joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c0bd0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
movzx eax, r8b
lea rdi, [rcx + 0x10]
mov rbx, rdx
movzx esi, r9b
mov rdx, rcx
lea eax, [rax*8]
mov byte [rax + rcx + 0xd7], 0
lea r11d, [rax - 1]
mov r10d, eax
movzx eax, byte [rcx + 0x1a0]
mov byte [rax + rcx + 0xd8], 6
or byte [r10 + rcx + 0xd7], 0x80
movzx ecx, byte [rcx + 0x1a0]
inc cl
movzx eax, cl
cmp eax, r11d
jge 0x1400c0c45
movzx eax, cl
inc cl
mov byte [rax + rdx + 0xd8], 0
movzx eax, cl
cmp eax, r11d
jl 0x1400c0c30
test r8b, r8b
je 0x1400c0c65
mov rax, rdi
movzx edx, r8b
mov rcx, qword [rax + 0xc8]
xor qword [rax], rcx
lea rax, [rax + 8]
sub rdx, 1
jne 0x1400c0c51
mov rcx, rdi
call fcn.1400bf7f0
test sil, sil
je 0x1400c0c90
sub rdi, rbx
mov rcx, rsi
nop dword [rax + rax]
movzx eax, byte [rbx + rdi]
mov byte [rbx], al
lea rbx, [rbx + 1]
sub rcx, 1
jne 0x1400c0c80
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1400c0ca0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r14
sub rsp, 0x20
lea r14, [rcx + 0x1a0]
mov qword [rsp + 0x40], rbp
mov rbx, rdx
mov qword [rsp + 0x50], r15
movzx edx, byte [r14]
mov edi, r8d
movzx r15d, r9b
mov rsi, rcx
test dl, dl
je 0x1400c0d77
movzx eax, r15b
movzx r8d, dil
shl al, 3
lea r9, [rsi + rdx]
sub al, dl
mov r10, r14
movzx ecx, al
cmp ecx, edi
cmovbe r8d, ecx
xor dl, dl
test r8b, r8b
je 0x1400c0d1d
nop dword [rax + rax]
movzx ecx, dl
inc dl
movzx eax, byte [rcx + rbx]
mov byte [r9 + rcx + 0xd8], al
cmp dl, r8b
jb 0x1400c0d00
lea r10, [rsi + 0x1a0]
add byte [r14], dl
movzx ecx, byte [r14]
mov r14, r10
movzx eax, dl
add rbx, rax
movzx eax, dl
sub edi, eax
mov eax, r15d
shl eax, 3
cmp ecx, eax
jne 0x1400c0d77
lea r8, [rsi + 0x10]
test r15b, r15b
je 0x1400c0d6b
mov rcx, r8
mov rdx, r15
nop dword [rax + rax]
mov rax, qword [rcx + 0xc8]
xor qword [rcx], rax
lea rcx, [rcx + 8]
sub rdx, 1
jne 0x1400c0d50
lea r14, [rsi + 0x1a0]
mov rcx, r8
call fcn.1400bf7f0
mov byte [r14], 0
mov ebp, r15d
shl ebp, 3
cmp edi, ebp
jb 0x1400c0de0
mov qword [rsp + 0x48], r12
mov r12d, ebp
nop dword [rax]
test r15b, r15b
je 0x1400c0dc2
mov r8, rbx
lea rax, [rsi + 0x10]
sub r8, rsi
mov rdx, r15
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [rax + r8 - 0x10]
xor qword [rax], rcx
lea rax, [rax + 8]
sub rdx, 1
jne 0x1400c0db0
lea rcx, [rsi + 0x10]
call fcn.1400bf7f0
sub edi, ebp
add rbx, r12
cmp edi, ebp
jae 0x1400c0d90
mov r12, qword [rsp + 0x48]
lea r14, [rsi + 0x1a0]
mov r15, qword [rsp + 0x50]
xor dl, dl
mov rbp, qword [rsp + 0x40]
test edi, edi
je 0x1400c0e1b
movzx ecx, dl
inc dl
movzx eax, byte [rcx + rbx]
mov byte [rsi + rcx + 0xd8], al
movzx eax, dl
cmp eax, edi
jb 0x1400c0df0
add byte [rsi + 0x1a0], dl
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
add byte [r14], dl
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x1400f5850
Capabilities:
Encrypt data using salsa20 or chacha
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov rbx, rdx
test r8, r8
je 0x1400f5a57
lea rcx, [rdx + 0x18]
call fcn.140042d30
cmp eax, 0x20
jne 0x1400f5a57
lea rbp, [rbx + 0x50]
mov rcx, rbp
call fcn.140042d30
cmp eax, 0xc
jb 0x1400f5a57
lea rcx, [rbx + 0x18]
call fcn.1400428d0
mov rcx, rbp
mov rbx, rax
call fcn.1400428d0
mov dword [rdi], 0x61707865
mov r8, rax
mov dword [rdi + 4], 0x3320646e
mov dword [rdi + 8], 0x79622d32
mov dword [rdi + 0xc], 0x6b206574
movzx ecx, byte [rbx + 2]
movzx eax, byte [rbx]
movzx edx, byte [rbx + 3]
shl edx, 8
or edx, ecx
movzx ecx, byte [rbx + 1]
shl edx, 8
or edx, ecx
shl edx, 8
or edx, eax
mov dword [rdi + 0x10], edx
movzx eax, byte [rbx + 6]
movzx ecx, byte [rbx + 7]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 5]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 4]
shl ecx, 8
or ecx, eax
mov dword [rdi + 0x14], ecx
movzx eax, byte [rbx + 0xa]
movzx ecx, byte [rbx + 0xb]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 9]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 8]
shl ecx, 8
or ecx, eax
mov dword [rdi + 0x18], ecx
movzx eax, byte [rbx + 0xe]
movzx ecx, byte [rbx + 0xf]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0xd]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0xc]
shl ecx, 8
or ecx, eax
mov dword [rdi + 0x1c], ecx
movzx eax, byte [rbx + 0x12]
movzx ecx, byte [rbx + 0x13]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0x11]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0x10]
shl ecx, 8
or ecx, eax
mov dword [rdi + 0x20], ecx
movzx eax, byte [rbx + 0x16]
movzx ecx, byte [rbx + 0x17]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0x15]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0x14]
shl ecx, 8
or ecx, eax
mov dword [rdi + 0x24], ecx
movzx ecx, byte [rbx + 0x1b]
movzx eax, byte [rbx + 0x1a]
shl ecx, 8
or ecx, eax
shl ecx, 8
movzx eax, byte [rbx + 0x19]
or ecx, eax
movzx eax, byte [rbx + 0x18]
shl ecx, 8
or ecx, eax
mov dword [rdi + 0x28], ecx
movzx eax, byte [rbx + 0x1e]
movzx ecx, byte [rbx + 0x1f]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0x1d]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0x1c]
shl ecx, 8
or ecx, eax
mov dword [rdi + 0x30], 0
mov dword [rdi + 0x2c], ecx
movzx eax, byte [r8 + 2]
movzx ecx, byte [r8 + 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [r8 + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [r8]
shl ecx, 8
or ecx, eax
mov dword [rdi + 0x34], ecx
movzx eax, byte [r8 + 6]
movzx ecx, byte [r8 + 7]
shl ecx, 8
or ecx, eax
movzx eax, byte [r8 + 5]
shl ecx, 8
or ecx, eax
movzx eax, byte [r8 + 4]
shl ecx, 8
or ecx, eax
mov dword [rdi + 0x38], ecx
movzx eax, byte [r8 + 0xa]
movzx ecx, byte [r8 + 0xb]
shl ecx, 8
or ecx, eax
movzx eax, byte [r8 + 9]
shl ecx, 8
or ecx, eax
movzx eax, byte [r8 + 8]
shl ecx, 8
or ecx, eax
mov al, 1
mov dword [rdi + 0x3c], ecx
jmp 0x1400f5a59
xor al, al
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140102b10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
movsxd rdi, r8d
add rcx, 8
mov rsi, rdx
call fcn.1400428d0
lea rcx, [rbx + 0x38]
mov rbp, rax
call fcn.1400428d0
mov r9d, dword [rsi + rdi*4 + 4]
mov rcx, rdi
mov r10d, dword [rsi + rcx*4]
lea rdi, [rsi + rdi*4]
xor r10d, dword [rbp]
lea rsi, [rsi + rcx*4]
xor ebx, ebx
mov r11, rax
nop
inc ebx
mov ecx, r10d
and ecx, 0xff0000
mov eax, r10d
shr rax, 0x18
bts rcx, 0x18
shr rcx, 0x10
mov edx, dword [r11 + rcx*4]
add edx, dword [r11 + rax*4]
mov eax, r10d
and eax, 0xff00
bts rax, 0x11
shr rax, 8
xor edx, dword [r11 + rax*4]
movzx eax, r10b
or rax, 0x300
add edx, dword [r11 + rax*4]
xor edx, dword [rbp + rbx*4]
inc ebx
xor r9d, edx
mov ecx, r9d
and ecx, 0xff0000
mov eax, r9d
shr rax, 0x18
bts rcx, 0x18
shr rcx, 0x10
mov edx, dword [r11 + rcx*4]
add edx, dword [r11 + rax*4]
mov eax, r9d
and eax, 0xff00
bts rax, 0x11
shr rax, 8
xor edx, dword [r11 + rax*4]
movzx eax, r9b
or rax, 0x300
add edx, dword [r11 + rax*4]
xor edx, dword [rbp + rbx*4]
xor r10d, edx
cmp ebx, 0xe
jbe 0x140102b60
xor r9d, dword [rbp + 0x44]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov dword [rsi], r9d
mov rsi, qword [rsp + 0x40]
mov dword [rdi + 4], r10d
add rsp, 0x20
pop rdi
ret
Function at 0x140102ff0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r14, rcx
xor ebx, ebx
add rcx, 8
mov qword [rsp + 0x20], rbx
mov r13d, r8d
call fcn.140042d30
cdq
lea rcx, [r14 + 0x38]
and edx, 3
add eax, edx
sar eax, 2
movsxd rsi, eax
call fcn.140042d30
cdq
lea rcx, [r14 + 8]
and edx, 3
add eax, edx
sar eax, 2
mov dword [rsp + 0x88], eax
call fcn.1400428d0
lea rcx, [r14 + 0x38]
mov r15, rax
call fcn.1400428d0
mov r12, rax
test rsi, rsi
jle 0x1401030fa
mov r10, qword [rsp + 0x78]
mov r9d, ebx
mov eax, ebx
nop
movsxd rcx, eax
inc eax
cdq
idiv r13d
movzx r8d, byte [rcx + r10]
movsxd rax, edx
shl r8d, 8
movzx ecx, byte [rax + r10]
lea eax, [rdx + 1]
cdq
or ecx, r8d
idiv r13d
shl ecx, 8
movsxd rax, edx
movzx r8d, byte [rax + r10]
lea eax, [rdx + 1]
cdq
or r8d, ecx
idiv r13d
shl r8d, 8
movsxd rax, edx
movzx ecx, byte [rax + r10]
lea eax, [rdx + 1]
cdq
or ecx, r8d
xor dword [r15 + r9*4], ecx
inc r9
idiv r13d
mov eax, edx
cmp r9, rsi
jl 0x140103070
mov rdi, rbx
xor r8d, r8d
lea rdx, [rsp + 0x20]
mov rcx, r14
call fcn.140102b10
mov eax, dword [rsp + 0x20]
mov dword [r15 + rdi*4], eax
mov eax, dword [rsp + 0x24]
mov dword [r15 + rdi*4 + 4], eax
add rdi, 2
cmp rdi, rsi
jl 0x1401030d0
movsxd rdi, dword [rsp + 0x88]
test rdi, rdi
jle 0x14010313a
nop word [rax + rax]
xor r8d, r8d
lea rdx, [rsp + 0x20]
mov rcx, r14
call fcn.140102b10
mov eax, dword [rsp + 0x20]
mov dword [r12 + rbx*4], eax
mov eax, dword [rsp + 0x24]
mov dword [r12 + rbx*4 + 4], eax
add rbx, 2
cmp rbx, rdi
jl 0x140103110
mov rbx, qword [rsp + 0x80]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140109140
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push rbp
push rbx
push r13
push r14
push r15
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov rax, qword [0x140353c70]
xor rax, rsp
mov qword [rbp + 0x190], rax
mov rax, qword [rbp + 0x210]
mov r13, rcx
mov rcx, qword [rbp + 0x218]
mov r14d, r9d
mov qword [rsp + 0x20], rcx
mov ebx, r8d
mov qword [rsp + 0x28], rax
mov r15, rdx
test rax, rax
je 0x140109387
mov qword [rsp + 0x2b8], rsi
lea eax, [r9 - 2]
mov ecx, 0x80
mov qword [rsp + 0x2b0], rdi
cmp eax, 1
mov qword [rsp + 0x2a8], r12
mov esi, 0x40
cmovbe esi, ecx
mov ecx, r14d
call fcn.14005f400
movsxd r12, eax
cmp ebx, esi
jle 0x1401091e9
lea r9, [rbp + 0x50]
mov r8d, r14d
mov edx, ebx
mov rcx, r15
call fcn.14005e400
lea r15, [rbp + 0x50]
mov ebx, r12d
mov r8d, esi
lea rcx, [rsp + 0x30]
xor edx, edx
mov edi, esi
call sub.VCRUNTIME140.dll_memset
mov r8d, esi
lea rcx, [rbp - 0x40]
xor edx, edx
call sub.VCRUNTIME140.dll_memset
cmp ebx, esi
lea rcx, [rsp + 0x30]
mov eax, esi
mov rdx, r15
cmovle eax, ebx
movsxd rbx, eax
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov r8, rbx
lea rcx, [rbp - 0x40]
mov rdx, r15
call sub.VCRUNTIME140.dll_memcpy
movdqa xmm2, xmmword [str.6666666666666666Pbkdf2_bin]
xor ecx, ecx
movdqa xmm3, xmmword [0x1402a2190]
mov eax, ecx
nop word [rax + rax]
movdqu xmm0, xmmword [rsp + rax + 0x30]
add ecx, 0x40
movdqa xmm1, xmm3
xorps xmm0, xmm2
movdqu xmmword [rsp + rax + 0x30], xmm0
movdqu xmm0, xmmword [rbp + rax - 0x40]
xorps xmm1, xmm0
movdqu xmm0, xmmword [rsp + rax + 0x40]
movdqu xmmword [rbp + rax - 0x40], xmm1
xorps xmm0, xmm2
movdqa xmm1, xmm3
movdqu xmmword [rsp + rax + 0x40], xmm0
movdqu xmm0, xmmword [rbp + rax - 0x30]
xorps xmm1, xmm0
movdqu xmm0, xmmword [rsp + rax + 0x50]
movdqu xmmword [rbp + rax - 0x30], xmm1
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmm0, xmmword [rbp + rax - 0x20]
movdqu xmmword [rsp + rax + 0x50], xmm1
xorps xmm0, xmm3
movdqa xmm1, xmm2
movdqu xmmword [rbp + rax - 0x20], xmm0
movdqu xmm0, xmmword [rsp + rax + 0x60]
xorps xmm1, xmm0
movdqu xmm0, xmmword [rbp + rax - 0x10]
movdqu xmmword [rsp + rax + 0x60], xmm1
xorps xmm0, xmm3
movdqu xmmword [rbp + rax - 0x10], xmm0
add rax, 0x40
cmp rax, rdi
jl 0x140109250
movsxd rax, ecx
cmp rax, rdi
jge 0x140109302
xor byte [rsp + rax + 0x30], 0x36
xor byte [rbp + rax - 0x40], 0x5c
inc rax
cmp rax, rdi
jl 0x1401092f0
mov r9, qword [rsp + 0x20]
lea rax, [rsp + 0x30]
lea r8, [rbp + 0x90]
mov qword [r13 + 8], rax
mov edx, r14d
mov dword [r13 + 0x808], esi
mov rcx, r13
call fcn.14005e760
mov r8, rdi
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0xd0]
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbp + 0xd0]
mov r8, r12
add rcx, rdi
lea rdx, [rbp + 0x90]
call sub.VCRUNTIME140.dll_memcpy
mov r9, qword [rsp + 0x28]
lea edx, [r12 + rsi]
mov r8d, r14d
lea rcx, [rbp + 0xd0]
call fcn.14005e400
mov r12, qword [rsp + 0x2a8]
mov al, 1
mov rdi, qword [rsp + 0x2b0]
mov rsi, qword [rsp + 0x2b8]
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.1402474e0
add rsp, 0x2c0
pop r15
pop r14
pop r13
pop rbx
pop rbp
ret
Function at 0x14010d9f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp dword [0x140359500], 0
mov edi, edx
mov esi, ecx
jne 0x14010da17
call sub.KERNEL32.dll_GetTickCount
mov dword [0x140359500], eax
call fcn.14007c3c0
mov ebx, eax
imul ebx, dword [0x140359500]
call fcn.14007c3d0
mov r8d, eax
xor edx, edx
mov eax, ebx
div r8d
mov dword [0x140359500], edx
mov eax, edx
test edx, edx
jne 0x14010da4b
call sub.KERNEL32.dll_GetTickCount
mov dword [0x140359500], eax
mov r8d, edi
mov edx, esi
mov ecx, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.14007c730
Function at 0x14010e7b0
Capabilities:
Reference google public dns server

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push r14
sub rsp, 0x20
mov esi, ecx
mov r14, r8
mov rcx, rdx
mov rbx, rdx
call fcn.140030e50
mov byte [r14], 0
cmp byte [0x1403594c9], 0
jne 0x14010e888
call fcn.14010db50
mov rcx, qword [0x1403594d0]
test rcx, rcx
je 0x14010e888
cmp qword [0x1403594f8], 0
je 0x14010e888
mov qword [rsp + 0x30], rdi
call fcn.140070000
mov rcx, qword [0x1403594f8]
mov edx, esi
xor dil, dil
call fcn.140070d50
mov rsi, rax
test rax, rax
je 0x14010e862
lea rdx, [rax + 0x10]
mov rcx, rbx
call fcn.14002e390
lea rdx, str.0.0.0.0
mov rcx, rbx
call fcn.140033060
test al, al
je 0x14010e855
lea rdx, str.8.8.8.8
mov rcx, rbx
call fcn.1400377d0
movzx eax, byte [rsi + 0xa0]
mov dil, 1
mov byte [r14], al
mov rcx, qword [0x1403594d0]
call fcn.140070040
movzx eax, dil
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov rbx, qword [rsp + 0x38]
xor al, al
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret

Function at 0x14010ecb0
Capabilities:
Reference google public dns server

Disassembly:
test rcx, rcx
je 0x14010ee46
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
movzx r14d, dl
mov rbp, rcx
cmp byte [0x1403594c9], 0
jne 0x14010ee34
call fcn.14010db50
cmp byte [0x1403594c8], 0
je 0x14010ee34
mov rcx, qword [0x1403594d0]
test rcx, rcx
je 0x14010ee34
cmp qword [0x1403594f8], 0
je 0x14010ee34
call fcn.140070000
mov ecx, 0xb8
call fcn.140247500
mov rdi, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14010ed67
xor edx, edx
mov r8d, 0xb8
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov rcx, rdi
call fcn.14005f990
nop
lea rax, vtable._ckNameserver.0
mov qword [rdi], rax
lea rcx, [rdi + 0x10]
call fcn.14002e000
xor ebx, ebx
mov dword [rdi + 0xa4], ebx
mov dword [rdi + 0xb4], ebx
jmp 0x14010ed6b
xor ebx, ebx
mov edi, ebx
test rdi, rdi
je 0x14010ee28
mov rdx, rbp
lea rcx, [rdi + 0x10]
call fcn.14002e730
lea rcx, [rdi + 0x10]
call fcn.14003a680
lea rdx, str.0.0.0.0
lea rcx, [rdi + 0x10]
call fcn.140033060
test al, al
je 0x14010edad
lea rdx, str.8.8.8.8
lea rcx, [rdi + 0x10]
call fcn.1400377d0
lea rcx, [rdi + 0x10]
call fcn.140033b00
test eax, eax
je 0x14010ee1b
mov byte [rdi + 0xa0], r14b
mov rcx, qword [0x1403594f8]
call fcn.140070f10
mov ebp, eax
test eax, eax
jle 0x14010ee0a
nop dword [rax]
nop word [rax + rax]
mov edx, ebx
mov rcx, qword [0x1403594f8]
call fcn.140070d50
test rax, rax
je 0x14010ee04
lea rcx, [rax + 0x10]
lea rdx, [rdi + 0x10]
call fcn.140033020
test al, al
jne 0x14010ee1b
inc ebx
cmp ebx, ebp
jl 0x14010ede0
mov rdx, rdi
mov rcx, qword [0x1403594f8]
call fcn.1400709b0
jmp 0x14010ee28
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax]
mov rcx, qword [0x1403594d0]
call fcn.140070040
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x140115510
Capabilities:
Generate random numbers via winapi

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x140353c70]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, r8
mov esi, ecx
test ecx, ecx
js 0x140115599
test rbx, rbx
je 0x140115599
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rax
lea r8, str.getEntropy
mov rdx, r9
lea rcx, [rsp + 0x20]
call fcn.14004ce70
nop
call fcn.14007b910
mov rdi, rax
test rax, rax
jne 0x14011556a
xor bl, bl
jmp 0x14011558a
mov r8, rbx
mov edx, esi
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov ebx, eax
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test ebx, ebx
setne bl
lea rcx, [rsp + 0x20]
call fcn.14004d020
movzx eax, bl
jmp 0x14011559b
xor al, al
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1402474e0
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x14012d5f0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rbx, r8
mov rcx, rdx
mov rsi, rdx
call fcn.140030e50
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x14012d642
add rcx, 0xc8
mov r9b, 1
mov qword [rsp + 0x20], rbx
mov r8, rsi
xor edx, edx
call fcn.140084b30
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x14012d662
mov rdx, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp fcn.1401387a0
mov rcx, qword [rdi + 0x20]
test rcx, rcx
je 0x14012d69b
add rcx, 0x550
mov qword [rsp + 0x20], rbx
mov r9b, 1
mov r8, rsi
xor edx, edx
call fcn.140084b30
mov dl, 0x2c
mov rcx, rsi
call fcn.14002eb30
mov rcx, qword [rdi + 0x20]
add rcx, 0x570
jmp 0x14012d620
mov rcx, qword [rdi + 0x28]
test rcx, rcx
je 0x14012d6de
add rcx, 0xa0
call fcn.140042d30
mov rcx, qword [rdi + 0x28]
mov ebx, eax
add rcx, 0xa0
call fcn.1400428d0
mov rcx, rax
mov r8, rsi
mov edx, ebx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp fcn.14007a050
mov rbx, qword [rsp + 0x40]
xor al, al
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140162fd0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xe0
mov rax, qword [0x140353c70]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov r14, r9
mov rbx, r8
mov r15, rdx
mov r12, rcx
xor ecx, ecx
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x34], 1
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
xor sil, sil
test eax, eax
jne 0x14016316d
mov ecx, dword [rsp + 0x30]
test ecx, ecx
je 0x1401631e3
call fcn.14003be80
mov rdi, rax
test rax, rax
je 0x1401631e7
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rdx, r15
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov r12d, eax
test eax, eax
jne 0x1401630ed
mov r8d, dword [rsp + 0x30]
mov eax, dword [rsp + 0x34]
cmp eax, 4
jne 0x1401630b0
cmp r8d, eax
jne 0x1401630d2
mov edx, dword [rdi]
mov rcx, rbx
call fcn.14002e620
mov sil, 1
mov rcx, rdi
call fcn.140247544
jmp 0x1401631e3
dec eax
cmp eax, 1
ja 0x1401630d2
mov rdx, rdi
mov rcx, rbx
call fcn.14002e730
mov sil, 1
mov rcx, rdi
call fcn.140247544
jmp 0x1401631e3
mov rdx, rdi
mov rcx, rbx
call fcn.14002ed50
mov sil, 1
mov rcx, rdi
call fcn.140247544
jmp 0x1401631e3
xorps xmm0, xmm0
movups xmmword [rbp - 0x79], xmm0
movups xmmword [rbp - 0x69], xmm0
movups xmmword [rbp - 0x59], xmm0
movups xmmword [rbp - 0x49], xmm0
movups xmmword [rbp - 0x39], xmm0
movups xmmword [rbp - 0x29], xmm0
movups xmmword [rbp - 0x19], xmm0
movups xmmword [rbp - 9], xmm0
movups xmmword [rbp + 7], xmm0
lea rcx, [rbp - 0x79]
call fcn.14002e000
nop
mov edx, r12d
lea rcx, [rbp - 0x79]
call fcn.14002f7e0
mov rbx, qword [r14]
lea rcx, [rbp - 0x79]
call fcn.140033b70
mov r8, rax
lea rdx, str.RegistryQueryError2
mov rcx, r14
call qword [rbx + 0x58]
mov rax, qword [r14]
mov r8, r15
lea rdx, str.ValueName
mov rcx, r14
call qword [rax + 0x58]
nop
lea rcx, [rbp - 0x79]
call fcn.14002e050
mov rcx, rdi
call fcn.140247544
jmp 0x1401631e3
xorps xmm0, xmm0
movups xmmword [rbp - 0x79], xmm0
movups xmmword [rbp - 0x69], xmm0
movups xmmword [rbp - 0x59], xmm0
movups xmmword [rbp - 0x49], xmm0
movups xmmword [rbp - 0x39], xmm0
movups xmmword [rbp - 0x29], xmm0
movups xmmword [rbp - 0x19], xmm0
movups xmmword [rbp - 9], xmm0
movups xmmword [rbp + 7], xmm0
lea rcx, [rbp - 0x79]
call fcn.14002e000
nop
mov edx, edi
lea rcx, [rbp - 0x79]
call fcn.14002f7e0
mov rbx, qword [r14]
lea rcx, [rbp - 0x79]
call fcn.140033b70
mov r8, rax
lea rdx, str.RegistryQueryError
mov rcx, r14
call qword [rbx + 0x58]
mov r9, qword [r14]
mov r8, r15
lea rdx, str.ValueName
mov rcx, r14
call qword [r9 + 0x58]
nop
lea rcx, [rbp - 0x79]
call fcn.14002e050
movzx eax, sil
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.1402474e0
add rsp, 0xe0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140165c80
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x1b0
mov rax, qword [0x140353c70]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov r15, r9
mov rbx, r8
mov rdi, qword [rsp + 0x200]
xor edx, edx
mov r8d, 0x178
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x20]
call fcn.14004cf80
nop
lea rcx, [r15 + 0x50]
call fcn.140042d30
test eax, eax
jne 0x140165cfa
xor edx, edx
lea r8d, [rax + 0x10]
lea rcx, [r15 + 0x50]
call fcn.14003eb80
mov dword [r15 + 0x48], reloc.WS2_32.dll_inet_ntoa
cmp dword [rbx + 0x554], 0
je 0x140165d0f
lea rdx, str.Not_in_IV_mode.
jmp 0x140165ee2
mov ecx, dword [rbx + 0x558]
cmp ecx, 0xf
ja 0x140165edb
add ecx, dword [r15 + 0x48]
cmp ecx, 0xc
jbe 0x140165d2e
or dword [rbx + 0x550], 1
lea rcx, [r15 + 0x50]
call fcn.1400428d0
mov rsi, rax
xor r12d, r12d
mov edi, r12d
cmp dword [rbx + 0x558], r12d
jne 0x140165daa
test dword [r15 + 0x48], 0xfffffff0
jbe 0x140165da5
nop dword [rax]
nop word [rax + rax]
mov eax, edi
mov rcx, qword [rax + rsi]
xor qword [rbx + 0x510], rcx
lea eax, [rdi + 8]
mov rax, qword [rax + rsi]
xor qword [rbx + 0x518], rax
lea r8, [rsp + 0x20]
lea rdx, [rbx + 0x510]
mov rcx, rbx
call fcn.140167680
sub qword [rbx + 0x560], 0xffffffffffffff80
add edi, 0x10
mov eax, dword [r15 + 0x48]
and eax, 0xfffffff0
cmp edi, eax
jb 0x140165d60
mov eax, edi
add rsi, rax
cmp edi, dword [r15 + 0x48]
jae 0x140165ed7
movsxd rcx, dword [rbx + 0x558]
movzx eax, byte [rsi]
mov byte [rcx + rbx + 0x540], al
inc dword [rbx + 0x558]
lea rsi, [rsi + 1]
cmp dword [rbx + 0x558], 0x10
jne 0x140165ecb
lea rdx, [rbx + 0x510]
movzx eax, byte [rbx + 0x540]
xor byte [rdx], al
movzx eax, byte [rbx + 0x541]
xor byte [rbx + 0x511], al
movzx eax, byte [rbx + 0x542]
xor byte [rbx + 0x512], al
movzx eax, byte [rbx + 0x543]
xor byte [rbx + 0x513], al
movzx eax, byte [rbx + 0x544]
xor byte [rbx + 0x514], al
movzx eax, byte [rbx + 0x545]
xor byte [rbx + 0x515], al
movzx eax, byte [rbx + 0x546]
xor byte [rbx + 0x516], al
movzx eax, byte [rbx + 0x547]
xor byte [rbx + 0x517], al
movzx eax, byte [rbx + 0x548]
xor byte [rbx + 0x518], al
movzx eax, byte [rbx + 0x549]
xor byte [rbx + 0x519], al
movzx eax, byte [rbx + 0x54a]
xor byte [rbx + 0x51a], al
movzx eax, byte [rbx + 0x54b]
xor byte [rbx + 0x51b], al
movzx eax, byte [rbx + 0x54c]
xor byte [rbx + 0x51c], al
movzx eax, byte [rbx + 0x54d]
xor byte [rbx + 0x51d], al
movzx eax, byte [rbx + 0x54e]
xor byte [rbx + 0x51e], al
movzx eax, byte [rbx + 0x54f]
xor byte [rbx + 0x51f], al
lea r8, [rsp + 0x20]
mov rcx, rbx
call fcn.140167680
mov dword [rbx + 0x558], r12d
sub qword [rbx + 0x560], 0xffffffffffffff80
inc edi
cmp edi, dword [r15 + 0x48]
jb 0x140165db4
mov bl, 1
jmp 0x140165eed
lea rdx, str.buflen_error.
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x28]
xor bl, bl
lea rcx, [rsp + 0x20]
call fcn.14004d070
movzx eax, bl
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.1402474e0
lea r11, [rsp + 0x1b0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret