joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003b88
Capabilities:
Enumerate processes
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x260
mov rdi, rdx
mov dword [rsp + 0x20], 0x238
mov rsi, rcx
lea rdx, [rsp + 0x20]
mov rcx, rdi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x140003bfe
lea rdx, [rsp + 0x4c]
mov rcx, rsi
call fcn.140159ed0
test eax, eax
jne 0x140003bf1
mov r8d, dword [rsp + 0x28]
xor edx, edx
mov ecx, 0x401
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rcx, rax
xor edx, edx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call sub.KERNEL32.dll_Process32NextW
cmp eax, 1
je 0x140003bb7
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x140003c24
Capabilities:
Stop service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rsi, rdx
mov rdi, rcx
xor ebx, ebx
call fcn.1400038a8
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbp, rax
test rax, rax
je 0x140003ce3
lea r8d, [rbx + 0x20]
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
je 0x140003cc0
lea r8, [rsp + 0x20]
mov rcx, rax
lea edx, [rbx + 1]
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x140003c9d
mov ecx, 0x7d0
mov bl, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140003cb5
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.03__d
mov rcx, rsi
mov r8d, eax
call fcn.14000870c
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140003cd8
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.02__d
mov rcx, rsi
mov r8d, eax
call fcn.14000870c
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140003cfb
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.01__d
mov rcx, rsi
mov r8d, eax
call fcn.14000870c
mov rbp, qword [rsp + 0x58]
mov al, bl
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140003d64
Capabilities:
Enumerate processes
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x260
mov rsi, rcx
mov dword [rsp + 0x20], 0x238
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
lea ecx, [rbx + 2]
mov ebp, eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140003e11
lea rdx, [rsp + 0x20]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
jmp 0x140003e03
lea rdx, [rsp + 0x4c]
mov rcx, rsi
call fcn.140159ed0
mov r8d, dword [rsp + 0x28]
cmp r8d, ebp
je 0x140003df6
test eax, eax
jne 0x140003df6
xor edx, edx
mov ecx, 0x401
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rcx, rax
xor edx, edx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 1
lea rdx, [rsp + 0x20]
mov rcx, rdi
call sub.KERNEL32.dll_Process32NextW
cmp eax, 1
je 0x140003db2
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0x260]
mov eax, ebx
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140012ff0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r8, rcx
or eax, 0xffffffff
movzx ecx, byte [rcx]
test cl, cl
je 0x14001309a
movzx edx, cl
lea r8, [r8 + 1]
xor eax, edx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
movzx ecx, byte [r8]
test cl, cl
jne 0x140013001
not eax
ret

Function at 0x1400133b0
Capabilities:
Create pipe
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
sub rsp, 0x60
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x80], rbx
movzx esi, r8b
mov rdi, rdx
mov rbx, rcx
xor ebp, ebp
cmp dword [rcx + 0x20], ebp
je 0x140013421
mov dword [rcx + 0x20], ebp
cmp qword [rcx + 0x60], 0xffffffffffffffff
je 0x14001340e
mov rcx, qword [rcx + 0x60]
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rcx, qword [rbx + 0x60]
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov rcx, qword [rbx + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x60], 0xffffffffffffffff
mov rcx, qword [rbx + 0x58]
test rcx, rcx
je 0x140013421
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x58], rbp
cmp rbx, rdi
je 0x140013438
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
call fcn.14000ca10
test sil, sil
je 0x1400134f3
mov ecx, Ordinal_41
call fcn.14015301c
mov qword [rsp + 0x50], rax
mov edx, 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
mov dword [rsp + 0x48], Ordinal_30
mov dword [rsp + 0x58], 1
cmp qword [rbx + 0x18], 0x10
jb 0x14001348f
mov rcx, qword [rbx]
jmp 0x140013492
mov rcx, rbx
lea rax, [rsp + 0x48]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x28], 0x200
mov dword [rsp + 0x20], 0x200
mov r9d, VarUI2FromI4
xor r8d, r8d
mov edx, 0x80003
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov qword [rbx + 0x68], rax
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400134d7
call fcn.140153014
cmp qword [rbx + 0x68], 0xffffffffffffffff
jne 0x1400134ea
mov rcx, rdi
call fcn.14000c7e0
xor al, al
jmp 0x140013539
lea r8, [0x140014140]
jmp 0x1400134fa
lea r8, [0x140013fc0]
lea rax, [rsp + 0x90]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x90], ebp
mov r9, rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x58], rax
cmp rax, rbp
je 0x1400134de
mov dword [rbx + 0x20], 1
mov rcx, rdi
call fcn.14000c7e0
mov al, 1
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400142b0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x30
xor r15d, r15d
mov ebp, r8d
mov dword [rsp + 0x60], r15d
mov rdi, rdx
mov r14, rcx
mov ebx, r15d
mov esi, r8d
test r8d, r8d
jle 0x140014328
nop dword [rax]
nop dword [rax + rax]
lea r9, [rsp + 0x60]
mov qword [rsp + 0x20], r15
mov r8d, esi
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140014322
mov eax, dword [rsp + 0x60]
test eax, eax
je 0x140014322
add ebx, eax
sub esi, eax
add rdi, rax
cmp ebx, ebp
jl 0x1400142f0
jmp 0x140014328
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rsi, qword [rsp + 0x68]
cmp ebx, ebp
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
sete al
add rsp, 0x30
pop r15
pop r14
pop rdi
ret

Function at 0x140014350
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x30
xor r15d, r15d
mov ebp, r8d
mov rdi, rdx
mov r14, rcx
mov ebx, r15d
mov esi, r8d
test r8d, r8d
jle 0x1400143ac
nop
lea r9, [rsp + 0x60]
mov qword [rsp + 0x20], r15
mov r8d, esi
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400143ca
mov eax, dword [rsp + 0x60]
add ebx, eax
sub esi, eax
add rdi, rax
cmp ebx, ebp
jl 0x140014380
cmp ebx, ebp
sete al
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
xor al, al
jmp 0x1400143b1

Function at 0x1400150c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov edi, r8d
mov rsi, rdx
mov rbx, rcx
xor eax, eax
mov r9d, eax
mov r10d, eax
cmp r10d, edi
jae 0x14001514e
inc eax
and eax, 0x800000ff
jge 0x1400150f7
dec eax
or eax, 0xffffff00
inc eax
movsxd r8, eax
movzx r11d, byte [r8 + rbx]
add r9d, r11d
and r9d, 0x800000ff
jge 0x140015118
dec r9d
or r9d, 0xffffff00
inc r9d
movsxd rdx, r9d
add rdx, rbx
movzx ecx, byte [rdx]
mov byte [r8 + rbx], cl
mov byte [rdx], r11b
movzx edx, byte [r8 + rbx]
mov r8d, r10d
add rdx, r11
movzx ecx, dl
movzx edx, byte [rcx + rbx]
movzx ecx, byte [r8 + rsi]
xor edx, ecx
mov byte [r8 + rsi], dl
inc r10d
jmp 0x1400150e0
mov al, 1
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
Function at 0x140016c20
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rbx, rdx
lea r9, [rcx + 0xf0]
mov rsi, rcx
test r8d, r8d
je 0x140016c99
dec rdi
shr rdi, 4
inc rdi
nop dword [rax]
nop word [rax + rax]
mov rax, rbx
sub r9, rbx
mov edx, reloc.WS2_32.dll_recv
nop dword [rax + rax]
movzx ecx, byte [r9 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x140016c70
mov rdx, rsi
mov rcx, rbx
call fcn.1400171e0
mov r9, rbx
add rbx, 0x10
sub rdi, 1
jne 0x140016c60
movups xmm0, xmmword [r9]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
movups xmmword [rsi + 0xf0], xmm0
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140016cc0
Capabilities:
Encode data using xor

Disassembly:
test r8d, r8d
je 0x140016d5b
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov qword [rsp + 0x30], rbp
mov rbx, rdx
mov qword [rsp + 0x38], rdi
mov r14, rcx
lea rdi, [rcx + 0xf0]
mov esi, r8d
sub rdi, rdx
dec rsi
shr rsi, 4
inc rsi
movups xmm0, xmmword [rbx]
mov rdx, r14
mov rcx, rbx
call fcn.140017420
mov ecx, reloc.WS2_32.dll_recv
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdi + rbx]
xor byte [rbx], al
inc rbx
sub rcx, 1
jne 0x140016d20
sub rdi, 0x10
movups xmmword [r14 + 0xf0], xmm0
sub rsi, 1
jne 0x140016d00
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1400171e0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rsi, rdx
mov rbx, rcx
sub rsi, rcx
mov r8, rcx
mov r9d, 4
nop dword [rax]
mov ecx, 4
nop word [rax + rax]
movzx eax, byte [rsi + r8]
xor byte [r8], al
inc r8
sub rcx, 1
jne 0x140017220
sub r9, 1
jne 0x140017210
lea rdi, [rsi + 0x10]
lea ebp, [rcx + 0xd]
lea r14, [0x140246b10]
nop word [rax + rax]
mov r8, rbx
mov r9d, 4
nop dword [rax]
mov rcx, r8
mov edx, 4
nop dword [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 4]
movzx eax, byte [rax + r14]
mov byte [rcx - 4], al
sub rdx, 1
jne 0x140017270
inc r8
sub r9, 1
jne 0x140017260
movzx ecx, byte [rbx + 1]
movzx eax, byte [rbx + 5]
mov byte [rbx + 1], al
movzx eax, byte [rbx + 9]
mov byte [rbx + 5], al
movzx eax, byte [rbx + 0xd]
mov byte [rbx + 9], al
movzx eax, byte [rbx + 0xa]
mov byte [rbx + 0xd], cl
movzx ecx, byte [rbx + 2]
mov byte [rbx + 2], al
movzx eax, byte [rbx + 0xe]
mov byte [rbx + 0xa], cl
movzx ecx, byte [rbx + 6]
mov byte [rbx + 6], al
movzx eax, byte [rbx + 0xf]
mov byte [rbx + 0xe], cl
movzx ecx, byte [rbx + 3]
mov byte [rbx + 3], al
movzx eax, byte [rbx + 0xb]
mov byte [rbx + 0xf], al
movzx eax, byte [rbx + 7]
mov byte [rbx + 7], cl
mov rcx, rbx
mov byte [rbx + 0xb], al
call fcn.140017b00
mov rax, rbx
mov r8d, 4
nop dword [rax]
nop word [rax + rax]
mov edx, 4
nop word [rax + rax]
movzx ecx, byte [rdi + rax]
xor byte [rax], cl
inc rax
sub rdx, 1
jne 0x140017310
sub r8, 1
jne 0x140017300
add rdi, 0x10
sub rbp, 1
jne 0x140017250
mov r8, rbx
lea r9d, [rdx + 4]
nop word [rax + rax]
mov rcx, r8
mov edx, 4
nop dword [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 4]
movzx eax, byte [rax + r14]
mov byte [rcx - 4], al
sub rdx, 1
jne 0x140017350
inc r8
sub r9, 1
jne 0x140017340
movzx eax, byte [rbx + 5]
lea edx, [r9 + 4]
movzx ecx, byte [rbx + 1]
mov byte [rbx + 1], al
movzx eax, byte [rbx + 9]
mov byte [rbx + 5], al
movzx eax, byte [rbx + 0xd]
mov byte [rbx + 9], al
movzx eax, byte [rbx + 0xa]
mov byte [rbx + 0xd], cl
movzx ecx, byte [rbx + 2]
mov byte [rbx + 2], al
movzx eax, byte [rbx + 0xe]
mov byte [rbx + 0xa], cl
movzx ecx, byte [rbx + 6]
mov byte [rbx + 6], al
movzx eax, byte [rbx + 0xf]
mov byte [rbx + 0xe], cl
movzx ecx, byte [rbx + 3]
mov byte [rbx + 3], al
movzx eax, byte [rbx + 0xb]
mov byte [rbx + 0xf], al
movzx eax, byte [rbx + 7]
mov byte [rbx + 0xb], al
mov byte [rbx + 7], cl
nop word [rax + rax]
mov ecx, 4
nop word [rax + rax]
movzx eax, byte [rsi + rbx + 0xe0]
xor byte [rbx], al
inc rbx
sub rcx, 1
jne 0x1400173e0
sub rdx, 1
jne 0x1400173d0
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140017420
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rsi, rdx
mov rbx, rcx
sub rsi, rcx
mov r9d, 4
nop dword [rax]
mov r8d, 4
nop word [rax + rax]
movzx eax, byte [rsi + rcx + 0xe0]
xor byte [rcx], al
inc rcx
sub r8, 1
jne 0x140017460
sub r9, 1
jne 0x140017450
mov bpl, reloc.WS2_32.dll_listen
lea rdi, [rsi + 0xd0]
lea r14, [0x140246c10]
nop word [rax + rax]
movzx eax, byte [rbx + 9]
mov r8, rbx
movzx ecx, byte [rbx + 0xd]
mov r9d, 4
mov byte [rbx + 0xd], al
movzx eax, byte [rbx + 5]
mov byte [rbx + 9], al
movzx eax, byte [rbx + 1]
mov byte [rbx + 5], al
movzx eax, byte [rbx + 0xa]
mov byte [rbx + 1], cl
movzx ecx, byte [rbx + 2]
mov byte [rbx + 2], al
movzx eax, byte [rbx + 0xe]
mov byte [rbx + 0xa], cl
movzx ecx, byte [rbx + 6]
mov byte [rbx + 6], al
movzx eax, byte [rbx + 7]
mov byte [rbx + 0xe], cl
movzx ecx, byte [rbx + 3]
mov byte [rbx + 3], al
movzx eax, byte [rbx + 0xb]
mov byte [rbx + 7], al
movzx eax, byte [rbx + 0xf]
mov byte [rbx + 0xb], al
mov byte [rbx + 0xf], cl
nop dword [rax]
mov rcx, r8
mov edx, 4
nop dword [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 4]
movzx eax, byte [rax + r14]
mov byte [rcx - 4], al
sub rdx, 1
jne 0x140017500
inc r8
sub r9, 1
jne 0x1400174f0
mov rax, rbx
lea r8d, [rdx + 4]
nop word [rax + rax]
mov edx, 4
nop word [rax + rax]
movzx ecx, byte [rdi + rax]
xor byte [rax], cl
inc rax
sub rdx, 1
jne 0x140017540
sub r8, 1
jne 0x140017530
mov rcx, rbx
call fcn.140017640
sub rdi, 0x10
add bpl, 0xff
jne 0x140017490
movzx eax, byte [rbx + 9]
mov r8, rbx
movzx ecx, byte [rbx + 0xd]
mov r9d, 4
mov byte [rbx + 0xd], al
movzx eax, byte [rbx + 5]
mov byte [rbx + 9], al
movzx eax, byte [rbx + 1]
mov byte [rbx + 5], al
movzx eax, byte [rbx + 0xa]
mov byte [rbx + 1], cl
movzx ecx, byte [rbx + 2]
mov byte [rbx + 2], al
movzx eax, byte [rbx + 0xe]
mov byte [rbx + 0xa], cl
movzx ecx, byte [rbx + 6]
mov byte [rbx + 6], al
movzx eax, byte [rbx + 7]
mov byte [rbx + 0xe], cl
movzx ecx, byte [rbx + 3]
mov byte [rbx + 3], al
movzx eax, byte [rbx + 0xb]
mov byte [rbx + 7], al
movzx eax, byte [rbx + 0xf]
mov byte [rbx + 0xb], al
mov byte [rbx + 0xf], cl
nop dword [rax + rax]
mov rcx, r8
mov edx, 4
nop dword [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 4]
movzx eax, byte [rax + r14]
mov byte [rcx - 4], al
sub rdx, 1
jne 0x1400175e0
inc r8
sub r9, 1
jne 0x1400175d0
lea edx, [r9 + 4]
mov ecx, 4
nop word [rax + rax]
movzx eax, byte [rsi + rbx]
xor byte [rbx], al
inc rbx
sub rcx, 1
jne 0x140017610
sub rdx, 1
jne 0x140017602
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140017640
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
lea rbp, [rcx + 2]
mov qword [rsp + 0x20], 4
mov qword [rsp + 0x18], rbp
nop word [rax + rax]
movzx r9d, byte [rbp - 1]
movzx edx, byte [rbp - 2]
movzx ebx, r9b
movzx r8d, byte [rbp]
movzx eax, dl
shr al, 7
add bl, bl
movzx ecx, byte [rbp + 1]
movzx eax, al
imul eax, eax, 0x1b
mov byte [rsp + 0x78], r9b
mov byte [rsp + 0x88], dl
add dl, dl
mov byte [rsp + 0x80], r8b
xor dl, al
mov dword [rsp + 8], eax
movzx eax, dl
movzx esi, dl
shr al, 7
add sil, sil
movzx eax, al
imul eax, eax, 0x1b
xor sil, al
mov dword [rsp + 4], eax
movzx eax, r9b
movzx r9d, r8b
shr al, 7
add r9b, r9b
movzx eax, al
imul r15d, eax, 0x1b
xor bl, r15b
movzx eax, bl
movzx r10d, bl
shr al, 7
add r10b, r10b
movzx eax, al
imul eax, eax, 0x1b
xor r10b, al
mov dword [rsp + 0x10], eax
movzx eax, r8b
shr al, 7
movzx eax, al
imul r12d, eax, 0x1b
xor r9b, r12b
mov dword [rsp + 0xc], r12d
movzx eax, r9b
movzx r8d, r9b
shr al, 7
xor r9b, dl
movzx eax, al
add r8b, r8b
imul ebp, eax, 0x1b
movzx eax, cl
shr al, 7
add cl, cl
movzx eax, al
imul eax, eax, 0x1b
xor r8b, bpl
xor cl, al
mov dword [rsp + 0x14], eax
movzx eax, cl
movzx r13d, cl
shr al, 7
add r13b, r13b
movzx eax, al
imul r14d, eax, 0x1b
xor r13b, r14b
xor r9b, r13b
movzx eax, r13b
shr al, 7
xor r9b, r8b
movzx eax, al
xor r9b, r10b
imul edi, eax, 0x1b
xor r9b, sil
movzx eax, r8b
mov byte [rsp], r9b
shr al, 7
movzx eax, al
imul r11d, eax, 0x1b
movzx eax, r10b
shr al, 7
xor r13b, cl
movzx eax, al
xor r13b, r8b
imul r9d, eax, 0x1b
xor r13b, r10b
mov r12, qword [rsp + 0x18]
xor r13b, bl
movzx ebx, byte [rsp + 0x80]
xor r13b, sil
mov rcx, qword [rsp + 0x18]
movzx eax, sil
shr al, 7
movzx esi, byte [rsp + 0x78]
mov r8d, dword [rsp + 0x10]
movzx r10d, byte [rcx + 1]
movzx eax, al
imul edx, eax, 0x1b
movzx eax, byte [rsp]
xor al, byte [rsp + 0x78]
xor al, byte [rsp + 0x88]
add al, al
xor al, dl
xor al, r9b
xor al, r11b
xor al, dil
xor al, bpl
xor al, r15b
xor al, byte [rsp + 4]
xor al, byte [rsp + 8]
xor al, byte [r12 + 1]
xor al, byte [rsp + 0x80]
xor al, byte [rsp + 0x78]
mov byte [r12 - 2], al
movzx eax, r13b
mov r12d, dword [rsp + 0xc]
xor al, bl
xor al, sil
xor r13b, r10b
add al, al
xor al, dl
xor al, r9b
xor al, r11b
xor al, dil
xor al, r14b
xor al, r12b
xor al, r8b
xor al, r15b
movzx r15d, byte [rsp + 0x88]
xor r13b, r15b
xor al, r10b
add r13b, r13b
xor al, bl
xor r13b, dl
xor al, r15b
mov byte [rcx - 1], al
xor r13b, r9b
mov eax, dword [rsp + 0x14]
xor r13b, r11b
movzx ecx, byte [rsp]
xor r13b, dil
xor cl, r10b
xor r13b, r14b
xor cl, bl
xor r13b, al
add cl, cl
xor r13b, r8b
xor cl, dl
xor cl, r9b
xor cl, r11b
xor cl, dil
xor cl, al
xor cl, bpl
mov rbp, qword [rsp + 0x18]
xor cl, r12b
xor cl, byte [rsp + 4]
xor cl, r10b
xor cl, sil
xor cl, r15b
xor r13b, byte [rsp + 8]
mov byte [rbp], cl
xor r13b, bl
xor r13b, sil
xor r13b, r15b
mov byte [rbp + 1], r13b
add rbp, 4
sub qword [rsp + 0x20], 1
mov qword [rsp + 0x18], rbp
jne 0x140017670
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140017b00
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
lea rax, [rcx + 2]
mov ebp, 4
nop dword [rax]
movzx esi, byte [rax - 2]
movzx r9d, byte [rax - 1]
movzx r8d, sil
movzx edi, byte [rax + 1]
xor r8b, r9b
movzx r11d, byte [rax]
lea rax, [rax + 4]
movzx ecx, r8b
movzx r10d, dil
shr cl, 7
add r8b, r8b
movzx ecx, cl
xor r10b, r11b
imul edx, ecx, 0x1b
movzx ebx, r10b
xor bl, sil
xor bl, r9b
xor dl, r8b
movzx r8d, r9b
xor dl, sil
xor r8b, r11b
xor dl, bl
movzx ecx, r8b
mov byte [rax - 6], dl
xor sil, dil
shr cl, 7
add r8b, r8b
movzx ecx, cl
imul edx, ecx, 0x1b
movzx ecx, r10b
shr cl, 7
add r10b, r10b
movzx ecx, cl
xor dl, r8b
xor dl, r9b
xor dl, bl
mov byte [rax - 5], dl
imul edx, ecx, 0x1b
movzx ecx, sil
shr cl, 7
add sil, sil
movzx ecx, cl
xor dl, r10b
xor dl, r11b
xor dl, bl
mov byte [rax - 4], dl
imul edx, ecx, 0x1b
xor dl, sil
xor dl, dil
xor dl, bl
mov byte [rax - 3], dl
sub rbp, 1
jne 0x140017b20
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret

Function at 0x14001a210
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor r8d, r8d
mov word [rbp - 0x18], 0x626f
mov qword [rcx + 0x10], r8
mov rbx, rcx
mov dword [rbp - 8], 0x6c6d7365
mov word [rbp - 0x13], 0x6a61
mov dword [rbp - 4], 0x637370
mov word [rbp - 0x10], 0x6467
mov word [rbp - 0xd], 0x7161
mov word [rbp - 0xa], 0x6d6b
mov word [rbp - 0x15], 0x6f77
mov byte [rbp - 0x11], 0x63
mov byte [rbp - 0xe], WSAGetLastError
mov byte [rbp - 0x16], 0x61
mov byte [rbp - 0xb], 0x63
mov qword [rcx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rcx], r8b
mov dword [rbp - 0x20], r8d
cmp byte [rbp - 0x18], r8b
je 0x14001a290
lea rax, [rbp - 0x18]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x14001a286
lea rdx, [rbp - 0x18]
call fcn.14000d058
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x14001a2b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x40
xor r8d, r8d
mov byte [rsp + 0x28], Ordinal_50
mov qword [rcx + 0x10], r8
mov rbx, rcx
mov dword [rsp + 0x2d], 0x31303538
mov dword [rsp + 0x29], 0x39303836
mov word [rsp + 0x31], reloc.WLDAP32.dll_Ordinal_50
mov qword [rcx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rcx], r8b
mov dword [rsp + 0x20], r8d
cmp byte [rsp + 0x28], r8b
je 0x14001a30a
lea rax, [rsp + 0x28]
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14001a300
lea rdx, [rsp + 0x28]
call fcn.14000d058
mov rax, rbx
add rsp, 0x40
pop rbx
ret
Function at 0x14001a8d0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x50
mov qword [rax - 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], rbp
mov r14, rdx
mov rdi, rcx
xor bl, bl
cmp qword [rcx + 0x18], 0x10
jb 0x14001a901
mov rcx, qword [rcx]
xor ebp, ebp
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [rbp + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x14001a974
mov dword [rsp + 0x80], ebp
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
mov edx, eax
mov rcx, r14
call fcn.14000e8f0
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x80]
mov r8d, ebx
mov rdx, qword [r14]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
mov rcx, rdi
call fcn.14000c7e0
movzx eax, bl
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x88]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret

Function at 0x14001a9a0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x40
xor dil, dil
mov rsi, rdx
cmp qword [rcx + 0x18], 0x10
mov rbx, rcx
jb 0x14001a9ca
mov rcx, qword [rcx]
xor r14d, r14d
xor r9d, r9d
mov qword [rsp + 0x30], r14
xor r8d, r8d
mov dword [rsp + 0x28], r14d
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x14001aa3e
mov r8d, dword [rsi + 8]
lea r9, [rsp + 0x60]
sub r8d, dword [rsi]
mov rcx, rax
mov rdx, qword [rsi]
mov dword [rsp + 0x60], r14d
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rsi + 8]
mov eax, 1
sub rdx, qword [rsi]
mov ecx, dword [rsp + 0x60]
cmp rcx, rdx
movzx edi, dil
cmove edi, eax
mov rcx, rbx
call fcn.14000c7e0
mov rbx, qword [rsp + 0x68]
movzx eax, dil
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret