joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14012d8b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov r11, rsp
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa8
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x14026be10]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov rsi, r9
mov rbx, r8
mov r15d, edx
mov r13, rcx
mov rdi, qword [rsp + 0x110]
mov r12, qword [rsp + 0x118]
xor eax, eax
mov qword [r11 - 0x68], rax
mov qword [r11 - 0x60], rax
mov qword [r11 - 0x58], rax
mov rdx, rcx
lea rcx, [r11 - 0x68]
call fcn.14006faf0
nop
xor eax, eax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
lea r8, str.readChannelToClose
mov rdx, rdi
lea rcx, [rsp + 0x68]
call fcn.140071270
nop
cmp byte [rbx + 0x38], 0
je 0x14012d95b
cmp qword [rbx + 0x40], 0
jne 0x14012d95b
mov rax, qword [rdi]
lea rdx, str.No_m_pHandler.
mov rcx, rdi
call qword [rax + 0x28]
mov rcx, rsi
call fcn.1400aeb50
mov r14, qword [rsi + 8]
mov byte [r12], 0
mov dword [rbx + 0x18], r15d
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x38]
call fcn.140034320
nop
call sub.KERNEL32.dll_GetTickCount
mov dword [rbx + 8], eax
cmp dword [rbx + 0x14], 0
je 0x14012d9ce
cmp dword [rbx + 8], 0
jne 0x14012d9b7
call sub.KERNEL32.dll_GetTickCount
mov dword [rbx + 8], eax
call sub.KERNEL32.dll_GetTickCount
mov ecx, dword [rbx + 8]
cmp eax, ecx
jbe 0x14012d9ce
sub eax, ecx
cmp eax, dword [rbx + 0x14]
ja 0x14012da88
lea rcx, [rsp + 0x38]
call fcn.140035e00
mov word [rbx + 0x48], 0
mov dword [rbx + 0x88], 0xffffffff
mov dword [rbx + 0x8c], 0
lea rax, [rsp + 0x38]
mov qword [rbx + 0x20], rax
lea rax, [rsp + 0x38]
mov qword [rbx + 0x28], rax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rsi
mov r9, rbx
xor r8d, r8d
mov edx, r15d
mov rcx, r13
call fcn.14012d430
movzx ebp, al
movzx ecx, byte [rbx + 0x4b]
mov byte [r12], cl
test cl, cl
jne 0x14012dac9
cmp byte [rbx + 0x4a], cl
jne 0x14012dac0
mov rcx, rsi
call fcn.1400aeb20
test al, al
jne 0x14012dad9
test bpl, bpl
je 0x14012dab7
mov rcx, rsi
call fcn.1400aeb70
test al, al
jne 0x14012daa3
test r14, r14
je 0x14012da70
mov rdx, rdi
mov rcx, r14
call fcn.14008e6e0
test al, al
jne 0x14012da96
cmp byte [rbx + 0x49], 0
je 0x14012d9a3
cmp dword [rbx + 0x88], r15d
je 0x14012da9f
jmp 0x14012d9a3
mov rcx, rsi
call fcn.1400aeb50
mov byte [rsi + 0x18], 1
jmp 0x14012dad9
lea rdx, str.Aborted_by_app.
jmp 0x14012dad0
mov bl, 1
jmp 0x14012dadb
mov r8, rdi
lea rdx, str.readChannelData
mov rcx, rsi
call fcn.1400aec10
jmp 0x14012dad9
lea rdx, str.readChannelData_failed.
jmp 0x14012dad0
lea rdx, str.Channel_no_longer_exists.
jmp 0x14012dad0
lea rdx, str.disconnected.
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x28]
xor bl, bl
lea rcx, [rsp + 0x38]
call fcn.1400344a0
nop
lea rcx, [rsp + 0x68]
call fcn.140071380
nop
lea rcx, [rsp + 0x80]
call fcn.14006fbb0
movzx eax, bl
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.140168e10
add rsp, 0xa8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14012db30
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x14026be10]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rsi, r9
movzx ebp, r8b
mov rbx, rdx
mov r14, rcx
mov rdi, qword [rsp + 0xa0]
xor eax, eax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
movzx r9d, byte [rdx + 0x38]
lea r8, str.readExpectedMessage
mov rdx, rdi
lea rcx, [rsp + 0x28]
call fcn.1400712c0
nop
cmp byte [rbx + 0x38], 0
je 0x14012dbb0
cmp qword [rbx + 0x40], 0
jne 0x14012dbb0
mov rax, qword [rdi]
lea rdx, str.No_m_pHandler.
mov rcx, rdi
call qword [rax + 0x28]
mov dword [rbx + 0x50], 0
cmp dword [rbx + 8], 0
jne 0x14012dbc5
call sub.KERNEL32.dll_GetTickCount
mov dword [rbx + 8], eax
cmp dword [rbx + 0x14], 0
je 0x14012dbec
cmp dword [rbx + 8], 0
jne 0x14012dbd9
call sub.KERNEL32.dll_GetTickCount
mov dword [rbx + 8], eax
call sub.KERNEL32.dll_GetTickCount
mov ecx, dword [rbx + 8]
cmp eax, ecx
jbe 0x14012dbec
sub eax, ecx
cmp eax, dword [rbx + 0x14]
ja 0x14012dc1a
mov r9, rdi
mov r8, rsi
mov rdx, rbx
mov rcx, r14
call fcn.1401309c0
test al, al
je 0x14012dc58
mov rcx, rsi
call fcn.1400aeb70
test al, al
jne 0x14012dc58
test bpl, bpl
je 0x14012dc54
cmp dword [rbx + 0x50], 0x5d
jne 0x14012dc54
jmp 0x14012dbc5
mov rcx, rsi
call fcn.1400aeb50
mov byte [rsi + 0x18], 1
cmp byte [rdi + 0xa9], 0
je 0x14012dc58
mov rax, qword [rdi]
lea rdx, str.Too_much_time_elapsed_waiting_for_response.
mov rcx, rdi
call qword [rax + 0x28]
mov r8d, dword [rbx + 0x14]
lea rdx, str.totalTimeoutMs
mov rcx, rdi
call fcn.1400717d0
jmp 0x14012dc58
mov bl, 1
jmp 0x14012dc5a
xor bl, bl
lea rcx, [rsp + 0x28]
call fcn.140071380
movzx eax, bl
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140168e10
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14012e220
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xe0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x128], rbx
mov rax, qword [0x14026be10]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov rdi, r9
mov r13, r8
mov rsi, rdx
mov r15, rcx
mov rbx, qword [rbp + 0x7f]
xor eax, eax
mov qword [rbp - 1], rax
mov qword [rbp + 7], rax
mov qword [rbp + 0xf], rax
lea r8, str.readUntilRcvWindowAdjust
mov rdx, rbx
lea rcx, [rbp - 1]
call fcn.140071270
nop
call sub.KERNEL32.dll_GetTickCount
mov r14d, eax
cmp dword [rsi + 0xdc], 0
jne 0x14012e435
xor r12d, r12d
xor edx, edx
mov r8d, 0x90
lea rcx, [rsp + 0x30]
call fcn.14016c710
lea rax, vtable.SshReadParams.0
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], r12d
mov byte [rsp + 0x3c], 1
mov dword [rsp + 0x40], r12d
mov dword [rbp - 0x7d], 0xea60
mov dword [rbp - 0x79], 0xffffffff
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x71], xmm0
mov qword [rbp - 0x61], r12
mov byte [rbp - 0x59], 0
mov qword [rbp - 0x51], r12
mov dword [rbp - 0x49], 0
mov word [rbp - 0x45], 0
mov dword [rbp - 0x41], r12d
lea rcx, [rbp - 0x39]
call fcn.140034320
mov qword [rbp - 9], r12
mov dword [rbp - 0x79], 0xffffffff
mov eax, dword [r13 + 0x14]
mov dword [rbp - 0x7d], eax
mov dword [rsp + 0x40], r12d
mov rcx, rdi
call fcn.1400aeb50
mov r9, rbx
mov r8, rdi
mov rdx, r13
mov rcx, r15
call fcn.1401309c0
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14012e34f
mov rdx, rbx
call fcn.14008e0f0
test al, al
jne 0x14012e3ab
mov rcx, rdi
call fcn.1400aeb00
test al, al
jne 0x14012e401
cmp byte [rbp - 0x46], al
jne 0x14012e3ef
cmp byte [rbp - 0x48], al
jne 0x14012e3dd
call sub.KERNEL32.dll_GetTickCount
sub eax, r14d
cmp eax, 0xea60
ja 0x14012e3bd
lea rax, vtable.SshReadParams.0
mov qword [rsp + 0x30], rax
mov qword [rbp - 0x61], r12
mov qword [rbp - 0x51], r12
lea rcx, [rbp - 0x39]
call fcn.1400344a0
cmp dword [rsi + 0xdc], 0
jne 0x14012e435
jmp 0x14012e2a1
mov rax, qword [rbx]
lea rdx, str.aborted_by_user_application.
mov rcx, rbx
call qword [rax + 0x28]
jmp 0x14012e414
mov r8, rbx
mov rdx, rdi
mov rcx, r15
call fcn.140127c70
mov rax, qword [rbx]
lea rdx, str.No_WINDOW_ADJUST_seems_to_be_coming...
mov rcx, rbx
call qword [rax + 0x28]
jmp 0x14012e414
mov rax, qword [rbx]
lea rdx, str.Received_CHANNEL_CLOSE
mov rcx, rbx
call qword [rax + 0x28]
jmp 0x14012e414
mov rax, qword [rbx]
lea rdx, str.Received_DISCONNECT
mov rcx, rbx
call qword [rax + 0x28]
jmp 0x14012e414
mov r8, rbx
lea rdx, str.sshWindowAdjust1
mov rcx, rdi
call fcn.1400aec10
nop
lea rax, vtable.SshReadParams.0
mov qword [rsp + 0x30], rax
mov qword [rbp - 0x61], r12
mov qword [rbp - 0x51], r12
lea rcx, [rbp - 0x39]
call fcn.1400344a0
xor bl, bl
jmp 0x14012e437
mov bl, 1
lea rcx, [rbp - 1]
call fcn.140071380
movzx eax, bl
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.140168e10
mov rbx, qword [rsp + 0x128]
add rsp, 0xe0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14013c830
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x20
lea rcx, [r9 + 0x50]
mov rbp, r9
mov rbx, r8
call fcn.1400372d0
test eax, eax
jne 0x14013c861
xor edx, edx
lea r8d, [rax + 0x10]
lea rcx, [rbp + 0x50]
call fcn.140034c10
mov dword [rbp + 0x48], reloc.WS2_32.dll_inet_ntoa
cmp dword [rbx + 0x544], 0
je 0x14013c876
lea rdx, str.Not_in_IV_mode.
jmp 0x14013ca80
mov ecx, dword [rbx + 0x548]
cmp ecx, 0xf
ja 0x14013ca79
mov edx, dword [rbp + 0x48]
mov qword [rsp + 0x40], rsi
add edx, ecx
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x58], r15
cmp edx, 0xc
jbe 0x14013c8a5
or dword [rbx + 0x540], 1
lea rcx, [rbp + 0x50]
call fcn.140036f60
mov r15, qword [rsp + 0x60]
xor r12d, r12d
mov rsi, rax
mov edi, r12d
cmp dword [rbx + 0x548], r12d
jne 0x14013c92c
test dword [rbp + 0x48], 0xfffffff0
jbe 0x14013c927
mov qword [rsp + 0x50], r14
nop dword [rax]
nop word [rax + rax]
mov eax, edi
lea rdx, [rbx + 0x500]
mov r8, r15
mov rcx, qword [rax + rsi]
lea eax, [rdi + 8]
xor qword [rbx + 0x500], rcx
mov rcx, rbx
mov rax, qword [rax + rsi]
xor qword [rbx + 0x508], rax
call fcn.14013e210
sub qword [rbx + 0x550], 0xffffffffffffff80
add edi, 0x10
mov eax, dword [rbp + 0x48]
and eax, 0xfffffff0
cmp edi, eax
jb 0x14013c8e0
mov r14, qword [rsp + 0x50]
mov eax, edi
add rsi, rax
cmp edi, dword [rbp + 0x48]
jae 0x14013ca60
nop word [rax + rax]
movzx eax, byte [rsi]
lea rsi, [rsi + 1]
movsxd rcx, dword [rbx + 0x548]
mov byte [rcx + rbx + 0x530], al
inc dword [rbx + 0x548]
cmp dword [rbx + 0x548], 0x10
jne 0x14013ca55
movzx eax, byte [rbx + 0x530]
lea rdx, [rbx + 0x500]
xor byte [rdx], al
mov r8, r15
movzx eax, byte [rbx + 0x531]
mov rcx, rbx
xor byte [rbx + 0x501], al
movzx eax, byte [rbx + 0x532]
xor byte [rbx + 0x502], al
movzx eax, byte [rbx + 0x533]
xor byte [rbx + 0x503], al
movzx eax, byte [rbx + 0x534]
xor byte [rbx + 0x504], al
movzx eax, byte [rbx + 0x535]
xor byte [rbx + 0x505], al
movzx eax, byte [rbx + 0x536]
xor byte [rbx + 0x506], al
movzx eax, byte [rbx + 0x537]
xor byte [rbx + 0x507], al
movzx eax, byte [rbx + 0x538]
xor byte [rbx + 0x508], al
movzx eax, byte [rbx + 0x539]
xor byte [rbx + 0x509], al
movzx eax, byte [rbx + 0x53a]
xor byte [rbx + 0x50a], al
movzx eax, byte [rbx + 0x53b]
xor byte [rbx + 0x50b], al
movzx eax, byte [rbx + 0x53c]
xor byte [rbx + 0x50c], al
movzx eax, byte [rbx + 0x53d]
xor byte [rbx + 0x50d], al
movzx eax, byte [rbx + 0x53e]
xor byte [rbx + 0x50e], al
movzx eax, byte [rbx + 0x53f]
xor byte [rbx + 0x50f], al
call fcn.14013e210
sub qword [rbx + 0x550], 0xffffffffffffff80
mov dword [rbx + 0x548], r12d
inc edi
cmp edi, dword [rbp + 0x48]
jb 0x14013c940
mov r15, qword [rsp + 0x58]
mov al, 1
mov r12, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
lea rdx, str.buflen_error.
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
call qword [rax + 0x28]
xor al, al
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
Function at 0x14013e040
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x14026be10]
xor rax, rsp
mov qword [rsp + 0x30], rax
xor eax, eax
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
mov rsi, r8
mov qword [rsp + 0x28], rax
add r8, 0x4f0
mov rax, qword [rcx]
call qword [rax + 0x20]
xor eax, eax
mov qword [rsi + 0x530], rax
xor ebx, ebx
mov qword [rsi + 0x538], rax
mov edi, ebx
mov qword [rsi + 0x500], rax
mov qword [rsi + 0x508], rax
mov qword [rsi + 0x540], rbx
mov dword [rsi + 0x548], ebx
mov qword [rsi + 0x550], rbx
mov qword [rsi + 0x558], rbx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
nop dword [rax]
nop word [rax + rax]
lea r8, [rsi + 0x560]
mov byte [rsp + 0x20], bl
add r8, rdi
lea rdx, [rsp + 0x20]
lea rcx, [rsi + 0x4f0]
call fcn.14013d120
inc ebx
add rdi, 0x10
cmp ebx, 0x100
jl 0x14013e0d0
lea rax, [rsi + 0x56e]
mov r10d, reloc.WS2_32.dll_ntohs
lea r11, [0x140203af0]
mov r9d, 0x100
nop word [rax + rax]
movzx ecx, byte [rax]
movzx r8d, byte [rax + 1]
mov byte [rax + 0x1001], cl
movzx ecx, byte [rax - 1]
mov byte [rax + 0x1000], cl
movzx ecx, byte [rax - 2]
mov byte [rax + 0xfff], cl
movzx ecx, byte [rax - 3]
mov byte [rax + 0xffe], cl
movzx ecx, byte [rax - 4]
mov byte [rax + 0xffd], cl
movzx ecx, byte [rax - 5]
mov byte [rax + 0xffc], cl
movzx ecx, byte [rax - 6]
mov byte [rax + 0xffb], cl
movzx ecx, byte [rax - 7]
mov byte [rax + 0xffa], cl
movzx ecx, byte [rax - 8]
mov byte [rax + 0xff9], cl
movzx ecx, byte [rax - 9]
mov byte [rax + 0xff8], cl
movzx ecx, byte [rax - 0xa]
mov byte [rax + 0xff7], cl
movzx ecx, byte [rax - 0xb]
mov byte [rax + 0xff6], cl
movzx ecx, byte [rax - 0xc]
mov byte [rax + 0xff5], cl
movzx ecx, byte [rax - 0xd]
mov byte [rax + 0xff4], cl
lea ecx, [r8 + r8]
movzx ecx, byte [rcx + r11]
mov byte [rax + 0xff2], cl
lea ecx, [r8*2 + 1]
movzx ecx, byte [rcx + r11]
xor cl, byte [rax - 0xe]
mov byte [rax + 0xff3], cl
add rax, 0x10
sub r9, 1
jne 0x14013e120
sub r10, 1
jne 0x14013e111
mov al, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140168e10
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x140146ad0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov ebx, pe_nt_image_headers64
mov esi, r8d
mov rdi, rcx
cmp r8d, ebx
jbe 0x140146b01
xor al, al
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbp
test r9d, r9d
mov ebp, 0x400
mov qword [rsp + 0x38], r14
cmovne ebp, r9d
mov r8, rsi
add rcx, 0xb0
call fcn.14016a920
lea r11, [0x140207f40]
cmp esi, ebx
jae 0x140146b78
xor edx, edx
lea eax, [rsi - 1]
movzx r9d, byte [rax + rdi + 0xb0]
lea r8, [rdi + 0xb0]
add r8, rsi
nop dword [rax]
movzx ecx, byte [rdx + rdi + 0xb0]
lea r8, [r8 + 1]
movzx eax, r9b
lea edx, [rdx + 1]
add rcx, rax
inc esi
movzx eax, cl
movzx r9d, byte [rax + r11]
mov byte [r8 - 1], r9b
cmp esi, ebx
jb 0x140146b50
mov r14, qword [rsp + 0x38]
lea r10d, [rbp + 7]
neg ebp
shr r10d, 3
sub ebx, r10d
lea r8, [rdi + 0xb0]
mov eax, ebx
movzx ecx, bpl
mov rbp, qword [rsp + 0x30]
add r8, rax
and cl, 7
mov edx, 0xff
sar rdx, cl
movzx eax, byte [r8]
and rdx, rax
movzx r9d, byte [rdx + r11]
mov byte [r8], r9b
test ebx, ebx
je 0x140146be4
lea edx, [rbx + r10]
movzx eax, r9b
lea edx, [rdx - 1]
movzx ecx, byte [rdx + rdi + 0xb0]
lea r8, [r8 - 1]
xor rcx, rax
movzx r9d, byte [rcx + r11]
mov byte [r8], r9b
add ebx, 0xffffffff
jne 0x140146bc1
mov r9d, 0x3f
lea r10, [rdi + 0x12e]
mov r11d, 0x100
nop word [rax + rax]
lea r8d, [r9 + r9]
movzx ecx, r11w
lea eax, [r8 + 1]
movzx edx, byte [rax + rdi + 0xb0]
lea r10, [r10 - 2]
imul edx, ecx
mov eax, r9d
movzx ecx, byte [r8 + rdi + 0xb0]
dec r9d
add dx, cx
mov word [r10 + 2], dx
test eax, eax
jne 0x140146c00
mov rbx, qword [rsp + 0x40]
mov al, 1
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, pe_nt_image_headers64
mov rsi, rdx
mov rbp, rcx
cmp r8d, edi
ja 0x140146c82
mov eax, 1
mov edi, r8d
cmp r8d, eax
cmovb edi, eax
mov ebx, 0x400
test r9d, r9d
je 0x140146c96
cmp r9d, ebx
cmova r9d, ebx
mov ebx, r9d
mov edx, edi
mov rcx, rsi
call fcn.140036af0
mov rcx, rsi
call fcn.140036f60
mov rdx, rax
mov r9d, ebx
mov r8d, edi
mov rcx, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp 0x140146ad0
Function at 0x140146c50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov ebx, pe_nt_image_headers64
mov esi, r8d
mov rdi, rcx
cmp r8d, ebx
jbe 0x140146b01
xor al, al
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbp
test r9d, r9d
mov ebp, 0x400
mov qword [rsp + 0x38], r14
cmovne ebp, r9d
mov r8, rsi
add rcx, 0xb0
call fcn.14016a920
lea r11, [0x140207f40]
cmp esi, ebx
jae 0x140146b78
xor edx, edx
lea eax, [rsi - 1]
movzx r9d, byte [rax + rdi + 0xb0]
lea r8, [rdi + 0xb0]
add r8, rsi
nop dword [rax]
movzx ecx, byte [rdx + rdi + 0xb0]
lea r8, [r8 + 1]
movzx eax, r9b
lea edx, [rdx + 1]
add rcx, rax
inc esi
movzx eax, cl
movzx r9d, byte [rax + r11]
mov byte [r8 - 1], r9b
cmp esi, ebx
jb 0x140146b50
mov r14, qword [rsp + 0x38]
lea r10d, [rbp + 7]
neg ebp
shr r10d, 3
sub ebx, r10d
lea r8, [rdi + 0xb0]
mov eax, ebx
movzx ecx, bpl
mov rbp, qword [rsp + 0x30]
add r8, rax
and cl, 7
mov edx, 0xff
sar rdx, cl
movzx eax, byte [r8]
and rdx, rax
movzx r9d, byte [rdx + r11]
mov byte [r8], r9b
test ebx, ebx
je 0x140146be4
lea edx, [rbx + r10]
movzx eax, r9b
lea edx, [rdx - 1]
movzx ecx, byte [rdx + rdi + 0xb0]
lea r8, [r8 - 1]
xor rcx, rax
movzx r9d, byte [rcx + r11]
mov byte [r8], r9b
add ebx, 0xffffffff
jne 0x140146bc1
mov r9d, 0x3f
lea r10, [rdi + 0x12e]
mov r11d, 0x100
nop word [rax + rax]
lea r8d, [r9 + r9]
movzx ecx, r11w
lea eax, [r8 + 1]
movzx edx, byte [rax + rdi + 0xb0]
lea r10, [r10 - 2]
imul edx, ecx
mov eax, r9d
movzx ecx, byte [r8 + rdi + 0xb0]
dec r9d
add dx, cx
mov word [r10 + 2], dx
test eax, eax
jne 0x140146c00
mov rbx, qword [rsp + 0x40]
mov al, 1
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, pe_nt_image_headers64
mov rsi, rdx
mov rbp, rcx
cmp r8d, edi
ja 0x140146c82
mov eax, 1
mov edi, r8d
cmp r8d, eax
cmovb edi, eax
mov ebx, 0x400
test r9d, r9d
je 0x140146c96
cmp r9d, ebx
cmova r9d, ebx
mov ebx, r9d
mov edx, edi
mov rcx, rsi
call fcn.140036af0
mov rcx, rsi
call fcn.140036f60
mov rdx, rax
mov r9d, ebx
mov r8d, edi
mov rcx, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp 0x140146ad0

Function at 0x140147660
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov r10d, dword [rdx + 0x458]
mov rbx, r8
mov r11d, dword [rdx + 0x45c]
movsxd rdi, r9d
test r9d, r9d
jle 0x1401476cd
nop dword [rax]
nop word [rax + rax]
inc r10b
lea rbx, [rbx + 1]
movzx r10d, r10b
mov r9d, dword [rdx + r10*4 + 0x58]
lea r8, [rdx + r10*4]
add r11b, r9b
movzx r11d, r11b
mov ecx, dword [rdx + r11*4 + 0x58]
mov dword [r8 + 0x58], ecx
add cl, r9b
mov dword [rdx + r11*4 + 0x58], r9d
movzx eax, cl
movzx ecx, byte [rdx + rax*4 + 0x58]
xor byte [rbx - 1], cl
sub rdi, 1
jne 0x140147690
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
mov dword [rdx + 0x45c], r11d
mov dword [rdx + 0x458], r10d
ret
Function at 0x140147b30
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
movzx eax, byte [r8 + 2]
mov r10, rdx
movzx ecx, byte [r8 + 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [r8 + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [r8]
shl ecx, 8
or ecx, eax
mov dword [rdx + 0x470], ecx
movzx eax, byte [r8 + 6]
movzx ecx, byte [r8 + 7]
shl ecx, 8
or ecx, eax
movzx eax, byte [r8 + 5]
shl ecx, 8
or ecx, eax
movzx eax, byte [r8 + 4]
shl ecx, 8
or ecx, eax
mov dword [rdx + 0x474], ecx
movzx eax, byte [r8 + 0xa]
movzx ecx, byte [r8 + 0xb]
shl ecx, 8
or ecx, eax
movzx eax, byte [r8 + 9]
shl ecx, 8
or ecx, eax
movzx eax, byte [r8 + 8]
shl ecx, 8
or ecx, eax
mov dword [rdx + 0x478], ecx
movzx eax, byte [r8 + 0xe]
movzx ecx, byte [r8 + 0xf]
shl ecx, 8
or ecx, eax
movzx eax, byte [r8 + 0xd]
shl ecx, 8
or ecx, eax
movzx eax, byte [r8 + 0xc]
shl ecx, 8
or ecx, eax
mov dword [rdx + 0x47c], ecx
cmp r9d, 0x100
jne 0x140147bec
add r8, 0x10
lea rdx, [0x140208040]
jmp 0x140147bf3
lea rdx, str.expand_16_byte_k
movzx eax, byte [r8 + 2]
movzx ecx, byte [r8 + 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [r8 + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [r8]
shl ecx, 8
or ecx, eax
mov dword [r10 + 0x480], ecx
movzx eax, byte [r8 + 6]
movzx ecx, byte [r8 + 7]
shl ecx, 8
or ecx, eax
movzx eax, byte [r8 + 5]
shl ecx, 8
or ecx, eax
movzx eax, byte [r8 + 4]
shl ecx, 8
or ecx, eax
mov dword [r10 + 0x484], ecx
movzx eax, byte [r8 + 0xa]
movzx ecx, byte [r8 + 0xb]
shl ecx, 8
or ecx, eax
movzx eax, byte [r8 + 9]
shl ecx, 8
or ecx, eax
movzx eax, byte [r8 + 8]
shl ecx, 8
or ecx, eax
mov dword [r10 + 0x488], ecx
movzx eax, byte [r8 + 0xe]
movzx ecx, byte [r8 + 0xf]
shl ecx, 8
or ecx, eax
movzx eax, byte [r8 + 0xd]
shl ecx, 8
or ecx, eax
movzx eax, byte [r8 + 0xc]
shl ecx, 8
or ecx, eax
mov dword [r10 + 0x48c], ecx
movsx eax, byte [rdx + 2]
movsx ecx, byte [rdx + 3]
shl ecx, 8
or ecx, eax
movsx eax, byte [rdx + 1]
shl ecx, 8
or ecx, eax
movsx eax, byte [rdx]
shl ecx, 8
or ecx, eax
mov dword [r10 + 0x460], ecx
movsx eax, byte [rdx + 6]
movsx ecx, byte [rdx + 7]
shl ecx, 8
or ecx, eax
movsx eax, byte [rdx + 5]
shl ecx, 8
or ecx, eax
movsx eax, byte [rdx + 4]
shl ecx, 8
or ecx, eax
mov dword [r10 + 0x464], ecx
movsx eax, byte [rdx + 0xa]
movsx ecx, byte [rdx + 0xb]
shl ecx, 8
or ecx, eax
movsx eax, byte [rdx + 9]
shl ecx, 8
or ecx, eax
movsx eax, byte [rdx + 8]
shl ecx, 8
or ecx, eax
mov dword [r10 + 0x468], ecx
movsx ecx, byte [rdx + 0xf]
movsx eax, byte [rdx + 0xe]
shl ecx, 8
or ecx, eax
movsx eax, byte [rdx + 0xd]
shl ecx, 8
or ecx, eax
movsx eax, byte [rdx + 0xc]
shl ecx, 8
or ecx, eax
mov dword [r10 + 0x46c], ecx
ret
Function at 0x140159a40
Capabilities:
Resolve dns

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x14026be10]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rbx, rcx
add rcx, 0x40
call fcn.14002ed10
mov rcx, rax
call qword [sym.imp.WS2_32.dll_gethostbyname]
test rax, rax
je 0x140159ada
mov rdx, qword [rax + 0x18]
mov rcx, qword [rdx]
test rcx, rcx
je 0x140159a85
mov ecx, dword [rcx]
mov dword [rbx + 0x16c], ecx
jmp 0x140159a8f
mov dword [rbx + 0x16c], 0
mov rax, qword [rax + 0x18]
lea r8, str._b._b._b._b
mov r9, qword [rax]
lea rcx, [r9 + 2]
lea rdx, [r9 + 1]
lea rax, [r9 + 3]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x20], rdx
mov edx, 0x28
call fcn.14007ab20
lea rcx, [rbx + 0xd8]
lea rdx, [rsp + 0x40]
call fcn.140030950
jmp 0x140159ae6
lea rcx, [rbx + 0xd8]
call fcn.14002d770
mov byte [rbx + 0x168], 0
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140168e10
add rsp, 0x70
pop rbx
ret