joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140080370
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push rbp
push rbx
push rdi
push r15
lea rbp, [rsp - 0x3358]
mov eax, 0x3458
call fcn.140224fa0
sub rsp, rax
mov rax, qword [0x1402f3010]
xor rax, rsp
mov qword [rbp + 0x3340], rax
mov r15, rdx
mov rdi, rcx
xor edx, edx
lea rcx, [rbp + 0x2f40]
mov r8d, 0x400
call sub.VCRUNTIME140.dll_memset
lea rdx, [0x1402d5c14]
mov rcx, rdi
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
je 0x1400803df
mov edx, 0x5c
mov rcx, rdi
call qword [sym.imp.VCRUNTIME140.dll_strrchr]
lea r8, [rax + 1]
jmp 0x1400803e2
mov r8, rdi
lea rcx, [rbp + 0x2f40]
dec rcx
nop dword [rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x1400803f0
xor edx, edx
nop dword [rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140080400
lea rcx, [rbp + 0x2f40]
call fcn.14007f730
mov rbx, rax
test rax, rax
jne 0x14008060f
mov qword [rsp + 0x3490], rsi
mov dword [rsp + 0x20], 0x4d446b70
mov dword [rsp + 0x24], 0x49400d4e
mov word [rsp + 0x28], Ordinal_79
mov byte [rsp + 0x2a], 1
nop dword [rax]
lea ecx, [rax + 0x1e]
xor byte [rsp + rax + 0x20], cl
inc rax
cmp rax, 9
jb 0x140080450
lea rcx, [rsp + 0x20]
mov byte [rsp + 0x2a], 0
call fcn.14007f730
mov rsi, rax
test rax, rax
je 0x140080604
mov rcx, r15
mov qword [rsp + 0x3450], r14
call fcn.140085c30
mov r14, rax
test rax, rax
je 0x1400805fc
mov rbx, 0xffffffffffffffff
add rsi, 0x1000
mov rcx, rbx
nop dword [rax + rax]
inc rcx
cmp byte [rdi + rcx], 0
jne 0x1400804b0
lea rax, [rsi + 1]
mov rdx, rsi
add rax, rcx
lea rcx, [rbp + 0xf30]
mov qword [rbp + 0x1f30], rax
call fcn.140085cd0
mov rdx, rax
lea rcx, [rsp + 0x30]
mov r8d, 0x1000
call sub.VCRUNTIME140.dll_memcpy
mov r8d, 0x1000
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x1f40]
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x1402f59e3], rax
mov qword [0x1402f59b8], r15
mov qword [0x1402f59c2], r14
mov qword [0x1402f59d9], rsi
cmp byte [rdi + rbx + 1], 0
lea rbx, [rbx + 1]
jne 0x140080523
lea r8d, [rbx + 1]
mov rdx, rdi
mov rcx, rsi
call fcn.14007f5c0
mov rcx, qword [rbp + 0x1f30]
lea rdx, str.QRUVSWAPAQARASATAUAVAWH
mov r8d, WSASetLastError
call fcn.14007f5c0
mov ecx, 4
call fcn.140087b28
mov edx, 8
mov r9, rax
mov rcx, r15
lea r8d, [rdx - 4]
call fcn.14007f520
mov r8d, 8
lea rdx, [rbp + 0x1f30]
mov rcx, r15
call fcn.14007f5c0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea edi, [rax + 0x1b58]
nop word [rax + rax]
lea rcx, [rbp + 0x2f40]
call fcn.14007f730
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, edi
ja 0x1400805c9
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
test rbx, rbx
je 0x1400805a0
mov ecx, 4
call fcn.140087b28
mov edx, 8
mov r9, rax
mov rcx, r15
lea r8d, [rdx - 6]
call fcn.14007f520
mov r8d, 0x1000
lea rdx, [rbp + 0x1f40]
mov rcx, rsi
call fcn.14007f5c0
mov r14, qword [rsp + 0x3450]
mov rsi, qword [rsp + 0x3490]
mov rax, rbx
mov rcx, qword [rbp + 0x3340]
xor rcx, rsp
call fcn.1400876d0
add rsp, 0x3458
pop r15
pop rdi
pop rbx
pop rbp
ret
Function at 0x140081950
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x1402f3010]
xor rax, rsp
mov qword [rsp + 0x68], rax
movdqa xmm0, xmmword [0x1402d6d70]
xor eax, eax
movdqa xmm1, xmmword [0x1402d6c90]
movdqu xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x40], 0x323e3e32
movdqu xmmword [rsp + 0x30], xmm1
mov word [rsp + 0x44], 0x100
nop dword [rax]
nop word [rax + rax]
lea ecx, [rax + 0x25]
xor byte [rsp + rax + 0x20], cl
inc rax
cmp rax, 0x24
jb 0x1400819a0
movdqa xmm0, xmmword [0x1402d6b10]
lea rax, [rsp + 0x20]
movdqu xmmword [rsp + 0x58], xmm0
mov byte [rsp + 0x45], 0
mov r8, 0xffffffffffffffff
mov byte [rsp + 0x48], 0
inc r8
cmp byte [rax + r8], 0
jne 0x1400819d4
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x48]
call fcn.14007c570
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
movabs rax, 0x842108421084211
and r8d, 0x1f
mul r8
mov ecx, r8d
lea rax, [rsp + 0x48]
sub rcx, rdx
shr rcx, 1
add rcx, rdx
mov rdx, qword [rsp + 0x60]
shr rcx, 4
imul rcx, rcx, 0x1f
sub r8, rcx
mov rcx, qword [rsp + 0x48]
cmp rdx, 0x10
cmovae rax, rcx
movzx ebx, byte [rax + r8 + 1]
jb 0x140081a6d
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140081a68
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140081a68
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400876fc
movzx eax, bl
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400876d0
add rsp, 0x70
pop rbx
ret
Function at 0x140085c30
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x78
mov rax, qword [0x1402f3010]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov eax, dword [0x140681430]
mov dword [rsp + 0x34], eax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x4c], 0
mov dword [rsp + 0x54], 0
mov dword [rsp + 0x30], 0x64
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x48], 8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [0x140681428]
lea r9, [rsp + 0x58]
mov r8d, reloc.WLDAP32.dll_Ordinal_41
mov dword [rsp + 0x4c], eax
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400876d0
add rsp, 0x78
ret

Function at 0x140085cd0
Capabilities:
Write file on windows

Disassembly:
push rbx
mov eax, 0x1070
call fcn.140224fa0
sub rsp, rax
mov rax, qword [0x1402f3010]
xor rax, rsp
mov qword [rsp + 0x1060], rax
mov eax, dword [0x140681430]
mov rbx, rcx
mov dword [rsp + 0x34], eax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x4c], 0
mov dword [rsp + 0x54], 0
mov dword [rsp + 0x30], 0x64
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x48], 0x1000
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [0x140681428]
lea r9, [rsp + 0x58]
mov r8d, reloc.WLDAP32.dll_Ordinal_41
mov dword [rsp + 0x4c], eax
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r8d, 0x1000
lea rdx, [rsp + 0x60]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rax, rbx
mov rcx, qword [rsp + 0x1060]
xor rcx, rsp
call fcn.1400876d0
add rsp, 0x1070
pop rbx
ret

Function at 0x140091210
Capabilities:
Set thread local storage value

Disassembly:
mov eax, Ordinal_41
call fcn.140224fa0
sub rsp, rax
mov ecx, dword [rcx]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x28
ret

Function at 0x1400920f0
Capabilities:
Initialize winsock library

Disassembly:
mov eax, Ordinal_41
call fcn.140224fa0
sub rsp, rax
cmp dword [0x14067f4a0], 0
jne 0x1400921aa
xor edx, edx
mov dword [0x14067f4a0], 1
mov r8d, 0x198
lea rcx, [0x14067f4b0]
call sub.VCRUNTIME140.dll_memset
mov ecx, 0x202
lea rdx, [0x14067f4b0]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x1400921aa
call fcn.14008c7b0
lea r8, str.BIO_sock_init
mov edx, 0x92
lea rcx, str.crypto_bio_bio_sock.c
call fcn.14008c8d0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea r8, str.calling_wsastartup__
mov ecx, 2
mov edx, eax
call fcn.14008c9d0
call fcn.14008c7b0
lea r8, str.BIO_sock_init
mov edx, __WSAFDIsSet
lea rcx, str.crypto_bio_bio_sock.c
call fcn.14008c8d0
xor r8d, r8d
lea edx, [r8 + 0x7a]
lea ecx, [rdx - 0x5a]
call fcn.14008c9d0
mov eax, 0xffffffff
add rsp, 0x28
ret
mov eax, 1
add rsp, 0x28
ret
Function at 0x140094510
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
mov eax, 0x280
call fcn.140224fa0
sub rsp, rax
mov rax, qword [0x1402f3010]
xor rax, rsp
mov qword [rsp + 0x270], rax
cmp dword [0x14067f788], 0
lea rax, [0x140093e60]
mov qword [rsp + 0x28], rax
lea rbx, [0x14022a108]
lea rax, str.getnameinfo
movzx ebp, cx
mov qword [rsp + 0x30], rax
lea rax, [0x1400942c0]
mov qword [rsp + 0x38], rax
lea rax, [0x14022a128]
mov qword [rsp + 0x40], rax
lea rax, [0x140093e00]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x20], rbx
jne 0x1400946e9
mov edx, 0x104
lea rcx, [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1400946df
lea r8, [rsp + 0x160]
mov qword [rsp + 0x290], rsi
mov edx, 0x10c
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
lea r8, str.ws2_32
mov edx, 0x10c
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x14009460c
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x14009466e
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea r8, [rsp + 0x160]
mov edx, 0x10c
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
lea r8, str.wship6
mov edx, 0x10c
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x1400946d7
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x14009466e
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x1400946d7
mov qword [rsp + 0x298], rdi
lea rbx, [rsp + 0x28]
xor edi, edi
nop dword [rax]
mov rdx, qword [rbx - 8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx], rax
test rax, rax
je 0x1400946c6
inc edi
add rbx, 0x10
cmp edi, 3
jl 0x140094680
mov rax, qword [rsp + 0x28]
mov qword [str.___t_], rax
mov rax, qword [rsp + 0x38]
mov qword [0x1402f35b0], rax
mov rax, qword [rsp + 0x48]
mov qword [0x1402f35c0], rax
jmp 0x1400946cf
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rdi, qword [rsp + 0x298]
mov rsi, qword [rsp + 0x290]
mov dword [0x14067f788], 1
mov rax, rbp
lea rcx, [0x1402f3598]
add rax, rax
mov rax, qword [rcx + rax*8 + 8]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1400876d0
mov rbx, qword [rsp + 0x2a0]
add rsp, 0x280
pop rbp
ret
Function at 0x140014360
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x10040
call fcn.140030cb0
sub rsp, rax
mov rbx, rcx
xor edx, edx
lea rcx, [0x140000000]
nop
movzx eax, byte [rdx + rcx + 0xb0310]
inc rdx
cmp rdx, 8
mov byte [rsp + rdx + 0x1f], al
movzx eax, byte [rdx + rcx + 0xb0097]
mov byte [rsp + rdx + 0x27], al
jl 0x140014380
lea rdx, str.AU3_
lea rcx, [rsp + 0x10058]
call fcn.140017e10
lea rdx, [rsp + 0x10058]
lea rcx, [rsp + 0x30]
mov r8d, 4
call fcn.140016710
xor edi, edi
nop
mov r9, qword [rbx]
lea rcx, [rsp + 0x40]
mov edx, 1
mov r8d, 0x10000
call fcn.140019a28
cmp eax, 0x18
jl 0x14001444c
lea r10d, [rax - 0x14]
xor ecx, ecx
mov r11, rax
test r10d, r10d
jle 0x140014426
lea rdx, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
movzx eax, byte [rdx + r8]
cmp byte [rsp + r8 + 0x20], al
je 0x14001443e
cmp r9d, 0x14
je 0x1400313d0
inc ecx
inc rdx
cmp ecx, r10d
jl 0x140014400
mov rcx, qword [rbx]
mov edx, 0xffffffec
lea edi, [rdi + r11 - 0x14]
lea r8d, [rdx + 0x15]
call fcn.140019e98
jmp 0x1400143d0
inc r8
inc r9d
cmp r8, 0x14
jl 0x140014406
jmp 0x140014412
mov eax, 3
mov rbx, qword [rsp + 0x10050]
add rsp, 0x10040
pop rdi
ret
lea edx, [rdi + rcx + 0x14]
mov rcx, qword [rbx]
xor r8d, r8d
call fcn.140019e98
mov r9, qword [rbx]
mov edx, 1
lea r8d, [rdx + 3]
lea rcx, [rsp + 0x10058]
call fcn.140019a28
lea rdx, str.EA06
lea rcx, [rsp + 0x10058]
mov byte [rsp + 0x1005c], 0
call fcn.140019a60
neg eax
sbb eax, eax
and eax, 4
jmp 0x140014451

Function at 0x140014530
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x1d0
mov rdi, rcx
mov rsi, rdx
lea rcx, [0x14009b6c0]
or edx, 0xffffffff
call fcn.140014470
lea rcx, [rsp + 0xc0]
mov rdx, rax
mov rbx, rax
call fcn.140017e10
mov rcx, rbx
call fcn.140016a60
lea rcx, [rsp + 0x30]
call fcn.140014620
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x30]
call fcn.1400146b0
xor ebp, ebp
mov dword [rdi + 0xc], ebp
mov rdx, rbp
mov ecx, ebp
movzx eax, byte [rsp + rdx + 0x30]
add rdx, 4
add ecx, eax
movzx eax, byte [rsp + rdx + 0x2d]
add ecx, eax
movzx eax, byte [rsp + rdx + 0x2e]
add ecx, eax
movzx eax, byte [rsp + rdx + 0x2f]
add ecx, eax
cmp rdx, 0x10
jl 0x14001459d
mov dword [rdi + 0xc], ecx
lea rdx, [0x14009e810]
mov rcx, rsi
call fcn.1400195fc
mov qword [rdi], rax
test rax, rax
je 0x140033c60
mov rcx, rdi
call fcn.140014360
test eax, eax
je 0x140033c6a
mov rcx, qword [rdi]
mov ebx, eax
call fcn.140019694
mov eax, ebx
lea r11, [rsp + 0x1d0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
mov eax, 1
jmp 0x1400145fd
mov r9, qword [rdi]
mov edx, 1
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 0xf]
call fcn.140019a28
lea rdx, [rsp + 0x20]
mov r9d, 0x99f2
mov r8d, reloc.WSOCK32.dll_recv
mov rcx, rdi
call fcn.140058f00
mov dword [rdi + 0xc], ebp
mov ecx, ebp
movzx eax, byte [rsp + rbp + 0x20]
inc rbp
imul ecx, eax
cmp rbp, 0x10
jl 0x140033c9e
mov dword [rdi + 0xc], ecx
mov rcx, qword [rdi]
call fcn.140019d7c
mov dword [rdi + 8], eax
xor eax, eax
jmp 0x1400145fd
Function at 0x14003f170
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
movsxd rax, dword [rcx + 0x488]
mov rbx, rcx
test eax, eax
je 0x14003f1a3
mov r9, qword [rcx + 0x30]
mov rcx, qword [rcx + 0x478]
mov r8, rax
mov edx, 1
call fcn.140018ce4
and dword [rbx + 0x488], 0
add rsp, 0x20
pop rbx
ret

Function at 0x14003f1b0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0x488]
mov rax, qword [rcx + 0x478]
mov rbx, rcx
mov byte [r8 + rax], dl
mov edx, 1
mov r8d, 0x10000
add dword [rcx + 0x488], edx
cmp dword [rcx + 0x488], r8d
jne 0x14003f1fc
mov r9, qword [rcx + 0x30]
mov rcx, qword [rcx + 0x478]
call fcn.140018ce4
and dword [rbx + 0x488], 0
add rsp, 0x20
pop rbx
ret

Function at 0x14003f2d0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov edx, 1
mov rbx, rcx
lea r8d, [rdx + 7]
cmp dword [rcx + 0x1c], edx
jne 0x14003f301
mov edx, dword [rcx + 0x14]
add rdx, qword [rcx + 8]
lea rcx, [rsp + 0x30]
call fcn.140016710
jmp 0x14003f30f
mov r9, qword [rcx + 0x28]
lea rcx, [rsp + 0x30]
call fcn.140019a28
movzx ecx, byte [rsp + 0x34]
movzx eax, byte [rsp + 0x35]
add dword [rbx + 0x14], 8
shl ecx, 8
lea rdx, str.EA06
xor ebx, ebx
or ecx, eax
movzx eax, byte [rsp + 0x36]
mov byte [rsp + 0x34], bl
shl ecx, 8
or ecx, eax
movzx eax, byte [rsp + 0x37]
shl ecx, 8
or ecx, eax
mov dword [rdi], ecx
lea rcx, [rsp + 0x30]
call fcn.140019a60
cmp eax, ebx
setne bl
mov eax, ebx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14003f3e0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov r9d, 1
mov dword [0x1400c5530], ecx
lea rdx, [0x1400c5530]
mov r8d, r9d
mov eax, dword [rdx]
add rdx, 4
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
lea rax, [0x1400c5eec]
imul ecx, ecx, 0x6c078965
add ecx, r8d
add r8d, r9d
cmp rdx, rax
mov dword [rdx], ecx
jl 0x14003f3f6
mov dword [reloc.WSOCK32.dll_accept], r9d
mov dword [0x1400c5f04], r9d
ret

Function at 0x140040590
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
test ecx, ecx
js 0x140040613
push rbx
sub rsp, 0x20
mov ebx, ecx
test ecx, ecx
je 0x140040608
cmp ecx, 0xf
jae 0x140040606
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x140040606
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov r11, qword [rsp + 0x38]
sub r11, qword [rsp + 0x40]
pxor xmm1, xmm1
pxor xmm0, xmm0
cvtsi2sd xmm0, qword [rsp + 0x48]
cvtsi2sd xmm1, r11
divsd xmm1, xmm0
mulsd xmm1, qword [0x1400a3ca0]
cvttsd2si rax, xmm1
cmp eax, ebx
jb 0x1400405be
jmp 0x14004060e
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_Sleep]
add rsp, 0x20
pop rbx
ret
Function at 0x1400614b0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x450
xor ebx, ebx
mov r14, r8
mov r13, rdx
lea r15d, [rbx + 1]
mov rsi, rcx
mov r12d, ebx
mov bpl, r15b
lea edi, [rbx + 4]
mov r9, qword [rsi]
lea rcx, [rsp + 0x24]
mov r8, rdi
mov rdx, r15
call fcn.140019a28
lea rdx, [rsp + 0x24]
mov r9d, 0x18ee
mov r8d, edi
mov rcx, rsi
call fcn.140058f00
lea rdx, str.FILE
lea rcx, [rsp + 0x24]
mov byte [rsp + 0x28], bl
call fcn.140019a60
cmp eax, ebx
jne 0x14006166f
mov r9, qword [rsi]
lea rcx, [rsp + 0x20]
mov r8, r15
mov rdx, rdi
add r12d, r15d
call fcn.140019a28
mov edi, dword [rsp + 0x20]
mov r9, qword [rsi]
xor edi, 0xadbc
lea rcx, [rsp + 0x30]
mov rdx, r15
lea ebx, [rdi + rdi]
movsxd r8, ebx
call fcn.140019a28
lea r9d, [rdi + 0xb33f]
lea rdx, [rsp + 0x30]
mov r8d, ebx
mov rcx, rsi
call fcn.140058f00
movsxd r11, edi
xor eax, eax
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x240]
mov word [rsp + r11*2 + 0x30], ax
call fcn.140016e4c
mov r9, qword [rsi]
lea rcx, [rsp + 0x20]
mov r8, r15
mov edx, 4
call fcn.140019a28
mov edi, dword [rsp + 0x20]
mov r9, qword [rsi]
xor edi, 0xf820
lea rcx, [rsp + 0x30]
mov rdx, r15
lea ebx, [rdi + rdi]
movsxd r8, ebx
call fcn.140019a28
lea r9d, [rdi + 0xf479]
lea rdx, [rsp + 0x30]
mov r8d, ebx
mov rcx, rsi
call fcn.140058f00
movsxd r11, edi
lea rdx, [rsp + 0x30]
xor ebx, ebx
mov rcx, r14
mov word [rsp + r11*2 + 0x30], bx
call fcn.140016e4c
lea rcx, [rsp + 0x240]
mov rdx, r13
call fcn.140017790
cmp eax, ebx
je 0x1400616a1
lea rdx, [0x14009e840]
mov rcx, r13
call fcn.140017790
cmp eax, ebx
jne 0x14006162b
cmp r12d, ebx
je 0x1400616a1
mov rcx, qword [rsi]
mov r8d, r15d
mov edx, r15d
call fcn.140019e98
mov r9, qword [rsi]
mov edi, 4
lea rcx, [rsp + 0x2c]
mov rdx, rdi
mov r8, r15
call fcn.140019a28
mov edx, dword [rsp + 0x2c]
mov rcx, qword [rsi]
xor edx, 0x87bc
mov r8d, r15d
mov dword [rsp + 0x2c], edx
add edx, 0x18
call fcn.140019e98
jmp 0x140061672
mov bpl, bl
cmp bpl, r15b
je 0x1400614e7
mov eax, 6
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor eax, eax
jmp 0x140061680
Function at 0x1400616b0
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x6d0
xor r15d, r15d
mov rbx, rdx
mov edx, dword [rcx + 8]
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x40], r15d
mov dword [rsp + 0x44], r15d
mov dword [rsp + 0x48], r15d
mov dword [rsp + 0x4c], r15d
mov dword [rsp + 0x50], r15d
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], r15
mov word [rsp + 0x68], r15w
mov r13, rcx
mov rcx, qword [rcx]
mov r14, r8
lea r12d, [r15 + 1]
xor r8d, r8d
mov rbp, r9
mov word [rax - 0x486], r15w
mov qword [rax - 0x258], r15
mov dword [rsp + 0x24], r12d
call fcn.140019e98
lea r8, [rsp + 0x4c0]
xor r9d, r9d
mov rdx, rbx
mov rcx, r13
call fcn.1400614b0
cmp eax, r15d
je 0x14006175b
lea eax, [r15 + 6]
jmp 0x1400618d1
mov r9, qword [r13]
lea rcx, [rsp + 0x700]
mov r8, r12
mov rdx, r12
call fcn.140019a28
mov r9, qword [r13]
mov edi, 4
lea rcx, [rsp + 0x20]
mov rdx, rdi
mov r8, r12
call fcn.140019a28
mov esi, dword [rsp + 0x20]
mov r9, qword [r13]
lea rcx, [rsp + 0x20]
mov ebx, 0x87bc
mov r8, r12
mov rdx, rdi
xor esi, ebx
call fcn.140019a28
mov r11d, dword [rsp + 0x20]
mov r9, qword [r13]
xor r11d, ebx
lea rcx, [rsp + 0x20]
mov r8, r12
mov rdx, rdi
mov dword [rbp], r11d
call fcn.140019a28
mov edi, dword [rsp + 0x20]
mov rcx, qword [r13]
mov r8d, r12d
mov edx, reloc.WSOCK32.dll_recv
xor edi, 0xa685
call fcn.140019e98
mov ecx, dword [rbp]
call fcn.140017ca8
movsxd rbx, esi
mov rcx, rbx
mov rbp, rax
call fcn.140017ca8
mov r9, qword [r13]
mov r8d, 1
mov rcx, rax
mov rdx, rbx
mov r12, rax
call fcn.140019a28
mov r9d, dword [r13 + 0xc]
mov r8d, esi
mov rdx, r12
mov rcx, r13
add r9d, 0x2477
call fcn.140058f00
lea rcx, [rsp + 0x24]
mov r8d, esi
mov rdx, r12
call fcn.14003f370
cmp edi, dword [rsp + 0x24]
je 0x140061859
mov rcx, rbp
call fcn.140017ec8
mov rcx, r12
call fcn.140017ec8
mov eax, 0xa
jmp 0x1400618d1
cmp byte [rsp + 0x700], 1
jne 0x1400618c1
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x40], r15d
mov dword [rsp + 0x44], r15d
mov dword [rsp + 0x48], r15d
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], r15
mov word [rsp + 0x68], r15w
mov word [rsp + 0x272], r15w
mov qword [rsp + 0x4a0], r15
mov dword [rsp + 0x4c], 1
mov dword [rsp + 0x50], 1
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], rbp
call fcn.140059110
mov rcx, r12
call fcn.140017ec8
jmp 0x1400618cc
mov rcx, rbp
call fcn.140017ec8
mov rbp, r12
mov qword [r14], rbp
xor eax, eax
lea r11, [rsp + 0x6d0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1800010a4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x1800a7120]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rcx + 0x20], reloc.WS2_32.dll_ntohs
mov rbx, rcx
mov qword [rcx + 0x18], rax
mov byte [rsp + 0x28], reloc.WS2_32.dll_WSAStartup
mov byte [rsp + 0x29], 0x59
mov byte [rsp + 0x38], al
mov byte [rsp + 0x2a], Ordinal_79
mov byte [rsp + 0x2b], 0x66
mov byte [rsp + 0x2c], 0x64
mov byte [rsp + 0x2d], Ordinal_41
mov byte [rsp + 0x2e], 0x41
mov byte [rsp + 0x2f], 0x75
mov byte [rsp + 0x30], 0x69
mov byte [rsp + 0x31], 0x33
mov byte [rsp + 0x32], 0x48
mov byte [rsp + 0x33], 0x55
mov byte [rsp + 0x34], 0x76
mov byte [rsp + 0x35], Ordinal_41
mov byte [rsp + 0x36], reloc.WS2_32.dll_gethostname
mov byte [rsp + 0x37], gethostname
mov byte [rcx + 8], al
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x28]
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x28]
mov dword [rsp + 0x20], eax
not rcx
lea r8, [rcx - 1]
mov rcx, rbx
call fcn.18000164c
mov rax, rbx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.18005c4c0
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret