joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140024900
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x88
mov rax, qword [0x140033040]
xor rax, rsp
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
lea rdx, str.HARDWAREDESCRIPTIONSystemBIOS
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140024a5d
mov edx, 0xa
lea rcx, [rsp + 0x58]
call fcn.140024a80
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
mov r8d, 0x12
lea rdx, str.SystemSerialNumber
lea rcx, [rsp + 0x30]
call fcn.14001f0e0
mov eax, dword [rsp + 0x68]
lea eax, [rax*2 + 2]
lea rcx, [rsp + 0x58]
cmp qword [rsp + 0x70], 7
cmova rcx, qword [rsp + 0x58]
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 7
cmova rdx, qword [rsp + 0x30]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x140024a0c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140024a07
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140024a07
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002598c
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 7
jbe 0x140024a5d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140024a58
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140024a58
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002598c
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140025930
add rsp, 0x88
ret
Function at 0x140024a80
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov eax, 0x1450
call fcn.140026960
sub rsp, rax
mov rax, qword [0x140033040]
xor rax, rsp
mov qword [rsp + 0x1440], rax
mov rsi, rdx
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor ebp, ebp
mov dword [rsp + 0x20], ebp
movaps xmm0, xmmword [str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890]
movaps xmmword [rsp + 0x30], xmm0
movaps xmm1, xmmword [0x14002ca50]
movaps xmmword [rsp + 0x40], xmm1
movaps xmm0, xmmword [0x14002ca60]
movaps xmmword [rsp + 0x50], xmm0
movaps xmm1, xmmword [0x14002ca70]
movaps xmmword [rsp + 0x60], xmm1
movaps xmm0, xmmword [0x14002ca80]
movaps xmmword [rsp + 0x70], xmm0
movaps xmm1, xmmword [0x14002ca90]
movaps xmmword [rsp + 0x80], xmm1
movaps xmm0, xmmword [0x14002caa0]
movaps xmmword [rsp + 0x90], xmm0
movsd xmm0, qword [0x14002cab0]
movsd qword [rsp + 0xa0], xmm0
mov eax, dword [0x14002cab8]
mov dword [rsp + 0xa8], eax
movzx eax, word [0x14002cabc]
mov word [rsp + 0xac], ax
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], rbp
mov qword [rcx + 0x18], 7
mov word [rcx], bp
mov edi, 1
mov dword [rsp + 0x20], edi
cmp rdx, 8
jb 0x140024b6c
call fcn.140024c90
mov qword [rbx + 0x10], rbp
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov ecx, eax
mov dword [rsp + 0x1434], 0xffffffff
mov dword [rsp + 0xb4], eax
nop word [rax + rax]
mov eax, ecx
shr eax, 0x1e
xor eax, ecx
imul ecx, eax, 0x6c078965
add ecx, edi
mov dword [rsp + rdi*4 + 0xb4], ecx
inc rdi
cmp rdi, 0x270
jb 0x140024b90
mov dword [rsp + 0xb0], 0x270
test rsi, rsi
je 0x140024c5a
mov edi, 0x80000000
nop dword [rax + rax]
lea rcx, [rsp + 0xb0]
call fcn.14001fe00
mov ecx, eax
imul rax, rcx, 0x3e
cmp eax, 3
ja 0x140024c08
nop dword [rax + rax]
lea rcx, [rsp + 0xb0]
call fcn.14001fe00
mov ecx, eax
imul rax, rcx, 0x3e
cmp eax, 4
jb 0x140024bf0
shr rax, 0x20
sub rax, rdi
xor rax, 0xffffffff80000000
movzx r9d, word [rsp + rax*2 + 0x30]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x140024c48
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 7
jbe 0x140024c3c
mov rax, qword [rbx]
mov word [rax + rcx*2], r9w
mov word [rax + rcx*2 + 2], bp
jmp 0x140024c50
mov rcx, rbx
call fcn.14001ec30
sub rsi, 1
jne 0x140024bd0
mov rax, rbx
mov rcx, qword [rsp + 0x1440]
xor rcx, rsp
call fcn.140025930
mov rbx, qword [rsp + 0x1480]
add rsp, 0x1450
pop rdi
pop rsi
pop rbp
ret
Function at 0x140025038
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x140025072
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x140025077
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1400250c0
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x14002a770]
cmp byte [rcx + rax], 0
je 0x1400250c0
dec r8
sub rdx, 1
jne 0x1400250a6
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x1400265c0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14002660a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14002660a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14002660a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14002660a
cmp dword [rcx + 0x84], 0xe
jbe 0x14002660a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14002660c
xor al, al
add rsp, 0x28
ret
Function at 0x180011280
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x180001b10]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor eax, eax
mov r9d, 0x5513
lea r8, [0x1800ed9f8]
lea rcx, [rsp + 0x20]
lea edx, [rax + 0xd]
mov dword [rsp + 0x20], 0x5576557a
mov dword [rsp + 0x24], 0x5563556b
mov dword [rsp + 0x28], 0x557c557f
mov dword [rsp + 0x2c], 0x55765561
mov dword [rsp + 0x30], 0x5576553d
mov dword [rsp + 0x34], 0x5576556b
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rax
mov qword [rbp], rax
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rax
call fcn.180057ff0
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1800ad880
add rsp, 0x130
pop rbp
ret

Function at 0x180011ad0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x180001b10]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor eax, eax
lea r8, [0x1800eda88]
lea rcx, [rsp + 0x20]
lea edx, [rax + 8]
mov r9d, 0x5e22
mov dword [rsp + 0x20], 0x5e4c5e57
mov dword [rsp + 0x24], 0x5e4c5e49
mov dword [rsp + 0x28], 0x5e555e4d
mov qword [rsp + 0x2c], 0x5e225e4c
mov qword [rsp + 0x34], rax
mov qword [rsp + 0x3c], rax
mov qword [rsp + 0x44], rax
mov qword [rsp + 0x4c], rax
mov qword [rsp + 0x54], rax
mov qword [rsp + 0x5c], rax
mov qword [rsp + 0x64], rax
mov qword [rsp + 0x6c], rax
mov qword [rsp + 0x74], rax
mov qword [rsp + 0x7c], rax
mov qword [rbp - 0x7c], rax
mov qword [rbp - 0x74], rax
mov qword [rbp - 0x6c], rax
mov qword [rbp - 0x64], rax
mov qword [rbp - 0x5c], rax
mov qword [rbp - 0x54], rax
mov qword [rbp - 0x4c], rax
mov qword [rbp - 0x44], rax
mov qword [rbp - 0x3c], rax
mov qword [rbp - 0x34], rax
mov qword [rbp - 0x2c], rax
mov qword [rbp - 0x24], rax
mov qword [rbp - 0x1c], rax
mov qword [rbp - 0x14], rax
mov qword [rbp - 0xc], rax
mov qword [rbp - 4], rax
mov qword [rbp + 4], rax
mov qword [rbp + 0xc], rax
mov qword [rbp + 0x14], rax
mov dword [rbp + 0x1c], eax
call fcn.180057ff0
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1800ad880
add rsp, 0x130
pop rbp
ret

Function at 0x18001c510
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x18001c544
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x18001c530
mov rcx, rax
shr rcx, 0x20
xor eax, ecx
ret
Function at 0x1800299d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x180001b10]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor eax, eax
mov r9d, 0x243d
lea r8, [0x1800edcc8]
lea rcx, [rsp + 0x20]
lea edx, [rax + 0xd]
mov dword [rsp + 0x20], 0x24582476
mov dword [rsp + 0x24], 0x2453244f
mov dword [rsp + 0x28], 0x24512458
mov dword [rsp + 0x2c], 0x240f240e
mov dword [rsp + 0x30], 0x24592413
mov dword [rsp + 0x34], 0x24512451
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rax
mov qword [rbp], rax
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rax
call fcn.180057ff0
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1800ad880
add rsp, 0x130
pop rbp
ret
Function at 0x180029ad0
Capabilities:
Create thread

Disassembly:
mov rax, rsp
push r14
sub rsp, 0x60
mov qword [rax - 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x180001b10]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r14, rcx
cmp edx, 1
jne 0x180029cf0
xor esi, esi
mov ebx, esi
lea rdi, [0x1800ec670]
mov dword [rsp + 0x30], ebx
cmp ebx, 5
jge 0x180029b37
movsxd rax, ebx
lea rcx, [rax + rax*2]
shl rcx, 5
add rcx, rdi
call fcn.1800585d0
test al, al
jne 0x180029b47
inc ebx
jmp 0x180029b13
call fcn.180058990
test al, al
jne 0x180029b47
xor eax, eax
jmp 0x180029cf5
call fcn.180058990
test al, al
je 0x180029b5a
mov eax, 1
jmp 0x180029cf5
mov qword [0x1800ec5d8], r14
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x1800ec5d0], eax
mov rcx, r14
call fcn.1800298f0
call fcn.180029d20
or rdi, 0xffffffffffffffff
cmp word [rax], 0
jne 0x180029b89
mov r8, rsi
jmp 0x180029b9b
mov r8, rdi
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x180029b90
mov rdx, rax
lea rcx, [0x180004338]
call fcn.1800125e0
mov rcx, r14
call fcn.180059700
nop
lea rcx, [0x1800ec6d0]
call fcn.1800585d0
test al, al
je 0x180029bc8
call fcn.1800480e0
lea rcx, [0x1800ec7f0]
call fcn.1800585d0
test al, al
je 0x180029bdd
call fcn.1800480e0
lea rcx, [0x1800ec790]
call fcn.1800585d0
test al, al
je 0x180029c4b
call fcn.180058280
test al, al
je 0x180029bfd
xor eax, eax
jmp 0x180029cf5
call fcn.1800480e0
mov dword [rsp + 0x44], esi
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
xor r9d, r9d
lea r8, [0x180029320]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, reloc.WS2_32.dll_ntohs
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
jne 0x180029c41
call fcn.180059ae0
jmp 0x180029c41
mov eax, 1
jmp 0x180029cf5
mov dword [rsp + 0x40], esi
xor eax, eax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
xor r9d, r9d
lea r8, [0x180029320]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.180073a80
nop
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x180029c98
mov rsi, qword [rax]
mov edx, reloc.WS2_32.dll_ntohs
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
jne 0x180029caf
call fcn.180059ae0
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
mov rbx, qword [rsp + 0x50]
test rbx, rbx
je 0x180029cf0
mov eax, edi
lock xadd dword [rbx + 8], eax
dec eax
jne 0x180029cf0
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
dec edi
jne 0x180029cf0
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
jmp 0x180029cf0
mov eax, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800ad880
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x1800452a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x180001b10]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor eax, eax
mov r9d, 0x5513
lea r8, [0x1800ee258]
lea rcx, [rsp + 0x20]
lea edx, [rax + 0xb]
mov dword [rsp + 0x20], 0x557b5570
mov dword [rsp + 0x24], 0x557c5561
mov dword [rsp + 0x28], 0x5576557e
mov dword [rsp + 0x2c], 0x5577553d
mov dword [rsp + 0x30], 0x557f557f
mov qword [rsp + 0x34], r9
mov qword [rsp + 0x3c], rax
mov qword [rsp + 0x44], rax
mov qword [rsp + 0x4c], rax
mov qword [rsp + 0x54], rax
mov qword [rsp + 0x5c], rax
mov qword [rsp + 0x64], rax
mov qword [rsp + 0x6c], rax
mov qword [rsp + 0x74], rax
mov qword [rsp + 0x7c], rax
mov qword [rbp - 0x7c], rax
mov qword [rbp - 0x74], rax
mov qword [rbp - 0x6c], rax
mov qword [rbp - 0x64], rax
mov qword [rbp - 0x5c], rax
mov qword [rbp - 0x54], rax
mov qword [rbp - 0x4c], rax
mov qword [rbp - 0x44], rax
mov qword [rbp - 0x3c], rax
mov qword [rbp - 0x34], rax
mov qword [rbp - 0x2c], rax
mov qword [rbp - 0x24], rax
mov qword [rbp - 0x1c], rax
mov qword [rbp - 0x14], rax
mov qword [rbp - 0xc], rax
mov qword [rbp - 4], rax
mov qword [rbp + 4], rax
mov qword [rbp + 0xc], rax
mov qword [rbp + 0x14], rax
mov dword [rbp + 0x1c], eax
call fcn.180057ff0
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1800ad880
add rsp, 0x130
pop rbp
ret

Function at 0x180045750
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x180001b10]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor eax, eax
mov r9d, 0x5e22
lea r8, [0x1800ee320]
lea rcx, [rsp + 0x20]
lea edx, [rax + 0xb]
mov dword [rsp + 0x20], 0x5e4a5e41
mov dword [rsp + 0x24], 0x5e4d5e50
mov dword [rsp + 0x28], 0x5e475e4f
mov dword [rsp + 0x2c], 0x5e465e0c
mov dword [rsp + 0x30], 0x5e4e5e4e
mov qword [rsp + 0x34], r9
mov qword [rsp + 0x3c], rax
mov qword [rsp + 0x44], rax
mov qword [rsp + 0x4c], rax
mov qword [rsp + 0x54], rax
mov qword [rsp + 0x5c], rax
mov qword [rsp + 0x64], rax
mov qword [rsp + 0x6c], rax
mov qword [rsp + 0x74], rax
mov qword [rsp + 0x7c], rax
mov qword [rbp - 0x7c], rax
mov qword [rbp - 0x74], rax
mov qword [rbp - 0x6c], rax
mov qword [rbp - 0x64], rax
mov qword [rbp - 0x5c], rax
mov qword [rbp - 0x54], rax
mov qword [rbp - 0x4c], rax
mov qword [rbp - 0x44], rax
mov qword [rbp - 0x3c], rax
mov qword [rbp - 0x34], rax
mov qword [rbp - 0x2c], rax
mov qword [rbp - 0x24], rax
mov qword [rbp - 0x1c], rax
mov qword [rbp - 0x14], rax
mov qword [rbp - 0xc], rax
mov qword [rbp - 4], rax
mov qword [rbp + 4], rax
mov qword [rbp + 0xc], rax
mov qword [rbp + 0x14], rax
mov dword [rbp + 0x1c], eax
call fcn.180057ff0
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1800ad880
add rsp, 0x130
pop rbp
ret
Function at 0x180047ef0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x180001b10]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor eax, eax
lea r8, [0x1800ee5c8]
lea rcx, [rsp + 0x20]
lea edx, [rax + 0xa]
mov r9d, 0x794f
mov dword [rsp + 0x20], 0x793c7921
mov dword [rsp + 0x24], 0x793d793f
mov dword [rsp + 0x28], 0x7961797b
mov dword [rsp + 0x2c], 0x7923792b
mov qword [rsp + 0x30], 0x794f7923
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rax
mov qword [rbp], rax
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rax
call fcn.180057ff0
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1800ad880
add rsp, 0x130
pop rbp
ret

Function at 0x180048df0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x180001b10]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor eax, eax
mov r9d, 0x4879
lea r8, [0x1800ee678]
lea rcx, [rsp + 0x20]
lea edx, [rax + 0xb]
mov dword [rsp + 0x20], 0x480a482e
mov dword [rsp + 0x24], 0x4826484b
mov dword [rsp + 0x28], 0x484b484a
mov dword [rsp + 0x2c], 0x481d4857
mov dword [rsp + 0x30], 0x48154815
mov qword [rsp + 0x34], r9
mov qword [rsp + 0x3c], rax
mov qword [rsp + 0x44], rax
mov qword [rsp + 0x4c], rax
mov qword [rsp + 0x54], rax
mov qword [rsp + 0x5c], rax
mov qword [rsp + 0x64], rax
mov qword [rsp + 0x6c], rax
mov qword [rsp + 0x74], rax
mov qword [rsp + 0x7c], rax
mov qword [rbp - 0x7c], rax
mov qword [rbp - 0x74], rax
mov qword [rbp - 0x6c], rax
mov qword [rbp - 0x64], rax
mov qword [rbp - 0x5c], rax
mov qword [rbp - 0x54], rax
mov qword [rbp - 0x4c], rax
mov qword [rbp - 0x44], rax
mov qword [rbp - 0x3c], rax
mov qword [rbp - 0x34], rax
mov qword [rbp - 0x2c], rax
mov qword [rbp - 0x24], rax
mov qword [rbp - 0x1c], rax
mov qword [rbp - 0x14], rax
mov qword [rbp - 0xc], rax
mov qword [rbp - 4], rax
mov qword [rbp + 4], rax
mov qword [rbp + 0xc], rax
mov qword [rbp + 0x14], rax
mov dword [rbp + 0x1c], eax
call fcn.180057ff0
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1800ad880
add rsp, 0x130
pop rbp
ret
Function at 0x180058120
Capabilities:
Get system information on windows

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x80
mov qword [r11 - 0x68], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov rax, qword [0x180001b10]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov edi, ecx
xor ebx, ebx
mov dword [rsp + 0x40], ebx
xor eax, eax
mov qword [r11 - 0x44], rax
mov qword [r11 - 0x3c], rax
mov qword [r11 - 0x34], rax
mov qword [r11 - 0x2c], rax
mov qword [r11 - 0x24], rax
mov dword [rsp + 0x6c], eax
lea rcx, [r11 - 0x48]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [rsp + 0x40], bx
jne 0x180058184
xor al, al
jmp 0x180058207
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov r8d, edi
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.180073a80
nop
mov dword [rsp + 0x28], ebx
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x1800581bf
mov rbx, qword [rax]
lea rdx, [rsp + 0x28]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [rsp + 0x28], 0
sete sil
mov rbx, qword [rsp + 0x38]
test rbx, rbx
je 0x180058203
or eax, 0xffffffff
lock xadd dword [rbx + 8], eax
dec eax
jne 0x180058203
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx]
lock dec dword [rbx + 0xc]
jne 0x180058203
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + reloc.WS2_32.dll_htonl]
movzx eax, sil
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1800ad880
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x180058a30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x180001b10]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor eax, eax
mov r9d, 0x243d
lea r8, [0x1800ee850]
lea rcx, [rsp + 0x20]
lea edx, [rax + 0xd]
mov dword [rsp + 0x20], 0x245c244a
mov dword [rsp + 0x24], 0x245c2457
mov dword [rsp + 0x28], 0x24622450
mov dword [rsp + 0x2c], 0x2409240b
mov dword [rsp + 0x30], 0x24582413
mov dword [rsp + 0x34], 0x24582445
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rax
mov qword [rbp], rax
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rax
call fcn.180057ff0
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1800ad880
add rsp, 0x130
pop rbp
ret