilities:
Hide thread from debugger

Disassembly:
sub rsp, 0x88
mov dword [rsp + 0x38], SafeArrayGetLBound
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea rdx, [0x140013758]
lea rcx, [rsp + 0x48]
call fcn.1400059c0
mov rcx, rax
call fcn.1400059f0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsp + 0x30], rax
lea rdx, str.NtSetInformationThread
lea rcx, [rsp + 0x60]
call fcn.140005ed0
mov rcx, rax
call fcn.140005f00
mov rdx, rax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor r9d, r9d
xor r8d, r8d
mov edx, SafeArrayGetLBound
mov rcx, rax
call qword [rsp + 0x40]
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
je 0x140005eb8
mov dword [rsp + 0x20], 1
mov eax, dword [rsp + 0x20]
add rsp, 0x88
ret

Function at 0x140005f20
Capabilities:
Get explorer pid

Disassembly:
sub rsp, 0x38
mov rax, qword [0x140017040]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
call qword [sym.imp.USER32.dll_GetShellWindow]
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14000e450
add rsp, 0x38
ret

Function at 0x140006060
Capabilities:
Check for peb beingdebugged flag

Disassembly:
sub rsp, 0x18
mov rax, qword gs:[0x60]
mov qword [rsp], rax
mov rax, qword [rsp]
movzx eax, byte [rax + 2]
cmp eax, 1
jne 0x140006087
mov eax, 1
jmp 0x140006089
xor eax, eax
add rsp, 0x18
ret

Function at 0x140006090
Capabilities:
Get process heap flags

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
call fcn.140001ba0
movzx eax, al
test eax, eax
je 0x1400060d7
mov rax, qword gs:[0x60]
add rax, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
add rax, 0x70
mov qword [rsp + 0x28], rax
jmp 0x1400060fa
mov rax, qword gs:[0x60]
add rax, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
add rax, 0x14
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
add rsp, 0x38
ret

Function at 0x140006150
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap force flags

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
call fcn.140001ba0
movzx eax, al
test eax, eax
je 0x140006197
mov rax, qword gs:[0x60]
add rax, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
add rax, 0x74
mov qword [rsp + 0x28], rax
jmp 0x1400061ba
mov rax, qword gs:[0x60]
add rax, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
add rax, 0x18
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
add rsp, 0x38
ret
Function at 0x140006210
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x10], 0
mov qword [rsp + 0x18], 0
mov rax, qword gs:[0x30]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x60]
mov qword [rsp + 0x28], rax
mov rax, qword gs:[0x60]
add rax, 0xbc
mov qword [rsp + 0x10], rax
cmp qword [rsp + 0x10], 0
je 0x140006276
mov rax, qword [rsp + 0x10]
mov eax, dword [rax]
and eax, 0x70
test eax, eax
je 0x140006276
mov dword [rsp + 4], 1
jmp 0x14000627e
mov dword [rsp + 4], 0
movzx eax, byte [rsp + 4]
mov byte [rsp], al
cmp qword [rsp + 0x18], 0
je 0x1400062a6
mov rax, qword [rsp + 0x18]
mov eax, dword [rax]
and eax, 0x70
test eax, eax
je 0x1400062a6
mov dword [rsp + 8], 1
jmp 0x1400062ae
mov dword [rsp + 8], 0
movzx eax, byte [rsp + 8]
mov byte [rsp + 1], al
movzx eax, byte [rsp]
test eax, eax
jne 0x1400062c8
movzx eax, byte [rsp + 1]
test eax, eax
je 0x1400062d1
mov eax, 1
jmp 0x1400062d3
xor eax, eax
add rsp, 0x38
ret

Function at 0x140006390
Capabilities:
Check for protected handle exception

Disassembly:
sub rsp, 0x58
lea rdx, str.Random_name
lea rcx, [rsp + 0x28]
call fcn.140002ce0
mov rcx, rax
call fcn.140006400
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x20], rax
mov r8d, 2
mov edx, 2
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
nop
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400063ea
xor eax, eax
add rsp, 0x58
ret

Function at 0x140006460
Capabilities:
Check for software breakpoints

Disassembly:
sub rsp, 0x28
lea rax, [0x140006450]
lea rcx, [fcn.140006420]
sub rax, rcx
mov qword [rsp + 8], rax
lea rax, [fcn.140006420]
mov qword [rsp + 0x10], rax
mov qword [rsp], 0
jmp 0x14000649b
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
mov rax, qword [rsp + 8]
cmp qword [rsp], rax
jae 0x1400064c8
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x10]
add rcx, rax
mov rax, rcx
movzx eax, byte [rax]
cmp eax, 0xcc
jne 0x1400064c6
mov eax, 1
jmp 0x1400064ca
jmp 0x140006490
xor eax, eax
add rsp, 0x28
ret
Function at 0x140006c60
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
sub rsp, 0x170
mov rax, qword [0x140017040]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov byte [rsp + 0x30], 0
lea rax, [rsp + 0x50]
mov rdi, rax
xor eax, eax
mov ecx, 0x104
rep stosb byte [rdi], al
mov dword [rsp + 0x48], 0x104
mov dword [rsp + 0x4c], 1
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControl
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jne 0x140006d36
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x4c]
xor r8d, r8d
lea rdx, str.SystemStartOptions
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
jne 0x140006d2b
lea rdx, str.TESTSIGNING
lea rcx, [rsp + 0x50]
call fcn.1400010e0
test rax, rax
je 0x140006d2b
mov byte [rsp + 0x30], 1
xor al, al
jmp 0x140006d3b
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, byte [rsp + 0x30]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.14000e450
add rsp, 0x170
pop rdi
ret

Function at 0x140006db0
Capabilities:
Get token membership

Disassembly:
sub rsp, 0x88
mov rax, qword [0x140017040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov byte [rsp + 0x68], 0
mov byte [rsp + 0x69], 0
mov byte [rsp + 0x6a], 0
mov byte [rsp + 0x6b], 0
mov byte [rsp + 0x6c], 0
mov byte [rsp + 0x6d], 5
lea rax, [rsp + 0x60]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0x220
mov r8d, 0x20
mov dl, 2
lea rcx, [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x140006e3f
xor eax, eax
jmp 0x140006e74
mov dword [rsp + 0x70], 0
lea r8, [rsp + 0x70]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x140006e65
mov dword [rsp + 0x70], 0
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [rsp + 0x70]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14000e450
add rsp, 0x88
ret
Function at 0x14000efa0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000efea
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000efea
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000efea
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000efea
cmp dword [rcx + 0x84], 0xe
jbe 0x14000efea
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000efec
xor al, al
add rsp, 0x28
ret
Function at 0x7ff744ff16d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
xor r8d, r8d
lea rsi, [0x7ff744ff0000]
mov r10d, r8d
lea rbp, [0x7ff7450191b0]
mov r9d, r8d
mov r11d, 0x4c8f8d29
test r10b, 1
jne 0x7ff744ff1708
mov al, byte [r9 + rbp]
jmp 0x7ff744ff172a
mov eax, r11d
mov ecx, r10d
imul r10d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x6b
sub ecx, eax
movsxd rax, ecx
mov al, byte [rax + rsi + 0x1e6e0]
xor byte [r9 + rsi + 0x29700], al
inc r10d
inc r9
cmp r10d, 0x1d
jl 0x7ff744ff16fc
mov r10d, r8d
mov r9, r8
test r10b, 1
jne 0x7ff744ff1750
mov al, byte [r9 + rbp]
jmp 0x7ff744ff1772
mov eax, r11d
mov ecx, r10d
imul r10d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x6b
sub ecx, eax
movsxd rax, ecx
mov al, byte [rax + rsi + 0x1e6e0]
xor byte [r9 + rsi + 0x29560], al
inc r10d
inc r9
cmp r10d, 0x1f
jl 0x7ff744ff1744
mov r11d, dword [0x7ff745023424]
test r11d, r11d
jne 0x7ff744ff17dd
mov r9d, r8d
mov r10, rbp
mov eax, 0x8f3f82a9
mov ecx, r9d
imul r9d
add edx, r9d
inc r9d
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0xe4c
sub ecx, eax
movsxd rax, ecx
mov al, byte [rax + rsi + 0x1e750]
xor byte [r10], al
inc r10
cmp r9d, 0x1dd
jl 0x7ff744ff1798
mov byte [0x7ff74501938d], r8b
jmp 0x7ff744ff183c
mov r10d, r8d
mov rbx, rbp
mov r9, rbp
mov eax, r10d
cdq
idiv r11d
test edx, edx
jne 0x7ff744ff17f4
inc r9
mov eax, 0x8f3f82a9
mov ecx, r10d
imul r10d
add edx, r10d
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0xe4c
sub ecx, eax
movsxd rax, ecx
mov al, byte [rax + rsi + 0x1e750]
xor al, byte [r9]
inc r9
mov byte [rbx], al
inc rbx
movsxd rax, r10d
inc r10d
cmp r10d, 0x273
jb 0x7ff744ff17e6
mov byte [rax + rbp], r8b
mov rdx, r8
mov r9d, 0x46
mov al, byte [rdx + rsi + 0x29700]
inc rdx
mov ecx, r9d
inc r9d
mov byte [rcx + rbp], al
cmp rdx, 0x1d
jl 0x7ff744ff1845
mov edx, 0x8f
mov al, byte [r8 + rsi + 0x29560]
inc r8
mov ecx, edx
inc edx
mov byte [rcx + rbp], al
cmp r8, 0x1f
jl 0x7ff744ff1863
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
ret
Function at 0x7ff744ff246c
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xb0
mov ebx, dword [0x7ff7450246d8]
lea rcx, [rsp + 0x40]
mov edx, 0x32
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xor edi, edi
lea rcx, [rsp + 0x40]
sub rcx, 2
mov word [rsp + 0x44], di
test ebx, ebx
je 0x7ff744ff24ef
lea rcx, [rcx + 2]
cmp word [rcx], di
jne 0x7ff744ff24a3
movaps xmm0, xmmword [str.Documents_and_SettingsDefault_User_sys]
movaps xmm1, xmmword [0x7ff74500e2d0]
movzx eax, word [0x7ff74500e310]
movups xmmword [rcx], xmm0
movaps xmm0, xmmword [0x7ff74500e2e0]
movups xmmword [rcx + 0x10], xmm1
movaps xmm1, xmmword [0x7ff74500e2f0]
movups xmmword [rcx + 0x20], xmm0
movaps xmm0, xmmword [0x7ff74500e300]
movups xmmword [rcx + 0x30], xmm1
movups xmmword [rcx + 0x40], xmm0
mov word [rcx + 0x50], ax
jmp 0x7ff744ff2516
lea rcx, [rcx + 2]
cmp word [rcx], di
jne 0x7ff744ff24ef
movups xmm0, xmmword [str.usersPublic_sys]
mov eax, dword [0x7ff74500e338]
movups xmm1, xmmword [0x7ff74500e328]
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm1
mov dword [rcx + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov qword [rsp + 0x30], rdi
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x28], 2
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
jne 0x7ff744ff2567
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 2
jmp 0x7ff744ff25ad
mov ebx, 1
cmp eax, 2
lea ecx, [rbx + 0xa]
cmove ebx, ecx
test eax, eax
je 0x7ff744ff25ab
mov qword [rsp + 0x30], rdi
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x28], 2
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 2
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
neg rax
sbb ecx, ecx
and ebx, ecx
mov eax, ebx
mov rbx, qword [rsp + 0xc0]
add rsp, 0xb0
pop rdi
ret
Function at 0x7ff744ff5c84
Capabilities:
Initialize winsock library
Send data
Send data on socket
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r15
lea rbp, [rsp - 0x160]
sub rsp, 0x260
mov rsi, rdx
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x50]
lea r8d, [rdx + 0x66]
call fcn.7ff744ff188c
xor edi, edi
mov byte [rbp + 0x190], 1
or r15, 0xffffffffffffffff
mov dword [rsp + 0x50], r15d
mov word [rsp + 0x54], r15w
mov al, byte [rsi + rdi*4]
mov byte [rbp + rdi + 0x198], al
inc rdi
cmp rdi, 6
jl 0x7ff744ff5ccf
mov eax, dword [rbp + 0x198]
lea rdi, [rsp + 0x5c]
mov dword [rsp + 0x56], eax
lea rsi, [rsp + 0x56]
movzx eax, word [rbp + 0x19c]
lea rdx, [rbp - 0x40]
mov word [rsp + 0x5a], ax
mov ecx, 0x2d
rep movsw word [rdi], word [rsi]
mov ecx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x7ff744ff5d24
xor eax, eax
jmp 0x7ff744ff5e21
mov esi, 2
mov edx, esi
mov ecx, esi
lea r8d, [rsi + 0xf]
call qword [sym.imp.WS2_32.dll_socket]
mov rdi, rax
cmp rax, r15
je 0x7ff744ff5d1d
lea r9, [rbp + 0x190]
mov dword [rsp + 0x20], 1
mov edx, 0xffff
lea r8d, [rsi + 0x1e]
mov rcx, rax
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x7ff744ff5d1d
and qword [rsp + 0x30], 0
xor ecx, ecx
and qword [rsp + 0x38], 0
mov word [rsp + 0x30], si
call qword [sym.imp.WS2_32.dll_htonl]
xor ecx, ecx
mov dword [rsp + 0x34], eax
call qword [sym.imp.WS2_32.dll_htons]
lea r8d, [rsi + 0xe]
mov rcx, rdi
lea rdx, [rsp + 0x30]
mov word [rsp + 0x32], ax
call qword [sym.imp.WS2_32.dll_bind]
test eax, eax
jne 0x7ff744ff5d1d
and qword [rsp + 0x40], 0
mov rcx, rbx
and qword [rsp + 0x48], 0
mov word [rsp + 0x40], si
call qword [sym.imp.WS2_32.dll_inet_addr]
lea ecx, [rsi + 5]
mov dword [rsp + 0x44], eax
call qword [sym.imp.WS2_32.dll_htons]
mov dword [rsp + 0x28], 0x10
lea r8d, [rsi + 0x64]
mov word [rsp + 0x42], ax
lea rdx, [rsp + 0x50]
lea rax, [rsp + 0x40]
xor r9d, r9d
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_sendto]
cmp eax, r15d
je 0x7ff744ff5d1d
mov ecx, 0xfa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
lea eax, [rsi - 1]
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r15
pop rdi
pop rbp
ret