joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140052ac3
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x48
test rcx, rcx
je 0x140052ba6
cmp byte [rcx + 8], 1
jne 0x140052ba6
mov rsi, qword [rcx]
lea rax, [0x14008aa55]
lea rdx, [rsp + 0x38]
mov qword [rdx], rax
mov rcx, qword [rdx]
movabs rax, 0xc793261fe3033db9
mov qword [rdx], rax
lea rax, [rsp + 0x38]
mov rdx, qword [rax]
call fcn.14005242f
xor ecx, ecx
lea r10, [rsp + 0x28]
mov qword [r10], rcx
lea rdx, [rsp + 0x30]
mov qword [rdx], rcx
mov r9b, 1
lea r8, [0x14008e9aa]
mov r11, qword [rcx + r8]
xor r11, qword [rax + rcx]
mov qword [r10], r11
mov ecx, 8
mov r10, rdx
test r9b, 1
mov r9d, 0
jne 0x140052b27
lea rax, [rsp + 0x28]
mov rcx, qword [rax]
lea rdi, [rsp + 0x38]
mov qword [rdi], rcx
mov rcx, qword [rsp + 0x30]
mov qword [rdi + 8], rcx
lea rcx, [0x140084413]
mov qword [rax], rcx
mov rcx, qword [rax]
movabs rdx, 0x2c1fc7183e2cb6e1
mov qword [rax], rdx
mov rdx, qword [rax]
call fcn.140052416
mov rcx, qword [rax]
mov rax, qword [rax + 8]
mov r8d, 0x10
mov rcx, rsi
mov rdx, rdi
call fcn.14004e09b
mov rdx, rax
xor eax, eax
test rdx, rdx
setne al
jmp 0x140052ba8
xor eax, eax
add rsp, 0x48
pop rdi
pop rsi
ret
Function at 0x14007146c
Capabilities:
Set socket configuration

Disassembly:
push rsi
sub rsp, 0x30
movzx eax, dl
lea r8, [rsp + 0x2c]
mov dword [r8], eax
mov edx, 0x8004667e
call qword [sym.imp.ws2_32.dll_ioctlsocket]
test eax, eax
je 0x140071499
mov esi, 1
call sub.KERNEL32.dll_GetLastError
mov edx, eax
jmp 0x14007149b
xor esi, esi
mov eax, esi
add rsp, 0x30
pop rsi
ret

Function at 0x140074d1f
Capabilities:
Connect socket

Disassembly:
sub rsp, 0x28
mov r8d, dword [rdx + 0x80]
call sub.ws2_32.dll_connect
test eax, eax
je 0x140074d42
call fcn.140034010
shl rax, 0x20
or rax, 2
jmp 0x140074d44
xor eax, eax
add rsp, 0x28
ret
mov rcx, qword [rcx]
jmp 0x140074d1f

Function at 0x140074d49
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x28
movzx eax, dl
lea r8, [rsp + 0x24]
mov dword [r8], eax
mov edx, 0x8004667e
call sub.ws2_32.dll_ioctlsocket
cmp eax, 0xffffffff
je 0x140074d6b
xor eax, eax
jmp 0x140074d78
call fcn.140034010
shl rax, 0x20
or rax, 2
add rsp, 0x28
ret
mov rcx, qword [rcx]
jmp 0x140074d49

Function at 0x140074f9a
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x28
movzx eax, dl
lea r8, [rsp + 0x24]
mov dword [r8], eax
mov edx, 0x8004667e
call sub.ws2_32.dll_ioctlsocket
cmp eax, 0xffffffff
je 0x140074d6b
xor eax, eax
jmp 0x140074d78
call fcn.140034010
shl rax, 0x20
or rax, 2
add rsp, 0x28
ret
mov rcx, qword [rcx]
jmp 0x140074d49
Function at 0x140075e78
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x140075eae
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 4
jb 0x140075eb6
mov esi, dword [rdx]
mov r9d, 4
jmp 0x140075ebb
xor r10d, r10d
jmp 0x140075f69
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x140075ede
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x140075ef5
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x140075f15
add r11, r8
jmp 0x140076039
mov rcx, qword [rax + 0x18]
xor rcx, rsi
mov rdi, qword [rax + 0x10]
mov r9, qword [rax]
add r9, rdi
mov r11, qword [rax + 8]
add r11, rcx
rol rdi, 0xd
xor rdi, r9
rol rcx, 0x10
rol r9, 0x20
xor rcx, r11
add r11, rdi
rol rdi, 0x11
add r9, rcx
xor rdi, r11
rol rcx, 0x15
mov qword [rax + 0x10], rdi
xor rcx, r9
rol r11, 0x20
mov qword [rax + 0x18], rcx
mov qword [rax + 8], r11
xor r9, rsi
mov qword [rax], r9
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x140075fdd
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
mov rbx, qword [rdx + r10]
xor rdi, rbx
add rcx, rsi
rol rsi, 0xd
add r9, rdi
xor rsi, rcx
rol rdi, 0x10
xor rdi, r9
rol rcx, 0x20
add r9, rsi
add rcx, rdi
rol rsi, 0x11
xor rsi, r9
rol rdi, 0x15
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x140075f8b
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 4
jb 0x140075fef
mov r9d, dword [rdx + r10]
mov r8d, 4
jmp 0x140075ff5
xor r9d, r9d
xor r8d, r8d
mov ecx, r8d
or ecx, 1
cmp ecx, r11d
jae 0x14007601b
lea rcx, [rdx + r8]
movzx esi, word [r10 + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8d, r11d
jae 0x140076035
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret

Function at 0x1400783b0
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov r8, rdx
mov rax, qword [rcx + 0x38]
test rax, rax
jle 0x1400783d7
cmp qword [rcx + 0x40], 0
js 0x1400783d7
add rax, 0xffffffffffffff00
mov qword [rcx + 0x38], rax
mov edx, 6
jmp fcn.1400786d4
mov rdx, r8
xor r8d, r8d
jmp 0x140078438
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
call fcn.1400783e2
test rax, rax
je 0x140078463
lea rcx, [rsp + 0x20]
mov qword [rcx], rax
mov qword [rcx + 8], rdx
call fcn.1400054af
mov qword [rdi + 0x40], rbx
mov rax, 0xffffffffffffff00
add rax, qword [rdi + 0x30]
mov qword [rdi + 0x38], rax
mov rcx, rdi
mov edx, 6
mov r8, rsi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp fcn.1400786d4
Function at 0x140078438
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov r8, rdx
mov rax, qword [rcx + 0x38]
test rax, rax
jle 0x1400783d7
cmp qword [rcx + 0x40], 0
js 0x1400783d7
add rax, 0xffffffffffffff00
mov qword [rcx + 0x38], rax
mov edx, 6
jmp fcn.1400786d4
mov rdx, r8
xor r8d, r8d
jmp 0x140078438
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
call fcn.1400783e2
test rax, rax
je 0x140078463
lea rcx, [rsp + 0x20]
mov qword [rcx], rax
mov qword [rcx + 8], rdx
call fcn.1400054af
mov qword [rdi + 0x40], rbx
mov rax, 0xffffffffffffff00
add rax, qword [rdi + 0x30]
mov qword [rdi + 0x38], rax
mov rcx, rdi
mov edx, 6
mov r8, rsi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp fcn.1400786d4
Function at 0x14007aed4
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
test rdx, rdx
je 0x14007af3b
mov rsi, rdx
mov rdi, rcx
mov r14d, 0xffffffff
mov r15, qword [sym.imp.bcrypt.dll_BCryptGenRandom]
mov r12, qword [sym.imp.advapi32.dll_SystemFunction036]
cmp rsi, r14
mov ebx, 0xffffffff
cmovb rbx, rsi
xor ecx, ecx
mov rdx, rdi
mov r8d, ebx
mov r9d, 2
call r15
cmp eax, 0xbfffffff
jbe 0x14007af33
mov ebp, eax
mov rcx, rdi
mov edx, ebx
call r12
test al, al
je 0x14007af3f
add rdi, rbx
sub rsi, rbx
jne 0x14007af01
xor ebp, ebp
jmp 0x14007af45
and ebp, 0x7fffffff
mov eax, ebp
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x14007b96c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14007b9b6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14007b9b6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14007b9b6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14007b9b6
cmp dword [rcx + 0x84], 0xe
jbe 0x14007b9b6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14007b9b8
xor al, al
add rsp, 0x28
ret

Function at 0x14007d490
Capabilities:
Resolve dns

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov r14, r9
mov rsi, rcx
lea rcx, [rbp - 0x28]
call fcn.14003f450
mov rdx, qword [rbp - 0x28]
mov rax, rdx
neg rax
jno 0x14007d512
mov rdi, qword [rbp - 0x20]
mov rbx, qword [rbp - 0x18]
xorps xmm0, xmm0
movaps xmmword [rbp - 0x60], xmm0
movaps xmmword [rbp - 0x40], xmm0
movaps xmmword [rbp - 0x50], xmm0
mov dword [rbp - 0x58], 1
mov qword [rbp - 8], 0
lea r8, [rbp - 0x60]
lea r9, [rbp - 8]
mov rcx, rdi
xor edx, edx
call qword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x14007d542
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
mov ecx, 1
jmp 0x14007d556
lea rax, str.xv_b_
mov qword [rsi + 8], rax
mov qword [rsi], 1
jae 0x14007d576
mov rcx, qword [rbp - 0x20]
mov r8d, 1
add rsp, 0x80
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
jmp fcn.140028620
mov rcx, qword [r14]
mov rax, qword [rbp - 8]
movzx ecx, word [rcx]
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], cx
xor ecx, ecx
mov qword [rsi + 8], rax
mov qword [rsi], rcx
mov byte [rdi], 0
test rbx, rbx
je 0x14007d576
mov r8d, 1
mov rcx, rdi
mov rdx, rbx
call fcn.140028620
nop
add rsp, 0x80
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
Function at 0x140001300
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
lea r10, [0x140029d20]
xor edx, edx
mov r8, r10
nop dword [rax]
mov ecx, edx
lea r8, [r8 + 4]
and ecx, 1
mov eax, edx
shr eax, 1
neg ecx
and ecx, 0xedb88320
inc edx
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [r8 - 4], eax
cmp edx, 0x100
jb 0x140001310
lea rax, [0x140029d24]
mov r9d, 0x1c0
nop dword [rax]
mov r8d, dword [rax - 4]
lea rax, [rax + 0x10]
movzx edx, r8b
shr r8d, 8
xor r8d, dword [r10 + rdx*4]
mov dword [rax + 0x3ec], r8d
mov r8d, dword [rax - 0x10]
movzx edx, r8b
shr r8d, 8
xor r8d, dword [r10 + rdx*4]
mov dword [rax + 0x3f0], r8d
mov r8d, dword [rax - 0xc]
movzx edx, r8b
shr r8d, 8
xor r8d, dword [r10 + rdx*4]
mov dword [rax + 0x3f4], r8d
mov r8d, dword [rax - 8]
movzx edx, r8b
shr r8d, 8
xor r8d, dword [r10 + rdx*4]
mov dword [rax + 0x3f8], r8d
sub r9, 1
jne 0x1400013c0
lea rax, [0x140001440]
mov qword [0x140029d08], rax
ret
Function at 0x140004050
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov r12, rdx
mov qword [rbp - 0x39], 0
mov rsi, rcx
mov dword [rbp - 0x19], 0x6a09e667
xor eax, eax
mov dword [rbp - 0x15], 0xbb67ae85
mov dword [rbp - 0x11], 0x3c6ef372
mov r15d, 0x43fc4
mov dword [rbp - 0xd], 0xa54ff53a
mov dword [rbp - 9], 0x510e527f
mov dword [rbp - 5], 0x9b05688c
mov dword [rbp - 1], 0x1f83d9ab
mov dword [rbp + 3], 0x5be0cd19
nop dword [rax]
nop word [rax + rax]
mov ecx, eax
mov edi, 0x100
and ecx, 0x3f
mov ebx, 0x40
add rax, rdi
sub ebx, ecx
mov qword [rbp - 0x31], rax
mov r14, r12
cmp rbx, rdi
jbe 0x140004156
mov eax, ecx
mov edx, 2
lea rcx, [rbp + 7]
add rcx, rax
mov rax, r12
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx - 0x20], xmm0
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x140004101
jmp 0x1400041b7
test ecx, ecx
je 0x140004188
mov eax, ecx
mov r8, rbx
lea rcx, [rbp + 7]
mov rdx, r12
add rcx, rax
sub rdi, rbx
call fcn.14001a970
mov r8d, 1
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x19]
lea r14, [rbx + r12]
call fcn.140003900
mov rbx, rdi
lea rcx, [rbp - 0x19]
shr rbx, 6
mov rdx, r14
mov r8, rbx
call fcn.140003900
and edi, 0x3f
je 0x1400041b7
shl rbx, 6
lea rcx, [rbp + 7]
mov r8d, edi
lea rdx, [r14 + rbx]
call fcn.14001a970
sub r15, 1
je 0x1400041c6
mov rax, qword [rbp - 0x31]
jmp 0x1400040d0
mov ecx, dword [rbp - 0x31]
and ecx, 0x3f
mov byte [rbp + rcx + 7], 0x80
inc ecx
cmp ecx, 0x38
jbe 0x140004201
cmp ecx, 0x40
je 0x1400041ec
nop dword [rax]
mov byte [rbp + rcx + 7], 0
inc ecx
cmp ecx, 0x40
jne 0x1400041e0
mov r8d, 1
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x19]
call fcn.140003900
xor ecx, ecx
mov eax, ecx
mov r8d, 0x38
sub r8d, ecx
xor edx, edx
lea rcx, [rbp + 7]
add rcx, rax
call fcn.14001a5b0
mov rax, qword [rbp - 0x31]
lea rdx, [rbp + 7]
mov r8d, 1
lea rcx, [rax*8]
mov rax, rcx
bswap ecx
shr rax, 0x20
bswap eax
mov dword [rbp + 0x43], ecx
lea rcx, [rbp - 0x19]
mov dword [rbp + 0x3f], eax
call fcn.140003900
lea rcx, [rbp - 0x15]
mov edx, 4
nop dword [rax]
nop word [rax + rax]
mov eax, dword [rcx - 4]
lea rsi, [rsi + 8]
lea rcx, [rcx + 8]
bswap eax
mov dword [rsi - 8], eax
mov eax, dword [rcx - 8]
bswap eax
mov dword [rsi - 4], eax
sub rdx, 1
jne 0x140004260
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140004b10
Capabilities:
Encode data using xor
Read file on windows
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x60
movaps xmmword [rax - 0x28], xmm6
mov rdi, r8
movq xmm6, r8
mov rbx, rdx
xor r14d, r14d
punpcklqdq xmm6, xmm6
mov qword [rax - 0x48], r14
xor r9d, r9d
mov dword [rax - 0x50], 0x80
xor r8d, r8d
mov edx, 0x80000000
mov dword [rax - 0x58], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x30], r14
mov edx, 0x40000000
cmp rax, 0xffffffffffffffff
mov dword [rsp + 0x28], 0x80
mov rbp, rax
mov dword [rsp + 0x20], 2
cmove rbp, r14
mov rcx, rbx
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
mov rsi, rax
cmove rsi, r14
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r15d, 0x186a0
xor edx, edx
mov rcx, rax
mov r8d, r15d
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rbp, rbp
je 0x140004d1f
test rsi, rsi
je 0x140004d1f
test rax, rax
je 0x140004d1f
lea r9, [rsp + 0x98]
mov qword [rsp + 0x20], r14
mov r8d, r15d
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r10d, dword [rsp + 0x98]
cmp r10d, 1
jb 0x140004cf7
nop word [rax + rax]
cmp r10d, r15d
mov ecx, r10d
mov rax, rbx
mov r8, r14
cmova ecx, r15d
mov edx, ecx
add rcx, rbx
add rdx, 7
shr rdx, 3
cmp rbx, rcx
cmova rdx, r14
test rdx, rdx
je 0x140004c9f
cmp rdx, 8
jb 0x140004c9f
and rdx, 0xfffffffffffffff8
nop dword [rax]
nop word [rax + rax]
movdqu xmm0, xmmword [rax]
add r8, 8
movdqa xmm1, xmm6
xorps xmm1, xmm0
movdqu xmmword [rax], xmm1
movdqu xmm0, xmmword [rax + 0x10]
movdqa xmm1, xmm6
xorps xmm1, xmm0
movdqu xmmword [rax + 0x10], xmm1
movdqu xmm0, xmmword [rax + 0x20]
movdqa xmm1, xmm6
xorps xmm1, xmm0
movdqu xmmword [rax + 0x20], xmm1
movdqu xmm0, xmmword [rax + 0x30]
movdqa xmm1, xmm6
xorps xmm1, xmm0
movdqu xmmword [rax + 0x30], xmm1
add rax, 0x40
cmp r8, rdx
jb 0x140004c50
cmp rax, rcx
jae 0x140004cb0
xor qword [rax], rdi
add rax, 8
cmp rax, rcx
jb 0x140004ca4
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], r14
mov r8d, r10d
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea r9, [rsp + 0x98]
mov qword [rsp + 0x20], r14
mov r8d, r15d
mov rdx, rbx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r10d, dword [rsp + 0x98]
cmp r10d, 1
jae 0x140004c10
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140004d21
xor eax, eax
movaps xmm6, xmmword [rsp + 0x50]
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140006d90
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rdi
push r14
sub rsp, 0x150
mov rdi, qword [0x140029940]
xor ebx, ebx
mov rbp, rdx
mov r14, rcx
test rdi, rdi
je 0x140006de0
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xorps xmm0, xmm0
mov qword [0x140029950], rbx
movdqu xmmword [0x140029940], xmm0
mov dword [0x140029958], ebx
test r14, r14
je 0x140006f8d
test rbp, rbp
je 0x140006f8d
lea r8, [rsp + 0x180]
mov qword [rsp + 0x178], rsi
mov rdx, rbp
mov rcx, r14
call fcn.1400042a0
lea r9, [0x140029d20]
mov qword [0x140029940], rax
mov r8, rbp
mov qword [0x140029948], rax
mov rdx, r14
mov ecx, 0xffffffff
call qword [0x140029d08]
cmp word [reloc.d2d1.dll_Ordinal_1], bx
not eax
mov dword [0x140029950], eax
mov qword [0x140029954], rbx
je 0x140006e89
movzx ecx, word [0x14001cb64]
mov eax, ebx
inc ecx
test cl, 3
setne al
shr ecx, 2
add eax, ecx
mov rcx, rbx
mov edx, eax
je 0x140006e82
lea r8, [0x14001cb68]
nop
mov eax, dword [0x14001cb60]
xor dword [r8 + rcx*4], eax
inc rcx
cmp rcx, rdx
jne 0x140006e70
mov word [reloc.d2d1.dll_Ordinal_1], bx
mov rsi, 0xffffffffffffffff
lea rdx, [0x140029820]
mov rdi, rsi
nop word [rax + rax]
inc rdi
cmp byte [rdx + rdi], bl
jne 0x140006ea0
test rdi, rdi
je 0x140006ec2
mov r8, rdi
lea rcx, [rsp + 0x40]
call fcn.14001a970
mov byte [rsp + rdi + 0x40], 0x5c
inc rdi
lea rdx, [0x14001cb68]
nop dword [rax]
inc rsi
cmp byte [rdx + rsi], bl
jne 0x140006ed0
lea rcx, [rsp + 0x40]
mov r8, rsi
add rcx, rdi
call fcn.14001a970
lea rax, [rdi + rsi]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x80
lea rcx, [rsp + 0x40]
xor r9d, r9d
mov byte [rsp + rax + 0x40], bl
xor r8d, r8d
mov dword [rsp + 0x20], 2
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, qword [rsp + 0x178]
cmp rax, 0xffffffffffffffff
mov rdi, rax
cmove rdi, rbx
test rdi, rdi
je 0x140006f58
lea r9, [rsp + 0x170]
mov qword [rsp + 0x20], rbx
mov r8d, ebp
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rsp + 0x180]
test rdx, rdx
je 0x140006f8d
mov r8, qword [0x140029940]
mov rcx, rbx
mov eax, dword [0x140029958]
cmp byte [rcx + r8], 0
jne 0x140006f84
inc eax
mov dword [0x140029958], eax
inc ebx
mov ecx, ebx
cmp rcx, rdx
jne 0x140006f75
mov rbx, qword [rsp + 0x188]
add rsp, 0x150
pop r14
pop rdi
pop rbp
ret
Function at 0x140006fb0
Capabilities:
Encode data using xor
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor dword [rcx], 0xf6fc61e8
lea r8, [rcx + 4]
xor edi, edi
lea r9, [rcx - 4]
add r9, rdx
mov r10d, 1
mov rax, r9
mov rbx, rdx
sub rax, r8
add rax, 4
shr rax, 2
cmp r8, r9
cmova rax, rdi
cmp rax, r10
jb 0x140007049
cmp rax, 0x10
jb 0x140007049
movdqa xmm1, xmmword [str.]
and rax, 0xfffffffffffffff0
movdqu xmm0, xmmword [r8]
add r10, 0x10
xorps xmm0, xmm1
movdqu xmmword [r8], xmm0
movdqu xmm0, xmmword [r8 + 0x10]
xorps xmm0, xmm1
movdqu xmmword [r8 + 0x10], xmm0
movdqu xmm0, xmmword [r8 + 0x20]
xorps xmm0, xmm1
movdqu xmmword [r8 + 0x20], xmm0
movdqu xmm0, xmmword [r8 + 0x30]
xorps xmm0, xmm1
movdqu xmmword [r8 + 0x30], xmm0
add r8, 0x40
cmp r10, rax
jbe 0x140007002
cmp r8, r9
ja 0x140007060
nop
xor dword [r8], 0x3db6cc5c
add r8, 4
cmp r8, r9
jbe 0x140007050
mov rdx, rcx
xor r9d, r9d
mov rcx, qword [0x140029930]
mov r8d, ebx
call qword [sym.imp.WS2_32.dll_send]
movsxd rcx, eax
cmp rcx, rbx
mov rbx, qword [rsp + 0x30]
sete dil
mov eax, edi
add rsp, 0x20
pop rdi
ret
Function at 0x140008920
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x20
movzx edi, dl
mov rbx, rcx
cmp dil, 8
je 0x140008b03
cmp dil, 0x7f
je 0x140008b03
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x40], r14
cmp dil, 0x16
jne 0x140008a52
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x140008ad0
mov ecx, 1
call qword [sym.imp.USER32.dll_GetClipboardData]
mov r14, rax
test rax, rax
jne 0x140008986
call qword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x140008ad0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rdi, rax
test rax, rax
je 0x140008ad0
mov rbp, 0xffffffffffffffff
mov qword [rsp + 0x38], rsi
mov rsi, rbp
nop word [rax + rax]
inc rsi
cmp byte [rax + rsi], 0
jne 0x1400089b0
test rsi, rsi
je 0x140008a3c
nop
mov rdx, qword [rbx]
mov rax, rbp
inc rax
cmp byte [rdx + rax], 0
jne 0x1400089c6
cmp rax, qword [rbx + 8]
je 0x140008a33
movzx ecx, byte [rdi]
lea eax, [rcx - 0x20]
cmp al, 0x5e
ja 0x140008a33
cmp dword [rbx + 0x10], 0
je 0x140008a0c
mov r8, qword [rbx + 0x18]
mov rax, r8
sub rax, rdx
cmp rax, 7
jne 0x140008a00
cmp cl, 0x2d
je 0x140008a00
mov byte [r8], 0x2d
jmp 0x140008a2f
lea eax, [rcx - 0x61]
cmp al, 0x19
ja 0x140008a0a
sub cl, 0x20
mov byte [rdi], cl
mov rdx, qword [rbx + 0x18]
mov r8, rbp
inc r8
cmp byte [rdx + r8], 0
jne 0x140008a13
lea rcx, [rdx + 1]
call fcn.14001a970
mov rcx, qword [rbx + 0x18]
movzx eax, byte [rdi]
mov byte [rcx], al
inc qword [rbx + 0x18]
inc rdi
sub rsi, 1
jne 0x1400089c0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rsi, qword [rsp + 0x38]
jmp 0x140008ad0
mov rdx, qword [rcx]
mov rbp, 0xffffffffffffffff
mov rax, rbp
nop
inc rax
cmp byte [rdx + rax], 0
jne 0x140008a60
cmp rax, qword [rcx + 8]
je 0x140008ad0
lea ecx, [rdi - 0x20]
cmp cl, 0x5e
ja 0x140008ad0
cmp dword [rbx + 0x10], 0
je 0x140008aa9
mov r8, qword [rbx + 0x18]
mov rax, r8
sub rax, rdx
cmp rax, 7
jne 0x140008a9e
cmp dil, 0x2d
je 0x140008a9e
mov byte [r8], 0x2d
lea ecx, [rdi - 0x20]
inc qword [rbx + 0x18]
lea eax, [rdi - 0x61]
movzx ecx, cl
cmp al, 0x19
cmovbe edi, ecx
mov rdx, qword [rbx + 0x18]
nop dword [rax]
inc rbp
cmp byte [rdx + rbp], 0
jne 0x140008ab0
mov r8, rbp
lea rcx, [rdx + 1]
call fcn.14001a970
mov rax, qword [rbx + 0x18]
mov byte [rax], dil
inc qword [rbx + 0x18]
cmp dword [rbx + 0x30], 0
mov rax, qword [rbx + 0x18]
mov r14, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x30]
jne 0x140008af9
cmp rax, qword [rbx + 0x20]
jae 0x140008b03
mov qword [rbx + 0x20], rax
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
cmp rax, qword [rbx + 0x28]
jbe 0x140008b03
mov qword [rbx + 0x28], rax
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x140008dd0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
lea rcx, [0x14002997b]
xor edx, edx
mov qword [0x14002996c], rax
mov r8d, 0x100
mov dword [0x140029974], eax
mov word [0x140029978], ax
mov byte [0x14002997a], al
call fcn.14001a5b0
mov rdx, qword [0x1400295a8]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop word [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x140008e20
lea rcx, [0x14002996c]
call fcn.14001a970
mov rdx, qword [0x1400295e0]
nop dword [rax]
inc rbx
cmp byte [rdx + rbx], 0
jne 0x140008e40
mov r8, rbx
lea rcx, [0x14002997b]
call fcn.14001a970
call fcn.140008cd0
cmp dword [0x140029938], 5
je 0x140008e9e
xor eax, eax
mov dword [0x140029938], 6
mov qword [rsp + 0x28], rax
lea r8, [0x140005fc0]
xor r9d, r9d
mov dword [rsp + 0x20], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
add rsp, 0x30
pop rbx
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x30
pop rbx
ret