joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140011b50
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
mov rax, qword [0x1400f3e08]
xor rax, rsp
mov qword [rsp + 0x90], rax
movzx ebp, byte [rsp + 0x100]
mov r13, r9
mov rax, qword [rsp + 0x108]
mov r12, rdx
mov rdi, qword [rsp + 0x130]
mov esi, ecx
mov r15, qword [rsp + 0x120]
lea r14d, [rbp + 0x67]
movzx ebx, r8b
add r14w, bx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
cmp word [rsp + 0x128], r14w
jb 0x140011d36
mov r9d, 2
lea rdx, [rsp + 0x40]
xor ecx, ecx
lea r8d, [r9 - 1]
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
cmp esi, 0xcf43336b
mov dword [rdi + 1], esi
mov eax, 0xc0
mov byte [rdi + 5], bl
mov ecx, 0xf0
cmove ecx, eax
movzx eax, byte [rsp + 0x40]
and al, 0xf
or cl, al
mov byte [rdi], cl
add rdi, 6
test bl, bl
je 0x140011c1a
mov r8d, ebx
mov rdx, r12
mov rcx, rdi
call fcn.140081340
add rdi, rbx
mov byte [rdi], bpl
inc rdi
test bpl, bpl
je 0x140011c36
mov r8, rbp
mov rdx, r13
mov rcx, rdi
call fcn.140081340
add rdi, rbp
movups xmm0, xmmword [r15]
lea rdx, [0x1400d1310]
mov rcx, rdx
movups xmmword [rdi], xmm0
movups xmm1, xmmword [r15 + 0x10]
movups xmmword [rdi + 0x10], xmm1
movups xmm0, xmmword [r15 + 0x20]
movups xmmword [rdi + 0x20], xmm0
movups xmm1, xmmword [r15 + 0x30]
movups xmmword [rdi + 0x30], xmm1
movups xmm0, xmmword [r15 + 0x40]
movups xmmword [rdi + 0x40], xmm0
add rdi, 0x50
xor ebx, ebx
mov ebp, ebx
mov eax, ebx
cmp dword [rcx], esi
je 0x140011c86
inc eax
add rcx, 0x58
cmp eax, 4
jb 0x140011c75
jmp 0x140011c8f
imul rbp, rax, 0x58
add rbp, rdx
jne 0x140011d01
test byte [0x1400f8b38], 4
je 0x140011cff
lea rax, [rsp + 0x48]
mov dword [rsp + 0x48], 0x1d1
mov qword [rsp + 0x60], rax
lea rdx, [0x1400d0898]
lea rax, str.C:Users_adminDownloadsquicreach_mainquicreachmsquic_srccorepacket.c
mov qword [rsp + 0x68], 4
mov qword [rsp + 0x70], rax
mov r9d, 4
lea rax, str.VersionInfo_____void__0_
mov qword [rsp + 0x78], 0x4b
mov qword [rsp + 0x80], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x88], 0x1b
call fcn.140001460
int 0x2c
mov rax, qword [rsp + 0x30]
lea r9d, [r14 - 0x10]
mov r8, qword [rsp + 0x38]
mov rcx, rbp
movzx edx, byte [rsp + 0x110]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call fcn.140011910
test eax, eax
cmovs r14w, bx
movzx eax, r14w
jmp 0x140011d3b
xor ebx, ebx
movzx eax, bx
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.14007f5b0
mov rbx, qword [rsp + 0xe0]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x140013c60
Capabilities:
Generate random numbers via winapi

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x1400f3e08]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov r9d, 2
lea rdx, [rsp + 0x20]
movzx ebx, cx
mov r8d, r9d
xor ecx, ecx
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
movzx eax, word [0x1400f7578]
not ax
and ax, word [rsp + 0x20]
or ax, bx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14007f5b0
add rsp, 0x30
pop rbx
ret
Function at 0x140013cc0
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
movzx r14d, r8w
movzx ebp, r9b
movzx r8d, byte [0x1400f757c]
mov rbx, rdx
mov rdi, rcx
add r8, 0x38
mov rcx, qword [0x1400f8a70]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
je 0x140013da2
mov qword [rax + 0x20], rdi
xorps xmm0, xmm0
lea rdi, [rax + 0x38]
movups xmmword [rax + 0x28], xmm0
movzx ecx, byte [0x1400f757c]
mov byte [rax + 0x29], cl
test rbx, rbx
je 0x140013d42
movzx r8d, byte [0x1400f757b]
mov rdx, rbx
mov rcx, rdi
call fcn.140081340
jmp 0x140013d5b
movzx r8d, byte [0x1400f757b]
mov r9d, 2
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
movzx eax, byte [0x1400f757b]
add rdi, rax
mov word [rdi], r14w
add rdi, 2
test bpl, bpl
je 0x140013d85
mov rdx, qword [rsp + 0x50]
mov r8, rbp
mov rcx, rdi
call fcn.140081340
add rdi, rbp
mov r8d, 7
mov r9d, 2
sub r8d, ebp
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
mov rax, rsi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140030360
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
movzx esi, dl
lea r9, [rsp + 0x48]
mov rdx, rcx
mov rdi, r8
xor ebx, ebx
lea rcx, [0x1400f7628]
lea r8, [rsp + 0x38]
mov dword [rsp + 0x38], ebx
call fcn.140030080
test sil, sil
je 0x140030416
mov eax, dword [rsp + 0x48]
lea r8d, [rax + rax]
cmp sil, 0x14
jae 0x1400303b0
mov ecx, esi
test sil, sil
je 0x140030400
jmp 0x1400303b5
mov ecx, reloc.OLEAUT32.dll_SafeArrayLock
mov r9d, ecx
lea r10, [0x1400f7470]
nop
movzx edx, byte [rdi]
lea rdi, [rdi + 1]
mov eax, r8d
mov ecx, edx
shl rax, 4
inc r8d
shr rcx, 4
and edx, 0xf
add rcx, rax
mov eax, r8d
shl rax, 4
inc r8d
add rax, rdx
xor ebx, dword [r10 + rcx*4 + 0x1b8]
xor ebx, dword [r10 + rax*4 + 0x1b8]
sub r9, 1
jne 0x1400303c0
mov eax, dword [rsp + 0x38]
xor eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov eax, dword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140031500
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0xf0
mov rax, qword [0x1400f3e08]
xor rax, rsp
mov qword [rsp + 0xe0], rax
mov r9, qword [rcx + 0x18]
xor eax, eax
mov r8, qword [rcx + 0x10]
mov rsi, rdx
mov rbx, rcx
mov qword [rsp + 0x28], rax
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsi], rax
mov r9, rax
test rax, rax
jne 0x140031558
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14003167b
test byte [rbx], 2
xorps xmm0, xmm0
movzx ecx, word [rbx + 2]
mov rax, qword [0x1400f8b00]
mov qword [rsp + 0x110], rdi
movups xmmword [rsp + 0x30], xmm0
lea rdi, [rax + rcx*8]
je 0x14003158d
mov ecx, dword [rdi]
mov eax, 1
shl rax, cl
mov qword [rsp + 0x30], rax
jmp 0x1400315a4
movzx ecx, word [rdi + 4]
mov rax, qword [0x1400f8b18]
add rcx, rcx
mov rcx, qword [rax + rcx*8]
mov qword [rsp + 0x30], rcx
movzx eax, word [rdi + 4]
lea rdx, [rsp + 0x30]
xor r8d, r8d
mov word [rsp + 0x38], ax
mov rcx, r9
call qword [sym.imp.KERNEL32.dll_SetThreadGroupAffinity]
test byte [rbx], 1
je 0x1400315ce
mov edx, dword [rdi]
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_SetThreadIdealProcessor]
test byte [rbx], 4
mov rdi, qword [rsp + 0x110]
je 0x1400315e9
mov rcx, qword [rsi]
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov r9, qword [rbx + 8]
test r9, r9
je 0x140031679
xorps xmm0, xmm0
mov qword [rsp + 0x20], 0xffffffffffffffff
mov r8d, 0x3f
movaps xmmword [rsp + 0x60], xmm0
lea rdx, [rsp + 0x60]
movaps xmmword [rsp + 0x70], xmm0
lea rcx, [rsp + 0x40]
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0xb0], xmm0
movaps xmmword [rsp + 0xc0], xmm0
movaps xmmword [rsp + 0xd0], xmm0
call fcn.14008bb7c
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov rcx, qword [rsi]
lea r8, [rsp + 0x48]
mov r9d, reloc.WS2_32.dll_recv
lea edx, [r9 + 0x16]
call qword [sym.imp.ntdll.dll_NtSetInformationThread]
xor eax, eax
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.14007f5b0
mov rbx, qword [rsp + 0x118]
add rsp, 0xf0
pop rsi
ret
Function at 0x14003b910
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x20], rsi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
mov rax, qword [0x1400f3e08]
xor rax, rsp
mov qword [rbp + 0x4f], rax
mov rdx, qword [rcx + 0x60]
mov rsi, rcx
test rdx, rdx
je 0x14003bab0
mov r9, qword [rdx + 0x20]
mov r8d, 0x80
mov qword [rsp + 0xc0], rdi
xor edi, edi
cmp dword [rdx + 4], r8d
ja 0x14003b95f
mov r8d, edi
jmp 0x14003b971
bsr eax, r8d
mov dword [rbp - 0x19], edi
btc r8d, eax
add eax, 0xfffffff9
mov r9, qword [r9 + rax*8]
inc dword [rdx + 0x18]
mov ecx, r8d
shl rcx, 4
add rcx, r9
cmp qword [rcx], rcx
jne 0x14003b986
inc dword [rdx + 0x14]
mov rax, qword [rcx]
lea rdx, [rbp - 9]
mov qword [rbp - 9], rax
mov qword [rbp - 1], rcx
mov qword [rax + 8], rdx
lea rax, [rbp - 9]
mov qword [rcx], rax
lea rdx, [rbp - 9]
mov qword [rbp + 0xf], rcx
mov rcx, qword [rsi + 0x60]
mov dword [rbp + 0x17], edi
mov qword [rbp + 7], rdi
call fcn.14005cd30
test rax, rax
je 0x14003ba7d
mov qword [rsp + 0xb8], rbx
nop dword [rax]
lea rbx, [rax - 0x20]
movzx eax, byte [0x1400f8b3c]
test al, 8
je 0x14003ba15
movzx eax, byte [rbx + 0x50]
lea rdx, [0x1400d07a8]
mov r9, qword [rbx + 0x48]
mov r8, rbx
cmp dword [r9], 3
sete cl
and al, 1
xor cl, al
mov rax, qword [rbx + 0x50]
mov byte [rsp + 0x28], cl
mov qword [rsp + 0x20], rax
call fcn.14002e5d0
movzx eax, byte [0x1400f8b3c]
test al, 4
je 0x14003ba5f
movzx eax, byte [rbx + 0x62]
lea rdx, [0x1400d0668]
mov byte [rbp - 0x11], al
mov r9d, 3
lea rax, [rbp - 0x19]
mov qword [rbp - 0x19], rbx
mov qword [rbp + 0x2f], rax
lea rax, [rbp - 0x11]
mov qword [rbp + 0x3f], rax
lea rax, [rbp + 0x1f]
mov qword [rsp + 0x20], rax
mov qword [rbp + 0x37], 8
mov qword [rbp + 0x47], 1
call fcn.140001460
mov rcx, qword [rsi + 0x60]
lea rdx, [rbp - 9]
call fcn.14005cd30
test rax, rax
jne 0x14003b9d0
mov rbx, qword [rsp + 0xb8]
mov rcx, qword [rsi + 0x60]
lea rax, [rbp - 9]
mov rdi, qword [rsp + 0xc0]
dec dword [rcx + 0x18]
mov rdx, qword [rbp - 9]
cmp rdx, rax
je 0x14003bab0
mov rax, qword [rbp - 1]
mov qword [rax], rdx
mov qword [rdx + 8], rax
mov rax, qword [rbp + 0xf]
cmp qword [rax], rax
jne 0x14003bab0
dec dword [rcx + 0x14]
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.14007f5b0
mov rsi, qword [rsp + 0xc8]
add rsp, 0xa0
pop rbp
ret
Function at 0x1400412e0
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x100
mov rax, qword [0x1400f3e08]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov rbx, rdx
mov rdi, rcx
mov rcx, rbx
xor edx, edx
mov r8d, 0xf0
call fcn.1400819f0
movzx eax, byte [rdi + 0x108]
mov esi, 0
mov byte [rbx], al
mov eax, 0xffffffff
inc byte [rdi + 0x108]
or byte [rbx + 1], 1
mov qword [rbx + 0xa8], rax
movzx eax, word [rdi + 0xd8]
mov word [rbx + 0x10], ax
imul ecx, dword [rdi + 0xb8], 0x3e8
movzx eax, byte [rbx + 2]
mov qword [rbx + 0x98], rcx
shr rcx, 1
mov qword [rbx + 0xb8], rcx
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
test byte [rdi + 0xe4], 1
cmovne ecx, esi
and al, 0xe7
or cl, al
mov byte [rbx + 2], cl
mov rax, qword [0x1400f75a0]
test rax, rax
je 0x1400413a6
test byte [rax], 1
je 0x1400413a6
lea rdx, [rbx + 0x8c]
xor ecx, ecx
lea r9d, [rsi + 2]
lea r8d, [rsi + 4]
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
test byte [0x1400f8b3b], 0x80
je 0x14004142c
movzx eax, byte [rbx]
lea r9, str.Path__hhu__Initialized
mov rbx, 0xffffffffffffffff
mov dword [rsp + 0x20], eax
mov r8, rbx
lea rcx, [rsp + 0x70]
mov edx, 0x80
call fcn.1400015d0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x50], 8
inc rbx
cmp byte [rax + rbx], sil
jne 0x1400413f3
lea rax, [rsp + 0x70]
mov dword [rsp + 0x64], esi
mov qword [rsp + 0x58], rax
lea rdx, [0x1400d0508]
lea rax, [rsp + 0x38]
inc ebx
mov r9d, 3
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x60], ebx
call fcn.140001460
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.14007f5b0
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x140052470
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
movzx edx, byte [rcx + 0x170]
lea r9, [rcx + 0xb0]
mov rbx, rcx
shr dl, 2
lea r8, [rcx + 0x30]
and dl, 0xf
mov rcx, qword [rcx + 0x28]
mov rcx, qword [rcx + 0x10]
call fcn.140057cc0
test eax, eax
jns 0x1400524c7
mov ecx, 0xa
movsxd r8, eax
mov word [rsp + 0x20], cx
lea r9, str.HP_failure
lea edx, [rcx + 8]
mov rcx, qword [rbx]
call fcn.140017410
add rsp, 0x30
pop rbx
ret
movzx ecx, byte [rbx + 0x170]
xor r10b, r10b
test cl, 0x3c
jbe 0x140052557
nop word [rax + rax]
movzx eax, r10b
movzx r9d, r10b
shl r9, 4
mov rdx, qword [rbx + rax*8 + 0x130]
movzx eax, byte [r9 + rbx + 0xb0]
and al, 0x1f
xor byte [rdx], al
mov rax, qword [rbx + 8]
mov rcx, qword [rax + 0x90]
xor al, al
movzx r11d, byte [rcx + 0x21]
inc r11
add r11, rdx
cmp byte [rbx + 0x179], al
jbe 0x140052540
movzx ecx, al
inc al
lea r8, [rcx + r11]
add rcx, r9
movzx edx, byte [rcx + rbx + 0xb1]
xor byte [r8], dl
cmp al, byte [rbx + 0x179]
jb 0x140052521
movzx ecx, byte [rbx + 0x170]
inc r10b
movzx eax, cl
shr al, 2
and al, 0xf
cmp r10b, al
jb 0x1400524e0
and cl, 0xc3
mov byte [rbx + 0x170], cl
add rsp, 0x30
pop rbx
ret
Function at 0x140053630
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x1400f3e08]
xor rax, rsp
mov qword [rsp + 0x70], rax
lea rbx, [rcx - 0x880]
mov rdi, rcx
mov rcx, rbx
movzx esi, dl
call fcn.140013ea0
mov eax, dword [rdi + 0x94]
cmp dword [rdi + 0xb0], eax
jb 0x140053681
cmp byte [rdi + 0xbc], 0
ja 0x140053681
xor al, al
jmp 0x140053683
mov al, 1
cmp sil, al
je 0x140053763
test sil, sil
je 0x140053787
test byte [rbx + 0x10a], 8
jne 0x140053763
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov r8, qword [0x1400f8b08]
xor edx, edx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
mov ecx, ecx
shr rax, 0x20
imul r9, rax, 0xf4240
mov rax, r9
div r8
mov rax, rdx
shl rax, 0x20
imul rdx, rcx, 0xf4240
add rax, rdx
xor edx, edx
div r8
xor edx, edx
mov rcx, rax
mov rax, r9
div r8
shl rax, 0x20
add rcx, rax
movzx eax, byte [rbx + 0x10a]
or al, 8
mov qword [rbx + 0xf88], rcx
mov byte [rbx + 0x10a], al
test byte [0x1400f8b3a], 0x10
je 0x140053763
mov byte [rsp + 0x30], al
lea rdx, [0x1400cfe20]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x50], rax
mov r9d, 3
lea rax, [rsp + 0x30]
mov qword [rsp + 0x58], 8
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x68], 1
call fcn.140001460
xor al, al
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14007f5b0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
mov edx, 8
mov rcx, rbx
call fcn.140014370
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov r8, qword [0x1400f8b08]
xor edx, edx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
mov ecx, ecx
shr rax, 0x20
imul r9, rax, 0xf4240
mov rax, r9
div r8
mov rax, rdx
shl rax, 0x20
imul rdx, rcx, 0xf4240
add rax, rdx
xor edx, edx
div r8
xor edx, edx
mov rcx, rax
mov rax, r9
div r8
shl rax, 0x20
add rcx, rax
mov al, 1
mov qword [rbx + 0xd68], rcx
jmp 0x140053765

Function at 0x140054950
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rax, qword [0x1400f3e08]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov r9d, 2
mov dword [rcx + 0xdc], 2
mov rdi, rdx
mov dword [rcx + 0xb0], 0x200
mov rbx, rcx
mov dword [rsp + 0x20], 0
lea rdx, [rsp + 0x20]
xor ecx, ecx
lea r8d, [r9 + 2]
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
mov r8d, dword [rsp + 0x20]
mov eax, 0x24924925
mul r8d
mov eax, r8d
mov qword [rbx + 0xe0], rdi
sub eax, edx
lea ecx, [r8 + 2]
shr eax, 1
add eax, edx
shr eax, 2
add ecx, eax
lea rax, [0x1400d1898]
and ecx, 7
mov dword [rbx + 0xc4], ecx
mov eax, dword [rax + rcx*4]
mov dword [rbx + 0xb4], eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14007f5b0
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140054ed0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x1400f3e08]
xor rax, rsp
mov qword [rsp + 0x70], rax
lea rdi, [rcx - 0x880]
mov rbx, rcx
mov rcx, rdi
movzx esi, dl
call fcn.140013ea0
cmp dword [rbx + 0xdc], 3
movzx ecx, word [rbx - 0x740]
jne 0x140054f37
cmp word [rbx - 0x718], 2
mov eax, 0x1c
mov edx, 0x30
cmovne ax, dx
sub cx, ax
movzx ecx, cx
shl ecx, 2
jmp 0x140054f51
cmp dword [rbx + 0xd8], 0
mov ecx, dword [rbx + 0x90]
je 0x140054f51
mov eax, dword [rbx + 0x98]
cmp ecx, eax
cmovae ecx, eax
cmp dword [rbx + 0x9c], ecx
jb 0x140054f66
cmp byte [rbx + 0xa4], 0
ja 0x140054f66
xor al, al
jmp 0x140054f68
mov al, 1
cmp sil, al
je 0x140055048
test sil, sil
je 0x14005506c
test byte [rdi + 0x10a], 8
jne 0x140055048
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov r8, qword [0x1400f8b08]
xor edx, edx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
mov ecx, ecx
shr rax, 0x20
imul r9, rax, 0xf4240
mov rax, r9
div r8
mov rax, rdx
shl rax, 0x20
imul rdx, rcx, 0xf4240
add rax, rdx
xor edx, edx
div r8
xor edx, edx
mov rcx, rax
mov rax, r9
div r8
shl rax, 0x20
add rcx, rax
movzx eax, byte [rdi + 0x10a]
or al, 8
mov qword [rdi + 0xf88], rcx
mov byte [rdi + 0x10a], al
test byte [0x1400f8b3a], 0x10
je 0x140055048
mov byte [rsp + 0x30], al
lea rdx, [0x1400cfe20]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x50], rax
mov r9d, 3
lea rax, [rsp + 0x30]
mov qword [rsp + 0x58], 8
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x68], 1
call fcn.140001460
xor al, al
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14007f5b0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
mov edx, 8
mov rcx, rdi
call fcn.140014370
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov r8, qword [0x1400f8b08]
xor edx, edx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
mov ecx, ecx
shr rax, 0x20
imul r9, rax, 0xf4240
mov rax, r9
div r8
mov rax, rdx
shl rax, 0x20
imul rdx, rcx, 0xf4240
add rax, rdx
xor edx, edx
div r8
xor edx, edx
mov rcx, rax
mov rax, r9
div r8
shl rax, 0x20
add rcx, rax
mov al, 1
mov qword [rdi + 0xd68], rcx
jmp 0x14005504a
Function at 0x140057860
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
sub rsp, 0xc8
mov rax, qword [0x1400f3e08]
xor rax, rsp
mov qword [rsp + 0xb8], rax
mov r10, qword [rsp + 0xf8]
xorps xmm0, xmm0
mov r11, rcx
xor eax, eax
movzx ecx, word [rsp + 0xf0]
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0xa0], rax
movzx eax, r8w
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x68], r9
mov r9d, ecx
movups xmmword [rsp + 0x70], xmm0
lea rcx, [r10 - 0x10]
mov dword [rsp + 0x70], eax
add rcx, r9
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x78], rcx
lea rax, [rsp + 0xb0]
xor ecx, ecx
mov dword [rsp + 0x50], 0x58
mov dword [rsp + 0x48], ecx
lea r8d, [r9 - 0x10]
mov qword [rsp + 0x40], rax
mov rdx, r10
mov dword [rsp + 0x38], r9d
lea r9, [rsp + 0x50]
mov qword [rsp + 0x30], r10
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rcx
mov rcx, r11
movups xmmword [rsp + 0x80], xmm0
mov dword [rsp + 0x54], 1
movups xmmword [rsp + 0x90], xmm0
mov dword [rsp + 0x80], reloc.WS2_32.dll_recv
mov dword [rsp + 0x60], recv
call qword [sym.imp.bcrypt.dll_BCryptEncrypt]
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
test eax, eax
jle 0x14005794b
movzx eax, ax
or eax, 0x80070000
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.14007f5b0
add rsp, 0xc8
ret

Function at 0x140057970
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
sub rsp, 0xc8
mov rax, qword [0x1400f3e08]
xor rax, rsp
mov qword [rsp + 0xb8], rax
mov r10, qword [rsp + 0xf8]
mov r11, rcx
movzx ecx, word [rsp + 0xf0]
xorps xmm0, xmm0
xor eax, eax
mov qword [rsp + 0xa0], rax
movzx eax, r8w
lea r8d, [rcx - 0x10]
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x58], rdx
mov rdx, r10
movups xmmword [rsp + 0x70], xmm0
mov dword [rsp + 0x70], eax
mov eax, ecx
movups xmmword [rsp + 0x60], xmm0
lea rcx, [r10 - 0x10]
mov qword [rsp + 0x68], r9
add rcx, rax
mov dword [rsp + 0x50], 0x58
mov qword [rsp + 0x78], rcx
lea rax, [rsp + 0xb0]
xor ecx, ecx
mov dword [rsp + 0x54], 1
mov dword [rsp + 0x48], ecx
lea r9, [rsp + 0x50]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], r8d
mov qword [rsp + 0x30], r10
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rcx
mov rcx, r11
movups xmmword [rsp + 0x80], xmm0
mov dword [rsp + 0x80], reloc.WS2_32.dll_recv
movups xmmword [rsp + 0x90], xmm0
mov dword [rsp + 0x60], recv
call qword [sym.imp.bcrypt.dll_BCryptDecrypt]
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
test eax, eax
jle 0x140057a5a
movzx eax, ax
or eax, 0x80070000
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.14007f5b0
add rsp, 0xc8
ret
Function at 0x140057cc0
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
mov r11, rsp
push rbp
push rsi
push r13
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x1400f3e08]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor r13d, r13d
movzx esi, dl
cmp dword [rcx + 8], 2
mov r15, r9
mov rbp, r8
mov dword [r11 - 0x68], r13d
mov r14, rcx
jne 0x140057dd4
mov qword [r11 - 0x30], rbx
mov ebx, r13d
mov qword [r11 - 0x38], rdi
mov edi, r13d
mov dword [r11 - 0x64], r13d
mov byte [r11 - 0x60], r13b
mov dword [rcx + 0x20], reloc.WS2_32.dll_recv
test dl, dl
je 0x140057dcf
mov qword [r11 - 0x40], r12
nop word [rax + rax]
mov dword [rsp + 0x48], r13d
lea r9, [r14 + 0x10]
mov ecx, edi
lea rdx, [rsp + 0x54]
mov r8d, 5
lea rax, [rcx + rbp]
mov qword [r14 + 0x18], rax
lea rax, [rcx + r15]
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x40], rcx
mov rcx, qword [r14]
mov dword [rsp + 0x38], reloc.WS2_32.dll_recv
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
call qword [sym.imp.bcrypt.dll_BCryptEncrypt]
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
test eax, eax
jle 0x140057d92
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0x140057d9d
inc ebx
add edi, 0x10
cmp ebx, esi
jb 0x140057d30
mov r12, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14007f5b0
add rsp, 0x90
pop r15
pop r14
pop r13
pop rsi
pop rbp
ret
mov eax, r13d
jmp 0x140057da2
mov rcx, qword [rcx]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x48], r13d
xor r9d, r9d
mov qword [rsp + 0x40], rax
mov rdx, rbp
shl esi, 4
mov dword [rsp + 0x38], esi
mov r8d, esi
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
call qword [sym.imp.bcrypt.dll_BCryptEncrypt]
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
test eax, eax
jle 0x140057db2
movzx eax, ax
or eax, 0x80070000
jmp 0x140057db2

Function at 0x140057f40
Capabilities:
Hash data via bcrypt

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x78
mov rax, qword [0x1400f3e08]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rbp, qword [rsp + 0xc0]
mov esi, r9d
xor r9d, r9d
mov rdi, rcx
call qword [sym.imp.bcrypt.dll_BCryptHashData]
mov ebx, eax
test eax, eax
jns 0x140057f90
test byte [0x1400f8b38], 4
je 0x140057ff9
lea rcx, [0x1400d92b8]
mov qword [rsp + 0x60], SafeArrayLock
jmp 0x140057fc1
xor r9d, r9d
mov r8d, esi
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.bcrypt.dll_BCryptFinishHash]
mov ebx, eax
test eax, eax
jns 0x140057ff9
test byte [0x1400f8b38], 4
je 0x140057ff9
lea rcx, [0x1400d92c8]
mov qword [rsp + 0x60], SafeArrayGetElement
mov dword [rsp + 0x30], eax
lea rdx, [0x1400d0948]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x50], 4
mov qword [rsp + 0x48], rax
mov r9d, 3
lea rax, [rsp + 0x38]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x20], rax
call fcn.140001460
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
test eax, eax
jle 0x14005800d
movzx eax, ax
or eax, 0x80070000
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14007f5b0
add rsp, 0x78
pop rdi
pop rsi
pop rbp
pop rbx
ret