joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005a930
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov qword [rax - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov r12, r9
movzx r15d, r8b
mov r14, rdx
mov r10, rcx
mov r13, qword [rcx]
mov rsi, r13
mov rbx, qword [r13 + 8]
mov dil, 1
cmp byte [rbx + 0x19], 0
jne 0x14005a9be
mov rsi, rbx
test r15b, r15b
je 0x14005a993
lea rcx, [rbx + 0x20]
mov rdx, r12
call fcn.14005ae40
mov edi, eax
shr edi, 0x1f
xor dil, 1
jmp 0x14005a9a5
lea rdx, [rbx + 0x20]
mov rcx, r12
call fcn.14005ae40
shr eax, 0x1f
movzx edi, al
test dil, dil
je 0x14005a9af
mov rbx, qword [rbx]
jmp 0x14005a9b3
mov rbx, qword [rbx + 0x10]
cmp byte [rbx + 0x19], 0
je 0x14005a974
mov r10, qword [rsp + 0x70]
mov rbx, rsi
mov rcx, rsi
test dil, dil
je 0x14005aa80
cmp rsi, qword [r13]
jne 0x14005aa0a
movzx eax, byte [rsp + 0x90]
mov byte [rsp + 0x28], al
mov qword [rsp + 0x20], r12
mov r9, rsi
mov r8b, 1
lea rdx, [rsp + 0x70]
mov rcx, r10
call fcn.14005a6a0
mov rax, qword [rax]
mov qword [r14], rax
mov byte [r14 + 8], 1
mov rax, r14
jmp 0x14005aad5
cmp byte [rsi + 0x19], 0
je 0x14005aa16
mov rbx, qword [rsi + 0x10]
jmp 0x14005aa7d
mov rax, qword [rsi]
cmp byte [rax + 0x19], 0
je 0x14005aa5f
mov rax, qword [rsi + 8]
cmp byte [rax + 0x19], 0
jne 0x14005aa51
mov rdx, rsi
nop dword [rax]
mov r8, rax
mov r9, rax
mov rcx, rdx
cmp rdx, qword [rax]
jne 0x14005aa51
mov rbx, rax
mov rax, qword [rax + 8]
mov rdx, rbx
mov rcx, rbx
cmp byte [rax + 0x19], 0
je 0x14005aa30
cmp byte [rbx + 0x19], 0
jne 0x14005aa80
mov rbx, rax
mov rcx, rax
jmp 0x14005aa80
mov rbx, rax
mov rax, qword [rax + 0x10]
cmp byte [rax + 0x19], 0
jne 0x14005aa7d
nop dword [rax]
mov rbx, rax
mov rax, qword [rax + 0x10]
cmp byte [rax + 0x19], 0
je 0x14005aa70
mov rcx, rbx
add rcx, 0x20
mov rdx, r12
call fcn.14005ae40
shr eax, 0x1f
test al, al
je 0x14005aaca
movzx eax, byte [rsp + 0x90]
mov byte [rsp + 0x28], al
mov qword [rsp + 0x20], r12
mov r9, rsi
movzx r8d, dil
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x70]
call fcn.14005a6a0
mov rax, qword [rax]
mov qword [r14], rax
mov byte [r14 + 8], 1
mov rax, r14
jmp 0x14005aad5
mov qword [r14], rbx
mov byte [r14 + 8], 0
mov rax, r14
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14005bcb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov qword [rax - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov r12, r9
movzx r15d, r8b
mov r14, rdx
mov r10, rcx
mov r13, qword [rcx]
mov rsi, r13
mov rbx, qword [r13 + 8]
mov dil, 1
cmp byte [rbx + 0x19], 0
jne 0x14005bd3e
mov rsi, rbx
test r15b, r15b
je 0x14005bd13
lea rcx, [rbx + 0x20]
mov rdx, r12
call fcn.14005ae40
mov edi, eax
shr edi, 0x1f
xor dil, 1
jmp 0x14005bd25
lea rdx, [rbx + 0x20]
mov rcx, r12
call fcn.14005ae40
shr eax, 0x1f
movzx edi, al
test dil, dil
je 0x14005bd2f
mov rbx, qword [rbx]
jmp 0x14005bd33
mov rbx, qword [rbx + 0x10]
cmp byte [rbx + 0x19], 0
je 0x14005bcf4
mov r10, qword [rsp + 0x70]
mov rbx, rsi
mov rcx, rsi
test dil, dil
je 0x14005be00
cmp rsi, qword [r13]
jne 0x14005bd8a
movzx eax, byte [rsp + 0x90]
mov byte [rsp + 0x28], al
mov qword [rsp + 0x20], r12
mov r9, rsi
mov r8b, 1
lea rdx, [rsp + 0x70]
mov rcx, r10
call fcn.14005ba20
mov rax, qword [rax]
mov qword [r14], rax
mov byte [r14 + 8], 1
mov rax, r14
jmp 0x14005be55
cmp byte [rsi + 0x19], 0
je 0x14005bd96
mov rbx, qword [rsi + 0x10]
jmp 0x14005bdfd
mov rax, qword [rsi]
cmp byte [rax + 0x19], 0
je 0x14005bddf
mov rax, qword [rsi + 8]
cmp byte [rax + 0x19], 0
jne 0x14005bdd1
mov rdx, rsi
nop dword [rax]
mov r8, rax
mov r9, rax
mov rcx, rdx
cmp rdx, qword [rax]
jne 0x14005bdd1
mov rbx, rax
mov rax, qword [rax + 8]
mov rdx, rbx
mov rcx, rbx
cmp byte [rax + 0x19], 0
je 0x14005bdb0
cmp byte [rbx + 0x19], 0
jne 0x14005be00
mov rbx, rax
mov rcx, rax
jmp 0x14005be00
mov rbx, rax
mov rax, qword [rax + 0x10]
cmp byte [rax + 0x19], 0
jne 0x14005bdfd
nop dword [rax]
mov rbx, rax
mov rax, qword [rax + 0x10]
cmp byte [rax + 0x19], 0
je 0x14005bdf0
mov rcx, rbx
add rcx, 0x20
mov rdx, r12
call fcn.14005ae40
shr eax, 0x1f
test al, al
je 0x14005be4a
movzx eax, byte [rsp + 0x90]
mov byte [rsp + 0x28], al
mov qword [rsp + 0x20], r12
mov r9, rsi
movzx r8d, dil
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x70]
call fcn.14005ba20
mov rax, qword [rax]
mov qword [r14], rax
mov byte [r14 + 8], 1
mov rax, r14
jmp 0x14005be55
mov qword [r14], rbx
mov byte [r14 + 8], 0
mov rax, r14
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140066e60
Capabilities:
Generate random numbers via winapi

Disassembly:
mov rax, rsp
push rsi
push rdi
push r14
sub rsp, 0x80
mov qword [rax - 0x48], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov rax, qword [0x1403ad830]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov r14, rcx
cmp byte [rcx + 0x90], 0
jne 0x140066fee
mov ecx, 0x64
call fcn.140283754
mov rsi, rax
xor ebx, ebx
mov dword [rsp + 0x30], ebx
xor ecx, ecx
call fcn.14028c13c
mov dword [rsi + 0x10], eax
lea rax, [rsp + 0x30]
mov dword [rsi + 0x14], eax
call sub.KERNEL32.dll_GetTickCount
mov dword [rsi + 0x18], eax
lea edi, [rbx + 0x1c]
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x20], ebx
lea r9d, [rbx + 1]
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov ebp, edi
test eax, eax
je 0x140066f1b
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140066f1b
lea r8, [rsi + 0x1c]
lea edx, [rbx + 0x20]
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov ebp, SQLMoreResults
mov edi, ebp
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ebx, edi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, edi
mov dword [rdi + rsi], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rbx + rsi + 4], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsi + rbp + 8], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov dword [rbx + rsi + 0xc], eax
lea rcx, [rsp + 0x48]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [rsp + 0x4c]
mov eax, dword [rsp + 0x48]
mov dword [rdi + rsi + 0x10], eax
mov dword [rdi + rsi + 0x14], ecx
lea rcx, [rsp + 0x40]
call fcn.14006faa0
nop
mov r8d, 0x64
mov rdx, rsi
lea rcx, [rsp + 0x40]
call fcn.14006fb10
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x40]
call fcn.14006ffd0
mov eax, dword [rsp + 0x58]
mov qword [r14 + 0x50], rax
mov eax, dword [rsp + 0x5c]
mov qword [r14 + 0x58], rax
mov eax, dword [rsp + 0x60]
mov qword [r14 + 0x60], rax
mov eax, dword [rsp + 0x64]
mov qword [r14 + 0x68], rax
mov eax, dword [rsp + 0x68]
mov qword [r14 + 0x70], rax
mov eax, dword [rsp + 0x6c]
mov qword [r14 + 0x78], rax
mov eax, dword [rsp + 0x70]
mov qword [r14 + 0x80], rax
mov eax, dword [rsp + 0x74]
mov qword [r14 + 0x88], rax
mov rcx, rsi
call fcn.140283144
mov byte [r14 + 0x90], 1
lea rcx, [rsp + 0x40]
call fcn.14006fb00
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140283120
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret

Function at 0x14006b3b0
Capabilities:
Get storage device properties

Disassembly:
sub rsp, 0x68
mov rax, qword [0x1403ad830]
xor rax, rsp
mov qword [rsp + 0x58], rax
xor eax, eax
lea r8, [rsp + 0x48]
mov qword [rsp + 0x38], rax
mov r9d, reloc.ODBC32.dll_SQLExecute
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov eax, dword [rdx + 4]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
mov edx, 0x2d1400
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140283120
add rsp, 0x68
ret
Function at 0x14006b510
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x100
mov rax, qword [0x1403ad830]
xor rax, rsp
mov qword [rsp + 0xf0], rax
call fcn.14029c3bc
movzx ebx, ax
lea ecx, [rbx - 0x41]
cmp cx, 2
jbe 0x14006b56f
movzx r8d, ax
lea rdx, str._c:_
lea rcx, [rsp + 0x20]
call fcn.140006c20
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x14006b58a
mov dl, 1
movzx ecx, bx
call fcn.14006b5a0
test al, al
jne 0x14006b58f
xor al, al
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.140283120
add rsp, 0x100
pop rbx
ret
cmp eax, 2
jne 0x14006b56f
mov al, 1
jmp 0x14006b571
Function at 0x14006b7f0
Capabilities:
Check for sandbox username or hostname
Get session user name

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x138]
sub rsp, 0x230
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rdi
mov rax, qword [0x1403ad830]
xor rax, rsp
mov qword [rbp + 0x120], rax
mov rdi, rcx
call fcn.14002e7e0
test al, al
jne 0x14006b856
lea rcx, [rsp + 0x68]
call fcn.140030540
nop
mov rdx, rax
mov rcx, rdi
call fcn.14001d690
nop
lea rcx, [rsp + 0x68]
call fcn.14001d440
jmp 0x14006ba22
mov rcx, rdi
call fcn.14001f170
mov dl, 1
lea rcx, [rsp + 0x28]
call fcn.14006bb40
nop
cmp byte [rsp + 0x34], 0
je 0x14006b95b
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
mov ebx, eax
xor edx, edx
mov r8d, 0x190
lea rcx, [rbp - 0x70]
call fcn.140285450
mov dword [rsp + 0x20], 0xc8
lea rdx, [rsp + 0x20]
lea rcx, [rbp - 0x70]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x68]
call fcn.14001c950
nop
lea rdx, [rsp + 0x68]
mov rcx, rdi
call fcn.14001d690
nop
lea rcx, [rsp + 0x68]
call fcn.14001d440
test ebx, ebx
je 0x14006ba12
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
test eax, eax
jne 0x14006ba12
lea rdx, str.GetCurrentUserName_RevertToSelf_fail
lea rcx, [rsp + 0x40]
call fcn.14001c950
nop
call fcn.140005320
mov rcx, rax
mov r9d, 0x42
lea r8, str.e:worksuniaccess_unimon_blowsnow_source_spacetokenhuserutil.cpp
lea edx, [r9 - 0x3f]
call fcn.140004df0
mov rbx, rax
cmp byte [rax + 0x28], 0
je 0x14006b940
lea rdx, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rdx, qword [rsp + 0x48]
lea rcx, [rax + 8]
mov r8, qword [rsp + 0x58]
call fcn.140004ac0
call fcn.140005320
mov rcx, rax
mov rdx, rbx
call fcn.1400054f0
nop
lea rcx, [rsp + 0x40]
jmp 0x14006ba0c
mov edx, dword [rsp + 0x30]
lea rcx, [rsp + 0x68]
call fcn.14001c660
nop
lea rdx, str._______________________________token_NOT_ok__Error_Code
lea rcx, [rsp + 0x40]
call fcn.14001c950
nop
call fcn.140005320
mov rcx, rax
mov r9d, SQLSetEnvAttr
lea r8, str.e:worksuniaccess_unimon_blowsnow_source_spacetokenhuserutil.cpp
lea edx, [r9 - 0x47]
call fcn.140004df0
mov rbx, rax
movzx eax, byte [rax + 0x28]
lea rdi, [rbx + 8]
test al, al
je 0x14006b9eb
lea rdx, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rdx, qword [rsp + 0x48]
mov r8, qword [rsp + 0x58]
mov rcx, rdi
call fcn.140004ac0
movzx eax, byte [rbx + 0x28]
test al, al
je 0x14006b9eb
lea rdx, [rsp + 0x70]
cmp qword [rbp - 0x78], 8
cmovae rdx, qword [rsp + 0x70]
mov r8, qword [rbp - 0x80]
mov rcx, rdi
call fcn.140004ac0
call fcn.140005320
mov rcx, rax
mov rdx, rbx
call fcn.1400054f0
nop
lea rcx, [rsp + 0x40]
call fcn.14001d440
nop
lea rcx, [rsp + 0x68]
call fcn.14001d440
nop
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x14006ba22
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rbp + 0x120]
xor rcx, rsp
call fcn.140283120
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x14006cdb0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rbx
mov r11, rdx
mov rbx, rcx
test rdx, rdx
je 0x14006cecb
test r8, r8
jle 0x14006cecb
add qword [rcx], r8
mov qword [rsp + 0x10], rsi
lea rsi, [0x1403a9c80]
cmp r8, 8
jl 0x14006ce92
mov edx, dword [rcx + 8]
mov qword [rsp + 0x18], rdi
mov rdi, r8
shr rdi, 3
mov rax, rdi
neg rax
lea r8, [r8 + rax*8]
nop dword [rax]
mov r10d, dword [r11 + 4]
mov ecx, dword [r11]
add r11, 8
xor ecx, edx
mov r9d, ecx
mov eax, ecx
shr rax, 0x10
movzx edx, al
mov eax, ecx
shr rax, 8
movzx ecx, al
mov eax, r10d
mov edx, dword [rsi + rdx*4 + 0x1400]
shr rax, 0x10
xor edx, dword [rsi + rcx*4 + 0x1800]
movzx ecx, al
mov eax, r10d
shr rax, 8
xor edx, dword [rsi + rcx*4 + 0x400]
movzx ecx, al
mov eax, r9d
shr rax, 0x18
xor edx, dword [rsi + rcx*4 + 0x800]
xor edx, dword [rsi + rax*4 + 0x1000]
mov eax, r10d
shr rax, 0x18
xor edx, dword [rsi + rax*4]
movzx eax, r9b
xor edx, dword [rsi + rax*4 + 0x1c00]
movzx eax, r10b
xor edx, dword [rsi + rax*4 + 0xc00]
mov dword [rbx + 8], edx
sub rdi, 1
jne 0x14006ce00
mov rdi, qword [rsp + 0x18]
test r8, r8
je 0x14006cec6
mov r9d, dword [rbx + 8]
nop dword [rax + rax]
movzx eax, byte [r11]
lea r11, [r11 + 1]
movzx edx, r9b
mov ecx, r9d
xor rdx, rax
shr ecx, 8
mov eax, dword [rsi + rdx*4]
xor eax, ecx
mov dword [rbx + 8], eax
mov r9d, eax
sub r8, 1
jne 0x14006cea0
mov rsi, qword [rsp + 0x10]
pop rbx
ret

Function at 0x14006cee0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rdi
lea rdi, [0x1403a9c80]
mov r10, rdx
mov r11, rcx
mov eax, 0xffffffff
cmp rdx, 8
jl 0x14006cfaf
mov qword [rsp + 0x10], rbx
mov rbx, rdx
shr rbx, 3
mov r8, rbx
neg r8
lea r10, [rdx + r8*8]
nop dword [rax]
nop dword [rax + rax]
mov r9d, dword [r11 + 4]
mov ecx, dword [r11]
add r11, 8
xor ecx, eax
mov eax, ecx
shr rax, 0x10
movzx edx, al
mov eax, ecx
mov r8d, ecx
shr rax, 8
movzx ecx, al
mov eax, dword [rdi + rdx*4 + 0x1400]
xor eax, dword [rdi + rcx*4 + 0x1800]
mov ecx, r9d
shr rcx, 0x10
movzx edx, cl
mov ecx, r9d
shr rcx, 8
xor eax, dword [rdi + rdx*4 + 0x400]
movzx edx, cl
mov ecx, r8d
shr rcx, 0x18
xor eax, dword [rdi + rdx*4 + 0x800]
xor eax, dword [rdi + rcx*4 + 0x1000]
mov ecx, r9d
shr rcx, 0x18
xor eax, dword [rdi + rcx*4]
movzx ecx, r8b
xor eax, dword [rdi + rcx*4 + 0x1c00]
movzx ecx, r9b
xor eax, dword [rdi + rcx*4 + 0xc00]
sub rbx, 1
jne 0x14006cf20
mov rbx, qword [rsp + 0x10]
test r10, r10
jmp 0x14006cfdc
movzx ecx, byte [r11]
lea r11, [r11 + 1]
movzx edx, al
xor rdx, rcx
mov ecx, eax
shr ecx, 8
mov eax, dword [rdi + rdx*4]
xor eax, ecx
sub r10, 1
jne 0x14006cfc0
not eax
pop rdi
ret
Function at 0x140085bf0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub r8, rdx
movabs rax, 0xcbf29ce484222325
sar r8, 1
mov r9d, 0
add r8, r8
je 0x140085c34
movabs r10, 0x100000001b3
nop word [rax + rax]
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x140085c20
ret
Function at 0x140099dc0
Capabilities:
Get graphical window text

Disassembly:
mov r11, rsp
push rsi
push rdi
push r14
sub rsp, 0x70
mov qword [r11 - 0x60], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
mov rax, qword [0x1403ad830]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rbp, rdx
mov rbx, rcx
mov qword [r11 - 0x58], rcx
xor r14d, r14d
mov dword [r11 - 0x68], r14d
xor r9d, r9d
xor r8d, r8d
lea edx, [r14 + 0xe]
mov rcx, rbp
call qword [sym.imp.USER32.dll_SendMessageW]
mov rsi, rax
mov rcx, rbx
call fcn.14001cac0
mov dword [rsp + 0x20], 1
test rsi, rsi
jle 0x140099e93
lea rdx, [rsi + 0xa]
mov eax, 2
mul rdx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.140283754
mov rdi, rax
mov word [rax], r14w
lea r8, [rsi + 1]
mov r9, rax
lea edx, [r14 + 0xd]
mov rcx, rbp
call qword [sym.imp.USER32.dll_SendMessageW]
test rax, rax
jle 0x140099e8b
mov rdx, rdi
lea rcx, [rsp + 0x38]
call fcn.14001c950
nop
lea rdx, [rsp + 0x38]
mov rcx, rbx
call fcn.14001d690
nop
lea rcx, [rsp + 0x38]
call fcn.14001d440
mov rcx, rdi
call fcn.140283144
mov rax, rbx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140283120
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret

Function at 0x1400ad060
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x470
mov rax, qword [0x1403ad830]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov rdi, r8
mov dword [rsp + 0x30], 0
mov rbp, rdx
mov rsi, rcx
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x208
call fcn.140285450
xor edx, edx
lea rcx, [rsp + 0x250]
mov r8d, 0x208
call fcn.140285450
xor r9d, r9d
lea rdx, [0x14031f7b0]
mov r8, rbp
lea rcx, [rsp + 0x30]
call qword [sym.imp.SETUPAPI.dll_CM_Get_Device_Interface_List_SizeW]
test eax, eax
jne 0x1400ad1b8
mov eax, dword [rsp + 0x30]
cmp eax, 2
jbe 0x1400ad1b8
lea r8d, [rax + 1]
mov eax, 2
mul r8
mov rdx, 0xffffffffffffffff
cmovo rax, rdx
mov rcx, rax
call fcn.140283754
mov r9d, dword [rsp + 0x30]
lea rcx, [0x14031f7b0]
mov r8, rax
mov dword [rsp + 0x20], 0
mov rdx, rbp
mov rbx, rax
call qword [sym.imp.SETUPAPI.dll_CM_Get_Device_Interface_ListW]
test eax, eax
jne 0x1400ad1a6
mov edx, dword [rsp + 0x30]
lea r8, [0x1402d03d8]
inc edx
mov rcx, rbx
call fcn.14029df08
mov r8d, 0x104
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
test eax, eax
je 0x1400ad1a6
lea r9, [rsp + 0x30]
mov r8d, 0x104
lea rdx, [rsp + 0x250]
lea rcx, [rsp + 0x40]
call qword [rsi + reloc.OLEAUT32.dll_VariantClear]
test eax, eax
je 0x1400ad1a6
mov rax, qword [rsp + 0x250]
test ax, ax
je 0x1400ad1a6
movzx edx, ax
mov rcx, rdi
call fcn.140028e20
test rbx, rbx
je 0x1400ad1a2
mov edx, 2
mov rcx, rbx
call fcn.140283144
mov al, 1
jmp 0x1400ad1ba
test rbx, rbx
je 0x1400ad1b8
mov edx, 2
mov rcx, rbx
call fcn.140283144
xor al, al
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.140283120
mov rbx, qword [rsp + 0x4a8]
add rsp, 0x470
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400ae6d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
xor ebx, ebx
lea rdi, [rcx + 0x33e1c]
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rcx + 0x344c6]
lea rdi, [rdi + 4]
shr rax, 4
mov r9d, ebx
and r9d, 1
mov r11d, ebx
mov edx, r9d
shr r11d, 1
neg edx
or r9d, 2
sar rdx, 4
mov r8d, r11d
and edx, 0x7f
shr r11d, 1
xor rdx, rax
and r8d, 1
mov eax, r8d
inc ebx
neg eax
sar rax, 4
mov r10d, dword [rcx + rdx*4 + 0x3276c]
and eax, 0x7f
movzx edx, word [rcx + r9*2 + 0x344c4]
add r9d, r9d
shr rdx, 4
or r9d, r8d
xor rdx, rax
mov r8d, r11d
and r8d, 1
shr r11d, 1
mov eax, r8d
and r11d, 1
neg eax
add r10d, dword [rcx + rdx*4 + 0x3276c]
movzx edx, word [rcx + r9*2 + 0x344c4]
sar rax, 4
and eax, 0x7f
shr rdx, 4
xor rdx, rax
lea eax, [r9 + r9]
or eax, r8d
add r10d, dword [rcx + rdx*4 + 0x3276c]
movzx edx, word [rcx + rax*2 + 0x344c4]
mov eax, r11d
shr rdx, 4
neg eax
sar rax, 4
and eax, 0x7f
xor rdx, rax
mov edx, dword [rcx + rdx*4 + 0x3276c]
add edx, r10d
mov dword [rdi - 4], edx
cmp ebx, 0x10
jb 0x1400ae6f0
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
mov dword [rcx + 0x33e5c], 0
ret
Function at 0x1400b10a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
push r15
mov r11, qword [rsp + 0x48]
mov ebp, r8d
movzx r10d, word [rcx]
mov r13, r9
movzx r8d, word [rcx + 2]
mov eax, r10d
shr rax, 4
xor r10, 0x7f0
shr r10, 4
mov r15d, edx
mov rbx, rcx
mov rsi, r13
mov r14d, dword [r11 + rax*4]
mov eax, r8d
shr rax, 4
xor r8, 0x7f0
shr r8, 4
mov r12d, dword [r11 + rax*4]
mov eax, dword [r11 + r8*4]
add eax, dword [r11 + r10*4]
add r12d, dword [r11 + r10*4]
mov dword [rsp + 0x48], eax
xor r9d, r9d
nop dword [rax + rax]
cmp r9d, ebp
jae 0x1400b1260
xor r10d, r10d
lea edi, [r15*8]
mov r8d, r9d
or r8d, 8
nop dword [rax + rax]
mov ecx, r8d
mov eax, r8d
and ecx, 1
shr rax, 1
neg ecx
shr r8d, 1
sar rcx, 4
add rax, rdi
and ecx, 0x7f
movzx edx, word [rbx + rax*2 + 4]
shr rdx, 4
xor rdx, rcx
add r10d, dword [r11 + rdx*4]
cmp r8d, 1
jne 0x1400b1140
lea eax, [r10 + r14]
inc r9d
mov dword [rsi], eax
add rsi, 4
cmp r9d, 8
jb 0x1400b1120
cmp r9d, 0x10
jae 0x1400b11f7
lea rsi, [r9*4]
add rsi, r13
cmp r9d, ebp
jae 0x1400b1260
xor r10d, r10d
lea r8d, [r9 - 8]
or r8d, 8
nop dword [rax]
mov ecx, r8d
mov eax, r8d
and ecx, 1
shr rax, 1
neg ecx
shr r8d, 1
sar rcx, 4
add rax, rdi
and ecx, 0x7f
movzx edx, word [rbx + rax*2 + 0x104]
shr rdx, 4
xor rdx, rcx
add r10d, dword [r11 + rdx*4]
cmp r8d, 1
jne 0x1400b11b0
lea eax, [r10 + r12]
inc r9d
mov dword [rsi], eax
add rsi, 4
cmp r9d, 0x10
jb 0x1400b1195
cmp r9d, ebp
jae 0x1400b1260
mov esi, dword [rsp + 0x48]
lea rdi, [r9*4]
add rdi, r13
nop dword [rax + rax]
xor r10d, r10d
lea eax, [r9 - 0x10]
bts eax, 8
nop dword [rax + rax]
mov edx, eax
mov ecx, eax
and edx, 1
shr rcx, 1
neg edx
shr eax, 1
sar rdx, 4
and edx, 0x7f
movzx r8d, word [rbx + rcx*2 + 0x204]
shr r8, 4
xor r8, rdx
add r10d, dword [r11 + r8*4]
cmp eax, 1
jne 0x1400b1220
lea eax, [r10 + rsi]
inc r9d
mov dword [rdi], eax
add rdi, 4
cmp r9d, ebp
jb 0x1400b1210
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
pop r15
pop r14
pop r13
pop r12
ret

Function at 0x1400b13b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xor r11d, r11d
mov rbx, rcx
bts edx, 8
nop
mov ecx, edx
mov eax, edx
shr ecx, 7
add edx, edx
and ecx, 1
shr rax, 8
neg ecx
sar rcx, 4
and ecx, 0x7f
movzx r10d, word [rbx + rax*2]
shr r10, 4
xor r10, rcx
add r11d, dword [r8 + r10*4]
cmp edx, 0x10000
jb 0x1400b13c0
mov rbx, qword [rsp + 8]
mov eax, r11d
ret

Function at 0x1400b1400
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
xor ebx, ebx
mov r10d, 0x100
or edx, r10d
mov r11d, r8d
mov rdi, rcx
nop dword [rax + rax]
add r11d, r11d
mov r8d, edx
shr r8d, 8
mov ecx, edx
shr ecx, 7
mov eax, r10d
and ecx, 1
and eax, r11d
neg ecx
add eax, r10d
sar rcx, 4
add r8d, eax
and ecx, 0x7f
add edx, edx
movzx r8d, word [rdi + r8*2]
shr r8, 4
xor r8, rcx
mov ecx, edx
xor ecx, r11d
not ecx
and r10d, ecx
add ebx, dword [r9 + r8*4]
cmp edx, 0x10000
jb 0x1400b1420
mov rdi, qword [rsp + 0x10]
mov eax, ebx
mov rbx, qword [rsp + 8]
ret
Function at 0x1400ef3d0
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, r8d
mov rbx, rcx
call fcn.14001d690
mov rcx, rbx
mov dword [rbx + 0x28], edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1400ef400
Function at 0x1400efa40
Capabilities:
Receive data
Receive data on socket

Disassembly:
test rdx, rdx
je 0x1400efa6f
test r8d, r8d
jle 0x1400efa6f
movzx eax, byte [rcx + 0x68]
test al, al
je 0x1400efa6f
cmp byte [rcx + 0x2c], 0
je 0x1400efa61
mov rcx, qword [rcx + 0x78]
jmp fcn.140180790
mov rcx, qword [rcx + 0x58]
xor r9d, r9d
jmp qword [sym.imp.WS2_32.dll_recv]
xor eax, eax
ret

Function at 0x1400efa80
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x20
movzx eax, byte [rcx + 0x68]
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test al, al
jne 0x1400efaaa
mov rax, 0xffffffffffffff9c
add rsp, 0x20
pop r14
pop rsi
pop rbp
ret
test r14, r14
je 0x1400efbb8
test rbp, rbp
jle 0x1400efbb8
cmp byte [rcx + 0x2c], 0
je 0x1400efae2
mov rcx, qword [rcx + 0x78]
call fcn.140181290
movsxd rcx, eax
test eax, eax
jle 0x1400efad6
add qword [rsi + 0x60], rcx
mov rax, rcx
add rsp, 0x20
pop r14
pop rsi
pop rbp
ret
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x58], r15
mov r15, qword [rcx + 0x58]
cmp r15, 0xffffffffffffffff
jne 0x1400efb0f
mov rbx, r15
mov r15, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
pop rsi
pop rbp
ret
mov qword [rsp + 0x48], rdi
xor ebx, ebx
mov qword [rsp + 0x50], r12
mov edi, 0xc8
test rbp, rbp
jle 0x1400efb86
mov r12d, 0x578
nop dword [rax + rax]
cmp edi, 0xea60
jg 0x1400efb86
mov r8d, ebp
lea rdx, [rbx + r14]
sub r8d, ebx
mov rax, rbp
sub rax, rbx
mov rcx, r15
cmp rax, r12
cmovg r8d, r12d
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jg 0x1400efb77
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x1400efbaf
mov ecx, edi
call sub.KERNEL32.dll_Sleep
add edi, edi
jmp 0x1400efb81
cdqe
mov edi, 0xc8
add rbx, rax
cmp rbx, rbp
jl 0x1400efb30
test rbx, rbx
jle 0x1400efb8f
add qword [rsi + 0x60], rbx
mov rdi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov r12, qword [rsp + 0x50]
mov r15, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rsi
pop rbp
ret
mov rbx, 0xfffffffffffffffe
jmp 0x1400efb8f
xor eax, eax
add rsp, 0x20
pop r14
pop rsi
pop rbp
ret