joyce8/EMBER2024-capa huggingface dataset:
Function at 0x710570
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
movzx rbx, word [0x007105d4]
mov eax, ecx
test ax, 4
je 0x710589
or bx, 1
mov eax, ecx
test ax, 8
je 0x710595
or bx, 4
mov eax, ecx
test ax, 1
je 0x7105a1
or bx, 8
mov eax, ecx
test ax, 2
je 0x7105ad
or bx, 0x10
test cx, 0x10
je 0x7105b8
or bx, 0x20
mov ecx, 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x7105cb
or bx, 2
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x7105e0
Capabilities:
Log keystrokes via polling

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov ebx, ecx
movzx rsi, word [0x0071062c]
mov ecx, 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x710603
or si, 1
mov ecx, 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x710616
or si, 4
test ebx, 0x20000000
je 0x710622
or si, 2
mov eax, esi
add rsp, 0x28
pop rbx
pop rsi
ret
Function at 0x726c70
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push rbp
sub rsp, 0x510
mov rbp, rsp
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x58], rbp
mov qword [rbp + 0x520], rcx
nop
mov rax, qword [rbp + 0x520]
cmp qword [rax + 0x80], 0
jne 0x726e7d
mov rcx, qword [0x004d0a40]
mov dl, 1
call fcn.005110c0
mov rcx, qword [rbp + 0x520]
mov qword [rcx + 0x80], rax
mov rax, qword [rbp + 0x520]
lea rcx, [rax + 0x88]
call fcn.004107c0
mov ecx, 0x40
lea rdx, [rbp + 0x2f0]
call sub.user32.dll_GetKeyboardLayoutList
mov dword [rbp + 0x4fc], eax
xor eax, eax
mov ecx, dword [rbp + 0x4fc]
sub ecx, 1
mov dword [rbp + 0x3c], ecx
mov dword [rbp + 0x4f8], eax
mov ecx, dword [rbp + 0x3c]
cmp dword [rbp + 0x4f8], ecx
jg 0x726e60
mov ecx, dword [rbp + 0x3c]
sub ecx, eax
add ecx, 1
mov dword [rbp + 0x3c], ecx
lea rax, [rbp + 0x2f0]
mov qword [rbp + 0x60], rax
mov rax, qword [rbp + 0x60]
mov rcx, qword [rax]
call fcn.00605b50
test al, al
je 0x726e47
mov rax, qword [rbp + 0x60]
movzx eax, word [rax]
mov dword [rbp + 0x48], eax
mov byte [rbp + 0x50], 0
lea rcx, [rbp + 0x70]
lea rdx, [0x00726ee8]
lea r8, [rbp + 0x48]
xor r9, r9
call fcn.00439240
mov rcx, 0xffffffff80000002
mov rdx, rax
xor r8, r8
mov r9d, 0x20019
lea rax, [rbp + 0x508]
mov qword [rsp + 0x20], rax
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x726e47
nop
mov dword [rbp + 0x4f4], 0x200
mov rcx, qword [rbp + 0x508]
lea rdx, [0x00726f56]
xor r8, r8
xor r9, r9
lea rax, [rbp + 0xf0]
mov qword [rsp + 0x20], rax
lea rax, [rbp + 0x4f4]
mov qword [rsp + 0x28], rax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x726e3a
lea rcx, [rbp + 0x40]
lea rdx, [rbp + 0xf0]
mov r8d, pe_nt_image_headers64
call fcn.00411e60
mov rax, qword [rbp + 0x520]
mov rax, qword [rax + 0x80]
mov rcx, rax
mov rdx, qword [rbp + 0x40]
mov r8, qword [rbp + 0x60]
mov r8, qword [r8]
mov rax, qword [rax]
call qword [rax + 0x80]
mov rax, qword [rbp + 0x60]
mov rcx, qword [rbp + 0x520]
mov rax, qword [rax]
cmp rax, qword [rcx + 0x90]
jne 0x726e3a
mov rax, qword [rbp + 0x520]
lea rcx, [rax + 0x88]
lea rdx, [rbp + 0xf0]
mov r8d, pe_nt_image_headers64
call fcn.00411e60
nop
mov rcx, qword [rbp + 0x508]
call sub.advapi32.dll_RegCloseKey
add qword [rbp + 0x60], 8
mov eax, dword [rbp + 0x3c]
sub eax, 1
mov dword [rbp + 0x3c], eax
mov eax, dword [rbp + 0x3c]
test eax, eax
jne 0x726d23
nop
mov rax, qword [rbp + 0x520]
mov rax, qword [rax + 0x80]
mov byte [rax + 0x49], 0
mov rcx, rax
mov dl, 1
call fcn.00510f50
mov rax, qword [rbp + 0x520]
mov rax, qword [rax + 0x80]
mov qword [rbp + 0x500], rax
nop
lea rcx, [rbp + 0x40]
call fcn.004107c0
mov rax, qword [rbp + 0x500]
lea rsp, [rbp + 0x510]
pop rbp
ret
Function at 0x7281f0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x48
mov rax, qword [0x00861d90]
cmp byte [rax + 0x159], 0
jne 0x72828e
cmp qword [0x00861dc8], 0
jne 0x728235
call sub.kernel32.dll_GetCurrentThreadId
mov ecx, 3
mov rdx, qword [0x00847aa8]
xor r8, r8
mov r9d, eax
call sub.user32.dll_SetWindowsHookExW
mov qword [0x00861dc8], rax
cmp qword [0x00861dc0], 0
jne 0x728255
xor ecx, ecx
xor edx, edx
xor r8, r8
xor r9, r9
call sub.kernel32.dll_CreateEventW
mov qword [0x00861dc0], rax
cmp qword [0x00861dd0], 0
jne 0x72828e
xor ecx, ecx
mov edx, 0x3e8
mov r8, qword [0x00847aa0]
xor r9, r9
mov dword [rsp + 0x20], 0
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
call sub.kernel32.dll_CreateThread
mov qword [0x00861dd0], rax
add rsp, 0x48
ret

Function at 0x729430
Capabilities:
Enumerate gui resources

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x50
mov rbp, rsp
mov rbx, rcx
mov rax, qword [rbx + 0x2e0]
test rax, rax
je 0x72950d
cmp dword [rbx + 0x128], 0
jne 0x729506
mov qword [rbp + 0x40], rax
mov byte [rbp + 0x48], dl
lea rcx, [0x00729330]
lea rdx, [rbp + 0x40]
call sub.user32.dll_EnumWindows
mov rax, qword [rbx + 0x120]
cmp qword [rax + 0x10], 0
je 0x729506
mov rcx, qword [rbp + 0x40]
mov edx, 3
call sub.user32.dll_GetWindow
mov qword [rbp + 0x40], rax
mov rcx, qword [rbp + 0x40]
mov edx, 0xffffffec
call sub.user32.dll_GetWindowLongPtrW
test rax, 8
je 0x7294b3
mov qword [rbp + 0x40], 0xfffffffffffffffe
mov rax, qword [rbx + 0x120]
mov esi, dword [rax + 0x10]
sub esi, 1
test esi, esi
jl 0x729505
mov rcx, qword [rbx + 0x120]
movsxd rdx, esi
call fcn.00509140
mov rcx, rax
mov rdx, qword [rbp + 0x40]
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x30], 0x213
call sub.user32.dll_SetWindowPos
sub esi, 1
cmp esi, 0xffffffff
jne 0x7294c4
nop
add dword [rbx + 0x128], 1
lea rsp, [rbp + 0x50]
pop rbx
pop rsi
pop rbp
ret
Function at 0x729980
Capabilities:
Enumerate gui resources

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
mov esi, edx
mov rax, qword [0x00861d90]
cmp qword [rax + 0x2e0], 0
je 0x729b3c
test sil, sil
jne 0x729a68
cmp dword [rbx + 0x138], 0
jne 0x729a5c
mov rcx, rbx
call fcn.0072e1b0
lea rcx, [0x00729840]
mov rdx, rax
call sub.user32.dll_EnumWindows
cmp qword [rbx + 0xa8], 0
je 0x729a1f
mov rax, qword [0x00861d90]
cmp byte [rax + 0x193], 0
je 0x729a1f
mov rax, qword [rbx + 0x1a0]
test rax, rax
je 0x7299f9
mov rax, qword [rax - 8]
lea rdi, [rax - 1]
test edi, edi
jl 0x729a1e
mov rax, qword [rbx + 0x1a0]
movsxd rcx, edi
mov rcx, qword [rax + rcx*8]
xor edx, edx
call sub.user32.dll_ShowWindow
sub edi, 1
cmp edi, 0xffffffff
jne 0x729a01
nop
mov rax, qword [rbx + 0x130]
mov edi, dword [rax + 0x10]
sub edi, 1
test edi, edi
jl 0x729a5b
mov rcx, qword [rbx + 0x130]
movsxd rdx, edi
call fcn.00509140
mov rcx, rax
test sil, sil
setne al
movzx rdx, al
neg edx
call sub.user32.dll_ShowOwnedPopups
sub edi, 1
cmp edi, 0xffffffff
jne 0x729a30
nop
add dword [rbx + 0x138], 1
jmp 0x729b3c
cmp dword [rbx + 0x138], 0
jle 0x729b3c
sub dword [rbx + 0x138], 1
cmp dword [rbx + 0x138], 0
jne 0x729b3c
cmp qword [rbx + 0xa8], 0
je 0x729adc
mov rax, qword [0x00861d90]
cmp byte [rax + 0x193], 0
je 0x729adc
mov rax, qword [rbx + 0x1a0]
test rax, rax
je 0x729ab3
mov rax, qword [rax - 8]
lea rdi, [rax - 1]
test edi, edi
jl 0x729adb
mov rax, qword [rbx + 0x1a0]
movsxd rcx, edi
mov rcx, qword [rax + rcx*8]
mov edx, 5
call sub.user32.dll_ShowWindow
sub edi, 1
cmp edi, 0xffffffff
jne 0x729abb
nop
mov rax, qword [rbx + 0x130]
mov edi, dword [rax + 0x10]
sub edi, 1
test edi, edi
jl 0x729b18
mov rcx, qword [rbx + 0x130]
movsxd rdx, edi
call fcn.00509140
mov rcx, rax
test sil, sil
setne al
movzx rdx, al
neg edx
call sub.user32.dll_ShowOwnedPopups
sub edi, 1
cmp edi, 0xffffffff
jne 0x729aed
nop
mov rax, qword [rbx + 0x130]
mov rcx, rax
mov rsi, qword [rax]
call qword [rsi + 0x10]
lea rcx, [rbx + 0x1a0]
mov rdx, qword [0x0070b078]
call fcn.004151d0
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x72ae70
Capabilities:
Get graphical window text

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x220
mov rbp, rsp
mov rbx, rcx
mov rsi, rdx
cmp byte [rbx + 0x158], 0
je 0x72aedc
cmp byte [rbx + 0x193], 0
jne 0x72aedc
mov rcx, qword [rbx + 0x2e0]
lea rdx, [rbp + 0x20]
mov r8d, pe_nt_image_headers64
call sub.user32.dll_GetWindowTextW
mov rcx, rsi
lea rdx, [rbp + 0x20]
mov r8d, eax
call fcn.00410ac0
xor eax, eax
mov rcx, qword [rsi]
test rcx, rcx
je 0x72aec7
mov eax, dword [rcx - 4]
test eax, eax
jne 0x72aeeb
mov rcx, rsi
mov rdx, qword [rbx + 0x118]
call fcn.00410e50
jmp 0x72aeeb
mov rcx, rsi
mov rdx, qword [rbx + 0x118]
call fcn.00410e50
mov rax, rsi
lea rsp, [rbp + 0x220]
pop rbx
pop rsi
pop rbp
ret
Function at 0x72e5a0
Capabilities:
Hide graphical window from taskbar

Disassembly:
push r14
push r13
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
mov esi, edx
cmp sil, byte [rbx + 0x193]
je 0x72e7e0
mov byte [rbx + 0x193], sil
mov rax, qword [rbx + 0xa8]
test rax, rax
je 0x72e74a
mov rcx, rax
call fcn.005fc6d0
test al, al
je 0x72e74a
mov rax, qword [rbx + 0xa8]
movzx rax, word [rax + 0x34]
test ax, 0x10
jne 0x72e74a
mov rax, qword [rbx + 0xa8]
movzx rax, word [rax + 0x34]
test ax, 2
jne 0x72e74a
test sil, sil
je 0x72e64e
mov rcx, qword [rbx + 0x2e0]
xor edx, edx
xor r8, r8
call fcn.0070ff60
mov rcx, qword [rbx + 0xa8]
call fcn.005fc060
mov rcx, rax
mov dl, 1
mov rax, qword [rbx + 0xa8]
movzx r8, byte [rax + 0xa9]
call fcn.0070ff60
jmp 0x72e6b8
call sub.user32.dll_GetForegroundWindow
mov rdi, rax
mov rcx, qword [rbx + 0xa8]
call fcn.005fc060
cmp rdi, rax
sete dil
mov rcx, qword [rbx + 0xa8]
call fcn.005fc060
mov rcx, rax
xor edx, edx
mov rax, qword [rbx + 0xa8]
movzx r8, byte [rax + 0xa9]
call fcn.0070ff60
mov rcx, qword [rbx + 0x2e0]
mov dl, 1
mov r8b, 1
call fcn.0070ff60
test dil, dil
je 0x72e6b8
mov rcx, qword [rbx + 0xa8]
call fcn.005fc060
mov rcx, rax
call sub.user32.dll_SetForegroundWindow
mov rcx, qword [rbx + 0xa8]
mov edx, 0xb033
xor r8, r8
xor r9, r9
call fcn.005ef100
mov rax, qword [rbx + 0xa8]
mov byte [rax + 0x711], sil
mov rcx, qword [0x00861d98]
call fcn.00726860
xor ecx, ecx
mov r14d, eax
sub r14d, 1
mov edi, ecx
cmp edi, r14d
jg 0x72e749
sub r14d, ecx
add r14d, 1
mov rcx, qword [0x00861d98]
mov edx, edi
call fcn.00726840
mov r13, rax
cmp r13, qword [rbx + 0xa8]
je 0x72e73d
cmp byte [r13 + 0x711], 0
je 0x72e73d
mov rcx, r13
mov rax, qword [r13]
call qword [rax + 0x2f0]
test al, al
je 0x72e73d
mov rcx, r13
call fcn.005f5be0
add edi, 1
sub r14d, 1
test r14d, r14d
jne 0x72e700
nop
test sil, sil
je 0x72e78f
mov rcx, qword [rbx + 0x2e0]
mov rax, rcx
mov rsi, rcx
mov rcx, rax
mov edx, 0xffffffec
call sub.user32.dll_GetWindowLongPtrW
or rax, 0x80
mov rcx, rsi
mov edx, 0xffffffec
mov r8, rax
call sub.user32.dll_SetWindowLongPtrW
mov rcx, qword [rbx + 0x2e0]
xor edx, edx
call sub.user32.dll_SetWindowTextW
jmp 0x72e7e0
mov rcx, qword [rbx + 0x2e0]
mov rax, rcx
mov rsi, rcx
mov rcx, rax
mov edx, 0xffffffec
call sub.user32.dll_GetWindowLongPtrW
and rax, 0xffffffffffffff7f
mov rcx, rsi
mov edx, 0xffffffec
mov r8, rax
call sub.user32.dll_SetWindowLongPtrW
mov rsi, qword [rbx + 0x2e0]
mov rax, qword [rbx + 0x118]
mov rcx, rax
call fcn.00411d70
mov rcx, rsi
mov rdx, rax
call sub.user32.dll_SetWindowTextW
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop r13
pop r14
ret
Function at 0x7396f0
Capabilities:
Hide graphical window

Disassembly:
push r13
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
cmp qword [rbx + 0xd8], 0
jne 0x7397ab
mov rcx, qword [rbx + 0x10]
call fcn.005fc060
mov rcx, qword [0x006170b0]
mov dl, 1
mov r8, rax
call fcn.005f28b0
mov qword [rbx + 0xd8], rax
mov rsi, qword [rbx + 0xd8]
mov rcx, rsi
xor edx, edx
call fcn.00627b10
mov qword [rsi + 0x508], rbx
lea rax, [0x00738d70]
mov qword [rsi + 0x500], rax
mov rcx, qword [rbx + 0xd8]
call fcn.005fc060
mov rdi, rax
mov rcx, rsi
mov edx, 3
mov rax, qword [rsi]
call qword [rax + 0x1d0]
mov rcx, rdi
xor edx, edx
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x30], 8
call sub.user32.dll_SetWindowPos
mov rcx, qword [rbx + 0xd8]
call fcn.005fc060
mov rcx, rax
xor edx, edx
call sub.user32.dll_ShowWindow
cmp qword [rbx + 0xf8], 0
jne 0x73985a
mov rcx, qword [rbx + 0x10]
call fcn.005fc060
mov rcx, qword [0x006170b0]
mov dl, 1
mov r8, rax
call fcn.005f28b0
mov qword [rbx + 0xf8], rax
mov rsi, qword [rbx + 0xf8]
mov rcx, rsi
mov dl, 1
call fcn.00627b10
mov qword [rsi + 0x508], rbx
lea rax, [0x00738dd0]
mov qword [rsi + 0x500], rax
mov rcx, qword [rbx + 0xf8]
call fcn.005fc060
mov rdi, rax
mov rcx, rsi
mov edx, 2
mov rax, qword [rsi]
call qword [rax + 0x1d0]
mov rcx, rdi
xor edx, edx
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x30], 8
call sub.user32.dll_SetWindowPos
mov rcx, qword [rbx + 0xf8]
call fcn.005fc060
mov rcx, rax
xor edx, edx
call sub.user32.dll_ShowWindow
cmp qword [rbx + 0xe8], 0
jne 0x739902
mov rcx, qword [rbx + 0x10]
call fcn.005fc060
mov rcx, qword [0x006181d8]
mov dl, 1
mov r8, rax
call fcn.005f28b0
mov qword [rbx + 0xe8], rax
mov rsi, qword [rbx + 0xe8]
mov byte [rsi + 0x4d0], 1
mov rcx, qword [rbx + 0xe8]
call fcn.005fc060
mov rdi, rax
mov rcx, rsi
mov edx, 2
mov rax, qword [rsi]
call qword [rax + 0x1d0]
mov r13d, eax
mov rcx, rsi
mov edx, 3
mov rax, qword [rsi]
call qword [rax + 0x1d0]
mov rcx, rdi
xor edx, edx
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], r13d
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x30], 8
call sub.user32.dll_SetWindowPos
mov rcx, qword [rbx + 0xe8]
call fcn.005fc060
mov rcx, rax
xor edx, edx
call sub.user32.dll_ShowWindow
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop r13
ret

Function at 0x746a80
Capabilities:
Hash data with crc32

Disassembly:
xor ecx, ecx
lea rdx, [0x00861df8]
mov eax, ecx
mov r8d, 8
mov r9d, eax
and r9d, 1
test r9b, r9b
je 0x746aa7
shr eax, 1
xor eax, 0xedb88320
jmp 0x746aaa
shr eax, 1
sub r8d, 1
test r8d, r8d
jne 0x746a91
nop
mov dword [rdx], eax
add ecx, 1
add rdx, 4
cmp ecx, 0x100
jne 0x746a89
nop
mov byte [0x008621f8], 1
ret
Function at 0x746ad0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rdx
mov esi, r8d
mov edi, ecx
cmp byte [0x008621f8], 0
jne 0x746aed
call fcn.00746a80
xor ecx, ecx
mov edx, esi
sub edx, 1
mov eax, ecx
cmp eax, edx
jg 0x746b33
sub edx, ecx
add edx, 1
lea rcx, [0x00861df8]
movsxd r8, eax
movzx r8, byte [rbx + r8]
mov r9d, edi
xor r9d, r8d
and r9d, 0xff
mov r9d, r9d
shr edi, 8
mov ecx, dword [rcx + r9*4]
xor ecx, edi
mov edi, ecx
add eax, 1
sub edx, 1
test edx, edx
jne 0x746aff
nop
mov eax, edi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
Function at 0x758320
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
push rbx
mov byte [rsp - 0x58], 0
mov byte [rsp - 0x1058], 0
sub rsp, 0x1058
mov rbp, rsp
mov qword [rbp + 0x28], rbp
mov qword [rbp + 0x1070], rcx
mov rcx, qword [rbp + 0x1070]
call fcn.00758250
nop
mov byte [rbp + 0x104f], 0
mov rax, qword [rbp + 0x1070]
cmp qword [rax + 0x18], 0
je 0x7584fa
mov rax, qword [rbp + 0x1070]
cmp qword [rax + 8], 0xffffffffffffffff
je 0x758509
mov rax, qword [rbp + 0x1070]
cmp byte [rax + 0x10], 0
je 0x758509
mov rax, qword [rbp + 0x1070]
mov rcx, qword [rax + 0x18]
call fcn.00511790
mov dword [rbp + 0x48], eax
mov rax, qword [rbp + 0x1070]
mov rax, qword [rax + 0x18]
mov rcx, rax
lea rdx, [rbp + 0x4f]
mov r8d, 0x1000
mov rax, qword [rax]
call qword [rax + 0x30]
mov dword [rbp + 0x44], eax
cmp dword [rbp + 0x44], 0
jle 0x7584ea
mov rax, qword [rbp + 0x1070]
mov rcx, qword [rax + 8]
lea rdx, [rbp + 0x4f]
mov r8d, dword [rbp + 0x44]
xor r9, r9
call sub.wsock32.dll_send
mov dword [rbp + 0x40], eax
cmp dword [rbp + 0x40], 0xffffffff
jne 0x75848a
call sub.wsock32.dll_WSAGetLastError
mov dword [rbp + 0x3c], eax
cmp dword [rbp + 0x3c], 0x2733
je 0x758474
mov rcx, qword [rbp + 0x1070]
mov dx, 0xfffe
call fcn.0040dbb0
mov rbx, rax
mov rcx, qword [rbp + 0x1070]
mov rdx, qword [rbp + 0x1070]
mov r8b, 1
lea r9, [rbp + 0x3c]
call rbx
mov rcx, qword [rbp + 0x1070]
mov rax, qword [rbp + 0x1070]
mov rdx, qword [rax + 8]
mov rax, qword [rbp + 0x1070]
mov rbx, qword [rax]
call qword [rbx + 0x10]
mov rcx, rbp
call fcn.007582b0
mov rax, qword [rbp + 0x1070]
movzx rax, byte [rax + 0x40]
cmp al, byte [0x0075854c]
je 0x7584f2
call fcn.00442e10
jmp 0x7584f2
mov rax, qword [rbp + 0x1070]
mov rcx, qword [rax + 0x18]
movsxd rdx, dword [rbp + 0x48]
call fcn.005117b0
jmp 0x7584f2
mov eax, dword [rbp + 0x44]
cmp eax, dword [rbp + 0x40]
jle 0x7584b0
mov rax, qword [rbp + 0x1070]
mov rcx, qword [rax + 0x18]
mov edx, dword [rbp + 0x48]
add edx, dword [rbp + 0x40]
movsxd rdx, edx
call fcn.005117b0
jmp 0x75838d
mov rax, qword [rbp + 0x1070]
mov rcx, qword [rax + 0x18]
call fcn.00511790
mov rbx, rax
mov rax, qword [rbp + 0x1070]
mov rax, qword [rax + 0x18]
mov rcx, rax
mov rax, qword [rax]
call qword [rax + 0x18]
cmp rbx, rax
jne 0x75838d
mov rcx, rbp
call fcn.007582b0
jmp 0x7584f2
mov rcx, rbp
call fcn.007582b0
nop
mov byte [rbp + 0x104f], 1
nop
mov rcx, qword [rbp + 0x1070]
call fcn.00758270
jmp 0x758514
xor ecx, ecx
mov rdx, qword [rbp + 0x28]
call fcn.00758530
movzx rax, byte [rbp + 0x104f]
lea rsp, [rbp + 0x1058]
pop rbx
pop rbp
ret
Function at 0x758570
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
push rbx
sub rsp, 0x88
mov rbp, rsp
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x68], rbp
mov qword [rbp + 0xa0], rcx
mov qword [rbp + 0xa8], rdx
mov dword [rbp + 0xb0], r8d
nop
mov rcx, qword [rbp + 0xa0]
call fcn.00758250
nop
mov dword [rbp + 0x7c], 0
mov rax, qword [rbp + 0xa0]
cmp byte [rax + 0x10], 0
je 0x7586c2
mov rax, qword [rbp + 0xa0]
mov rcx, qword [rax + 8]
mov rdx, qword [rbp + 0xa8]
mov r8d, dword [rbp + 0xb0]
xor r9, r9
call sub.wsock32.dll_send
mov dword [rbp + 0x7c], eax
cmp dword [rbp + 0x7c], 0xffffffff
jne 0x7586b3
call sub.wsock32.dll_WSAGetLastError
mov dword [rbp + 0x78], eax
cmp dword [rbp + 0x78], 0x2733
je 0x7586b3
mov rcx, qword [rbp + 0xa0]
mov dx, 0xfffe
call fcn.0040dbb0
mov rbx, rax
mov rcx, qword [rbp + 0xa0]
mov rdx, qword [rbp + 0xa0]
mov r8b, 1
lea r9, [rbp + 0x78]
call rbx
mov rcx, qword [rbp + 0xa0]
mov rax, qword [rbp + 0xa0]
mov rdx, qword [rax + 8]
mov rax, qword [rbp + 0xa0]
mov rbx, qword [rax]
call qword [rbx + 0x10]
cmp dword [rbp + 0x78], 0
je 0x7586b3
lea rcx, [rbp + 0x30]
mov edx, dword [rbp + 0x78]
xor r8, r8
call fcn.00440390
mov rax, qword [rbp + 0x30]
mov qword [rbp + 0x38], rax
mov byte [rbp + 0x40], 0x11
mov eax, dword [rbp + 0x78]
mov dword [rbp + 0x48], eax
mov byte [rbp + 0x50], 0
lea rax, [0x00758734]
mov qword [rbp + 0x58], rax
mov byte [rbp + 0x60], 0x11
mov rcx, qword [0x00758110]
mov dl, 1
mov r8, qword [0x008547f8]
lea r9, [rbp + 0x38]
mov qword [rsp + 0x20], 2
call fcn.004432a0
mov rcx, rax
call fcn.0040fa60
nop
mov rcx, qword [rbp + 0xa0]
call fcn.00758270
jmp 0x7586cf
xor ecx, ecx
mov rdx, qword [rbp + 0x68]
call fcn.007586f0
jmp 0x7586d0
nop
lea rcx, [rbp + 0x30]
call fcn.004107c0
mov eax, dword [rbp + 0x7c]
lea rsp, [rbp + 0x88]
pop rbx
pop rbp
ret
Function at 0x7eb190
Capabilities:
Compare security identifiers

Disassembly:
push rbx
add rsp, 0xffffffffffffff80
call sub.kernel32.dll_GetCurrentProcess
mov rcx, rax
mov edx, 8
lea r8, [rsp + 0x78]
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x7eb1b7
xor ebx, ebx
jmp 0x7eb284
mov ecx, 0x400
call fcn.004091b0
mov rbx, rax
mov rcx, qword [rsp + 0x78]
mov edx, 1
mov r8, rbx
mov r9d, 0x400
lea rax, [rsp + 0x74]
mov qword [rsp + 0x20], rax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x7eb1fb
mov rcx, qword [rsp + 0x78]
call sub.kernel32.dll_CloseHandle
xor ebx, ebx
jmp 0x7eb284
mov rcx, qword [rsp + 0x78]
call sub.kernel32.dll_CloseHandle
lea rax, [0x008539a4]
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
mov dl, 1
mov r8d, 0x12
xor r9, r9
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x48], 0
lea rax, [rsp + 0x68]
mov qword [rsp + 0x50], rax
call sub.advapi32.dll_AllocateAndInitializeSid
test eax, eax
jne 0x7eb268
xor ebx, ebx
jmp 0x7eb284
mov rcx, qword [rbx]
mov rdx, qword [rsp + 0x68]
call sub.advapi32.dll_EqualSid
test eax, eax
setne bl
mov rcx, qword [rsp + 0x68]
call sub.advapi32.dll_FreeSid
mov eax, ebx
sub rsp, 0xffffffffffffff80
pop rbx
ret
Function at 0x7eb2a0
Capabilities:
Create process on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x68
mov rbp, rsp
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x50], 0
nop
lea rcx, [0x007eb5a8]
call fcn.0041b6b0
nop
mov rax, qword [0x00854578]
mov rcx, qword [rax]
call fcn.0072b820
call fcn.007eb190
test al, al
jne 0x7eb3b3
call fcn.007eb030
lea rcx, [rbp + 0x50]
xor edx, edx
call fcn.00409b90
lea rcx, [rbp + 0x58]
mov rdx, qword [rbp + 0x50]
call fcn.00438970
lea rcx, [rbp + 0x58]
lea rdx, [0x007eb528]
call fcn.004120d0
mov rcx, qword [rbp + 0x58]
call fcn.00411d70
mov rbx, rax
mov rax, qword [0x00854578]
mov rcx, qword [rax]
lea rdx, [rbp + 0x40]
call fcn.0072caa0
lea rcx, [rbp + 0x48]
mov edx, 3
lea r8, [0x007eb558]
mov r9, qword [rbp + 0x40]
lea rax, [0x007eb558]
mov qword [rsp + 0x20], rax
call fcn.004122c0
mov rcx, qword [rbp + 0x48]
call fcn.00411d70
xor ecx, ecx
lea rdx, [0x007eb510]
mov r8, rbx
mov r9, rax
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
call sub.shell32.dll_ShellExecuteW
mov rax, qword [0x00854578]
mov rcx, qword [rax]
call fcn.0072bba0
jmp 0x7eb3ee
mov ecx, 0x3e8
call sub.kernel32.dll_Sleep
lea rcx, [rbp + 0x30]
xor edx, edx
call fcn.00409b90
lea rcx, [rbp + 0x38]
mov rdx, qword [rbp + 0x30]
call fcn.00438970
lea rcx, [rbp + 0x38]
lea rdx, [0x007eb528]
call fcn.004120d0
mov rcx, qword [rbp + 0x38]
call fcn.00438840
mov rax, qword [0x00854578]
mov rcx, qword [rax]
mov dl, 1
call fcn.0072e5a0
mov rax, qword [0x00854578]
mov rcx, qword [rax]
lea rdx, [0x007eb568]
call fcn.0072b050
mov rcx, qword [0x0069ec68]
lea rdx, [0x007eb594]
mov r8b, 1
call fcn.006c5580
mov rax, qword [0x00854578]
mov rcx, qword [rax]
mov rdx, qword [0x00760890]
mov r8, qword [0x00854458]
call fcn.0072b850
mov rax, qword [0x00854578]
mov rcx, qword [rax]
mov rdx, qword [0x0075ce50]
mov r8, qword [0x008543b0]
call fcn.0072b850
mov rax, qword [0x00854578]
mov rcx, qword [rax]
mov rdx, qword [0x0075a930]
mov r8, qword [0x00854480]
call fcn.0072b850
mov rax, qword [0x00854578]
mov rcx, qword [rax]
mov rdx, qword [0x0075b530]
mov r8, qword [0x008545e8]
call fcn.0072b850
mov rax, qword [0x00854578]
mov rcx, qword [rax]
call fcn.0072ba40
nop
lea rcx, [rbp + 0x30]
mov edx, 6
call fcn.004108a0
call fcn.00410310
jmp 0x7eb4cc
lea rsp, [rbp + 0x68]
pop rbx
pop rbp
ret
Function at 0x140f6297a
Capabilities:
Execute anti-debugging instructions

Disassembly:
ror edx, 1
cmc
add edx, 0x4ea2c6f
push rdi
xor dword [rsp], edx
stc
pop rdi
stc
test r10d, 0x41c175c
test r13b, cl
movsxd rdx, edx
jmp 0x140ec8030
add r9, rdx
jmp 0x140fe6f4d
push rsi
movsx r11, r8w
movzx si, dil
push r15
movsx si, r13b
mov si, dx
movsxd r11, edi
push r13
push rbx
movzx rbx, sp
not bl
bswap rbx
push rcx
movsx bx, dil
cmovbe r11w, dx
jmp 0x140f67cfc
add rsi, 4
xor edx, edi
inc edx
bswap edx
cmc
jmp 0x140ebb201
push r11
movzx r11w, sil
bswap r11w
push r10
jmp 0x140f125d5
push rax
not r11
mov r11w, 0x6e9a
movzx si, r8b
push r9
movzx r9, r12w
mov ax, 0x906
lahf
pushfq
mov r11b, sil
cwde
push r8
dec r11w
push r12
movzx rbx, r9w
movzx r11d, r13w
mov r11w, si
push rbp
push r14
not sil
push rdx
movsx eax, bp
mov r11w, 0x15a1
push rdi
inc r9w
rdtsc
movabs r11, 0
push r11
rdtsc
mov rsi, qword [rsp + 0x90]
lahf
cdqe
dec esi
movsxd rdi, ebp
rol esi, 1
not esi
xor esi, 0x2f444045
cdq
dec esi
rcl r9w, 0xf0
not dh
bswap esi
rcl ax, 0x3f
not r9
sub esi, 0x77d9592b
lea rsi, [rsi + r11]
bt rax, rax
shl bx, 0xdc
movabs rax, 0x100000000
rcr r9b, cl
xchg dil, r8b
movzx dx, r8b
add rsi, rax
mov r8, rsp
dec dil
sub rsp, 0x180
sal rdx, cl
dec r9b
movzx rdx, r14w
and rsp, 0xfffffffffffffff0
btc r9, 0x67
adc dil, dl
setns r9b
mov rdi, rsi
btr r9d, 0xe2
cqo
movabs rbx, 0
sub rdi, rbx
clc
rcl dl, cl
lea r9, [0x140f67ded]
bsr dx, r13w
rol dh, 0x6a
mov edx, dword [rsi]
jmp 0x140f5c691
jmp r9