joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180062c6c
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.180057a20
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.180057a20
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x180062db9
cmp rax, 0xffffffffffffffff
je 0x180062db9
xor edi, edi
test rbp, rbp
jle 0x180062d67
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.180058800
mov rbx, rax
test rax, rax
jne 0x180062cf4
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x180062d5d
mov edx, 0x8000
mov ecx, r14d
call fcn.180062af0
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.180059a2c
cmp eax, 0xffffffff
je 0x180062d3d
cdqe
sub rbp, rax
test rbp, rbp
jg 0x180062d04
mov edx, r15d
mov ecx, r14d
call fcn.180062af0
jmp 0x180062d5d
cmp byte [rsi + 0x38], dil
je 0x180062d54
cmp dword [rsi + 0x34], 5
jne 0x180062d54
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x180062d5d
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.180058880
jmp 0x180062dcb
jns 0x180062dcb
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.180057a20
cmp rax, 0xffffffffffffffff
jne 0x180062d85
cmp byte [rsi + 0x30], dil
je 0x180062dcb
jmp 0x180062dc1
mov ecx, r14d
call fcn.18005f7b4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x180062dcb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x180062dcb
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x180062dc6
mov edi, dword [rsi + 0x2c]
jmp 0x180062dcb
mov edi, 0x16
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.180057a20
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x180064410
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x180064438
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x180064438
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140002be0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub rsp, 0x28
mov edx, ecx
mov r8d, 0xa
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x140002c16
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
test rax, rax
je 0x140002c16
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_LockResource]
xor eax, eax
add rsp, 0x28
ret

Function at 0x140002c20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r12
lea r11, [0x140007460]
mov r9, qword [0x140007410]
mov r12, qword [0x140007428]
mov eax, dword [0x140007430]
push rbp
xor ebp, ebp
push rdi
push rsi
mov rsi, rcx
mov ecx, edx
push rbx
movzx ebx, dl
mov r10w, word [r11 + rbx*2]
mov r8d, dword [0x140007434]
mov edi, dword [0x140007438]
cmp r8d, edi
jae 0x140002c99
shl r8d, 8
inc r9
shl eax, 8
mov bpl, 1
mov dword [0x140007434], r8d
mov dl, byte [r9 - 1]
mov byte [r12], dl
mov edx, dword [0x140007438]
shl edx, 8
mov edi, edx
mov dword [0x140007438], edx
add edi, eax
jae 0x140002c50
mov eax, edx
not eax
jmp 0x140002c50
lea edx, [rdi + rax]
xor edx, edi
cmp edx, 0xffffff
jbe 0x140002c62
cmp eax, 0xffff
jbe 0x140002c62
test bpl, bpl
je 0x140002cb9
mov qword [0x140007410], r9
movzx ebp, r10w
xor edx, edx
div ebp
xor edx, edx
mov r9d, eax
mov dword [0x140007430], eax
mov eax, r8d
mov r8b, 1
sub eax, edi
div r9d
cmp ebp, eax
jbe 0x140002d68
movzx ecx, cl
lea rdx, [0x140007660]
shl rcx, 9
add rdx, rcx
xor ecx, ecx
mov r8, rdx
movzx ebp, word [r8]
add ebp, ecx
cmp eax, ebp
jb 0x140002d07
add r8, 2
mov ecx, ebp
jmp 0x140002cf5
imul ecx, r9d
mov rax, r8
sub rax, rdx
sar rax, 1
add ecx, edi
mov dword [0x140007438], ecx
mov byte [rsi], al
movzx eax, word [r8]
lea ecx, [rax + 1]
imul eax, r9d
mov word [r8], cx
mov dword [0x140007430], eax
inc r10w
jne 0x140002d60
xor eax, eax
mov r8w, word [rdx + rax]
mov ecx, r8d
and r8d, 1
shr cx, 1
or ecx, r8d
mov word [rdx + rax], cx
add rax, 2
add r10d, ecx
cmp rax, 0x200
jne 0x140002d3b
mov word [r11 + rbx*2], r10w
xor r8d, r8d
pop rbx
mov eax, r8d
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x180007ba4
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
test r8, r8
jne 0x180007bc7
lea eax, [r8 + 0xd]
jmp 0x180007bf4
mov rcx, rbx
call fcn.18000ad68
mov r9d, 1
xor r8d, r8d
lea ecx, [rax*2 + 2]
mov rdx, rdi
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsi]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x180007c5c
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
xor ebx, ebx
mov rdi, r8
mov rbp, rdx
mov r14, rcx
test r8, r8
jne 0x180007c8a
lea eax, [rbx + 0xd]
jmp 0x180007cbf
mov rsi, r8
mov rcx, rsi
call fcn.18000ad68
inc eax
lea rsi, [rsi + rax*2]
lea ebx, [rbx + rax*2]
cmp eax, 1
jne 0x180007c8d
mov rcx, qword [r14]
lea r9d, [rax + 6]
xor r8d, r8d
mov rdx, rbp
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x180007d10
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
sub rsp, 0x48
mov rax, qword [0x180025070]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rcx, qword [rcx]
lea rax, [r11 - 0x18]
mov r9d, 4
mov dword [r11 - 0x18], r8d
mov dword [r11 - 0x20], r9d
xor r8d, r8d
mov qword [r11 - 0x28], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.18000a9b0
add rsp, 0x48
ret
Function at 0x18000846c
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x180025070]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov rdi, rcx
lea rcx, [rsp + 0x40]
mov rsi, rdx
call fcn.1800085dc
lea rcx, [rsp + 0x40]
call fcn.1800085e8
mov r9d, dword [rdi + 8]
mov rdx, qword [rdi]
lea rcx, [rsp + 0x40]
or r9d, 0x2001f
mov r8, rsi
call fcn.1800083d0
jmp 0x1800084d5
lea rdx, [rsp + 0x70]
call fcn.18000846c
xor ecx, ecx
mov ebx, eax
test eax, eax
jne 0x180008530
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x40]
xor edx, edx
mov dword [rsp + 0x58], 0x100
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea rcx, [rsp + 0x40]
test eax, eax
je 0x1800084cb
call fcn.1800085f8
mov rdx, rsi
mov rcx, rdi
call fcn.1800086c4
mov ebx, eax
lea rcx, [rsp + 0x40]
call fcn.180008620
mov eax, ebx
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.18000a9b0
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret

Function at 0x180008638
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x18000869b
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1800086af
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800086af
mov rcx, qword [rbx]
and qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call rax
jmp 0x1800086b4
cmp dword [rcx + 8], 0
je 0x1800086af
mov rdx, r8
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x1800086b4
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x1800086c4
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
mov rdi, rdx
test rcx, rcx
je 0x1800086ea
mov r8, rdx
mov rdx, qword [rbx]
call fcn.180008638
jmp 0x180008751
cmp byte [0x1800284e8], 0
jne 0x18000872e
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x18000871e
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800284e0], rax
jmp 0x180008725
mov rax, qword [0x1800284e0]
mov byte [0x1800284e8], 1
jmp 0x180008735
mov rax, qword [0x1800284e0]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x18000874b
mov r8d, dword [rbx + 8]
xor r9d, r9d
call rax
jmp 0x180008751
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180009094
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x490
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov rax, qword [0x180025070]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov r15, r9
mov r14, r8
mov rdi, rdx
mov rbx, rcx
lea rcx, [rsp + 0x40]
call fcn.180002978
lea rcx, [rsp + 0x40]
call fcn.1800017f4
nop
lea rcx, [rsp + 0x58]
call fcn.180006ae4
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.180007124
lea rcx, [rsp + 0x70]
call fcn.180002978
lea rcx, [rsp + 0x70]
call fcn.1800017f4
nop
mov rcx, rdi
call fcn.1800037d4
mov rbx, rax
xor edx, edx
lea r8d, [rdx + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
xor esi, esi
test rax, rax
jne 0x18000915c
xor edx, edx
lea r8d, [rax + 2]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x18000915c
call fcn.1800071d4
mov ebx, eax
jmp 0x18000924f
mov r8, r15
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x18000917d
call fcn.1800071d4
jmp 0x18000923e
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r14, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x180009173
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, ebx
jae 0x1800091b8
mov ebx, 0x8007000e
jmp 0x180009240
mov edx, eax
lea rcx, [rsp + 0x70]
call fcn.1800071a8
nop
jmp 0x1800091d7
lea rcx, [rsp + 0x70]
call fcn.180003cb8
mov r15, rax
test rax, rax
je 0x1800091ae
call fcn.180007cdc
mov ecx, eax
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r15
mov r9d, ebx
mov r8, r14
xor edx, edx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ebx, eax
test eax, eax
je 0x180009173
lea rcx, [rsp + 0x70]
call fcn.180003cb8
mov word [rax + rbx*2], si
lea rcx, [rsp + 0x70]
call fcn.180003cb8
mov rdx, rax
mov r8d, dword [rsp + 0x4e0]
lea rcx, [rsp + 0x58]
call fcn.180008f50
mov ebx, eax
test rdi, rdi
je 0x18000924f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rcx, [rsp + 0x70]
call fcn.180007138
nop
lea rcx, [rsp + 0x40]
call fcn.180007ce4
mov eax, ebx
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.18000a9b0
add rsp, 0x490
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x180009aac
Capabilities:
Check if file exists
Create process on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x3f]
sub rsp, 0xb0
mov rax, qword [0x180025070]
xor rax, rsp
mov qword [rbp + 0x37], rax
xor edi, edi
mov rsi, rdx
mov rbx, rcx
cmp byte [rcx + 0x50], dil
je 0x180009be0
lea rcx, [rbp - 0x39]
call fcn.180009c04
lea rcx, [rbp - 0x39]
call fcn.18000317c
lea rdx, [rbp - 0x39]
mov rcx, rsi
call fcn.1800098e4
lea rdx, [rbp + 0x17]
call fcn.180001da8
lea rcx, [rbp + 0x17]
call fcn.18000316c
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x180009b27
mov edi, 0x80004005
jmp 0x180009bca
lea rdx, [0x1800207b8]
lea rcx, [rbp - 9]
call fcn.180003054
mov rdx, qword [rbx + 0x58]
lea rcx, [rbp - 9]
call fcn.18000310c
lea rdx, [0x180020064]
lea rcx, [rbp - 9]
call fcn.18000310c
lea rcx, [rbp - 0x41]
call fcn.180002f8c
lea rcx, [rbp - 0x41]
call fcn.180002f74
lea rdx, [rbp - 0x39]
lea rcx, [rbp - 0x21]
call fcn.180003194
lea r9, [rbp - 9]
lea r8, [rbp - 0x41]
mov rdx, rax
call fcn.180002748
test eax, eax
je 0x180009b8e
mov edi, 0x80004005
jmp 0x180009bc1
lea rcx, [rbp - 9]
call fcn.18000316c
lea rcx, [rbp + 0x17]
mov rbx, rax
call fcn.18000316c
lea rdx, str.open
mov r9, rbx
xor ecx, ecx
mov r8, rax
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rbp - 9]
call fcn.1800030d4
lea rcx, [rbp + 0x17]
call fcn.1800030d4
lea rcx, [rbp - 0x39]
call fcn.180003290
mov eax, edi
jmp 0x180009be5
mov eax, 0x80004005
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.18000a9b0
mov rbx, qword [rsp + 0xe0]
add rsp, 0xb0
pop rdi
pop rsi
pop rbp
ret

Function at 0x180009f68
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
lea rcx, str.DllCanUnloadNow_end_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add rsp, 0x28
jmp 0x18000a06c
sub rsp, 0x28
mov rax, qword [0x180028400]
lea rcx, [0x180028400]
call qword [rax + 0x18]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x28
ret
Function at 0x180009f84
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
lea rcx, str.DllGetClassObject_end_n
mov rbx, r8
mov rdi, rdx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov r9, rbx
mov r8, rdi
mov rdx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x18000a090
jmp 0x18000a120
jmp 0x18000a678
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x180025070]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov r14, r9
mov r15, r8
mov rbp, rdx
test r9, r9
jne 0x18000a6af
mov eax, 0x80004003
jmp 0x18000a7a4
and qword [r9], 0
cmp dword [0x180026fe0], 0
jne 0x18000a6c6
mov eax, 0x8000ffff
jmp 0x18000a7a4
mov rbx, qword [0x180026ff0]
mov rsi, qword [0x180026ff8]
cmp rbx, rsi
jae 0x18000a79d
mov rdi, qword [rbx]
test rdi, rdi
je 0x18000a6fb
cmp qword [rdi + 0x10], 0
je 0x18000a6fb
mov rdx, qword [rdi]
mov rcx, rbp
call fcn.1800069dc
test eax, eax
jne 0x18000a701
add rbx, 8
jmp 0x18000a6d4
mov rsi, qword [rdi + 0x20]
mov rcx, qword [rsi]
test rcx, rcx
jne 0x18000a77c
lea rdx, [0x180027000]
lea rcx, [rsp + 0x20]
xor r8d, r8d
call fcn.18000a5cc
lea rcx, [rsp + 0x20]
call fcn.18000a654
mov ebx, eax
test eax, eax
jns 0x18000a73d
lea rcx, [rsp + 0x20]
call fcn.18000a62c
jmp 0x18000a793
cmp qword [rsi], 0
jne 0x18000a76a
mov rcx, qword [rdi + 0x18]
lea r8, [rsp + 0x30]
lea rdx, [0x18001f630]
call qword [rdi + 0x10]
mov ebx, eax
test eax, eax
js 0x18000a76a
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [rsi], rax
lea rcx, [rsp + 0x20]
call fcn.18000a62c
mov rcx, qword [rsi]
test rcx, rcx
je 0x18000a793
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r8, r14
mov rdx, r15
mov r9, qword [rax]
mov rcx, rax
call qword [r9]
mov ebx, eax
cmp qword [r14], 0
jne 0x18000a7a2
test ebx, ebx
jne 0x18000a7a2
mov ebx, 0x80040111
mov eax, ebx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.18000a9b0
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x180009fc8
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
lea rcx, str.DllRegisterServer_end_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add rsp, 0x28
jmp 0x18000a098
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetThreadLocale]
mov ecx, 0x800
mov edi, eax
call qword [sym.imp.KERNEL32.dll_SetThreadLocale]
call fcn.18000a170
mov ebx, eax
test eax, eax
js 0x18000a0c7
call fcn.18000a128
mov ebx, eax
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetThreadLocale]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180009fe4
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
lea rcx, str.DllUnregisterServer_end_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add rsp, 0x28
jmp 0x18000a0dc
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetThreadLocale]
mov ecx, 0x800
mov edi, eax
call qword [sym.imp.KERNEL32.dll_SetThreadLocale]
call fcn.18000a150
mov ebx, eax
test eax, eax
js 0x18000a10b
call fcn.18000a17c
mov ebx, eax
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetThreadLocale]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x18000a000
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, ecx
lea rcx, str.DllInstall_end_n
mov rbx, rdx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
test rbx, rbx
je 0x18000a03f
lea rdx, str.user
mov r8d, 5
mov rcx, rbx
call fcn.18000bfa0
test eax, eax
jne 0x18000a03f
call fcn.18000a7c4
test edi, edi
je 0x18000a055
call sym.wzShellctx64.dll_DllRegisterServer
mov ebx, eax
test eax, eax
jns 0x18000a05c
call sym.wzShellctx64.dll_DllUnregisterServer
jmp 0x18000a05c
call sym.wzShellctx64.dll_DllUnregisterServer
mov ebx, eax
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x401000
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], 0x2000
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x2000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea rax, section..data
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x28]
sub rcx, 1
mov qword [rsp + 0x28], rcx
test rax, rax
je 0x401086
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
movzx ecx, byte [rcx]
mov byte [rax], cl
mov rax, qword [rsp + 0x20]
add rax, 1
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x38]
add rax, 1
mov qword [rsp + 0x38], rax
jmp 0x401041
call qword [rsp + 0x30]
add rsp, 0x48
ret
Function at 0x14001ce60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
push r15
mov rsi, qword [rsp + 0x48]
xor r14d, r14d
mov rbx, qword [rsp + 0x60]
mov r12, r9
mov rcx, qword [rsp + 0x50]
mov r13, r8
mov rbp, qword [rsp + 0x58]
mov r15, rdx
mov qword [rsi], r8
mov qword [rbx], rcx
mov rax, qword [rsi]
cmp rax, r9
je 0x14001cff5
cmp rcx, rbp
je 0x14001cff5
mov r9d, 1
movzx edx, word [r15]
xor dil, dil
movzx ecx, word [rax]
mov r11d, 0x2800
mov r8d, 0x3ff
mov r10d, 0x2400
cmp r9w, dx
jae 0x14001cefc
lea eax, [r10 + rcx]
cmp ax, r8w
ja 0x14001d01c
mov eax, edx
sub ecx, 0xdc00
shl eax, 0xa
or eax, ecx
jmp 0x14001cf13
mov eax, ecx
add cx, r11w
cmp cx, r8w
ja 0x14001cf13
shl eax, 0xa
mov dil, 1
sub eax, 0x35f0000
cmp eax, 0x80
jae 0x14001cf26
movzx r8d, al
mov r10d, r14d
mov r11d, r14d
jmp 0x14001cf73
mov r8d, eax
cmp eax, 0x800
jae 0x14001cf40
shr r8d, 6
mov r10d, r9d
or r8b, 0xc0
mov r11d, r9d
jmp 0x14001cf73
cmp eax, 0x10000
jae 0x14001cf5a
shr r8d, 0xc
mov r10d, 2
or r8b, 0xe0
mov r11d, r10d
jmp 0x14001cf73
shr r8d, 0x12
mov r10d, 3
movzx r11d, dil
or r8b, 0xf0
xor r11d, 1
add r11d, r11d
lea r9d, [r11 + 1]
mov rdx, rbp
sub rdx, qword [rbx]
mov ecx, r9d
cmp rdx, rcx
jl 0x14001cff5
add qword [rsi], 2
test dil, dil
jne 0x14001cf94
cmp r10d, 3
jae 0x14001cfa0
mov rcx, qword [rbx]
mov r9d, r11d
mov byte [rcx], r8b
inc qword [rbx]
mov r8, qword [rbx]
test r9d, r9d
jle 0x14001cfce
lea ecx, [r10 + r10*2]
add ecx, ecx
nop
sub ecx, 6
mov edx, eax
shr edx, cl
dec r9d
and dl, 0x3f
or dl, 0x80
mov byte [r8], dl
inc qword [rbx]
mov r8, qword [rbx]
test r9d, r9d
jg 0x14001cfb0
shr eax, 0xa
mov r9d, 1
test dil, dil
mov ecx, r9d
cmovne ecx, eax
mov word [r15], cx
mov rax, qword [rsi]
cmp rax, r12
je 0x14001cff5
cmp qword [rbx], rbp
jne 0x14001cebd
cmp r13, qword [rsi]
sete r14b
mov eax, r14d
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
pop r15
pop r14
pop r13
pop r12
ret
mov eax, 2
jmp 0x14001cfff
Function at 0x14001f654
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rdi, rcx
test r8, r8
jg 0x14001f682
xor eax, eax
jmp 0x14001f768
cmp qword [rcx + 0x68], 0
je 0x14001f693
call fcn.140006aa0
jmp 0x14001f768
mov rax, qword [rcx + 0x38]
mov rsi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14001f6aa
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14001f6ac
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14001f6de
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.140087db0
mov rax, qword [rdi + 0x50]
add r14, rbx
sub rsi, rbx
sub dword [rax], ebx
mov rcx, qword [rdi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rdi + 0x80], 0
je 0x14001f762
mov r8, qword [rdi + 0x18]
lea rax, [rdi + 0x70]
cmp qword [r8], rax
jne 0x14001f715
mov rcx, qword [rdi + 0x88]
mov rdx, qword [rdi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rdi + 0x38]
mov qword [rax], rcx
mov rax, qword [rdi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x14001f73e
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call fcn.14006a394
add r14, rax
sub rsi, rax
cmp rax, rbx
jne 0x14001f762
cmp rsi, rbx
ja 0x14001f71c
test rsi, rsi
je 0x14001f762
mov r9, qword [rdi + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.14006a394
sub rsi, rax
sub rbp, rsi
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x140039838
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
lea r9, [rdx + rdx]
movabs r8, 0xcbf29ce484222325
xor edx, edx
test r9, r9
je 0x140026166
movzx eax, byte [rcx + rdx]
movabs r10, 0x100000001b3
xor r8, rax
inc rdx
imul r8, r10
cmp rdx, r9
jb 0x140026149
mov rax, r8
ret
sub r8, rdx
mov rcx, rdx
sar r8, 1
mov rdx, r8
jmp 0x140026134

Function at 0x1400437ac
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x28
call fcn.14006b548
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x1400437fe
and dword [rsp + 0x30], 0
lea r8, [rsp + 0x30]
mov r9d, 2
lea edx, [r9 + 0x20]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx ecx, word [rsp + 0x30]
sub ecx, 0x30
je 0x1400437fe
sub ecx, 1
je 0x1400437f7
cmp ecx, 1
je 0x1400437f0
xor eax, eax
jmp 0x140043803
mov eax, 3
jmp 0x140043803
mov eax, 1
jmp 0x140043803
mov eax, 2
add rsp, 0x28
ret

Function at 0x140044fb8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140045002
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140045002
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140045002
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140045002
cmp dword [rcx + 0x84], 0xe
jbe 0x140045002
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140045004
xor al, al
add rsp, 0x28
ret