joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400102a0
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
sub rsp, 0x238
mov rsi, rcx
lea rdi, [rsp + 0x20]
mov r8d, 0x20a
mov rcx, rdi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov ecx, 0x105
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
add eax, 0xffffffff
cmp eax, 0x105
jb 0x14001032e
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____Failed_to_get_temp_path
call fcn.1400022d0
mov rdi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rdi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
mov rcx, rdi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::put_wchar_t____ptr64]
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::flush_void____ptr64]
mov qword [rsi], 0
movaps xmm0, xmmword [0x14001a770]
movups xmmword [rsi + 0x10], xmm0
mov word [rsi], 0
jmp 0x1400103a0
lea rcx, [rsp + 0x20]
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
cmp word [rsp + rax*2 + 0x1e], 0x5c
jne 0x140010347
mov word [rsp + rax*2 + 0x1e], 0
mov qword [rsi], 0
movaps xmm0, xmmword [0x14001a770]
movups xmmword [rsi + 0x10], xmm0
mov word [rsi], 0
lea rcx, [rsp + 0x20]
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
mov rdi, rax
cmp rax, 7
jbe 0x140010383
lea r9, [rsp + 0x20]
mov rcx, rsi
mov rdx, rdi
call fcn.14000b410
jmp 0x1400103a0
mov qword [rsi + 0x10], rdi
mov r8, rdi
add r8, rdi
lea rdx, [rsp + 0x20]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov word [rsi + rdi*2], 0
mov rax, rsi
add rsp, 0x238
pop rdi
pop rsi
ret
Function at 0x1400105e0
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
movaps xmmword [rsp + 0x50], xmm6
mov r12, rcx
mov dword [rsp + 0x2c], 0
xor r15d, r15d
lea r9, [rsp + 0x2c]
mov ecx, 0xb
xor edx, edx
xor r8d, r8d
call sub.ntdll.dll_NtQuerySystemInformation
cmp eax, 0xc0000004
jne 0x1400107d0
xor edi, edi
mov rsi, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea rbx, [rsp + 0x2c]
mov r13, qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x140010673
mov edx, dword [rsp + 0x2c]
xor ecx, ecx
mov r8d, 0x3000
mov r9d, 4
call rsi
mov rdi, rax
mov r8d, dword [rsp + 0x2c]
mov ecx, 0xb
mov rdx, rax
mov r9, rbx
call sub.ntdll.dll_NtQuerySystemInformation
cmp eax, 0xc0000004
jne 0x140010688
test rdi, rdi
je 0x140010640
mov rcx, rdi
xor edx, edx
mov r8d, 0x8000
call r13
jmp 0x140010640
test eax, eax
js 0x1400107b2
test rdi, rdi
je 0x1400107cd
cmp dword [rdi], 0
je 0x1400107b7
mov rsi, rdi
add rsi, 0x30
xor r14d, r14d
movaps xmm6, xmmword [0x14001a760]
nop word cs:[rax + rax]
nop dword [rax]
movzx ebp, word [rsi - 2]
add rbp, rsi
mov qword [rsp + 0x30], 0
movups xmmword [rsp + 0x40], xmm6
mov byte [rsp + 0x30], 0
mov rcx, rbp
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rbx, rax
cmp rax, 0xf
jbe 0x140010700
lea rcx, [rsp + 0x30]
mov rdx, rbx
mov r9, rbp
call fcn.14000ae40
jmp 0x14001071a
mov qword [rsp + 0x40], rbx
lea rcx, [rsp + 0x30]
mov rdx, rbp
mov r8, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rsp + rbx + 0x30], 0
cmp qword [r12 + 0x18], 0xf
mov rdx, r12
jbe 0x140010729
mov rdx, qword [r12]
cmp qword [rsp + 0x48], 0xf
lea rcx, [rsp + 0x30]
jbe 0x14001073b
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
mov ebp, eax
test eax, eax
jne 0x140010759
mov r15, qword [rsi - 0x18]
mov rcx, rdi
xor edx, edx
mov r8d, 0x8000
call r13
mov rax, qword [rsp + 0x48]
cmp rax, 0x10
jb 0x140010796
mov rcx, qword [rsp + 0x30]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140010791
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x1400107e9
add rax, 0x28
mov rdx, rax
mov rcx, rbx
call fcn.140010960
test ebp, ebp
je 0x1400107d0
add r14, 1
mov eax, dword [rdi]
add rsi, 0x128
cmp r14, rax
jb 0x1400106c0
jmp 0x1400107b7
test rdi, rdi
je 0x1400107cd
xor r15d, r15d
mov rcx, rdi
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x1400107d0
xor r15d, r15d
mov rax, r15
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140010860
Capabilities:
Enumerate pe sections

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r14, r8
mov r12, rdx
mov r13, rcx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rsi, rax
movsxd rax, dword [r12 + 0x3c]
movzx ebx, word [rax + r12 + 6]
test rbx, rbx
je 0x1400108f9
movzx ecx, word [rax + r12 + 0x14]
add rax, r12
lea rdi, [rcx + rax]
add rdi, 0x18
xor r15d, r15d
xor ebp, ebp
jmp 0x1400108bd
add rbp, 1
add rdi, 0x28
cmp rbp, rbx
jae 0x1400108fc
mov rcx, rdi
mov rdx, r13
mov r8, rsi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400108b0
mov rcx, rdi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
cmp rsi, rax
jne 0x1400108b0
mov eax, dword [rdi + 0xc]
test eax, eax
je 0x1400108f9
test r14, r14
je 0x1400108f1
mov eax, dword [rdi + 8]
mov dword [r14], eax
mov eax, dword [rdi + 0xc]
mov r15d, eax
add r15, r12
jmp 0x1400108fc
xor r15d, r15d
mov rax, r15
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x180003e10
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x38
lea rax, [rsp + 0x48]
mov r8, rcx
lea r9, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_smprule_
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x48], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
xor ecx, ecx
test eax, eax
jne 0x180003e5d
cmp dword [rsp + 0x50], 4
mov eax, dword [rsp + 0x58]
je 0x180003e5f
mov eax, ecx
test eax, eax
setne al
add rsp, 0x38
ret

Function at 0x180003e70
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x60
xor ebp, ebp
mov rbx, r8
lea r8, [rax + 0x18]
mov dword [rsp + 0x80], ebp
mov esi, ebp
mov rdi, rdx
mov byte [rax + 0x18], sil
call fcn.180002810
test rbx, rbx
jne 0x180003ec8
lea rcx, [rsp + 0x30]
mov rdx, rdi
call fcn.180001500
lea esi, [rbp + 1]
cmp qword [rax + 0x20], 8
jb 0x180003ec4
mov rbx, qword [rax + 8]
jmp 0x180003ec8
lea rbx, [rax + 8]
cmp byte [rsp + 0x80], bpl
lea rax, [rsp + 0x80]
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_smprule_
setne bpl
mov r9d, 4
mov r8, rbx
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x80], ebp
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
test sil, 1
je 0x180003f25
cmp qword [rsp + 0x50], 8
jb 0x180003f25
mov rcx, qword [rsp + 0x38]
call fcn.18009a864
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
ret
Function at 0x180008200
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
sub rsp, 0x150
mov qword [rsp + 0xf8], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov dword [r11 + 0x10], 4
lea rax, [r11 + 0x10]
mov qword [rsp + 0x28], rax
lea rax, [r11 + 0x20]
mov qword [rsp + 0x20], rax
lea r9, [r11 + 0x18]
lea r8, [0x1800ce0a0]
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_smprule_
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x1800084b9
cmp dword [rsp + 0x180], 4
jne 0x1800084b9
cmp dword [rsp + 0x188], eax
je 0x1800084b9
mov qword [rsp + 0x70], 7
xor ebp, ebp
mov qword [rsp + 0x68], rbp
mov word [rsp + 0x58], bp
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [0x180108f60]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [0x180108f60]
lea rcx, [rsp + 0x50]
call fcn.18000f510
nop
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0xd0]
call fcn.180012880
mov rdi, rax
lea r9, str.docwmSendProcs
lea r8, str.SoftwareWOW6432Nodeprojonepodlp_smpcache_
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0xa8]
call fcn.180053c64
nop
cmp qword [rax + 0x20], 8
jb 0x1800082fc
mov rdx, qword [rax + 8]
jmp 0x180008300
lea rdx, [rax + 8]
lea r8, [0x1800ce180]
lea rcx, [rsp + 0x78]
call fcn.180053294
nop
mov rdx, rax
lea rcx, [rsp + 0x100]
call fcn.1800124e0
nop
mov rdx, rdi
mov rcx, rax
call fcn.18000d380
mov esi, ebp
test rax, rax
setne sil
mov rax, qword [rsp + 0x130]
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x100]
mov qword [rsp + 0x40], rcx
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rcx
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
movaps xmm1, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm1
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x100]
call fcn.18000e860
mov rcx, qword [rsp + 0x130]
call fcn.18009a864
mov qword [rsp + 0x130], rbp
mov qword [rsp + 0x138], rbp
mov rcx, qword [rsp + 0x100]
call fcn.18009a864
nop
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x180008418
mov rbx, qword [rsp + 0x98]
cmp rcx, rbx
je 0x180008413
lea rdi, [rcx + 0x20]
nop dword [rax]
cmp qword [rdi], 8
jb 0x1800083ef
mov rcx, qword [rdi - 0x18]
call fcn.18009a864
mov qword [rdi], 7
mov qword [rdi - 8], rbp
mov word [rdi - 0x18], bp
add rdi, 0x28
lea rax, [rdi - 0x20]
cmp rax, rbx
jne 0x1800083e0
mov rcx, qword [rsp + 0x90]
call fcn.18009a864
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0x98], rbp
mov qword [rsp + 0xa0], rbp
mov rcx, qword [rsp + 0x78]
call fcn.18009a864
nop
cmp qword [rsp + 0xc8], 8
jb 0x180008453
mov rcx, qword [rsp + 0xb0]
call fcn.18009a864
mov qword [rsp + 0xc8], 7
mov qword [rsp + 0xc0], rbp
mov word [rsp + 0xb0], bp
cmp qword [rsp + 0xf0], 8
jb 0x180008487
mov rcx, qword [rsp + 0xd8]
call fcn.18009a864
mov qword [rsp + 0xf0], 7
mov qword [rsp + 0xe8], rbp
mov word [rsp + 0xd8], bp
cmp qword [rsp + 0x70], 8
jb 0x1800084b5
mov rcx, qword [rsp + 0x58]
call fcn.18009a864
mov eax, esi
jmp 0x1800084bb
xor eax, eax
mov rbx, qword [rsp + 0x170]
add rsp, 0x150
pop rdi
pop rsi
pop rbp
ret
Function at 0x180009080
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x30
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 1]
call fcn.180005360
mov rcx, rbx
call fcn.180008200
mov dword [rbx + 0x50], eax
test eax, eax
je 0x1800090fc
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x48]
lea r8, [0x1800ce0c8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_smprule_
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x1800090f0
cmp dword [rsp + 0x48], 4
jne 0x1800090f0
mov ecx, dword [rsp + 0x50]
jmp 0x1800090f2
xor ecx, ecx
xor eax, eax
test ecx, ecx
setne al
mov dword [rbx + 0x54], eax
mov ecx, dword [rbx + 0x50]
mov eax, dword [rbx + 0x54]
mov r9d, dword [rbx + 8]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
lea r8, [0x180108f60]
lea rcx, str.banSendFileDbg
lea rdx, str.is_hook__s_:__d__d__d
call fcn.18005c640
cmp dword [rbx + 0x50], 0
jne 0x18000913c
cmp dword [rbx + 8], 1
jne 0x18000913c
xor eax, eax
add rsp, 0x30
pop rbx
ret
mov eax, 1
add rsp, 0x30
pop rbx
ret
Function at 0x1800165e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rbx
push rsi
push rdi
sub rsp, 0x60
mov qword [rsp + 0x30], 0xfffffffffffffffe
xor esi, esi
mov ebx, esi
mov dword [r11 + 8], ebx
mov dword [r11 + 8], 4
lea rax, [r11 + 8]
mov qword [r11 - 0x50], rax
lea rax, [r11 + 0x18]
mov qword [r11 - 0x58], rax
lea r9, [r11 + 0x10]
lea r8, [0x1800cee58]
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_smprule_
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x18001675f
cmp dword [rsp + 0x88], 4
jne 0x18001675f
cmp dword [rsp + 0x90], ebx
je 0x18001675f
cmp dword [0x180108d44], ebx
je 0x1800166a5
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], rsi
mov word [rsp + 0x40], si
lea r8d, [rsi + 8]
lea rdx, str.winprtsc
lea rcx, [rsp + 0x38]
call fcn.18000f510
nop
mov ebx, 1
mov dword [rsp + 0x80], ebx
lea rcx, [rsp + 0x38]
call fcn.18004bc20
test eax, eax
je 0x1800166a5
movzx edi, bl
jmp 0x1800166a8
xor dil, dil
test bl, 1
je 0x1800166c2
and ebx, 0xfffffffe
cmp qword [rsp + 0x58], 8
jb 0x1800166c2
mov rcx, qword [rsp + 0x40]
call fcn.18009a864
test dil, dil
je 0x1800166d1
mov eax, 1
jmp 0x180016761
lea rcx, [0x180108f60]
call fcn.18004c040
test eax, eax
je 0x18001673a
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], rsi
mov word [rsp + 0x40], si
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [0x180108f60]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [0x180108f60]
lea rcx, [rsp + 0x38]
call fcn.18000f510
nop
or ebx, 2
mov dword [rsp + 0x80], ebx
lea rcx, [rsp + 0x38]
call fcn.18004bc20
test eax, eax
je 0x18001673a
mov dil, 1
jmp 0x18001673d
xor dil, dil
test bl, 2
je 0x180016754
cmp qword [rsp + 0x58], 8
jb 0x180016754
mov rcx, qword [rsp + 0x40]
call fcn.18009a864
test dil, dil
setne sil
mov eax, esi
jmp 0x180016761
xor eax, eax
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret
Function at 0x180016f20
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
sub rsp, 0x30
cmp dword [0x180108bf4], 0
mov edi, 1
jne 0x180016f81
lea rdx, str.SetClipboardData
lea rcx, [0x1800cf0e0]
mov dword [0x180108bf4], 0
call fcn.1800a7b40
mov qword [0x180108ae8], rax
test rax, rax
je 0x180016f81
lea rdx, [0x180016770]
lea rcx, [0x180108ae8]
call fcn.1800a6320
mov ecx, dword [0x180108bf4]
test eax, eax
cmove ecx, edi
mov dword [0x180108bf4], ecx
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x48]
lea r8, str.CryptEnabled
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_smprule_
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x180017081
cmp dword [rsp + 0x48], 4
jne 0x180017081
cmp dword [rsp + 0x50], eax
je 0x180017081
cmp dword [0x180108d04], eax
jne 0x18001702b
lea rdx, str.GetClipboardData
lea rcx, [0x1800cf0e0]
mov dword [0x180108d04], eax
call fcn.1800a7b40
mov qword [0x180108bf8], rax
test rax, rax
je 0x18001702b
lea rdx, [0x180016e00]
lea rcx, [0x180108bf8]
call fcn.1800a6320
mov edx, dword [0x180108d04]
test eax, eax
cmove edx, edi
mov dword [0x180108d04], edx
cmp dword [0x180108d10], 0
jne 0x180017081
lea rdx, str.IsClipboardFormatAvailable
lea rcx, [0x1800cf0e0]
mov dword [0x180108d10], 0
call fcn.1800a7b40
mov qword [0x180108d08], rax
test rax, rax
je 0x180017081
lea rdx, [0x180016e90]
lea rcx, [0x180108d08]
call fcn.1800a6320
mov ecx, dword [0x180108d10]
test eax, eax
cmove ecx, edi
mov dword [0x180108d10], ecx
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.GetTickCount64
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800170b2
call rax
mov qword [0x180108d18], rax
add rsp, 0x30
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r11d, eax
mov qword [0x180108d18], r11
add rsp, 0x30
pop rdi
ret
Function at 0x18001a900
Capabilities:
Create thread

Disassembly:
mov eax, 0x1058
call fcn.1800b3cb0
sub rsp, rax
mov rax, qword [0x180101090]
xor rax, rsp
mov qword [rsp + 0x1040], rax
cmp dword [0x180105588], 0
je 0x18001a9c2
lea rax, str._GlobalHookThread
mov qword [rsp + 0x1050], rbx
lea r9, str..dllmain.cpp
mov qword [rsp + 0x28], rax
lea r8, str._s._d:_s
lea rcx, [rsp + 0x40]
xor ebx, ebx
mov edx, 0x800
mov dword [rsp + 0x20], 0x82
mov dword [0x180105588], ebx
call qword [sym.imp.SHLWAPI.dll_wnsprintfW]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r8, [0x18001a770]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
mov dword [rsp + 0x30], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
test rax, rax
je 0x18001a9b1
mov edx, dword [rsp + 0x30]
lea r8, [rsp + 0x40]
lea rcx, str.thread__d_created:__s
call fcn.180057ba8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x1050]
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.180099fe0
add rsp, 0x1058
ret
Function at 0x18001a9e0
Capabilities:
Move file

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r12
sub rsp, 0x6c0
mov rax, qword [0x180101090]
xor rax, rsp
mov qword [rsp + 0x6b0], rax
lea rax, str.athens32.dll
lea rsi, [rsp + 0x58]
mov ebp, 4
mov qword [rsp + 0x58], rax
lea rax, str.athens64.dll
xor r12d, r12d
mov qword [rsp + 0x60], rax
lea rax, str.athenx32.dll
mov qword [r11 + 8], rbx
mov qword [rsp + 0x68], rax
lea rax, str.athenx64.dll
mov qword [rsp + 0x70], rax
nop dword [rax + rax]
lea rcx, [rsp + 0x82]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x80], r12w
call fcn.18009e990
mov rdi, qword [rsi]
test rdi, rdi
je 0x18001aafe
mov rcx, qword [0x180108838]
lea rdx, [rsp + 0x290]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x18001aafe
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rsp + 0x290]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add ebx, eax
cmp ebx, 0x104
jge 0x18001aafe
lea rdx, [0x1800d1a48]
lea rcx, [rsp + 0x290]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rsp + 0x290]
mov rdx, rdi
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdx, [rsp + 0x290]
lea rcx, [rsp + 0x80]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
xor eax, eax
lea r8, [rsp + 0x30]
lea rcx, [rsp + 0x80]
xor edx, edx
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x3c], eax
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x4c], eax
mov dword [rsp + 0x50], eax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x18001abf4
mov ecx, dword [rsp + 0x4c]
mov eax, dword [rsp + 0x50]
shl rcx, 0x20
add rcx, rax
cmp rcx, 0x400
jbe 0x18001abf4
lea rcx, [rsp + 0x4a2]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x4a0], r12w
call fcn.18009e990
call fcn.180051898
lea r9, [rsp + 0x80]
lea r8, str._s._08x.dirty
lea rcx, [rsp + 0x4a0]
mov edx, 0x104
mov dword [rsp + 0x20], eax
call qword [sym.imp.SHLWAPI.dll_wnsprintfW]
lea rdx, [rsp + 0x4a0]
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x18001abe0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [rsp + 0x80]
lea rcx, str.remove_old_module__s_failed:__d
mov r8d, eax
call fcn.180057d40
jmp 0x18001abf4
lea rdx, [rsp + 0x80]
lea rcx, str.remove_old_module__s_succeeded
call fcn.180057d40
add rsi, 8
sub rbp, 1
jne 0x18001aa50
mov rbx, qword [rsp + 0x6d0]
mov rcx, qword [rsp + 0x6b0]
xor rcx, rsp
call fcn.180099fe0
lea r11, [rsp + 0x6c0]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
Function at 0x18001c200
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x68
call fcn.18001c0c0
test rax, rax
je 0x18001c215
mov al, 1
add rsp, 0x68
ret
mov qword [rsp + 0x60], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rdx, [0x1800cfca0]
lea rcx, [rsp + 0x30]
mov r8d, eax
call fcn.180053a60
cmp qword [rax + 0x20], 8
jb 0x18001c241
mov r8, qword [rax + 8]
jmp 0x18001c245
lea r8, [rax + 8]
lea rax, [rsp + 0x70]
lea r9, [rsp + 0x78]
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_volatilehookBypass_
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x80]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x70], 4
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x18001c291
cmp dword [rsp + 0x78], 4
jne 0x18001c291
mov ebx, dword [rsp + 0x80]
jmp 0x18001c293
xor ebx, ebx
cmp qword [rsp + 0x50], 8
jb 0x18001c2a5
mov rcx, qword [rsp + 0x38]
call fcn.18009a864
test ebx, ebx
mov rbx, qword [rsp + 0x60]
setne al
add rsp, 0x68
ret
Function at 0x18001c2c0
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file
Set file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x290
mov rax, qword [0x180101090]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rdi, rcx
lea rcx, [rsp + 0x52]
xor ebx, ebx
xor edx, edx
mov r8d, 0x226
mov word [rsp + 0x50], bx
call fcn.18009e990
lea rcx, [rsp + 0x50]
mov r8d, 0x104
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
call fcn.180051898
lea rdx, str.._08x
lea rcx, [rsp + 0x20]
mov r8d, eax
call fcn.180053a60
cmp qword [rax + 0x20], 8
jb 0x18001c33f
mov rdx, qword [rax + 8]
jmp 0x18001c343
lea rdx, [rax + 8]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
cmp qword [rsp + 0x40], 8
jb 0x18001c360
mov rcx, qword [rsp + 0x28]
call fcn.18009a864
mov ebp, ebx
mov esi, ebx
test ebp, ebp
jne 0x18001c395
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.18007d350
mov ebp, eax
test eax, eax
jne 0x18001c395
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str._TryDecryptDirectly_failed__s__d
mov rdx, rdi
mov r8d, eax
call fcn.18005c5d0
jmp 0x18001c3ea
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x18001c3b5
test al, 1
je 0x18001c3b5
and eax, 0xfffffffe
mov rcx, rdi
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rsp + 0x50]
mov r8d, 1
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x18001c443
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [rsp + 0x50]
lea rcx, str.MoveFileExW_failed_on__TryDecryptDirectly__s___s__d
mov r9d, eax
mov r8, rdi
call fcn.18005c5d0
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0xa
jl 0x18001c364
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 1
je 0x18001c420
and eax, 0xfffffffe
lea rcx, [rsp + 0x50]
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x18001c43f
lea ecx, [rax + 0x14]
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 0xa
jl 0x18001c420
xor eax, eax
jmp 0x18001c448
mov eax, 1
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.180099fe0
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret