joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007c9f0
Capabilities:
Read pipe
Write file on windows
Write pipe

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x38]
sub rsp, 0x130
mov ebx, dword [rcx + 0x38]
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rbp - 0x68], ebx
xor ebx, ebx
movups xmm0, xmmword [rdi + 0x28]
mov dword [rbp - 0x6c], eax
lea rax, [rdi + 0x5c]
mov qword [rsp + 0x30], rbx
movdqu xmmword [rbp - 0x48], xmm0
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x30], xmm0
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x60], rax
lea rax, [rdi + 0x60]
lea r9, [rsp + 0x40]
mov qword [rbp - 0x58], rax
lea rax, [rdi + 0x68]
lea r8d, [rbx + 0x50]
mov qword [rbp - 0x50], rax
xor eax, eax
lea rdx, [rbp - 0x70]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
lea rax, [rbp + 0x40]
mov qword [rsp + 0x28], rax
mov rcx, rsi
mov dword [rbp - 0x70], 1
mov dword [rsp + 0x20], 0x50
mov qword [rbp - 0x38], rbx
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x48], ebx
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x78], rbx
mov dword [rbp + 0x40], ebx
call qword [sym.imp.KERNEL32.dll_TransactNamedPipe]
test eax, eax
je 0x14007cb47
cmp dword [rsp + 0x40], 2
jne 0x14007cb47
cmp dword [rsp + 0x44], ebx
je 0x14007cb47
cmp qword [rsp + 0x78], rbx
je 0x14007cb47
cmp qword [rbp - 0x80], rbx
je 0x14007cb47
cmp qword [rbp - 0x78], rbx
je 0x14007cb47
xorps xmm0, xmm0
xor eax, eax
lea r9, [rbp + 0x40]
lea r8d, [rbx + 0x50]
lea rdx, [rbp - 0x20]
mov rcx, rsi
movdqa xmmword [rbp - 0x10], xmm0
movdqa xmmword [rbp + 0x20], xmm0
mov qword [rbp - 0x1c], rbx
mov qword [rbp], rbx
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rbx
mov dword [rbp - 0x20], 3
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14007cb47
mov rcx, qword [rsp + 0x78]
mov al, 1
mov qword [rdi + 0x40], rcx
mov rcx, qword [rbp - 0x80]
mov qword [rdi + 0x48], rcx
mov rcx, qword [rbp - 0x78]
mov qword [rdi + 0x50], rcx
mov ecx, dword [rsp + 0x44]
mov dword [rdi + 0x58], ecx
jmp 0x14007cb49
xor al, al
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14007ddf8
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x1400d33c0]
xor rax, rsp
mov qword [rbp + 0x170], rax
lea rax, [rsp + 0x60]
mov rdi, rdx
mov edx, ecx
xor ebx, ebx
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov word [rsp + 0x60], bx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jns 0x14007de4f
xor al, al
jmp 0x14007deab
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
cmp word [rsp + 0x60], bx
je 0x14007de75
lea rcx, [rsp + 0x60]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], bx
jne 0x14007de69
mov rbx, rax
mov qword [rsp + 0x38], rbx
movaps xmm0, xmmword [rsp + 0x30]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
movdqa xmmword [rsp + 0x30], xmm0
call fcn.140004530
mov rcx, rdi
mov rdx, rax
call fcn.1400045d0
lea rcx, [rsp + 0x40]
call fcn.1400045a0
mov al, 1
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.140091a70
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret

Function at 0x14007ded0
Capabilities:
Get common file path

Disassembly:
mov rdx, rcx
mov ecx, 5
jmp fcn.14007ddf8

Function at 0x14007e0a4
Capabilities:
Get common file path

Disassembly:
mov rdx, rcx
mov ecx, ntohl
jmp fcn.14007ddf8

Function at 0x14007e0b4
Capabilities:
Get common file path

Disassembly:
mov rdx, rcx
mov ecx, 0x27
jmp fcn.14007ddf8

Function at 0x14007e0c4
Capabilities:
Get common file path

Disassembly:
mov rdx, rcx
mov ecx, reloc.WS2_32.dll_ntohl
jmp fcn.14007ddf8

Function at 0x14007f77c
Capabilities:
Check mutex on windows

Disassembly:
push rbx
sub rsp, 0x20
and qword [rcx + 8], 0
mov rbx, rcx
mov byte [rcx], 0
lea r8, str.A946A6A9_917E_4949_B9BC_6BADA8C7FD63
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rbx + 8], rax
test rax, rax
je 0x14007f7bc
mov edx, 0x1388
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
sete al
mov byte [rbx], al
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x1400804e0
Capabilities:
Hash data using sha256

Disassembly:
push rbx
sub rsp, 0x20
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x70]
call fcn.140091cf0
mov dword [rbx], 0x6a09e667
mov dword [rbx + 4], 0xbb67ae85
mov dword [rbx + 8], 0x3c6ef372
mov dword [rbx + 0xc], 0xa54ff53a
mov dword [rbx + 0x10], 0x510e527f
mov dword [rbx + 0x14], 0x9b05688c
mov dword [rbx + 0x18], 0x1f83d9ab
mov dword [rbx + 0x1c], 0x5be0cd19
mov dword [rbx + 0x6c], 0x20
mov eax, 1
add rsp, 0x20
pop rbx
ret
Function at 0x14008cc88
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 0x28
lea r11, [0x1400d8da0]
xor r8d, r8d
mov rdx, r11
mov r9d, r8d
mov r10d, 8
mov ecx, r9d
mov eax, r9d
and ecx, 1
shr eax, 1
dec ecx
not ecx
and ecx, 0xedb88320
mov r9d, ecx
xor r9d, eax
dec r10
jne 0x14008cca2
inc r8d
mov dword [rdx], r9d
add rdx, 4
cmp r8d, 0x100
jb 0x14008cc99
mov r10d, 0x800
cmp r8d, r10d
jae 0x14008cd0a
lea r9, [r11 + r8*4]
lea eax, [r8 - 0x100]
inc r8d
mov edx, dword [r11 + rax*4]
movzx ecx, dl
shr edx, 8
mov eax, dword [r11 + rcx*4]
xor eax, edx
mov dword [r9], eax
lea r9, [r9 + 4]
cmp r8d, r10d
jb 0x14008cce4
lea rax, [0x14008d7c0]
mov qword [0x1400d5db0], rax
call fcn.14008d6d8
mov rcx, qword [0x1400d5db0]
lea rdx, [0x14008d898]
test eax, eax
cmove rcx, rdx
mov qword [0x1400d5db0], rcx
add rsp, 0x28
ret

Function at 0x14008db88
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], r9
push rdi
push r13
push r14
push r15
mov r10d, dword [r9]
xor r13d, r13d
mov edi, r8d
and r10d, 7
mov rbp, rcx
mov r11d, r13d
cmp rdx, 5
jae 0x14008dbc2
xor eax, eax
jmp 0x14008dd29
lea rsi, [rdx - 4]
add edi, 5
or rbx, 0xffffffffffffffff
add rsi, rcx
lea r14, [0x140000000]
lea r8, [r11 + rbp]
jmp 0x14008dbe9
mov al, byte [r8]
and al, 0xfe
cmp al, 0xe8
je 0x14008dbee
inc r8
cmp r8, rsi
jb 0x14008dbdd
mov r11, r8
sub r11, rbp
mov rax, r11
cmp r8, rsi
jae 0x14008dd09
sub rax, rbx
cmp rax, 3
jbe 0x14008dc54
mov r10d, r13d
mov al, byte [r8 + 4]
mov rbx, r11
dec al
cmp al, 0xfd
jbe 0x14008dc85
movzx eax, byte [r8 + 3]
movzx r9d, byte [r8 + 4]
mov r15d, r10d
shl r9d, 8
or r9d, eax
movzx eax, byte [r8 + 2]
shl r9d, 8
or r9d, eax
movzx eax, byte [r8 + 1]
shl r9d, 8
or r9d, eax
cmp dword [rsp + 0x48], r13d
je 0x14008dc98
lea edx, [r11 + r9]
add edx, edi
jmp 0x14008dca0
lea ecx, [rax - 1]
shl r10d, cl
and r10d, 7
je 0x14008dc0c
movzx eax, byte [r10 + r14 + 0xbb770]
mov rcx, r8
sub rcx, rax
mov al, byte [rcx + 4]
cmp byte [r10 + r14 + 0xbb768], r13b
je 0x14008dc82
inc al
test al, 0xfe
jne 0x14008dc0c
mov rbx, r11
and r10d, 3
add r10d, r10d
or r10d, 1
inc r11
jmp 0x14008dbd7
mov edx, r9d
sub edx, r11d
sub edx, edi
test r10d, r10d
je 0x14008dcdb
movzx r9d, byte [r15 + r14 + 0xbb770]
mov eax, edx
shl r9d, 3
neg r9d
lea ecx, [r9 + 0x18]
shr eax, cl
inc al
test al, 0xfe
jne 0x14008dcdb
lea ecx, [r9 + 0x20]
mov r9d, 1
shl r9d, cl
dec r9d
xor r9d, edx
jmp 0x14008dc45
mov eax, edx
mov byte [r8 + 1], dl
shr eax, 0x18
and al, 1
dec al
not al
mov byte [r8 + 4], al
mov eax, edx
shr eax, 0x10
mov byte [r8 + 3], al
mov eax, edx
shr eax, 8
add r11, 5
mov byte [r8 + 2], al
jmp 0x14008dbd7
mov r14, qword [rsp + 0x40]
mov rdx, r11
sub rdx, rbx
lea ecx, [rdx - 1]
shl r10d, cl
and r10d, 7
cmp rdx, 3
cmova r10d, r13d
mov dword [r14], r10d
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
pop r15
pop r14
pop r13
pop rdi
ret
Function at 0x14008fb80
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x1400d33c0]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rax, rdx
mov r15, rcx
or edi, 0xffffffff
mov edx, 0x8000
mov rcx, rax
mov r12, r8
mov ebp, edi
xor esi, esi
call fcn.140096cb0
mov r14d, eax
test eax, eax
jns 0x14008fbcd
lea eax, [rdi + 7]
jmp 0x14008fcae
lea rdx, [rsp + 0x20]
mov ecx, eax
call fcn.14008fe9c
mov ebx, eax
test eax, eax
jne 0x14008fc86
mov edx, 0x8000
mov rcx, r15
call fcn.140096cb0
mov edi, eax
test eax, eax
jns 0x14008fc00
mov ebx, 6
jmp 0x14008fc86
lea rdx, [rsp + 0x40]
mov ecx, eax
call fcn.140096808
test eax, eax
jne 0x14008fbf6
mov ebx, dword [rsp + 0x28]
cmp dword [rsp + 0x54], ebx
je 0x14008fc1f
lea ebx, [rax + 8]
jmp 0x14008fc86
mov rcx, rbx
call fcn.140095ef0
mov rsi, rax
test rax, rax
jne 0x14008fc34
lea ebx, [rax + 1]
jmp 0x14008fc86
mov r8d, ebx
mov rdx, rax
mov ecx, edi
call fcn.1400a1cc0
mov edx, dword [rsp + 0x28]
cmp eax, edx
jne 0x14008fbf6
mov rcx, rsi
call fcn.14008fcd0
cmp eax, dword [rsp + 0x2c]
je 0x14008fc5e
mov ebx, 4
jmp 0x14008fc86
mov edx, 0x8301
mov rcx, r12
call fcn.140096cb0
mov ebp, eax
test eax, eax
js 0x14008fbf6
lea rcx, [rsp + 0x20]
mov r9d, eax
mov r8, rsi
mov edx, r14d
call fcn.14008fd00
mov ebx, eax
mov rcx, rsi
call fcn.140091c58
mov ecx, r14d
call fcn.140093d50
test edi, edi
js 0x14008fca1
mov ecx, edi
call fcn.140093d50
test ebp, ebp
js 0x14008fcac
mov ecx, ebp
call fcn.140093d50
mov eax, ebx
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140091a70
add rsp, 0x80
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14008fd00
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x20], r9d
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov edi, dword [rcx + 0x18]
mov eax, dword [rcx + 8]
mov r14, rcx
add edi, dword [rcx + 0x1c]
add rax, r8
mov r15, r8
add edi, dword [rcx + 0x14]
mov esi, edx
mov qword [rsp + 0x70], rax
mov ecx, edi
call fcn.140095ef0
xor ebx, ebx
mov r12, rax
test rax, rax
jne 0x14008fd4e
lea eax, [rbx + 1]
jmp 0x14008fe87
test edi, edi
je 0x14008fd84
mov ebp, 0x7fffffff
mov r8d, edi
cmp edi, ebp
mov rdx, r12
cmovg r8d, ebp
mov ecx, esi
call fcn.1400a1cc0
test eax, eax
js 0x14008fe6a
sub edi, eax
test eax, eax
jne 0x14008fd80
test edi, edi
jne 0x14008fe78
test edi, edi
jne 0x14008fd57
mov esi, dword [r14 + 0x14]
mov ebp, dword [r14 + 0x18]
mov r13d, dword [r14 + 0x1c]
add rsi, r12
mov rdi, r12
add rbp, rsi
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x80], rbp
add r13, rbp
mov ecx, dword [rdi]
call qword [sym.imp.WS2_32.dll_ntohl]
mov ecx, dword [rdi + 4]
mov dword [rdi], eax
call qword [sym.imp.WS2_32.dll_ntohl]
mov ecx, dword [rdi + 8]
mov dword [rdi + 4], eax
call qword [sym.imp.WS2_32.dll_ntohl]
mov ecx, dword [rdi]
mov dword [rdi + 8], eax
lea rax, [rcx + r15]
cmp rax, qword [rsp + 0x70]
ja 0x14008fe78
lea rax, [rcx + rsi]
cmp rax, qword [rsp + 0x80]
ja 0x14008fe78
mov edx, ebx
test ecx, ecx
je 0x14008fe03
mov ecx, edx
inc edx
mov al, byte [rcx + r15]
add byte [rcx + rsi], al
cmp edx, dword [rdi]
jb 0x14008fdf4
mov r8d, dword [rdi]
mov ecx, dword [rsp + 0x88]
mov r14d, dword [rdi]
mov rdx, rsi
call fcn.140092ba8
cmp eax, r14d
jne 0x14008fe71
mov eax, dword [rdi + 4]
add r15, r14
add rsi, r14
add rax, rbp
cmp rax, r13
ja 0x14008fe78
mov r14d, dword [rdi + 4]
mov ecx, dword [rsp + 0x88]
mov rdx, rbp
mov r8d, r14d
call fcn.140092ba8
cmp eax, r14d
jne 0x14008fe71
movsxd rax, dword [rdi + 8]
add rbp, r14
add r15, rax
cmp r15, qword [rsp + 0x70]
ja 0x14008fe78
add rdi, 0xc
cmp rdi, qword [rsp + 0x20]
jae 0x14008fe7d
jmp 0x14008fda9
mov ebx, 6
jmp 0x14008fe7d
mov ebx, 7
jmp 0x14008fe7d
mov ebx, 8
mov rcx, r12
call fcn.140091c58
mov eax, ebx
mov rbx, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14008fe9c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x1400d33c0]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov r8d, 0x20
mov rbx, rdx
mov edi, ecx
call fcn.1400a1cc0
cmp eax, 0x20
je 0x14008fed4
mov eax, 6
jmp 0x14008ff62
mov ecx, dword [rbx + 8]
call qword [sym.imp.WS2_32.dll_ntohl]
mov ecx, dword [rbx + 0xc]
mov dword [rbx + 8], eax
call qword [sym.imp.WS2_32.dll_ntohl]
mov ecx, dword [rbx + 0x10]
mov dword [rbx + 0xc], eax
call qword [sym.imp.WS2_32.dll_ntohl]
mov ecx, dword [rbx + 0x14]
mov dword [rbx + 0x10], eax
call qword [sym.imp.WS2_32.dll_ntohl]
mov ecx, dword [rbx + 0x18]
mov dword [rbx + 0x14], eax
call qword [sym.imp.WS2_32.dll_ntohl]
mov ecx, dword [rbx + 0x1c]
mov dword [rbx + 0x18], eax
call qword [sym.imp.WS2_32.dll_ntohl]
lea rdx, [rsp + 0x20]
mov ecx, edi
mov dword [rbx + 0x1c], eax
call fcn.140096808
test eax, eax
jne 0x14008feca
mov rax, qword [rbx]
cmp rax, qword [str.MBDIFF10]
je 0x14008ff3f
mov eax, 8
jmp 0x14008ff62
mov eax, dword [rbx + 0x18]
mov ecx, dword [rbx + 0x14]
mov edx, dword [rbx + 0x1c]
add rcx, rax
movsxd rax, dword [rsp + 0x34]
add rdx, 0x20
add rdx, rcx
sub rdx, rax
neg rdx
sbb eax, eax
and eax, 8
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140091a70
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret

Function at 0x1400942b0
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.140094118
Function at 0xf5bba0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0xf5bbad
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0xf5bbbd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0xf5bba5
lea eax, [rcx + 1]
jmp 0xf5bbcb
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0xf5bbde
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0xf5bbc4
sub eax, 3
jb 0xf5bbfe
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0xf5bc4d
sar eax, 1
movsxd rbp, eax
jb 0xf5bc34
jmp 0xf5bc0c
add ebx, ebx
jne 0xf5bc0a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0xf5bc34
inc ecx
add ebx, ebx
jne 0xf5bc1a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0xf5bc34
call r11
adc ecx, ecx
add ebx, ebx
jne 0xf5bc2d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0xf5bc1c
add ecx, 2
jmp 0xf5bc39
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.00f5bb62
jmp 0xf5bbad
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x3cc600
mov dl, 0x3c
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0xf5bc99
cmp rsi, rcx
jae 0xf5bca1
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0xf5bc80
cmp al, 0x8f
ja 0xf5bc80
cmp byte [rsi - 2], 0xf
je 0xf5bc86
sub al, 0xe8
cmp al, 1
ja 0xf5bc6a
cmp rsi, rcx
jae 0xf5bca1
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0xf5bc70
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0xf5bca1
lodsb al, byte [rsi]
jmp 0xf5bc80
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0xb4f000]
mov eax, dword [rdi]
or eax, eax
je 0xf5bcfe
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0xb5b000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0xf5bcae
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0xf5bcf8
mov qword [rbx], rax
add rbx, 8
jmp 0xf5bcce
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0xf5bd42
cmp al, 0xef
ja 0xf5bd2a
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0xf5bd0a
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0xf5bd19
mov eax, dword [rdi]
add rdi, 4
jmp 0xf5bd19
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0xf5bd96
sub rsp, 0xffffffffffffff80
jmp 0x4677a0
Function at 0x140015870
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x140015892
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x14001590c
mov rdi, r14
mov rcx, rbx
call fcn.14000b5c0
test rax, rax
jle 0x1400158e4
mov rdx, qword [rbx + 0x38]
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov r8, rbp
mov rdx, qword [rdx]
call fcn.140097600
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x1400158fc
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + gethostname]
cmp eax, 0xffffffff
je 0x140015904
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x1400158a6
sub r14, rdi
jmp 0x1400159f9
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x140015923
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140015925
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14001595a
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.140097600
mov rax, qword [rbx + 0x50]
sub rbp, rdi
add rsi, rdi
mov r8, rbp
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x1400159f6
mov r9, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r9], rax
jne 0x140015995
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r9], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rdi, r8
cmp r8, 0xfff
jbe 0x1400159d1
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.1400a8128
sub rbp, rax
add rsi, rax
mov rdi, rbp
cmp rax, 0xfff
jne 0x140015a0f
cmp rbp, rax
ja 0x1400159a1
mov r8, rdi
test rdi, rdi
je 0x1400159f6
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.1400a8128
mov r8, rdi
sub r8, rax
sub r14, r8
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
sub r14, rbp
jmp 0x1400159f9
Function at 0x140016240
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x18], r8
push rdi
push r12
push r13
push r14
push r15
mov r14, qword [rsp + 0x50]
xor ebp, ebp
mov rax, qword [rsp + 0x58]
mov r13, r9
mov rbx, qword [rsp + 0x68]
mov r12, rdx
mov qword [r14], r8
mov qword [rbx], rax
mov rax, qword [r14]
cmp rax, r9
je 0x1400163d4
mov r15, qword [rsp + 0x60]
lea r9d, [rbp + 1]
mov rdi, qword [rbx]
mov r11d, 0x2800
mov r8d, 0x3ff
mov r10d, 0x2400
cmp rdi, r15
je 0x1400163d4
movzx edx, word [r12]
xor sil, sil
movzx ecx, word [rax]
cmp r9w, dx
jae 0x1400162db
lea eax, [r10 + rcx]
cmp ax, r8w
ja 0x1400163fb
mov eax, edx
sub ecx, 0xdc00
shl eax, 0xa
or eax, ecx
jmp 0x1400162f2
mov eax, ecx
add cx, r11w
cmp cx, r8w
ja 0x1400162f2
shl eax, 0xa
mov sil, 1
sub eax, 0x35f0000
cmp eax, 0x80
jae 0x140016305
movzx r8d, al
mov r10d, ebp
mov r11d, ebp
jmp 0x140016352
mov r8d, eax
cmp eax, 0x800
jae 0x14001631f
shr r8d, 6
mov r10d, r9d
or r8b, 0xc0
mov r11d, r9d
jmp 0x140016352
cmp eax, 0x10000
jae 0x140016339
shr r8d, 0xc
mov r10d, 2
or r8b, 0xe0
mov r11d, r10d
jmp 0x140016352
shr r8d, 0x12
mov r10d, 3
movzx r11d, sil
or r8b, 0xf0
xor r11d, 1
add r11d, r11d
lea r9d, [r11 + 1]
mov rdx, r15
sub rdx, rdi
mov ecx, r9d
cmp rdx, rcx
jl 0x1400163d4
add qword [r14], 2
test sil, sil
jne 0x140016373
cmp r10d, 3
jae 0x14001637f
mov rcx, qword [rbx]
mov r9d, r11d
mov byte [rcx], r8b
inc qword [rbx]
test r9d, r9d
je 0x1400163b1
lea r8d, [r10 + r10*2]
add r8d, r8d
nop dword [rax + rax]
sub r8d, 6
mov edx, eax
mov ecx, r8d
dec r9d
shr edx, cl
mov rcx, qword [rbx]
and dl, 0x3f
or dl, 0x80
mov byte [rcx], dl
inc qword [rbx]
test r9d, r9d
jg 0x140016390
shr eax, 0xa
mov r9d, 1
test sil, sil
mov ecx, r9d
cmovne ecx, eax
mov word [r12], cx
mov rax, qword [r14]
cmp rax, r13
jne 0x14001628f
mov rax, qword [rsp + 0x40]
cmp rax, qword [r14]
sete bpl
mov eax, ebp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov eax, 2
jmp 0x1400163e2
Function at 0x1400179a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r15
sub rsp, 0x20
mov r15, qword [rdx + 0x18]
mov rdi, rdx
mov r10, rcx
mov r9, rdx
cmp r15, 0x10
jb 0x1400179c8
mov r9, qword [rdx]
mov rsi, qword [rdx + 0x10]
xor ebp, ebp
movabs r8, 0xcbf29ce484222325
mov edx, ebp
test rsi, rsi
je 0x140017a04
movabs rcx, 0x100000001b3
nop dword [rax]
movzx eax, byte [rdx + r9]
inc rdx
xor r8, rax
imul r8, rcx
cmp rdx, rsi
jb 0x1400179f0
mov rcx, qword [r10 + 0x30]
mov rax, qword [r10 + 0x18]
and rcx, r8
add rcx, rcx
mov rbx, qword [rax + rcx*8 + 8]
cmp rbx, qword [r10 + 8]
jne 0x140017a22
mov rbx, rbp
jmp 0x140017a70
mov qword [rsp + 0x40], r14
mov r14, qword [rax + rcx*8]
nop dword [rax + rax]
cmp qword [rbx + 0x28], 0x10
lea rdx, [rbx + 0x10]
jb 0x140017a3f
mov rdx, qword [rbx + 0x10]
mov rcx, rdi
cmp r15, 0x10
jb 0x140017a4b
mov rcx, qword [rdi]
cmp rsi, qword [rbx + 0x20]
jne 0x140017a5d
mov r8, rsi
call fcn.140097f80
test eax, eax
je 0x140017a6b
cmp rbx, r14
je 0x140017a68
mov rbx, qword [rbx + 8]
jmp 0x140017a30
mov rbx, rbp
mov r14, qword [rsp + 0x40]
test rbx, rbx
mov rbx, qword [rsp + 0x48]
setne bpl
mov rax, rbp
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop rdi
pop rsi
ret
Function at 0x140022480
Capabilities:
Reference http user-agent string

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
push rdi
push r14
sub rsp, 0x20
mov r14, r8
mov rdi, rdx
mov rsi, rcx
call fcn.14002eb20
mov rbx, rax
test rax, rax
je 0x14002266b
lea r8, [0x1400eb99f]
mov qword [rsp + 0x40], rbp
mov edx, 0x272f
mov rcx, rax
call fcn.140031330
mov edx, 0x34
mov rcx, rbx
lea r8d, [rdx - 0x33]
call fcn.140031330
lea rdx, str.User_Agent:_Mozilla_5.0__Windows_NT_10.0__WOW64__Trident_7.0__rv:11.0__like_Gecko
xor ecx, ecx
call fcn.140031490
cmp qword [rdi + 0x10], 0
mov rbp, rax
jbe 0x140022528
lea rdx, str.Content_Type:application_x_www_form_urlencoded__charsetUTF_8
mov rcx, rax
call fcn.140031490
cmp qword [rdi + 0x18], 0x10
mov rbp, rax
jb 0x140022505
mov rdi, qword [rdi]
mov r8, rdi
mov edx, 0x271f
mov rcx, rbx
call fcn.140031330
mov edx, Ordinal_50
mov rcx, rbx
lea r8d, [rdx - 0x2e]
call fcn.140031330
jmp 0x140022537
xor r8d, r8d
mov rcx, rbx
lea edx, [r8 + 0x2f]
call fcn.140031330
mov r8, rbp
mov edx, 0x2727
mov rcx, rbx
call fcn.140031330
xor r8d, r8d
mov rcx, rbx
lea edx, [r8 + 0x2a]
call fcn.140031330
cmp qword [rsi + 0x18], 0x10
mov rbp, qword [rsp + 0x40]
jb 0x140022565
mov rsi, qword [rsi]
mov r8, rsi
mov edx, 0x2712
mov rcx, rbx
call fcn.140031330
xor r8d, r8d
mov rcx, rbx
lea edx, [r8 + 0x40]
call fcn.140031330
xor r8d, r8d
mov rcx, rbx
lea edx, [r8 + 0x51]
call fcn.140031330
xor r8d, r8d
mov rcx, rbx
lea edx, [r8 + 0x29]
call fcn.140031330
xor r8d, r8d
mov edx, 0x4e2c
mov rcx, rbx
call fcn.140031330
lea r8, [0x140022690]
mov edx, 0x4e2b
mov rcx, rbx
call fcn.140031330
mov r8, r14
mov edx, 0x2711
mov rcx, rbx
call fcn.140031330
mov edx, 0x63
mov rcx, rbx
lea r8d, [rdx - 0x62]
call fcn.140031330
mov edx, Ordinal_79
mov rcx, rbx
lea r8d, [rdx - 0x48]
call fcn.140031330
mov edx, reloc.WS2_32.dll_listen
mov rcx, rbx
lea r8d, [rdx - 7]
call fcn.140031330
mov rax, qword [0x140102ba0]
test rax, rax
je 0x140022647
nop word [rax + rax]
mov r8, qword [rax]
mov edx, 0x2797
mov rcx, rbx
call fcn.140031330
mov rax, qword [0x140102ba0]
mov rax, qword [rax + 8]
mov qword [0x140102ba0], rax
test rax, rax
jne 0x140022620
mov rcx, rbx
call fcn.14002eb70
mov edi, eax
test eax, eax
jne 0x14002266f
lea r8, [0x140102ba0]
mov edx, 0x40001c
mov rcx, rbx
call fcn.14002eaf0
jmp 0x14002266f
mov edi, dword [rsp + 0x58]
mov rcx, rbx
call fcn.14002eae0
mov rbx, qword [rsp + 0x48]
mov eax, edi
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret