joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180073d2c
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.180073d7c
movzx r11d, word [rbx + 2]
xor word [rbx], r11w
xor edx, edx
lea r8, [rbx + 0x12]
mov eax, edx
inc edx
and eax, 3
shl eax, 2
mov ecx, dword [rax + rbx + 2]
xor dword [r8], ecx
add r8, 4
cmp edx, 0xa
jb 0x180073d49
mov al, byte [rbx + 0x10]
xor byte [rbx + 0x42], al
mov al, byte [rbx + 0x11]
xor byte [rbx + 0x43], al
add rsp, 0x20
pop rbx
ret

Function at 0x180073e5c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x38
test r8b, 0xf
mov r14d, r8d
mov r13, rdx
mov r15, rcx
je 0x180073e8f
mov eax, 1
jmp 0x180073fa9
test r8d, r8d
je 0x180073fa7
lea rdx, [rcx + 0xa8]
mov edi, dword [r13 + 8]
mov eax, dword [r13]
mov ecx, dword [r13 + 0xc]
mov r12d, dword [r13 + 4]
sub edi, dword [r15 + 0xb4]
add r13, 0x10
add r14d, 0xfffffff0
sub eax, dword [r15 + 0xb0]
mov qword [rsp + 0x88], r13
mov dword [rsp + 0x90], r14d
mov r15d, ecx
mov r13, rdx
mov r14d, socket
mov ebp, r15d
mov r15d, edi
mov edx, 5
lea ecx, [r15 + r15 + 1]
mov edi, r12d
mov ebx, eax
mov r12d, eax
imul ecx, r15d
call fcn.1800731ec
lea ecx, [r12 + r12 + 1]
mov edx, 5
mov esi, eax
imul ecx, ebx
call fcn.1800731ec
sub edi, dword [r13 + 4]
mov ecx, edi
mov edx, eax
mov ebx, eax
call fcn.180073fcc
sub ebp, dword [r13]
mov edx, esi
mov edi, eax
mov ecx, ebp
xor edi, esi
call fcn.180073fcc
dec r14
xor eax, ebx
sub r13, 8
test r14, r14
jg 0x180073ee1
mov r14d, dword [rsp + 0x90]
mov r13, qword [rsp + 0x88]
mov edx, r12d
mov r12, qword [rsp + 0x98]
mov dword [rsp + 0x20], r15d
mov r15, qword [rsp + 0x80]
sub edx, dword [r15 + 8]
mov ecx, dword [rsp + 0x20]
sub ecx, dword [r15 + 0xc]
mov dword [r12], eax
mov dword [r12 + 4], edx
mov dword [r12 + 8], edi
add r12, 0x10
test r14d, r14d
mov dword [r12 - 4], ecx
mov qword [rsp + 0x98], r12
lea rdx, [r15 + 0xa8]
jne 0x180073e9f
xor eax, eax
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180074a1c
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x160
mov rax, qword [0x1800d1eb0]
mov qword [rsp + 0x158], rax
mov esi, ecx
mov edi, 8
lea rdx, [0x1800d1620]
lea rcx, [rsp + 0x30]
mov r8d, edi
call fcn.1800715fc
mov rbx, qword [rsp + 0x30]
lea rdx, [0x1800d15f0]
lea rcx, [rsp + 0x30]
mov r8d, edi
call fcn.1800715fc
mov rbp, qword [rsp + 0x30]
lea rdx, [0x1800d1628]
lea rcx, [rsp + 0x30]
mov r8d, edi
call fcn.1800715fc
mov r12, qword [rsp + 0x30]
lea r8d, [rdi + 0xc]
lea rcx, [rsp + 0x140]
xor edx, edx
call fcn.180073d0c
cmp esi, 1
lea r8d, [rdi + 8]
lea rcx, [rsp + 0x140]
jne 0x180074ad8
lea rdx, [0x1800d1598]
call fcn.1800715fc
lea r11, [rsp + 0x140]
lea eax, [rdi - 4]
xor dword [r11], 0x3dd17ea6
add r11, 4
dec rax
jne 0x180074ac6
jmp 0x180074b09
lea rdx, [0x1800d15a8]
call fcn.1800715fc
lea r11, [rsp + 0x140]
mov eax, 4
xor dword [r11], 0x3dd17ea6
add r11, 4
dec rax
jne 0x180074af1
mov byte [rsp + 0x151], WSAStartup
lea rcx, [rsp + 0x140]
mov byte [rsp + 0x150], WSAStartup
call rbx
test rax, rax
mov rdi, rax
je 0x180074bdd
lea rdx, [0x1800d12f0]
mov r8d, pe_nt_image_headers64
mov rcx, rax
call fcn.180074e8c
test eax, eax
je 0x180074b97
call fcn.180074c6c
cmp eax, 3
je 0x180074ba1
cmp eax, 4
je 0x180074ba1
cmp eax, 5
je 0x180074ba1
cmp qword [0x1800d13f0], 0xffffffffffffffff
jne 0x180074ba1
lea rax, [rsp + 0x38]
lea r9, [0x1800d12f0]
lea r8, [0x1800752ac]
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
call fcn.180074f6c
cmp dword [0x1800d12e8], 0
mov qword [0x1800d13f0], rax
jne 0x180074ba1
mov eax, 0xa816001f
jmp 0x180074c3d
mov ebx, 1
mov rdx, rbx
mov rcx, rdi
call r12
test rax, rax
mov qword [rsp + rbx*8 + 0x40], rax
je 0x180074bd8
inc rbx
cmp rbx, 0x1f
jb 0x180074ba6
cmp esi, 1
mov rax, qword [rsp + 0x120]
jne 0x180074be4
mov qword [0x1800d1560], rax
jmp 0x180074beb
mov rcx, rdi
call rbp
mov eax, 0xa8160005
jmp 0x180074c3d
mov qword [0x1800d1568], rax
mov rcx, qword [rsp + 0x68]
call fcn.18007505c
test eax, eax
je 0x180074c00
mov eax, 0xa8160006
jmp 0x180074c3d
mov rdx, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0xf8]
call fcn.18007518c
test eax, eax
je 0x180074c20
mov eax, 0xa8160007
jmp 0x180074c3d
cmp esi, 1
jne 0x180074c31
mov dword [0x1800d1558], 2
jmp 0x180074c3b
mov dword [0x1800d155c], 2
xor eax, eax
mov rcx, qword [rsp + 0x158]
call fcn.18007a7c0
add rsp, 0x160
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180074c6c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
mov r11, rsp
sub rsp, 0xe0
mov rax, qword [0x1800d1eb0]
mov qword [rsp + 0xd8], rax
xor edx, edx
lea rcx, [r11 - 0x20]
lea r8d, [rdx + 0x14]
call fcn.180074dbc
mov byte [rsp + 0xc0], 0x47
mov byte [rsp + 0xc5], WSAStartup
mov byte [rsp + 0xca], 0x45
mov byte [rsp + 0xc1], 0x65
mov byte [rsp + 0xc6], reloc.WS2_32.dll_WSAStartup
mov byte [rsp + 0xcb], 0x78
mov byte [rsp + 0xc2], reloc.WS2_32.dll_WSACleanup
mov byte [rsp + 0xc7], 0x69
mov byte [rsp + 0xcc], 0x41
mov byte [rsp + 0xc3], 0x56
mov byte [rsp + 0xc8], WSAStartup
mov byte [rsp + 0xcd], 0
mov byte [rsp + 0xc4], 0x65
mov byte [rsp + 0xc9], WSAStartup
mov dword [rsp + 0x20], DllRegisterServer
call fcn.180074ddc
lea rdx, [rsp + 0xc0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rsp + 0xc0]
lea r8d, [rdx + 0x14]
mov rbx, rax
call fcn.180074dbc
lea rcx, [rsp + 0x20]
call rbx
test eax, eax
jne 0x180074d5c
lea r8d, [rax + 0x14]
lea rcx, [rsp + 0xc0]
xor edx, edx
call fcn.180074dbc
xor eax, eax
jmp 0x180074d93
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x180074d8e
dec eax
je 0x180074d78
dec eax
jne 0x180074d58
cmp dword [rsp + 0x24], 5
sbb eax, eax
add eax, 7
jmp 0x180074d93
mov eax, dword [rsp + 0x28]
test eax, eax
jne 0x180074d87
mov eax, 4
jmp 0x180074d93
mov eax, 5
jmp 0x180074d93
mov eax, 3
mov rcx, qword [rsp + 0xd8]
call fcn.18007a7c0
add rsp, 0xe0
pop rbx
ret

Function at 0x180074ddc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1800d1eb0]
mov qword [rsp + 0x38], rax
xor edx, edx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 0x14]
call fcn.180074dbc
cmp qword [0x1800d12c8], 1
mov byte [rsp + 0x28], 0x2e
mov byte [rsp + 0x29], 0x64
mov byte [rsp + 0x2a], 0x6c
mov byte [rsp + 0x2b], 0x6c
mov byte [rsp + 0x20], 0x6b
mov byte [rsp + 0x21], 0x65
mov byte [rsp + 0x22], WSAStartup
mov byte [rsp + 0x23], 0x6e
mov byte [rsp + 0x24], 0x65
mov byte [rsp + 0x25], 0x6c
mov byte [rsp + 0x26], gethostbyname
mov byte [rsp + 0x27], gethostbyname
mov byte [rsp + 0x2c], 0
jne 0x180074e59
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x1800d12c8], rax
xor edx, edx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 0x14]
call fcn.180074dbc
mov rax, qword [0x1800d12c8]
mov rcx, qword [rsp + 0x38]
call fcn.18007a7c0
add rsp, 0x48
ret
Function at 0x180074e8c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x48
mov rax, qword [0x1800d1eb0]
mov qword [rsp + 0x38], rax
mov rbp, rdx
xor edx, edx
mov edi, r8d
mov rsi, rcx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 0x14]
call fcn.180074dbc
mov byte [rsp + 0x20], 0x47
mov byte [rsp + 0x25], 0x64
mov byte [rsp + 0x2a], 0x69
mov byte [rsp + 0x2f], 0x6d
mov byte [rsp + 0x21], 0x65
mov byte [rsp + 0x27], 0x6c
mov byte [rsp + 0x2c], 0x65
mov byte [rsp + 0x30], 0x65
mov byte [rsp + 0x22], reloc.WS2_32.dll_WSACleanup
mov byte [rsp + 0x26], 0x75
mov byte [rsp + 0x2b], 0x6c
mov byte [rsp + 0x31], 0x41
mov byte [rsp + 0x23], 0x4d
mov byte [rsp + 0x28], 0x65
mov byte [rsp + 0x2d], 0x4e
mov byte [rsp + 0x32], 0
mov byte [rsp + 0x24], WSAStartup
mov byte [rsp + 0x29], 0x46
mov byte [rsp + 0x2e], 0x61
call fcn.180074ddc
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 0x14]
mov rbx, rax
call fcn.180074dbc
test rbx, rbx
jne 0x180074f49
lea eax, [rbx + 1]
jmp 0x180074f54
mov r8d, edi
mov rdx, rbp
mov rcx, rsi
call rbx
mov rcx, qword [rsp + 0x38]
call fcn.18007a7c0
add rsp, 0x48
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x180074f6c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x58
mov rax, qword [0x1800d1eb0]
mov qword [rsp + 0x48], rax
mov r13, qword [rsp + 0xb8]
mov rdi, rdx
xor edx, edx
mov rbp, r8
mov rsi, rcx
lea r8d, [rdx + 0x14]
lea rcx, [rsp + 0x30]
mov r12, r9
call fcn.180074dbc
mov byte [rsp + 0x30], 0x43
mov byte [rsp + 0x35], 0x65
mov byte [rsp + 0x3a], 0x61
mov byte [rsp + 0x31], WSAStartup
mov byte [rsp + 0x36], 0x54
mov byte [rsp + 0x3b], 0x64
mov byte [rsp + 0x32], 0x65
mov byte [rsp + 0x37], 0x68
mov byte [rsp + 0x3c], 0
mov byte [rsp + 0x33], 0x61
mov byte [rsp + 0x38], WSAStartup
mov byte [rsp + 0x34], reloc.WS2_32.dll_WSACleanup
mov byte [rsp + 0x39], 0x65
call fcn.180074ddc
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 0x14]
mov rbx, rax
call fcn.180074dbc
test rbx, rbx
jne 0x18007501b
lea rax, [rbx - 1]
jmp 0x180075039
mov eax, dword [rsp + 0xb0]
mov r9, r12
mov r8, rbp
mov rdx, rdi
mov rcx, rsi
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], eax
call rbx
mov rcx, qword [rsp + 0x48]
call fcn.18007a7c0
add rsp, 0x58
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18007568c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x1800d1eb0]
mov qword [rsp + 0x38], rax
xor edx, edx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 0x14]
call fcn.180074dbc
mov byte [rsp + 0x20], 0x47
mov byte [rsp + 0x25], reloc.WS2_32.dll_WSAStartup
mov byte [rsp + 0x2a], WSAStartup
mov byte [rsp + 0x21], 0x65
mov byte [rsp + 0x26], reloc.WS2_32.dll_WSACleanup
mov byte [rsp + 0x2b], WSAStartup
mov byte [rsp + 0x22], reloc.WS2_32.dll_WSACleanup
mov byte [rsp + 0x27], 0x45
mov byte [rsp + 0x2c], 0
mov byte [rsp + 0x23], 0x4c
mov byte [rsp + 0x28], WSAStartup
mov byte [rsp + 0x24], 0x61
mov byte [rsp + 0x29], WSAStartup
call fcn.180074ddc
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 0x14]
mov rbx, rax
call fcn.180074dbc
test rbx, rbx
jne 0x18007571e
xor eax, eax
jmp 0x180075720
call rbx
mov rcx, qword [rsp + 0x38]
call fcn.18007a7c0
add rsp, 0x40
pop rbx
ret

Function at 0x18007578c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x68
mov rax, qword [0x1800d1eb0]
mov qword [rsp + 0x58], rax
mov r13, qword [rsp + 0xd0]
mov esi, edx
xor edx, edx
mov edi, r8d
mov rbp, rcx
lea r8d, [rdx + 0x14]
lea rcx, [rsp + 0x40]
mov r12, r9
call fcn.180074dbc
mov byte [rsp + 0x40], 0x43
mov byte [rsp + 0x45], 0x65
mov byte [rsp + 0x4a], 0x41
mov byte [rsp + 0x41], WSAStartup
mov byte [rsp + 0x46], 0x46
mov byte [rsp + 0x4b], 0
mov byte [rsp + 0x42], 0x65
mov byte [rsp + 0x47], 0x69
mov byte [rsp + 0x43], 0x61
mov byte [rsp + 0x48], 0x6c
mov byte [rsp + 0x44], reloc.WS2_32.dll_WSACleanup
mov byte [rsp + 0x49], 0x65
call fcn.180074ddc
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rsp + 0x40]
lea r8d, [rdx + 0x14]
mov rbx, rax
call fcn.180074dbc
test rbx, rbx
jne 0x180075833
xor eax, eax
jmp 0x18007585b
mov eax, dword [rsp + 0xc8]
mov qword [rsp + 0x30], r13
mov r9, r12
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0xc0]
mov r8d, edi
mov edx, esi
mov rcx, rbp
mov dword [rsp + 0x20], eax
call rbx
mov rcx, qword [rsp + 0x58]
call fcn.18007a7c0
add rsp, 0x68
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18007587c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rdi
sub rsp, 0x48
mov rax, qword [0x1800d1eb0]
mov qword [rsp + 0x38], rax
xor edx, edx
mov rdi, rcx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 0x14]
call fcn.180074dbc
mov byte [rsp + 0x20], 0x43
mov byte [rsp + 0x25], 0x48
mov byte [rsp + 0x2a], 0x65
mov byte [rsp + 0x21], 0x6c
mov byte [rsp + 0x26], 0x61
mov byte [rsp + 0x2b], 0
mov byte [rsp + 0x22], WSAStartup
mov byte [rsp + 0x27], 0x6e
mov byte [rsp + 0x23], reloc.WS2_32.dll_WSAStartup
mov byte [rsp + 0x28], 0x64
mov byte [rsp + 0x24], 0x65
mov byte [rsp + 0x29], 0x6c
call fcn.180074ddc
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 0x14]
mov rbx, rax
call fcn.180074dbc
test rbx, rbx
jne 0x18007590d
xor eax, eax
jmp 0x180075912
mov rcx, rdi
call rbx
mov rcx, qword [rsp + 0x38]
call fcn.18007a7c0
add rsp, 0x48
pop rdi
pop rbx
ret

Function at 0x180078d90
Capabilities:
Enumerate threads

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1800d1eb0]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor edx, edx
lea ecx, [rdx + 4]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180078eb1
mov qword [rsp + 0x60], rdi
xor eax, eax
lea rdi, [rsp + 0x20]
mov ecx, 0x1c
lea rdx, [rsp + 0x20]
rep stosb byte [rdi], al
mov rcx, rbx
mov dword [rsp + 0x20], 0x1c
call sub.KERNEL32.dll_Thread32First
mov rdi, qword [rsp + 0x60]
test eax, eax
je 0x180078eb1
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x2c], eax
jne 0x180078e9c
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rsp + 0x28], eax
je 0x180078e9c
mov rdx, qword [0x1800d9c80]
test rdx, rdx
jne 0x180078e4b
mov rcx, qword [0x1800d4048]
mov r8d, 0x400
mov dword [0x1800d9c88], 0x100
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdx, rax
mov qword [0x1800d9c80], rax
test rax, rax
je 0x180078eb1
jmp 0x180078e89
mov eax, dword [0x1800d9c88]
cmp dword [0x1800d9c8c], eax
jb 0x180078e89
mov rcx, qword [0x1800d4048]
add eax, eax
mov r8, rdx
mov r9d, eax
xor edx, edx
mov dword [0x1800d9c88], eax
shl r9, 2
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rdx, rax
test rax, rax
je 0x180078eb1
mov qword [0x1800d9c80], rax
mov ecx, dword [0x1800d9c8c]
mov eax, dword [rsp + 0x28]
mov dword [rdx + rcx*4], eax
inc dword [0x1800d9c8c]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x180078df1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.18007a7c0
add rsp, 0x50
pop rbx
ret
Function at 0x180078ed0
Capabilities:
Suspend thread

Disassembly:
mov qword [rsp + 0x20], rbp
push r12
sub rsp, 0x20
mov ebp, edx
mov r12d, ecx
call fcn.180078d90
mov r11, qword [0x1800d9c80]
test r11, r11
je 0x180078f6d
mov qword [rsp + 0x30], rbx
xor ebx, ebx
cmp dword [0x1800d9c8c], ebx
jbe 0x180078f68
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rdi
mov edi, ebx
nop dword [rax]
mov r8d, dword [rdi + r11]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x180078f47
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov r8d, ebp
mov edx, r12d
mov rcx, rsi
call fcn.180078bd0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
add rdi, 4
cmp ebx, dword [0x1800d9c8c]
jae 0x180078f5e
mov r11, qword [0x1800d9c80]
jmp 0x180078f10
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret

Function at 0x180078f80
Capabilities:
Resume thread

Disassembly:
sub rsp, 0x28
mov r8, qword [0x1800d9c80]
test r8, r8
je 0x180079022
mov qword [rsp + 0x30], rbx
xor ebx, ebx
cmp dword [0x1800d9c8c], ebx
jbe 0x180078ff8
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x20], rdi
xor edi, edi
nop
mov r8d, dword [rdi + r8]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x180078fd9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8, qword [0x1800d9c80]
inc ebx
add rdi, 4
cmp ebx, dword [0x1800d9c8c]
jb 0x180078fb0
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x38]
mov rcx, qword [0x1800d4048]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x30]
mov qword [0x1800d9c80], 0
mov qword [0x1800d9c88], 0
add rsp, 0x28
ret
Function at 0x180079030
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov ebx, ecx
mov ebp, edx
mov esi, 5
imul rbx, rbx, 0x38
add rbx, qword [0x1800d9c70]
test byte [rbx + 0x20], 1
mov rdi, qword [rbx]
je 0x180079069
sub rdi, rsi
mov esi, 7
lea r9, [rsp + 0x30]
mov r8d, 0x40
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x18007908b
mov eax, 0xa
jmp 0x180079104
test ebp, ebp
je 0x1800790b2
mov byte [rdi], 0xe9
mov eax, dword [rbx + 8]
sub eax, edi
sub eax, 5
mov dword [rdi + 1], eax
test byte [rbx + 0x20], 1
je 0x1800790d5
mov rax, qword [rbx]
mov byte [rax], 0xeb
mov rax, qword [rbx]
mov byte [rax + 1], 0xf9
jmp 0x1800790d5
mov eax, dword [rbx + 0x18]
test byte [rbx + 0x20], 1
mov dword [rdi], eax
je 0x1800790ce
movzx eax, word [rbx + 0x1c]
mov word [rdi + 4], ax
movzx eax, byte [rbx + 0x1e]
mov byte [rdi + 6], al
jmp 0x1800790d5
movzx eax, byte [rbx + 0x1c]
mov byte [rdi + 4], al
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
and dword [rbx + 0x20], 0xfffffff9
and ebp, 1
lea eax, [rbp + rbp]
mov ecx, ebp
and ecx, 0xfffffffd
or ecx, eax
add ecx, ecx
or dword [rbx + 0x20], ecx
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x180079920
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x50
mov rbp, rcx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rbx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
cmp rbp, 0x2000000
jbe 0x18007995e
lea rax, [rbp - 0x2000000]
cmp rbx, rax
cmovbe rbx, rax
mov rcx, qword [0x1800d9c68]
lea rax, [rbp + 0x2000000]
cmp rsi, rax
cmovae rsi, rax
test rcx, rcx
je 0x180079995
cmp rcx, rbx
jb 0x18007998d
cmp rcx, rsi
jae 0x18007998d
cmp qword [rcx + 8], 0
jne 0x180079a72
mov rcx, qword [rcx]
test rcx, rcx
jne 0x180079978
and rbp, 0xfffffffffffff000
mov qword [rsp + 0x60], rdi
lea rdi, [rbp - 0x1000]
cmp rdi, rbx
jb 0x1800799e0
nop dword [rax]
mov edx, 0x1000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rcx, rax
test rax, rax
jne 0x180079a21
sub rdi, 0x1000
cmp rdi, rbx
jae 0x1800799b0
jmp 0x1800799e5
test rcx, rcx
jne 0x180079a21
lea rbx, [rbp + 0x1000]
cmp rbx, rsi
jae 0x180079a6d
mov edx, 0x1000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rcx, rax
test rax, rax
jne 0x180079a21
add rbx, 0x1000
cmp rbx, rsi
jb 0x1800799f1
jmp 0x180079a6d
lea rdx, [rcx + 0x40]
mov qword [rcx + 8], 0
mov r8, rdx
sub r8, rcx
nop word [rax + rax]
mov rax, qword [rcx + 8]
add r8, 0x40
mov qword [rdx], rax
mov qword [rcx + 8], rdx
add rdx, 0x40
cmp r8, 0x1000
jbe 0x180079a40
mov rax, qword [0x1800d9c68]
mov qword [rcx], rax
mov qword [0x1800d9c68], rcx
mov rdi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rax, rcx
add rsp, 0x50
pop rsi
ret
Function at 0x18007b8e4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, edx
test rcx, rcx
jne 0x18007b90e
call fcn.180081d30
and dword [rax], 0
call fcn.180081d10
mov ebx, socket
mov dword [rax], ebx
call fcn.180081ca8
mov eax, ebx
jmp 0x18007b95e
test edx, 0xfffffff9
jne 0x18007b8f1
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x18007b937
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.180081d50
call fcn.180081d10
mov eax, dword [rax]
jmp 0x18007b95e
test al, 0x10
jne 0x18007b95c
test al, 1
je 0x18007b95c
test bl, 2
je 0x18007b95c
call fcn.180081d30
mov dword [rax], 5
call fcn.180081d10
mov dword [rax], recv
jmp 0x18007b92e
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x180080760
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x180080776
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x180080778
xor eax, eax
test eax, eax
je 0x180080788
mov ecx, eax
call fcn.180081d50
or eax, 0xffffffff
jmp 0x18008078a
xor eax, eax
add rsp, 0x28
ret

Function at 0x180080aa3
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1800d1eb0]
jne 0x18007a7da
rol rcx, 0x10
test cx, 0xffff
jne 0x18007a7d6
repz ret
ror rcx, 0x10
jmp 0x1800809fc
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x1800d4140]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x1800d4238]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x180080a81
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x1800d4140]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x180080aa3
mov rax, qword [rsp + 0x88]
mov qword [0x1800d4238], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1800d41d8], rax
mov rax, qword [0x1800d4238]
mov qword [0x1800d40b0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1800d41c0], rax
mov dword [0x1800d40a0], 0xc0000409
mov dword [0x1800d40a4], 1
mov rax, qword [0x1800d1eb0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1800d1eb8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x1800d4138], eax
mov ecx, 1
call fcn.180090a54
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1800a2040]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x1800d4138], 0
jne 0x180080b2a
mov ecx, 1
call fcn.180090a54
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret