joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14008d412
Capabilities:
Get client handle via schannel
Get outbound credentials handle via credssp

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xb8
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0xa8], xmm0
movups xmmword [rsp + 0x98], xmm0
movups xmmword [rsp + 0x88], xmm0
movups xmmword [rsp + 0x78], xmm0
mov dword [rsp + 0x68], 4
mov dword [rsp + 0xb0], 0x400010
mov rax, qword [rcx + 0x18]
test rax, rax
je 0x14008d475
mov edx, dword [rcx + 0x28]
mov dword [rsp + 0x90], edx
mov qword [rsp + 0x98], rax
mov rax, qword [rcx + 0x30]
test rax, rax
je 0x14008d4ab
mov r8, qword [rcx + 0x40]
xor edx, edx
test r8, r8
je 0x14008d4a4
lea r9, [0x140157908]
xor r10d, r10d
movzx r11d, byte [rax + r10]
or edx, dword [r9 + r11*4]
inc r10
cmp r8, r10
jne 0x14008d493
mov dword [rsp + 0xa0], edx
mov r15, qword [rcx + 0x10]
lea rsi, [r15*8]
test r15, r15
je 0x14008d4fc
mov rax, r15
shr rax, 0x3c
jne 0x14008d5be
mov rbx, qword [rcx]
mov ecx, 8
mov rdx, rsi
call fcn.1400ae2fe
test rax, rax
je 0x14008d5c5
mov rdi, rax
xor eax, eax
mov rcx, qword [rbx + rax*8]
mov qword [rdi + rax*8], rcx
inc rax
cmp r15, rax
jne 0x14008d4e7
mov eax, r15d
jmp 0x14008d503
xor eax, eax
mov edi, 8
lea rcx, [rsp + 0x68]
mov dword [rcx + 4], eax
mov qword [rcx + 8], rdi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], rcx
and qword [rsp + 0x40], 0
lea rdx, str.Microsoft_Unified_Security_Protocol_Provider
xor ecx, ecx
mov r8d, 2
xor r9d, r9d
call qword [sym.imp.secur32.dll_AcquireCredentialsHandleA]
test eax, eax
je 0x14008d55a
mov ebx, eax
shl rbx, 0x20
or rbx, 2
mov r14d, 1
jmp 0x14008d592
mov r14, qword [rsp + 0x50]
mov r12, qword [rsp + 0x58]
mov ecx, 8
mov edx, 0x20
call fcn.1400ae2fe
test rax, rax
je 0x14008d5cf
mov rbx, rax
mov eax, 1
mov qword [rbx], rax
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], r12
xor r14d, r14d
test r15, r15
je 0x14008d5a7
mov edx, 8
mov rcx, rdi
mov r8, rsi
call fcn.140004072
mov rax, r14
mov rdx, rbx
add rsp, 0xb8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
call fcn.140010250
ud2
mov ecx, 8
mov rdx, rsi
jmp 0x14008d5d9
mov ecx, 8
mov edx, 0x20
call fcn.1400cdc50
ud2

Function at 0x14008dc15
Capabilities:
Get remote cert context via schannel

Disassembly:
sub rsp, 0x28
lea r8, [rsp + 0x20]
and qword [r8], 0
invalid
mov edx, 0x53
call qword [sym.imp.secur32.dll_QueryContextAttributesW]
mov edx, eax
xor eax, eax
test edx, edx
setne cl
invalid
jne 0x14008dc3f
mov rdx, qword [rsp + 0x20]
jmp 0x14008dc47
shl rdx, 0x20
or rdx, 2
mov al, cl
add rsp, 0x28
ret
Function at 0x14008fbd1
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
mov eax, edx
lea r9, [rsp + 0x34]
mov dword [r9], r8d
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, eax
call qword [sym.imp.ws2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x14008fbfe
xor eax, eax
jmp 0x14008fc03
call fcn.1400408b9
nop
add rsp, 0x38
ret

Function at 0x1400916f0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
Function at 0x1400a2ea0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x88
movdqa xmmword [rsp + 0x70], xmm6
mov rsi, rcx
lea rcx, [rsp + 0x40]
call fcn.140091fd0
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x48]
test rcx, rcx
je 0x1400a2f16
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rdx
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x58]
and al, 0x58
call fcn.1400a2dd0
mov rdi, qword [rsp + 0x28]
test rdi, rdi
je 0x1400a2f24
movdqu xmm6, xmmword [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400a2f44
mov qword [rsi], rdi
movdqu xmmword [rsi + 8], xmm6
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x28], 0
mov qword [rsi], 0
movq rax, xmm6
movd eax, mm6
Function at 0x1400a5100
Capabilities:
Create thread

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, r8
mov r14, rdx
mov rsi, rcx
movzx eax, byte [0x14016dc80]
mov ecx, 0x10
mov edx, 8
call fcn.1400bde50
test rax, rax
je 0x1400a51d7
mov rbx, rax
mov qword [rax], r14
mov qword [rax + 8], rdi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x1400a55c0]
xor edi, edi
xor ecx, ecx
mov rdx, rsi
mov r9, rax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x1400a51c9
mov rcx, qword [rbx]
mov qword [rbp - 0x18], rbx
mov rax, qword [rbx + 8]
mov qword [rbp - 0x20], rcx
mov qword [rbp - 0x10], rax
call qword [rax]
mov rax, qword [rbp - 0x10]
cmp qword [rax + 8], 0
je 0x1400a51a6
mov rdx, qword [rax + 0x10]
mov rcx, qword [rbp - 0x20]
call fcn.1400bdee0
mov edx, 8
mov rcx, qword [rbp - 0x18]
call fcn.1400bdee0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov edi, 1
mov rax, rdi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov qword [rbp - 0x10], r14
mov qword [rbp - 0x18], rdi
mov ecx, 8
mov edx, 0x10
call fcn.1400cdc50
ud2
Function at 0x1400a5a60
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
mov eax, 0x1098
call fcn.1400be430
sub rsp, rax
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x1000], xmm6
mov qword [rbp + 0xff8], 0xfffffffffffffffe
mov qword [rbp + 0xfd8], rdx
mov r14, rcx
lea rsi, [rbp - 0x50]
mov r8d, 0x1000
mov rcx, rsi
xor edx, edx
call fcn.1400bf920
mov dword [rbp + 0xfec], 0
xorps xmm6, xmm6
movaps xmmword [rbp + 0xfb0], xmm6
mov qword [rbp + 0xfc0], 0
lea r15, [rbp + 0xfec]
mov qword [rbp + 0xfc8], r15
lea r12, [loc.14009be50]
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0xfb0]
mov rcx, r14
mov rdx, rsi
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_ReadFileEx]
test eax, eax
je 0x1400a5c4e
mov r13, qword [sym.imp.KERNEL32.dll_SleepEx]
lea rsi, [rbp + 0xfb0]
mov rdi, qword [sym.imp.KERNEL32.dll_WriteFileEx]
mov qword [rbp + 0xfe0], r14
mov ecx, 0xffffffff
mov edx, 1
call r13
cmp dword [rbp + 0xfec], 0
je 0x1400a5b27
cmp dword [rbp + 0xff0], 0
jne 0x1400a5c63
mov ebx, dword [rbp + 0xff4]
test rbx, rbx
je 0x1400a5c63
cmp ebx, 0x1000
ja 0x1400a5ca7
xor r14d, r14d
nop dword [rax + rax]
cmp r14, rbx
ja 0x1400a5c93
lea rdx, [r14 + rbp]
add rdx, 0xffffffffffffffb0
mov r8d, ebx
sub r8d, r14d
mov dword [rbp + 0xfec], 0
movaps xmmword [rbp + 0xfb0], xmm6
mov qword [rbp + 0xfc0], 0
mov qword [rbp + 0xfc8], r15
mov qword [rsp + 0x20], r12
mov rcx, qword [rbp + 0xfd8]
mov r9, rsi
call rdi
test eax, eax
je 0x1400a5c56
nop word cs:[rax + rax]
mov ecx, 0xffffffff
mov edx, 1
call r13
cmp dword [rbp + 0xfec], 0
je 0x1400a5bd0
cmp dword [rbp + 0xff0], 0
jne 0x1400a5c5c
mov eax, dword [rbp + 0xff4]
add r14, rax
cmp r14, rbx
jne 0x1400a5b70
mov dword [rbp + 0xfec], 0
movaps xmmword [rbp + 0xfb0], xmm6
mov qword [rbp + 0xfc0], 0
mov qword [rbp + 0xfc8], r15
mov qword [rsp + 0x20], r12
mov r14, qword [rbp + 0xfe0]
mov rcx, r14
lea rdx, [rbp - 0x50]
mov r8d, 0x1000
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_ReadFileEx]
test eax, eax
jne 0x1400a5b27
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400a5c63
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14, qword [rbp + 0xfe0]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
call rsi
mov rcx, qword [rbp + 0xfd8]
call rsi
movaps xmm6, xmmword [rbp + 0x1000]
add rsp, 0x1098
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea r8, str.library_std_src_syswindowspipe.rs
mov rcx, r14
mov rdx, rbx
call fcn.1400ce2a0
jmp 0x1400a5cbb
lea r8, str.library_std_src_syswindowspipe.rs
mov edx, 0x1000
mov rcx, rbx
call fcn.1400ce010
ud2
Function at 0x1400a5d10
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rbp
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov qword [rbp - 8], 0xfffffffffffffffe
xorps xmm0, xmm0
movaps xmmword [rbp - 0x20], xmm0
lea rcx, [rbp - 0x20]
mov edx, 0x10
call qword [sym.imp.ADVAPI32.dll_SystemFunction036]
test al, al
je 0x1400a5d53
mov rax, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
add rsp, 0x80
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x10]
mov qword [rbp - 0x30], rax
lea rax, [fcn.140096990]
mov qword [rbp - 0x28], rax
lea rax, str.fallback_RNG_broken:
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 1
mov qword [rbp - 0x40], 0
lea rax, [rbp - 0x30]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 1
lea rdx, str.library_std_src_syswindows_rand.rs
lea rcx, [rbp - 0x60]
call fcn.1400cded0
ud2

Function at 0x1400a83f0
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rdi, rdx
cmp qword [rdx], 0
jne 0x1400a84f7
mov rsi, rcx
mov rbx, qword [rdi + 0x18]
mov rax, qword [rbx + 8]
test rax, rax
jne 0x1400a8428
mov rdx, qword [rbx + 0x10]
lea rax, [rdx + 0xf]
cmp rax, 0xf
jbe 0x1400a84e0
xor eax, eax
mov rdx, qword [rbx + 0x10]
cmp rax, rdx
je 0x1400a84c2
sub rax, rdx
add rdx, qword [rbx]
mov r8, qword [rdi + 0x10]
mov ecx, 0xffffffff
cmp rax, rcx
cmovae rax, rcx
mov dword [rsp + 0x30], 0
mov rcx, qword [rdi + 0x20]
mov qword [rsp + 0x20], r8
lea r9, [rsp + 0x30]
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400a847e
mov eax, dword [rsp + 0x30]
mov ecx, 2
test rax, rax
jne 0x1400a849b
jmp 0x1400a8490
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x1400a8496
cmp eax, 0x6d
jne 0x1400a84b2
mov byte [rsi + 1], 0
jmp 0x1400a84a6
mov ecx, 1
mov qword [rdi], rcx
mov qword [rdi + 8], rax
mov byte [rsi + 1], 1
xor eax, eax
mov byte [rsi], al
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov al, 1
jmp 0x1400a84a8
mov r8d, 1
mov rcx, rbx
mov rdx, rax
call fcn.1400d1100
mov rax, qword [rbx + 8]
mov rdx, qword [rbx + 0x10]
jmp 0x1400a8435
mov r8d, 0x10
mov rcx, rbx
call fcn.1400d1100
mov rax, qword [rbx + 8]
jmp 0x1400a8428
mov qword [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.1400d1560
ud2

Function at 0x1400ad480
Capabilities:
Generate random numbers via winapi

Disassembly:
sub rsp, 0x38
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x10
mov r9d, 2
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
js 0x1400ad4b5
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
jmp 0x1400ad4ba
call fcn.1400a5d10
nop
add rsp, 0x38
ret
Function at 0x1400b2c2c
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx]
mov rdx, rax
xor rdx, 3
lock cmpxchg qword [rcx], rdx
jne 0x1400b2c33
test al, 1
je 0x1400b2c52
test al, 2
jne 0x1400b2c67
xor rax, 3
add rsp, 0x28
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x140131f68]
mov edx, 0x23
jmp 0x1400b2c7a
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x140131fa8]
mov edx, 0x25
call fcn.1400ce090
ud2

Function at 0x1400b3501
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x30
mov ebx, edx
call fcn.1400b253f
mov rcx, qword [rax]
movzx eax, bl
lea r9, [rsp + 0x2c]
mov dword [r9], eax
mov dword [rsp + 0x20], 4
mov edx, 6
mov r8d, 1
call qword [sym.imp.ws2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x1400b353d
xor eax, eax
jmp 0x1400b354b
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
add rsp, 0x30
pop rbx
ret
Function at 0x1400b3551
Capabilities:
Receive data
Receive data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov qword [rsp + 0x60], rdx
mov r14, rcx
lea r12, [rsp + 0x72]
lea rbx, [rsp + 0x42]
lea r15, [rcx + 0x18]
xor eax, eax
cmp qword [rcx + 0x18], 0xffffffffffffffff
cmove r15, rax
mov rbp, qword [r8 + 8]
mov rdi, qword [r8 + 0x10]
mov rcx, rbp
sub rcx, rdi
mov qword [rsp + 0x48], r8
mov rax, qword [r8]
add rax, rdi
mov qword [rsp + 0x50], rax
mov eax, 0x7fffffff
cmp rcx, rax
cmovae rcx, rax
mov qword [rsp + 0x58], rcx
lea r13, [rsp + 0x68]
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r14
mov rdx, qword [r14 + 0x10]
mov rcx, r13
mov r8, qword [rsp + 0x60]
xor r9d, r9d
call fcn.1400b3328
mov al, byte [rsp + 0x71]
cmp al, 3
je 0x1400b36ee
mov rsi, qword [rsp + 0x68]
cmp al, 2
je 0x1400b3726
mov cl, byte [rsp + 0x70]
movzx edx, word [r12 + 4]
mov word [rbx + 4], dx
mov edx, dword [r12]
mov dword [rbx], edx
mov qword [rsp + 0x38], rsi
mov byte [rsp + 0x40], cl
mov byte [rsp + 0x41], al
cmp rbp, rdi
jb 0x1400b373f
mov rcx, r15
lea rdx, str.C:Usersuser.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.36.0_srciopoll_evented.rs
call fcn.14003672e
mov rcx, qword [r15]
mov rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x1400b36f5
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
cmp eax, 0x274a
je 0x1400b36fa
mov esi, eax
shl rsi, 0x20
or rsi, 2
mov rcx, rsi
call fcn.140025ba4
cmp al, 0xd
jne 0x1400b36c3
mov rax, qword [r15 + 8]
test rax, rax
je 0x1400b36c3
mov rcx, rsi
call fcn.1400ae48c
invalid
invalid
cmp al, 0xd
jne 0x1400b3726
mov qword [rsp + 0x68], rsi
mov rcx, r14
lea rdx, [rsp + 0x38]
call fcn.1400b32c5
in al, 0xfb
invalid
invalid
mov rcx, r13
call fcn.1400ae41e
jmp 0x1400b35c3
invalid
mov eax, 1
jmp 0x1400b3728
movsxd r8, eax
jmp 0x1400b36fd
xor r8d, r8d
lea rax, [rdi + r8]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rdx + 0x18]
cmp rax, rcx
jbe 0x1400b3716
mov qword [rdx + 0x18], rax
mov rcx, rax
invalid
add rdi, r8
jb case.0x14005e90f.1460
xor eax, eax
mov rdx, rsi
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea r8, str.C:Usersuser.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.36.0_srcio_read_buf.rs
mov rcx, rdi
mov rdx, rbp
call fcn.1400cdf10
ud2
lea rcx, str.filled_overflowfilled_must_not_become_larger_than_initialized
lea r8, str.C:Usersuser.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.36.0_srciopoll_evented.rs
mov edx, 0xf
call fcn.1400ce480
adc dword [rbp + 0xb0f0001], ebp
Function at 0x1400b37a8
Capabilities:
Send data
Send data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov rdi, r9
mov rbx, r8
mov r14, rdx
mov esi, edx
mov qword [rsp + 0x28], rcx
mov rax, qword [rsp + 0xc0]
add byte [rax - 0x73], cl
insb byte [rdi], dx
and al, 0x3a
lea r13, [rsp + 0x52]
xor ecx, ecx
cmp qword [rdx + 0x18], 0xffffffffffffffff
lea r15, [rdx + 0x18]
cmove r15, rcx
mov r12d, 0x7fffffff
cmp rax, r12
cmovb r12, rax
cmovb esp, eax
lea rsi, [rsp + 0x30]
mov qword [rsp + 0x40], r15

Function at 0x1400be974
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400be9be
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400be9be
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400be9be
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400be9be
cmp dword [rcx + 0x84], 0xe
jbe 0x1400be9be
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400be9c0
xor al, al
add rsp, 0x28
ret

Function at 0x1400c42a0
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400c40cc
Function at 0x180001010
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rdi
sub rsp, 0x448
mov rax, qword [0x180020008]
xor rax, rsp
mov qword [rsp + 0x430], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x400
call fcn.180003b80
lea rdi, [rsp + 0x468]
call fcn.180001000
mov qword [rsp + 0x28], rdi
lea rdx, [rsp + 0x30]
mov r9, rbx
mov qword [rsp + 0x20], 0
mov r8d, 0x400
mov rcx, qword [rax]
call fcn.180007224
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [rsp + 0x430]
xor rcx, rsp
call fcn.180002a50
add rsp, 0x448
pop rdi
pop rbx
ret

Function at 0x180001280
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rdi
sub rsp, 0x848
mov rax, qword [0x180020008]
xor rax, rsp
mov qword [rsp + 0x830], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x800
call fcn.180003b80
lea rdi, [rsp + 0x868]
call fcn.180001000
mov qword [rsp + 0x28], rdi
lea rdx, [rsp + 0x30]
mov r9, rbx
mov qword [rsp + 0x20], 0
mov r8d, 0x400
mov rcx, qword [rax]
call fcn.180007288
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rsp + 0x830]
xor rcx, rsp
call fcn.180002a50
add rsp, 0x848
pop rdi
pop rbx
ret
Function at 0x180001ee0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x300
mov rax, qword [0x180020008]
xor rax, rsp
mov qword [rsp + 0x2f0], rax
mov edi, edx
mov rbx, rcx
mov edx, 0x104
lea rcx, [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xor esi, esi
mov dword [rsp + 0x50], esi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
lea rcx, [rsp + 0xe0]
mov eax, 0x82
mov edx, eax
cmp dword [rsp + 0x50], esi
je 0x180001fc0
nop dword [rax + rax]
cmp word [rcx], si
je 0x180001f5f
add rcx, 2
sub rdx, 1
jne 0x180001f50
mov rcx, rax
sub rcx, rdx
test rdx, rdx
cmove rcx, rsi
je 0x18000202f
lea rdx, [rsp + 0xe0]
lea rdx, [rdx + rcx*2]
sub rax, rcx
je 0x180002021
lea r9, str.SysWOW64dllhost.exe
mov ecx, 0x7ffffffe
sub r9, rdx
test rcx, rcx
je 0x180002021
movzx r8d, word [r9 + rdx]
test r8w, r8w
je 0x180002021
mov word [rdx], r8w
dec rcx
add rdx, 2
sub rax, 1
jne 0x180001f96
jmp 0x180002021
cmp word [rcx], si
je 0x180001fcf
add rcx, 2
sub rdx, 1
jne 0x180001fc0
mov rcx, rax
sub rcx, rdx
test rdx, rdx
cmove rcx, rsi
je 0x18000202f
lea rdx, [rsp + 0xe0]
lea rdx, [rdx + rcx*2]
sub rax, rcx
je 0x180002021
lea r9, str._system32dllhost.exe
mov ecx, 0x7ffffffe
sub r9, rdx
nop
test rcx, rcx
je 0x180002021
movzx r8d, word [r9 + rdx]
test r8w, r8w
je 0x180002021
mov word [rdx], r8w
dec rcx
add rdx, 2
sub rax, 1
jne 0x180002000
test rax, rax
lea rcx, [rdx - 2]
cmovne rcx, rdx
mov word [rcx], si
xor edx, edx
lea rcx, [rsp + 0x70]
lea r8d, [rdx + 0x68]
call qword [0x1800221a8]
xor edx, edx
lea rcx, [rsp + 0x58]
lea r8d, [rdx + 0x18]
call qword [0x1800221a8]
lea rax, [rsp + 0x58]
mov dword [rsp + 0x70], 0x68
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0xe0]
lea rax, [rsp + 0x70]
mov dword [rsp + 0xac], 1
mov qword [rsp + 0x40], rax
xor r9d, r9d
mov qword [rsp + 0x38], rsi
xor r8d, r8d
mov qword [rsp + 0x30], rsi
xor ecx, ecx
mov dword [rsp + 0x28], 0x14
mov dword [rsp + 0x20], esi
mov word [rsp + 0xb0], si
call qword [0x1800221d8]
test eax, eax
je 0x1800020c0
mov rcx, qword [rsp + 0x58]
mov r9d, edi
mov r8, rbx
call fcn.180001c30
mov rcx, qword [rsp + 0x60]
call qword [0x1800221c0]
xor eax, eax
mov rcx, qword [rsp + 0x2f0]
xor rcx, rsp
call fcn.180002a50
lea r11, [rsp + 0x300]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x180002100
Capabilities:
Create process on windows
Encode data using xor

Disassembly:
push rbp
lea rbp, [rsp - 0x270]
sub rsp, 0x370
mov rax, qword [0x180020008]
xor rax, rsp
mov qword [rbp + 0x260], rax
xor edx, edx
lea rcx, [rbp + 0x40]
mov r8d, 0x104
call fcn.180003b80
mov rcx, qword [0x1800221a0]
lea rdx, [rbp + 0x40]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor edx, edx
lea rcx, [rbp + 0x150]
mov r8d, 0x104
call fcn.180003b80
movdqa xmm0, xmmword [0x18001dd00]
lea rcx, [rbp - 0x20]
movdqa xmm1, xmmword [0x18001dd10]
mov al, 0x97
movdqa xmmword [rbp - 0x10], xmm0
movdqa xmm0, xmmword [0x18001dd30]
movdqa xmmword [rbp], xmm1
movdqa xmm1, xmmword [0x18001dd20]
movdqa xmmword [rbp + 0x10], xmm0
movdqa xmmword [rbp + 0x20], xmm1
mov dword [rbp - 0x1f], 0x84c58280
mov dword [rbp - 0x1b], 0xc7c58181
mov dword [rbp - 0x17], 0xbca0aead
mov word [rbp - 0x13], 0xa6ba
mov byte [rbp - 0x11], 0xb0
mov dword [rbp + 0x30], 0xe5a3cac5
nop
xor al, 0xe5
mov byte [rcx], al
lea rcx, [rcx + 1]
movzx eax, byte [rcx]
test al, al
jne 0x1800021c0
lea r8, [rbp + 0x40]
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0x150]
call fcn.180002740
xorps xmm0, xmm0
lea rdx, [rbp + 0x150]
xor ecx, ecx
xor eax, eax
mov qword [rbp - 0x30], rax
xor r9d, r9d
mov qword [rsp + 0x60], rax
xor r8d, r8d
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], ecx
movups xmmword [rsp + 0x70], xmm0
mov dword [rsp + 0x20], ecx
movups xmmword [rbp - 0x50], xmm0
mov dword [rsp + 0x70], 0x68
movups xmmword [rbp - 0x80], xmm0
mov word [rbp - 0x50], cx
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x180002270
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ExcuteCmdA_error__d_n
call fcn.180001010
jmp 0x180002296
mov rcx, qword [rsp + 0x50]
mov edx, 0x186a0
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x260]
xor rcx, rsp
call fcn.180002a50
add rsp, 0x370
pop rbp
ret
Function at 0x180002670
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x140
mov rax, qword [0x180020008]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov ebx, edx
lea r8, str.hijack
mov rdi, rcx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
test rax, rax
je 0x18000271e
cmp ebx, 1
jne 0x180002719
mov ecx, dword [0x180020be4]
mov qword [0x1800221a0], rdi
call fcn.1800015f0
call fcn.180001320
test eax, eax
je 0x1800026cf
call fcn.1800022b0
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.180003b80
mov r8d, 0x104
lea rdx, [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, str.explorer.exe
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_StrStrIA]
test rax, rax
jne 0x180002719
call fcn.180002100
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, 1
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.180002a50
mov rbx, qword [rsp + 0x150]
add rsp, 0x140
pop rdi
ret