joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002010
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x30
mov r9d, dword [rcx + 0x40044]
mov rdi, r8
mov r8d, edx
mov rbx, rcx
mov rdx, rcx
lea rcx, str.connection_io__p_bytes:_d_state:_d
call fcn.140007d70
mov edx, dword [rsp + 0x48]
test edx, edx
jne 0x140002062
mov rcx, qword [rbx + 0x20]
lea r8, [rsp + 0x48]
xor r9d, r9d
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x1400020c7
mov edx, dword [rsp + 0x48]
mov ecx, dword [rbx + 0x40044]
test ecx, ecx
je 0x14000207f
sub ecx, 1
je 0x140002134
sub ecx, 1
je 0x1400020e4
cmp ecx, 1
jne 0x1400020d9
lea rcx, [rbx + 0x38]
mov dword [rbx + 0x40044], 1
xor edx, edx
mov r8d, 0x4000c
call fcn.140017e30
lea rdx, [rbx + 0x40]
mov r8d, 4
mov rcx, qword [rbx + 0x20]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400020d9
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x1400020d9
mov rcx, rbx
mov dword [rbx + 0x40044], 4
call fcn.1400019c0
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
add dword [rbx + 0x3c], edx
mov eax, dword [rbx + 0x3c]
mov ecx, dword [rbx + 0x38]
cmp eax, ecx
jne 0x140002123
mov rcx, rbx
call fcn.1400021a0
test eax, eax
jne 0x1400020c7
mov r8d, dword [rbx + 0x38]
lea rdx, [rbx + 0x40]
mov rcx, qword [rbx + 0x20]
xor r9d, r9d
mov dword [rbx + 0x40044], 3
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x1400020b6
sub ecx, eax
lea rdx, [rbx + 0x40]
add rdx, rax
mov r8d, ecx
jmp 0x1400020a4
add dword [rbx + 0x3c], edx
lea rdx, [rbx + 0x40]
cmp dword [rbx + 0x3c], 4
jne 0x140002187
movzx eax, byte [rbx + 0x41]
movzx ecx, byte [rdx]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0x42]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0x43]
shl ecx, 8
or ecx, eax
mov dword [rbx + 0x3c], 0
mov dword [rbx + 0x38], ecx
cmp ecx, 0x40000
ja 0x1400020c7
mov dword [rbx + 0x40044], 2
mov r8d, ecx
jmp 0x1400020a4
mov eax, dword [rbx + 0x38]
mov r8d, 4
sub r8d, eax
add rdx, rax
jmp 0x1400020a4
Function at 0x140003240
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
xor edi, edi
mov qword [rsp + 0x50], 0
cmp dword [r8 + 0x40048], 2
mov rcx, 0xffffffff80000002
mov rbx, rdx
mov qword [rsp + 0x40], rcx
jg 0x1400032ba
mov rcx, qword [r8 + 0x28]
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x1400032f0
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x40], rdi
mov ecx, 0xf003f
call qword [sym.imp.ADVAPI32.dll_RegOpenCurrentUser]
test eax, eax
je 0x1400032ab
mov edx, eax
lea rcx, str.unable_to_open_users_registry_hive__ERROR____d
call fcn.140007d10
or edi, 0xffffffff
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
test edi, edi
jne 0x1400032f0
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x50]
mov r9d, 0x10109
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREOpenSSHAgent
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400032f0
mov rcx, qword [rsp + 0x50]
lea rdx, str.Keys
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
xor edi, edi
mov rcx, rbx
lea edx, [rdi + 1]
call fcn.140008460
test eax, eax
jne 0x140003315
mov rcx, qword [rbx + 0x18]
mov rdi, qword [rbx]
add rdi, rcx
lea rax, [rcx + 1]
mov qword [rbx + 0x18], rax
jmp 0x140003317
js 0x14000331c
mov byte [rdi], 6
xor eax, eax
mov rcx, qword [rsp + 0x40]
neg eax
sbb ebx, ebx
test rcx, rcx
je 0x140003330
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140003340
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140003a50
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x1d8
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
call fcn.140003910
call fcn.140003770
test eax, eax
jne 0x140003a99
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x198
call fcn.140017e30
mov ecx, 0x202
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor edx, edx
mov ecx, 0x100010
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [0x14006e9e8], rax
test rax, rax
je 0x140003adc
call fcn.140004ba0
test eax, eax
jne 0x140003adc
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.1400164b0
add rsp, 0x1d8
ret
lea rcx, str.failed_to_initialize_w32posix_wrapper
call fcn.140007c80
int3

Function at 0x140003af0
Capabilities:
Decode data using base64 via winapi

Disassembly:
mov r11, rsp
push rbx
push r14
sub rsp, 0x58
lea rax, [r11 + 0x18]
mov dword [rsp + 0x78], 0
mov qword [r11 - 0x38], rax
xor r9d, r9d
lea rax, [r11 + 0x20]
xor edx, edx
mov qword [r11 - 0x40], rax
mov r8d, 0x20000001
lea rax, [r11 + 0x10]
mov rbx, rcx
mov qword [r11 - 0x48], rax
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
mov ecx, dword [rsp + 0x78]
call fcn.14001da34
mov r14, rax
test rax, rax
je 0x140003cc9
lea rax, [rsp + 0x80]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x30], rax
mov r9, r14
lea rax, [rsp + 0x88]
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x28], rax
xor edx, edx
lea rax, [rsp + 0x78]
mov r8d, 0x20000001
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
movsx ecx, byte [r14 + 4]
mov rax, qword [0x14006c2d0]
mov dword [rax + 0x84], ecx
cmp ecx, 1
jne 0x140003bad
mov rax, qword [0x14006c2d0]
mov dword [rax + 0xb0], 3
movsx ecx, byte [r14 + 5]
mov rax, qword [0x14006c2d8]
mov dword [rax + 0x84], ecx
cmp ecx, 1
jne 0x140003bd5
mov rax, qword [0x14006c2d8]
mov dword [rax + 0xb0], 3
movsx ecx, byte [r14 + 6]
mov rax, qword [0x14006c2e0]
mov dword [rax + 0x84], ecx
cmp ecx, 1
jne 0x140003bfd
mov rax, qword [0x14006c2e0]
mov dword [rax + 0xb0], 3
mov esi, dword [r14]
lea rdi, [r14 + 8]
mov qword [rsp + 0x50], rbp
test esi, esi
je 0x140003caa
lea rbp, [0x14006c2b0]
nop dword [rax + rax]
mov ecx, 0xc0
dec esi
call fcn.14001da34
mov rbx, rax
test rax, rax
je 0x140003cd6
xor edx, edx
mov r8d, 0xc0
mov rcx, rax
call fcn.140017e30
movsxd rcx, dword [rdi]
mov qword [rbx + 0x90], rcx
movsx ecx, byte [rdi + 6]
mov dword [rbx + 0x84], ecx
cmp ecx, 1
jne 0x140003c6b
mov dword [rbx + 0xb0], 3
movsx rax, word [rdi + 4]
mov r8, rax
sar r8, 3
mov qword [rbp + rax*8 + 0x20], rbx
mov dword [rbx + 0x80], eax
and eax, 0x80000007
jge 0x140003c90
dec eax
or eax, 0xfffffff8
inc eax
mov edx, 0x80
movzx ecx, al
sar edx, cl
add rdi, 8
or byte [r8 + rbp], dl
test esi, esi
jne 0x140003c20
mov rcx, r14
call fcn.14001da20
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x40]
add rsp, 0x58
pop r14
pop rbx
ret
lea rcx, str.out_of_memory
call fcn.140007c80
int3
lea rcx, str.out_of_memory
call fcn.140007c80
int3
Function at 0x140005060
Capabilities:
Create thread

Disassembly:
push rdi
sub rsp, 0x30
xor eax, eax
lea r8, [0x140004f10]
mov qword [rcx + 0xa4], rax
mov rdi, rcx
mov dword [rcx + 0xac], eax
mov r9, rcx
mov dword [rcx + 0xa4], edx
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], eax
call fcn.14002040c
test rax, rax
jne 0x140005128
mov qword [rsp + 0x40], rbx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 0xe
jg 0x1400050d8
je 0x1400050d1
cmp eax, 1
je 0x1400050ca
jle 0x1400050fc
cmp eax, 3
jle 0x1400050f0
cmp eax, 5
je 0x1400050e9
jmp 0x1400050fc
mov ebx, 0x82
jmp 0x1400050fc
mov ebx, 0xc
jmp 0x1400050fc
cmp eax, 0x50
je 0x1400050f7
cmp eax, 0x7b
je 0x1400050f0
cmp eax, 0x522
jne 0x1400050fc
mov ebx, 0xd
jmp 0x1400050fc
mov ebx, 2
jmp 0x1400050fc
mov ebx, 0x11
call fcn.14001daf4
mov dword [rax], ebx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, rdi
lea rcx, str.syncio_initiate_write_initiate___ERROR__beginthreadex__d__io:_p
mov edx, eax
call fcn.140007d70
mov rbx, qword [rsp + 0x40]
or eax, 0xffffffff
add rsp, 0x30
pop rdi
ret
mov qword [rdi + 0x38], rax
xor eax, eax
mov dword [rdi + 0x74], 1
add rsp, 0x30
pop rdi
ret
Function at 0x140006300
Capabilities:
Manipulate console buffer

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x50
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov edi, edx
mov ebx, ecx
call fcn.1400054b0
mov rcx, rax
lea rdx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x1400063a1
movsx ecx, word [rsp + 0x2a]
mov word [rsp + 0x20], bx
mov word [rsp + 0x22], di
lea eax, [rcx - 1]
cmp edi, eax
jle 0x140006370
mov edx, dword [0x14006d12c]
cmp edi, edx
jle 0x140006370
cmp edx, edi
jge 0x140006370
mov ebx, edi
sub ebx, edx
nop dword [rax]
call fcn.140006db0
sub rbx, 1
jne 0x140006360
movzx ecx, word [rsp + 0x2a]
movsx eax, cx
cmp edi, eax
jl 0x14000637f
dec cx
mov word [rsp + 0x22], cx
call fcn.1400054b0
mov edx, dword [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
test eax, eax
jne 0x14000639b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x14006d12c], edi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400164b0
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret

Function at 0x140006510
Capabilities:
Manipulate console buffer

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x50
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov edi, edx
mov ebx, ecx
call fcn.1400054b0
mov rcx, rax
lea rdx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x14000656a
add bx, word [rsp + 0x2c]
add di, word [rsp + 0x2e]
mov word [rsp + 0x20], bx
mov word [rsp + 0x22], di
call fcn.1400054b0
mov edx, dword [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400164b0
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret

Function at 0x140006590
Capabilities:
Manipulate console buffer

Disassembly:
push rdi
sub rsp, 0x470
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov edi, ecx
call fcn.1400054b0
mov rcx, rax
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x14000668f
mov qword [rsp + 0x488], rbx
movzx ebx, word [rsp + 0x44]
mov qword [rsp + 0x490], rbp
mov qword [rsp + 0x498], rsi
mov dword [rsp + 0x30], 0x10100
lea eax, [rbx + rdi]
mov word [rsp + 0x38], ax
movzx eax, word [rsp + 0x46]
mov word [rsp + 0x3a], ax
mov word [rsp + 0x3e], ax
movzx eax, word [rsp + 0x4e]
mov word [rsp + 0x3c], ax
call fcn.1400054b0
mov r9d, dword [0x14006c1a4]
lea rdx, [rsp + 0x60]
mov r8d, dword [rsp + 0x30]
mov rcx, rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadConsoleOutputA]
call fcn.140005c90
sub word [rsp + 0x3c], di
mov word [rsp + 0x38], bx
mov dword [rsp + 0x30], 0x10100
call fcn.1400054b0
mov r9d, dword [0x14006c1a4]
lea rdx, [rsp + 0x60]
mov r8d, dword [rsp + 0x30]
mov rcx, rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteConsoleOutputA]
mov rsi, qword [rsp + 0x498]
mov rbp, qword [rsp + 0x490]
mov rbx, qword [rsp + 0x488]
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.1400164b0
add rsp, 0x470
pop rdi
ret
Function at 0x1400067f0
Capabilities:
Manipulate console buffer

Disassembly:
push r14
sub rsp, 0x60
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov r14, qword [0x14006c1b0]
xor eax, eax
mov dword [rsp + 0x30], eax
call fcn.1400054b0
test rax, rax
jne 0x140006832
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400164b0
add rsp, 0x60
pop r14
ret
call fcn.1400054b0
mov rcx, rax
lea rdx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x14000681c
movsx edx, word [rsp + 0x42]
movsx eax, word [rsp + 0x44]
movsx ecx, word [rsp + 0x46]
mov qword [rsp + 0x70], rbx
sub ecx, edx
mov qword [rsp + 0x78], rsi
inc ecx
movsx esi, word [rsp + 0x48]
sub esi, eax
mov qword [rsp + 0x80], rdi
inc esi
mov word [rsp + 0x30], dx
imul esi, ecx
mov word [rsp + 0x32], ax
call fcn.1400054b0
mov r9d, dword [rsp + 0x30]
mov rcx, rax
lea rax, [rsp + 0x34]
mov r8d, esi
mov dl, 0x20
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterA]
mov rdi, qword [r14]
call fcn.1400054b0
movzx edx, word [rdi + 2]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
call fcn.1400054b0
mov r9d, dword [rsp + 0x30]
mov rcx, rax
movzx edx, word [rdi + 2]
lea rax, [rsp + 0x34]
mov r8d, esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FillConsoleOutputAttribute]
call fcn.1400054b0
mov r9d, dword [0x14006c1a4]
mov rcx, rax
mov r8d, dword [r14 + 8]
lea rax, [rsp + 0x42]
mov rdx, qword [r14]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteConsoleOutputA]
mov edi, eax
call fcn.1400054b0
mov rcx, rax
lea r8, [r14 + 0x10]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_SetConsoleWindowInfo]
movsx edx, word [r14 + 0xe]
movsx ecx, word [r14 + 0xc]
call fcn.140006300
mov rsi, qword [rsp + 0x78]
mov eax, edi
mov rdi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400164b0
add rsp, 0x60
pop r14
ret
Function at 0x140006b40
Capabilities:
Write file on windows

Disassembly:
test r8d, r8d
je 0x140006c9e
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x30
cmp dword [0x14006c198], 0
mov r14, r9
mov edi, r8d
mov rbx, rdx
mov rbp, rcx
mov qword [rsp + 0x50], rsi
jne 0x140006c44
xor r14d, r14d
cmp dword [0x14005ab1c], r14d
je 0x140006ba0
lea rdx, str.e_2J
mov dword [0x14005ab1c], r14d
mov rcx, rbx
call fcn.140017250
test rax, rax
je 0x140006ba0
call fcn.140006ac0
cmp dword [0x14006c1b8], r14d
jne 0x140006c0f
cmp edi, 5
jb 0x140006c0f
lea rdx, str.e__1h
mov qword [rsp + 0x58], r15
mov rcx, rbx
call fcn.140003e10
mov ecx, dword [0x14006c1d4]
lea rdx, str.e__1l
test rax, rax
mov r15d, 1
mov rsi, rax
cmovne ecx, r15d
mov dword [0x14006c1d4], ecx
mov rcx, rbx
call fcn.140003e10
test rax, rax
je 0x140006c0a
test rsi, rsi
je 0x140006c03
mov dword [0x14006c1d4], r15d
cmp rsi, rax
ja 0x140006c0a
mov dword [0x14006c1d4], r14d
mov r15, qword [rsp + 0x58]
cmp dword [0x14006c1a0], r14d
je 0x140006c1d
call fcn.1400069b0
xor r9d, r9d
mov qword [rsp + 0x20], r14
mov r8d, edi
mov rdx, rbx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [0x14006c1a0], r14d
je 0x140006c8c
call fcn.140006960
jmp 0x140006c8c
cmp edi, 1
jne 0x140006c51
cmp byte [rdx], 0xd
jne 0x140006c51
mov byte [rdx], 0xa
mov rsi, qword [rsp + 0x70]
lea rbp, [rdx + rdi]
nop word [rax + rax]
mov r9, rsi
mov r8, r14
mov rdx, rbp
mov rcx, rbx
mov rdi, rbx
call fcn.140006ec0
mov rbx, rax
cmp rax, rdi
je 0x140006c8c
cmp rax, rbp
jae 0x140006c8c
test rsi, rsi
je 0x140006c60
cmp qword [rsi], 0
je 0x140006c60
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rbp
ret
Function at 0x140006db0
Capabilities:
Manipulate console buffer

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor esi, esi
mov ebx, esi
mov edi, esi
call fcn.1400054b0
mov rcx, rax
lea rdx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x140006df5
movsx ebx, word [rsp + 0x2c]
movsx edi, word [rsp + 0x2e]
call fcn.140006420
test eax, eax
je 0x140006e54
call fcn.1400054b0
mov rcx, rax
lea rdx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
jne 0x140006e19
mov eax, esi
jmp 0x140006e20
movsx eax, word [rsp + 0x2a]
dec eax
cmp edi, eax
jl 0x140006e3a
mov edx, edi
xor ecx, ecx
call fcn.1400060f0
neg ebx
xor edx, edx
mov ecx, ebx
call fcn.140006510
jmp 0x140006e97
mov ecx, 1
call fcn.140005ff0
neg ebx
mov edx, 1
mov ecx, ebx
call fcn.140006510
jmp 0x140006e97
call fcn.1400054b0
mov rcx, rax
lea rdx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x140006e97
movzx eax, word [rsp + 0x2c]
sub ax, bx
mov word [rsp + 0x20], ax
movzx eax, word [rsp + 0x2e]
inc ax
mov word [rsp + 0x22], ax
call fcn.1400054b0
mov edx, dword [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov dword [0x14006c208], esi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400164b0
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x140011f10
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r9, rcx
lea r11, [rdx + 8]
lea r10, [rcx + 2]
mov ebx, 0xa
nop word [rax + rax]
mov ecx, dword [r11 - 4]
lea r10, [r10 + 8]
movzx eax, byte [r11 - 8]
mov r8d, dword [r11 - 8]
lea r11, [r11 + 0xc]
and al, 7
mov byte [r10 - 0xa], al
mov eax, r8d
shr eax, 3
and al, 7
shr r8d, 6
mov byte [r10 - 9], al
movzx eax, byte [r11 - 0x10]
shl al, 2
xor r8b, al
mov eax, ecx
shr eax, 1
and r8b, 7
and al, 7
mov byte [r10 - 8], r8b
mov byte [r10 - 7], al
mov eax, ecx
shr eax, 4
and al, 7
shr ecx, 7
mov byte [r10 - 6], al
movzx eax, byte [r11 - 0xc]
add al, al
xor cl, al
and cl, 7
mov byte [r10 - 5], cl
mov ecx, dword [r11 - 0xc]
mov eax, ecx
shr eax, 2
shr ecx, 5
and al, 7
and cl, 7
mov byte [r10 - 4], al
mov byte [r10 - 3], cl
sub rbx, 1
jne 0x140011f30
movzx eax, byte [rdx + 0x78]
lea r10, [r9 + 0x54]
mov ecx, dword [rdx + 0x78]
lea r8d, [rbx + 0x54]
and al, 7
mov byte [r9 + 0x50], al
mov eax, ecx
shr eax, 3
and al, 7
shr ecx, 6
mov byte [r9 + 0x51], al
movzx eax, byte [rdx + 0x7c]
shl al, 2
xor cl, al
and cl, 7
mov byte [r9 + 0x52], cl
mov ecx, dword [rdx + 0x7c]
mov eax, ecx
shr eax, 1
shr ecx, 4
and al, 7
and cl, 7
mov byte [r9 + 0x53], al
xor al, al
mov byte [r10], cl
nop dword [rax]
nop dword [rax + rax]
movzx ecx, byte [r9]
lea r9, [r9 + 1]
add cl, al
movzx eax, cl
sar cl, 3
add byte [r9], cl
and al, 7
mov byte [r9 - 1], al
sar al, 2
movzx ecx, al
shl cl, 3
sub byte [r9 - 1], cl
sub r8, 1
jne 0x140012010
add byte [r10], al
mov rbx, qword [rsp + 8]
ret
Function at 0x140012050
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov r9, rcx
movzx eax, byte [rdx + 2]
movzx r8d, byte [rdx + 3]
shl r8d, 8
or r8d, eax
movzx eax, byte [rdx + 1]
shl r8d, 8
or r8d, eax
movzx eax, byte [rdx]
shl r8d, 8
or r8d, eax
mov dword [rcx + 0x10], r8d
movzx eax, byte [rdx + 6]
movzx ecx, byte [rdx + 7]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 5]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 4]
shl ecx, 8
or ecx, eax
mov dword [r9 + 0x14], ecx
movzx eax, byte [rdx + 0xa]
movzx ecx, byte [rdx + 0xb]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 9]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 8]
shl ecx, 8
or ecx, eax
mov dword [r9 + 0x18], ecx
movzx eax, byte [rdx + 0xe]
movzx ecx, byte [rdx + 0xf]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0xd]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0xc]
shl ecx, 8
or ecx, eax
mov dword [r9 + 0x1c], ecx
movzx eax, byte [rdx + 0x12]
movzx ecx, byte [rdx + 0x13]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x11]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x10]
shl ecx, 8
or ecx, eax
mov dword [r9 + 0x20], ecx
movzx eax, byte [rdx + 0x16]
movzx ecx, byte [rdx + 0x17]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x15]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x14]
shl ecx, 8
or ecx, eax
mov dword [r9 + 0x24], ecx
movzx eax, byte [rdx + 0x1a]
movzx ecx, byte [rdx + 0x1b]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x19]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x18]
shl ecx, 8
or ecx, eax
mov dword [r9 + 0x28], ecx
movzx ecx, byte [rdx + 0x1f]
movzx eax, byte [rdx + 0x1e]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x1d]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x1c]
shl ecx, 8
or ecx, eax
mov dword [r9], 0x61707865
mov dword [r9 + 0x2c], ecx
mov dword [r9 + 4], 0x3320646e
mov dword [r9 + 8], 0x79622d32
mov dword [r9 + 0xc], 0x6b206574
ret
Function at 0x1400136e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, dword [rcx + 0x7c]
lea r10, [rcx + 0x74]
mov r9d, r11d
mov r8, rcx
xor r9d, 0x7f
mov ebx, 5
dec r9d
shr r9d, 0x1f
nop dword [rax]
nop word [rax + rax]
mov ecx, dword [r10 - 0x10]
mov eax, dword [r10 - 0xc]
xor ecx, 0xff
mov edx, dword [r10 + 4]
lea r10, [r10 - 0x18]
xor eax, 0xff
dec ecx
dec eax
shr ecx, 0x1f
shr eax, 0x1f
xor edx, 0xff
and ecx, eax
dec edx
mov eax, dword [r10 + 0x10]
xor eax, 0xff
shr edx, 0x1f
dec eax
shr eax, 0x1f
and ecx, eax
mov eax, dword [r10 + 0x14]
xor eax, 0xff
dec eax
shr eax, 0x1f
and ecx, eax
mov eax, dword [r10 + 0x18]
xor eax, 0xff
dec eax
shr eax, 0x1f
and ecx, eax
and ecx, edx
and r9d, ecx
sub rbx, 1
jne 0x140013710
mov ecx, dword [r8]
sub ecx, 0xed
not ecx
shr ecx, 0x1f
and ecx, r9d
neg ecx
mov eax, ecx
movzx edx, cl
and eax, 0x7f
sub r11d, eax
mov eax, 0x1e
mov dword [r8 + 0x7c], r11d
nop dword [rax]
nop dword [rax + rax]
sub dword [r8 + rax*4], edx
sub dword [r8 + rax*4 - 4], edx
sub rax, 2
test rax, rax
jg 0x1400137b0
mov rbx, qword [rsp + 8]
and ecx, 0xed
sub dword [r8], ecx
ret

Function at 0x140013900
Capabilities:
Encode data using xor

Disassembly:
mov r9, rdx
movzx r10d, r8b
neg r10d
lea rdx, [rcx + 0x7c]
lea rax, [r9 + 0x7c]
movd xmm2, r10d
pshufd xmm2, xmm2, 0
cmp rcx, rax
ja 0x140013947
cmp rdx, r9
jb 0x140013947
sub r9, rcx
mov r8d, 0x20
nop
mov edx, dword [rcx + r9]
xor edx, dword [rcx]
lea rcx, [rcx + 4]
and edx, r10d
xor dword [rcx - 4], edx
sub r8, 1
jne 0x140013930
ret
lea rax, [rcx + 0x10]
sub r9, rcx
mov ecx, 4
nop dword [rax]
nop word [rax + rax]
movdqu xmm0, xmmword [rax - 0x10]
movdqu xmm1, xmmword [r9 + rax - 0x10]
lea rax, [rax + 0x20]
pxor xmm1, xmm0
pand xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rax - 0x30], xmm1
movdqu xmm0, xmmword [rax - 0x20]
movdqu xmm1, xmmword [r9 + rax - 0x20]
pxor xmm1, xmm0
pand xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rax - 0x20], xmm1
sub rcx, 1
jne 0x140013960
ret
Function at 0x140015010
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
movzx eax, byte [rdx + 2]
movzx ecx, byte [rdx + 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx]
shl ecx, 8
or ecx, eax
mov dword [0x14006cfc0], ecx
movzx eax, byte [rdx + 6]
movzx ecx, byte [rdx + 7]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 5]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 4]
shl ecx, 8
or ecx, eax
mov dword [0x14006cfc4], ecx
movzx eax, byte [rdx + 0xa]
movzx ecx, byte [rdx + 0xb]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 9]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 8]
shl ecx, 8
or ecx, eax
mov dword [0x14006cfc8], ecx
movzx eax, byte [rdx + 0xe]
movzx ecx, byte [rdx + 0xf]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0xd]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0xc]
shl ecx, 8
or ecx, eax
mov dword [0x14006cfcc], ecx
movzx eax, byte [rdx + 0x12]
movzx ecx, byte [rdx + 0x13]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x11]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x10]
shl ecx, 8
or ecx, eax
mov dword [0x14006cfd0], ecx
movzx eax, byte [rdx + 0x16]
movzx ecx, byte [rdx + 0x17]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x15]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x14]
shl ecx, 8
or ecx, eax
mov dword [0x14006cfd4], ecx
movzx eax, byte [rdx + 0x1a]
movzx ecx, byte [rdx + 0x1b]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x19]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x18]
shl ecx, 8
or ecx, eax
mov dword [0x14006cfd8], ecx
movzx ecx, byte [rdx + 0x1f]
movzx eax, byte [rdx + 0x1e]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x1d]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x1c]
shl ecx, 8
or ecx, eax
mov dword [0x14006cfb0], 0x61707865
mov dword [0x14006cfdc], ecx
mov dword [0x14006cfb4], 0x3320646e
mov dword [0x14006cfb8], 0x79622d32
mov dword [0x14006cfbc], 0x6b206574
ret