joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180001470
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x160
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rsi, rcx
xor ebp, ebp
xor edx, edx
lea ecx, [rbp + 0xf]
mov dword [rsp + 0x20], 0x130
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea rdx, [rsp + 0x20]
mov rcx, rax
mov rbx, rax
call sub.KERNEL32.dll_Process32First
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x4c]
repne scasb al, byte [rdi]
not rcx
dec rcx
movsxd rdx, ecx
test ecx, ecx
jle 0x1800014fe
nop word [rax + rax]
movzx ecx, byte [rsp + rax + 0x4c]
cmp cl, 0x41
jl 0x1800014f6
cmp cl, 0x5f
jg 0x1800014f6
add cl, 0x20
mov byte [rsp + rax + 0x4c], cl
inc rax
cmp rax, rdx
jl 0x1800014e0
lea rax, [rsp + 0x4c]
mov rdi, rsi
sub rdi, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + rdi]
sub edx, ecx
jne 0x180001522
inc rax
test ecx, ecx
jne 0x180001510
test edx, edx
je 0x180001539
lea rdx, [rsp + 0x20]
mov rcx, rbx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x1800014c0
jmp 0x180001548
mov eax, dword [rsp + 0x28]
mov ebp, 1
mov dword [0x180008b00], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x180008b04], 0
mov eax, ebp
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1800046d0
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x180002150
Capabilities:
Create thread
Encode data using xor

Disassembly:
push rbx
push rdi
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.MSVCR90.dll__time64]
mov rcx, rax
call qword [sym.imp.MSVCR90.dll_srand]
mov edi, 4
nop dword [rax]
call qword [sym.imp.MSVCR90.dll_rand]
sub rdi, 1
jne 0x180002170
call qword [sym.imp.MSVCR90.dll_rand]
mov ebx, eax
imul ebx, ebx, 0x1d
call qword [sym.imp.MSVCR90.dll_rand]
add ebx, eax
mov eax, 0x431bde83
imul ebx
sar edx, 0x12
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0xf4240
sub ebx, edx
cmp ebx, 0xf4240
jl 0x1800021b6
sub ebx, 0xf4240
cmp ebx, 0x186a0
jge 0x1800021cb
call qword [sym.imp.MSVCR90.dll_rand]
lea ebx, [rbx + rax + 0x186a0]
mov rcx, qword [0x180008918]
or edx, 0xffffffff
mov dword [0x1800088cc], ebx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
or rcx, 0xffffffffffffffff
xor eax, eax
lea r8, str.224269_6:_8__C
xor ebx, ebx
mov rdi, r8
repne scasb al, byte [rdi]
not rcx
lea rdi, [rcx - 1]
mov ecx, ebx
test edi, edi
jle 0x18000221b
mov eax, ecx
inc r8
cdq
and eax, 1
xor eax, edx
sub eax, edx
add al, cl
inc ecx
sub byte [r8 - 1], al
cmp ecx, edi
jl 0x180002202
or rcx, 0xffffffffffffffff
xor eax, eax
lea r8, str.a5355:66kyw
mov rdi, r8
repne scasb al, byte [rdi]
not rcx
lea rdi, [rcx - 1]
mov ecx, ebx
test edi, edi
jle 0x180002259
nop word [rax + rax]
mov eax, ecx
inc r8
cdq
and eax, 1
xor eax, edx
sub eax, edx
add al, cl
inc ecx
sub byte [r8 - 1], al
cmp ecx, edi
jl 0x180002240
mov rcx, qword [0x180008918]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
call fcn.180002360
lea rdx, [0x1800087f8]
mov qword [rsp + 0x20], rdx
lea rdx, [0x180008920]
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call fcn.180002cb0
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x28], rdx
lea r8, [0x1800030f0]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x1800022c9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x58]
lea r8, [0x180001a30]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x1800022f9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x60]
lea r8, [0x180003440]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x180002329
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x68]
lea r8, [0x180003cb0]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x180002359
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x38
pop rdi
pop rbx
ret
Function at 0x180002a40
Capabilities:
Encode data using xor
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
dec rcx
mov r9, rcx
test ecx, ecx
jle 0x180002afe
lea r10, [0x180008ab8]
mov rdx, rbx
mov rdi, r10
sub rdi, rbx
nop dword [rax]
movzx eax, byte [rdx]
inc rdx
mov byte [rdi + rdx - 1], al
test al, al
jne 0x180002a80
xor ecx, ecx
test r9d, r9d
jle 0x180002aba
mov r8, r10
nop dword [rax + rax]
mov eax, ecx
inc r8
cdq
and eax, 1
xor eax, edx
sub eax, edx
add al, cl
inc ecx
add byte [r8 - 1], al
cmp ecx, r9d
jl 0x180002aa0
mov rcx, qword [0x1800087f8]
lea eax, [r9 + 1]
lea rdx, [0x1800080d0]
mov dword [rsp + 0x28], eax
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], r10
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
nop word [rax + rax]
movzx eax, byte [rbx]
inc rbx
mov byte [rdi + rbx - 1], al
test al, al
jne 0x180002af0
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x180002b10
Capabilities:
Encode data using xor
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
dec rcx
mov r9, rcx
test ecx, ecx
jle 0x180002bce
lea r10, [0x180008ac8]
mov rdx, rbx
mov rdi, r10
sub rdi, rbx
nop dword [rax]
movzx eax, byte [rdx]
inc rdx
mov byte [rdi + rdx - 1], al
test al, al
jne 0x180002b50
xor ecx, ecx
test r9d, r9d
jle 0x180002b8a
mov r8, r10
nop dword [rax + rax]
mov eax, ecx
inc r8
cdq
and eax, 1
xor eax, edx
sub eax, edx
add al, cl
inc ecx
add byte [r8 - 1], al
cmp ecx, r9d
jl 0x180002b70
mov rcx, qword [0x1800087f8]
lea eax, [r9 + 1]
lea rdx, [0x1800080e8]
mov dword [rsp + 0x28], eax
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], r10
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
nop word [rax + rax]
movzx eax, byte [rbx]
inc rbx
mov byte [rdi + rbx - 1], al
test al, al
jne 0x180002bc0
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x180002be0
Capabilities:
Encode data using xor
Set registry value

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
or rcx, 0xffffffffffffffff
xor eax, eax
lea rsi, [0x1800063f0]
mov rdi, rsi
repne scasb al, byte [rdi]
not rcx
dec rcx
mov r9, rcx
test ecx, ecx
jle 0x180002ca4
xor edi, edi
mov qword [rsp + 0x40], rbx
lea rbx, [0x180008ad8]
mov rdx, rdi
nop
movzx eax, byte [rdx + rsi]
inc rdx
mov byte [rdx + rbx - 1], al
test al, al
jne 0x180002c20
mov ecx, edi
test r9d, r9d
jle 0x180002c5a
mov r8, rbx
nop dword [rax]
mov eax, ecx
inc r8
cdq
and eax, 1
xor eax, edx
sub eax, edx
add al, cl
inc ecx
add byte [r8 - 1], al
cmp ecx, r9d
jl 0x180002c40
mov rcx, qword [0x1800087f8]
lea eax, [r9 + 1]
lea rdx, [0x180008100]
mov dword [rsp + 0x28], eax
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
nop word [rax + rax]
movzx eax, byte [rdi + rsi]
inc rdi
mov byte [rdi + rbx - 1], al
test al, al
jne 0x180002c90
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x180004550
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0x80
mov rbp, rcx
mov rcx, qword [0x180008918]
mov rdi, rdx
or edx, 0xffffffff
mov ebx, r8d
mov esi, 1
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call qword [sym.imp.WS2_32.dll_WSACreateEvent]
mov dword [rsp + 0x40], ebx
mov r12, rax
mov qword [rsp + 0x50], rax
xor eax, eax
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x78], r12
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x48], rdi
xor ebx, ebx
nop word [rax + rax]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rbx
lea r9, [rsp + 0xb0]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x40]
mov r8d, esi
mov rcx, rbp
mov dword [rsp + 0x20], ebx
call qword [sym.imp.WS2_32.dll_WSASend]
cmp eax, 0xffffffff
jne 0x1800045fe
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
jne 0x180004667
lea rdx, [rsp + 0x50]
or r9d, 0xffffffff
xor r8d, r8d
mov ecx, esi
mov dword [rsp + 0x20], ebx
call qword [sym.imp.WS2_32.dll_WSAWaitForMultipleEvents]
cmp eax, 0xffffffff
je 0x180004667
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_WSAResetEvent]
lea r11, [rsp + 0xa8]
lea r8, [rsp + 0xb0]
lea rdx, [rsp + 0x60]
xor r9d, r9d
mov rcx, rbp
mov qword [rsp + 0x20], r11
call qword [sym.imp.WS2_32.dll_WSAGetOverlappedResult]
test eax, eax
je 0x180004667
mov eax, dword [rsp + 0xb0]
sub dword [rsp + 0x40], eax
je 0x180004669
add qword [rsp + 0x48], rax
jmp 0x1800045c0
mov esi, ebx
mov rcx, r12
call qword [sym.imp.WS2_32.dll_WSACloseEvent]
mov rcx, qword [0x180008918]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea r11, [rsp + 0x80]
mov eax, esi
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x180004bcb
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [section..data]
jne 0x1800046ea
rol rcx, 0x10
test cx, 0xffff
jne 0x1800046e6
repz ret
ror rcx, 0x10
jmp 0x180004b24
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x180008300]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x1800083f8]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x180004ba9
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x180008300]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x180004bcb
mov rax, qword [rsp + 0x88]
mov qword [0x1800083f8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x180008398], rax
mov rax, qword [0x1800083f8]
mov qword [0x180008270], rax
mov rax, qword [rsp + 0x90]
mov qword [0x180008380], rax
mov dword [0x180008260], 0xc0000409
mov dword [0x180008264], 1
mov rax, qword [section..data]
mov qword [rsp + 0x68], rax
mov rax, qword [0x180008008]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x1800082f8], eax
mov ecx, 1
call sub.MSVCR90.dll___crt_debugger_hook
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x180006328]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x1800082f8], 0
jne 0x180004c52
mov ecx, 1
call sub.MSVCR90.dll___crt_debugger_hook
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x180031350
Capabilities:
Check os version
Get common file path

Disassembly:
push rbx
mov eax, 0x1170
call fcn.18016e500
sub rsp, rax
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x18020b020]
xor rax, rsp
mov qword [rsp + 0x1160], rax
mov rbx, rdx
mov qword [rsp + 0x38], rdx
xor eax, eax
mov dword [rsp + 0x28], eax
mov qword [rdx + 0x10], rax
mov qword [rdx + 0x18], 7
mov word [rdx], ax
mov dword [rsp + 0x28], 1
lea ecx, [rax + 1]
call fcn.18011c674
mov qword [rsp + 0x20], rax
mov byte [rax], 0
xor edx, edx
mov r8d, 0x118
lea rcx, [rsp + 0x44]
call fcn.18013b560
mov dword [rsp + 0x40], 0x11c
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1800313e7
cmp dword [rsp + 0x44], 6
setae cl
mov rax, qword [rsp + 0x20]
mov byte [rax], cl
lea rcx, [rsp + 0x20]
call fcn.180082410
xor edx, edx
mov r8d, 0x1000
lea rcx, [rsp + 0x160]
call fcn.18013b560
xor r9d, r9d
lea r8d, [r9 + 0x1c]
lea rdx, [rsp + 0x160]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x18003144b
lea rax, [rsp + 0x160]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x180031430
lea rdx, [rsp + 0x160]
mov rcx, rbx
call fcn.180003950
lea rcx, [rsp + 0x20]
call fcn.180082720
nop
lea rcx, [rsp + 0x20]
call fcn.180081b70
mov rax, rbx
mov rcx, qword [rsp + 0x1160]
xor rcx, rsp
call fcn.18011c650
add rsp, 0x1170
pop rbx
ret
Function at 0x180047900
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xd0
mov qword [rbp - 0x71], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x18020b020]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rbx, rdx
mov qword [rbp - 0x69], rdx
xor r13d, r13d
mov dword [rbp - 0x79], r13d
mov dword [rbp - 0x59], 0x6c0047
mov dword [rbp - 0x55], 0x62006f
mov dword [rbp - 0x51], 0x6c0061
mov dword [rbp - 0x4d], 0x52005c
mov dword [rbp - 0x49], 0x410043
mov dword [rbp - 0x45], 0x370056
mov dword [rbp - 0x41], 0x340045
mov dword [rbp - 0x3d], 0x440037
mov dword [rbp - 0x39], 0x390041
mov dword [rbp - 0x35], 0x2d0033
mov dword [rbp - 0x31], 0x460041
mov dword [rbp - 0x2d], 0x310034
mov dword [rbp - 0x29], 0x34002d
mov dword [rbp - 0x25], 0x350034
mov dword [rbp - 0x21], 0x2d0030
mov dword [rbp - 0x1d], 0x300039
mov dword [rbp - 0x19], 0x440043
mov dword [rbp - 0x15], 0x33002d
mov dword [rbp - 0x11], 0x430031
mov dword [rbp - 0xd], 0x380037
mov dword [rbp - 9], 0x320031
mov dword [rbp - 5], 0x320035
mov dword [rbp - 1], 0x370038
mov dword [rbp + 3], 0x5f0044
mov dword [rbp + 7], 0x540052
mov dword [rbp + 0xb], 0x520050
mov dword [rbp + 0xf], 0x54004f
mov dword [rbp + 0x13], 0x430045
mov dword [rbp + 0x17], 0x5f0054
mov dword [rbp + 0x1b], 0x55004d
mov dword [rbp + 0x1f], 0x450054
mov dword [rbp + 0x23], 0x58
mov qword [rdx + 0x10], r13
mov qword [rdx + 0x18], 7
mov word [rdx], r13w
lea rax, [rbp - 0x59]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], r13w
jne 0x180047a42
lea rdx, [rbp - 0x59]
mov rcx, rbx
call fcn.180003950
nop
mov dword [rbp - 0x79], 1
mov rax, rbx
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.18011c650
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x180048800
Capabilities:
Check mutex on windows

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
lea rdx, [rsp + 0x28]
call fcn.180047900
nop
cmp qword [rax + 0x18], 8
jb 0x180048829
mov rax, qword [rax]
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rbx, rax
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x180048877
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180048872
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800488b8
call fcn.18011ca94
movdqa xmm0, xmmword [0x1801b12f0]
movdqu xmmword [rsp + 0x38], xmm0
xor eax, eax
mov word [rsp + 0x28], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
sete dil
test rbx, rbx
je 0x1800488a9
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, dil
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
call fcn.180144c64
int3

Function at 0x180048bc0
Capabilities:
Check mutex on windows

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x70], rsi
xor ebx, ebx
mov dword [rsp + 0x20], ebx
xor bpl, bpl
mov eax, dword [0x1802122d8]
test al, 1
jne 0x180048c35
or eax, 1
mov dword [0x1802122d8], eax
movdqa xmm0, xmmword [0x1801b12f0]
movdqu xmmword [0x180212340], xmm0
mov word [0x180212330], bx
lea r8d, [rbx + 0x2f]
lea rdx, str.GlobalRCAVD277DCA8_31E4_4750_8F68_057A8C0F2C93
lea rcx, [0x180212330]
call fcn.180003950
lea rcx, [0x1801846b0]
call fcn.18011ca7c
nop
lea rdx, [0x180212330]
lea rcx, [rsp + 0x30]
call fcn.1800260f0
mov esi, 1
mov dword [rsp + 0x20], esi
cmp qword [rax + 0x18], 8
jb 0x180048c59
mov rax, qword [rax]
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rdi, rax
mov ecx, esi
and ecx, 0xfffffffe
mov dword [rsp + 0x20], ecx
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x180048cb0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180048cab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180048cfb
call fcn.18011ca94
movdqa xmm0, xmmword [0x1801b12f0]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x30], bx
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, bpl
cmp eax, 0xb7
cmove ebx, esi
test rdi, rdi
je 0x180048ce3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, bl
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
call fcn.180144c64
int3
Function at 0x180051310
Capabilities:
Get file attributes
Set file attributes

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x60
mov qword [rax - 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rbx, rdx
mov qword [rax - 0x18], rdx
xor ebp, ebp
mov dword [rax - 0x48], ebp
mov eax, dword [0x180212370]
lea rsi, [0x180212350]
test al, 1
jne 0x18005138a
or eax, 1
mov dword [0x180212370], eax
mov qword [0x180212360], rbp
mov qword [0x180212368], 7
mov word [0x180212350], bp
xor r8d, r8d
lea rdx, [0x18019d818]
mov rcx, rsi
call fcn.180003950
lea rcx, [0x1801849e0]
call fcn.18011ca7c
nop
mov rcx, rsi
call fcn.180084be0
test al, al
je 0x1800513a6
mov rdx, rsi
mov rcx, rbx
call fcn.1800260f0
jmp 0x18005154b
lea rcx, [rsp + 0x28]
call fcn.18002d3d0
mov rdi, rax
cmp rsi, rax
je 0x1800513e4
mov rcx, rsi
call fcn.1800038d0
movups xmm0, xmmword [rdi]
movups xmmword [0x180212350], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [0x180212360], xmm1
mov qword [rdi + 0x10], rbp
mov qword [rdi + 0x18], 7
mov word [rdi], bp
mov rax, qword [rsp + 0x40]
cmp rax, 8
jb 0x180051426
lea rdx, [rax*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180051421
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180051572
call fcn.18011ca94
movdqa xmm0, xmmword [0x1801b12f0]
movdqu xmmword [rsp + 0x38], xmm0
mov word [rsp + 0x28], bp
mov rdx, rsi
cmp qword [0x180212360], 0
je 0x180051543
lea r8, [0x18020bd30]
lea rcx, [rsp + 0x28]
call fcn.180080ec0
mov rdi, rax
cmp rsi, rax
je 0x18005148f
mov rcx, rsi
call fcn.1800038d0
movups xmm0, xmmword [rdi]
movups xmmword [0x180212350], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [0x180212360], xmm1
mov qword [rdi + 0x10], rbp
mov qword [rdi + 0x18], 7
mov word [rdi], bp
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x1800514d1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800514cc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18005156c
call fcn.18011ca94
movdqa xmm0, xmmword [0x1801b12f0]
movdqu xmmword [rsp + 0x38], xmm0
mov word [rsp + 0x28], bp
mov edx, 0x10
mov rcx, rsi
call fcn.180080a80
mov rcx, rsi
call fcn.180084be0
test al, al
jne 0x180051505
mov rcx, rsi
call fcn.180085080
mov rcx, rsi
cmp qword [0x180212368], 8
cmovae rcx, qword [0x180212350]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 2
je 0x180051540
and eax, 0xfffffffd
mov rcx, rsi
cmp qword [0x180212368], 8
cmovae rcx, qword [0x180212350]
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rdx, rsi
mov rcx, rbx
call fcn.1800260f0
mov dword [rsp + 0x20], 1
mov rax, rbx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.180144c64
int3
call fcn.180144c64
int3
Function at 0x180055ba0
Capabilities:
Check os version

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0xc8]
sub rsp, 0x1b0
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x18020b020]
xor rax, rsp
mov qword [rbp + 0xa0], rax
mov rsi, rcx
xor r14d, r14d
mov dword [rsp + 0x20], r14d
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x24], r14d
mov qword [rsp + 0x58], r14
mov edi, 1
mov ecx, edi
call fcn.18011c674
mov rbx, rax
mov qword [rsp + 0x58], rax
mov byte [rax], r14b
xor edx, edx
mov r8d, 0x118
lea rcx, [rbp - 0x7c]
call fcn.18013b560
mov dword [rbp - 0x80], 0x11c
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x180055c37
cmp dword [rbp - 0x7c], 6
setae al
mov byte [rbx], al
lea r8, [rsp + 0x24]
lea rdx, [rsp + 0x28]
call fcn.180082b30
test al, al
je 0x180055d55
mov r8, qword [rsp + 0x28]
test r8, r8
je 0x180055d55
lea rdx, [rsp + 0x60]
call fcn.180082bc0
nop
cmp qword [rsp + 0x70], 0
jne 0x180055c76
xor bl, bl
jmp 0x180055d01
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
xor r9d, r9d
mov r8d, dword [rsp + 0x70]
lea rcx, [rsp + 0x30]
call fcn.180091cf0
mov dword [rsp + 0x20], edi
mov rdx, rax
mov rcx, rsi
call fcn.180055da0
and edi, 0xfffffffe
mov dword [rsp + 0x20], edi
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x180055cec
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180055ce7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180055d91
call fcn.18011ca94
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
mov bl, 1
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x180055d3f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180055d3a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180055d8b
call fcn.18011ca94
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], r14w
jmp 0x180055d57
xor bl, bl
lea rcx, [rsp + 0x58]
call fcn.180081b70
movzx eax, bl
mov rcx, qword [rbp + 0xa0]
xor rcx, rsp
call fcn.18011c650
lea r11, [rsp + 0x1b0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.180144c64
nop
call fcn.180144c64
int3