joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001c720
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Terminate process

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
cmp dword [rcx + 0x220], 0x100
mov qword [rsp + 0x28], 0
mov rbx, rcx
mov rdi, rdx
je 0x14001c808
movzx ebp, byte [rcx + 0x270]
shr bpl, 7
cmp byte [rdx], 0x2d
je 0x14001c7d0
movzx ebp, bpl
lea rcx, [rsp + 0x28]
mov rdx, rdi
mov r8d, ebp
call dbg.pixie_fopen_shareable
test eax, eax
jne 0x14001c780
mov rsi, qword [rsp + 0x28]
test rsi, rsi
jne 0x14001c7f2
nop dword [rax]
test ebp, ebp
lea rax, str.appending
mov ecx, 2
lea rbx, str.writing
cmovne rbx, rax
xor esi, esi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, str.out:_could_not_open_file_for__s_n
mov rcx, rax
mov r8, rbx
call sym.fprintf_1
mov rcx, rdi
call sym.perror
mov rax, qword [0x140073700]
mov dword [rax], 1
jmp 0x14001c7f9
cmp byte [rdx + 1], 0
jne 0x14001c757
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov qword [rsp + 0x28], rax
mov rsi, rax
test rax, rax
je 0x14001c757
or byte [rbx + 0x230], 1
mov rax, rsi
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rsi, qword [rcx + 0x300]
test rsi, rsi
jle 0x14001c830
mov rax, qword [rbx + 0x218]
mov rdx, rsi
mov rcx, rbx
call qword [rax + 0x10]
mov rax, rsi
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
xor r8d, r8d
mov edx, 1
mov ecx, 2
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
call qword [sym.imp.WS2_32.dll_socket]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x14001c8cc
mov ecx, dword [rbx + 0x2d8]
call qword [sym.imp.WS2_32.dll_htonl]
movzx ecx, word [rbx + 0x2f0]
mov dword [rsp + 0x34], eax
call qword [sym.imp.WS2_32.dll_htons]
lea rdx, [rsp + 0x30]
mov r8d, 0x10
mov rcx, rsi
mov word [rsp + 0x32], ax
mov eax, 2
mov word [rsp + 0x30], ax
call qword [sym.imp.WS2_32.dll_connect]
test eax, eax
jne 0x14001c8b0
mov qword [rbx + 0x300], rsi
jmp 0x14001c814
xor ecx, ecx
lea rdx, str.redis:_connect___failed_n
call dbg.LOG
lea rcx, [0x140060362]
call sym.perror
jmp 0x14001c8a2
xor ecx, ecx
lea rdx, str.redis:_socket___failed_to_create_socket_n
call dbg.LOG
mov ecx, 1
call sym.exit
nop
nop word cs:[rax + rax]
Function at 0x14001e0f0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov edx, 1
lea rcx, str.foo.bar
call dbg.indexed_filename
lea rdx, str.foo.01.bar
mov rcx, rax
mov rbx, rax
call sym.strcmp
test eax, eax
jne 0x14001e198
mov rcx, rbx
call sym.free
mov edx, 2
lea rcx, str.foo.b_ar
call dbg.indexed_filename
lea rdx, str.foo.b_ar.02
mov rcx, rax
mov rbx, rax
call sym.strcmp
test eax, eax
jne 0x14001e198
mov rcx, rbx
call sym.free
mov edx, 3
lea rcx, str..foobar
call dbg.indexed_filename
lea rdx, str..03.foobar
mov rcx, rax
mov rsi, rax
call sym.strcmp
test eax, eax
jne 0x14001e198
mov rcx, rsi
mov dword [rsp + 0x2c], eax
call sym.free
mov eax, dword [rsp + 0x2c]
add rsp, 0x38
pop rbx
pop rsi
ret
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, 0x18
mov edx, 1
lea rcx, str.output:_failed_selftest_n
mov r9, rax
call sym.fwrite
mov eax, 1
add rsp, 0x38
pop rbx
pop rsi
ret

Function at 0x14001e480
Capabilities:
Create thread

Disassembly:
xor edx, edx
jmp qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthread]

Function at 0x14001e4e0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push rbx
sub rsp, 0x40
mov ecx, dword [global_initialized]
mov rbx, rdx
test ecx, ecx
je 0x14001e578
mov eax, dword [global_usePerformanceCounter]
test eax, eax
je 0x14001e560
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x28]
sub rax, qword [0x14017eba8]
pxor xmm0, xmm0
cvtsi2sd xmm0, rax
divsd xmm0, qword [0x14017eba0]
movabs rax, 0x431bde82d7b634db
cvttsd2si rcx, xmm0
imul rcx
mov rax, rcx
sar rax, 0x3f
sar rdx, 0x12
sub rdx, rax
xor eax, eax
mov dword [rbx], edx
imul rdx, rdx, 0xf4240
sub rcx, rdx
mov dword [rbx + 4], ecx
add rsp, 0x40
pop rbx
ret
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rax, qword [rsp + 0x30]
jmp 0x14001e510
mov dword [global_initialized], 1
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov dword [global_usePerformanceCounter], eax
test eax, eax
jne 0x14001e5e0
xor edx, edx
mov dword [rsp + 0x30], 0x107b2
lea rcx, [rsp + 0x30]
mov word [rsp + 0x3e], dx
lea rdx, [rsp + 0x28]
mov qword [rsp + 0x36], 1
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov rax, qword [rsp + 0x28]
movsd xmm0, qword [0x1400608d8]
mov qword [global_offset], rax
movsd qword [global_frequencyToMicroseconds], xmm0
jmp 0x14001e4f6
lea rcx, [0x14017eba8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
pxor xmm0, xmm0
cvtsi2sd xmm0, qword [rsp + 0x20]
divsd xmm0, qword [0x1400608e0]
jmp 0x14001e5d3
Function at 0x14001e7e0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movaps xmmword [rsp + 0x30], xmm6
movaps xmmword [rsp + 0x40], xmm7
mov rdi, qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea r13, [rsp + 0x20]
lea r12, [rsp + 0x28]
mov rbx, rcx
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
mov rcx, r13
call rdi
mov rbp, qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rcx, r12
call rbp
mov rax, qword [rsp + 0x20]
test rax, rax
js 0x14001e9b0
pxor xmm0, xmm0
cvtsi2sd xmm0, rax
mov rax, qword [rsp + 0x28]
test rax, rax
js 0x14001e9d7
pxor xmm1, xmm1
cvtsi2sd xmm1, rax
divsd xmm0, xmm1
movsd xmm7, qword [0x1400608e0]
movsd xmm6, qword [0x1400608e8]
mulsd xmm0, xmm7
comisd xmm0, xmm6
jae 0x14001e970
cvttsd2si rsi, xmm0
cmp rbx, 0x3e8
ja 0x14001e98b
movabs r14, 0x8000000000000000
jmp 0x14001e8ad
cvttsd2si rax, xmm0
sub rax, rsi
cmp rax, rbx
jae 0x14001e911
mov qword [rsp + 0x20], 0
mov rcx, r13
mov qword [rsp + 0x28], 0
call rdi
mov rcx, r12
call rbp
mov rax, qword [rsp + 0x20]
test rax, rax
js 0x14001e950
pxor xmm0, xmm0
cvtsi2sd xmm0, rax
mov rax, qword [rsp + 0x28]
test rax, rax
js 0x14001e930
pxor xmm1, xmm1
cvtsi2sd xmm1, rax
divsd xmm0, xmm1
mulsd xmm0, xmm7
comisd xmm0, xmm6
jb 0x14001e8a0
subsd xmm0, xmm6
cvttsd2si rax, xmm0
xor rax, r14
sub rax, rsi
cmp rax, rbx
jb 0x14001e8ad
movaps xmm6, xmmword [rsp + 0x30]
movaps xmm7, xmmword [rsp + 0x40]
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rdx, rax
and eax, 1
pxor xmm1, xmm1
shr rdx, 1
or rdx, rax
cvtsi2sd xmm1, rdx
addsd xmm1, xmm1
jmp 0x14001e8ef
mov rdx, rax
and eax, 1
pxor xmm0, xmm0
shr rdx, 1
or rdx, rax
cvtsi2sd xmm0, rdx
addsd xmm0, xmm0
jmp 0x14001e8dc
subsd xmm0, xmm6
cvttsd2si rsi, xmm0
btc rsi, 0x3f
cmp rbx, 0x3e8
jbe 0x14001e891
movabs rax, 0x20c49ba5e353f7cf
mov rdx, rbx
shr rdx, 3
mul rdx
shr rdx, 4
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14001e891
mov rdx, rax
and eax, 1
pxor xmm0, xmm0
shr rdx, 1
or rdx, rax
mov rax, qword [rsp + 0x28]
cvtsi2sd xmm0, rdx
addsd xmm0, xmm0
test rax, rax
jns 0x14001e854
mov rdx, rax
and eax, 1
pxor xmm1, xmm1
shr rdx, 1
or rdx, rax
cvtsi2sd xmm1, rdx
addsd xmm1, xmm1
jmp 0x14001e85d
Function at 0x140028dc0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xffffffff
lea r8, [0x140063fa0]
mov r11, rdx
mov r10, rcx
lea r9, [rcx + 8]
mov rdx, rcx
nop dword [rax]
mov ecx, eax
xor al, byte [rdx]
add rdx, 1
movzx eax, al
shr ecx, 8
xor ecx, dword [r8 + rax*4]
mov eax, ecx
cmp rdx, r9
jne 0x140028de0
movzx eax, cl
mov edx, ecx
shr edx, 8
xor edx, dword [r8 + rax*4]
mov eax, edx
movzx edx, dl
shr eax, 8
xor eax, dword [r8 + rdx*4]
mov edx, eax
movzx eax, al
shr edx, 8
xor edx, dword [r8 + rax*4]
mov eax, edx
movzx edx, dl
shr eax, 8
xor eax, dword [r8 + rdx*4]
cmp r11, 0xc
jbe 0x140028e60
mov ecx, 0xc
mov edx, 0xc
nop dword [rax]
mov r9d, eax
xor al, byte [r10 + rdx]
lea edx, [rcx + 1]
movzx eax, al
shr r9d, 8
mov rcx, rdx
xor r9d, dword [r8 + rax*4]
mov eax, r9d
cmp rdx, r11
jb 0x140028e40
not eax
bswap eax
ret
Function at 0x14002c870
Capabilities:
Terminate process

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x140
xor edx, edx
lea rcx, str.snmp_mib
xor edi, edi
lea rsi, [0x140064fc0]
call dbg.smack_create
lea r12, [rsp + 0x40]
mov qword [0x14017ec70], rax
mov eax, 0x34
nop dword [rax]
mov r9, qword [rsi]
mov rbp, rsi
xor r13d, r13d
lea rbx, [rsp + 0x38]
xor r8d, r8d
test al, al
je 0x14002c97b
nop dword [rax]
cmp al, 0x2e
jne 0x14002c8ea
nop word cs:[rax + rax]
nop
add r9, 1
cmp byte [r9], 0x2e
je 0x14002c8e0
mov rcx, r9
xor r8d, r8d
mov rdx, rbx
mov r14, r9
call sym.strtoul
mov r9, qword [rsp + 0x38]
cmp r9, r14
je 0x14002c978
cmp eax, 0xfffffff
ja 0x14002c9b0
cmp eax, 0x1fffff
ja 0x14002c9c0
cmp eax, 0x3fff
ja 0x14002c9d0
mov edx, 1
cmp eax, 0x7f
jbe 0x14002c957
lea ecx, [rdx*8]
sub ecx, edx
cmp r13, 0xff
ja 0x14002c952
mov edx, eax
shr edx, cl
or edx, 0xffffff80
mov byte [rsp + r13 + 0x40], dl
add r13, 1
sub ecx, 7
jne 0x14002c939
cmp r13, 0xff
ja 0x14002c96c
and eax, 0x7f
mov byte [rsp + r13 + 0x40], al
add r13, 1
movzx eax, byte [r9]
test al, al
jne 0x14002c8d0
mov r8d, r13d
mov dword [rsp + 0x20], 5
mov rcx, qword [0x14017ec70]
mov r9, rdi
mov rdx, r12
add rdi, 1
add rsi, 0x10
call dbg.smack_add_pattern
cmp qword [rbp + 0x18], 0
je 0x14002c9da
mov rax, qword [rsi]
movzx eax, byte [rax]
jmp 0x14002c8b0
mov edx, 4
jmp 0x14002c930
mov edx, 3
jmp 0x14002c930
mov edx, 2
jmp 0x14002c930
mov rcx, qword [0x14017ec70]
add rsp, 0x140
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp dbg.smack_compile

Function at 0x14002ca00
Capabilities:
Write file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x120
lea rsi, [rsp + 0x40]
lea rdi, [rsp + 0x3c]
mov dword [rsp + 0x3c], 0
mov rcx, rsi
call sym.banout_init
mov r9, rdi
mov r8, rsi
mov edx, 0x3b
lea rcx, [0x140064e20]
call sym.snmp_parse.constprop.0
cmp dword [rsp + 0x3c], 0x26
je 0x14002ca58
mov eax, 1
add rsp, 0x120
pop rbx
pop rsi
pop rdi
ret
mov edx, 7
mov rcx, rsi
call sym.banout_string
mov edx, 7
mov rcx, rsi
mov rbx, rax
call sym.banout_string_length
lea rdx, str.sysObjectID:okidata.1.1.1.297.93.1.27.2.2.1
mov rcx, rbx
mov r8d, eax
call sym.memcmp
test eax, eax
jne 0x14002ca42
mov rcx, rsi
mov rbx, 0xffffffffffffffff
call sym.banout_release
mov dword [rsp + 0x3c], 0
mov dword [rsp + 0x40], 0
nop word [rax + rax]
mov dword [rsp + 0x20], 7
mov r9, rsi
mov rdx, rdi
mov rcx, qword [0x14017ec70]
lea r8, [0x140064e5b]
call dbg.smack_search_next
cmp rax, 0xffffffffffffffff
cmovne rbx, rax
cmp dword [rsp + 0x40], 6
jbe 0x14002cab0
cmp rbx, 0xffffffffffffffff
je 0x14002cb0a
shl rbx, 4
lea rax, [0x140064fc0]
lea rdx, [0x140064e15]
mov rcx, qword [rax + rbx + 8]
call sym.strcmp
test eax, eax
je 0x14002ca47
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, 0x18
mov edx, 1
lea rcx, str.snmp:_oid_parser_failed_n
mov r9, rax
call sym.fwrite
jmp 0x14002ca42
Function at 0x14002ec80
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
cmp byte [rcx], 0x16
mov rbx, rcx
mov esi, edx
mov edi, r8d
jne 0x14002eca4
cmp word [rcx + 1], 3
je 0x14002ece0
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, 0xf
mov edx, 1
lea rcx, str.internal_error_n
mov r9, rax
call sym.fwrite
mov rax, rbx
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
movzx edx, word [rcx + 3]
rol dx, 8
movzx edx, dx
lea r12d, [rdx + 5]
add edx, 7
movsxd r8, r12d
mov qword [rsp + 0x20], r8
call dbg.REALLOC
mov ecx, esi
mov r8, qword [rsp + 0x20]
mov rbx, rax
movzx r13d, word [rax + 3]
movzx eax, byte [rax + 6]
shr ecx, 8
movzx edx, byte [rbx + 7]
movzx r14d, byte [rbx + 0x2b]
mov dword [rsp + 0x2c], ecx
shl eax, 0x10
rol r13w, 8
shl edx, 8
lea r15, [rbx + r14 + 0x2c]
lea rbp, [rbx + r14 + 0x2d]
movzx r13d, r13w
or eax, edx
movzx edx, byte [rbx + 8]
or eax, edx
movzx edx, byte [rbp]
mov dword [rsp + 0x28], eax
movzx eax, byte [r15]
shl eax, 8
or eax, edx
test edi, edi
movsxd r12, eax
lea rax, [r14 + 0x2e]
jne 0x14002edc0
lea rdi, [rbx + rax]
lea rcx, [rbx + r14 + 0x30]
sub r8, rax
mov rdx, rdi
call sym.memmove
movzx eax, byte [rsp + 0x2c]
mov byte [rdi], al
mov byte [rbx + r14 + 0x2f], sil
lea rax, [r12 + 2]
mov rsi, r15
add r13d, 2
mov byte [rsi], ah
rol r13w, 8
mov byte [rbp], al
mov eax, dword [rsp + 0x28]
mov word [rbx + 3], r13w
add eax, 2
movsxd rdx, eax
rol ax, 8
shr rdx, 0x10
mov word [rbx + 7], ax
mov byte [rbx + 6], dl
jmp 0x14002ecc9
lea rdi, [r12 + rax]
lea r14, [rbx + rdi]
lea rcx, [rbx + rdi + 2]
sub r8, rdi
mov rdx, r14
call sym.memmove
movzx eax, byte [rsp + 0x2c]
mov byte [r14], al
mov byte [rbx + rdi + 1], sil
jmp 0x14002ed7f

Function at 0x140030950
Capabilities:
Write file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rax, r8
mov rbx, rcx
mov esi, edx
shr rax, 0x10
jne 0x1400309d0
movzx eax, byte [rcx + 0x1f]
cmp al, 8
ja 0x140030a08
mov edi, r8d
test al, al
je 0x14003098f
movzx ecx, word [rcx + 4]
mov rdx, rcx
cmp rcx, r8
jb 0x140030a40
sub edx, r8d
mov word [rbx + 4], dx
lea rdx, [rbx + 4]
lea rcx, [rbx + 6]
lea r8, [rax + rax]
call sym.memmove
mov word [rbx + 4], di
movzx r8d, byte [rbx + 0x1f]
lea rdx, [rbx + 0x16]
lea rcx, [rbx + 0x17]
call sym.memmove
add byte [rbx + 0x1f], 1
mov byte [rbx + 0x16], sil
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, 0x1b
mov edx, 1
lea rcx, str.ASN.1_length_field_too_big_n
mov r9, rax
call sym.fwrite
mov dword [rbx], 0xffffffff
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, 0x19
mov edx, 1
lea rcx, str.ASN.1_recursion_too_deep_n
mov r9, rax
call sym.fwrite
mov dword [rbx], 0xffffffff
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
movzx r9d, byte [rbx + 0x16]
mov r8d, esi
mov ecx, 1
lea rdx, str.ASN.1_inner_object_bigger_than_container___u___u__n
call dbg.LOG
mov dword [rbx], 0xffffffff
jmp 0x1400309be
Function at 0x140030a70
Capabilities:
Terminate process

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x140
xor edx, edx
lea rcx, str.ssl_oids
xor edi, edi
lea rsi, [0x14006d9e0]
call dbg.smack_create
lea r12, [rsp + 0x40]
mov qword [0x14017ec80], rax
mov eax, 0x34
nop dword [rax]
mov r9, qword [rsi]
mov rbp, rsi
xor r13d, r13d
lea rbx, [rsp + 0x38]
xor r8d, r8d
test al, al
je 0x140030b7b
nop dword [rax]
cmp al, 0x2e
jne 0x140030aea
nop word cs:[rax + rax]
nop
add r9, 1
cmp byte [r9], 0x2e
je 0x140030ae0
mov rcx, r9
xor r8d, r8d
mov rdx, rbx
mov r14, r9
call sym.strtoul
mov r9, qword [rsp + 0x38]
cmp r9, r14
je 0x140030b78
cmp eax, 0xfffffff
ja 0x140030bb0
cmp eax, 0x1fffff
ja 0x140030bc0
cmp eax, 0x3fff
ja 0x140030bd0
mov edx, 1
cmp eax, 0x7f
jbe 0x140030b57
lea ecx, [rdx*8]
sub ecx, edx
cmp r13, 0xff
ja 0x140030b52
mov edx, eax
shr edx, cl
or edx, 0xffffff80
mov byte [rsp + r13 + 0x40], dl
add r13, 1
sub ecx, 7
jne 0x140030b39
cmp r13, 0xff
ja 0x140030b6c
and eax, 0x7f
mov byte [rsp + r13 + 0x40], al
add r13, 1
movzx eax, byte [r9]
test al, al
jne 0x140030ad0
mov r8d, r13d
mov dword [rsp + 0x20], 5
mov rcx, qword [0x14017ec80]
mov r9, rdi
mov rdx, r12
add rdi, 1
add rsi, 0x18
call dbg.smack_add_pattern
cmp qword [rbp + 0x20], 0
je 0x140030bda
mov rax, qword [rsi]
movzx eax, byte [rax]
jmp 0x140030ab0
mov edx, 4
jmp 0x140030b30
mov edx, 3
jmp 0x140030b30
mov edx, 2
jmp 0x140030b30
mov rcx, qword [0x14017ec80]
add rsp, 0x140
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp dbg.smack_compile

Function at 0x140031af0
Capabilities:
Write file on windows

Disassembly:
pxor xmm0, xmm0
mov r8, rdx
mov edx, 0xffffffff
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm0
movups xmmword [rcx + 0x20], xmm0
movups xmmword [rcx + 0x30], xmm0
movups xmmword [rcx + 0x40], xmm0
jmp dbg.ASN1_push

Function at 0x140031b20
Capabilities:
Write file on windows

Disassembly:
push rdi
xor eax, eax
lea rdi, [rcx + 8]
mov qword [rcx], 0
mov r9, rcx
mov r8, rdx
and rdi, 0xfffffffffffffff8
mov qword [rcx + 0x58], 0
mov edx, 0xffffffff
sub rcx, rdi
add ecx, 0x60
shr ecx, 3
rep stosq qword [rdi], rax
mov rcx, r9
pop rdi
jmp dbg.ASN1_push

Function at 0x140031b60
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
cmp r9, rdx
mov r10, rcx
mov rax, rdx
cmova r9, rdx
test r9, r9
je 0x140031bc6
xor ecx, ecx
mov ebx, 0x66747032
nop dword [rax + rax]
movzx r11d, byte [r10 + rcx]
xor r11d, ebx
mov byte [r8 + rcx], r11b
movzx edx, byte [r10 + rcx + 1]
mov r11d, ebx
shr r11d, 0x10
xor dl, bh
mov byte [r8 + rcx + 1], dl
xor r11b, byte [r10 + rcx + 2]
mov byte [r8 + rcx + 2], r11b
mov r11d, ebx
rol ebx, 1
shr r11d, 0x18
xor r11b, byte [r10 + rcx + 3]
mov byte [r8 + rcx + 3], r11b
add rcx, 4
cmp rcx, r9
jb 0x140031b80
pop rbx
pop rsi
ret
Function at 0x140031bd0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x998
mov r9d, 0x800
mov r12, qword [rsp + 0xa00]
mov rax, qword [r12 + 0x50]
movdqu xmm0, xmmword [r12 + 0x40]
mov ebp, dword [r12 + 0x78]
mov qword [rsp + 0xa0], rax
mov eax, dword [r12 + 0x80]
mov rsi, rdx
mov rbx, rcx
mov edx, dword [r12 + 0x84]
lea rdi, [rsp + 0x190]
mov qword [rsp + 0xb0], 0
lea rcx, [r8 + rax]
mov r8, rdi
mov qword [rsp + 0xb8], 0xe
mov byte [rsp + 0x190], 0
mov r13, rdx
movaps xmmword [rsp + 0x90], xmm0
call dbg.zadecrypt
mov r14d, eax
cmp r13d, eax
je 0x140031c80
xor eax, eax
add rsp, 0x998
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov r9d, dword [rsp + 0x190]
mov dword [rsp + 0x190], 0
test eax, eax
je 0x140031c67
cmp eax, 1
je 0x140031c67
lea eax, [rax - 2]
lea rdx, [rsp + 0x191]
mov r13, rdi
lea r10, [rsp + rax + 0x192]
lea r8, [0x14006de20]
mov eax, 0x2dfd1072
nop
movzx ecx, byte [rdx]
add rdx, 1
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [r8 + rcx*4]
cmp rdx, r10
jne 0x140031cc0
not eax
cmp eax, r9d
jne 0x140031c67
cmp r14d, 0xf
jbe 0x140031c67
cmp dword [rsp + 0x194], 0x7265744c
jne 0x140031c67
lea r15, [rsp + 0xb0]
mov r9d, 0xb
mov edx, 0xe
lea r8, str.ZeroAccess:
mov rcx, r15
call dbg.banout_append
mov eax, dword [rsp + 0x19c]
cmp eax, 0x100
ja 0x140031c67
lea edx, [rax*8 + 0x10]
cmp r14d, edx
jb 0x140031c67
lea r14, [rdi + rax*8]
lea rdi, [rsp + 0x70]
test eax, eax
je 0x140031da8
nop word [rax + rax]
movzx eax, byte [r13 + 0x13]
mov edx, 0x14
mov rcx, rdi
add r13, 8
lea r8, str._u._u._u._u
mov dword [rsp + 0x30], eax
movzx eax, byte [r13 + 0xa]
mov dword [rsp + 0x28], eax
movzx eax, byte [r13 + 9]
mov dword [rsp + 0x20], eax
movzx r9d, byte [r13 + 8]
call sym.snprintf
mov rcx, rdi
call sym.strlen
mov r8, rdi
mov edx, 0xe
mov rcx, r15
mov r9, rax
call dbg.banout_append
cmp r14, r13
jne 0x140031d50
mov rcx, r15
mov edx, 0xe
call sym.banout_string_length
mov rcx, r15
mov edx, 0xe
mov edi, eax
call sym.banout_string
mov rdx, qword [rsp + 0xa0]
mov dword [rsp + 0x40], edi
mov rcx, rbx
mov qword [rsp + 0x38], rax
mov r9d, 0x11
lea r8, [rsp + 0x50]
movdqa xmm1, xmmword [rsp + 0x90]
mov qword [rsp + 0x60], rdx
mov rdx, rsi
movaps xmmword [rsp + 0x50], xmm1
mov eax, dword [r12 + 0x28]
mov dword [rsp + 0x28], 0xe
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x20], ebp
call dbg.output_report_banner
jmp 0x140031c67
Function at 0x140031e20
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0xb0
mov r9d, pe_nt_image_headers64
mov edx, 0x10
lea rcx, [0x14006de00]
lea rdi, [rsp + 0x30]
mov r8, rdi
call dbg.zadecrypt
mov esi, dword [rsp + 0x30]
lea rdx, [rsp + 0x31]
mov dword [rsp + 0x30], 0
lea r8, [rsp + 0x40]
mov eax, 0x2dfd1072
lea r9, [0x14006de20]
nop word cs:[rax + rax]
nop word cs:[rax + rax]
movzx ecx, byte [rdx]
add rdx, 1
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [r9 + rcx*4]
cmp r8, rdx
jne 0x140031e80
mov qword [rsp + 0x20], 0
not eax
lea r8, [rsp + 0x21]
mov dword [rsp + 0x28], 0
mov ebx, eax
mov eax, 0x2dfd1072
mov dword [rsp + 0x24], 0x6765744c
mov dword [rsp + 0x2c], 0xf0a577f
nop word cs:[rax + rax]
nop word cs:[rax + rax]
nop dword [rax]
movzx edx, byte [r8]
add r8, 1
xor edx, eax
shr eax, 8
movzx edx, dl
xor eax, dword [r9 + rdx*4]
cmp r8, rdi
jne 0x140031ee0
not eax
lea rcx, [rsp + 0x20]
mov r9d, 0x10
mov edx, 0x10
mov dword [rsp + 0x20], eax
call dbg.zadecrypt
movabs rax, 0xab8d9428ce6ebeda
xor rax, qword [rsp + 0x30]
movabs rdx, 0x3ca9d6ec99d1c0c9
xor rdx, qword [rsp + 0x38]
or rax, rdx
setne al
cmp esi, ebx
setne dl
or eax, edx
movzx eax, al
add rsp, 0xb0
pop rbx
pop rsi
pop rdi
ret

Function at 0x140031f60
Capabilities:
Write file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rdi, rcx
mov ecx, 0x2c0
mov dword [rsp + 0x3c], 0x2c0
mov rbp, rdx
call sym.malloc
mov rbx, rax
test rax, rax
je 0x14003207a
lea rsi, [rsp + 0x3c]
jmp 0x140031fb5
mov rcx, rbx
call sym.free
mov ecx, dword [rsp + 0x3c]
call sym.malloc
mov rbx, rax
test rax, rax
je 0x14003207a
mov rdx, rsi
mov rcx, rbx
call sym.GetAdaptersInfo
cmp eax, 0x6f
je 0x140031f98
mov r12, rbx
test eax, eax
je 0x140031fde
jmp 0x140032047
cmp eax, 0x47
je 0x140031feb
mov r12, qword [r12]
test r12, r12
je 0x140032032
mov eax, dword [r12 + 0x1a4]
cmp eax, 6
jne 0x140031fd0
lea rsi, [r12 + 0x1e8]
jmp 0x140032000
mov rsi, qword [rsi]
test rsi, rsi
je 0x140031fd5
lea rcx, [rsi + 8]
call dbg.massip_parse_ipv4
cmp eax, 0xffffffff
je 0x140031ff8
test eax, eax
je 0x140031fd5
lea r9, [r12 + 0xc]
lea r8, [0x14006e29f]
mov rdx, rbp
mov rcx, rdi
call sym.snprintf
mov r12, qword [r12]
test r12, r12
jne 0x140031fde
mov rcx, rbx
call sym.free
xor eax, eax
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov ecx, 2
mov dword [rsp + 0x2c], eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, dword [rsp + 0x2c]
lea rdx, [0x14006e278]
mov rcx, rax
call sym.fprintf_1
mov eax, 0xe
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, 0x37
mov edx, 1
lea rcx, [0x14006e240]
mov r9, rax
call sym.fwrite
jmp 0x14003206a
Function at 0x1400320b0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov dword [rsp + 0x3c], 0x2c0
call dbg.rawsock_win_name
mov ecx, 0x2c0
mov rbp, rax
call sym.malloc
mov rbx, rax
test rax, rax
je 0x1400321a8
lea rdi, [rsp + 0x3c]
jmp 0x140032105
mov rcx, rbx
call sym.free
mov ecx, dword [rsp + 0x3c]
call sym.malloc
mov rbx, rax
test rax, rax
je 0x1400321a8
mov rdx, rdi
mov rcx, rbx
call sym.GetAdaptersInfo
mov esi, eax
cmp eax, 0x6f
je 0x1400320e8
mov rdi, rbx
test eax, eax
jne 0x140032180
nop
lea rcx, [rdi + 0xc]
mov rdx, rbp
call dbg.rawsock_is_adapter_names_equal
test eax, eax
jne 0x140032158
mov rdi, qword [rdi]
test rdi, rdi
jne 0x140032120
xor eax, eax
mov rcx, rbx
mov dword [rsp + 0x2c], eax
call sym.free
mov eax, dword [rsp + 0x2c]
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
add rdi, 0x1b8
nop
lea rcx, [rdi + 8]
call dbg.massip_parse_ipv4
cmp eax, 0xffffffff
jne 0x14003213a
mov rdi, qword [rdi]
test rdi, rdi
jne 0x140032160
jmp 0x140032138
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, esi
lea rdx, [0x14006e2d8]
mov rcx, rax
call sym.fprintf_1
xor eax, eax
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, 0x24
mov edx, 1
lea rcx, str.error:malloc__:_for_GetAdaptersinfo_n
mov r9, rax
call sym.fwrite
xor eax, eax
jmp 0x14003219f