joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180071750
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rdi
sub rsp, 0x88
call fcn.18000f3c4
test al, al
je 0x18007176a
xor al, al
jmp 0x1800718de
mov bl, 1
lea rcx, [rsp + 0x30]
call fcn.18001002c
nop
lea rcx, [rsp + 0x58]
call fcn.18000d560
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.18000d6ac
mov dil, al
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x1800717cf
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800717ca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800718e8
call fcn.18009d1f4
test dil, dil
je 0x180071899
lea rdx, str.ConfigOSSProxySettings
lea rcx, [rsp + 0x30]
call fcn.18000d480
lea rdx, [rsp + 0x38]
cmp qword [rsp + 0x50], 0x10
cmovae rdx, qword [rsp + 0x38]
and qword [rsp + 0xb8], 0
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x20], rax
mov r9d, 0x20219
xor r8d, r8d
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x180071899
mov rdi, qword [rsp + 0xb8]
mov dword [rsp + 0xa0], 4
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xa8]
xor r8d, r8d
lea rdx, str.OptionsBitmask
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x18007188a
cmp dword [rsp + 0xa8], 4
jne 0x18007188a
mov eax, dword [rsp + 0xb0]
shr eax, 8
and bl, al
test rdi, rdi
je 0x180071899
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x1800718d3
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800718cd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800718ee
call fcn.18009d1f4
nop
jmp 0x1800718dc
mov al, bl
add rsp, 0x88
pop rdi
pop rbx
ret
call fcn.1800a45b8
nop
call fcn.1800a45b8
int3
Function at 0x180071a20
Capabilities:
Create thread
Encode data using xor

Disassembly:
sub rsp, 0x48
call fcn.18005ceb8
test al, al
jne 0x180071a35
cmp byte [0x18010a5a4], al
je 0x180071a9c
call fcn.18005ceb8
test al, al
jne 0x180071a43
call fcn.180007af8
lea rax, [0x18010a060]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x180068f94]
xor edx, edx
xor ecx, ecx
call fcn.1800a8cdc
mov qword [0x18010a068], rax
test rax, rax
jne 0x180071a9c
and dword [rsp + 0x30], eax
and dword [rsp + 0x28], eax
and dword [rsp + 0x20], eax
lea r9, str.Couldnt_start_new_thread
lea r8, str.StartBrowserMonitor
lea rdx, str.OSMIMHK
lea ecx, [rax + 1]
call fcn.18005dd20
call fcn.1800478b8
test eax, eax
jne 0x180071b67
call fcn.180072560
mov rcx, rax
lea rdx, str.IM_Capture
call fcn.18009040c
test eax, eax
jne 0x180071b10
cmp byte [0x18010a364], al
je 0x180071b67
lea rcx, [rsp + 0x50]
call fcn.18006da5c
mov r8, rax
cmp byte [rax + 0x20], 0
je 0x180071b5a
xor r9d, r9d
movabs r10, 0xd993efbb19cfe32d
mov cl, r9b
and cl, 7
shl cl, 3
mov rax, r10
shr rax, cl
xor byte [r9 + r8], al
inc r9
cmp r9, 0x20
jb 0x180071aed
mov byte [r8 + 0x20], 0
jmp 0x180071b5a
cmp byte [0x18010a364], 0
je 0x180071b67
lea rcx, [rsp + 0x50]
call fcn.18006e160
mov r8, rax
cmp byte [rax + 0x34], 0
je 0x180071b5a
xor r9d, r9d
movabs r10, 0xd993efbb19cfe32d
mov cl, r9b
and cl, 7
shl cl, 3
mov rax, r10
shr rax, cl
xor byte [r9 + r8], al
inc r9
cmp r9, 0x34
jb 0x180071b39
mov byte [r8 + 0x34], 0
mov rdx, r8
mov ecx, 4
call fcn.18006a848
add rsp, 0x48
ret
Function at 0x180074098
Capabilities:
Accept command line arguments
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [0x18010a364], 0
mov ebx, ecx
je 0x1800740f3
lea rcx, [rsp + 0x30]
call fcn.18006df00
mov rdx, rax
cmp byte [rax + 0x17], 0
je 0x1800740e6
xor r8d, r8d
mov cl, r8b
movabs rax, 0xd993efbb19cfe32d
and cl, 7
shl cl, 3
shr rax, cl
xor byte [r8 + rdx], al
inc r8
cmp r8, 0x17
jb 0x1800740bf
mov byte [rdx + 0x17], 0
mov r8d, ebx
mov ecx, 4
call fcn.18006a848
mov dword [0x180117004], ebx
test ebx, ebx
je 0x18007412d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [section.Shared], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov r8d, 0x400
lea rcx, [0x180117010]
mov rdx, rax
call fcn.1800a8850
mov byte [0x18011740f], 0
jmp 0x180074134
or dword [section.Shared], 0xffffffff
mov eax, 1
add rsp, 0x20
pop rbx
ret
Function at 0x180074838
Capabilities:
Inject dll
Inject thread

Disassembly:
sub rsp, 0x28
xor eax, eax
test r8, r8
je 0x18007484b
mov rcx, r8
call fcn.1800a83fc
mov ecx, eax
add rsp, 0x28
jmp 0x1800946c0
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x40
and qword [rax + 0x20], 0
mov ebp, ecx
xor r15b, r15b
xor ebx, ebx
xor esi, esi
xor edi, edi
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov ecx, 0x1fffff
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
test rax, rax
jne 0x180094767
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [0x18010a364], bl
mov ebp, eax
je 0x180094898
lea rcx, [rsp + 0x78]
call fcn.18007ea34
mov rdx, rax
cmp byte [rax + 0x30], bl
je 0x180094755
xor r8d, r8d
mov cl, r8b
movabs rax, 0xd993efbb19cfe32d
and cl, 7
shl cl, 3
shr rax, cl
xor byte [r8 + rdx], al
inc r8
cmp r8, 0x30
jb 0x18009472f
mov byte [rdx + 0x30], bl
mov r8d, ebp
mov ecx, 4
call fcn.18006a848
jmp 0x180094898
lea r8, [rsp + 0x88]
mov edx, 0x28
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x18009488f
mov rcx, qword [rsp + 0x88]
lea rdx, str.SeDebugPrivilege
mov r8d, 1
call fcn.180093b38
mov r8d, ebp
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x18009488f
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp ebp, eax
je 0x18009488f
lea rcx, str.Kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbp, rax
test rax, rax
je 0x18009488f
xor edx, edx
mov dword [rsp + 0x20], 4
mov r9d, 0x1000
mov r8d, 0x105
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rsi, rax
test rax, rax
je 0x18009488f
and qword [rsp + 0x20], rdi
lea r8, [0x18010a700]
mov r9d, 0x105
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x18009488f
lea rdx, [0x1800d6d78]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
and qword [rsp + 0x30], rdi
xor r8d, r8d
and dword [rsp + 0x28], edi
mov r9, rax
xor edx, edx
mov qword [rsp + 0x20], rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rdi, rax
test rax, rax
je 0x18009488f
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rsp + 0x80]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [rsp + 0x80], 0
setne r15b
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x1800948ab
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x1800948b9
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rdi, rdi
je 0x1800948c7
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rsi, rsi
je 0x1800948e4
mov r9d, 0x8000
mov r8d, 0x105
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rbx, qword [rsp + 0x70]
mov al, r15b
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x180075560
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x70
cmp dword [rdx + 0x148], 0
mov rbx, rdx
je 0x180075684
mov ecx, dword [rdx + 0x110]
sub ecx, 1
je 0x1800755d0
sub ecx, 1
je 0x1800755c7
sub ecx, 1
je 0x1800755be
sub ecx, 1
je 0x1800755b5
sub ecx, 1
je 0x1800755ac
cmp ecx, 1
je 0x1800755a3
lea rdx, str.UNKNOWN_
jmp 0x1800755d7
lea rdx, [0x1800d608c]
jmp 0x1800755d7
lea rdx, str.MPEG
jmp 0x1800755d7
lea rdx, str.ASF_Media
jmp 0x1800755d7
lea rdx, str.MP3_Media
jmp 0x1800755d7
lea rdx, str.ID3_Media
jmp 0x1800755d7
lea rdx, str.Flash_Video
lea rcx, [rsp + 0x50]
call fcn.18000f45c
cmp byte [0x18010a364], 0
je 0x180075684
lea rcx, [rsp + 0x88]
call fcn.180074f68
mov r10, rax
cmp byte [rax + 0xa5], 0
je 0x180075635
xor eax, eax
mov cl, al
movabs r8, 0xd993efbb19cfe32d
and cl, 7
shl cl, 3
shr r8, cl
xor byte [rax + r10], r8b
inc rax
cmp rax, 0xa5
jb 0x180075609
mov byte [r10 + 0xa5], 0
mov eax, dword [rbx + 0x148]
lea rcx, [rbx + 0x114]
mov r9, qword [rbx + 0x108]
mov r8, rbx
mov dword [rsp + 0x40], eax
mov rdx, r10
mov rax, qword [rbx + 0x160]
mov qword [rsp + 0x38], rax
mov rax, qword [rbx + 0x158]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov ecx, 3
call fcn.18006a848
xor eax, eax
add rsp, 0x70
pop rbx
ret
Function at 0x1800759f4
Capabilities:
Check for time delay via gettickcount
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov ebx, r8d
mov rdi, rdx
lea rcx, [rsp + 0x30]
call fcn.18003d8c0
nop
test ebx, ebx
jne 0x180075a3a
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [rdi + 0x178]
cmp eax, 0x3e8
jb 0x180075b85
mov ebx, 0x139
mov r8d, ebx
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.1800a02d0
movups xmm0, xmmword [rdi + 0x114]
movdqu xmmword [rsp + 0x50], xmm0
mov rcx, rdi
lea rdx, [rsp + 0x61]
sub rdx, rdi
mov al, byte [rcx]
mov byte [rdx + rcx], al
inc rcx
test al, al
jne 0x180075a66
mov eax, dword [rdi + 0x13c]
mov dword [rbp + 0x65], eax
mov eax, dword [rdi + 0x144]
mov dword [rbp + 0x69], eax
mov rax, qword [rdi + 0x158]
mov qword [rbp + 0x6d], rax
mov rax, qword [rdi + 0x160]
mov qword [rbp + 0x75], rax
mov eax, dword [rdi + 0x17c]
mov dword [rbp + 0x81], eax
mov eax, dword [rdi + 0x180]
mov dword [rbp + 0x85], eax
inc eax
mov dword [rdi + 0x180], eax
mov edx, 0x539
lea rcx, [rsp + 0x30]
call fcn.18003e08c
xor r9d, r9d
mov r8d, ebx
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.18003de9c
call fcn.180049c04
mov rcx, rax
mov r8d, 0x2710
lea rdx, [rsp + 0x30]
call fcn.180077c5c
cmp byte [0x18010a364], 0
je 0x180075b69
lea rcx, [rbp + 0xb0]
call fcn.180074e5c
mov r10, rax
cmp byte [rax + 0x4c], 0
je 0x180075b3e
xor r9d, r9d
mov cl, r9b
and cl, 7
shl cl, 3
movabs r8, 0xd993efbb19cfe32d
shr r8, cl
xor byte [r9 + rax], r8b
inc r9
cmp r9, 0x4c
jb 0x180075b17
mov byte [rax + 0x4c], 0
mov rax, qword [rbp + 0x75]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0x6d]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x85]
lea r8, [rsp + 0x50]
mov rdx, r10
mov ecx, 3
call fcn.18006a848
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rdi + 0x178], eax
cmp dword [rdi + 0x17c], 0
je 0x180075b85
and dword [rdi + 0x17c], 0
lea rcx, [rsp + 0x30]
call fcn.18001d6c0
xor eax, eax
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x180076780
Capabilities:
Check mutex on windows

Disassembly:
mov r8, rdx
mov edx, ecx
lea rcx, [0x18010ad50]
jmp 0x180076794
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x40
mov r14, r8
mov esi, edx
mov rdi, rcx
mov qword [rbp + 0x30], rcx
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x1800767c8
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
mov byte [r14], 0
mov r8d, esi
lea rdx, [rbp + 0x20]
mov rcx, rdi
call fcn.180076904
mov rbx, qword [rbp + 0x20]
cmp rbx, qword [rdi + 8]
jne 0x1800767ec
xor ebx, ebx
jmp 0x1800768d6
cmp byte [rbx + 0x30], 0
jne 0x1800768cc
mov qword [rbp - 8], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x10], 8
movabs rax, 0x5c6e6f6973736553
mov qword [rbp - 0x20], rax
mov byte [rbp - 0x18], 0
xor eax, eax
mov dword [rbp + 0x20], eax
mov byte [rbp + 0x24], al
mov r8d, esi
lea rdx, [0x1800d448c]
lea rcx, [rbp + 0x20]
call fcn.180076098
lea rax, [rbp + 0x20]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x18007683b
lea rdx, [rbp + 0x20]
lea rcx, [rbp - 0x20]
call fcn.180002f70
mov r8d, reloc.WS2_32.dll_inet_ntoa
lea rdx, [0x1800d6198]
lea rcx, [rbp - 0x20]
call fcn.180002f70
lea r8, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae r8, qword [rbp - 0x20]
xor edx, edx
mov ecx, CoInitializeEx
call qword [sym.imp.KERNEL32.dll_OpenMutexA]
test rax, rax
je 0x180076895
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [rbx + 0x30], 1
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x1800768cc
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800768c7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800768fb
call fcn.18009d1f4
mov al, byte [rbx + 0x30]
mov byte [r14], al
mov rbx, qword [rbx + 0x28]
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x1800768e5
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, rbx
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rbp
ret
call fcn.1800a45b8
nop
int3
Function at 0x180076794
Capabilities:
Check mutex on windows

Disassembly:
mov r8, rdx
mov edx, ecx
lea rcx, [0x18010ad50]
jmp 0x180076794
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x40
mov r14, r8
mov esi, edx
mov rdi, rcx
mov qword [rbp + 0x30], rcx
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x1800767c8
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
mov byte [r14], 0
mov r8d, esi
lea rdx, [rbp + 0x20]
mov rcx, rdi
call fcn.180076904
mov rbx, qword [rbp + 0x20]
cmp rbx, qword [rdi + 8]
jne 0x1800767ec
xor ebx, ebx
jmp 0x1800768d6
cmp byte [rbx + 0x30], 0
jne 0x1800768cc
mov qword [rbp - 8], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x10], 8
movabs rax, 0x5c6e6f6973736553
mov qword [rbp - 0x20], rax
mov byte [rbp - 0x18], 0
xor eax, eax
mov dword [rbp + 0x20], eax
mov byte [rbp + 0x24], al
mov r8d, esi
lea rdx, [0x1800d448c]
lea rcx, [rbp + 0x20]
call fcn.180076098
lea rax, [rbp + 0x20]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x18007683b
lea rdx, [rbp + 0x20]
lea rcx, [rbp - 0x20]
call fcn.180002f70
mov r8d, reloc.WS2_32.dll_inet_ntoa
lea rdx, [0x1800d6198]
lea rcx, [rbp - 0x20]
call fcn.180002f70
lea r8, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae r8, qword [rbp - 0x20]
xor edx, edx
mov ecx, CoInitializeEx
call qword [sym.imp.KERNEL32.dll_OpenMutexA]
test rax, rax
je 0x180076895
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [rbx + 0x30], 1
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x1800768cc
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800768c7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800768fb
call fcn.18009d1f4
mov al, byte [rbx + 0x30]
mov byte [r14], al
mov rbx, qword [rbx + 0x28]
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x1800768e5
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, rbx
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rbp
ret
call fcn.1800a45b8
nop
int3
Function at 0x180077180
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x50
mov r14, rdx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x18], xmm0
and qword [rbp - 8], 0
movdqu xmmword [rbp - 0x30], xmm0
and qword [rbp - 0x20], 0
xor ebx, ebx
xor edi, edi
xor esi, esi
add rcx, 0x18
lea r9, [rbp - 0x30]
lea r8, [rbp - 0x18]
call fcn.180011058
mov rax, qword [rbp - 0x10]
mov rcx, qword [rbp - 0x18]
sub rax, rcx
sar rax, 3
mov r8, qword [rbp - 0x30]
cmp rax, 2
jne 0x18007724d
mov r9, qword [rbp - 0x28]
sub r9, r8
sar r9, 2
cmp rax, r9
jne 0x18007724d
xor r11d, r11d
test r9, r9
je 0x18007721d
xor edx, edx
mov r10d, dword [r8 + rdx*4]
test r10d, r10d
je 0x18007720e
cmp r10d, 1
jne 0x180077212
mov rsi, qword [rcx + rdx*8]
jmp 0x180077212
mov rdi, qword [rcx + rdx*8]
inc r11d
mov edx, r11d
cmp rdx, r9
jb 0x1800771f9
mov ecx, 0x28
call fcn.18009d1b8
mov qword [rbp + 0x20], rax
test rax, rax
je 0x180077249
mov r9d, 0x10000
mov r8, rsi
mov rdx, rdi
mov rcx, rax
call fcn.180040188
mov rbx, rax
jmp 0x18007724b
xor ebx, ebx
jmp 0x18007729e
cmp byte [0x18010a364], bl
je 0x1800772a6
lea rcx, [rbp + 0x20]
call fcn.180076df8
mov r9, rax
cmp byte [rax + 0x2d], bl
je 0x18007728e
xor edx, edx
mov cl, dl
and cl, 7
shl cl, 3
movabs rax, 0xd993efbb19cfe32d
shr rax, cl
xor byte [rdx + r9], al
inc rdx
cmp rdx, 0x2d
jb 0x180077268
mov byte [r9 + 0x2d], bl
mov r8, r14
mov rdx, r9
mov ecx, 2
call fcn.18006a848
mov r8, qword [rbp - 0x30]
mov rcx, qword [rbp - 0x18]
mov edi, 0x1000
test r8, r8
je 0x1800772f9
mov rax, qword [rbp - 0x20]
sub rax, r8
sar rax, 2
lea rdx, [rax*4]
mov rax, r8
cmp rdx, rdi
jb 0x1800772e0
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180077349
mov rcx, r8
call fcn.18009d1f4
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x30], xmm0
and qword [rbp - 0x20], 0
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x18007732b
mov rdx, qword [rbp - 8]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
mov rax, rcx
cmp rdx, rdi
jb 0x180077326
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180077343
call fcn.18009d1f4
mov rax, rbx
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.1800a45b8
nop
call fcn.1800a45b8
nop
int3
Function at 0x1800779ac
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov r14, rdx
xor eax, eax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rax
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x18], xmm0
mov qword [rbp - 8], rax
mov edi, eax
mov r15d, eax
mov r12d, eax
mov r13d, eax
mov qword [rbp + 0x50], rax
mov ebx, eax
lea rsi, [rcx + 0x18]
lea r9, [rbp - 0x18]
lea r8, [rbp - 0x30]
mov rdx, r14
mov rcx, rsi
call fcn.180011058
mov rcx, qword [rbp - 0x30]
mov rax, qword [rbp - 0x28]
cmp rcx, rax
jne 0x180077a2f
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 0xa
jb 0x1800779f5
mov rax, qword [rbp - 0x28]
mov rcx, qword [rbp - 0x30]
sub rax, rcx
sar rax, 3
mov r8, qword [rbp - 0x18]
cmp rax, 4
jne 0x180077ae0
mov r10, qword [rbp - 0x10]
sub r10, r8
sar r10, 2
cmp rax, r10
jne 0x180077ae0
xor r11d, r11d
test r10, r10
je 0x180077aa2
xor edx, edx
mov r9d, dword [r8 + rdx*4]
test r9d, r9d
je 0x180077a93
sub r9d, 1
je 0x180077a8d
sub r9d, 1
je 0x180077a83
cmp r9d, 1
jne 0x180077a97
mov r13, qword [rcx + rdx*8]
jmp 0x180077a97
mov rax, qword [rcx + rdx*8]
mov qword [rbp + 0x50], rax
jmp 0x180077a97
mov r12, qword [rcx + rdx*8]
jmp 0x180077a97
mov r15, qword [rcx + rdx*8]
inc r11d
mov edx, r11d
cmp rdx, r10
jb 0x180077a62
mov ecx, 0x50
call fcn.18009d1b8
mov qword [rbp + 0x58], rax
test rax, rax
je 0x180077adc
mov dword [rsp + 0x28], CoInitializeEx
mov rcx, qword [rbp + 0x50]
mov qword [rsp + 0x20], rcx
mov r9, r13
mov r8, r12
mov rdx, r15
mov rcx, rax
call fcn.18003e6e4
mov rdi, rax
jmp 0x180077ade
xor edi, edi
jmp 0x180077b32
cmp byte [0x18010a364], dil
je 0x180077b3a
lea rcx, [rbp + 0x50]
call fcn.180076fc4
mov rdx, rax
cmp byte [rax + 0x2d], dil
je 0x180077b25
xor r8d, r8d
mov cl, r8b
and cl, 7
shl cl, 3
movabs rax, 0xd993efbb19cfe32d
shr rax, cl
xor byte [r8 + rdx], al
inc r8
cmp r8, 0x2d
jb 0x180077afe
mov byte [rdx + 0x2d], dil
mov r8, r14
mov ecx, 2
call fcn.18006a848
mov r8, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x30]
mov ebx, 0x1000
test r8, r8
je 0x180077b8d
mov rax, qword [rbp - 8]
sub rax, r8
sar rax, 2
lea rdx, [rax*4]
mov rax, r8
cmp rdx, rbx
jb 0x180077b74
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180077be0
mov rcx, r8
call fcn.18009d1f4
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x18], xmm0
and qword [rbp - 8], 0
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x180077bbf
mov rdx, qword [rbp - 0x20]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
mov rax, rcx
cmp rdx, rbx
jb 0x180077bba
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180077bda
call fcn.18009d1f4
mov rax, rdi
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1800a45b8
nop
call fcn.1800a45b8
nop
int3
Function at 0x180081040
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
cmp byte [0x18010b098], 0
mov r14, rdx
mov rbp, rcx
je 0x18008115e
cmp byte [0x18010b09c], 0
jne 0x18008115e
mov ecx, dword [0x18010aedc]
call fcn.180099868
mov ecx, dword [0x18010aee0]
mov rdi, rax
call fcn.180099868
mov ebx, dword [0x180102ad0]
mov rsi, rax
test ebx, ebx
jns 0x1800810b6
test rdi, rdi
je 0x1800810b6
mov r8d, 0x200
mov rdx, rbp
mov rcx, rdi
call fcn.1800864b4
mov ebx, eax
mov dword [0x180102ad0], eax
mov eax, dword [0x180102ad4]
test eax, eax
jns 0x1800810dc
test rsi, rsi
je 0x1800810dc
mov r8d, 0x20
mov rdx, r14
mov rcx, rsi
call fcn.1800864b4
mov dword [0x180102ad4], eax
test ebx, ebx
js 0x18008115e
test eax, eax
js 0x18008115e
cmp byte [0x18010a364], 0
mov byte [0x18010b09c], 1
je 0x180081155
lea rcx, [rsp + 0x50]
call fcn.18007de44
cmp byte [rax + 0x17], 0
je 0x18008112e
xor r9d, r9d
mov cl, r9b
movabs r8, 0xd993efbb19cfe32d
and cl, 7
shl cl, 3
shr r8, cl
xor byte [r9 + rax], r8b
inc r9
cmp r9, 0x17
jb 0x180081107
mov byte [rax + 0x17], 0
mov r9d, dword [0x180102ad4]
mov rdx, rax
mov r8d, dword [0x180102ad0]
mov ecx, 4
call fcn.18006a848
mov eax, dword [0x180102ad4]
mov ebx, dword [0x180102ad0]
mov edx, eax
mov ecx, ebx
call fcn.180094adc
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x180082518
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0xb0]
sub rsp, 0x1b0
xorps xmm0, xmm0
mov rdi, rcx
movups xmmword [rsp + 0x30], xmm0
mov ebx, 0x10000
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
mov r9d, gethostbyname
lea r8, [rsp + 0x30]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
test rax, rax
je 0x180082622
cmp dword [rsp + 0x50], 0x1000
jne 0x18008260b
test dword [rsp + 0x54], 0x100
jne 0x18008260b
xor edx, edx
lea rcx, [rsp + 0x60]
lea r8d, [rdx + 0x40]
call fcn.1800a02d0
and qword [rsp + 0x20], 0
lea r8, [rsp + 0x60]
mov r9d, 0x40
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x18008260b
mov eax, 0x5a4d
cmp word [rsp + 0x60], ax
jne 0x18008260b
xor edx, edx
lea rcx, [rbp - 0x60]
mov r8d, 0x108
call fcn.1800a02d0
movsxd rdx, dword [rbp - 0x64]
lea r8, [rbp - 0x60]
and qword [rsp + 0x20], 0
add rdx, rbx
mov r9d, 0x108
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x18008260b
cmp dword [rbp - 0x60], 0x4550
jne 0x18008260b
mov eax, 0x2000
test word [rbp - 0x4a], ax
je 0x18008261d
mov rbx, qword [rsp + 0x48]
mov rcx, rdi
add rbx, qword [rsp + 0x30]
jmp 0x18008254c
mov rax, rbx
jmp 0x18008262a
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
lea r11, [rsp + 0x1b0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret

Function at 0x180082640
Capabilities:
Get process image filename

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x230
mov rbx, r8
mov rdi, rdx
mov r8d, ecx
xor edx, edx
mov ecx, 0x100400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbx], rax
mov rsi, rax
test rax, rax
je 0x180082701
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x208
call fcn.1800a02d0
mov r8d, 0x208
lea rdx, [rsp + 0x20]
mov rcx, rsi
call sub.PSAPI.DLL_GetProcessImageFileNameA
test eax, eax
jne 0x1800826af
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and qword [rbx], 0
jmp 0x180082701
lea rax, [rsp + 0x20]
or rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x1800826b8
cmp rbx, qword [rdi + 0x18]
ja 0x1800826ee
cmp qword [rdi + 0x18], 0x10
mov rsi, rdi
jb 0x1800826d4
mov rsi, qword [rdi]
mov r8, rbx
mov qword [rdi + 0x10], rbx
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.18009fc20
mov byte [rsi + rbx], 0
jmp 0x180082701
lea r9, [rsp + 0x20]
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call fcn.180003a38
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret