joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180013590
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x230
mov rax, qword [0x1803a5f20]
xor rax, rsp
mov qword [rsp + 0x220], rax
call fcn.1800d5fa0
test eax, eax
jge 0x1800135bf
xor eax, eax
jmp 0x180013867
mov byte [rsp + 0x88], 0x90
mov byte [rsp + 0x89], 0x86
mov byte [rsp + 0x8a], 0xd5
mov byte [rsp + 0x8b], 0x44
mov byte [rsp + 0x8c], 0x57
mov byte [rsp + 0x8d], 0x92
mov byte [rsp + 0x8e], 0x70
mov byte [rsp + 0x8f], 0x5a
mov byte [rsp + 0x90], 0x17
mov byte [rsp + 0x91], 0x5d
mov byte [rsp + 0x92], 0x45
mov byte [rsp + 0x93], 0x3c
mov byte [rsp + 0x94], 0xcc
mov byte [rsp + 0x95], 0x9f
mov byte [rsp + 0x96], 0xaf
mov byte [rsp + 0x97], 0xab
mov byte [rsp + 0x98], 0xff
mov byte [rsp + 0x99], 0x73
mov byte [rsp + 0x9a], 0xf4
mov byte [rsp + 0x9b], 0xc9
mov byte [rsp + 0x9c], 0xaa
mov byte [rsp + 0x9d], 0x5e
mov byte [rsp + 0x9e], 3
mov byte [rsp + 0x9f], 2
mov byte [rsp + 0xa0], 0x16
mov byte [rsp + 0xa1], 0xea
mov byte [rsp + 0xa2], 0xf6
mov byte [rsp + 0xa3], 0x7b
mov byte [rsp + 0xa4], 0x22
mov byte [rsp + 0xa5], 0x6a
mov byte [rsp + 0xa6], 0xfe
mov byte [rsp + 0xa7], 0x99
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
mov r9d, 0x81
mov r8, qword [rsp + 0x240]
mov edx, 0x40
lea rcx, [rsp + 0x1e0]
call fcn.1800d6e30
mov byte [rsp + 0xb0], 0
lea rax, [rsp + 0xb1]
mov rdi, rax
xor eax, eax
mov ecx, 0x41
rep stosb byte [rdi], al
mov byte [rsp + 0x100], 0
lea rax, [rsp + 0x101]
mov rdi, rax
xor eax, eax
mov ecx, 0x41
rep stosb byte [rdi], al
mov byte [rsp + 0x150], 0
lea rax, [rsp + 0x151]
mov rdi, rax
xor eax, eax
mov ecx, 0x81
rep stosb byte [rdi], al
lea rcx, [rsp + 0xb0]
call sym.SegurazoEngine.dll_GetHardwareId
lea rcx, [rsp + 0x100]
call sym.SegurazoEngine.dll_GetSoftwareId
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x150]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x60]
movzx eax, byte [rax]
mov byte [rsp + 0x40], al
mov rax, qword [rsp + 0x50]
movzx ecx, byte [rsp + 0x40]
mov byte [rax], cl
mov rax, qword [rsp + 0x60]
inc rax
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x50]
inc rax
mov qword [rsp + 0x50], rax
cmp byte [rsp + 0x40], 0
jne 0x180013791
lea rax, [rsp + 0x150]
mov qword [rsp + 0x48], rax
dec qword [rsp + 0x48]
inc qword [rsp + 0x48]
mov rax, qword [rsp + 0x48]
cmp byte [rax], 0
jne 0x1800137dc
mov rax, qword [rsp + 0x48]
lea rcx, [rsp + 0x100]
xor edx, edx
movzx edi, byte [rcx + rdx]
mov byte [rax + rdx], dil
inc rdx
test dil, dil
jne 0x1800137fa
lea rax, [rsp + 0x150]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x58], 0xffffffffffffffff
inc qword [rsp + 0x58]
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
cmp byte [rax + rcx], 0
jne 0x180013820
mov rax, qword [rsp + 0x58]
lea r9, [rsp + 0x88]
mov r8, rax
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0x1e0]
call fcn.1800d62a0
test eax, eax
je 0x180013862
xor eax, eax
jmp 0x180013867
mov eax, 1
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.1800f1430
add rsp, 0x230
pop rdi
ret
Function at 0x180016820
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rcx
mov rax, qword [rsp + 8]
mov qword [rax], 0
mov rax, qword [rsp + 8]
mov qword [rax + 8], 0
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0x6a09e667
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0xbb67ae85
mov eax, 4
imul rax, rax, 2
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0x3c6ef372
mov eax, 4
imul rax, rax, 3
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0xa54ff53a
mov eax, 4
imul rax, rax, 4
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0x510e527f
mov eax, 4
imul rax, rax, 5
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0x9b05688c
mov eax, 4
imul rax, rax, 6
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0x1f83d9ab
mov eax, 4
imul rax, rax, 7
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0x5be0cd19
ret
Function at 0x180034df0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x58
mov rax, qword [rsp + 0x80]
mov ecx, dword [rsp + 0x88]
mov eax, dword [rax + 0x24]
sub eax, ecx
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jg 0x180034ec8
mov dword [rsp + 0x30], 0
jmp 0x180034e41
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x90]
cmp dword [rsp + 0x30], eax
jge 0x180034e62
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x78]
movzx eax, byte [rcx + rax]
test eax, eax
jne 0x180034e62
jmp 0x180034e37
mov eax, dword [rsp + 0x90]
cmp dword [rsp + 0x30], eax
jge 0x180034ec3
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 0x70]
call fcn.180087b60
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
je 0x180034e91
mov eax, dword [rsp + 0x38]
jmp 0x180034fb5
mov eax, dword [rsp + 0x30]
mov ecx, dword [rsp + 0x90]
sub ecx, eax
mov eax, ecx
cdqe
mov qword [rsp + 0x48], rax
movsxd rcx, dword [rsp + 0x30]
mov rdx, qword [rsp + 0x78]
add rdx, rcx
mov rcx, rdx
mov rdi, rcx
xor eax, eax
mov rcx, qword [rsp + 0x48]
rep stosb byte [rdi], al
jmp 0x180034fb3
mov eax, dword [rsp + 0x90]
cmp dword [rsp + 0x34], eax
jge 0x180034f3b
mov eax, dword [rsp + 0x34]
mov ecx, dword [rsp + 0x90]
sub ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x34]
mov edx, dword [rsp + 0x88]
add edx, ecx
mov ecx, edx
movsxd rdx, dword [rsp + 0x34]
mov rdi, qword [rsp + 0x78]
add rdi, rdx
mov rdx, rdi
mov dword [rsp + 0x20], eax
mov r9d, ecx
mov r8, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x70]
call fcn.180034df0
mov dword [rsp + 0x3c], eax
cmp dword [rsp + 0x3c], 0
je 0x180034f30
mov eax, dword [rsp + 0x3c]
jmp 0x180034fb5
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x90], eax
movsxd rax, dword [rsp + 0x90]
movsxd rcx, dword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
add rcx, qword [rdx + 0x10]
mov r8, rax
mov rdx, rcx
mov rcx, qword [rsp + 0x78]
call fcn.1800f3010
test eax, eax
je 0x180034fb3
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 0x70]
call fcn.180087b60
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
je 0x180034f8a
mov eax, dword [rsp + 0x40]
jmp 0x180034fb5
movsxd rax, dword [rsp + 0x90]
movsxd rcx, dword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
add rcx, qword [rdx + 0x10]
mov rdi, qword [rsp + 0x78]
mov rsi, rcx
mov rcx, rax
rep movsb byte [rdi], byte [rsi]
xor eax, eax
add rsp, 0x58
pop rdi
pop rsi
ret
Function at 0x18005abc0
Capabilities:
Reference sql statements

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea r9, [0x18039ea38]
mov r8, qword [rsp + 0x48]
lea rdx, str.SELECT_1_FROM___w_._s_WHERE_name_NOT_LIKE_sqlite____AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d_NULL
mov rcx, qword [rsp + 0x40]
call fcn.180083d80
cmp dword [rsp + 0x50], 0
jne 0x18005ac26
mov r9, qword [rsp + 0x48]
lea r8, [0x18039eb28]
lea rdx, str.SELECT_1_FROM_temp._s_WHERE_name_NOT_LIKE_sqlite____AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1_NULL
mov rcx, qword [rsp + 0x40]
call fcn.180083d80
add rsp, 0x38
ret
Function at 0x1800960e0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov rax, qword [rsp + 0x50]
mov qword [rax], 0
mov ecx, 0x28
call fcn.1800832d0
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x180096121
mov eax, 7
jmp 0x1800961eb
cmp dword [0x1803a2aa4], 0
je 0x180096138
mov ecx, 0xc8
call fcn.180077a10
test eax, eax
je 0x180096148
mov rdi, qword [rsp + 0x30]
xor eax, eax
mov ecx, 0x28
rep stosb byte [rdi], al
jmp 0x1800961b0
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x58]
mov qword [rax + 0x10], rcx
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x60]
mov qword [rax + 0x18], rcx
mov rax, qword [rsp + 0x30]
add rax, 8
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0x30]
lea r8, [0x1800962a0]
xor edx, edx
xor ecx, ecx
call fcn.1800fca74
mov rcx, qword [rsp + 0x30]
mov qword [rcx], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
jne 0x1800961b0
mov rdi, qword [rsp + 0x30]
xor eax, eax
mov ecx, 0x28
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x30]
cmp qword [rax + 0x10], 0
jne 0x1800961dc
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rcx, qword [rsp + 0x30]
mov dword [rcx + 8], eax
mov rcx, qword [rsp + 0x60]
call qword [rsp + 0x58]
mov rcx, qword [rsp + 0x30]
mov qword [rcx + 0x20], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
xor eax, eax
add rsp, 0x40
pop rdi
ret
Function at 0x1800d6370
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x28
lea r9, [rsp + 0x40]
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor ecx, ecx
test eax, eax
sete cl
neg ecx
mov eax, ecx
add rsp, 0x28
ret

Function at 0x1800d63a0
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x28
lea r9, [rsp + 0x40]
mov r8d, 2
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor ecx, ecx
test eax, eax
sete cl
neg ecx
mov eax, ecx
add rsp, 0x28
ret

Function at 0x1800d63d0
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x28
lea r9, [rsp + 0x40]
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor ecx, ecx
test eax, eax
sete cl
neg ecx
mov eax, ecx
add rsp, 0x28
ret

Function at 0x1800d6420
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x24]
mov qword [0x1803a7458], rax
cmp rax, 0xf
ja 0x1800d6445
call fcn.1800d6020
mov edx, 0x10
lea rcx, [0x1803a7460]
call fcn.1800d62b0
xor eax, eax
add rsp, 0x58
ret

Function at 0x1800d66e0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rcx
xor r9d, r9d
mov qword [rsp + 0x10], rdx
mov r10, r8
mov byte [rsp + 8], 0
test r8, r8
je 0x1800d672b
nop word [rax + rax]
mov rax, qword [rsp + 0x10]
movzx ecx, byte [rax + r9]
mov rax, qword [rsp + 0x18]
movzx r8d, byte [rax + r9]
inc r9
movzx eax, byte [rsp + 8]
xor r8d, ecx
or eax, r8d
mov byte [rsp + 8], al
cmp r9, r10
jb 0x1800d6700
movzx eax, byte [rsp + 8]
dec eax
sar eax, 8
and eax, 1
dec eax
ret
Function at 0x1800d6c70
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x20
xor edi, edi
mov rbp, rcx
mov ecx, dword [rsp + 0x70]
mov ebx, edi
mov r14d, edi
mov esi, edi
mov r15, r9
call fcn.1800d6c60
movabs rax, 0xaaaaaaaaaaaaaaab
mov rcx, r15
mul r15
shr rdx, 1
lea rax, [rdx + rdx*2]
lea r12, [rdx*4]
sub rcx, rax
je 0x1800d6ce3
test byte [rsp + 0x70], 2
jne 0x1800d6cd9
add r12, 4
jmp 0x1800d6ce3
shr rcx, 1
add r12, 2
add r12, rcx
cmp qword [rsp + 0x58], r12
ja 0x1800d6cef
call fcn.1800d6020
test byte [rsp + 0x70], 4
je 0x1800d6d75
test r15, r15
je 0x1800d6de5
mov r11, qword [rsp + 0x60]
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [r14 + r11]
add rdi, 8
shl esi, 8
inc r14
add esi, eax
cmp rdi, 6
jb 0x1800d6d51
nop word [rax + rax]
mov eax, esi
sub rdi, 6
mov rcx, rdi
shr eax, cl
and eax, 0x3f
mov ecx, eax
call fcn.1800d68d0
mov byte [rbx + rbp], al
inc rbx
cmp rdi, 6
jae 0x1800d6d30
cmp r14, r15
jb 0x1800d6d10
test rdi, rdi
je 0x1800d6de5
mov ecx, 6
sub cl, dil
shl esi, cl
and esi, 0x3f
mov ecx, esi
call fcn.1800d68d0
jmp 0x1800d6ddf
test r15, r15
je 0x1800d6de5
mov r11, qword [rsp + 0x60]
nop
movzx eax, byte [r14 + r11]
add rdi, 8
shl esi, 8
inc r14
add esi, eax
cmp rdi, 6
jb 0x1800d6dc1
nop word [rax + rax]
mov eax, esi
sub rdi, 6
mov rcx, rdi
shr eax, cl
and eax, 0x3f
mov ecx, eax
call fcn.1800d6860
mov byte [rbx + rbp], al
inc rbx
cmp rdi, 6
jae 0x1800d6da0
cmp r14, r15
jb 0x1800d6d80
test rdi, rdi
je 0x1800d6de5
mov ecx, 6
sub cl, dil
shl esi, cl
and esi, 0x3f
mov ecx, esi
call fcn.1800d6860
mov byte [rbx + rbp], al
inc rbx
cmp rbx, r12
jae 0x1800d6dfe
sub r12, rbx
lea rdi, [rbx + rbp]
mov rcx, r12
mov eax, 0x3d
rep stosb byte [rdi], al
add rbx, r12
mov rax, qword [rsp + 0x58]
mov byte [rbx + rbp], 0
inc rbx
cmp rbx, rax
jb 0x1800d6e03
mov rbx, qword [rsp + 0x50]
mov rax, rbp
mov rbp, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1800d7370
Capabilities:
Encode data using xor
Encrypt data using salsa20 or chacha

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x18
mov rax, rdx
test r9, r9
jne 0x1800d73a6
mov ebx, 0x79622d32
mov r10d, 0x61707865
mov r11d, 0x3320646e
mov r9d, 0x6b206574
jmp 0x1800d73b5
mov r10d, dword [r9]
mov r11d, dword [r9 + 4]
mov ebx, dword [r9 + 8]
mov r9d, dword [r9 + 0xc]
mov ecx, dword [r8 + 0x18]
mov edx, dword [r8 + 0x14]
mov r14d, dword [r8]
mov r15d, dword [r8 + 4]
mov r12d, dword [r8 + 8]
mov ebp, dword [r8 + 0xc]
mov r13d, dword [r8 + 0x10]
mov edi, dword [rax + 8]
mov esi, dword [rax + 0xc]
mov dword [rsp + 0x68], ecx
mov ecx, dword [r8 + 0x1c]
mov r8d, dword [rax + 4]
mov dword [rsp + 0x78], edx
mov edx, dword [rax]
mov dword [rsp + 0x70], ecx
mov ecx, dword [rsp + 0x78]
mov qword [rsp + 8], 0xa
nop dword [rax]
lea eax, [rcx + r10]
rol eax, 7
xor ebp, eax
lea eax, [r10 + rbp]
rol eax, 9
xor edi, eax
lea eax, [rdi + rbp]
rol eax, 0xd
xor ecx, eax
lea eax, [rdi + rcx]
ror eax, 0xe
xor r10d, eax
lea eax, [r14 + r11]
rol eax, 7
xor esi, eax
lea eax, [rsi + r11]
rol eax, 9
xor dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x68]
add eax, esi
rol eax, 0xd
xor r14d, eax
mov eax, dword [rsp + 0x68]
add eax, r14d
ror eax, 0xe
xor r11d, eax
lea eax, [rdx + rbx]
rol eax, 7
xor dword [rsp + 0x70], eax
mov eax, dword [rsp + 0x70]
add eax, ebx
rol eax, 9
xor r15d, eax
mov eax, dword [rsp + 0x70]
add eax, r15d
rol eax, 0xd
xor edx, eax
lea eax, [rdx + r15]
ror eax, 0xe
xor ebx, eax
lea eax, [r9 + r13]
rol eax, 7
xor r12d, eax
lea eax, [r12 + r9]
rol eax, 9
xor r8d, eax
lea eax, [r8 + r12]
rol eax, 0xd
xor r13d, eax
lea eax, [r8 + r13]
ror eax, 0xe
xor r9d, eax
lea eax, [r12 + r10]
rol eax, 7
xor r14d, eax
mov dword [rsp], r14d
lea eax, [r14 + r10]
rol eax, 9
xor r15d, eax
lea eax, [r15 + r14]
rol eax, 0xd
xor r12d, eax
lea eax, [r12 + r15]
ror eax, 0xe
xor r10d, eax
lea eax, [r11 + rbp]
rol eax, 7
xor edx, eax
lea eax, [rdx + r11]
rol eax, 9
xor r8d, eax
lea eax, [r8 + rdx]
rol eax, 0xd
xor ebp, eax
lea eax, [r8 + rbp]
ror eax, 0xe
xor r11d, eax
lea eax, [rsi + rbx]
rol eax, 7
xor r13d, eax
lea eax, [rbx + r13]
mov r14d, dword [rsp + 0x70]
rol eax, 9
xor edi, eax
lea eax, [rdi + r13]
rol eax, 0xd
xor esi, eax
lea eax, [rsi + rdi]
ror eax, 0xe
xor ebx, eax
mov eax, dword [rsp + 0x70]
add eax, r9d
rol eax, 7
xor ecx, eax
lea eax, [rcx + r9]
rol eax, 9
xor dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x68]
add eax, ecx
rol eax, 0xd
xor r14d, eax
mov eax, dword [rsp + 0x68]
add eax, r14d
mov dword [rsp + 0x70], r14d
mov r14d, dword [rsp]
ror eax, 0xe
xor r9d, eax
sub qword [rsp + 8], 1
jne 0x1800d7400
mov rcx, qword [rsp + 0x60]
xor eax, eax
mov dword [rcx], r10d
mov dword [rcx + 4], r11d
mov dword [rcx + 8], ebx
mov dword [rcx + 0xc], r9d
mov dword [rcx + 0x10], edx
mov dword [rcx + 0x14], r8d
mov dword [rcx + 0x18], edi
mov dword [rcx + 0x1c], esi
add rsp, 0x18
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1800d77d0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
call fcn.1800d7850
mov eax, 0xffffffff
cmp rbx, rax
jbe 0x1800d77f4
call fcn.1800d6020
mov edx, ebx
mov rcx, rdi
call sub.ADVAPI32.dll_SystemFunction036
test al, al
jne 0x1800d7807
call fcn.1800d6020
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1800ddfc0
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov dword [rcx], 0x61707865
mov dword [rcx + 4], 0x3320646e
mov dword [rcx + 8], 0x79622d32
mov dword [rcx + 0xc], 0x6b206574
mov eax, dword [rdx]
mov dword [rcx + 0x10], eax
mov eax, dword [rdx + 4]
mov dword [rcx + 0x14], eax
mov eax, dword [rdx + 8]
mov dword [rcx + 0x18], eax
mov eax, dword [rdx + 0xc]
mov dword [rcx + 0x1c], eax
mov eax, dword [rdx + 0x10]
mov dword [rcx + 0x20], eax
mov eax, dword [rdx + 0x14]
mov dword [rcx + 0x24], eax
mov eax, dword [rdx + 0x18]
mov dword [rcx + 0x28], eax
mov eax, dword [rdx + 0x1c]
mov dword [rcx + 0x2c], eax
ret
Function at 0x1800e42d0
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov eax, dword [rdx]
mov dword [rcx + 0x14], eax
mov eax, dword [rdx + 4]
mov dword [rcx + 0x28], eax
mov eax, dword [rdx + 8]
mov dword [rcx + 0x3c], eax
mov eax, dword [rdx + 0xc]
mov dword [rcx + 0x30], eax
mov eax, dword [rdx + 0x10]
mov dword [rcx + 0x1c], eax
mov eax, dword [rdx + 0x14]
mov dword [rcx + 0x10], eax
mov eax, dword [rdx + 0x18]
mov dword [rcx + 0x24], eax
mov eax, dword [rdx + 0x1c]
mov dword [rcx + 0x38], eax
mov dword [rcx], 0x61707865
mov dword [rcx + 4], 0x3320646e
mov dword [rcx + 8], 0x79622d32
mov dword [rcx + 0xc], 0x6b206574
ret

Function at 0x1800e7190
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x10
mov rax, qword [0x1803a5f20]
xor rax, rsp
mov qword [rsp + 8], rax
xor eax, eax
lea r15, [0x18011d200]
mov dword [rsp + 1], eax
xor r8b, r8b
movzx r11d, byte [rsp + 4]
mov r14, rcx
movzx ebx, byte [rsp + 3]
mov rbp, rcx
movzx edi, byte [rsp + 2]
sub r14, r15
mov word [rsp + 5], ax
movzx r10d, al
movzx r9d, byte [rsp + 6]
movzx esi, al
nop dword [rax]
nop word [rax + rax]
lea rcx, [r14 + rax]
movzx edx, byte [rcx + r15]
movzx ecx, byte [rax + r15]
xor cl, dl
or r8b, cl
movzx ecx, byte [rax + r15 + 0x20]
xor cl, dl
or sil, cl
movzx ecx, byte [rax + r15 + 0x40]
xor cl, dl
or dil, cl
movzx ecx, byte [rax + r15 + 0x60]
xor cl, dl
or bl, cl
movzx ecx, byte [rax + r15 + 0x80]
xor cl, dl
or r11b, cl
movzx ecx, byte [rax + r15 + 0xa0]
xor cl, dl
or r10b, cl
movzx ecx, byte [rax + r15 + 0xc0]
xor cl, dl
inc rax
or r9b, cl
cmp rax, 0x1f
jb 0x1800e7200
movzx edx, byte [rax + rbp]
movzx ecx, byte [rax + r15]
and dl, 0x7f
xor cl, dl
or r8b, cl
movzx ecx, byte [rax + r15 + 0x20]
xor cl, dl
or sil, cl
movzx ecx, byte [rax + r15 + 0x40]
xor cl, dl
or dil, cl
movzx ecx, byte [rax + r15 + 0x60]
xor cl, dl
or bl, cl
movzx ecx, byte [rax + r15 + 0x80]
xor cl, dl
or r11b, cl
movzx ecx, byte [rax + r15 + 0xa0]
xor cl, dl
or r10b, cl
movzx ecx, byte [rax + r15 + 0xc0]
xor cl, dl
movzx eax, bl
dec eax
movzx edx, dil
or r9b, cl
dec edx
or edx, eax
movzx ecx, r9b
dec ecx
movzx eax, r11b
dec eax
or edx, eax
movzx eax, r10b
dec eax
or eax, edx
or eax, ecx
movzx ecx, sil
dec ecx
or eax, ecx
movzx ecx, r8b
dec ecx
or eax, ecx
shr eax, 8
and eax, 1
mov rcx, qword [rsp + 8]
xor rcx, rsp
call fcn.1800f1430
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x10
pop r15
pop r14
pop rdi
ret

Function at 0x1800e8690
Capabilities:
Encode data using add xor sub operations
Hash data using sha512

Disassembly:
mov qword [rsp + 8], rbx
xor r9b, r9b
lea r8, [0x18011d300]
sub rcx, r8
mov r10b, 1
mov r11d, 0x20
lea rbx, [rcx + 0x20]
nop
movzx edx, byte [rbx + r8 - 1]
lea r8, [r8 - 1]
movzx ecx, byte [r8]
mov eax, edx
sub eax, ecx
xor edx, ecx
sar eax, 8
dec edx
and al, r10b
sar edx, 8
or r9b, al
and r10b, dl
add r11d, 0xffffffff
jne 0x1800e86b0
mov rbx, qword [rsp + 8]
xor eax, eax
test r9b, r9b
setne al
ret
Function at 0x1800e9630
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rcx
xor eax, eax
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], eax
mov rcx, qword [rsp + 0x10]
movzx edx, byte [rcx + rax]
mov rcx, qword [rsp + 0x18]
movzx ecx, byte [rcx + rax]
inc rax
xor ecx, edx
or dword [rsp + 8], ecx
cmp rax, 0x10
jl 0x1800e9640
mov eax, dword [rsp + 8]
dec eax
shr eax, 8
and eax, 1
dec eax
ret

Function at 0x1800e9670
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rcx
xor eax, eax
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], eax
mov rcx, qword [rsp + 0x10]
movzx edx, byte [rcx + rax]
mov rcx, qword [rsp + 0x18]
movzx ecx, byte [rcx + rax]
inc rax
xor ecx, edx
or dword [rsp + 8], ecx
cmp rax, 0x20
jl 0x1800e9680
mov eax, dword [rsp + 8]
dec eax
shr eax, 8
and eax, 1
dec eax
ret
Function at 0x14001cb20
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14001cb2d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14001cb3d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14001cb25
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x14001cb55
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14001cb42
sub eax, 3
jb 0x14001cb6f
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14001cba6
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x14001cb96
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14001cb94
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14001cb83
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.14001cae2
jmp 0x14001cb2d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x6e00
mov dl, 2
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14001cbf2
cmp rsi, rcx
jae 0x14001cbfa
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x14001cbd9
cmp al, 0x8f
ja 0x14001cbd9
cmp byte [rsi - 2], 0xf
je 0x14001cbdf
sub al, 0xe8
cmp al, 1
ja 0x14001cbc3
cmp rsi, rcx
jae 0x14001cbfa
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x14001cbc9
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14001cbfa
lodsb al, byte [rsi]
jmp 0x14001cbd9
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x1a000]
mov eax, dword [rdi]
or eax, eax
je 0x14001cc57
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x1c000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14001cc07
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14001cc51
mov qword [rbx], rax
add rbx, 8
jmp 0x14001cc27
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x14001cc91
cmp al, 0xef
ja 0x14001cc83
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x14001cc63
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x14001cc72
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.14001cd10], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.14001cd10
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14001cd00
sub rsp, 0xffffffffffffff80
jmp 0x140001125