joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001c200
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5c18], 0
lea rbx, [rcx + 0x5c20]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x14001c2a7
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x14001c25a
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.14001e970
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.140004240
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5c18]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x5c28]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x1401d55e8]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x14001c2af
mov rcx, rbx
call fcn.140004240
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x14001c840
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
movzx r8d, byte [rcx]
lea rdx, [rcx + 1]
mov r14, qword [0x1401d55f0]
mov r9d, 0xffffffff
mov ebx, r9d
test r8b, r8b
je 0x14001c8a4
lea r10, [0x14014ec00]
cmp r8b, 0x23
jne 0x14001c887
cmp byte [rdx], r8b
jne 0x14001c887
cmp byte [rdx + 1], r8b
cmove ebx, r9d
movzx ecx, bl
movzx eax, r8b
movzx r8d, byte [rdx]
xor rcx, rax
shr ebx, 8
inc rdx
xor ebx, dword [r10 + rcx*4]
test r8b, r8b
jne 0x14001c874
mov eax, dword [r14 + 0x5b90]
xor edi, edi
mov qword [rsp + 0x30], rbp
not ebx
mov qword [rsp + 0x38], rsi
test eax, eax
jle 0x14001c905
mov esi, edi
mov ebp, edi
test rsi, rsi
js 0x14001c8ca
cmp edi, eax
jl 0x14001c8e4
mov r8d, 0x6ff
lea rdx, str.C:UsersAdministratorMusicGAELProyecto_Diego_Golden_t2Proyecto_Diego_Goldenimgui.h
lea rcx, str.i___0__i___Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [r14 + 0x5b98]
cmp dword [rax + rbp + 8], ebx
je 0x14001c922
mov eax, dword [r14 + 0x5b90]
inc edi
inc rsi
add rbp, 0x48
cmp edi, eax
jl 0x14001c8c1
xor eax, eax
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
test edi, edi
js 0x14001c92f
cmp edi, dword [r14 + 0x5b90]
jl 0x14001c949
mov r8d, 0x6ff
lea rdx, str.C:UsersAdministratorMusicGAELProyecto_Diego_Golden_t2Proyecto_Diego_Goldenimgui.h
lea rcx, str.i___0__i___Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movsxd rax, edi
lea rcx, [rax + rax*8]
mov rax, qword [r14 + 0x5b98]
lea rax, [rax + rcx*8]
jmp 0x14001c907
Function at 0x14003f370
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, pe_nt_image_headers64
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x14003f3d7
lea r8, [r10 + 0x10]
movabs r11, 0xb5026f5aa96619e9
mov rdx, qword [r8]
xor rdx, qword [r8 - 8]
lea r8, [r8 + 8]
and rdx, 0xffffffff80000000
xor rdx, qword [r8 - 8]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [r8 + 0x4d0]
xor rcx, rdx
mov qword [r8 + 0x9b0], rcx
sub r9, 1
jne 0x14003f392
mov ecx, dword [r10]
jmp 0x14003f4f8
cmp ecx, 0x270
jb 0x14003f4f8
mov qword [rsp + 0x10], rbx
movabs r11, 0xb5026f5aa96619e9
lea rbx, [r10 + 0x9c8]
mov qword [rsp], rdi
mov rax, qword [rbx]
mov edi, 0x9c
nop word [rax + rax]
mov r9, qword [rbx + 8]
mov r8, rbx
add rbx, 8
mov rdx, r9
xor rdx, rax
and rdx, 0xffffffff80000000
xor rdx, r9
movzx eax, dl
and al, 1
neg al
mov rax, r9
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [r8 + 0x4e0]
xor rcx, rdx
mov qword [r8 - 0x9c0], rcx
sub rdi, 1
jne 0x14003f410
lea rbx, [r10 + 0xea8]
mov edi, 0x9b
mov r9, qword [rbx]
nop dword [rax]
nop dword [rax + rax]
mov r8, qword [rbx + 8]
mov rdx, rbx
xor r9, r8
add rbx, 8
and r9, 0xffffffff80000000
xor r9, r8
movzx eax, r9b
and al, 1
neg al
sbb rcx, rcx
shr r9, 1
and rcx, r11
xor rcx, qword [rdx - 0xea0]
xor rcx, r9
mov r9, r8
mov qword [rdx - 0x9c0], rcx
sub rdi, 1
jne 0x14003f470
mov rdx, qword [r10 + 8]
xor rdx, qword [r10 + 0x1380]
mov rdi, qword [rsp]
and rdx, 0xffffffff80000000
xor rdx, qword [r10 + 8]
mov rbx, qword [rsp + 0x10]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [r10 + 0x4e0]
xor rcx, rdx
mov qword [r10 + 0x9c0], rcx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov rdx, qword [r10 + rax*8 + 8]
lea eax, [rcx + 1]
mov dword [r10], eax
mov rcx, rdx
mov rax, qword [r10 + 0x1388]
shr rcx, 0x1d
and rax, rcx
movabs rcx, 0x38eb3ffff6d3
xor rdx, rax
mov rax, rdx
and rax, rcx
shl rax, 0x11
xor rdx, rax
mov rax, rdx
and rax, 0xffffffffffffbf77
shl rax, 0x25
xor rdx, rax
mov rax, rdx
shr rax, 0x2b
xor rax, rdx
add rsp, 8
ret
Function at 0x14003fa20
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov rdi, qword [0x1401fb100]
mov rbx, r8
lea rsi, [rdi + 0x164]
lea rcx, [rdi + 0x16c]
mov dword [rsi], 1
call sub.VCRUNTIME140.dll_memcpy
mov dword [rdi + 0x168], ebx
add rbx, 8
je 0x14003fb33
mov rax, qword [rdi]
test rax, rax
jne 0x14003fa8b
mov r8d, reloc.WLDAP32.dll_Ordinal_79
lea rdx, str.C:UsersAdministratorMusicGAELProyecto_Diego_Golden_t2Proyecto_Diego_Goldenexamplesexample_win32_directx11DiscordSDK_srcconnection_win.cpp
lea rcx, str.self
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
jmp 0x14003fae3
mov rcx, qword [rax + 8]
cmp rcx, 0xffffffffffffffff
je 0x14003fae3
test rsi, rsi
jne 0x14003fab6
mov r8d, 0x56
lea rdx, str.C:UsersAdministratorMusicGAELProyecto_Diego_Golden_t2Proyecto_Diego_Goldenexamplesexample_win32_directx11DiscordSDK_srcconnection_win.cpp
lea rcx, [0x1401ac8d8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
jmp 0x14003fae3
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], 0
mov r8d, ebx
mov qword [rsp + 0x20], 0
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
jne 0x14003fae3
cmp dword [rsp + 0x40], ebx
je 0x14003fb33
mov r8, qword [rdi + 0x18]
test r8, r8
je 0x14003fb02
mov eax, dword [rdi + 8]
dec eax
test eax, 0xfffffffd
jne 0x14003fb02
mov ecx, dword [rdi + 0x60]
lea rdx, [rdi + 0x64]
call r8
mov rbx, qword [rdi]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 8], 0xffffffffffffffff
xor al, al
mov byte [rbx], 0
mov dword [rdi + 8], 0
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x48]
mov al, 1
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140045090
Capabilities:
Enumerate processes

Disassembly:
push rsi
sub rsp, 0x150
mov rsi, rdx
test rdx, rdx
jne 0x1400450ac
xor eax, eax
add rsp, 0x150
pop rsi
ret
mov qword [rsp + 0x160], rbx
xor edx, edx
mov qword [rsp + 0x168], rbp
mov ecx, 2
mov qword [rsp + 0x170], rdi
xor edi, edi
mov ebx, edi
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x140045132
mov rdx, rsi
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp]
test eax, eax
jne 0x140045120
mov eax, dword [rsp + 0x3c]
cmp eax, ebx
jbe 0x140045120
mov edi, dword [rsp + 0x28]
mov ebx, eax
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140045100
mov rbp, qword [rsp + 0x168]
mov eax, edi
mov rdi, qword [rsp + 0x170]
mov rbx, qword [rsp + 0x160]
add rsp, 0x150
pop rsi
ret

Function at 0x140045160
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x50
mov rbx, r9
mov r15, qword [rsp + 0x90]
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__msize]
mov rsi, rax
test eax, eax
jg 0x1400451a0
xor al, al
jmp 0x140045286
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
xor r12d, r12d
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9, rbx
call fcn.1400452b0
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
cmp rbx, rdi
jne 0x1400451d7
xor dil, dil
jmp 0x140045241
mov ebp, r12d
sub rdi, rbx
sar rdi, 3
test rdi, rdi
je 0x14004523e
movsxd r14, esi
mov rsi, rbx
nop dword [rax]
mov edx, dword [rsi]
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
mov r8, r14
mov rcx, qword [0x1401f67f0]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov qword [rsp + 0x20], r12
mov r9, r14
mov r8, r15
mov rdx, qword [rsi]
mov rcx, qword [0x1401f67f0]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
inc ebp
lea rsi, [rsi + 8]
movsxd rax, ebp
cmp rax, rdi
jb 0x1400451f0
mov dil, 1
test rbx, rbx
je 0x140045282
mov rdx, qword [rsp + 0x40]
sub rdx, rbx
and rdx, 0xfffffffffffffff8
mov rax, rbx
cmp rdx, 0x1000
jb 0x14004527a
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004527a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.14011a784
movzx eax, dil
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x140045cb0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
xor eax, eax
movq xmm2, r8
punpcklqdq xmm2, xmm2
mov r9, rdx
mov r10, rcx
test rdx, rdx
je 0x140045e3b
cmp rdx, 8
jb 0x140045e20
cmp dword [reloc.WS2_32.dll_accept], 5
jl 0x140045e20
movdqa xmm3, xmmword [0x1401b0700]
mov r11, rdx
movdqa xmm4, xmmword [reloc.WS2_32.dll_getsockopt]
lea rdx, [rcx + 4]
movdqa xmm5, xmmword [0x1401b07a0]
and r11, 0xfffffffffffffff8
mov qword [rsp + 0x10], rbx
mov rbx, 0xfffffffffffffffe
mov qword [rsp], rdi
sub rbx, rcx
mov edi, 2
sub rdi, rcx
movzx ecx, word [rdx - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm3
andps xmm0, xmm4
psllq xmm0, 3
vpsrlvq xmm1, xmm2, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 4], cx
lea rcx, [rbx + rdx]
movq xmm0, rcx
movzx ecx, word [rdx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm3
andps xmm0, xmm4
psllq xmm0, 3
vpsrlvq xmm1, xmm2, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 2], cx
mov rcx, rdx
sub rcx, r10
movq xmm0, rcx
movzx ecx, word [rdx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm3
andps xmm0, xmm4
psllq xmm0, 3
vpsrlvq xmm1, xmm2, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx], cx
lea rcx, [rdi + rdx]
movq xmm0, rcx
movzx ecx, word [rdx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm3
andps xmm0, xmm4
psllq xmm0, 3
vpsrlvq xmm1, xmm2, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx + 2], cx
add rdx, 8
cmp rax, r11
jb 0x140045d23
mov rdi, qword [rsp]
mov rbx, qword [rsp + 0x10]
cmp rax, r9
jae 0x140045e3b
nop word [rax + rax]
movzx ecx, al
mov rdx, r8
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r10 + rax], dl
inc rax
cmp rax, r9
jb 0x140045e20
add rsp, 8
ret
Function at 0x140046170
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x18], r8
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rbx, r9
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__msize]
test eax, eax
jg 0x1400461ad
xor al, al
jmp 0x14004634e
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
xor r13d, r13d
mov qword [rsp + 0x40], r13
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9, rbx
call fcn.140046370
mov rbp, qword [rsp + 0x30]
mov r14, qword [rsp + 0x38]
cmp rbp, r14
jne 0x1400461e6
xor bl, bl
jmp 0x14004630a
mov r12d, r13d
sub r14, rbp
sar r14, 3
test r14, r14
je 0x140046308
mov r15, rbp
nop dword [rax]
mov rax, qword [r15]
lea rbx, [rax + 0x2c]
lea rdi, [rax + 0x28]
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
mov r8d, 8
mov edx, ebx
mov rcx, qword [0x1401d47b8]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rsp + 0x90]
mov rdx, rbx
mov rcx, qword [0x1401d47b8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
mov r8d, 8
mov edx, edi
mov rcx, qword [0x1401d47b8]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rsp + 0x90]
mov rdx, rdi
mov rcx, qword [0x1401d47b8]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0xa8]
mov r8d, 8
mov edx, ebx
mov rcx, qword [0x1401d47b8]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0xa8]
mov r8d, 8
mov edx, edi
mov rcx, qword [0x1401d47b8]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
inc r12d
lea r15, [r15 + 8]
movsxd rax, r12d
cmp rax, r14
jb 0x140046200
mov bl, 1
test rbp, rbp
je 0x14004634b
mov rdx, qword [rsp + 0x40]
sub rdx, rbp
and rdx, 0xfffffffffffffff8
mov rax, rbp
cmp rdx, 0x1000
jb 0x140046343
add rdx, 0x27
mov rbp, qword [rbp - 8]
sub rax, rbp
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140046343
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbp
call fcn.14011a784
movzx eax, bl
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400490a0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x150
xor edi, edi
xor edx, edx
mov ecx, 2
mov ebx, edi
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x140049126
nop
lea rdx, str.HD_Player.exe
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp]
test eax, eax
jne 0x140049114
mov eax, dword [rsp + 0x3c]
cmp eax, ebx
jbe 0x140049114
mov edi, dword [rsp + 0x28]
mov ebx, eax
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1400490f0
lea r11, [rsp + 0x150]
mov eax, edi
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x140049320
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
xor esi, esi
call fcn.1400490a0
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
mov dword [rsp + 0x20], 4
xor edx, edx
mov r9d, 0x1000
mov r8d, Ordinal_35
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rbx, rax
mov qword [rsp + 0x20], rsi
mov r9d, Ordinal_35
lea r8, str.C:_Windows_System32_xwtpduir1.dll
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [0x1401af6a0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r9, rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rbx
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov r9d, 0x8000
mov r8d, Ordinal_35
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov ecx, 8
call fcn.14011a438
lea rcx, [0x140049030]
mov qword [rax], rcx
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x140050590]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14004946f
cmp dword [rsp + 0x48], esi
je 0x140049463
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0x50]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140049463
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x48], esi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x140049480
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
xor esi, esi
call fcn.1400490a0
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
mov dword [rsp + 0x20], 4
xor edx, edx
mov r9d, 0x1000
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rbx, rax
mov qword [rsp + 0x20], rsi
mov r9d, reloc.WLDAP32.dll_Ordinal_32
lea r8, str.C:_Windows_System32_chams3d.dll
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [0x1401af6a0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r9, rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rbx
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov r9d, 0x8000
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov ecx, 8
call fcn.14011a438
lea rcx, [0x140048ff0]
mov qword [rax], rcx
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x140050590]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1400495cf
cmp dword [rsp + 0x48], esi
je 0x1400495c3
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0x50]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x1400495c3
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x48], esi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x14004f920
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xd], 0
mov r8, rcx
je 0x14004fa71
xor eax, eax
cmp dword [reloc.WS2_32.dll_accept], 5
jl 0x14004fa43
movzx eax, word [rcx]
movdqa xmm5, xmmword [0x1401b0840]
movdqa xmm4, xmmword [0x1401b07a0]
movdqa xmm3, xmmword [0x1401b0700]
movdqa xmm2, xmmword [reloc.WS2_32.dll_bind]
movdqa xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm5, xmm0
pshufb xmm1, xmm4
movd xmm0, eax
xorps xmm1, xmm0
psllq xmm3, 3
movd eax, xmm1
movdqa xmm0, xmm2
psllq xmm0, 3
vpsrlvq xmm1, xmm5, xmm0
mov word [rcx], ax
movzx eax, word [rcx + 2]
pshufb xmm1, xmm4
movd xmm0, eax
xorps xmm1, xmm0
psllq xmm2, 3
movdqa xmm0, xmmword [reloc.WS2_32.dll_connect]
movd eax, xmm1
psllq xmm0, 3
vpsrlvq xmm1, xmm5, xmm0
mov word [rcx + 2], ax
movzx eax, word [rcx + 4]
pshufb xmm1, xmm4
movd xmm0, eax
xorps xmm1, xmm0
movdqa xmm0, xmmword [reloc.WS2_32.dll_getsockname]
movd eax, xmm1
psllq xmm0, 3
vpsrlvq xmm1, xmm5, xmm0
mov word [rcx + 4], ax
movzx eax, word [rcx + 6]
pshufb xmm1, xmm4
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
vpsrlvq xmm1, xmm5, xmm3
pshufb xmm1, xmm4
mov word [rcx + 6], ax
movzx eax, word [rcx + 8]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
vpsrlvq xmm1, xmm5, xmm2
pshufb xmm1, xmm4
mov word [rcx + 8], ax
movzx eax, word [rcx + 0xa]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [rcx + 0xa], ax
mov eax, ntohs
movabs r9, 0x319fc37957090b5d
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0xd
jb 0x14004fa50
mov byte [r8 + 0xd], 0
ret
Function at 0x14004fa80
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xc], 0
mov r8, rcx
je 0x14004fbd1
xor eax, eax
cmp dword [reloc.WS2_32.dll_accept], 5
jl 0x14004fba3
movzx eax, word [rcx]
movdqa xmm5, xmmword [0x1401b0830]
movdqa xmm4, xmmword [0x1401b07a0]
movdqa xmm3, xmmword [0x1401b0700]
movdqa xmm2, xmmword [reloc.WS2_32.dll_bind]
movdqa xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm5, xmm0
pshufb xmm1, xmm4
movd xmm0, eax
xorps xmm1, xmm0
psllq xmm3, 3
movd eax, xmm1
movdqa xmm0, xmm2
psllq xmm0, 3
vpsrlvq xmm1, xmm5, xmm0
mov word [rcx], ax
movzx eax, word [rcx + 2]
pshufb xmm1, xmm4
movd xmm0, eax
xorps xmm1, xmm0
psllq xmm2, 3
movdqa xmm0, xmmword [reloc.WS2_32.dll_connect]
movd eax, xmm1
psllq xmm0, 3
vpsrlvq xmm1, xmm5, xmm0
mov word [rcx + 2], ax
movzx eax, word [rcx + 4]
pshufb xmm1, xmm4
movd xmm0, eax
xorps xmm1, xmm0
movdqa xmm0, xmmword [reloc.WS2_32.dll_getsockname]
movd eax, xmm1
psllq xmm0, 3
vpsrlvq xmm1, xmm5, xmm0
mov word [rcx + 4], ax
movzx eax, word [rcx + 6]
pshufb xmm1, xmm4
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
vpsrlvq xmm1, xmm5, xmm3
pshufb xmm1, xmm4
mov word [rcx + 6], ax
movzx eax, word [rcx + 8]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
vpsrlvq xmm1, xmm5, xmm2
pshufb xmm1, xmm4
mov word [rcx + 8], ax
movzx eax, word [rcx + 0xa]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [rcx + 0xa], ax
mov byte [rcx + 0xc], 0
ret
movabs r9, 0x783d5619155675b
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0xc
jb 0x14004fbb0
mov byte [r8 + 0xc], 0
ret

Function at 0x14004fed0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rbx, rdx
mov rdi, rcx
mov ecx, 8
call fcn.14011a438
mov qword [rax], rbx
mov qword [rsp + 0x40], rax
lea rbx, [rdi + 8]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x140050590]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rdi], rax
test rax, rax
je 0x14004ff2d
mov rax, rdi
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov dword [rbx], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3