joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800ffe70
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x180163880]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbp, r8
mov dword [rsp + 0x20], 0xf0000040
mov rsi, rdx
mov rdi, rcx
xor r8d, r8d
lea rcx, [rsp + 0x38]
xor edx, edx
mov r9d, Ordinal_27
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x1800ffebc
mov eax, reloc.WLDAP32.dll_Ordinal_27
jmp 0x1800fff8e
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x1800fff00
mov rcx, qword [rsp + 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 2
mov qword [rsp + 0x38], 0
jmp 0x1800fff8e
mov rcx, rbp
call fcn.1800bc500
mov rcx, qword [rsp + 0x40]
xor r9d, r9d
mov r8d, eax
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x20], 0
lea edx, [r8 + 2]
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp dword [rsp + 0x30], 0x20
jne 0x1800fff6a
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x30]
mov r8, rdi
mov dword [rsp + 0x20], 0
mov edx, 2
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1800fff7a
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1800fff8c
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180104980
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret

Function at 0x180100d50
Capabilities:
Encode data using xor

Disassembly:
mov r10, rcx
test rdx, rdx
je 0x180100db5
nop dword [rax + rax]
movzx r8d, byte [r10]
lea r10, [r10 + 1]
movzx eax, r8b
movzx r9d, r8b
shr r9b, 1
and al, 0xfe
not r9b
movzx eax, al
xor r9b, r8b
shr r9b, 1
xor r9b, r8b
shr r9b, 1
xor r9b, r8b
shr r9b, 1
xor r9b, r8b
shr r9b, 1
xor r9b, r8b
shr r9b, 1
xor r9b, r8b
or r8b, 1
test r9b, 2
movzx ecx, r8b
cmove ecx, eax
mov byte [r10 - 1], cl
sub rdx, 1
jne 0x180100d60
ret
Function at 0x1801010a0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x78]
sub rax, 0x10000
mov rcx, rax
call fcn.1801012f0
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x70]
cmp qword [rsp + 0x20], rax
jbe 0x1801011ba
mov rax, qword [0x180163830]
cmp qword [rsp + 0x20], rax
jb 0x180101104
mov rax, qword [0x180163838]
cmp qword [rsp + 0x20], rax
ja 0x180101104
mov rax, qword [rsp + 0x20]
sub rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x1801010c6
mov r8d, Ordinal_50
xor edx, edx
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
mov r8d, Ordinal_50
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualQuery
test rax, rax
jne 0x180101135
jmp 0x1801011ba
cmp dword [rsp + 0x50], 0x10000
jne 0x18010119d
cmp qword [rsp + 0x48], 0x10000
jb 0x18010119d
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualAlloc
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x18010117b
mov rax, qword [rsp + 0x28]
jmp 0x1801011bc
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x18010118b
xor eax, eax
jmp 0x1801011bc
mov rax, qword [rsp + 0x20]
sub rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x1801011b5
mov rax, qword [rsp + 0x38]
sub rax, 0x10000
mov rcx, rax
call fcn.1801012f0
mov qword [rsp + 0x20], rax
jmp 0x1801010c6
xor eax, eax
add rsp, 0x68
ret

Function at 0x1801011d0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rcx, qword [rsp + 0x70]
call fcn.180101330
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x78]
cmp qword [rsp + 0x20], rax
jae 0x1801012e6
mov rax, qword [0x180163830]
cmp qword [rsp + 0x20], rax
jb 0x18010122b
mov rax, qword [0x180163838]
cmp qword [rsp + 0x20], rax
ja 0x18010122b
mov rax, qword [rsp + 0x20]
add rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x1801011ed
mov r8d, Ordinal_50
xor edx, edx
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
mov r8d, Ordinal_50
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualQuery
test rax, rax
jne 0x18010125c
jmp 0x1801012e6
cmp dword [rsp + 0x50], 0x10000
jne 0x1801012c4
cmp qword [rsp + 0x48], 0x10000
jb 0x1801012c4
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualAlloc
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1801012a2
mov rax, qword [rsp + 0x28]
jmp 0x1801012e8
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x1801012b2
xor eax, eax
jmp 0x1801012e8
mov rax, qword [rsp + 0x20]
add rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x1801012e1
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.180101330
mov qword [rsp + 0x20], rax
jmp 0x1801011ed
xor eax, eax
add rsp, 0x68
ret
Function at 0x180101380
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.180101910
mov qword [rsp + 0x28], 0
cmp qword [0x180165ff8], 0
jne 0x1801013c8
cmp qword [0x180165ff0], 0
je 0x1801013c8
mov rax, qword [0x180165ff0]
mov qword [0x180165ff8], rax
cmp qword [0x180165ff8], 0
je 0x18010146e
mov rax, qword [0x180165ff8]
cmp qword [rax + 0x10], 0
je 0x18010146e
mov rax, qword [0x180165ff8]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x18010146e
mov rax, qword [0x180165ff8]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x18010146e
mov rax, qword [0x180165ff8]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x28], rax
jb 0x180101434
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x28], rax
jbe 0x18010143b
xor eax, eax
jmp 0x1801015e9
mov rax, qword [0x180165ff8]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x48]
mov qword [rax + 0x10], rcx
mov r8d, 0x60
mov edx, 0xcc
mov rcx, qword [rsp + 0x28]
call sub.VCRUNTIME140.dll_memset
mov rax, qword [rsp + 0x28]
jmp 0x1801015e9
mov rax, qword [0x180165ff0]
mov qword [0x180165ff8], rax
jmp 0x180101490
mov rax, qword [0x180165ff8]
mov rax, qword [rax + 8]
mov qword [0x180165ff8], rax
cmp qword [0x180165ff8], 0
je 0x1801014dd
cmp qword [0x180165ff8], 0
je 0x1801014db
mov rax, qword [0x180165ff8]
cmp qword [rax + 0x10], 0
je 0x1801014db
mov rax, qword [0x180165ff8]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x1801014db
mov rax, qword [0x180165ff8]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x1801014db
jmp 0x18010140c
jmp 0x18010147e
mov rcx, qword [rsp + 0x60]
call fcn.180103560
and eax, 0xffff
mov eax, eax
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.1801015f0
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x1801015e7
mov rax, qword [rsp + 0x48]
mov qword [0x180165ff8], rax
mov rax, qword [0x180165ff8]
mov dword [rax], 0x52727464
mov rax, qword [0x180165ff8]
mov qword [rax + 0x10], 0
mov rax, qword [0x180165ff8]
mov rcx, qword [0x180165ff0]
mov qword [rax + 8], rcx
mov rax, qword [0x180165ff8]
mov qword [0x180165ff0], rax
mov qword [rsp + 0x40], 0
mov rax, qword [0x180165ff8]
add rax, 0x60
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x2a8
jmp 0x180101598
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 1
jle 0x1801015d2
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x40]
mov qword [rcx + rax + 0x48], rdx
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
jmp 0x18010158e
mov rax, qword [0x180165ff8]
mov rcx, qword [rsp + 0x40]
mov qword [rax + 0x10], rcx
jmp 0x18010140c
xor eax, eax
add rsp, 0x58
ret
Function at 0x180102300
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov r8d, Ordinal_50
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x80]
call sub.KERNEL32.dll_VirtualQuery
nop
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x180102347
xor al, al
jmp 0x1801023e9
mov rax, qword [rsp + 0x28]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x180102371
xor al, al
jmp 0x1801023e9
mov eax, 8
imul rax, rax, 0xc
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
cmp qword [rsp + 0x88], rax
jb 0x1801023e1
mov eax, 8
imul rax, rax, 0xc
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov ecx, 8
imul rcx, rcx, 0xc
mov rdx, qword [rsp + 0x30]
mov ecx, dword [rdx + rcx + 0x8c]
add rax, rcx
cmp qword [rsp + 0x88], rax
jae 0x1801023e1
mov al, 1
jmp 0x1801023e9
jmp 0x1801023e7
xor al, al
add rsp, 0x78
ret

Function at 0x1801026f0
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x38
mov rax, qword [0x180165ff0]
mov qword [rsp + 0x28], rax
jmp 0x180102710
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 8]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x18010273f
lea r9, [rsp + 0x20]
mov r8d, 0x40
mov edx, 0x10000
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x18010273d
call sub.KERNEL32.dll_GetLastError
jmp 0x180102741
jmp 0x180102702
xor eax, eax
add rsp, 0x38
ret
Function at 0x180102e00
Capabilities:
Resume thread

Disassembly:
sub rsp, 0x68
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x180166008], eax
je 0x180102e1b
mov eax, 0x10dd
jmp 0x180102f40
mov rax, qword [0x180166020]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x180102ec5
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x20]
movzx eax, byte [rax + 0x3e]
lea r9, [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov r8d, dword [rcx + 0x28]
mov edx, eax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x18]
call sub.KERNEL32.dll_VirtualProtect
mov rax, qword [rsp + 0x28]
cmp dword [rax + 8], 0
jne 0x180102e90
mov rax, qword [rsp + 0x28]
cmp qword [rax + 0x20], 0
je 0x180102e90
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x20]
call fcn.180101a50
mov rax, qword [rsp + 0x28]
mov qword [rax + 0x20], 0
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov edx, Ordinal_50
mov rcx, qword [rsp + 0x38]
call fcn.180104e24
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x28], rax
jmp 0x180102e27
mov qword [0x180166020], 0
call fcn.1801024b0
mov rax, qword [0x180166018]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x180102f29
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
call sub.KERNEL32.dll_ResumeThread
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov edx, reloc.WS2_32.dll_recv
mov rcx, qword [rsp + 0x48]
call fcn.180104e24
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
jmp 0x180102ee1
mov qword [0x180166018], 0
mov dword [0x180166008], 0
xor eax, eax
add rsp, 0x68
ret
Function at 0x180103470
Capabilities:
Suspend thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
cmp dword [0x18016600c], 0
je 0x18010348d
mov eax, dword [0x18016600c]
jmp 0x180103553
call sub.KERNEL32.dll_GetCurrentThread
cmp qword [rsp + 0x50], rax
jne 0x1801034a0
xor eax, eax
jmp 0x180103553
mov ecx, reloc.WS2_32.dll_recv
call fcn.1801049a0
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x18010350e
mov dword [rsp + 0x20], 8
cmp qword [rsp + 0x28], 0
je 0x1801034f3
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov edx, reloc.WS2_32.dll_recv
mov rcx, qword [rsp + 0x38]
call fcn.180104e24
mov qword [rsp + 0x28], 0
mov eax, dword [rsp + 0x20]
mov dword [0x18016600c], eax
mov qword [0x180166010], 0
mov eax, dword [rsp + 0x20]
jmp 0x180103553
mov rcx, qword [rsp + 0x50]
call sub.KERNEL32.dll_SuspendThread
cmp eax, 0xffffffff
jne 0x180103528
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
jmp 0x1801034c9
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
mov qword [rax + 8], rcx
mov rax, qword [rsp + 0x28]
mov rcx, qword [0x180166018]
mov qword [rax], rcx
mov rax, qword [rsp + 0x28]
mov qword [0x180166018], rax
xor eax, eax
add rsp, 0x48
ret

Function at 0x180105a50
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x180105a8a
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x180105a8f
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x180105ad8
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, reloc.WS2_32.dll_accept
cmp byte [rcx + rax], 0
je 0x180105ad8
dec r8
sub rdx, 1
jne 0x180105abe
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x141126058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1411261df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141126089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14112606f
add dl, dl
jne 0x141126096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1411260f6
xor eax, eax
add dl, dl
jne 0x1411260a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1411261ad
add dl, dl
jne 0x1411260b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1411260c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1411260d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1411260dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1411260ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14112607e
mov eax, 1
add dl, dl
jne 0x141126106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141126113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1411260fb
sub eax, ebx
mov ebx, 1
jne 0x14112614c
mov ecx, 1
add dl, dl
jne 0x14112612e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14112613b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141126123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14112607e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141126168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141126175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14112615d
cmp eax, 0x7d00
jae 0x14112619b
cmp eax, 0x500
jb 0x141126196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14112607e
cmp eax, 0x7f
ja 0x14112619e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14112607e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1411261d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14112607e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400449e0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x1400449ed
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x1400449fd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x1400449e5
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x140044a15
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140044a02
sub eax, 3
jb 0x140044a2f
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x140044a66
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x140044a56
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x140044a54
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x140044a43
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.1400449a2
jmp 0x1400449ed
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x7400
mov dl, 5
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x140044ab2
cmp rsi, rcx
jae 0x140044aba
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x140044a99
cmp al, 0x8f
ja 0x140044a99
cmp byte [rsi - 2], 0xf
je 0x140044a9f
sub al, 0xe8
cmp al, 1
ja 0x140044a83
cmp rsi, rcx
jae 0x140044aba
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x140044a89
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x140044aba
lodsb al, byte [rsi]
jmp 0x140044a99
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x42000]
mov eax, dword [rdi]
or eax, eax
je 0x140044b17
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x444ec]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140044ac7
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140044b11
mov qword [rbx], rax
add rbx, 8
jmp 0x140044ae7
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x140044b51
cmp al, 0xef
ja 0x140044b43
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140044b23
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x140044b32
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.140044bd0], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.140044bd0
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140044bc0
sub rsp, 0xffffffffffffff80
jmp 0x1400013e0
Function at 0x140001500
Capabilities:
Encode data using xor

Disassembly:
xor eax, dword [r15]
xor ebx, dword [r15 + 4]
xor ecx, dword [r15 + 8]
xor edx, dword [r15 + 0xc]
mov r13d, dword [r15 + 0xf0]
sub r13d, 1
jmp 0x140001520
movzx esi, al
movzx edi, bl
movzx ebp, cl
mov r10d, dword [r14 + rsi*8]
mov r11d, dword [r14 + rdi*8]
mov r12d, dword [r14 + rbp*8]
movzx esi, bh
movzx edi, ch
movzx ebp, dl
xor r10d, dword [r14 + rsi*8 + 3]
xor r11d, dword [r14 + rdi*8 + 3]
mov r8d, dword [r14 + rbp*8]
movzx esi, dh
shr ecx, 0x10
movzx ebp, ah
xor r12d, dword [r14 + rsi*8 + 3]
shr edx, 0x10
xor r8d, dword [r14 + rbp*8 + 3]
shr ebx, 0x10
lea r15, [r15 + 0x10]
shr eax, 0x10
movzx esi, cl
movzx edi, dl
movzx ebp, al
xor r10d, dword [r14 + rsi*8 + 2]
xor r11d, dword [r14 + rdi*8 + 2]
xor r12d, dword [r14 + rbp*8 + 2]
movzx esi, dh
movzx edi, ah
movzx ebp, bl
xor r10d, dword [r14 + rsi*8 + 1]
xor r11d, dword [r14 + rdi*8 + 1]
xor r8d, dword [r14 + rbp*8 + 2]
mov edx, dword [r15 + 0xc]
movzx edi, bh
movzx ebp, ch
mov eax, dword [r15]
xor r12d, dword [r14 + rdi*8 + 1]
xor r8d, dword [r14 + rbp*8 + 1]
mov ebx, dword [r15 + 4]
mov ecx, dword [r15 + 8]
xor eax, r10d
xor ebx, r11d
xor ecx, r12d
xor edx, r8d
sub r13d, 1
jne 0x140001520
movzx esi, al
movzx edi, bl
movzx ebp, cl
movzx r10d, byte [r14 + rsi*8 + 2]
movzx r11d, byte [r14 + rdi*8 + 2]
movzx r12d, byte [r14 + rbp*8 + 2]
movzx esi, dl
movzx edi, bh
movzx ebp, ch
movzx r8d, byte [r14 + rsi*8 + 2]
mov edi, dword [r14 + rdi*8]
mov ebp, dword [r14 + rbp*8]
and edi, 0xff00
and ebp, 0xff00
xor r10d, edi
xor r11d, ebp
shr ecx, 0x10
movzx esi, dh
movzx edi, ah
shr edx, 0x10
mov esi, dword [r14 + rsi*8]
mov edi, dword [r14 + rdi*8]
and esi, 0xff00
and edi, 0xff00
shr ebx, 0x10
xor r12d, esi
xor r8d, edi
shr eax, 0x10
movzx esi, cl
movzx edi, dl
movzx ebp, al
mov esi, dword [r14 + rsi*8]
mov edi, dword [r14 + rdi*8]
mov ebp, dword [r14 + rbp*8]
and esi, 0xff0000
and edi, 0xff0000
and ebp, 0xff0000
xor r10d, esi
xor r11d, edi
xor r12d, ebp
movzx esi, bl
movzx edi, dh
movzx ebp, ah
mov esi, dword [r14 + rsi*8]
mov edi, dword [r14 + rdi*8 + 2]
mov ebp, dword [r14 + rbp*8 + 2]
and esi, 0xff0000
and edi, 0xff000000
and ebp, 0xff000000
xor r8d, esi
xor r10d, edi
xor r11d, ebp
movzx esi, bh
movzx edi, ch
mov edx, dword [r15 + 0x1c]
mov esi, dword [r14 + rsi*8 + 2]
mov edi, dword [r14 + rdi*8 + 2]
mov eax, dword [r15 + 0x10]
and esi, 0xff000000
and edi, 0xff000000
xor r12d, esi
xor r8d, edi
mov ebx, dword [r15 + 0x14]
mov ecx, dword [r15 + 0x18]
xor eax, r10d
xor ebx, r11d
xor ecx, r12d
xor edx, r8d
repz ret
Function at 0x1400460c0
Capabilities:
Encode data using xor

Disassembly:
sub rdx, r8
sub rcx, r8
mov r10, r9
shr r9, 4
je 0x1400460f5
nop
movdqu xmm0, xmmword [rdx + r8]
pxor xmm0, xmmword [r8]
movdqu xmmword [rcx + r8], xmm0
movdqa xmmword [r8], xmm0
lea r8, [r8 + 0x10]
dec r9
jne 0x1400460d0
and r10, 0xf
je 0x140046125
mov r9d, reloc.WS2_32.dll_recv
sub r9, r10
xor eax, eax
mov al, byte [rdx + r8]
xor al, byte [r8]
mov byte [rcx + r8], al
mov byte [r8], al
lea r8, [r8 + 1]
dec r10
jne 0x140046100
xor eax, eax
mov byte [r8], al
lea r8, [r8 + 1]
dec r9
jne 0x140046119
mov rax, r8
repz ret

Function at 0x140046130
Capabilities:
Encode data using xor

Disassembly:
sub rdx, r8
sub rcx, r8
mov r10, r9
shr r9, 4
je 0x14004616d
nop
movdqu xmm0, xmmword [rdx + r8]
movdqa xmm1, xmmword [r8]
pxor xmm1, xmm0
movdqu xmmword [rcx + r8], xmm1
movdqa xmmword [r8], xmm0
lea r8, [r8 + 0x10]
dec r9
jne 0x140046140
pxor xmm1, xmm1
and r10, 0xf
je 0x1400461a3
mov r9d, reloc.WS2_32.dll_recv
sub r9, r10
xor eax, eax
xor r11, r11
mov r11b, byte [rdx + r8]
mov al, byte [r8]
xor al, r11b
mov byte [rcx + r8], al
mov byte [r8], r11b
lea r8, [r8 + 1]
dec r10
jne 0x14004617b
xor eax, eax
mov byte [r8], al
lea r8, [r8 + 1]
dec r9
jne 0x140046197
mov rax, r8
repz ret
Function at 0x14012ef10
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x50
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x60], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [rsp + 0x24]
xor ecx, ecx
lea r9d, [rcx + 0x40]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
mov qword [rsp + 0x68], rax
test rax, rax
je 0x14012efb3
mov byte [rax], 0xc3
mov edx, dword [rsp + 0x24]
lea r9, [rsp + 0x60]
mov r8d, 0x140
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x14012efb3
call rbx
nop
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, 1
add rsp, 0x50
pop rbx
ret
xor eax, eax
add rsp, 0x50
pop rbx
ret