joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001640
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x14000165f
lea ecx, [rbx + 0x57]
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add rsp, 0x20
pop rbx
ret
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x140001674
mov eax, 1
add rsp, 0x20
pop rbx
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000168e
and eax, 0x410
cmp eax, 0x410
je 0x1400016a1
lea rdx, [0x1400011d0]
mov rcx, rbx
call fcn.1400012c0
test eax, eax
je 0x1400016b0
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
add rsp, 0x20
pop rbx
ret

Function at 0x1400016c0
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x250
mov rax, qword [0x140025008]
xor rax, rsp
mov qword [rsp + 0x230], rax
xor ebx, ebx
xor eax, eax
lock cmpxchg dword [0x140027060], ebx
mov ecx, eax
jne 0x140001722
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x140001715
lea rdx, str.RemoveDllDirectory
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [rbx + 2]
test rax, rax
jne 0x14000171a
mov ecx, 1
mov eax, ecx
xchg dword [0x140027060], eax
cmp ecx, 1
jne 0x1400018b0
mov qword [rsp + 0x260], rbp
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x268], rsi
xor edx, edx
mov qword [rsp + 0x270], rdi
mov r8d, 0x208
mov qword [rsp + 0x248], r14
mov qword [rsp + 0x240], r15
call fcn.1400077e0
mov edx, 0x104
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1400018ac
cmp word [rsp + 0x20], bx
je 0x1400018ac
mov ebp, ebx
lea rax, [rsp + 0x20]
mov rsi, rbx
mov rdi, 0xffffffffffffffff
nop dword [rax]
inc rdi
cmp word [rax + rdi*2], bx
jne 0x1400017a0
mov r15d, 0x5c
test rdi, rdi
je 0x1400017d3
movzx eax, word [rsp + rdi*2 + 0x1e]
mov rbx, rdi
cmp r15w, ax
je 0x1400017d3
mov ecx, 0x2f
cmp cx, ax
je 0x1400017d3
lea ebp, [rcx - 0x2e]
lea rbx, [rdi + 1]
add rbx, 0xc
je 0x1400018ac
lea rbx, [rbx*2 + 2]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r14, rax
test rax, rax
je 0x1400018ac
test rdi, rdi
je 0x140001821
lea r8, [rdi + rdi]
mov rcx, rax
lea rdx, [rsp + 0x20]
call fcn.140009e80
mov rsi, rdi
test ebp, ebp
je 0x14000182d
mov word [r14 + rsi*2], r15w
inc rsi
movups xmm0, xmmword [str.Wtsapi32.dll]
mov rcx, r14
movups xmmword [r14 + rsi*2], xmm0
movsd xmm1, qword [0x140020988]
movsd qword [r14 + rsi*2 + 0x10], xmm1
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, rbx
mov r14, qword [rsp + 0x248]
mov rdi, qword [rsp + 0x270]
mov rsi, qword [rsp + 0x268]
mov rbp, qword [rsp + 0x260]
mov r15, qword [rsp + 0x240]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140005b40
add rsp, 0x250
pop rbx
ret
xor eax, eax
jmp 0x14000186b
xor edx, edx
lea rcx, str.Wtsapi32.dll
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x140001893
Function at 0x1400021f0
Capabilities:
Access firewall policy via inetfwpolicy2

Disassembly:
push rbx
sub rsp, 0x30
mov ecx, dword [0x140025a00]
mov ebx, 0x80000000
lea eax, [rcx + rbx]
test ebx, eax
jne 0x140002235
cmp ecx, 0x80010106
je 0x140002235
mov edx, 2
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov dword [0x140025a00], eax
lea ecx, [rax + rbx]
test ebx, ecx
jne 0x140002235
cmp eax, 0x80010106
jne 0x1400022c7
cmp qword [0x140026ff0], 0
jne 0x140002273
xor edx, edx
lea rax, [0x140026ff0]
lea r9, [0x140020dd8]
mov qword [rsp + 0x20], rax
lea rcx, [0x140020e88]
lea r8d, [rdx + 1]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x14000227e
cmp qword [0x140026ff0], 0
je 0x1400022a2
mov eax, 1
add rsp, 0x30
pop rbx
ret
mov rcx, qword [0x140026ff0]
test rcx, rcx
je 0x1400022a2
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400183c0]
mov qword [0x140026ff0], 0
mov ecx, dword [0x140025a00]
lea eax, [rcx + rbx]
test ebx, eax
jne 0x1400022b7
cmp ecx, 0x80010106
jne 0x1400022c7
call qword [sym.imp.ole32.dll_CoUninitialize]
mov dword [0x140025a00], 0x80004005
xor eax, eax
add rsp, 0x30
pop rbx
ret
Function at 0x140002bd0
Capabilities:
Check if file exists
Create directory
Delete directory
Get common file path
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x240
mov rax, qword [0x140025008]
xor rax, rsp
mov qword [rsp + 0x230], rax
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20a
call fcn.1400077e0
xor ebp, ebp
lea rdx, [rsp + 0x20]
xor r9d, r9d
xor ecx, ecx
mov ebx, ebp
lea r8d, [rbp + 0x26]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x140002da1
lea rdx, str.Zoom_bin
lea rcx, [rsp + 0x20]
call fcn.140004b40
mov rdi, rax
test rax, rax
je 0x140002da1
lea rdx, str.Zoom.exe
mov qword [rsp + 0x250], rsi
mov rcx, rax
call fcn.140004b40
mov rsi, rax
test rax, rax
je 0x140002d20
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140002d20
test al, 0x10
jne 0x140002d20
mov rcx, rsi
call fcn.1400056f0
test eax, eax
je 0x140002d20
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea rdx, str.temp
mov rcx, rdi
call fcn.140004b40
mov rbx, rax
test rax, rax
je 0x140002d20
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x140002cfc
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140002ce0
and eax, 0x410
cmp eax, 0x410
je 0x140002cf3
lea rdx, [0x1400011d0]
mov rcx, rbx
call fcn.1400012c0
test eax, eax
je 0x140002cfc
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140002d16
mov rcx, rbx
call fcn.14000ca34
mov rbx, rbp
mov rcx, rdi
call fcn.14000ca34
jmp 0x140002d2d
mov rcx, rdi
call fcn.14000ca34
test rsi, rsi
je 0x140002d35
mov rcx, rsi
call fcn.14000ca34
mov rsi, qword [rsp + 0x250]
test rbx, rbx
je 0x140002da1
mov rcx, qword [0x140027008]
test rcx, rcx
je 0x140002d94
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], bp
jne 0x140002d55
cmp rax, 4
jb 0x140002d94
lea rcx, [rcx + rax*2]
mov r8d, 4
add rcx, 0xfffffffffffffff8
lea rdx, str..msi
call fcn.14000c5f0
test eax, eax
jne 0x140002d94
lea rdx, str.temp.msi
mov rcx, rbx
call fcn.140004b40
mov rbp, rax
mov rcx, rbx
call fcn.14000ca34
mov rax, rbp
jmp 0x140002da3
xor eax, eax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140005b40
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140003b50
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x460
mov rax, qword [0x140025008]
xor rax, rsp
mov qword [rsp + 0x450], rax
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x412
call fcn.1400077e0
mov edx, 0x208
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea rdx, str.system32msiexec.exe
lea rcx, [rsp + 0x30]
call fcn.140004b40
mov rbp, rax
test rax, rax
je 0x140003d06
mov rbx, 0xffffffffffffffff
mov rcx, rbx
nop dword [rax + rax]
inc rcx
cmp word [rax + rcx*2], 0
jne 0x140003bd0
add rcx, 1
je 0x140003cfe
lea r14, [rcx*2 + 2]
mov rcx, r14
call fcn.14000ca48
mov rsi, rax
test rax, rax
je 0x140003cfe
mov rdi, rax
mov rcx, r14
xor eax, eax
mov r8, rbx
rep stosb byte [rdi], al
movzx eax, word [0x140021044]
mov word [rsi], ax
nop word [rax + rax]
inc r8
cmp word [rbp + r8*2], 0
jne 0x140003c20
add r8, r8
lea rcx, [rsi + 2]
mov rdx, rbp
call fcn.140009e80
mov rcx, rbp
call fcn.14000ca34
mov rax, rbx
inc rax
cmp word [rsi + rax*2], 0
jne 0x140003c46
add rax, 1
jne 0x140003c5a
xor ebp, ebp
jmp 0x140003ca8
lea r14, [rax*2 + 2]
mov rcx, r14
call fcn.14000ca48
mov rbp, rax
test rax, rax
je 0x140003ca8
mov rdi, rbp
xor eax, eax
mov rcx, r14
rep stosb byte [rdi], al
nop dword [rax]
cmp word [rsi + rbx*2 + 2], ax
lea rbx, [rbx + 1]
jne 0x140003c80
lea rdi, [rbx + rbx]
mov rdx, rsi
mov r8, rdi
mov rcx, rbp
call fcn.140009e80
movzx eax, word [0x140021044]
mov word [rdi + rbp], ax
mov rcx, rsi
call fcn.14000ca34
test rbp, rbp
je 0x140003d06
call fcn.1400036c0
mov rbx, rax
test rax, rax
je 0x140003cfe
mov dword [rsp + 0x28], 1
mov r9, rax
mov r8, rbp
mov qword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rcx, rbp
mov rdi, rax
call fcn.14000ca34
mov rcx, rbx
call fcn.14000ca34
cmp edi, 0x20
setg al
jmp 0x140003d08
mov rcx, rbp
call fcn.14000ca34
xor al, al
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.140005b40
lea r11, [rsp + 0x460]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x140004820
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x250
mov rax, qword [0x140025008]
xor rax, rsp
mov qword [rsp + 0x230], rax
xor ebx, ebx
xor eax, eax
lock cmpxchg dword [0x140027070], ebx
mov ecx, eax
jne 0x140004882
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x140004875
lea rdx, str.RemoveDllDirectory
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [rbx + 2]
test rax, rax
jne 0x14000487a
mov ecx, 1
mov eax, ecx
xchg dword [0x140027070], eax
cmp ecx, 1
jne 0x140004a1b
mov qword [rsp + 0x260], rbp
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x268], rsi
xor edx, edx
mov qword [rsp + 0x270], rdi
mov r8d, 0x208
mov qword [rsp + 0x248], r14
mov qword [rsp + 0x240], r15
call fcn.1400077e0
mov edx, 0x104
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x140004a17
cmp word [rsp + 0x20], bx
je 0x140004a17
mov ebp, ebx
lea rax, [rsp + 0x20]
mov rsi, rbx
mov rdi, 0xffffffffffffffff
nop dword [rax]
inc rdi
cmp word [rax + rdi*2], bx
jne 0x140004900
mov r15d, 0x5c
test rdi, rdi
je 0x140004933
movzx eax, word [rsp + rdi*2 + 0x1e]
mov rbx, rdi
cmp r15w, ax
je 0x140004933
mov ecx, 0x2f
cmp cx, ax
je 0x140004933
lea ebp, [rcx - 0x2e]
lea rbx, [rdi + 1]
add rbx, 7
je 0x140004a17
lea rbx, [rbx*2 + 2]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r14, rax
test rax, rax
je 0x140004a17
test rdi, rdi
je 0x140004981
lea r8, [rdi + rdi]
mov rcx, rax
lea rdx, [rsp + 0x20]
call fcn.140009e80
mov rsi, rdi
test ebp, ebp
je 0x14000498d
mov word [r14 + rsi*2], r15w
inc rsi
movsd xmm0, qword [str.msi.dll]
mov rcx, r14
movsd qword [r14 + rsi*2], xmm0
mov eax, dword [0x140020ea0]
mov dword [r14 + rsi*2 + 8], eax
movzx eax, word [0x140020ea4]
mov word [r14 + rsi*2 + 0xc], ax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, rbx
mov r14, qword [rsp + 0x248]
mov rdi, qword [rsp + 0x270]
mov rsi, qword [rsp + 0x268]
mov rbp, qword [rsp + 0x260]
mov r15, qword [rsp + 0x240]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140005b40
add rsp, 0x250
pop rbx
ret
xor eax, eax
jmp 0x1400049d6
xor edx, edx
lea rcx, str.msi.dll
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x1400049fe
Function at 0x140004cf0
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [0x140027074], 0
jne 0x140004e12
call fcn.140004820
mov rbx, rax
test rax, rax
je 0x140004e03
lea rdx, str.MsiViewExecute
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MsiCloseHandle
mov rcx, rbx
mov qword [0x140027020], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MsiViewFetch
mov rcx, rbx
mov qword [0x140027030], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MsiViewClose
mov rcx, rbx
mov qword [0x140027018], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MsiOpenDatabaseW
mov rcx, rbx
mov qword [0x140027040], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MsiDatabaseOpenViewW
mov rcx, rbx
mov qword [0x140027048], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MsiRecordGetStringW
mov rcx, rbx
mov qword [0x140027038], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MsiGetSummaryInformationW
mov rcx, rbx
mov qword [0x140027028], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MsiSummaryInfoGetPropertyW
mov rcx, rbx
mov qword [0x140027010], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MsiEnumRelatedProductsW
mov rcx, rbx
mov qword [0x140027058], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140027050], rax
mov byte [0x140027074], 1
jmp 0x140004e19
mov byte [0x140027074], 1
xor al, al
add rsp, 0x20
pop rbx
ret
mov rax, qword [0x140027050]
cmp qword [0x140027048], 0
je 0x140004e0a
cmp qword [0x140027038], 0
je 0x140004e0a
cmp qword [0x140027020], 0
je 0x140004e0a
cmp qword [0x140027030], 0
je 0x140004e0a
cmp qword [0x140027018], 0
je 0x140004e0a
cmp qword [0x140027028], 0
je 0x140004e0a
cmp qword [0x140027040], 0
je 0x140004e0a
cmp qword [0x140027010], 0
je 0x140004e0a
cmp qword [0x140027058], 0
je 0x140004e0a
test rax, rax
je 0x140004e0a
mov al, 1
add rsp, 0x20
pop rbx
ret
Function at 0x1400110e6
Capabilities:
Write file on windows

Disassembly:
jmp 0x14001bd70
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x1400340f5]
call fcn.14001192e
nop
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x68], 0
je 0x14001bdc8
mov r8, qword [rbp + 0x130]
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x14001beda
mov rax, qword [rbp + 0x130]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x130], 0
jle 0x14001be73
cmp qword [rbp + 0x28], 0
jle 0x14001be73
mov rax, qword [rbp + 0x28]
cmp qword [rbp + 0x130], rax
jge 0x14001be11
mov rax, qword [rbp + 0x130]
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x128]
mov rcx, rax
call fcn.1400118ac
nop
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x128]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov edx, dword [rbp + 0x28]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
nop
cmp qword [rbp + 0x130], 0
jle 0x14001bec9
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x80], 0
je 0x14001bec9
mov rax, qword [rbp + 0x120]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x130]
mov edx, 1
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.ucrtbased.dll_fwrite]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x130]
mov rcx, qword [rbp + 8]
sub rcx, rax
mov rax, rcx
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x140011460
Capabilities:
Enumerate process modules

Disassembly:
jmp 0x140019cf0
mov qword [rsp + 8], rcx
push rbp
push rdi
mov eax, 0x1858
call fcn.14001119f
sub rsp, rax
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x48e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1878]
mov rax, qword [0x14002d040]
xor rax, rbp
mov qword [rbp + 0x1828], rax
lea rcx, [0x1400340f9]
call fcn.14001192e
nop
lea r8, [rbp + 0x1024]
mov edx, 0x1000
lea rcx, [rbp + 0x10]
call fcn.140011398
test eax, eax
jne 0x140019d60
xor eax, eax
jmp 0x140019e7e
mov eax, dword [rbp + 0x1024]
xor edx, edx
mov ecx, 4
div rcx
mov qword [rbp + 0x1048], rax
mov qword [rbp + 0x1068], 0
jmp 0x140019d95
mov rax, qword [rbp + 0x1068]
inc rax
mov qword [rbp + 0x1068], rax
mov rax, qword [rbp + 0x1048]
cmp qword [rbp + 0x1068], rax
jae 0x140019e7c
mov rax, qword [rbp + 0x1068]
mov eax, dword [rbp + rax*4 + 0x10]
mov dword [rbp + 0x1084], eax
mov r8d, dword [rbp + 0x1084]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x10a8], rax
cmp qword [rbp + 0x10a8], 0
je 0x140019e77
lea rax, [rbp + 0x1110]
mov rdi, rax
xor eax, eax
mov ecx, 0x104
rep stosb byte [rdi], al
lea r9, [rbp + 0x10e4]
mov r8d, 8
lea rdx, [rbp + 0x10c8]
mov rcx, qword [rbp + 0x10a8]
call fcn.1400110dc
test eax, eax
je 0x140019e69
mov r9d, 0x104
lea r8, [rbp + 0x1110]
mov rdx, qword [rbp + 0x10c8]
mov rcx, qword [rbp + 0x10a8]
call fcn.140011050
nop
mov rdx, qword [rbp + 0x1850]
lea rcx, [rbp + 0x1110]
call qword [sym.imp.ucrtbased.dll__stricmp]
test eax, eax
jne 0x140019e69
mov rcx, qword [rbp + 0x10a8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov eax, dword [rbp + 0x1084]
jmp 0x140019e7e
mov rcx, qword [rbp + 0x10a8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x140019d84
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x1400271d0]
call fcn.14001179e
mov rax, rdi
mov rcx, qword [rbp + 0x1828]
xor rcx, rbp
call fcn.140011456
lea rsp, [rbp + 0x1838]
pop rdi
pop rbp
ret

Function at 0x140011500
Capabilities:
Create thread

Disassembly:
jmp 0x14001cc76
jmp qword [sym.imp.ntdll.dll_NtCreateThreadEx]

Function at 0x140011523
Capabilities:
Terminate process

Disassembly:
jmp 0x14001f140
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret

Function at 0x14001163b
Capabilities:
Download url
Receive data

Disassembly:
jmp 0x1400175a0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x118
lea rbp, [rsp + 0x30]
lea rcx, [0x1400340f9]
call fcn.14001192e
nop
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rbp + 0x108]
mov rdx, qword [rbp + 0x100]
xor ecx, ecx
call fcn.14001120d
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jne 0x1400175fb
mov dword [rbp + 0xd4], 1
jmp 0x140017605
mov dword [rbp + 0xd4], 0
mov eax, dword [rbp + 0xd4]
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x140011672
Capabilities:
Parse pe header

Disassembly:
jmp 0x14001fc70
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14001fc90
xor al, al
jmp 0x14001fd11
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14001fca3
xor al, al
jmp 0x14001fd11
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001fccd
xor al, al
jmp 0x14001fd11
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14001fce1
xor al, al
jmp 0x14001fd11
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x14001fcf3
xor al, al
jmp 0x14001fd11
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001fd0f
xor al, al
jmp 0x14001fd11
mov al, 1
add rsp, 0x38
ret
Function at 0x140011721
Capabilities:
Create process on windows

Disassembly:
jmp 0x140017640
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1d8
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x32
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1f8]
mov rax, qword [0x14002d040]
xor rax, rbp
mov qword [rbp + 0x178], rax
lea rcx, [0x1400340f9]
call fcn.14001192e
nop
mov dword [rbp + 0x10], 0x68
lea rax, [rbp + 0x18]
mov rdi, rax
xor eax, eax
mov ecx, 0x60
rep stosb byte [rdi], al
lea rax, [rbp + 0x98]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x1a0]
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x140017719
lea rdx, str.____Failed_to_create_process.
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011104
lea rdx, [0x14001105f]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
xor eax, eax
jmp 0x14001774d
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x98]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
mov rcx, qword [rbp + 0x98]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [rbp + 0xa0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov eax, 1
mov rdi, rax
lea rcx, [rbp - 0x50]
lea rdx, [0x1400272c0]
call fcn.14001179e
mov rax, rdi
mov rcx, qword [rbp + 0x178]
xor rcx, rbp
call fcn.140011456
lea rsp, [rbp + 0x188]
pop rdi
pop rbp
ret