joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400838b0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x30
call fcn.1401f4630
sub rsp, rax
mov rbx, r8
mov rbp, rdx
mov rdi, rcx
call fcn.14013a560
mov rcx, rax
call fcn.1400e91c0
mov rsi, rax
test rax, rax
je 0x14008399f
xor r8d, r8d
mov r9, rbp
mov rcx, rax
lea edx, [r8 + 0x64]
call fcn.1400e86e0
xor r9d, r9d
mov edx, 0x9b
mov rcx, rsi
lea r8d, [r9 + 0x10]
call fcn.1400e86e0
test rdi, rdi
jne 0x140083927
mov rcx, rbx
call fcn.1400a39e0
mov rbx, rax
jmp 0x140083932
mov rcx, rdi
mov rbx, rdi
call fcn.1400a4780
mov r8, rsi
mov rdx, rsi
mov rcx, rbx
call fcn.1400a4540
mov rcx, rbx
call fcn.1400a1d70
test eax, eax
jg 0x1400839b6
mov rcx, qword [0x1402dfba8]
lea rdx, str.ERROR_n
call fcn.1400e9c80
mov ecx, dword [0x1402d8b68]
test ecx, ecx
je 0x140083986
call fcn.1401416e0
mov rcx, qword [0x1402dfba8]
lea rdx, str.verify_error:_s_n
mov r8, rax
call fcn.1400e9c80
jmp 0x140083992
mov rcx, qword [0x1402dfba8]
call fcn.1400f57f0
test rdi, rdi
jne 0x14008399f
mov rcx, rbx
call fcn.1400a2960
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rcx, rbx
mov dword [rsp + 0x58], 1
call fcn.1400a3440
test eax, eax
js 0x1400839eb
movsxd rcx, eax
lea r9, [rsp + 0x58]
mov edx, 0xffff
mov dword [rsp + 0x20], 4
mov r8d, 0x80
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rax, rbx
jmp 0x1400839a1

Function at 0x140087080
Capabilities:
Create thread
Terminate process
Terminate thread

Disassembly:
mov eax, 0x48
call fcn.1401f4630
sub rsp, rax
movaps xmmword [rsp + 0x30], xmm6
test ecx, ecx
jne 0x140087134
xor eax, eax
lea r8, [0x140087df0]
mov qword [rsp + 0x28], rax
xor r9d, r9d
mov edx, 0x1000
mov dword [rsp + 0x20], eax
xor ecx, ecx
mov dword [0x1402dfdbc], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x1402dfdc0], rax
test rax, rax
jne 0x1400870fe
mov qword [rsp + 0x40], rbx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x1402dfba8]
lea rdx, str.unable_to_CreateThread___lu_
mov r8d, eax
mov ebx, eax
call fcn.1400e9c80
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [0x1402dfdbc]
test eax, eax
jne 0x14008711a
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x1402dfdbc]
test eax, eax
je 0x140087108
mov edx, dword [reloc.WS2_32.dll_accept]
xor ecx, ecx
call fcn.140097ad0
movaps xmm6, xmm0
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret
mov edx, dword [reloc.WS2_32.dll_accept]
call fcn.140097ad0
mov eax, dword [0x1402dfdb0]
movaps xmm6, xmm0
test eax, eax
je 0x14008715b
mov rcx, qword [0x1402dfdc0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [0x1402dfdc0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movaps xmm0, xmm6
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret
Function at 0x140097520
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x250
call fcn.1401f4630
sub rsp, rax
mov rax, qword [0x1402defb8]
xor rax, rsp
mov qword [rsp + 0x240], rax
xor ebx, ebx
mov rsi, rcx
mov eax, ebx
mov rdx, rcx
cmp byte [rcx], al
je 0x140097568
cmp eax, 0x80000000
jae 0x140097568
inc rdx
inc eax
cmp byte [rdx], bl
jne 0x140097558
btr eax, 0x1f
lea r9d, [rax + 1]
mov edi, r9d
cmp rdi, 0x104
ja 0x140097679
lea rax, [rsp + 0x30]
mov dword [rsp + 0x28], 0x104
mov r8, rsi
mov qword [rsp + 0x20], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x140097661
test rdi, rdi
je 0x140097661
cmp rdi, 0x20
jb 0x140097650
lea rax, [rsi - 1]
add rax, rdi
lea rdx, [rsp + 0x30]
lea rcx, [rsp + rdi*2 + 0x2e]
cmp rdx, rax
ja 0x1400975d5
cmp rcx, rsi
jae 0x140097650
mov rax, rdi
and rax, 0xffffffffffffffe0
lea rcx, [rsi + 0x10]
movq xmm0, qword [rcx - 0x10]
movq xmm1, qword [rcx - 8]
lea rcx, [rcx + 0x20]
punpcklbw xmm0, xmm0
punpcklbw xmm1, xmm1
psraw xmm0, 8
movdqu xmmword [rsp + rbx*2 + 0x30], xmm0
movq xmm0, qword [rcx - 0x20]
psraw xmm1, 8
movdqu xmmword [rsp + rbx*2 + 0x40], xmm1
movq xmm1, qword [rcx - 0x18]
punpcklbw xmm0, xmm0
punpcklbw xmm1, xmm1
psraw xmm0, 8
movdqu xmmword [rsp + rbx*2 + 0x50], xmm0
psraw xmm1, 8
movdqu xmmword [rsp + rbx*2 + 0x60], xmm1
add rbx, 0x20
cmp rbx, rax
jb 0x1400975e0
cmp rbx, rdi
jae 0x140097661
nop dword [rax]
nop word [rax + rax]
movsx eax, byte [rsi + rbx]
mov word [rsp + rbx*2 + 0x30], ax
inc rbx
cmp rbx, rdi
jb 0x140097650
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140097679
shr eax, 4
and eax, 1
jmp 0x14009767e
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1401f4710
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x14009afe0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x30
call fcn.1401f4630
sub rsp, rax
mov rdi, rcx
mov ebx, edx
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], 0
mov rcx, rax
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rbx, qword [rsp + 0x40]
mov ecx, 0xffffffff
test eax, eax
cmovne ecx, dword [rsp + 0x50]
mov eax, ecx
add rsp, 0x30
pop rdi
ret

Function at 0x14009b040
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x30
call fcn.1401f4630
sub rsp, rax
mov rdi, rcx
mov ebx, edx
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], 0
mov rcx, rax
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x40]
mov ecx, 0xffffffff
test eax, eax
cmovne ecx, dword [rsp + 0x50]
mov eax, ecx
add rsp, 0x30
pop rdi
ret
Function at 0x1400f8430
Capabilities:
Encode data using xor

Disassembly:
push rbx
movsxd rbx, r9d
mov r10, r8
mov r11, rdx
cmp rdx, r8
je 0x1400f8592
mov qword [rsp + 0x10], rsi
lea rsi, [rcx - 1]
not rcx
shr rsi, 0x3f
shr rcx, 0x3f
and rsi, rcx
mov ecx, dword [rdx + 8]
xor ecx, dword [r8 + 8]
dec rsi
and ecx, esi
xor dword [rdx + 8], ecx
xor dword [r8 + 8], ecx
mov edx, dword [r8 + 0x10]
movq xmm4, rsi
xor edx, dword [r11 + 0x10]
and edx, esi
punpcklqdq xmm4, xmm4
xor dword [r11 + 0x10], edx
xor dword [r8 + 0x10], edx
mov ecx, dword [r11 + 0x14]
mov edx, dword [r8 + 0x14]
xor rdx, rcx
and edx, 4
and rdx, rsi
mov eax, edx
xor eax, ecx
xor ecx, ecx
mov dword [r11 + 0x14], eax
xor dword [r8 + 0x14], edx
mov edx, ecx
test r9d, r9d
jle 0x1400f8552
cmp ebx, 2
jb 0x1400f8552
mov r9, qword [r8]
lea rax, [rbx - 1]
mov r8, qword [r11]
mov qword [rsp + 0x18], rdi
lea rdi, [rbx - 1]
lea rdi, [r9 + rdi*8]
lea rax, [r8 + rax*8]
cmp r9, rax
ja 0x1400f84e1
cmp rdi, r8
jae 0x1400f854d
cmp r9, r10
ja 0x1400f84eb
cmp rdi, r10
jae 0x1400f854d
cmp r9, r11
ja 0x1400f84f5
cmp rdi, r11
jae 0x1400f854d
cmp r8, r10
ja 0x1400f84ff
cmp rax, r10
jae 0x1400f854d
cmp r8, r11
ja 0x1400f8509
cmp rax, r11
jae 0x1400f854d
mov eax, ebx
and eax, 0xfffffffe
nop
movdqu xmm2, xmmword [rcx + r9]
add edx, 2
movdqu xmm1, xmmword [rcx + r8]
lea rcx, [rcx + 0x10]
movdqa xmm3, xmm2
pxor xmm3, xmm1
pand xmm3, xmm4
movdqa xmm0, xmm3
pxor xmm3, xmm2
pxor xmm0, xmm1
movdqu xmmword [rcx + r8 - 0x10], xmm0
movdqu xmmword [rcx + r9 - 0x10], xmm3
cmp edx, eax
jl 0x1400f8510
mov rdi, qword [rsp + 0x18]
movsxd rax, edx
cmp rax, rbx
jge 0x1400f858d
nop word [rax + rax]
mov rcx, qword [r11]
mov rdx, qword [rcx + rax*8]
lea r8, [rcx + rax*8]
mov rcx, qword [r10]
mov r9, qword [rcx + rax*8]
xor r9, rdx
and r9, rsi
xor rdx, r9
mov qword [r8], rdx
mov rcx, qword [r10]
xor qword [rcx + rax*8], r9
inc rax
cmp rax, rbx
jl 0x1400f8560
mov rsi, qword [rsp + 0x10]
pop rbx
ret
Function at 0x1400fdf50
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
mov r10, rdx
xor r11b, r11b
xor edx, edx
mov rsi, r9
mov rbx, rcx
test rcx, rcx
je 0x1400fe064
test r10, r10
je 0x1400fe064
movzx eax, byte [rcx]
test r8d, r8d
jne 0x1400fdf95
cmp al, 0x7f
jbe 0x1400fe05d
mov edx, 1
mov eax, edx
add rax, r10
jmp 0x1400fe06c
mov r11b, 0xff
cmp al, 0x80
jbe 0x1400fdfab
mov edx, 1
mov eax, edx
add rax, r10
jmp 0x1400fe06c
jne 0x1400fe05d
mov eax, 1
lea rcx, [r10 - 1]
cmp r10, rax
jbe 0x1400fe04e
cmp rcx, 8
jb 0x1400fe040
and ecx, 7
mov rdx, r10
sub rdx, rcx
xorps xmm3, xmm3
xorps xmm2, xmm2
nop dword [rax + rax]
movd xmm1, dword [rax + rbx]
xorps xmm0, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
por xmm1, xmm3
movdqa xmm3, xmm1
movd xmm1, dword [rax + rbx + 4]
punpcklbw xmm1, xmm0
add rax, 8
punpcklwd xmm1, xmm0
por xmm1, xmm2
movdqa xmm2, xmm1
cmp rax, rdx
jb 0x1400fdfe0
por xmm2, xmm3
movdqa xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movd edx, xmm2
cmp rax, r10
jae 0x1400fe04e
nop
movzx ecx, byte [rax + rbx]
inc rax
or edx, ecx
cmp rax, r10
jb 0x1400fe040
neg edx
sbb r11b, r11b
movzx r11d, r11b
mov edx, r11d
and edx, 1
mov eax, edx
add rax, r10
jmp 0x1400fe06c
mov eax, 1
mov r10, rdx
mov qword [rsp + 0x10], rdi
test rsi, rsi
je 0x1400fe0c5
mov rdi, qword [r9]
test rdi, rdi
je 0x1400fe0c5
movzx r8d, r11b
lea r9, [rbx + r10]
and r8d, 1
mov byte [rdi], r11b
test r10, r10
je 0x1400fe0c2
mov ebx, edx
add rbx, rdi
nop word [rax + rax]
movzx edx, byte [r9 - 1]
lea r9, [r9 - 1]
dec r10
movzx ecx, r11b
xor edx, ecx
add r8d, edx
mov byte [rbx + r10], r8b
shr r8d, 8
test r10, r10
jne 0x1400fe0a0
add qword [rsi], rax
mov rdi, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
pop rsi
ret
Function at 0x140140fa0
Capabilities:
Encode data using xor

Disassembly:
xor edx, edx
mov r9, rcx
test rcx, rcx
je 0x140140ff7
movzx eax, byte [rcx]
test al, al
je 0x140140ff7
mov r10d, pe_nt_image_headers64
nop word [rax + rax]
movsx r8d, al
lea r9, [r9 + 1]
movzx eax, byte [r9]
or r8d, r10d
mov ecx, r8d
add r10d, 0x100
shr ecx, 2
xor ecx, r8d
imul r8d, r8d
and ecx, 0xf
rol edx, cl
xor edx, r8d
test al, al
jne 0x140140fc0
mov eax, edx
shr eax, 0x10
xor eax, edx
ret
xor eax, eax
ret

Function at 0x14014ddb0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
mov eax, 0x20
call fcn.1401f4630
sub rsp, rax
mov rbx, rcx
mov rsi, rdx
mov rcx, rdx
call fcn.1400f8860
test eax, eax
je 0x14014ddef
xor edx, edx
mov rcx, rbx
call fcn.1400f8e70
mov eax, 1
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
mov qword [rsp + 0x30], rbp
mov ebp, dword [rsi + 8]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], r14
mov r14, qword [rsi]
lea eax, [rbp - 1]
movsxd rdi, eax
xor eax, eax
mov rcx, qword [r14 + rdi*8]
cmp rcx, 1
sete al
sub ebp, eax
cmp rsi, rbx
je 0x14014de37
mov edx, ebp
mov rcx, rbx
call fcn.1400f9410
test rax, rax
je 0x14014de9d
mov eax, dword [rsi + 0x10]
mov dword [rbx + 0x10], eax
mov rcx, qword [r14 + rdi*8]
mov rax, qword [rbx]
mov rdx, rcx
xor rdx, 1
inc rdx
neg rdx
shl rdx, 0x3f
lea r8, [rax + rdi*8]
shr rcx, 1
je 0x14014de57
mov qword [r8], rcx
test rdi, rdi
jle 0x14014de8e
sub r14, rax
nop
mov rcx, qword [r14 + r8 - 8]
lea r8, [r8 - 8]
mov rax, rcx
dec rdi
shr rax, 1
or rax, rdx
mov rdx, rcx
xor rdx, 1
mov qword [r8], rax
inc rdx
neg rdx
shl rdx, 0x3f
test rdi, rdi
jg 0x14014de60
mov dword [rbx + 8], ebp
test ebp, ebp
jne 0x14014de98
mov dword [rbx + 0x10], ebp
mov eax, 1
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret

Function at 0x140155da0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, 0x28
call fcn.1401f4630
sub rsp, rax
lea rcx, [0x1402e3fe0]
add rsp, 0x28
jmp fcn.140174f90
Function at 0x14015c440
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0xd8
call fcn.1401f4630
sub rsp, rax
mov rax, qword [0x1402defb8]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov r14, qword [rsp + 0x140]
xor r12d, r12d
mov rax, qword [rcx]
mov rbp, r9
movsxd rbx, r8d
mov rsi, rdx
mov qword [rsp + 0x20], r14
mov rdi, rcx
lea r15d, [r12 + 1]
mov r13d, r12d
test r9, r9
je 0x14015c4af
cmp r9, rax
je 0x14015c4a7
test rdx, rdx
je 0x14015c520
test r8d, r8d
js 0x14015c520
mov r13d, r15d
mov qword [rcx], r9
jmp 0x14015c4b7
test rax, rax
je 0x14015c520
mov rbp, rax
mov rcx, rbp
call fcn.1400fec30
test al, 2
jne 0x14015c520
test rsi, rsi
je 0x14015c588
mov rcx, rbp
mov r13d, r15d
call fcn.1400a3910
cmp eax, 0x90
jg 0x14015c520
cmp eax, ebx
jge 0x14015c546
mov rcx, qword [rdi + 8]
mov r8, r14
mov rdx, rbp
call fcn.14011f2d0
test eax, eax
je 0x14015c520
mov rcx, qword [rdi + 8]
mov r8, rbx
mov rdx, rsi
call fcn.14011f530
test eax, eax
je 0x14015c520
mov rcx, qword [rdi + 8]
lea rsi, [rdi + 0x20]
mov r8, rsi
lea rdx, [rdi + 0x24]
call fcn.14011f1f0
test eax, eax
jne 0x14015c563
xor eax, eax
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1401f4710
add rsp, 0xd8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
cmp ebx, 0x90
ja 0x14015c520
mov r8, rbx
lea rcx, [rdi + 0x24]
mov rdx, rsi
call fcn.1401f54a0
lea rsi, [rdi + 0x20]
mov dword [rsi], ebx
mov ecx, dword [rsi]
cmp ecx, 0x90
je 0x14015c591
mov eax, ecx
mov r8d, 0x90
sub r8d, ecx
xor edx, edx
lea rcx, [rdi + 0x24]
add rcx, rax
call fcn.1401f58b0
jmp 0x14015c591
test r13d, r13d
je 0x14015c666
lea r14, [rsp + 0x30]
mov esi, 0x48
sub r14, rdi
lea rbx, [rdi + 0x25]
lea r15, [rsp + 0x31]
mov rcx, rbx
sub r15, rdi
mov edx, esi
nop
movzx eax, byte [rcx - 1]
lea rcx, [rcx + 2]
xor al, 0x36
mov byte [r14 + rcx - 0x27], al
movzx eax, byte [rcx - 2]
xor al, 0x36
mov byte [r15 + rcx - 0x27], al
sub rdx, 1
jne 0x14015c5b0
mov r8, qword [rsp + 0x20]
mov rdx, rbp
mov rcx, qword [rdi + 0x10]
call fcn.14011f2d0
test eax, eax
je 0x14015c679
mov rcx, rbp
call fcn.1400a3910
mov rcx, qword [rdi + 0x10]
lea rdx, [rsp + 0x30]
movsxd r8, eax
call fcn.14011f530
test eax, eax
je 0x14015c679
nop word [rax + rax]
movzx eax, byte [rbx - 1]
lea rbx, [rbx + 2]
xor al, 0x5c
mov byte [rbx + r14 - 0x27], al
movzx eax, byte [rbx - 2]
xor al, 0x5c
mov byte [rbx + r15 - 0x27], al
sub rsi, 1
jne 0x14015c610
mov r8, qword [rsp + 0x20]
mov rdx, rbp
mov rcx, qword [rdi + 0x18]
call fcn.14011f2d0
test eax, eax
je 0x14015c679
mov rcx, rbp
call fcn.1400a3910
mov rcx, qword [rdi + 0x18]
lea rdx, [rsp + 0x30]
movsxd r8, eax
call fcn.14011f530
test eax, eax
je 0x14015c679
lea r15d, [rsi + 1]
mov rdx, qword [rdi + 0x10]
mov rcx, qword [rdi + 8]
call fcn.14011f5a0
test eax, eax
cmovne r12d, r15d
test r13d, r13d
je 0x14015c68d
mov edx, 0x90
lea rcx, [rsp + 0x30]
call fcn.140001240
mov eax, r12d
jmp 0x14015c522
Function at 0x140175130
Capabilities:
Set thread local storage value

Disassembly:
mov eax, 0x28
call fcn.1401f4630
sub rsp, rax
mov ecx, dword [rcx]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x28
ret
Function at 0x140191400
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x1401915c6
push rbx
push rsi
push rdi
push r12
push r13
mov eax, 0x20
call fcn.1401f4630
sub rsp, rax
mov r13, qword [rsp + 0x70]
mov r12, r9
mov qword [rsp + 0x60], r15
mov r10, r13
mov r15, qword [rsp + 0x78]
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
cmp r8, 0x10
jb 0x1401914b0
mov qword [rsp + 0x50], rbp
mov rbp, r8
shr rbp, 4
imul rax, rbp, 0xfffffffffffffff0
add rdi, rax
sub r10, rsi
mov r8, rbx
sub r8, rsi
mov rax, rsi
mov edx, 2
nop word [rax + rax]
mov rcx, qword [r10 + rax]
xor rcx, qword [rax]
mov qword [r8 + rax], rcx
lea rax, [rax + 8]
sub rdx, 1
jne 0x140191470
mov r8, r12
mov rdx, rbx
mov rcx, rbx
call r15
mov r10, rbx
add rsi, 0x10
add rbx, 0x10
sub rbp, 1
jne 0x140191454
mov rbp, qword [rsp + 0x50]
test rdi, rdi
je 0x1401915ad
mov qword [rsp + 0x58], r14
nop word [rax + rax]
mov r8, r10
lea rcx, [rsi + 1]
mov r9, rbx
mov r11d, 1
sub r8, rsi
sub r9, rsi
sub r11, rsi
xor edx, edx
mov r14d, 2
sub r14, rsi
cmp rdx, rdi
jae 0x140191560
movzx eax, byte [r8 + rcx - 1]
xor al, byte [rcx - 1]
mov byte [r9 + rcx - 1], al
mov rax, rcx
sub rax, rsi
cmp rax, rdi
jae 0x140191557
movzx eax, byte [rcx + r8]
xor al, byte [rcx]
mov byte [rcx + r9], al
lea rax, [r11 + rcx]
cmp rax, rdi
jae 0x140191551
movzx eax, byte [r8 + rcx + 1]
xor al, byte [rcx + 1]
mov byte [r9 + rcx + 1], al
lea rax, [r14 + rcx]
cmp rax, rdi
jae 0x14019154b
movzx eax, byte [r8 + rcx + 2]
add rdx, 4
xor al, byte [rcx + 2]
mov byte [r9 + rcx + 2], al
add rcx, 4
cmp rdx, 0x10
jb 0x1401914e4
jmp 0x140191581
add rdx, 3
jmp 0x14019155a
add rdx, 2
jmp 0x14019155a
inc rdx
cmp rdx, 0x10
jae 0x140191581
sub r10, rbx
lea rcx, [rdx + rbx]
mov r8d, reloc.WS2_32.dll_recv
sub r8, rdx
movzx eax, byte [r10 + rcx]
mov byte [rcx], al
lea rcx, [rcx + 1]
sub r8, 1
jne 0x140191570
mov r8, r12
mov rdx, rbx
mov rcx, rbx
call r15
mov r10, rbx
cmp rdi, 0x10
jbe 0x1401915a8
add rsi, 0x10
add rbx, 0x10
sub rdi, 0x10
jne 0x1401914c0
mov r14, qword [rsp + 0x58]
movups xmm0, xmmword [r10]
mov r15, qword [rsp + 0x60]
movups xmmword [r13], xmm0
add rsp, 0x20
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x1401b6f49
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x1401b713a
push rbx
mov eax, 0xd0
call fcn.1401f4630
sub rsp, rax
mov rax, qword [0x1402defb8]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xe8], rbp
mov rbx, rdx
mov qword [rsp + 0xf0], rsi
lea rbp, [r8 - 1]
mov qword [rsp + 0xf8], rdi
mov qword [rsp + 0xc8], r14
lea r14, [rcx + 0xc]
shr rbp, 3
mov qword [rsp + 0xc0], r15
inc rbp
lea r15, [rcx + 0x14]
nop word [rax + rax]
movzx eax, byte [rbx + 1]
mov rcx, r14
movzx edi, byte [rbx]
movzx esi, byte [rbx + 4]
lea rbx, [rbx + 8]
shl eax, 8
or edi, eax
movzx eax, byte [rbx - 6]
shl eax, 0x10
or edi, eax
movzx eax, byte [rbx - 5]
shl eax, 0x18
or edi, eax
movzx eax, byte [rbx - 3]
shl eax, 8
or esi, eax
mov dword [rsp + 0x20], edi
movzx eax, byte [rbx - 2]
shl eax, 0x10
or esi, eax
mov dword [rsp + 0x28], edi
movzx eax, byte [rbx - 1]
and byte [r14], 0xdf
and byte [r15], 0xbf
or byte [r14], 0x40
or byte [r15], 0x20
shl eax, 0x18
or esi, eax
mov dword [rsp + 0x24], esi
mov dword [rsp + 0x2c], esi
call fcn.140159b10
lea rdx, [rsp + 0x30]
mov rcx, r14
call fcn.1401594b0
mov r8d, 1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x28]
call fcn.1401568a0
mov rcx, r15
call fcn.140159b10
lea rdx, [rsp + 0x30]
mov rcx, r15
call fcn.1401594b0
mov r8d, 1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call fcn.1401568a0
mov r8d, dword [rsp + 0x20]
mov edx, dword [rsp + 0x24]
xor r8d, edi
xor edi, dword [rsp + 0x28]
xor edx, esi
xor esi, dword [rsp + 0x2c]
mov eax, edi
shr eax, 8
mov byte [r14 + 1], al
mov eax, edi
shr eax, 0x10
mov byte [r14 + 2], al
mov eax, edx
shr eax, 8
mov byte [r14 + 5], al
mov eax, edx
shr eax, 0x10
mov byte [r14 + 6], al
mov eax, r8d
shr eax, 8
mov byte [r15 + 1], al
mov eax, r8d
shr eax, 0x10
mov byte [r14], dil
shr edi, 0x18
mov byte [r14 + 4], dl
shr edx, 0x18
mov byte [r15], r8b
shr r8d, 0x18
mov byte [r15 + 3], r8b
mov byte [r14 + 3], dil
mov byte [r14 + 7], dl
mov byte [r15 + 2], al
mov byte [r15 + 4], sil
mov eax, esi
shr eax, 8
mov byte [r15 + 5], al
mov eax, esi
shr eax, 0x10
shr esi, 0x18
mov byte [r15 + 6], al
mov byte [r15 + 7], sil
sub rbp, 1
jne 0x1401b6fb0
mov r15, qword [rsp + 0xc0]
mov r14, qword [rsp + 0xc8]
mov rdi, qword [rsp + 0xf8]
mov rsi, qword [rsp + 0xf0]
mov rbp, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1401f4710
add rsp, 0xd0
pop rbx
ret
Function at 0x1401e1190
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x38
call fcn.1401f4630
sub rsp, rax
mov r10, rdx
mov dword [rsp + 0x40], reloc.WS2_32.dll_recv
add rdx, 0xf
lea rax, [r8 + 0xf]
mov r11, rcx
cmp r10, rax
ja 0x1401e11e3
xor ecx, ecx
cmp rdx, r8
jb 0x1401e11e3
sub r8, r10
lea rax, [rcx + r10]
mov edx, reloc.WS2_32.dll_recv
sub rdx, rcx
nop
movzx ecx, byte [r8 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x1401e11d0
jmp 0x1401e11f6
movdqu xmm1, xmmword [r10]
movdqu xmm0, xmmword [r8]
pxor xmm1, xmm0
movdqu xmmword [r10], xmm1
mov rcx, qword [r11 + 8]
lea r8, [rsp + 0x40]
mov r9, r10
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
mov rdx, r10
call fcn.14010d260
test eax, eax
je 0x1401e1227
cmp dword [rsp + 0x40], 0x10
jne 0x1401e1227
mov eax, 1
add rsp, 0x38
ret
xor eax, eax
add rsp, 0x38
ret

Function at 0x1401e13d0
Capabilities:
Encode data using xor

Disassembly:
mov r10, rcx
test rdx, rdx
je 0x1401e1458
test r8, r8
je 0x1401e1458
mov rax, qword [rcx + 0x18]
cmp r8, rax
mov r9, rax
cmovb r9, r8
test r9, r9
je 0x1401e1416
add rcx, 0x20
mov r11, rdx
sub r11, r10
nop
movzx eax, byte [r11 + rcx - 0x20]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub r9, 1
jne 0x1401e1400
mov rax, qword [r10 + 0x18]
cmp r8, rax
jbe 0x1401e1458
sub r8, rax
cmp r8, 0x10
jbe 0x1401e142c
mov r8d, reloc.WS2_32.dll_recv
jmp 0x1401e1431
test r8, r8
je 0x1401e1458
xor ecx, ecx
nop dword [rax]
nop word [rax + rax]
mov rax, qword [r10 + 0x18]
add rax, rcx
movzx eax, byte [rax + rdx]
xor byte [r10 + rcx + 0x40], al
inc rcx
cmp rcx, r8
jb 0x1401e1440
ret

Function at 0x1401f4d58
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
mov r8, rcx
mov eax, 0x5a4d
cmp word [0x140000000], ax
jne 0x1401f4de3
movsxd rcx, dword [0x14000003c]
lea rdx, [0x140000000]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x1401f4de3
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1401f4de3
sub r8, rdx
movzx eax, word [rcx + 0x14]
lea rdx, [rcx + 0x18]
add rdx, rax
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
mov qword [rsp], rdx
cmp rdx, r9
je 0x1401f4ddf
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x1401f4dd9
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jae 0x1401f4dd9
test rdx, rdx
je 0x1401f4ddf
cmp dword [rdx + 0x24], 0
jge 0x1401f4dd5
xor al, al
jmp 0x1401f4de9
mov al, 1
jmp 0x1401f4de9
add rdx, 0x28
jmp 0x1401f4dab
xor al, al
jmp 0x1401f4de9
xor al, al
jmp 0x1401f4de9
add rsp, 0x18
ret
Function at 0x140200ebc
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x140200d4f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140200d4f
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140200d4f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140200d4f
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140200d4f
cmp dword [rcx + 0x84], 0xe
jbe 0x140200d4f
cmp dword [rcx + 0xf8], 0
je 0x140200d4f
mov ecx, ebx
call fcn.140200df0
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.140200be0
cmp dword [rbp + 0x20], 0
je 0x140200d9c
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140200da4
int3
xor r8d, r8d
xor edx, edx
jmp 0x140200ce8

Function at 0x1402092d8
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov rdx, rcx
test rcx, rcx
jne 0x1402092b5
call fcn.14020167c
mov dword [rax], reloc.WS2_32.dll_shutdown
call fcn.140207f1c
or eax, 0xffffffff
jmp 0x1402092d2
sub dword [rcx + 0x10], 1
jns 0x1402092c4
add rsp, 0x28
jmp fcn.14020e080
mov rax, qword [rcx]
movzx ecx, byte [rax]
inc rax
mov qword [rdx], rax
mov eax, ecx
add rsp, 0x28
ret
jmp 0x140209294

Function at 0x14020bb58
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14020bb78
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14020160c
or eax, 0xffffffff
jmp 0x14020bb7a
xor eax, eax
add rsp, 0x28
ret