joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1337c0fd3c30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x60
call fcn.1337c1023cb0
sub rsp, rax
mov rax, qword [0x1337c1249ac0]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov r14, qword [rsp + 0xd0]
mov r13, r9
mov rax, qword [rsp + 0xc0]
mov rdi, rcx
mov rcx, qword [rsp + 0xc8]
mov esi, r8d
mov r12, qword [rsp + 0xd8]
mov r15, rdx
movzx r8d, byte [r14 + 3]
xor ebp, ebp
movzx edx, byte [r14 + 7]
movzx r9d, byte [r14]
movzx r10d, byte [r14 + 4]
mov ebx, dword [r12]
mov qword [rsp + 0x28], rax
movzx eax, byte [r14 + 1]
shl eax, 8
or r9d, eax
mov qword [rsp + 0x30], rcx
movzx eax, byte [r14 + 2]
mov ecx, edx
shl eax, 0x10
or r9d, eax
shl ecx, 8
mov eax, r8d
mov qword [rsp + 0x38], r14
shl eax, 0x18
or r9d, eax
mov qword [rsp + 0x40], r12
movzx eax, byte [r14 + 5]
shl eax, 8
or r10d, eax
mov dword [rsp + 0x20], r9d
movzx eax, byte [r14 + 6]
or ecx, eax
mov byte [rsp + 0x48], r9b
mov eax, ecx
mov byte [rsp + 0x4b], r8b
shl eax, 0x10
or r10d, eax
mov byte [rsp + 0x4e], cl
mov eax, r9d
mov dword [rsp + 0x24], r10d
shr eax, 8
mov byte [rsp + 0x49], al
mov eax, r9d
shr eax, 0x10
mov byte [rsp + 0x4a], al
mov eax, r10d
shr eax, 8
mov byte [rsp + 0x4c], r10b
mov byte [rsp + 0x4d], al
mov byte [rsp + 0x4f], dl
test esi, esi
je 0x1337c0fd3e1d
mov r12, qword [rsp + 0x28]
sub r15, rdi
mov r14, qword [rsp + 0x30]
dec esi
test ebx, ebx
jne 0x1337c0fd3db2
mov r9, r14
lea rcx, [rsp + 0x20]
mov r8, r12
mov rdx, r13
call fcn.1337c0fd1770
mov r9d, dword [rsp + 0x20]
mov eax, r9d
mov r10d, dword [rsp + 0x24]
shr eax, 8
mov byte [rsp + 0x49], al
mov eax, r9d
shr eax, 0x10
mov byte [rsp + 0x4a], al
mov eax, r9d
shr eax, 0x18
mov byte [rsp + 0x4b], al
mov eax, r10d
shr eax, 8
mov byte [rsp + 0x4d], al
mov eax, r10d
shr eax, 0x10
mov byte [rsp + 0x4e], al
mov eax, r10d
shr eax, 0x18
mov byte [rsp + 0x4f], al
inc ebp
mov byte [rsp + 0x48], r9b
mov byte [rsp + 0x4c], r10b
movsxd rax, ebx
movzx ecx, byte [rsp + rax + 0x48]
xor cl, byte [rdi]
mov byte [rdi + r15], cl
inc rdi
inc ebx
and ebx, 7
test esi, esi
jne 0x1337c0fd3d47
mov r14, qword [rsp + 0x38]
mov r12, qword [rsp + 0x40]
test ebp, ebp
je 0x1337c0fd3e1d
mov eax, r9d
mov byte [r14], r9b
shr eax, 8
mov byte [r14 + 1], al
mov eax, r9d
shr eax, 0x10
mov byte [r14 + 2], al
mov eax, r10d
shr eax, 8
mov byte [r14 + 5], al
mov eax, r10d
shr eax, 0x10
shr r9d, 0x18
mov byte [r14 + 4], r10b
shr r10d, 0x18
mov byte [r14 + 7], r10b
mov byte [r14 + 3], r9b
mov byte [r14 + 6], al
mov dword [r12], ebx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1337c1023d90
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1337c0fd6770
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x38
call fcn.1337c1023cb0
sub rsp, rax
cmp dword [rsp + 0x68], 0
je 0x1337c0fd6799
lea rax, [0x1337c0fd4d40]
mov qword [rsp + 0x68], rax
add rsp, 0x38
jmp fcn.1337c0fbbc80
lea rax, [0x1337c0fd3ef0]
mov qword [rsp + 0x68], rax
add rsp, 0x38
jmp fcn.1337c0fbb9c0
Function at 0x1337c0ff7e70
Capabilities:
Encrypt data using curve25519

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
lea rbp, [rsp - 0x70]
mov eax, 0x170
call fcn.1337c1023cb0
sub rsp, rax
mov rax, qword [0x1337c1249ac0]
xor rax, rsp
mov qword [rbp + 0x60], rax
movups xmm0, xmmword [rdx]
mov rbx, rcx
lea rcx, [rsp + 0x50]
movups xmm1, xmmword [rdx + 0x10]
movd eax, xmm0
movups xmmword [rbp + 0x40], xmm0
and al, 0xf8
mov byte [rbp + 0x40], al
mov rax, qword [rdx + 0x18]
lea rdx, [rbp + 0x40]
shr rax, 0x38
and al, 0x3f
or al, 0x40
movups xmmword [rbp + 0x50], xmm1
mov byte [rbp + 0x5f], al
call fcn.1337c0ffc330
mov ecx, dword [rsp + 0x78]
mov edx, dword [rbp - 0x60]
mov r8d, dword [rbp - 0x3c]
lea eax, [rcx + rdx]
sub edx, ecx
mov ecx, dword [rsp + 0x7c]
mov dword [rbp + 0x18], edx
mov edx, dword [rbp - 0x5c]
mov dword [rbp - 0x10], eax
lea eax, [rcx + rdx]
sub edx, ecx
mov ecx, dword [rbp - 0x80]
mov dword [rbp + 0x1c], edx
mov edx, dword [rbp - 0x58]
mov dword [rbp - 0xc], eax
lea eax, [rcx + rdx]
sub edx, ecx
mov ecx, dword [rbp - 0x7c]
mov dword [rbp + 0x20], edx
mov edx, dword [rbp - 0x54]
mov dword [rbp - 8], eax
lea eax, [rcx + rdx]
sub edx, ecx
mov ecx, dword [rbp - 0x78]
mov dword [rbp + 0x24], edx
mov edx, dword [rbp - 0x50]
mov dword [rbp - 4], eax
lea eax, [rcx + rdx]
sub edx, ecx
mov ecx, dword [rbp - 0x74]
mov dword [rbp + 0x28], edx
mov edx, dword [rbp - 0x4c]
mov dword [rbp], eax
lea eax, [rcx + rdx]
sub edx, ecx
mov ecx, dword [rbp - 0x70]
mov dword [rbp + 0x2c], edx
mov edx, dword [rbp - 0x48]
mov dword [rbp + 4], eax
lea eax, [rcx + rdx]
sub edx, ecx
mov ecx, dword [rbp - 0x6c]
mov dword [rbp + 0x30], edx
mov edx, dword [rbp - 0x44]
mov dword [rbp + 8], eax
lea eax, [rcx + rdx]
sub edx, ecx
mov ecx, dword [rbp - 0x68]
mov dword [rbp + 0x34], edx
mov edx, dword [rbp - 0x40]
mov dword [rbp + 0xc], eax
lea eax, [rcx + rdx]
sub edx, ecx
mov dword [rbp + 0x38], edx
lea rcx, [rsp + 0x20]
mov edx, dword [rbp - 0x64]
mov dword [rbp + 0x10], eax
lea eax, [rdx + r8]
sub r8d, edx
lea rdx, [rbp + 0x18]
mov dword [rbp + 0x3c], r8d
mov dword [rbp + 0x14], eax
call fcn.1337c0ff8d30
lea r8, [rsp + 0x20]
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x10]
call fcn.1337c0ff8fb0
lea rdx, [rbp - 0x10]
mov rcx, rbx
call fcn.1337c0ffa650
lea rcx, [rbp + 0x40]
mov edx, 0x20
call fcn.1337c0de1240
mov rcx, qword [rbp + 0x60]
xor rcx, rsp
call fcn.1337c1023d90
mov rbx, qword [rsp + 0x190]
add rsp, 0x170
pop rbp
ret
Function at 0x1337c1001e50
Capabilities:
Encode data using xor

Disassembly:
mov r9, rcx
movd xmm4, r8d
mov r10d, r8d
pshufd xmm4, xmm4, 0
lea rcx, [rdx + 0x3c]
lea rax, [r9 + 0x3c]
cmp rdx, rax
ja 0x1337c1001ea1
cmp rcx, r9
jb 0x1337c1001ea1
sub r9, rdx
mov r8d, reloc.WS2_32.dll_recv
nop dword [rax + rax]
mov ecx, dword [r9 + rdx]
lea rdx, [rdx + 4]
mov eax, ecx
xor eax, dword [rdx - 4]
and eax, r10d
xor ecx, eax
mov dword [r9 + rdx - 4], ecx
xor dword [rdx - 4], eax
sub r8, 1
jne 0x1337c1001e80
ret
sub r9, rdx
mov eax, 4
nop dword [rax]
movdqu xmm1, xmmword [r9 + rdx]
movdqu xmm2, xmmword [rdx]
lea rdx, [rdx + 0x10]
movdqa xmm3, xmm1
xorps xmm3, xmm2
andps xmm3, xmm4
movdqa xmm0, xmm3
xorps xmm3, xmm2
xorps xmm0, xmm1
movdqu xmmword [r9 + rdx - 0x10], xmm0
movdqu xmmword [rdx - 0x10], xmm3
sub rax, 1
jne 0x1337c1001eb0
ret
Function at 0x1337c10065f0
Capabilities:
Check for software breakpoints

Disassembly:
mov eax, 0x38
call fcn.1337c1023cb0
sub rsp, rax
mov r11, rcx
cmp dword [rsp + 0x60], r9d
jne 0x1337c10066d0
movzx r10d, byte [r8]
lea eax, [r10 - 0x6a]
cmp al, 1
ja 0x1337c10066d0
lea rdx, [r8 + 1]
mov qword [rsp + 0x30], rbx
xor r8d, r8d
cmp r10b, 0x6b
jne 0x1337c1006684
lea ebx, [r9 - 3]
mov eax, r8d
test ebx, ebx
jle 0x1337c1006656
nop dword [rax + rax]
movzx ecx, byte [rdx]
inc rdx
cmp cl, 0xba
je 0x1337c1006656
cmp cl, 0xbb
jne 0x1337c100665c
inc eax
cmp eax, ebx
jl 0x1337c1006640
sub ebx, eax
test eax, eax
jne 0x1337c1006688
mov edx, pe_nt_image_headers64
mov dword [rsp + 0x20], r8d
xor r9d, r9d
lea ecx, [rdx - 0x7c]
lea r8d, [rdx + 0xa]
call fcn.1337c0f82460
mov rbx, qword [rsp + 0x30]
mov eax, 0xffffffff
add rsp, 0x38
ret
lea ebx, [r9 - 2]
movsxd rax, ebx
cmp byte [rax + rdx], 0xcc
je 0x1337c10066b9
mov edx, pe_nt_image_headers64
mov dword [rsp + 0x20], r8d
xor r9d, r9d
lea ecx, [rdx - 0x7c]
lea r8d, [rdx + 0xb]
call fcn.1337c0f82460
mov rbx, qword [rsp + 0x30]
mov eax, 0xffffffff
add rsp, 0x38
ret
mov r8d, ebx
mov rcx, r11
call fcn.1337c1052260
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
ret
mov edx, pe_nt_image_headers64
xor r8d, r8d
mov dword [rsp + 0x20], r8d
xor r9d, r9d
lea ecx, [rdx - 0x7c]
lea r8d, [rdx + 9]
call fcn.1337c0f82460
mov eax, 0xffffffff
add rsp, 0x38
ret
Function at 0x1337c1007330
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
mov eax, 0x30
call fcn.1337c1023cb0
sub rsp, rax
xor edi, edi
mov qword [rsp + 0x40], rbp
movsxd rbx, r9d
mov r11, r8
mov dword [rsp + 0x58], reloc.WS2_32.dll_recv
mov rbp, rcx
mov r10d, edi
test r9d, r9d
jle 0x1337c1007454
cmp ebx, 8
jb 0x1337c1007454
lea rax, [rbx - 1]
lea rcx, [rax + rdx]
add rax, r8
cmp rdx, rax
ja 0x1337c1007389
cmp rcx, r8
jae 0x1337c1007454
sub r8, rdx
cmp ebx, 0x40
jb 0x1337c100741e
mov eax, ebx
mov qword [rsp + 0x48], rsi
and eax, 0xffffffc0
mov r9, 0xfffffffffffffff0
movsxd rsi, eax
sub r9, rdx
lea rcx, [rdx + 0x10]
movdqu xmm0, xmmword [rcx - 0x10]
add r10d, 0x40
movdqu xmm1, xmmword [rcx + r8 - 0x10]
lea rcx, [rcx + 0x40]
lea rax, [r9 + rcx]
xorps xmm1, xmm0
movdqu xmm0, xmmword [rcx + r8 - 0x40]
movdqu xmmword [rcx - 0x50], xmm1
movdqu xmm2, xmmword [rcx - 0x40]
movdqu xmm1, xmmword [rcx + r8 - 0x30]
xorps xmm2, xmm0
movdqu xmmword [rcx - 0x40], xmm2
movdqu xmm0, xmmword [rcx - 0x30]
xorps xmm1, xmm0
movdqu xmmword [rcx - 0x30], xmm1
movdqu xmm0, xmmword [rcx - 0x20]
movdqu xmm1, xmmword [rcx + r8 - 0x20]
xorps xmm1, xmm0
movdqu xmmword [rcx - 0x20], xmm1
cmp rax, rsi
jl 0x1337c10073b0
mov rsi, qword [rsp + 0x48]
mov eax, ebx
and al, 0x3f
cmp al, 8
jb 0x1337c1007454
mov ecx, ebx
and ecx, 0xfffffff8
movsxd rax, r10d
movsxd r9, ecx
lea rcx, [rax + rdx]
nop dword [rax]
movq xmm0, qword [rcx]
add r10d, 8
movq xmm1, qword [r8 + rcx]
xorps xmm1, xmm0
movq qword [rcx], xmm1
add rcx, 8
mov rax, rcx
sub rax, rdx
cmp rax, r9
jl 0x1337c1007430
movsxd rcx, r10d
mov r8, rbx
cmp rcx, rbx
jge 0x1337c1007481
sub r11, rdx
lea rax, [rcx + rdx]
sub r8, rcx
nop dword [rax]
movzx ecx, byte [r11 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub r8, 1
jne 0x1337c1007470
mov rcx, qword [rbp + 0x10]
lea r8, [rsp + 0x58]
mov r9, rdx
mov dword [rsp + 0x20], ebx
call fcn.1337c0f7dc20
mov rbp, qword [rsp + 0x40]
test eax, eax
je 0x1337c10074b4
cmp dword [rsp + 0x58], ebx
sete dil
mov eax, edi
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x50]
xor eax, eax
add rsp, 0x30
pop rdi
ret

Function at 0x1337c1007640
Capabilities:
Encode data using xor

Disassembly:
mov r11, rdx
mov r10, rcx
test rdx, rdx
je 0x1337c10076bb
test r8, r8
je 0x1337c10076bb
mov r9, qword [rcx + 0x28]
cmp r8, r9
cmovb r9, r8
test r9, r9
je 0x1337c1007681
add rcx, 0x30
sub rdx, r10
nop word [rax + rax]
movzx eax, byte [rdx + rcx - 0x30]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub r9, 1
jne 0x1337c1007670
mov rax, qword [r10 + 0x28]
cmp r8, rax
jbe 0x1337c10076bb
sub r8, rax
cmp r8, 0x10
jbe 0x1337c100769b
mov r8d, reloc.WS2_32.dll_recv
jmp 0x1337c10076a0
test r8, r8
je 0x1337c10076bb
xor ecx, ecx
mov rax, qword [r10 + 0x28]
add rax, rcx
movzx eax, byte [rax + r11]
xor byte [r10 + rcx + 0x50], al
inc rcx
cmp rcx, r8
jb 0x1337c10076a2
ret
Function at 0x1337c1051de0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1337c1051e08
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1337c1051e08
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x1337c10566c0
Capabilities:
Execute syscall

Disassembly:
push r10
pushfq
mov r10, rcx
push qword [0x1337c1250068]
lea rax, [0x1337c1056734]
push rax
push qword [0x1337c1250090]
push qword [0x1337c1250080]
sub rsp, 8
mov rax, rsp
push qword [0x1337c1250090]
push qword [0x1337c1250058]
push rax
push qword [0x1337c1250090]
push qword [0x1337c1250070]
lea rax, [0x1337c1250020]
push rax
push qword [0x1337c1250078]
lea rax, [0x1337c1056680]
push rax
push qword [0x1337c1250080]
push qword [0x1337c1250088]
push qword [0x1337c1250090]
pushfq
pop rax
or rax, 0x40000
push rax
popfq
syscall
popfq
pop r10
ret

Function at 0x1337c12abaaa
Capabilities:
Encode data using xor

Disassembly:
push rbx
pushfq
movabs rbx, 0xc72faf0dc6a75415
push rbx
mov qword [rsp + 0x18], 0x43aaa33a
mov rbx, qword [rsp + 0x10]
or byte [rsp], 0xbe
xor qword [rsp], 0xffffffffae1a7089
test byte [rsp], 0xb9
not dword [rsp]
js 0x1337c12abaab
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x18]
call fcn.1337c13f16d8
int3
Function at 0x1411ae348
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1411ae352
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x1411ae37b
pop rbp
sub rbp, 0x33
sub rbp, 0x11ae348
sub rsp, 0x20
jmp 0x1411ae39a
mov rax, 0x11ae348
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0xffffffffc42c78ef
xor byte [rax], dl
inc rax
dec rcx
jne 0x1411ae3b9
jmp 0x1411ae3d0
cmpsd dword [rsi], dword [rdi]
invalid
Function at 0x1400146b0
Capabilities:
Get memory capacity

Disassembly:
mov qword [rsp + 8], rbx
push rsi
push rdi
push r14
sub rsp, 0xc0
mov rax, qword [0x140574180]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rsi, r9
mov rbx, r8
mov r14, rdx
mov rdi, rcx
test rcx, rcx
je 0x14001479f
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8d, 0x48
lea rdx, [rsp + 0x60]
mov rcx, rax
call sub.KERNEL32.dll_K32GetProcessMemoryInfo
test eax, eax
je 0x14001479f
mov rdx, qword [rsp + 0x70]
test r14, r14
je 0x14001477a
xorps xmm0, xmm0
test rdx, rdx
js 0x140014721
cvtsi2ss xmm0, rdx
jmp 0x140014739
mov rax, rdx
mov rcx, rdx
shr rcx, 1
and eax, 1
or rcx, rax
cvtsi2ss xmm0, rcx
addss xmm0, xmm0
cvtps2pd xmm1, xmm0
xorps xmm0, xmm0
mulsd xmm1, qword [0x140505bf0]
test rdi, rdi
js 0x140014753
cvtsi2ss xmm0, rdi
jmp 0x14001476b
mov rax, rdi
mov rcx, rdi
shr rcx, 1
and eax, 1
or rcx, rax
cvtsi2ss xmm0, rcx
addss xmm0, xmm0
cvtps2pd xmm0, xmm0
divsd xmm1, xmm0
cvttsd2si rax, xmm1
mov dword [r14], eax
xor eax, eax
test rbx, rbx
je 0x140014791
cmp rdx, rdi
jbe 0x14001478b
mov qword [rbx], rax
jmp 0x140014791
sub rdi, rdx
mov qword [rbx], rdi
test rsi, rsi
je 0x140014868
jmp 0x140014865
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rdx, qword [rsp + 0x48]
cmp rdx, qword [rsp + 0x28]
jae 0x140014842
test r14, r14
je 0x140014831
mov rcx, rdx
xorps xmm0, xmm0
sub rcx, qword [rsp + 0x50]
js 0x1400147db
cvtsi2ss xmm0, rcx
jmp 0x1400147f0
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
cvtps2pd xmm1, xmm0
xorps xmm0, xmm0
mulsd xmm1, qword [0x140505bf0]
test rdx, rdx
js 0x14001480a
cvtsi2ss xmm0, rdx
jmp 0x140014822
mov rax, rdx
mov rcx, rdx
shr rcx, 1
and eax, 1
or rcx, rax
cvtsi2ss xmm0, rcx
addss xmm0, xmm0
cvtps2pd xmm0, xmm0
divsd xmm1, xmm0
cvttsd2si rax, xmm1
mov dword [r14], eax
test rbx, rbx
je 0x140014839
mov qword [rbx], rdx
test rsi, rsi
je 0x140014868
xor eax, eax
jmp 0x140014865
test r14, r14
je 0x14001484e
mov eax, dword [rsp + 0x24]
mov dword [r14], eax
test rbx, rbx
je 0x14001485b
mov rax, qword [rsp + 0x30]
mov qword [rbx], rax
test rsi, rsi
je 0x140014868
mov rax, qword [rsp + 0x40]
mov qword [rsi], rax
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140063b40
mov rbx, qword [rsp + 0xe0]
add rsp, 0xc0
pop r14
pop rdi
pop rsi
ret
Function at 0x1400841e0
Capabilities:
Hash data with crc32

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov ebx, ecx
cmp ebx, 0xedb88320
jne 0x140084207
mov rax, qword [0x140571520]
mov rax, qword [rax + 8]
test rax, rax
je 0x140084207
add rsp, 0x28
pop rbx
pop rsi
ret
lea rcx, [0x14039a8b0]
mov edx, 0x100
call fcn.140005640
mov rsi, rax
xor ecx, ecx
mov edx, ecx
xor eax, eax
test dl, 1
je 0x14008422c
shr edx, 1
xor edx, ebx
jmp 0x14008422e
shr edx, 1
inc eax
cmp eax, 8
jl 0x140084221
mov eax, ecx
mov dword [rsi + rax*4 + 0x10], edx
inc ecx
cmp ecx, 0x100
jl 0x14008421d
cmp ebx, 0xedb88320
jne 0x140084260
mov rcx, qword [0x140571520]
lea rcx, [rcx + 8]
mov rdx, rsi
call fcn.140005730
mov rax, rsi
add rsp, 0x28
pop rbx
pop rsi
ret
Function at 0x1400928c0
Capabilities:
Create pipe

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0xa8
lea rbp, [rsp + 0xe0]
xor eax, eax
mov qword [rbp - 0x58], rax
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rbx, r8
mov r14d, r9d
xor ecx, ecx
mov dword [rbp - 0x3c], ecx
mov qword [rbp - 0x48], rcx
mov qword [rbp - 0x50], rcx
mov byte [rbp - 0x5c], 0
lea rcx, [0x1402fd3c8]
call fcn.1402a84b0
mov qword [rbp - 0x68], rax
mov byte [rbp - 0x60], 0
lea rcx, [0x1402fd3c8]
call fcn.1402a84b0
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x58], rbx
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
lea rcx, [rbp - 0x48]
mov qword [rbp - 0x7c], rcx
lea rdx, [rbp - 0x50]
mov qword [rbp - 0x84], rdx
mov r8, rbx
mov qword [rbp - 0x8c], r8
mov r9d, r14d
mov dword [rbp - 0x74], r9d
lea rcx, [rbp - 0xb8]
call fcn.140006aa0
mov rcx, qword [rbp - 0x7c]
mov rdx, qword [rbp - 0x84]
mov r8, qword [rbp - 0x8c]
mov r9d, dword [rbp - 0x74]
call sub.KERNEL32.dll_CreatePipe
mov ebx, eax
lea rcx, [rbp - 0xb8]
call fcn.140006af0
call sub.KERNEL32.dll_GetLastError
mov esi, eax
xor ecx, ecx
mov qword [rbp - 0x58], rcx
mov dword [rbp - 0x3c], 1
mov rcx, qword [rbp - 0x50]
mov byte [rbp - 0x5c], 1
mov rax, qword [rbp - 0x68]
mov qword [rax + 8], rcx
mov rcx, qword [rbp - 0x48]
mov byte [rbp - 0x60], 1
mov r8, qword [rbp - 0x70]
mov qword [r8 + 8], rcx
test ebx, ebx
setne bl
movzx ebx, bl
mov rcx, qword [rbp + 0x18]
mov rdx, rax
call fcn.1400057a0
mov rcx, qword [rbp + 0x10]
mov rdx, qword [rbp - 0x70]
call fcn.1400057a0
nop
call fcn.140002cfe
mov dword [rax + 0xb8], esi
movzx eax, bl
add rsp, 0xa8
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x14009c3e0
Capabilities:
Initialize winsock library

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x1f8
lea rbp, [rsp + 0x230]
lea rdx, [rbp - 0x1d0]
mov qword [rbp - 0x1dc], rdx
mov ecx, 0x202
mov dword [rbp - 0x1d4], ecx
lea rcx, [rbp - 0x208]
call fcn.140006aa0
mov rdx, qword [rbp - 0x1dc]
mov ecx, dword [rbp - 0x1d4]
call sub.WS2_32.dll_WSAStartup
mov ebx, eax
lea rcx, [rbp - 0x208]
call fcn.140006af0
test ebx, ebx
jne 0x14009c48c
lea rcx, [0x1405742e0]
mov edx, 1
xor eax, eax
lock cmpxchg dword [rcx], edx
test eax, eax
je 0x14009c477
lea rcx, [rbp - 0x208]
call fcn.140006aa0
call sub.WS2_32.dll_WSACleanup
lea rcx, [rbp - 0x208]
call fcn.140006af0
nop
add rsp, 0x1f8
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea rcx, [0x14030fc48]
call fcn.140005520
mov rsi, rax
mov rcx, rsi
mov edx, ebx
call fcn.1400a1e80
mov rcx, rsi
call fcn.140005aa0
int3
Function at 0x1400b3350
Capabilities:
Initialize winsock library

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x1f8
lea rbp, [rsp + 0x230]
lea rdx, [rbp - 0x1d0]
mov qword [rbp - 0x1dc], rdx
mov ecx, 0x202
mov dword [rbp - 0x1d4], ecx
lea rcx, [rbp - 0x208]
call fcn.140006aa0
mov rdx, qword [rbp - 0x1dc]
mov ecx, dword [rbp - 0x1d4]
call sub.WS2_32.dll_WSAStartup
mov ebx, eax
lea rcx, [rbp - 0x208]
call fcn.140006af0
test ebx, ebx
jne 0x1400b33fc
lea rcx, [0x1405742e8]
mov edx, 1
xor eax, eax
lock cmpxchg dword [rcx], edx
test eax, eax
je 0x1400b33e7
lea rcx, [rbp - 0x208]
call fcn.140006aa0
call sub.WS2_32.dll_WSACleanup
lea rcx, [rbp - 0x208]
call fcn.140006af0
nop
add rsp, 0x1f8
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea rcx, [0x14030fc48]
call fcn.140005520
mov rsi, rax
mov rcx, rsi
mov edx, ebx
call fcn.1400a1e80
mov rcx, rsi
call fcn.140005aa0
int3

Function at 0x1400bdaa0
Capabilities:
Generate random numbers via winapi

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0xa0]
mov r8d, edx
mov dword [rbp - 0x3c], r8d
mov rdx, rcx
mov qword [rbp - 0x48], rdx
xor ecx, ecx
mov qword [rbp - 0x50], rcx
mov r9d, 2
mov dword [rbp - 0x40], r9d
lea rcx, [rbp - 0x78]
call fcn.140006aa0
mov r8d, dword [rbp - 0x3c]
mov rdx, qword [rbp - 0x48]
mov rcx, qword [rbp - 0x50]
mov r9d, dword [rbp - 0x40]
call sub.bcrypt.dll_BCryptGenRandom
mov ebx, eax
lea rcx, [rbp - 0x78]
call fcn.140006af0
test ebx, ebx
jne 0x1400bdb14
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
cmp ebx, 0xc0000017
jne 0x1400bdb3b
lea rcx, [0x140314a10]
call fcn.140005520
mov rbx, rax
mov rcx, rbx
call fcn.1400e9290
mov rcx, rbx
call fcn.140005aa0
lea rcx, [0x1403141c8]
call fcn.140005520
mov rbx, rax
mov rcx, rbx
call fcn.1400e4460
mov rcx, rbx
call fcn.140005aa0
int3

Function at 0x1400bdfc0
Capabilities:
Inspect section memory permissions

Disassembly:
push rbp
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x50]
mov rbx, rcx
mov eax, dword [rbx + 0x38]
cmp eax, 0xffffffff
je 0x1400bdfdd
add rsp, 0x48
pop rbx
pop rbp
ret
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
lea r8, [rbp - 0x10]
lea rdx, [rbp - 0x20]
mov rcx, rbx
mov r9d, 4
call fcn.140166e10
mov ecx, eax
test ecx, ecx
jne 0x1400be06a
xor eax, eax
mov ecx, 0x40000000
test byte [rbp - 0x10], 0x30
cmove eax, ecx
mov ecx, eax
or ecx, 0x80000000
test byte [rbp - 0x10], 2
cmovne eax, ecx
mov ecx, eax
or ecx, 0x10000000
test dword [rbp - 0x10], 0x800
cmovne eax, ecx
mov ecx, eax
or ecx, 0x8000000
test byte [rbp - 0x10], 4
cmovne eax, ecx
mov ecx, eax
or ecx, 0x4000000
test dword [rbp - 0x10], 0x1000
cmovne eax, ecx
mov ecx, eax
or ecx, 0x20000000
test byte [rbp - 0x10], 8
cmovne eax, ecx
mov dword [rbx + 0x38], eax
add rsp, 0x48
pop rbx
pop rbp
ret
call fcn.140166ce0
mov ecx, eax
lea rdx, [0x1402bd968]
call fcn.140134ca0
mov rcx, rax
call fcn.140005aa0
int3
Function at 0x1400e3810
Capabilities:
Hash data using murmur3

Disassembly:
push rdi
push rsi
push rbp
push rbx
sub rsp, 0x28
mov rbx, rcx
mov esi, dword [rbx + 0x1c]
mov edi, esi
and edi, 3
cmp esi, 4
jb 0x1400e3846
mov eax, dword [rbx]
rol eax, 1
mov ecx, dword [rbx + 4]
rol ecx, 7
add eax, ecx
mov ecx, dword [rbx + 8]
rol ecx, 0xc
add eax, ecx
mov ecx, dword [rbx + 0xc]
rol ecx, 0x12
add eax, ecx
jmp 0x1400e385c
lea rbp, [0x1403023a0]
cmp qword [rbp - 8], 0
jne 0x1400e38cd
mov eax, dword [rbp]
add eax, 0x165667b1
lea eax, [rax + rsi*4]
test edi, edi
je 0x1400e38a3
imul ecx, dword [rbx + 0x10], 0xc2b2ae3d
add eax, ecx
rol eax, 0x11
imul eax, eax, 0x27d4eb2f
cmp edi, 1
jbe 0x1400e38a3
imul ecx, dword [rbx + 0x14], 0xc2b2ae3d
add ecx, eax
rol ecx, 0x11
imul eax, ecx, 0x27d4eb2f
cmp edi, 2
jbe 0x1400e38a3
imul ecx, dword [rbx + 0x18], 0xc2b2ae3d
add ecx, eax
rol ecx, 0x11
imul eax, ecx, 0x27d4eb2f
mov ecx, eax
shr ecx, 0xf
xor ecx, eax
imul eax, ecx, 0x85ebca77
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul eax, ecx, 0xc2b2ae3d
mov ecx, eax
shr ecx, 0x10
xor eax, ecx
add rsp, 0x28
pop rbx
pop rbp
pop rsi
pop rdi
ret
call fcn.1400012d5
jmp 0x1400e3854

Function at 0x1400e4620
Capabilities:
Encode data using xor

Disassembly:
cmp edx, 8
jae 0x1400e462f
cmp edx, 4
jae 0x1400e468c
jmp 0x1400e4704
mov eax, edx
shr eax, 3
add r8d, dword [rcx]
mov r10d, dword [rcx + 4]
xor r9d, r8d
rol r8d, 0x14
add r8d, r9d
rol r9d, 9
xor r9d, r8d
rol r8d, 0x1b
add r8d, r9d
rol r9d, 0x13
add r10d, r8d
mov r8d, r9d
xor r8d, r10d
rol r10d, 0x14
add r10d, r8d
rol r8d, 9
xor r8d, r10d
rol r10d, 0x1b
add r10d, r8d
rol r8d, 0x13
mov r9d, r8d
add rcx, 8
dec eax
mov r8d, r10d
jne 0x1400e4634
test dl, 4
je 0x1400e46ab
add r8d, dword [rcx]
xor r9d, r8d
rol r8d, 0x14
add r8d, r9d
rol r9d, 9
xor r9d, r8d
rol r8d, 0x1b
add r8d, r9d
rol r9d, 0x13
mov eax, edx
and rax, 7
mov eax, dword [rcx + rax - 4]
shr eax, 8
or eax, 0x80000000
mov ecx, edx
not ecx
shl ecx, 3
shr eax, cl
add eax, r8d
mov edx, r9d
xor edx, eax
rol eax, 0x14
add eax, edx
rol edx, 9
xor edx, eax
rol eax, 0x1b
add eax, edx
rol edx, 0x13
mov r8d, edx
xor r8d, eax
rol eax, 0x14
add eax, r8d
rol r8d, 9
xor r8d, eax
rol eax, 0x1b
add eax, r8d
mov r9d, r8d
rol r9d, 0x13
xor eax, r9d
ret
mov eax, 0x80
test dl, 1
je 0x1400e471d
mov eax, edx
and rax, 2
movzx eax, byte [rcx + rax]
or eax, 0x8000
test dl, 2
je 0x1400e46c6
shl eax, 0x10
movzx ecx, word [rcx]
or eax, ecx
jmp 0x1400e46c6