joyce8/EMBER2024-capa huggingface dataset:
Function at 0x29759cd40
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
movd xmm0, dword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movdqu xmm1, xmmword [rsi]
movdqu xmm2, xmmword [rsi + 0x10]
movdqu xmm3, xmmword [rsi + 0x20]
movdqu xmm4, xmmword [rsi + 0x30]
pxor xmm1, xmm0
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jb 0x29759ce15
movdqa xmm0, xmmword [0x297647570]
movdqa xmm5, xmm1
movdqa xmm6, xmm2
movdqa xmm7, xmm3
movdqa xmm8, xmm4
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm2, xmm0, 0
pclmulqdq xmm3, xmm0, 0
pclmulqdq xmm4, xmm0, 0
movdqu xmm11, xmmword [rsi]
movdqu xmm12, xmmword [rsi + 0x10]
movdqu xmm13, xmmword [rsi + 0x20]
movdqu xmm14, xmmword [rsi + 0x30]
pclmulqdq xmm5, xmm0, 0x11
pclmulqdq xmm6, xmm0, 0x11
pclmulqdq xmm7, xmm0, 0x11
pclmulqdq xmm8, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm2, xmm6
pxor xmm3, xmm7
pxor xmm4, xmm8
pxor xmm1, xmm11
pxor xmm2, xmm12
pxor xmm3, xmm13
pxor xmm4, xmm14
add rdi, 0x40
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jge 0x29759cd81
movdqa xmm0, xmmword [0x297647580]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm2
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm3
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm4
cmp rcx, 0x10
jb 0x29759ce97
movdqu xmm10, xmmword [rsi]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm10
sub rcx, 0x10
add rsi, 0x10
cmp rcx, 0x10
jge 0x29759ce6b
pcmpeqb xmm3, xmm3
pclmulqdq xmm0, xmm1, 1
psrldq xmm1, 8
pxor xmm1, xmm0
movdqa xmm2, xmm1
movq xmm0, qword [0x2976473e8]
psrlq xmm3, 0x20
psrldq xmm2, 4
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
movdqa xmm0, xmmword [0x297647590]
movdqa xmm2, xmm1
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0x10
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
pextrd eax, xmm1, 1
mov dword [rsp + 0x28], eax
ret
Function at 0x29759dea0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x29759e0db
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
nop
call fcn.29759da00
xorps xmm15, xmm15
mov r14, qword [0x2977618b8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
add qword [rcx + 0x68], rax
mov rdx, qword [rcx + 0x60]
test rdx, rdx
jle 0x29759dfea
nop dword [rax]
cmp rdx, 0x40
ja 0x29759e0cd
lea rsi, [rdx - 0x40]
mov rdi, rsi
neg rsi
sar rdi, 0x3f
and rdi, rdx
lea rdx, [rcx + rdi]
lea rdx, [rdx + 0x20]
cmp rax, rsi
cmovl rsi, rax
mov qword [rsp + 0x28], rsi
mov rbx, qword [rsp + 0x60]
cmp rbx, rdx
je 0x29759df59
mov rax, rdx
mov rcx, rsi
nop
call fcn.2975525a0
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdx, qword [rcx + 0x60]
add rdx, rsi
mov qword [rcx + 0x60], rdx
cmp rdx, 0x40
jne 0x29759dfc1
mov qword [rsp], rcx
lea rax, [rcx + 0x20]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.29759e520
xorps xmm15, xmm15
mov r14, qword [0x2977618b8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x60], 0
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
cmp rax, rsi
jb 0x29759e0c2
mov rdi, qword [rsp + 0x70]
sub rdi, rsi
mov rdx, rdi
neg rdx
sar rdx, 0x3f
and rdx, rsi
mov r8, rax
sub r8, rsi
add rbx, rdx
jmp 0x29759dff7
mov r8, rax
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
cmp r8, 0x40
jl 0x29759e075
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x40], rbx
mov qword [rsp], rcx
mov qword [rsp + 8], rbx
and r8, 0xffffffffffffffc0
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x10], r8
mov qword [rsp + 0x18], rdi
call fcn.29759e520
xorps xmm15, xmm15
mov r14, qword [0x2977618b8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov r8, qword [rsp + 0x30]
and rax, r8
and rax, 0xffffffffffffffc0
mov rcx, qword [rsp + 0x40]
lea rbx, [rcx + rax]
sub r8, rdx
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
test r8, r8
je 0x29759e0b8
lea rdx, [rcx + 0x20]
cmp r8, 0x40
mov esi, 0x40
cmovl rsi, r8
cmp rbx, rdx
je 0x29759e0b4
mov qword [rsp + 0x38], rsi
mov rax, rdx
mov rcx, rsi
nop dword [rax + rax]
call fcn.2975525a0
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x38]
mov qword [rcx + 0x60], rsi
xor ebx, ebx
xor ecx, ecx
add rsp, 0x48
pop rbp
ret
mov rcx, rax
mov rax, rsi
call fcn.297551cc0
mov rax, rdx
mov ecx, 0x40
call fcn.297551cc0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.29754f960
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.29759dea0
Function at 0x2975adf80
Capabilities:
Execute syscall

Disassembly:
xor rax, rax
mov ax, word [rsp + 8]
push rcx
mov rcx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x18]
mov rdi, qword gs:[0x30]
mov dword [rdi + 0x68], 0
sub rsp, 0x80
cmp ecx, 4
jle 0x2975adfc0
cmp ecx, 0x10
jle 0x2975adfb6
int 3
mov rdi, rsp
cld
rep movsq qword [rdi], qword [rsi]
mov rsi, rsp
sub rsp, 8
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
mov r9, qword [rsi + 0x18]
movq xmm0, rcx
movq xmm1, rdx
movq xmm2, r8
movq xmm3, r9
mov r10, rcx
syscall
add rsp, 0x88
pop rcx
mov dword [rsp + 0x28], eax
ret
Function at 0x2975b01a0
Capabilities:
Hash data using fnv

Disassembly:
test byte [rax], al
mov rcx, rbx
and ebx, 0x7f
shl rbx, 5
lea rdx, [rax + rbx]
xor eax, eax
jmp 0x2975b01b7
inc rax
cmp rax, 4
jge 0x2975b01cf
lea rbx, [rdx + rax*8]
mov rbx, qword [rbx]
cmp rbx, rcx
jne 0x2975b01b4
mov eax, 1
ret
xor eax, eax
movabs rbx, 0xcbf29ce484222325
jmp 0x2975b01e0
inc rax
cmp rax, 4
jge 0x2975b01ee
mov rsi, qword [rdx + rax*8]
xor edi, edi
jmp 0x2975b0217
and ebx, 3
lea rdx, [rdx + rbx*8]
xchg qword [rdx], rcx
xor eax, eax
ret
movzx r8d, sil
xor rbx, r8
inc rdi
shr rsi, 8
movabs r8, 0x100000001b3
imul rbx, r8
cmp rdi, 8
jl 0x2975b01fb
jmp 0x2975b01dd
Function at 0x2975ba260
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x20]
cmp r12, qword [r14 + 0x10]
jbe 0x2975ba4f9
push rbp
mov rbp, rsp
sub rsp, 0x98
mov qword [rsp + 0xb0], rbx
mov qword [rsp + 0xa8], rax
nop
lea rax, [0x2975fa060]
call fcn.2974fcd60
mov qword [rsp + 0x70], rax
mov qword [rax + 8], 9
lea rcx, [0x2976078c5]
mov qword [rax], rcx
mov byte [rax + 0x10], 1
nop
lea rax, [0x2975fa060]
call fcn.2974fcd60
mov qword [rsp + 0x68], rax
mov qword [rax + 8], 8
lea rcx, [0x297607645]
mov qword [rax], rcx
mov byte [rax + 0x10], 1
nop
lea rax, [0x2975fa120]
call fcn.2974fcd60
cmp dword [0x297761930], 0
jne 0x2975ba2f7
mov rcx, qword [rsp + 0x70]
jmp 0x2975ba304
call fcn.297551880
mov rcx, qword [rsp + 0x70]
mov qword [r11], rcx
mov qword [rsp + 0x60], rax
mov qword [rax + 0x18], rcx
mov qword [rax + 8], 0xd
lea rcx, [0x297608725]
mov qword [rax], rcx
nop
lea rax, [0x2975fa120]
call fcn.2974fcd60
cmp dword [0x297761930], 0
jne 0x2975ba340
mov rcx, qword [rsp + 0x68]
jmp 0x2975ba34d
call fcn.297551880
mov rcx, qword [rsp + 0x68]
mov qword [r11], rcx
mov qword [rsp + 0x58], rax
mov qword [rax + 0x18], rcx
mov qword [rax + 8], 0xc
lea rcx, [0x29760828d]
mov qword [rax], rcx
mov qword [rsp + 0x50], 0
mov rcx, qword [rsp + 0xb0]
mov qword [rsp + 0x40], rcx
lea rax, [0x2975e76e0]
call fcn.2974fcd60
mov rcx, qword [rsp + 0xb0]
mov qword [rax + 8], rcx
mov qword [rax + 0x10], 0x3000
mov qword [rax + 0x18], 0x40
mov rbx, rax
mov edi, 4
mov rax, qword [rsp + 0x58]
mov rcx, rdi
call fcn.2975b3600
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0xb0]
test rcx, rcx
jbe 0x2975ba4ee
mov rcx, qword [rsp + 0xa8]
mov qword [rsp + 0x90], rcx
lea rax, [0x2975e7680]
call fcn.2974fcd60
mov rcx, qword [rsp + 0x48]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x90]
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0xb0]
mov qword [rax + 0x10], rcx
mov rbx, rax
mov ecx, 3
mov rdi, rcx
mov rax, qword [rsp + 0x60]
nop dword [rax]
call fcn.2975b3600
movzx ecx, word [0x297761682]
mov word [rsp + 0x3e], cx
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x88], rdx
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x80], rdx
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x78], rdx
lea rax, [0x2975e7740]
nop dword [rax]
call fcn.2974fcd60
mov qword [rax], 0xffffffffffffffff
mov rcx, qword [rsp + 0x88]
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0x80]
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], 0x20
mov rcx, qword [rsp + 0x78]
mov qword [rax + 0x20], rcx
movzx ecx, word [rsp + 0x3e]
mov word [rsp], cx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 5
mov qword [rsp + 0x18], 5
call fcn.2975adf80
xorps xmm15, xmm15
mov r14, qword [0x2977618b8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x48]
xor ebx, ebx
mov rcx, rbx
mov rdi, rcx
mov rsi, rcx
nop dword [rax]
call fcn.29754e420
add rsp, 0x98
pop rbp
ret
xor eax, eax
mov rcx, rax
call fcn.297551c00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.29754f960
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
nop dword [rax]
jmp fcn.2975ba260
Function at 0x2975c08e0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.2975c1760
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.2975c1760
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]

Function at 0x2975c0950
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x2977661e4]
mov rbx, rcx
test esi, esi
jle 0x2975c0a80
mov rax, qword [0x2977661e8]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x2975c099b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x2975c0a25
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x2975c0980
mov rcx, rbx
call fcn.2975c11b0
mov rdi, rax
test rax, rax
je 0x2975c0aa2
mov rax, qword [0x2977661e8]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.2975c12f0
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x2977661e8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x2975c0a87
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x2975c0a1e
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x2975c0a30
add dword [0x2977661e4], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x2977661e8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x2975c0a1e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.2975c08e0
nop dword [rax]
xor esi, esi
jmp 0x2975c09a8
mov rax, qword [0x2977661e8]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.2975c08e0
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.2975c08e0
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x2975c0e20
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x297766220]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x297766200]
test rbx, rbx
je 0x2975c0e7c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x2975c0e73
test rsi, rsi
je 0x2975c0e73
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x2975c0e58
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x2975c11b0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x2977062d0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x2975c11d0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x2975c11d8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x2975c11d0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x2975c122d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x2975c1224
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x2975c11d0
add rax, 0x28
cmp rax, r9
jne 0x2975c1210
xor eax, eax
ret

Function at 0x2975c1230
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x2977062d0]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x2975c124f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x2975c1258
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x2975c124f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x2975c12f0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x2977062d0]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x2975c130f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x2975c1318
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x140002c30
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140041008]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x70], rsi
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x58], r14
mov r14, rdx
lea rdx, str.arg.txt
mov qword [rsp + 0x50], r15
mov r15, r8
call fcn.140002520
cmp qword [rsp + 0x38], 0x10
lea rcx, [rsp + 0x20]
lea rdx, [0x1400389e0]
cmovae rcx, qword [rsp + 0x20]
call fcn.14001a21c
mov rsi, rax
test rax, rax
je 0x140002d01
xor edx, edx
mov qword [rsp + 0x88], rdi
mov rcx, rax
lea r8d, [rdx + 2]
call fcn.14001a49c
mov rcx, rsi
call fcn.14001a980
mov edi, eax
lea ecx, [rdi + 1]
mov ebx, ecx
call fcn.14001a008
mov r8d, ebx
mov qword [r14], rax
xor edx, edx
mov rcx, rax
call fcn.140012ac0
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call fcn.14001a49c
mov rcx, qword [r14]
mov r8d, edi
mov r9, rsi
mov edx, 1
call fcn.14001ac08
mov rcx, rsi
mov dword [r15], eax
call fcn.14001ad54
mov rdi, qword [rsp + 0x88]
mov bl, 1
jmp 0x140002d03
xor bl, bl
mov rax, qword [rsp + 0x38]
mov r15, qword [rsp + 0x50]
mov r14, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x70]
cmp rax, 0x10
jb 0x140002d58
mov rcx, qword [rsp + 0x20]
inc rax
cmp rax, 0xffffffffffffffff
ja 0x140002d6e
cmp rax, 0x1000
jb 0x140002d53
test cl, 0x1f
jne 0x140002d74
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x140002d7a
sub rcx, rax
cmp rcx, 8
jb 0x140002d80
cmp rcx, 0x27
ja 0x140002d86
mov rcx, rax
call fcn.14000f220
movzx eax, bl
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14000f1c0
add rsp, 0x60
pop rbx
ret
call fcn.140019f90
int3
call fcn.140019f90
int3
call fcn.140019f90
int3
call fcn.140019f90
int3
call fcn.140019f90
int3
Function at 0x1400032b0
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x80
mov rax, qword [0x140041008]
xor rax, rsp
mov qword [rsp + 0x70], rax
xor edi, edi
mov rsi, rcx
mov ebx, edi
mov qword [rsp + 0x48], rdi
mov ebp, edi
mov dword [rsp + 0x40], ebx
cmp dword [rcx + 0xa4], ebx
jne 0x14000330f
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x48]
call fcn.140002880
mov rbp, qword [rsp + 0x48]
movzx r14d, al
mov ebx, dword [rsp + 0x40]
jmp 0x1400033ec
mov rdx, rcx
lea rcx, [rsp + 0x50]
call fcn.140002520
cmp qword [rsp + 0x68], 0x10
lea rcx, [rsp + 0x50]
lea rdx, [0x1400389dc]
cmovae rcx, qword [rsp + 0x50]
call fcn.14001a21c
mov r14, rax
test rax, rax
je 0x140003391
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 2]
call fcn.14001a49c
mov rcx, r14
call fcn.14001a980
mov ecx, eax
mov ebx, eax
call fcn.14001a008
xor r8d, r8d
xor edx, edx
mov rcx, r14
mov rbp, rax
call fcn.14001a49c
mov r9, r14
mov r8d, ebx
mov edx, 1
mov rcx, rbp
call fcn.14001ac08
mov rcx, r14
mov rbx, rax
call fcn.14001ad54
mov r14b, 1
mov rcx, qword [rsp + 0x68]
cmp rcx, 0x10
jb 0x1400033ec
lea rax, [rcx + 1]
mov rcx, qword [rsp + 0x50]
cmp rax, 0xffffffffffffffff
ja 0x1400034e4
cmp rax, 0x1000
jb 0x1400033e7
test cl, 0x1f
jne 0x1400034ea
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x1400034f0
sub rcx, rax
cmp rcx, 8
jb 0x1400034f6
cmp rcx, 0x27
ja 0x1400034fc
mov rcx, rax
call fcn.14000f220
mov rdx, rsi
test r14b, r14b
jne 0x140003405
lea rcx, str.Get_File__s__Fail__n
call fcn.140003240
jmp 0x1400034bf
lea rcx, str.Get_File__s__Success__n
call fcn.140003240
lea rax, [rsi + 0x80]
test rax, rax
je 0x140003460
mov r10d, dword [rsi + 0xa0]
test r10d, r10d
jle 0x140003460
movsxd r9, ebx
test ebx, ebx
jle 0x140003454
mov r8, rbp
mov eax, edi
lea r8, [r8 + 1]
cdq
inc edi
idiv r10d
movsxd rax, edx
movzx ecx, byte [rax + rsi + 0x80]
xor byte [r8 - 1], cl
sub r9, 1
jne 0x140003433
lea rcx, str.Deencrypt_Success._n
call fcn.140003240
movsxd rdx, ebx
mov rcx, rbp
call fcn.140004b80
mov rbx, rax
test rax, rax
jne 0x140003481
lea rcx, str.Load_error._n
call fcn.140003240
jmp 0x1400034bf
cmp dword [rax + 0x20], 0
jne 0x1400034ae
mov rax, qword [rax + 0x60]
test rax, rax
je 0x1400034ae
cmp dword [rbx + 0x24], 0
je 0x1400034ae
call rax
test eax, eax
js 0x1400034b1
mov rcx, rbx
call fcn.140004fa0
mov rcx, rbp
call fcn.140019d5c
jmp 0x1400034bf
or eax, 0xffffffff
mov edx, eax
lea rcx, str.No_entry_point:__d_n
call fcn.140003240
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14000f1c0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.140019f90
int3
call fcn.140019f90
int3
call fcn.140019f90
int3
call fcn.140019f90
int3
call fcn.140019f90
int3
Function at 0x14000a010
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call sym.Zeus_x64.exe_private:_bool___cdecl_Http::HttpClient::sendHeader_void____ptr64
test al, al
je 0x14000a052
mov rax, qword [rbx + 0x10]
mov rcx, rbx
cmp byte [rax + 0xf0], 0
je 0x14000a03c
add rsp, 0x20
pop rbx
jmp sym.Zeus_x64.exe_private:_bool___cdecl_Http::HttpClient::doMultipartPost_void____ptr64
call sym.Zeus_x64.exe_private:_bool___cdecl_Http::HttpClient::sendBody_void____ptr64
test al, al
je 0x14000a052
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp sym.Zeus_x64.exe_private:_bool___cdecl_Http::HttpClient::getResponse_void____ptr64
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x14000a060
Capabilities:
Send data
Send data on socket

Disassembly:
mov r11, rsp
push r14
sub rsp, 0x50
mov qword [r11 - 0x38], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
mov rax, qword [0x140041008]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r14, rcx
mov qword [r11 - 0x18], 0xf
mov qword [r11 - 0x20], 0
mov byte [rsp + 0x28], 0
lea rdx, [r11 - 0x30]
mov rcx, qword [rcx + 0x10]
call sym.Zeus_x64.exe_private:_int___cdecl_Http::HttpRequest::generateHeader_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______ptr64____ptr64
mov ebx, eax
lea rdi, [rsp + 0x28]
mov rcx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x40]
cmp rax, 0x10
cmovae rdi, rcx
mov rsi, qword [r14]
test ebx, ebx
je 0x14000a105
cmp byte [rsi + 0x50], 0
je 0x14000a0f9
movsxd rcx, dword [rsi + 0x4c]
xor r9d, r9d
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jle 0x14000a0f9
sub ebx, eax
cdqe
add rdi, rax
test ebx, ebx
jne 0x14000a0d1
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
test ebx, ebx
sete dil
test dil, dil
jne 0x14000a160
mov dword [r14 + 8], 3
mov rbx, qword [r14]
cmp byte [rbx + 0x50], dil
jne 0x14000a127
mov eax, dword [rbx + 0x4c]
cmp eax, 0xffffffff
je 0x14000a131
movsxd rcx, dword [rbx + 0x4c]
call qword [sym.imp.WS2_32.dll_closesocket]
mov byte [rbx + 0x50], 0
xor r8d, r8d
lea rdx, [0x14003899f]
lea rcx, [rbx + 0x28]
call fcn.140001f90
mov dword [rbx + 0x48], 0
mov dword [rbx + 0x4c], 0xffffffff
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
cmp rax, 0x10
jb 0x14000a1bc
inc rax
cmp rax, 0xffffffffffffffff
jbe 0x14000a175
call fcn.140019f90
int3
cmp rax, 0x1000
jb 0x14000a1b7
test byte [rsp + 0x28], 0x1f
je 0x14000a18a
call fcn.140019f90
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x14000a199
call fcn.140019f90
int3
sub rcx, rax
cmp rcx, 8
jae 0x14000a1a8
call fcn.140019f90
int3
cmp rcx, 0x27
jbe 0x14000a1b4
call fcn.140019f90
int3
mov rcx, rax
call fcn.14000f220
movzx eax, dil
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14000f1c0
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret
Function at 0x14000a1f0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rbx, qword [rcx + 0x10]
mov r14, rcx
add rbx, 0xd0
mov rdi, qword [rbx + 0x10]
test rdi, rdi
jne 0x14000a22a
mov al, 1
mov rbx, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
cmp qword [rbx + 0x18], 0x10
mov qword [rsp + 0x30], rsi
jb 0x14000a239
mov rbx, qword [rbx]
mov rsi, qword [rcx]
test edi, edi
je 0x14000a26a
cmp byte [rsi + 0x50], 0
je 0x14000a268
movsxd rcx, dword [rsi + 0x4c]
xor r9d, r9d
mov r8d, edi
mov rdx, rbx
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jle 0x14000a268
sub edi, eax
cdqe
add rbx, rax
test edi, edi
jne 0x14000a240
test edi, edi
mov rsi, qword [rsp + 0x30]
sete dil
test dil, dil
jne 0x14000a2c0
mov rbx, qword [r14]
mov dword [r14 + 8], 3
cmp byte [rbx + 0x50], dil
jne 0x14000a291
mov eax, dword [rbx + 0x4c]
cmp eax, 0xffffffff
je 0x14000a29b
movsxd rcx, dword [rbx + 0x4c]
call qword [sym.imp.WS2_32.dll_closesocket]
xor r8d, r8d
mov byte [rbx + 0x50], 0
lea rdx, [0x14003899f]
lea rcx, [rbx + 0x28]
call fcn.140001f90
mov dword [rbx + 0x48], 0
mov dword [rbx + 0x4c], 0xffffffff
mov rbx, qword [rsp + 0x38]
movzx eax, dil
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x14000be80
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x2830
call fcn.14002b060
sub rsp, rax
mov rax, qword [0x140041008]
xor rax, rsp
mov qword [rsp + 0x2820], rax
mov rsi, rdx
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x2800
call fcn.140012ac0
mov rax, qword [rbx]
movzx edi, byte [rax + 0x50]
test dil, dil
je 0x14000bf03
movsxd rcx, dword [rax + 0x4c]
lea rdx, [rsp + 0x20]
xor r9d, r9d
mov r8d, 0x2800
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x14000bf03
test dil, dil
je 0x14000bf03
movsxd r8, eax
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140002f40
mov al, 1
jmp 0x14000bf4f
mov dword [rbx + 8], 3
mov rbx, qword [rbx]
cmp byte [rbx + 0x50], 0
jne 0x14000bf1b
mov eax, dword [rbx + 0x4c]
cmp eax, 0xffffffff
je 0x14000bf28
movsxd rax, dword [rbx + 0x4c]
mov rcx, rax
call qword [sym.imp.WS2_32.dll_closesocket]
xor r8d, r8d
mov byte [rbx + 0x50], 0
lea rdx, [0x14003899f]
lea rcx, [rbx + 0x28]
call fcn.140001f90
mov dword [rbx + 0x48], 0
xor al, al
mov dword [rbx + 0x4c], 0xffffffff
mov rcx, qword [rsp + 0x2820]
xor rcx, rsp
call fcn.14000f1c0
lea r11, [rsp + 0x2830]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret