joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c9460
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rax, qword [0x141256160]
lea r10, [0x140236d70]
mov r8, rcx
mov rbx, qword [rax + 0x1c10]
add rbx, 0xd8
movsxd r9, dword [rbx]
mov rax, qword [rbx + 8]
mov edi, dword [rax + r9*4 - 4]
not edi
movzx eax, r8b
movzx ecx, dil
xor rcx, rax
shr edi, 8
mov rax, r8
shr rax, 8
movzx edx, al
mov rax, r8
xor edi, dword [r10 + rcx*4]
movzx ecx, dil
xor rdx, rcx
shr edi, 8
shr rax, 0x10
xor edi, dword [r10 + rdx*4]
movzx ecx, dil
shr edi, 8
movzx edx, al
mov rax, r8
xor rdx, rcx
shr rax, 0x18
xor edi, dword [r10 + rdx*4]
movzx ecx, dil
shr edi, 8
movzx edx, al
mov rax, r8
xor rdx, rcx
shr rax, 0x20
xor edi, dword [r10 + rdx*4]
movzx ecx, dil
shr edi, 8
movzx edx, al
mov rax, r8
xor rdx, rcx
shr rax, 0x28
xor edi, dword [r10 + rdx*4]
movzx ecx, dil
shr edi, 8
movzx edx, al
mov rax, r8
xor rdx, rcx
shr r8, 0x38
shr rax, 0x30
xor edi, dword [r10 + rdx*4]
movzx ecx, dil
shr edi, 8
movzx edx, al
xor rdx, rcx
xor edi, dword [r10 + rdx*4]
movzx ecx, dil
xor rcx, r8
shr edi, 8
mov r8d, dword [rbx + 4]
xor edi, dword [r10 + rcx*4]
not edi
cmp r9d, r8d
jne 0x1400c9580
lea ecx, [r9 + 1]
test r8d, r8d
je 0x1400c956c
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x1400c9571
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
mov rcx, rbx
call fcn.1400d1250
movsxd rcx, dword [rbx]
mov rax, qword [rbx + 8]
mov dword [rax + rcx*4], edi
inc dword [rbx]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400c95a0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rax, qword [0x141256160]
lea r10, [0x140236d70]
mov r8d, ecx
mov rbx, qword [rax + 0x1c10]
add rbx, 0xd8
movsxd r9, dword [rbx]
mov rax, qword [rbx + 8]
mov edi, dword [rax + r9*4 - 4]
not edi
movzx eax, r8b
movzx ecx, dil
xor rcx, rax
shr edi, 8
mov eax, r8d
shr eax, 8
movzx edx, al
mov eax, r8d
xor edi, dword [r10 + rcx*4]
movzx ecx, dil
xor rdx, rcx
shr edi, 8
shr eax, 0x10
xor edi, dword [r10 + rdx*4]
movzx ecx, dil
shr edi, 8
movzx edx, al
mov eax, r8d
mov r8d, dword [rbx + 4]
xor rdx, rcx
shr rax, 0x18
xor edi, dword [r10 + rdx*4]
movzx ecx, dil
shr edi, 8
xor rcx, rax
xor edi, dword [r10 + rcx*4]
not edi
cmp r9d, r8d
jne 0x1400c9661
lea ecx, [r9 + 1]
test r8d, r8d
je 0x1400c964d
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x1400c9652
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
mov rcx, rbx
call fcn.1400d1250
movsxd rcx, dword [rbx]
mov rax, qword [rbx + 8]
mov dword [rax + rcx*4], edi
inc dword [rbx]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400ca680
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140d81080]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x141256160]
mov edi, edx
cmp byte [rbx + 0x1f85], 0
jne 0x1400ca6e0
cmp byte [rbx + 0x1f86], 0
jne 0x1400ca6e0
mov r9d, dword [rbx + 0x3028]
lea r8, [0x140d5fd30]
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x20]
call fcn.1400bce80
test dil, 1
je 0x1400ca806
jmp 0x1400ca76a
movss xmm1, dword [rbx + 0x1614]
lea r8, [0x140d5fd30]
mov r9d, dword [rbx + 0x3028]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x140d621c4]
mov edx, reloc.WS2_32.dll_recv
mulss xmm1, dword [0x140d621a0]
addss xmm0, dword [rbx + 0x128]
addss xmm1, dword [rbx + 0x12c]
mov qword [rbx + 0x1d00], rax
mov dword [rbx + 0x1cec], 1
movss dword [rbx + 0x1cf8], xmm0
movss dword [rbx + 0x1cfc], xmm1
movss xmm0, dword [rbx + 0x1670]
mulss xmm0, dword [0x140d6205c]
or dword [rbx + 0x1ce8], 0x41
movss dword [rbx + 0x1d48], xmm0
call fcn.1400bce80
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x1400ca7c0
lea r11, [0x140236d70]
nop word [rax + rax]
cmp r9b, 0x23
jne 0x1400ca7a3
cmp byte [r8], r9b
jne 0x1400ca7a3
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x1400ca790
not ecx
call fcn.1400c3ea0
test rax, rax
je 0x1400ca806
cmp byte [rax + 0x9e], 0
je 0x1400ca806
mov byte [rax + 0xa5], 1
lea r8, [0x140d5fd30]
mov byte [rax + 0xbc], 1
lea rcx, [rsp + 0x20]
inc dword [rbx + 0x3028]
mov edx, reloc.WS2_32.dll_recv
mov r9d, dword [rbx + 0x3028]
call fcn.1400bce80
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.1400c64d0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14017e360
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x1400cf320
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x30c8], 0
lea rbx, [rcx + 0x30d0]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x1400cf3c7
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x1400cf37a
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.1400d0fd0
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.1400bd7b0
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x30c8]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x30d8]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x141254d05]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x1400cf3cf
mov rcx, rbx
call fcn.1400bd7b0
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x1400e3330
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x140d81080]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rcx, qword [0x14128c540]
lea rdx, [rsp + 0x28]
mov rdi, qword [0x141256160]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x28], xmm0
call qword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [rsp + 0x30]
lea rcx, [rsp + 0x40]
sub eax, dword [rsp + 0x28]
mov qword [rsp + 0x40], 0
movd xmm1, eax
mov eax, dword [rsp + 0x34]
sub eax, dword [rsp + 0x2c]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [rdi + 0x10], xmm1
movss dword [rdi + 0x14], xmm0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rcx, qword [rsp + 0x40]
xorps xmm1, xmm1
mov rax, rcx
xorps xmm0, xmm0
sub rax, qword [0x14128c548]
cvtsi2ss xmm0, qword [0x14128c550]
cvtsi2ss xmm1, rax
divss xmm1, xmm0
movss dword [rdi + 0x18], xmm1
mov qword [0x14128c548], rcx
mov ecx, reloc.WS2_32.dll_recvfrom
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, reloc.WS2_32.dll_recv
and al, 1
mov byte [rdi + 0x140], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, reloc.WS2_32.dll_select
and al, 1
mov byte [rdi + 0x141], al
call qword [sym.imp.USER32.dll_GetKeyState]
mov rbx, qword [0x141256160]
shr eax, 0xf
and al, 1
mov byte [rdi + 0x143], 0
mov byte [rdi + 0x142], al
cmp byte [rbx + 0x39b], 0
je 0x1400e346f
cvttss2si eax, dword [rbx + 0x128]
mov rcx, qword [0x14128c540]
lea rdx, [rsp + 0x38]
mov dword [rsp + 0x38], eax
cvttss2si eax, dword [rbx + 0x12c]
mov dword [rsp + 0x3c], eax
call qword [sym.imp.USER32.dll_ClientToScreen]
test eax, eax
je 0x1400e346f
mov edx, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x38]
call qword [sym.imp.USER32.dll_SetCursorPos]
mov dword [rbx + 0x128], 0xff7fffff
mov dword [rbx + 0x12c], 0xff7fffff
call qword [sym.imp.USER32.dll_GetForegroundWindow]
test rax, rax
je 0x1400e34ee
mov rdx, qword [0x14128c540]
cmp rax, rdx
je 0x1400e34a7
mov rcx, rax
call qword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x1400e34ee
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x1400e34ee
mov rcx, qword [0x14128c540]
lea rdx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x1400e34ee
movd xmm0, dword [rsp + 0x20]
movd xmm1, dword [rsp + 0x24]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [rbx + 0x128], xmm0
movss dword [rbx + 0x12c], xmm1
cmp byte [rdi + 0xc8], 0
je 0x1400e34fe
mov eax, 0xffffffff
jmp 0x1400e350b
mov rax, qword [0x141256160]
mov eax, dword [rax + 0x1f80]
cmp dword [reloc.WS2_32.dll_htons], eax
je 0x1400e351e
mov dword [reloc.WS2_32.dll_htons], eax
call fcn.1400e2ee0
call fcn.1400e3060
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14017e360
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x1400fc2a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x140d81080]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx eax, byte [rcx]
mov ebx, edx
mov r10, rcx
test al, al
je 0x1400fc2e0
cmp al, 0x25
jne 0x1400fc2d4
cmp byte [r10 + 1], al
jne 0x1400fc2e0
inc r10
movzx eax, byte [r10 + 1]
inc r10
test al, al
jne 0x1400fc2c7
cmp byte [r10], 0x25
jne 0x1400fc400
cmp byte [r10 + 1], 0x25
je 0x1400fc400
mov rcx, r10
lea r11, [rsp + 0x20]
call fcn.1400ec6f0
mov r8, rax
cmp r10, rax
jae 0x1400fc340
movabs r9, 0x800000000000009
nop dword [rax]
nop dword [rax + rax]
movzx edx, byte [r10]
inc r10
lea ecx, [rdx - 0x24]
cmp cl, 0x3b
ja 0x1400fc335
bt r9, rcx
jb 0x1400fc33b
mov byte [r11], dl
inc r11
cmp r10, r8
jb 0x1400fc320
xorps xmm3, xmm3
mov byte [r11], 0
cvtss2sd xmm3, xmm2
lea r8, [rsp + 0x20]
mov edx, 0x40
lea rcx, [rsp + 0x40]
movq r9, xmm3
call fcn.1400bce80
cmp byte [rsp + 0x40], 0x20
lea rcx, [rsp + 0x40]
jne 0x1400fc378
inc rcx
cmp byte [rcx], 0x20
je 0x1400fc370
lea eax, [rbx - 8]
cmp eax, 1
jbe 0x1400fc3ee
movzx edx, byte [rcx]
movzx r8d, dl
cmp dl, 0x2d
jne 0x1400fc391
movzx r8d, byte [rcx + 1]
lea rax, [rcx + 1]
xorps xmm1, xmm1
cmovne rax, rcx
cmp r8b, 0x2b
lea rcx, [rax + 1]
cmovne rcx, rax
movzx eax, byte [rcx]
cmp al, 0x30
jl 0x1400fc3dd
movss xmm2, dword [0x140d621a8]
cmp al, 0x39
ja 0x1400fc3dd
movsx eax, byte [rcx]
inc rcx
sub eax, 0x30
mulss xmm1, xmm2
movd xmm0, eax
movzx eax, byte [rcx]
cvtdq2ps xmm0, xmm0
addss xmm0, xmm1
movaps xmm1, xmm0
cmp al, 0x30
jge 0x1400fc3b7
cmp dl, 0x2d
jne 0x1400fc3fb
xorps xmm1, xmmword [0x140d62f90]
movaps xmm0, xmm1
jmp 0x1400fc403
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
movaps xmm0, xmm1
jmp 0x1400fc403
movaps xmm0, xmm2
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14017e360
add rsp, 0x90
pop rbx
ret
Function at 0x1400fc4a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x140d81080]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx eax, byte [rcx]
mov ebx, edx
mov r10, rcx
test al, al
je 0x1400fc4e0
cmp al, 0x25
jne 0x1400fc4d4
cmp byte [r10 + 1], al
jne 0x1400fc4e0
inc r10
movzx eax, byte [r10 + 1]
inc r10
test al, al
jne 0x1400fc4c7
cmp byte [r10], 0x25
jne 0x1400fc5fa
cmp byte [r10 + 1], 0x25
je 0x1400fc5fa
mov rcx, r10
lea r11, [rsp + 0x20]
call fcn.1400ec6f0
mov r8, rax
cmp r10, rax
jae 0x1400fc540
movabs r9, 0x800000000000009
nop dword [rax]
nop dword [rax + rax]
movzx edx, byte [r10]
inc r10
lea ecx, [rdx - 0x24]
cmp cl, 0x3b
ja 0x1400fc535
bt r9, rcx
jb 0x1400fc53b
mov byte [r11], dl
inc r11
cmp r10, r8
jb 0x1400fc520
movaps xmm3, xmm2
mov byte [r11], 0
movq r9, xmm2
lea r8, [rsp + 0x20]
mov edx, 0x40
lea rcx, [rsp + 0x40]
call fcn.1400bce80
cmp byte [rsp + 0x40], 0x20
lea rcx, [rsp + 0x40]
jne 0x1400fc578
nop dword [rax]
inc rcx
cmp byte [rcx], 0x20
je 0x1400fc570
lea eax, [rbx - 8]
cmp eax, 1
jbe 0x1400fc5ec
movzx edx, byte [rcx]
movzx r8d, dl
cmp dl, 0x2d
jne 0x1400fc591
movzx r8d, byte [rcx + 1]
lea rax, [rcx + 1]
xorps xmm1, xmm1
cmovne rax, rcx
cmp r8b, 0x2b
lea rcx, [rax + 1]
cmovne rcx, rax
movzx eax, byte [rcx]
cmp al, 0x30
jl 0x1400fc5db
movsd xmm2, qword [0x140d62140]
cmp al, 0x39
ja 0x1400fc5db
movsx eax, byte [rcx]
inc rcx
sub eax, 0x30
mulsd xmm1, xmm2
movd xmm0, eax
movzx eax, byte [rcx]
cvtdq2pd xmm0, xmm0
addsd xmm1, xmm0
cmp al, 0x30
jge 0x1400fc5b7
cmp dl, 0x2d
jne 0x1400fc5f5
xorps xmm1, xmmword [0x140d62f80]
movaps xmm0, xmm1
jmp 0x1400fc5fd
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
movaps xmm1, xmm0
movaps xmm0, xmm1
jmp 0x1400fc5fd
movaps xmm0, xmm2
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14017e360
add rsp, 0x90
pop rbx
ret

Function at 0x1400fc690
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140d81080]
xor rax, rsp
mov qword [rsp + 0x48], rax
cmp qword [r9 + 0x18], 0xf
mov rax, r9
mov edi, r8d
mov rbx, rdx
jbe 0x1400fc6ba
mov rax, qword [r9]
mov qword [rsp + 0x30], 0
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0xc0000000
mov dword [rsp + 0x20], 1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1400fc72e
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], 0
mov r8d, edi
mov qword [rsp + 0x20], 0
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x1400fc72e
cmp dword [rsp + 0x40], edi
jne 0x1400fc72e
mov al, 1
jmp 0x1400fc730
xor al, al
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14017e360
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400fc9e0
Capabilities:
Delete file
Delete service
Modify service
Stop service

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x90
mov rax, qword [0x140d81080]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, qword [0x1412561a0]
movzx ecx, byte [rbx]
test cl, cl
je 0x1400fca13
mov word [rbx + 0x78], 0
cmp byte [rbx + 0x78], 0
je 0x1400fca24
test cl, cl
jne 0x1400fca24
mov al, 1
jmp 0x1400fcb6a
xor edx, edx
mov qword [rsp + 0xa8], rsi
xor ecx, ecx
mov r8d, 1
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rsi, rax
test rax, rax
je 0x1400fcba1
cmp byte [rbx + 0x79], 0
lea rdx, [rbx + 0x48]
mov eax, 0x10020
mov ecx, reloc.WLDAP32.dll_Ordinal_32
cmovne eax, ecx
mov r8d, eax
or r8d, 2
cmp byte [rbx + 0x7a], 0
cmove r8d, eax
cmp qword [rdx + 0x18], 0xf
jbe 0x1400fca76
mov rdx, qword [rdx]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rdi, rax
test rax, rax
je 0x1400fcb98
lea r8, [rsp + 0x60]
mov edx, 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x1400fcb8f
cmp byte [rbx + 0x7a], 0
je 0x1400fcaf0
xor eax, eax
mov edx, 0xffffffff
mov qword [rsp + 0x50], rax
mov r9d, edx
mov qword [rsp + 0x48], rax
mov r8d, 4
mov qword [rsp + 0x40], rax
mov rcx, rdi
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
test eax, eax
je 0x1400fcb8f
cmp byte [rbx + 0x79], 0
je 0x1400fcb11
cmp byte [rbx], 0
jne 0x1400fcb11
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, 1
jmp 0x1400fcb62
mov rcx, rdi
mov qword [rsp + 0xa0], rbp
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov rcx, rdi
mov ebp, eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp byte [rbx + 0x7b], 0
je 0x1400fcb8b
cmp byte [rbx], 0
je 0x1400fcb8b
cmp qword [rbx + 0x20], 0xf
lea rcx, [rbx + 8]
jbe 0x1400fcb4f
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
mov rbp, qword [rsp + 0xa0]
setne al
mov rsi, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14017e360
mov rbx, qword [rsp + 0xb0]
add rsp, 0x90
pop rdi
ret
test ebp, ebp
jmp 0x1400fcb57
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
jmp 0x1400fcb62
Function at 0x1401059b0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x38
call fcn.140086080
mov dword [rsp + 0x20], eax
mov byte [0x141254c9d], 1
mov rax, qword [0x1412879c8]
mov ecx, dword [rsp + 0x20]
mov dword [rax + 0x10], ecx
mov rax, qword [0x1412879c8]
mov rcx, rax
call fcn.140102c10
nop
mov rax, qword [0x1412879c8]
cmp qword [rax], 0xffffffffffffffff
jne 0x140105a0c
mov edx, reloc.WS2_32.dll_recv
lea rcx, [0x140d60e58]
call fcn.14010bef0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
call fcn.140102c90
nop
add rsp, 0x38
ret
Function at 0x14010bef0
Capabilities:
Terminate process

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov qword [rsp + 0x38], 0
lea rcx, [0x140d61640]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x14010bf6f
lea rdx, [0x140d61670]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x68]
bts eax, 0xc
mov dword [rsp + 0x28], 0xbb8
mov word [rsp + 0x20], 0
mov r9d, eax
lea r8, [0x140d61658]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call qword [rsp + 0x40]
jmp 0x14010bf86
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
add rsp, 0x58
ret
Function at 0x1401115e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x140d81080]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov ebx, ecx
lea rax, [rsp + 0x38]
mov edx, ecx
mov r9d, 0x40
mov rcx, qword [0x141256150]
mov r8d, 4
mov qword [rsp + 0x20], rax
movss dword [rsp + 0x30], xmm1
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rcx, qword [0x141256150]
lea r8, [rsp + 0x30]
mov r9d, 4
mov qword [rsp + 0x20], 0
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r9d, dword [rsp + 0x38]
mov r8d, 4
mov rcx, qword [0x141256150]
mov edx, ebx
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14017e360
add rsp, 0x50
pop rbx
ret

Function at 0x140118490
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
cmp byte [rcx + 0x29], 0
je 0x140118622
movdqa xmm2, xmmword [0x140d62440]
lea r10, [rcx + 4]
movdqa xmm3, xmmword [0x140d64ef0]
mov r8, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x140d625b0]
mov r9d, 2
sub r8, rcx
sub r9, rcx
mov rdx, 0xfffffffffffffffc
sub rdx, rcx
nop dword [rax]
nop word [rax + rax]
lea rax, [rdx + r10]
movq xmm0, rax
movzx eax, word [r10 - 4]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
pshufd xmm1, xmm0, 0xd8
movq xmm0, xmm3
paddd xmm1, xmm0
movd xmm0, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm4
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd eax, xmm1
mov word [r10 - 4], ax
lea rax, [r8 + r10]
movq xmm0, rax
movzx eax, word [r10 - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
pshufd xmm1, xmm0, 0xd8
movq xmm0, xmm3
paddd xmm1, xmm0
movd xmm0, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm4
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd eax, xmm1
mov word [r10 - 2], ax
mov rax, r10
sub rax, rcx
movq xmm0, rax
movzx eax, word [r10]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
pshufd xmm1, xmm0, 0xd8
movq xmm0, xmm3
paddd xmm1, xmm0
movd xmm0, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm4
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd eax, xmm1
mov word [r10], ax
lea rax, [r9 + r10]
movq xmm0, rax
movzx eax, word [r10 + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
pshufd xmm1, xmm0, 0xd8
movq xmm0, xmm3
paddd xmm1, xmm0
movd xmm0, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm4
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd eax, xmm1
mov word [r10 + 2], ax
add r10, 8
lea rax, [rdx + r10]
cmp rax, 0x28
jb 0x1401184e0
mov byte [rcx + 0x29], 0
ret
Function at 0x14011bd20
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x140d81080]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbp, rcx
xor edi, edi
mov ecx, 2
xor edx, edx
mov ebx, edi
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x14011bd6a
xor eax, eax
jmp 0x14011bdcd
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14011bdc2
nop dword [rax]
nop dword [rax + rax]
mov rdx, rbp
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x14011bdb0
mov eax, dword [rsp + 0x3c]
cmp eax, ebx
jbe 0x14011bdb0
mov edi, dword [rsp + 0x28]
mov ebx, eax
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14011bd90
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.14017e360
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x14011d610
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xb0
mov rax, qword [0x140d81080]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rdi, rcx
mov qword [rsp + 0x90], rcx
mov r9d, 3
lea r8, [0x140d60c98]
xor edx, edx
call fcn.140073380
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
mov dword [rsp + 0x20], reloc.WS2_32.dll_WSASetLastError
mov dword [rsp + 0x24], 0x40
xor ecx, ecx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rcx
lea rax, [0x140d60c90]
mov qword [rsp + 0x38], rax
mov rax, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x14011d6ac
mov rax, qword [rdi]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rcx
mov dword [rsp + 0x50], ecx
mov qword [rsp + 0x58], rcx
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x14011d6dd
mov rcx, rdi
call fcn.1400641b0
mov eax, 0xffffffff
jmp 0x14011d725
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rsp + 0x98]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [rsp + 0x98]
mov rcx, rdi
call fcn.1400641b0
mov eax, ebx
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.14017e360
mov rbx, qword [rsp + 0xc8]
add rsp, 0xb0
pop rdi
ret
Function at 0x14011e570
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 7], dil
je 0x14011e5a4
mov ecx, edi
nop dword [rax]
lea eax, [rcx + 0x4a]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 6
jb 0x14011e590
mov byte [r8 + 7], dil
lea rax, [r8 + 6]
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x14011e5d1
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x14011e5f0
mov qword [rsp + 0x30], 6
mov eax, dword [r8]
mov dword [rsp + 0x20], eax
movzx eax, word [r8 + 4]
mov word [rsp + 0x24], ax
mov byte [rsp + 0x26], dil
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x14011e5fe
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.140073380
mov qword [rbx], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14011e675
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14011e670
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14011e670
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14017e5c0
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret