joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400846f0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x160
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400848d3
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x1400848d3
mov r8d, dword [rax + rcx + 0xd8]
test r8d, r8d
jne 0x140084750
lea rdx, str.___Load_config_directory_wasnt_found__probably_StackCookie_not_defined__fix_cookie_skipped
lea rcx, [0x140242640]
call fcn.140079cb0
mov rcx, rax
call fcn.140079f70
mov al, 1
jmp 0x1400848d5
mov rdi, qword [r8 + rcx + 0x58]
test rdi, rdi
jne 0x14008477c
lea rdx, str.___StackCookie_not_defined__fix_cookie_skipped
lea rcx, [0x140242640]
call fcn.140079cb0
mov rcx, rax
call fcn.140079f70
mov al, 1
jmp 0x1400848d5
sub rcx, rdx
add rdi, rcx
movabs rsi, 0x2b992ddfa232
cmp qword [rdi], rsi
je 0x1400848ea
mov r8d, 1
lea rdx, str.C:_bKernellog.log
lea rcx, [rsp + 0x50]
call fcn.1400779b0
nop
mov rax, qword [rsp + 0x50]
movsxd rcx, dword [rax + 4]
cmp dword [rsp + rcx + 0x60], 0
jne 0x14008485f
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov ecx, 0x40
call fcn.1400ba130
mov rcx, rax
mov qword [rsp + 0x30], rax
movdqa xmm0, xmmword [0x14013e060]
movdqu xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [str.____StackCookie_already_fixed___this_probably_wrong_n]
movups xmmword [rax], xmm1
movups xmm0, xmmword [0x14013d120]
movups xmmword [rax + 0x10], xmm0
movups xmm1, xmmword [0x14013d130]
movups xmmword [rax + 0x20], xmm1
mov eax, dword [0x14013d140]
mov dword [rcx + 0x30], eax
mov byte [rcx + 0x34], 0
lea rcx, [rsp + 0x30]
call fcn.14006d5d0
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14008485f
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140084859
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140084933
call fcn.1400b9d58
nop
mov rax, qword [rsp + 0x50]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x50], rax
mov rax, qword [rsp + 0x50]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rsp + rcx + 0x4c], edx
lea rcx, [rsp + 0x60]
call fcn.14005deb0
mov rax, qword [rsp + 0x50]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x50], rax
mov rax, qword [rsp + 0x50]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x18]
mov dword [rsp + rcx + 0x4c], edx
lea rax, vtable.std::ios_base.0
mov qword [rsp + 0x100], rax
lea rcx, [rsp + 0x100]
call fcn.1400bb848
nop
xor al, al
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
lea rdx, str.___Fixing_stack_cookie
lea rcx, [0x140242640]
call fcn.140079cb0
mov rcx, rax
call fcn.140079f70
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
xor rcx, rbx
xor rcx, rsi
movabs rax, 0x2b992ddfa233
cmp rcx, rsi
cmove rcx, rax
mov qword [rdi], rcx
mov al, 1
jmp 0x1400848d5
call fcn.1400d3378
nop
int3
Function at 0x140085740
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rsi, rdx
mov rdi, rcx
xor r8d, r8d
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x140085841
movsxd rax, dword [rdx + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x140085841
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], r8
mov ecx, dword [rax + rdx + 0xb0]
test ecx, ecx
jne 0x1400857a5
mov qword [rdi], r8
mov qword [rdi + 8], r8
mov qword [rdi + 0x10], r8
jmp 0x14008584c
lea rbx, [rdx + rcx]
mov ebp, dword [rax + rdx + 0xb4]
add rbp, rbx
mov rcx, qword [rsp + 0x30]
cmp rbx, rbp
jae 0x14008582f
nop dword [rax]
mov edx, dword [rbx + 4]
test edx, edx
je 0x14008582f
mov eax, dword [rbx]
add rax, rsi
mov qword [rsp + 0x40], rax
lea rax, [rbx + 8]
mov qword [rsp + 0x48], rax
lea rax, [rdx - 8]
shr rax, 1
mov dword [rsp + 0x50], eax
cmp rcx, r8
je 0x140085808
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rcx], xmm0
movsd xmm1, qword [rsp + 0x50]
movsd qword [rcx + 0x10], xmm1
add rcx, 0x18
mov qword [rsp + 0x30], rcx
jmp 0x140085824
lea r8, [rsp + 0x40]
mov rdx, rcx
lea rcx, [rsp + 0x28]
call fcn.140085e70
mov r8, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov eax, dword [rbx + 4]
add rbx, rax
cmp rbx, rbp
jb 0x1400857c0
mov rax, qword [rsp + 0x28]
mov qword [rdi], rax
mov qword [rdi + 8], rcx
mov qword [rdi + 0x10], r8
jmp 0x14008584c
mov qword [rcx], r8
mov qword [rcx + 8], r8
mov qword [rcx + 0x10], r8
mov rax, rdi
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
Function at 0x140085870
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 8], rcx
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xa0
mov r12, rdx
mov rdx, rcx
xor r8d, r8d
mov eax, 0x5a4d
cmp word [r12], ax
jne 0x140085a92
movsxd rax, dword [r12 + 0x3c]
cmp dword [rax + r12], 0x4550
jne 0x140085a92
mov ecx, dword [rax + r12 + 0x90]
test ecx, ecx
jne 0x1400858e1
mov qword [rdx], r8
mov qword [rdx + 8], r8
mov qword [rdx + 0x10], r8
jmp 0x140085a9d
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x49], xmm0
mov rbx, r8
mov qword [rbp - 0x39], rbx
lea r13, [r12 + rcx]
mov r14, qword [rbp - 0x41]
cmp dword [r13 + 0x10], 0
je 0x140085a81
xorps xmm0, xmm0
movups xmmword [rbp - 9], xmm0
mov qword [rbp + 7], r8
mov qword [rbp + 0xf], 0xf
mov byte [rbp - 9], 0
movdqu xmmword [rbp + 0x17], xmm0
mov r15, r8
mov qword [rbp + 0x27], r8
mov edx, dword [r13 + 0xc]
add rdx, r12
movups xmmword [rbp - 0x31], xmm0
mov qword [rbp - 0x21], r8
mov qword [rbp - 0x19], r8
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x140085940
lea rcx, [rbp - 0x31]
call fcn.140061160
movups xmm0, xmmword [rbp - 0x31]
movups xmmword [rbp - 9], xmm0
movups xmm1, xmmword [rbp - 0x21]
movups xmmword [rbp + 7], xmm1
mov esi, dword [r13 + 0x10]
add rsi, r12
mov edi, dword [r13]
add rdi, r12
mov rax, qword [rdi]
test rax, rax
je 0x140085a23
mov rbx, qword [rbp + 0x1f]
xorps xmm0, xmm0
movups xmmword [rbp - 0x31], xmm0
mov qword [rbp - 0x21], 0
mov qword [rbp - 0x19], 0xf
mov byte [rbp - 0x31], 0
lea rdx, [r12 + 2]
add rdx, rax
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x1400859b0
lea rcx, [rbp - 0x31]
call fcn.140085ad0
mov qword [rbp - 0x11], rsi
cmp rbx, r15
je 0x1400859ea
lea rdx, [rbp - 0x31]
mov rcx, rbx
call fcn.14005e540
mov rax, qword [rbp - 0x11]
mov qword [rbx + 0x20], rax
add rbx, 0x28
mov qword [rbp + 0x1f], rbx
jmp 0x140085a02
lea r8, [rbp - 0x31]
mov rdx, rbx
lea rcx, [rbp + 0x17]
call fcn.140086090
mov r15, qword [rbp + 0x27]
mov rbx, qword [rbp + 0x1f]
add rdi, 8
add rsi, 8
lea rcx, [rbp - 0x31]
call fcn.14005ed40
mov rax, qword [rdi]
test rax, rax
jne 0x140085981
mov rbx, qword [rbp - 0x39]
cmp r14, rbx
je 0x140085a3e
lea rdx, [rbp - 9]
mov rcx, r14
call fcn.1400864e0
add r14, 0x38
mov qword [rbp - 0x41], r14
jmp 0x140085a56
lea r8, [rbp - 9]
mov rdx, r14
lea rcx, [rbp - 0x49]
call fcn.140085c30
mov r14, qword [rbp - 0x41]
mov rbx, qword [rbp - 0x39]
add r13, 0x14
lea rcx, [rbp + 0x17]
call fcn.1400855f0
lea rcx, [rbp - 9]
call fcn.14005ed40
cmp dword [r13 + 0x10], 0
mov r8d, 0
jne 0x140085903
mov rdx, qword [rbp + 0x67]
mov rax, qword [rbp - 0x49]
mov qword [rdx], rax
mov qword [rdx + 8], r14
mov qword [rdx + 0x10], rbx
jmp 0x140085a9d
mov qword [rcx], r8
mov qword [rcx + 8], r8
mov qword [rcx + 0x10], r8
mov rax, rdx
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x14008a600
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x280]
sub rsp, 0x380
mov rbx, rcx
xor edi, edi
xor edx, edx
mov r8d, 0x20a
lea rcx, [rbp + 0x70]
call fcn.1400f14e0
lea rdx, [rbp + 0x70]
mov ecx, 0x105
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x104
ja 0x14008a673
lea rcx, [rbp + 0x70]
mov rax, 0xffffffffffffffff
lea rax, [rax + 1]
cmp word [rcx + rax*2], di
jne 0x14008a653
cmp word [rbp + rax*2 + 0x6e], 0x5c
jne 0x14008a66a
mov word [rbp + rax*2 + 0x6e], di
lea rdx, [rbp + 0x70]
jmp 0x14008a7a4
mov r8d, 1
lea rdx, str.C:_bKernellog.log
lea rcx, [rsp + 0x60]
call fcn.1400779b0
nop
mov rax, qword [rsp + 0x60]
movsxd rcx, dword [rax + 4]
cmp dword [rsp + rcx + 0x70], 0
jne 0x14008a731
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov ecx, 0x20
call fcn.1400ba130
mov qword [rsp + 0x38], rax
movdqa xmm0, xmmword [0x14013df00]
movdqu xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [str.____Failed_to_get_temp_path_n]
movups xmmword [rax], xmm1
movsd xmm0, qword [0x14013d638]
movsd qword [rax + 0x10], xmm0
mov ecx, dword [0x14013d640]
mov dword [rax + 0x18], ecx
mov byte [rax + 0x1c], 0
lea rcx, [rsp + 0x38]
call fcn.14006d5d0
nop
mov rdx, qword [rsp + 0x50]
cmp rdx, 0xf
jbe 0x14008a731
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008a72b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008a7c4
call fcn.1400b9d58
nop
mov rax, qword [rsp + 0x60]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x60], rax
mov rax, qword [rsp + 0x60]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rsp + rcx + 0x5c], edx
lea rcx, [rsp + 0x70]
call fcn.14005deb0
mov rax, qword [rsp + 0x60]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x60], rax
mov rax, qword [rsp + 0x60]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x18]
mov dword [rsp + rcx + 0x5c], edx
lea rax, vtable.std::ios_base.0
mov qword [rbp + 0x10], rax
lea rcx, [rbp + 0x10]
call fcn.1400bb848
nop
lea rdx, [0x14013b4e8]
mov rcx, rbx
call fcn.1400784a0
mov rax, rbx
lea r11, [rsp + 0x380]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
call fcn.1400d3378
nop
int3
Function at 0x14008a9e0
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x40
xor edx, edx
lea r9, [rsp + 0x68]
mov rsi, rcx
xor r14d, r14d
xor r8d, r8d
mov dword [rsp + 0x68], r14d
mov ebx, r14d
lea ecx, [rdx + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x14008aa5f
test rbx, rbx
je 0x14008aa27
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rsp + 0x68]
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rsp + 0x68]
lea r9, [rsp + 0x68]
mov rdx, rax
mov ecx, 0xb
mov rbx, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x14008aa11
test eax, eax
jns 0x14008aa84
test rbx, rbx
je 0x14008aa89
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
add rsp, 0x40
pop r14
pop rsi
pop rbx
ret
test rbx, rbx
jne 0x14008aa94
xor eax, eax
add rsp, 0x40
pop r14
pop rsi
pop rbx
ret
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x70], rdi
mov edi, r14d
cmp dword [rbx], r14d
jbe 0x14008ab66
nop word [rax + rax]
mov eax, edi
xorps xmm0, xmm0
imul rcx, rax, 0x128
movups xmmword [rsp + 0x20], xmm0
movzx edx, word [rcx + rbx + 0x2e]
lea rbp, [rcx + rbx]
add rdx, 0x30
mov qword [rsp + 0x30], r14
add rdx, rcx
mov qword [rsp + 0x38], r14
add rdx, rbx
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], r14b
jne 0x14008aae5
lea rcx, [rsp + 0x20]
call fcn.140061160
cmp qword [rsi + 0x18], 0xf
mov rdx, rsi
jbe 0x14008ab05
mov rdx, qword [rsi]
cmp qword [rsp + 0x38], 0xf
lea rcx, [rsp + 0x20]
cmova rcx, qword [rsp + 0x20]
call fcn.1400d41fc
test eax, eax
je 0x14008ab8c
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x14008ab5c
mov rcx, qword [rsp + 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008ab57
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008abdf
call fcn.1400b9d58
inc edi
cmp edi, dword [rbx]
jb 0x14008aab0
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rbp, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rsi
pop rbx
ret
mov rdi, qword [rbp + 0x18]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x14008abda
mov rcx, qword [rsp + 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008abd5
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008abdf
call fcn.1400b9d58
mov rax, rdi
jmp 0x14008ab79
call fcn.1400d3378
int3
Function at 0x14008ada0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x14008ae01
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x14008adc0
mov ecx, dword [r9]
jmp 0x14008aeeb
cmp ecx, 0x4e0
jb 0x14008aeeb
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
add r10, 4
mov edx, r11d
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x14008ae20
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x14008ae70
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x14008b120
Capabilities:
Get storage device properties

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x70
mov rbx, rdx
xor r15d, r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor edx, edx
lea r8d, [r15 + 3]
lea rcx, str..PhysicalDrive0
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x14008b186
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 0xf
mov byte [rbx], r15b
jmp 0x14008b2eb
lea rax, [0x14008b310]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x4c], r15
mov dword [rsp + 0x48], r15d
mov qword [rsp + 0xb0], r15
mov dword [rsp + 0xa0], r15d
mov qword [rsp + 0x38], r15
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 8
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
mov r9d, 0xc
lea r8, [rsp + 0x48]
mov edx, 0x2d1400
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x14008b20e
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 0xf
mov byte [rbx], al
jmp 0x14008b2dc
mov esi, dword [rsp + 0xb4]
mov ecx, esi
call fcn.1400ba344
mov r14, rax
mov r8d, esi
xor edx, edx
mov rcx, rax
call fcn.1400f14e0
mov qword [rsp + 0xb8], r14
mov qword [rsp + 0x38], r15
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r14
mov r9d, 0xc
lea r8, [rsp + 0x48]
mov edx, 0x2d1400
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
xorps xmm0, xmm0
test eax, eax
jne 0x14008b28b
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 0xf
mov byte [rbx], al
mov rcx, r14
call fcn.1400b9d58
nop
jmp 0x14008b2dc
mov eax, dword [r14 + 0x18]
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r15
test eax, eax
jne 0x14008b2af
mov qword [rbx + 0x18], 0xf
mov byte [rbx], al
mov rcx, r14
call fcn.1400b9d58
nop
jmp 0x14008b2dc
lea rdx, [r14 + rax]
mov qword [rbx + 0x18], r15
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rdx + r8], 0
jne 0x14008b2c0
mov rcx, rbx
call fcn.140061160
nop
mov rcx, r14
call fcn.1400b9d58
nop
test rbp, rbp
je 0x14008b2eb
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rax, rbx
mov rbx, qword [rsp + 0xa8]
add rsp, 0x70
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14008c9e0
Capabilities:
Hash data using sha512

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x10], rdx
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x150]
sub rsp, 0x250
mov r15, rdx
mov r14, rcx
xor ebx, ebx
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
xor edx, edx
mov r8d, 0x100
lea rcx, [rsp + 0x78]
call fcn.1400f14e0
movabs rax, 0x6a09e667f3bcc908
mov qword [rbp + 0x78], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rbp + 0x80], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rbp + 0x88], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rbp + 0x90], rax
movabs rax, 0x510e527fade682d1
mov qword [rbp + 0x98], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rbp + 0xa0], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rbp + 0xa8], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rbp + 0xb0], rax
mov qword [rsp + 0x70], rbx
mov esi, dword [r15 + 0x10]
mov r12, r15
cmp qword [r15 + 0x18], 0xf
jbe 0x14008cad8
mov r12, qword [r15]
mov ebx, 0x80
cmp esi, ebx
cmovb ebx, esi
mov r8d, ebx
mov rdx, r12
lea rcx, [rsp + 0x78]
call fcn.1400f18a0
mov ecx, dword [rsp + 0x74]
add ecx, esi
cmp ecx, 0x80
jae 0x14008cb06
mov dword [rsp + 0x74], ecx
jmp 0x14008cb61
sub esi, ebx
mov edi, esi
shr edi, 7
add rbx, r12
mov r8d, 1
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x70]
call fcn.14008bbb0
mov r8d, edi
mov rdx, rbx
lea rcx, [rsp + 0x70]
call fcn.14008bbb0
and esi, 0x7f
mov r8d, esi
mov edx, edi
shl edx, 7
add rdx, rbx
lea rcx, [rsp + 0x78]
call fcn.1400f18a0
mov dword [rsp + 0x74], esi
shl edi, 7
mov ecx, dword [rsp + 0x70]
sub ecx, 0xffffff80
add ecx, edi
mov dword [rsp + 0x70], ecx
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x70]
call fcn.14008c5c0
mov byte [rbp + 0x140], 0
lea rbx, [rsp + 0x30]
lea rdi, [rbp + 0xc0]
mov esi, 0x40
nop dword [rax + rax]
movzx r8d, byte [rbx]
lea rdx, str._02x
mov rcx, rdi
call fcn.14001cae0
add rdi, 2
lea rbx, [rbx + 1]
sub rsi, 1
jne 0x14008cb90
xorps xmm0, xmm0
movups xmmword [r14], xmm0
xor eax, eax
mov qword [r14 + 0x10], rax
mov qword [r14 + 0x18], rax
lea rax, [rbp + 0xc0]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x14008cbd0
lea rdx, [rbp + 0xc0]
mov rcx, r14
call fcn.140061160
nop
mov rcx, r15
call fcn.14005ed40
mov rax, r14
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret

Function at 0x14008ccc0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x13], 0
je 0x14008cce3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x34]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0x12
jb 0x14008ccd0
mov byte [rcx + 0x13], 0
mov rax, rcx
ret

Function at 0x14008ccf0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x10], 0
je 0x14008cd13
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x34]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0xf
jb 0x14008cd00
mov byte [rcx + 0x10], 0
mov rax, rcx
ret
Function at 0x14008dab0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xf], 0
je 0x14008dad3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x34]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0xe
jb 0x14008dac0
mov byte [rcx + 0xf], 0
mov rax, rcx
ret

Function at 0x14008dd00
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x24], 0
je 0x14008dd23
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x34]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0x23
jb 0x14008dd10
mov byte [rcx + 0x24], 0
mov rax, rcx
ret
Function at 0x14008fa30
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 8], 0
je 0x14008fa53
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x34]
xor byte [rcx + rax], dl
inc rax
cmp rax, 7
jb 0x14008fa40
mov byte [rcx + 8], 0
mov rax, rcx
ret

Function at 0x14008fa60
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xc], 0
je 0x14008fa83
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x34]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0xb
jb 0x14008fa70
mov byte [rcx + 0xc], 0
mov rax, rcx
ret

Function at 0x14008fa90
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x25], 0
je 0x14008fab3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x34]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0x24
jb 0x14008faa0
mov byte [rcx + 0x25], 0
mov rax, rcx
ret

Function at 0x14008fac0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1b], 0
je 0x14008fae3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x34]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0x1a
jb 0x14008fad0
mov byte [rcx + 0x1b], 0
mov rax, rcx
ret
Function at 0x140090c70
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x12], 0
je 0x140090c93
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x34]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0x11
jb 0x140090c80
mov byte [rcx + 0x12], 0
mov rax, rcx
ret