joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b71e0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rdi, r9
xor r15d, r15d
mov r9, qword [r9]
mov rsi, r8
mov r14, rdx
mov rbx, rcx
cmp r9, r8
jae 0x1400b727c
mov rax, r9
lea rbp, [rcx + 0x68]
nop word [rax + rax]
mov rcx, qword [rbx + 0x88]
cmp dword [rbx + 0x90], r15d
jne 0x1400b724c
mov r8d, esi
mov qword [rsp + 0x20], rbp
sub r8d, r9d
lea rdx, [rax + r14]
lea r9, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x1400b725d
xor r9d, r9d
lea r8, [rsp + 0x60]
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov ecx, eax
mov eax, dword [rsp + 0x60]
add qword [rdi], rax
test ecx, ecx
je 0x1400b729b
mov dword [rbx + 0x90], r15d
mov rax, qword [rdi]
mov r9d, eax
cmp rax, rsi
jb 0x1400b7220
mov qword [rdi], r15
mov eax, r9d
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [rbx + 0x90], r15d
jne 0x1400b72b8
cmp eax, 0x3e5
je 0x1400b72bf
mov eax, 0xffffffff
jmp 0x1400b7282
cmp eax, 0x3e4
jne 0x1400b72b1
mov dword [rbx + 0x90], 1
mov eax, 0xffffffdb
jmp 0x1400b7282

Function at 0x1400b72d0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rdi, r9
xor r15d, r15d
mov r9, qword [r9]
mov rsi, r8
mov r14, rdx
mov rbx, rcx
cmp r9, r8
jae 0x1400b736c
mov rax, r9
lea rbp, [rcx + 0x68]
nop word [rax + rax]
mov rcx, qword [rbx + 0x88]
cmp dword [rbx + 0x90], r15d
jne 0x1400b733c
mov r8d, esi
mov qword [rsp + 0x20], rbp
sub r8d, r9d
lea rdx, [rax + r14]
lea r9, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x1400b734d
xor r9d, r9d
lea r8, [rsp + 0x60]
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov ecx, eax
mov eax, dword [rsp + 0x60]
add qword [rdi], rax
test ecx, ecx
je 0x1400b738b
mov dword [rbx + 0x90], r15d
mov rax, qword [rdi]
mov r9d, eax
cmp rax, rsi
jb 0x1400b7310
mov qword [rdi], r15
mov eax, r9d
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [rbx + 0x90], r15d
jne 0x1400b73a8
cmp eax, 0x3e5
je 0x1400b73af
mov eax, 0xffffffff
jmp 0x1400b7372
cmp eax, 0x3e4
jne 0x1400b73a1
mov dword [rbx + 0x90], 1
mov eax, 0xffffffdb
jmp 0x1400b7372
Function at 0x1400c2e00
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x1e0]
cmp dword [rax + 0x20], 0
je 0x1400c2e38
mov r8d, reloc.WS2_32.dll_listen
mov dword [rbx + 0x850], 0xd
mov dl, 1
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.1400c2f80
cmp byte [rcx + 0xebe], 0
je 0x1400c2e50
xor edx, edx
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.1400c4070
cmp byte [rcx + 0xec1], 0
je 0x1400c2ef1
mov r8, qword [rbx + 0x820]
test r8, r8
jne 0x1400c2eab
mov r8, qword [rcx + 0xc00]
test r8, r8
jne 0x1400c2e8e
cmp byte [rcx + 0xebd], 0
lea rax, str.NLST
lea r8, str.LIST
cmovne r8, rax
lea rcx, [rbx + 0x798]
lea rdx, str.PRET__s
call fcn.140125e80
test eax, eax
je 0x1400c2ee1
add rsp, 0x20
pop rbx
ret
cmp byte [rcx + 0xecd], 0
lea rcx, [rbx + 0x798]
je 0x1400c2ed1
lea rdx, str.PRET_STOR__s
call fcn.140125e80
test eax, eax
je 0x1400c2ee1
add rsp, 0x20
pop rbx
ret
lea rdx, str.PRET_RETR__s
call fcn.140125e80
test eax, eax
jne 0x1400c2efe
mov dword [rbx + 0x850], 0x1d
add rsp, 0x20
pop rbx
ret
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.1400c48c0
add rsp, 0x20
pop rbx
ret

Function at 0x1400c2f10
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx]
mov rbx, rcx
add rcx, 0x798
cmp byte [rax + 0xeb9], 0
jne 0x1400c2f35
cmp dword [rax + 0x9f0], 0
je 0x1400c2f61
mov r8, qword [rcx + 0x88]
test r8, r8
je 0x1400c2f61
lea rdx, str.MDTM__s
call fcn.140125e80
test eax, eax
jne 0x1400c2f6e
mov dword [rbx + 0x850], 0x12
add rsp, 0x20
pop rbx
ret
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.1400c4a10
add rsp, 0x20
pop rbx
ret

Function at 0x1400c3a70
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0xa0
mov rbp, qword [rcx + 0x260]
lea r8, [rax + 8]
mov rsi, qword [rcx]
lea rdx, [rsp + 0x20]
mov rdi, rcx
mov dword [rax + 8], 0x80
mov rcx, rbp
mov rbx, 0xffffffffffffffff
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x1400c3adc
lea r8, [rsp + 0xb0]
mov dword [rsp + 0xb0], 0x80
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_accept]
mov rbx, rax
mov rdx, rbp
mov rcx, rdi
call fcn.140054630
mov rcx, rsi
cmp rbx, 0xffffffffffffffff
jne 0x1400c3b01
lea rdx, str.Error_accept__ing_server_connect
call fcn.140052d00
lea eax, [rbx + 0x1f]
jmp 0x1400c3b7a
lea rdx, str.Connection_accepted_from_server_n
call fcn.140052ba0
mov edx, 1
mov byte [rdi + 0x3f8], 0
mov rcx, rbx
mov qword [rdi + 0x260], rbx
call fcn.1400a7fb0
mov byte [rdi + 0x279], 1
cmp qword [rsi + 0x728], 0
je 0x1400c3b78
mov dl, 1
mov rcx, rsi
call fcn.140040390
mov rcx, qword [rsi + 0x730]
mov r8d, 1
mov rdx, rbx
call qword [rsi + 0x728]
xor edx, edx
mov rcx, rsi
mov ebx, eax
call fcn.140040390
test ebx, ebx
je 0x1400c3b78
mov rcx, rdi
call fcn.1400c3980
mov eax, 0x2a
jmp 0x1400c3b7a
xor eax, eax
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400c4950
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx]
mov rbx, rcx
mov rdx, qword [rax + 0x1e0]
cmp dword [rdx + 0x20], 0
je 0x1400c499d
cmp qword [rcx + 0x820], 0
je 0x1400c499d
add rcx, 0x798
lea rdx, str.REST__d
xor r8d, r8d
call fcn.140125e80
test eax, eax
jne 0x1400c49a7
mov dword [rbx + 0x850], 0x1a
add rsp, 0x20
pop rbx
ret
add rsp, 0x20
pop rbx
jmp fcn.1400c2e00
add rsp, 0x20
pop rbx
ret

Function at 0x1400c49b0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
add rcx, 0x798
mov rax, qword [rbx]
mov rdx, qword [rax + 0x1e0]
cmp dword [rdx + 0x20], 1
jne 0x1400c49fc
mov r8, qword [rcx + 0x88]
test r8, r8
je 0x1400c49fc
lea rdx, str.SIZE__s
call fcn.140125e80
test eax, eax
jne 0x1400c4a09
mov dword [rbx + 0x850], 0x17
add rsp, 0x20
pop rbx
ret
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.1400c4950
add rsp, 0x20
pop rbx
ret

Function at 0x1400c4a10
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov r9, qword [rcx]
cmp byte [r9 + 0xecc], 0
je 0x1400c4a68
cmp qword [rcx + 0x820], 0
je 0x1400c4a68
cmp byte [r9 + 0xebb], 0
mov eax, 0x41
mov edx, 0x49
cmovne edx, eax
movsx eax, byte [rcx + 0x840]
cmp eax, edx
je 0x1400c4a68
mov rax, qword [r9 + 0x1e0]
mov r8d, reloc.WS2_32.dll_send
mov dword [rax + 0x20], 1
movzx edx, byte [r9 + 0xebb]
jmp fcn.1400c3260
jmp fcn.1400c49b0
Function at 0x1400c5470
Capabilities:
Check http status code

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
xor ebx, ebx
lea eax, [rdx - 0xc8]
mov rdi, rcx
mov rcx, qword [rcx]
mov esi, r8d
cmp eax, 0x64
jb 0x1400c54a5
lea rdx, str.Couldnt_set_desired_mode
call fcn.140052d00
lea eax, [rbx + 0x11]
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
cmp edx, 0xc8
je 0x1400c54bc
mov r8d, edx
lea rdx, str.Got_a__03d_response_code_instead_of_the_assumed_200_n
call fcn.140052ba0
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], r14
cmp esi, 0x13
jne 0x1400c54d8
mov rcx, rdi
call fcn.1400c49b0
jmp 0x1400c5610
cmp esi, 0x14
jne 0x1400c55f2
mov rsi, qword [rdi]
mov rbp, rbx
cmp dword [rsi + 0xb98], 2
jne 0x1400c555a
mov rax, qword [rsi + 0x1e0]
mov rdx, qword [rax + 0x10]
test rdx, rdx
je 0x1400c555a
mov byte [rsp + 0x28], 1
lea r9, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov rcx, rsi
mov qword [rsp + 0x50], rbx
call fcn.140014c60
test eax, eax
jne 0x1400c5610
mov rcx, qword [rsp + 0x50]
lea edx, [rax + 0x2f]
call fcn.14005ebf4
test rax, rax
je 0x1400c554f
mov rbp, qword [rsp + 0x50]
mov ecx, 1
sub rax, rbp
cmovne rcx, rax
mov byte [rcx + rbp], bl
jmp 0x1400c555a
mov rcx, qword [rsp + 0x50]
call qword [fcn.14003ef6c]
mov rdx, qword [rsi + 0xc00]
test rdx, rdx
jne 0x1400c557e
cmp byte [rsi + 0xebd], bl
lea rax, str.NLST
lea rdx, str.LIST
cmovne rdx, rax
lea r8, [0x1401606ec]
test rbp, rbp
mov r9, r8
lea rax, [0x1401613ac]
cmovne r9, rbp
lea rcx, [0x1401608bc]
cmovne r8, rax
call fcn.140056b40
mov rcx, rbp
mov r14, rax
call qword [fcn.14003ef6c]
test r14, r14
jne 0x1400c55bd
lea ebx, [r14 + 0x1b]
jmp 0x1400c5612
lea rcx, [rdi + 0x798]
mov r8, r14
lea rdx, [0x140160914]
call fcn.140125e80
mov rcx, r14
mov esi, eax
call qword [fcn.14003ef6c]
test esi, esi
je 0x1400c55e6
mov ebx, esi
jmp 0x1400c5612
mov dword [rdi + 0x850], 0x1f
jmp 0x1400c5612
cmp esi, 0x15
jne 0x1400c55fd
lea r8d, [rsi - 8]
jmp 0x1400c5606
cmp esi, 0x16
jne 0x1400c5612
lea r8d, [rsi - 8]
mov dl, 1
mov rcx, rdi
call fcn.1400c2f80
mov ebx, eax
mov r14, qword [rsp + 0x60]
mov eax, ebx
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400cdef4
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x1400cdf0a
mov al, 1
jmp 0x1400cdf6a
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x1400cdf1b
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x1400cdf68
mov ecx, dword [rcx + 0x18]
nop
call fcn.1400d53e0
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400cdf68
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1400cdf68
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1400cdf68
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x1400cdf6a
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x1400d36a0
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.140059c64
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x1400d3741
cmp ebx, dword [rsp + 0x30]
je 0x1400d373a
test esi, esi
je 0x1400d373a
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x1400d3715
sub r8w, 0x61
cmp r8w, 0x19
ja 0x1400d3722
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x1400d36ff
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x1400d3726
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x1400d3743
mov eax, 1
jmp 0x1400d3743
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1401156b0
Capabilities:
Generate random numbers via winapi

Disassembly:
sub rsp, 0x28
mov eax, 0xffffffff
cmp rdx, rax
jbe 0x1401156c8
mov eax, 0xffffffff
add rsp, 0x28
ret
mov r8d, edx
xor r9d, r9d
mov rdx, rcx
mov rcx, qword [0x1401d6920]
call sub.bcrypt.dll_BCryptGenRandom
xor ecx, ecx
test eax, eax
setns cl
lea eax, [rcx - 1]
add rsp, 0x28
ret

Function at 0x140115820
Capabilities:
Hash data via bcrypt

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx]
xor r9d, r9d
call sub.bcrypt.dll_BCryptHashData
xor ecx, ecx
test eax, eax
setns cl
lea eax, [rcx - 1]
add rsp, 0x28
ret
Function at 0x140117080
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x18], r8d
push rbp
push rdi
push r13
push r14
push r15
sub rsp, 0x50
mov ebp, dword [rdx + 0x10]
mov r14, r9
mov r13, qword [rsp + 0xa0]
mov eax, r8d
mov rdi, rcx
test ebp, ebp
je 0x1401170b4
mov r15, qword [rcx + 0x18]
jmp 0x1401170b7
mov r15, r14
mov qword [rsp + 0x88], r12
test eax, eax
jne 0x140117109
test ebp, ebp
jne 0x140117109
xor r12d, r12d
lea rax, [rsp + 0xa0]
mov dword [rsp + 0x48], r12d
xor r9d, r9d
mov qword [rsp + 0x40], rax
mov r8d, r13d
mov eax, dword [rcx + 0x24]
mov rdx, r15
mov dword [rsp + 0x38], r12d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], eax
mov rax, qword [rcx + 0x10]
mov rcx, qword [rcx]
mov qword [rsp + 0x20], rax
call sub.bcrypt.dll_BCryptDecrypt
jmp 0x140117149
xor r12d, r12d
lea rax, [rsp + 0xa0]
mov dword [rsp + 0x48], r12d
xor r9d, r9d
mov qword [rsp + 0x40], rax
mov r8d, r13d
mov eax, dword [rcx + 0x24]
mov rdx, r15
mov dword [rsp + 0x38], r12d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], eax
mov rax, qword [rcx + 0x10]
mov rcx, qword [rcx]
mov qword [rsp + 0x20], rax
call sub.bcrypt.dll_BCryptEncrypt
mov ebx, eax
test eax, eax
js 0x14011726c
mov ecx, dword [rsp + 0xa0]
mov qword [rsp + 0x80], rsi
call fcn.14003f410
mov rsi, rax
test rax, rax
je 0x14011725f
cmp dword [rsp + 0x90], 0
jne 0x1401171c6
test ebp, ebp
jne 0x1401171c6
mov ecx, dword [rsp + 0xa0]
lea rax, [rsp + 0xa0]
mov dword [rsp + 0x48], r12d
xor r9d, r9d
mov qword [rsp + 0x40], rax
mov r8d, r13d
mov eax, dword [rdi + 0x24]
mov rdx, r15
mov dword [rsp + 0x38], ecx
mov rcx, qword [rdi]
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], eax
mov rax, qword [rdi + 0x10]
mov qword [rsp + 0x20], rax
call sub.bcrypt.dll_BCryptDecrypt
jmp 0x140117209
mov rcx, qword [rdi]
lea rax, [rsp + 0xa0]
mov dword [rsp + 0x48], r12d
xor r9d, r9d
mov qword [rsp + 0x40], rax
mov r8d, r13d
mov eax, dword [rsp + 0xa0]
mov rdx, r15
mov dword [rsp + 0x38], eax
mov eax, dword [rdi + 0x24]
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], eax
mov rax, qword [rdi + 0x10]
mov qword [rsp + 0x20], rax
call sub.bcrypt.dll_BCryptEncrypt
mov ebx, eax
test eax, eax
js 0x140117242
mov rcx, r14
test ebp, ebp
je 0x140117232
mov r9, r13
mov r8, rsi
mov rdx, r14
call fcn.140119a10
mov edx, dword [rdi + 0x2c]
mov rcx, qword [rdi + 0x18]
call fcn.140119af0
jmp 0x140117242
mov r8d, dword [rsp + 0xa0]
mov rdx, rsi
call fcn.1400173a0
mov ecx, dword [rsp + 0xa0]
test rcx, rcx
je 0x140117255
mov rdi, rsi
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call fcn.14003ef6c
jmp 0x140117264
mov ebx, 0xc0000017
mov rsi, qword [rsp + 0x80]
mov r12, qword [rsp + 0x88]
sar ebx, 0x1f
mov eax, ebx
mov rbx, qword [rsp + 0x98]
add rsp, 0x50
pop r15
pop r14
pop r13
pop rdi
pop rbp
ret
Function at 0x140118b60
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x60
mov rbx, r9
mov r15, r8
mov rdi, rdx
mov r14, rcx
test rcx, rcx
je 0x140118d9f
test rdx, rdx
je 0x140118d9f
test r8, r8
je 0x140118d9f
test rbx, rbx
je 0x140118d9f
mov ecx, dword [r9 + 8]
mov ebp, dword [r8 + 8]
add ecx, 0x18
add ebp, ecx
mov dword [rsp + 0x50], 0x18
mov ecx, ebp
mov r12d, ebp
call fcn.14003f410
mov rsi, rax
test rax, rax
je 0x140118d9f
mov dword [rax], 0x31415352
mov ecx, dword [rbx + 8]
shl ecx, 3
mov dword [rax + 4], ecx
mov ecx, dword [r15 + 8]
mov dword [rax + 8], ecx
mov ecx, dword [rbx + 8]
mov dword [rax + 0xc], ecx
mov qword [rsp + 0x98], r13
xor r13d, r13d
mov qword [rax + 0x10], r13
mov ecx, dword [rsp + 0x50]
mov r8d, dword [r15 + 8]
add rcx, rax
mov rdx, qword [r15]
call fcn.1400173a0
mov ecx, dword [r15 + 8]
add ecx, dword [rsp + 0x50]
mov r8d, dword [rbx + 8]
add rcx, rsi
mov rdx, qword [rbx]
call fcn.1400173a0
mov rcx, qword [0x1401d6978]
lea r9, [rsp + 0x58]
mov dword [rsp + 0x30], r13d
lea r8, str.RSAPUBLICBLOB
mov dword [rsp + 0x28], ebp
xor edx, edx
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x50], r13d
call sub.bcrypt.dll_BCryptImportKeyPair
mov ebx, eax
test eax, eax
js 0x140118d79
mov r8d, dword [rdi + 8]
lea rax, [rsp + 0x90]
mov rdx, qword [rdi]
xor r9d, r9d
mov rcx, qword [rsp + 0x58]
mov dword [rsp + 0x48], 1
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
call sub.bcrypt.dll_BCryptEncrypt
mov ebx, eax
test eax, eax
js 0x140118d6f
mov edx, dword [rsp + 0x90]
mov rcx, r14
call fcn.140118ae0
test eax, eax
jne 0x140118d6a
mov ecx, dword [rsp + 0x90]
cmp dword [rdi + 8], ecx
cmova ecx, dword [rdi + 8]
mov dword [rsp + 0x90], ecx
call fcn.14003f410
mov rbp, rax
test rax, rax
je 0x140118d6a
mov r9d, dword [rdi + 8]
mov rcx, rax
mov r8, qword [rdi]
mov edx, dword [rsp + 0x90]
call fcn.140118010
mov ecx, dword [r14 + 8]
lea rax, [rsp + 0x50]
mov r8d, dword [rsp + 0x90]
xor r9d, r9d
mov dword [rsp + 0x48], 1
mov rdx, rbp
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], ecx
mov rcx, qword [r14]
mov qword [rsp + 0x30], rcx
mov rcx, qword [rsp + 0x58]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
call sub.bcrypt.dll_BCryptEncrypt
mov ecx, dword [rsp + 0x90]
mov ebx, eax
test rcx, rcx
je 0x140118d50
mov rdi, rbp
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rbp
call fcn.14003ef6c
test ebx, ebx
js 0x140118d6f
mov edx, dword [rsp + 0x50]
mov rcx, r14
call fcn.140118ae0
jmp 0x140118d6f
mov ebx, 0xc0000017
mov rcx, qword [rsp + 0x58]
call sub.bcrypt.dll_BCryptDestroyKey
mov r13, qword [rsp + 0x98]
test r12, r12
je 0x140118d90
mov rdi, rsi
xor eax, eax
mov rcx, r12
rep stosb byte [rdi], al
mov rcx, rsi
call fcn.14003ef6c
sar ebx, 0x1f
mov eax, ebx
jmp 0x140118da4
mov eax, 0xffffffff
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1401191f0
Capabilities:
Encode data using base64

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rbx, r8
mov qword [r9], 0
mov r15, r9
mov rdi, rdx
mov r8, rcx
mov rsi, 0xffffffffffffffff
test rbx, rbx
jne 0x140119229
mov rbx, rsi
nop
inc rbx
cmp byte [rdx + rbx], 0
jne 0x140119220
lea rcx, [rbx*4]
movabs rax, 0xaaaaaaaaaaaaaaab
mul rcx
mov rcx, rdx
mov rdx, r8
shr rcx, 1
add rcx, 4
call qword [rreloc.WS2_32.dll_htonl + 8]
mov r10, rax
mov r14, rax
test rax, rax
jne 0x140119266
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], r12
test rbx, rbx
je 0x14011934b
lea r12, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
xor edx, edx
xor eax, eax
test rbx, rbx
je 0x140119296
movzx ecx, byte [rdi]
inc edx
inc rdi
dec rbx
jmp 0x1401192a2
cmp rax, 3
jae 0x140119375
xor cl, cl
mov byte [rsp + rax + 0x50], cl
inc rax
cmp rax, 3
jl 0x140119284
movzx r11d, byte [rsp + 0x50]
movzx ecx, byte [rsp + 0x51]
movzx ebp, r11b
movzx r8d, byte [rsp + 0x52]
movzx eax, cl
shr al, 4
and r11b, 3
and cl, 0xf
shl r11b, 4
or r11b, al
shl cl, 2
movzx eax, r8b
shr bpl, 2
shr al, 6
and r8b, 0x3f
or cl, al
sub edx, 1
je 0x140119316
cmp edx, 1
je 0x140119309
movzx eax, r8b
movzx r8d, byte [rax + r12]
movzx eax, cl
movzx r9d, byte [rax + r12]
jmp 0x14011931d
movzx eax, cl
mov r8b, 0x3d
movzx r9d, byte [rax + r12]
jmp 0x14011931d
mov r8b, 0x3d
movzx r9d, r8b
movzx eax, bpl
movzx edx, byte [rax + r12]
movzx eax, r11b
movzx ecx, byte [rax + r12]
mov byte [r10], dl
mov byte [r10 + 1], cl
mov byte [r10 + 2], r9b
mov byte [r10 + 3], r8b
add r10, 4
test rbx, rbx
jne 0x140119280
mov byte [r10], 0
mov qword [r15], r14
inc rsi
cmp byte [r14 + rsi], 0
jne 0x140119352
mov rbp, qword [rsp + 0x58]
mov rax, rsi
mov r12, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
call fcn.1400d1ccc
int3

Function at 0x140119a10
Capabilities:
Encode data using xor

Disassembly:
xor r10d, r10d
test r9, r9
je 0x140119ae4
cmp r9, 0x40
jb 0x140119ac7
lea r11, [rcx - 1]
lea rax, [r8 - 1]
add r11, r9
add rax, r9
cmp rcx, rax
ja 0x140119a42
cmp r11, r8
jae 0x140119ac7
lea rax, [rdx - 1]
add rax, r9
cmp rcx, rax
ja 0x140119a53
cmp r11, rdx
jae 0x140119ac7
mov rax, r9
and rax, 0xffffffffffffffc0
nop word [rax + rax]
movdqu xmm0, xmmword [r8]
add r10, 0x40
movdqu xmm1, xmmword [rdx]
pxor xmm1, xmm0
movdqu xmm0, xmmword [r8 + 0x10]
movdqu xmmword [rcx], xmm1
movdqu xmm1, xmmword [rdx + 0x10]
pxor xmm1, xmm0
movdqu xmm0, xmmword [r8 + 0x20]
movdqu xmmword [rcx + 0x10], xmm1
movdqu xmm1, xmmword [rdx + 0x20]
pxor xmm1, xmm0
movdqu xmm0, xmmword [r8 + 0x30]
add r8, 0x40
movdqu xmmword [rcx + 0x20], xmm1
movdqu xmm1, xmmword [rdx + 0x30]
add rdx, 0x40
pxor xmm1, xmm0
movdqu xmmword [rcx + 0x30], xmm1
add rcx, 0x40
cmp r10, rax
jb 0x140119a60
cmp r10, r9
jae 0x140119ae4
sub rdx, rcx
sub r8, rcx
sub r9, r10
movzx eax, byte [r8 + rcx]
xor al, byte [rdx + rcx]
mov byte [rcx], al
lea rcx, [rcx + 1]
sub r9, 1
jne 0x140119ad0
ret
Function at 0x14012ebe0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rdi
cmp byte [0x1401d69d4], 0
lea rdi, [0x1401d69e0]
mov r11, rdx
mov r10, rcx
jne 0x14012ecbc
mov qword [rsp + 0x10], rbx
xor ebx, ebx
mov byte [0x1401d69d4], 1
nop word [rax + rax]
mov edx, ebx
shr edx, 1
mov ecx, edx
xor ecx, 0xedb88320
test bl, 1
cmove ecx, edx
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, 0xedb88320
test cl, 1
cmove edx, eax
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, 0xedb88320
test dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, 0xedb88320
test cl, 1
cmove edx, eax
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, 0xedb88320
test dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, 0xedb88320
test cl, 1
cmove edx, eax
mov eax, edx
shr eax, 1
mov r9d, eax
xor r9d, 0xedb88320
test dl, 1
cmove r9d, eax
mov ecx, r9d
shr ecx, 1
mov eax, ecx
xor eax, 0xedb88320
test r9b, 1
cmove eax, ecx
mov dword [rdi + rbx*4], eax
inc rbx
cmp rbx, 0x100
jb 0x14012ec10
mov rbx, qword [rsp + 0x10]
not r8d
test r11, r11
je 0x14012eced
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [r10]
lea r10, [r10 + 1]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
xor r8d, dword [rdi + rcx*4]
sub r11, 1
jne 0x14012ecd0
not r8d
mov eax, r8d
pop rdi
ret

Function at 0x14012ed00
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp byte [0x1401d69d4], 0
jne 0x14012edc5
mov byte [0x1401d69d4], 1
lea r9, [0x1401d69e0]
xor r8d, r8d
nop
mov ecx, r8d
shr ecx, 1
mov edx, ecx
xor edx, 0xedb88320
test r8b, 1
cmove edx, ecx
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, 0xedb88320
test dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, 0xedb88320
test cl, 1
cmove edx, eax
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, 0xedb88320
test dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, 0xedb88320
test cl, 1
cmove edx, eax
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, 0xedb88320
test dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, 0xedb88320
test cl, 1
cmove edx, eax
mov ecx, edx
shr ecx, 1
mov eax, ecx
xor eax, 0xedb88320
test dl, 1
cmove eax, ecx
mov dword [r9 + r8*4], eax
inc r8
cmp r8, 0x100
jb 0x14012ed20
ret
Function at 0x14012edd0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
cmp byte [0x1401d75e0], 0
lea rbx, [0x1401d6de0]
mov r11, rdx
mov r10, rcx
jne 0x14012eea4
mov byte [0x1401d75e0], 1
xor r9d, r9d
movabs rcx, 0xc96c5795d7870f42
nop dword [rax]
nop word [rax + rax]
mov rdx, r9
mov rax, r9
shr rdx, 1
xor rdx, rcx
shr rax, 1
test r9b, 1
cmovne rax, rdx
test al, 1
je 0x14012ee33
shr rax, 1
xor rax, rcx
jmp 0x14012ee36
shr rax, 1
test al, 1
je 0x14012ee42
shr rax, 1
xor rax, rcx
jmp 0x14012ee45
shr rax, 1
test al, 1
je 0x14012ee51
shr rax, 1
xor rax, rcx
jmp 0x14012ee54
shr rax, 1
test al, 1
je 0x14012ee60
shr rax, 1
xor rax, rcx
jmp 0x14012ee63
shr rax, 1
test al, 1
je 0x14012ee6f
shr rax, 1
xor rax, rcx
jmp 0x14012ee72
shr rax, 1
test al, 1
je 0x14012ee7e
shr rax, 1
xor rax, rcx
jmp 0x14012ee81
shr rax, 1
test al, 1
je 0x14012ee8d
shr rax, 1
xor rax, rcx
jmp 0x14012ee90
shr rax, 1
mov qword [rbx + r9*8], rax
inc r9
cmp r9, 0x100
jb 0x14012ee10
not r8
test r11, r11
je 0x14012eecd
nop dword [rax]
movzx eax, byte [r10]
lea r10, [r10 + 1]
movzx ecx, r8b
xor rcx, rax
shr r8, 8
xor r8, qword [rbx + rcx*8]
sub r11, 1
jne 0x14012eeb0
mov rbx, qword [rsp + 8]
not r8
mov rax, r8
ret