joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1406a6058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1406a61df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1406a6089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406a606f
add dl, dl
jne 0x1406a6096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406a60f6
xor eax, eax
add dl, dl
jne 0x1406a60a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406a61ad
add dl, dl
jne 0x1406a60b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406a60c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406a60d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406a60dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1406a60ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1406a607e
mov eax, 1
add dl, dl
jne 0x1406a6106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406a6113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406a60fb
sub eax, ebx
mov ebx, 1
jne 0x1406a614c
mov ecx, 1
add dl, dl
jne 0x1406a612e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406a613b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406a6123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406a607e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1406a6168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406a6175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406a615d
cmp eax, 0x7d00
jae 0x1406a619b
cmp eax, 0x500
jb 0x1406a6196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406a607e
cmp eax, 0x7f
ja 0x1406a619e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406a607e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1406a61d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1406a607e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140b67fd0
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140b68157
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140b68001
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140b67fe7
add dl, dl
jne 0x140b6800e
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140b6806e
xor eax, eax
add dl, dl
jne 0x140b6801d
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140b68125
add dl, dl
jne 0x140b6802e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140b6803b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140b68048
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140b68055
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140b68062
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140b67ff6
mov eax, 1
add dl, dl
jne 0x140b6807e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140b6808b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140b68073
sub eax, ebx
mov ebx, 1
jne 0x140b680c4
mov ecx, 1
add dl, dl
jne 0x140b680a6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140b680b3
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140b6809b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140b67ff6
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140b680e0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140b680ed
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140b680d5
cmp eax, 0x7d00
jae 0x140b68113
cmp eax, 0x500
jb 0x140b6810e
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140b67ff6
cmp eax, 0x7f
ja 0x140b68116
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140b67ff6
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140b6814a
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140b67ff6
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x2fc4c5350
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4c5d52
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4e8108]
test eax, eax
je 0x2fc4c5dea
lea rax, [0x2fc4e80e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4e8110]
mov qword [rbp - 8], rax
jmp 0x2fc4c5dce
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4c5dc2
cmp qword [rbp - 0x10], 0
je 0x2fc4c5dc2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4c5d88
lea rax, [0x2fc4e80e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4c5deb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4c5ef0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4c5f18
mov eax, 0
jmp 0x2fc4c5f66
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4c5f41
mov eax, 0
jmp 0x2fc4c5f66
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4c5f61
mov eax, 0
jmp 0x2fc4c5f66
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4c5f6c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4c5fea
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4c5fe1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4c5fe1
mov rax, qword [rbp - 8]
jmp 0x2fc4c5fff
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4c5fb4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x180a31a39
Capabilities:
Encode data using xor

Disassembly:
add r11, 0xa
mov word ss:[r8], r10w
jmp 0x180a07746
add rdi, 0xc
xor ecx, ecx
test r11, r11
lea rsp, [rsp + 0x10]
je 0x180a31ad5
push rdi
lea rdi, [0x180a00740]
mov r9d, 0x4a202a9e
movzx r9d, byte [rax + r9 - 0x4a202a9e]
push 0x168cdb8a
dec qword [rsp]
xor r9d, ecx
and r9d, 0xff
push 0xfffffffffe14dc09
shr dword [rsp + 8], 0xf
mov r9d, dword [rdi + r9*4]
inc qword [rsp + 7]
shr ecx, 8
xor ecx, r9d
inc rax
ror word [rsp + 1], 0x2d
xor ecx, 0x2bb36914
sub byte [rsp + 0xf], 0x36
xor qword [rsp + 8], 0xffffffffa38a5786
dec r11
lea rsp, [rsp + 0x10]
jne 0x180a31a58
mov edi, 0x3e8c8c8a
push rdi
lea rdi, [rdi + 0x463f671e]
mov rdi, qword [rsp + 8]
lea rsp, [rsp + 0x10]
call fcn.180a2da71
mov ecx, 0x1e314b1c
mov rcx, qword [rcx + r11 - 0x1e314b1c]
mov r8d, 0x6a202a27
not r8
mov r8, qword [r8 + r11 + 0x6a202a30]
call fcn.180a38951
jmp 0x180a07ae8

Function at 0x180a32a03
Capabilities:
Encode data using xor

Disassembly:
call fcn.180a37203
sub r8, 2
mov word [r8], ax
push 0x49bb6903
lea rsp, [rsp + 0x18]
jmp 0x180a30471
lea rsp, [rsp + 0x10]
je 0x180a08cc6
push rsi
mov esi, 0x742c9b1d
lea r9, [rsi*8 + 0x32a93498]
lea r9, [0x180a3a708]
mov esi, 0x271d849d
movzx esi, byte [rsi + r11 - 0x271d849d]
push 0x3b02173a
xor esi, edx
and esi, 0xff
and qword [rsp], 0xfffffffffea80c3e
mov esi, dword [r9 + rsi*4]
shr edx, 8
xor edx, esi
dec byte [rsp + 6]
inc r11
xor edx, 0x709fe233
dec rbp
lea rsp, [rsp + 8]
jne 0x180a32a23
call fcn.180a08cbc

Function at 0x180a3942e
Capabilities:
Encode data using xor

Disassembly:
test rax, rax
mov qword [rsp + 0x10], 0xffffffff86b1f02c
lea rsp, [rsp + 0x18]
je 0x180a394a2
mov edx, 0x71b5631c
push r9
movsx r9d, dl
sal r9d, 0xbb
lea r9, [0x180a05ce8]
movzx edx, byte [rcx]
push 0x7d20ac8b
xor edx, esi
mov word [rsp + 6], 0xa437
and edx, 0xff
mov edx, dword [r9 + rdx*4]
shr esi, 8
neg qword [rsp]
xor esi, edx
push 0xffffffffce012210
inc rcx
xor esi, 0x96266d09
sal dword [rsp + 7], 0xe5
dec rax
lea rsp, [rsp + 0x10]
jne 0x180a3945b
pop r9
call fcn.180a07ced
neg ebx
sar bpl, 0xa4
mov rbx, rcx
mov esi, edx
movzx r10d, sil
jae 0x180a0c0b7
mov cl, byte [r8 + 8]
adc r8, 2
push 0x591c8c93
shr r9, cl
call fcn.180a0cba2
Function at 0x2fc4c5ad0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4c64d2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4e9108]
test eax, eax
je 0x2fc4c656a
lea rax, [0x2fc4e90e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4e9110]
mov qword [rbp - 8], rax
jmp 0x2fc4c654e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4c6542
cmp qword [rbp - 0x10], 0
je 0x2fc4c6542
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4c6508
lea rax, [0x2fc4e90e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4c656b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4c6670
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4c6698
mov eax, 0
jmp 0x2fc4c66e6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4c66c1
mov eax, 0
jmp 0x2fc4c66e6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4c66e1
mov eax, 0
jmp 0x2fc4c66e6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4c66ec
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4c676a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4c6761
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4c6761
mov rax, qword [rbp - 8]
jmp 0x2fc4c677f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4c6734
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140017be0
Capabilities:
Get hostname

Disassembly:
push rbx
sub rsp, 0x140
mov rax, qword [0x1404f3628]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rbx, rcx
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x100
call fcn.140349a00
mov edx, 0x100
lea rcx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x140017c6e
xor eax, eax
mov rcx, 0xffffffffffffffff
mov qword [rbx], rax
lea rax, [rsp + 0x30]
nop word [rax + rax]
inc rcx
cmp byte [rax + rcx], 0
jne 0x140017c40
mov qword [rbx + 8], rcx
inc rcx
call fcn.140347238
mov r8, qword [rbx + 8]
lea rdx, [rsp + 0x30]
inc r8
mov qword [rbx], rax
mov rcx, rax
call fcn.140349350
jmp 0x140017c7d
xor eax, eax
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx], rax
mov qword [rbx + 8], rax
mov rax, rbx
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.140346cc0
add rsp, 0x140
pop rbx
ret

Function at 0x1400192c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x1400192f4
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x1400192e0
ret
Function at 0x14001f4a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rcx, qword [rcx + 8]
jmp 0x14001fc50
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x40
mov rax, qword [0x1404f3628]
xor rax, rsp
mov qword [rsp + 0x38], rax
cmp word [rcx + 0xe], 3
movzx esi, r8b
mov rbx, rcx
jne 0x14001fd11
cmp dword [rcx], 0
je 0x14001fd11
mov eax, 0x405
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov word [rsp + 0x36], ax
movabs rcx, 0xffff000000000000
mov rax, qword [rsp + 0x30]
and rax, rcx
or rax, rdx
mov qword [rsp + 0x30], rax
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], 0
jne 0x14001fcb7
lea r8, [rsp + 0x28]
mov dword [rsp + 0x28], eax
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140020f60
mov ecx, dword [rbx]
movabs rdx, 0xffffffffffff
mov rax, qword [rbx + 8]
and rax, rdx
shl rcx, 5
add rcx, rax
mov rax, qword [rsp + 0x20]
cmp rax, rcx
je 0x14001fd11
movzx ecx, word [rax + 0x1e]
movzx eax, cl
shr al, 3
test al, 1
je 0x14001fd11
cmp cx, 0xa
sete al
jmp 0x14001fd15
movzx eax, sil
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140346cc0
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rsi
ret
Function at 0x140022730
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x90
movaps xmmword [rax - 0x28], xmm6
movaps xmmword [rax - 0x38], xmm7
movaps xmmword [rax - 0x48], xmm8
movaps xmmword [rax - 0x58], xmm9
movaps xmmword [rax - 0x68], xmm10
mov rax, qword [0x1404f3628]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, qword [rcx + 0x10]
movaps xmm10, xmm2
mov rbx, rdx
mov rsi, rcx
cmp rdi, qword [rcx + 8]
je 0x140022923
movsd xmm7, qword [0x1404b9130]
movabs rbp, 0x8000000000000000
movsd xmm6, qword [0x1404b9128]
mov r14d, 0x405
movsd xmm9, qword [0x1404b9148]
movabs r15, 0xffff000000000000
movabs r12, 0xffffffffffff
xorps xmm8, xmm8
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov word [rsp + 0x36], r14w
mov rax, qword [rsp + 0x30]
and rax, r15
or rax, rbx
mov qword [rsp + 0x30], rax
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rbx + rax], 0
jne 0x1400227f5
add rdi, 0xffffffffffffffa0
mov dword [rsp + 0x28], eax
mov rcx, rdi
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x20]
call fcn.140020f60
mov edx, dword [rdi]
mov rax, qword [rdi + 8]
mov rcx, qword [rsp + 0x20]
and rax, r12
shl rdx, 5
add rdx, rax
cmp rcx, rdx
je 0x140022919
movzx eax, word [rcx + 0x1e]
shr ax, 9
test al, 1
jne 0x140022974
movzx edx, word [rcx + 0x1e]
movzx eax, dl
shr al, 4
test al, 1
je 0x140022919
movzx eax, dx
shr ax, 8
test al, 1
je 0x1400228d2
mov rdx, qword [rcx + 0x10]
xorps xmm0, xmm0
test rdx, rdx
js 0x140022876
cvtsi2sd xmm0, rdx
jmp 0x14002288e
mov rax, rdx
mov rcx, rdx
shr rcx, 1
and eax, 1
or rcx, rax
cvtsi2sd xmm0, rcx
addsd xmm0, xmm0
movsd qword [rsp + 0x28], xmm0
movsd xmm0, qword [rsp + 0x28]
comisd xmm0, xmm8
jb 0x140022919
movsd xmm0, qword [rsp + 0x28]
comisd xmm7, xmm0
jbe 0x140022919
movsd xmm0, qword [rsp + 0x28]
xor ecx, ecx
comisd xmm0, xmm6
jb 0x1400228c8
subsd xmm0, xmm6
comisd xmm0, xmm6
jae 0x1400228c8
mov rcx, rbp
cvttsd2si rax, xmm0
add rax, rcx
jmp 0x140022914
shr dl, 7
test dl, 1
je 0x140022974
mov rdx, qword [rcx + 0x10]
xorps xmm0, xmm0
cvtsi2sd xmm0, rdx
movsd qword [rsp + 0x28], xmm0
movsd xmm1, qword [rsp + 0x28]
comisd xmm1, xmm9
jb 0x140022919
movsd xmm0, qword [rsp + 0x28]
comisd xmm6, xmm0
jbe 0x140022919
movsd xmm0, qword [rsp + 0x28]
cvttsd2si rax, xmm0
cmp rdx, rax
je 0x14002296f
cmp rdi, qword [rsi + 8]
jne 0x1400227d0
movaps xmm0, xmm10
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140346cc0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [rsp + 0x70]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
mov rsp, r11
pop r15
pop r14
pop r12
ret
mov rcx, qword [rsp + 0x20]
add rcx, 0x10
call fcn.140020a60
jmp 0x140022927
Function at 0x140025be0
Capabilities:
Set console window title

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rdi, rdx
mov rsi, rcx
lea rax, vtable.xmrig::ConsoleLog.0
mov qword [rcx], rax
xor ebp, ebp
mov qword [rcx + 8], rbp
mov qword [rcx + 0x10], rbp
lea ecx, [rbp + 1]
call fcn.14030d600
cmp eax, 0xe
je 0x140025c20
cmp eax, 7
jne 0x140025c4c
mov ecx, 0x158
call fcn.140346ce0
mov rbx, rax
mov qword [rsi + 8], rax
call fcn.14030dce0
mov rcx, rax
xor r9d, r9d
lea r8d, [r9 + 1]
mov rdx, rbx
call fcn.1403117f0
test eax, eax
jns 0x140025c58
mov byte [0x1404f4328], bpl
jmp 0x140025da3
xor edx, edx
mov rcx, qword [rsi + 8]
call fcn.140311d00
mov rax, qword [rsi + 8]
mov qword [rsi + 0x10], rax
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140025cad
mov dword [rsp + 0x50], ebp
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
test eax, eax
je 0x140025cad
mov edx, dword [rsp + 0x50]
and edx, 0xffffffbf
mov dword [rsp + 0x50], edx
bts edx, 7
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleMode]
cmp byte [rdi], bpl
je 0x140025da3
cmp qword [rdi + 8], rbp
jne 0x140025ced
mov ecx, reloc.WS2_32.dll_listen
call fcn.140347238
mov rbx, rax
movsd xmm0, qword [str.XMRig_6.21.0]
movsd qword [rax], xmm0
mov eax, dword [0x1404ac798]
mov dword [rbx + 8], eax
movzx eax, byte [0x1404ac79c]
mov byte [rbx + 0xc], al
jmp 0x140025d92
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x28], rbp
mov ecx, 0x40
call fcn.140346ce0
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x20]
mov rdx, qword [rdi + 8]
lea rcx, [rsp + 0x30]
call fcn.140016c60
nop
mov rcx, qword [rsp + 0x20]
mov rdi, qword [rcx + 8]
cmp byte [rdi + 0x19], 0
jne 0x140025d83
nop word [rax + rax]
mov r8, qword [rdi + 0x10]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x20]
call fcn.14001a0d0
mov rbx, rdi
mov rdi, qword [rdi]
mov rcx, qword [rbx + 0x30]
call fcn.140346d1c
mov rcx, qword [rbx + 0x20]
call fcn.140346d1c
mov edx, 0x40
mov rcx, rbx
call fcn.140346d1c
cmp byte [rdi + 0x19], 0
je 0x140025d40
mov rcx, qword [rsp + 0x20]
mov edx, 0x40
call fcn.140346d1c
mov rbx, qword [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov rcx, rbx
call fcn.140346d1c
mov rax, rsi
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x14004ad00
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
movzx eax, byte [rcx + 6]
mov rdx, rcx
movzx r8d, byte [rcx + 7]
movzx esi, byte [rcx + 0xb]
movzx ebp, byte [rcx + 0xf]
movzx r11d, byte [rcx + 0x13]
movzx ebx, byte [rcx + 0x17]
movzx edi, byte [rcx + 0x1b]
movzx r14d, byte [rcx + 0x1f]
shl r8, 8
or r8, rax
shl rsi, 8
movzx eax, byte [rcx + 5]
shl rbp, 8
shl r11, 8
shl rbx, 8
shl rdi, 8
shl r14, 8
shl r8, 8
or r8, rax
movzx eax, byte [rcx + 4]
shl r8, 8
or r8, rax
movzx eax, byte [rcx + 0xa]
or rsi, rax
movzx eax, byte [rcx + 9]
shl rsi, 8
or rsi, rax
movzx eax, byte [rcx + 8]
shl rsi, 8
or rsi, rax
movzx eax, byte [rcx + 0xe]
or rbp, rax
movzx eax, byte [rcx + 0xd]
shl rbp, 8
or rbp, rax
movzx eax, byte [rcx + 0xc]
shl rbp, 8
or rbp, rax
movzx eax, byte [rcx + 0x12]
or r11, rax
movzx eax, byte [rcx + 0x11]
shl r11, 8
or r11, rax
movzx eax, byte [rcx + 0x10]
shl r11, 8
or r11, rax
movzx eax, byte [rcx + 0x16]
or rbx, rax
movzx eax, byte [rcx + 0x15]
shl rbx, 8
or rbx, rax
movzx eax, byte [rcx + 0x14]
shl rbx, 8
or rbx, rax
movzx eax, byte [rcx + 0x1a]
or rdi, rax
movzx eax, byte [rcx + 0x19]
shl rdi, 8
or rdi, rax
movzx eax, byte [rcx + 0x18]
shl rdi, 8
or rdi, rax
movzx eax, byte [rcx + 0x1e]
or r14, rax
movzx eax, byte [rcx + 0x1d]
shl r14, 8
or r14, rax
movzx eax, byte [rcx + 0x1c]
movzx ecx, byte [rcx + 3]
shl rcx, 8
shl r14, 8
or r14, rax
movzx eax, byte [rdx + 2]
or rcx, rax
movzx eax, byte [rdx + 1]
shl rcx, 8
or rcx, rax
movzx eax, byte [rdx]
shl rcx, 8
or rcx, rax
mov edx, 0x5cf5d3ec
mov eax, 1
sub rdx, rcx
test rdx, rdx
jle 0x14004ae5a
mov r10d, eax
jmp 0x14004ae67
xor r10d, r10d
test rdx, rdx
setns r10b
dec r10d
mov ecx, 0x5812631a
sub rcx, r8
test rcx, rcx
jle 0x14004ae79
mov r9d, eax
jmp 0x14004ae86
xor r9d, r9d
test rcx, rcx
setns r9b
dec r9d
mov ecx, 0xa2f79cd6
sub rcx, rsi
test rcx, rcx
jle 0x14004ae98
mov r8d, eax
jmp 0x14004aea5
xor r8d, r8d
test rcx, rcx
setns r8b
dec r8d
mov ecx, 0x14def9de
sub rcx, rbp
test rcx, rcx
jle 0x14004aeb6
mov edx, eax
jmp 0x14004aec0
xor edx, edx
test rcx, rcx
setns dl
dec edx
mov ecx, 0x10000000
neg r11
sub rcx, r14
neg rbx
neg rdi
test rcx, rcx
jg 0x14004aee0
xor eax, eax
test rcx, rcx
setns al
dec eax
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
cdqe
sar rdi, 0x3f
sar rbx, 0x3f
sar r11, 0x3f
lea rcx, [rdi + rax*2]
mov rdi, qword [rsp + 0x28]
lea rax, [rbx + rcx*2]
mov rbx, qword [rsp + 0x10]
lea rcx, [r11 + rax*2]
movsxd rax, edx
lea rdx, [rax + rcx*2]
movsxd rax, r8d
lea rcx, [rax + rdx*2]
movsxd rax, r9d
lea rdx, [rax + rcx*2]
movsxd rax, r10d
lea rax, [rax + rdx*2]
sar rax, 8
pop r14
ret