joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180010bd0
Capabilities:
Create thread

Disassembly:
push r12
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
mov rsi, r8
mov r12, rdx
mov rbp, rcx
cmp qword [0x18010daa8], 0
jne 0x180010d8e
mov ecx, 3
call fcn.18008aa50
mov ecx, 0x80
call fcn.1800576c0
mov rbx, rax
mov qword [rsp + 0x38], rax
test rax, rax
je 0x180010c64
lea rax, vtable.AsyncReportService.0
mov qword [rbx], rax
mov dword [rbx + 8], 0
mov qword [rbx + 0x10], 0xffffffffffffffff
lea rcx, [rbx + 0x18]
mov qword [rcx], 0
mov qword [rcx + 8], 0
call fcn.180001dc0
nop
lea rcx, [rbx + 0x28]
call fcn.180001170
nop
jmp 0x180010c66
xor ebx, ebx
mov rdx, rbx
lea rcx, [0x18010daa8]
call fcn.1800111c0
mov rax, qword [0x18010db48]
test rax, rax
jne 0x180010ca8
mov ecx, 0x1b8
call fcn.1800576c0
mov qword [rsp + 0x38], rax
test rax, rax
je 0x180010c9f
mov rcx, rax
call fcn.1800114a0
jmp 0x180010ca1
xor eax, eax
mov qword [0x18010db48], rax
lea rcx, [rax + 0x50]
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rbp
call fcn.180003d60
cmp qword [r12 + 0x18], 0
je 0x180010d09
mov rax, qword [0x18010db48]
test rax, rax
jne 0x180010cf6
mov ecx, 0x1b8
call fcn.1800576c0
mov qword [rsp + 0x38], rax
test rax, rax
je 0x180010ced
mov rcx, rax
call fcn.1800114a0
jmp 0x180010cef
xor eax, eax
mov qword [0x18010db48], rax
lea rcx, [rax + 0x78]
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, r12
call fcn.180003d60
cmp qword [rsi + 0x18], 0
je 0x180010d56
mov rax, qword [0x18010db48]
test rax, rax
jne 0x180010d43
mov ecx, 0x1b8
call fcn.1800576c0
mov qword [rsp + 0x38], rax
test rax, rax
je 0x180010d3a
mov rcx, rax
call fcn.1800114a0
jmp 0x180010d3c
xor eax, eax
mov qword [0x18010db48], rax
lea rcx, [rax + 0x28]
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rsi
call fcn.180003d60
mov rbx, qword [0x18010daa8]
mov dword [rbx + 8], 1
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, rbx
lea r8, [0x180001800]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x10], rax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop r12
ret
Function at 0x180011d20
Capabilities:
Check if file exists

Disassembly:
push rdi
sub rsp, 0xe0
mov qword [rsp + 0x88], 0xfffffffffffffffe
mov qword [rsp + 0xf8], rbx
mov rax, qword [0x180109f10]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov rdi, rcx
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
xor ebx, ebx
mov qword [rsp + 0x50], rbx
mov byte [rsp + 0x40], bl
lea r8d, [rbx + 0x17]
lea rdx, str.SoftwareKuaiZipReport
lea rcx, [rsp + 0x38]
call fcn.180003680
nop
mov dword [rsp + 0x20], ebx
mov r9b, 1
lea r8, [rsp + 0x38]
mov rdx, 0xffffffff80000001
lea rcx, [rsp + 0x90]
call fcn.1800c83d0
nop
cmp qword [rsp + 0x58], 0x10
jb 0x180011daf
mov rcx, qword [rsp + 0x40]
call fcn.180057684
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x50], rbx
mov byte [rsp + 0x40], 0
lea rcx, [rsp + 0x90]
call fcn.1800c7eb0
test al, al
jne 0x180011de7
lea rcx, [rsp + 0x90]
call fcn.1800c83a0
mov al, 1
jmp 0x180011ed0
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x80], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x78], rbx
mov byte [rsp + 0x68], 0
mov r8d, 9
lea rdx, str.timestamp
lea rcx, [rsp + 0x60]
call fcn.180003680
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x90]
call fcn.1800c80a0
test al, al
sete bl
cmp qword [rsp + 0x80], 0x10
jb 0x180011e49
mov rcx, qword [rsp + 0x68]
call fcn.180057684
test bl, bl
je 0x180011e5e
lea rcx, [rsp + 0x90]
call fcn.1800c83a0
mov al, 1
jmp 0x180011ed0
xor ecx, ecx
call fcn.180058690
mov ecx, eax
call fcn.18001fb10
mov ebx, eax
mov ecx, dword [rsp + 0x30]
call fcn.18001fb10
cmp ebx, eax
je 0x180011e8c
lea rcx, [rsp + 0x90]
call fcn.1800c83a0
mov al, 1
jmp 0x180011ed0
cmp qword [rdi + 0x1b0], 0x10
jb 0x180011e9f
mov rcx, qword [rdi + 0x198]
jmp 0x180011ea6
lea rcx, [rdi + 0x198]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x180011ec1
lea rcx, [rsp + 0x90]
call fcn.1800c83a0
mov al, 1
jmp 0x180011ed0
lea rcx, [rsp + 0x90]
call fcn.1800c83a0
xor al, al
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.1800576a0
mov rbx, qword [rsp + 0xf8]
add rsp, 0xe0
pop rdi
ret
Function at 0x180012040
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x140
mov rax, qword [0x180109f10]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rbx, rcx
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.18005dcd0
xor r9d, r9d
lea rdx, [rsp + 0x20]
lea r8d, [r9 + 0x1a]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea rdx, str.Kuaizip
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathAppendA]
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x1800120d2
lea rdx, [rsp + 0x20]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExA]
test eax, eax
je 0x1800120d2
lea rdx, [rsp + 0x20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea rdx, str.report_config.txt
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathAppendA]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x20]
lea rdx, [rsp + 0x20]
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rbx + 0x190]
call fcn.180003680
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1800576a0
mov rbx, qword [rsp + 0x158]
add rsp, 0x140
pop rdi
ret
Function at 0x18001d910
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r13
mov rsi, r9
mov r13, r8
mov ebx, edx
mov rdi, rcx
test edx, edx
je 0x18001dab9
lea ecx, [rdx*8]
mov eax, 0x2aaaaaab
imul ecx
lea ecx, [rbx*8]
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
cmp ecx, 2
je 0x18001d95e
cmp ecx, 4
jne 0x18001d961
add edx, 2
jmp 0x18001d961
add edx, 3
inc edx
cmp dword [r9], edx
jge 0x18001d97a
mov dword [r9], edx
mov eax, 0xfffffff0
mov rbx, qword [rsp + 0x38]
pop r13
pop rdi
pop rsi
ret
xor r11d, r11d
mov qword [rsp + 0x20], rbp
mov eax, 0x55555556
mov qword [rsp + 0x30], r14
mov r10, r8
mov ebp, r11d
imul ebx
mov eax, edx
lea r14, [0x1800e6b70]
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
test ecx, ecx
jle 0x18001da3e
dec ecx
mov eax, 0xaaaaaaab
mov qword [rsp + 0x28], r12
mul ecx
shr edx, 1
inc edx
mov r12d, edx
lea ebp, [rdx + rdx*2]
nop word [rax + rax]
movzx edx, byte [rdi]
movzx r8d, byte [rdi + 1]
movzx r9d, byte [rdi + 2]
mov eax, edx
add edx, edx
add r10, 4
sar rax, 2
add rdi, 3
and eax, 0x3f
movzx eax, byte [rax + r14]
mov byte [r10 - 4], al
mov eax, r8d
sar eax, 4
lea ecx, [rax + rdx*8]
and ecx, 0x3f
movzx eax, byte [rcx + r14]
mov byte [r10 - 3], al
mov eax, r9d
sar eax, 6
lea ecx, [rax + r8*4]
and ecx, 0x3f
movzx eax, byte [rcx + r14]
mov byte [r10 - 2], al
mov eax, r9d
and eax, 0x3f
sub r12, 1
movzx eax, byte [rax + r14]
mov byte [r10 - 1], al
jne 0x18001d9d0
mov r12, qword [rsp + 0x28]
cmp ebp, ebx
jge 0x18001daa3
movzx edx, byte [rdi]
inc ebp
cmp ebp, ebx
jge 0x18001da50
movzx r11d, byte [rdi + 1]
mov eax, edx
add edx, edx
sar rax, 2
and eax, 0x3f
movzx eax, byte [rax + r14]
mov byte [r10], al
mov eax, r11d
sar eax, 4
lea ecx, [rax + rdx*8]
and ecx, 0x3f
cmp ebp, ebx
movzx eax, byte [rcx + r14]
mov byte [r10 + 1], al
jge 0x18001da92
and r11d, 0xf
shl r11d, 2
movsxd rax, r11d
movzx eax, byte [rax + r14]
mov byte [r10 + 2], al
jmp 0x18001da97
mov byte [r10 + 2], 0x3d
add r10, 3
inc r10
mov byte [r10 - 1], 0x3d
mov r14, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x20]
mov eax, r10d
sub eax, r13d
mov dword [rsi], eax
mov byte [r10], 0
xor eax, eax
mov rbx, qword [rsp + 0x38]
pop r13
pop rdi
pop rsi
ret
Function at 0x18001dad0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
mov rbp, r8
movsxd r8, edx
mov rsi, r9
xor r9d, r9d
xor edx, edx
xor ebx, ebx
xor r10d, r10d
mov r11, rcx
mov rdi, r8
test r8d, r8d
jle 0x18001dc29
lea r12, [0x1800e6bb0]
nop
cmp r8d, 2
jl 0x18001db2f
movzx eax, byte [r10 + r11]
cmp eax, 0x2f72
jne 0x18001db2f
movzx eax, byte [r10 + r11 + 1]
cmp eax, 0x2f6e
je 0x18001db60
movzx eax, byte [r10 + r11]
cmp eax, 0x2f6e
je 0x18001db60
cmp al, 0x3d
jne 0x18001db46
inc edx
cmp edx, 2
jg 0x18001db91
cmp al, 0x7f
ja 0x18001db91
movzx ecx, byte [rax + r12]
cmp cl, 0x7f
je 0x18001db91
cmp cl, 0x40
jae 0x18001db5d
test edx, edx
jne 0x18001db91
inc r9d
inc r10
inc ebx
dec r8d
cmp r10, rdi
jl 0x18001db10
test r9d, r9d
je 0x18001dc29
lea eax, [r9 + r9*2]
lea eax, [rax + rax + 7]
sar eax, 3
cmp dword [rsi], eax
jge 0x18001db9b
mov dword [rsi], eax
mov eax, 0xfffffff0
jmp 0x18001dc2b
mov eax, 0xffffffee
jmp 0x18001dc2b
xor r9d, r9d
xor r10d, r10d
mov r8d, 3
mov rdx, rbp
test ebx, ebx
jle 0x18001dc25
nop
movzx eax, byte [r11]
cmp eax, 0x2f72
je 0x18001dc1c
cmp eax, 0x2f6e
je 0x18001dc1c
movzx ecx, byte [rax + r12]
xor eax, eax
cmp cl, 0x40
sete al
and ecx, 0x3f
inc r10d
sub r8d, eax
mov eax, r9d
mov r9d, ecx
shl eax, 6
or r9d, eax
cmp r10d, 4
jne 0x18001dc1c
xor r10d, r10d
test r8d, r8d
jle 0x18001dbfe
mov eax, r9d
shr eax, 0x10
inc rdx
mov byte [rdx - 1], al
cmp r8d, 1
jle 0x18001dc10
mov eax, r9d
shr eax, 8
inc rdx
mov byte [rdx - 1], al
cmp r8d, 2
jle 0x18001dc1c
mov byte [rdx], r9b
inc rdx
dec ebx
inc r11
test ebx, ebx
jg 0x18001dbb0
sub edx, ebp
mov dword [rsi], edx
xor eax, eax
mov rbx, qword [rsp + 0x10]
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
pop r12
ret
Function at 0x180020dc0
Capabilities:
Check if file exists
Get common file path
Get program files directory
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x470
mov rax, qword [0x180109f10]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov rdi, qword [rdx]
mov rbx, rcx
lea rcx, [rsp + 0x252]
xor esi, esi
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x250], si
call fcn.18005dcd0
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x250]
lea r9, [rsp + 0x30]
lea rdx, [0x1800e735c]
xor r8d, r8d
mov rcx, rdi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x34], 0x104
mov dword [rsp + 0x30], 1
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rsp + 0x250]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x180020f33
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x42]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x40], si
call fcn.18005dcd0
lea r8d, [rsi + 0x2a]
lea rdx, [rsp + 0x40]
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x40]
repne scasw ax, word [rdi]
mov rax, qword [str.Internet_Exploreriexplore.exe]
lea rcx, [rsp + 0x40]
mov qword [rdi - 2], rax
mov rax, qword [0x1800e74a8]
mov qword [rdi + 6], rax
mov rax, qword [0x1800e74b0]
mov qword [rdi + 0xe], rax
mov rax, qword [0x1800e74b8]
mov qword [rdi + 0x16], rax
mov rax, qword [0x1800e74c0]
mov qword [rdi + 0x1e], rax
mov rax, qword [0x1800e74c8]
mov qword [rdi + 0x26], rax
mov rax, qword [0x1800e74d0]
mov qword [rdi + 0x2e], rax
mov rax, qword [0x1800e74d8]
mov qword [rdi + 0x36], rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x180020f6f
lea rcx, [rsp + 0x40]
lea rdx, [rsp + 0x40]
sub rbx, rcx
nop word [rax + rax]
movzx ecx, word [rdx]
add rdx, 2
mov word [rbx + rdx - 2], cx
test cx, cx
jne 0x180020f20
jmp 0x180020f6a
lea rax, [rsp + 0x250]
lea rcx, [rsp + 0x250]
sub rbx, rax
nop word [rax + rax]
movzx eax, word [rcx]
add rcx, 2
mov word [rbx + rcx - 2], ax
test ax, ax
jne 0x180020f50
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.1800576a0
lea r11, [rsp + 0x470]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x180020fa0
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x280
mov rax, qword [0x180109f10]
xor rax, rsp
mov qword [rsp + 0x270], rax
xor ebx, ebx
lea rcx, [rsp + 0x62]
xor edx, edx
mov r8d, 0x206
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x30], ebx
mov word [rsp + 0x60], bx
call fcn.18005dcd0
lea r11, [rsp + 0x50]
lea rdx, str.http
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000000
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x180021019
xor eax, eax
jmp 0x18002111c
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x38]
lea rdx, str.shell
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180021012
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
lea rdx, str.opencommand
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180021012
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
lea rdx, [0x1800e735c]
xor r8d, r8d
mov dword [rsp + 0x30], 0x104
mov dword [rsp + 0x48], 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x60]
call fcn.18005b208
lea rdx, [0x1800e751c]
mov rcx, rax
call fcn.18005b290
test rax, rax
je 0x180021012
mov qword [rsp + 0x290], rdi
lea rdi, [rax + 2]
lea rdx, [0x1800e751c]
mov rcx, rdi
call fcn.18005b290
test rax, rax
je 0x180021114
mov rcx, rdi
mov word [rax], bx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
setne bl
mov eax, ebx
mov rdi, qword [rsp + 0x290]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1800576a0
add rsp, 0x280
pop rbx
ret
Function at 0x1800212a0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x280
mov rax, qword [0x180109f10]
xor rax, rsp
mov qword [rsp + 0x270], rax
xor ebx, ebx
mov rdi, rcx
lea rcx, [rsp + 0x62]
xor edx, edx
mov r8d, 0x206
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x30], ebx
mov word [rsp + 0x60], bx
call fcn.18005dcd0
lea r11, [rsp + 0x50]
lea rdx, str.htmlfile
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000000
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x180021320
xor eax, eax
jmp 0x1800213e3
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x38]
lea rdx, str.shell
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180021319
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
lea rdx, str.opencommand
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180021319
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
lea rdx, [0x1800e735c]
xor r8d, r8d
mov dword [rsp + 0x30], 0x104
mov dword [rsp + 0x48], 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x60]
call fcn.18005b208
mov rdx, rdi
mov rcx, rax
call fcn.18005b290
test rax, rax
setne bl
mov eax, ebx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1800576a0
mov rbx, qword [rsp + 0x298]
add rsp, 0x280
pop rdi
ret

Function at 0x1800215c0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xfe0
mov rax, qword [0x180109f10]
xor rax, rsp
mov qword [rsp + 0xfd0], rax
mov rbx, rcx
lea rcx, [rsp + 0x30]
mov edx, 0x7d0
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xor ecx, ecx
lea rdx, str.Program_FilesInternet_Exploreriexplore.exe
nop dword [rax + rax]
movzx eax, word [rcx + rdx]
add rcx, 2
mov word [rsp + rcx + 0x3a], ax
test ax, ax
jne 0x180021600
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x30]
repne scasw ax, word [rdi]
xor ecx, ecx
nop word [rax + rax]
movzx eax, word [rbx + rcx]
add rcx, 2
mov word [rdi + rcx - 4], ax
test ax, ax
jne 0x180021630
lea rdx, str.open
xor r9d, r9d
mov r8, rbx
xor ecx, ecx
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x180021677
lea rcx, [rsp + 0x30]
call fcn.180021730
mov rcx, qword [rsp + 0xfd0]
xor rcx, rsp
call fcn.1800576a0
mov rbx, qword [rsp + 0xff8]
add rsp, 0xfe0
pop rdi
ret
Function at 0x180021730
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x8c0
mov rax, qword [0x180109f10]
xor rax, rsp
mov qword [rsp + 0x8b0], rax
xor edx, edx
mov rbx, rcx
lea rcx, [rsp + 0x70]
lea r8d, [rdx + 0x68]
call fcn.18005dcd0
xor eax, eax
lea rdx, [0x1800e737c]
lea rcx, [rsp + 0xe0]
mov r8, rbx
mov dword [rsp + 0x70], WSAGetLastError
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
call fcn.18005ac00
lea r11, [rsp + 0x50]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
lea rdx, [rsp + 0xe0]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1800217ea
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x8b0]
xor rcx, rsp
call fcn.1800576a0
add rsp, 0x8c0
pop rbx
ret

Function at 0x180021a60
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x690
mov rax, qword [0x180109f10]
xor rax, rsp
mov qword [rsp + 0x680], rax
lea rcx, [rsp + 0x472]
xor esi, esi
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x470], si
call fcn.18005dcd0
lea rcx, [rsp + 0x262]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x260], si
call fcn.18005dcd0
mov r11, rsi
lea rcx, str.EXPLORER.EXE
nop word [rax + rax]
movzx eax, word [r11 + rcx]
add r11, 2
mov word [rsp + r11 + 0x46e], ax
test ax, ax
jne 0x180021ad0
lea rcx, [rsp + 0x470]
call fcn.18005b584
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x234
mov dword [rsp + 0x20], esi
mov rdi, rax
call fcn.18005dcd0
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180021ba2
lea rdx, [rsp + 0x20]
mov rcx, rax
mov dword [rsp + 0x20], 0x238
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x180021b99
nop dword [rax]
mov rcx, rsi
movzx eax, word [rsp + rcx + 0x4c]
add rcx, 2
mov word [rsp + rcx + 0x25e], ax
test ax, ax
jne 0x180021b43
lea rcx, [rsp + 0x260]
call fcn.18005b584
mov r8, rdi
sub r8, rax
nop dword [rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x180021b84
add rax, 2
test ecx, ecx
jne 0x180021b70
mov rcx, rbx
test edx, edx
je 0x180021bc9
lea rdx, [rsp + 0x20]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x180021b40
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x680]
xor rcx, rsp
call fcn.1800576a0
lea r11, [rsp + 0x690]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x28]
jmp 0x180021ba4
Function at 0x1800288f0
Capabilities:
Create thread

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rsi
mov rsi, rdx
mov rbx, rcx
mov ecx, 0x98
call fcn.1800576c0
mov qword [rsp + 0x50], rax
test rax, rax
je 0x180028930
mov rcx, rax
call fcn.1800280f0
mov r11, rax
jmp 0x180028933
xor r11d, r11d
mov qword [rbx + 0xc8], r11
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [r11 + 0x10]
mov rdx, rsi
call fcn.180003680
mov rdx, qword [rbx + 0xc8]
mov dword [rdx + 8], 1
mov rcx, qword [rbx + 0xc8]
add rcx, 0x68
mov r8d, 9
lea rdx, str.GET_test1
call fcn.180003680
lea rdx, [rbx + 0x38]
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], 0
mov r9, rbx
lea r8, [0x180028c60]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x40], rax
test rax, rax
je 0x1800289d5
cmp rax, 0xffffffffffffffff
je 0x1800289d5
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x40], 0
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x18002d5a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x60]
movzx eax, byte [rax + 0x100]
mov byte [rsp + 0x21], al
mov rax, qword [rsp + 0x60]
movzx eax, byte [rax + 0x101]
mov byte [rsp + 0x20], al
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x24], 0
jmp 0x18002d5f1
mov eax, dword [rsp + 0x24]
add eax, 1
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x58]
cmp dword [rsp + 0x24], eax
jge 0x18002d6c9
movzx eax, byte [rsp + 0x21]
add eax, 1
cdq
and edx, 0xff
add eax, edx
and eax, 0xff
sub eax, edx
mov byte [rsp + 0x21], al
movzx ecx, byte [rsp + 0x21]
mov rax, qword [rsp + 0x30]
movzx eax, byte [rax + rcx]
movzx ecx, byte [rsp + 0x20]
add eax, ecx
cdq
and edx, 0xff
add eax, edx
and eax, 0xff
sub eax, edx
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + 0x20]
mov rdx, qword [rsp + 0x30]
add rdx, rax
movzx eax, byte [rsp + 0x21]
mov rcx, qword [rsp + 0x30]
add rcx, rax
call fcn.18002d6f0
movzx r11d, byte [rsp + 0x21]
mov rax, qword [rsp + 0x30]
movzx edx, byte [rax + r11]
movzx ecx, byte [rsp + 0x20]
mov rax, qword [rsp + 0x30]
movzx ecx, byte [rax + rcx]
mov eax, edx
add eax, ecx
cdq
and edx, 0xff
add eax, edx
and eax, 0xff
sub eax, edx
mov byte [rsp + 0x28], al
movsxd rdx, dword [rsp + 0x24]
movzx ecx, byte [rsp + 0x28]
mov rax, qword [rsp + 0x30]
movzx ecx, byte [rax + rcx]
mov rax, qword [rsp + 0x50]
movzx edx, byte [rax + rdx]
xor edx, ecx
movsxd rcx, dword [rsp + 0x24]
mov rax, qword [rsp + 0x50]
mov byte [rax + rcx], dl
jmp 0x18002d5e6
mov rcx, qword [rsp + 0x60]
movzx eax, byte [rsp + 0x21]
mov byte [rcx + 0x100], al
mov rcx, qword [rsp + 0x60]
movzx eax, byte [rsp + 0x20]
mov byte [rcx + 0x101], al
add rsp, 0x48
ret

Function at 0x18005b638
Capabilities:
Move file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x18005b64e
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x18005b650
xor eax, eax
test eax, eax
je 0x18005b660
mov ecx, eax
call fcn.180061734
or eax, 0xffffffff
jmp 0x18005b662
xor eax, eax
add rsp, 0x28
ret