joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003be20
Capabilities:
Read file via mapping

Disassembly:
test rdx, rdx
je 0x14003be3d
mov rax, qword [rcx]
test rax, rax
je 0x14003be3d
cmp rax, 0xffffffffffffffff
je 0x14003be3d
cmp qword [rcx + 0x10], rdx
jae 0x14003c0c0
xor eax, eax
ret
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rsi, r9
mov rdi, r8
mov rbx, rcx
mov rax, qword [0x140062030]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor eax, eax
cmp dword [rcx + 8], 0
mov r14, rdx
setne al
lea ebp, [rax + rax]
add ebp, 4
mov rcx, qword [rcx]
mov qword [rsp + 0x20], rdx
mov edx, ebp
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r15, rax
mov qword [rdi], rax
test rax, rax
je 0x14003c161
lea rdi, [rsp + 0x30]
mov r8d, 0x30
mov rcx, r15
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
mov rcx, qword [rdi + 0x18]
sub rcx, r15
add rcx, qword [rdi + 8]
test rax, rax
cmove rcx, rax
mov qword [rsi], rcx
mov bl, 1
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14002fa70
mov eax, ebx
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov rcx, qword [rbx]
mov qword [rsp + 0x20], r14
xor ebx, ebx
mov edx, ebp
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r15, rax
mov qword [rdi], rax
test rax, rax
jne 0x14003c117
jmp 0x14003c145

Function at 0x14003c0c0
Capabilities:
Read file via mapping

Disassembly:
test rdx, rdx
je 0x14003be3d
mov rax, qword [rcx]
test rax, rax
je 0x14003be3d
cmp rax, 0xffffffffffffffff
je 0x14003be3d
cmp qword [rcx + 0x10], rdx
jae 0x14003c0c0
xor eax, eax
ret
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rsi, r9
mov rdi, r8
mov rbx, rcx
mov rax, qword [0x140062030]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor eax, eax
cmp dword [rcx + 8], 0
mov r14, rdx
setne al
lea ebp, [rax + rax]
add ebp, 4
mov rcx, qword [rcx]
mov qword [rsp + 0x20], rdx
mov edx, ebp
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r15, rax
mov qword [rdi], rax
test rax, rax
je 0x14003c161
lea rdi, [rsp + 0x30]
mov r8d, 0x30
mov rcx, r15
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
mov rcx, qword [rdi + 0x18]
sub rcx, r15
add rcx, qword [rdi + 8]
test rax, rax
cmove rcx, rax
mov qword [rsi], rcx
mov bl, 1
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14002fa70
mov eax, ebx
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov rcx, qword [rbx]
mov qword [rsp + 0x20], r14
xor ebx, ebx
mov edx, ebp
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r15, rax
mov qword [rdi], rax
test rax, rax
jne 0x14003c117
jmp 0x14003c145
Function at 0x14003c500
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rsi
sub rsp, 0x140
mov rax, qword [0x140062030]
xor rax, rsp
mov qword [rsp + 0x138], rax
mov edx, 0x10
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x14003c542
mov rcx, qword [rsp + 0x138]
xor rcx, rsp
call fcn.14002fa70
nop
add rsp, 0x140
pop rsi
ret
lea rsi, [rsp + 0x28]
mov dword [rsi - 8], 3
mov rcx, rsi
call fcn.140027120
lea rax, str._builds_worker_checkouts_gecko_security_sandbox_chromium_base_rand_util_win.cc
mov qword [rsi + 0xf0], rax
mov dword [rsi + 0xf8], 0x20
lea rcx, [rsp + 0x130]
call fcn.14003c590
lea rcx, [rsp + 0x20]
call fcn.14003a730
jmp 0x14003c528

Function at 0x14003d9c0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x140062080]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14003d9f0
movsxd rcx, dword [rsi]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [rsi + 4]
jne 0x14003d9f0
mov rax, qword [rax + rcx]
jmp 0x14003d9f2
xor eax, eax
add rsp, 0x20
pop rsi
ret

Function at 0x14003dd80
Capabilities:
Parse pe header

Disassembly:
movzx eax, word [rcx]
cmp eax, 0x5a4d
jne 0x14003ddb2
movsxd rax, dword [rcx + 0x3c]
cmp dword [rcx + rax], 0x4550
jne 0x14003ddb2
movzx edx, word [rcx + rax + 0x14]
cmp edx, 0xf0
jne 0x14003ddb2
movzx eax, word [rcx + rax + 0x18]
cmp eax, 0x20b
sete al
ret
xor eax, eax
jmp 0x14003ddb1

Function at 0x140045360
Capabilities:
Create pipe

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
mov r14, qword [rsp + 0xc8]
mov rax, qword [0x140062030]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov qword [r14], 0xffffffffffffffff
mov esi, 5
cmp ecx, 3
jne 0x140045444
mov edi, dword [rsp + 0xc0]
mov r11d, dword [rsp + 0xb8]
mov ecx, dword [rsp + 0xb0]
mov eax, dword [rsp + 0xa8]
mov r10d, dword [rsp + 0xa0]
cmp qword [r8 + 0x18], 8
jb 0x1400453c6
mov r8, qword [r8]
mov rsi, qword [rdx]
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], r11d
mov dword [rsp + 0x20], ecx
mov qword [rsp + 0x38], 0
mov rcx, r8
mov edx, r9d
mov r8d, r10d
mov r9d, eax
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
cmp rax, 0xffffffffffffffff
je 0x14004545f
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor r15d, r15d
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
mov dword [rsp + 0x30], 3
lea rbx, [rsp + 0x40]
mov rcx, rax
mov rdx, rdi
mov r8, rsi
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
cmp eax, 1
sbb r15, r15
or r15, qword [rbx]
mov qword [r14], r15
xor eax, eax
cmp r15, 0xffffffffffffffff
sete al
lea esi, [rax + rax*4]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14002fa70
mov eax, esi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov r15, 0xffffffffffffffff
jmp 0x140045435
Function at 0x1400471e0
Capabilities:
Read file via mapping

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov edi, edx
mov rsi, rcx
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov dword [rsp + 0x20], edx
mov qword [rsp + 0x28], 0
mov rcx, 0xffffffffffffffff
xor edx, edx
mov r8d, 0x8000004
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rcx, rsi
mov rdx, rax
call fcn.14000cd10
mov rcx, qword [rsi]
lea rax, [rcx + 1]
cmp rax, 2
jb 0x14004724a
mov eax, edi
mov qword [rsp + 0x20], rax
mov edx, 6
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsi + 8], rax
mov rax, rsi
add rsp, 0x38
pop rdi
pop rsi
ret

Function at 0x140049fe0
Capabilities:
Create process on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc8
mov edi, ecx
mov rax, qword [0x140062030]
xor rax, rsp
mov qword [rsp + 0xc0], rax
lea eax, [rdi - 7]
mov ebp, 5
cmp eax, 0xfffffffe
jae 0x14004a03a
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14002fa70
mov eax, ebp
add rsp, 0xc8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r14, r8
mov r15, rdx
mov r12, qword [rsp + 0x130]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
xor r13d, r13d
mov qword [rsp + 0xb0], r13
mov dword [rsp + 0x50], 0x68
cmp qword [r9 + 0x18], 8
jb 0x14004a08f
mov r9, qword [r9]
mov rcx, r9
call qword [sym.imp.mozglue.dll__wcsdup]
mov rsi, rax
mov rax, qword [r12 + 0x10]
cmp qword [r12 + 0x18], 8
jb 0x14004a0ac
mov r12, qword [r12]
mov rbx, qword [rsp + 0x138]
test rax, rax
cmove r12, rax
cmp qword [r14 + 0x18], 8
jb 0x14004a0c5
mov r14, qword [r14]
mov r15, qword [r15]
mov qword [rsp + 0x48], rbx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
mov rcx, r14
mov rdx, rsi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ebp, 5
test eax, eax
je 0x14004a19b
cmp edi, 6
mov r12d, 0x1fffff
mov r13d, 0x101c01
cmove r13d, r12d
mov r14, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x20], r13d
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 0
mov rcx, rax
mov rdx, r14
mov r8, r15
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x14004a1b2
cmp edi, 6
mov ebp, 0x100c43
cmove ebp, r12d
mov rdi, qword [rbx + 8]
add rbx, 8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 0
mov rcx, rax
mov rdx, rdi
mov r8, r15
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor ecx, ecx
test eax, eax
sete cl
lea ebp, [rcx + rcx*4]
test rsi, rsi
je 0x14004a014
mov rcx, rsi
call qword [sym.imp.mozglue.dll_free]
jmp 0x14004a014
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14004a19b
Function at 0x14004a1c0
Capabilities:
Create thread

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rax, r8
mov r8, rdx
mov rdi, rcx
mov rsi, qword [rsp + 0x88]
mov edx, dword [rsp + 0x80]
xor r14d, r14d
mov qword [rsi], r14
mov rcx, qword [rcx]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], r9
xor edx, edx
mov r9, rax
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test rax, rax
je 0x14004a24c
mov rbx, rax
mov rdi, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
mov dword [rsp + 0x30], 3
mov rcx, rax
mov rdx, rbx
mov r8, rdi
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor ecx, ecx
test eax, eax
sete cl
lea eax, [rcx + rcx*4]
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
jmp qword [sym.imp.KERNEL32.dll_GetLastError]

Function at 0x140051230
Capabilities:
Parse pe header

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x140064a50]
test rax, rax
je 0x140051273
mov rax, qword [0x140064a50]
test rax, rax
je 0x1400512c0
mov rcx, qword [0x140064a50]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi], rax
test rax, rax
je 0x1400512c3
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x140056ad0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
movzx eax, word [rax]
cmp eax, 0x5a4d
jne 0x1400512c6
movsxd rax, dword [rcx + 0x3c]
cmp dword [rcx + rax], 0x4550
jne 0x1400512c6
movzx edx, word [rcx + rax + 0x14]
cmp edx, 0xf0
jne 0x1400512c6
movzx eax, word [rcx + rax + 0x18]
cmp eax, 0x20b
jne 0x1400512c6
xor eax, eax
lock cmpxchg qword [0x140064a50], rcx
jmp 0x140051248
int3
int3
int3

Function at 0x1400519d0
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, r9
mov rdi, r8
mov rbx, rdx
mov r14, rcx
cmp byte [rcx + 0x1c], 0
jne 0x140026ef6
mov r15, qword [r14 + 0x20]
lea rcx, [0x14005a6b0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp byte [r14 + 0x1c], 0
jne 0x140026ef6
xor ecx, ecx
cmp r15, rax
sete cl
bts rcx, 0x20
mov qword [r14 + 0x18], rcx
mov rcx, r14
mov rdx, rbx
mov r8, rdi
mov r9, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.1400036a0
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov rcx, qword [rcx + 0x20]
test rcx, rcx
je 0x140051a36
mov rsi, r9
mov rdi, r8
mov r14, rdx
and rcx, 0xfffffffffffffffc
call fcn.140051a50
test al, al
je 0x140051a36
mov rcx, qword [rbx + 0x20]
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140051a36
mov r14, rax
mov rcx, rax
call fcn.140051a50
test al, al
je 0x140051a36
mov rcx, rbx
mov rdx, r14
mov r8, rdi
mov r9, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp 0x140026eb0
xor eax, eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140052080
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rsi, rcx
mov rax, qword [0x140062030]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov eax, dword [0x140064af4]
mov ecx, dword [0x1400624b8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140052123
mov r14, qword [rsi + 0x10]
test r14, r14
je 0x1400520ff
mov r15, qword [rsi + 8]
shl r14, 4
add r14, r15
mov edi, dword [0x140064af0]
lea rbx, [rsp + 0x20]
mov r12, qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, dword [r15]
mov rcx, qword [r15 + 8]
mov rdx, rdi
mov r9, rbx
call r12
add r15, 0x10
cmp r15, r14
jne 0x1400520e6
mov qword [rsi + 0x10], 0
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14002fa70
nop
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rcx, [0x140064af4]
call fcn.14002e938
cmp dword [0x140064af4], 0xffffffff
jne 0x1400520c0
lea rdi, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rdi + 4]
mov dword [0x140064af0], eax
lea rcx, [0x140064af4]
call fcn.14002e8d8
jmp 0x1400520c0

Function at 0x140052160
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get system information on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
mov r14, qword [rcx + 8]
lea rbx, [r14 + 2]
call fcn.140026f20
mov r8d, eax
mov rax, r14
xor edx, edx
div r8
mov rcx, rax
mov rax, rbx
xor edx, edx
div r8
cmp rcx, rax
je 0x1400521a3
mov rcx, rbx
call fcn.140051a50
test al, al
je 0x1400521f6
mov rdx, qword [rdi]
mov r8, qword [rdi + 8]
add r8, 2
mov qword [rsi], rdx
mov qword [rsi + 8], r8
mov qword [rsi + 0x10], 8
xor eax, eax
mov qword [rsi + 0x18], rax
mov qword [rsi + 0x28], rax
mov qword [rsi + 0x30], 0x20
lea rax, [rsi + 0x38]
mov qword [rsi + 0x20], rax
mov byte [rsi + 0x58], 1
add rsi, 0x60
mov r9d, 8
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.1400071c0
mov rax, qword [rdi]
mov qword [rsi], rax
xor ecx, ecx
mov qword [rsi + 0x28], rcx
xorps xmm0, xmm0
movups xmmword [rsi + 8], xmm0
mov qword [rsi + 0x18], rcx
mov qword [rsi + 0x30], 0x20
lea rdx, [rsi + 0x38]
mov qword [rsi + 0x20], rdx
mov byte [rsi + 0x58], 0
mov qword [rsi + 0x60], rax
mov qword [rsi + 0x70], rcx
mov qword [rsi + 0x78], 2
lea rax, [rsi + 0x80]
mov qword [rsi + 0x68], rax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140a460b0
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140a46237
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140a460e1
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140a460c7
add dl, dl
jne 0x140a460ee
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140a4614e
xor eax, eax
add dl, dl
jne 0x140a460fd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140a46205
add dl, dl
jne 0x140a4610e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140a4611b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140a46128
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140a46135
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140a46142
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140a460d6
mov eax, 1
add dl, dl
jne 0x140a4615e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140a4616b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140a46153
sub eax, ebx
mov ebx, 1
jne 0x140a461a4
mov ecx, 1
add dl, dl
jne 0x140a46186
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140a46193
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140a4617b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140a460d6
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140a461c0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140a461cd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140a461b5
cmp eax, 0x7d00
jae 0x140a461f3
cmp eax, 0x500
jb 0x140a461ee
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140a460d6
cmp eax, 0x7f
ja 0x140a461f6
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140a460d6
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140a4622a
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140a460d6
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400159a0
Capabilities:
Get hostname

Disassembly:
push rbx
sub rsp, 0x140
mov rax, qword [0x1402bc4e8]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rbx, rcx
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x100
call fcn.1401c6f10
mov edx, 0x100
lea rcx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x140015a2e
xor eax, eax
mov rcx, 0xffffffffffffffff
mov qword [rbx], rax
lea rax, [rsp + 0x30]
nop word [rax + rax]
inc rcx
cmp byte [rax + rcx], 0
jne 0x140015a00
mov qword [rbx + 8], rcx
inc rcx
call fcn.1401c48f8
mov r8, qword [rbx + 8]
lea rdx, [rsp + 0x30]
inc r8
mov qword [rbx], rax
mov rcx, rax
call fcn.1401c6860
jmp 0x140015a3d
xor eax, eax
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx], rax
mov qword [rbx + 8], rax
mov rax, rbx
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1401c4380
add rsp, 0x140
pop rbx
ret

Function at 0x140016f60
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x140016f94
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x140016f80
ret
Function at 0x14001da50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rcx, qword [rcx + 8]
jmp 0x14001e250
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x40
mov rax, qword [0x1402bc4e8]
xor rax, rsp
mov qword [rsp + 0x38], rax
cmp word [rcx + 0xe], 3
movzx esi, r8b
mov rbx, rcx
jne 0x14001e311
cmp dword [rcx], 0
je 0x14001e311
mov eax, 0x405
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov word [rsp + 0x36], ax
movabs rcx, 0xffff000000000000
mov rax, qword [rsp + 0x30]
and rax, rcx
or rax, rdx
mov qword [rsp + 0x30], rax
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], 0
jne 0x14001e2b7
lea r8, [rsp + 0x28]
mov dword [rsp + 0x28], eax
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14001f320
mov ecx, dword [rbx]
movabs rdx, 0xffffffffffff
mov rax, qword [rbx + 8]
and rax, rdx
shl rcx, 5
add rcx, rax
mov rax, qword [rsp + 0x20]
cmp rax, rcx
je 0x14001e311
movzx ecx, word [rax + 0x1e]
movzx eax, cl
shr al, 3
test al, 1
je 0x14001e311
cmp cx, 0xa
sete al
jmp 0x14001e315
movzx eax, sil
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1401c4380
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rsi
ret
Function at 0x140024210
Capabilities:
Set console window title

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rdi, rdx
mov rsi, rcx
lea rax, vtable.xmrig::ConsoleLog.0
mov qword [rcx], rax
xor ebp, ebp
mov qword [rcx + 8], rbp
mov qword [rcx + 0x10], rbp
lea ecx, [rbp + 1]
call fcn.1401abb50
cmp eax, 0xe
je 0x140024250
cmp eax, 7
jne 0x14002427c
mov ecx, 0x158
call fcn.1401c43a0
mov rbx, rax
mov qword [rsi + 8], rax
call fcn.1401ac230
mov rcx, rax
xor r9d, r9d
lea r8d, [r9 + 1]
mov rdx, rbx
call fcn.1401afd40
test eax, eax
jns 0x140024288
mov byte [0x1402bd0c8], bpl
jmp 0x1400243d3
xor edx, edx
mov rcx, qword [rsi + 8]
call fcn.1401b0250
mov rax, qword [rsi + 8]
mov qword [rsi + 0x10], rax
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400242dd
mov dword [rsp + 0x50], ebp
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
test eax, eax
je 0x1400242dd
mov edx, dword [rsp + 0x50]
and edx, 0xffffffbf
mov dword [rsp + 0x50], edx
bts edx, 7
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleMode]
cmp byte [rdi], bpl
je 0x1400243d3
cmp qword [rdi + 8], rbp
jne 0x14002431d
mov ecx, reloc.WS2_32.dll_send
call fcn.1401c48f8
mov rbx, rax
movups xmm0, xmmword [str.xmrig_proxy_6.21.0]
movups xmmword [rax], xmm0
movzx eax, word [0x14028e888]
mov word [rbx + 0x10], ax
movzx eax, byte [0x14028e88a]
mov byte [rbx + 0x12], al
jmp 0x1400243c2
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x28], rbp
mov ecx, 0x40
call fcn.1401c43a0
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x20]
mov rdx, qword [rdi + 8]
lea rcx, [rsp + 0x30]
call fcn.140014830
nop
mov rcx, qword [rsp + 0x20]
mov rdi, qword [rcx + 8]
cmp byte [rdi + 0x19], 0
jne 0x1400243b3
nop word [rax + rax]
mov r8, qword [rdi + 0x10]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x20]
call fcn.140017e90
mov rbx, rdi
mov rdi, qword [rdi]
mov rcx, qword [rbx + 0x30]
call fcn.1401c43dc
mov rcx, qword [rbx + 0x20]
call fcn.1401c43dc
mov edx, 0x40
mov rcx, rbx
call fcn.1401c43dc
cmp byte [rdi + 0x19], 0
je 0x140024370
mov rcx, qword [rsp + 0x20]
mov edx, 0x40
call fcn.1401c43dc
mov rbx, qword [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov rcx, rbx
call fcn.1401c43dc
mov rax, rsi
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x14004a2a0
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
movzx eax, byte [rcx + 6]
mov rdx, rcx
movzx r8d, byte [rcx + 7]
movzx esi, byte [rcx + 0xb]
movzx ebp, byte [rcx + 0xf]
movzx r11d, byte [rcx + 0x13]
movzx ebx, byte [rcx + 0x17]
movzx edi, byte [rcx + 0x1b]
movzx r14d, byte [rcx + 0x1f]
shl r8, 8
or r8, rax
shl rsi, 8
movzx eax, byte [rcx + 5]
shl rbp, 8
shl r11, 8
shl rbx, 8
shl rdi, 8
shl r14, 8
shl r8, 8
or r8, rax
movzx eax, byte [rcx + 4]
shl r8, 8
or r8, rax
movzx eax, byte [rcx + 0xa]
or rsi, rax
movzx eax, byte [rcx + 9]
shl rsi, 8
or rsi, rax
movzx eax, byte [rcx + 8]
shl rsi, 8
or rsi, rax
movzx eax, byte [rcx + 0xe]
or rbp, rax
movzx eax, byte [rcx + 0xd]
shl rbp, 8
or rbp, rax
movzx eax, byte [rcx + 0xc]
shl rbp, 8
or rbp, rax
movzx eax, byte [rcx + 0x12]
or r11, rax
movzx eax, byte [rcx + 0x11]
shl r11, 8
or r11, rax
movzx eax, byte [rcx + 0x10]
shl r11, 8
or r11, rax
movzx eax, byte [rcx + 0x16]
or rbx, rax
movzx eax, byte [rcx + 0x15]
shl rbx, 8
or rbx, rax
movzx eax, byte [rcx + 0x14]
shl rbx, 8
or rbx, rax
movzx eax, byte [rcx + 0x1a]
or rdi, rax
movzx eax, byte [rcx + 0x19]
shl rdi, 8
or rdi, rax
movzx eax, byte [rcx + 0x18]
shl rdi, 8
or rdi, rax
movzx eax, byte [rcx + 0x1e]
or r14, rax
movzx eax, byte [rcx + 0x1d]
shl r14, 8
or r14, rax
movzx eax, byte [rcx + 0x1c]
movzx ecx, byte [rcx + 3]
shl rcx, 8
shl r14, 8
or r14, rax
movzx eax, byte [rdx + 2]
or rcx, rax
movzx eax, byte [rdx + 1]
shl rcx, 8
or rcx, rax
movzx eax, byte [rdx]
shl rcx, 8
or rcx, rax
mov edx, 0x5cf5d3ec
mov eax, 1
sub rdx, rcx
test rdx, rdx
jle 0x14004a3fa
mov r10d, eax
jmp 0x14004a407
xor r10d, r10d
test rdx, rdx
setns r10b
dec r10d
mov ecx, 0x5812631a
sub rcx, r8
test rcx, rcx
jle 0x14004a419
mov r9d, eax
jmp 0x14004a426
xor r9d, r9d
test rcx, rcx
setns r9b
dec r9d
mov ecx, 0xa2f79cd6
sub rcx, rsi
test rcx, rcx
jle 0x14004a438
mov r8d, eax
jmp 0x14004a445
xor r8d, r8d
test rcx, rcx
setns r8b
dec r8d
mov ecx, 0x14def9de
sub rcx, rbp
test rcx, rcx
jle 0x14004a456
mov edx, eax
jmp 0x14004a460
xor edx, edx
test rcx, rcx
setns dl
dec edx
mov ecx, 0x10000000
neg r11
sub rcx, r14
neg rbx
neg rdi
test rcx, rcx
jg 0x14004a480
xor eax, eax
test rcx, rcx
setns al
dec eax
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
cdqe
sar rdi, 0x3f
sar rbx, 0x3f
sar r11, 0x3f
lea rcx, [rdi + rax*2]
mov rdi, qword [rsp + 0x28]
lea rax, [rbx + rcx*2]
mov rbx, qword [rsp + 0x10]
lea rcx, [r11 + rax*2]
movsxd rax, edx
lea rdx, [rax + rcx*2]
movsxd rax, r8d
lea rcx, [rax + rdx*2]
movsxd rax, r9d
lea rdx, [rax + rcx*2]
movsxd rax, r10d
lea rax, [rax + rdx*2]
sar rax, 8
pop r14
ret