joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2000011a0
Capabilities:
Get mac address on windows

Disassembly:
mov rax, rsp
push rbx
push rbp
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x50
xor ebx, ebx
mov r15, rdx
mov r14, rcx
lea rdx, [rax + 0x18]
xor ecx, ecx
mov dword [rax + 0x18], ebx
mov rsi, rbx
mov word [rax + 0x20], bx
movzx ebp, bx
mov word [rax + 0x22], bx
movzx r12d, bx
mov word [rax + 0x24], bx
movzx r13d, bx
mov word [rax + 0x26], bx
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, 0x6f
jne 0x200001277
mov ecx, dword [rsp + 0xa0]
call fcn.200007ec8
lea rdx, [rsp + 0xa0]
mov rcx, rax
mov rsi, rax
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
je 0x200001277
lea rdx, [0x200000000]
mov ecx, dword [rdx + 0x17c98]
mov dword [r14], ecx
mov ecx, dword [rdx + 0x17c9c]
mov dword [r14 + 4], ecx
mov eax, dword [rdx + 0x17ca0]
mov rcx, rsi
mov dword [r14 + 8], eax
movzx eax, byte [rdx + 0x17ca4]
mov byte [r14 + 0xc], al
mov eax, dword [rdx + 0x17ca8]
mov dword [r15], eax
mov eax, dword [rdx + 0x17cac]
mov dword [r15 + 4], eax
movzx eax, byte [rdx + 0x17cb0]
mov byte [r15 + 8], al
call fcn.200007e88
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rsi
pop rbp
pop rbx
ret
mov qword [rsp + 0x90], rdi
mov rdi, rsi
lea rax, [rdi + 0x1c0]
test rax, rax
je 0x200001293
cmp byte [rax], 0x30
jne 0x20000129e
mov rdi, qword [rdi]
test rdi, rdi
jne 0x200001282
mov rdi, rsi
lea rcx, [rdi + 0x1c0]
lea rdx, [rsp + 0x40]
sub rdx, rcx
nop dword [rax]
movzx eax, byte [rcx]
inc rcx
mov byte [rdx + rcx - 1], al
test al, al
jne 0x2000012b0
lea rdx, [0x200017c34]
lea rcx, [rsp + 0x40]
call fcn.200008164
test rax, rax
je 0x200001322
mov rcx, rax
call fcn.200007fdc
inc rbx
cmp rbx, 4
mov word [rsp + rbx*2 + 0xa6], ax
jg 0x200001300
lea rdx, [0x200017c44]
xor ecx, ecx
call fcn.200008164
test rax, rax
jne 0x2000012d4
mov r13w, word [rsp + 0xae]
mov r12w, word [rsp + 0xac]
mov bp, word [rsp + 0xaa]
mov bx, word [rsp + 0xa8]
movzx ecx, byte [rdi + 0x19c]
movzx edx, byte [rdi + 0x19b]
movzx eax, byte [rdi + 0x19d]
movzx r10d, byte [rdi + 0x19a]
movzx r9d, byte [rdi + 0x199]
movzx r8d, byte [rdi + 0x198]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], edx
lea rdx, str._02X_02X_02X_02X_02X_02X
mov rcx, r14
mov dword [rsp + 0x20], r10d
call fcn.200007d18
movsx r11d, r13w
movsx eax, r12w
mov dword [rsp + 0x28], r11d
lea rdx, str._02X_02X_02X_02X
movsx r9d, bp
movsx r8d, bx
mov rcx, r15
mov dword [rsp + 0x20], eax
call fcn.200007d18
mov rcx, rsi
call fcn.200007e88
mov rdi, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rsi
pop rbp
pop rbx
ret
Function at 0x2000013c0
Capabilities:
Check os version
Get system information on windows

Disassembly:
push rbx
sub rsp, 0xf0
mov rbx, rcx
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8d, 0x9c
call fcn.20000d940
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x9c
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x200001507
mov eax, dword [rsp + 0x54]
sub eax, 4
je 0x20000148e
sub eax, 1
je 0x20000144e
cmp eax, 1
je 0x200001418
mov byte [rbx], 0
jmp 0x2000014a2
mov eax, dword [rsp + 0x58]
test eax, eax
jne 0x200001432
cmp byte [rsp + 0xea], 1
mov eax, 0x1c
lea ecx, [rax - 4]
jmp 0x20000149d
cmp eax, 1
jne 0x2000014a2
cmp byte [rsp + 0xea], 1
mov eax, 0x20
mov ecx, 0x1d
cmovne eax, ecx
jmp 0x2000014a0
mov eax, dword [rsp + 0x58]
test eax, eax
jne 0x20000145b
mov byte [rbx], 0xc
jmp 0x2000014a2
cmp eax, 1
jne 0x200001465
mov byte [rbx], reloc.WS2_32.dll_recv
jmp 0x2000014a2
cmp eax, 2
jne 0x2000014a2
lea ecx, [rax + 0x57]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x20000147c
mov byte [rbx], 0x15
jmp 0x2000014a2
cmp byte [rsp + 0xea], 1
mov eax, 0x14
lea ecx, [rax - 3]
jmp 0x20000149d
cmp dword [rsp + 0x58], 0x5a
mov eax, 4
mov ecx, 8
cmove eax, ecx
mov byte [rbx], al
xor eax, eax
lea rcx, [0x200017d08]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.GetNativeSystemInfo
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rsp + 0x20]
test rax, rax
jne 0x2000014f1
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
jmp 0x2000014f3
call rax
mov rax, qword [rsp + 0x20]
cmp ax, 9
je 0x200001504
cmp ax, 6
jne 0x200001507
or byte [rbx], 1
add rsp, 0xf0
pop rbx
ret
Function at 0x200001820
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
or ebx, 0xffffffff
mov esi, 0x2c
nop word [rax + rax]
movzx ecx, byte [rdi]
call fcn.200008af0
inc rdi
movzx edx, al
xor edx, ebx
mov eax, edx
shr edx, 1
and eax, 1
imul eax, eax, 0xedb88320
xor eax, edx
mov ecx, eax
shr eax, 1
and ecx, 1
imul ecx, ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
imul eax, eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
imul ecx, ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
imul eax, eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
imul ecx, ecx, 0xedb88320
xor ecx, eax
mov edx, ecx
shr ecx, 1
and edx, 1
imul edx, edx, 0xedb88320
xor edx, ecx
mov ebx, edx
shr edx, 1
and ebx, 1
imul ebx, ebx, 0xedb88320
xor ebx, edx
sub rsi, 1
not ebx
jne 0x200001840
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x200002840
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x240
mov rbx, rcx
lea rcx, [rsp + 0x131]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x130], 0
call fcn.20000d940
xor edx, edx
lea rcx, [rsp + 0x31]
lea r8d, [rdx + 0x7f]
call fcn.20000d940
lea r10, [0x200000000]
lea rdx, [rsp + 0x30]
mov rax, qword [r10 + 0x17c68]
xor esi, esi
mov qword [rdx], rax
movzx eax, word [r10 + 0x17c70]
mov r8d, esi
mov word [rdx + 8], ax
movzx eax, byte [r10 + 0x17c72]
mov rdi, rsi
mov byte [rdx + 0xa], al
movzx r9d, byte [rdi + r10 + 0x17e00]
mov eax, 0x66666667
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, r8d
lea ecx, [rdx + rdx*4]
add ecx, ecx
sub eax, ecx
cdqe
movzx ecx, byte [rsp + rax + 0x30]
cmp r9b, cl
je 0x2000028ed
xor cl, r9b
mov byte [rsp + rdi + 0x130], cl
jmp 0x2000028f5
mov byte [rsp + rdi + 0x130], r9b
inc rdi
inc r8d
cmp rdi, 0x1b
jl 0x2000028b0
movsxd rax, r8d
mov rcx, rsi
mov byte [rsp + rax + 0x130], sil
nop
movzx eax, byte [rsp + rcx + 0x130]
inc rcx
mov byte [rsp + rcx + 0x2f], al
test al, al
jne 0x200002910
lea rax, [rsp + 0x278]
lea rdx, [rsp + 0x30]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000000
mov byte [rsp + 0x130], sil
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x200002abc
mov rcx, qword [rsp + 0x278]
lea rax, [rsp + 0x268]
lea r9, [rsp + 0x270]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x130]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x270], 1
mov dword [rsp + 0x268], 0x100
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x278]
mov edi, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
mov r11d, esi
sete r11b
test r11d, r11d
je 0x200002abc
cmp byte [rsp + 0x130], 0x22
mov rcx, rsi
jne 0x200002a00
nop word [rax + rax]
movzx eax, byte [rsp + rcx + 0x131]
inc rcx
mov byte [rsp + rcx + 0x2f], al
test al, al
jne 0x2000029e0
lea rdx, [0x200017d04]
jmp 0x200002a1a
movzx eax, byte [rsp + rcx + 0x130]
inc rcx
mov byte [rsp + rcx + 0x2f], al
test al, al
jne 0x200002a00
lea rdx, [0x200017e1c]
lea rcx, [rsp + 0x30]
call fcn.200008164
lea rdx, str.__x86_
lea rcx, [rsp + 0x30]
call fcn.200007f80
mov rdi, rax
test rax, rax
je 0x200002a8f
mov rdx, rax
lea rax, [rsp + 0x130]
sub rax, rdx
nop dword [rax + rax]
movzx ecx, byte [rdx]
inc rdx
mov byte [rax + rdx - 1], cl
test cl, cl
jne 0x200002a50
mov byte [rdi], sil
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x30]
lea rdx, [rsp + 0x136]
repne scasb al, byte [rdi]
xor ecx, ecx
nop dword [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x200002a80
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x30]
sub rbx, rcx
nop dword [rax]
movzx ecx, byte [rdx]
inc rdx
mov byte [rbx + rdx - 1], cl
test cl, cl
jne 0x200002aa0
mov ax, si
add rsp, 0x240
pop rdi
pop rsi
pop rbx
ret
or rax, 0xffffffffffffffff
add rsp, 0x240
pop rdi
pop rsi
pop rbx
ret
Function at 0x200002ad0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x150
xor edx, edx
mov rdi, rcx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x200002b79
lea rdx, [0x200017e28]
mov rcx, rdi
call fcn.200008164
mov rdi, rax
test rax, rax
je 0x200002b70
nop
lea rdx, [rsp + 0x20]
mov rcx, rbx
mov dword [rsp + 0x20], 0x130
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x200002b5a
nop dword [rax]
lea rcx, [rsp + 0x4c]
mov rdx, rdi
call fcn.200007cc4
mov rcx, rbx
test eax, eax
je 0x200002b8c
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x200002b30
lea rdx, [0x200017e2c]
xor ecx, ecx
call fcn.200008164
mov rdi, rax
test rax, rax
jne 0x200002b10
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rbx, qword [rsp + 0x160]
add rsp, 0x150
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x160]
mov eax, 1
add rsp, 0x150
pop rdi
ret

Function at 0x200003310
Capabilities:
Enumerate processes

Disassembly:
push rsi
sub rsp, 0x190
mov rsi, rcx
test rcx, rcx
je 0x200003496
xor edx, edx
mov byte [rcx], 0
mov qword [rsp + 0x1a8], rbx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x200003483
mov rcx, qword [str.svchost.exe]
lea rax, [rsp + 0x20]
xor edx, edx
mov qword [rax], rcx
mov ecx, dword [0x200017ea8]
lea r8d, [rdx + 0x34]
mov dword [rax + 8], ecx
lea rcx, [rsp + 0x2c]
call fcn.20000d940
xor eax, eax
lea rdx, [rsp + 0x60]
mov rcx, rbx
mov byte [rsp + 0x1a0], 0
mov dword [rsp + 0x1a1], eax
mov byte [rsp + 0x1a5], al
mov dword [rsp + 0x60], 0x130
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x200003464
mov qword [rsp + 0x1b0], rdi
nop dword [rax]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x8c]
call fcn.200007cc4
test eax, eax
je 0x20000343f
movzx eax, byte [rsp + 0x90]
or rcx, 0xffffffffffffffff
mov rdi, rsi
mov byte [rsp + 0x1a0], al
movzx eax, byte [rsp + 0x8e]
lea rdx, [rsp + 0x1a0]
mov byte [rsp + 0x1a1], al
movzx eax, byte [rsp + 0x8c]
mov byte [rsp + 0x1a2], al
movzx eax, byte [rsp + 0x8f]
mov byte [rsp + 0x1a3], al
movzx eax, byte [rsp + 0x8d]
mov byte [rsp + 0x1a4], al
xor eax, eax
repne scasb al, byte [rdi]
xor ecx, ecx
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x200003430
lea rdx, [rsp + 0x60]
mov rcx, rbx
mov dword [rsp + 0x60], 0x130
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x2000033b0
mov rdi, qword [rsp + 0x1b0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x1a8]
mov eax, 1
add rsp, 0x190
pop rsi
ret
xor eax, eax
mov rbx, qword [rsp + 0x1a8]
add rsp, 0x190
pop rsi
ret
xor eax, eax
add rsp, 0x190
pop rsi
ret
Function at 0x2000047c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x3b0
mov rbp, rcx
mov rsi, r8
mov rbx, rdx
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0xff
mov byte [rsp + 0x20], 0
call fcn.20000d940
xor edx, edx
lea r8d, [rdx + 0x7f]
lea rcx, [rsp + 0x121]
call fcn.20000d940
lea r10, [0x200000000]
lea rdx, [rsp + 0x120]
mov rax, qword [r10 + 0x17c68]
xor r8d, r8d
mov qword [rdx], rax
movzx eax, word [r10 + 0x17c70]
mov rdi, r8
mov word [rdx + 8], ax
movzx eax, byte [r10 + 0x17c72]
mov byte [rdx + 0xa], al
movzx r9d, byte [rdi + r10 + 0x17fd0]
mov eax, 0x66666667
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, r8d
lea ecx, [rdx + rdx*4]
add ecx, ecx
sub eax, ecx
cdqe
movzx ecx, byte [rsp + rax + 0x120]
cmp r9b, cl
je 0x20000487d
xor cl, r9b
mov byte [rsp + rdi + 0x20], cl
jmp 0x200004882
mov byte [rsp + rdi + 0x20], r9b
inc rdi
inc r8d
cmp rdi, 0x31
jl 0x200004840
lea rcx, [rsp + 0x1a0]
movsxd rax, r8d
sub rcx, rbx
mov byte [rsp + rax + 0x20], 0
movzx eax, byte [rbx]
inc rbx
mov byte [rcx + rbx - 1], al
test al, al
jne 0x2000048a1
test rsi, rsi
je 0x20000490f
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasb al, byte [rdi]
not rcx
cmp rcx, 1
je 0x20000490f
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x1a0]
repne scasb al, byte [rdi]
movzx eax, word [0x200018004]
or rcx, 0xffffffffffffffff
mov word [rdi - 1], ax
xor eax, eax
lea rdi, [rsp + 0x1a0]
repne scasb al, byte [rdi]
xor ecx, ecx
nop word [rax + rax]
movzx eax, byte [rsi + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x200004900
lea r9, [rsp + 0x1a0]
lea rdx, [rsp + 0x20]
mov r8, rbp
mov rcx, 0xffffffff80000001
call fcn.200004460
lea r11, [rsp + 0x3b0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x200004950
Capabilities:
Check if file exists
Get file attributes
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x820
mov rbx, rcx
lea rcx, [rsp + 0xa0]
sub rcx, rdx
movzx eax, byte [rdx]
inc rdx
mov byte [rcx + rdx - 1], al
test al, al
jne 0x200004970
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0xa0]
repne scasb al, byte [rdi]
movzx eax, word [0x200018008]
lea rcx, [rsp + 0xa0]
mov word [rdi - 1], ax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
lea rsi, [0x20001b560]
cmp eax, 0xffffffff
je 0x2000049ed
lea rdx, [0x20001800c]
lea rcx, [rsp + 0xa0]
call fcn.200008388
mov rdi, rax
test rax, rax
je 0x2000049ed
mov r9, rax
mov edx, 1
mov r8d, 0x670
mov rcx, rsi
call fcn.2000086b0
mov rcx, rdi
call fcn.200008c78
xor edx, edx
lea rcx, [rsp + 0x21]
lea r8d, [rdx + 0x7f]
call fcn.20000d940
mov rax, qword [str.Error_Code]
lea rdx, [rsp + 0x20]
mov qword [rdx], rax
movzx eax, word [0x200017c80]
xor r9d, r9d
mov word [rdx + 8], ax
movzx eax, byte [0x200017c82]
mov rdi, r9
mov byte [rdx + 0xa], al
nop word [rax + rax]
movzx r8d, byte [rdi + rsi]
test r8b, r8b
je 0x200004a68
mov eax, 0xcccccccd
mul r9d
mov eax, r9d
shr edx, 3
lea ecx, [rdx + rdx*4]
add ecx, ecx
sub eax, ecx
movsx edx, byte [rsp + rax + 0x20]
movzx eax, r8b
cmp eax, edx
je 0x200004a68
xor dl, r8b
mov byte [rsp + rdi + 0x1b0], dl
jmp 0x200004a70
mov byte [rsp + rdi + 0x1b0], r8b
inc r9d
inc rdi
cmp r9d, 0x670
jb 0x200004a30
lea rdx, [rsp + 0x1b0]
mov rcx, rbx
call section..text
lea rcx, [rbx + 0x20]
lea rdx, [rsp + 0x1d0]
call section..text
lea rcx, [rbx + 0x40]
lea rdx, [rsp + 0x1f0]
call section..text
movzx eax, word [rsp + 0x212]
movzx edx, word [rsp + 0x210]
mov word [rbx + 0x62], ax
movzx eax, word [rsp + 0x214]
mov word [rbx + 0x60], dx
lea rcx, [rbx + 0x66]
lea rdx, [rsp + 0x216]
mov word [rbx + 0x64], ax
call section..text
lea rcx, [rbx + 0x86]
lea rdx, [rsp + 0x236]
call section..text
lea rcx, [rbx + 0xa6]
lea rdx, [rsp + 0x256]
call section..text
movzx edx, byte [rsp + 0x276]
lea rcx, [rbx + 0xc8]
mov byte [rbx + 0xc6], dl
lea rdx, [rsp + 0x278]
mov r8d, 0x5a8
call fcn.20000e2d0
lea r11, [rsp + 0x820]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x200004b50
Capabilities:
Check for sandbox and av modules

Disassembly:
sub rsp, 0xe8
lea rcx, str.sbieDll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x200004b76
mov eax, 1
add rsp, 0xe8
ret
lea rcx, str.kernel32.dll
mov qword [rsp + 0xe0], rbx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.CheckRemoteDebuggerPresent
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x200004bc4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0xf0]
mov rcx, rax
call rbx
cmp dword [rsp + 0xf0], 0
jne 0x200004d53
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x200004d53
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.RtlGetCurrentPeb
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
cmp byte [rax + 2], 0
jne 0x200004d53
test byte [rax + 0xbc], 0x70
jne 0x200004d53
xor eax, eax
lea rdx, [0x200018020]
lea rcx, [rsp + 0x60]
mov byte [rsp + 0x60], 0
mov qword [rsp + 0x61], rax
mov qword [rsp + 0x69], rax
mov qword [rsp + 0x71], rax
mov qword [rsp + 0x79], rax
mov qword [rsp + 0x81], rax
mov qword [rsp + 0x89], rax
mov qword [rsp + 0x91], rax
mov dword [rsp + 0x99], eax
mov word [rsp + 0x9d], ax
mov byte [rsp + 0x9f], al
call section..text
xor eax, eax
lea rdx, [0x200018030]
lea rcx, [rsp + 0x20]
mov byte [rsp + 0x20], 0
mov qword [rsp + 0x21], rax
mov qword [rsp + 0x29], rax
mov qword [rsp + 0x31], rax
mov qword [rsp + 0x39], rax
mov qword [rsp + 0x41], rax
mov qword [rsp + 0x49], rax
mov qword [rsp + 0x51], rax
mov dword [rsp + 0x59], eax
mov word [rsp + 0x5d], ax
mov byte [rsp + 0x5f], al
call section..text
xor eax, eax
lea rdx, [0x200018040]
lea rcx, [rsp + 0xa0]
mov byte [rsp + 0xa0], 0
mov qword [rsp + 0xa1], rax
mov qword [rsp + 0xa9], rax
mov qword [rsp + 0xb1], rax
mov qword [rsp + 0xb9], rax
mov qword [rsp + 0xc1], rax
mov qword [rsp + 0xc9], rax
mov qword [rsp + 0xd1], rax
mov dword [rsp + 0xd9], eax
mov word [rsp + 0xdd], ax
mov byte [rsp + 0xdf], al
call section..text
lea rcx, [rsp + 0x60]
call fcn.200002ad0
test eax, eax
jne 0x200004d53
lea rcx, [rsp + 0x20]
call fcn.200002ad0
test eax, eax
jne 0x200004d53
lea rcx, [rsp + 0xa0]
call fcn.200002ad0
test eax, eax
jne 0x200004d53
mov rbx, qword [rsp + 0xe0]
add rsp, 0xe8
ret
mov eax, 1
mov rbx, qword [rsp + 0xe0]
add rsp, 0xe8
ret
Function at 0x200005a30
Capabilities:
Query environment variable
Set environment variable

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x4c0
xor eax, eax
mov byte [rsp + 0x70], 0
xor ebx, ebx
mov qword [rsp + 0x71], rax
mov qword [rsp + 0x79], rax
mov qword [r11 - 0x447], rax
mov qword [r11 - 0x43f], rax
mov qword [r11 - 0x437], rax
mov qword [r11 - 0x42f], rax
mov qword [r11 - 0x427], rax
mov qword [r11 - 0x41f], rax
mov qword [r11 - 0x417], rax
mov dword [rsp + 0xb9], eax
mov word [rsp + 0xbd], ax
mov byte [rsp + 0xbf], al
mov byte [rsp + 0x20], al
mov qword [rsp + 0x21], rax
mov qword [rsp + 0x29], rax
mov qword [rsp + 0x31], rax
mov qword [rsp + 0x39], rax
mov qword [rsp + 0x41], rax
mov qword [rsp + 0x49], rax
mov qword [rsp + 0x51], rax
mov qword [rsp + 0x59], rax
mov qword [rsp + 0x61], rax
mov dword [rsp + 0x69], eax
mov word [rsp + 0x6d], ax
mov byte [rsp + 0x6f], al
mov rdi, rbx
lea esi, [rax + 0x4f]
call fcn.2000086e8
mov r11d, eax
mov eax, 0x51eb851f
imul r11d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x19
sub r11d, edx
add r11b, 0x41
mov byte [rsp + rdi + 0x70], r11b
call fcn.2000086e8
inc rdi
mov r11d, eax
mov eax, 0x51eb851f
imul r11d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x19
sub r11d, edx
add r11b, 0x41
sub rsi, 1
mov byte [rsp + rdi + 0x1f], r11b
jne 0x200005ae1
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x70]
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
lea r11, [rsp + 0x4c0]
mov rsi, qword [r11 + 0x18]
test eax, eax
setne bl
mov eax, ebx
mov rbx, qword [r11 + 0x10]
mov rsp, r11
pop rdi
ret
Function at 0x200005ba0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x370
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.20000d940
lea rcx, [rsp + 0x261]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x260], 0
call fcn.20000d940
lea rdx, [rsp + 0x20]
mov r8d, 0x104
xor ecx, ecx
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x20]
repne scasb al, byte [rdi]
not rcx
cmp rcx, 1
je 0x200005cb7
lea edx, [rbx + 0x5c]
lea rcx, [rsp + 0x20]
call fcn.200008954
lea rdx, [rsp + 0x260]
lea rcx, [rax + 1]
sub rdx, rcx
nop dword [rax]
movzx eax, byte [rcx]
inc rcx
mov byte [rdx + rcx - 1], al
test al, al
jne 0x200005c30
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x200005cb4
lea rdx, [rsp + 0x130]
mov rcx, rax
mov dword [rsp + 0x130], 0x130
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x200005cab
lea rdx, [rsp + 0x260]
lea rcx, [rsp + 0x15c]
call fcn.200007cc4
test eax, eax
jne 0x200005c8c
inc bx
lea rdx, [rsp + 0x130]
mov rcx, rdi
mov dword [rsp + 0x130], 0x130
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x200005c70
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ax, bx
mov rbx, qword [rsp + 0x380]
add rsp, 0x370
pop rdi
ret

Function at 0x200005cd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x1b0
mov rbx, qword [0x20001e218]
mov rdi, rcx
test rbx, rbx
jne 0x200005dcb
lea r8d, [rbx + 0x7f]
lea rcx, [rsp + 0x21]
xor edx, edx
call fcn.20000d940
lea rbx, [0x200000000]
lea r11, [rsp + 0x20]
mov rax, qword [rbx + 0x17c68]
xor r9d, r9d
mov qword [r11], rax
movzx eax, word [rbx + 0x17c70]
mov r8, r9
mov word [r11 + 8], ax
movzx eax, byte [rbx + 0x17c72]
mov byte [r11 + 0xa], al
nop word [rax + rax]
movzx r10d, byte [r8 + rbx + 0x17738]
mov eax, 0x66666667
imul r9d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, r9d
lea ecx, [rdx + rdx*4]
add ecx, ecx
sub eax, ecx
cdqe
movzx ecx, byte [rsp + rax + 0x20]
cmp r10b, cl
je 0x200005d7e
xor cl, r10b
mov byte [rsp + r8 + 0xa0], cl
jmp 0x200005d86
mov byte [rsp + r8 + 0xa0], r10b
inc r8
inc r9d
cmp r8, 0xb
jl 0x200005d40
movsxd rax, r9d
lea rcx, [rsp + 0xa0]
mov byte [rsp + rax + 0xa0], 0
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
mov qword [0x20001e218], rax
test rax, rax
jne 0x200005dcb
mov rbx, qword [rsp + 0x1c0]
add rsp, 0x1b0
pop rdi
ret
lea rcx, [rsp + 0xa0]
mov rdx, rdi
call section..text
lea rdx, [rsp + 0xa0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, qword [rsp + 0x1c0]
add rsp, 0x1b0
pop rdi
ret
Function at 0x200005e00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x1b0
mov rbx, qword [0x20001e220]
mov rdi, rcx
test rbx, rbx
jne 0x200005efb
lea r8d, [rbx + 0x7f]
lea rcx, [rsp + 0x21]
xor edx, edx
call fcn.20000d940
lea rbx, [0x200000000]
lea r11, [rsp + 0x20]
mov rax, qword [rbx + 0x17c68]
xor r9d, r9d
mov qword [r11], rax
movzx eax, word [rbx + 0x17c70]
mov r8, r9
mov word [r11 + 8], ax
movzx eax, byte [rbx + 0x17c72]
mov byte [r11 + 0xa], al
nop word [rax + rax]
movzx r10d, byte [r8 + rbx + 0x17748]
mov eax, 0x66666667
imul r9d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, r9d
lea ecx, [rdx + rdx*4]
add ecx, ecx
sub eax, ecx
cdqe
movzx ecx, byte [rsp + rax + 0x20]
cmp r10b, cl
je 0x200005eae
xor cl, r10b
mov byte [rsp + r8 + 0xa0], cl
jmp 0x200005eb6
mov byte [rsp + r8 + 0xa0], r10b
inc r8
inc r9d
cmp r8, 0xa
jl 0x200005e70
movsxd rax, r9d
lea rcx, [rsp + 0xa0]
mov byte [rsp + rax + 0xa0], 0
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
mov qword [0x20001e220], rax
test rax, rax
jne 0x200005efb
mov rbx, qword [rsp + 0x1c0]
add rsp, 0x1b0
pop rdi
ret
lea rcx, [rsp + 0xa0]
mov rdx, rdi
call section..text
lea rdx, [rsp + 0xa0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, qword [rsp + 0x1c0]
add rsp, 0x1b0
pop rdi
ret