joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180165130
Capabilities:
Get file size
Read file on windows
Read file via mapping

Disassembly:
push rbx
push rbp
sub rsp, 0x48
mov rbp, rdx
mov rbx, rcx
test rcx, rcx
jne 0x18016514c
lea eax, [rcx + 0x28]
add rsp, 0x48
pop rbp
pop rbx
ret
mov qword [rsp + 0x68], rsi
xor r9d, r9d
mov qword [rsp + 0x40], r14
mov edx, 0x80000000
xor r14d, r14d
mov rcx, rbp
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
lea r8d, [r14 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x1801651a0
mov r14, qword [rsp + 0x40]
lea eax, [rsi + 2]
mov rsi, qword [rsp + 0x68]
add rsp, 0x48
pop rbp
pop rbx
ret
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x78], rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1801652c5
mov rax, qword [rsp + 0x70]
cmp rax, 0x7fffffff
jg 0x1801652c5
test rax, rax
je 0x1801652c5
xor r9d, r9d
mov qword [rsp + 0x28], r14
xor edx, edx
mov dword [rsp + 0x20], r14d
mov rcx, rsi
lea r8d, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rdi, rax
test rax, rax
je 0x1801652c5
mov ecx, dword [rsp + 0x70]
xor r9d, r9d
mov dword [rbx + 8], ecx
xor r8d, r8d
mov rcx, rax
mov dword [rbx + 0xc], r14d
mov qword [rsp + 0x20], r14
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rcx, rdi
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rbx], r14
je 0x18016523a
lea rax, [0x180165320]
jmp 0x180165293
mov rcx, qword [rbx + 0x30]
xor edx, edx
movsxd r8, dword [rbx + 8]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbx], rax
test rax, rax
je 0x1801652c5
mov edi, r14d
nop dword [rax + rax]
mov r8d, dword [rbx + 8]
lea r9, [rsp + 0x60]
mov edx, edi
sub r8d, edi
add rdx, qword [rbx]
mov rcx, rsi
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1801652b3
add edi, dword [rsp + 0x60]
cmp edi, dword [rbx + 8]
jne 0x180165260
lea rax, [0x1801652f0]
mov rcx, rsi
mov qword [rbx + 0x28], rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbx]
mov qword [rbx + 0x10], rax
xor eax, eax
mov qword [rbx + 0x18], rbp
mov qword [rbx + 0x20], r14
jmp 0x1801652da
mov rcx, qword [rbx + 0x30]
xor edx, edx
mov r8, qword [rbx]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x51
mov qword [rbx], r14
mov qword [rbx + 8], r14
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x68]
mov r14, qword [rsp + 0x40]
add rsp, 0x48
pop rbp
pop rbx
ret
Function at 0x180166020
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r9, rdx
test rdx, rdx
jne 0x18016602b
xor eax, eax
ret
lea r11, [0x180193360]
not ecx
cmp r8d, 8
jb 0x180166101
mov r10d, r8d
shr r10, 3
nop word [rax + rax]
movzx edx, byte [r9]
mov eax, ecx
xor rdx, rax
shr ecx, 8
movzx eax, dl
add r8d, 0xfffffff8
movzx edx, byte [r9 + 1]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 2]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 3]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 4]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 5]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 6]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 7]
add r9, 8
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
sub r10, 1
jne 0x180166050
test r8d, r8d
je 0x18016612d
nop word [rax + rax]
movzx edx, byte [r9]
lea r9, [r9 + 1]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
add r8d, 0xffffffff
jne 0x180166110
not ecx
mov eax, ecx
ret
Function at 0x180169e60
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x78]
sub rax, 0x10000
mov rcx, rax
call fcn.18016a0b0
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x70]
cmp qword [rsp + 0x20], rax
jbe 0x180169f7a
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x180169ec4
mov rax, qword [0x1801ca008]
cmp qword [rsp + 0x20], rax
ja 0x180169ec4
mov rax, qword [rsp + 0x20]
sub rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x180169e86
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualQuery
test rax, rax
jne 0x180169ef5
jmp 0x180169f7a
cmp dword [rsp + 0x50], 0x10000
jne 0x180169f5d
cmp qword [rsp + 0x48], 0x10000
jb 0x180169f5d
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualAlloc
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x180169f3b
mov rax, qword [rsp + 0x28]
jmp 0x180169f7c
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x180169f4b
xor eax, eax
jmp 0x180169f7c
mov rax, qword [rsp + 0x20]
sub rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x180169f75
mov rax, qword [rsp + 0x38]
sub rax, 0x10000
mov rcx, rax
call fcn.18016a0b0
mov qword [rsp + 0x20], rax
jmp 0x180169e86
xor eax, eax
add rsp, 0x68
ret

Function at 0x180169f90
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rcx, qword [rsp + 0x70]
call fcn.18016a0f0
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x78]
cmp qword [rsp + 0x20], rax
jae 0x18016a0a6
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x180169feb
mov rax, qword [0x1801ca008]
cmp qword [rsp + 0x20], rax
ja 0x180169feb
mov rax, qword [rsp + 0x20]
add rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x180169fad
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualQuery
test rax, rax
jne 0x18016a01c
jmp 0x18016a0a6
cmp dword [rsp + 0x50], 0x10000
jne 0x18016a084
cmp qword [rsp + 0x48], 0x10000
jb 0x18016a084
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualAlloc
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x18016a062
mov rax, qword [rsp + 0x28]
jmp 0x18016a0a8
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x18016a072
xor eax, eax
jmp 0x18016a0a8
mov rax, qword [rsp + 0x20]
add rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x18016a0a1
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.18016a0f0
mov qword [rsp + 0x20], rax
jmp 0x180169fad
xor eax, eax
add rsp, 0x68
ret
Function at 0x18016a140
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.18016a6d0
mov qword [rsp + 0x28], 0
cmp qword [0x180469de8], 0
jne 0x18016a188
cmp qword [0x180469de0], 0
je 0x18016a188
mov rax, qword [0x180469de0]
mov qword [0x180469de8], rax
cmp qword [0x180469de8], 0
je 0x18016a22e
mov rax, qword [0x180469de8]
cmp qword [rax + 0x10], 0
je 0x18016a22e
mov rax, qword [0x180469de8]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x18016a22e
mov rax, qword [0x180469de8]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x18016a22e
mov rax, qword [0x180469de8]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x28], rax
jb 0x18016a1f4
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x28], rax
jbe 0x18016a1fb
xor eax, eax
jmp 0x18016a3a9
mov rax, qword [0x180469de8]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x48]
mov qword [rax + 0x10], rcx
mov r8d, 0x60
mov edx, 0xcc
mov rcx, qword [rsp + 0x28]
call sub.VCRUNTIME140.dll_memset
mov rax, qword [rsp + 0x28]
jmp 0x18016a3a9
mov rax, qword [0x180469de0]
mov qword [0x180469de8], rax
jmp 0x18016a250
mov rax, qword [0x180469de8]
mov rax, qword [rax + 8]
mov qword [0x180469de8], rax
cmp qword [0x180469de8], 0
je 0x18016a29d
cmp qword [0x180469de8], 0
je 0x18016a29b
mov rax, qword [0x180469de8]
cmp qword [rax + 0x10], 0
je 0x18016a29b
mov rax, qword [0x180469de8]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x18016a29b
mov rax, qword [0x180469de8]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x18016a29b
jmp 0x18016a1cc
jmp 0x18016a23e
mov rcx, qword [rsp + 0x60]
call fcn.18016c320
and eax, 0xffff
mov eax, eax
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.18016a3b0
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x18016a3a7
mov rax, qword [rsp + 0x48]
mov qword [0x180469de8], rax
mov rax, qword [0x180469de8]
mov dword [rax], 0x52727464
mov rax, qword [0x180469de8]
mov qword [rax + 0x10], 0
mov rax, qword [0x180469de8]
mov rcx, qword [0x180469de0]
mov qword [rax + 8], rcx
mov rax, qword [0x180469de8]
mov qword [0x180469de0], rax
mov qword [rsp + 0x40], 0
mov rax, qword [0x180469de8]
add rax, 0x60
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x2a8
jmp 0x18016a358
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 1
jle 0x18016a392
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x40]
mov qword [rcx + rax + 0x48], rdx
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
jmp 0x18016a34e
mov rax, qword [0x180469de8]
mov rcx, qword [rsp + 0x40]
mov qword [rax + 0x10], rcx
jmp 0x18016a1cc
xor eax, eax
add rsp, 0x58
ret
Function at 0x18016b0c0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov r8d, 0x30
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x80]
call sub.KERNEL32.dll_VirtualQuery
nop
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x18016b107
xor al, al
jmp 0x18016b1a9
mov rax, qword [rsp + 0x28]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x18016b131
xor al, al
jmp 0x18016b1a9
mov eax, 8
imul rax, rax, 0xc
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
cmp qword [rsp + 0x88], rax
jb 0x18016b1a1
mov eax, 8
imul rax, rax, 0xc
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov ecx, 8
imul rcx, rcx, 0xc
mov rdx, qword [rsp + 0x30]
mov ecx, dword [rdx + rcx + 0x8c]
add rax, rcx
cmp qword [rsp + 0x88], rax
jae 0x18016b1a1
mov al, 1
jmp 0x18016b1a9
jmp 0x18016b1a7
xor al, al
add rsp, 0x78
ret

Function at 0x18016b4b0
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x38
mov rax, qword [0x180469de0]
mov qword [rsp + 0x28], rax
jmp 0x18016b4d0
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 8]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x18016b4ff
lea r9, [rsp + 0x20]
mov r8d, 0x40
mov edx, 0x10000
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x18016b4fd
call sub.KERNEL32.dll_GetLastError
jmp 0x18016b501
jmp 0x18016b4c2
xor eax, eax
add rsp, 0x38
ret
Function at 0x18016bbc0
Capabilities:
Resume thread

Disassembly:
sub rsp, 0x68
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x180469df8], eax
je 0x18016bbdb
mov eax, 0x10dd
jmp 0x18016bd00
mov rax, qword [0x180469e10]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x18016bc85
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x20]
movzx eax, byte [rax + 0x3e]
lea r9, [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov r8d, dword [rcx + 0x28]
mov edx, eax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x18]
call sub.KERNEL32.dll_VirtualProtect
mov rax, qword [rsp + 0x28]
cmp dword [rax + 8], 0
jne 0x18016bc50
mov rax, qword [rsp + 0x28]
cmp qword [rax + 0x20], 0
je 0x18016bc50
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x20]
call fcn.18016a810
mov rax, qword [rsp + 0x28]
mov qword [rax + 0x20], 0
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov edx, 0x30
mov rcx, qword [rsp + 0x38]
call fcn.18016dc74
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x28], rax
jmp 0x18016bbe7
mov qword [0x180469e10], 0
call fcn.18016b270
mov rax, qword [0x180469e08]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x18016bce9
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
call sub.KERNEL32.dll_ResumeThread
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov edx, 0x10
mov rcx, qword [rsp + 0x48]
call fcn.18016dc74
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
jmp 0x18016bca1
mov qword [0x180469e08], 0
mov dword [0x180469df8], 0
xor eax, eax
add rsp, 0x68
ret
Function at 0x18016c230
Capabilities:
Suspend thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
cmp dword [0x180469dfc], 0
je 0x18016c24d
mov eax, dword [0x180469dfc]
jmp 0x18016c313
call sub.KERNEL32.dll_GetCurrentThread
cmp qword [rsp + 0x50], rax
jne 0x18016c260
xor eax, eax
jmp 0x18016c313
mov ecx, 0x10
call fcn.18016d7f0
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x18016c2ce
mov dword [rsp + 0x20], 8
cmp qword [rsp + 0x28], 0
je 0x18016c2b3
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov edx, 0x10
mov rcx, qword [rsp + 0x38]
call fcn.18016dc74
mov qword [rsp + 0x28], 0
mov eax, dword [rsp + 0x20]
mov dword [0x180469dfc], eax
mov qword [0x180469e00], 0
mov eax, dword [rsp + 0x20]
jmp 0x18016c313
mov rcx, qword [rsp + 0x50]
call sub.KERNEL32.dll_SuspendThread
cmp eax, 0xffffffff
jne 0x18016c2e8
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
jmp 0x18016c289
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
mov qword [rax + 8], rcx
mov rax, qword [rsp + 0x28]
mov rcx, qword [0x180469e08]
mov qword [rax], rcx
mov rax, qword [rsp + 0x28]
mov qword [0x180469e08], rax
xor eax, eax
add rsp, 0x48
ret
Function at 0x140001c20
Capabilities:
Hash data with md5

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x18]
sub rsp, 0x118
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x140041250]
xor rax, rsp
mov qword [rbp], rax
mov rsi, r9
mov rbx, r8
mov r15, rcx
mov r12, qword [rbp + 0x80]
mov r13, qword [rbp + 0x88]
mov r14, qword [rbp + 0x90]
mov qword [rsp + 0x50], 7
xor eax, eax
mov qword [rsp + 0x48], rax
mov word [rsp + 0x38], ax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x38]
call fcn.140003d40
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.140003d40
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rsi
lea rcx, [rsp + 0x38]
call fcn.140003d40
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r12
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, r12
lea rcx, [rsp + 0x38]
call fcn.140003d40
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r13
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, r13
lea rcx, [rsp + 0x38]
call fcn.140003d40
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r14
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, r14
lea rcx, [rsp + 0x38]
call fcn.140003d40
lea rdx, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rdx, qword [rsp + 0x38]
mov byte [rbp - 8], 0
xor edi, edi
mov qword [rbp - 0x60], rdi
mov dword [rbp - 0x70], 0x67452301
mov dword [rbp - 0x6c], 0xefcdab89
mov dword [rbp - 0x68], 0x98badcfe
mov dword [rbp - 0x64], 0x10325476
mov r8, qword [rsp + 0x48]
lea r8, [r8 + r8 + 2]
lea rcx, [rbp - 0x70]
call fcn.140004210
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x70]
call fcn.140004d50
lea r8, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae r8, qword [rsp + 0x60]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
or r9d, 0xffffffff
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea r8, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae r8, qword [rsp + 0x60]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r15
or r9d, 0xffffffff
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp qword [rsp + 0x78], 0x10
jb 0x140001df8
mov rcx, qword [rsp + 0x60]
call fcn.14001c290
mov qword [rsp + 0x78], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x70], rdi
mov byte [rsp + 0x60], dil
cmp qword [rsp + 0x50], 8
jb 0x140001e1d
mov rcx, qword [rsp + 0x38]
call fcn.14001c290
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.14001c270
add rsp, 0x118
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1400021e0
Capabilities:
Enumerate processes

Disassembly:
mov r11, rsp
push rsi
sub rsp, 0x280
mov rax, qword [0x140041250]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov qword [r11 + 0x20], r12
lea rsi, [0x14004b530]
xor edx, edx
mov r8d, 0x1fe
mov rcx, rsi
mov qword [r11 - 0x18], r14
call fcn.14001dcf0
mov rcx, qword [str.360Safe.exe]
lea rdx, [0x140039b30]
xor r14d, r14d
mov r12d, r14d
call fcn.14001c934
test rax, rax
jne 0x14000234e
mov qword [rsp + 0x290], rbx
mov qword [rsp + 0x298], rbp
mov qword [rsp + 0x2a0], rdi
mov qword [rsp + 0x278], r13
lea r13, str.360Safe.exe
mov ebp, r14d
mov rbx, r13
nop dword [rax + rax]
mov rdi, qword [rbx]
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x234
mov dword [rsp + 0x20], r14d
call fcn.14001dcf0
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140002307
lea rdx, [rsp + 0x20]
mov rcx, rax
mov dword [rsp + 0x20], 0x238
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400022fe
nop dword [rax + rax]
lea rcx, [rsp + 0x4c]
mov r8, rdi
sub r8, rcx
nop dword [rax + rax]
movzx edx, word [rcx]
movzx eax, word [rcx + r8]
sub edx, eax
jne 0x1400022e4
add rcx, 2
test eax, eax
jne 0x1400022d0
mov rcx, rbx
test edx, edx
je 0x14000239e
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400022c0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc r12
lea rdx, [0x140039b30]
mov rbp, r12
shl rbp, 4
lea rbx, [r13 + rbp]
mov rcx, qword [rbx]
call fcn.14001c934
test rax, rax
je 0x140002270
mov r13, qword [rsp + 0x278]
mov rdi, qword [rsp + 0x2a0]
mov rbp, qword [rsp + 0x298]
mov rbx, qword [rsp + 0x290]
lea rdx, [0x140039b30]
mov rcx, rsi
call fcn.14001c934
mov r14, qword [rsp + 0x270]
mov r12, qword [rsp + 0x2a8]
test rax, rax
jne 0x140002382
lea rdx, [0x1400399e4]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rax, rsi
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.14001c270
add rsp, 0x280
pop rsi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x28], r14d
je 0x140002307
mov rdx, qword [r13 + rbp + 8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [0x140039b34]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcatW]
jmp 0x140002307
Function at 0x1400023e0
Capabilities:
Persist via run registry key

Disassembly:
push rbp
sub rsp, 0x690
mov rax, qword [0x140041250]
xor rax, rsp
mov qword [rsp + 0x680], rax
lea rcx, [rsp + 0x52]
xor ebp, ebp
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x50], bp
call fcn.14001dcf0
lea rcx, [rsp + 0x262]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x260], bp
call fcn.14001dcf0
lea rcx, str.Shell32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.SHGetSpecialFolderPathW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400024c1
lea r9d, [rbp + 1]
lea r8d, [rbp + 7]
lea rdx, [rsp + 0x50]
xor ecx, ecx
call rax
test eax, eax
je 0x1400024c1
lea r9, str.GFIRestart64.exe
lea r8, [rsp + 0x50]
lea rdx, str._s_s
lea rcx, [rsp + 0x260]
call qword [sym.imp.USER32.dll_wsprintfW]
mov qword [rsp + 0x30], rbp
lea rcx, [rsp + 0x260]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x1400024c1
lea eax, [rbp + 1]
jmp 0x1400025e2
mov qword [rsp + 0x6a0], rbx
lea rcx, [0x140039c10]
mov qword [rsp + 0x6a8], rsi
mov qword [rsp + 0x6b0], rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, [0x140039c30]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x140039c48]
mov rcx, rbx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x140039c58]
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rsi, rsi
je 0x1400025c8
test rdi, rdi
je 0x1400025c8
test rax, rax
je 0x1400025c8
lea rax, [rsp + 0x48]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call rdi
test eax, eax
jne 0x1400025c8
lea rcx, [rsp + 0x472]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x470], bp
call fcn.14001dcf0
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
lea rdx, str.GFIRestart64.exe
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x470]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x40], 0x208
call rsi
mov rcx, qword [rsp + 0x48]
test eax, eax
jne 0x1400025c6
call rbx
mov eax, 1
jmp 0x1400025ca
call rbx
xor eax, eax
mov rsi, qword [rsp + 0x6a8]
mov rbx, qword [rsp + 0x6a0]
mov rdi, qword [rsp + 0x6b0]
mov rcx, qword [rsp + 0x680]
xor rcx, rsp
call fcn.14001c270
add rsp, 0x690
pop rbp
ret