joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800067a0
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x140
mov rbx, rcx
lea r9, [rsp]
lea r8, [rcx + 0x26]
mov r10d, 0x10
movzx eax, byte [r8 - 1]
lea r9, [r9 + 4]
movzx edx, byte [r8 - 2]
lea r8, [r8 + 4]
shl edx, 8
or edx, eax
movzx eax, byte [r8 - 4]
shl edx, 8
or edx, eax
movzx eax, byte [r8 - 3]
shl edx, 8
or edx, eax
mov dword [r9 - 4], edx
sub r10, 1
jne 0x1800067d0
lea rdx, [rsp + 0x40]
lea rax, [rsp + 8]
lea r8d, [r10 + 0x40]
nop dword [rax]
nop word [rax + rax]
mov ecx, dword [rax + 0x2c]
lea rdx, [rdx + 4]
xor ecx, dword [rax + 0x18]
xor ecx, dword [rax - 8]
xor ecx, dword [rax]
lea rax, [rax + 4]
rol ecx, 1
mov dword [rdx - 4], ecx
sub r8, 1
jne 0x180006820
mov r12d, dword [rbx]
lea rbp, [rsp]
mov r13d, dword [rbx + 4]
mov r14d, 0x14
mov r9d, dword [rbx + 8]
mov r15d, r14d
mov r11d, dword [rbx + 0xc]
mov edi, r12d
mov esi, dword [rbx + 0x10]
mov r10d, r13d
mov eax, r9d
lea r8d, [rsi + 0x5a827999]
and eax, r10d
lea rbp, [rbp + 4]
mov ecx, r10d
mov edx, edi
rol edx, 5
not ecx
and ecx, r11d
mov esi, r11d
or ecx, eax
mov r11d, r9d
add edx, ecx
mov r9d, r10d
add edx, dword [rbp - 4]
mov r10d, edi
add r8d, edx
ror r9d, 2
mov edi, r8d
sub r15, 1
jne 0x180006863
lea rcx, [rsp + 0x50]
mov rdx, r14
nop dword [rax]
rol r8d, 5
lea rcx, [rcx + 4]
add esi, 0x6ed9eba1
mov eax, r11d
xor eax, r9d
xor eax, r10d
add r8d, eax
add r8d, dword [rcx - 4]
add r8d, esi
mov esi, r11d
mov r11d, r9d
mov r9d, r10d
ror r9d, 2
mov r10d, edi
mov edi, r8d
sub rdx, 1
jne 0x1800068b0
lea rdx, [rsp + 0xa0]
mov rbp, r14
nop word [rax + rax]
mov ecx, r9d
rol r8d, 5
or ecx, r10d
lea rdx, [rdx + 4]
and ecx, r11d
mov eax, r9d
add esi, 0x8f1bbcdc
and eax, r10d
add r8d, esi
or ecx, eax
add ecx, dword [rdx - 4]
mov esi, r11d
mov r11d, r9d
add r8d, ecx
mov r9d, r10d
mov r10d, edi
ror r9d, 2
mov edi, r8d
sub rbp, 1
jne 0x180006900
lea rcx, [rsp + 0xf0]
nop dword [rax]
rol r8d, 5
lea rcx, [rcx + 4]
add r8d, 0xca62c1d6
mov eax, r11d
add r8d, dword [rcx - 4]
xor eax, r9d
xor eax, r10d
add eax, esi
mov esi, r11d
mov r11d, r9d
add r8d, eax
mov r9d, r10d
mov r10d, edi
ror r9d, 2
mov edi, r8d
sub r14, 1
jne 0x180006950
add dword [rbx + 0xc], r11d
lea eax, [r12 + r8]
add dword [rbx + 8], r9d
lea r11, [rsp + 0x140]
add dword [rbx + 0x10], esi
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov dword [rbx], eax
lea eax, [r10 + r13]
mov dword [rbx + 4], eax
mov dword [rbx + 0x20], r14d
mov rbx, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1800072b0
Capabilities:
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
xor ebp, ebp
mov r11d, r8d
mov rdi, rdx
mov rsi, rcx
mov ebx, ebp
mov rax, rdx
test rdx, rdx
je 0x1800074dd
movzx r9d, byte [rdx]
mov r10d, ebp
test r9b, r9b
je 0x1800074dd
lea rax, [rax + 1]
inc r10d
cmp byte [rax], bl
jne 0x1800072f3
test r10d, r10d
je 0x1800074dd
mov rcx, rdi
mov r8d, 0x811c9dc5
lea eax, [r9 - 0x41]
cmp al, 0x19
movsx eax, r9b
ja 0x18000731f
add eax, 0x20
movzx r9d, byte [rcx + 1]
inc rcx
movzx eax, al
xor eax, r8d
imul r8d, eax, 0x1000193
test r9b, r9b
jne 0x180007310
mov eax, 0xba2e8ba3
mul r8d
shr edx, 3
imul eax, edx, 0xb
sub r8d, eax
lea r14, [r8 + r8*2]
add r14, r14
mov rax, qword [rsi + r14*8 + 0x48]
mov rbx, qword [rax + 0x10]
test rbx, rbx
je 0x1800073c1
nop
mov r8, qword [rbx + 0x38]
test r8, r8
je 0x1800073b5
cmp rdi, r8
je 0x1800074dd
mov r9, rdi
sub r9, r8
nop dword [rax + rax]
movzx eax, byte [r9 + r8]
movzx edx, byte [r8]
lea r8, [r8 + 1]
cmp al, dl
je 0x1800073ac
lea ecx, [rax - 0x61]
cmp cl, 0x19
ja 0x18000739b
add al, 0xe0
lea ecx, [rdx - 0x61]
cmp cl, 0x19
ja 0x1800073a6
add dl, 0xe0
cmp al, dl
jb 0x1800073b5
ja 0x1800073b5
test al, al
jne 0x180007380
jmp 0x1800074dd
mov rax, qword [rbx]
mov rbx, qword [rax + 0x10]
test rbx, rbx
jne 0x180007360
test r11d, r11d
je 0x1800074dd
mov rcx, qword [rsi]
xor edx, edx
mov r8d, 0x25c0
lea r9d, [rdx + 1]
call fcn.180002440
mov rbx, rax
test rax, rax
je 0x1800074dd
mov edx, ebp
mov rax, rdi
cmp byte [rdi], dl
je 0x1800073fe
lea rax, [rax + 1]
inc edx
cmp byte [rax], bpl
jne 0x1800073f3
mov rcx, qword [rsi]
lea eax, [rdx + 1]
mov r8d, eax
mov rdx, rdi
mov r9d, eax
call fcn.180002590
mov qword [rbx + 0x38], rax
test rax, rax
je 0x1800074c9
mov qword [rbx], rbp
lea rcx, [rbx + 0x40]
mov qword [rbx + 8], rbp
lea r8, [rbx + 0x18]
mov qword [rbx + 0x10], rbx
lea rax, [rcx + 0x18]
mov qword [r8], rbp
mov edx, 0xc7
mov qword [r8 + 8], rbp
mov qword [r8 + 0x10], rbx
mov qword [rbx + 0x30], rsi
mov qword [rcx], rax
mov qword [rcx + 8], rbp
mov qword [rcx + 0x10], rbp
mov qword [rcx + 0x20], rcx
mov qword [rcx + 0x28], rbp
lea rcx, [rbx + 0x70]
mov qword [rax], rbp
nop dword [rax]
nop dword [rax + rax]
lea rax, [rcx + 0x18]
mov qword [rcx + 8], rbp
mov qword [rcx], rax
mov qword [rcx + 0x10], rbp
mov qword [rcx + 0x20], rcx
mov qword [rcx + 0x28], rbp
add rcx, 0x30
mov qword [rax], rbp
add edx, 0xffffffff
jne 0x180007470
mov rcx, qword [rsi + r14*8 + 0x68]
mov rax, qword [rcx]
mov qword [rax + 8], rbx
mov rax, qword [rcx]
mov qword [rbx], rax
mov qword [rbx + 8], rcx
mov qword [rcx], rbx
mov rcx, qword [rsi + 0x38]
mov rax, qword [rcx]
mov qword [rax + 8], r8
mov rax, qword [rcx]
mov qword [r8], rax
mov qword [r8 + 8], rcx
mov qword [rcx], r8
inc dword [rsi + 8]
jmp 0x1800074dd
mov rcx, qword [rsi]
mov r8d, 1
mov rdx, rbx
call fcn.180002740
mov rbx, rbp
mov rbp, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x180007500
Capabilities:
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
xor r15d, r15d
mov r11d, r8d
mov rdi, rdx
mov rbp, rcx
mov ebx, r15d
mov rax, rdx
test rdx, rdx
je 0x1800076d9
movzx r9d, byte [rdx]
mov r10d, r15d
test r9b, r9b
je 0x1800076d9
lea rax, [rax + 1]
inc r10d
cmp byte [rax], bl
jne 0x180007543
test r10d, r10d
je 0x1800076d9
mov rsi, qword [rcx + 0x30]
mov r8d, 0x811c9dc5
mov rcx, rdi
lea eax, [r9 - 0x41]
cmp al, 0x19
movsx eax, r9b
ja 0x180007573
add eax, 0x20
movzx r9d, byte [rcx + 1]
inc rcx
movzx eax, al
xor eax, r8d
imul r8d, eax, 0x1000193
test r9b, r9b
jne 0x180007564
mov eax, 0x5254e78f
mul r8d
shr edx, 6
imul eax, edx, 0xc7
sub r8d, eax
lea r14, [r8 + r8*2]
add r14, r14
mov rax, qword [rbp + r14*8 + 0x70]
mov rbx, qword [rax + 0x10]
test rbx, rbx
je 0x180007611
mov r8, qword [rbx + 0x38]
test r8, r8
je 0x180007605
cmp rdi, r8
je 0x1800076d9
mov r9, rdi
sub r9, r8
nop
movzx eax, byte [r9 + r8]
movzx edx, byte [r8]
lea r8, [r8 + 1]
cmp al, dl
je 0x1800075fc
lea ecx, [rax - 0x61]
cmp cl, 0x19
ja 0x1800075eb
add al, 0xe0
lea ecx, [rdx - 0x61]
cmp cl, 0x19
ja 0x1800075f6
add dl, 0xe0
cmp al, dl
jb 0x180007605
ja 0x180007605
test al, al
jne 0x1800075d0
jmp 0x1800076d9
mov rax, qword [rbx]
mov rbx, qword [rax + 0x10]
test rbx, rbx
jne 0x1800075b6
test r11d, r11d
je 0x1800076d9
mov rcx, qword [rsi]
xor edx, edx
lea r9d, [rdx + 1]
lea r8d, [rdx + 0x48]
call fcn.180002440
mov rbx, rax
test rax, rax
je 0x1800076d9
mov edx, r15d
mov rax, rdi
cmp byte [rdi], dl
je 0x18000764d
lea rax, [rax + 1]
inc edx
cmp byte [rax], r15b
jne 0x180007642
mov rcx, qword [rsi]
lea eax, [rdx + 1]
mov r8d, eax
mov rdx, rdi
mov r9d, eax
call fcn.180002590
mov qword [rbx + 0x38], rax
test rax, rax
je 0x1800076c5
mov qword [rbx], r15
lea rdx, [rbx + 0x18]
mov qword [rbx + 8], r15
mov qword [rbx + 0x10], rbx
mov qword [rdx], r15
mov qword [rdx + 8], r15
mov qword [rdx + 0x10], rbx
mov qword [rbx + 0x30], rbp
mov qword [rbx + 0x40], r15
mov rcx, qword [rbp + r14*8 + 0x90]
mov rax, qword [rcx]
mov qword [rax + 8], rbx
mov rax, qword [rcx]
mov qword [rbx], rax
mov qword [rbx + 8], rcx
mov qword [rcx], rbx
mov rcx, qword [rbp + 0x60]
mov rax, qword [rcx]
mov qword [rax + 8], rdx
mov rax, qword [rcx]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
mov qword [rcx], rdx
inc dword [rsi + 8]
jmp 0x1800076d9
mov rcx, qword [rsi]
mov r8d, 1
mov rdx, rbx
call fcn.180002740
mov rbx, r15
mov rbp, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x180007c60
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov r15d, dword [r8]
xor edi, edi
mov r12, qword [rsp + 0x90]
mov r14, r9
mov rbp, rdx
mov rsi, rcx
lea eax, [r15 + 1]
mov dword [r8], eax
test r9, r9
je 0x180007cc0
mov r8, qword [rdx + 0x38]
mov r9d, r15d
mov qword [rsp + 0x38], r12
lea edx, [rdi + 1]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
call r14
test eax, eax
je 0x180007dfc
cmp rsi, 0xffffffffffffffff
je 0x180007dfc
lea r9, [rsp + 0x78]
mov qword [rsp + 0x20], rdi
mov r8d, 1
lea rdx, [0x180065084]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180007dfc
cmp dword [rsp + 0x78], 1
jne 0x180007dfc
mov rdx, qword [rbp + 0x38]
mov ebx, edi
mov rax, rdx
test rdx, rdx
je 0x180007d1b
cmp byte [rdx], bl
je 0x180007d1b
nop
lea rax, [rax + 1]
inc ebx
cmp byte [rax], dil
jne 0x180007d10
lea r9, [rsp + 0x78]
mov qword [rsp + 0x20], rdi
mov r8d, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180007dfc
cmp ebx, dword [rsp + 0x78]
jne 0x180007dfc
lea r9, [rsp + 0x78]
mov qword [rsp + 0x20], rdi
mov r8d, 3
lea rdx, [0x180065088]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180007dfc
cmp dword [rsp + 0x78], 3
jne 0x180007dfc
mov rax, qword [rbp + 0x40]
mov dword [rsp + 0x78], edi
mov rbx, qword [rax + 0x10]
test rbx, rbx
je 0x180007dc6
nop word [rax + rax]
mov qword [rsp + 0x30], r12
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], r14
mov r9, rbx
mov r8d, r15d
mov qword [rsp + 0x20], rax
mov rdx, rbp
mov rcx, rsi
call fcn.180007e20
test eax, eax
je 0x180007dd1
mov rax, qword [rbx + 0x18]
mov rbx, qword [rax + 0x10]
test rbx, rbx
jne 0x180007d90
test r14, r14
jne 0x180007dd5
lea edi, [r14 + 1]
jmp 0x180007dfc
xor eax, eax
jmp 0x180007dfe
mov r8, qword [rbp + 0x38]
mov r9d, r15d
mov qword [rsp + 0x38], r12
mov edx, 4
mov qword [rsp + 0x30], rdi
mov rcx, rsi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
call r14
mov edi, eax
mov eax, edi
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x180007e20
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
push r13
sub rsp, 0x48
mov rdi, r9
xor ebx, ebx
mov r9, qword [r9 + 0x40]
mov r13, rdx
mov rsi, rcx
mov rax, r9
test r9, r9
je 0x180007e60
mov r10d, ebx
cmp byte [r9], bl
je 0x180007e60
nop dword [rax]
lea rax, [rax + 1]
inc r10d
cmp byte [rax], bl
jne 0x180007e50
test r10d, r10d
jne 0x180007e7d
mov rax, qword [rdi + 0x30]
mov rcx, qword [rax + 0x30]
test byte [rcx + 0xc], 0x20
je 0x180007e7d
mov eax, 1
add rsp, 0x48
pop r13
pop rdi
pop rsi
pop rbx
ret
mov rcx, qword [rsp + 0x90]
test r9, r9
mov qword [rsp + 0x70], rbp
mov rbp, qword [rsp + 0x98]
mov qword [rsp + 0x78], r12
mov r12, qword [rsp + 0xa0]
mov qword [rsp + 0x80], r14
lea r14, [0x18006508c]
mov qword [rsp + 0x40], r15
cmovne r14, r9
mov r15d, dword [rcx]
lea eax, [r15 + 1]
mov dword [rcx], eax
mov rax, qword [rdi + 0x38]
test rbp, rbp
je 0x180007ef9
mov qword [rsp + 0x38], r12
mov r9d, r8d
mov r8, qword [rdx + 0x38]
mov rcx, rsi
mov qword [rsp + 0x30], r14
mov edx, 2
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rax
call rbp
test eax, eax
je 0x180007ff3
mov rdx, qword [rdi + 0x38]
mov edi, ebx
mov rax, rdx
test rdx, rdx
je 0x180007f1a
cmp byte [rdx], bl
je 0x180007f1a
nop dword [rax + rax]
lea rax, [rax + 1]
inc edi
cmp byte [rax], bl
jne 0x180007f10
cmp rsi, 0xffffffffffffffff
je 0x180007ff3
lea r9, [rsp + 0x88]
mov qword [rsp + 0x20], rbx
mov r8d, edi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180007ff3
cmp edi, dword [rsp + 0x88]
jne 0x180007ff3
lea r9, [rsp + 0x88]
mov qword [rsp + 0x20], rbx
mov r8d, 3
lea rdx, [0x180065090]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180007ff3
cmp dword [rsp + 0x88], 3
jne 0x180007ff3
mov rdx, r14
mov rcx, rsi
call fcn.180008020
test eax, eax
je 0x180007ff3
lea r9, [rsp + 0x88]
mov qword [rsp + 0x20], rbx
mov r8d, 2
lea rdx, [0x180065094]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180007ff3
cmp dword [rsp + 0x88], 2
jne 0x180007ff3
test rbp, rbp
jne 0x180007fcd
lea ebx, [rbp + 1]
jmp 0x180007ff3
mov r8, qword [r13 + 0x38]
mov r9d, r15d
mov qword [rsp + 0x38], r12
mov edx, 4
mov qword [rsp + 0x30], rbx
mov rcx, rsi
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
call rbp
mov ebx, eax
mov r15, qword [rsp + 0x40]
mov eax, ebx
mov r14, qword [rsp + 0x80]
mov r12, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x70]
add rsp, 0x48
pop r13
pop rdi
pop rsi
pop rbx
ret
Function at 0x180008020
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rdi
push r14
push r15
sub rsp, 0x30
xor r15d, r15d
mov rdi, rdx
mov ebp, 1
mov r14, rcx
mov ebx, r15d
mov r8d, ebp
mov r10d, r15d
mov edx, r15d
movzx eax, byte [rdi]
mov r9, rdi
test al, al
je 0x1800081e9
lea r11, [0x180064f00]
nop dword [rax + rax]
movzx eax, al
movzx ecx, byte [rax + r11]
cmp cl, 8
jne 0x180008076
test r8d, r8d
jne 0x18000809b
mov edx, ebp
jmp 0x180008088
cmp cl, 5
je 0x18000809b
cmp cl, bpl
jne 0x180008085
test r8d, r8d
jne 0x18000809b
mov edx, r15d
movzx eax, byte [r9 + 1]
inc r9
inc ebx
mov r8d, r15d
test al, al
jne 0x180008060
jmp 0x18000809e
mov r10d, ebp
test edx, edx
jne 0x1800080ab
test r10d, r10d
je 0x1800081e9
cmp r14, 0xffffffffffffffff
je 0x1800081db
lea r9, [rsp + 0x68]
mov qword [rsp + 0x20], r15
mov r8d, ebp
lea rdx, [0x180065098]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1800081db
cmp dword [rsp + 0x68], ebp
jne 0x1800081db
movzx eax, byte [rdi]
mov rbx, rdi
mov qword [rsp + 0x60], rsi
test al, al
je 0x18000819e
cmp al, 0x22
jne 0x180008156
cmp rdi, rbx
je 0x180008127
mov esi, ebx
mov qword [rsp + 0x20], r15
sub esi, edi
lea r9, [rsp + 0x68]
mov r8d, esi
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x18000818b
cmp esi, dword [rsp + 0x68]
jne 0x18000818b
lea r9, [rsp + 0x70]
mov qword [rsp + 0x20], r15
mov r8d, 2
lea rdx, [0x18006509c]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x18000818b
cmp dword [rsp + 0x70], 2
jne 0x18000818b
lea rdi, [rbx + 1]
movzx eax, byte [rbx + 1]
inc rbx
test al, al
jne 0x1800080f7
cmp rbx, rdi
jbe 0x18000819e
sub ebx, edi
mov qword [rsp + 0x20], r15
mov r8d, ebx
lea r9, [rsp + 0x68]
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x18000818b
cmp ebx, dword [rsp + 0x68]
je 0x18000819e
xor eax, eax
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rbp
pop rbx
ret
lea r9, [rsp + 0x68]
mov qword [rsp + 0x20], r15
mov r8d, ebp
lea rdx, [0x180065098]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1800081c5
cmp dword [rsp + 0x68], ebp
je 0x1800081c8
mov ebp, r15d
mov eax, ebp
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rbp
pop rbx
ret
xor eax, eax
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rbp
pop rbx
ret
cmp r14, 0xffffffffffffffff
je 0x180008212
lea r9, [rsp + 0x68]
mov qword [rsp + 0x20], r15
mov r8d, ebx
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180008212
cmp ebx, dword [rsp + 0x68]
je 0x180008215
mov ebp, r15d
mov eax, ebp
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rbp
pop rbx
ret
Function at 0x180008a30
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x50
xor r15d, r15d
mov r14, r9
mov rsi, r8
mov rax, rdx
mov rbp, rcx
mov edi, r15d
test rcx, rcx
je 0x180008b71
test rdx, rdx
je 0x180008b71
mov qword [rsp + 0x30], r15
lea r8d, [r15 + 1]
mov dword [rsp + 0x28], r15d
xor r9d, r9d
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x40], rax
mov rcx, rax
cmp rax, 0xffffffffffffffff
je 0x180008b71
mov qword [rsp + 0x78], rbx
test rsi, rsi
je 0x180008ad1
mov qword [rsp + 0x38], r14
xor r9d, r9d
mov qword [rsp + 0x30], r15
xor r8d, r8d
mov dword [rsp + 0x28], r15d
xor edx, edx
mov qword [rsp + 0x20], r15
call rsi
test eax, eax
je 0x180008b47
mov rcx, qword [rsp + 0x40]
mov rax, qword [rbp + 0x18]
mov dword [rsp + 0x70], r15d
mov rbx, qword [rax + 0x10]
test rbx, rbx
je 0x180008b1b
nop dword [rax]
nop word [rax + rax]
mov r9, rsi
mov qword [rsp + 0x20], r14
lea r8, [rsp + 0x70]
mov rdx, rbx
call fcn.180007c60
test eax, eax
je 0x180008b47
mov rax, qword [rbx + 0x18]
mov rcx, qword [rsp + 0x40]
mov rbx, qword [rax + 0x10]
test rbx, rbx
jne 0x180008af0
test rsi, rsi
jne 0x180008b25
lea edi, [rsi + 1]
jmp 0x180008b4c
mov qword [rsp + 0x38], r14
xor r9d, r9d
mov qword [rsp + 0x30], r15
xor r8d, r8d
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea edx, [r9 + 5]
call rsi
mov edi, eax
mov rcx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x78]
cmp rcx, 0xffffffffffffffff
je 0x180008b5d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x180008b6d
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x180008b71
mov dword [rbp + 8], r15d
lea r11, [rsp + 0x50]
mov eax, edi
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret

Function at 0x180016050
Capabilities:
Check for software breakpoints

Disassembly:
mov r10, rcx
cmp edx, 4
jb 0x1800160b4
mov r8, qword [rcx + 0x3f8]
mov r9, qword [rcx + 0x400]
cmp r8, r9
jae 0x1800160ad
cmp byte [r8], 0xcc
jne 0x180016098
mov eax, 1
cmp eax, edx
jae 0x180016090
lea rcx, [r8 + 1]
nop
cmp byte [rcx], 0xcc
jne 0x18001608e
inc eax
inc rcx
cmp eax, edx
jb 0x180016080
cmp eax, edx
je 0x18001609d
lea ecx, [rax + 1]
add r8, rcx
inc r8
jmp 0x180016066
mov ecx, edx
mov rax, r8
add rcx, r8
mov qword [r10 + 0x3f8], rcx
ret
mov qword [r10 + 0x3f8], r9
xor eax, eax
ret
Function at 0x1800160c0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov esi, r8d
mov rdi, rdx
mov rbx, r9
mov r14, rcx
xor r15d, r15d
lea r9, [rsp + 0x50]
mov edx, esi
mov rcx, rdi
lea r8d, [r15 + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x18001614a
mov rdx, rdi
mov rcx, r14
call fcn.180003860
mov edx, eax
xor r8d, r8d
mov rcx, rbx
call fcn.1800021a0
test eax, eax
je 0x18001614a
mov r8d, esi
mov rdx, rdi
mov rcx, rbx
call fcn.180001e70
mov r8d, dword [rsp + 0x50]
lea r9, [rsp + 0x50]
mov edx, esi
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
cmove ebx, r15d
mov eax, ebx
jmp 0x18001614d
mov eax, r15d
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x18003f0b0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x590
mov rax, qword [0x18007b5b0]
xor rax, rsp
mov qword [rsp + 0x580], rax
mov rdi, rdx
mov esi, r8d
mov rbx, rcx
lea rdx, [0x180064cd8]
mov rcx, rdi
xor r8d, r8d
call fcn.1800016f0
cmp eax, 0x208
jae 0x18003f27a
lea r8, [rsp + 0x160]
mov qword [rsp + 0x5c8], rbp
lea rdx, [0x180064cd8]
mov rcx, rdi
call fcn.1800016f0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x18003f272
mov ecx, dword [rsp + 0x20]
test cl, 0x10
je 0x18003f1b6
lea rdx, [0x180064cd0]
lea rcx, [rsp + 0x4c]
call fcn.180003fd0
test eax, eax
je 0x18003f253
lea rdx, [0x180064cd4]
lea rcx, [rsp + 0x4c]
call fcn.180003fd0
test eax, eax
je 0x18003f253
xor r8d, r8d
lea rdx, [rsp + 0x4c]
mov rcx, rdi
call fcn.1800016f0
cmp eax, 0x208
jae 0x18003f253
lea r8, [rsp + 0x370]
mov rcx, rdi
lea rdx, [rsp + 0x4c]
call fcn.1800016f0
lea r8d, [rsi + 1]
mov rcx, rbx
lea rdx, [rsp + 0x370]
call fcn.18003f0b0
jmp 0x18003f253
test cl, 0x40
jne 0x18003f253
mov eax, dword [rbx]
cmp eax, 0x3e7
jae 0x18003f269
cmp dword [rsp + 0x3c], 0
jne 0x18003f253
cmp dword [rsp + 0x40], 0
jl 0x18003f253
imul rcx, rax, 0x218
xor r8d, r8d
mov dword [rcx + rbx + 0x38], esi
mov eax, dword [rsp + 0x40]
mov edx, dword [rsp + 0x3c]
shl rdx, 0x20
add rdx, rax
mov eax, dword [rbx]
imul rcx, rax, 0x218
mov qword [rcx + rbx + 0x40], rdx
lea rdx, [rsp + 0x4c]
mov rcx, rdi
call fcn.1800016f0
mov edx, dword [rbx + 0x82be0]
sub eax, edx
cmp eax, 0x208
jae 0x18003f251
mov eax, dword [rbx]
lea r8, [rbx + 0x48]
imul rcx, rax, 0x218
xor eax, eax
add r8, rcx
lea rcx, [rdi - 1]
cmp esi, 1
setne al
add rcx, rax
add rcx, rdx
lea rdx, [rsp + 0x4c]
call fcn.1800016f0
inc dword [rbx]
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x18003f132
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rbp, qword [rsp + 0x5c8]
mov rcx, qword [rsp + 0x580]
xor rcx, rsp
call fcn.180045f10
add rsp, 0x590
pop rdi
pop rsi
pop rbx
ret
Function at 0x140001480
Capabilities:
Create thread
Persist via run registry key
Set registry value

Disassembly:
push rbx
sub rsp, 0x180
mov rax, qword [0x140021010]
xor rax, rsp
mov qword [rsp + 0x170], rax
xor edx, edx
lea rcx, [rsp + 0x60]
mov r8d, 0x104
call fcn.140008ce0
mov r8d, 0x104
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor ebx, ebx
test eax, eax
je 0x1400015a3
xorps xmm0, xmm0
mov qword [rsp + 0x38], rbx
lea r8d, [rbx + 0x2d]
lea rdx, str.SOFTWAREMicrosoftwindowscurrentVersionRun
lea rcx, [rsp + 0x38]
movdqu xmmword [rsp + 0x48], xmm0
call fcn.140001670
cmp qword [rsp + 0x50], 0x10
lea rax, [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x20], rax
cmovae rdx, qword [rsp + 0x38]
lea r9d, [rbx + 2]
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140001559
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x30]
lea r9d, [rbx + 1]
xor r8d, r8d
lea rdx, str.AutoRun
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x1400015a3
mov rcx, qword [rsp + 0x38]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000159e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000159e
call fcn.14000c05c
int3
call fcn.140007254
mov qword [rsp + 0x28], rbx
lea r8, [0x1400021d0]
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x1400015ce
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x28], rbx
lea r8, [0x1400031a0]
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x1400015f9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x64
jmp 0x1400015fe