joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001e8f8
Capabilities:
Delete registry value
Persist via run registry key
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1401567f8]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rdx
mov rbx, rcx
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x40], xmm1
mov r8d, 0x2d
lea rdx, [0x14013bac0]
lea rcx, [rbp - 0x50]
call fcn.14002a4e0
nop
cmp qword [rdi + 0x10], 2
jbe 0x14001e9f4
mov rdx, rdi
mov rcx, rbx
call fcn.14001e6f4
test al, al
je 0x14001e96b
mov edi, 1
jmp 0x14001ea22
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x20], xmm1
mov r8, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 8
jb 0x14001e988
mov rdi, qword [rdi]
mov rdx, rdi
lea rcx, [rbp - 0x30]
call fcn.14002a5d8
mov eax, dword [rbp - 0x20]
lea ecx, [rax*2 + 2]
lea rax, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rax, qword [rbp - 0x30]
cmp qword [rbx + 0x18], 8
jb 0x14001e9b6
mov rbx, qword [rbx]
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 8
cmovae rdx, qword [rbp - 0x50]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rax
mov r9d, 1
mov r8, rbx
mov rcx, 0xffffffff80000001
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
test eax, eax
sete dil
lea rcx, [rbp - 0x30]
call fcn.1400253a8
jmp 0x14001ea22
cmp qword [rbx + 0x18], 8
jb 0x14001e9fe
mov rbx, qword [rbx]
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 8
cmovae rdx, qword [rbp - 0x50]
mov r8, rbx
mov rcx, 0xffffffff80000001
call qword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
test eax, eax
sete dil
lea rcx, [rbp - 0x50]
call fcn.1400253a8
mov al, dil
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400b7620
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14001ff2c
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 4], 0
mov rdx, rcx
je 0x14001ff5f
xor r8d, r8d
mov cl, r8b
movabs rax, 0xe1f511d51961f783
and cl, 7
shl cl, 3
shr rax, cl
xor byte [r8 + rdx], al
inc r8
cmp r8, 4
jb 0x14001ff38
mov byte [rdx + 4], 0
mov rax, rdx
ret

Function at 0x14001ff64
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
mov rdx, rcx
je 0x14001ff97
xor r8d, r8d
mov cl, r8b
movabs rax, 0x730b5fc175f311ed
and cl, 7
shl cl, 3
shr rax, cl
xor byte [r8 + rdx], al
inc r8
cmp r8, 5
jb 0x14001ff70
mov byte [rdx + 5], 0
mov rax, rdx
ret

Function at 0x140020fe0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140021000
xor eax, eax
jmp 0x1400210e6
cmp qword [rcx + 0x68], 0
je 0x140021011
call fcn.1400217f0
jmp 0x1400210e6
mov rax, qword [rcx + 0x38]
mov rdi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140021028
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14002102a
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14002105c
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.1400b9a70
mov rax, qword [rsi + 0x50]
add r14, rbx
sub rdi, rbx
sub dword [rax], ebx
mov rcx, qword [rsi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x1400210e0
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x140021093
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x1400210bc
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call fcn.1400caaf4
add r14, rax
sub rdi, rax
cmp rax, rbx
jne 0x1400210e0
cmp rdi, rbx
ja 0x14002109a
test rdi, rdi
je 0x1400210e0
mov r9, qword [rsi + 0x80]
mov r8, rdi
mov edx, 1
mov rcx, r14
call fcn.1400caaf4
sub rdi, rax
sub rbp, rdi
mov rax, rbp
add rsp, 0x20
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14003b5e4
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x14003b668
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x140101c80]
cmp byte [rcx + rax], 0
je 0x14003b668
dec r8
sub rdx, 1
jne 0x14003b64e
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x14004cd70
Capabilities:
Hash data using djb2

Disassembly:
push rbp
push rsi
push r12
push r15
sub rsp, 0x28
mov r12d, r9d
mov r15, r8
mov rsi, rdx
mov rbp, rcx
test rcx, rcx
je 0x14004cf4b
test rdx, rdx
je 0x14004cf4b
movabs rax, 0x7fffffffffffffff
cmp r8, rax
ja 0x14004cf4b
cmp dword [rcx], 0
mov qword [rsp + 0x20], r14
mov r14, qword [rsp + 0x70]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], r13
jne 0x14004cddf
mov r8, r14
mov edx, 0x100
call fcn.14004d370
test al, al
je 0x14004ce70
movzx eax, byte [rsi]
mov rcx, rsi
mov edi, 0x1505
test al, al
je 0x14004ce05
nop
imul rdi, rdi, 0x21
movzx eax, al
lea rcx, [rcx + 1]
add rdi, rax
movzx eax, byte [rcx]
test al, al
jne 0x14004cdf0
xor edx, edx
mov eax, edi
div dword [rbp]
mov rax, qword [rbp + 0x10]
mov r13d, edx
mov rbx, qword [rax + rdx*8]
test rbx, rbx
je 0x14004ce50
nop dword [rax]
cmp dword [rbx + 0x20], edi
jne 0x14004ce47
mov r8, qword [rbx]
mov rax, rsi
sub r8, rsi
nop
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x14004ce43
inc rax
test ecx, ecx
jne 0x14004ce30
test edx, edx
je 0x14004ce91
mov rbx, qword [rbx + 0x18]
test rbx, rbx
jne 0x14004ce20
mov ecx, 0x28
call fcn.1400cb070
mov rbx, rax
test rax, rax
jne 0x14004ceb2
xor r8d, r8d
lea edx, [rax + 0xe]
mov rcx, r14
call fcn.1400449d0
xor al, al
mov r13, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov r14, qword [rsp + 0x20]
add rsp, 0x28
pop r15
pop r12
pop rsi
pop rbp
ret
test r12b, 8
je 0x14004ce9e
cmp qword [rbx + 8], 0xffffffffffffffff
jne 0x14004cea9
cmp qword [rbx + 0x10], 0xffffffffffffffff
je 0x14004cf36
xor r8d, r8d
lea edx, [r8 + 0xa]
jmp 0x14004ce68
mov qword [rax], rsi
xorps xmm1, xmm1
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + r13*8]
mov qword [rbx + 0x18], rcx
mov rax, qword [rbp + 0x10]
mov qword [rax + r13*8], rbx
mov dword [rbx + 0x20], edi
mov qword [rbx + 8], 0xffffffffffffffff
inc qword [rbp + 8]
mov rcx, qword [rbp + 8]
mov edx, dword [rbp]
test rcx, rcx
js 0x14004ceee
cvtsi2sd xmm1, rcx
jmp 0x14004cf03
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2sd xmm1, rax
addsd xmm1, xmm1
xorps xmm0, xmm0
cvtsi2sd xmm0, rdx
mulsd xmm0, qword [0x1401039d0]
comisd xmm1, xmm0
jbe 0x14004cf36
cmp edx, 0x80000000
jae 0x14004cf36
add edx, edx
mov r8, r14
mov rcx, rbp
call fcn.14004d370
test al, al
je 0x14004ce70
test r12b, 8
je 0x14004cf40
mov qword [rbx + 8], r15
mov qword [rbx + 0x10], r15
mov al, 1
jmp 0x14004ce72
mov rcx, qword [rsp + 0x70]
xor r8d, r8d
lea edx, [r8 + 0x12]
call fcn.1400449d0
xor al, al
add rsp, 0x28
pop r15
pop r12
pop rsi
pop rbp
ret
Function at 0x14004cf70
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x20
mov rsi, r8
mov r11, rdx
mov rbx, rcx
test rcx, rcx
je 0x14004d0e1
test rdx, rdx
je 0x14004d0e1
cmp qword [rcx + 8], 0
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], r14
jbe 0x14004d023
movzx eax, byte [rdx]
mov r8, rdx
mov r10d, 0x1505
test al, al
je 0x14004cfd6
nop
imul r10, r10, 0x21
movzx eax, al
lea r8, [r8 + 1]
add r10, rax
movzx eax, byte [r8]
test al, al
jne 0x14004cfc0
mov r14, qword [rcx + 0x10]
xor edx, edx
mov eax, r10d
xor edi, edi
div dword [rcx]
mov ebp, edx
mov r8, qword [r14 + rdx*8]
test r8, r8
je 0x14004d023
nop
cmp dword [r8 + 0x20], r10d
jne 0x14004d017
mov r9, qword [r8]
mov rax, r11
sub r9, r11
nop
movzx edx, byte [rax]
movzx ecx, byte [rax + r9]
sub edx, ecx
jne 0x14004d013
inc rax
test ecx, ecx
jne 0x14004d000
test edx, edx
je 0x14004d04e
mov rdi, r8
mov r8, qword [r8 + 0x18]
test r8, r8
jne 0x14004cff0
xor r8d, r8d
mov rcx, rsi
lea edx, [r8 + 9]
call fcn.1400449d0
xor al, al
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
cmp qword [r8 + 8], 0xffffffffffffffff
jne 0x14004d0d2
mov rax, qword [r8 + 0x18]
test rdi, rdi
je 0x14004d064
mov qword [rdi + 0x18], rax
jmp 0x14004d068
mov qword [r14 + rbp*8], rax
mov rcx, r8
call fcn.1400ca5d8
dec qword [rbx + 8]
xorps xmm1, xmm1
mov rcx, qword [rbx + 8]
mov edx, dword [rbx]
test rcx, rcx
js 0x14004d089
cvtsi2sd xmm1, rcx
jmp 0x14004d09e
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2sd xmm1, rax
addsd xmm1, xmm1
xorps xmm0, xmm0
cvtsi2sd xmm0, rdx
mulsd xmm0, qword [0x1401039c8]
comisd xmm0, xmm1
jbe 0x14004d0da
cmp edx, 0x100
jbe 0x14004d0da
shr edx, 1
mov r8, rsi
mov rcx, rbx
call fcn.14004d370
test al, al
jne 0x14004d0da
jmp 0x14004d032
mov qword [r8 + 0x10], 0xffffffffffffffff
mov al, 1
jmp 0x14004d034
xor r8d, r8d
mov rcx, rsi
lea edx, [r8 + 0x12]
call fcn.1400449d0
mov rbx, qword [rsp + 0x48]
xor al, al
add rsp, 0x20
pop rsi
ret
Function at 0x14004d180
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r9
mov esi, r8d
mov rbx, rdx
mov r11, rcx
test rcx, rcx
je 0x14004d267
test rdx, rdx
je 0x14004d267
cmp qword [rcx + 8], 0
jbe 0x14004d260
movzx r8d, byte [rdx]
mov r10, rdx
mov eax, 0x1505
test r8b, r8b
je 0x14004d1e8
nop dword [rax]
imul rax, rax, 0x21
movzx ecx, r8b
lea r10, [r10 + 1]
movzx r8d, byte [r10]
add rax, rcx
test r8b, r8b
jne 0x14004d1d0
xor edx, edx
div dword [r11]
mov rax, qword [r11 + 0x10]
mov r9, qword [rax + rdx*8]
test r9, r9
je 0x14004d260
nop word [rax + rax]
mov r8, qword [r9]
mov rax, rbx
sub r8, rbx
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x14004d223
inc rax
test ecx, ecx
jne 0x14004d210
test edx, edx
je 0x14004d236
mov r9, qword [r9 + 0x18]
test r9, r9
jne 0x14004d200
lea edx, [r9 + 9]
jmp 0x14004d26c
test sil, 8
je 0x14004d256
mov rax, qword [r9 + 8]
cmp rax, 0xffffffffffffffff
je 0x14004d260
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, qword [r9 + 0x10]
cmp rax, 0xffffffffffffffff
jne 0x14004d27e
mov edx, 9
jmp 0x14004d26c
mov edx, reloc.WS2_32.dll_select
xor r8d, r8d
mov rcx, rdi
call fcn.1400449d0
mov rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140050730
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
test r9, r9
je 0x14005084e
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, r9
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
test rdx, rdx
je 0x1400507d2
sub rsi, rdx
movzx eax, word [rbx + 8]
lea rdx, [rsp + 0x48]
or eax, 2
mov r8d, 1
mov ecx, eax
xor ecx, 1
imul ecx, eax
shr ecx, 8
xor cl, byte [rsi + rdi]
mov byte [rdi], cl
mov byte [rsp + 0x48], cl
mov ecx, dword [rbx]
not ecx
call fcn.1400f0ad0
not eax
lea rdx, [rsp + 0x48]
mov dword [rbx], eax
mov r8d, 1
movzx eax, al
add eax, dword [rbx + 4]
imul ecx, eax, 0x8088405
inc ecx
mov dword [rbx + 4], ecx
shr ecx, 0x18
mov byte [rsp + 0x48], cl
mov ecx, dword [rbx + 8]
not ecx
call fcn.1400f0ad0
lea rdi, [rdi + 1]
not eax
mov dword [rbx + 8], eax
sub rbp, 1
jne 0x140050761
jmp 0x14005083a
xor edi, edi
nop dword [rax]
nop dword [rax + rax]
mov ecx, dword [rbx]
lea rdx, [rsp + 0x48]
movzx eax, byte [rdi + rsi]
not ecx
mov r8d, 1
mov byte [rsp + 0x48], al
call fcn.1400f0ad0
not eax
lea rdx, [rsp + 0x48]
mov dword [rbx], eax
mov r8d, 1
movzx eax, al
add eax, dword [rbx + 4]
imul ecx, eax, 0x8088405
inc ecx
mov dword [rbx + 4], ecx
shr ecx, 0x18
mov byte [rsp + 0x48], cl
mov ecx, dword [rbx + 8]
not ecx
call fcn.1400f0ad0
inc rdi
not eax
mov dword [rbx + 8], eax
cmp rdi, rbp
jb 0x1400507e0
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140050850
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
test r9, r9
je 0x14005098e
mov qword [rsp + 0x18], rbx
push rbp
push r14
push r15
sub rsp, 0x20
mov qword [rsp + 0x48], rdi
mov rbp, r9
mov r15, r8
mov r14, rdx
mov rbx, rcx
test rdx, rdx
je 0x140050912
mov qword [rsp + 0x40], rsi
sub r15, rdx
nop dword [rax]
mov ecx, dword [rbx]
lea rdx, [rsp + 0x58]
movzx esi, byte [r15 + r14]
not ecx
movzx edi, word [rbx + 8]
mov r8d, 1
or di, 2
mov byte [rsp + 0x58], sil
call fcn.1400f0ad0
not eax
lea rdx, [rsp + 0x58]
mov dword [rbx], eax
mov r8d, 1
movzx eax, al
add eax, dword [rbx + 4]
imul ecx, eax, 0x8088405
inc ecx
mov dword [rbx + 4], ecx
shr ecx, 0x18
mov byte [rsp + 0x58], cl
mov ecx, dword [rbx + 8]
not ecx
call fcn.1400f0ad0
not eax
lea r14, [r14 + 1]
mov dword [rbx + 8], eax
movzx eax, di
mov ecx, eax
xor ecx, 1
imul ecx, eax
shr ecx, 8
xor cl, sil
mov byte [r14 - 1], cl
sub rbp, 1
jne 0x140050890
mov rsi, qword [rsp + 0x40]
jmp 0x14005097b
xor edi, edi
nop dword [rax]
nop dword [rax + rax]
mov ecx, dword [rbx]
lea rdx, [rsp + 0x58]
movzx eax, byte [rdi + r15]
not ecx
mov r8d, 1
mov byte [rsp + 0x58], al
call fcn.1400f0ad0
not eax
lea rdx, [rsp + 0x58]
mov dword [rbx], eax
mov r8d, 1
movzx eax, al
add eax, dword [rbx + 4]
imul ecx, eax, 0x8088405
inc ecx
mov dword [rbx + 4], ecx
shr ecx, 0x18
mov byte [rsp + 0x58], cl
mov ecx, dword [rbx + 8]
not ecx
call fcn.1400f0ad0
inc rdi
not eax
mov dword [rbx + 8], eax
cmp rdi, rbp
jb 0x140050920
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rbp
ret

Function at 0x1400509b0
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
sub rsp, 0x58
mov rcx, qword [rcx + 8]
lea rax, [rsp + 0x60]
xor r9d, r9d
mov dword [rsp + 0x48], r9d
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], reloc.WS2_32.dll_recv
mov qword [rsp + 0x30], r8
lea r8d, [r9 + 0x10]
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], r9
call sub.bcrypt.dll_BCryptEncrypt
test eax, eax
setns al
add rsp, 0x58
ret

Function at 0x140050bf0
Capabilities:
Hash data via bcrypt

Disassembly:
sub rsp, 0x28
test rcx, rcx
je 0x140050c19
mov eax, 0xffffffff
cmp r8, rax
ja 0x140050c19
mov rcx, qword [rcx + 8]
xor r9d, r9d
call sub.bcrypt.dll_BCryptHashData
test eax, eax
setns al
add rsp, 0x28
ret
xor al, al
add rsp, 0x28
ret

Function at 0x140050f40
Capabilities:
Generate random numbers via winapi

Disassembly:
sub rsp, 0x28
movzx r8d, dx
mov r9d, 2
mov rdx, rcx
xor ecx, ecx
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
setns al
add rsp, 0x28
ret

Function at 0x140051c00
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x1d8
mov rax, qword [0x1401567f8]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov ecx, 0x202
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
sete al
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.1400b7620
add rsp, 0x1d8
ret
Function at 0x14005f090
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub rsp, 0x28
movsxd rcx, dword [rcx + 8]
xor r9d, r9d
nop
call qword [sym.imp.WS2_32.dll_recv]
cdqe
add rsp, 0x28
ret

Function at 0x14005f0b0
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x28
movsxd rcx, dword [rcx + 8]
xor r9d, r9d
nop
call qword [sym.imp.WS2_32.dll_send]
cdqe
add rsp, 0x28
ret
Function at 0x140060d20
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, qword [rcx]
mov r9d, 0x270
mov ecx, dword [r10]
cmp ecx, r9d
jne 0x140060d81
lea r8, [r10 + 8]
nop dword [rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x140060d40
mov ecx, dword [r10]
jmp 0x140060e6a
cmp ecx, 0x4e0
jb 0x140060e6a
lea r11, [r10 + 0x9c4]
mov qword [rsp], rbx
mov eax, dword [r11]
mov ebx, 0xe3
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140060da0
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140060df0
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x140063480
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
mov eax, 0x13f0
call fcn.1400b81e0
sub rsp, rax
mov rax, qword [0x1401567f8]
xor rax, rsp
mov qword [rsp + 0x13e0], rax
movsxd rsi, r8d
mov rdi, rdx
mov qword [rsp + 0x28], rdx
xor ebx, ebx
mov dword [rsp + 0x20], ebx
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
lea edx, [rbx + 0x20]
lea rcx, [rsp + 0x30]
call fcn.14002559c
mov rbp, rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], 0x1a
mov qword [rsp + 0x48], 0x1f
movups xmm0, xmmword [str.0123456789ABCDEFGHabcdefgh]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x140105078]
movsd qword [rax + 0x10], xmm0
movzx eax, word [0x140105080]
mov word [rbp + 0x18], ax
mov byte [rbp + 0x1a], bl
call fcn.1400f804c
mov edx, eax
mov dword [rsp + 0x13d4], 0xffffffff
mov dword [rsp + 0x54], eax
lea ecx, [rbx + 1]
nop word [rax + rax]
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [rsp + rcx*4 + 0x54], edx
inc rcx
cmp rcx, 0x270
jb 0x140063530
mov dword [rsp + 0x50], 0x270
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], setsockopt
mov byte [rdi], 0
mov dword [rsp + 0x20], 1
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
call fcn.140026500
test rsi, rsi
jle 0x1400635e0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x28]
call fcn.140060d20
mov ecx, eax
imul rax, rcx, 0x1a
cmp eax, 0x15
ja 0x1400635bb
lea rcx, [rsp + 0x28]
call fcn.140060d20
mov ecx, eax
imul rax, rcx, 0x1a
cmp eax, 0x16
jb 0x1400635a6
shr rax, 0x20
movsxd rcx, eax
mov rax, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x1400635cf
mov rax, qword [rdi]
movzx r8d, byte [rcx + rbp]
mov byte [rax + rbx], r8b
inc rbx
cmp rbx, rsi
jl 0x140063591
mov edx, 0x20
mov rcx, rbp
call fcn.1400b7640
mov rax, rdi
mov rcx, qword [rsp + 0x13e0]
xor rcx, rsp
call fcn.1400b7620
mov rbx, qword [rsp + 0x1410]
add rsp, 0x13f0
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400865b0
Capabilities:
Encrypt data using openssl rsa

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rsi, rcx
lea rbx, [0x14010af10]
mov r14, rdx
mov rcx, rbx
test rsi, rsi
je 0x14008660e
cmp qword [0x14010af10], 0
je 0x14008660e
mov rdi, qword [rsi + 8]
cmp qword [rcx + 8], rdi
jne 0x140086601
mov rdx, qword [rsi + 0x10]
mov r8, rdi
mov rcx, qword [rcx]
call fcn.1400ba580
test eax, eax
je 0x140086629
add rbx, 0x28
mov rcx, rbx
cmp qword [rbx], 0
jne 0x1400865e8
mov eax, 0xffffffd2
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
test rbx, rbx
je 0x14008660e
mov eax, dword [rbx + 0x20]
mov dword [r14], eax
xor eax, eax
jmp 0x140086613

Function at 0x1400866e0
Capabilities:
Encrypt data using openssl rsa

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push r15
sub rsp, 0x20
mov rsi, rcx
lea rbx, [0x14010ace0]
mov r14, r8
mov r15, rdx
mov rcx, rbx
test rsi, rsi
je 0x140086746
cmp qword [0x14010ace0], 0
je 0x140086746
mov rdi, qword [rsi + 8]
cmp qword [rcx + 8], rdi
jne 0x140086739
mov rdx, qword [rsi + 0x10]
mov r8, rdi
mov rcx, qword [rcx]
call fcn.1400ba580
test eax, eax
je 0x140086766
add rbx, 0x28
mov rcx, rbx
cmp qword [rbx], 0
jne 0x140086720
mov eax, 0xffffffd2
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
test rbx, rbx
je 0x140086746
mov eax, dword [rbx + 0x20]
mov dword [r15], eax
mov eax, dword [rbx + 0x24]
mov dword [r14], eax
xor eax, eax
jmp 0x14008674b
Function at 0x14008fe60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
push r15
mov rax, qword [rdx + 8]
mov r15, r8
mov rsi, rdx
mov rdi, rcx
cmp qword [rcx + 8], rax
je 0x14008fe89
mov eax, 0xfffffffc
mov rsi, qword [rsp + 0x30]
pop r15
pop rdi
ret
mov r11d, dword [rcx]
mov eax, dword [rdx]
sar eax, 1
mov qword [rsp + 0x18], rbx
and eax, 1
sar r11d, 1
and r11d, 1
mov qword [rsp + 0x28], r14
xor eax, r11d
mov ebx, eax
and ebx, r11d
mov dword [r8], ebx
mov r14, qword [rcx + 8]
test r14, r14
je 0x14008ff80
mov qword [rsp + 0x20], rbp
mov ebp, 1
sub ebp, r11d
nop dword [rax]
mov rcx, qword [rdi + 0x10]
mov r10d, 1
sub r10d, eax
mov r8, qword [rcx + r14*8 - 8]
mov rcx, qword [rsi + 0x10]
mov rdx, qword [rcx + r14*8 - 8]
mov rcx, rdx
sub rdx, r8
xor rcx, r8
shr rdx, 0x3f
mov r9, rcx
shr r8, 0x3f
not r9
shr rcx, 0x3f
and ecx, r8d
shr r9, 0x3f
and r9d, edx
or r9d, ecx
and r10d, r9d
or eax, r9d
and r10d, r11d
or r10d, ebx
mov ebx, 1
mov dword [r15], r10d
sub ebx, eax
mov rcx, qword [rsi + 0x10]
and ebx, ebp
mov r8, qword [rcx + r14*8 - 8]
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rcx + r14*8 - 8]
mov rcx, rdx
sub rdx, r8
xor rcx, r8
shr rdx, 0x3f
mov r9, rcx
shr r8, 0x3f
not r9
shr rcx, 0x3f
shr r9, 0x3f
and ecx, r8d
and r9d, edx
or r9d, ecx
and ebx, r9d
or eax, r9d
or ebx, r10d
mov dword [r15], ebx
sub r14, 1
jne 0x14008fed0
mov rbp, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
xor eax, eax
mov rbx, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x30]
pop r15
pop rdi
ret

Function at 0x140094c40
Capabilities:
Encode data using add xor sub operations
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, dword [rcx]
mov r10, rcx
mov ebx, dword [rcx + 4]
test rdx, rdx
je 0x140094ca2
sub r8, r9
nop word [rax + rax]
lea eax, [r11 + 1]
movzx r11d, al
lea r9, [r9 + 1]
movzx ecx, byte [r11 + r10 + 8]
lea eax, [rbx + rcx]
movzx ebx, al
movzx eax, byte [rbx + r10 + 8]
mov byte [r11 + r10 + 8], al
add al, cl
mov byte [rbx + r10 + 8], cl
movzx eax, al
movzx ecx, byte [rax + r10 + 8]
xor cl, byte [r8 + r9 - 1]
mov byte [r9 - 1], cl
sub rdx, 1
jne 0x140094c60
mov dword [r10 + 4], ebx
xor eax, eax
mov rbx, qword [rsp + 8]
mov dword [r10], r11d
ret