joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401a0170
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x1403aa6c8]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, rcx
mov rcx, rdx
call fcn.1401a0120
movsd xmm0, qword [rbx]
mov eax, dword [rbx + 8]
xor ebx, ebx
movsd qword [rsp + 0x20], xmm0
mov dword [rsp + 0x28], eax
call fcn.1401a0100
movzx ecx, byte [rsp + rbx + 0x20]
xor eax, ecx
movzx ecx, al
mov byte [rsp + rbx + 0x20], al
call fcn.1401a0320
inc rbx
cmp rbx, 0xc
jl 0x1401a01a3
mov rax, qword [0x1404bbe30]
movzx edx, byte [rsp + 0x2b]
movzx ecx, byte [0x1404cbec1]
test byte [rax + 0x28], 2
jne 0x1401a01e4
movzx ecx, byte [0x1404cbec7]
cmp edx, ecx
je 0x1401a01fe
or eax, 0xffffffff
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140229810
add rsp, 0x40
pop rbx
ret
mov rax, qword [0x1403dbe00]
mov rbx, qword [0x1404cbe50]
mov qword [rsp + 0x60], rdi
movsxd rdi, dword [0x1404cbe58]
cmp rdi, rax
cmovg edi, eax
test edi, edi
je 0x1401a023a
call fcn.1401a0100
xor byte [rbx], al
movzx ecx, byte [rbx]
call fcn.1401a0320
lea rbx, [rbx + 1]
sub edi, 1
jne 0x1401a0222
xor eax, eax
mov rdi, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140229810
add rsp, 0x40
pop rbx
ret

Function at 0x1401a0320
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov r8d, dword [0x1404cc114]
mov eax, ecx
mov r9, qword [0x1404cbe38]
mov r10d, ecx
mov edx, r8d
shr r8d, 8
xor rdx, rax
movzx eax, dl
mov edx, dword [r9 + rax*4]
xor edx, r8d
movzx eax, dl
add eax, dword [0x1404cc118]
imul ecx, eax, 0x8088405
mov dword [0x1404cc114], edx
inc ecx
mov edx, ecx
mov dword [0x1404cc118], ecx
mov ecx, dword [0x1404cc11c]
mov eax, ecx
shr edx, 0x18
xor rdx, rax
shr ecx, 8
movzx eax, dl
mov eax, dword [r9 + rax*4]
xor eax, ecx
mov dword [0x1404cc11c], eax
mov eax, r10d
ret
Function at 0x1401a0930
Capabilities:
Check mutex on windows

Disassembly:
sub rsp, 0x28
mov eax, dword [0x1403d29e8]
test eax, eax
je 0x1401a0948
mov eax, 1
add rsp, 0x28
ret
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor ecx, ecx
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov rdi, rax
test rax, rax
jne 0x1401a096e
mov rdi, qword [rsp + 0x20]
add rsp, 0x28
ret
mov qword [rsp + 0x30], rbx
mov rbx, rax
xchg qword [0x1403d29f0], rbx
test rbx, rbx
je 0x1401a09bf
mov rax, rbx
mov rcx, rdi
xchg qword [0x1403d29f0], rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
or edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [0x1403d29e8]
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x20]
add rsp, 0x28
ret
mov eax, dword [0x1403d29e8]
test eax, eax
jne 0x1401a09f9
lea rcx, [0x1403dbbc0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor edx, edx
lea rcx, [0x1403dbc00]
mov r8d, 0x120
call sub.VCRUNTIME140.dll_memset
call fcn.1401a0810
mov dword [0x1403d29e8], 1
xor eax, eax
mov rcx, rdi
xchg qword [0x1403d29f0], rax
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x30]
mov eax, 1
mov rdi, qword [rsp + 0x20]
add rsp, 0x28
ret
Function at 0x1401b5c10
Capabilities:
Generate random numbers via winapi
Get memory capacity

Disassembly:
push rbx
mov eax, 0xd0
call fcn.140229de0
sub rsp, rax
mov rax, qword [0x1403aa6c8]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov r9d, 1
mov dword [rsp + 0x20], 0xf0000040
xor r8d, r8d
lea rcx, [rsp + 0x30]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov ebx, 0x40
test eax, eax
je 0x1401b5ca2
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x80]
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x1401b5c95
xorps xmm2, xmm2
cvtsi2sd xmm2, rbx
test rbx, rbx
jns 0x1401b5c86
addsd xmm2, qword [0x140290b20]
mov edx, ebx
lea rcx, [rsp + 0x80]
call fcn.140117e10
mov rcx, qword [rsp + 0x30]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov r9d, 0x16
mov dword [rsp + 0x20], 0xf0000040
lea r8, str.Intel_Hardware_Cryptographic_Service_Provider
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1401b5d12
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x80]
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x1401b5d05
xorps xmm2, xmm2
cvtsi2sd xmm2, rbx
test rbx, rbx
jns 0x1401b5cf6
addsd xmm2, qword [0x140290b20]
mov edx, ebx
lea rcx, [rsp + 0x80]
call fcn.140117e10
mov rcx, qword [rsp + 0x30]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
cmp dword [0x1403aa0c8], 0
je 0x1401b5d4d
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
jne 0x1401b5d32
mov dword [0x1403aa0c8], eax
jmp 0x1401b5d4d
xorps xmm2, xmm2
lea rcx, [rsp + 0x40]
mov edx, 8
call fcn.140117e10
cmp dword [0x1403aa0c8], 0
jne 0x1401b5d69
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xorps xmm2, xmm2
lea rcx, [rsp + 0x38]
mov edx, 4
mov dword [rsp + 0x38], eax
call fcn.140117e10
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
movsd xmm2, qword [0x14024c270]
lea rcx, [rsp + 0x48]
mov edx, 0x38
call fcn.140117e10
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
movsd xmm2, qword [0x14024c270]
lea rcx, [rsp + 0x3c]
mov edx, 4
mov dword [rsp + 0x3c], eax
call fcn.140117e10
mov eax, 1
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.140229810
add rsp, 0xd0
pop rbx
ret
Function at 0x1401c4c60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x30
call fcn.140229de0
sub rsp, rax
mov rdi, r8
mov r14, rdx
mov r8, qword [rsp + 0xa0]
mov r15, rcx
mov ebx, dword [r8]
mov dword [rsp + 0x80], ebx
test ebx, ebx
je 0x1401c4cd8
mov rdx, qword [rsp + 0x98]
nop dword [rax]
test rdi, rdi
je 0x1401c4cd1
mov eax, ebx
dec rdi
movzx ecx, byte [rax + rdx]
xor cl, byte [r15]
inc r15
mov byte [r14], cl
inc r14
inc ebx
and ebx, 0xf
jne 0x1401c4cb0
mov dword [rsp + 0x80], ebx
mov rcx, qword [rsp + 0x90]
mov esi, recv
movzx r13d, byte [rcx + 0xc]
lea r12, [rcx + 0xc]
mov r10, qword [rsp + 0xa8]
shl r13d, 8
movzx eax, byte [rcx + 0xd]
lea ebp, [rsi - 0xb]
or r13d, eax
movzx eax, byte [rcx + 0xe]
shl r13d, 8
or r13d, eax
movzx eax, byte [rcx + 0xf]
shl r13d, 8
or r13d, eax
cmp rdi, 0x10
jb 0x1401c4dfd
mov eax, 0x10000000
mov ebx, esi
nop dword [rax + rax]
mov rsi, rdi
shr rsi, 4
cmp rsi, rax
cmova rsi, rax
add r13d, esi
mov eax, r13d
cmp rax, rsi
jae 0x1401c4d4f
sub rsi, rax
xor r13d, r13d
mov qword [rsp + 0x20], rcx
mov r8, rsi
mov rcx, r15
mov rdx, r14
call r10
mov rcx, qword [rsp + 0x90]
mov eax, r13d
shr eax, 0x18
mov byte [r12], al
mov eax, r13d
shr eax, 0x10
mov byte [rcx + 0xd], al
mov eax, r13d
shr eax, 8
mov byte [rcx + 0xe], al
mov byte [rcx + 0xf], r13b
test r13d, r13d
jne 0x1401c4dbd
mov r8d, ebx
mov ecx, ebp
mov rdx, r12
nop word [rax + rax]
movzx eax, byte [rdx - 1]
lea rdx, [rdx - 1]
add ecx, eax
mov byte [rdx], cl
shr ecx, 8
add r8d, 0xffffffff
jne 0x1401c4da0
mov rcx, qword [rsp + 0x90]
mov r9, qword [rsp + 0x88]
mov eax, 0x10000000
mov r10, qword [rsp + 0xa8]
shl rsi, 4
sub rdi, rsi
add r14, rsi
add r15, rsi
cmp rdi, 0x10
jae 0x1401c4d30
mov ebx, dword [rsp + 0x80]
mov esi, recv
mov r8, qword [rsp + 0xa0]
test rdi, rdi
je 0x1401c4eb2
mov rax, qword [rsp + 0x98]
xor edx, edx
mov qword [rsp + 0x20], rcx
mov r8, rbp
mov rcx, rax
mov qword [rax], rdx
mov qword [rax + 8], rdx
mov rdx, rax
call r10
mov rcx, qword [rsp + 0x90]
inc r13d
mov eax, r13d
shr eax, 0x18
mov byte [r12], al
mov eax, r13d
shr eax, 0x10
mov byte [rcx + 0xd], al
mov eax, r13d
shr eax, 8
mov byte [rcx + 0xe], al
mov byte [rcx + 0xf], r13b
test r13d, r13d
jne 0x1401c4e79
nop dword [rax + rax]
movzx eax, byte [r12 - 1]
lea r12, [r12 - 1]
add ebp, eax
mov byte [r12], bpl
shr ebp, 8
add esi, 0xffffffff
jne 0x1401c4e60
mov rdx, qword [rsp + 0x98]
nop dword [rax]
nop word [rax + rax]
mov ecx, ebx
inc ebx
movzx eax, byte [rcx + r15]
xor al, byte [rcx + rdx]
mov byte [rcx + r14], al
sub rdi, 1
jne 0x1401c4e90
mov rax, qword [rsp + 0xa0]
mov dword [rax], ebx
jmp 0x1401c4eb5
mov dword [r8], ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401c5580
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
mov eax, 0x20
call fcn.140229de0
sub rsp, rax
cmp qword [rcx + 0x38], 0
mov rbx, r8
mov r14, rdx
mov rsi, rcx
je 0x1401c55bf
mov eax, 0xfffffffe
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov rcx, qword [rcx + 0x30]
movabs rax, 0x2000000000000000
add rcx, rbx
cmp rcx, rax
ja 0x1401c5690
cmp rcx, rbx
jb 0x1401c5690
mov qword [rsp + 0x38], rdi
mov edi, dword [rsi + 0x174]
mov qword [rsi + 0x30], rcx
test edi, edi
je 0x1401c5624
test rbx, rbx
je 0x1401c5613
movzx eax, byte [r14]
dec rbx
mov ecx, edi
inc r14
xor byte [rcx + rsi + 0x40], al
inc edi
and edi, 0xf
jne 0x1401c55f5
jmp 0x1401c5617
test edi, edi
jne 0x1401c5672
lea rdx, [rsi + 0x60]
lea rcx, [rsi + 0x40]
call fcn.1401c69e0
mov qword [rsp + 0x30], rbp
mov rbp, rbx
and rbp, 0xfffffffffffffff0
je 0x1401c564b
lea rdx, [rsi + 0x60]
mov r9, rbp
lea rcx, [rsi + 0x40]
mov r8, r14
call fcn.1401c6810
add r14, rbp
sub rbx, rbp
mov rbp, qword [rsp + 0x30]
test rbx, rbx
je 0x1401c5672
mov edi, ebx
lea rcx, [rsi + 0x40]
sub r14, rsi
nop
movzx eax, byte [r14 + rcx - 0x40]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub rbx, 1
jne 0x1401c5660
mov dword [rsi + 0x174], edi
xor eax, eax
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov rbx, qword [rsp + 0x40]
or eax, 0xffffffff
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1401c6810
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
push r15
mov rsi, rcx
lea r14, [r8 + 0xe]
sub rsi, r8
lea r13, [0x140302c70]
mov r12, r9
mov rbp, rdx
mov r11, rcx
nop word [rax + rax]
movzx eax, byte [r11 + 0xf]
mov rdi, r14
movzx ecx, byte [r14 + 1]
mov r15d, send
xor rcx, rax
mov r9, rcx
and ecx, 0xf
add rcx, rcx
and r9, 0xfffffffffffffff0
mov r8, qword [rbp + rcx*8]
mov rcx, qword [rbp + rcx*8 + 8]
mov rax, r8
mov rdx, rcx
shr r8, 4
and edx, 0xf
shl rax, 0x3c
shr rcx, 4
or rax, rcx
mov rbx, qword [r13 + rdx*8]
xor rbx, r8
xor rbx, qword [r9 + rbp]
xor rax, qword [r9 + rbp + 8]
nop word [rax + rax]
movzx ecx, byte [rdi]
mov r9, rbx
movzx edx, byte [rsi + rdi]
lea rdi, [rdi - 1]
xor rdx, rcx
shr rbx, 4
mov rcx, rax
shl r9, 0x3c
shr rax, 4
and ecx, 0xf
or r9, rax
mov r10, rdx
and r10, 0xfffffffffffffff0
and edx, 0xf
add rdx, rdx
mov r8, qword [r13 + rcx*8]
xor r8, rbx
xor r9, qword [rbp + rdx*8 + 8]
xor r8, qword [rbp + rdx*8]
mov rcx, r9
and ecx, 0xf
shr r9, 4
mov rax, r8
shr r8, 4
shl rax, 0x3c
or rax, r9
mov rbx, qword [r13 + rcx*8]
xor rax, qword [r10 + rbp + 8]
xor rbx, r8
xor rbx, qword [r10 + rbp]
sub r15, 1
jne 0x1401c68b0
mov rdx, rbx
mov byte [r11 + 7], bl
shr rdx, 0x20
add r14, 0x10
mov ecx, edx
mov byte [r11 + 3], dl
shr ecx, 0x18
sub rsi, 0x10
mov byte [r11], cl
mov ecx, edx
shr ecx, 0x10
mov byte [r11 + 1], cl
mov ecx, edx
shr ecx, 8
mov rdx, rax
mov byte [r11 + 2], cl
mov ecx, ebx
shr ecx, 0x18
mov byte [r11 + 4], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [r11 + 5], cl
mov ecx, ebx
shr ecx, 8
mov byte [r11 + 6], cl
shr rdx, 0x20
mov ecx, edx
mov byte [r11 + 0xb], dl
shr ecx, 0x18
mov byte [r11 + 8], cl
mov ecx, edx
shr ecx, 0x10
mov byte [r11 + 9], cl
mov ecx, edx
shr ecx, 8
mov byte [r11 + 0xa], cl
mov ecx, eax
shr ecx, 0x18
mov byte [r11 + 0xc], cl
mov ecx, eax
shr ecx, 0x10
mov byte [r11 + 0xd], cl
mov ecx, eax
shr ecx, 8
mov byte [r11 + 0xe], cl
mov byte [r11 + 0xf], al
sub r12, 0x10
jne 0x1401c6850
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
pop r15
pop r14
pop r13
pop r12
ret
Function at 0x1401c69e0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
movzx eax, byte [rcx + 0xf]
lea r14, [0x140302c70]
mov r10d, eax
mov rdi, rdx
and eax, 0xf
and r10, 0xfffffffffffffff0
add rax, rax
mov esi, recv
mov r9, qword [rdx + rax*8]
mov r8, qword [rdx + rax*8 + 8]
mov r11, r9
mov rax, r8
shr r9, 4
and eax, 0xf
shl r11, 0x3c
shr r8, 4
or r11, r8
mov rbx, qword [r14 + rax*8]
xor rbx, r9
xor rbx, qword [r10 + rdx]
xor r11, qword [r10 + rdx + 8]
nop word [rax + rax]
movzx edx, byte [rsi + rcx]
mov rax, r11
shr r11, 4
mov r9, rbx
shr rbx, 4
and eax, 0xf
shl r9, 0x3c
mov r10d, edx
or r9, r11
and r10, 0xfffffffffffffff0
and edx, 0xf
mov r8, qword [r14 + rax*8]
add rdx, rdx
xor r8, rbx
xor r9, qword [rdi + rdx*8 + 8]
xor r8, qword [rdi + rdx*8]
mov rax, r9
and eax, 0xf
shr r9, 4
mov r11, r8
shr r8, 4
shl r11, 0x3c
or r11, r9
mov rbx, qword [r14 + rax*8]
xor r11, qword [r10 + rdi + 8]
xor rbx, r8
xor rbx, qword [r10 + rdi]
sub rsi, 1
jns 0x1401c6a50
mov rsi, qword [rsp + 0x10]
mov rdx, rbx
mov rdi, qword [rsp + 0x18]
mov r14, qword [rsp + 0x20]
shr rdx, 0x20
mov eax, edx
mov byte [rcx + 3], dl
shr eax, 0x18
mov byte [rcx], al
mov eax, edx
shr eax, 0x10
mov byte [rcx + 1], al
mov eax, edx
shr eax, 8
mov rdx, r11
mov byte [rcx + 2], al
mov eax, ebx
shr eax, 0x18
mov byte [rcx + 4], al
mov eax, ebx
shr eax, 0x10
mov byte [rcx + 5], al
mov eax, ebx
shr eax, 8
mov byte [rcx + 6], al
shr rdx, 0x20
mov eax, edx
mov byte [rcx + 7], bl
mov rbx, qword [rsp + 8]
shr eax, 0x18
mov byte [rcx + 8], al
mov eax, edx
shr eax, 0x10
mov byte [rcx + 9], al
mov eax, edx
shr eax, 8
mov byte [rcx + 0xa], al
mov eax, r11d
shr eax, 0x18
mov byte [rcx + 0xc], al
mov eax, r11d
shr eax, 0x10
mov byte [rcx + 0xd], al
mov eax, r11d
shr eax, 8
mov byte [rcx + 0xe], al
mov byte [rcx + 0xb], dl
mov byte [rcx + 0xf], r11b
ret
Function at 0x1401c9250
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Encrypt data using salsa20 or chacha

Disassembly:
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x3f]
mov eax, 0xb0
call fcn.140229de0
sub rsp, rax
mov rax, qword [0x1403aa6c8]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov rax, qword [rbp + 0x7f]
mov r14, r8
mov dword [rbp - 0x11], 0x61707865
mov rsi, rdx
mov dword [rbp - 0xd], 0x3320646e
mov rdi, rcx
mov dword [rbp - 9], 0x79622d32
mov dword [rbp - 5], 0x6b206574
movups xmm0, xmmword [r9]
movups xmm1, xmmword [r9 + 0x10]
movups xmmword [rbp - 1], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xf], xmm1
movups xmmword [rbp + 0x1f], xmm0
test r8, r8
je 0x1401c93e4
mov qword [rsp + 0xd8], rbx
nop dword [rax + rax]
mov ebx, 0x40
lea rdx, [rbp - 0x11]
cmp r14, rbx
lea rcx, [rbp - 0x51]
cmovb rbx, r14
call fcn.1401c9410
xor eax, eax
test rbx, rbx
je 0x1401c93ca
cmp rbx, 0x20
jb 0x1401c9395
lea rdx, [rdi - 1]
add rdx, rbx
lea rcx, [rbp + rbx - 0x52]
cmp rdi, rcx
ja 0x1401c9318
lea rcx, [rbp - 0x51]
cmp rdx, rcx
jae 0x1401c9395
lea rcx, [rsi - 1]
add rcx, rbx
cmp rdi, rcx
ja 0x1401c9329
cmp rdx, rsi
jae 0x1401c9395
lea rcx, [rbp - 0x51]
mov rdx, rsi
sub rdx, rcx
mov r9, rbx
lea rcx, [rbp - 0x51]
and r9, 0xffffffffffffffe0
mov r8, rdi
sub r8, rcx
nop dword [rax]
nop dword [rax + rax]
movdqu xmm0, xmmword [rbp + rax - 0x51]
lea rcx, [rdx + rax]
movdqu xmm1, xmmword [rbp + rcx - 0x51]
lea rcx, [r8 + rax]
pxor xmm1, xmm0
movdqu xmm0, xmmword [rbp + rax - 0x41]
movdqu xmmword [rbp + rcx - 0x51], xmm1
lea rcx, [rdx + rax]
movdqu xmm1, xmmword [rbp + rcx - 0x41]
lea rcx, [r8 + rax]
add rax, 0x20
pxor xmm1, xmm0
movdqu xmmword [rbp + rcx - 0x41], xmm1
cmp rax, r9
jb 0x1401c9350
cmp rax, rbx
jae 0x1401c93ca
lea rcx, [rbp - 0x51]
mov r8, rsi
sub r8, rcx
mov r9, rdi
lea rcx, [rbp - 0x51]
sub r9, rcx
nop
lea rdx, [rbp - 0x51]
add rdx, rax
inc rax
movzx ecx, byte [r8 + rdx]
xor cl, byte [rdx]
mov byte [r9 + rdx], cl
cmp rax, rbx
jb 0x1401c93b0
inc dword [rbp + 0x1f]
add rdi, rbx
add rsi, rbx
sub r14, rbx
jne 0x1401c92d0
mov rbx, qword [rsp + 0xd8]
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.140229810
mov rsi, qword [rsp + 0xe0]
add rsp, 0xb0
pop r14
pop rdi
pop rbp
ret
Function at 0x1401cc7d0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x38
call fcn.140229de0
sub rsp, rax
cmp dword [rsp + 0x68], 0
je 0x1401cc7f9
lea rax, [0x1401cada0]
mov qword [rsp + 0x68], rax
add rsp, 0x38
jmp fcn.1401c4890
lea rax, [0x1401c9f00]
mov qword [rsp + 0x68], rax
add rsp, 0x38
jmp fcn.1401c45c0

Function at 0x1401d1989
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x1401d1b7a
push rbx
mov eax, 0xd0
call fcn.140229de0
sub rsp, rax
mov rax, qword [0x1403aa6c8]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xe8], rbp
mov rbx, rdx
mov qword [rsp + 0xf0], rsi
lea rbp, [r8 - 1]
mov qword [rsp + 0xf8], rdi
mov qword [rsp + 0xc8], r14
lea r14, [rcx + 0xc]
shr rbp, 3
mov qword [rsp + 0xc0], r15
inc rbp
lea r15, [rcx + 0x14]
nop word [rax + rax]
movzx eax, byte [rbx + 1]
mov rcx, r14
movzx edi, byte [rbx]
movzx esi, byte [rbx + 4]
lea rbx, [rbx + 8]
shl eax, 8
or edi, eax
movzx eax, byte [rbx - 6]
shl eax, 0x10
or edi, eax
movzx eax, byte [rbx - 5]
shl eax, 0x18
or edi, eax
movzx eax, byte [rbx - 3]
shl eax, 8
or esi, eax
mov dword [rsp + 0x20], edi
movzx eax, byte [rbx - 2]
shl eax, 0x10
or esi, eax
mov dword [rsp + 0x28], edi
movzx eax, byte [rbx - 1]
and byte [r14], 0xdf
and byte [r15], 0xbf
or byte [r14], 0x40
or byte [r15], 0x20
shl eax, 0x18
or esi, eax
mov dword [rsp + 0x24], esi
mov dword [rsp + 0x2c], esi
call fcn.140174c70
lea rdx, [rsp + 0x30]
mov rcx, r14
call fcn.1401749c0
mov r8d, 1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x28]
call fcn.140170f40
mov rcx, r15
call fcn.140174c70
lea rdx, [rsp + 0x30]
mov rcx, r15
call fcn.1401749c0
mov r8d, 1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call fcn.140170f40
mov r8d, dword [rsp + 0x20]
mov edx, dword [rsp + 0x24]
xor r8d, edi
xor edi, dword [rsp + 0x28]
xor edx, esi
xor esi, dword [rsp + 0x2c]
mov eax, edi
mov byte [r14], dil
shr eax, 8
mov byte [r14 + 1], al
mov eax, edi
shr eax, 0x10
mov byte [r14 + 2], al
mov eax, edx
shr eax, 8
shr edi, 0x18
mov byte [r14 + 3], dil
mov byte [r14 + 4], dl
mov byte [r14 + 5], al
mov eax, edx
shr eax, 0x10
mov byte [r14 + 6], al
mov eax, r8d
shr eax, 8
shr edx, 0x18
mov byte [r14 + 7], dl
mov byte [r15], r8b
mov byte [r15 + 1], al
mov eax, r8d
shr eax, 0x10
mov byte [r15 + 2], al
shr r8d, 0x18
mov byte [r15 + 3], r8b
mov byte [r15 + 4], sil
mov eax, esi
shr eax, 8
mov byte [r15 + 5], al
mov eax, esi
shr eax, 0x10
shr esi, 0x18
mov byte [r15 + 6], al
mov byte [r15 + 7], sil
sub rbp, 1
jne 0x1401d19f0
mov r15, qword [rsp + 0xc0]
mov r14, qword [rsp + 0xc8]
mov rdi, qword [rsp + 0xf8]
mov rsi, qword [rsp + 0xf0]
mov rbp, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140229810
add rsp, 0xd0
pop rbx
ret
Function at 0x1402208f0
Capabilities:
Create directory

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x140220939
mov rax, qword [rcx]
call qword [rax + 0x48]
mov rcx, rax
call fcn.1402284c0
test eax, eax
jne 0x140220933
mov rcx, rbx
call fcn.1402206e0
mov rcx, rax
mov rdx, qword [rax]
call qword [rdx + 0x48]
xor r8d, r8d
xor edx, edx
mov rcx, rax
add rsp, 0x20
pop rbx
jmp 0x140227fc0
add rsp, 0x20
pop rbx
ret
call fcn.14021ada0
int3
push rbx
sub rsp, 0x20
mov rax, r8
mov rbx, rcx
mov r8, rdx
mov rdx, rcx
mov rcx, rax
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
test eax, eax
jne 0x140227fe5
add rsp, 0x20
pop rbx
ret
mov r8, rbx
lea rdx, str.SHCreateDirectory__S__failed
mov ecx, eax
call fcn.140228b00
int3

Function at 0x140221bc0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov esi, r8d
mov rbx, rdx
mov rbp, rcx
mov ecx, 0x40
call fcn.1402176f0
mov rdi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140221c5b
mov r8, rbx
mov rdx, rbp
mov rcx, rax
call fcn.1402216d0
lea rax, vtable.vcfoundation::thread::Thread.0
mov qword [rdi], rax
lea rax, vtable.vcfoundation::thread::Thread.1.0
mov qword [rdi + 0x10], rax
mov qword [rdi + 0x30], 0xffffffffffffffff
lea rbx, [rdi + 0x38]
mov dword [rbx], 0
mov rcx, rdi
call fcn.140217bf0
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0
mov r9, rdi
lea r8, [0x140221d90]
mov edx, esi
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rdi + 0x30], rax
mov rax, rdi
jmp 0x140221c5d
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x140222d30
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rdx, rcx
lea rcx, [rsp + 0x30]
call fcn.140228550
nop
mov rdi, qword [rbx + 0x50]
cmp rdi, 0xffffffffffffffff
je 0x140222d7b
lea rcx, [rsp + 0x30]
call fcn.140228580
mov edx, 0x8f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rax, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
lea rcx, str.Process_not_launched
call fcn.140219e80
int3
Function at 0x140226c20
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
movsxd r15, edx
xor r14d, r14d
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x20], xmm0
mov ebp, r14d
mov qword [rsp + 0x30], r14
test edx, edx
je 0x140226cec
movabs rax, 0x1fffffffffffffff
cmp r15, rax
ja 0x140226e19
lea rbx, [r15*8]
cmp rbx, 0x1000
jb 0x140226cad
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140226e13
call fcn.140229738
test rax, rax
je 0x140226de3
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140226cc2
test rbx, rbx
je 0x140226cbf
mov rcx, rbx
call fcn.140229738
mov rdi, rax
jmp 0x140226cc2
mov rdi, r14
mov qword [rsp + 0x20], rdi
lea rbp, [rbx + rdi]
mov qword [rsp + 0x30], rbp
mov r8, rbx
xor edx, edx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memset
mov r13, rbp
mov qword [rsp + 0x28], rbp
mov rcx, qword [rsp + 0x70]
jmp 0x140226cf6
mov r13, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x20]
dec r15d
mov r12, qword [rcx + 0x10]
lea r14, [rcx + 8]
mov rbx, qword [r14]
cmp rbx, r12
je 0x140226d6e
nop dword [rax]
mov rsi, qword [rbx]
test rsi, rsi
je 0x140226d60
nop dword [rax + rax]
mov rcx, qword [rsi + 8]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov ecx, eax
shl ecx, 9
not ecx
add eax, ecx
mov ecx, eax
shr ecx, 0xe
xor ecx, eax
imul edx, ecx, 0x11
mov eax, edx
shr eax, 0xa
xor edx, eax
and edx, r15d
movsxd rcx, edx
mov rdx, qword [rsi]
mov rax, qword [rdi + rcx*8]
mov qword [rsi], rax
mov qword [rdi + rcx*8], rsi
mov rsi, rdx
test rdx, rdx
jne 0x140226d20
add rbx, 8
cmp rbx, r12
jne 0x140226d10
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x20]
cmp r14, rax
je 0x140226d90
mov rax, qword [r14]
mov qword [r14], rdi
mov rdi, rax
mov qword [r14 + 8], r13
mov rax, qword [r14 + 0x10]
mov qword [r14 + 0x10], rbp
mov rbp, rax
mov rax, qword [r14 + 8]
sub rax, qword [r14]
sar rax, 3
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mulsd xmm0, qword [0x1403287d8]
cvttsd2si eax, xmm0
mov dword [rcx + 0x24], eax
mov dword [rcx + 0x20], r15d
test rdi, rdi
je 0x140226df5
sub rbp, rdi
and rbp, 0xfffffffffffffff8
mov rax, rdi
cmp rbp, 0x1000
jb 0x140226dea
add rbp, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140226dea
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, rbp
mov rcx, rdi
call fcn.140229774
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.140054bd0
int3
call fcn.14005c830
int3

Function at 0x1402279d0
Capabilities:
Accept command line arguments

Disassembly:
sub rsp, 0x28
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
test rax, rax
je 0x1402279e4
add rsp, 0x28
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x1403291d8]
call fcn.140228d40
int3