joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c2950
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp dword [rcx + 0xd4], edx
je 0x4c2963
mov dword [rcx + 0xd4], edx
jmp fcn.004c2240
ret

Function at 0x4c2970
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov r9, qword [rcx + 0x28]
mov r8d, r8d
imul rax, r8, 0x170
add rax, qword [rcx + 0x1e8]
mov rcx, qword [rcx + 0x30]
mov dword [rax + 0xd0], edx
sub rcx, r9
sar rcx, 3
cmp r8, rcx
jb 0x47c480
ret
mov rcx, qword [r9 + r8*8]
jmp 0x4c2970
cmp dword [rcx + 0xd8], edx
je 0x4c2983
mov dword [rcx + 0xd8], edx
jmp fcn.004c2240
ret

Function at 0x4c2990
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov r9, qword [rcx + 0x28]
mov r8d, r8d
imul rax, r8, 0x170
add rax, qword [rcx + 0x1e8]
mov rcx, qword [rcx + 0x30]
mov dword [rax + 0xd4], edx
sub rcx, r9
sar rcx, 3
cmp r8, rcx
jb 0x47c4c0
ret
mov rcx, qword [r9 + r8*8]
jmp 0x4c2990
cmp dword [rcx + 0xdc], edx
je 0x4c29a3
mov dword [rcx + 0xdc], edx
jmp fcn.004c2240
ret

Function at 0x4c29b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov r9, qword [rcx + 0x28]
mov r8d, r8d
imul rax, r8, 0x170
add rax, qword [rcx + 0x1e8]
mov rcx, qword [rcx + 0x30]
mov dword [rax + 0xd8], edx
sub rcx, r9
sar rcx, 3
cmp r8, rcx
jb 0x47c500
ret
mov rcx, qword [r9 + r8*8]
jmp 0x4c29b0
cmp dword [rcx + 0xe0], edx
je 0x4c29c3
mov dword [rcx + 0xe0], edx
jmp fcn.004c2240
ret

Function at 0x4c29d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov r9, qword [rcx + 0x28]
mov r8d, r8d
imul rax, r8, 0x170
add rax, qword [rcx + 0x1e8]
mov rcx, qword [rcx + 0x30]
mov dword [rax + 0xdc], edx
sub rcx, r9
sar rcx, 3
cmp r8, rcx
jb 0x47c540
ret
mov rcx, qword [r9 + r8*8]
jmp 0x4c29d0
cmp dword [rcx + 0xe4], edx
je 0x4c29e3
mov dword [rcx + 0xe4], edx
jmp fcn.004c2240
ret

Function at 0x4c29f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov r9, qword [rcx + 0x28]
mov r8d, r8d
imul rax, r8, 0x170
add rax, qword [rcx + 0x1e8]
mov rcx, qword [rcx + 0x30]
mov dword [rax + 0xe0], edx
sub rcx, r9
sar rcx, 3
cmp r8, rcx
jb 0x47c580
ret
mov rcx, qword [r9 + r8*8]
jmp 0x4c29f0
cmp dword [rcx + 0xe8], edx
je 0x4c2a03
mov dword [rcx + 0xe8], edx
jmp fcn.004c2240
ret

Function at 0x4c2a10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rdx, qword [rcx + 0x28]
mov r8d, r8d
imul rax, r8, 0x170
add rax, qword [rcx + 0x1e8]
mov rcx, qword [rcx + 0x30]
movss dword [rax + 0xe4], xmm1
sub rcx, rdx
sar rcx, 3
cmp r8, rcx
jb 0x47c5c0
ret
mov rcx, qword [rdx + r8*8]
jmp 0x4c2a10
ucomiss xmm1, dword [rcx + 0xec]
jp 0x4c2a20
jne 0x4c2a20
ret
movss dword [rcx + 0xec], xmm1
jmp fcn.004c2240

Function at 0x4c2a30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rdx, qword [rcx + 0x28]
mov r8d, r8d
imul rax, r8, 0x170
add rax, qword [rcx + 0x1e8]
mov rcx, qword [rcx + 0x30]
movss dword [rax + 0xe8], xmm1
sub rcx, rdx
sar rcx, 3
cmp r8, rcx
jb 0x47c600
ret
mov rcx, qword [rdx + r8*8]
jmp 0x4c2a30
ucomiss xmm1, dword [rcx + 0xf0]
jp 0x4c2a40
jne 0x4c2a40
ret
movss dword [rcx + 0xf0], xmm1
jmp fcn.004c2240
Function at 0x4c2a50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rdx, qword [rcx + 0x28]
mov r8d, r8d
imul rax, r8, 0x170
add rax, qword [rcx + 0x1e8]
mov rcx, qword [rcx + 0x30]
movss dword [rax + 0xec], xmm1
sub rcx, rdx
sar rcx, 3
cmp r8, rcx
jb 0x47c640
ret
mov rcx, qword [rdx + r8*8]
jmp 0x4c2a50
ucomiss xmm1, dword [rcx + 0xf4]
jp 0x4c2a60
jne 0x4c2a60
ret
movss dword [rcx + 0xf4], xmm1
jmp fcn.004c2240

Function at 0x4c2a70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rdx, qword [rcx + 0x28]
mov r8d, r8d
imul rax, r8, 0x170
add rax, qword [rcx + 0x1e8]
mov rcx, qword [rcx + 0x30]
movss dword [rax + 0xf0], xmm1
sub rcx, rdx
sar rcx, 3
cmp r8, rcx
jb 0x47c680
ret
mov rcx, qword [rdx + r8*8]
jmp 0x4c2a70
ucomiss xmm1, dword [rcx + 0xf8]
jp 0x4c2a80
jne 0x4c2a80
ret
movss dword [rcx + 0xf8], xmm1
jmp fcn.004c2240

Function at 0x4c2a90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp dword [rcx + 0xfc], edx
je 0x4c2aa3
mov dword [rcx + 0xfc], edx
jmp fcn.004c2240
ret
Function at 0x592d50
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x0071ce20]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x592dbd
mov rcx, r8
call fcn.00592c30
test eax, eax
je 0x592dbd
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x592dbd
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x592db4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x592dbf
add rax, 0x28
cmp rax, r9
jne 0x592da0
xor eax, eax
add rsp, 0x28
ret
Function at 0x7813d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rsi
sub rsp, 0x170
mov rax, qword [0x007cd058]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov r9d, r8d
mov dword [rsp + 0x20], r8d
mov qword [rsp + 0x38], rdx
mov r8, rdx
mov rsi, rcx
test rcx, rcx
jne 0x78140a
xor eax, eax
jmp 0x7815c4
movsxd rax, dword [rcx + 0x3c]
mov qword [rsp + 0x190], rbx
mov qword [rsp + 0x168], rbp
mov ebx, dword [rax + rcx + 0x88]
mov r10d, dword [rax + rcx + 0x8c]
mov qword [rsp + 0x160], rdi
add rbx, rcx
xor edi, edi
mov qword [rsp + 0x30], r10
cmp edx, 0x10000
jae 0x781478
mov edx, dword [rbx + 0x10]
mov eax, dword [rbx + 0x14]
lea ecx, [rdx + rax]
cmp r8d, ecx
jae 0x781552
cmp r8d, edx
jb 0x781552
mov eax, dword [rbx + 0x1c]
sub r8d, edx
lea rcx, [rsi + rax]
mov edi, dword [rcx + r8*4]
add rdi, rsi
jmp 0x781523
mov eax, dword [rbx + 0x20]
mov ebp, edi
add rax, rcx
cmp dword [rbx + 0x18], edi
mov qword [rsp + 0x28], rax
jle 0x7815a9
nop
mov edx, dword [rax]
add rdx, rsi
test r9d, r9d
je 0x7814d0
mov rcx, rdx
call fcn.00787bb2
mov r8, qword [rsp + 0x38]
cmp r8d, eax
jne 0x7814e1
mov eax, dword [rbx + 0x24]
mov r10, qword [rsp + 0x30]
movsxd rdx, ebp
lea rcx, [rsi + rax]
mov eax, dword [rbx + 0x1c]
movzx r8d, word [rcx + rdx*2]
lea rcx, [rsi + rax]
mov edi, dword [rcx + r8*4]
add rdi, rsi
jmp 0x781523
mov rcx, r8
call fcn.00787f04
test eax, eax
je 0x781501
mov r8, qword [rsp + 0x38]
mov rax, qword [rsp + 0x28]
inc ebp
add rax, 4
cmp ebp, dword [rbx + 0x18]
mov qword [rsp + 0x28], rax
jge 0x7815a9
mov r9d, dword [rsp + 0x20]
jmp 0x781490
mov eax, dword [rbx + 0x24]
mov r10, qword [rsp + 0x30]
movsxd rdx, ebp
lea rcx, [rsi + rax]
mov eax, dword [rbx + 0x1c]
movzx r8d, word [rcx + rdx*2]
lea rcx, [rsi + rax]
mov edi, dword [rcx + r8*4]
add rdi, rsi
test rdi, rdi
je 0x7815a9
cmp rdi, rbx
jb 0x7815a9
lea rax, [r10 + rbx]
cmp rdi, rax
jae 0x7815a9
movzx eax, byte [rdi]
mov rbx, rdi
test al, al
je 0x781552
cmp al, 0x2e
je 0x781556
mov al, byte [rbx + 1]
inc rbx
test al, al
jne 0x781544
xor eax, eax
jmp 0x7815ac
mov rsi, rbx
sub rsi, rdi
test rsi, rsi
jle 0x781552
lea rcx, [rsp + 0x40]
mov r8, rsi
mov rdx, rdi
call fcn.007917e0
lea rdx, [0x007c52c8]
lea rcx, [rsp + 0x40]
mov r8d, 5
call fcn.00788110
lea rcx, [rsp + 0x40]
mov byte [rsp + rsi + 0x45], 0
call fcn.00782140
lea rdx, [rbx + 1]
xor r8d, r8d
mov rcx, rax
call fcn.007813d0
mov rdi, rax
mov rax, rdi
mov rbp, qword [rsp + 0x168]
mov rbx, qword [rsp + 0x190]
mov rdi, qword [rsp + 0x160]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.00787d00
add rsp, 0x170
pop rsi
ret
Function at 0x7815e0
Capabilities:
Allocate or change rwx memory
Get common file path
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rdi
push r12
sub rsp, 0x160
mov rax, qword [0x007cd058]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor r12d, r12d
mov rbp, rdx
xor r9d, r9d
mov qword [rsp + 0x30], r12
lea r8d, [r12 + 1]
xor edx, edx
mov dword [rsp + 0x28], r12d
mov rbx, rcx
mov dword [rsp + 0x44], r12d
mov dword [rsp + 0x40], r12d
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
je 0x78167b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], r12
lea r8d, [r12 + 3]
xor r9d, r9d
mov edx, 0x80000000
mov rcx, rbx
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x781702
lea rcx, [rsp + 0x51]
xor edx, edx
mov r8d, 0xff
mov byte [rsp + 0x50], r12b
call fcn.00790ad0
lea rcx, [rsp + 0x50]
mov edx, 0x100
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea rdx, [0x007c52d0]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rcx, [rsp + 0x50]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcatA]
xor r9d, r9d
mov qword [rsp + 0x30], r12
lea rcx, [rsp + 0x50]
lea r8d, [r9 + 1]
mov edx, 0x80000000
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x781702
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rax, r12
jmp 0x78178f
lea rdx, [rsp + 0x44]
mov rcx, rdi
mov qword [rsp + 0x190], rsi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, eax
mov esi, eax
mov qword [rbp], rdx
cmp eax, 0xffffffff
je 0x781778
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
je 0x78177b
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x781778
lea r9, [rsp + 0x40]
mov r8d, esi
mov rdx, rbx
mov rcx, rdi
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x781778
cmp dword [rsp + 0x40], esi
je 0x78177b
mov rbx, r12
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x190]
mov rax, rbx
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.00787d00
mov rbx, qword [rsp + 0x198]
add rsp, 0x160
pop r12
pop rdi
pop rbp
ret
Function at 0x781c70
Capabilities:
Check os version
Parse pe header

Disassembly:
push rbp
sub rsp, 0xe0
mov rax, qword [0x007cd058]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbp, rcx
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x98
mov dword [rsp + 0x20], 0x9c
call fcn.00790ad0
mov r11d, 0x5a4d
cmp word [rbp], r11w
je 0x781cbc
xor eax, eax
jmp 0x781e69
mov qword [rsp + 0xd8], rdi
movsxd rdi, dword [rbp + 0x3c]
add rdi, rbp
cmp dword [rdi], 0x4550
je 0x781cda
xor eax, eax
jmp 0x781e61
mov edx, dword [rdi + 0x50]
mov rcx, qword [rdi + 0x30]
mov r9d, 4
mov r8d, 0x2000
mov qword [rsp + 0xd0], r12
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, dword [rdi + 0x50]
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x2000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r12, rax
test rax, rax
je 0x781e59
mov qword [rsp + 0xf8], rbx
mov qword [rsp + 0x100], rsi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 0x20]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r8d, 0x1000
mov rcx, r12
mov rsi, rax
mov qword [rax + 8], r12
xor eax, eax
mov dword [rsi + 0x18], eax
mov qword [rsi + 0x10], rax
mov dword [rsi + 0x1c], eax
mov edx, dword [rdi + 0x50]
lea r9d, [rax + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, dword [rdi + 0x54]
mov r9d, 4
mov r8d, 0x1000
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rbp + 0x3c]
mov rdx, rbp
add r8d, dword [rdi + 0x54]
mov rcx, rax
mov rbx, rax
call fcn.007917e0
movsxd rax, dword [rbp + 0x3c]
mov r8, rsi
add rax, rbx
mov rdx, rdi
mov rcx, rbp
mov qword [rsi], rax
mov qword [rax + 0x30], r12
call fcn.007817c0
mov rdx, r12
mov rcx, rsi
sub rdx, qword [rdi + 0x30]
call fcn.007819b0
mov rcx, rsi
call fcn.00781ab0
test eax, eax
je 0x781e3f
mov rcx, rsi
call fcn.007818b0
mov r11, qword [rsi]
mov eax, dword [r11 + 0x28]
test eax, eax
je 0x781e3a
mov rbx, rax
add rbx, r12
je 0x781e3f
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x30], 2
jne 0x781e23
cmp dword [rsp + 0x24], 6
jne 0x781e23
mov eax, dword [rsp + 0x28]
test eax, eax
je 0x781e10
cmp eax, 1
jne 0x781e23
cmp byte [rsp + 0xba], 1
jne 0x781e23
cmp dword [0x007db220], 0
jne 0x781e33
xor r8d, r8d
mov rcx, r12
lea edx, [r8 + 1]
call rbx
test eax, eax
je 0x781e3f
mov dword [rsi + 0x1c], 1
mov rax, rsi
jmp 0x781e49
mov rcx, rsi
call fcn.00782070
xor eax, eax
mov rbx, qword [rsp + 0xf8]
mov rsi, qword [rsp + 0x100]
mov r12, qword [rsp + 0xd0]
mov rdi, qword [rsp + 0xd8]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.00787d00
add rsp, 0xe0
pop rbp
ret
Function at 0x782140
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x007cd058]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rax, qword gs:[0x60]
mov rdx, qword [rax + 0x18]
mov rbx, qword [rdx + 0x10]
mov rdi, qword [rdx + 0x18]
test rcx, rcx
jne 0x782179
mov rax, qword [rbx + 0x30]
jmp 0x7821ec
movzx edx, byte [rcx]
xor eax, eax
mov byte [rsp + 0x20], 0
mov qword [rsp + 0x21], rax
mov qword [rsp + 0x29], rax
mov qword [rsp + 0x31], rax
mov qword [rsp + 0x39], rax
mov qword [rsp + 0x41], rax
mov qword [rsp + 0x49], rax
mov byte [rsp + 0x51], al
lea rax, [rsp + 0x20]
test dl, dl
je 0x7821c4
nop
mov byte [rax], dl
mov dl, byte [rcx + 1]
inc rcx
mov byte [rax + 1], 0
add rax, 2
test dl, dl
jne 0x7821b0
cmp rbx, rdi
je 0x7821ea
nop dword [rax]
mov rdx, qword [rbx + 0x60]
lea rcx, [rsp + 0x20]
call fcn.0078806c
test eax, eax
je 0x782173
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x7821d0
xor eax, eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.00787d00
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x783c90
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov edi, ecx
call fcn.00782450
test eax, eax
je 0x783cad
xor ecx, ecx
call qword [0x007d0920]
mov rax, qword [0x007d0930]
mov ecx, dword [0x007db1c4]
lea rdx, [0x007d0978]
movsxd rbx, dword [rax + 0x3c]
add rbx, rax
call fcn.007854f0
mov eax, 0x2000
test word [rbx + 0x16], ax
je 0x783d07
lea rcx, [0x007c5448]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
test edi, edi
je 0x783d2d
call fcn.007848e0
test al, al
je 0x783d2d
mov dword [0x007d0938], 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
xor ecx, ecx
lea rax, [rsp + 0x48]
lea r8, [0x00783ee0]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], ecx
mov dword [rsp + 0x48], ecx
call qword [0x007d07e8]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x783d50
Capabilities:
Enumerate threads
Resume thread
Suspend thread

Disassembly:
mov rax, rsp
push rbx
push rsi
push rdi
push r12
sub rsp, 0x848
mov qword [rax + 8], rbp
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], r14
mov qword [rax - 0x28], r15
mov r14d, edx
mov r15, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, ebp
mov ecx, 6
mov r13d, eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
xor edi, edi
mov r12, rax
mov esi, edi
call qword [sym.imp.USER32.dll_GetDesktopWindow]
test r12, r12
je 0x783e1d
lea rdx, [rsp + 0x20]
mov rcx, r12
mov dword [rsp + 0x20], 0x1c
call sub.KERNEL32.dll_Thread32First
lea rdx, [rsp + 0x20]
mov rcx, r12
mov rbx, rdi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
je 0x783e1d
nop dword [rax]
cmp dword [rsp + 0x2c], ebp
jne 0x783e0c
mov r8d, dword [rsp + 0x28]
cmp r8d, r13d
je 0x783e0c
xor edx, edx
lea ecx, [rdx + 2]
call qword [0x007d07d8]
mov qword [rsp + rbx*8 + 0x40], rax
test rax, rax
je 0x783e0c
cmp rbx, 0x100
jge 0x783e0c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
inc esi
inc rbx
lea rdx, [rsp + 0x20]
mov rcx, r12
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x783dd0
mov edx, r14d
mov rcx, r15
call fcn.00785220
mov r15, qword [rsp + 0x840]
mov r14, qword [rsp + 0x880]
mov r13, qword [rsp + 0x878]
mov rbp, qword [rsp + 0x870]
movsxd rsi, esi
test rsi, rsi
jle 0x783e74
mov rbx, qword [rsp + rdi*8 + 0x40]
test rbx, rbx
je 0x783e6c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc rdi
cmp rdi, rsi
jl 0x783e50
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x848
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x785650
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push rbx
sub rsp, 0x290
mov rax, qword [0x007cd058]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rbx, rcx
mov qword [rsp + 0x20], rdx
lea r9, [0x007c5528]
lea rcx, [rsp + 0x70]
lea r8, [0x007c5540]
mov edx, 0x104
mov dword [rsp + 0x58], 1
call fcn.00788f84
lea r11, [rsp + 0x60]
mov qword [rsp + 0x40], r11
lea rax, [rsp + 0x50]
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x38], rax
xor eax, eax
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x785754
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x50]
lea rdx, [0x007c55a8]
lea eax, [rax + rax + 2]
mov r9d, 2
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
test eax, eax
jne 0x78574e
lea rax, [rsp + 0x5c]
lea rdx, [0x007c55d0]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x5c], 7
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x785758
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x7857cb
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x50]
lea rdx, [0x007c55f0]
lea eax, [rax + rax + 2]
mov r9d, 2
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
test eax, eax
jne 0x78574e
lea rax, [rsp + 0x58]
lea rdx, [0x007c5618]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
test eax, eax
jne 0x78574e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.00787d00
add rsp, 0x290
pop rbx
ret

Function at 0x7857f0
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 0x20], r9
sub rsp, 0x58
xor edx, edx
lea rax, [rsp + 0x78]
mov r9d, r8d
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], edx
mov word [rsp + 0x28], 1
mov qword [rsp + 0x20], rdx
xor r8d, r8d
mov dx, 1
call qword [sym.imp.ADVAPI32.dll_ReportEventA]
test eax, eax
setne al
add rsp, 0x58
ret
Function at 0x785da0
Capabilities:
Encode data using xor
Encrypt data using xtea

Disassembly:
push rbx
push r15
sub rsp, 0x58
mov rax, qword [0x007cd058]
xor rax, rsp
mov qword [rsp + 0x38], rax
cmp byte [0x007ce750], 0
mov r15d, edx
mov rbx, rcx
je 0x785fbf
lea rdx, [0x007ce750]
lea rcx, [rsp + 0x28]
or r8d, 0xffffffff
call fcn.00785a50
test eax, eax
je 0x785fbf
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x48], r13
xor r12d, r12d
mov r13d, r15d
mov qword [rsp + 0x40], r14
mov r9d, r12d
sar r13d, 3
lea r14d, [r12 + 0x20]
test r13d, r13d
jle 0x785ed1
mov qword [rsp + 0x78], rbp
mov qword [rsp + 0x80], rsi
mov r12d, 0xc6ef3720
mov qword [rsp + 0x88], rdi
nop dword [rax]
lea eax, [r9*8]
mov edi, r12d
mov ebp, r14d
movsxd r10, eax
mov rsi, r12
mov r8d, dword [r10 + rbx]
mov r11d, dword [r10 + rbx + 4]
nop dword [rax]
shr rsi, 0xb
mov eax, r8d
mov ecx, r8d
shl eax, 4
shr ecx, 5
and esi, 3
xor ecx, eax
mov eax, dword [rsp + rsi*4 + 0x28]
add eax, edi
add ecx, r8d
add edi, 0x61c88647
xor ecx, eax
mov esi, edi
sub r11d, ecx
mov eax, r11d
mov edx, r11d
shr edx, 5
shl eax, 4
xor edx, eax
mov eax, edi
and eax, 3
add edx, r11d
mov ecx, dword [rsp + rax*4 + 0x28]
add ecx, edi
xor edx, ecx
sub r8d, edx
add ebp, 0xffffffff
jne 0x785e50
xor r8d, r9d
inc r9d
mov dword [r10 + rbx + 4], r11d
cmp r9d, r13d
mov dword [r10 + rbx], r8d
jl 0x785e30
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
xor r12d, r12d
and r15d, 7
mov r13, qword [rsp + 0x48]
je 0x785fb1
mov byte [rsp + 0x20], 0
mov byte [rsp + 0x21], 0
mov byte [rsp + 0x22], 0
mov byte [rsp + 0x23], 0
mov edx, dword [rsp + 0x20]
mov byte [rsp + 0x24], 0
mov byte [rsp + 0x25], 0
mov byte [rsp + 0x26], 0
mov byte [rsp + 0x27], 0
mov r8d, dword [rsp + 0x24]
mov r10, r12
nop word [rax + rax]
mov eax, r8d
and r10d, 3
mov ecx, r8d
shl eax, 4
shr ecx, 5
xor ecx, eax
mov eax, dword [rsp + r10*4 + 0x28]
add eax, r12d
add ecx, r8d
add r12d, 0x9e3779b9
xor ecx, eax
mov r10d, r12d
add edx, ecx
mov eax, edx
mov ecx, edx
shl eax, 4
shr ecx, 5
xor ecx, eax
mov eax, r12d
shr rax, 0xb
add ecx, edx
and eax, 3
mov eax, dword [rsp + rax*4 + 0x28]
add eax, r12d
xor ecx, eax
add r8d, ecx
add r14d, 0xffffffff
jne 0x785f20
lea eax, [r9*8]
mov dword [rsp + 0x20], edx
mov dword [rsp + 0x24], r8d
movsxd rcx, eax
add rcx, rbx
test r15d, r15d
jle 0x785fb1
lea r8, [rsp + 0x20]
mov edx, r15d
sub r8, rcx
nop dword [rax]
movzx eax, byte [r8 + rcx]
inc rcx
xor byte [rcx - 1], al
sub rdx, 1
jne 0x785fa0
mov r14, qword [rsp + 0x40]
mov r12, qword [rsp + 0x50]
mov al, 1
jmp 0x785fc1
xor al, al
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.00787d00
add rsp, 0x58
pop r15
pop rbx
ret
Function at 0x7864c0
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
lea rcx, [0x007c5670]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, [0x007c5690]
mov rcx, rax
mov qword [0x007da3a0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x007da3a0]
lea rdx, [0x007c56a0]
mov qword [0x007da398], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x007da3a0]
lea rdx, [0x007c56b0]
mov qword [0x007da390], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x007da3a0]
lea rdx, [0x007c56c0]
mov qword [0x007da388], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x007da3a0]
lea rdx, [0x007c56d0]
mov qword [0x007da380], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r9, qword [0x007da398]
lea rcx, [0x007da450]
mov edx, reloc.WS2_32.dll_ntohl
sub r9, rcx
mov r11, rax
mov qword [0x007da378], rax
mov byte [0x007da3f0], 0xff
mov byte [0x007da3f1], 0x25
mov byte [0x007da3e0], 0xff
mov byte [0x007da3e1], 0x25
mov byte [0x007da3c0], 0xff
mov byte [0x007da3c1], 0x25
mov byte [0x007da3d0], 0xff
mov byte [0x007da3d1], 0x25
mov byte [0x007da3b0], 0xff
mov byte [0x007da3b1], 0x25
mov r8, rdx
nop dword [rax]
movzx eax, byte [r9 + rcx]
inc rcx
sub r8, 1
mov byte [rcx - 1], al
jne 0x7865c0
mov r9, qword [0x007da390]
lea rax, [0x00786b50]
lea rcx, [0x007da440]
mov qword [0x007da3f6], rax
mov r8, rdx
sub r9, rcx
nop word [rax + rax]
movzx eax, byte [r9 + rcx]
inc rcx
sub r8, 1
mov byte [rcx - 1], al
jne 0x786600
mov r9, qword [0x007da388]
lea rax, [0x00786bb0]
lea rcx, [0x007da430]
mov qword [0x007da3e6], rax
mov r8, rdx
sub r9, rcx
nop word [rax + rax]
movzx eax, byte [r9 + rcx]
inc rcx
sub r8, 1
mov byte [rcx - 1], al
jne 0x786640
mov r9, qword [0x007da380]
lea rax, [0x00786c10]
lea rcx, [0x007da420]
mov qword [0x007da3c6], rax
mov r8, rdx
sub r9, rcx
nop word [rax + rax]
movzx eax, byte [r9 + rcx]
inc rcx
sub r8, 1
mov byte [rcx - 1], al
jne 0x786680
lea rax, [0x00786ca0]
lea rcx, [0x007da410]
mov qword [0x007da3d6], rax
sub r11, rcx
nop dword [rax]
movzx eax, byte [r11 + rcx]
inc rcx
sub rdx, 1
mov byte [rcx - 1], al
jne 0x7866b0
lea rax, [0x00786d00]
mov qword [0x007da3b6], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [0x007da374], eax
mov dword [0x007da370], eax
add rsp, 0x28
jmp fcn.007866f0