joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10003d144
Capabilities:
Copy file
Delete file

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
mov rbx, rcx
mov edx, dword [rcx + 0x50]
sub edx, dword [rcx + 0x48]
mov r8, qword [rcx + 0x48]
add rcx, 0x60
call fcn.10003beec
lea r8, [0x10005b130]
mov edx, 1
lea rcx, [rbx + 0x60]
call fcn.10003bf70
mov edx, dword [rbx + 0x38]
sub edx, dword [rbx + 0x30]
mov r8, qword [rbx + 0x30]
lea rcx, [rbx + 0x60]
call fcn.10003bf70
lea r8, str..xml
mov edx, 4
lea rcx, [rbx + 0x60]
call fcn.10003bf70
lea rdx, [0x10005b170]
mov qword [rsp + 0x28], rdx
and qword [rsp + 0x30], 0
lea rdx, [rsp + 0x28]
mov rcx, rbx
call fcn.10003cea4
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x10003d1eb
cmp rcx, 0xffffffffffffffff
je 0x10003d1eb
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0xc0]
test rcx, rcx
je 0x10003d20a
mov eax, dword [rbx + 0xcc]
test eax, eax
je 0x10003d20a
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_FlushViewOfFile]
xor r8d, r8d
mov rdx, qword [rbx + 0x78]
mov rcx, qword [rbx + 0x60]
call qword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, dword [rbx + 0xa8]
cmp dword [rbx + 0xac], eax
jne 0x10003d2b8
mov eax, dword [rbx + 0xac]
test eax, eax
jne 0x10003d23b
xor esi, esi
jmp 0x10003d268
mov ecx, dword [rbx + 0xb0]
mov rsi, rcx
imul rsi, rsi, 0x53
add rsi, qword [rbx + 0xb8]
dec eax
mov dword [rbx + 0xac], eax
lea eax, [rcx + 1]
xor edx, edx
div dword [rbx + 0xa8]
mov dword [rbx + 0xb0], edx
mov edx, dword [rbx + 0x50]
sub edx, dword [rbx + 0x48]
mov r8, qword [rbx + 0x48]
lea rcx, [rbx + 0x60]
call fcn.10003beec
lea r8, [0x10005b130]
mov edx, 1
lea rcx, [rbx + 0x60]
call fcn.10003bf70
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasb al, byte [rdi]
not rcx
lea rdx, [rcx - 1]
mov r8, rsi
lea rcx, [rbx + 0x60]
call fcn.10003bf70
mov rcx, qword [rbx + 0x60]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov r9, qword [rbx + 0x90]
mov eax, dword [rbx + 0xa8]
cmp dword [rbx + 0xac], eax
je 0x10003d32f
mov edx, dword [rbx + 0xb4]
imul rdx, rdx, 0x53
mov rax, qword [rbx + 0xb8]
mov byte [rdx + rax], 0
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r9
repne scasb al, byte [rdi]
not rcx
and ecx, ecx
cmp ecx, 0x52
ja 0x10003d313
mov r8d, ecx
mov ecx, dword [rbx + 0xb4]
imul rcx, rcx, 0x53
add rcx, qword [rbx + 0xb8]
mov rdx, r9
call sub.msvcrt.dll_memcpy
inc dword [rbx + 0xac]
mov eax, dword [rbx + 0xb4]
inc eax
xor edx, edx
div dword [rbx + 0xa8]
mov dword [rbx + 0xb4], edx
mov rdx, qword [rbx + 0xc0]
lea rdi, [rdx + 0x10]
lea rcx, [rdx + 0x80000]
cmp rdi, rcx
jae 0x10003d35a
sub rcx, rdi
dec rcx
shr rcx, 2
inc rcx
mov eax, 0x200020
rep stosd dword [rdi], eax
movdqu xmm0, xmmword [str._r_n__LOG_]
movdqu xmmword [rdx + 0x7fff0], xmm0
mov dword [rbx + 0xc8], 0x10
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x100047498
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x10004755e
test rdx, rdx
je 0x10004755e
xor r9d, r9d
lea rdx, [0x10005b740]
lea esi, [r9 + 1]
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
jne 0x1000474df
xor ebx, ebx
jmp 0x1000474ee
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
lea rdx, [0x10005b740]
xor r9d, r9d
mov r8, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
je 0x100047515
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rbx, rbx
je 0x100047553
test rax, rax
je 0x100047553
mov ecx, 0xfecdfecd
cmp dword [rbx], ecx
jne 0x10004754d
cmp dword [rax], ecx
jne 0x10004754d
mov rdx, qword [rbx + 0x1c]
cmp rdx, qword [rax + 0x1c]
jne 0x100047544
mov rdx, qword [rbx + 0x24]
cmp rdx, qword [rax + 0x24]
jne 0x100047544
xor eax, eax
jmp 0x100047549
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x10004754f
xor esi, esi
mov eax, esi
jmp 0x100047560
mov ecx, 0xd
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x100047650
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x10006e0c8]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov eax, dword [0x1000706cc]
test eax, eax
jne 0x100047755
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x11c
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x1000476b3
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], VarUI4FromDisp
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov ecx, dword [rsp + 0x30]
mov edx, dword [rsp + 0x24]
xor eax, eax
lea r8d, [rax + 1]
mov dword [0x1000706cc], eax
sub ecx, r8d
je 0x100047735
cmp ecx, r8d
jne 0x100047755
cmp edx, 5
jne 0x100047723
mov ecx, dword [rsp + 0x28]
test ecx, ecx
je 0x10004771c
sub ecx, r8d
je 0x100047707
cmp ecx, r8d
je 0x1000476f1
lea eax, [rdx + 0xf]
jmp 0x10004774f
cmp word [rsp + 0x134], r8w
mov ecx, 0x10
cmovae eax, ecx
or eax, 4
jmp 0x10004774f
mov edx, 8
lea ecx, [rdx - 6]
cmp word [rsp + 0x134], cx
cmovae eax, edx
jmp 0x100047702
mov eax, 4
jmp 0x10004774f
cmp edx, 4
ja 0x10004776d
mov ecx, 2
mov eax, ecx
mov dword [0x1000706cc], ecx
cmp edx, 4
jne 0x100047755
mov ecx, dword [rsp + 0x28]
test ecx, ecx
je 0x10004774c
cmp ecx, 0xa
je 0x10004774c
cmp ecx, 0x5a
jne 0x100047755
mov eax, r8d
mov dword [0x1000706cc], eax
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.100001670
add rsp, 0x158
ret
mov eax, 0x20
jmp 0x10004774f
Function at 0x10004823c
Capabilities:
Encode data using add xor sub operations

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov r9, qword [0x10006e110]
mov rbx, qword [0x10006e120]
mov rdi, qword [0x10006e118]
mov rsi, qword [0x10006e100]
lea eax, [rdx - 1]
mov r11d, r8d
mov r10d, edx
lea r8, [rcx + rax*4]
test edx, edx
je 0x1000482b6
mov edx, r11d
mov eax, r11d
shr rax, 0x10
movzx ecx, al
mov eax, r11d
mov r11d, dword [rdi + rcx*4]
shr rax, 8
movzx eax, al
xor r11d, dword [rbx + rax*4]
mov rax, rdx
shr rax, 0x18
xor r11d, dword [rsi + rax*4]
movzx eax, dl
xor r11d, dword [r9 + rax*4]
xor r11d, dword [r8]
sub r8, 4
add r10d, 0xffffffff
jne 0x100048278
mov eax, r11d
shr rax, 0x10
movzx ecx, al
mov eax, r11d
mov edx, dword [rdi + rcx*4]
mov rdi, qword [rsp + 0x18]
shr rax, 8
movzx eax, al
mov ecx, r11d
xor edx, dword [rbx + rax*4]
mov rbx, qword [rsp + 8]
shr rcx, 0x18
xor edx, dword [rsi + rcx*4]
mov rsi, qword [rsp + 0x10]
movzx ecx, r11b
xor edx, dword [r9 + rcx*4]
xor edx, r11d
mov eax, edx
ret
Function at 0x14002ada0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14002adad
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14002adbd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14002ada5
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x14002add5
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14002adc2
sub eax, 3
jb 0x14002adef
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14002ae26
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x14002ae16
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14002ae14
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14002ae03
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.14002ad62
jmp 0x14002adad
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x12600
mov dl, 5
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14002ae76
cmp rsi, rcx
jae 0x14002ae7e
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x14002ae5d
cmp al, 0x8f
ja 0x14002ae5d
cmp byte [rsi - 2], 0xf
je 0x14002ae63
sub al, 0xe8
cmp al, 1
ja 0x14002ae47
cmp rsi, rcx
jae 0x14002ae7e
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x14002ae4d
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14002ae7e
lodsb al, byte [rsi]
jmp 0x14002ae5d
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x27000]
mov eax, dword [rdi]
or eax, eax
je 0x14002aee7
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x2bb48]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14002ae8b
jns 0x14002aec0
movzx rdx, word [rdi]
add rdi, 2
jmp 0x14002aeca
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14002aee1
mov qword [rbx], rax
add rbx, 8
jmp 0x14002aeab
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x14002af21
cmp al, 0xef
ja 0x14002af13
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x14002aef3
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x14002af02
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x237]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14002af75
sub rsp, 0xffffffffffffff80
jmp 0x140011010
Function at 0x140083ba0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x140083bad
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x140083bbd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140083ba5
lea eax, [rcx + 1]
jmp 0x140083bcb
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x140083bde
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140083bc4
sub eax, 3
jb 0x140083bfe
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x140083c4d
sar eax, 1
movsxd rbp, eax
jb 0x140083c34
jmp 0x140083c0c
add ebx, ebx
jne 0x140083c0a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140083c34
inc ecx
add ebx, ebx
jne 0x140083c1a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140083c34
call r11
adc ecx, ecx
add ebx, ebx
jne 0x140083c2d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x140083c1c
add ecx, 2
jmp 0x140083c39
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.140083b62
jmp 0x140083bad
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x36600
mov dl, 0x11
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x140083c99
cmp rsi, rcx
jae 0x140083ca1
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x140083c80
cmp al, 0x8f
ja 0x140083c80
cmp byte [rsi - 2], 0xf
je 0x140083c86
sub al, 0xe8
cmp al, 1
ja 0x140083c6a
cmp rsi, rcx
jae 0x140083ca1
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x140083c70
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x140083ca1
lodsb al, byte [rsi]
jmp 0x140083c80
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x80000]
mov eax, dword [rdi]
or eax, eax
je 0x140083cfe
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x8d308]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140083cae
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140083cf8
mov qword [rbx], rax
add rbx, 8
jmp 0x140083cce
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x140083d38
cmp al, 0xef
ja 0x140083d2a
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140083d0a
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x140083d19
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x257]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140083d8c
sub rsp, 0xffffffffffffff80
jmp 0x140024640
Function at 0x180001000
Capabilities:
Create process memory minidump
Delete file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x60
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rbx, rcx
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0xa0], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
lea rdx, [0x18007e0f8]
lea rcx, [rsp + 0xa0]
call fcn.180001a50
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x98], rdi
mov ecx, 1
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
mov esi, 0x104
sub eax, esi
or eax, ecx
jge 0x18000109b
mov edx, esi
lea rcx, [rsp + 0x98]
call fcn.180001790
mov rdi, qword [rsp + 0x98]
call fcn.18001dda4
mov rcx, rax
mov r8d, esi
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
movsxd rdx, dword [rdi - 0xc]
mov rcx, rdi
call fcn.18005215c
xor ebp, ebp
cmp eax, ebp
jl 0x18000122b
cmp eax, dword [rdi - 0xc]
jg 0x18000122b
mov dword [rdi - 0x10], eax
cdqe
mov word [rdi + rax*2], bp
lea r8, [rsp + 0xa0]
lea rdx, [0x18007e100]
lea rcx, [rsp + 0xa8]
call fcn.180001514
nop
mov rdx, qword [rax]
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x98]
call fcn.1800017d8
nop
mov rdx, qword [rsp + 0xa8]
add rdx, 0xffffffffffffffe8
or r12, 0xffffffffffffffff
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, r12d
cmp eax, ebp
jg 0x180001131
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
mov rcx, r12
lea rdx, str..normal.dmp
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rcx, [rsp + 0x98]
call fcn.1800017d8
mov rdi, qword [rsp + 0x98]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, r12
je 0x1800011e8
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x48], eax
mov qword [rsp + 0x4c], rbx
mov dword [rsp + 0x54], ebp
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbp
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, rsi
mov edx, ebx
call sub.dbghelp.dll_MiniDumpWriteDump
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rdx, [rdi - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, r12d
cmp eax, ebp
jg 0x180001205
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0xa0]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, r12d
cmp eax, ebp
jg 0x180001236
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x180001236
mov ecx, 0x80070057
call fcn.180001af4
nop
add rsp, 0x60
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180001244
Capabilities:
Create process memory minidump
Delete file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x60
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rbx, rcx
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0xa0], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
lea rdx, [0x18007e0f8]
lea rcx, [rsp + 0xa0]
call fcn.180001a50
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x98], rdi
mov ecx, 1
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
mov esi, 0x104
sub eax, esi
or eax, ecx
jge 0x1800012df
mov edx, esi
lea rcx, [rsp + 0x98]
call fcn.180001790
mov rdi, qword [rsp + 0x98]
call fcn.18001dda4
mov rcx, rax
mov r8d, esi
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
movsxd rdx, dword [rdi - 0xc]
mov rcx, rdi
call fcn.18005215c
xor ebp, ebp
cmp eax, ebp
jl 0x180001472
cmp eax, dword [rdi - 0xc]
jg 0x180001472
mov dword [rdi - 0x10], eax
cdqe
mov word [rdi + rax*2], bp
lea r8, [rsp + 0xa0]
lea rdx, [0x18007e100]
lea rcx, [rsp + 0xa8]
call fcn.180001514
nop
mov rdx, qword [rax]
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x98]
call fcn.1800017d8
nop
mov rdx, qword [rsp + 0xa8]
add rdx, 0xffffffffffffffe8
or r12, 0xffffffffffffffff
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, r12d
cmp eax, ebp
jg 0x180001375
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
mov rcx, r12
lea rdx, str..fullmem.dmp
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rcx, [rsp + 0x98]
call fcn.1800017d8
mov rdi, qword [rsp + 0x98]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, r12
je 0x18000142f
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x48], eax
mov qword [rsp + 0x4c], rbx
mov dword [rsp + 0x54], ebp
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbp
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 2
mov r8, rsi
mov edx, ebx
call sub.dbghelp.dll_MiniDumpWriteDump
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rdx, [rdi - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, r12d
cmp eax, ebp
jg 0x18000144c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0xa0]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, r12d
cmp eax, ebp
jg 0x18000147d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x18000147d
mov ecx, 0x80070057
call fcn.180001af4
nop
add rsp, 0x60
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180002d04
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov r12d, ecx
lea rcx, [0x1800a2de0]
xor edx, edx
xor ebx, ebx
call fcn.180049ef4
lea r13d, [rbx + 1]
mov ebp, r13d
jmp 0x180002de2
test rbx, rbx
jne 0x180002dee
mov ecx, r12d
lea edx, [rbx + 6]
xor r9d, r9d
shr ecx, 4
add cx, r13w
movzx r8d, cx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
mov rbx, rax
test rax, rax
je 0x180002dd1
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x180002d7e
xor ebx, ebx
jmp 0x180002dcc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
je 0x180002d7a
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, r12d
mov r11d, eax
add r11, rdi
and ecx, 0xf
jbe 0x180002dbb
cmp rdi, r11
jae 0x180002d7a
add ecx, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x180002da9
cmp rdi, r11
jae 0x180002d7a
movzx eax, word [rdi]
neg ax
sbb rbx, rbx
and rbx, rdi
test rbx, rbx
jne 0x180002e09
lea rcx, [0x1800a2de0]
mov edx, ebp
call fcn.180049ef4
add ebp, r13d
mov rsi, rax
test rax, rax
jne 0x180002d3b
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
mov rax, rsi
jmp 0x180002df0

Function at 0x180002e10
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
mov eax, edx
mov esi, edx
mov r8d, 6
shr eax, 4
mov rbp, rcx
inc ax
movzx edx, ax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
xor ebx, ebx
mov r12, rax
cmp rax, rbx
jne 0x180002e53
xor eax, eax
jmp 0x180002eb2
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
cmp rax, rbx
je 0x180002eaf
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
cmp rax, rbx
je 0x180002eaf
mov rdx, r12
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rdi
and esi, 0xf
jbe 0x180002e9e
cmp rdi, r11
jae 0x180002eaf
add esi, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x180002e8c
cmp rdi, r11
jae 0x180002eaf
movzx eax, word [rdi]
neg ax
sbb rbx, rbx
and rbx, rdi
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
Function at 0x180003a38
Capabilities:
Read file via mapping

Disassembly:
mov r11, rsp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov rbp, r8
mov esi, edx
mov r13, rcx
xor ebx, ebx
cmp rcx, rbx
je 0x180003bb1
cmp esi, ebx
je 0x180003bb1
cmp r8, rbx
je 0x180003bb1
xor eax, eax
or r14, 0xffffffffffffffff
mov rcx, r14
mov rdi, r8
repne scasw ax, word [rdi]
not rcx
cmp rcx, 1
je 0x180003bb1
lea r12d, [rsi + 0xc]
lea rax, [r11 - 0x40]
cmp rax, rbx
je 0x180003abb
xor r9d, r9d
lea r8, [r11 - 0x38]
lea edx, [rbx + 1]
lea rcx, str.D:_D_OICI_GA___BG__D_OICI_GA___AN__A_OICI_GA___AU__A_OICI_GA___BA_
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
lea rdx, str.Global_
lea rcx, [rsp + 0x98]
call fcn.180012620
nop
mov r8, rbp
mov rdx, rax
lea rcx, [rsp + 0x80]
call fcn.1800130a0
mov rcx, qword [rax]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r12d
xor r9d, r9d
lea r8d, [r9 + 4]
lea rdx, [rsp + 0x38]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rbp, rax
mov rdx, qword [rsp + 0x80]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
cmp eax, ebx
jg 0x180003b2d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x98]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
cmp eax, ebx
jg 0x180003b51
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp rbp, rbx
je 0x180003bb1
mov eax, r12d
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 6]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rdi, rax
cmp rax, rbx
je 0x180003ba8
mov dword [rax], r12d
mov dword [rax + 8], esi
mov dword [rax + 4], reloc.WS2_32.dll_inet_ntoa
mov rdx, rsi
lea rcx, [rax + 0xc]
mov r9, rsi
mov r8, r13
call fcn.18005217c
mov ebx, 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
jmp 0x180003bb1
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret