joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180001318
Capabilities:
Check os version
Get token membership

Disassembly:
push rbp
push rbx
lea rbp, [rsp - 0x38]
sub rsp, 0x138
xor edx, edx
lea rcx, [rsp + 0x44]
mov r8d, 0x98
xor ebx, ebx
call fcn.180002b44
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x9c
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x18000135f
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
jmp 0x18000147e
cmp dword [rsp + 0x50], 2
jne 0x180001478
cmp dword [rsp + 0x44], 5
jbe 0x180001478
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov edx, 8
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x18000146e
mov rcx, qword [rsp + 0x30]
lea rax, [rbp + 0x50]
mov r9d, 4
mov dword [rbp + 0x50], ebx
lea r8, [rbp + 0x60]
mov qword [rsp + 0x20], rax
lea edx, [r9 + 0xe]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x1800013d7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180001358
cmp dword [rbp + 0x60], 3
jne 0x180001459
mov rcx, qword [rsp + 0x30]
lea rax, [rbp + 0x50]
mov r9d, 8
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea edx, [r9 + 0xb]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x1800013c4
xor edx, edx
mov dword [rbp + 0x68], 0x44
lea r9, [rbp + 0x68]
lea r8, [rbp - 0x20]
lea ecx, [rdx + 0x1a]
call qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
test eax, eax
je 0x180001446
mov rcx, qword [rsp + 0x38]
lea r8, [rbp + 0x58]
lea rdx, [rbp - 0x20]
mov dword [rbp + 0x58], ebx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x180001446
mov ebx, dword [rbp + 0x58]
jmp 0x18000144c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180001461
call qword [sym.imp.SHELL32.dll_IsUserAnAdmin]
mov ebx, eax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180001474
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, ebx
jmp 0x18000147e
call qword [sym.imp.SHELL32.dll_IsUserAnAdmin]
add rsp, 0x138
pop rbx
pop rbp
ret
Function at 0x180001488
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xd0
xor edx, edx
lea rcx, [rbp - 0x45]
mov r8d, 0x98
xor ebx, ebx
call fcn.180002b44
lea rcx, [rbp - 0x49]
mov dword [rbp - 0x49], 0x9c
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x1800014d4
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
jmp 0x1800015b8
cmp dword [rbp - 0x39], 2
jne 0x1800015b6
cmp dword [rbp - 0x45], 5
jbe 0x1800015b6
mov qword [rbp + 0x6f], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp + 0x6f]
mov edx, 8
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1800015b0
mov rcx, qword [rbp + 0x6f]
lea rax, [rbp + 0x67]
xor r9d, r9d
mov dword [rbp + 0x67], ebx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea edx, [r9 + 0x19]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x18000159e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x18000159e
mov edx, dword [rbp + 0x67]
lea ecx, [rax - 0x3a]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x18000159e
mov r9d, dword [rbp + 0x67]
lea rax, [rbp + 0x67]
mov rcx, qword [rbp + 0x6f]
mov r8, rdi
mov edx, 0x19
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x18000158d
mov rcx, qword [rdi]
call qword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
mov rcx, qword [rdi]
movzx edx, byte [rax]
dec edx
call qword [sym.imp.ADVAPI32.dll_GetSidSubAuthority]
mov ebx, dword [rax]
jmp 0x180001593
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1800015a4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rbp + 0x6f]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1800015b6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, ebx
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x180002444
Capabilities:
Accept command line arguments
Delete registry value
Persist via run registry key
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
lea rbp, [rsp - 0x68]
sub rsp, 0x168
xor edi, edi
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rsi, rax
test rax, rax
je 0x180002653
lea rax, [rbp + 0xb8]
mov r12, 0xffffffff80000001
mov rcx, r12
mov qword [rsp + 0x20], rax
mov r9d, 0xf013f
lea rdx, [0x180001050]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1800024bc
lea r8, [rbp + 0xb8]
mov rcx, r12
lea rdx, [0x180001050]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x180002653
mov edx, 0x1000
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x180002642
mov rcx, qword [rbp + 0xb8]
lea rax, [rbp + 0xa0]
and dword [rbp + 0xa8], edi
lea r9, [rbp + 0xb0]
mov qword [rsp + 0x38], rax
lea r8, [rsp + 0x50]
lea rax, [rbp + 0xa8]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rax
xor edx, edx
and qword [rsp + 0x20], rdi
xor r14d, r14d
mov dword [rbp + 0xb0], 0x104
mov dword [rbp + 0xa0], 0x1000
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x180002639
lea eax, [r14 + 1]
cmp dword [rbp + 0xa8], eax
jne 0x1800025d6
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x1800025d1
mov rcx, qword [rbp + 0xb8]
lea rdx, [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov r9d, 0xf013f
lea rdx, [0x180001080]
test eax, eax
mov rcx, r12
mov eax, 1
cmove edi, eax
lea rax, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1800025b6
lea r8, [rsp + 0x40]
mov rcx, r12
lea rdx, [0x180001080]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x1800025d1
mov rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov rcx, qword [rbp + 0xb8]
lea r9, [rbp + 0xb0]
add r14d, eax
mov dword [rbp + 0xb0], 0x104
lea rax, [rbp + 0xa0]
mov dword [rbp + 0xa0], 0x1000
mov qword [rsp + 0x38], rax
lea r8, [rsp + 0x50]
lea rax, [rbp + 0xa8]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rax
mov edx, r14d
and qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
mov eax, 1
je 0x18000253e
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rbp + 0xb8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x180002655
xor eax, eax
add rsp, 0x168
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x180002668
Capabilities:
Accept command line arguments
Check mutex on windows

Disassembly:
sub rsp, 0x28
lea r8, [0x180001128]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov qword [0x180003188], rax
test rax, rax
je 0x180002696
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1800026af
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
lea rcx, [0x1800029f4]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
add rsp, 0x28
ret

Function at 0x1800026d4
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
test r8d, r8d
jle 0x18000271f
mov r8d, edi
movsxd rdx, ebx
sub r8d, ebx
add rdx, rsi
xor r9d, r9d
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_recv]
mov ecx, eax
inc eax
cmp eax, 1
jbe 0x180002754
add ebx, ecx
cmp ebx, edi
jl 0x1800026f8
cmp dword [0x180003184], 0
je 0x18000273a
mov r8d, edi
lea rcx, [0x1800033b0]
mov rdx, rsi
call fcn.180002acc
mov eax, 1
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
xor eax, eax
jmp 0x18000273f

Function at 0x18000286c
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rbx, rdx
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rdx, rbx
mov rcx, rdi
mov r8d, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1800028a0

Function at 0x1800028a0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
mov edi, r8d
cmp dword [0x180003184], ebx
mov rsi, rdx
mov rbp, rcx
je 0x1800028d3
lea rcx, [0x1800032a0]
call fcn.180002acc
test edi, edi
jle 0x1800028fe
mov r8d, edi
movsxd rdx, ebx
sub r8d, ebx
add rdx, rsi
xor r9d, r9d
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_send]
mov ecx, eax
inc eax
cmp eax, 1
jbe 0x180002918
add ebx, ecx
cmp ebx, edi
jl 0x1800028d7
mov eax, 1
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
xor eax, eax
jmp 0x180002903
Function at 0x180002a2c
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, r8
mov rbx, rcx
cmp edx, 1
jne 0x180002abb
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r8d, 0x104
lea rdx, [0x180003190]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, [0x1800011b8]
lea rcx, [0x180003190]
call qword [sym.imp.SHLWAPI.dll_StrStrA]
test rax, rax
jne 0x180002abb
xor ecx, ecx
test rdi, rdi
jne 0x180002aaa
and qword [rsp + 0x28], rdi
lea r8, [0x1800026b4]
and dword [rsp + 0x20], edi
mov r9, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x180002abb
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180002abb
mov r9d, 1
xor r8d, r8d
mov rdx, rbx
call sym.client_amd64.dll_EntryPoint
mov rbx, qword [rsp + 0x40]
mov eax, 1
add rsp, 0x30
pop rdi
ret

Function at 0x180002acc
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
test r8d, r8d
jle 0x180002b43
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov rdi, rdx
movsxd rbx, r8d
mov r11, rcx
mov r10b, byte [r11 + 0x100]
inc r10b
movzx r8d, r10b
movzx edx, byte [r8 + r11]
mov r9b, dl
add r9b, byte [r11 + 0x101]
movzx ecx, r9b
mov al, byte [rcx + r11]
mov byte [r8 + r11], al
mov byte [rcx + r11], dl
movzx ecx, byte [r8 + r11]
add rcx, rdx
movzx eax, cl
mov cl, byte [rax + r11]
xor byte [rdi], cl
inc rdi
mov byte [r11 + 0x100], r10b
mov byte [r11 + 0x101], r9b
sub rbx, 1
jne 0x180002ae4
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
Function at 0x1406d2058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1406d21df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1406d2089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406d206f
add dl, dl
jne 0x1406d2096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406d20f6
xor eax, eax
add dl, dl
jne 0x1406d20a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406d21ad
add dl, dl
jne 0x1406d20b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406d20c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406d20d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406d20dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1406d20ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1406d207e
mov eax, 1
add dl, dl
jne 0x1406d2106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406d2113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406d20fb
sub eax, ebx
mov ebx, 1
jne 0x1406d214c
mov ecx, 1
add dl, dl
jne 0x1406d212e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406d213b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406d2123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406d207e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1406d2168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406d2175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406d215d
cmp eax, 0x7d00
jae 0x1406d219b
cmp eax, 0x500
jb 0x1406d2196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406d207e
cmp eax, 0x7f
ja 0x1406d219e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406d207e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1406d21d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1406d207e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20

Function at 0x100403a20
Capabilities:
Encode data using xor

Disassembly:
xor al, 0x6c
xor al, 0x64
xor al, 0x67
xor al, 0x41
xor al, 0x3e
xor al, 0x7d
xor al, 0xa2
xor al, 0x9a
xor al, 0xa3
xor al, 0x88
xor al, 0x9d
xor al, 0xa4
xor al, 0x71
xor al, 0x74
xor al, 0x59
xor al, 0x87
xchg dword [rbp*4 - 0x57cb58cc], esi
xor al, 0x99
xor al, 0xa1
xor al, 0x86
xor al, 0xa3
xor al, 0xa3
movabs dword [0xa73490345934a834], eax
xor al, 0xad
xor al, 0xa7
xor al, 0xa8
xor al, 0x99
cdq
xor al, 0xa1
xor al, 0x67
xor al, 0x66
xor al, 0x90
xor al, 0xa7
xor al, 0x9c
xor al, 0x99
xor al, 0xa0
xor al, 0xa0
xor al, 0x67
xor al, 0x66
xor al, 0x62
Function at 0x100403a20
Capabilities:
Encode data using xor

Disassembly:
xor al, 0x6c
xor al, 0x64
xor al, 0x67
xor al, 0x41
xor al, 0x3e
xor al, 0x7d
xor al, 0xa2
xor al, 0x9a
xor al, 0xa3
xor al, 0x88
xor al, 0x9d
xor al, 0xa4
xor al, 0x71
xor al, 0x74
xor al, 0x59
xor al, 0x87
xchg dword [rbp*4 - 0x57cb58cc], esi
xor al, 0x99
xor al, 0xa1
xor al, 0x86
xor al, 0xa3
xor al, 0xa3
movabs dword [0xa73490345934a834], eax
xor al, 0xad
xor al, 0xa7
xor al, 0xa8
xor al, 0x99
cdq
xor al, 0xa1
xor al, 0x67
xor al, 0x66
xor al, 0x90
xor al, 0xa7
xor al, 0x9c
xor al, 0x99
xor al, 0xa0
xor al, 0xa0
xor al, 0x67
xor al, 0x66
xor al, 0x62

Function at 0x1408a6058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1408a61df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1408a6089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1408a606f
add dl, dl
jne 0x1408a6096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1408a60f6
xor eax, eax
add dl, dl
jne 0x1408a60a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1408a61ad
add dl, dl
jne 0x1408a60b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408a60c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408a60d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408a60dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1408a60ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1408a607e
mov eax, 1
add dl, dl
jne 0x1408a6106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408a6113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1408a60fb
sub eax, ebx
mov ebx, 1
jne 0x1408a614c
mov ecx, 1
add dl, dl
jne 0x1408a612e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1408a613b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1408a6123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1408a607e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1408a6168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1408a6175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1408a615d
cmp eax, 0x7d00
jae 0x1408a619b
cmp eax, 0x500
jb 0x1408a6196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1408a607e
cmp eax, 0x7f
ja 0x1408a619e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1408a607e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1408a61d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1408a607e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140040540
Capabilities:
Terminate process

Disassembly:
xchg edi, eax
mov cl, byte [rbp - 0x49]
mov byte [rbp + 0x2f], cl
pop rax
xchg esi, eax
not dh
pop rbx
jo 0x14002a5ec
invalid
test al, 0xa8
add ebp, ebx
invalid
cld
pop r11
jmp 0x14004054d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14004055d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140040545
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x140040575
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140040562
sub eax, 3
jb 0x14004058f
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x1400405c6
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x1400405b6
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x1400405b4
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x1400405a3
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.140040502
jmp 0x14004054d
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x2b200
mov dl, 0xd
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x140040616
cmp rsi, rcx
jae 0x14004061e
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x1400405fd
cmp al, 0x8f
ja 0x1400405fd
cmp byte [rsi - 2], 0xf
je 0x140040603
sub al, 0xe8
cmp al, 1
ja 0x1400405e7
cmp rsi, rcx
jae 0x14004061e
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x1400405ed
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14004061e
lodsb al, byte [rsi]
jmp 0x1400405fd
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x3e000]
mov eax, dword [rdi]
or eax, eax
je 0x14004067b
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x40000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14004062b
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140040675
mov qword [rbx], rax
add rbx, 8
jmp 0x14004064b
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x1400406b5
cmp al, 0xef
ja 0x1400406a7
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140040687
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x140040696
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x21f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.140040734], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.140040734
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140040724
sub rsp, 0xffffffffffffff80
jmp 0x14002a5d0
Function at 0x180001000
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x90
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov rbx, rcx
mov dword [rsp + 0x28], 1
xor edi, edi
lea r8, str.msedge.exe
xor ecx, ecx
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor edx, edx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], 1
call fcn.180001160
movzx eax, word [rbx]
test ax, ax
je 0x1800010ca
xorps xmm0, xmm0
mov qword [rsp + 0x38], 1
mov r8d, 0x28
mov qword [rsp + 0x58], rdi
lea rdx, [rsp + 0x38]
mov word [rsp + 0x40], di
mov ecx, 1
mov word [rsp + 0x42], ax
movdqu xmmword [rsp + 0x48], xmm0
mov dword [rsp + 0x44], 4
call qword [sym.imp.USER32.dll_SendInput]
mov r8d, 0x28
mov dword [rsp + 0x44], 6
lea rdx, [rsp + 0x38]
mov ecx, 1
call qword [sym.imp.USER32.dll_SendInput]
movzx eax, word [rbx + 2]
lea rbx, [rbx + 2]
test ax, ax
jne 0x180001060
xor eax, eax
lea rdx, [rsp + 0x60]
xorps xmm0, xmm0
mov qword [rsp + 0x80], rax
movups xmmword [rsp + 0x60], xmm0
mov eax, 0xd
mov dword [rsp + 0x60], 1
mov r8d, 0x28
mov word [rsp + 0x68], ax
mov ecx, 1
movups xmmword [rsp + 0x70], xmm0
call qword [sym.imp.USER32.dll_SendInput]
mov r8d, 0x28
mov dword [rsp + 0x6c], 2
lea rdx, [rsp + 0x60]
mov ecx, 1
call qword [sym.imp.USER32.dll_SendInput]
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.180001380
mov rbx, qword [rsp + 0xa8]
add rsp, 0x90
pop rdi
ret
Function at 0x18000103c
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x278
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0xffffffffffffffff
jne 0x180001065
xor eax, eax
jmp 0x1800010c7
mov dword [rsp + 0x30], 0x238
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x1800010ba
lea rdx, [rsp + 0x5c]
mov rcx, qword [rsp + 0x280]
call fcn.180001978
test eax, eax
jne 0x1800010a7
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x38]
jmp 0x1800010c7
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x180001080
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x278
ret

Function at 0x180001a10
Capabilities:
Terminate process

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov r8d, dword [rsp + 0x40]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x180001a3b
xor eax, eax
jmp 0x180001a5b
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [rsp + 0x20], eax
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x20]
add rsp, 0x38
ret