joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000e640
Capabilities:
Stop service

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x68
mov rax, qword [0x18040b070]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x80]
call fcn.18000e7b0
mov r8d, 0xf003f
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x18000e6e4
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x18000e6d9
lea r8, [rsp + 0x38]
mov edx, 1
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x18000e6ce
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x20], rax
sub qword [rsp + 0x20], 2
add qword [rsp + 0x20], 2
mov rax, qword [rsp + 0x20]
cmp word [rax], 0
jne 0x18000e6f7
mov rax, qword [rsp + 0x20]
lea rcx, str..exe
mov rdi, rax
mov rsi, rcx
mov ecx, 0xa
rep movsb byte [rdi], byte [rsi]
mov rcx, qword [rsp + 0x80]
call fcn.18000e150
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180133f80
add rsp, 0x68
pop rdi
pop rsi
ret
Function at 0x180011b40
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x6a0
mov rax, qword [0x18040b070]
xor rax, rsp
mov qword [rsp + 0x690], rax
lea rdx, [0x18015b044]
lea rcx, [rsp + 0x58]
call fcn.180001890
xor eax, eax
mov word [rsp + 0x480], ax
lea rax, [rsp + 0x482]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
xor eax, eax
mov word [rsp + 0x270], ax
lea rax, [rsp + 0x272]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov dword [rsp + 0x44], 0
mov dword [rsp + 0x40], 0
mov rax, qword [0x18015b0f8]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, 0x200
rep stosb byte [rdi], al
mov eax, 2
imul rax, rax, 3
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0x208
jae 0x180011bf4
jmp 0x180011bf9
call fcn.1801340d8
xor eax, eax
mov rcx, qword [rsp + 0x50]
mov word [rsp + rcx + 0x60], ax
mov dword [rsp + 0x38], 0x105
lea rax, [rsp + 0x270]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x6b0]
mov r8d, 0x105
lea rdx, [rsp + 0x480]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov dword [rsp + 0x48], eax
lea rcx, [rsp + 0x58]
call fcn.180001b90
mov eax, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x690]
xor rcx, rsp
call fcn.180133f80
add rsp, 0x6a0
pop rdi
ret
Function at 0x180016690
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rcx
mov rax, qword [rsp + 8]
mov qword [rax], 0
mov rax, qword [rsp + 8]
mov qword [rax + 8], 0
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0x6a09e667
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0xbb67ae85
mov eax, 4
imul rax, rax, 2
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0x3c6ef372
mov eax, 4
imul rax, rax, 3
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0xa54ff53a
mov eax, 4
imul rax, rax, 4
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0x510e527f
mov eax, 4
imul rax, rax, 5
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0x9b05688c
mov eax, 4
imul rax, rax, 6
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0x1f83d9ab
mov eax, 4
imul rax, rax, 7
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0x5be0cd19
ret
Function at 0x180034c50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x58
mov rax, qword [rsp + 0x80]
mov ecx, dword [rsp + 0x88]
mov eax, dword [rax + 0x24]
sub eax, ecx
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jg 0x180034d28
mov dword [rsp + 0x30], 0
jmp 0x180034ca1
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x90]
cmp dword [rsp + 0x30], eax
jge 0x180034cc2
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x78]
movzx eax, byte [rcx + rax]
test eax, eax
jne 0x180034cc2
jmp 0x180034c97
mov eax, dword [rsp + 0x90]
cmp dword [rsp + 0x30], eax
jge 0x180034d23
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 0x70]
call fcn.1800879a0
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
je 0x180034cf1
mov eax, dword [rsp + 0x38]
jmp 0x180034e15
mov eax, dword [rsp + 0x30]
mov ecx, dword [rsp + 0x90]
sub ecx, eax
mov eax, ecx
cdqe
mov qword [rsp + 0x48], rax
movsxd rcx, dword [rsp + 0x30]
mov rdx, qword [rsp + 0x78]
add rdx, rcx
mov rcx, rdx
mov rdi, rcx
xor eax, eax
mov rcx, qword [rsp + 0x48]
rep stosb byte [rdi], al
jmp 0x180034e13
mov eax, dword [rsp + 0x90]
cmp dword [rsp + 0x34], eax
jge 0x180034d9b
mov eax, dword [rsp + 0x34]
mov ecx, dword [rsp + 0x90]
sub ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x34]
mov edx, dword [rsp + 0x88]
add edx, ecx
mov ecx, edx
movsxd rdx, dword [rsp + 0x34]
mov rdi, qword [rsp + 0x78]
add rdi, rdx
mov rdx, rdi
mov dword [rsp + 0x20], eax
mov r9d, ecx
mov r8, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x70]
call fcn.180034c50
mov dword [rsp + 0x3c], eax
cmp dword [rsp + 0x3c], 0
je 0x180034d90
mov eax, dword [rsp + 0x3c]
jmp 0x180034e15
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x90], eax
movsxd rax, dword [rsp + 0x90]
movsxd rcx, dword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
add rcx, qword [rdx + 0x10]
mov r8, rax
mov rdx, rcx
mov rcx, qword [rsp + 0x78]
call fcn.180135ad0
test eax, eax
je 0x180034e13
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 0x70]
call fcn.1800879a0
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
je 0x180034dea
mov eax, dword [rsp + 0x40]
jmp 0x180034e15
movsxd rax, dword [rsp + 0x90]
movsxd rcx, dword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
add rcx, qword [rdx + 0x10]
mov rdi, qword [rsp + 0x78]
mov rsi, rcx
mov rcx, rax
rep movsb byte [rdi], byte [rsi]
xor eax, eax
add rsp, 0x58
pop rdi
pop rsi
ret
Function at 0x18005aa10
Capabilities:
Reference sql statements

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea r9, [0x180403a38]
mov r8, qword [rsp + 0x48]
lea rdx, str.SELECT_1_FROM___w_._s_WHERE_name_NOT_LIKE_sqlite____AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d_NULL
mov rcx, qword [rsp + 0x40]
call fcn.180083bc0
cmp dword [rsp + 0x50], 0
jne 0x18005aa76
mov r9, qword [rsp + 0x48]
lea r8, [0x180403b28]
lea rdx, str.SELECT_1_FROM_temp._s_WHERE_name_NOT_LIKE_sqlite____AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1_NULL
mov rcx, qword [rsp + 0x40]
call fcn.180083bc0
add rsp, 0x38
ret
Function at 0x180095f30
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov rax, qword [rsp + 0x50]
mov qword [rax], 0
mov ecx, Ordinal_41
call fcn.180083120
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x180095f71
mov eax, 7
jmp 0x18009603b
cmp dword [reloc.WS2_32.dll_accept], 0
je 0x180095f88
mov ecx, reloc.WLDAP32.dll_Ordinal_200
call fcn.180077860
test eax, eax
je 0x180095f98
mov rdi, qword [rsp + 0x30]
xor eax, eax
mov ecx, Ordinal_41
rep stosb byte [rdi], al
jmp 0x180096000
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x58]
mov qword [rax + 0x10], rcx
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x60]
mov qword [rax + 0x18], rcx
mov rax, qword [rsp + 0x30]
add rax, 8
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0x30]
lea r8, [0x1800960f0]
xor edx, edx
xor ecx, ecx
call fcn.1801416d4
mov rcx, qword [rsp + 0x30]
mov qword [rcx], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
jne 0x180096000
mov rdi, qword [rsp + 0x30]
xor eax, eax
mov ecx, Ordinal_41
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x30]
cmp qword [rax + 0x10], 0
jne 0x18009602c
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rcx, qword [rsp + 0x30]
mov dword [rcx + 8], eax
mov rcx, qword [rsp + 0x60]
call qword [rsp + 0x58]
mov rcx, qword [rsp + 0x30]
mov qword [rcx + 0x20], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
xor eax, eax
add rsp, 0x40
pop rdi
ret
Function at 0x1800d61f0
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x28
lea r9, [rsp + 0x40]
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor ecx, ecx
test eax, eax
sete cl
neg ecx
mov eax, ecx
add rsp, 0x28
ret

Function at 0x1800d6220
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x28
lea r9, [rsp + 0x40]
mov r8d, 2
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor ecx, ecx
test eax, eax
sete cl
neg ecx
mov eax, ecx
add rsp, 0x28
ret

Function at 0x1800d6250
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x28
lea r9, [rsp + 0x40]
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor ecx, ecx
test eax, eax
sete cl
neg ecx
mov eax, ecx
add rsp, 0x28
ret

Function at 0x1800d62a0
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x24]
mov qword [0x18040c628], rax
cmp rax, 0xf
ja 0x1800d62c5
call fcn.1800d5ea0
mov edx, reloc.WS2_32.dll_recv
lea rcx, [0x18040c630]
call fcn.1800d6130
xor eax, eax
add rsp, 0x58
ret

Function at 0x1800d6560
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rcx
xor r9d, r9d
mov qword [rsp + 0x10], rdx
mov r10, r8
mov byte [rsp + 8], 0
test r8, r8
je 0x1800d65ab
nop word [rax + rax]
mov rax, qword [rsp + 0x10]
movzx ecx, byte [rax + r9]
mov rax, qword [rsp + 0x18]
movzx r8d, byte [rax + r9]
inc r9
movzx eax, byte [rsp + 8]
xor r8d, ecx
or eax, r8d
mov byte [rsp + 8], al
cmp r9, r10
jb 0x1800d6580
movzx eax, byte [rsp + 8]
dec eax
sar eax, 8
and eax, 1
dec eax
ret
Function at 0x1800d6af0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x20
xor edi, edi
mov rbp, rcx
mov ecx, dword [rsp + 0x70]
mov ebx, edi
mov r14d, edi
mov esi, edi
mov r15, r9
call fcn.1800d6ae0
movabs rax, 0xaaaaaaaaaaaaaaab
mov rcx, r15
mul r15
shr rdx, 1
lea rax, [rdx + rdx*2]
lea r12, [rdx*4]
sub rcx, rax
je 0x1800d6b63
test byte [rsp + 0x70], 2
jne 0x1800d6b59
add r12, 4
jmp 0x1800d6b63
shr rcx, 1
add r12, 2
add r12, rcx
cmp qword [rsp + 0x58], r12
ja 0x1800d6b6f
call fcn.1800d5ea0
test byte [rsp + 0x70], 4
je 0x1800d6bf5
test r15, r15
je 0x1800d6c65
mov r11, qword [rsp + 0x60]
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [r14 + r11]
add rdi, 8
shl esi, 8
inc r14
add esi, eax
cmp rdi, 6
jb 0x1800d6bd1
nop word [rax + rax]
mov eax, esi
sub rdi, 6
mov rcx, rdi
shr eax, cl
and eax, 0x3f
mov ecx, eax
call fcn.1800d6750
mov byte [rbx + rbp], al
inc rbx
cmp rdi, 6
jae 0x1800d6bb0
cmp r14, r15
jb 0x1800d6b90
test rdi, rdi
je 0x1800d6c65
mov ecx, 6
sub cl, dil
shl esi, cl
and esi, 0x3f
mov ecx, esi
call fcn.1800d6750
jmp 0x1800d6c5f
test r15, r15
je 0x1800d6c65
mov r11, qword [rsp + 0x60]
nop
movzx eax, byte [r14 + r11]
add rdi, 8
shl esi, 8
inc r14
add esi, eax
cmp rdi, 6
jb 0x1800d6c41
nop word [rax + rax]
mov eax, esi
sub rdi, 6
mov rcx, rdi
shr eax, cl
and eax, 0x3f
mov ecx, eax
call fcn.1800d66e0
mov byte [rbx + rbp], al
inc rbx
cmp rdi, 6
jae 0x1800d6c20
cmp r14, r15
jb 0x1800d6c00
test rdi, rdi
je 0x1800d6c65
mov ecx, 6
sub cl, dil
shl esi, cl
and esi, 0x3f
mov ecx, esi
call fcn.1800d66e0
mov byte [rbx + rbp], al
inc rbx
cmp rbx, r12
jae 0x1800d6c7e
sub r12, rbx
lea rdi, [rbx + rbp]
mov rcx, r12
mov eax, 0x3d
rep stosb byte [rdi], al
add rbx, r12
mov rax, qword [rsp + 0x58]
mov byte [rbx + rbp], 0
inc rbx
cmp rbx, rax
jb 0x1800d6c83
mov rbx, qword [rsp + 0x50]
mov rax, rbp
mov rbp, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1800d71f0
Capabilities:
Encode data using xor
Encrypt data using salsa20 or chacha

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x18
mov rax, rdx
test r9, r9
jne 0x1800d7226
mov ebx, 0x79622d32
mov r10d, 0x61707865
mov r11d, 0x3320646e
mov r9d, 0x6b206574
jmp 0x1800d7235
mov r10d, dword [r9]
mov r11d, dword [r9 + 4]
mov ebx, dword [r9 + 8]
mov r9d, dword [r9 + 0xc]
mov ecx, dword [r8 + 0x18]
mov edx, dword [r8 + 0x14]
mov r14d, dword [r8]
mov r15d, dword [r8 + 4]
mov r12d, dword [r8 + 8]
mov ebp, dword [r8 + 0xc]
mov r13d, dword [r8 + 0x10]
mov edi, dword [rax + 8]
mov esi, dword [rax + 0xc]
mov dword [rsp + 0x68], ecx
mov ecx, dword [r8 + 0x1c]
mov r8d, dword [rax + 4]
mov dword [rsp + 0x78], edx
mov edx, dword [rax]
mov dword [rsp + 0x70], ecx
mov ecx, dword [rsp + 0x78]
mov qword [rsp + 8], 0xa
nop dword [rax]
lea eax, [rcx + r10]
rol eax, 7
xor ebp, eax
lea eax, [r10 + rbp]
rol eax, 9
xor edi, eax
lea eax, [rdi + rbp]
rol eax, 0xd
xor ecx, eax
lea eax, [rdi + rcx]
ror eax, 0xe
xor r10d, eax
lea eax, [r14 + r11]
rol eax, 7
xor esi, eax
lea eax, [rsi + r11]
rol eax, 9
xor dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x68]
add eax, esi
rol eax, 0xd
xor r14d, eax
mov eax, dword [rsp + 0x68]
add eax, r14d
ror eax, 0xe
xor r11d, eax
lea eax, [rdx + rbx]
rol eax, 7
xor dword [rsp + 0x70], eax
mov eax, dword [rsp + 0x70]
add eax, ebx
rol eax, 9
xor r15d, eax
mov eax, dword [rsp + 0x70]
add eax, r15d
rol eax, 0xd
xor edx, eax
lea eax, [rdx + r15]
ror eax, 0xe
xor ebx, eax
lea eax, [r9 + r13]
rol eax, 7
xor r12d, eax
lea eax, [r12 + r9]
rol eax, 9
xor r8d, eax
lea eax, [r8 + r12]
rol eax, 0xd
xor r13d, eax
lea eax, [r8 + r13]
ror eax, 0xe
xor r9d, eax
lea eax, [r12 + r10]
rol eax, 7
xor r14d, eax
mov dword [rsp], r14d
lea eax, [r14 + r10]
rol eax, 9
xor r15d, eax
lea eax, [r15 + r14]
rol eax, 0xd
xor r12d, eax
lea eax, [r12 + r15]
ror eax, 0xe
xor r10d, eax
lea eax, [r11 + rbp]
rol eax, 7
xor edx, eax
lea eax, [rdx + r11]
rol eax, 9
xor r8d, eax
lea eax, [r8 + rdx]
rol eax, 0xd
xor ebp, eax
lea eax, [r8 + rbp]
ror eax, 0xe
xor r11d, eax
lea eax, [rsi + rbx]
rol eax, 7
xor r13d, eax
lea eax, [rbx + r13]
mov r14d, dword [rsp + 0x70]
rol eax, 9
xor edi, eax
lea eax, [rdi + r13]
rol eax, 0xd
xor esi, eax
lea eax, [rsi + rdi]
ror eax, 0xe
xor ebx, eax
mov eax, dword [rsp + 0x70]
add eax, r9d
rol eax, 7
xor ecx, eax
lea eax, [rcx + r9]
rol eax, 9
xor dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x68]
add eax, ecx
rol eax, 0xd
xor r14d, eax
mov eax, dword [rsp + 0x68]
add eax, r14d
mov dword [rsp + 0x70], r14d
mov r14d, dword [rsp]
ror eax, 0xe
xor r9d, eax
sub qword [rsp + 8], 1
jne 0x1800d7280
mov rcx, qword [rsp + 0x60]
xor eax, eax
mov dword [rcx], r10d
mov dword [rcx + 4], r11d
mov dword [rcx + 8], ebx
mov dword [rcx + 0xc], r9d
mov dword [rcx + 0x10], edx
mov dword [rcx + 0x14], r8d
mov dword [rcx + 0x18], edi
mov dword [rcx + 0x1c], esi
add rsp, 0x18
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1800d7650
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
call fcn.1800d76d0
mov eax, 0xffffffff
cmp rbx, rax
jbe 0x1800d7674
call fcn.1800d5ea0
mov edx, ebx
mov rcx, rdi
call sub.ADVAPI32.dll_SystemFunction036
test al, al
jne 0x1800d7687
call fcn.1800d5ea0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1800dea40
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov dword [rcx], 0x61707865
mov dword [rcx + 4], 0x3320646e
mov dword [rcx + 8], 0x79622d32
mov dword [rcx + 0xc], 0x6b206574
mov eax, dword [rdx]
mov dword [rcx + 0x10], eax
mov eax, dword [rdx + 4]
mov dword [rcx + 0x14], eax
mov eax, dword [rdx + 8]
mov dword [rcx + 0x18], eax
mov eax, dword [rdx + 0xc]
mov dword [rcx + 0x1c], eax
mov eax, dword [rdx + 0x10]
mov dword [rcx + 0x20], eax
mov eax, dword [rdx + 0x14]
mov dword [rcx + 0x24], eax
mov eax, dword [rdx + 0x18]
mov dword [rcx + 0x28], eax
mov eax, dword [rdx + 0x1c]
mov dword [rcx + 0x2c], eax
ret
Function at 0x1800e1550
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov eax, dword [rdx]
mov dword [rcx + 0x14], eax
mov eax, dword [rdx + 4]
mov dword [rcx + 0x28], eax
mov eax, dword [rdx + 8]
mov dword [rcx + 0x3c], eax
mov eax, dword [rdx + 0xc]
mov dword [rcx + 0x30], eax
mov eax, dword [rdx + 0x10]
mov dword [rcx + 0x1c], eax
mov eax, dword [rdx + 0x14]
mov dword [rcx + 0x10], eax
mov eax, dword [rdx + 0x18]
mov dword [rcx + 0x24], eax
mov eax, dword [rdx + 0x1c]
mov dword [rcx + 0x38], eax
mov dword [rcx], 0x61707865
mov dword [rcx + 4], 0x3320646e
mov dword [rcx + 8], 0x79622d32
mov dword [rcx + 0xc], 0x6b206574
ret
Function at 0x1800e7010
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x10
mov rax, qword [0x18040b070]
xor rax, rsp
mov qword [rsp + 8], rax
xor eax, eax
lea r15, [0x18016b760]
mov dword [rsp + 1], eax
xor r8b, r8b
movzx r11d, byte [rsp + 4]
mov r14, rcx
movzx ebx, byte [rsp + 3]
mov rbp, rcx
movzx edi, byte [rsp + 2]
sub r14, r15
mov word [rsp + 5], ax
movzx r10d, al
movzx r9d, byte [rsp + 6]
movzx esi, al
nop dword [rax]
nop word [rax + rax]
lea rcx, [r14 + rax]
movzx edx, byte [rcx + r15]
movzx ecx, byte [rax + r15]
xor cl, dl
or r8b, cl
movzx ecx, byte [rax + r15 + 0x20]
xor cl, dl
or sil, cl
movzx ecx, byte [rax + r15 + 0x40]
xor cl, dl
or dil, cl
movzx ecx, byte [rax + r15 + 0x60]
xor cl, dl
or bl, cl
movzx ecx, byte [rax + r15 + 0x80]
xor cl, dl
or r11b, cl
movzx ecx, byte [rax + r15 + 0xa0]
xor cl, dl
or r10b, cl
movzx ecx, byte [rax + r15 + 0xc0]
xor cl, dl
inc rax
or r9b, cl
cmp rax, 0x1f
jb 0x1800e7080
movzx edx, byte [rax + rbp]
movzx ecx, byte [rax + r15]
and dl, 0x7f
xor cl, dl
or r8b, cl
movzx ecx, byte [rax + r15 + 0x20]
xor cl, dl
or sil, cl
movzx ecx, byte [rax + r15 + 0x40]
xor cl, dl
or dil, cl
movzx ecx, byte [rax + r15 + 0x60]
xor cl, dl
or bl, cl
movzx ecx, byte [rax + r15 + 0x80]
xor cl, dl
or r11b, cl
movzx ecx, byte [rax + r15 + 0xa0]
xor cl, dl
or r10b, cl
movzx ecx, byte [rax + r15 + 0xc0]
xor cl, dl
movzx eax, bl
dec eax
movzx edx, dil
or r9b, cl
dec edx
or edx, eax
movzx ecx, r9b
dec ecx
movzx eax, r11b
dec eax
or edx, eax
movzx eax, r10b
dec eax
or eax, edx
or eax, ecx
movzx ecx, sil
dec ecx
or eax, ecx
movzx ecx, r8b
dec ecx
or eax, ecx
shr eax, 8
and eax, 1
mov rcx, qword [rsp + 8]
xor rcx, rsp
call fcn.180133f80
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x10
pop r15
pop r14
pop rdi
ret

Function at 0x1800e8510
Capabilities:
Encode data using add xor sub operations

Disassembly:
mov qword [rsp + 8], rbx
xor r9b, r9b
lea r8, [0x18016b860]
sub rcx, r8
mov r10b, 1
mov r11d, reloc.WLDAP32.dll_Ordinal_32
lea rbx, [rcx + 0x20]
nop
movzx edx, byte [rbx + r8 - 1]
lea r8, [r8 - 1]
movzx ecx, byte [r8]
mov eax, edx
sub eax, ecx
xor edx, ecx
sar eax, 8
dec edx
and al, r10b
sar edx, 8
or r9b, al
and r10b, dl
add r11d, 0xffffffff
jne 0x1800e8530
mov rbx, qword [rsp + 8]
xor eax, eax
test r9b, r9b
setne al
ret

Function at 0x1800e94b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rcx
xor eax, eax
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], eax
mov rcx, qword [rsp + 0x10]
movzx edx, byte [rcx + rax]
mov rcx, qword [rsp + 0x18]
movzx ecx, byte [rcx + rax]
inc rax
xor ecx, edx
or dword [rsp + 8], ecx
cmp rax, 0x10
jl 0x1800e94c0
mov eax, dword [rsp + 8]
dec eax
shr eax, 8
and eax, 1
dec eax
ret
Function at 0x1800e94f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rcx
xor eax, eax
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], eax
mov rcx, qword [rsp + 0x10]
movzx edx, byte [rcx + rax]
mov rcx, qword [rsp + 0x18]
movzx ecx, byte [rcx + rax]
inc rax
xor ecx, edx
or dword [rsp + 8], ecx
cmp rax, 0x20
jl 0x1800e9500
mov eax, dword [rsp + 8]
dec eax
shr eax, 8
and eax, 1
dec eax
ret
Function at 0x1800f0920
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x1d8
mov rax, qword [0x18040b070]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov ecx, 0x202
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x1800f0981
movzx eax, word [rsp + 0x20]
cmp al, 2
jne 0x1800f097b
shr ax, 8
cmp al, 2
jne 0x1800f097b
call fcn.1800f9230
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.180133f80
add rsp, 0x1d8
ret
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 2
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.180133f80
add rsp, 0x1d8
ret
Function at 0x1801007c0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0xe0
mov rax, qword [0x18040b070]
xor rax, rsp
mov qword [rsp + 0xd0], rax
cmp byte [rcx + 0x731], 0
mov r14, r9
mov rax, qword [rsp + 0x130]
mov rbp, r8
mov esi, edx
mov rdi, rcx
je 0x1801008ef
test rax, rax
je 0x1801008ef
mov rdx, qword [rax + 0xd8]
test rdx, rdx
je 0x1801008ef
mov ecx, esi
lea r9, str.Data
sub ecx, 1
je 0x18010084b
sub ecx, 1
je 0x18010083b
sub ecx, 1
je 0x180100852
cmp ecx, 1
je 0x180100842
jmp 0x1801008ef
lea r9, str.Header
lea rax, [0x18016cfa0]
jmp 0x180100859
lea r9, str.Header
lea rax, [0x18016cf98]
mov qword [rsp + 0x28], rdx
lea r8, str.__s__s__s_
mov edx, 0xa0
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x30]
call fcn.1801102f0
lea rax, [rsp + 0x30]
or rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x180100882
mov r10, qword [rdi + 0x2b8]
test r10, r10
je 0x1801008b9
mov rax, qword [rdi + 0x208]
lea r8, [rsp + 0x30]
mov r9, rbx
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rdi
call r10
test eax, eax
je 0x1801008ef
jmp 0x1801008ff
mov r9, qword [rdi + 0x200]
lea rcx, [0x18016cec8]
mov edx, 2
lea r8d, [rdx - 1]
call fcn.18014226c
mov r9, qword [rdi + 0x200]
lea rcx, [rsp + 0x30]
mov r8d, 1
mov rdx, rbx
call fcn.18014226c
mov r9, r14
mov r8, rbp
mov edx, esi
mov rcx, rdi
call fcn.180101330
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.180133f80
add rsp, 0xe0
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x180100c10
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r9
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
cmp rcx, 0xffffffffffffffff
jne 0x180100c4b
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, gethostname
mov edx, 0x51
cmp eax, 0x2733
cmove ecx, edx
mov eax, ecx
add rsp, 0x20
pop rbx
ret
mov qword [rbx], rcx
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x180100fa0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
xor eax, eax
mov rdi, r9
cmp rdx, qword [rcx + 0x240]
mov rsi, r8
mov r14, rcx
sete al
mov edx, eax
mov rbx, qword [rcx + rdx*8 + 0x238]
call fcn.180101230
xor r9d, r9d
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_send]
movsxd rdi, eax
cmp rdi, 0xffffffffffffffff
jne 0x180101040
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
cmp eax, 0x2733
jne 0x180101014
mov rcx, qword [rsp + 0x50]
lea eax, [rdi + 0x52]
mov qword [rcx], 0
jmp 0x18010104a
mov edx, ebx
mov rcx, r14
call fcn.1801124d0
mov rcx, qword [r14]
lea rdx, str.Send_failure:__s
mov r8, rax
call fcn.180100920
mov rax, qword [r14]
mov dword [rax + 0x4c7c], ebx
mov eax, gethostname
jmp 0x180101042
xor eax, eax
mov rcx, qword [rsp + 0x50]
mov qword [rcx], rdi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret