joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800027a0
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
cmp dword [0x180020a94], 0xa
jl 0x1800027d2
mov eax, dword [0x180020a98]
lea edx, [rax - 1]
imul edx, eax
and edx, 1
je 0x1800027d2
nop word cs:[rax + rax]
jmp 0x1800027d0
mov rax, qword gs:[0x60]
mov rbx, qword [rax + 0x18]
mov eax, dword [0x180020a80]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180020a7c], 0xa
setl r8b
mov edx, dword [0x180020a9c]
lea edi, [rdx - 1]
imul edi, edx
test dil, 1
sete dl
cmp dword [0x180020aa0], 0xa
setl r9b
mov r14, qword [rbx + 0x10]
lea r10, [rbx + 0x10]
cmp r14, r10
je 0x1800028c8
or r8b, al
or r9b, dl
lea r11, [rcx - 1]
xor eax, eax
mov rsi, r11
test r8b, r8b
je 0x1800028b0
nop
cmp byte [rsi + 1], 0
lea rsi, [rsi + 1]
jne 0x180002840
test r9b, r9b
je 0x1800028c0
sub rsi, rcx
je 0x1800028c2
mov r15, qword [r14 + 0x60]
xor ebx, ebx
nop word [rax + rax]
movzx edx, word [r15 + rbx*2]
movsx r13d, byte [rcx + rbx]
lea r12d, [rdx - 0x41]
lea ebp, [rdx + 0x20]
cmp r12w, 0x1a
cmovae ebp, edx
lea r12d, [r13 - 0x41]
lea edi, [r13 + 0x20]
cmp r12b, 0x1a
cmovae edi, r13d
cmp ebp, edi
jne 0x18000289d
test dx, dx
je 0x1800028c2
add rbx, 1
cmp rsi, rbx
jne 0x180002860
jmp 0x1800028c2
mov r14, qword [r14]
cmp r14, r10
jne 0x180002837
jmp 0x1800028ca
jmp 0x1800028b0
jmp 0x1800028c0
mov rax, qword [r14 + 0x30]
jmp 0x1800028ca
xor eax, eax
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400068d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, qword [rdx + 0x20]
mov r11, qword [rdx + 0x28]
lea r10, [r11 + 1]
mov qword [rdx + 0x28], r10
mov al, 1
cmp r10, rsi
jae 0x140006910
mov rax, qword [rdx + 0x18]
movzx edi, byte [rax + r10]
mov al, 1
cmp edi, 0x2b
je 0x140006905
cmp edi, 0x2d
jne 0x140006910
xor eax, eax
add r11, 2
mov qword [rdx + 0x28], r11
mov r10, r11
cmp r10, rsi
jae 0x140006aa4
mov rdi, qword [rdx + 0x18]
movzx r11d, byte [rdi + r10]
lea rbx, [r10 + 1]
mov qword [rdx + 0x28], rbx
add r11b, 0xd0
cmp r11b, 0xa
jae 0x140006aaf
movzx r11d, r11b
cmp rbx, rsi
jae 0x1400069ad
mov ebx, 1
sub rbx, rsi
add r10, 2
jmp 0x14000696c
movzx esi, sil
lea r11d, [r11 + r11*4]
lea r11d, [rsi + r11*2]
lea rsi, [rbx + r10]
inc rsi
inc r10
cmp rsi, 2
je 0x1400069ad
movzx esi, byte [rdi + r10 - 1]
add sil, 0xd0
cmp sil, 0xa
jae 0x1400069ad
mov qword [rdx + 0x28], r10
cmp r11d, 0xccccccb
jle 0x140006950
cmp r11d, 0xccccccc
jne 0x140006998
cmp sil, 7
jbe 0x140006950
test r9, r9
sete r9b
mov byte [rsp + 0x20], al
call fcn.14005ab30
jmp 0x140006a91
mov r10d, dword [rsp + 0x80]
test al, al
je 0x1400069ca
lea eax, [r10 + r11]
sar eax, 0x1f
add eax, 0x80000000
add r10d, r11d
jmp 0x1400069da
xor eax, eax
cmp r10d, r11d
setns al
add eax, 0x7fffffff
sub r10d, r11d
cmovo r10d, eax
movq xmm1, r9
punpckldq xmm1, xmmword [0x140060c80]
subpd xmm1, xmmword [0x140060c90]
movapd xmm0, xmm1
unpckhpd xmm0, xmm1
addsd xmm0, xmm1
mov eax, r10d
neg eax
cmovs eax, r10d
cmp eax, 0x135
jb 0x140006a4c
xorpd xmm1, xmm1
movsd xmm2, qword [0x140060ca0]
nop dword [rax + rax]
ucomisd xmm0, xmm1
jne 0x140006a28
jnp 0x140006a7a
test r10d, r10d
jns 0x140006ad8
divsd xmm0, xmm2
add r10d, 0x134
mov eax, r10d
neg eax
cmovs eax, r10d
cmp eax, 0x134
ja 0x140006a20
mov eax, eax
mov r9, qword [0x140080040]
movsd xmm1, qword [r9 + rax*8]
test r10d, r10d
js 0x140006a99
mulsd xmm0, xmm1
movapd xmm1, xmmword [0x140060cb0]
andpd xmm1, xmm0
ucomisd xmm1, qword [0x140060cc0]
jae 0x140006ad8
test r8b, r8b
jne 0x140006a87
xorpd xmm0, xmmword [0x140060cd0]
movsd qword [rcx + 8], xmm0
xor eax, eax
mov qword [rcx], rax
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
divsd xmm0, xmm1
test r8b, r8b
je 0x140006a7f
jmp 0x140006a87
mov qword [rsp + 0x28], 5
jmp 0x140006ab8
mov qword [rsp + 0x28], 0xd
lea rax, [rsp + 0x28]
mov rsi, rcx
mov rcx, rdx
mov rdx, rax
call fcn.14005abd0
mov qword [rsi + 8], rax
mov qword [rsi], 1
jmp 0x140006a91
mov qword [rsp + 0x28], 0xe
lea rax, [rsp + 0x28]
mov rsi, rcx
mov rcx, rdx
mov rdx, rax
call fcn.14005abd0
mov rcx, rsi
mov qword [rsi + 8], rax
mov eax, 1
jmp 0x140006a8e
Function at 0x14000c3f0
Capabilities:
Set registry value

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x98
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x10], 0xfffffffffffffffe
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
lea rcx, [rbp - 0x18]
mov rdx, r9
call fcn.14000f030
mov rdi, qword [rdi]
add rsi, rbx
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x48], rsi
mov word [rbp - 0x40], 0
mov dword [rbp - 0x38], 1
lea rcx, [rbp - 0x30]
lea rdx, [rbp - 0x50]
call fcn.14000afb0
movzx r9d, byte [rbp]
mov rdx, qword [rbp - 0x28]
mov rsi, qword [rbp - 0x10]
mov eax, dword [rbp - 8]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
mov rcx, rdi
mov qword [rbp + 8], rdx
xor r8d, r8d
call qword [sym.imp.advapi32.dll_RegSetValueExW]
mov edi, eax
mov rdx, qword [rbp - 0x30]
test rdx, rdx
je 0x14000c48e
add rdx, rdx
mov r8d, 2
mov rcx, qword [rbp + 8]
call fcn.14000e9c0
mov rdx, qword [rbp - 0x18]
test rdx, rdx
je 0x14000c4a5
mov r8d, 1
mov rcx, rsi
call fcn.14000e9c0
mov rcx, rdi
shl rcx, 0x20
or rcx, 2
xor eax, eax
test edi, edi
cmovne rax, rcx
add rsp, 0x98
pop rbx
pop rdi
pop rsi
pop rbp
ret

Function at 0x14000ec70
Capabilities:
Get session user name

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rcx
mov dword [rbp - 4], 0
lea rdx, [rbp - 4]
xor ecx, ecx
call qword [sym.imp.advapi32.dll_GetUserNameW]
test eax, eax
jne 0x14000edb0
call fcn.14003b2d0
mov edi, eax
mov rcx, rdi
shl rcx, 0x20
or rcx, 2
call fcn.14000cea0
cmp edi, 0x7a
jne 0x14000ecf1
mov ebx, dword [rbp - 4]
test rbx, rbx
je 0x14000ed14
lea rdi, [rbx + rbx]
movzx eax, byte [0x140080181]
mov edx, 2
mov rcx, rdi
call fcn.14000e9b0
test rax, rax
jne 0x14000ed19
mov ecx, 2
mov rdx, rdi
call fcn.14005ed30
call fcn.14003b2d0
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
jmp 0x14000eda4
mov eax, 2
mov qword [rbp - 0x10], rbx
mov dword [rbp - 4], ebx
lea rdx, [rbp - 4]
mov qword [rbp - 0x18], rax
mov rcx, rax
call qword [sym.imp.advapi32.dll_GetUserNameW]
test eax, eax
je 0x14000ed43
mov r8d, dword [rbp - 4]
test r8, r8
je 0x14000ed6b
dec r8
jmp 0x14000ed6e
call fcn.14003b2d0
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov rdx, qword [rbp - 0x10]
test edx, edx
jne 0x14000ed92
jmp 0x14000eda4
xor r8d, r8d
lea rcx, [rbp - 0x38]
mov rdx, qword [rbp - 0x18]
call fcn.140032fc0
movups xmm0, xmmword [rbp - 0x38]
movups xmm1, xmmword [rbp - 0x28]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rdx, qword [rbp - 0x10]
test edx, edx
je 0x14000eda4
add rdx, rdx
mov r8d, 2
mov rcx, qword [rbp - 0x18]
call fcn.14000e9c0
mov rax, rsi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop rbp
ret
lea rcx, [0x1400615c1]
lea r8, [0x140061640]
mov edx, 0x16
call fcn.14005eef0
int3
Function at 0x14000ee10
Capabilities:
Get session user name

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov qword [rbp - 8], 0xfffffffffffffffe
mov edi, edx
mov rsi, rcx
mov dword [rbp - 0xc], 0
lea r8, [rbp - 0xc]
mov ecx, edx
xor edx, edx
call qword [sym.imp.Secur32.dll_GetUserNameExW]
test al, al
jne 0x14000ef7f
call fcn.14003b2d0
mov ebx, eax
mov rcx, rbx
shl rcx, 0x20
or rcx, 2
call fcn.14000cea0
cmp ebx, 0xea
je 0x14000ee8c
cmp ebx, 0x534
jne 0x14000eebb
lea rdx, str.Missing_record
mov r8d, 0xe
xor ecx, ecx
call fcn.14000ea40
jmp 0x14000eec8
mov r14d, dword [rbp - 0xc]
test r14, r14
je 0x14000eedb
lea rbx, [r14 + r14]
movzx eax, byte [0x140080181]
mov edx, 2
mov rcx, rbx
call fcn.14000e9b0
test rax, rax
je 0x14000ef97
mov rdx, rax
jmp 0x14000eee0
call fcn.14003b2d0
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
jmp 0x14000ef46
mov edx, 2
mov qword [rbp - 0x18], r14
mov dword [rbp - 0x10], r14d
lea r8, [rbp - 0x10]
mov ecx, edi
mov qword [rbp - 0x20], rdx
call qword [sym.imp.Secur32.dll_GetUserNameExW]
test al, al
je 0x14000ef57
mov r8d, dword [rbp - 0x10]
lea eax, [r8 + 1]
mov dword [rbp - 0x24], eax
cmp dword [rbp - 0xc], eax
jne 0x14000efa4
lea rcx, [rbp - 0x58]
mov rdx, qword [rbp - 0x20]
call fcn.140032fc0
movups xmm0, xmmword [rbp - 0x58]
movups xmm1, xmmword [rbp - 0x48]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rdx, qword [rbp - 0x18]
test edx, edx
je 0x14000ef46
add rdx, rdx
mov r8d, 2
mov rcx, qword [rbp - 0x20]
call fcn.14000e9c0
mov rax, rsi
add rsp, 0x80
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
call fcn.14003b2d0
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov rdx, qword [rbp - 0x18]
test edx, edx
jne 0x14000ef34
jmp 0x14000ef46
lea rcx, [0x1400615c1]
lea r8, [0x140061670]
mov edx, 0x16
call fcn.14005eef0
mov ecx, 2
mov rdx, rbx
call fcn.14005ed30
mov qword [rbp - 0x58], 0
lea rax, [0x140061658]
mov qword [rsp + 0x20], rax
lea rdx, [rbp - 0xc]
lea r8, [rbp - 0x24]
lea r9, [rbp - 0x58]
xor ecx, ecx
call fcn.14005b1c0
ud2

Function at 0x14000f710
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
test rdx, rdx
je 0x14000f782
mov rsi, rdx
mov rdi, rcx
mov r14d, 0xffffffff
mov r15, qword [sym.imp.bcrypt.dll_BCryptGenRandom]
mov r12, qword [sym.imp.advapi32.dll_SystemFunction036]
jmp 0x14000f748
add rdi, rbx
sub rsi, rbx
je 0x14000f782
cmp rsi, r14
mov ebx, 0xffffffff
cmovb rbx, rsi
xor ecx, ecx
mov rdx, rdi
mov r8d, ebx
mov r9d, 2
call r15
cmp eax, 0xbfffffff
jbe 0x14000f740
mov ebp, eax
mov rcx, rdi
mov edx, ebx
call r12
test al, al
jne 0x14000f740
and ebp, 0x7fffffff
jmp 0x14000f784
xor ebp, ebp
mov eax, ebp
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x140011810
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x140011852
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 4
jb 0x14001185a
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x14001186b
jmp 0x140011882
xor r10d, r10d
jmp 0x14001190d
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x140011882
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x140011899
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x1400118b9
add r11, r8
jmp 0x1400119eb
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x140011982
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x140011930
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 4
jb 0x1400119a0
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x1400119b2
jmp 0x1400119cd
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x1400119cd
lea rcx, [rdx + r8]
movzx esi, word [r10 + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x1400119e7
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x140013d30
Capabilities:
Get memory capacity

Disassembly:
push rsi
push rbx
sub rsp, 0xa8
mov ebx, r8d
mov rsi, rcx
test dl, dl
je 0x140013dbd
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x20], 0x40
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x140013d7f
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rsi + 0xc0], xmm0
jmp 0x140013dbd
call fcn.140024ae0
mov qword [rsp + 0x98], rax
mov dword [rsp + 0xa0], edx
mov qword [rsp + 0x90], 1
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rsi + 0xc0], xmm0
test rax, rax
je 0x140013dbd
lea rcx, [rsp + 0x98]
call fcn.140025030
test bl, bl
je 0x140013e54
xorps xmm0, xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x80], 0
lea rcx, [rsp + 0x20]
mov edx, 0x68
call qword [sym.imp.KERNEL32.dll_K32GetPerformanceInfo]
test eax, eax
je 0x140013e54
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x30]
xor r9d, r9d
sub rdx, r8
cmovb rdx, r9
mov rcx, qword [rsp + 0x70]
mov rax, rcx
mul rdx
mov r10, 0xffffffffffffffff
cmovo rax, r10
mov rdx, qword [rsp + 0x28]
sub rdx, r8
cmovb rdx, r9
mov qword [rsi + 0xd0], rax
mov rax, rcx
mul rdx
cmovo rax, r10
mov qword [rsi + 0xd8], rax
add rsp, 0xa8
pop rbx
pop rsi
ret
Function at 0x140017ea0
Capabilities:
Accept command line arguments

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0x80]
mov qword [rbp], 0xfffffffffffffffe
mov rax, rdx
mov rsi, rcx
lea rdx, [rbp - 0x24]
mov rcx, rax
call qword [sym.imp.shell32.dll_CommandLineToArgvW]
test rax, rax
je 0x140017fb1
mov rdi, rax
mov qword [rbp - 0x30], rsi
movsxd rax, dword [rbp - 0x24]
mov qword [rbp - 0x20], 0
mov qword [rbp - 0x18], 8
mov qword [rbp - 0x10], 0
lea r13, [rdi + rax*8]
lea rbx, [rbp - 0x60]
lea r14, [rbp - 0x48]
lea r15, [rbp - 0x20]
mov r12, rdi
jmp 0x140017f44
add r12, 8
mov rax, qword [rbp - 0x18]
lea rcx, [rsi + rsi*2]
mov rdx, qword [rbp - 0x50]
mov qword [rax + rcx*8 + 0x10], rdx
movups xmm0, xmmword [rbp - 0x60]
movups xmmword [rax + rcx*8], xmm0
inc rsi
mov qword [rbp - 0x10], rsi
cmp r12, r13
je 0x140017f8a
mov byte [rbp - 1], 1
mov rcx, r12
call fcn.140025040
lea rcx, [rax + rdx*2]
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rcx
mov word [rbp - 0x38], 0
mov byte [rbp - 1], 1
mov rcx, rbx
mov rdx, r14
call fcn.14001a970
mov rsi, qword [rbp - 0x10]
cmp rsi, qword [rbp - 0x20]
jne 0x140017f20
mov rcx, r15
call fcn.14001a330
jmp 0x140017f20
mov byte [rbp - 1], 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rax, rax
je 0x140017fca
mov rax, qword [rbp - 0x10]
mov rcx, qword [rbp - 0x30]
mov qword [rcx + 0x10], rax
movups xmm0, xmmword [rbp - 0x20]
movups xmmword [rcx], xmm0
jmp 0x140018007
mov qword [rsi], 0
mov qword [rsi + 8], 8
mov qword [rsi + 0x10], 0
jmp 0x140018007
mov byte [rbp - 1], 1
call fcn.140024ae0
mov dword [rbp - 0x38], edx
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x48], 1
mov rcx, qword [rbp - 0x10]
mov rdx, qword [rbp - 0x30]
mov qword [rdx + 0x10], rcx
movups xmm0, xmmword [rbp - 0x20]
movups xmmword [rdx], xmm0
test rax, rax
je 0x140018007
lea rcx, [rbp - 0x40]
mov byte [rbp - 1], 0
call fcn.140025030
nop
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x14001f6d0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0x70]
mov qword [rbp], 0xfffffffffffffffe
mov r14, rdx
mov rsi, rcx
movups xmm0, xmmword [rdx + 0x38]
movups xmm1, xmmword [rdx + 0x48]
movaps xmmword [rbp - 0x30], xmm1
movaps xmmword [rbp - 0x40], xmm0
mov rax, qword [rdx + 0x28]
movzx ebx, byte [rdx + 0x30]
mov qword [rbp - 0x10], rax
mov qword [rbp - 0x50], rax
mov byte [rbp - 0x48], bl
movzx eax, byte [0x140080181]
mov ecx, 0x5f0
mov edx, 8
call fcn.14000e9b0
test rax, rax
mov qword [rbp - 8], r14
je 0x14001f940
mov rdi, rax
mov r8d, 0x5f0
mov rcx, rax
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rax, qword [r14 + 0x60]
mov qword [rbp - 0x18], rax
movabs rcx, 0x7465646279746573
movabs rdx, 0x6c7967656e657261
movabs r8, 0xded7d4e2d7dedfc6
movabs r9, 0xa60c596fc19fead0
movabs r10, 0xe414a674f0de7325
movabs r11, 0x800000000000000
mov r12d, 1
lock xadd qword [0x140080198], r12
mov r14, r12
xor r14, rcx
lea r15, [r14 + rdx]
mov rax, r14
rol rax, 0x10
xor rax, r15
lea r15, [rax + r8]
rol rax, 0x15
add r14, r9
mov r13, r14
xor r13, r10
rol r14, 0x20
xor r12, r15
add r12, r13
rol r13, 0xd
xor r15, r11
xor r13, r12
rol r12, 0x20
xor r15, rax
add r14, r15
rol r15, 0x10
xor r15, r14
add r12, r15
rol r15, 0x15
add r14, r13
rol r13, 0x11
xor r15, r12
xor r13, r14
rol r14, 0x20
xor r12, r11
add r12, r13
rol r13, 0xd
xor r13, r12
rol r12, 0x20
xor r14, 0xff
add r14, r15
rol r15, 0x10
xor r15, r14
add r12, r15
rol r15, 0x15
add r14, r13
rol r13, 0x11
xor r13, r14
rol r14, 0x20
xor r15, r12
add r12, r13
rol r13, 0xd
xor r13, r12
rol r12, 0x20
add r14, r15
rol r15, 0x10
xor r15, r14
add r12, r15
rol r15, 0x15
add r14, r13
rol r13, 0x11
xor r13, r14
rol r14, 0x20
xor r15, r12
add r12, r13
rol r13, 0xd
add r14, r15
rol r15, 0x10
xor r15, r14
rol r15, 0x15
xor r13, r12
add r14, r13
rol r13, 0x11
mov r12, r14
rol r12, 0x20
xor r12, r13
xor r12, r15
xor r12, r14
je 0x14001f790
mov rcx, qword [rbp - 8]
mov rax, qword [rcx + 0x58]
movaps xmm0, xmmword [rbp - 0x40]
movaps xmm1, xmmword [rbp - 0x30]
movups xmmword [rsi + 0x128], xmm1
movups xmmword [rsi + 0x118], xmm0
mov rdx, qword [rbp - 0x10]
mov qword [rsi + 0x138], rdx
mov byte [rsi + 0x140], bl
mov qword [rsi], 0
mov qword [rsi + 8], rdi
mov qword [rsi + 0x80], 0
mov qword [rsi + 0x88], rdi
mov rdx, qword [rbp - 0x18]
mov qword [rsi + 0x100], rdx
mov qword [rsi + 0x108], r12
mov qword [rsi + 0x110], rax
mov rdx, qword [rcx + 0x10]
movabs rax, 0x8000000000000000
cmp rdx, rax
je 0x14001f92c
test rdx, rdx
je 0x14001f92c
mov rcx, qword [rcx + 0x18]
mov r8d, 1
call fcn.14000e9c0
mov rax, rsi
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov ecx, 8
mov edx, 0x5f0
call fcn.14005ed50
ud2
Function at 0x1400246b0
Capabilities:
Get hostname

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rcx
mov dword [rbp - 4], 0
lea r8, [rbp - 4]
mov ecx, 5
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
jne 0x140024706
call fcn.140024ae0
mov qword [rbp - 0x30], rax
mov dword [rbp - 0x28], edx
mov qword [rbp - 0x38], 1
test rax, rax
je 0x140024706
lea rcx, [rbp - 0x30]
call fcn.140025030
mov ebx, dword [rbp - 4]
test rbx, rbx
mov qword [rbp - 0x10], rbx
je 0x140024738
lea rdi, [rbx + rbx]
movzx eax, byte [0x140080181]
mov edx, 2
mov rcx, rdi
call fcn.14000e9b0
test rax, rax
je 0x1400247cf
mov rdx, rax
jmp 0x14002473d
mov edx, 2
lea r8, [rbp - 4]
mov ecx, 5
mov qword [rbp - 0x18], rdx
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
je 0x140024776
mov r8d, dword [rbp - 4]
lea rcx, [rbp - 0x38]
mov rdx, qword [rbp - 0x18]
call fcn.140032fc0
movups xmm0, xmmword [rbp - 0x38]
movups xmm1, xmmword [rbp - 0x28]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
jmp 0x1400247a9
call fcn.140024ae0
mov qword [rbp - 0x38], rax
mov dword [rbp - 0x30], edx
shl rdx, 0x20
or rdx, 2
mov qword [rsi + 8], rdx
movabs rcx, 0x8000000000000000
mov qword [rsi], rcx
test rax, rax
je 0x1400247a9
lea rcx, [rbp - 0x38]
call fcn.140025030
mov rdx, qword [rbp - 0x10]
test edx, edx
mov rcx, qword [rbp - 0x18]
je 0x1400247c3
add rdx, rdx
mov r8d, 2
call fcn.14000e9c0
mov rax, rsi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop rbp
ret
mov ecx, 2
mov rdx, rdi
call fcn.14005ed30
int3

Function at 0x14002fed0
Capabilities:
Get system information on windows

Disassembly:
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x50]
xorps xmm0, xmm0
movaps xmmword [rbp - 0x10], xmm0
movaps xmmword [rbp - 0x20], xmm0
movaps xmmword [rbp - 0x30], xmm0
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [rbp - 0x10]
xor eax, eax
test rcx, rcx
sete al
lea rdx, str.The_number_of_hardware_threads_is_not_known_for_the_target_platform
cmovne rdx, rcx
add rsp, 0x50
pop rbp
ret
Function at 0x14002ff10
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3d0], rcx
mov qword [rbp + 0x3d8], 0
mov qword [rbp + 0x3e0], 2
mov qword [rbp + 0x3e8], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3c8], rax
xor esi, esi
xor edi, edi
xor ebx, ebx
cmp r8, 0x201
jae 0x14002ffb0
jmp 0x14002ff9f
jae 0x14003006f
cmp r8, 0x201
jae 0x14002ffb0
mov r14d, 0x200
lea r15, [rbp - 0x58]
mov r12, r8
jmp 0x140030007
sub r8, rbx
sub rdi, rbx
cmp rdi, r8
jae 0x14002ffdf
lea rcx, [rbp + 0x3d8]
mov rdx, rbx
call fcn.14005de80
mov rsi, qword [rbp + 0x3d8]
mov rax, qword [rbp + 0x3e0]
mov qword [rbp + 0x3c8], rax
mov eax, 0xffffffff
cmp rsi, rax
mov ebx, 0xffffffff
cmovb rbx, rsi
mov qword [rbp + 0x3e8], rbx
mov rdi, rsi
mov r14, rbx
mov r15, qword [rbp + 0x3c8]
mov r12, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, r12d
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r13d, eax
test eax, eax
jne 0x140030030
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400300db
mov r8d, r13d
cmp r12, r8
jne 0x14002ff90
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14003010f
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x14002ff9f
jmp 0x14002ffb0
cmp r14, r8
jb 0x140030129
lea rcx, [rbp + 0x3a8]
mov rdx, r15
call fcn.140032fc0
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3d0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rdx, qword [rbp + 0x3d8]
test rdx, rdx
je 0x1400300c4
mov rcx, qword [rbp + 0x3e0]
add rdx, rdx
mov r8d, 2
call fcn.14000e9c0
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3d0]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov rdx, qword [rbp + 0x3d8]
test rdx, rdx
jne 0x1400300af
jmp 0x1400300c4
lea rcx, str.internal_error:_entered_unreachable_code_
lea r8, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.14005eef0
jmp 0x14003013e
lea rax, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, r14
mov r8, rax
call fcn.14005f280
ud2
Function at 0x140032f00
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rcx, qword [rcx]
cmp r8, 0x7fffffff
mov eax, 0x7fffffff
cmovae r8, rax
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_send]
cmp eax, 0xffffffff
je 0x140032f36
movsxd rdx, eax
xor eax, eax
add rsp, 0x20
pop rbp
ret
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0x20
pop rbp
ret

Function at 0x140032f60
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rcx, qword [rcx]
cmp r8, 0x7fffffff
mov eax, 0x7fffffff
cmovae r8, rax
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_recv]
cmp eax, 0xffffffff
je 0x140032f92
movsxd rdx, eax
xor ecx, ecx
jmp 0x140032fb6
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
xor edx, edx
mov ecx, 0
cmp eax, 0x274a
je 0x140032fb6
shl rax, 0x20
or rax, 2
mov ecx, 1
mov rdx, rax
mov rax, rcx
add rsp, 0x20
pop rbp
ret