joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000e250
Capabilities:
Acquire debug privileges

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x860
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x890], rbx
mov rax, qword [0x18015d950]
xor rax, rsp
mov qword [rsp + 0x850], rax
mov rsi, rdx
mov ebx, ecx
xor dil, dil
lea rdx, str.SeDebugPrivilege
lea rcx, [rsp + 0x28]
call fcn.180002af0
nop
xor ebp, ebp
mov qword [rsp + 0x20], rbp
call qword [0x1800fd180]
mov rcx, rax
lea r8, [rsp + 0x20]
lea edx, [rbp + 0x20]
call qword [0x1800fd030]
test eax, eax
je 0x18000e2cc
lea r8, [rsp + 0x20]
mov dl, 1
lea rcx, [rsp + 0x28]
call fcn.18000f750
nop
lea rcx, [rsp + 0x28]
call fcn.180002be0
mov r8d, ebx
xor edx, edx
mov ecx, 0x1400
call qword [0x1800fd200]
mov rbx, rax
test rax, rax
je 0x18000e32d
mov word [rsp + 0x50], bp
xor edx, edx
mov r8d, 0x7fe
lea rcx, [rsp + 0x52]
call fcn.1800b76b0
mov r8d, 0x400
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [0x1800fd4f8]
test eax, eax
je 0x18000e32d
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.180004dd0
mov dil, 1
lea rdx, str.SeDebugPrivilege
lea rcx, [rsp + 0x28]
call fcn.180002af0
nop
mov qword [rsp + 0x20], rbp
call qword [0x1800fd180]
mov rcx, rax
lea r8, [rsp + 0x20]
mov edx, 0x20
call qword [0x1800fd030]
test eax, eax
je 0x18000e373
lea r8, [rsp + 0x20]
xor edx, edx
lea rcx, [rsp + 0x28]
call fcn.18000f750
nop
lea rcx, [rsp + 0x28]
call fcn.180002be0
mov rcx, rbx
call qword [0x1800fd118]
movzx eax, dil
mov rcx, qword [rsp + 0x850]
xor rcx, rsp
call fcn.1800b29b0
mov rbx, qword [rsp + 0x890]
add rsp, 0x860
pop rdi
pop rsi
pop rbp
ret

Function at 0x18000fc50
Capabilities:
Acquire debug privileges

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x18015d950]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rsi, r8
mov rdi, rdx
mov ebx, ecx
test ecx, 0xfffffffb
je 0x18000fd58
xor eax, eax
mov qword [rsp + 0x88], rbp
xor ebp, ebp
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x38], ebp
mov qword [rsp + 0x3c], rax
mov dword [rsp + 0x44], eax
call qword [0x1800fd180]
lea r8, [rsp + 0x30]
lea edx, [rbp + 0x28]
mov rcx, rax
call qword [0x1800fd030]
cmp eax, 1
jne 0x18000fd03
lea r8, [rsp + 0x3c]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [0x1800fd008]
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x38]
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x44], 2
mov qword [rsp + 0x20], rbp
call qword [section..rdata]
mov rcx, qword [rsp + 0x30]
call qword [0x1800fd118]
mov r8d, ebx
call fcn.18000f830
mov rbp, qword [rsp + 0x88]
mov rbx, rax
test rax, rax
je 0x18000fd58
mov rcx, rax
call fcn.18000f8d0
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
test eax, eax
je 0x18000fd44
call fcn.18000f940
mov rcx, rbx
mov edi, eax
call qword [0x1800fd118]
mov eax, edi
jmp 0x18000fd5a
call fcn.18000faa0
mov rcx, rbx
mov edi, eax
call qword [0x1800fd118]
mov eax, edi
jmp 0x18000fd5a
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1800b29b0
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x180015360
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub r8, rdx
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sar r8, 1
add r8, r8
je 0x1800153a4
movabs r10, 0x100000001b3
nop word [rax + rax]
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x180015390
mov rcx, rax
shr rcx, 0x20
xor eax, ecx
ret
Function at 0x1800352e0
Capabilities:
Hash data with md5

Disassembly:
mov rcx, qword [rcx + 8]
mov rcx, qword [rcx]
jmp fcn.1800d00c0
Function at 0x180046dc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
mov qword [rbp + 7], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rdi
mov rax, qword [0x18015d950]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rdi, rdx
mov rbx, rcx
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x180046f8f
mov dword [rbp + 0x27], 0x2d2d4352
mov dword [rbp + 0x2b], 0xf7babac9
mov dword [rbp + 0x2f], 0x61726f43
mov dword [rbp + 0x33], 0x776f7242
mov dword [rbp + 0x37], 0x2d756e45
mov dword [rbp + 0x3b], 0x61746144
mov dword [rbp + 0x3f], 0x37313630
mov dword [rbp + 0x43], 0x30313032
mov eax, 1
movd xmm2, eax
movdqu xmm1, xmmword [rbp + 0x27]
pslld xmm1, xmm2
xorps xmm0, xmm0
paddd xmm0, xmmword [0x1801139f0]
paddd xmm0, xmm1
movdqu xmmword [rbp + 0x27], xmm0
movdqu xmm1, xmmword [rbp + 0x37]
pslld xmm1, xmm2
movdqa xmm0, xmmword [0x180113a00]
paddd xmm0, xmmword [0x1801139f0]
paddd xmm0, xmm1
movdqu xmmword [rbp + 0x37], xmm0
mov rcx, rdx
call fcn.180004550
mov rax, qword [rdi]
mov qword [rdi + 8], rax
xor eax, eax
mov qword [rbp + 0xf], rax
mov qword [rbp + 0x17], rax
mov qword [rbp + 0x1f], rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xf], xmm0
mov qword [rbp + 0x1f], rax
mov rdx, qword [rbx]
mov rax, qword [rbx + 8]
sub rax, rdx
test rdx, rdx
je 0x180046f66
lea r9, [rbp + 0xf]
mov r8d, eax
lea rcx, [rbp + 0x27]
call fcn.180041290
test al, al
je 0x180046f66
mov rax, qword [rbp + 0x17]
cmp qword [rbp + 0xf], rax
je 0x180046f66
mov rdx, rdi
mov ecx, 0xa
call fcn.180057a70
mov ecx, dword [rbp + 0x17]
sub ecx, dword [rbp + 0xf]
mov rdx, rdi
call fcn.180057a70
mov rax, qword [rdi + 8]
mov qword [rbp - 0x11], rax
mov rdx, rdi
lea rcx, [rbp - 0x11]
call fcn.180002280
mov rbx, qword [rbp - 0x11]
mov rax, qword [rbp + 0x17]
mov qword [rbp - 0x19], rax
lea rdx, [rbp + 0xf]
lea rcx, [rbp - 0x19]
call fcn.180002280
mov rax, qword [rbp + 0xf]
mov qword [rbp - 9], rax
lea rdx, [rbp + 0xf]
lea rcx, [rbp - 9]
call fcn.180002280
mov r9, qword [rbp - 0x19]
mov r8, qword [rbp - 9]
mov rdx, rbx
mov rcx, rdi
call fcn.1800471f0
mov rax, qword [rdi]
mov qword [rbp - 1], rax
mov rdx, rdi
lea rcx, [rbp - 1]
call fcn.180002280
nop
cmp qword [rbp + 0xf], 0
je 0x180046f8f
lea rcx, [rbp + 0xf]
call fcn.180004550
mov rcx, qword [rbp + 0xf]
call fcn.1800b3114
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xf], xmm0
mov qword [rbp + 0x1f], 0
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1800b29b0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x180046fb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x60
mov rax, qword [0x18015d950]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rax, qword [rcx]
mov rdi, rcx
mov rcx, qword [rcx + 8]
mov r14, r8
mov rbx, rdx
cmp rax, rcx
je 0x1800471db
mov rdx, qword [rdx]
sub rcx, rax
cmp rdx, rcx
jae 0x1800471db
lea rax, [rdx + 5]
cmp rax, rcx
ja 0x1800471db
lea r8, [rdx + 1]
mov qword [rbx], r8
mov rax, qword [rdi]
cmp byte [rdx + rax], 2
jne 0x1800471db
lea rcx, [r8 + 1]
mov qword [rbx], rcx
mov rax, qword [rdi]
movzx r9d, byte [rax + r8]
lea rdx, [rcx + 1]
mov qword [rbx], rdx
mov rax, qword [rdi]
shl r9d, 0x18
movzx ecx, byte [rax + rcx]
lea r8, [rdx + 1]
mov qword [rbx], r8
mov rax, qword [rdi]
shl ecx, 0x10
or r9d, ecx
movzx ecx, byte [rax + rdx]
lea rdx, [r8 + 1]
mov qword [rbx], rdx
mov r10, qword [rdi]
shl ecx, 8
movzx eax, byte [r10 + r8]
or r9d, ecx
or r9d, eax
cmp r9d, 0xa
jne 0x1800471db
mov rcx, qword [rdi + 8]
lea rax, [rdx + 5]
sub rcx, r10
cmp rax, rcx
ja 0x1800471db
lea r8, [rdx + 1]
mov qword [rbx], r8
mov rax, qword [rdi]
cmp byte [rdx + rax], 2
jne 0x1800471db
lea rcx, [r8 + 1]
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x50], rsi
mov qword [rbx], rcx
mov rax, qword [rdi]
lea rdx, [rcx + 1]
movzx esi, byte [rax + r8]
mov qword [rbx], rdx
mov rax, qword [rdi]
movzx ecx, byte [rax + rcx]
lea r8, [rdx + 1]
shl esi, 0x18
mov qword [rbx], r8
mov rax, qword [rdi]
shl ecx, 0x10
or esi, ecx
movzx ecx, byte [rax + rdx]
shl ecx, 8
or esi, ecx
lea rcx, [r8 + 1]
mov qword [rbx], rcx
mov rdx, qword [rdi]
movzx eax, byte [rdx + r8]
or esi, eax
mov rax, qword [rdi + 8]
sub rax, rcx
mov ebp, esi
sub rax, rdx
cmp rbp, rax
jbe 0x180047116
xor al, al
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1800b29b0
add rsp, 0x60
pop r14
pop rdi
pop rbx
ret
xorps xmm0, xmm0
mov eax, 1
mov dword [rsp + 0x20], 0x2d2d4352
mov dword [rsp + 0x24], 0xf7babac9
mov dword [rsp + 0x28], 0x61726f43
mov dword [rsp + 0x2c], 0x776f7242
movd xmm2, eax
paddd xmm0, xmmword [0x1801139f0]
movdqu xmm1, xmmword [rsp + 0x20]
mov dword [rsp + 0x30], 0x2d756e45
mov dword [rsp + 0x34], 0x61746144
mov dword [rsp + 0x38], 0x37313630
pslld xmm1, xmm2
paddd xmm0, xmm1
mov dword [rsp + 0x3c], 0x30313032
mov rcx, r14
movdqu xmmword [rsp + 0x20], xmm0
movdqa xmm0, xmmword [0x180113a00]
paddd xmm0, xmmword [0x1801139f0]
movdqu xmm1, xmmword [rsp + 0x30]
pslld xmm1, xmm2
paddd xmm0, xmm1
movdqu xmmword [rsp + 0x30], xmm0
call fcn.180004550
mov rax, qword [r14]
mov qword [r14 + 8], rax
mov rdx, qword [rbx]
add rdx, qword [rdi]
jne 0x1800471c3
xor al, al
add qword [rbx], rbp
jmp 0x1800470f6
lea rcx, [rsp + 0x20]
mov r9, r14
mov r8d, esi
call fcn.1800422a0
add qword [rbx], rbp
jmp 0x1800470f6
xor al, al
jmp 0x180047100
Function at 0x180047960
Capabilities:
Create thread

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov rax, qword [0x18015d950]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, rcx
mov rdi, qword [rcx + 0x10]
test rdi, rdi
jne 0x180047996
xor al, al
jmp 0x180047a73
add rdi, 0x38
mov qword [rsp + 0x38], rdi
je 0x1800479b0
mov rcx, qword [rdi]
test rcx, rcx
je 0x1800479b0
call qword [0x1800fd2e0]
nop
mov rax, qword [rbx + 0x10]
cmp qword [rax + 8], 0
je 0x180047a52
mov eax, 1
lock xadd dword [rbx + 8], eax
mov rcx, qword [rbx + 0x10]
add rcx, 0x14
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 4
mov r9, rbx
lea r8, [0x1800475b0]
xor edx, edx
xor ecx, ecx
call fcn.1800b5f3c
mov rcx, qword [rbx + 0x10]
mov qword [rcx + 0x18], rax
mov rax, qword [rbx + 0x10]
cmp qword [rax + 0x18], 0
jne 0x180047a24
or eax, 0xffffffff
lock xadd dword [rbx + 8], eax
dec eax
jne 0x180047a19
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
mov rcx, qword [rbx + 0x10]
call fcn.180047740
jmp 0x180047a52
mov byte [rax + 0x10], 1
mov rax, qword [rbx + 0x10]
mov rcx, qword [rax + 0x40]
test rcx, rcx
je 0x180047a3b
call qword [0x1800fd400]
mov rcx, qword [rbx + 0x10]
mov rcx, qword [rcx + 0x18]
call qword [0x1800fd3f8]
cmp eax, 0xffffffff
je 0x180047a04
mov bl, 1
jmp 0x180047a54
xor bl, bl
test rdi, rdi
je 0x180047a70
mov rcx, qword [rdi]
test rcx, rcx
je 0x180047a67
call qword [0x1800fd270]
mov qword [rsp + 0x38], 0
movzx eax, bl
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1800b29b0
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x1800aa700
Capabilities:
Check http status code

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa8
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rax, qword [0x18015d950]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov r12, r9
mov r14, r8
mov r15, rdx
mov rbp, rcx
xor esi, esi
lea rdx, [rcx + 0x18]
lea rcx, [rsp + 0x78]
call fcn.180004be0
nop
xor ebx, ebx
mov qword [rsp + 0x70], rbx
lea r13, [rbp + 0x58]
lea rdi, [rbp + 0x78]
mov dword [rbp + 0x104], 0
lea rdx, [0x180112f98]
lea rcx, [rsp + 0x48]
call fcn.1800029f0
nop
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], rdi
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9, r12
lea r8, [rsp + 0x78]
mov rdx, qword [r14 + 8]
mov rcx, r15
call fcn.1800ab5b0
test al, al
sete dil
lea rcx, [rsp + 0x48]
call fcn.180002a90
test dil, dil
jne 0x1800aa8d7
mov dword [rsp + 0x6c], 0
mov dword [rsp + 0x68], 4
mov rdi, qword [r15 + 8]
test rdi, rdi
je 0x1800aa8d7
call fcn.18006a450
mov rcx, rax
mov qword [rsp + 0x28], 0
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x6c]
mov r8d, 0x20000013
mov rdx, rdi
call fcn.18006a5e0
test eax, eax
je 0x1800aa8d7
mov eax, dword [rsp + 0x6c]
mov dword [rbp + 0x104], eax
cmp eax, 0xc8
je 0x1800aa8c9
cmp eax, 0xce
je 0x1800aa8c9
cmp eax, 0x12e
jne 0x1800aa910
mov ecx, 0x400
mov eax, ecx
mov dword [rsp + 0x68], ecx
test rbx, rbx
jne 0x1800aa86d
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1800ade60
mov rbx, rax
mov qword [rsp + 0x70], rax
mov eax, dword [rsp + 0x68]
mov r8d, eax
add r8, r8
xor edx, edx
mov rcx, rbx
call fcn.1800b76b0
mov rdi, qword [r15 + 8]
test rdi, rdi
je 0x1800aa910
call fcn.18006a450
mov rcx, rax
mov qword [rsp + 0x28], 0
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9, rbx
mov r8d, 0x21
mov rdx, rdi
call fcn.18006a5e0
test eax, eax
je 0x1800aa910
mov rdx, rbx
lea rcx, [rsp + 0x78]
call fcn.180004dd0
jmp 0x1800aa8f5
test r12, r12
je 0x1800aa901
cmp eax, 0xce
je 0x1800aa901
jmp 0x1800aa8e3
call qword [0x1800fd228]
mov dword [rbp + 0x100], eax
cmp qword [r14 + 8], 0
je 0x1800aa910
mov ecx, 0x14
call qword [0x1800fd100]
inc esi
cmp esi, 3
jae 0x1800aa910
jmp 0x1800aa757
mov dword [rbp + 0x100], 0
mov dil, 1
jmp 0x1800aa913
xor dil, dil
test rbx, rbx
je 0x1800aa921
mov rcx, rbx
call fcn.1800b30e0
nop
lea rcx, [rsp + 0x78]
call fcn.180002be0
movzx eax, dil
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.1800b29b0
add rsp, 0xa8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1800d00c0
Capabilities:
Hash data with md5

Disassembly:
push rbx
mov eax, 0x20
call fcn.1800c6880
sub rsp, rax
lea r8d, [rax + 0x3c]
xor edx, edx
mov rbx, rcx
call fcn.1800b76b0
mov dword [rbx], 0x67452301
mov dword [rbx + 4], 0xefcdab89
mov dword [rbx + 8], 0x98badcfe
mov dword [rbx + 0xc], 0x10325476
mov eax, 1
add rsp, 0x20
pop rbx
ret
Function at 0x18017ae90
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x50
mov r12, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x18017aebd
xor al, al
jmp 0x18017b01f
mov rax, qword [0x18019a6e0]
lea rcx, [rsp]
xor r11d, r11d
mov qword [rcx], rax
mov rax, qword [0x18019a6e8]
mov qword [rsp + 0x60], rbp
mov qword [rcx + 8], rax
mov rax, qword [0x18019a6f0]
mov rdx, r11
mov qword [rcx + 0x10], rax
mov rax, qword [0x18019a6f8]
mov qword [rcx + 0x18], rax
mov rax, qword [0x18019a700]
mov qword [rcx + 0x20], rax
mov rax, qword [0x18019a708]
mov qword [rcx + 0x28], rax
mov rax, qword [0x18019a710]
mov qword [rcx + 0x30], rax
mov rax, qword [0x18019a718]
mov qword [rcx + 0x38], rax
movzx eax, byte [0x18019a720]
mov byte [rcx + 0x40], al
mov rax, qword [r9]
mov rcx, r8
lea rbp, [r8 + rax]
test rbx, rbx
je 0x18017b011
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x18017af69
mov r11d, 2
jmp 0x18017af8d
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x18017af83
mov r11d, 1
jmp 0x18017af8d
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, rbp
ja 0x18017b035
mov rax, r10
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov rax, r10
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x18017afd2
mov byte [rcx + 2], 0x3d
add rcx, 3
add r8, 3
jmp 0x18017afea
shr r10, 6
add rcx, 3
and r10d, 0x3f
add r8, 3
movzx eax, byte [rsp + r10]
mov byte [rcx - 1], al
test r11, r11
je 0x18017affa
mov byte [rcx], 0x3d
inc rcx
inc r8
jmp 0x18017b008
movzx eax, byte [rsp + r9]
inc rcx
inc r8
mov byte [rcx - 1], al
cmp rdx, rbx
jb 0x18017af50
sub rcx, rsi
mov al, 1
mov qword [r12], rcx
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
xor al, al
jmp 0x18017b01a

Function at 0x18036f79c
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
syscall
ret

Function at 0x18039d104
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
jmp 0x18039d10c
syscall
ret
Function at 0x140010d54
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140010d9e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140010d9e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140010d9e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140010d9e
cmp dword [rcx + 0x84], 0xe
jbe 0x140010d9e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140010da0
xor al, al
add rsp, 0x28
ret
Function at 0x1000205a0
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
mov rax, r8
mov r10, rcx
cmp rdx, r9
jbe 0x1000205df
movzx r8d, byte [r9 + r10]
shl rax, 4
inc r9
add r8, rax
movabs rax, 0xf000000000000000
mov rcx, r8
and rcx, rax
mov rax, rcx
shr rax, 0x38
xor rax, rcx
xor rax, r8
cmp r9, rdx
jb 0x1000205ae
repz ret

Function at 0x100020bac
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov eax, edx
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
cmp rax, rdx
je 0x100020bd5
mov eax, 0x80070057
jmp 0x100020c5b
mov r8d, edx
jmp 0x100020bf5
mov eax, dword [rsp + 0x48]
cmp eax, ebx
je 0x100020c59
test eax, eax
je 0x100020c52
cmp eax, ebx
ja 0x100020c52
sub ebx, eax
mov rcx, rsi
add rdi, rax
mov r8d, ebx
and qword [rsp + 0x20], 0
and dword [rsp + 0x48], 0
lea r9, [rsp + 0x48]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x100020bda
call fcn.10001e9f0
mov ebx, eax
test ebx, ebx
jns 0x100020c59
mov rcx, qword [0x10002d220]
lea rax, [0x10002d220]
cmp rcx, rax
je 0x100020c4e
test byte [rcx + 0x1c], 1
je 0x100020c4e
mov rcx, qword [rcx + 0x10]
lea r8, [0x100001928]
mov edx, 0x29
mov r9d, ebx
call fcn.10000f078
mov eax, ebx
jmp 0x100020c5b
mov ebx, 0x8000ffff
jmp 0x100020c19
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x100021c30
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], r8
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x50
mov rbp, qword [rsp + 0xa8]
mov r13, rdx
mov rdx, qword [r9]
mov r15, qword [rbp]
mov eax, edx
mov r12, r9
mov dword [r11 + 0x20], eax
mov eax, edx
mov qword [rsp + 0x40], rdx
cmp rax, rdx
je 0x100021c92
mov ebx, 0x80070057
mov eax, ebx
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret
mov eax, r15d
mov dword [rsp + 0xa8], eax
mov eax, r15d
cmp rax, r15
jne 0x100021c72
mov eax, r13d
cmp rax, r13
jne 0x100021c72
lea rax, [rsp + 0xa8]
lea r9, [rsp + 0x98]
xor edi, edi
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xb0]
mov edx, r13d
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r8
mov r8, qword [rsp + 0xa0]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov edx, 0x80070103
movzx ebx, ax
or ebx, 0x80070000
cmp eax, edi
cmovle ebx, eax
cmp ebx, edi
jl 0x100021d41
mov ecx, dword [rsp + 0x98]
lea esi, [rdx - 0x19]
inc ecx
cmp qword [rsp + 0xa0], rdi
je 0x100021d21
mov eax, ecx
cmp rax, qword [r12]
cmova ebx, esi
cmp qword [rsp + 0xb0], rdi
je 0x100021d39
mov eax, dword [rsp + 0xa8]
cmp rax, qword [rbp]
cmova ebx, esi
mov eax, ecx
mov qword [r12], rax
jmp 0x100021dbb
cmp ebx, edx
jne 0x100021d4c
mov ebx, edx
jmp 0x100021c77
mov esi, 0x800700ea
cmp ebx, esi
je 0x100021d8f
mov rcx, qword [0x10002d220]
lea rax, [0x10002d220]
cmp rcx, rax
je 0x100021dc6
test byte [rcx + 0x1c], 1
je 0x100021dc6
mov rcx, qword [rcx + 0x10]
lea r8, [0x100001908]
mov edx, 0x19
mov r9d, r13d
mov dword [rsp + 0x20], ebx
call fcn.10000f0b4
lea edx, [rsi + 0x19]
jmp 0x100021dc6
mov ecx, dword [rsp + 0x98]
inc ecx
cmp qword [r12], rcx
jb 0x100021db5
mov eax, dword [rsp + 0xa8]
cmp qword [rbp], rax
jb 0x100021db5
mov ebx, 0x8000ffff
jmp 0x100021c77
mov qword [r12], rcx
mov ebx, esi
mov eax, dword [rsp + 0xa8]
mov qword [rbp], rax
cmp ebx, esi
je 0x100021c77
cmp ebx, edx
je 0x100021c77
cmp ebx, edi
jl 0x100021c77
mov r9, qword [rsp + 0xa0]
mov rdx, qword [rsp + 0x40]
mov r8, r12
mov rcx, r13
call fcn.100021810
cmp eax, edi
jl 0x100021c79
mov rax, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0xa0]
mov r9, rbp
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x90]
mov rdx, r15
mov r8d, dword [rax]
call fcn.10002173c
cmp eax, edi
cmovl edi, eax
mov eax, edi
jmp 0x100021c79
Function at 0x100024d10
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x10002d120]
jne 0x100024d2b
rol rcx, 0x10
test cx, 0xffff
jne 0x100024d27
ret 0
ror rcx, 0x10
jmp 0x10002517c
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x10002dbe0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x10002dcd8]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x100025201
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x10002dbe0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x100025223
mov rax, qword [rsp + 0x88]
mov qword [0x10002dcd8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x10002dc78], rax
mov rax, qword [0x10002dcd8]
mov qword [0x10002db50], rax
mov rax, qword [rsp + 0x90]
mov qword [0x10002dc60], rax
mov dword [0x10002db40], 0xc0000409
mov dword [0x10002db44], 1
mov rax, qword [0x10002d120]
mov qword [rsp + 0x68], rax
mov rax, qword [0x10002d128]
mov qword [rsp + 0x70], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x100001770]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x100025018
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
cmp rcx, rdx
je 0x100025065
cmp rcx, 0xffffffffffffffff
je 0x100025065
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x10002505d
cmp dword [rcx + 0x3c], edx
jl 0x10002505d
cmp dword [rcx + 0x3c], 0x10000000
jae 0x10002505d
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x100025065
mov rax, rdx
add rsp, 0x18
ret
Function at 0x14000275c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400027a6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400027a6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400027a6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400027a6
cmp dword [rcx + 0x84], 0xe
jbe 0x1400027a6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400027a8
xor al, al
add rsp, 0x28
ret

Function at 0x140001270
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
lea rcx, str.___Press__Enter__To_Run_...
call fcn.140001210
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
xor eax, eax
lea r8, section..text
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
test rax, rax
jne 0x1400012cc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____CreateThread_Failed_With_Error_:__d__n
call fcn.140001210
lea eax, [rbx - 1]
add rsp, 0x30
pop rbx
ret
lea rcx, str._i__Waiting_the_thread_to_finish...
call fcn.140001210
mov edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, eax
lea rcx, str.Thread_finished_:_code__d_n
call fcn.140001210
lea rcx, str.___Press__Enter__To_Quit_...__n
call fcn.140001210
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
xor eax, eax
add rsp, 0x30
pop rbx
ret

Function at 0x140001bf4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001c3e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001c3e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001c3e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001c3e
cmp dword [rcx + 0x84], 0xe
jbe 0x140001c3e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001c40
xor al, al
add rsp, 0x28
ret