joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140184a00
Capabilities:
Contain obfuscated stackstrings
Encrypt data using salsa20 or chacha

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x1404f2618]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov eax, dword [rcx + 0xc]
mov rbx, rdx
mov dword [rsp + 0x30], eax
xor edx, edx
mov eax, dword [rcx + 0x1c]
mov rdi, r8
mov dword [rsp + 0x38], eax
mov eax, dword [rcx + 8]
mov dword [rsp + 0x3c], eax
mov eax, dword [rcx + 0x18]
mov dword [rsp + 0x44], eax
mov eax, dword [rcx + 4]
mov dword [rsp + 0x48], eax
mov eax, dword [rcx + 0x14]
mov dword [rsp + 0x50], eax
mov eax, dword [rcx]
mov dword [rsp + 0x54], eax
mov eax, dword [rcx + 0x10]
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x34], edx
mov dword [rsp + 0x40], edx
mov dword [rsp + 0x4c], edx
mov dword [rsp + 0x58], edx
mov rdx, rbx
mov dword [rsp + 0x20], 0x61707865
mov dword [rsp + 0x24], 0x3320646e
mov dword [rsp + 0x28], 0x79622d32
mov dword [rsp + 0x2c], 0x6b206574
mov dword [rsp + 0x5c], eax
call fcn.1401881d0
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rbx - 0x10], xmm0
movups xmmword [rdi + rbx], xmm1
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140346fd0
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret

Function at 0x140184ac0
Capabilities:
Contain obfuscated stackstrings
Encrypt data using salsa20 or chacha

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x1404f2618]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, r8
mov rbx, rdx
test r8, r8
je 0x140184b6e
mov eax, dword [rcx]
xor edx, edx
mov dword [rsp + 0x34], eax
mov eax, dword [rcx + 4]
mov dword [rsp + 0x48], eax
mov eax, dword [rcx + 8]
mov dword [rsp + 0x5c], eax
mov eax, dword [rcx + 0xc]
mov dword [rsp + 0x50], eax
mov eax, dword [rcx + 0x10]
mov dword [rsp + 0x3c], eax
mov eax, dword [rcx + 0x14]
mov dword [rsp + 0x30], eax
mov eax, dword [rcx + 0x18]
mov dword [rsp + 0x44], eax
mov eax, dword [rcx + 0x1c]
mov rcx, rbx
mov dword [rsp + 0x58], eax
xor eax, eax
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x4c], eax
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x54], eax
mov dword [rsp + 0x20], 0x61707865
mov dword [rsp + 0x24], 0x3320646e
mov dword [rsp + 0x28], 0x79622d32
mov dword [rsp + 0x2c], 0x6b206574
call fcn.140349d10
mov r9, rdi
lea rcx, [rsp + 0x20]
mov r8, rbx
mov rdx, rbx
call fcn.140186530
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rbx - 0x10], xmm0
movups xmmword [rdi + rbx], xmm1
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140346fd0
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
Function at 0x140189710
Capabilities:
Create thread

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov r12, r8
mov rbx, rdx
mov r14, rcx
mov rdx, qword [rcx]
mov rdi, rbx
sub rdi, rdx
mov rax, qword [rcx + 8]
sub rax, rdx
sar rax, 4
movabs r9, 0xfffffffffffffff
cmp rax, r9
je 0x14018990c
lea r8, [rax + 1]
mov qword [rsp + 0xa8], r8
mov rcx, qword [rcx + 0x10]
sub rcx, rdx
sar rcx, 4
mov rdx, rcx
shr rdx, 1
mov rax, r9
sub rax, rdx
cmp rcx, rax
jbe 0x14018984e
mov rsi, r9
mov qword [rsp + 0x98], r9
mov rcx, rsi
shl rcx, 4
call fcn.140003fb0
mov r15, rax
mov qword [rsp + 0x38], rax
and rdi, 0xfffffffffffffff0
lea r13, [rdi + rax]
lea rdi, [r13 + 0x10]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x90], rdi
mov ecx, 0x18
call fcn.140346ff0
movups xmm0, xmmword [r12]
movups xmmword [rax], xmm0
movsd xmm1, qword [r12 + 0x10]
movsd qword [rax + 0x10], xmm1
mov qword [rsp + 0x40], rax
lea r12, [r13 + 8]
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x140189920]
xor edx, edx
xor ecx, ecx
call fcn.140355040
mov qword [r13], rax
test rax, rax
je 0x1401898f9
mov qword [rsp + 0x90], r13
mov rcx, qword [r14 + 8]
mov rax, qword [r14]
mov rdx, r15
cmp rbx, rcx
jne 0x140189872
cmp rax, rcx
je 0x1401898d0
nop dword [rax + rax]
xorps xmm0, xmm0
movups xmm1, xmmword [rax]
movups xmmword [rax], xmm0
movups xmmword [rdx], xmm1
lea rdx, [rdx + 0x10]
add rax, 0x10
cmp rax, rcx
jne 0x140189830
jmp 0x1401898d0
lea rax, [rdx + rcx]
mov rsi, r8
cmp rax, r8
cmovae rsi, rax
mov qword [rsp + 0x98], rsi
cmp rsi, r9
ja 0x140189912
jmp 0x140189787
cmp rax, rbx
je 0x14018989d
nop word [rax + rax]
xorps xmm0, xmm0
movups xmm1, xmmword [rax]
movups xmmword [rax], xmm0
movups xmmword [rdx], xmm1
lea rdx, [rdx + 0x10]
add rax, 0x10
cmp rax, rbx
jne 0x140189880
mov rcx, qword [r14 + 8]
mov qword [rsp + 0x90], r15
cmp rbx, rcx
je 0x1401898d0
sub rdi, rbx
nop dword [rax]
xorps xmm0, xmm0
movups xmm1, xmmword [rbx]
movups xmmword [rbx], xmm0
movups xmmword [rdi + rbx], xmm1
add rbx, 0x10
cmp rbx, rcx
jne 0x1401898b0
nop word [rax + rax]
mov r9, rsi
mov r8, qword [rsp + 0xa8]
mov rdx, r15
mov rcx, r14
call fcn.1401749f0
mov rax, r13
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov dword [r12], 0
mov ecx, 6
call fcn.140345814
nop
call fcn.140014130
int3
call fcn.140003da0
int3
Function at 0x140190090
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rdx + 0x3f8]
lea r8, [rcx + 0x3f8]
cmp rcx, rax
ja 0x1401900d2
xor r9d, r9d
cmp r8, rdx
jb 0x1401900d2
mov r8d, 0x80
lea rax, [rcx + r9*8]
sub rdx, rcx
sub r8, r9
nop dword [rax + rax]
mov rcx, qword [rax + rdx]
xor qword [rax], rcx
lea rax, [rax + 8]
sub r8, 1
jne 0x1401900c0
ret
lea rax, [rcx + 0x10]
sub rdx, rcx
mov ecx, reloc.WS2_32.dll_recv
nop
movdqu xmm0, xmmword [rax - 0x10]
movdqu xmm1, xmmword [rdx + rax - 0x10]
movdqu xmm2, xmmword [rdx + rax]
lea rax, [rax + 0x40]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x50], xmm1
movdqu xmm0, xmmword [rax - 0x40]
movdqu xmm1, xmmword [rdx + rax - 0x30]
pxor xmm2, xmm0
movdqu xmmword [rax - 0x40], xmm2
movdqu xmm0, xmmword [rax - 0x30]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x30], xmm1
movdqu xmm0, xmmword [rax - 0x20]
movdqu xmm1, xmmword [rdx + rax - 0x20]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x20], xmm1
sub rcx, 1
jne 0x1401900e0
ret
Function at 0x140197ee8
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r15
sub rsp, 0x80
mov rax, qword [0x1404f2618]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, rdx
mov rsi, rcx
test dl, 0x3f
je 0x140197f17
xor al, al
jmp 0x140198034
mov r15d, 0x40
shr rbx, 6
mov dword [rsp + 0x28], r15d
mov ecx, 0x200
mov qword [rsp + 0x20], rsi
lea edx, [r15 - 0x3f]
lea r9d, [r15 - 0x20]
call fcn.140015b90
lea edi, [r15 - 0x3f]
cmp ebx, edi
je 0x140197f7b
mov ecx, edi
lea r8d, [rdi - 1]
shl rcx, 6
mov r9d, r15d
add rcx, rsi
shl r8, 6
mov dword [rsp + 0x28], r15d
add r8, rsi
mov qword [rsp + 0x20], rcx
mov edx, 1
mov ecx, 0x200
call fcn.140015b90
inc edi
cmp edi, ebx
jne 0x140197f45
mov ebp, 3
xor edi, edi
test ebx, ebx
je 0x140198028
xor edx, edx
mov r9d, edi
shl r9, 6
add r9, rsi
mov eax, dword [r9]
div ebx
lea eax, [rbx - 1]
mov r8d, edx
add eax, edi
xor edx, edx
shl r8, 6
div ebx
mov ecx, edx
lea rdx, [rsp + 0x30]
shl rcx, 6
sub r8, rdx
add r8, rsi
mov edx, reloc.WS2_32.dll_recv
movups xmm0, xmmword [rcx + rsi]
movups xmm1, xmmword [rcx + rsi + 0x10]
movaps xmmword [rsp + 0x30], xmm0
movups xmm0, xmmword [rcx + rsi + 0x20]
movaps xmmword [rsp + 0x40], xmm1
movups xmm1, xmmword [rcx + rsi + 0x30]
lea rcx, [rsp + 0x30]
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x60], xmm1
mov eax, dword [r8 + rcx]
xor dword [rcx], eax
lea rcx, [rcx + 4]
sub rdx, 1
jne 0x140197fed
mov dword [rsp + 0x28], r15d
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], r9
mov edx, 1
mov r9d, r15d
mov ecx, 0x200
call fcn.140015b90
inc edi
cmp edi, ebx
jne 0x140197f8a
sub rbp, 1
jne 0x140197f80
mov al, 1
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140346fd0
add rsp, 0x80
pop r15
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140198050
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x1404f2618]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rax, qword [r9]
xor ebp, ebp
mov r14, r9
mov r13d, edx
mov qword [rsp + 0x38], rcx
mov rsi, rcx
mov qword [rsp + 0x30], rax
mov rbx, rax
lea edi, [rbp + 4]
mov eax, dword [r14 + 0x1c]
mov r8, r13
mov cl, byte [r14 + 0x24]
add r8, rbp
mov edx, dword [r14 + 0x20]
mov r9d, 0x40
add rdx, r8
mov dword [rsp + 0x28], 0x40
imul rdx, rax
mov qword [rsp + 0x20], rsi
shr rdx, cl
mov ecx, 0x200
imul edx, dword [r14 + 0x18]
sub r8d, edx
lea edx, [r9 - 0x3f]
mov eax, r8d
mov r8, rsi
shl rax, 6
movups xmm0, xmmword [rax + rbx]
movups xmmword [rsi], xmm0
movups xmm1, xmmword [rax + rbx + 0x10]
movups xmmword [rsi + 0x10], xmm1
movups xmm0, xmmword [rax + rbx + 0x20]
movups xmmword [rsi + 0x20], xmm0
movups xmm1, xmmword [rax + rbx + 0x30]
mov eax, ebp
add eax, r13d
movups xmmword [rsi + 0x30], xmm1
xor dword [rsi], eax
call fcn.140015b90
inc rbp
add rsi, 0x40
cmp rbp, rdi
jb 0x140198099
mov rbx, qword [rsp + 0x38]
xor r9d, r9d
xor r10d, r10d
mov ebp, dword [r14 + 0x24]
lea r11, [rsp + 0x40]
mov r15d, dword [r14 + 0x20]
mov rax, r10
mov r12d, dword [r14 + 0x1c]
xor r8d, r8d
and eax, 0xf
lea rsi, [rbx + rax*4]
mov rbx, qword [rsp + 0x30]
lea eax, [r8 + r13]
xor eax, r9d
imul ecx, eax, 0x1000193
xor ecx, dword [rsi]
mov edx, ecx
lea rax, [r15 + rcx]
mov rcx, rbp
imul rax, r12
shr rax, cl
imul eax, dword [r14 + 0x18]
sub edx, eax
mov ecx, edx
shl rcx, 6
add rcx, rbx
mov qword [r11], rcx
prefetcht0 byte [rcx]
inc r8d
lea rsi, [rsi + 0x40]
lea r11, [r11 + 8]
cmp r8d, edi
jb 0x14019814f
mov rbx, qword [rsp + 0x38]
mov r11d, reloc.WS2_32.dll_recv
mov rdx, qword [rsp + 0x40]
mov rcx, rbx
sub rdx, rbx
mov r8d, r11d
lea esi, [r11 - 0xf]
imul eax, dword [rcx], 0x1000193
xor eax, dword [rdx + rcx]
mov dword [rcx], eax
add rcx, rdi
sub r8, rsi
jne 0x1401981b1
mov rdx, qword [rsp + 0x48]
lea rcx, [rbx + 0x40]
sub rdx, rbx
mov r8, r11
imul eax, dword [rcx], 0x1000193
xor eax, dword [rdx + rcx - 0x40]
mov dword [rcx], eax
add rcx, rdi
sub r8, rsi
jne 0x1401981d3
mov rdx, qword [rsp + 0x50]
lea rcx, [rbx + 0x80]
sub rdx, rbx
mov r8, r11
imul eax, dword [rcx], 0x1000193
xor eax, dword [rdx + rcx - 0x80]
mov dword [rcx], eax
add rcx, rdi
sub r8, rsi
jne 0x1401981f9
mov rdx, qword [rsp + 0x58]
lea rcx, [rbx + 0xc0]
sub rdx, rbx
mov r8, r11
imul eax, dword [rcx], 0x1000193
xor eax, dword [rdx + rcx - 0xc0]
mov dword [rcx], eax
add rcx, rdi
sub r8, rsi
jne 0x14019821f
add r9d, esi
add r10, rsi
cmp r9d, 0x200
jne 0x14019812c
mov dword [rsp + 0x28], 0x40
mov r9d, 0x40
mov r8, rbx
mov qword [rsp + 0x20], rbx
mov edx, esi
mov ecx, 0x200
call fcn.140015b90
add rbx, 0x40
sub rdi, rsi
jne 0x140198249
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140346fd0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14019b340
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov edx, dword [rcx + 0x60]
mov rbx, rcx
and edx, 0x3f
mov eax, gethostname
mov rsi, r9
lea rdi, [rbx + 0x40]
mov byte [rdx + rcx], 0x80
inc edx
mov ecx, edx
add rcx, rbx
cmp edx, eax
jbe 0x14019b3a2
lea r8d, [rax + 8]
sub r8d, edx
xor edx, edx
call fcn.140349d10
mov rdx, rdi
mov rcx, rbx
call fcn.140198a54
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
movups xmmword [rbx + 0x20], xmm0
mov qword [rbx + 0x30], rax
jmp 0x14019b3ae
sub eax, edx
xor edx, edx
mov r8d, eax
call fcn.140349d10
mov rcx, qword [rbx + 0x60]
shl rcx, 3
rol rcx, 0x20
mov rdx, rcx
mov rax, rcx
shl rcx, 0x10
shr rdx, 0x10
shl rax, 0x10
xor rdx, rax
movabs rax, 0xffff0000ffff
and rdx, rax
xor rdx, rcx
mov rcx, rdx
mov rax, rdx
shr rcx, 8
shl rax, 8
xor rcx, rax
shl rdx, 8
movabs rax, 0xff00ff00ff00ff
and rcx, rax
xor rcx, rdx
mov rdx, rdi
mov qword [rbx + 0x38], rcx
mov rcx, rbx
call fcn.140198a54
xor r8d, r8d
mov ecx, dword [rdi]
lea rdi, [rdi + 4]
rol ecx, 0x10
mov eax, ecx
mov edx, ecx
shr edx, 8
shl eax, 8
xor edx, eax
shl ecx, 8
and edx, 0xff00ff
lea eax, [r8*4]
xor edx, ecx
inc r8d
mov dword [rax + rsi], edx
cmp r8d, 8
jb 0x14019b416
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14019b45c
Capabilities:
Hash data using sha256

Disassembly:
mov r11, rsp
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0xb0
mov rax, qword [0x1404f2618]
xor rax, rsp
mov qword [rsp + 0xa0], rax
movups xmm0, xmmword [0x14046a518]
mov rdi, r8
mov rsi, rdx
movups xmm1, xmmword [0x14046a528]
mov r14, rcx
movaps xmmword [rsp + 0x70], xmm0
and qword [r11 - 0x48], 0
movaps xmmword [r11 - 0x58], xmm1
cmp r8, 0x80
jae 0x14019b4b9
lea rcx, [rsp + 0x30]
call fcn.14019b2ac
jmp 0x14019b4fb
mov rbx, rdi
shr rbx, 6
imul rbp, rbx, 0xffffffffffffffc0
add rbp, rdi
lea rdx, [rsp + 0x70]
mov rcx, rsi
call fcn.140198a54
add rsi, 0x40
sub rbx, 1
jne 0x14019b4c7
test rbp, rbp
je 0x14019b4f3
mov r8, rbp
lea rcx, [rsp + 0x30]
mov rdx, rsi
call fcn.140349660
add qword [rsp + 0x90], rdi
mov r9, r14
lea rcx, [rsp + 0x30]
call fcn.14019b340
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140346fd0
add rsp, 0xb0
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14019c7c0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
movzx esi, r8b
mov rdi, rdx
mov rbx, rcx
add rcx, 0x70
xor edx, edx
mov r8d, 0x200
call fcn.140349d10
xor ebp, ebp
mov dword [rbx + 0x270], ebp
mov byte [rbx + 0x274], bpl
mov byte [rbx + 0x275], bpl
mov qword [rbx + 0x278], rdi
mov byte [rbx + 0x280], sil
mov qword [rbx + 0x288], rbp
mov rcx, rbx
call fcn.1403232a0
lea rcx, [rbx + 0x28]
call fcn.1403231f0
lea ecx, [rbp + 0x10]
call fcn.140346ff0
mov rdi, rax
mov qword [rsp + 0x50], rax
lea ecx, [rbp + 0x10]
call fcn.140346ff0
mov qword [rax], rbx
lea rcx, [0x14019c8c0]
mov qword [rax + 8], rcx
mov qword [rsp + 0x58], rax
lea rsi, [rdi + 8]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], ebp
mov r9, rax
lea r8, [0x1400701e0]
xor edx, edx
xor ecx, ecx
call fcn.140355040
mov qword [rdi], rax
test rax, rax
je 0x14019c8ab
mov qword [rbx + 0x288], rdi
mov qword [rsp + 0x50], 1
lea rcx, [rsp + 0x50]
call fcn.1400825c0
movzx eax, byte [rbx + 0x274]
test al, al
je 0x14019c886
mov rax, rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
mov dword [rsi], ebp
mov ecx, 6
call fcn.140345814
int3
Function at 0x14019ca10
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov eax, 1
xchg dword [0x14079c810], eax
test eax, eax
jne 0x14019cbc0
lea ecx, [rax + 1]
call fcn.140346ff0
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
xor ebx, ebx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x14019ef70]
xor edx, edx
xor ecx, ecx
call fcn.140355040
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14019cbd5
cmp dword [rsp + 0x38], ebx
je 0x14019cbe4
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [rsp + 0x38], eax
je 0x14019cbef
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.140345f54
test eax, eax
jne 0x14019cbfa
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
cmp dword [0x14078ae80], eax
jbe 0x14019cafb
lea rdx, str._____________________________________________
lea ecx, [rbx + 6]
call fcn.1400264e0
cmp dword [0x14078ae80], ebx
jbe 0x14019cafb
lea rdx, str._________GhostRider_tuning_results_________
lea ecx, [rbx + 6]
call fcn.1400264e0
cmp dword [0x14078ae80], ebx
jbe 0x14019cafb
lea rdx, str._____________________________________________
lea ecx, [rbx + 6]
call fcn.1400264e0
lea rdi, str.cn_dark__512_KB_
mov esi, 6
lea rbp, [0x140000000]
nop
cmp dword [0x14078ae80], 0
jbe 0x14019cb4f
movsd xmm0, qword [rbx + rbp + 0x4f9140]
movsd qword [rsp + 0x28], xmm0
mov eax, dword [rbx + rbp + 0x4f914c]
mov dword [rsp + 0x20], eax
mov r9d, dword [rbx + rbp + 0x4f9148]
mov r8, qword [rdi]
lea rdx, str._24s___ux_u___.2f_h_s
mov ecx, 6
call fcn.1400264e0
mov r9d, dword [rbx + rbp + 0x4f90e8]
cmp r9d, dword [rbx + rbp + 0x4f9148]
jne 0x14019cb71
mov eax, dword [rbx + rbp + 0x4f914c]
cmp dword [rbx + rbp + 0x4f90ec], eax
je 0x14019cba8
cmp dword [0x14078ae80], 0
jbe 0x14019cba8
movsd xmm0, qword [rbx + rbp + 0x4f90e0]
movsd qword [rsp + 0x28], xmm0
mov eax, dword [rbx + rbp + 0x4f90ec]
mov dword [rsp + 0x20], eax
mov r8, qword [rdi]
lea rdx, str._24s___ux_u___.2f_h_s
mov ecx, 6
call fcn.1400264e0
add rbx, 0x10
add rdi, 8
sub rsi, 1
jne 0x14019cb10
cmp dword [rsp + 0x38], esi
jne 0x14019cc05
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
mov dword [rsp + 0x38], ebx
mov ecx, 6
call fcn.140345814
nop
mov ecx, 1
call fcn.140345814
int3
mov ecx, 5
call fcn.140345814
int3
mov ecx, 2
call fcn.140345814
nop
call fcn.14035239c
int3
Function at 0x1401b66f4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rax, qword [0x1404f2618]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov r10, qword [rcx + 8]
mov rbx, rcx
mov rax, qword [rcx + 0x50]
mov rdi, r9
mov byte [rbx + r10], 0x80
lea rdx, [rax + r10*8]
rol rdx, 0x20
mov r8, rdx
mov rax, rdx
shr r8, 0x10
shl rax, 0x10
xor r8, rax
shl rdx, 0x10
movabs rax, 0xffff0000ffff
and r8, rax
xor r8, rdx
mov rcx, r8
mov rax, r8
shr rcx, 8
shl rax, 8
xor rcx, rax
shl r8, 8
movabs rax, 0xff00ff00ff00ff
and rcx, rax
xor rcx, r8
mov r8d, 8
inc r10
mov qword [rsp + 0x20], rcx
cmp r10, r8
jae 0x1401b6793
sub r8, r10
lea rcx, [rbx + r10]
xor edx, edx
call fcn.140349d10
mov r8d, 1
mov rdx, rbx
mov rcx, rbx
call fcn.1401ad5a4
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1401b085c
xor r8d, r8d
add rbx, 0x10
mov edx, dword [rbx]
lea rbx, [rbx + 4]
rol edx, 0x10
mov ecx, edx
mov eax, edx
shr ecx, 8
shl eax, 8
xor ecx, eax
shl edx, 8
and ecx, 0xff00ff
xor ecx, edx
mov dword [rdi + r8*4], ecx
inc r8
cmp r8, 0x10
jb 0x1401b67b8
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140346fd0
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1401dd8bc
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xc0
mov rax, qword [0x1404f2618]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rbp, qword [rcx + 0x80]
lea r12, [rsp + 0x30]
mov rdx, qword [rcx + 0xe8]
add r12, rbp
mov rsi, qword [rcx + 0xf0]
or r13, 0xffffffffffffffff
xor edi, edi
mov qword [rsp + 0x20], r9
lea r8d, [rbp*8]
mov r15d, 0x80
mov byte [r12], r15b
lea r14, [rdx + r8]
mov rbx, rcx
test rbp, rbp
jne 0x1401dd93b
mov qword [rcx + 0xf0], r13
mov rdx, 0xfffffffffffffc00
jmp 0x1401dd95f
test rdx, rdx
jne 0x1401dd954
lea rax, [rsi - 1]
mov qword [rcx + 0xf0], rax
lea rdx, [r8 - 0x400]
jmp 0x1401dd95f
mov ecx, 0x400
sub ecx, r8d
sub rdx, rcx
lea rcx, [rsp + 0x31]
mov qword [rbx + 0xe8], rdx
add rcx, rbp
rol rsi, 0x20
rol r14, 0x20
xor edx, edx
cmp r8d, 0x37e
ja 0x1401dda29
lea r8d, [rdx + 0x6f]
sub r8, rbp
call fcn.140349d10
or byte [rsp + 0x9f], 1
mov rdx, rsi
shr rdx, 0x10
mov rax, rsi
shl rax, 0x10
movabs r13, 0xffff0000ffff
xor rdx, rax
shl rsi, 0x10
and rdx, r13
xor rdx, rsi
movabs rsi, 0xff00ff00ff00ff
mov rcx, rdx
mov rax, rdx
shr rcx, 8
shl rdx, 8
shl rax, 8
xor rcx, rax
mov rax, r14
and rcx, rsi
shl rax, 0x10
xor rcx, rdx
mov rdx, r14
shr rdx, 0x10
xor rdx, rax
mov qword [rsp + 0xa0], rcx
and rdx, r13
shl r14, 0x10
xor rdx, r14
mov rcx, rdx
mov rax, rdx
shr rcx, 8
shl rax, 8
xor rcx, rax
shl rdx, 8
and rcx, rsi
xor rcx, rdx
sub r15, rbp
jmp 0x1401ddaff
mov r8d, 0x7f
sub r8, rbp
call fcn.140349d10
mov r8, r15
mov rdx, r12
sub r8, rbp
mov rcx, rbx
call fcn.1401d9468
xor edx, edx
mov qword [rbx + 0xe8], 0xfffffffffffffc00
lea rcx, [rsp + 0x30]
mov qword [rbx + 0xf0], r13
lea r8d, [rdx + 0x6f]
call fcn.140349d10
mov rdx, rsi
mov byte [rsp + 0x9f], 1
shr rdx, 0x10
lea r12, [rsp + 0x30]
mov rax, rsi
movabs r13, 0xffff0000ffff
shl rax, 0x10
xor rdx, rax
shl rsi, 0x10
and rdx, r13
xor rdx, rsi
movabs rsi, 0xff00ff00ff00ff
mov rcx, rdx
mov rax, rdx
shr rcx, 8
shl rdx, 8
shl rax, 8
xor rcx, rax
mov rax, r14
and rcx, rsi
shl rax, 0x10
xor rcx, rdx
mov rdx, r14
shr rdx, 0x10
xor rdx, rax
mov qword [rsp + 0xa0], rcx
and rdx, r13
shl r14, 0x10
xor rdx, r14
mov rcx, rdx
mov rax, rdx
shr rcx, 8
shl rax, 8
xor rcx, rax
shl rdx, 8
and rcx, rsi
xor rcx, rdx
mov qword [rsp + 0xa8], rcx
mov r8, r15
mov rcx, rbx
mov rdx, r12
call fcn.1401d9468
mov r8, qword [rsp + 0x20]
add rbx, 0x88
mov rcx, qword [rbx]
lea rbx, [rbx + 8]
rol rcx, 0x20
mov rdx, rcx
mov rax, rcx
shl rcx, 0x10
shr rdx, 0x10
shl rax, 0x10
xor rdx, rax
and rdx, r13
xor rdx, rcx
mov rcx, rdx
mov rax, rdx
shr rcx, 8
shl rax, 8
xor rcx, rax
shl rdx, 8
and rcx, rsi
xor rcx, rdx
mov qword [r8 + rdi*8], rcx
inc rdi
cmp rdi, 8
jb 0x1401ddb21
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140346fd0
mov rbx, qword [rsp + 0x108]
add rsp, 0xc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14022ca20
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, gethostname
call fcn.140347c30
sub rsp, rax
mov r10, r8
mov r11, rcx
test r9, r9
jne 0x14022ca5f
mov edx, 0xe2
mov dword [rsp + 0x20], 0x9a
lea r9, str.crypto_asn1_a_int.c
lea ecx, [rax - 0x2b]
lea r8d, [rdx - 4]
call fcn.1402311a0
xor eax, eax
add rsp, 0x38
ret
movzx r8d, byte [r8]
and r8d, 0x80
test rdx, rdx
je 0x14022ca72
mov dword [rdx], r8d
cmp r9, 1
jne 0x14022ca94
test r11, r11
je 0x14022ca8a
movzx eax, byte [r10]
test r8d, r8d
je 0x14022ca88
neg al
mov byte [rcx], al
mov eax, 1
add rsp, 0x38
ret
movzx ecx, byte [r10]
mov qword [rsp + 0x40], rbx
xor ebx, ebx
mov eax, ebx
test cl, cl
jne 0x14022cab1
mov eax, 1
mov ebx, eax
jmp 0x14022cb5f
cmp cl, 0xff
jne 0x14022cb9d
mov eax, 1
lea rcx, [r9 - 1]
mov edx, ebx
cmp r9, rax
jbe 0x14022cb4f
cmp rcx, 8
jb 0x14022cb40
and ecx, 7
mov rdx, r9
sub rdx, rcx
xorps xmm2, xmm2
xorps xmm3, xmm3
movd xmm1, dword [rax + r10]
xorps xmm0, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
por xmm2, xmm1
movd xmm1, dword [rax + r10 + 4]
punpcklbw xmm1, xmm0
add rax, 8
punpcklwd xmm1, xmm0
por xmm1, xmm3
movdqa xmm3, xmm1
cmp rax, rdx
jb 0x14022cae3
por xmm2, xmm1
movdqa xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movd edx, xmm2
cmp rax, r9
jae 0x14022cb4f
nop
movzx ecx, byte [rax + r10]
inc rax
or edx, ecx
cmp rax, r9
jb 0x14022cb40
test edx, edx
mov eax, ebx
setne al
test edx, edx
setne bl
test edx, edx
je 0x14022cb9d
movzx ecx, byte [r10 + 1]
and ecx, 0x80
cmp r8d, ecx
jne 0x14022cb9d
mov edx, 0xe2
mov dword [rsp + 0x20], 0xbb
lea r9, str.crypto_asn1_a_int.c
mov ecx, reloc.WS2_32.dll_listen
lea r8d, [rdx - 5]
call fcn.1402311a0
mov rbx, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x38
ret
mov ecx, eax
sub r9, rcx
test r11, r11
je 0x14022cbf1
neg r8d
mov qword [rsp + 0x30], rdi
lea r8, [rbx + r10]
sbb edi, edi
add r8, r9
movzx edi, dil
mov ecx, edi
and ecx, 1
test r9, r9
je 0x14022cbec
mov rdx, r8
sub rdx, rbx
sub rdx, r10
nop
movzx eax, byte [r8 - 1]
lea r8, [r8 - 1]
dec rdx
xor eax, edi
add ecx, eax
mov byte [rdx + r11], cl
shr ecx, 8
test rdx, rdx
jne 0x14022cbd0
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
mov rax, r9
add rsp, 0x38
ret

Function at 0x140230350
Capabilities:
Set thread local storage value

Disassembly:
mov eax, 0x28
call fcn.140347c30
sub rsp, rax
mov ecx, dword [rcx]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x28
ret
Function at 0x140246750
Capabilities:
Get thread local storage value

Disassembly:
mov eax, 0x28
call fcn.140347c30
sub rsp, rax
lea rcx, [0x1404ff508]
add rsp, 0x28
jmp fcn.1402301b0

Function at 0x140251350
Capabilities:
Encode data using xor

Disassembly:
xor r9b, r9b
mov r10, rdx
test r8, r8
je 0x140251377
sub r10, rcx
nop
movzx edx, byte [r10 + rcx]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
xor dl, al
or r9b, dl
sub r8, 1
jne 0x140251360
movzx eax, r9b
ret