joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401a4e90
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rbx, rdx
mov r14, rcx
mov rdx, qword [rcx]
mov rsi, rbx
sub rsi, rdx
mov rax, qword [rcx + 8]
sub rax, rdx
sar rax, 4
movabs r8, 0xfffffffffffffff
cmp rax, r8
je 0x1401a50a7
lea r12, [rax + 1]
mov rcx, qword [rcx + 0x10]
sub rcx, rdx
sar rcx, 4
mov rdx, rcx
shr rdx, 1
mov rax, r8
sub rax, rdx
cmp rcx, rax
jbe 0x1401a4efb
mov rdi, r12
jmp 0x1401a4f06
lea rdi, [rdx + rcx]
cmp rdi, r12
cmovb rdi, r12
mov qword [rsp + 0x98], rdi
cmp rdi, r8
ja 0x1401a50ad
mov rcx, rdi
shl rcx, 4
call fcn.140004a40
mov r15, rax
mov qword [rsp + 0x38], rax
and rsi, 0xfffffffffffffff0
lea r13, [rsi + rax]
lea rsi, [r13 + 0x10]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x90], rsi
mov ecx, 0x28
call fcn.14036fce4
mov r9, rax
mov rax, qword [rsp + 0xc8]
mov ecx, dword [rax]
mov dword [r9], ecx
mov rax, qword [rsp + 0xc0]
mov ecx, dword [rax]
mov dword [r9 + 4], ecx
mov rax, qword [rsp + 0xb8]
mov ecx, dword [rax]
mov dword [r9 + 8], ecx
mov rax, qword [rsp + 0xb0]
mov rcx, qword [rax]
mov qword [r9 + 0x10], rcx
mov rax, qword [rsp + 0xa8]
mov rax, qword [rax]
mov qword [r9 + 0x18], rax
mov rax, qword [rsp + 0xa0]
mov qword [r9 + 0x20], rax
mov qword [rsp + 0x40], r9
lea rax, [r13 + 8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
lea r8, [0x1401a50e0]
xor edx, edx
xor ecx, ecx
call fcn.14039a510
mov qword [r13], rax
test rax, rax
je 0x1401a5094
mov qword [rsp + 0x90], r13
mov rcx, qword [r14 + 8]
mov rax, qword [r14]
mov rdx, r15
cmp rbx, rcx
jne 0x1401a501b
cmp rax, rcx
je 0x1401a5070
nop dword [rax]
nop word [rax + rax]
xorps xmm0, xmm0
movups xmm1, xmmword [rax]
movups xmmword [rax], xmm0
movups xmmword [rdx], xmm1
lea rdx, [rdx + 0x10]
add rax, 0x10
cmp rax, rcx
jne 0x1401a5000
jmp 0x1401a5070
cmp rax, rbx
je 0x1401a503d
xorps xmm0, xmm0
movups xmm1, xmmword [rax]
movups xmmword [rax], xmm0
movups xmmword [rdx], xmm1
lea rdx, [rdx + 0x10]
add rax, 0x10
cmp rax, rbx
jne 0x1401a5020
mov rcx, qword [r14 + 8]
mov qword [rsp + 0x90], r15
cmp rbx, rcx
je 0x1401a5070
sub rsi, rbx
nop dword [rax]
xorps xmm0, xmm0
movups xmm1, xmmword [rbx]
movups xmmword [rbx], xmm0
movups xmmword [rbx + rsi], xmm1
add rbx, 0x10
cmp rbx, rcx
jne 0x1401a5050
nop word [rax + rax]
mov r9, rdi
mov r8, r12
mov rdx, r15
mov rcx, r14
call fcn.14019c830
mov rax, r13
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov dword [r13 + 8], 0
mov ecx, 6
call fcn.14036d01c
nop
call fcn.140014d90
int3
call fcn.140004800
int3
Function at 0x1401a52d0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x50
mov rsi, rcx
lea rax, vtable.xmrig::RxQueue.0
mov qword [rcx], rax
mov qword [rcx + 8], rdx
xor r14d, r14d
mov qword [rcx + 0x10], r14
mov dword [rcx + 0x18], r14d
mov qword [rcx + 0x20], r14
mov qword [rcx + 0x28], r14
mov qword [rcx + 0x30], r14
mov dword [rcx + 0x38], r14d
add rcx, 0x40
call fcn.14036ea00
nop
lea rcx, [rsi + 0x88]
lea edx, [r14 + 2]
call fcn.14036d318
nop
mov qword [rsi + 0xd8], r14
mov qword [rsi + 0xe0], r14
xorps xmm0, xmm0
movups xmmword [rsi + 0xe8], xmm0
mov qword [rsi + 0xf8], r14
mov qword [rsi + 0x100], r14
mov qword [rsi + 0x108], r14
lea ecx, [r14 + 0x18]
call fcn.14036fce4
mov rdi, rax
mov qword [rsp + 0x78], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], 1
mov dword [rax + 0xc], 1
lea rax, vtable.std::_Ref_count_obj2_class_xmrig::Async_.0
mov qword [rdi], rax
lea rbx, [rdi + 0x10]
mov rdx, rsi
mov rcx, rbx
call fcn.1400168f0
nop
mov qword [rsp + 0x40], rbx
mov qword [rsi + 0xd8], rbx
mov rbp, qword [rsi + 0xe0]
mov qword [rsp + 0x38], rbp
mov qword [rsi + 0xe0], rdi
test rbp, rbp
je 0x1401a53ee
mov ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rbp + 8], eax
cmp eax, 1
jne 0x1401a53ee
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax]
lock xadd dword [rbp + 0xc], ebx
cmp ebx, 1
jne 0x1401a53ee
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + 8]
mov ecx, 0x10
call fcn.14036fce4
mov qword [rax], rsi
lea rcx, [0x1401a5940]
mov qword [rax + 8], rcx
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r14d
mov r9, rax
lea r8, [0x140075e80]
xor edx, edx
xor ecx, ecx
call fcn.14039a510
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1401a546a
cmp dword [rsi + 0xf0], 0
jne 0x1401a5464
movaps xmm0, xmmword [rsp + 0x30]
movups xmmword [rsi + 0xe8], xmm0
mov rax, rsi
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.1403978dc
nop
mov dword [rsp + 0x38], r14d
mov ecx, 6
call fcn.14036d01c
int3
Function at 0x1401a9a50
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov esi, r8d
mov ebp, edx
mov r13, rcx
call fcn.14036d3b0
mov rbx, rax
call fcn.14036d394
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rcx, rax
movabs rax, 0x431bde82d7b634db
imul rcx
mov rbx, rdx
sar rbx, 0x12
mov rax, rbx
shr rax, 0x3f
add rbx, rax
xor r12d, r12d
mov rax, qword [r13 + 0x30]
mov rax, qword [rax]
cmp byte [rax + 0x19], r12b
jne 0x1401a9b22
mov rcx, qword [rax + 0x28]
cmp qword [rcx + 0x10], 0
je 0x1401a9ad1
mov r12d, dword [rax + 0x20]
mov rcx, qword [rax + 0x10]
cmp byte [rcx + 0x19], 0
je 0x1401a9afd
mov rcx, qword [rax + 8]
cmp byte [rcx + 0x19], 0
jne 0x1401a9af8
cmp rax, qword [rcx + 0x10]
jne 0x1401a9af8
mov rax, rcx
mov rcx, qword [rcx + 8]
cmp byte [rcx + 0x19], 0
je 0x1401a9ae5
mov rax, rcx
jmp 0x1401a9b1c
mov rax, rcx
mov rcx, qword [rcx]
cmp byte [rcx + 0x19], 0
jne 0x1401a9b1c
nop dword [rax]
mov rax, rcx
mov rcx, qword [rcx]
cmp byte [rcx + 0x19], 0
je 0x1401a9b10
cmp byte [rax + 0x19], 0
je 0x1401a9ac2
mov edx, r12d
mov rcx, r13
call fcn.1401a94d0
mov rdi, rax
mov qword [rsp + 0x70], rax
lea rdx, [r13 + 0x18]
mov r9d, esi
mov r8d, ebp
mov rcx, rax
call fcn.1401a49d0
mov rdx, rbx
mov ecx, r12d
call fcn.1401a9440
cmp qword [r13 + 0x38], 1
jbe 0x1401a9c9e
mov rbx, qword [r13 + 0x30]
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
jne 0x1401a9c96
lea rdx, [0x1401aa320]
nop word [rax + rax]
lea rsi, [rbx + 0x20]
cmp dword [rsi], r12d
je 0x1401a9c3f
mov rcx, rdi
call fcn.1401a4de0
mov rbp, rax
mov qword [rsp + 0x88], rax
mov r14, qword [r13 + 0x48]
cmp r14, qword [r13 + 0x50]
je 0x1401a9c0e
mov ecx, 0x20
call fcn.14036fce4
mov qword [rax], rbp
mov ecx, dword [rsi]
mov dword [rax + 8], ecx
mov rcx, qword [rsi + 8]
mov qword [rax + 0x10], rcx
lea rcx, [0x1401aa320]
mov qword [rax + 0x18], rcx
mov qword [rsp + 0x88], rax
lea rcx, [r14 + 8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x1401aadd0]
xor edx, edx
xor ecx, ecx
call fcn.14039a510
mov qword [r14], rax
test rax, rax
je 0x1401a9cb8
add qword [r13 + 0x48], 0x10
jmp 0x1401a9c33
lea rax, [rsp + 0x88]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsi + 8]
mov r8, rdx
mov rdx, r14
lea rcx, [r13 + 0x40]
call fcn.1401aab00
lea rdx, [0x1401aa320]
mov rdi, qword [rsp + 0x70]
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
je 0x1401a9c6b
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x1401a9c66
cmp rbx, qword [rax + 0x10]
jne 0x1401a9c66
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x1401a9c53
mov rbx, rax
jmp 0x1401a9c8c
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x1401a9c8c
nop word [rax + rax]
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1401a9c80
cmp byte [rbx + 0x19], 0
je 0x1401a9b80
mov rcx, r13
call fcn.1401aa3d0
mov byte [r13 + 1], 1
mov rbx, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov dword [r14 + 8], 0
mov ecx, 6
call fcn.14036d01c
int3
Function at 0x1401aa7e0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rbx, rdx
mov r14, rcx
mov rdx, qword [rcx]
mov rsi, rbx
sub rsi, rdx
mov rax, qword [rcx + 8]
sub rax, rdx
sar rax, 4
movabs r8, 0xfffffffffffffff
cmp rax, r8
je 0x1401aa9e7
lea r12, [rax + 1]
mov rcx, qword [rcx + 0x10]
sub rcx, rdx
sar rcx, 4
mov rdx, rcx
shr rdx, 1
mov rax, r8
sub rax, rdx
cmp rcx, rax
jbe 0x1401aa84b
mov rdi, r12
jmp 0x1401aa856
lea rdi, [rdx + rcx]
cmp rdi, r12
cmovb rdi, r12
mov qword [rsp + 0x98], rdi
cmp rdi, r8
ja 0x1401aa9ed
mov rcx, rdi
shl rcx, 4
call fcn.140004a40
mov r15, rax
mov qword [rsp + 0x38], rax
and rsi, 0xfffffffffffffff0
lea r13, [rsi + rax]
lea rsi, [r13 + 0x10]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x90], rsi
mov ecx, 0x18
call fcn.14036fce4
mov r9, rax
mov rax, qword [rsp + 0xc0]
movzx ecx, byte [rax]
mov byte [r9], cl
mov rax, qword [rsp + 0xb8]
movzx ecx, byte [rax]
mov byte [r9 + 1], cl
mov rax, qword [rsp + 0xb0]
mov ecx, dword [rax]
mov dword [r9 + 4], ecx
mov rax, qword [rsp + 0xa8]
mov rax, qword [rax]
mov qword [r9 + 8], rax
mov rax, qword [rsp + 0xa0]
mov qword [r9 + 0x10], rax
mov qword [rsp + 0x40], r9
lea rax, [r13 + 8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
lea r8, [0x1401aad90]
xor edx, edx
xor ecx, ecx
call fcn.14039a510
mov qword [r13], rax
test rax, rax
je 0x1401aa9d4
mov qword [rsp + 0x90], r13
mov rcx, qword [r14 + 8]
mov rax, qword [r14]
mov rdx, r15
cmp rbx, rcx
jne 0x1401aa95b
cmp rax, rcx
je 0x1401aa9b0
nop word [rax + rax]
xorps xmm0, xmm0
movups xmm1, xmmword [rax]
movups xmmword [rax], xmm0
movups xmmword [rdx], xmm1
lea rdx, [rdx + 0x10]
add rax, 0x10
cmp rax, rcx
jne 0x1401aa940
jmp 0x1401aa9b0
cmp rax, rbx
je 0x1401aa97d
xorps xmm0, xmm0
movups xmm1, xmmword [rax]
movups xmmword [rax], xmm0
movups xmmword [rdx], xmm1
lea rdx, [rdx + 0x10]
add rax, 0x10
cmp rax, rbx
jne 0x1401aa960
mov rcx, qword [r14 + 8]
mov qword [rsp + 0x90], r15
cmp rbx, rcx
je 0x1401aa9b0
sub rsi, rbx
nop dword [rax]
xorps xmm0, xmm0
movups xmm1, xmmword [rbx]
movups xmmword [rbx], xmm0
movups xmmword [rbx + rsi], xmm1
add rbx, 0x10
cmp rbx, rcx
jne 0x1401aa990
nop word [rax + rax]
mov r9, rdi
mov r8, r12
mov rdx, r15
mov rcx, r14
call fcn.14019c830
mov rax, r13
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov dword [r13 + 8], 0
mov ecx, 6
call fcn.14036d01c
nop
call fcn.140014d90
int3
call fcn.140004800
int3
Function at 0x1401aab00
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rbx, rdx
mov r14, rcx
mov rdx, qword [rcx]
mov rsi, rbx
sub rsi, rdx
mov rax, qword [rcx + 8]
sub rax, rdx
sar rax, 4
movabs r8, 0xfffffffffffffff
cmp rax, r8
je 0x1401aacf7
lea r12, [rax + 1]
mov rcx, qword [rcx + 0x10]
sub rcx, rdx
sar rcx, 4
mov rdx, rcx
shr rdx, 1
mov rax, r8
sub rax, rdx
cmp rcx, rax
jbe 0x1401aab6b
mov rdi, r12
jmp 0x1401aab76
lea rdi, [rdx + rcx]
cmp rdi, r12
cmovb rdi, r12
mov qword [rsp + 0x98], rdi
cmp rdi, r8
ja 0x1401aacfd
mov rcx, rdi
shl rcx, 4
call fcn.140004a40
mov r15, rax
mov qword [rsp + 0x38], rax
and rsi, 0xfffffffffffffff0
lea r13, [rsi + rax]
lea rsi, [r13 + 0x10]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x90], rsi
mov ecx, 0x20
call fcn.14036fce4
mov r9, rax
mov rax, qword [rsp + 0xb8]
mov rcx, qword [rax]
mov qword [r9], rcx
mov rax, qword [rsp + 0xb0]
mov ecx, dword [rax]
mov dword [r9 + 8], ecx
mov rax, qword [rsp + 0xa8]
mov rax, qword [rax]
mov qword [r9 + 0x10], rax
mov rax, qword [rsp + 0xa0]
mov qword [r9 + 0x18], rax
mov qword [rsp + 0x40], r9
lea rax, [r13 + 8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
lea r8, [0x1401aadd0]
xor edx, edx
xor ecx, ecx
call fcn.14039a510
mov qword [r13], rax
test rax, rax
je 0x1401aace4
mov qword [rsp + 0x90], r13
mov rcx, qword [r14 + 8]
mov rax, qword [r14]
mov rdx, r15
cmp rbx, rcx
jne 0x1401aac6b
cmp rax, rcx
je 0x1401aacc0
nop word [rax + rax]
xorps xmm0, xmm0
movups xmm1, xmmword [rax]
movups xmmword [rax], xmm0
movups xmmword [rdx], xmm1
lea rdx, [rdx + 0x10]
add rax, 0x10
cmp rax, rcx
jne 0x1401aac50
jmp 0x1401aacc0
cmp rax, rbx
je 0x1401aac8d
xorps xmm0, xmm0
movups xmm1, xmmword [rax]
movups xmmword [rax], xmm0
movups xmmword [rdx], xmm1
lea rdx, [rdx + 0x10]
add rax, 0x10
cmp rax, rbx
jne 0x1401aac70
mov rcx, qword [r14 + 8]
mov qword [rsp + 0x90], r15
cmp rbx, rcx
je 0x1401aacc0
sub rsi, rbx
nop dword [rax]
xorps xmm0, xmm0
movups xmm1, xmmword [rbx]
movups xmmword [rbx], xmm0
movups xmmword [rbx + rsi], xmm1
add rbx, 0x10
cmp rbx, rcx
jne 0x1401aaca0
nop word [rax + rax]
mov r9, rdi
mov r8, r12
mov rdx, r15
mov rcx, r14
call fcn.14019c830
mov rax, r13
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov dword [r13 + 8], 0
mov ecx, 6
call fcn.14036d01c
nop
call fcn.140014d90
int3
call fcn.140004800
int3
Function at 0x1401aaf30
Capabilities:
Delete service
Stop service

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x140546618]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, rcx
mov rcx, qword [rcx + 8]
cmp rcx, 0xffffffffffffffff
je 0x1401aaf58
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
jne 0x1401aaf76
mov al, 1
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14036fcc0
add rsp, 0x50
pop rbx
ret
mov qword [rsp + 0x68], rsi
xor esi, esi
mov qword [rsp + 0x70], rdi
mov dil, 1
cmp byte [rbx], sil
jne 0x1401aafd1
lea r8, [rsp + 0x20]
lea edx, [rsi + 1]
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov rcx, qword [rbx + 0x18]
test eax, eax
movzx edi, dil
cmove edi, esi
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x1401aafd1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, str.e_43_1me_1_37m_msr_____e_0m
lea rdx, str._s_e_0_31mfailed_to_remove_WinRing0_driver__error__ue_0m
lea ecx, [rsi + 3]
call fcn.140027890
xor dil, dil
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
movzx eax, dil
mov qword [rbx + 0x18], rsi
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14036fcc0
add rsp, 0x50
pop rbx
ret
Function at 0x1401acd20
Capabilities:
Contain obfuscated stackstrings
Encrypt data using salsa20 or chacha

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x140546618]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov eax, dword [rcx + 0xc]
mov rbx, rdx
mov dword [rsp + 0x30], eax
xor edx, edx
mov eax, dword [rcx + 0x1c]
mov rdi, r8
mov dword [rsp + 0x38], eax
mov eax, dword [rcx + 8]
mov dword [rsp + 0x3c], eax
mov eax, dword [rcx + 0x18]
mov dword [rsp + 0x44], eax
mov eax, dword [rcx + 4]
mov dword [rsp + 0x48], eax
mov eax, dword [rcx + 0x14]
mov dword [rsp + 0x50], eax
mov eax, dword [rcx]
mov dword [rsp + 0x54], eax
mov eax, dword [rcx + 0x10]
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x34], edx
mov dword [rsp + 0x40], edx
mov dword [rsp + 0x4c], edx
mov dword [rsp + 0x58], edx
mov rdx, rbx
mov dword [rsp + 0x20], 0x61707865
mov dword [rsp + 0x24], 0x3320646e
mov dword [rsp + 0x28], 0x79622d32
mov dword [rsp + 0x2c], 0x6b206574
mov dword [rsp + 0x5c], eax
call fcn.1401b04f0
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rbx - 0x10], xmm0
movups xmmword [rdi + rbx], xmm1
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14036fcc0
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret

Function at 0x1401acde0
Capabilities:
Contain obfuscated stackstrings
Encrypt data using salsa20 or chacha

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x140546618]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, r8
mov rbx, rdx
test r8, r8
je 0x1401ace8e
mov eax, dword [rcx]
xor edx, edx
mov dword [rsp + 0x34], eax
mov eax, dword [rcx + 4]
mov dword [rsp + 0x48], eax
mov eax, dword [rcx + 8]
mov dword [rsp + 0x5c], eax
mov eax, dword [rcx + 0xc]
mov dword [rsp + 0x50], eax
mov eax, dword [rcx + 0x10]
mov dword [rsp + 0x3c], eax
mov eax, dword [rcx + 0x14]
mov dword [rsp + 0x30], eax
mov eax, dword [rcx + 0x18]
mov dword [rsp + 0x44], eax
mov eax, dword [rcx + 0x1c]
mov rcx, rbx
mov dword [rsp + 0x58], eax
xor eax, eax
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x4c], eax
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x54], eax
mov dword [rsp + 0x20], 0x61707865
mov dword [rsp + 0x24], 0x3320646e
mov dword [rsp + 0x28], 0x79622d32
mov dword [rsp + 0x2c], 0x6b206574
call fcn.14038ebe0
mov r9, rdi
lea rcx, [rsp + 0x20]
mov r8, rbx
mov rdx, rbx
call fcn.1401ae850
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rbx - 0x10], xmm0
movups xmmword [rdi + rbx], xmm1
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14036fcc0
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
Function at 0x1401b1a30
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], r8
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rbx, rdx
mov r14, rcx
mov rdx, qword [rcx]
mov rsi, rbx
sub rsi, rdx
mov rax, qword [rcx + 8]
sub rax, rdx
sar rax, 4
movabs r8, 0xfffffffffffffff
cmp rax, r8
je 0x1401b1c1c
lea r13, [rax + 1]
mov rcx, qword [rcx + 0x10]
sub rcx, rdx
sar rcx, 4
mov rdx, rcx
shr rdx, 1
mov rax, r8
sub rax, rdx
cmp rcx, rax
jbe 0x1401b1a96
mov rdi, r13
jmp 0x1401b1aa1
lea rdi, [rdx + rcx]
cmp rdi, r13
cmovb rdi, r13
mov qword [rsp + 0xa8], rdi
cmp rdi, r8
ja 0x1401b1c22
mov rcx, rdi
shl rcx, 4
call fcn.140004a40
mov r15, rax
mov qword [rsp + 0x38], rax
and rsi, 0xfffffffffffffff0
lea r12, [rsi + rax]
mov qword [rsp + 0x98], r12
lea rsi, [r12 + 0x10]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x90], rsi
mov ecx, 0x18
call fcn.14036fce4
mov rcx, qword [rsp + 0xa0]
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movsd xmm1, qword [rcx + 0x10]
movsd qword [rax + 0x10], xmm1
mov qword [rsp + 0x40], rax
add r12, 8
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x1401b1c30]
xor edx, edx
xor ecx, ecx
call fcn.14039a510
mov rcx, qword [rsp + 0x98]
mov qword [rcx], rax
test rax, rax
je 0x1401b1c09
mov qword [rsp + 0x90], rcx
mov rcx, qword [r14 + 8]
mov rax, qword [r14]
mov rdx, r15
cmp rbx, rcx
jne 0x1401b1b8b
cmp rax, rcx
je 0x1401b1be0
nop dword [rax]
nop word [rax + rax]
xorps xmm0, xmm0
movups xmm1, xmmword [rax]
movups xmmword [rax], xmm0
movups xmmword [rdx], xmm1
lea rdx, [rdx + 0x10]
add rax, 0x10
cmp rax, rcx
jne 0x1401b1b70
jmp 0x1401b1be0
cmp rax, rbx
je 0x1401b1bad
xorps xmm0, xmm0
movups xmm1, xmmword [rax]
movups xmmword [rax], xmm0
movups xmmword [rdx], xmm1
lea rdx, [rdx + 0x10]
add rax, 0x10
cmp rax, rbx
jne 0x1401b1b90
mov rcx, qword [r14 + 8]
mov qword [rsp + 0x90], r15
cmp rbx, rcx
je 0x1401b1be0
sub rsi, rbx
nop dword [rax]
xorps xmm0, xmm0
movups xmm1, xmmword [rbx]
movups xmmword [rbx], xmm0
movups xmmword [rsi + rbx], xmm1
add rbx, 0x10
cmp rbx, rcx
jne 0x1401b1bc0
nop word [rax + rax]
mov r9, rdi
mov r8, r13
mov rdx, r15
mov rcx, r14
call fcn.14019c830
mov rax, qword [rsp + 0x98]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov dword [r12], 0
mov ecx, 6
call fcn.14036d01c
nop
call fcn.140014d90
int3
call fcn.140004800
int3
Function at 0x1401b8530
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rdx + 0x3f8]
lea r8, [rcx + 0x3f8]
cmp rcx, rax
ja 0x1401b8572
xor r9d, r9d
cmp r8, rdx
jb 0x1401b8572
mov r8d, 0x80
lea rax, [rcx + r9*8]
sub rdx, rcx
sub r8, r9
nop dword [rax + rax]
mov rcx, qword [rax + rdx]
xor qword [rax], rcx
lea rax, [rax + 8]
sub r8, 1
jne 0x1401b8560
ret
lea rax, [rcx + 0x10]
sub rdx, rcx
mov ecx, 0x10
nop
movdqu xmm0, xmmword [rax - 0x10]
movdqu xmm1, xmmword [rdx + rax - 0x10]
movdqu xmm2, xmmword [rdx + rax]
lea rax, [rax + 0x40]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x50], xmm1
movdqu xmm0, xmmword [rax - 0x40]
movdqu xmm1, xmmword [rdx + rax - 0x30]
pxor xmm2, xmm0
movdqu xmmword [rax - 0x40], xmm2
movdqu xmm0, xmmword [rax - 0x30]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x30], xmm1
movdqu xmm0, xmmword [rax - 0x20]
movdqu xmm1, xmmword [rdx + rax - 0x20]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x20], xmm1
sub rcx, 1
jne 0x1401b8580
ret
Function at 0x1401c0388
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r15
sub rsp, 0x80
mov rax, qword [0x140546618]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, rdx
mov rsi, rcx
test dl, 0x3f
je 0x1401c03b7
xor al, al
jmp 0x1401c04d4
mov r15d, 0x40
shr rbx, 6
mov dword [rsp + 0x28], r15d
mov ecx, 0x200
mov qword [rsp + 0x20], rsi
lea edx, [r15 - 0x3f]
lea r9d, [r15 - 0x20]
call fcn.1400167b0
lea edi, [r15 - 0x3f]
cmp ebx, edi
je 0x1401c041b
mov ecx, edi
lea r8d, [rdi - 1]
shl rcx, 6
mov r9d, r15d
add rcx, rsi
shl r8, 6
mov dword [rsp + 0x28], r15d
add r8, rsi
mov qword [rsp + 0x20], rcx
mov edx, 1
mov ecx, 0x200
call fcn.1400167b0
inc edi
cmp edi, ebx
jne 0x1401c03e5
mov ebp, 3
xor edi, edi
test ebx, ebx
je 0x1401c04c8
xor edx, edx
mov r9d, edi
shl r9, 6
add r9, rsi
mov eax, dword [r9]
div ebx
lea eax, [rbx - 1]
mov r8d, edx
add eax, edi
xor edx, edx
shl r8, 6
div ebx
mov ecx, edx
lea rdx, [rsp + 0x30]
shl rcx, 6
sub r8, rdx
add r8, rsi
mov edx, 0x10
movups xmm0, xmmword [rcx + rsi]
movups xmm1, xmmword [rcx + rsi + 0x10]
movaps xmmword [rsp + 0x30], xmm0
movups xmm0, xmmword [rcx + rsi + 0x20]
movaps xmmword [rsp + 0x40], xmm1
movups xmm1, xmmword [rcx + rsi + 0x30]
lea rcx, [rsp + 0x30]
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x60], xmm1
mov eax, dword [r8 + rcx]
xor dword [rcx], eax
lea rcx, [rcx + 4]
sub rdx, 1
jne 0x1401c048d
mov dword [rsp + 0x28], r15d
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], r9
mov edx, 1
mov r9d, r15d
mov ecx, 0x200
call fcn.1400167b0
inc edi
cmp edi, ebx
jne 0x1401c042a
sub rbp, 1
jne 0x1401c0420
mov al, 1
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14036fcc0
add rsp, 0x80
pop r15
pop rdi
pop rsi
pop rbp
pop rbx
ret