joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180023650
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov rax, qword [0x180060010]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov eax, 8
imul rax, rax, 0
lea rcx, [0x180060aa8]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x38], rax
mov byte [rsp + 0x60], 0x48
mov byte [rsp + 0x61], 0xb8
mov byte [rsp + 0x62], 0xc8
mov byte [rsp + 0x63], 0x35
mov byte [rsp + 0x64], 0x4d
mov byte [rsp + 0x65], 0x9f
mov byte [rsp + 0x66], 0xce
mov byte [rsp + 0x67], 0x32
mov byte [rsp + 0x68], 0x23
mov byte [rsp + 0x69], 0xa9
mov byte [rsp + 0x70], 0x48
mov byte [rsp + 0x71], 0xb8
mov byte [rsp + 0x72], 0x9e
mov byte [rsp + 0x73], 0xb1
mov byte [rsp + 0x74], 0x60
mov byte [rsp + 0x75], 0xb9
mov byte [rsp + 0x76], 0x47
mov byte [rsp + 0x77], 0xef
mov byte [rsp + 0x78], 5
mov byte [rsp + 0x79], 0xc1
movabs rax, 0xb2c0933cdf8c4e22
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x80], rax
mov dword [rsp + 0x20], 0
mov r8d, 0xa
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x28]
call fcn.18004d010
test eax, eax
je 0x180023751
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
jmp 0x180023729
mov r8d, 0xa
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x38]
call fcn.18004d010
test eax, eax
je 0x180023779
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
jmp 0x180023751
mov rax, qword [rsp + 0x28]
add rax, 0x11
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x50], 0x40
mov dword [rsp + 0x54], 0
mov eax, dword [rsp + 0x30]
lea r9, [rsp + 0x54]
mov r8d, dword [rsp + 0x50]
mov edx, eax
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [rsp + 0x20], 0
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x40], rax
jmp 0x1800237e7
mov rax, qword [rsp + 0x40]
inc rax
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x40], rax
je 0x180023829
mov eax, dword [rsp + 0x20]
movzx eax, byte [rsp + rax + 0x80]
mov rcx, qword [rsp + 0x40]
movzx ecx, byte [rcx]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x40]
mov byte [rcx], al
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
and eax, 7
mov dword [rsp + 0x20], eax
jmp 0x1800237da
mov eax, dword [rsp + 0x30]
lea r9, [rsp + 0x50]
mov r8d, dword [rsp + 0x54]
mov edx, eax
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.180036760
add rsp, 0x98
ret
Function at 0x140001290
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x13f0
call fcn.140004530
sub rsp, rax
mov rax, qword [0x140009040]
xor rax, rsp
mov qword [rsp + 0x13e0], rax
mov ebp, edx
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor edi, edi
mov dword [rsp + 0x20], edi
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
lea ecx, [rdi + 0x40]
call fcn.140003700
mov rsi, rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], 0x3e
mov qword [rsp + 0x48], 0x3f
movups xmm0, xmmword [str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x140005558]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [0x140005568]
movups xmmword [rax + 0x20], xmm0
movsd xmm0, qword [0x140005578]
movsd qword [rax + 0x30], xmm0
mov eax, dword [0x140005580]
mov dword [rsi + 0x38], eax
movzx eax, word [0x140005584]
mov word [rsi + 0x3c], ax
mov byte [rsi + 0x3e], dil
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], dil
mov edi, 1
mov dword [rsp + 0x20], edi
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov ecx, eax
mov dword [rsp + 0x13d4], 0xffffffff
mov dword [rsp + 0x54], eax
nop dword [rax]
nop word [rax + rax]
mov eax, ecx
shr eax, 0x1e
xor eax, ecx
imul ecx, eax, 0x6c078965
add ecx, edi
mov dword [rsp + rdi*4 + 0x54], ecx
inc rdi
cmp rdi, 0x270
jb 0x140001380
mov dword [rsp + 0x50], 0x270
test ebp, ebp
jle 0x140001420
mov rdi, rbp
nop
lea rcx, [rsp + 0x50]
call fcn.1400034f0
mov ecx, eax
imul rax, rcx, 0x3e
cmp eax, 3
ja 0x1400013da
lea rcx, [rsp + 0x50]
call fcn.1400034f0
mov ecx, eax
imul rax, rcx, 0x3e
cmp eax, 4
jb 0x1400013c5
shr rax, 0x20
movsxd rcx, eax
movzx r9d, byte [rcx + rsi]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x140001412
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0xf
jbe 0x140001407
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x14000141a
mov rcx, rbx
call fcn.140002e90
sub rdi, 1
jne 0x1400013b0
mov edx, 0x40
mov rcx, rsi
call fcn.14000373c
mov rax, rbx
mov rcx, qword [rsp + 0x13e0]
xor rcx, rsp
call fcn.1400036e0
lea r11, [rsp + 0x13f0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140001d20
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je case.default.0x140001d41
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x140001d6e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140001d70
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140001dc9
test ecx, ecx
jle 0x140001da9
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140001dc9
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140001dc9
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
Function at 0x140002380
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140009040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x1400023ad
xor eax, eax
jmp 0x140002519
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x1400023e7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x1400023e7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140002519
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14000250c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14000242a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140002455
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140002511
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400024c4
sub eax, 1
je 0x1400024c4
cmp eax, 2
jne 0x14000250c
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140002511
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x1400024f2
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14000250c
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x140002511
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400036e0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140002980
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140009040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140002a53
cmp byte [rcx + 0x71], 0
je 0x140002a53
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140002a4f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140002a14
sub eax, 1
je 0x140002a18
cmp eax, 2
jne 0x140002a4f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400036e0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140002a46
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140002a4f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1400029fc
xor al, al
jmp 0x1400029fc
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400036e0
add rsp, 0x60
pop rbx
ret
Function at 0x1400034f0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x140003551
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x140003510
mov ecx, dword [r9]
jmp 0x140003638
cmp ecx, 0x4e0
jb 0x140003638
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x140003570
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop dword [rax + rax]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x1400035c0
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret

Function at 0x140004060
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400040aa
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400040aa
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400040aa
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400040aa
cmp dword [rcx + 0x84], 0xe
jbe 0x1400040aa
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400040ac
xor al, al
add rsp, 0x28
ret
Function at 0x142774058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1427741df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x142774089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14277406f
add dl, dl
jne 0x142774096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1427740f6
xor eax, eax
add dl, dl
jne 0x1427740a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1427741ad
add dl, dl
jne 0x1427740b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1427740c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1427740d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1427740dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1427740ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14277407e
mov eax, 1
add dl, dl
jne 0x142774106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x142774113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1427740fb
sub eax, ebx
mov ebx, 1
jne 0x14277414c
mov ecx, 1
add dl, dl
jne 0x14277412e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14277413b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x142774123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14277407e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x142774168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x142774175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14277415d
cmp eax, 0x7d00
jae 0x14277419b
cmp eax, 0x500
jb 0x142774196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14277407e
cmp eax, 0x7f
ja 0x14277419e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14277407e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1427741d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14277407e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400c2b40
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r15
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x1401126b8], rbx
je 0x1400c2b8c
cmp rax, rbx
jne 0x1400c2b7f
mov ebx, 1
mov esi, ebx
jmp 0x1400c2b91
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400c2b64
mov ebx, 1
mov eax, dword [0x1401126c0]
cmp eax, ebx
jne 0x1400c2ba7
mov ecx, 0x1f
call fcn.1401ab000
jmp 0x1400c2c16
mov eax, dword [0x1401126c0]
test eax, eax
jne 0x1400c2c10
mov dword [0x1401126c0], ebx
lea r15, [0x1400d57e8]
lea rdi, [0x1400d57d0]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
cmp rdi, r15
jae 0x1400c2c02
test eax, eax
jne 0x1400c2c06
cmp qword [rdi], 0
je 0x1400c2bf7
movabs r10, 0xd30527475e523070
mov rax, qword [rdi]
mov rcx, qword [0x1400d51e0]
call rcx
mov dword [rsp + 0x20], eax
add rdi, 8
mov qword [rsp + 0x28], rdi
jmp 0x1400c2bce
test eax, eax
je 0x1400c2c16
mov eax, 0xff
jmp 0x1400c2cfc
mov dword [0x140111358], ebx
mov eax, dword [0x1401126c0]
cmp eax, ebx
jne 0x1400c2c3d
lea rdx, [0x1400d57c8]
lea rcx, [0x1400d51f0]
call sub.msvcrt.dll__initterm
mov dword [0x1401126c0], 2
test esi, esi
jne 0x1400c2c4a
xor eax, eax
xchg qword [0x1401126b8], rax
cmp qword [0x1401126d8], 0
je 0x1400c2c88
lea rcx, [0x1401126d8]
call fcn.1400c3370
test eax, eax
je 0x1400c2c88
movabs r10, 0x99012e4578d92870
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x1401126d8]
mov r9, qword [0x1400d51e0]
call r9
mov r8, qword [0x140111370]
mov rdx, qword [0x140111368]
mov ecx, dword [0x140111360]
call fcn.140003a10
mov dword [0x140111354], eax
cmp dword [0x140111378], 0
jne 0x1400c2cb8
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x140111358], 0
jne 0x1400c2ccd
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x140111354]
jmp 0x1400c2cfc
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r15
ret
sub rsp, 0x28
call fcn.1400c3404
add rsp, 0x28
jmp 0x1400c2b40

Function at 0x1400c325c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400c32a8
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400c32a0
cmp dword [rcx + 0x3c], edx
jl 0x1400c32a0
cmp dword [rcx + 0x3c], 0x10000000
jae 0x1400c32a0
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x1400c32a8
mov rax, rdx
add rsp, 0x18
ret
Function at 0x1400025a0
Capabilities:
Persist via windows service
Set registry value

Disassembly:
sub rsp, 0x78
mov rax, qword [0x140046040]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rdx, str.SYSTEMCurrentControlSetServiceswscsvc
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov rcx, 0xffffffff80000002
xor eax, eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x20106
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x140002622
mov r8d, eax
lea rdx, str.SYSTEMCurrentControlSetServiceswscsvc
lea rcx, str.Could_not_find_or_create__ls_error__d_n
call fcn.1400052a0
mov al, 1
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140008f50
add rsp, 0x78
ret
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x58]
mov dword [rsp + 0x28], 4
lea rdx, str.Start
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x58], 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14000260e
lea rcx, str.failed_to_write_to_wscsvc_n
call fcn.140001170
xor al, al
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140008f50
add rsp, 0x78
ret
Function at 0x140005a50
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x160
mov rax, qword [0x140046040]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor edx, edx
mov rbx, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140005b2c
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x12c
call fcn.14002dd70
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32First]
mov rcx, rdi
test eax, eax
je 0x140005b26
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x140005b23
nop dword [rax]
lea rcx, [rsp + 0x4c]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x140005ae0
cmp qword [rbx + 0x18], 0xf
mov rcx, rbx
mov r8, qword [rbx + 0x10]
jbe 0x140005afa
mov rcx, qword [rbx]
cmp r8, rax
jne 0x140005b11
lea rdx, [rsp + 0x4c]
call fcn.14002e120
test eax, eax
je 0x140005ba3
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140005ad0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x140005b66
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x140005b61
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140005bf6
mov rcx, r8
call fcn.140008f70
mov eax, 0xffffffff
mov byte [rbx], 0
mov qword [rbx + 0x18], 0xf
mov qword [rbx + 0x10], 0
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140008f50
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
mov esi, dword [rsp + 0x28]
cmp esi, 0xffffffff
je 0x140005b23
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x140005bef
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x140005bea
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140005bf6
mov rcx, r8
call fcn.140008f70
mov eax, esi
jmp 0x140005b6b
call fcn.140014410
int3
Function at 0x140007bfc
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rdi, rcx
test r8, r8
jg 0x140007c2a
xor eax, eax
jmp 0x140007d10
cmp qword [rcx + 0x68], 0
je 0x140007c3b
call fcn.140007d2c
jmp 0x140007d10
mov rax, qword [rcx + 0x38]
mov rsi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140007c52
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140007c54
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140007c86
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.14002d6d0
mov rax, qword [rdi + 0x50]
add r14, rbx
sub rsi, rbx
sub dword [rax], ebx
mov rcx, qword [rdi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rdi + 0x80], 0
je 0x140007d0a
mov r8, qword [rdi + 0x18]
lea rax, [rdi + 0x70]
cmp qword [r8], rax
jne 0x140007cbd
mov rcx, qword [rdi + 0x88]
mov rdx, qword [rdi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rdi + 0x38]
mov qword [rax], rcx
mov rax, qword [rdi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x140007ce6
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call fcn.140015f68
add r14, rax
sub rsi, rax
cmp rax, rbx
jne 0x140007d0a
cmp rsi, rbx
ja 0x140007cc4
test rsi, rsi
je 0x140007d0a
mov r9, qword [rdi + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.140015f68
sub rsi, rax
sub rbp, rsi
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x140009c48
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140009c92
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140009c92
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140009c92
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140009c92
cmp dword [rcx + 0x84], 0xe
jbe 0x140009c92
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140009c94
xor al, al
add rsp, 0x28
ret