joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18001d2c0
Capabilities:
Contain obfuscated stackstrings
Get common file path

Disassembly:
push rbx
sub rsp, 0x230
mov ebx, ecx
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0x1ff
mov byte [rsp + 0x30], 0
call fcn.180008040
lea rcx, [rsp + 0x30]
mov edx, 0x200
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov edx, 0x200
mov dword [rsp + 0x20], 0x6e69645c
mov dword [rsp + 0x24], 0x38747570
mov dword [rsp + 0x28], 0x6c6c642e
mov byte [rsp + 0x2c], 0
call fcn.180003440
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x18001d33e
xor eax, eax
add rsp, 0x230
pop rbx
ret
test ebx, ebx
je 0x18001d333
add rax, rbx
add rsp, 0x230
pop rbx
ret

Function at 0x18001d360
Capabilities:
Contain obfuscated stackstrings
Get common file path

Disassembly:
push rbx
sub rsp, 0x230
mov ebx, ecx
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0x1ff
mov byte [rsp + 0x30], 0
call fcn.180008040
lea rcx, [rsp + 0x30]
mov edx, 0x200
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov edx, 0x200
mov dword [rsp + 0x20], 0x7264645c
mov dword [rsp + 0x24], 0x642e7761
mov word [rsp + 0x28], 0x6c6c
mov byte [rsp + 0x2a], 0
call fcn.180003440
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x18001d3dd
xor eax, eax
add rsp, 0x230
pop rbx
ret
test ebx, ebx
je 0x18001d3d2
add rax, rbx
add rsp, 0x230
pop rbx
ret

Function at 0x18001d400
Capabilities:
Contain obfuscated stackstrings
Get common file path

Disassembly:
push rbx
sub rsp, 0x230
mov ebx, ecx
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0x1ff
mov byte [rsp + 0x30], 0
call fcn.180008040
lea rcx, [rsp + 0x30]
mov edx, 0x200
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov edx, 0x200
mov dword [rsp + 0x20], 0x6433645c
mov dword [rsp + 0x24], 0x6c642e39
mov word [rsp + 0x28], 0x6c
call fcn.180003440
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x18001d478
xor eax, eax
add rsp, 0x230
pop rbx
ret
test ebx, ebx
je 0x18001d46d
add rax, rbx
add rsp, 0x230
pop rbx
ret
Function at 0x18001f3e0
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rdx, qword [0x18007c0b8]
mov rax, qword [0x18007c0b0]
xor ecx, ecx
sub rdx, rax
sar rdx, 2
test edx, edx
je 0x18001f601
cmp dword [rax], 0x6435437f
je 0x18001f425
inc ecx
add rax, 4
cmp ecx, edx
jb 0x18001f408
mov eax, 1
add rsp, 0x60
pop rbp
ret
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x6e65706f
mov dword [rbp - 0x1c], 0x32336c67
mov dword [rbp - 0x18], 0x6c6c642e
mov byte [rbp - 0x14], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18001f601
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x40], 0x65526c67
mov dword [rbp - 0x3c], 0x69506461
mov qword [rbp - 0x38], 0x736c6578
mov qword [rbp - 0x30], 0
mov dword [rbp - 0x28], 0
mov byte [rbp - 0x24], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x40], 0x536c6777
mov dword [rbp - 0x3c], 0x42706177
mov dword [rbp - 0x38], 0x65666675
mov qword [rbp - 0x34], 0x7372
mov qword [0x18007bad0], rax
mov qword [rbp - 0x2c], 0
mov byte [rbp - 0x24], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x40], 0x536c6777
mov dword [rbp - 0x3c], 0x4c706177
mov dword [rbp - 0x38], 0x72657961
mov dword [rbp - 0x34], 0x66667542
mov qword [0x18007bb20], rax
mov qword [rbp - 0x30], 0x737265
mov dword [rbp - 0x28], 0
mov byte [rbp - 0x24], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x40], 0x436c6777
mov dword [rbp - 0x3c], 0x74616572
mov dword [rbp - 0x38], 0x6e6f4365
mov qword [rbp - 0x34], 0x74786574
mov qword [0x18007bb40], rax
mov qword [rbp - 0x2c], 0
mov byte [rbp - 0x24], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x40], 0x446c6777
mov dword [rbp - 0x3c], 0x74656c65
mov dword [rbp - 0x38], 0x6e6f4365
mov qword [rbp - 0x34], 0x74786574
mov qword [0x18007bac8], rax
mov qword [rbp - 0x2c], 0
mov byte [rbp - 0x24], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x40], 0x4d6c6777
mov dword [rbp - 0x3c], 0x43656b61
mov dword [rbp - 0x38], 0x65727275
mov qword [rbp - 0x34], 0x746e
mov qword [0x18007bae8], rax
mov qword [rbp - 0x2c], 0
mov byte [rbp - 0x24], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18007bb38], rax
mov eax, 1
add rsp, 0x60
pop rbp
ret
Function at 0x18001f7e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rdx, qword [0x18007c0b8]
mov rax, qword [0x18007c0b0]
xor ecx, ecx
sub rdx, rax
sar rdx, 2
test edx, edx
je 0x18001f8ee
cmp dword [rax], 0x264d4161
je 0x18001f825
inc ecx
add rax, 4
cmp ecx, edx
jb 0x18001f808
mov eax, 1
add rsp, 0x60
pop rbp
ret
lea rcx, [rbp - 0x40]
mov dword [rbp - 0x40], 0x6562696c
mov dword [rbp - 0x3c], 0x642e6c67
mov word [rbp - 0x38], 0x6c6c
mov byte [rbp - 0x36], 0
mov dword [rbp - 0x20], 0x4762696c
mov dword [rbp - 0x1c], 0x7653454c
mov dword [rbp - 0x18], 0x6c642e32
mov word [rbp - 0x14], 0x6c
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18001f8ee
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18001f8ee
lea rcx, [rbp - 0x40]
mov dword [rbp - 0x10], 0x536c6765
mov dword [rbp - 0xc], 0x42706177
mov dword [rbp - 8], 0x65666675
mov word [rbp - 4], 0x7372
mov byte [rbp - 2], 0
mov dword [rbp - 0x30], 0x65526c67
mov dword [rbp - 0x2c], 0x69506461
mov dword [rbp - 0x28], 0x736c6578
mov byte [rbp - 0x24], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp - 0x20]
mov qword [0x18007bab0], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18007bb00], rax
mov eax, 1
add rsp, 0x60
pop rbp
ret
Function at 0x18001fac0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdx, qword [0x18007c0b8]
mov rax, qword [0x18007c0b0]
xor ebx, ebx
sub rdx, rax
mov rdi, rcx
mov r8d, ebx
sar rdx, 2
test edx, edx
je 0x18001fb04
mov rcx, rax
nop
cmp dword [rcx], 0x5f141e32
je 0x18001fb48
inc r8d
add rcx, 4
cmp r8d, edx
jb 0x18001faf0
mov dword [0x18007baf8], ebx
mov r8d, ebx
test edx, edx
je 0x18001fb28
mov rcx, rax
cmp dword [rcx], 0x4766a246
je 0x18001fb54
inc r8d
add rcx, 4
cmp r8d, edx
jb 0x18001fb14
mov r8d, ebx
test edx, edx
je 0x18001fba6
mov rcx, rax
cmp dword [rcx], 0x5f141e32
je 0x18001fb54
inc r8d
add rcx, 4
cmp r8d, edx
jb 0x18001fb32
jmp 0x18001fba6
mov dword [0x18007baf8], 1
jmp 0x18001fb0a
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x61726464
mov dword [rsp + 0x24], 0x6c642e77
mov word [rsp + 0x28], 0x6c
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18001fb9f
mov ecx, dword [rdi + 0x1000438]
call fcn.18001d360
mov qword [0x18007bae0], rax
mov ecx, dword [rdi + 0x100043c]
call fcn.18001d360
mov qword [0x18007bb28], rax
mov rax, qword [0x18007c0b0]
mov rcx, qword [0x18007c0b8]
sub rcx, rax
sar rcx, 2
test ecx, ecx
je 0x18001fc35
cmp dword [rax], 0x4766a2c9
je 0x18001fbda
inc ebx
add rax, 4
cmp ebx, ecx
jb 0x18001fbb8
mov eax, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x39643364
mov dword [rsp + 0x24], 0x6c6c642e
mov byte [rsp + 0x28], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18001fc35
mov ecx, dword [rdi + 0x100042c]
call fcn.18001d400
mov qword [0x18007bb08], rax
mov ecx, dword [rdi + 0x1000430]
call fcn.18001d400
mov qword [0x18007bac0], rax
mov ecx, dword [rdi + 0x1000434]
call fcn.18001d400
mov qword [0x18007bad8], rax
mov eax, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x180025980
Capabilities:
Create thread

Disassembly:
mov r11, rsp
sub rsp, 0x48
xor r8d, r8d
lea rax, [r11 + 8]
mov qword [r11 - 0x18], rcx
mov qword [r11 - 0x10], rax
mov qword [r11 + 8], r8
test edx, edx
je 0x1800259f8
lea rax, [r11 + 0x10]
mov dword [r11 + 0x10], r8d
lea r9, [r11 - 0x18]
mov qword [r11 - 0x20], rax
mov dword [r11 - 0x28], r8d
lea r8, [0x180025a20]
xor edx, edx
xor ecx, ecx
mov qword [r11 - 8], rbx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
cmp eax, 0xffffffff
je 0x1800259e9
test rax, rax
je 0x1800259e9
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
add rsp, 0x48
ret
call rcx
mov rcx, qword [rsp + 0x38]
mov qword [rcx], rax
mov rax, qword [rsp + 0x50]
add rsp, 0x48
ret
Function at 0x180026320
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
push rbp
push rbx
push rsi
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0x98
mov ebx, 0xc00000
mov rsi, rcx
mov r15, rdx
mov ecx, ebx
xor r14d, r14d
mov qword [rbp - 0x59], rbx
call fcn.180003210
mov r13, rax
test rax, rax
jne 0x180026376
add rsp, 0x98
pop r15
pop r14
pop r13
pop rsi
pop rbx
pop rbp
ret
cmp rsi, r15
ja 0x180026528
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x88], r12
nop
xor eax, eax
lea rdx, [rbp - 0x49]
mov ecx, esi
lea r8d, [rax + 0x30]
mov qword [rbp - 0x49], 0
mov qword [rbp - 0x41], rax
mov qword [rbp - 0x39], rax
mov qword [rbp - 0x31], rax
mov qword [rbp - 0x29], rax
mov qword [rbp - 0x21], rax
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
cmp rax, 0x30
jne 0x180026518
cmp dword [rbp - 0x29], 0x1000
mov rdi, qword [rbp - 0x31]
mov r12, qword [rbp - 0x49]
mov qword [rbp - 0x51], rdi
jne 0x180026507
test dword [rbp - 0x25], 0x101
jne 0x180026507
cmp rbx, rdi
jae 0x180026422
mov edx, edi
mov rcx, r13
mov rbx, r13
call fcn.180003cd4
mov r13, rax
test rax, rax
jne 0x18002641e
test rbx, rbx
je 0x180026415
mov rcx, rbx
call fcn.1800031d0
lea rsi, [rdi + r12]
jmp 0x18002650b
mov qword [rbp - 0x59], rdi
mov r8d, edi
mov rdx, r13
mov rcx, r12
call fcn.1800276b0
test eax, eax
je 0x180026507
mov eax, dword [rbp + 0x4f]
sub esi, r12d
mov r15d, edi
sub r15d, eax
add esi, r13d
add r15d, r13d
cmp esi, r15d
jae 0x180026503
nop word [rax + rax]
mov ecx, dword [rbp + 0x67]
mov r8, qword [rbp + 0x5f]
mov rdx, qword [rbp + 0x57]
mov dword [rsp + 0x20], ecx
mov r9d, eax
mov ecx, esi
mov ebx, esi
call qword [rbp + 0x8f]
cmp eax, 1
jne 0x1800264ed
mov eax, r13d
sub rbx, rax
add rbx, r12
cmp rbx, qword [rbp + 0x47]
ja 0x1800264ed
lea eax, [r14 + 0x12]
mov dword [rbp - 0x61], 0x3649257c
mov word [rbp - 0x5d], 0x5834
mov byte [rbp - 0x5b], 0
mov dword [rbp + 0x3f], 0x34364925
mov word [rbp + 0x43], 0x58
cmp eax, 0xf4240
jae 0x1800264ed
mov edi, r14d
mov r9, rbx
mov edx, 0x12
add rdi, qword [rbp + 0x6f]
lea r8, [rbp - 0x61]
mov rcx, rdi
test r14d, r14d
jne 0x1800264d8
lea r8, [rbp + 0x3f]
call fcn.180003964
or rax, 0xffffffffffffffff
inc rax
cmp byte [rdi + rax], 0
jne 0x1800264e1
add r14d, eax
add esi, dword [rbp + 0x87]
mov eax, dword [rbp + 0x4f]
cmp esi, r15d
jb 0x180026460
mov rdi, qword [rbp - 0x51]
mov r15, qword [rbp + 0x47]
lea rsi, [r12 + rdi]
mov rbx, qword [rbp - 0x59]
cmp rsi, r15
jbe 0x180026390
mov rdi, qword [rsp + 0x90]
mov r12, qword [rsp + 0x88]
test r13, r13
je 0x180026535
mov rcx, r13
call fcn.1800031d0
mov eax, 1
add rsp, 0x98
pop r15
pop r14
pop r13
pop rsi
pop rbx
pop rbp
ret
Function at 0x180026ae0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
cmp rcx, rdx
ja 0x180026b68
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rdi, r9
mov r9, rcx
mov ecx, dword [r8]
lea eax, [rcx + 0x12]
mov rbx, r8
mov dword [rsp + 0x38], 0x3649257c
mov word [rsp + 0x3c], 0x5834
mov byte [rsp + 0x3e], 0
mov dword [rsp + 0x30], 0x34364925
mov word [rsp + 0x34], 0x58
cmp eax, 0xf4240
jae 0x180026b5e
mov edx, 0x12
lea r8, [rsp + 0x38]
test ecx, ecx
jne 0x180026b3f
lea r8, [rsp + 0x30]
add rcx, rdi
call fcn.180003964
mov edx, dword [rbx]
or rax, 0xffffffffffffffff
lea rcx, [rdi + rdx]
inc rax
cmp byte [rcx + rax], 0
jne 0x180026b51
add eax, edx
mov dword [rbx], eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
repz ret

Function at 0x180027620
Capabilities:
Allocate or change rwx memory

Disassembly:
push r14
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rdi
mov r14, rdx
mov rdi, rcx
xor ebx, ebx
movsxd rsi, r8d
lea r9, [rsp + 0x58]
lea r8d, [rbx + 0x40]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x18002768c
mov r8, rsi
mov rdx, r14
mov rcx, rdi
call fcn.1800029a0
lea r9, [rsp + 0x58]
mov r8d, dword [rsp + 0x58]
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ebx, 1
mov dword [rsp + 0x20], ebx
mov eax, ebx
jmp 0x180027694
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
ret
Function at 0x180035160
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0xa0
xor edi, edi
cmp dword [0x18007c090], 0x40
mov rbp, r8
mov rsi, rdx
mov r14, rcx
mov ebx, edi
jae 0x180035320
mov rax, qword [0x18007c098]
test rax, rax
je 0x1800351a9
call rax
mov rbx, rax
test rax, rax
jne 0x18003528f
add rsi, r14
mov eax, 0x80000000
cmp rsi, rax
jae 0x1800351bd
mov esi, 1
jmp 0x1800351c4
sub rsi, 0x7fff0000
add rbp, r14
cmp rbp, 0xffffffff80000000
jae 0x1800351d9
add rbp, 0x7ff80000
jmp 0x1800351e0
mov rbp, 0xfffffffffff80000
xor edx, edx
lea rcx, [rsp + 0x6c]
mov dword [rsp + 0x68], edi
lea r8d, [rdx + 0x2c]
call fcn.180008040
lea rcx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp rsi, rbp
jae 0x180035320
nop dword [rax + rax]
lea rdx, [rsp + 0x38]
mov r8d, 0x30
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x180035286
cmp dword [rsp + 0x58], 0x10000
jne 0x180035277
mov rax, qword [rsp + 0x50]
cmp rax, 0xa8
jb 0x180035277
mov edx, dword [rsp + 0x90]
mov ecx, edx
cmp rax, rdx
jb 0x180035277
lea eax, [rdx - 1]
xor edx, edx
add rax, rsi
div rcx
imul rax, rcx
test rax, rax
je 0x1800352b3
cmp eax, 0x10000
jae 0x1800352b3
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, rdi
mov rsi, qword [rsp + 0x38]
add rsi, qword [rsp + 0x50]
cmp rsi, rbp
jb 0x180035210
test rbx, rbx
je 0x180035320
lea rcx, [0x18007c170]
mov rax, rcx
nop dword [rax]
cmp qword [rax], 0
je 0x180035300
inc edi
add rax, 8
cmp edi, 0x40
jb 0x1800352a0
jmp 0x180035320
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0xd8]
or rcx, 0xffffffffffffffff
mov dword [rsp + 0x28], 0x20
mov qword [rsp + 0xd8], rax
mov qword [rsp + 0x30], 0xa8
mov dword [rsp + 0x20], 0x3000
call fcn.180012250
test eax, eax
js 0x180035274
mov rbx, qword [rsp + 0xd8]
test rbx, rbx
jne 0x18003528f
jmp 0x180035277
inc dword [0x18007c090]
mov eax, edi
mov qword [rcx + rax*8], rbx
mov rax, qword [0x18007bf88]
test rax, rax
je 0x180035320
mov rdx, rbx
mov rcx, r14
call rax
lea r11, [rsp + 0xa0]
mov rax, rbx
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1800363d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xf8]
sub rsp, 0x1d0
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov r15d, r8d
mov r13d, edx
movsxd rsi, ecx
mov eax, 1
xchg dword [0x18007c094], eax
cmp eax, 1
jne 0x18003643b
nop word [rax + rax]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
xchg dword [0x18007c094], eax
cmp eax, 1
je 0x180036420
mov r14, rsi
lea r12, [0x180000000]
shl r14, 8
test r13d, r13d
je 0x18003647b
lea rax, [r12 + 0x7c370]
add rax, r14
or rdi, 0xffffffffffffffff
mov rcx, rdi
inc rcx
cmp byte [rax + rcx], 0
jne 0x180036460
test rcx, rcx
je 0x18003649b
xor ebx, ebx
xchg dword [0x18007c094], ebx
jmp 0x180036616
lea rax, [r12 + 0x7ce70]
add rax, r14
or rdi, 0xffffffffffffffff
mov rcx, rdi
nop dword [rax]
inc rcx
cmp byte [rax + rcx], 0
jne 0x180036490
jmp 0x180036469
xor edx, edx
mov r8d, 0xff
lea rcx, [rbp - 0x2f]
call fcn.180008040
mov dword [rbp - 0x30], 0x61636f4c
mov word [rbp - 0x2c], 0x5c6c
mov byte [rbp - 0x2a], 0
mov dword [rbp + 0x118], 0x4e565354
mov byte [rbp + 0x11c], 0
lea r8, [rbp + 0x118]
mov edx, pe_nt_image_headers64
lea rcx, [rbp - 0x30]
call fcn.180003440
xor ebx, ebx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x38], 0xf
mov qword [rsp + 0x30], rbx
mov byte [rsp + 0x20], bl
cmp byte [rbp - 0x30], bl
jne 0x18003650b
mov r8d, ebx
jmp 0x18003651b
lea rax, [rbp - 0x30]
mov r8, rdi
inc r8
cmp byte [rax + r8], bl
jne 0x180036512
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x20]
call fcn.180001380
nop
test r15d, r15d
jne 0x18003653f
mov word [rbp - 0x60], 0x6425
mov byte [rbp - 0x5e], r15b
lea rdx, [rbp - 0x60]
jmp 0x18003657b
cmp r15d, 1
jne 0x18003655b
mov dword [rsp + 0x60], 0x25256425
mov word [rsp + 0x64], 0x64
lea rdx, [rsp + 0x60]
jmp 0x18003657b
cmp r15d, 2
jne 0x180036587
mov dword [rsp + 0x40], 0x25256425
mov dword [rsp + 0x44], 0x64252564
mov byte [rsp + 0x48], 0
lea rdx, [rsp + 0x40]
mov r8d, esi
lea rcx, [rbp - 0x80]
call fcn.180002430
cmp byte [rbp - 0x80], 0
jne 0x180036592
mov rdi, rbx
jmp 0x18003659f
lea rax, [rbp - 0x80]
inc rdi
cmp byte [rax + rdi], 0
jne 0x180036596
mov r8, rdi
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x20]
call fcn.180002490
lea r8, [rsp + 0x20]
mov edx, pe_nt_image_headers64
test r13d, r13d
lea rdi, [r12 + 0x7c370]
jne 0x1800365cf
lea rdi, [r12 + 0x7ce70]
cmp qword [rsp + 0x38], 0x10
cmovae r8, qword [rsp + 0x20]
add rdi, r14
mov rcx, rdi
call fcn.180003354
mov ecx, ebx
xchg dword [0x18007c094], ecx
cmp qword [rsp + 0x38], 0x10
jb 0x180036600
mov rcx, qword [rsp + 0x20]
call fcn.180003020
mov qword [rsp + 0x38], 0xf
mov qword [rsp + 0x30], rbx
mov byte [rsp + 0x20], 0
mov rax, rdi
lea r11, [rsp + 0x1d0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x2fbf317d9
Capabilities:
Reference cloudflare dns server

Disassembly:
push rbp
sub rsp, 0x240
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x1d0], rcx
lea rax, [rbp + 0x170]
mov rdx, qword [rbp + 0x1d0]
mov rcx, rax
call fcn.2fbf315a0
lea rax, [rbp + 0x170]
mov rcx, rax
call fcn.2fbf64720
xor eax, 1
test al, al
je 0x2fbf31911
lea rax, str.File_Hash:
mov rdx, rax
mov rax, qword [0x2fbffce40]
mov rcx, rax
call fcn.2fbfeccf0
mov rcx, rax
lea rax, [rbp + 0x170]
mov rdx, rax
call fcn.2fbfecff0
mov rcx, rax
mov rax, qword [0x2fbffce50]
mov rdx, rax
call fcn.2fbfaf550
lea rax, [rbp - 0x60]
mov r8d, 1
lea rdx, str.foundhashes.txt
mov rcx, rax
call fcn.2fbfcb350
lea rdx, [rbp + 0x170]
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.2fbfecff0
mov rcx, rax
mov rax, qword [0x2fbffce50]
mov rdx, rax
call fcn.2fbfaf550
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.2fbfcb1e0
lea rax, [rbp + 0x1b7]
mov qword [rbp + 0x1b8], rax
nop
nop
lea rdx, [rbp + 0x1b7]
lea rax, [rbp + 0x190]
mov r8, rdx
lea rdx, str.1.1.1.1
mov rcx, rax
call fcn.2fbfdc500
lea rax, [rbp + 0x190]
mov rcx, rax
call fcn.2fbf3178c
lea rax, [rbp + 0x190]
mov rcx, rax
call fcn.2fbfdcd10
lea rax, [rbp + 0x1b7]
mov rcx, rax
call fcn.2fbfcdca0
nop
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.2fbfcbc70
lea rax, [rbp + 0x170]
mov rcx, rax
call fcn.2fbfdcd10
nop
add rsp, 0x240
pop rbp
ret

Function at 0x2fbf3cba0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fbf3cbc8
mov eax, 0
jmp 0x2fbf3cc16
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fbf3cbf1
mov eax, 0
jmp 0x2fbf3cc16
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fbf3cc11
mov eax, 0
jmp 0x2fbf3cc16
mov eax, 1
add rsp, 0x20
pop rbp
ret

Function at 0x2fbf3cc1c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fbf3cc9a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fbf3cc91
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fbf3cc91
mov rax, qword [rbp - 8]
jmp 0x2fbf3ccaf
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fbf3cc64
mov eax, 0
add rsp, 0x20
pop rbp
ret