joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1402acc00
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov ebx, r8d
mov edx, 0x328
mov rsi, rcx
call fcn.140295260
lea rcx, [rsi + 0x144]
xor r9d, r9d
mov r8d, ebx
mov rdx, rdi
call fcn.14029a0a0
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x1402acc00
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x140601e40]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x28]
call fcn.140295260
lea rcx, [rbx + 0x144]
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x28]
call fcn.140299ed0
movzx eax, byte [rsp + 0x29]
movzx r8d, byte [rsp + 0x28]
movzx r9d, byte [rsp + 0x30]
movzx ecx, byte [rsp + 0x2c]
shl r8d, 8
or r8d, eax
shl r9d, 8
movzx eax, byte [rsp + 0x2a]
shl r8d, 8
or r8d, eax
shl ecx, 8
movzx eax, byte [rsp + 0x2b]
shl r8d, 8
or r8, rax
movzx eax, byte [rsp + 0x2d]
or ecx, eax
shl r8, 0x20
movzx eax, byte [rsp + 0x2e]
shl ecx, 8
or eax, ecx
movzx ecx, byte [rsp + 0x34]
shl eax, 8
or r8, rax
shl ecx, 8
movzx eax, byte [rsp + 0x2f]
or r8, rax
movzx eax, byte [rsp + 0x31]
or r9d, eax
mov qword [rbx + 0xc0], r8
movzx eax, byte [rsp + 0x32]
shl r9d, 8
or r9d, eax
movzx eax, byte [rsp + 0x33]
shl r9d, 8
or r9, rax
movzx eax, byte [rsp + 0x35]
or ecx, eax
shl r9, 0x20
movzx eax, byte [rsp + 0x36]
shl ecx, 8
or eax, ecx
shl eax, 8
or r9, rax
movzx eax, byte [rsp + 0x37]
or r9, rax
xor eax, eax
mov qword [rbx + 0x40], r9
mov qword [rbx + 0x80], rax
mov qword [rbx], rax
lea r10d, [rax + 4]
nop dword [rax + rax]
mov eax, r9d
mov rcx, r8
and eax, 1
shl rcx, 0x3f
imul edx, eax, 0xe1000000
mov rax, r9
shr rax, 1
mov r9, rcx
or r9, rax
mov rax, r8
shr rax, 1
mov ecx, edx
shl rcx, 0x20
mov r8, rcx
xor r8, rax
movsxd rax, r10d
mov qword [rbx + rax*8], r9
movsxd rax, r10d
sar r10d, 1
mov qword [rbx + rax*8 + 0x80], r8
test r10d, r10d
jg 0x1402acd10
mov r10d, 2
movsxd rcx, r10d
add rcx, 0x10
movsxd rax, r10d
mov rdi, qword [rbx + rcx*8]
lea rcx, [rbx + rcx*8]
mov rsi, qword [rbx + rax*8]
lea rdx, [rbx + rax*8]
movsxd r9, r10d
cmp r9, 1
jle 0x1402acdc5
mov r11, rbx
lea rax, [rcx + 8]
mov r8, rbx
sub r11, rcx
sub r8, rcx
sub rdx, rcx
dec r9
nop word [rax + rax]
mov rcx, rdi
xor rcx, qword [rax + r11 + 0x80]
mov qword [rax], rcx
lea rax, [rax + 8]
mov rcx, rsi
xor rcx, qword [r8 + rax - 8]
mov qword [rax + rdx - 8], rcx
sub r9, 1
jne 0x1402acda0
add r10d, r10d
cmp r10d, 0x10
jl 0x1402acd61
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140284180
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1402ad5f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rsi, rdx
add rcx, 0x14c4
mov edi, r8d
mov edx, dword [rbx + 0x14c0]
call fcn.14029b620
mov edx, 4
lea rcx, [rsp + 0x40]
call fcn.14029b620
xor r9d, r9d
cmp dword [rbx + 0x14c0], r9d
jle 0x1402ad673
mov edx, dword [rsp + 0x40]
lea r8, [rbx + 0x14c4]
cmp byte [r8], 0
jne 0x1402ad664
movzx eax, byte [r8]
nop word [rax + rax]
lea ecx, [rdx + 1]
imul edx, ecx, 0x10dcd
xor al, dl
je 0x1402ad650
mov dword [rsp + 0x40], edx
mov byte [r8], al
inc r9d
inc r8
cmp r9d, dword [rbx + 0x14c0]
jl 0x1402ad640
mov word [rbx + 0x14c4], 0x200
mov edx, 0x400
mov r8d, dword [rbx + 0x14c0]
mov r9d, edi
sub r8d, edi
sub edx, r8d
lea eax, [r8 - 1]
movsxd rcx, eax
mov byte [rcx + rbx + 0x14c4], 0
movsxd rcx, r8d
mov r8, rsi
add rcx, 0x14c4
add rcx, rbx
call fcn.140295280
cmp byte [rbx + 0x18c7], 0
lea r8, [rbx + 0x14c4]
mov r9d, dword [rbx + 0x14c0]
mov edx, 0xffffffff
mov byte [rbx + 0x18c6], 1
jne 0x1402ad6f4
lea rcx, [rbx + 0x420]
call fcn.1402a4350
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
lea rcx, [rbx + 0xa50]
call fcn.1402a4350
mov r9d, dword [rbx + 0x14c0]
lea r8, [rbx + 0x14c4]
lea rcx, [rbx + 0xc60]
mov edx, 0xffffffff
call fcn.1402a4350
lea r8, [rbx + 0xa50]
xor r9d, r9d
lea rcx, [rbx + 0xa50]
mov rdx, rbx
call fcn.1402a5dd0
lea r8, [rbx + 0xc60]
xor r9d, r9d
lea rdx, [rbx + 0x210]
lea rcx, [rbx + 0xc60]
call fcn.1402a5dd0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1402b1110
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xe8
mov rax, qword [0x140601e40]
xor rax, rsp
mov qword [rsp + 0xd0], rax
movsxd rbx, dword [rsp + 0x158]
mov r12, r8
mov edi, edx
mov rbp, rcx
mov rdx, qword [rsp + 0x150]
lea rcx, [rsp + 0x90]
mov r8d, ebx
mov r13d, r9d
call fcn.140295270
mov r8d, dword [rsp + 0x168]
lea eax, [rbx + 1]
movsxd rsi, dword [rsp + 0x178]
lea r9d, [rbx + 4]
mov ecx, r8d
mov edx, r8d
sar ecx, 0x18
mov byte [rsp + rbx + 0x90], cl
movsxd rcx, eax
lea eax, [rbx + 2]
sar edx, 0x10
mov byte [rsp + rcx + 0x90], dl
mov edx, r8d
movsxd rcx, eax
lea eax, [rbx + 3]
sar edx, 8
mov byte [rsp + rcx + 0x90], dl
mov edx, esi
movsxd rcx, eax
mov eax, dword [rsp + 0x170]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], r13d
mov byte [rsp + rcx + 0x90], r8b
lea r8, [rsp + 0x90]
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x20], r12
call fcn.14029b2f0
mov r9d, esi
lea r8, [rsp + 0x50]
mov edx, edi
mov rcx, rbp
call fcn.140295280
mov r15d, dword [rsp + 0x160]
mov ebx, 1
cmp r15d, ebx
jle 0x1402b129f
mov edi, ebx
nop dword [rax]
mov eax, ebx
lea r8, [rsp + 0x50]
not eax
lea rcx, [rsp + 0x50]
and eax, 1
mov r9d, esi
shl rax, 6
mov edx, esi
add r8, rax
mov rax, rdi
and eax, 1
shl rax, 6
add rcx, rax
mov eax, dword [rsp + 0x170]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r12
call fcn.14029b2f0
test esi, esi
jle 0x1402b1291
mov rax, rdi
lea r8, [rsp + 0x50]
and eax, 1
mov rcx, rbp
shl rax, 6
mov r9, rsi
sub rax, rbp
add r8, rax
nop dword [rax]
nop word [rax + rax]
movzx edx, byte [r8 + rcx]
xor byte [rcx], dl
lea rcx, [rcx + 1]
sub r9, 1
jne 0x1402b1280
inc ebx
inc rdi
cmp ebx, r15d
jl 0x1402b1210
mov eax, esi
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.140284180
add rsp, 0xe8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1402b2320
Capabilities:
Hash data using murmur3

Disassembly:
push rdi
xor r10d, r10d
mov qword [rsp + 0x10], rbx
mov eax, r9d
mov qword [rsp + 0x18], rsi
and eax, 0xf
lea rdi, [0x140000000]
dec eax
mov ebx, edx
mov r11, rcx
cmp eax, 0xe
ja case.default.0x1402b236c
cdqe
movabs rsi, 0x4cf5ad432745937f
movabs rcx, 0x87c37b91114253d5
mov edx, dword [rdi + rax*4 + 0x2b2594]
add rdx, rdi
jmp rdx
movzx r10d, byte [r8 + 0xe]
shl r10, 0x30
movzx eax, byte [r8 + 0xd]
shl rax, 0x28
xor r10, rax
movzx eax, byte [r8 + 0xc]
shl rax, 0x20
xor r10, rax
movzx eax, byte [r8 + 0xb]
shl rax, 0x18
xor r10, rax
movzx eax, byte [r8 + 0xa]
shl rax, 0x10
xor r10, rax
movzx eax, byte [r8 + 9]
shl rax, 8
xor r10, rax
movzx eax, byte [r8 + 8]
xor rax, r10
imul rax, rsi
rol rax, 0x21
imul rax, rcx
xor qword [rsp + 0x38], rax
movzx r10d, byte [r8 + 7]
shl r10, 0x38
movzx eax, byte [r8 + 6]
shl rax, 0x30
xor r10, rax
movzx eax, byte [r8 + 5]
shl rax, 0x28
xor r10, rax
movzx eax, byte [r8 + 4]
shl rax, 0x20
xor r10, rax
movzx eax, byte [r8 + 3]
shl rax, 0x18
xor r10, rax
movzx eax, byte [r8 + 2]
shl rax, 0x10
xor r10, rax
movzx eax, byte [r8 + 1]
shl rax, 8
xor r10, rax
movzx eax, byte [r8]
mov r8, qword [rsp + 0x30]
xor rax, r10
imul rax, rcx
rol rax, 0x1f
imul rax, rsi
xor r8, rax
jmp 0x1402b243f
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
movabs r10, 0xff51afd7ed558ccd
mov rsi, qword [rsp + 0x18]
movsxd rax, r9d
xor rdx, rax
movsxd rcx, r9d
xor rcx, r8
movabs r9, 0xc4ceb9fe1a85ec53
add rcx, rdx
mov rax, rcx
shr rax, 0x21
xor rax, rcx
imul rax, r10
mov r8, rax
shr r8, 0x21
xor r8, rax
lea rax, [rcx + rdx]
mov rcx, rax
imul r8, r9
shr rcx, 0x21
xor rcx, rax
imul rcx, r10
mov rax, rcx
shr rax, 0x21
xor rax, rcx
imul rax, r9
mov r9, r8
shr r9, 0x21
mov rdx, rax
shr rdx, 0x21
xor r9, r8
xor rdx, rax
lea eax, [rbx - 1]
mov rbx, qword [rsp + 0x10]
add r9, rdx
add rdx, r9
cmp eax, 0xf
ja case.default.0x1402b24df
cdqe
mov ecx, dword [rdi + rax*4 + 0x2b25d0]
add rcx, rdi
jmp rcx
mov rax, rdx
shr rax, 0x38
mov byte [r11 + 0xf], al
mov rax, rdx
shr rax, 0x30
mov byte [r11 + 0xe], al
mov rax, rdx
shr rax, 0x28
mov byte [r11 + 0xd], al
mov rax, rdx
shr rax, 0x20
mov byte [r11 + 0xc], al
mov rax, rdx
shr rax, 0x18
mov byte [r11 + 0xb], al
mov rax, rdx
shr rax, 0x10
mov byte [r11 + 0xa], al
mov rax, rdx
shr rax, 8
mov byte [r11 + 9], al
mov byte [r11 + 8], dl
cmp byte [rsp + 0x40], 0
je 0x1402b2541
shr rdx, 0x38
mov eax, edx
jmp 0x1402b2548
mov rax, r9
shr rax, 0x38
mov byte [r11 + 7], al
mov rax, r9
shr rax, 0x30
mov byte [r11 + 6], al
mov rax, r9
shr rax, 0x28
mov byte [r11 + 5], al
mov rax, r9
shr rax, 0x20
mov byte [r11 + 4], al
mov rax, r9
shr rax, 0x18
mov byte [r11 + 3], al
mov rax, r9
shr rax, 0x10
mov byte [r11 + 2], al
mov rax, r9
shr rax, 8
mov byte [r11 + 1], al
mov byte [r11], r9b
pop rdi
ret
Function at 0x1402bbf50
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rax, qword [0x140601e40]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov esi, r8d
mov rdi, rcx
cmp r8d, 8
jl 0x1402bc087
mov qword [rsp + 0x70], rbx
lea rbx, [rdx + 2]
mov qword [rsp + 0x78], rbp
mov ebp, esi
shr rbp, 3
mov qword [rsp + 0x40], r12
mov eax, ebp
neg eax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r15
lea esi, [rsi + rax*8]
mov edx, 8
lea r8, [rbx - 2]
mov r9d, edx
lea rcx, [rsp + 0x20]
call fcn.140295280
lea rdx, [rbx - 2]
lea rcx, [rdi + 0x100]
call fcn.1402bc130
lea rcx, [rdi + 0x80]
lea rdx, [rbx - 2]
call fcn.1402bc840
mov rcx, rdi
lea rdx, [rbx - 2]
call fcn.1402bc130
movzx eax, byte [rbx - 2]
lea r8, [rsp + 0x20]
xor al, byte [rdi + 0x180]
lea rcx, [rdi + 0x180]
mov byte [rbx - 2], al
mov r9d, 8
movzx eax, byte [rbx - 1]
mov edx, r9d
xor al, byte [rdi + 0x181]
mov byte [rbx - 1], al
movzx eax, byte [rdi + 0x182]
xor byte [rbx], al
movzx eax, byte [rbx + 1]
xor al, byte [rdi + 0x183]
mov byte [rbx + 1], al
movzx eax, byte [rbx + 2]
xor al, byte [rdi + 0x184]
mov byte [rbx + 2], al
movzx eax, byte [rbx + 3]
xor al, byte [rdi + 0x185]
mov byte [rbx + 3], al
movzx eax, byte [rbx + 4]
xor al, byte [rdi + 0x186]
mov byte [rbx + 4], al
movzx eax, byte [rbx + 5]
xor al, byte [rdi + 0x187]
mov byte [rbx + 5], al
call fcn.140295280
lea rbx, [rbx + 8]
sub rbp, 1
jne 0x1402bbfa0
mov r15, qword [rsp + 0x30]
mov r14, qword [rsp + 0x38]
mov r12, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
neg esi
sbb eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140284180
add rsp, 0x48
pop rdi
pop rsi
ret
Function at 0x1402c71b0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rcx + 9], 0
mov rbx, rcx
je 0x1402c71cb
lea rcx, str.User_requested_cancellation_of_run._n
call fcn.1400c8150
mov rcx, qword [rbx + 0x6f8]
mov edx, 0xffff
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov byte [rbx + 0x48], 0
add rsp, 0x20
pop rbx
ret

Function at 0x1402c7d00
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp byte [rcx + 9], 0
mov rdi, rdx
mov rbx, rcx
je 0x1402c7d4f
lea rcx, str.Target_process_generated_an_exception._n
call fcn.1400c8150
mov edx, dword [rdi]
lea rcx, str._Code______0x_08x_n
call fcn.1400c8150
mov rdx, qword [rdi + 0x10]
lea rcx, str._Address___0x_016llX__n
call fcn.1400c8150
mov edx, dword [rdi + 4]
lea rcx, str._Flags_____0x_08x_n
call fcn.1400c8150
mov rcx, qword [rbx + 0x6f8]
mov edx, 0xffff
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov byte [rbx + 0x48], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1402c9e20
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x38
xor r10d, r10d
mov r11, rcx
cmp byte [rcx + 0x558], r10b
je 0x1402c9e7a
cmp qword [rcx + 0x5b8], 0xffffffffffffffff
je 0x1402c9e49
mov r10, qword [rcx + 0x5b8]
cmp r8, r10
jb 0x1402c9e82
mov rcx, qword [rcx + 0x5c0]
add rcx, r10
cmp r8, rcx
jae 0x1402c9e82
cmp byte [r11 + 0x5b0], 0
je 0x1402c9e65
sub r8, r10
mov rax, qword [rsp + 0x60]
mov rcx, r11
mov qword [rsp + 0x20], rax
call fcn.1402cb510
mov r10d, eax
mov eax, r10d
add rsp, 0x38
ret
mov rcx, r11
add rsp, 0x38
jmp fcn.1402cb510
Function at 0x1402cdfb0
Capabilities:
Resume thread
Suspend thread

Disassembly:
push rbx
push rsi
sub rsp, 0x508
mov rax, qword [0x140601e40]
xor rax, rsp
mov qword [rsp + 0x4f0], rax
mov rbx, rdx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, ebx
jne 0x1402ce00c
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x50], 0x100003
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0xb8]
mov rbx, qword [rsp + 0x118]
jmp 0x1402ce0a5
mov edx, 1
mov qword [rsp + 0x530], rbp
mov r8d, ebx
mov qword [rsp + 0x500], rdi
lea ecx, [rdx + 9]
call qword [sym.imp.KERNEL32.dll_OpenThread]
xor ebx, ebx
mov rdi, rax
mov ebp, ebx
test rax, rax
je 0x1402ce08f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x1402ce068
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x50], 0x100003
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov rcx, rdi
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebp, ebp
je 0x1402ce08f
mov rbx, qword [rsp + 0x118]
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0xb8]
jmp 0x1402ce095
mov rcx, rbx
mov rax, rbx
mov rbp, qword [rsp + 0x530]
mov rdi, qword [rsp + 0x500]
test rbx, rbx
mov qword [rsi + 0x28], rax
mov qword [rsi + 0x18], rbx
setne al
mov qword [rsi + 0x20], rcx
mov rcx, qword [rsp + 0x4f0]
xor rcx, rsp
call fcn.140284180
add rsp, 0x508
pop rsi
pop rbx
ret
Function at 0x1402d2ed0
Capabilities:
Read file on windows
Read pipe

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x450
mov rax, qword [0x140601e40]
xor rax, rsp
mov qword [rsp + 0x440], rax
xor edi, edi
mov byte [rsp + 0x40], 0
lea rax, [rsp + 0x34]
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
lea rax, [rsp + 0x38]
mov dword [rsp + 0x38], edi
mov rbx, rcx
mov qword [rsp + 0x20], rax
mov rcx, qword [rcx + 0x768]
lea rdx, [rsp + 0x40]
mov r8d, 0x3ff
mov dword [rsp + 0x34], edi
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x1402d3098
nop
cmp dword [rsp + 0x30], edi
je 0x1402d3098
mov rcx, qword [rbx + 0x768]
lea r9, [rsp + 0x30]
mov r8d, 0x3ff
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1402d305f
mov edx, dword [rsp + 0x30]
test edx, edx
je 0x1402d305f
movzx eax, byte [rbx + 0x73f]
shr al, 7
test al, 1
je 0x1402d2f97
mov rcx, qword [rbx + 0x730]
jmp 0x1402d2fa7
movsx rax, byte [rbx + 0x73f]
mov ecx, reloc.WS2_32.dll_socket
sub rcx, rax
cmp rcx, 0x7a1200
jbe 0x1402d2ff1
lea rcx, [rbx + 0x728]
movzx eax, byte [rcx + 0x17]
shr al, 7
test al, 1
je 0x1402d2fc5
mov rcx, qword [rcx]
lea rdx, [rbx + 0x728]
movzx eax, byte [rdx + 0x17]
lea r8, [rcx + 0xf4240]
shr al, 7
test al, 1
je 0x1402d2fe1
mov rdx, qword [rdx]
lea rcx, [rbx + 0x728]
call fcn.140162690
mov edx, dword [rsp + 0x30]
mov eax, edx
lea r9, [rsp + 0x40]
add r9, rax
movzx eax, byte [rbx + 0x73f]
shr al, 7
test al, 1
je 0x1402d3019
mov rdx, qword [rbx + 0x730]
add rdx, qword [rbx + 0x728]
jmp 0x1402d302f
movsx rax, byte [rbx + 0x73f]
lea rdx, [rbx + 0x728]
sub rdx, rax
add rdx, 0x17
lea r8, [rsp + 0x40]
lea rcx, [rbx + 0x728]
call fcn.1402e36b0
mov eax, dword [rsp + 0x30]
cmp rax, 0x400
jae 0x1402d30b9
mov byte [rsp + rax + 0x40], dil
lea rdx, [rsp + 0x40]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x28]
mov rcx, qword [rbx + 0x768]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
lea rax, [rsp + 0x38]
mov r8d, 0x3ff
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
jne 0x1402d2f40
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.140284180
mov rbx, qword [rsp + 0x468]
add rsp, 0x450
pop rdi
ret
call fcn.140284c90
int3
Function at 0x1402d3a60
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
cmp byte [rbx + 9], 0
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x3c], eax
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x38], eax
je 0x1402d3adf
movabs rax, 0x346dc5d63886594b
lea rcx, str.Target_process_still_running_after_the__s_timeout_period_elapsed._n
imul qword [rsp + 0x38]
mov r8, rdx
lea rdx, str.response
sar r8, 0xb
mov rax, r8
shr rax, 0x3f
add r8, rax
lea rax, str.unilateral
cmp r8, qword [rbx + 0x30]
cmovg rdx, rax
call fcn.1400c8150
mov r8d, dword [rbx + 0x28]
lea rcx, str.Response_timeout___d_seconds__unilateral_timeout___d_seconds._n
mov edx, dword [rbx + 0x18]
call fcn.1400c8150
mov rcx, qword [rbx + 0x6f8]
mov edx, 0xffff
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov byte [rbx + 0x48], 0
add rsp, 0x20
pop rbx
ret

Function at 0x1402d3b70
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
mov rcx, rdi
lea rdx, str.keepalive
call sub.VCRUNTIME140.dll_strstr
movabs rbp, 0x346dc5d63886594b
movabs rsi, 0x7fffffffffffffff
test rax, rax
je 0x1402d3bf0
cmp qword [rbx + 0x30], rsi
je 0x1402d3bf0
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov eax, dword [rsp + 0x44]
imul rcx, qword [rbx + 0x28], 0x3e8
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x50], eax
mov rax, rbp
imul qword [rsp + 0x50]
sar rdx, 0xb
mov rax, rdx
add rdx, rcx
shr rax, 0x3f
add rax, rdx
mov qword [rbx + 0x30], rax
cmp qword [rbx + 0x20], rsi
je 0x1402d3c36
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov ecx, dword [rsp + 0x44]
mov rax, rbp
mov dword [rsp + 0x54], ecx
mov ecx, dword [rsp + 0x40]
mov dword [rsp + 0x50], ecx
imul qword [rsp + 0x50]
imul rcx, qword [rbx + 0x18], 0x3e8
sar rdx, 0xb
mov rax, rdx
shr rax, 0x3f
add rdx, rcx
add rax, rdx
mov qword [rbx + 0x20], rax
cmp byte [rbx + 9], 0
je 0x1402d3c72
mov rdx, rdi
lea rcx, [0x140446fc0]
call fcn.1400c8150
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1402d3c5e
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
Function at 0x1402e66c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
push r14
push r15
sub rsp, 0x30
mov rbx, rcx
mov dword [rsp + 0x20], 1
mov rdi, r9
mov r15, rdx
add rcx, 0x20
lea rdx, [rsp + 0x50]
mov r9d, dword [rbx + 0x18]
mov r8d, dword [rbx + 0x10]
call fcn.1402fc200
cmp byte [rsp + 0x50], 0
je 0x1402e6802
mov r10d, dword [rsp + 0x54]
xor edx, edx
mov rax, rdi
mov qword [rsp + 0x58], rbp
div r10
mov rcx, rbx
mov ebp, r10d
mov r14d, edx
mov edx, r10d
call fcn.1402c74c0
xor r10d, r10d
mov rdi, rax
cmp qword [rbx + 0x10], r10
jbe 0x1402e67cf
mov qword [rsp + 0x60], rsi
nop dword [rax + rax]
mov rcx, qword [rbx + 8]
mov r9, qword [rcx + r10*8]
test r9, r9
je 0x1402e67bd
mov rsi, rbp
mov rcx, qword [r9 + 8]
movsxd r8, dword [r9]
movsxd r11, dword [r9 + 4]
mov eax, 0x811c9dc5
movzx edx, byte [rcx]
inc rcx
test edx, edx
je 0x1402e6784
nop word [rax + rax]
imul eax, eax, 0x1000193
lea rcx, [rcx + 1]
xor eax, edx
movzx edx, byte [rcx - 1]
test edx, edx
jne 0x1402e6770
mov rcx, qword [rbx + 8]
add rax, rax
xor rax, r11
xor edx, edx
add rax, rax
xor rax, r8
div rsi
mov rax, qword [r9 + 0x18]
mov qword [rcx + r10*8], rax
mov r8d, edx
mov rax, qword [rdi + r8*8]
mov qword [r9 + 0x18], rax
mov qword [rdi + r8*8], r9
mov rax, qword [rbx + 8]
mov r9, qword [rax + r10*8]
test r9, r9
jne 0x1402e6750
inc r10
cmp r10, qword [rbx + 0x10]
jb 0x1402e6740
mov rsi, qword [rsp + 0x60]
mov r8, qword [rbx + 0x10]
cmp r8, 1
jbe 0x1402e67f3
mov rax, qword [rbx + 0x30]
lea r8, [r8*8 + 8]
mov rdx, qword [rbx + 8]
mov rcx, rax
mov r9, qword [rax]
call qword [r9 + 0x18]
mov qword [rbx + 0x10], rbp
mov rbp, qword [rsp + 0x58]
mov qword [rbx + 8], rdi
jmp 0x1402e6807
mov r14, qword [rsp + 0x70]
mov rax, qword [rbx + 8]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rax + r14*8]
mov qword [rdx + 0x18], rcx
mov rax, qword [rbx + 8]
mov qword [rax + r14*8], rdx
mov rax, qword [rbx + 8]
inc qword [rbx + 0x18]
mov rbx, qword [rsp + 0x68]
mov qword [r15], rdx
lea rcx, [rax + r14*8]
mov byte [r15 + 0x10], 1
mov qword [r15 + 8], rcx
mov rax, r15
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x1402ea5f0
Capabilities:
Create directory

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x1402ea622
cmp word [rcx], 0
je 0x1402ea622
call fcn.1402eb560
test al, al
je 0x1402ea615
mov al, 1
add rsp, 0x20
pop rbx
ret
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.1402e9fb0
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x1402eac30
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], r9
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r12, qword [rcx + 0x68]
mov r15, rdx
mov rbp, qword [rcx + 0x88]
mov rdx, rcx
mov r14, qword [rcx + 0x78]
mov rbx, rcx
mov rdi, qword [rcx + 0x80]
mov r13, r8
mov rsi, qword [rcx + 0x60]
mov rcx, r12
call fcn.1402e8bf0
mov qword [rbx + 0x70], rax
mov r9, rdi
shr r9, 0x20
mov r8d, ebp
mov rdx, r14
mov rcx, rsi
mov dword [rax + 0x1c], r9d
lea r9, [rsp + 0x70]
mov dword [rax + 0x18], edi
add rax, 8
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1402eacd2
mov rax, qword [r12]
mov rcx, r12
call qword [rax + gethostname]
cmp eax, 1
jne 0x1402eacbd
xor al, al
jmp 0x1402eace9
mov rcx, qword [rsp + 0x88]
mov eax, dword [rsp + 0x70]
mov qword [rcx], rax
mov byte [r15], 0
jmp 0x1402eace7
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x1402eacb9
mov dword [r13], eax
mov byte [r15], 1
mov al, 1
mov rbx, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x1402ead90
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], r9
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r12, qword [rcx + 0x68]
mov r15, rdx
mov rbp, qword [rcx + 0x88]
mov rdx, rcx
mov r14, qword [rcx + 0x78]
mov rbx, rcx
mov rdi, qword [rcx + 0x80]
mov r13, r8
mov rsi, qword [rcx + 0x60]
mov rcx, r12
call fcn.1402e8bf0
mov qword [rbx + 0x70], rax
mov r9, rdi
shr r9, 0x20
mov r8d, ebp
mov rdx, r14
mov rcx, rsi
mov dword [rax + 0x1c], r9d
lea r9, [rsp + 0x70]
mov dword [rax + 0x18], edi
add rax, 8
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1402eae32
mov rax, qword [r12]
mov rcx, r12
call qword [rax + gethostname]
cmp eax, 1
jne 0x1402eae1d
xor al, al
jmp 0x1402eae49
mov rcx, qword [rsp + 0x88]
mov eax, dword [rsp + 0x70]
mov qword [rcx], rax
mov byte [r15], 0
jmp 0x1402eae47
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x1402eae19
mov dword [r13], eax
mov byte [r15], 1
mov al, 1
mov rbx, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret