joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180002c90
Capabilities:
Create process on windows
Extract resource via kernel32 functions
Get common file path
Write and execute a file
Write file on windows

Disassembly:
push r12
sub rsp, 0x600
mov rax, qword [0x1800964f0]
xor rax, rsp
mov qword [rsp + 0x5f0], rax
lea rcx, [rsp + 0xe1]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0xe0], 0
call fcn.180055310
lea rcx, [rsp + 0x1f1]
xor edx, edx
mov r8d, 0x3ff
mov byte [rsp + 0x1f0], 0
call fcn.180055310
lea rcx, [rsp + 0xe0]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
xor r12d, r12d
test eax, eax
je 0x180002e3c
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x628], rdi
xor eax, eax
lea rdi, [rsp + 0xe0]
repne scasb al, byte [rdi]
not rcx
cmp rcx, 1
je 0x180002e34
mov rcx, qword [0x1800a2978]
lea r8, [0x180082bdc]
lea edx, [rax + 0x66]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdi, rax
test rax, rax
je 0x180002e34
mov rcx, qword [0x1800a2978]
mov qword [rsp + 0x610], rbx
mov rdx, rax
mov qword [rsp + 0x618], rbp
mov qword [rsp + 0x620], rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, qword [0x1800a2978]
mov rdx, rdi
mov esi, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbp, rax
mov rax, r12
nop word [rax + rax]
movzx edx, byte [rsp + rax + 0xe0]
inc rax
mov byte [rsp + rax + 0x1ef], dl
test dl, dl
jne 0x180002da0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x1f0]
repne scasb al, byte [rdi]
mov rax, qword [str._run.bat]
lea rdx, [0x180080678]
mov qword [rdi - 1], rax
movzx eax, byte [0x180080210]
lea rcx, [rsp + 0x1f0]
mov byte [rdi + 7], al
call fcn.180050a28
mov rdi, rax
test rax, rax
je 0x180002e13
mov rdx, rsi
mov r9, rax
mov r8d, 1
mov rcx, rbp
call fcn.180050ccc
mov rcx, rdi
call fcn.1800511e8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rsi, qword [rsp + 0x620]
mov rbp, qword [rsp + 0x618]
mov rbx, qword [rsp + 0x610]
mov rdi, qword [rsp + 0x628]
xor edx, edx
lea rcx, [rsp + 0x70]
lea r8d, [rdx + 0x68]
call fcn.180055310
xor eax, eax
lea rdx, [rsp + 0x1f0]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
xor ecx, ecx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x70], WSAGetLastError
mov dword [rsp + 0xac], 1
mov dword [rsp + 0x20], r12d
mov word [rsp + 0xb0], r12w
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rcx, qword [rsp + 0x5f0]
xor rcx, rsp
call fcn.180050540
add rsp, 0x600
pop r12
ret
Function at 0x180002ee0
Capabilities:
Delete internet cache
Enumerate internet cache

Disassembly:
push rsi
push rdi
sub rsp, 0x28
lea r8, [rsp + 0x40]
xor esi, esi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x50], rbp
mov dword [rsp + 0x40], esi
call qword [sym.imp.WININET.dll_FindFirstUrlCacheEntryA]
mov ecx, dword [rsp + 0x40]
call fcn.18004f9f8
lea r8, [rsp + 0x40]
xor ecx, ecx
mov rdx, rax
mov rdi, rax
call qword [sym.imp.WININET.dll_FindFirstUrlCacheEntryA]
mov rbp, rax
test rax, rax
je 0x180002fd6
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x20], r12
lea r12, str.sogou
nop word [rax + rax]
cmp dword [0x1800a2ea4], esi
je 0x180002f7e
mov ebx, esi
nop word [rax + rax]
mov rcx, qword [rdi + 8]
movsxd rdx, ebx
shl rdx, 5
add rdx, r12
call qword [sym.imp.SHLWAPI.dll_StrStrIA]
test rax, rax
jne 0x180002f72
inc ebx
cmp ebx, 8
jl 0x180002f50
jmp 0x180002f88
mov rcx, qword [rdi + 8]
call qword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
jmp 0x180002f88
mov rcx, qword [rdi + 8]
call qword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
lea r8, [rsp + 0x40]
xor edx, edx
mov rcx, rbp
mov dword [rsp + 0x40], esi
call qword [sym.imp.WININET.dll_FindNextUrlCacheEntryA]
mov rcx, rdi
call fcn.1800515dc
mov ecx, dword [rsp + 0x40]
call fcn.18004f9f8
lea r8, [rsp + 0x40]
mov rcx, rbp
mov rdx, rax
mov rdi, rax
call qword [sym.imp.WININET.dll_FindNextUrlCacheEntryA]
test eax, eax
jne 0x180002f40
mov r12, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x48]
lea esi, [rax + 1]
mov rbp, qword [rsp + 0x50]
test rdi, rdi
je 0x180002fe8
mov rcx, rdi
call fcn.1800515dc
mov eax, esi
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x180003000
Capabilities:
Check if file exists
Delete file

Disassembly:
push rdi
sub rsp, 0x3c0
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x3d8], rbx
mov rax, qword [0x1800964f0]
xor rax, rsp
mov qword [rsp + 0x3b0], rax
mov rbx, rcx
mov byte [rsp + 0x80], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0x81]
call fcn.180055310
mov edx, 0x5c
mov rcx, rbx
call fcn.180051920
sub rax, rbx
mov r8, rax
mov rdx, rbx
lea rcx, [rsp + 0x80]
call fcn.180054180
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x80]
repne scasb al, byte [rdi]
not rcx
cmp rcx, 1
je 0x1800031c4
mov qword [rsp + 0x40], select
mov qword [rsp + 0x38], rax
mov byte [rsp + 0x28], al
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.1800026a0
nop
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x50]
call fcn.18000a380
nop
cmp qword [rsp + 0x40], 0x10
jb 0x1800030de
mov rcx, qword [rsp + 0x28]
call fcn.180050528
mov byte [rsp + 0x190], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0x191]
call fcn.180055310
lea r9, [rsp + 0x58]
cmp qword [rsp + 0x70], 0x10
cmovae r9, qword [rsp + 0x58]
lea r8, [rsp + 0x80]
lea rdx, str._s_s_navhome.htm
lea rcx, [rsp + 0x190]
call fcn.18005151c
lea rcx, [rsp + 0x190]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x180003148
lea rcx, [rsp + 0x190]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov byte [rsp + 0x2a0], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0x2a1]
call fcn.180055310
lea r9, [rsp + 0x58]
cmp qword [rsp + 0x70], 0x10
cmovae r9, qword [rsp + 0x58]
lea r8, [rsp + 0x80]
lea rdx, str._s_s_shdov.dat
lea rcx, [rsp + 0x2a0]
call fcn.18005151c
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x1800031b2
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp qword [rsp + 0x70], 0x10
jb 0x1800031c4
mov rcx, qword [rsp + 0x58]
call fcn.180050528
mov rcx, qword [rsp + 0x3b0]
xor rcx, rsp
call fcn.180050540
mov rbx, qword [rsp + 0x3d8]
add rsp, 0x3c0
pop rdi
ret
Function at 0x1800036f0
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x1800964f0]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
cmp rcx, 1
je 0x180003810
lea rcx, [rsp + 0x131]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x130], al
call fcn.180055310
mov edx, 0x5c
mov rcx, rbx
call fcn.180051920
lea rcx, [rsp + 0x130]
mov rdx, rbx
sub rax, rbx
mov r8, rax
call fcn.180054180
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x130]
repne scasb al, byte [rdi]
not rcx
cmp rcx, 1
je 0x180003810
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], al
call fcn.180055310
xor edx, edx
nop
movzx eax, byte [rsp + rdx + 0x130]
inc rdx
mov byte [rsp + rdx + 0x1f], al
test al, al
jne 0x1800037a0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x20]
repne scasb al, byte [rdi]
mov rax, qword [str...User_DataDefaultPreferences]
lea rcx, [rsp + 0x20]
mov qword [rdi - 1], rax
mov rax, qword [0x180080368]
mov qword [rdi + 7], rax
mov rax, qword [0x180080370]
mov qword [rdi + 0xf], rax
mov rax, qword [0x180080378]
mov qword [rdi + 0x17], rax
movzx eax, word [reloc.WS2_32.dll_WSAStartup]
mov word [rdi + 0x1f], ax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x180003810
lea rcx, [rsp + 0x20]
call fcn.1800032b0
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.180050540
mov rbx, qword [rsp + 0x268]
add rsp, 0x250
pop rdi
ret

Function at 0x180003840
Capabilities:
Check if file exists
Get common file path

Disassembly:
sub rsp, 0x268
mov rax, qword [0x1800964f0]
xor rax, rsp
mov qword [rsp + 0x250], rax
cmp byte [0x1800a7128], 0
jne 0x180003967
lea rcx, [rsp + 0x141]
xor edx, edx
mov r8d, 0x103
mov qword [rsp + 0x260], rdi
mov byte [rsp + 0x140], 0
call fcn.180055310
lea rdx, [rsp + 0x140]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rdx
lea edx, [r9 + 0x1c]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x30], 0
call fcn.180055310
xor edx, edx
nop word [rax + rax]
movzx eax, byte [rsp + rdx + 0x140]
inc rdx
mov byte [rsp + rdx + 0x2f], al
test al, al
jne 0x1800038d0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x30]
repne scasb al, byte [rdi]
mov rax, qword [str.User_DataDefaultPreferences]
lea rcx, [rsp + 0x30]
mov qword [rdi - 1], rax
mov rax, qword [0x180080390]
mov qword [rdi + 7], rax
mov rax, qword [0x180080398]
mov qword [rdi + 0xf], rax
mov eax, dword [0x1800803a0]
mov dword [rdi + 0x17], eax
movzx eax, word [0x1800803a4]
mov word [rdi + 0x1b], ax
movzx eax, byte [0x1800803a6]
mov byte [rdi + 0x1d], al
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
mov rdi, qword [rsp + 0x260]
test eax, eax
je 0x180003967
lea rcx, [rsp + 0x30]
call fcn.1800032b0
movzx ecx, byte [0x1800a7128]
mov edx, 1
test eax, eax
cmovne ecx, edx
mov byte [0x1800a7128], cl
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.180050540
add rsp, 0x268
ret
Function at 0x180004800
Capabilities:
Parse pe header
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
lea rdx, [0x180082cd4]
call fcn.180050a28
mov rdi, rax
test rax, rax
je 0x1800048d5
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 2]
call fcn.180051050
mov rcx, rdi
call fcn.180050f34
movsxd rsi, eax
cmp esi, 0xffffffff
je 0x1800048d5
mov rcx, rdi
call fcn.180050820
lea r11d, [rsi + 1]
movsxd rbp, r11d
mov rcx, rbp
call fcn.18004f9f8
mov rbx, rax
test rax, rax
je 0x1800048d5
mov r8, rbp
xor edx, edx
mov rcx, rax
call fcn.180055310
mov rdx, rsi
mov r9, rdi
mov r8d, 1
mov rcx, rbx
call fcn.180051900
test eax, eax
jle 0x1800048cd
mov rcx, rdi
call fcn.1800511e8
mov r11d, 0x5a4d
cmp word [rbx], r11w
jne 0x1800048cd
mov eax, dword [rbx + 0x3c]
cmp dword [rax + rbx], 0x4550
jne 0x1800048cd
mov ecx, 0xe0
cmp cx, word [rax + rbx + 0x14]
mov rcx, rbx
jne 0x1800048d0
call fcn.1800515dc
mov eax, 1
jmp 0x1800048d7
mov rcx, rbx
call fcn.1800515dc
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180005990
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x160
mov rax, qword [0x1800964f0]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov edi, ecx
or esi, 0xffffffff
xor edx, edx
lea ecx, [rsi + 3]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
test rax, rax
je 0x180005a1c
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x130
call fcn.180055310
lea rdx, [rsp + 0x20]
mov rcx, rbx
mov dword [rsp + 0x20], 0x130
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x180005a13
cmp dword [rsp + 0x40], edi
je 0x180005a0f
lea rdx, [rsp + 0x20]
mov rcx, rbx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x1800059f6
jmp 0x180005a13
mov esi, dword [rsp + 0x28]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.180050540
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x1800072d0
Capabilities:
Enumerate processes

Disassembly:
push rbx
sub rsp, 0x160
mov rax, qword [0x1800964f0]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor edx, edx
mov dword [rsp + 0x20], 0x130
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
test rax, rax
je 0x18000734a
lea rdx, [rsp + 0x20]
mov rcx, rax
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x180007347
nop word [rax + rax]
lea rdx, [rsp + 0x4c]
lea rcx, [0x1800a3950]
call fcn.180051948
test rax, rax
jne 0x180007363
lea rdx, [rsp + 0x20]
mov rcx, rbx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x180007320
or eax, 0xffffffff
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.180050540
add rsp, 0x160
pop rbx
ret
mov eax, dword [rsp + 0x28]
jmp 0x18000734a

Function at 0x180007760
Capabilities:
Print debug messages

Disassembly:
test rcx, rcx
je 0x1800077d4
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
mov eax, 0x5038
call fcn.18006ba40
sub rsp, rax
mov rax, qword [0x1800964f0]
xor rax, rsp
mov qword [rsp + 0x5020], rax
mov r8, rcx
lea r9, [rsp + 0x5048]
lea rcx, [rsp + 0x20]
mov edx, 0x5000
call fcn.180051bd0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [rsp + 0x5020]
xor rcx, rsp
call fcn.180050540
add rsp, 0x5038
repz ret

Function at 0x180007765
Capabilities:
Print debug messages

Disassembly:
test rcx, rcx
je 0x1800077d4
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
mov eax, 0x5038
call fcn.18006ba40
sub rsp, rax
mov rax, qword [0x1800964f0]
xor rax, rsp
mov qword [rsp + 0x5020], rax
mov r8, rcx
lea r9, [rsp + 0x5048]
lea rcx, [rsp + 0x20]
mov edx, 0x5000
call fcn.180051bd0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [rsp + 0x5020]
xor rcx, rsp
call fcn.180050540
add rsp, 0x5038
repz ret

Function at 0x180007800
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp edx, 1
jne 0x18000782f
xor eax, eax
mov qword [0x1800a2978], rcx
lea r8, [0x1800077e0]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
add rsp, 0x38
ret
Function at 0x180007840
Capabilities:
Parse pe header
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x20
mov rbp, rdx
lea rdx, [0x180082cd4]
call fcn.180050a28
mov rdi, rax
test rax, rax
je 0x18000792b
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 2]
call fcn.180051050
mov rcx, rdi
call fcn.180050f34
movsxd rsi, eax
cmp esi, 0xffffffff
je 0x18000792b
mov rcx, rdi
call fcn.180050820
lea r11d, [rsi + 1]
movsxd r12, r11d
mov rcx, r12
call fcn.18004f9f8
mov rbx, rax
test rax, rax
je 0x18000792b
mov r8, r12
xor edx, edx
mov rcx, rax
call fcn.180055310
mov rdx, rsi
mov r9, rdi
mov r8d, 1
mov rcx, rbx
call fcn.180051900
test eax, eax
jle 0x180007923
mov rcx, rdi
call fcn.1800511e8
mov r11d, 0x5a4d
cmp word [rbx], r11w
jne 0x180007923
mov eax, dword [rbx + 0x3c]
add rax, rbx
cmp dword [rax], 0x4550
jne 0x180007923
mov ecx, 0xe0
cmp cx, word [rax + 0x14]
jne 0x180007923
mov ecx, dword [rax + 0x28]
mov dword [rbp], ecx
mov ecx, dword [rax + 0x1c]
mov dword [rbp + 4], ecx
mov rcx, rbx
call fcn.1800515dc
mov eax, 1
jmp 0x18000792d
mov rcx, rbx
call fcn.1800515dc
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
Function at 0x180008d30
Capabilities:
Enumerate process modules

Disassembly:
push rbp
push rsi
sub rsp, 0xa78
mov rax, qword [0x1800964f0]
xor rax, rsp
mov qword [rsp + 0xa60], rax
mov r8d, ecx
xor edx, edx
mov ecx, 0x410
xor esi, esi
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbp, rax
test rax, rax
je 0x180008f82
lea rcx, [rsp + 0x48]
xor edx, edx
mov r8d, 0x7f8
mov qword [rsp + 0x40], rsi
call fcn.180055310
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov r8d, 0x800
mov rcx, rbp
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x20], 1
call sub.PSAPI.DLL_EnumProcessModulesEx
test eax, eax
je 0x180008f77
lea rcx, [rsp + 0x841]
xor edx, edx
mov r8d, 0x103
mov qword [rsp + 0xaa0], rdi
mov byte [rsp + 0x840], sil
call fcn.180055310
mov eax, dword [rsp + 0x30]
mov edi, esi
test rax, 0xfffffffffffffff8
jbe 0x180008f6f
mov qword [rsp + 0xa98], rbx
mov qword [rsp + 0xaa8], r12
mov qword [rsp + 0xa70], r13
lea r13, [0x18009f424]
lea rbx, [rsp + 0x40]
lea r12, [0x18009f4f4]
nop
mov rdx, qword [rbx]
lea r8, [rsp + 0x840]
mov r9d, 0x104
mov rcx, rbp
call sub.PSAPI.DLL_GetModuleBaseNameA
test eax, eax
je 0x180008f36
lea rdx, str.wx.dll
lea rcx, [rsp + 0x840]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x180008eb2
lea rdx, str.pub.dll
lea rcx, [rsp + 0x840]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x180008eb2
lea rdx, str.icafe.dll
lea rcx, [rsp + 0x840]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x180008eb2
lea rdx, str.xy.dll
lea rcx, [rsp + 0x840]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x180008eb2
lea rdx, str.xs.dll
lea rcx, [rsp + 0x840]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x180008f36
lea rcx, [rsp + 0x951]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x950], sil
call fcn.180055310
mov rdx, qword [rbx]
lea r8, [rsp + 0x950]
mov r9d, 0x104
mov rcx, rbp
call sub.PSAPI.DLL_GetModuleFileNameExA
xor eax, eax
lea rcx, [rsp + 0x950]
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x3c], eax
call fcn.180004800
test eax, eax
je 0x180008f36
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x950]
call fcn.180007840
test eax, eax
je 0x180008f36
mov ecx, dword [rsp + 0x3c]
mov edx, dword [rsp + 0x38]
mov rax, r13
cmp edx, dword [rax - 4]
jne 0x180008f2d
cmp ecx, dword [rax]
je 0x180008f52
add rax, 8
cmp rax, r12
jl 0x180008f24
mov ecx, dword [rsp + 0x30]
inc edi
add rbx, 8
shr rcx, 3
movsxd rax, edi
cmp rax, rcx
jb 0x180008e10
jmp 0x180008f57
mov esi, 1
mov r12, qword [rsp + 0xaa8]
mov rbx, qword [rsp + 0xa98]
mov r13, qword [rsp + 0xa70]
mov rdi, qword [rsp + 0xaa0]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov rcx, qword [rsp + 0xa60]
xor rcx, rsp
call fcn.180050540
add rsp, 0xa78
pop rsi
pop rbp
ret
Function at 0x180008fa0
Capabilities:
Get process image filename

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x140
mov rax, qword [0x1800964f0]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov ebx, ecx
lea rcx, [rsp + 0x21]
xor edi, edi
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], dil
call fcn.180055310
mov r8d, ebx
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x18000901e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [rsp + 0x20]
mov r8d, 0x104
mov rcx, rbx
call sub.PSAPI.DLL_GetProcessImageFileNameA
test eax, eax
jne 0x180009015
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.dwm.exe
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_StrStrIA]
mov ecx, 1
test rax, rax
cmovne edi, ecx
mov eax, edi
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.180050540
mov rbx, qword [rsp + 0x158]
add rsp, 0x140
pop rdi
ret
Function at 0x180009060
Capabilities:
Enumerate threads

Disassembly:
push rbp
push rsi
push r12
sub rsp, 0x2a0
mov rax, qword [0x1800964f0]
xor rax, rsp
mov qword [rsp + 0x290], rax
xor eax, eax
mov r12, rcx
xor ebp, ebp
lea ecx, [rbp + 4]
xor edx, edx
mov dword [rsp + 0x38], 0x1c
mov dword [rsp + 0x3c], eax
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x4c], eax
mov dword [rsp + 0x50], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x1800090bf
xor eax, eax
jmp 0x180009297
lea rdx, [rsp + 0x38]
mov rcx, rax
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x18000928c
mov qword [rsp + 0x2c8], rbx
mov qword [rsp + 0x2d0], rdi
mov edi, dword [rsp + 0x40]
lea rcx, [0x1800809b0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x180009258
lea rdx, str.NtQueryInformationThread
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x180009258
xor edx, edx
mov r8d, edi
lea ecx, [rdx + 0x40]
call qword [sym.imp.KERNEL32.dll_OpenThread]
test rax, rax
je 0x180009258
lea rcx, [rsp + 0x30]
mov r9d, 8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x20], rcx
lea edx, [r9 + 1]
mov rcx, rax
mov qword [rsp + 0x58], rbp
mov dword [rsp + 0x30], ebp
call rbx
test eax, eax
jne 0x180009258
mov rbx, qword [rsp + 0x58]
test ebx, ebx
je 0x180009258
lea rcx, [rsp + 0x71]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x70], bpl
call fcn.180055310
xor eax, eax
lea rdx, str._08X
lea rcx, [rsp + 0x60]
mov r8d, ebx
mov byte [rsp + 0x60], bpl
mov qword [rsp + 0x61], rax
mov word [rsp + 0x69], ax
mov byte [rsp + 0x6b], al
call fcn.18005151c
lea rdx, [rsp + 0x64]
lea rcx, [rsp + 0x70]
mov r8d, 4
call fcn.180051c00
lea rdx, str.1270
lea rcx, [rsp + 0x70]
mov r8d, 4
call fcn.180069618
test eax, eax
je 0x1800091f8
lea rdx, str.12A0
lea rcx, [rsp + 0x70]
mov r8d, 4
call fcn.180069618
test eax, eax
jne 0x180009258
mov ecx, dword [rsp + 0x44]
call fcn.180008fa0
test eax, eax
jne 0x180009258
mov r8d, dword [rsp + 0x44]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x180009258
lea rcx, [rsp + 0x181]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x180], bpl
call fcn.180055310
lea r8, [rsp + 0x180]
mov edx, ebx
mov r9d, 0x104
mov rcx, rdi
call sub.PSAPI.DLL_GetMappedFileNameA
test eax, eax
je 0x18000926f
lea rdx, [rsp + 0x38]
mov rcx, rsi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x1800090e4
jmp 0x18000927c
mov eax, dword [rsp + 0x44]
mov ebp, 1
mov dword [r12], eax
mov rbx, qword [rsp + 0x2c8]
mov rdi, qword [rsp + 0x2d0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebp
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.180050540
add rsp, 0x2a0
pop r12
pop rsi
pop rbp
ret
Function at 0x1800092c0
Capabilities:
Enumerate processes

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x160
mov rax, qword [0x1800964f0]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor edi, edi
mov rbp, rdx
mov rsi, rcx
cmp dword [0x1800a4ed8], edi
je 0x180009305
call fcn.180009060
mov ecx, edi
mov edi, 1
test eax, eax
cmovne ecx, edi
mov eax, ecx
jmp 0x180009385
xor edx, edx
mov qword [rsp + 0x190], rbx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
test rax, rax
je 0x180009338
lea rdx, [rsp + 0x20]
mov rcx, rax
mov dword [rsp + 0x20], 0x130
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x180009340
xor eax, eax
jmp 0x18000937d
mov ecx, dword [rsp + 0x28]
call fcn.1800089d0
test eax, eax
jne 0x180009360
lea rdx, [rsp + 0x20]
mov rcx, rbx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x180009340
jmp 0x180009372
mov ecx, dword [rsp + 0x28]
mov edi, 1
mov dword [rsi], ecx
mov ecx, dword [rsp + 0x40]
mov dword [rbp], ecx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rbx, qword [rsp + 0x190]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.180050540
add rsp, 0x160
pop rdi
pop rsi
pop rbp
ret