joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800175b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov eax, dword [rcx + 0xc]
mov rsi, rdx
xor edx, edx
mov rdi, rcx
movsxd rcx, dword [rcx + 4]
mov rbx, r8
cmp eax, 1
jne 0x1800176f9
mov rax, r9
div rcx
mov rbp, rax
cmp rsi, rbx
jne 0x18001767b
test rax, rax
je 0x18001783f
nop dword [rax + rax]
movsxd r8, ecx
mov rdx, rsi
lea rcx, [rsp + 0x20]
call fcn.180008d30
mov r8, rbx
mov rdx, rsi
mov rcx, rdi
call fcn.180017860
mov eax, dword [rdi + 4]
mov rcx, rbx
test eax, eax
jle 0x180017651
lea r8, [rdi + 0x3d0]
mov edx, eax
sub r8, rbx
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [r8 + rcx]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x180017640
movsxd r8, dword [rdi + 4]
lea rdx, [rsp + 0x20]
lea rcx, [rdi + 0x3d0]
call fcn.180008d30
movsxd rcx, dword [rdi + 4]
add rsi, rcx
add rbx, rcx
sub rbp, 1
jne 0x180017600
jmp 0x18001783f
test rax, rax
je 0x18001783f
nop dword [rax]
nop dword [rax + rax]
mov r8, rbx
mov rdx, rsi
mov rcx, rdi
call fcn.180017860
mov eax, dword [rdi + 4]
mov rcx, rbx
test eax, eax
jle 0x1800176d1
lea r8, [rdi + 0x3d0]
mov edx, eax
sub r8, rbx
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [r8 + rcx]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x1800176c0
movsxd r8, dword [rdi + 4]
lea rcx, [rdi + 0x3d0]
mov rdx, rsi
call fcn.180008d30
movsxd rax, dword [rdi + 4]
add rsi, rax
add rbx, rax
sub rbp, 1
jne 0x180017690
jmp 0x18001783f
cmp eax, 2
mov rax, r9
jne 0x180017816
div rcx
mov r14, rax
cmp rsi, rbx
jne 0x1800177a1
test rax, rax
je 0x18001783f
mov qword [rsp + 0x60], r15
lea r8, [rdi + 0x3d0]
mov rcx, rdi
lea rdx, [rdi + 0x3d0]
call fcn.180019d50
mov r15d, dword [rdi + 4]
lea rcx, [rsp + 0x20]
movsxd r8, r15d
mov rdx, rsi
call fcn.180008d30
mov rcx, rbx
test r15d, r15d
jle 0x180017772
lea r8, [rdi + 0x3d0]
mov edx, r15d
sub r8, rbx
movzx eax, byte [r8 + rcx]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x180017761
movsxd r8, dword [rdi + 4]
lea rdx, [rsp + 0x20]
lea rcx, [rdi + 0x3d0]
call fcn.180008d30
movsxd rax, dword [rdi + 4]
add rsi, rax
add rbx, rax
sub r14, 1
jne 0x180017722
mov r15, qword [rsp + 0x60]
jmp 0x18001783f
test rax, rax
je 0x18001783f
nop word [rax + rax]
lea r8, [rdi + 0x3d0]
mov rcx, rdi
lea rdx, [rdi + 0x3d0]
call fcn.180019d50
mov ecx, dword [rdi + 4]
mov rax, rbx
test ecx, ecx
jle 0x1800177f1
lea r8, [rdi + 0x3d0]
mov edx, ecx
sub r8, rbx
nop dword [rax]
movzx ecx, byte [r8 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x1800177e0
movsxd r8, dword [rdi + 4]
lea rcx, [rdi + 0x3d0]
mov rdx, rsi
call fcn.180008d30
movsxd rax, dword [rdi + 4]
add rsi, rax
add rbx, rax
sub r14, 1
jne 0x1800177b0
jmp 0x18001783f
div rcx
mov rbp, rax
test rax, rax
je 0x18001783f
mov r8, rbx
mov rdx, rsi
mov rcx, rdi
call fcn.180017860
movsxd rcx, dword [rdi + 4]
add rsi, rcx
add rbx, rcx
sub rbp, 1
jne 0x180017821
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x180019bf0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
movsxd r11, dword [rcx + 4]
mov rdi, rdx
xor edx, edx
mov rax, r9
div r11
mov rsi, r8
mov rbx, rcx
mov r8d, dword [rcx + 0xc]
mov r14, rax
cmp r8d, 1
jne 0x180019c94
test rax, rax
je 0x180019d2e
lea rbp, [rcx + 0x3d0]
nop dword [rax]
mov rcx, rbp
test r11d, r11d
jle 0x180019c62
mov r8, rdi
mov edx, r11d
sub r8, rbp
movzx eax, byte [r8 + rcx]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x180019c51
mov r8, rbp
mov rdx, rbp
mov rcx, rbx
call fcn.180019d50
movsxd r8, dword [rbx + 4]
mov rdx, rbp
mov rcx, rsi
call fcn.180008d30
movsxd r11, dword [rbx + 4]
add rdi, r11
add rsi, r11
sub r14, 1
jne 0x180019c40
jmp 0x180019d2e
cmp r8d, 2
jne 0x180019d02
test rax, rax
je 0x180019d2e
lea rbp, [rcx + 0x3d0]
nop word [rax + rax]
mov r8, rbp
mov rdx, rbp
mov rcx, rbx
call fcn.180019d50
mov eax, dword [rbx + 4]
mov rcx, rbp
test eax, eax
jle 0x180019ce1
mov r8, rdi
mov edx, eax
sub r8, rbp
movzx eax, byte [r8 + rcx]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x180019cd0
movsxd r8, dword [rbx + 4]
mov rdx, rbp
mov rcx, rsi
call fcn.180008d30
movsxd rax, dword [rbx + 4]
add rdi, rax
add rsi, rax
sub r14, 1
jne 0x180019cb0
jmp 0x180019d2e
test rax, rax
je 0x180019d2e
nop word [rax + rax]
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
call fcn.180019d50
movsxd rax, dword [rbx + 4]
add rdi, rax
add rsi, rax
sub r14, 1
jne 0x180019d10
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x18001bef0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x40
xor r9d, r9d
mov qword [rsp + 0x30], 0
cmp byte [rdx + 1], r9b
mov r14, rcx
mov rax, rdx
mov dword [rsp + 0x28], 0x8000080
mov rcx, rdx
mov edx, 0x80000000
lea r8d, [r9 + 3]
mov dword [rsp + 0x20], r8d
jne 0x18001bf34
call qword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x18001bf3a
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x18001bf51
xor al, al
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop r14
ret
xor edx, edx
mov qword [rsp + 0x50], rdi
mov rcx, rbx
mov dword [rsp + 0x58], 0
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r8b, 0x20
mov rcx, r14
mov edx, eax
mov edi, eax
call fcn.180030970
test edi, edi
je 0x18001bf99
mov rdx, qword [r14]
lea r9, [rsp + 0x58]
mov r8d, edi
mov qword [rsp + 0x20], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x58], edi
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
sete al
add rsp, 0x40
pop r14
ret

Function at 0x18001bfc0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov eax, dword [rdx + 8]
movzx ebp, r9b
and eax, 0x1fffffff
mov edi, r8d
mov rbx, rdx
mov rsi, rcx
cmp eax, 3
jae 0x18001bff8
mov eax, 0xffffffff
jmp 0x18001c0ac
mov dl, 1
call fcn.180012b50
mov r11, qword [rbx]
mov eax, dword [r11]
cmp eax, 0x4e534942
je 0x18001c09b
and eax, 0x80808080
xor r9d, r9d
cmp eax, 0x80808080
jne 0x18001c0c1
mov r10d, dword [rbx + 8]
add r11, 4
and r10d, 0x1fffffff
sub r10d, 4
mov eax, r10d
movzx ecx, r10b
shr eax, 8
movzx edi, al
imul edi, ecx
test r10d, r10d
je 0x18001c09b
nop dword [rax + rax]
movzx eax, r9b
movzx ecx, dil
and al, 0x7e
lea r11, [r11 + 1]
movzx r8d, al
imul r8d, ecx
movzx ecx, byte [r11 - 1]
movzx eax, cl
add r8b, r9b
sub al, r8b
add cl, r8b
test r9b, 1
movzx r8d, cl
movzx eax, al
cmove r8d, eax
inc r9d
xor r8b, dil
not r8b
sub r8b, bpl
mov byte [r11 - 1], r8b
cmp r9d, r10d
jb 0x18001c050
mov r8d, 4
mov rdx, rbx
mov rcx, rsi
call fcn.18001a340
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov r8d, edi
mov rdx, rbx
mov rcx, rsi
call fcn.18001a640
neg eax
jmp 0x18001c0ac
Function at 0x18001c570
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x60
mov edx, dword [rcx + 0x3c]
xor esi, esi
mov rbp, rcx
mov r11d, esi
movzx eax, word [rdx + rcx + 0x14]
lea edi, [rdx + 0x18]
movzx ebx, word [rdx + rcx + 6]
add edi, eax
add rdi, rcx
test ebx, ebx
je 0x18001c65f
lea r14, str..rsrc
mov r10, rdi
sub r10, r14
nop dword [rax]
mov eax, r11d
cmp r14, rax
je 0x18001c60a
mov r8, rsi
nop dword [rax + rax]
lea rcx, [r8 + r14]
movzx edx, byte [r10 + rcx]
movzx r9d, dl
lea eax, [rdx - 0x61]
cmp al, 0x19
ja 0x18001c5e7
add dl, 0xe0
movzx ecx, byte [rcx]
lea eax, [rcx - 0x61]
cmp al, 0x19
ja 0x18001c5f4
add cl, 0xe0
cmp dl, cl
jne 0x18001c67c
test r9b, r9b
je 0x18001c60a
inc r8
cmp r8, 8
jl 0x18001c5d0
mov ebx, dword [rdi + 0xc]
mov eax, dword [rdi + 8]
add rbx, rbp
cmp eax, 0x40
jbe 0x18001c65f
movups xmm0, xmmword [str.FileVersion]
add eax, 0xffffffc0
movsd xmm1, qword [0x180044128]
mov edi, eax
add rdi, rbx
movsd qword [rsp + 0x30], xmm1
movups xmmword [rsp + 0x20], xmm0
cmp rbx, rdi
jae 0x18001c65f
nop
mov r8d, socket
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.180008ce0
test eax, eax
je 0x18001c692
inc rbx
cmp rbx, rdi
jb 0x18001c640
xor eax, eax
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
inc r11d
add rdi, 0x28
add r10, 0x28
cmp r11d, ebx
jb 0x18001c5c0
jmp 0x18001c65f
add rbx, 0x18
cmp byte [rbx], sil
jne 0x18001c6a8
nop dword [rax + rax]
inc rbx
cmp byte [rbx], sil
je 0x18001c6a0
xorps xmm0, xmm0
mov edx, esi
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
cmp word [rbx], dx
je 0x18001c65f
nop dword [rax]
cmp edx, 3
jge 0x18001c6ea
movzx ecx, word [rbx]
cmp cx, 0x2c
je 0x18001c65f
cmp cx, 0x2e
jne 0x18001c6d8
inc edx
jmp 0x18001c6e0
mov eax, esi
inc esi
mov byte [rsp + rax + 0x38], cl
add rbx, 2
cmp word [rbx], 0
jne 0x18001c6c0
test esi, esi
je 0x18001c65f
xor edx, edx
lea rcx, [rsp + 0x38]
call fcn.180009ed0
jmp 0x18001c661
Function at 0x18001c750
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x20], r14
push r15
mov rax, qword gs:[0x30]
mov r15, r8
mov r11, rcx
mov rax, qword [rax + 0x60]
test rcx, rcx
jne 0x18001c7be
mov r8, qword [rax + 0x10]
test rdx, rdx
je 0x18001c7b3
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x18]
add rcx, 0x20
mov rax, qword [rcx]
cmp rax, rcx
je 0x18001c7b3
cmp r8, qword [rax + 0x20]
je 0x18001c7ae
mov rax, qword [rax]
cmp rax, rcx
jne 0x18001c795
mov rax, r8
mov r14, qword [rsp + 0x28]
pop r15
ret
mov ecx, dword [rax + 0x30]
mov dword [rdx], ecx
mov rax, r8
mov r14, qword [rsp + 0x28]
pop r15
ret
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
test r15, r15
je 0x18001c7dd
mov edi, dword [r8]
inc edi
jmp 0x18001c7df
xor edi, edi
mov r8, qword [rcx + 0x20]
lea rsi, [rcx + 0x20]
xor ebx, ebx
cmp r8, rsi
je 0x18001c835
nop
movzx ecx, word [r8 + 0x48]
test cx, cx
je 0x18001c82b
mov r10, qword [r8 + 0x50]
test r10, r10
je 0x18001c82b
cmp ebx, edi
jl 0x18001c82b
xor eax, eax
mov r9d, ecx
shr r9d, 1
je 0x18001c824
movsx ecx, byte [rax + r11]
cmp word [r10 + rax*2], cx
jne 0x18001c82b
inc eax
cmp eax, r9d
jb 0x18001c811
cmp byte [rax + r11], 0
je 0x18001c84e
mov r8, qword [r8]
inc ebx
cmp r8, rsi
jne 0x18001c7f0
xor eax, eax
mov rsi, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
pop r15
ret
test r15, r15
je 0x18001c856
mov dword [r15], ebx
test rdx, rdx
je 0x18001c861
mov ecx, dword [r8 + 0x30]
mov dword [rdx], ecx
mov rax, qword [r8 + 0x20]
jmp 0x18001c837
Function at 0x18001c8d0
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
mov r11, rsp
sub rsp, 0x128
mov qword [r11 + 8], 0
test rcx, rcx
je 0x18001ca3f
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x18001ca3f
mov eax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x18001ca3f
mov r8d, 0x20b
xor r9d, r9d
cmp word [rax + rcx + 0x18], r8w
lea r8, [r11 + 8]
jne 0x18001c925
call fcn.18000eb00
jmp 0x18001c92a
call fcn.18000e740
test rax, rax
je 0x18001ca19
mov r9, qword [rsp + 0x130]
test r9, r9
je 0x18001ca19
mov qword [rsp + 0x138], rbx
xor ecx, ecx
mov qword [rsp + 0x120], rdi
xor edi, edi
cmp byte [r9], cl
je 0x18001c988
movzx edx, byte [r9]
mov r8, r9
nop dword [rax]
nop dword [rax + rax]
cmp dl, 0x2e
lea r8, [r8 + 1]
movzx edx, byte [r8]
mov eax, ecx
cmovne eax, edi
inc ecx
mov edi, eax
test dl, dl
jne 0x18001c970
movsxd rbx, edi
lea rcx, [rsp + 0x20]
mov r8, rbx
mov rdx, r9
call fcn.180008d30
mov rax, qword gs:[0x30]
xor r11d, r11d
mov byte [rsp + rbx + 0x20], 0
mov rcx, qword [rax + 0x60]
mov rbx, qword [rcx + 0x18]
add rbx, 0x20
mov r9, qword [rbx]
cmp r9, rbx
je 0x18001ca07
movzx ecx, word [r9 + 0x48]
test cx, cx
je 0x18001c9fc
mov r10, qword [r9 + 0x50]
test r10, r10
je 0x18001c9fc
test r11d, r11d
js 0x18001c9fc
xor eax, eax
mov r8d, ecx
shr r8d, 1
je 0x18001c9f5
movsx ecx, byte [rsp + rax + 0x20]
cmp word [r10 + rax*2], cx
jne 0x18001c9fc
inc eax
cmp eax, r8d
jb 0x18001c9e2
cmp byte [rsp + rax + 0x20], 0
je 0x18001ca21
mov r9, qword [r9]
inc r11d
cmp r9, rbx
jne 0x18001c9c0
xor eax, eax
mov rbx, qword [rsp + 0x138]
mov rdi, qword [rsp + 0x120]
add rsp, 0x128
ret
mov rcx, qword [r9 + 0x20]
test rcx, rcx
je 0x18001ca07
lea eax, [rdi + 1]
movsxd rdx, eax
add rdx, qword [rsp + 0x130]
call fcn.18001c8d0
jmp 0x18001ca09
xor eax, eax
add rsp, 0x128
ret
Function at 0x180026e70
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r14
sub rsp, 0x40
mov rdi, rcx
movabs rax, 0x5b2ef26b027cfb69
mov qword [r11 - 0x28], rax
movabs rcx, 0x5b2e97076512942d
xor rax, rcx
mov r14, rdx
mov rcx, qword [rsp + 0x70]
lea rdx, [r11 - 0x28]
mov qword [r11 - 0x28], rax
mov rbx, r9
mov rbp, r8
call fcn.18001c4b0
mov rsi, rax
test rax, rax
jne 0x180026ed2
lea eax, [rsi - 1]
jmp 0x180026fc4
movabs rax, 0x104be366137be67d
xor r10d, r10d
mov qword [rsp + 0x28], rax
movabs r11, 0x549a2d1f135dad7a
movabs rax, 0x50b56cba5c6eed2f
mov qword [rsp + 0x30], rax
nop dword [rax]
mov rax, qword [rsp + r10*8 + 0x28]
mov r9d, r10d
neg r9d
mov r8, r11
and r9d, 0xf
rol r8, 3
not r8
rol r11, 1
mov rdx, r8
mov ecx, r9d
neg ecx
and ecx, 0x3f
shl rdx, cl
mov ecx, r9d
shr r8, cl
or rdx, r8
xor rdx, rax
mov qword [rsp + r10*8 + 0x28], rdx
inc r10
cmp r10, 2
jb 0x180026f00
lea rdx, [rsp + 0x28]
mov rcx, rsi
call fcn.18001c4b0
test rax, rax
jne 0x180026f5d
mov eax, 0xfffffffe
jmp 0x180026fc4
mov rdx, rbp
mov rcx, rax
call fcn.18001c4b0
test rax, rax
jne 0x180026f74
mov eax, 0xfffffffd
jmp 0x180026fc4
mov rdx, qword [rax + 0x20]
test rdx, rdx
je 0x180026fbf
cmp byte [rdx], 0
je 0x180026fbf
mov r8d, dword [rdx - 4]
shr r8d, 1
lea eax, [r8 - 1]
cmp eax, 0x7ff
ja 0x180026fbf
mov r9b, 0x20
mov rcx, rdi
call fcn.18000ab90
mov dword [r14], eax
test rbx, rbx
je 0x180026fbb
mov r9d, 3
mov r8d, eax
mov rdx, rdi
mov rcx, rbx
call fcn.18001b0b0
xor eax, eax
jmp 0x180026fc4
mov eax, 0xfffffffc
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x18002c6f0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push rsi
push rdi
sub rsp, 0x168
mov rdi, rdx
mov rsi, rcx
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
je 0x18002c865
lea rax, [rsp + 0x198]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x18002c74c
cmp eax, 2
je 0x18002c865
mov eax, 0xffffffff
add rsp, 0x168
pop rdi
pop rsi
ret
mov qword [rsp + 0x180], rbx
mov rcx, rdi
mov qword [rsp + 0x160], rbp
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsxd rbx, eax
add rbx, rdi
cmp byte [rbx - 1], 0x5c
je 0x18002c77a
mov byte [rbx], 0x5c
inc rbx
mov byte [rbx], 0
mov rcx, qword [rsp + 0x198]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x190]
xor ebp, ebp
mov dword [rsp + 0x190], 0x104
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x50]
mov qword [rsp + 0x28], rbp
xor edx, edx
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x18002c826
lea rdx, [rsp + 0x50]
mov byte [rbx], bpl
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov rdx, rdi
mov rcx, rsi
call fcn.18002c6f0
test eax, eax
je 0x18002c826
mov rcx, qword [rsp + 0x198]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x190]
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x50]
mov qword [rsp + 0x28], rbp
xor edx, edx
mov qword [rsp + 0x20], rbp
mov dword [rsp + 0x190], 0x104
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x18002c7c1
mov byte [rbx - 1], bpl
mov rcx, qword [rsp + 0x198]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov rbp, qword [rsp + 0x160]
neg eax
mov rbx, qword [rsp + 0x180]
sbb eax, eax
and eax, 0xfffffffe
add rsp, 0x168
pop rdi
pop rsi
ret
xor eax, eax
add rsp, 0x168
pop rdi
pop rsi
ret

Function at 0x18002ccb0
Capabilities:
Enumerate pe sections

Disassembly:
mov r8d, dword [rcx + 0x3c]
mov r10d, edx
movzx eax, word [r8 + rcx + 0x14]
movzx r11d, word [r8 + rcx + 6]
add r8d, 0x18
add eax, r8d
xor r8d, r8d
add rax, rcx
test r11d, r11d
je 0x18002ccf5
mov r9d, dword [rax + 0xc]
cmp r9d, r10d
ja 0x18002cce9
mov edx, dword [rax + 8]
add edx, r9d
cmp edx, r10d
ja 0x18002ccf8
inc r8d
add rax, 0x28
cmp r8d, r11d
jl 0x18002ccd5
xor eax, eax
ret
sub r10d, r9d
cmp r10d, dword [rax + 0x10]
jae 0x18002ccf5
mov eax, dword [rax + 0x14]
add eax, r10d
ret
Function at 0x18002f920
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
mov rcx, qword [rcx]
cmp qword [rax + 8], rcx
jne 0x18002f946
jmp 0x18002fa27
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
mov rcx, qword [rcx]
mov qword [rax + 8], rcx
mov eax, 8
imul rax, rax, 3
mov rcx, qword [rsp + 0x60]
mov rcx, qword [rcx + 8]
mov rdx, qword [rsp + 0x60]
mov rax, qword [rax + rcx]
mov qword [rdx], rax
mov eax, 8
imul rax, rax, 3
mov rcx, qword [rsp + 0x60]
add rax, qword [rcx + 8]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 8
mov dword [rsp + 0x30], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x40]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
mov eax, 8
imul rax, rax, 3
mov rcx, qword [rsp + 0x60]
mov rcx, qword [rcx + 8]
lea rdx, [0x18001cd90]
mov qword [rax + rcx], rdx
mov eax, 8
imul rax, rax, 3
mov rcx, qword [rsp + 0x60]
add rax, qword [rcx + 8]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 8
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x30]
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x40]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
add rsp, 0x58
ret

Function at 0x18002fa30
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
mov rcx, qword [rcx]
cmp qword [rax + 8], rcx
jne 0x18002fa56
jmp 0x18002fb37
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
mov rcx, qword [rcx]
mov qword [rax + 8], rcx
mov eax, 8
imul rax, rax, 0x14
mov rcx, qword [rsp + 0x60]
mov rcx, qword [rcx + 8]
mov rdx, qword [rsp + 0x60]
mov rax, qword [rax + rcx]
mov qword [rdx], rax
mov eax, 8
imul rax, rax, 0x14
mov rcx, qword [rsp + 0x60]
add rax, qword [rcx + 8]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 8
mov dword [rsp + 0x30], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x40]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
mov eax, 8
imul rax, rax, 0x14
mov rcx, qword [rsp + 0x60]
mov rcx, qword [rcx + 8]
lea rdx, [0x18001ce20]
mov qword [rax + rcx], rdx
mov eax, 8
imul rax, rax, 0x14
mov rcx, qword [rsp + 0x60]
add rax, qword [rcx + 8]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 8
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x30]
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x40]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
add rsp, 0x58
ret
Function at 0x18002fb40
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
mov rcx, qword [rcx]
cmp qword [rax + 8], rcx
jne 0x18002fb66
jmp 0x18002fc47
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
mov rcx, qword [rcx]
mov qword [rax + 8], rcx
mov eax, 8
imul rax, rax, 0x15
mov rcx, qword [rsp + 0x60]
mov rcx, qword [rcx + 8]
mov rdx, qword [rsp + 0x60]
mov rax, qword [rax + rcx]
mov qword [rdx], rax
mov eax, 8
imul rax, rax, 0x15
mov rcx, qword [rsp + 0x60]
add rax, qword [rcx + 8]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 8
mov dword [rsp + 0x30], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x40]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
mov eax, 8
imul rax, rax, 0x15
mov rcx, qword [rsp + 0x60]
mov rcx, qword [rcx + 8]
lea rdx, [0x18001ce90]
mov qword [rax + rcx], rdx
mov eax, 8
imul rax, rax, 0x15
mov rcx, qword [rsp + 0x60]
add rax, qword [rcx + 8]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 8
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x30]
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x40]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
add rsp, 0x58
ret
Function at 0x180032680
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov ebp, dword [rdx + 8]
mov r14, rdx
mov r13, rcx
and ebp, 0x1fffffff
mov rcx, r14
movzx r12d, r8b
lea edi, [rbp + 4]
mov edx, edi
call fcn.18002cb90
xor esi, esi
test rax, rax
jne 0x1800326c8
mov r15d, esi
jmp 0x18003270a
mov r15d, dword [r14 + 8]
mov rcx, r14
mov rdi, qword [r14]
mov eax, r15d
mov ebx, r15d
and ebx, 0x1fffffff
add ebx, 4
xor eax, ebx
mov edx, ebx
and eax, 0x1fffffff
xor eax, r15d
mov dword [r14 + 8], eax
call fcn.18002dcf0
mov rax, qword [r14]
and r15d, 0x1fffffff
add r15, rdi
lea edi, [rbp + 4]
mov byte [rbx + rax], sil
xor eax, eax
mov rdx, r14
mov dword [r15], eax
mov rcx, r13
mov rax, qword [r14]
mov dword [rbp + rax], 0x4e534942
mov r8d, dword [r14 + 8]
and r8d, 0x1fffffff
call fcn.18001adc0
mov r10d, eax
test r12b, r12b
je 0x1800327c6
mov rcx, qword [r14]
or r13d, 0x80808080
mov r9d, edi
add r9, rcx
mov dword [rbp + rcx], r13d
mov r11d, dword [r14 + 8]
and r11d, 0x1fffffff
sub r11d, ebp
sub r11d, 4
mov eax, r11d
movzx ecx, r11b
shr eax, 8
movzx ebx, al
imul ebx, ecx
test r11d, r11d
je 0x1800327c3
nop dword [rax + rax]
movzx ecx, bl
lea r9, [r9 + 1]
movzx eax, sil
and al, 0x7e
movzx r8d, al
imul r8d, ecx
movzx ecx, r12b
add cl, byte [r9 - 1]
not cl
xor cl, bl
add r8b, sil
lea eax, [r8 + rcx]
sub cl, r8b
test sil, 1
movzx ecx, cl
movzx eax, al
cmove ecx, eax
inc esi
mov byte [r9 - 1], cl
cmp esi, r11d
jb 0x180032780
mov eax, r10d
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x1800327f0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rsi
sub rsp, 0x40
xor r9d, r9d
mov qword [rsp + 0x30], 0
cmp byte [rdx + 1], r9b
mov rsi, rcx
mov rax, rdx
mov dword [rsp + 0x28], 0x8000080
mov rcx, rdx
mov dword [rsp + 0x20], 2
lea r8d, [r9 + 3]
mov edx, 0x40000000
jne 0x180032836
call qword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x18003283c
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x180032852
xor al, al
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rsi
ret
mov r8d, dword [rsi + 8]
lea r9, [rsp + 0x58]
mov rdx, qword [rsi]
and r8d, 0x1fffffff
mov rcx, rbx
mov dword [rsp + 0x58], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsi + 8]
mov rbx, qword [rsp + 0x50]
and eax, 0x1fffffff
cmp dword [rsp + 0x58], eax
sete al
add rsp, 0x40
pop rsi
ret