joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000c934
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
mov dl, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8b, dl
mov byte [rax + r9], r8b
inc r9
cmp r9, 0x10
jb 0x14000c93b
mov byte [rcx + 0x14], 0
ret

Function at 0x14000c95c
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
mov dl, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8b, dl
mov byte [rax + r9], r8b
inc r9
cmp r9, 0x13
jb 0x14000c963
mov byte [rcx + 0x17], 0
ret

Function at 0x14000c984
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x38
mov r9, rax
mov dl, byte [r9]
mov r8d, dword [rcx]
xor r8b, dl
mov byte [r9], r8b
inc r9
sub r10, 1
jne 0x14000c991
mov byte [rcx + 0x3c], r10b
ret

Function at 0x14000c9ac
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
mov dl, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8b, dl
mov byte [rax + r9], r8b
inc r9
cmp r9, 0xc
jb 0x14000c9b3
mov byte [rcx + 0x10], 0
ret

Function at 0x14000c9d4
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x7b
mov r9, rax
mov dl, byte [r9]
mov r8d, dword [rcx]
xor r8b, dl
mov byte [r9], r8b
inc r9
sub r10, 1
jne 0x14000c9e1
mov byte [rcx + 0x7f], r10b
ret

Function at 0x14000ca18
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
mov dl, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8b, dl
mov byte [rax + r9], r8b
inc r9
cmp r9, 0x1d
jb 0x14000ca1f
mov byte [rcx + 0x21], 0
ret

Function at 0x14000ca40
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x14
mov r9, rax
mov dl, byte [r9]
mov r8d, dword [rcx]
xor r8b, dl
mov byte [r9], r8b
inc r9
sub r10, 1
jne 0x14000ca4d
mov byte [rcx + 0x18], r10b
ret

Function at 0x14000ca68
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0xc
mov r9, rax
mov dl, byte [r9]
mov r8d, dword [rcx]
xor r8b, dl
mov byte [r9], r8b
inc r9
sub r10, 1
jne 0x14000ca75
mov byte [rcx + 0x10], r10b
ret

Function at 0x14000cb00
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x43
mov r9, rax
mov dl, byte [r9]
mov r8d, dword [rcx]
xor r8b, dl
mov byte [r9], r8b
inc r9
sub r10, 1
jne 0x14000cb0d
mov byte [rcx + 0x47], r10b
ret

Function at 0x14000cb7c
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x39
mov r9, rax
mov dl, byte [r9]
mov r8d, dword [rcx]
xor r8b, dl
mov byte [r9], r8b
inc r9
sub r10, 1
jne 0x14000cb89
mov byte [rcx + 0x3d], r10b
ret

Function at 0x14000cba4
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
mov dl, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8b, dl
mov byte [rax + r9], r8b
inc r9
cmp r9, 8
jb 0x14000cbab
mov byte [rcx + 0xc], 0
ret

Function at 0x14000cbcc
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x17
mov r9, rax
mov dl, byte [r9]
mov r8d, dword [rcx]
xor r8b, dl
mov byte [r9], r8b
inc r9
sub r10, 1
jne 0x14000cbd9
mov byte [rcx + 0x1b], r10b
ret
Function at 0x14000cc10
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x11
mov r9, rax
mov dl, byte [r9]
mov r8d, dword [rcx]
xor r8b, dl
mov byte [r9], r8b
inc r9
sub r10, 1
jne 0x14000cc1d
mov byte [rcx + 0x15], r10b
ret

Function at 0x14000cc70
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
mov dl, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8b, dl
mov byte [rax + r9], r8b
inc r9
cmp r9, 0x14
jb 0x14000cc77
mov byte [rcx + 0x18], 0
ret

Function at 0x14000cc98
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
mov dl, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8b, dl
mov byte [rax + r9], r8b
inc r9
cmp r9, 0x38
jb 0x14000cc9f
mov byte [rcx + 0x3c], 0
ret

Function at 0x14000ccc0
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
mov dl, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8b, dl
mov byte [rax + r9], r8b
inc r9
cmp r9, 0x43
jb 0x14000ccc7
mov byte [rcx + 0x47], 0
ret

Function at 0x14000cd04
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
mov dl, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8b, dl
mov byte [rax + r9], r8b
inc r9
cmp r9, 0x18
jb 0x14000cd0b
mov byte [rcx + 0x1c], 0
ret

Function at 0x14000cd64
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x26
mov r9, rax
mov dl, byte [r9]
mov r8d, dword [rcx]
xor r8b, dl
mov byte [r9], r8b
inc r9
sub r10, 1
jne 0x14000cd71
mov byte [rcx + 0x2a], r10b
ret

Function at 0x14000cd8c
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 8
mov r9, rax
mov dl, byte [r9]
mov r8d, dword [rcx]
xor r8b, dl
mov byte [r9], r8b
inc r9
sub r10, 1
jne 0x14000cd99
mov byte [rcx + 0xc], r10b
ret

Function at 0x14000cdd0
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0xa
mov r9, rax
mov dl, byte [r9]
mov r8d, dword [rcx]
xor r8b, dl
mov byte [r9], r8b
inc r9
sub r10, 1
jne 0x14000cddd
mov byte [rcx + 0xe], r10b
ret

Function at 0x14000ce14
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
mov dl, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8b, dl
mov byte [rax + r9], r8b
inc r9
cmp r9, 3
jb 0x14000ce1b
mov byte [rcx + 7], 0
ret

Function at 0x14000ce3c
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
mov dl, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8b, dl
mov byte [rax + r9], r8b
inc r9
cmp r9, 7
jb 0x14000ce43
mov byte [rcx + 0xb], 0
ret

Function at 0x14000ce64
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 3
mov r9, rax
mov dl, byte [r9]
mov r8d, dword [rcx]
xor r8b, dl
mov byte [r9], r8b
inc r9
sub r10, 1
jne 0x14000ce71
mov byte [rcx + 7], r10b
ret

Function at 0x14000ce8c
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
mov dl, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8b, dl
mov byte [rax + r9], r8b
inc r9
cmp r9, 9
jb 0x14000ce93
mov byte [rcx + 0xd], 0
ret
Function at 0x14000ced0
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 7
mov r9, rax
mov dl, byte [r9]
mov r8d, dword [rcx]
xor r8b, dl
mov byte [r9], r8b
inc r9
sub r10, 1
jne 0x14000cedd
mov byte [rcx + 0xb], r10b
ret

Function at 0x14000cf14
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 6
mov r9, rax
mov dl, byte [r9]
mov r8d, dword [rcx]
xor r8b, dl
mov byte [r9], r8b
inc r9
sub r10, 1
jne 0x14000cf21
mov byte [rcx + 0xa], r10b
ret

Function at 0x14000cf90
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0xf
mov r9, rax
mov dl, byte [r9]
mov r8d, dword [rcx]
xor r8b, dl
mov byte [r9], r8b
inc r9
sub r10, 1
jne 0x14000cf9d
mov byte [rcx + 0x13], r10b
ret

Function at 0x14000cfd4
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
mov dl, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8b, dl
mov byte [rax + r9], r8b
inc r9
cmp r9, 4
jb 0x14000cfdb
mov byte [rcx + 8], 0
ret

Function at 0x14000cffc
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 5
mov r9, rax
mov dl, byte [r9]
mov r8d, dword [rcx]
xor r8b, dl
mov byte [r9], r8b
inc r9
sub r10, 1
jne 0x14000d009
mov byte [rcx + 9], r10b
ret

Function at 0x14000d024
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
mov dl, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8b, dl
mov byte [rax + r9], r8b
inc r9
cmp r9, 0xd
jb 0x14000d02b
mov byte [rcx + 0x11], 0
ret

Function at 0x14000d04c
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
mov dl, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8b, dl
mov byte [rax + r9], r8b
inc r9
cmp r9, 5
jb 0x14000d053
mov byte [rcx + 9], 0
ret

Function at 0x14000d0ac
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 9
mov r9, rax
mov dl, byte [r9]
mov r8d, dword [rcx]
xor r8b, dl
mov byte [r9], r8b
inc r9
sub r10, 1
jne 0x14000d0b9
mov byte [rcx + 0xd], r10b
ret
Function at 0x140011e8c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x140051af8]
xor rax, rsp
mov qword [rbp - 8], rax
mov dword [rbp - 0x38], 0x22
mov cl, 0x6c
mov eax, dword [rbp - 0x38]
xor al, 0x6e
mov byte [rbp - 0x34], al
mov eax, dword [rbp - 0x38]
inc al
xor al, 0x74
mov byte [rbp - 0x33], al
mov eax, dword [rbp - 0x38]
add al, 2
xor al, 0x64
mov byte [rbp - 0x32], al
mov eax, dword [rbp - 0x38]
add al, 3
xor al, cl
mov byte [rbp - 0x31], al
mov eax, dword [rbp - 0x38]
add al, 4
xor al, cl
mov byte [rbp - 0x30], al
mov eax, dword [rbp - 0x38]
add al, 5
xor al, 0x2e
mov byte [rbp - 0x2f], al
mov eax, dword [rbp - 0x38]
add al, 6
xor al, 0x64
mov byte [rbp - 0x2e], al
mov eax, dword [rbp - 0x38]
add al, 7
xor al, cl
mov byte [rbp - 0x2d], al
mov eax, dword [rbp - 0x38]
add al, 8
xor al, cl
mov byte [rbp - 0x2c], al
xor eax, eax
xor ebx, ebx
mov byte [rbp - 0x2b], al
mov al, byte [rbp - 0x34]
mov edx, ebx
mov al, byte [rbp + rdx - 0x34]
mov ecx, dword [rbp - 0x38]
add cl, dl
xor cl, al
mov byte [rbp + rdx - 0x34], cl
inc rdx
cmp rdx, 9
jb 0x140011f14
lea rcx, [rbp - 0x34]
mov byte [rbp - 0x2b], bl
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r9, rax
test rax, rax
je 0x140011fe9
mov byte [rbp - 0x28], 0x50
mov rcx, rbx
mov byte [rbp - 0x27], 0x76
mov byte [rbp - 0x26], 0x53
mov byte [rbp - 0x25], 0x77
mov byte [rbp - 0x24], 0x67
mov byte [rbp - 0x23], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0x22], 0x7b
mov byte [rbp - 0x21], 0x55
mov byte [rbp - 0x20], 0x7b
mov byte [rbp - 0x1f], 0x75
mov byte [rbp - 0x1e], 0x76
mov byte [rbp - 0x1d], 0x67
mov byte [rbp - 0x1c], 0x6f
mov byte [rbp - 0x1b], 0x4b
mov byte [rbp - 0x1a], WSAStartup
mov byte [rbp - 0x19], 0x68
mov byte [rbp - 0x18], WSACleanup
mov byte [rbp - 0x17], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0x16], 0x6f
mov byte [rbp - 0x15], 0x63
mov byte [rbp - 0x14], 0x76
mov byte [rbp - 0x13], 0x6b
mov byte [rbp - 0x12], WSACleanup
mov byte [rbp - 0x11], WSAStartup
mov byte [rbp - 0x10], bl
mov al, byte [rbp - 0x28]
mov al, byte [rbp + rcx - 0x28]
sub al, 2
mov byte [rbp + rcx - 0x28], al
inc rcx
cmp rcx, 0x18
jb 0x140011fae
lea rdx, [rbp - 0x28]
mov rcx, r9
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor r9d, r9d
mov word [rbp - 0x40], bx
lea rdx, [rbp - 0x40]
lea r8d, [r9 + 2]
lea ecx, [r9 + 0x23]
call rax
cmp byte [rbp - 0x40], bl
setne al
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140023640
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x140012000
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x140051af8]
xor rax, rsp
mov qword [rbp + 0x47], rax
call qword [0x140055000]
xor edx, edx
mov ecx, 0x1fffff
mov r8d, eax
call qword [0x140055078]
xor edi, edi
mov rbx, rax
test rax, rax
je 0x14001210f
mov dword [rbp + 0x37], 0x22
xor eax, eax
mov byte [rbp + 0x3b], 0x4c
mov edx, edi
mov byte [rbp + 0x3c], 0x56
mov byte [rbp + 0x3d], 0x46
mov byte [rbp + 0x3e], 0x4e
mov byte [rbp + 0x3f], 0x4e
mov byte [rbp + 0x40], 0xc
mov byte [rbp + 0x41], 0x46
mov byte [rbp + 0x42], 0x4e
mov byte [rbp + 0x43], 0x4e
mov byte [rbp + 0x44], al
mov al, byte [rbp + 0x3b]
mov al, byte [rbp + rdx + 0x3b]
mov ecx, dword [rbp + 0x37]
xor cl, al
mov byte [rbp + rdx + 0x3b], cl
inc rdx
cmp rdx, 9
jb 0x14001207e
lea rcx, [rbp + 0x3b]
mov byte [rbp + 0x44], dil
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r9d, 0x30
mov qword [rsp + 0x20], rdi
lea r8, [rbp + 7]
xor edx, edx
mov rcx, rbx
call qword [0x140055070]
test eax, eax
js 0x140012106
mov edx, dword [rbp + 0xf]
lea rax, [rbp - 1]
add edx, 0xbc
mov qword [rbp - 1], rdi
mov r9d, 2
mov word [rbp - 9], di
lea r8, [rbp - 9]
mov qword [rsp + 0x20], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x140012106
cmp qword [rbp - 1], 2
jne 0x140012106
cmp word [rbp - 9], 0x70
jne 0x140012106
mov eax, 1
jmp 0x140012111
mov rcx, rbx
call qword [0x1400550f0]
xor eax, eax
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140023640
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x140014738
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rbx, rdx
mov rdi, rcx
mov ecx, 8
call fcn.1400238b0
mov qword [rax], rbx
mov qword [rsp + 0x40], rax
lea rbx, [rdi + 8]
mov qword [rsp + 0x28], rbx
and dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x1400148fc]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rdi], rax
test rax, rax
je 0x14001478f
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
and dword [rbx], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x140015758
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x1180]
mov eax, 0x1280
call fcn.140023d00
sub rsp, rax
mov rax, qword [0x140051af8]
xor rax, rsp
mov qword [rbp + 0x1170], rax
mov rsi, rdx
mov rbx, rcx
xor edx, edx
lea rcx, [rbp + 0xf70]
mov r8d, 0x200
mov rdi, r9
call sub.VCRUNTIME140.dll_memset
mov dword [rbp + 0xf60], 0x14
mov cl, 0x5c
mov eax, dword [rbp + 0xf60]
xor al, cl
mov byte [rbp + 0xf64], al
mov eax, dword [rbp + 0xf60]
inc al
xor al, cl
mov byte [rbp + 0xf65], al
mov eax, dword [rbp + 0xf60]
add al, 2
xor al, 0x2e
mov byte [rbp + 0xf66], al
mov eax, dword [rbp + 0xf60]
add al, 3
xor al, cl
mov byte [rbp + 0xf67], al
mov eax, dword [rbp + 0xf60]
add al, 4
xor al, 0x70
mov byte [rbp + 0xf68], al
mov eax, dword [rbp + 0xf60]
add al, 5
xor al, 0x69
mov byte [rbp + 0xf69], al
mov eax, dword [rbp + 0xf60]
add al, 6
xor al, 0x70
mov byte [rbp + 0xf6a], al
mov eax, dword [rbp + 0xf60]
add al, 7
xor al, 0x65
mov byte [rbp + 0xf6b], al
mov eax, dword [rbp + 0xf60]
add al, 8
xor al, cl
mov byte [rbp + 0xf6c], al
mov eax, dword [rbp + 0xf60]
add al, 9
xor al, 0x25
mov byte [rbp + 0xf6d], al
mov eax, dword [rbp + 0xf60]
add al, 0xa
xor al, 0x73
mov byte [rbp + 0xf6e], al
xor eax, eax
mov byte [rbp + 0xf6f], al
xor edx, edx
mov al, byte [rbp + 0xf64]
mov al, byte [rbp + rdx + 0xf64]
mov ecx, dword [rbp + 0xf60]
add cl, dl
xor cl, al
mov byte [rbp + rdx + 0xf64], cl
inc rdx
cmp rdx, 0xb
jb 0x14001586d
mov r9, rbx
mov byte [rbp + 0xf6f], 0
lea r8, [rbp + 0xf64]
mov edx, 0x1ff
lea rcx, [rbp + 0xf70]
call fcn.140015328
and qword [rsp + 0x30], 0
lea rcx, [rbp + 0xf70]
and dword [rsp + 0x28], 0
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14001592b
xor edx, edx
lea rcx, [rsp + 0x4c]
mov r8d, 0x1014
call sub.VCRUNTIME140.dll_memset
mov rdx, rsi
mov qword [rsp + 0x40], rbx
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x48], 1
call fcn.1400154c0
test eax, eax
jne 0x14001592b
mov r8d, 0x1020
lea rdx, [rsp + 0x40]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
xor eax, eax
jmp 0x140015930
mov eax, 1
mov rcx, qword [rbp + 0x1170]
xor rcx, rsp
call fcn.140023640
mov rbx, qword [rsp + 0x12b0]
add rsp, 0x1280
pop rdi
pop rsi
pop rbp
ret
Function at 0x140015954
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0xf60]
mov eax, 0x1060
call fcn.140023d00
sub rsp, rax
mov rax, qword [0x140051af8]
xor rax, rsp
mov qword [rbp + 0xf50], rax
xor esi, esi
mov rbx, rcx
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x34], esi
cmp dword [rcx + 0x10], esi
je 0x140015ada
mov dword [rcx + 0x10], esi
cmp dword [rcx + 0xc], esi
jne 0x140015ada
movzx eax, word [rcx + 0x814]
lea r8d, [rsi + 0x10]
add ax, 0x18
mov word [rsp + 0x3e], dx
mov word [rsp + 0x48], ax
lea r9, [rsp + 0x30]
mov eax, dword [rcx + 8]
lea rdx, [rsp + 0x40]
mov rcx, qword [rcx]
lea r14d, [rsi + 5]
mov dword [rsp + 0x40], 0x3000005
mov dword [rsp + 0x44], r8d
mov word [rsp + 0x4a], si
mov dword [rsp + 0x4c], eax
mov dword [rsp + 0x38], esi
mov word [rsp + 0x3c], si
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140015ada
mov rcx, qword [rbx]
lea r9, [rsp + 0x30]
lea r8d, [rsi + 8]
mov qword [rsp + 0x20], rsi
lea rdx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140015ada
mov r8d, dword [rbx + 0x814]
lea rdx, [rbx + 0x14]
mov rcx, qword [rbx]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140015ada
inc dword [rbx + 8]
lea rcx, [rsp + 0x50]
mov edi, 0x1000
xor edx, edx
mov r8d, edi
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [rbx]
lea r9, [rsp + 0x34]
mov r8d, edi
mov qword [rsp + 0x20], rsi
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140015ada
cmp word [rsp + 0x50], r14w
jne 0x140015ada
cmp byte [rsp + 0x52], 2
jne 0x140015ada
cmp byte [rsp + 0x53], 3
jne 0x140015ada
movzx edi, word [rsp + 0x58]
cmp edi, dword [rsp + 0x34]
jne 0x140015ada
cmp word [rsp + 0x64], si
jne 0x140015ada
add edi, 0xffffffe8
cmp edi, 0x800
ja 0x140015ada
mov r8d, edi
lea rcx, [rbx + 0x818]
lea rdx, [rsp + 0x68]
call sub.VCRUNTIME140.dll_memcpy
xor eax, eax
mov dword [rbx + 0x1018], edi
jmp 0x140015adf
mov eax, 1
mov rcx, qword [rbp + 0xf50]
xor rcx, rsp
call fcn.140023640
lea r11, [rsp + 0x1060]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1400180a8
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x140051af8]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rcx
xor edx, edx
add rcx, 4
mov r8d, 0x118
call sub.VCRUNTIME140.dll_memset
mov rcx, rbx
mov dword [rbx], 0x11c
call qword [0x140054ff8]
xor r8d, r8d
test eax, eax
jne 0x1400181ca
mov dword [rbp - 0x38], 0x1a
xor eax, eax
mov byte [rbp - 0x34], 0x41
mov edx, r8d
mov byte [rbp - 0x33], 0x37
mov byte [rbp - 0x32], 0x47
mov byte [rbp - 0x31], 0x3a
mov byte [rbp - 0x30], 0x5c
mov byte [rbp - 0x2f], 0x7b
mov byte [rbp - 0x2e], reloc.WS2_32.dll_WSAStartup
mov byte [rbp - 0x2d], 0x76
mov byte [rbp - 0x2c], 0x7f
mov byte [rbp - 0x2b], 0x7e
mov byte [rbp - 0x2a], 0x3a
mov byte [rbp - 0x29], 0x6e
mov byte [rbp - 0x28], 0x75
mov byte [rbp - 0x27], 0x3a
mov byte [rbp - 0x26], 0x7d
mov byte [rbp - 0x25], 0x7f
mov byte [rbp - 0x24], 0x6e
mov byte [rbp - 0x23], 0x3a
mov byte [rbp - 0x22], 0x6c
mov byte [rbp - 0x21], 0x7f
mov byte [rbp - 0x20], 0x68
mov byte [rbp - 0x1f], 0x69
mov byte [rbp - 0x1e], reloc.WS2_32.dll_WSAStartup
mov byte [rbp - 0x1d], 0x75
mov byte [rbp - 0x1c], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0x1b], 0x3a
mov byte [rbp - 0x1a], 0x75
mov byte [rbp - 0x19], 0x69
mov byte [rbp - 0x18], 0x3a
mov byte [rbp - 0x17], reloc.WS2_32.dll_WSAStartup
mov byte [rbp - 0x16], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0x15], 0x7c
mov byte [rbp - 0x14], 0x75
mov byte [rbp - 0x13], al
mov al, byte [rbp - 0x34]
mov al, byte [rbp + rdx - 0x34]
mov ecx, dword [rbp - 0x38]
xor cl, al
mov byte [rbp + rdx - 0x34], cl
inc rdx
cmp rdx, 0x21
jb 0x14001818a
lea rdx, [rbp - 0x34]
mov byte [rbp - 0x13], r8b
lea rcx, [rbp - 0x60]
mov qword [rbp - 0x60], r8
mov qword [rbp - 0x50], r8
mov qword [rbp - 0x48], 0xf
call fcn.140005e0c
lea rcx, [rbp - 0x60]
call fcn.140017c38
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140023640
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rbp
ret
Function at 0x1400181ec
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
movaps xmmword [rsp + 0x50], xmm6
mov rax, qword [0x140051af8]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, rcx
mov qword [rsp + 0x40], rcx
cmp qword [rcx + 0x18], 0x10
jb 0x14001821c
mov rcx, qword [rcx]
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
call qword [0x1400550a0]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400182c4
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov rcx, rdi
test eax, eax
je 0x1400182bd
xorps xmm6, xmm6
cvtsi2sd xmm6, qword [rsp + 0x40]
mulsd xmm6, qword [0x14002b4a0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x1400182b1
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x1400182ac
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400182b6
mov rcx, r8
call fcn.1400238ec
movaps xmm0, xmm6
jmp 0x140018302
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x1400182fa
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x1400182f5
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001832f
mov rcx, r8
call fcn.1400238ec
movsd xmm0, qword [0x14002b4b0]
and qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140023640
mov rbx, qword [rsp + 0x78]
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x60
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140018338
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x120]
sub rsp, 0x220
mov rax, qword [0x140051af8]
xor rax, rsp
mov qword [rbp + 0x118], rax
mov rdi, rdx
mov qword [rsp + 0x20], rcx
mov rbx, rcx
lea rdx, [rsp + 0x60]
mov ecx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x14001838e
lea rdx, [0x14002b154]
jmp 0x140018428
cmp qword [rdi + 0x18], 0x10
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov dword [rsp + 0x2c], 2
mov dword [rsp + 0x30], 1
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
jb 0x1400183ba
mov rdi, qword [rdi]
lea r9, [rsp + 0x20]
xor edx, edx
lea r8, [rsp + 0x28]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
je 0x1400183db
call qword [sym.imp.WS2_32.dll_WSACleanup]
jmp 0x140018382
mov rdi, qword [rsp + 0x20]
test rdi, rdi
je 0x140018412
mov rdx, qword [rdi + 0x20]
lea r8, [rbp + 0x100]
mov r9d, 0x16
add rdx, 4
lea ecx, [r9 - 0x14]
call qword [sym.imp.WS2_32.dll_inet_ntop]
mov rdi, qword [rdi + 0x28]
test rdi, rdi
jne 0x1400183e5
mov rdi, qword [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
call qword [sym.imp.WS2_32.dll_WSACleanup]
lea rdx, [rbp + 0x100]
and qword [rbx], 0
mov rcx, rbx
and qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
call fcn.140005e0c
mov rax, rbx
mov rcx, qword [rbp + 0x118]
xor rcx, rsp
call fcn.140023640
lea r11, [rsp + 0x220]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret