joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004d920
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
sub rsp, 0x28
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov r11, rdx
mov dword [rsp + 0x20], ecx
mov r9, qword [r11]
mov r8, r9
and r8, 0xfffffffffffffffc
mov rdx, qword [r11 + 8]
add r8, rdx
cmp rdx, r8
je 0x14004d98d
mov ecx, dword [rdx]
imul eax, ecx, 0xcc9e2d51
mov ecx, eax
rol eax, 0xf
mov ecx, eax
imul r10d, ecx, 0x1b873593
mov ecx, r10d
xor dword [rsp + 0x20], ecx
mov ebx, dword [rsp + 0x20]
rol ebx, 0xd
lea ebx, [rbx + rbx*4]
lea esi, [rbx - 0x19ab949c]
mov dword [rsp + 0x20], esi
add rdx, 4
cmp rdx, r8
jne 0x14004d953
xor ecx, ecx
mov rdi, r9
and rdi, 3
cmp rdi, 1
je 0x14004d9bd
cmp rdi, 2
je 0x14004d9b4
cmp rdi, 3
je 0x14004d9ad
jmp 0x14004d9dd
movzx ecx, byte [rdx + 2]
shl ecx, 0x10
movzx eax, byte [rdx + 1]
shl eax, 8
xor ecx, eax
movzx r8d, byte [rdx]
xor ecx, r8d
imul ebx, ecx, 0xcc9e2d51
mov ecx, ebx
rol ebx, 0xf
mov ecx, ebx
imul esi, ecx, 0x1b873593
mov ecx, esi
xor dword [rsp + 0x20], ecx
xor dword [rsp + 0x20], r9d
movzx ecx, word [rsp + 0x22]
xor ecx, dword [rsp + 0x20]
imul eax, ecx, 0x85ebca6b
mov dword [rsp + 0x20], eax
shr eax, 0xd
xor eax, dword [rsp + 0x20]
imul edx, eax, 0xc2b2ae35
mov dword [rsp + 0x20], edx
movzx ebx, word [rsp + 0x22]
xor dword [rsp + 0x20], ebx
mov eax, dword [rsp + 0x20]
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
add rsp, 0x28
ret

Function at 0x140058f30
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x58], rbx
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x48], rdi
mov rdi, rcx
mov rbx, rdx
cmp dword [rdi + 0x18], 0
jg 0x140058fbb
mov rdx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rdx
mov r8, qword [rdi]
mov r9, qword [r8]
mov r8, qword [rbp - 0x40]
mov edx, 1
mov rcx, qword [rbp - 0x38]
call fcn.14013c3a0
mov rsi, rax
cmp qword [rbx], rsi
je 0x140058feb
xor r9d, r9d
mov qword [rbp - 0x30], rdi
lea rax, [fcn.140031db0]
mov qword [rbp - 0x28], rax
lea r8, [rbp - 0x30]
lea rdx, str.C:Ddmd_2.096.1windows_bin...._srcphobos_std_stdio.d
mov qword [rbp - 0x18], rdx
mov qword [rbp - 0x20], reloc.WS2_32.dll_gethostname
lea rdx, [rbp - 0x20]
mov ecx, 0xbc9
call fcn.14006b4e0
jmp 0x140058feb
mov rdx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rdx
xor esi, esi
cmp qword [rbp - 0x10], rsi
je 0x140058feb
mov rcx, qword [rbp - 8]
movzx edx, byte [rsi + rcx]
mov rcx, rdi
call fcn.140059000
inc rsi
cmp rsi, qword [rbp - 0x10]
jb 0x140058fd2
mov rbx, qword [rbp - 0x58]
mov rsi, qword [rbp - 0x50]
mov rdi, qword [rbp - 0x48]
mov rsp, rbp
pop rbp
ret
Function at 0x14007fa30
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub rsp, 0x28
mov qword [rsp + 8], rbx
mov qword [rsp + 0x38], rdx
movabs r9, 0xcbf29ce484222325
mov rax, qword [rsp + 0x38]
mov rdx, qword [rax + 8]
mov rax, qword [rax]
mov qword [rsp + 0x10], rax
mov qword [rsp + 0x18], rdx
xor r8d, r8d
cmp qword [rsp + 0x10], r8
je 0x14007fa8f
mov rbx, qword [rsp + 0x18]
mov ecx, dword [rbx + r8*4]
xor r9, rcx
movabs r10, 0x100000001b3
imul r10, r9
mov r9, r10
inc r8
cmp r8, qword [rsp + 0x10]
jb 0x14007fa68
mov rax, r9
mov rbx, qword [rsp + 8]
add rsp, 0x28
ret
Function at 0x140091b40
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x200
mov qword [rbp - 0x1e0], rbx
mov qword [rbp - 0x1d8], rsi
mov qword [rbp - 0x1d0], rdi
mov dword [rbp + 0x10], ecx
mov rbx, rdx
mov ecx, dword [rbp + 0x10]
test ecx, ecx
je 0x140091d1e
mov dword [rbp + 0x10], ecx
mov edx, 0x2e
mov rcx, rbx
call fcn.14000ccd0
mov edx, dword [rbp + 0x10]
lea rcx, [rbp - 0x178]
call fcn.1400163e0
lea rsi, [rbp - 0x178]
lea rdi, [rbp - 0x198]
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
movsd dword [rdi], dword [rsi]
mov eax, dword [rbp - 0x174]
sub eax, dword [rbp - 0x178]
mov eax, eax
cmp rax, 7
jae 0x140091bc1
mov edx, 7
sub rdx, rax
jmp 0x140091bc3
xor edx, edx
mov qword [rbp - 0x130], rdx
xor ecx, ecx
mov dword [rbp - 0x128], ecx
mov dword [rbp - 0x124], ecx
mov byte [rbp - 0x128], getprotobynumber
lea rsi, [rbp - 0x178]
lea rdi, [rbp - 0x118]
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
movsd dword [rdi], dword [rsi]
mov dword [rbp - 0xa4], ecx
lea rsi, [rbp - 0x178]
lea rdi, [rbp - 0x98]
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
movsd dword [rdi], dword [rsi]
mov rax, qword [rbp - 0x128]
mov qword [rbp - 0xc8], rax
mov rcx, qword [rbp - 0x130]
mov qword [rbp - 0xc0], rcx
lea rsi, [rbp - 0x178]
lea rdi, [rbp - 0x78]
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
movsd dword [rdi], dword [rsi]
lea rsi, [rbp - 0x178]
lea rdi, [rbp - 0xb8]
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
movsd dword [rdi], dword [rsi]
lea rsi, [rbp - 0xc8]
lea rdi, [rbp - 0xf8]
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
lea rsi, [rbp - 0xc8]
lea rdi, [rbp - 0x158]
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
lea rsi, [rbp - 0xc8]
lea rdi, [rbp - 0x1c8]
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
lea rcx, [rbp - 0x1c8]
call fcn.14009da00
cmp al, 0x30
jne 0x140091cbe
lea rcx, [rbp - 0x1c8]
call fcn.14009da80
lea rcx, [rbp - 0x1c8]
call fcn.14009da00
cmp al, 0x30
je 0x140091ca2
lea rsi, [rbp - 0x1c8]
lea rdi, [rbp - 0x58]
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
lea rsi, [rbp - 0x1c8]
lea rdi, [rbp - 0x28]
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
lea rcx, [rbp - 0x28]
call fcn.14009d950
xor al, 1
je 0x140091d1e
lea rcx, [rbp - 0x28]
call fcn.14009d990
mov edx, eax
mov rcx, rbx
call fcn.14000ccd0
lea rcx, [rbp - 0x28]
call fcn.14009d970
lea rcx, [rbp - 0x28]
call fcn.14009d950
xor al, 1
jne 0x140091cf5
mov rbx, qword [rbp - 0x1e0]
mov rsi, qword [rbp - 0x1d8]
mov rdi, qword [rbp - 0x1d0]
mov rsp, rbp
pop rbp
ret
Function at 0x1400ab6c0
Capabilities:
Connect socket

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x48], rbx
mov qword [rbp - 0x40], rsi
mov qword [rbp - 0x38], rdi
mov qword [rbp + 0x10], rcx
mov rsi, rdx
mov rax, qword [rbp + 0x10]
mov rbx, qword [rax + 0x10]
mov rcx, rsi
mov rdi, qword [rsi]
call qword [rdi + 0x28]
mov qword [rbp - 0x30], rax
mov rcx, rsi
mov rdx, qword [rsi]
call qword [rdx + reloc.WS2_32.dll_getservbyport]
mov r8d, eax
mov rdx, qword [rbp - 0x30]
mov rcx, rbx
call sub.WS2_32.dll_connect
cmp eax, 0xffffffff
jne 0x1400ab799
call fcn.1400c76a0
mov esi, eax
mov rcx, qword [rbp + 0x10]
mov rax, qword [rcx]
call qword [rax + gethostbyaddr]
xor al, 1
je 0x1400ab734
cmp esi, 0x2733
je 0x1400ab799
lea rcx, [0x1401ada70]
call fcn.1400a9c50
lea rdx, str.Unable_to_connect_socket
mov qword [rbp - 0x18], rdx
mov qword [rbp - 0x20], 0x18
lea rbx, [rbp - 0x20]
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x58], rsi
lea rdi, [fcn.1400c76c0]
mov qword [rbp - 0x60], rdi
lea r8, str.std_socket.d
mov qword [rbp - 8], r8
mov qword [rbp - 0x10], reloc.WS2_32.dll_inet_ntoa
lea r9, [rbp - 0x10]
mov r8d, 0xb29
xor edx, edx
mov rcx, rax
call fcn.1400c7610
mov rcx, rax
call fcn.1400b3dc0
mov rbx, qword [rbp - 0x48]
mov rsi, qword [rbp - 0x40]
mov rdi, qword [rbp - 0x38]
mov rsp, rbp
pop rbp
ret

Function at 0x1400aba70
Capabilities:
Get hostname

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x170
mov qword [rbp - 0x130], rdi
mov rax, 0xffffffffffffffff
lea rdi, [rbp - 0x120]
mov ecx, 0x20
rep stosq qword [rdi], rax
mov edx, 0x100
lea rcx, [rbp - 0x120]
call sub.WS2_32.dll_gethostname
cmp eax, 0xffffffff
jne 0x1400abb40
lea rcx, [0x1401ada70]
call fcn.1400a9c50
mov rdi, rax
lea rax, str.Unable_to_obtain_host_name
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x20], 0x1a
lea rdx, [rbp - 0x20]
mov qword [rbp - 0x140], rdx
lea rbx, str.std_socket.d
mov qword [rbp - 8], rbx
mov qword [rbp - 0x10], reloc.WS2_32.dll_inet_ntoa
lea rsi, [rbp - 0x10]
mov qword [rbp - 0x148], rsi
mov qword [rbp - 0x150], 0xb8e
xor r9d, r9d
mov qword [rbp - 0x128], r9
sub rsp, 0x20
call fcn.1400c76a0
add rsp, 0x20
mov r8d, eax
mov r9, qword [rbp - 0x128]
lea rdx, [fcn.1400c76c0]
mov rcx, rdi
call fcn.1400c7460
mov rcx, rax
call fcn.1400b3dc0
lea rcx, [rbp - 0x120]
call fcn.14004d6d0
mov rdi, qword [rbp - 0x130]
mov rsp, rbp
pop rbp
ret
Function at 0x1400b4d40
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xf0
mov qword [rbp - 0xb8], rbx
mov qword [rbp - 0xb0], rsi
mov qword [rbp - 0xa8], rdi
mov qword [rbp - 0xa0], r12
mov qword [rbp - 0x98], r13
mov qword [rbp + 0x20], r8
mov qword [rbp + 0x28], r9
mov r12, rdx
mov rsi, qword [rbp + 0x20]
mov rdi, qword [rbp + 0x28]
test cl, cl
je 0x1400b4e6b
xor r10d, r10d
mov qword [rbp - 0xc0], r10
mov qword [rbp - 0xc8], 0x8000080
mov qword [rbp - 0xd0], 4
mov r9, r10
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rsi
call sub.KERNEL32.dll_CreateFileW
mov rbx, rax
cmp rbx, 0xffffffffffffffff
setne r10b
mov qword [rbp - 0xd0], r10
mov rdx, qword [rdi + 8]
mov rax, qword [rdi]
mov qword [rbp - 0x90], rax
mov qword [rbp - 0x88], rdx
lea r9, [rbp - 0x90]
mov r8, rsi
lea rcx, str.std_file.d
mov qword [rbp - 0x78], rcx
mov r10d, 0xa
mov qword [rbp - 0x80], r10
lea rdx, [rbp - 0x80]
mov ecx, 0x366
call fcn.1400cbfb0
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call sub.KERNEL32.dll_SetFilePointer
cmp eax, 0xffffffff
setne r10b
mov qword [rbp - 0xd0], r10
mov rdx, qword [rdi + 8]
mov rax, qword [rdi]
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rdx
lea r9, [rbp - 0x70]
mov r8, rsi
lea rcx, str.std_file.d
mov qword [rbp - 0x58], rcx
mov qword [rbp - 0x60], 0xa
lea rdx, [rbp - 0x60]
mov ecx, 0x367
call fcn.1400cbfb0
jmp 0x1400b4ee6
xor ecx, ecx
mov qword [rbp - 0xc0], rcx
mov qword [rbp - 0xc8], 0x8000080
mov qword [rbp - 0xd0], 2
mov r9, rcx
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rsi
call sub.KERNEL32.dll_CreateFileW
mov rbx, rax
cmp rbx, 0xffffffffffffffff
setne r10b
mov qword [rbp - 0xd0], r10
mov rdx, qword [rdi + 8]
mov rax, qword [rdi]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rdx
lea r9, [rbp - 0x50]
mov r8, rsi
lea rcx, str.std_file.d
mov qword [rbp - 0x38], rcx
mov qword [rbp - 0x40], 0xa
lea rdx, [rbp - 0x40]
mov ecx, 0x372
call fcn.1400cbfb0
mov qword [rbp + 0x20], rsi
mov qword [rbp + 0x28], rdi
xor edi, edi
mov r13, qword [r12]
test r13, r13
je 0x1400b4f45
mov r9, r13
sub r9, rdi
mov r8d, 0x40000000
cmp r9, r8
jae 0x1400b4f0f
mov rsi, r9
jmp 0x1400b4f12
mov rsi, r8
mov qword [rbp - 0xd0], 0
lea r9, [rbp - 0x30]
mov r8d, esi
mov rdx, qword [r12 + 8]
add rdx, rdi
mov rcx, rbx
call sub.KERNEL32.dll_WriteFile
mov r10d, dword [rbp - 0x30]
cmp r10, rsi
jne 0x1400b4f45
add rdi, r10
cmp rdi, r13
jne 0x1400b4ef9
cmp rdi, r13
jne 0x1400b4f56
mov rcx, rbx
call sub.KERNEL32.dll_CloseHandle
test eax, eax
jne 0x1400b4f5b
xor r8d, r8d
jmp 0x1400b4f61
mov r8d, 1
mov qword [rbp - 0xd0], r8
mov rdx, qword [rbp + 0x28]
mov rax, qword [rdx]
mov rdx, qword [rdx + 8]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
lea r9, [rbp - 0x20]
mov r8, qword [rbp + 0x20]
lea rcx, str.std_file.d
mov qword [rbp - 8], rcx
mov qword [rbp - 0x10], 0xa
lea rdx, [rbp - 0x10]
mov ecx, 0x37f
call fcn.1400cbfb0
mov rbx, qword [rbp - 0xb8]
mov rsi, qword [rbp - 0xb0]
mov rdi, qword [rbp - 0xa8]
mov r12, qword [rbp - 0xa0]
mov r13, qword [rbp - 0x98]
mov rsp, rbp
pop rbp
ret
Function at 0x1400b5a50
Capabilities:
Get file size

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], rbx
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov qword [rax], 0
mov dword [rbp - 8], 0
lea rdx, [rbp - 8]
mov rcx, qword [rbp + 0x18]
call sub.KERNEL32.dll_GetFileSize
cmp eax, 0xffffffff
setne r8b
mov byte [rbp - 4], r8b
je 0x1400b5aa1
mov edx, eax
mov ecx, dword [rbp - 8]
call fcn.1400cc560
mov rbx, qword [rbp + 0x10]
mov qword [rbx], rax
mov al, byte [rbp - 4]
mov rbx, qword [rbp - 0x10]
mov rsp, rbp
pop rbp
ret

Function at 0x1400b5ab0
Capabilities:
Read file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x38], rbx
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x20], r12
mov qword [rbp - 0x18], r13
mov rbx, rcx
mov r12, rdx
mov r13, r8
xor esi, esi
test rbx, rbx
je 0x1400b5b48
mov qword [rbp - 0x40], 0
lea r9, [rbp - 8]
mov qword [rbp - 0x10], r9
mov rdx, rbx
sub rdx, rsi
mov ecx, 0xffff0000
sub rsp, 0x20
call fcn.1400cc580
add rsp, 0x20
mov edi, eax
mov r8d, edi
mov r9, qword [rbp - 0x10]
lea rdx, [r12 + rsi]
mov rcx, r13
call sub.KERNEL32.dll_ReadFile
test eax, eax
je 0x1400b5b22
cmp dword [rbp - 8], edi
je 0x1400b5b3d
xor eax, eax
mov rbx, qword [rbp - 0x38]
mov rsi, qword [rbp - 0x30]
mov rdi, qword [rbp - 0x28]
mov r12, qword [rbp - 0x20]
mov r13, qword [rbp - 0x18]
mov rsp, rbp
pop rbp
ret
mov r9d, edi
add rsi, r9
cmp rsi, rbx
jne 0x1400b5adc
mov eax, 1
mov rbx, qword [rbp - 0x38]
mov rsi, qword [rbp - 0x30]
mov rdi, qword [rbp - 0x28]
mov r12, qword [rbp - 0x20]
mov r13, qword [rbp - 0x18]
mov rsp, rbp
pop rbp
ret
Function at 0x1400b87a0
Capabilities:
Create thread
Resume thread

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x90
mov qword [rbp - 0x90], rbx
mov qword [rbp - 0x88], rsi
mov qword [rbp - 0x80], rdi
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], r14
mov qword [rbp - 0x60], r15
mov qword [rbp + 0x10], rcx
mov al, byte [0x1401dc6b0]
mov byte [rbp - 0x50], al
mov byte [0x1401dc6b0], 1
mov rsi, rcx
add rsi, 0xb0
mov edi, dword [rcx + 0x40]
lea r12, [0x1400ce450]
mov r13, rcx
mov rbx, rcx
add rbx, 0x10
push rbx
push 4
mov r9, rcx
lea r8, [0x1400ce450]
mov edx, edi
xor ecx, ecx
sub rsp, 0x20
call fcn.14013e358
add rsp, 0x30
mov qword [rsi], rax
mov r10, qword [rbp + 0x10]
cmp qword [r10 + 0xb0], 0
jne 0x1400b884e
lea rax, str.Error_creating_thread
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x40], reloc.WS2_32.dll_setsockopt
lea rcx, [rbp - 0x40]
sub rsp, 0x20
call fcn.1400ce670
lea rsi, [0x1401dc5f8]
lea rcx, [0x1401dc610]
sub rsp, 0x20
call sub.KERNEL32.dll_EnterCriticalSection
add rsp, 0x20
inc qword [0x1401dc6a8]
mov rdx, qword [0x1401dc6a8]
shl rdx, 3
mov rcx, qword [0x1401dc6a0]
sub rsp, 0x20
call fcn.14013ba6c
add rsp, 0x20
mov qword [0x1401dc6a0], rax
mov rbx, qword [rbp + 0x10]
mov rsi, qword [0x1401dc6a8]
lea rax, [rax + rsi*8]
mov qword [rax - 8], rbx
mov rdx, qword [rbp + 0x10]
mov rcx, qword [rdx + 0xb0]
sub rsp, 0x20
call sub.KERNEL32.dll_ResumeThread
add rsp, 0x20
cmp eax, 0xffffffff
jne 0x1400b88e6
lea rbx, str.Error_resuming_thread
mov qword [rbp - 0x28], rbx
mov qword [rbp - 0x30], reloc.WS2_32.dll_setsockopt
lea rcx, [rbp - 0x30]
sub rsp, 0x20
call fcn.1400ce670
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x58], rax
sub rsp, 8
call fcn.1400b8935
add rsp, 8
mov rax, qword [rbp - 0x58]
mov rbx, qword [rbp - 0x90]
mov rsi, qword [rbp - 0x88]
mov rdi, qword [rbp - 0x80]
mov r12, qword [rbp - 0x78]
mov r13, qword [rbp - 0x70]
mov r14, qword [rbp - 0x68]
mov r15, qword [rbp - 0x60]
mov rsp, rbp
pop rbp
ret
Function at 0x1400bcf80
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xd0
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
call fcn.1400bd0d0
mov qword [rbp - 0xa0], rax
cmp rax, 0xffffffffffffffff
jne 0x1400bcfab
ud2
mov rax, qword [rbp + 0x18]
mov rdx, qword [rax + 8]
mov rax, qword [rax]
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rdx
mov rdx, qword [rbp + 0x10]
lea rcx, [rbp - 0x90]
mov qword [rbp - 8], rcx
mov qword [rbp - 0x10], reloc.WS2_32.dll_sendto
lea rcx, [rbp - 0x10]
call fcn.140075990
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rdx
mov rbx, qword [rbp + 0x20]
mov rdx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
xor esi, esi
mov qword [rbp - 0xb0], rsi
mov r9, rsi
mov r8d, reloc.WS2_32.dll_ntohl
lea rdx, str.Aborting_from
mov rcx, qword [rbp - 0xa0]
call sub.KERNEL32.dll_WriteFile
mov qword [rbp - 0xb0], rsi
mov r9, rsi
mov r8d, dword [rbp - 0x60]
mov rdx, qword [rbp - 0x58]
mov rcx, qword [rbp - 0xa0]
call sub.KERNEL32.dll_WriteFile
mov qword [rbp - 0xb0], rsi
mov r9, rsi
mov r8d, 1
lea rdx, [0x140175460]
mov rcx, qword [rbp - 0xa0]
call sub.KERNEL32.dll_WriteFile
mov qword [rbp - 0xb0], rsi
mov r9, rsi
mov r8d, dword [rbp - 0x40]
mov rdx, qword [rbp - 0x38]
mov rcx, qword [rbp - 0xa0]
call sub.KERNEL32.dll_WriteFile
mov qword [rbp - 0xb0], rsi
mov r9, rsi
mov r8d, 2
lea rdx, [0x14018b730]
mov rcx, qword [rbp - 0xa0]
call sub.KERNEL32.dll_WriteFile
mov qword [rbp - 0xb0], rsi
mov r9, rsi
mov r8d, dword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
mov rcx, qword [rbp - 0xa0]
call sub.KERNEL32.dll_WriteFile
call fcn.14013e438
int3
Function at 0x1400bd450
Capabilities:
Query environment variable

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xe0
mov qword [rbp - 0xb8], rbx
mov qword [rbp - 0xb0], rsi
mov qword [rbp - 0xa8], rdi
xor eax, eax
mov qword [rbp - 0x90], rax
call sub.KERNEL32.dll_GetEnvironmentStringsW
mov r9, rax
mov qword [rbp - 0x88], r9
lea rcx, [0x1400bd6d0]
mov qword [rbp - 0x78], rcx
mov qword [rbp - 0x80], 0
lea r8, [rbp - 0x80]
lea rdx, str.stdprocess.d
mov qword [rbp - 0x68], rdx
mov qword [rbp - 0x70], reloc.WS2_32.dll_listen
lea rdx, [rbp - 0x70]
mov ecx, 0x1a0
call fcn.1400c9570
xor esi, esi
mov rax, qword [rbp - 0x88]
cmp word [rax], si
je 0x1400bd652
mov edi, esi
movsxd r8, esi
mov r9, qword [rbp - 0x88]
cmp word [r9 + r8*2], 0x3d
je 0x1400bd4f9
inc esi
movsxd rdx, esi
mov rcx, qword [rbp - 0x88]
cmp word [rcx + rdx*2], 0x3d
jne 0x1400bd4e6
movsxd r10, esi
movsxd r8, edi
mov qword [rbp - 0xa0], r10
sub r10, r8
mov qword [rbp - 0x50], r10
mov r9, qword [rbp - 0x88]
lea rdx, [r9 + r8*2]
mov qword [rbp - 0x48], rdx
lea rcx, [rbp - 0x50]
sub rsp, 0x20
call fcn.1400dc190
add rsp, 0x20
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rdx
lea rcx, [rbp - 0x40]
sub rsp, 0x20
call fcn.1400dc1f0
add rsp, 0x20
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rdx
lea edi, [rsi + 1]
mov r8, qword [rbp - 0xa0]
mov r9, qword [rbp - 0x88]
cmp word [r9 + r8*2], 0
je 0x1400bd57b
inc esi
movsxd rdx, esi
mov r10, qword [rbp - 0x88]
cmp word [r10 + rdx*2], 0
jne 0x1400bd567
cmp qword [rbp - 0x60], 0
je 0x1400bd63b
movsxd rcx, esi
movsxd r8, edi
sub rcx, r8
mov qword [rbp - 0x20], rcx
mov r9, qword [rbp - 0x88]
lea rdx, [r9 + r8*2]
mov qword [rbp - 0x18], rdx
lea rcx, [rbp - 0x20]
sub rsp, 0x20
call fcn.1400dc1f0
add rsp, 0x20
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rdx
lea r8, [rbp - 0x60]
lea rdx, [0x140183520]
mov rcx, qword [rbp - 0x90]
sub rsp, 0x20
call fcn.1400bb1d0
add rsp, 0x20
test rax, rax
jne 0x1400bd63b
mov r9, qword [rbp - 0x28]
or r9, qword [rbp - 0x30]
je 0x1400bd5f3
mov rdx, qword [rbp - 0x28]
mov rax, qword [rbp - 0x30]
jmp 0x1400bd5fc
lea rdx, [0x140170040]
xor eax, eax
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rdx
lea r9, [rbp - 0x60]
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [0x140170830]
lea rcx, [rbp - 0x90]
sub rsp, 0x20
call fcn.1400b8ba0
add rsp, 0x20
mov rdi, rax
mov rdx, qword [rbp - 8]
mov rax, qword [rbp - 0x10]
mov qword [rdi], rax
mov qword [rdi + 8], rdx
inc esi
movsxd rbx, esi
mov rdi, qword [rbp - 0x88]
cmp word [rdi + rbx*2], 0
jne 0x1400bd4d2
mov rax, qword [rbp - 0x90]
mov qword [rbp - 0x98], rax
sub rsp, 8
call fcn.1400bd69d
add rsp, 8
mov rax, qword [rbp - 0x98]
mov rbx, qword [rbp - 0xb8]
mov rsi, qword [rbp - 0xb0]
mov rdi, qword [rbp - 0xa8]
mov rsp, rbp
pop rbp
ret
Function at 0x1400c1280
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x38], rsi
mov qword [rbp + 0x10], rcx
xor esi, esi
lea rdx, [rbp - 0x28]
mov rcx, qword [rbp + 0x10]
call fcn.1400c11f0
lea rcx, [rbp - 0x28]
call fcn.1400c27e0
xor al, 1
je 0x1400c12f5
lea rcx, [rbp - 0x28]
call fcn.1400c3040
mov qword [rbp - 8], rax
lea rcx, [rbp - 8]
call fcn.1400dea60
mov eax, dword [rax]
mov qword [rbp - 0x30], rax
lea rcx, [rbp - 8]
call fcn.140080da0
mov rdx, rax
mov rax, qword [rbp - 0x30]
sub eax, dword [rdx]
mov eax, eax
add rsi, rax
lea rcx, [rbp - 0x28]
call fcn.1400c3100
lea rcx, [rbp - 0x28]
call fcn.1400c27e0
xor al, 1
jne 0x1400c12ac
mov rax, rsi
mov rsi, qword [rbp - 0x38]
mov rsp, rbp
pop rbp
ret

Function at 0x1400c6c00
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x40], rsi
mov qword [rbp - 0x38], rdi
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x28], r14
mov rdi, rcx
call fcn.1400e1330
test rax, rax
mov qword [rbp - 0x20], rax
jne 0x1400c6c34
mov rax, 0xffffffffffffffff
mov qword [rbp - 0x20], rax
mov r9d, dword [rbp - 0x20]
mov esi, dword [rbp - 0x1c]
mov qword [rbp - 8], rdi
mov qword [rbp - 0x10], 0x270
xor r11d, r11d
imul ecx, r9d, 0x9e3779bb
rol ecx, 5
lea ecx, [rcx + rcx*4]
mov rdx, qword [rbp - 8]
mov dword [rdx + r11*4], ecx
mov r8d, esi
xor r8d, r9d
mov r10d, r8d
shl r10d, 9
mov r12d, r9d
rol r12d, 0x1a
xor r12d, r8d
xor r10d, r12d
mov r9d, r10d
imul r14d, r10d, 0x9e3779bb
rol r14d, 5
lea r14d, [r14 + r14*4]
lea rcx, [r11 + 1]
mov dword [rdx + rcx*4], r14d
mov edx, r8d
rol edx, 0xd
xor edx, r10d
mov r8d, edx
shl edx, 9
rol r10d, 0x1a
xor r10d, r8d
xor edx, r10d
mov r9d, edx
mov esi, r8d
rol esi, 0xd
add r11, 2
cmp r11, 0x270
jb 0x1400c6c4a
mov qword [rdi + 0x9c8], 0x26f
mov rcx, rdi
call fcn.1400da290
mov rcx, rdi
call fcn.1400da290
mov rsi, qword [rbp - 0x40]
mov rdi, qword [rbp - 0x38]
mov r12, qword [rbp - 0x30]
mov r14, qword [rbp - 0x28]
mov rsp, rbp
pop rbp
ret
Function at 0x1400c82e0
Capabilities:
Create pipe

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x150
mov qword [rbp - 0x128], rbx
mov qword [rbp - 0x120], rsi
mov qword [rbp - 0x118], rdi
mov qword [rbp - 0x110], r12
mov qword [rbp - 0x108], r13
mov qword [rbp - 0x100], r14
mov qword [rbp - 0xf8], r15
mov qword [rbp + 0x10], rcx
xor eax, eax
mov qword [rbp - 0xf0], rax
mov qword [rbp - 0xe8], rax
xor r9d, r9d
mov r8, rax
lea rdx, [rbp - 0xe8]
lea rcx, [rbp - 0xf0]
call sub.KERNEL32.dll_CreatePipe
test eax, eax
jne 0x1400c8407
lea rcx, [0x1401ae6d0]
call fcn.1400a9c50
mov rsi, rax
lea rax, str.Error_creating_pipe__
mov qword [rbp - 0xd8], rax
mov qword [rbp - 0xe0], reloc.WS2_32.dll_setsockopt
call sub.KERNEL32.dll_GetLastError
mov r8d, eax
xor edx, edx
mov ecx, 1
call fcn.1400c9970
mov qword [rbp - 0xd0], rax
mov qword [rbp - 0xc8], rdx
lea rbx, [0x14015b630]
mov qword [rbp - 0xb8], rbx
mov qword [rbp - 0xc0], 1
lea rax, [rbp - 0xe0]
mov qword [rbp - 0xa8], rax
mov qword [rbp - 0xb0], 3
lea rdx, [rbp - 0xb0]
lea rcx, [0x140183520]
call fcn.1400b0960
mov qword [rbp - 0xa0], rax
mov qword [rbp - 0x98], rdx
lea r8, [rbp - 0xa0]
xor edx, edx
mov rcx, rsi
call fcn.1400c8770
mov rcx, rax
call fcn.1400b3dc0
mov rax, qword [rbp + 0x10]
xor ebx, ebx
mov qword [rax], rbx
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbx
mov qword [rax + 0x28], rbx
mov rdi, qword [rbp + 0x10]
mov r8, qword [rbp - 0xf0]
lea r9, [0x1401ae620]
mov qword [rbp - 0x68], r9
mov edx, 1
mov qword [rbp - 0x70], rdx
lea rdx, [rbp - 0x70]
mov rcx, qword [rbp + 0x10]
sub rsp, 0x20
call fcn.1400ae270
add rsp, 0x20
mov r8, qword [rbp + 0x10]
lea rsi, [r8 + 0x18]
mov r8, qword [rbp - 0xe8]
lea r9, [0x1401ae630]
mov qword [rbp - 0x58], r9
mov qword [rbp - 0x60], 1
lea rdx, [rbp - 0x60]
mov rcx, rsi
sub rsp, 0x20
call fcn.1400ae270
add rsp, 0x20
mov rax, qword [rbp + 0x10]
mov rbx, qword [rbp - 0x128]
mov rsi, qword [rbp - 0x120]
mov rdi, qword [rbp - 0x118]
mov r12, qword [rbp - 0x110]
mov r13, qword [rbp - 0x108]
mov r14, qword [rbp - 0x100]
mov r15, qword [rbp - 0xf8]
mov rsp, rbp
pop rbp
ret