joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140066300
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x140d87b80]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x140d87516], 0
je 0x140066336
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x140d88000]
aesenc xmm0, xmmword [0x140d88010]
aesenc xmm0, xmmword [0x140d88020]
movq rax, xmm0
ret
jmp 0x14000a880

Function at 0x1404065a0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140d2a880]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1404065c0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1404065c8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1404065c0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
movzx edx, word [r8 + 6]
lea rax, [r8 + rax + 0x18]
test edx, edx
je 0x140406615
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x14040660c
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1404065c0
add rax, 0x28
cmp rax, r9
jne 0x1404065f8
xor eax, eax
ret

Function at 0x140406620
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140d2a880]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x140406640
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140406648
mov eax, r8d
ret
cmp word [rax + 0x18], 0x20b
jne 0x140406640
movzx r8d, word [rax + 6]
mov eax, r8d
ret

Function at 0x1404066d0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140d2a880]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x1404066f0
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x1404066f8
mov rax, r8
ret
cmp word [rdx + 0x18], 0x20b
cmove r8, rax
mov rax, r8
ret
Function at 0x1400054d0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
mov eax, 0x8080
call fcn.140037250
sub rsp, rax
mov rax, qword [0x14005b740]
xor rax, rsp
mov qword [rsp + 0x8060], rax
mov ebx, ecx
lea r8, [rsp + 0x80a0]
lea rcx, [rsp + 0x60]
call fcn.14002bccc
cmp ebx, dword [0x140061d54]
jg 0x140005525
lea rcx, [rsp + 0x60]
call fcn.140005330
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
lea rcx, [0x140066358]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rsp + 0x48]
lea rcx, [0x140066358]
mov qword [0x140061d58], rax
mov rax, qword [rsp + 0x50]
mov qword [0x140061d60], rax
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp byte [0x14005eba0], 0
je 0x14000569b
or rbx, 0xffffffffffffffff
lea rcx, [rsp + 0x60]
mov rax, rbx
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x140005580
dec eax
movsxd rcx, eax
cmp rcx, 0x4000
jae 0x1400056b4
mov qword [rsp + 0x8078], rdi
mov byte [rsp + rcx + 0x60], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
movzx ecx, word [rsp + 0x56]
movzx edx, word [rsp + 0x54]
movzx r9d, word [rsp + 0x52]
movzx r8d, word [rsp + 0x50]
lea r10, [rsp + 0x60]
mov qword [rsp + 0x38], r10
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], edx
lea rcx, [rsp + 0x4060]
lea rdx, str._.2d:_.2d:_.2d:_.3d_t_x_t_s_r_n
call fcn.14002aef0
lea rcx, [0x140066358]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor r9d, r9d
mov qword [rsp + 0x30], 0
lea rcx, [0x14005eba0]
lea r8d, [r9 + 1]
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140005686
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea rax, [rsp + 0x4060]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140005652
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x4060]
mov r8, rbx
mov rcx, rdi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x140066358]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rdi, qword [rsp + 0x8078]
mov rcx, qword [rsp + 0x8060]
xor rcx, rsp
call fcn.14002aed0
add rsp, 0x8080
pop rbx
ret
call fcn.14002ba2c
int3

Function at 0x140005a50
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x438
mov rax, qword [0x14005b740]
xor rax, rsp
mov qword [rsp + 0x420], rax
lea rdx, [rsp + 0x20]
mov ecx, 0x3e8
mov byte [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea rax, [rsp + 0x20]
or rcx, 0xffffffffffffffff
inc rcx
cmp byte [rax + rcx], 0
jne 0x140005a87
mov eax, 0x2086296b
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 0xaa8e3da1
lea r8d, [rdx + rdx*2]
imul ecx
add edx, ecx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx*4 + 7]
add eax, edx
add eax, r8d
mov rcx, qword [rsp + 0x420]
xor rcx, rsp
call fcn.14002aed0
add rsp, 0x438
ret
Function at 0x14000ae90
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov rdi, rcx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r14, qword [rsp + 0x28]
mov r15, qword [rsp + 0x30]
cmp rdi, 0x40000000
jbe 0x14000aed0
lea rax, [rdi - 0x40000000]
cmp r14, rax
cmovb r14, rax
mov rsi, qword [0x1400983f0]
lea rax, [rdi + 0x40000000]
cmp r15, rax
cmova r15, rax
sub r15, 0xfff
test rsi, rsi
je 0x14000af0e
cmp rsi, r14
jb 0x14000af06
cmp rsi, r15
jae 0x14000af06
cmp qword [rsi + 8], 0
jne 0x14000b0cd
mov rsi, qword [rsi]
test rsi, rsi
jne 0x14000aef1
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xa8], rbp
mov rbx, rdi
cmp rdi, r14
jb 0x14000af89
nop word [rax + rax]
mov ebp, dword [rsp + 0x48]
mov rax, rbx
xor edx, edx
div rbp
sub rbx, rdx
sub rbx, rbp
cmp rbx, r14
jb 0x14000af89
nop word [rax + rax]
lea rdx, [rsp + 0x50]
mov r8d, gethostbyname
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x14000af89
cmp dword [rsp + 0x70], 0x10000
je 0x14000b00b
mov rbx, qword [rsp + 0x58]
cmp rbx, rbp
jb 0x14000af89
sub rbx, rbp
cmp rbx, r14
jae 0x14000af50
test rsi, rsi
jne 0x14000b076
cmp rdi, r15
ja 0x14000b0bd
nop dword [rax + rax]
mov ebp, dword [rsp + 0x48]
xor edx, edx
mov rax, rdi
div rbp
mov eax, ebp
mov ebx, ebp
sub rax, rdx
add rax, rdi
mov rdi, rax
cmp rax, r15
ja 0x14000b0bd
lea rdx, [rsp + 0x50]
mov r8d, gethostbyname
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x14000b0bd
cmp dword [rsp + 0x70], 0x10000
je 0x14000b044
xor edx, edx
lea edi, [rbp - 1]
add rdi, qword [rsp + 0x68]
add rdi, qword [rsp + 0x50]
mov rax, rdi
div rbx
sub rdi, rdx
cmp rdi, r15
jbe 0x14000afc2
jmp 0x14000b0bd
test rbx, rbx
je 0x14000af89
mov edx, 0x1000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x14000b076
cmp rbx, r14
jae 0x14000af30
jmp 0x14000af92
test rdi, rdi
je 0x14000b0bd
mov edx, 0x1000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x14000b076
cmp rdi, r15
jbe 0x14000afa0
jmp 0x14000b0bd
xor eax, eax
lea rcx, [rsi + 0x40]
mov rdx, rcx
mov qword [rsi + 8], rax
mov dword [rsi + 0x10], eax
sub rdx, rsi
nop dword [rax]
mov rax, qword [rsi + 8]
add rdx, 0x40
mov qword [rcx], rax
mov qword [rsi + 8], rcx
add rcx, 0x40
cmp rdx, 0xfc0
jbe 0x14000b090
mov rax, qword [0x1400983f0]
mov qword [0x1400983f0], rsi
mov qword [rsi], rax
mov rbp, qword [rsp + 0xa8]
mov rbx, qword [rsp + 0xa0]
mov rax, rsi
mov rsi, qword [rsp + 0xb0]
add rsp, 0x80
pop r15
pop r14
pop rdi
ret
Function at 0x14000bbb0
Capabilities:
Enumerate threads

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x14005b740]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor edx, edx
mov rbx, rcx
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14000bcb9
lea rdx, [rsp + 0x20]
mov rcx, rax
mov dword [rsp + 0x20], 0x1c
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x14000bcb0
cmp dword [rsp + 0x20], 0x10
jb 0x14000bc92
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x2c], eax
jne 0x14000bc92
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rsp + 0x28], eax
je 0x14000bc92
mov r8, qword [rbx]
test r8, r8
jne 0x14000bc53
mov rcx, qword [0x140061e28]
xor edx, edx
mov r8d, 0x200
mov dword [rbx + 8], 0x80
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbx], rax
test rax, rax
je 0x14000bcb0
jmp 0x14000bc82
mov eax, dword [rbx + 8]
cmp dword [rbx + 0xc], eax
jb 0x14000bc82
mov rcx, qword [0x140061e28]
lea r9d, [rax + rax]
xor edx, edx
shl r9, 2
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
test rax, rax
je 0x14000bcb0
mov ecx, dword [rbx + 8]
mov qword [rbx], rax
add ecx, ecx
mov dword [rbx + 8], ecx
mov edx, dword [rbx + 0xc]
mov rcx, qword [rbx]
mov eax, dword [rsp + 0x28]
mov dword [rcx + rdx*4], eax
inc dword [rbx + 0xc]
lea rdx, [rsp + 0x20]
mov rcx, rdi
mov dword [rsp + 0x20], 0x1c
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x14000bc02
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14002aed0
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret

Function at 0x14000bce0
Capabilities:
Suspend thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
xor ebx, ebx
mov ebp, r8d
mov r14d, edx
mov qword [rcx], rbx
mov qword [rcx + 8], rbx
mov rdi, rcx
call fcn.14000bbb0
cmp qword [rdi], rbx
je 0x14000bd68
cmp dword [rdi + 0xc], ebx
jbe 0x14000bd68
mov qword [rsp + 0x30], rsi
nop dword [rax + rax]
mov rax, qword [rdi]
mov ecx, ebx
xor edx, edx
mov r8d, dword [rax + rcx*4]
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x14000bd5c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov r8d, ebp
mov edx, r14d
mov rcx, rsi
call fcn.14000b9f0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, dword [rdi + 0xc]
jb 0x14000bd20
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14000bd80
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
xor ebx, ebx
mov rsi, rcx
cmp dword [rcx + 0xc], ebx
jbe 0x14000bdd8
mov qword [rsp + 0x30], rdi
nop dword [rax]
mov rax, qword [rsi]
xor edx, edx
mov r8d, dword [rax + rbx*4]
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rdi, rax
test rax, rax
je 0x14000bdcc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, dword [rsi + 0xc]
jb 0x14000bda0
mov rdi, qword [rsp + 0x30]
mov r8, qword [rsi]
mov rcx, qword [0x140061e28]
xor edx, edx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
jmp qword [sym.imp.KERNEL32.dll_HeapFree]

Function at 0x14000be00
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov ebx, ecx
mov esi, edx
mov ebp, 5
imul rbx, rbx, 0x38
add rbx, qword [0x1400983e0]
test byte [rbx + 0x20], 1
mov rdi, qword [rbx]
je 0x14000be39
sub rdi, rbp
mov ebp, 7
lea r9, [rsp + 0x30]
mov r8d, 0x40
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14000be5e
mov eax, 0xa
jmp 0x14000beed
test esi, esi
je 0x14000be80
mov byte [rdi], 0xe9
mov eax, dword [rbx + 8]
sub eax, edi
sub eax, 5
mov dword [rdi + 1], eax
test byte [rbx + 0x20], 1
je 0x14000bea3
mov rax, qword [rbx]
mov word [rax], 0xf9eb
jmp 0x14000bea3
mov eax, dword [rbx + 0x18]
test byte [rbx + 0x20], 1
mov dword [rdi], eax
je 0x14000be9c
movzx eax, word [rbx + 0x1c]
mov word [rdi + 4], ax
movzx eax, byte [rbx + 0x1e]
mov byte [rdi + 6], al
jmp 0x14000bea3
movzx eax, byte [rbx + 0x1c]
mov byte [rdi + 4], al
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, rbp
mov rcx, rax
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
and byte [rbx + 0x20], 0xfd
and sil, 1
movzx eax, sil
shl sil, 2
add al, al
or al, byte [rbx + 0x20]
and al, 0xfb
or al, sil
mov byte [rbx + 0x20], al
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x14000bf10
Capabilities:
Resume thread
Suspend thread

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
xor edi, edi
mov esi, ecx
mov ecx, dword [0x1400983ec]
mov ebx, edi
test ecx, ecx
je 0x14000c0b2
mov rax, qword [0x1400983e0]
add rax, 0x20
nop word [rax + rax]
movzx edx, byte [rax]
shr edx, 1
and edx, 1
cmp edx, esi
jne 0x14000bf60
inc ebx
add rax, 0x38
cmp ebx, ecx
jb 0x14000bf40
mov eax, edi
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
cmp ebx, 0xffffffff
je 0x14000c0b2
mov qword [rsp + 0x60], rbp
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rdi
call fcn.14000bbb0
mov r12, qword [rsp + 0x20]
mov r13d, dword [rsp + 0x2c]
test r12, r12
je 0x14000bfff
test r13d, r13d
je 0x14000bfff
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r15
mov r15d, r13d
mov r14, r12
mov r8d, dword [r14]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rbp, rax
test rax, rax
je 0x14000bfec
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov r8d, edi
test esi, esi
setne r8b
or edx, 0xffffffff
mov rcx, rbp
call fcn.14000b9f0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add r14, 4
dec r15
jne 0x14000bfb0
mov r15, qword [rsp + 0x30]
mov r14, qword [rsp + 0x38]
mov r8d, dword [0x1400983ec]
cmp ebx, r8d
jae 0x14000c048
nop dword [rax + rax]
mov rax, qword [0x1400983e0]
mov ecx, ebx
imul rcx, rcx, 0x38
movzx edx, byte [rcx + rax + 0x20]
shr edx, 1
and edx, 1
cmp edx, esi
je 0x14000c041
mov edx, esi
mov ecx, ebx
call fcn.14000be00
mov edi, eax
test eax, eax
jne 0x14000c048
mov r8d, dword [0x1400983ec]
inc ebx
cmp ebx, r8d
jb 0x14000c010
test r12, r12
je 0x14000c0a3
test r13d, r13d
je 0x14000c091
mov rsi, r12
mov rbp, r13
nop dword [rax + rax]
mov r8d, dword [rsi]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rbx, rax
test rax, rax
je 0x14000c088
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsi, 4
dec rbp
jne 0x14000c060
mov rcx, qword [0x140061e28]
mov r8, r12
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r12, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov r13, qword [rsp + 0x70]
mov eax, edi
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x14000d690
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
add r8d, 0xdeadbeef
mov rdi, rdx
mov r11, rcx
add r8d, edx
mov r10d, r8d
mov ebx, r8d
cmp rdx, 0xc
jbe 0x14000d7c3
mov qword [rsp + 0x10], rsi
lea r9, [rdx - 0xd]
movabs rax, 0xaaaaaaaaaaaaaaab
mul r9
mov rsi, rdx
shr rsi, 3
inc rsi
mov rax, rsi
imul rax, rax, 0xfffffffffffffff4
add rdi, rax
movzx eax, byte [r11 + 6]
movzx ecx, byte [r11 + 7]
movzx r9d, byte [r11 + 4]
movzx edx, byte [r11 + 8]
shl ecx, 8
add r9d, r10d
add ecx, eax
movzx eax, byte [r11 + 5]
add edx, r8d
shl ecx, 8
add r11, 0xc
add ecx, eax
movzx eax, byte [r11 - 2]
shl ecx, 8
add r9d, ecx
movzx ecx, byte [r11 - 1]
shl ecx, 8
add ecx, eax
movzx eax, byte [r11 - 3]
shl ecx, 8
add ecx, eax
movzx eax, byte [r11 - 0xa]
shl ecx, 8
add edx, ecx
movzx ecx, byte [r11 - 9]
shl ecx, 8
mov r8d, edx
add ecx, eax
movzx eax, byte [r11 - 0xb]
rol r8d, 4
shl ecx, 8
add ecx, eax
movzx eax, byte [r11 - 0xc]
shl ecx, 8
add ecx, eax
sub ecx, edx
add edx, r9d
add ecx, ebx
xor r8d, ecx
sub r9d, r8d
mov eax, r8d
add r8d, edx
rol eax, 6
xor eax, r9d
sub edx, eax
mov ecx, eax
add eax, r8d
rol ecx, 8
xor ecx, edx
sub r8d, ecx
mov ebx, ecx
add ecx, eax
rol ebx, 0x10
xor ebx, r8d
sub eax, ebx
mov r10d, ebx
add ebx, ecx
ror r10d, 0xd
xor r10d, eax
sub ecx, r10d
mov r8d, r10d
add r10d, ebx
rol r8d, 4
xor r8d, ecx
dec rsi
jne 0x14000d6e0
mov rsi, qword [rsp + 0x10]
cmp rdi, 0xc
ja 0x14000d84c
lea rcx, sym.ZecMiner64.exe__Co9eEk_rc_U8Qzt_M_rBCXNPgLr_62n_K__
mov eax, dword [rcx + rdi*4 + 0xd8ac]
add rax, rcx
jmp rax
movzx eax, byte [r11 + 0xb]
shl eax, 0x18
add r8d, eax
movzx eax, byte [r11 + 0xa]
shl eax, 0x10
add r8d, eax
movzx eax, byte [r11 + 9]
shl eax, 8
add r8d, eax
movzx eax, byte [r11 + 8]
add r8d, eax
movzx eax, byte [r11 + 7]
shl eax, 0x18
add r10d, eax
movzx eax, byte [r11 + 6]
shl eax, 0x10
add r10d, eax
movzx eax, byte [r11 + 5]
shl eax, 8
add r10d, eax
movzx eax, byte [r11 + 4]
add r10d, eax
movzx eax, byte [r11 + 3]
shl eax, 0x18
add ebx, eax
movzx eax, byte [r11 + 2]
shl eax, 0x10
add ebx, eax
movzx eax, byte [r11 + 1]
shl eax, 8
add ebx, eax
movzx eax, byte [r11]
add ebx, eax
xor r8d, r10d
mov eax, r10d
rol eax, 0xe
sub r8d, eax
mov eax, r8d
mov edx, r8d
xor edx, ebx
rol eax, 0xb
sub edx, eax
xor r10d, edx
mov eax, edx
ror eax, 7
sub r10d, eax
xor r8d, r10d
mov eax, r10d
rol eax, 0x10
sub r8d, eax
mov eax, r8d
mov ecx, r8d
xor ecx, edx
rol eax, 4
sub ecx, eax
xor r10d, ecx
mov eax, ecx
rol eax, 0xe
sub r10d, eax
mov eax, r10d
xor r8d, r10d
ror eax, 8
sub r8d, eax
mov eax, r8d
mov rbx, qword [rsp + 0x18]
pop rdi
ret
Function at 0x1400153f0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
call fcn.140014fa0
mov rcx, qword [0x14005d120]
cmp rcx, 0xffffffffffffffff
je 0x14001540c
call qword [sym.imp.WS2_32.dll_closesocket]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor ecx, ecx
call fcn.14002c9d0
int3

Function at 0x140015430
Capabilities:
Accept command line arguments
Create process on windows
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0xe0
cmp dword [0x14005f524], 1
je 0x140015566
mov rdi, qword [0x140066528]
xor esi, esi
mov dword [0x1400613e4], 1
lea rcx, [rdi + 0x38]
mov dword [rdi + 0x78], esi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call fcn.140003960
lea rcx, [rdi + 0x38]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x14005d120]
cmp rcx, 0xffffffffffffffff
je 0x1400154a7
call qword [sym.imp.WS2_32.dll_closesocket]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rbx, rax
test rax, rax
je 0x140015551
xor edx, edx
lea rcx, [rsp + 0x70]
lea r8d, [rdx + 0x68]
call fcn.140032380
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov rdx, rbx
xor ecx, ecx
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x1400155e2
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Restarting_failed:_error__d_n
xor ecx, ecx
mov r8d, eax
call fcn.1400054d0
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
lea rdx, str.Rebooting_n
xor ecx, ecx
call fcn.1400054d0
call fcn.1400150b0
mov rdi, qword [0x140066528]
lea rcx, [rdi + 0x38]
xor esi, esi
mov dword [0x1400613e4], 1
mov dword [rdi + 0x78], esi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call fcn.140003960
lea rcx, [rdi + 0x38]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor ecx, ecx
call fcn.14002c9d0
int3
lea rdx, str.Restarting_OK__exit..._n_n_n
xor ecx, ecx
call fcn.1400054d0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call fcn.14002c9d0
int3
Function at 0x140015620
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea rdx, str._n__
xor ecx, ecx
call fcn.1400054d0
call fcn.140007d70
mov dl, 1
movzx ecx, dl
call fcn.140014780
mov rbx, qword [0x140066528]
lea rcx, [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor r9d, r9d
xor r8d, r8d
mov dl, 1
mov rcx, rbx
call fcn.140003960
lea rcx, [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rdx, str._n__
xor ecx, ecx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1400054d0
Function at 0x140016590
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, qword [0x140066528]
mov dword [0x1400613e4], 1
lea rcx, [rdi + 0x38]
mov dword [rdi + 0x78], 0
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call fcn.140003960
lea rcx, [rdi + 0x38]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor ecx, ecx
call fcn.14002c9d0
int3
Function at 0x14001b230
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x180
mov rax, qword [0x14005b740]
xor rax, rsp
mov qword [rsp + 0x170], rax
lea rdx, [rsp + 0x40]
mov r8d, 0x12c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov qword [rsp + 0x30], 0
mov esi, 1
lea rcx, [rsp + 0x40]
mov r8d, esi
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14001b2dc
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x190], rbx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov rcx, rdi
lea ebx, [rax - 1]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, byte [0x14005f520]
cmp ebx, 0x1e847e
mov rbx, qword [rsp + 0x190]
cmovbe eax, esi
mov byte [0x14005f520], al
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.14002aed0
mov rsi, qword [rsp + 0x198]
add rsp, 0x180
pop rdi
ret