joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000ae10
Capabilities:
Check if file exists
Delete file
Get file attributes
Terminate process

Disassembly:
sub rsp, 0x68
mov rcx, qword [0x14002d518]
test rcx, rcx
je 0x14000ae4b
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14000ae3e
mov rcx, qword [0x14002d518]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [0x14002d518]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x140031568], 0
je 0x14000af3e
mov qword [rsp + 0x70], rbx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x78], rbp
lea rbp, [0x140025930]
mov qword [rsp + 0x80], rsi
lea rsi, [0x14002d540]
mov qword [rsp + 0x88], rdi
xor edi, edi
mov qword [rsp + 0x60], r14
mov r14d, 0x414
mov word [rsp + 0x40], r14w
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rbp
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ebx, edi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000af1f
test al, 0x10
je 0x14000af1f
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbp
mov word [rsp + 0x40], r14w
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rbp
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
inc ebx
cmp ebx, 0x14
jl 0x14000aec5
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov r14, qword [rsp + 0x60]
add rsp, 0x68
ret
Function at 0x157c00
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
mov eax, 0x14a8
call fcn.00187180
sub rsp, rax
movaps xmmword [rsp + 0x1490], xmm15
movaps xmmword [rsp + 0x1480], xmm14
movaps xmmword [rsp + 0x1470], xmm13
movaps xmmword [rsp + 0x1460], xmm12
movaps xmmword [rsp + 0x1450], xmm11
movaps xmmword [rsp + 0x1440], xmm10
movaps xmmword [rsp + 0x1430], xmm9
movdqa xmmword [rsp + 0x1420], xmm8
movaps xmmword [rsp + 0x1410], xmm7
movaps xmmword [rsp + 0x1400], xmm6
movdqa xmm9, xmmword [0x0018f5e0]
xor eax, eax
movdqa xmm12, xmmword [0x0018f5f0]
pxor xmm2, xmm2
movdqa xmm4, xmmword [0x0018f610]
movdqa xmm6, xmmword [0x0018f630]
movdqa xmm13, xmmword [0x0018f670]
movdqa xmm14, xmmword [0x0018f680]
movdqa xmm15, xmmword [0x0018f690]
movdqa xmm7, xmmword [0x0018f6a0]
movdqa xmm10, xmmword [0x0018f6b0]
movdqa xmm11, xmmword [0x0018f6c0]
nop dword [rax + rax]
Function at 0x160140
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub cl, byte [rdi]
test byte [rsi + rcx*2 + 0x75], dh
jmp 0xf6985c
test byte [rsi + 0xf000002], dh
test dword [rax + 2], esi
add byte [rax], al
add byte [rax - 0x3f7bc3fc], cl
mov rax, qword [rcx + 0x10]
mov edx, dword [rcx + 0x3c]
jmp 0x16020a
mov rdx, qword [rcx + 8]
mov word [r9 + rdx + 8], 0x5b41
mov rdx, qword [rcx + 8]
mov word [r9 + rdx + 0xa], 0x5a41
mov rdx, qword [rcx + 8]
mov word [r9 + rdx + 0xc], 0x5941
mov rdx, qword [rcx + 8]
mov word [r9 + rdx + 0xe], 0x5841
je 0x1602b4
jne 0x1602b4
jmp 0x184eb52
ret
mov qword [rcx + 0x10], rdx
jmp 0x160385
mov rdx, qword [rcx + 8]
mov word [r9 + rdx + 6], 0x5c41
jmp 0x16014e
cmp edx, 0x8664
je 0x1602d1
cmp edx, 0x14c
jne 0x16018b
je 0x16026b
jne 0x16026b
jmp 0x168bbe
jne 0x1602c6
add byte [rax], al
add byte [rax], al
jmp 0x160193
jne 0x160342
je 0x105f8d3d
mov r9, qword [rcx + 0x10]
lea rdx, [r9 + 1]
mov qword [rcx + 0x10], rdx
je 0x160303
jne 0x160303
jmp 0x1602f4
je 0x160285
jne 0x160285
add byte [rax], al
add byte [rax], al
mov rdx, qword [rcx + 8]
mov byte [rdx + r8], 0x58
mov qword [rcx + 0x10], r9
jmp 0x16018b
mov rdx, qword [rcx + 8]
mov byte [r9 + rdx + 0x11], 0x5e
mov rdx, qword [rcx + 8]
je 0x16028c
jne 0x16028c
je 0x2264706
mov byte [rax + rdx + 2], 0x5d
pop rbp
je 0x160342
jmp 0x1601e5
mov byte [rax + rdx + 4], 0x5a
mov rdx, qword [rcx + 8]
lea r8, [rax + 6]
je 0x1602c6
jmp 0x1601d7
mov byte [rax + rdx + 3], 0x5b
mov rdx, qword [rcx + 8]
jmp 0x16024b
mov rdx, qword [rcx + 8]
mov byte [rdx + rax], 0x5f
mov rdx, qword [rcx + 8]
mov byte [rax + rdx + 1], 0x5e
mov rdx, qword [rcx + 8]
je 0x16023c
jne 0x16023c
jmp 0x152972
jmp 0x1601b0
jne 0x1602f4
mov byte [r9 + rdx + 0x12], 0x5d
mov rdx, qword [rcx + 8]
mov byte [r9 + rdx + 0x13], 0x5b
mov rdx, qword [rcx + 8]
mov byte [r9 + rdx + 0x14], 0x5a
mov rdx, qword [rcx + 8]
mov byte [r9 + rdx + 0x15], 0x59
jmp 0x1602dd
je 0x8678e00
mov rdx, qword [rcx + 8]
mov byte [r9 + rdx + 0x10], 0x5f
jmp 0x160228
jne 0x160317
jmp 0x5264790
mov byte [rax + rdx + 5], 0x59
lea r9, [rax + 7]
jmp 0x1602e5
mov r8, qword [rcx + 8]
lea rdx, [rax + 1]
jmp 0x160339
lea r8, [r9 + 0x16]
add r9, 0x17
je 0x160212
jne 0x160212
jmp 0x1602b2
jmp 0x1601a0
je 0x160317
jmp 0x1602c3
mov byte [r8 + r9], 0x8b
mov r8, qword [rcx + 8]
mov r9, qword [rcx + 0x10]
je 0x160383
jne 0x160383
jmp 0x160317
mov qword [rcx + 0x10], rdx
mov byte [r8 + r9], 0xe5
mov r8, qword [rcx + 8]
mov r9, qword [rcx + 0x10]
lea rdx, [r9 + 1]
jmp 0x16035d
lea rdx, [r9 + 1]
jmp 0x1602f9
mov qword [rcx + 0x10], rdx
je 0x16036d
jne 0x16036d
jmp 0x8678e8e
mov rdx, qword [rcx + 8]
je 0x16025f
jne 0x16025f
je 0x151641
inc dword [rax]
add byte [rax], al
add byte [rdi], cl
test byte [rsi - 2], bh
invalid
je 0x1601e1
jne 0x1601e1
add byte [rax], al
add byte [rax], al
mov byte [r8 + rax], 0x48
mov r8, qword [rcx + 8]
je 0x1601ed
jne 0x1601ed
jmp 0xffffffffc659ae72
jmp 0x16032f
mov byte [r8 + r9], 0x5d
mov r8, qword [rcx + 8]
mov r9, qword [rcx + 0x10]
mov word [r8 + r9], 0x5f41
mov rdx, qword [rcx + 8]
mov word [r9 + rdx + 2], 0x5e41
mov rdx, qword [rcx + 8]
mov word [r9 + rdx + 4], 0x5d41
je 0x1602f4
jmp 0x16028a
invalid
Function at 0x16a860
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
jmp 0x16aab8
mov edi, edx
jmp 0x16ab91
je 0x16aabe
jne 0x16aabe
je 0x536c0218
push rsi
push rdi
push rbp
push rbx
jmp 0x16abba
sub rsp, 0xa8
jmp 0x16a9b8

Function at 0x178c50
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov eax, dword [rdx]
mov dword [rcx + 0x10], eax
mov eax, dword [rdx + 4]
mov dword [rcx + 0x14], eax
mov eax, dword [rdx + 8]
mov dword [rcx + 0x18], eax
mov eax, dword [rdx + 0xc]
mov dword [rcx + 0x1c], eax
lea rax, [rdx + 0x10]
cmp r8d, 0x100
cmovne rax, rdx
lea r8, str.expand_32_byte_kexpand_16_byte_k
lea r9, [0x0018fbe0]
cmove r9, r8
mov edx, dword [rax]
mov dword [rcx + 0x20], edx
mov edx, dword [rax + 4]
mov dword [rcx + 0x24], edx
mov edx, dword [rax + 8]
mov dword [rcx + 0x28], edx
mov eax, dword [rax + 0xc]
mov dword [rcx + 0x2c], eax
mov dword [rcx], 0x61707865
mov rax, qword [r9 + 4]
mov qword [rcx + 4], rax
mov eax, dword [r9 + 0xc]
mov dword [rcx + 0xc], eax
ret

Function at 0x178d90
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov qword [rsp + 0x50], rcx
mov eax, dword [rdx]
mov dword [rsp + 0xc], eax
mov eax, dword [rdx + 4]
mov dword [rsp + 0x10], eax
mov eax, dword [rdx + 8]
mov dword [rsp + 0x14], eax
mov r12d, dword [rdx + 0xc]
mov r13d, dword [rdx + 0x10]
mov r14d, dword [rdx + 0x14]
mov r15d, dword [rdx + 0x18]
mov r10d, dword [rdx + 0x1c]
mov edi, dword [rdx + 0x20]
mov r11d, dword [rdx + 0x24]
mov ebx, dword [rdx + 0x28]
mov ebp, dword [rdx + 0x2c]
mov ecx, dword [rdx + 0x30]
mov eax, dword [rdx + 0x34]
mov r9d, dword [rdx + 0x38]
mov r8d, dword [rdx + 0x3c]
mov dword [rsp + 0x4c], 0xfffffff8
mov dword [rsp + 0x48], r8d
mov dword [rsp + 0x44], r9d
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x3c], ecx
mov edx, ecx
mov dword [rsp + 0x38], ebp
mov dword [rsp + 8], ebp
mov dword [rsp + 0x34], ebx
mov dword [rsp], ebx
mov dword [rsp + 0x30], r11d
mov dword [rsp + 0x2c], edi
mov ebp, edi
mov dword [rsp + 0x28], r10d
mov edi, r10d
mov dword [rsp + 0x24], r15d
mov dword [rsp + 0x20], r14d
mov ebx, r14d
mov dword [rsp + 0x1c], r13d
mov dword [rsp + 0x18], r12d
mov r14d, r12d
mov r12d, dword [rsp + 0x14]
mov r10d, dword [rsp + 0x10]
mov ecx, dword [rsp + 0xc]
nop

Function at 0x17ed00
Capabilities:
Hash data using sha512

Disassembly:
test rcx, rcx
je 0x17ed8b
mov qword [rcx + 0x48], 0
mov qword [rcx], 0
movabs rax, 0x6a09e667f3bcc908
mov qword [rcx + 8], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rcx + 0x10], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rcx + 0x18], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rcx + 0x20], rax
movabs rax, 0x510e527fade682d1
mov qword [rcx + 0x28], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rcx + 0x30], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rcx + 0x38], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rcx + 0x40], rax
xor eax, eax
ret
mov eax, 1
ret
Function at 0x17f7b0
Capabilities:
Encrypt data using curve25519

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xc0
mov rsi, rdx
mov rdi, rcx
mov edx, 0x20
mov rcx, r8
mov r8, rsi
call fcn.0017f520
and byte [rsi], 0xf8
mov al, byte [rsi + 0x1f]
and al, 0x3f
or al, 0x40
mov byte [rsi + 0x1f], al
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov rdx, rsi
call fcn.0017c170
mov rcx, rdi
mov rdx, rbx
call fcn.0017c0f0
add rsp, 0xc0
pop rbx
pop rdi
pop rsi
ret
Function at 0x17f810
Capabilities:
Encrypt data using curve25519

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x198
mov qword [rsp + 0x28], rcx
xor eax, eax
nop word [rax + rax]
movzx ecx, byte [r8 + rax]
mov byte [rsp + rax + 0x30], cl
add rax, 1
cmp rax, 0x20
jne 0x17f830
and byte [rsp + 0x30], 0xf8
mov al, byte [rsp + 0x4f]
and al, 0x3f
or al, 0x40
mov byte [rsp + 0x4f], al
lea rbp, [rsp + 0x140]
mov rcx, rbp
call fcn.00179570
lea rbx, [rsp + 0x170]
mov rcx, rbx
call fcn.00179200
lea rsi, [rsp + 0xb0]
mov rcx, rsi
mov rdx, rbp
mov r8, rbx
call fcn.00179220
mov rcx, rbx
mov rdx, rbx
mov r8, rbp
call fcn.0017b4a0
mov rcx, rbx
mov rdx, rbx
call fcn.00179800
mov rcx, rbp
mov rdx, rsi
mov r8, rbx
call fcn.00179fa0
lea rcx, [rsp + 0x80]
call fcn.00179200
lea rdi, [rsp + 0x110]
mov rcx, rdi
call fcn.001791e0
lea rcx, [rsp + 0x50]
mov rdx, rbp
call fcn.00179550
lea r14, [rsp + 0xe0]
mov rcx, r14
call fcn.00179200
mov r13d, 0xfe
xor r15d, r15d
nop word cs:[rax + rax]
nop
mov ebp, r15d
mov eax, r13d
shr rax, 3
movzx r15d, byte [rsp + rax + 0x30]
mov ecx, r13d
and cl, 7
shr r15d, cl
and r15d, 1
xor ebp, r15d
lea rsi, [rsp + 0x80]
mov rcx, rsi
lea r12, [rsp + 0x50]
mov rdx, r12
mov r8d, ebp
call fcn.001793b0
mov rcx, rdi
mov rdx, r14
mov r8d, ebp
call fcn.001793b0
lea rbp, [rsp + 0xb0]
mov rcx, rbp
mov rdx, r12
mov r8, r14
call fcn.0017b4a0
mov rcx, rbx
mov rdx, rsi
mov r8, rdi
call fcn.0017b4a0
mov rcx, rsi
mov rdx, rsi
mov r8, rdi
call fcn.00179220
mov rcx, rdi
mov rdx, r12
mov r8, r14
call fcn.00179220
mov rcx, r14
mov rdx, rbp
mov r8, rsi
call fcn.00179fa0
mov rcx, rdi
mov rdx, rdi
mov r8, rbx
call fcn.00179fa0
mov rcx, rbp
mov rdx, rbx
call fcn.00179a90
mov rcx, rbx
mov rdx, rsi
call fcn.00179a90
mov rcx, r12
mov rdx, r14
mov r8, rdi
call fcn.00179220
mov rcx, rdi
mov rdx, r14
mov r8, rdi
call fcn.0017b4a0
mov rcx, rsi
mov rdx, rbx
mov r8, rbp
call fcn.00179fa0
mov rcx, rbx
mov rdx, rbx
mov r8, rbp
call fcn.0017b4a0
mov rcx, rdi
mov rdx, rdi
call fcn.00179a90
mov rcx, r14
mov rdx, rbx
call fcn.0017aae0
mov rcx, r12
mov rdx, r12
call fcn.00179a90
mov rcx, rbp
mov rdx, rbp
mov r8, r14
call fcn.00179220
mov rcx, r14
lea rdx, [rsp + 0x140]
mov r8, rdi
call fcn.00179fa0
mov rcx, rdi
mov rdx, rbx
mov r8, rbp
call fcn.00179fa0
add r13d, 0xffffffff
cmp r13d, 0xffffffff
jne 0x17f900
lea rsi, [rsp + 0x80]
lea rdx, [rsp + 0x50]
mov rcx, rsi
mov r8d, r15d
call fcn.001793b0
lea rdi, [rsp + 0x110]
lea rdx, [rsp + 0xe0]
mov rcx, rdi
mov r8d, r15d
call fcn.001793b0
mov rcx, rdi
mov rdx, rdi
call fcn.00179800
mov rcx, rsi
mov rdx, rsi
mov r8, rdi
call fcn.00179fa0
mov rcx, qword [rsp + 0x28]
mov rdx, rsi
call fcn.0017a810
add rsp, 0x198
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x647c00
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
mov eax, 0x14a8
call fcn.00677180
sub rsp, rax
movaps xmmword [rsp + 0x1490], xmm15
movaps xmmword [rsp + 0x1480], xmm14
movaps xmmword [rsp + 0x1470], xmm13
movaps xmmword [rsp + 0x1460], xmm12
movaps xmmword [rsp + 0x1450], xmm11
movaps xmmword [rsp + 0x1440], xmm10
movaps xmmword [rsp + 0x1430], xmm9
movdqa xmmword [rsp + 0x1420], xmm8
movaps xmmword [rsp + 0x1410], xmm7
movaps xmmword [rsp + 0x1400], xmm6
movdqa xmm9, xmmword [0x0067f5e0]
xor eax, eax
movdqa xmm12, xmmword [0x0067f5f0]
pxor xmm2, xmm2
movdqa xmm4, xmmword [0x0067f610]
movdqa xmm6, xmmword [0x0067f630]
movdqa xmm13, xmmword [0x0067f670]
movdqa xmm14, xmmword [0x0067f680]
movdqa xmm15, xmmword [0x0067f690]
movdqa xmm7, xmmword [0x0067f6a0]
movdqa xmm10, xmmword [0x0067f6b0]
movdqa xmm11, xmmword [0x0067f6c0]
nop dword [rax + rax]
Function at 0x650140
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub cl, byte [rdi]
test byte [rsi + rcx*2 + 0x75], dh
jmp 0x145985c
test byte [rsi + 0xf000002], dh
test dword [rax + 2], esi
add byte [rax], al
add byte [rax - 0x3f7bc3fc], cl
mov rax, qword [rcx + 0x10]
mov edx, dword [rcx + 0x3c]
jmp 0x65020a
mov rdx, qword [rcx + 8]
mov word [r9 + rdx + 8], 0x5b41
mov rdx, qword [rcx + 8]
mov word [r9 + rdx + 0xa], 0x5a41
mov rdx, qword [rcx + 8]
mov word [r9 + rdx + 0xc], 0x5941
mov rdx, qword [rcx + 8]
mov word [r9 + rdx + 0xe], 0x5841
je 0x6502b4
jne 0x6502b4
jmp 0x1d3eb52
ret
mov qword [rcx + 0x10], rdx
jmp 0x650385
mov rdx, qword [rcx + 8]
mov word [r9 + rdx + 6], 0x5c41
jmp 0x65014e
cmp edx, 0x8664
je 0x6502d1
cmp edx, 0x14c
jne 0x65018b
je 0x65026b
jne 0x65026b
jmp 0x658bbe
jne 0x6502c6
add byte [rax], al
add byte [rax], al
jmp 0x650193
jne 0x650342
je 0x10ae8d3d
mov r9, qword [rcx + 0x10]
lea rdx, [r9 + 1]
mov qword [rcx + 0x10], rdx
je 0x650303
jne 0x650303
jmp 0x6502f4
je 0x650285
jne 0x650285
add byte [rax], al
add byte [rax], al
mov rdx, qword [rcx + 8]
mov byte [rdx + r8], 0x58
mov qword [rcx + 0x10], r9
jmp 0x65018b
mov rdx, qword [rcx + 8]
mov byte [r9 + rdx + 0x11], 0x5e
mov rdx, qword [rcx + 8]
je 0x65028c
jne 0x65028c
je 0x2754706
mov byte [rax + rdx + 2], 0x5d
pop rbp
je 0x650342
jmp 0x6501e5
mov byte [rax + rdx + 4], 0x5a
mov rdx, qword [rcx + 8]
lea r8, [rax + 6]
je 0x6502c6
jmp 0x6501d7
mov byte [rax + rdx + 3], 0x5b
mov rdx, qword [rcx + 8]
jmp 0x65024b
mov rdx, qword [rcx + 8]
mov byte [rdx + rax], 0x5f
mov rdx, qword [rcx + 8]
mov byte [rax + rdx + 1], 0x5e
mov rdx, qword [rcx + 8]
je 0x65023c
jne 0x65023c
jmp 0x642972
jmp 0x6501b0
jne 0x6502f4
mov byte [r9 + rdx + 0x12], 0x5d
mov rdx, qword [rcx + 8]
mov byte [r9 + rdx + 0x13], 0x5b
mov rdx, qword [rcx + 8]
mov byte [r9 + rdx + 0x14], 0x5a
mov rdx, qword [rcx + 8]
mov byte [r9 + rdx + 0x15], 0x59
jmp 0x6502dd
je 0x8b68e00
mov rdx, qword [rcx + 8]
mov byte [r9 + rdx + 0x10], 0x5f
jmp 0x650228
jne 0x650317
jmp 0x5754790
mov byte [rax + rdx + 5], 0x59
lea r9, [rax + 7]
jmp 0x6502e5
mov r8, qword [rcx + 8]
lea rdx, [rax + 1]
jmp 0x650339
lea r8, [r9 + 0x16]
add r9, 0x17
je 0x650212
jne 0x650212
jmp 0x6502b2
jmp 0x6501a0
je 0x650317
jmp 0x6502c3
mov byte [r8 + r9], 0x8b
mov r8, qword [rcx + 8]
mov r9, qword [rcx + 0x10]
je 0x650383
jne 0x650383
jmp 0x650317
mov qword [rcx + 0x10], rdx
mov byte [r8 + r9], 0xe5
mov r8, qword [rcx + 8]
mov r9, qword [rcx + 0x10]
lea rdx, [r9 + 1]
jmp 0x65035d
lea rdx, [r9 + 1]
jmp 0x6502f9
mov qword [rcx + 0x10], rdx
je 0x65036d
jne 0x65036d
jmp 0x8b68e8e
mov rdx, qword [rcx + 8]
je 0x65025f
jne 0x65025f
je 0x641641
inc dword [rax]
add byte [rax], al
add byte [rdi], cl
test byte [rsi - 2], bh
invalid
je 0x6501e1
jne 0x6501e1
add byte [rax], al
add byte [rax], al
mov byte [r8 + rax], 0x48
mov r8, qword [rcx + 8]
je 0x6501ed
jne 0x6501ed
jmp 0xffffffffc6a8ae72
jmp 0x65032f
mov byte [r8 + r9], 0x5d
mov r8, qword [rcx + 8]
mov r9, qword [rcx + 0x10]
mov word [r8 + r9], 0x5f41
mov rdx, qword [rcx + 8]
mov word [r9 + rdx + 2], 0x5e41
mov rdx, qword [rcx + 8]
mov word [r9 + rdx + 4], 0x5d41
je 0x6502f4
jmp 0x65028a
invalid
Function at 0x65a860
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
jmp 0x65aab8
mov edi, edx
jmp 0x65ab91
je 0x65aabe
jne 0x65aabe
je 0x53bb0218
push rsi
push rdi
push rbp
push rbx
jmp 0x65abba
sub rsp, 0xa8
jmp 0x65a9b8

Function at 0x668c50
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov eax, dword [rdx]
mov dword [rcx + 0x10], eax
mov eax, dword [rdx + 4]
mov dword [rcx + 0x14], eax
mov eax, dword [rdx + 8]
mov dword [rcx + 0x18], eax
mov eax, dword [rdx + 0xc]
mov dword [rcx + 0x1c], eax
lea rax, [rdx + 0x10]
cmp r8d, 0x100
cmovne rax, rdx
lea r8, str.expand_32_byte_kexpand_16_byte_k
lea r9, [0x0067fbe0]
cmove r9, r8
mov edx, dword [rax]
mov dword [rcx + 0x20], edx
mov edx, dword [rax + 4]
mov dword [rcx + 0x24], edx
mov edx, dword [rax + 8]
mov dword [rcx + 0x28], edx
mov eax, dword [rax + 0xc]
mov dword [rcx + 0x2c], eax
mov dword [rcx], 0x61707865
mov rax, qword [r9 + 4]
mov qword [rcx + 4], rax
mov eax, dword [r9 + 0xc]
mov dword [rcx + 0xc], eax
ret

Function at 0x668d90
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov qword [rsp + 0x50], rcx
mov eax, dword [rdx]
mov dword [rsp + 0xc], eax
mov eax, dword [rdx + 4]
mov dword [rsp + 0x10], eax
mov eax, dword [rdx + 8]
mov dword [rsp + 0x14], eax
mov r12d, dword [rdx + 0xc]
mov r13d, dword [rdx + 0x10]
mov r14d, dword [rdx + 0x14]
mov r15d, dword [rdx + 0x18]
mov r10d, dword [rdx + 0x1c]
mov edi, dword [rdx + 0x20]
mov r11d, dword [rdx + 0x24]
mov ebx, dword [rdx + 0x28]
mov ebp, dword [rdx + 0x2c]
mov ecx, dword [rdx + 0x30]
mov eax, dword [rdx + 0x34]
mov r9d, dword [rdx + 0x38]
mov r8d, dword [rdx + 0x3c]
mov dword [rsp + 0x4c], 0xfffffff8
mov dword [rsp + 0x48], r8d
mov dword [rsp + 0x44], r9d
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x3c], ecx
mov edx, ecx
mov dword [rsp + 0x38], ebp
mov dword [rsp + 8], ebp
mov dword [rsp + 0x34], ebx
mov dword [rsp], ebx
mov dword [rsp + 0x30], r11d
mov dword [rsp + 0x2c], edi
mov ebp, edi
mov dword [rsp + 0x28], r10d
mov edi, r10d
mov dword [rsp + 0x24], r15d
mov dword [rsp + 0x20], r14d
mov ebx, r14d
mov dword [rsp + 0x1c], r13d
mov dword [rsp + 0x18], r12d
mov r14d, r12d
mov r12d, dword [rsp + 0x14]
mov r10d, dword [rsp + 0x10]
mov ecx, dword [rsp + 0xc]
nop

Function at 0x66ed00
Capabilities:
Hash data using sha512

Disassembly:
test rcx, rcx
je 0x66ed8b
mov qword [rcx + 0x48], 0
mov qword [rcx], 0
movabs rax, 0x6a09e667f3bcc908
mov qword [rcx + 8], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rcx + 0x10], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rcx + 0x18], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rcx + 0x20], rax
movabs rax, 0x510e527fade682d1
mov qword [rcx + 0x28], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rcx + 0x30], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rcx + 0x38], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rcx + 0x40], rax
xor eax, eax
ret
mov eax, 1
ret
Function at 0x66f7b0
Capabilities:
Encrypt data using curve25519

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xc0
mov rsi, rdx
mov rdi, rcx
mov edx, 0x20
mov rcx, r8
mov r8, rsi
call fcn.0066f520
and byte [rsi], 0xf8
mov al, byte [rsi + 0x1f]
and al, 0x3f
or al, 0x40
mov byte [rsi + 0x1f], al
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov rdx, rsi
call fcn.0066c170
mov rcx, rdi
mov rdx, rbx
call fcn.0066c0f0
add rsp, 0xc0
pop rbx
pop rdi
pop rsi
ret
Function at 0x66f810
Capabilities:
Encrypt data using curve25519

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x198
mov qword [rsp + 0x28], rcx
xor eax, eax
nop word [rax + rax]
movzx ecx, byte [r8 + rax]
mov byte [rsp + rax + 0x30], cl
add rax, 1
cmp rax, 0x20
jne 0x66f830
and byte [rsp + 0x30], 0xf8
mov al, byte [rsp + 0x4f]
and al, 0x3f
or al, 0x40
mov byte [rsp + 0x4f], al
lea rbp, [rsp + 0x140]
mov rcx, rbp
call fcn.00669570
lea rbx, [rsp + 0x170]
mov rcx, rbx
call fcn.00669200
lea rsi, [rsp + 0xb0]
mov rcx, rsi
mov rdx, rbp
mov r8, rbx
call fcn.00669220
mov rcx, rbx
mov rdx, rbx
mov r8, rbp
call fcn.0066b4a0
mov rcx, rbx
mov rdx, rbx
call fcn.00669800
mov rcx, rbp
mov rdx, rsi
mov r8, rbx
call fcn.00669fa0
lea rcx, [rsp + 0x80]
call fcn.00669200
lea rdi, [rsp + 0x110]
mov rcx, rdi
call fcn.006691e0
lea rcx, [rsp + 0x50]
mov rdx, rbp
call fcn.00669550
lea r14, [rsp + 0xe0]
mov rcx, r14
call fcn.00669200
mov r13d, 0xfe
xor r15d, r15d
nop word cs:[rax + rax]
nop
mov ebp, r15d
mov eax, r13d
shr rax, 3
movzx r15d, byte [rsp + rax + 0x30]
mov ecx, r13d
and cl, 7
shr r15d, cl
and r15d, 1
xor ebp, r15d
lea rsi, [rsp + 0x80]
mov rcx, rsi
lea r12, [rsp + 0x50]
mov rdx, r12
mov r8d, ebp
call fcn.006693b0
mov rcx, rdi
mov rdx, r14
mov r8d, ebp
call fcn.006693b0
lea rbp, [rsp + 0xb0]
mov rcx, rbp
mov rdx, r12
mov r8, r14
call fcn.0066b4a0
mov rcx, rbx
mov rdx, rsi
mov r8, rdi
call fcn.0066b4a0
mov rcx, rsi
mov rdx, rsi
mov r8, rdi
call fcn.00669220
mov rcx, rdi
mov rdx, r12
mov r8, r14
call fcn.00669220
mov rcx, r14
mov rdx, rbp
mov r8, rsi
call fcn.00669fa0
mov rcx, rdi
mov rdx, rdi
mov r8, rbx
call fcn.00669fa0
mov rcx, rbp
mov rdx, rbx
call fcn.00669a90
mov rcx, rbx
mov rdx, rsi
call fcn.00669a90
mov rcx, r12
mov rdx, r14
mov r8, rdi
call fcn.00669220
mov rcx, rdi
mov rdx, r14
mov r8, rdi
call fcn.0066b4a0
mov rcx, rsi
mov rdx, rbx
mov r8, rbp
call fcn.00669fa0
mov rcx, rbx
mov rdx, rbx
mov r8, rbp
call fcn.0066b4a0
mov rcx, rdi
mov rdx, rdi
call fcn.00669a90
mov rcx, r14
mov rdx, rbx
call fcn.0066aae0
mov rcx, r12
mov rdx, r12
call fcn.00669a90
mov rcx, rbp
mov rdx, rbp
mov r8, r14
call fcn.00669220
mov rcx, r14
lea rdx, [rsp + 0x140]
mov r8, rdi
call fcn.00669fa0
mov rcx, rdi
mov rdx, rbx
mov r8, rbp
call fcn.00669fa0
add r13d, 0xffffffff
cmp r13d, 0xffffffff
jne 0x66f900
lea rsi, [rsp + 0x80]
lea rdx, [rsp + 0x50]
mov rcx, rsi
mov r8d, r15d
call fcn.006693b0
lea rdi, [rsp + 0x110]
lea rdx, [rsp + 0xe0]
mov rcx, rdi
mov r8d, r15d
call fcn.006693b0
mov rcx, rdi
mov rdx, rdi
call fcn.00669800
mov rcx, rsi
mov rdx, rsi
mov r8, rdi
call fcn.00669fa0
mov rcx, qword [rsp + 0x28]
mov rdx, rsi
call fcn.0066a810
add rsp, 0x198
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140011069
Capabilities:
Get system information on windows

Disassembly:
jmp 0x1400126e0
push rbp
push rdi
sub rsp, 0x1e8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x42
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x1b8], rax
lea rcx, [0x1400250fb]
call fcn.140011447
nop
lea rax, str.VMware
mov qword [rbp + 8], rax
lea rax, str.VirtualBox
mov qword [rbp + 0x10], rax
lea rax, str.QEMU
mov qword [rbp + 0x18], rax
lea rcx, [rbp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
nop
lea rax, [rbp + 8]
mov qword [rbp + 0x88], rax
mov rax, qword [rbp + 0x88]
mov qword [rbp + 0xa8], rax
mov rax, qword [rbp + 0x88]
add rax, 0x18
mov qword [rbp + 0xc8], rax
jmp 0x140012789
mov rax, qword [rbp + 0xa8]
add rax, 8
mov qword [rbp + 0xa8], rax
mov rax, qword [rbp + 0xc8]
cmp qword [rbp + 0xa8], rax
je 0x1400127c5
mov rax, qword [rbp + 0xa8]
mov rax, qword [rax]
mov qword [rbp + 0xe8], rax
mov rdx, qword [rbp + 0xe8]
mov rcx, qword [rbp + 0x48]
call fcn.140011456
test rax, rax
je 0x1400127c3
mov al, 1
jmp 0x1400127c7
jmp 0x140012777
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14001bcd0]
call fcn.1400113c0
mov rax, rdi
mov rcx, qword [rbp + 0x1b8]
xor rcx, rbp
call fcn.140011221
lea rsp, [rbp + 0x1c8]
pop rdi
pop rbp
ret