joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18003cf10
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
mov ecx, edx
call fcn.18009c908
mov ecx, eax
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
and eax, 0x8000
add rsp, 0x28
ret

Function at 0x18003cf30
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x1801044f8]
xor rax, rsp
mov qword [rsp + 0x88], rax
movsxd rsi, edx
mov rdi, rcx
xor ebx, ebx
mov ecx, dword [rcx + 0x10]
test ecx, ecx
je 0x18003d09d
sub ecx, 1
je 0x18003cfd5
cmp ecx, 1
jne 0x18003d0d9
xor edx, edx
mov ecx, esi
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
movzx r9d, ax
shl r9, 0x10
or r9, 1
mov r8, rsi
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x7d0
mov dword [rsp + 0x20], 1
mov edx, 0x100
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_SendMessageTimeoutW]
mov ebx, eax
test eax, eax
jne 0x18003d0d9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.error_code_d
call fcn.1800478f0
jmp 0x18003d0d9
mov qword [rsp + 0x40], 1
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rbx
mov word [rsp + 0x48], bx
xor edx, edx
mov ecx, esi
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov word [rsp + 0x4a], ax
mov dword [rsp + 0x4c], 8
mov r8d, 0x28
lea rdx, [rsp + 0x40]
lea ecx, [r8 - 0x27]
call qword [sym.imp.USER32.dll_SendInput]
mov ebx, eax
test eax, eax
jne 0x18003d0d9
lea rcx, [rsp + 0x68]
call fcn.180042b40
nop
cmp qword [rax + 0x18], 0x10
jb 0x18003d03c
mov rax, qword [rax]
mov rdx, rax
lea rcx, str.op:IN_NORMAL2_erro_code:_s
call fcn.1800478f0
nop
mov rdx, qword [rsp + 0x80]
cmp rdx, 0x10
jb 0x18003d088
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18003d083
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18003d100
call fcn.180093588
movdqa xmm0, xmmword [0x1800e4080]
movdqu xmmword [rsp + 0x78], xmm0
mov byte [rsp + 0x68], 0
jmp 0x18003d0d9
mov qword [rsp + 0x40], 1
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rbx
mov word [rsp + 0x48], si
mov word [rsp + 0x4a], bx
mov dword [rsp + 0x4c], ebx
mov r8d, 0x28
lea rdx, [rsp + 0x40]
lea ecx, [r8 - 0x27]
call qword [sym.imp.USER32.dll_SendInput]
mov ebx, eax
mov eax, ebx
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.180093c30
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.18009a4c4
int3
Function at 0x18003d170
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x1801044f8]
xor rax, rsp
mov qword [rsp + 0x88], rax
movsxd rsi, edx
mov rdi, rcx
xor ebx, ebx
mov ecx, dword [rcx + 0x10]
test ecx, ecx
je 0x18003d2e5
sub ecx, 1
je 0x18003d219
cmp ecx, 1
jne 0x18003d325
xor edx, edx
mov ecx, esi
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
movzx r9d, ax
shl r9, 0x10
mov eax, 0xc0000001
or r9, rax
mov r8, rsi
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x7d0
mov dword [rsp + 0x20], 1
mov edx, 0x101
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_SendMessageTimeoutW]
mov ebx, eax
test eax, eax
jne 0x18003d325
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.error_code_d
call fcn.1800478f0
jmp 0x18003d325
mov qword [rsp + 0x40], 1
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rbx
mov word [rsp + 0x48], bx
xor edx, edx
mov ecx, esi
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov word [rsp + 0x4a], ax
mov dword [rsp + 0x4c], 0xa
mov r8d, 0x28
lea rdx, [rsp + 0x40]
lea ecx, [r8 - 0x27]
call qword [sym.imp.USER32.dll_SendInput]
mov ebx, eax
test eax, eax
jne 0x18003d325
lea rcx, [rsp + 0x68]
call fcn.180042b40
nop
cmp qword [rax + 0x18], 0x10
jb 0x18003d280
mov rax, qword [rax]
mov rdx, rax
lea rcx, str.op:IN_NORMAL2_erro_code:_s
call fcn.1800478f0
nop
mov rdx, qword [rsp + 0x80]
cmp rdx, 0x10
jb 0x18003d2d0
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18003d2cb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18003d34c
call fcn.180093588
movdqa xmm0, xmmword [0x1800e4080]
movdqu xmmword [rsp + 0x78], xmm0
mov byte [rsp + 0x68], 0
jmp 0x18003d325
mov qword [rsp + 0x40], 1
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rbx
mov word [rsp + 0x48], si
mov word [rsp + 0x4a], bx
mov dword [rsp + 0x4c], 2
mov r8d, 0x28
lea rdx, [rsp + 0x40]
lea ecx, [r8 - 0x27]
call qword [sym.imp.USER32.dll_SendInput]
mov ebx, eax
mov eax, ebx
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.180093c30
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.18009a4c4
int3
Function at 0x180042a10
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
xorps xmm0, xmm0
mov edi, ecx
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
add edi, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, edi
jae 0x180042a7f
xor r9d, r9d
mov dword [rsp + 0x20], 1
xor r8d, r8d
lea rcx, [rsp + 0x30]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jle 0x180042a75
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_DispatchMessageW]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, edi
jb 0x180042a40
mov rbx, qword [rsp + 0x70]
mov al, 1
add rsp, 0x60
pop rdi
ret

Function at 0x180049360
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x180049391
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rdi
je 0x18004940b
mov rdi, r14
mov rcx, rbx
call fcn.18002cb40
test rax, rax
jle 0x1800493e3
mov rdx, qword [rbx + 0x38]
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov r8, rbp
mov rdx, qword [rdx]
call fcn.1800956b0
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x1800493fb
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x180049403
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x1800493a5
sub r14, rdi
jmp 0x1800494ef
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x180049422
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x180049424
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x180049456
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.1800956b0
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x1800494ec
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x180049491
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x1800494cd
nop word [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.1800a3918
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x1800494ec
cmp rbp, rax
ja 0x1800494a0
test rbp, rbp
je 0x1800494ec
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.1800a3918
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x30]
mov rax, r14
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x180049960
Capabilities:
Terminate process
Terminate thread

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1801044f8]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, rcx
xor esi, esi
cmp dword [rcx + 0xc8], esi
je 0x180049a96
mov dword [rcx + 0xc8], esi
mov rax, qword [rcx]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [r11 - 0x28], rsi
mov qword [r11 - 0x20], rsi
mov qword [r11 - 0x28], 4
mov qword [r11 - 0x20], 0xf
mov dword [rsp + 0x20], 0x74697865
mov byte [rsp + 0x24], sil
lea rdx, [r11 - 0x38]
call qword [rax + 0x10]
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x180049a0b
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180049a06
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180049b54
call fcn.180093588
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], 0
mov edx, 0x3e8
mov rcx, qword [rbx + 0x48]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x180049a55
xor edx, edx
mov rcx, qword [rbx + 0x48]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rbx + 0xd0]
mov edx, 0xffffffff
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rdi, qword [rbx + 0xd0]
cmp dword [rdi + 8], 0
je 0x180049b5a
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [rdi + 8], eax
je 0x180049b65
movups xmm0, xmmword [rdi]
movaps xmmword [rsp + 0x20], xmm0
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.1800910bc
test eax, eax
jne 0x180049b70
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov rcx, qword [rbx + 0xd0]
test rcx, rcx
je 0x180049ab6
cmp dword [rcx + 8], 0
jne 0x180049b4e
mov edx, 0x10
call fcn.180093588
mov qword [rbx + 0xd0], rsi
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x180049acc
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 8], rsi
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x180049adf
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x10], rsi
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x180049af2
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x20], rsi
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x180049b05
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x18], rsi
mov rcx, qword [rbx + 0x48]
test rcx, rcx
je 0x180049b18
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x48], rsi
mov rcx, qword [rbx + 0x50]
test rcx, rcx
je 0x180049b2b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x50], rsi
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180093c30
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
call fcn.1800a45dc
int3
call fcn.18009a4c4
int3
mov ecx, 1
call fcn.180091494
int3
mov ecx, 5
call fcn.180091494
int3
mov ecx, 2
call fcn.180091494
int3
Function at 0x180049c90
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
cmp dword [rcx + 0xc8], 0
je 0x180049cca
mov r8d, dword [rdx + 0x10]
xor eax, eax
cmp qword [rdx + 0x18], 0x10
mov dword [rsp + 0x40], eax
jb 0x180049cb1
mov rdx, qword [rdx]
mov rcx, qword [rcx + 0x20]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
add rsp, 0x38
ret
xor eax, eax
add rsp, 0x38
ret

Function at 0x180049ce0
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create two anonymous pipes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x180
mov rax, qword [0x1801044f8]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rdi, rdx
mov rbx, rcx
xor ebp, ebp
mov dword [rsp + 0x50], ebp
mov dword [rcx + 0x30], 0x18
mov dword [rcx + 0x40], 1
mov qword [rcx + 0x38], rbp
add rcx, 8
xor r9d, r9d
lea r8, [rbx + 0x30]
lea rdx, [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x180049d44
lea eax, [rbp - 1]
jmp 0x180049ea5
lea rdx, [rbx + 0x20]
xor r9d, r9d
lea r8, [rbx + 0x30]
lea rcx, [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x180049d67
mov eax, 0xfffffffe
jmp 0x180049ea5
lea rsi, [rbx + 0x60]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [rsi], 0x68
mov rax, qword [rbx + 0x10]
mov qword [rbx + 0xc0], rax
mov qword [rbx + 0xb8], rax
mov rax, qword [rbx + 0x18]
mov qword [rbx + 0xb0], rax
mov word [rbx + 0xa0], bp
mov dword [rbx + 0x9c], 0x101
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x180049db5
mov rdx, qword [rdi]
mov r8, qword [rdi + 0x10]
inc r8
lea rcx, [rsp + 0x70]
call fcn.1800956b0
lea rax, [rbx + 0x48]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x180049e0b
mov eax, 0xfffffffd
jmp 0x180049ea5
mov dword [rbx + 0xc8], 1
mov ecx, 0x10
call fcn.18009354c
mov rdi, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x180049e96
mov ecx, 0x10
call fcn.18009354c
test rax, rax
je 0x180049e4b
mov qword [rax], rbx
lea rcx, [0x180049ee0]
mov qword [rax + 8], rcx
jmp 0x180049e4e
mov rax, rbp
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x50], 1
lea rsi, [rdi + 8]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], ebp
mov r9, rax
lea r8, [0x180049860]
xor edx, edx
xor ecx, ecx
call fcn.1800a4740
mov qword [rdi], rax
test rax, rax
je 0x180049ecc
mov qword [rsp + 0x58], rbp
mov eax, 1
and eax, 0xfffffffe
mov dword [rsp + 0x50], eax
jmp 0x180049e99
mov rdi, rbp
mov qword [rbx + 0xd0], rdi
mov eax, 1
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.180093c30
mov rbx, qword [rsp + 0x1c0]
add rsp, 0x180
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov dword [rsi], ebp
mov ecx, 6
call fcn.180091494
int3
Function at 0x1800545c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
push r13
push r15
sub rsp, 0x40
mov ebx, dword [rcx]
mov r15, rdx
mov dword [rsp + 0x60], ebx
mov r13, rcx
test ebx, ebx
je 0x18005477b
mov qword [rsp + 0x68], rbp
mov rdx, rcx
mov qword [rsp + 0x30], rdi
lea rbp, [rcx + 0x50]
mov edi, dword [rcx + 4]
mov rcx, rbp
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x70], edi
call fcn.180054dd0
xor r12d, r12d
test edi, edi
jle 0x18005476c
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x20], r14
nop dword [rax + rax]
mov eax, r12d
imul eax, dword [r13]
shl eax, 2
movsxd rdi, eax
mov eax, r12d
imul eax, dword [rbp]
add rdi, qword [r13 + 8]
movsxd rsi, eax
add rsi, qword [rbp + 8]
test ebx, ebx
jle 0x180054754
mov ebp, ebx
nop word [rax + rax]
movzx eax, byte [rdi + 1]
imul edx, eax, 0x24b
movzx eax, byte [rdi + 2]
imul ecx, eax, 0x12b
movzx eax, byte [rdi]
mov byte [rsi], 0
mov rbx, qword [r15 + 8]
add edx, ecx
imul ecx, eax, 0x72
mov eax, 0x10624dd3
add ecx, 0x1f4
add edx, ecx
mov rcx, qword [r15]
mul edx
shr edx, 6
cmp rcx, rbx
je 0x18005473b
movzx r14d, dl
lea r11, [rcx + 6]
nop dword [rax]
movzx eax, byte [r11 - 5]
imul r8d, eax, 0x24b
movzx eax, byte [r11 - 4]
imul edx, eax, 0x12b
movzx eax, byte [rcx]
add r8d, edx
imul edx, eax, 0x72
mov eax, 0x10624dd3
add edx, 0x1f4
add r8d, edx
mul r8d
mov eax, r14d
shr edx, 6
movzx r8d, dl
sub eax, r8d
cdq
mov r10d, eax
mov eax, 0x10624dd3
xor r10d, edx
sub r10d, edx
movzx edx, byte [r11 - 1]
imul r9d, edx, 0x24b
movzx edx, byte [r11 - 2]
imul r8d, edx, 0x72
movzx edx, byte [r11]
imul edx, edx, 0x12b
add r9d, r8d
add edx, 0x1f4
add edx, r9d
mul edx
shr edx, 6
movzx eax, dl
cmp r10d, eax
jle 0x180054738
add rcx, 8
add r11, 8
cmp rcx, rbx
jne 0x1800546a0
jmp 0x18005473b
mov byte [rsi], 1
inc rsi
add rdi, 4
sub rbp, 1
jne 0x180054650
mov ebx, dword [rsp + 0x60]
lea rbp, [r13 + 0x50]
inc r12d
cmp r12d, dword [rsp + 0x70]
jl 0x180054620
mov r14, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x68]
mov r12, qword [rsp + 0x28]
add rsp, 0x40
pop r15
pop r13
pop rbx
ret
Function at 0x180054f50
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x28
mov rbx, qword [rcx + 0x78]
mov rbp, rcx
mov r10d, dword [rcx + 0x70]
mov r13d, r8d
mov r12d, dword [r9 + 4]
mov r11d, r10d
mov esi, dword [r9]
movsd xmm1, qword [0x1800d0090]
subsd xmm1, qword [rsp + 0x98]
movsxd r15, edx
lea eax, [r12 + r8]
imul r10d, eax
imul r11d, r8d
mov r8d, dword [rsp + 0x90]
lea edi, [rsi + r15]
mov dword [rsp + 0x78], r12d
movd xmm2, r8d
cvtdq2pd xmm2, xmm2
lea eax, [r10 + rdi]
movsxd rdx, eax
lea eax, [r10 + r15]
movsxd rcx, eax
mov eax, dword [rbx + rcx*4]
lea ecx, [r11 + r15]
sub eax, dword [rbx + rdx*4]
movsxd rdx, ecx
lea ecx, [r11 + rdi]
sub eax, dword [rbx + rdx*4]
movsxd rdx, ecx
add eax, dword [rbx + rdx*4]
add eax, r8d
cdq
xor eax, edx
sub eax, edx
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm0, xmm2
comisd xmm0, xmm1
ja 0x1800551bf
mulsd xmm1, xmm2
xor ebx, ebx
xor r14d, r14d
cvttsd2si eax, xmm1
mov dword [rsp + 0x90], eax
test r12d, r12d
jle 0x1800551b8
mov rdx, qword [rbp + 0x18]
xor r12d, r12d
mov edi, dword [rbp + 0x10]
mov ebp, edi
mov rcx, qword [r9 + 8]
mov r9, r15
imul ebp, r13d
mov r13d, dword [rsp + 0x78]
mov qword [rsp + 0x98], rcx
mov qword [rsp + 0x70], rdx
mov qword [rsp + 0x88], r15
mov dword [rsp + 0x80], edi
nop
movsxd r8, ebp
add r8, rdx
add r8, r9
movsxd r9, r12d
add r9, rcx
xor ecx, ecx
test esi, esi
jle 0x180055101
cmp esi, 8
jb 0x180055101
mov eax, esi
and eax, 0x80000007
jge 0x180055082
dec eax
or eax, 0xfffffff8
inc eax
xorps xmm0, xmm0
mov edx, esi
movdqa xmmword [rsp + 0x10], xmm0
sub edx, eax
mov r10d, dword [rsp + 0x10]
movdqa xmmword [rsp], xmm0
mov eax, dword [rsp]
nop dword [rax]
movd xmm0, dword [r9]
add ecx, 8
movd xmm2, dword [r8]
psadbw xmm2, xmm0
movd xmm0, dword [r9 + 4]
add r9, 8
movd xmm1, r10d
paddd xmm2, xmm1
movd xmm1, eax
movd r10d, xmm2
movd xmm2, dword [r8 + 4]
add r8, 8
psadbw xmm2, xmm0
paddd xmm2, xmm1
movd eax, xmm2
cmp ecx, edx
jl 0x1800550a0
movd xmm1, eax
movd xmm0, r10d
paddd xmm1, xmm0
movd eax, xmm1
add ebx, eax
mov eax, dword [rsp + 0x90]
xor r10d, r10d
xor r11d, r11d
cmp ecx, esi
jge 0x18005518e
mov eax, esi
sub eax, ecx
cmp eax, 2
jl 0x180055169
mov eax, esi
sub eax, ecx
sub eax, 2
shr eax, 1
inc eax
mov edi, eax
lea r15d, [rcx + rax*2]
nop dword [rax]
movzx ecx, byte [r9]
movzx eax, byte [r8]
sub eax, ecx
movzx ecx, byte [r9 + 1]
cdq
add r9, 2
xor eax, edx
sub eax, edx
add r10d, eax
movzx eax, byte [r8 + 1]
sub eax, ecx
add r8, 2
cdq
xor eax, edx
sub eax, edx
add r11d, eax
sub rdi, 1
jne 0x180055130
cmp r15d, esi
jge 0x18005517a
movzx ecx, byte [r9]
movzx eax, byte [r8]
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
add ebx, eax
mov edi, dword [rsp + 0x80]
lea eax, [r11 + r10]
add ebx, eax
mov eax, dword [rsp + 0x90]
cmp ebx, eax
jg 0x1800551bf
mov rcx, qword [rsp + 0x98]
inc r14d
mov rdx, qword [rsp + 0x70]
add ebp, edi
mov r9, qword [rsp + 0x88]
add r12d, esi
cmp r14d, r13d
jl 0x180055050
mov eax, 1
jmp 0x1800551c1
xor eax, eax
add rsp, 0x28
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18005d4e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x18005d558
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x18005d558
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x18005d545
nop
cmp rbx, rcx
jae 0x18005d558
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x18005d530
cmp rbx, rcx
jae 0x18005d558
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
jmp 0x18005d55a
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x180062c40
Capabilities:
Acquire debug privileges

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1801044f8]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov ebx, ecx
mov qword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov edx, 0x20028
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x180062d07
lea r8, [rsp + 0x38]
xor ecx, ecx
lea rdx, str.SeDebugPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x180062d07
mov rax, qword [rsp + 0x38]
lea r8, [rsp + 0x40]
neg ebx
mov qword [rsp + 0x28], 0
mov r9d, 0x10
mov dword [rsp + 0x40], 1
sbb ecx, ecx
mov qword [rsp + 0x44], rax
and ecx, 2
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x4c], ecx
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x180062d07
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.180093c30
add rsp, 0x60
pop rbx
ret
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.180093c30
add rsp, 0x60
pop rbx
ret
Function at 0x180062d20
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rbx, r8
mov rdi, rdx
mov r8d, ecx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
jne 0x180062d5a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
lea rax, [rsi - 1]
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
mov qword [rsp + 0x60], rbp
mov rax, 0xffffffffffffffff
mov qword [rsp + 0x68], r14
nop dword [rax + rax]
cmp word [rdi + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x180062d70
lea eax, [rax*2 + 2]
mov dword [rsp + 0x20], 0x40
mov r8d, eax
mov r9d, 0x1000
xor edx, edx
mov r14d, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rbp, rax
test rax, rax
jne 0x180062dba
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
lea eax, [rbp - 2]
jmp 0x180062ea7
mov qword [rsp + 0x70], r15
mov r9, r14
xor r15d, r15d
mov r8, rdi
mov rdx, rbp
mov qword [rsp + 0x20], r15
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x180062dee
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
lea eax, [r15 - 3]
jmp 0x180062ea2
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [0x1800e2cf0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x180062e22
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
mov eax, 0xfffffffc
jmp 0x180062ea2
mov qword [rsp + 0x30], r15
mov r9, rax
mov dword [rsp + 0x28], r15d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rdi, rax
test rax, rax
jne 0x180062e57
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
lea eax, [rdi - 5]
jmp 0x180062ea2
mov edx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rsp + 0x78]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9d, 0x4000
mov r8, r14
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov dword [rbx], r15d
mov r15, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret