joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140045050
Capabilities:
Set environment variable

Disassembly:
push rbx
push r14
push r15
sub rsp, 0xa0
mov rax, qword [0x140084340]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rax, qword [0x140087da8]
mov rbx, r8
mov r14, rdx
mov r15, rcx
test rax, rax
jne 0x1400450a1
lea rcx, [0x1400661f4]
call qword [sym.imp.python311.dll_PyImport_ImportModule]
mov qword [0x140087da8], rax
test rax, rax
je 0x140045254
mov qword [rsp + 0xd8], rbp
lea rdx, str.environ
mov qword [rsp + 0x98], rsi
mov rcx, rax
mov qword [rsp + 0x90], rdi
call qword [sym.imp.python311.dll_PyObject_GetAttrString]
mov rcx, r14
mov rdi, rax
call qword [sym.imp.python311.dll_PyUnicode_FromString]
mov rbp, rax
test rbx, rbx
je 0x14004513e
mov rdx, rbx
mov rcx, r14
call fcn.140044e70
mov rdx, 0xffffffffffffffff
mov rcx, rbx
call qword [sym.imp.python311.dll_PyUnicode_FromWideChar]
mov rdx, rbp
mov rcx, rdi
mov r8, rax
mov rbx, rax
call qword [sym.imp.python311.dll_PyObject_SetItem]
test eax, eax
je 0x140045125
mov ecx, 1
call qword [sym.imp.python311.dll_PyErr_PrintEx]
mov ecx, 1
call qword [sym.imp.python311.dll_Py_Exit]
int3
sub qword [rbx], 1
jne 0x1400451f8
mov rax, qword [rbx + 8]
mov rcx, rbx
call qword [rax + 0x30]
jmp 0x1400451f8
movzx edx, byte [r14]
lea rbx, [rsp + 0x30]
xor eax, eax
mov word [rsp + 0x30], ax
lea esi, [rax + 0x28]
test dl, dl
je 0x1400451d3
nop word [rax + rax]
cmp word [rbx], 0
mov rcx, rsi
mov rax, rbx
je 0x14004517d
nop dword [rax]
add rax, 2
dec rcx
cmp word [rax], 0
jne 0x140045170
cmp rcx, 1
jb 0x14004524e
mov byte [rsp + 0x20], dl
mov rcx, 0xffffffffffffffff
mov byte [rsp + 0x21], 0
nop word [rax + rax]
cmp word [rax + rcx*2 + 2], 0
lea rcx, [rcx + 1]
jne 0x1400451a0
lea rcx, [rax + rcx*2]
mov r8d, 2
lea rdx, [rsp + 0x20]
call fcn.1400547d4
movzx edx, byte [r14 + 1]
inc r14
add rbx, 2
dec rsi
test dl, dl
jne 0x140045160
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.python311.dll_PyObject_DelItem]
test eax, eax
je 0x1400451f8
mov rcx, r15
call fcn.14002f210
sub qword [rbp], 1
jne 0x140045209
mov rax, qword [rbp + 8]
mov rcx, rbp
call qword [rax + 0x30]
sub qword [rdi], 1
jne 0x140045219
mov rax, qword [rdi + 8]
mov rcx, rdi
call qword [rax + 0x30]
mov rsi, qword [rsp + 0x98]
mov rbp, qword [rsp + 0xd8]
mov rdi, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400452f0
add rsp, 0xa0
pop r15
pop r14
pop rbx
ret
call fcn.140049980
int3
call fcn.140049980
int3

Function at 0x140045d58
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140045da2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140045da2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140045da2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140045da2
cmp dword [rcx + 0x84], 0xe
jbe 0x140045da2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140045da4
xor al, al
add rsp, 0x28
ret
Function at 0x14004ade0
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14004ac4b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14004ac4b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14004ac4b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14004ac4b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14004ac4b
cmp dword [rcx + 0x84], 0xe
jbe 0x14004ac4b
cmp dword [rcx + 0xf8], 0
je 0x14004ac4b
mov ecx, ebx
call fcn.14004acfc
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14004aad8
nop
cmp dword [rbp + 0x20], 0
je 0x14004ac99
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14004aca4
int3
xor r8d, r8d
xor edx, edx
jmp 0x14004abdc
Function at 0x14005c530
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14005c5b7
mov rsi, rbx
cmp word [rax], bp
je 0x14005c576
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x14005c560
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14005c55c
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140057ccc
mov rdi, rax
test rax, rax
je 0x14005c5a4
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.1400621f0
mov rbp, rdi
xor ecx, ecx
call fcn.1400586dc
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14005fcd0
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14005fce6
mov al, 1
jmp 0x14005fd46
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14005fcf7
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14005fd44
mov ecx, dword [rcx + 0x18]
nop
call fcn.14005c878
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14005fd44
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14005fd44
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14005fd44
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14005fd46
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x140062040
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140062068
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140062068
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1405ed058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1405ed1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1405ed089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405ed06f
add dl, dl
jne 0x1405ed096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405ed0f6
xor eax, eax
add dl, dl
jne 0x1405ed0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405ed1ad
add dl, dl
jne 0x1405ed0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405ed0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405ed0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405ed0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1405ed0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1405ed07e
mov eax, 1
add dl, dl
jne 0x1405ed106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405ed113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1405ed0fb
sub eax, ebx
mov ebx, 1
jne 0x1405ed14c
mov ecx, 1
add dl, dl
jne 0x1405ed12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1405ed13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1405ed123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1405ed07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1405ed168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1405ed175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1405ed15d
cmp eax, 0x7d00
jae 0x1405ed19b
cmp eax, 0x500
jb 0x1405ed196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1405ed07e
cmp eax, 0x7f
ja 0x1405ed19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1405ed07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1405ed1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1405ed07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400111f9
Capabilities:
Terminate process

Disassembly:
jmp 0x140012e90
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140011285
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400141e0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014200
xor al, al
jmp 0x140014281
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014213
xor al, al
jmp 0x140014281
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001423d
xor al, al
jmp 0x140014281
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014251
xor al, al
jmp 0x140014281
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014263
xor al, al
jmp 0x140014281
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001427f
xor al, al
jmp 0x140014281
mov al, 1
add rsp, 0x38
ret
Function at 0x14000a740
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rax, rdx
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x14000a7d0
cmp r10, r11
jb 0x14000a846
cmp r10, rdx
ja 0x14000a85a
add r11, r9
xor r15d, r15d
nop word cs:[rax + rax]
cmp r14, r15
je 0x14000a7d2
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x14000a7b0
jmp 0x14000a834
ja 0x14000a7da
mov r11, r10
cmp rax, r8
jne 0x14000a774
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x14000a810
mov rdi, r8
sub ecx, edx
jns 0x14000a82b
jmp 0x14000a836
cmp r8, rsi
je 0x14000a86b
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x14000a836
xor al, 1
cmp rdi, rsi
jne 0x14000a7f0
jmp 0x14000a836
xor eax, eax
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.14011e340
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.14011e120
ud2
lea rcx, str.called__Option::unwrap____on_a__None__valueC:UsersAdministrator.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.28.2_src_syncmpsclist.rs
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.14011e130
ud2
Function at 0x140017970
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x78
mov rsi, rdx
cmp dword [rcx], 2
jne 0x140017a06
movdqu xmm0, xmmword [rcx + 8]
pshufd xmm1, xmm0, 0x44
pxor xmm1, xmmword [0x140128670]
movdqa xmmword [rsp + 0x30], xmm1
pshufd xmm1, xmm0, 0xee
pxor xmm1, xmmword [0x140128680]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmmword [rsp + 0x50], xmm0
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov rdi, qword [rsi + 0x18]
xor eax, eax
test rdi, rdi
setne al
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.14001cc00
test rdi, rdi
je 0x140017a95
mov rdx, qword [rsi]
mov r8, qword [rsi + 8]
lea rcx, [rsp + 0x30]
jmp 0x140017aad
mov rdx, qword [rsi + 0x18]
xor ecx, ecx
test rdx, rdx
setne cl
movabs rax, 0xcbf29ce484222325
xor rax, rcx
movabs rcx, 0x1efac7090aef4a21
imul rax, rcx
test rdx, rdx
je 0x140017ba5
mov r9, qword [rsi + 8]
test r9, r9
je 0x140017c28
mov rcx, qword [rsi]
movabs rdx, 0x100000001b3
mov r10, r9
and r10, 7
je 0x140017bb4
mov r11, rax
mov r8, rcx
nop word cs:[rax + rax]
movzx eax, byte [r8]
inc r8
xor rax, r11
imul rax, rdx
mov r11, rax
dec r10
jne 0x140017a70
cmp r9, 8
jae 0x140017bbd
jmp 0x140017c28
movzx eax, byte [rsi]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.14001cc00
mov rcx, qword [rsp + 0x40]
mov r9, qword [rsp + 0x60]
shl r9, 0x38
or r9, qword [rsp + 0x68]
mov rax, qword [rsp + 0x48]
mov r8, qword [rsp + 0x30]
add r8, rcx
rol rcx, 0xd
xor rax, r9
xor rcx, r8
rol r8, 0x20
mov rdx, qword [rsp + 0x38]
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rax, r8
xor rcx, rdx
rol rdx, 0x20
xor r8, r9
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
xor rdx, 0xff
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
add rdx, rax
shl rax, 0x10
xor rax, rdx
shr rax, 0x2b
add rdx, rcx
shr rcx, 0x2f
xor rcx, rax
mov rax, rdx
shr rax, 0x20
xor rax, rdx
xor rax, rcx
jmp 0x140017c28
movzx edx, byte [rsi]
xor rax, rdx
imul rax, rcx
jmp 0x140017c28
mov r8, rcx
cmp r9, 8
jb 0x140017c28
add rcx, r9
movzx r9d, byte [r8]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 1]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 2]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 3]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 4]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 5]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 6]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 7]
add r8, 8
xor rax, r9
imul rax, rdx
cmp r8, rcx
jne 0x140017bc0
and eax, 0x7fff
add rsp, 0x78
pop rdi
pop rsi
ret
Function at 0x14001a9e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov r9, r8
mov r8, qword [rdx + 8]
mov r11d, dword [rdx]
mov r10d, dword [rdx + 4]
mov dword [rsp + 0x20], r11d
lea rax, [rsp + 0x24]
mov dword [rsp + 0x24], r10d
cmp qword [r8 + 0x20], r11
jbe 0x14001aa7a
mov rdi, qword [r8 + 0x18]
test rdi, rdi
je 0x14001aa7a
imul rbx, r11, 0x130
cmp dword [rdi + rbx + 0x88], 2
je 0x14001aa7a
lea rsi, [rdi + rbx]
cmp dword [rsi + 0xb8], r10d
jne 0x14001aa7a
mov ebp, dword [rsi + 0x4c]
xor edx, edx
test ebp, ebp
cmovg edx, ebp
jle 0x14001aa70
add rdi, rbx
add rdi, 0x88
mov dword [rsp + 0x20], r11d
mov dword [rsp + 0x24], r10d
cmp dword [rdi], 2
je 0x14001aac5
cmp dword [rsi + 0xb8], r10d
jne 0x14001aac5
sub dword [rsi + 0x4c], edx
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
jmp fcn.14001a4f0
nop
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
ret
mov qword [rsp + 0x28], rax
lea rax, [0x14000fa70]
mov qword [rsp + 0x30], rax
lea rax, str.dangling_store_key_for_stream_id
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], 1
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x28]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 1
lea rdx, [0x14012acf8]
jmp 0x14001ab0e
mov qword [rsp + 0x28], rax
lea rax, [0x14000fa70]
mov qword [rsp + 0x30], rax
lea rax, str.dangling_store_key_for_stream_id
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], 1
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x28]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 1
lea rdx, [0x14012ad10]
lea rcx, [rsp + 0x38]
call fcn.14011e050
ud2
Function at 0x14001cc00
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x14001cc42
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 3
jbe 0x14001cc4a
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x14001cc5b
jmp 0x14001cc72
xor r10d, r10d
jmp 0x14001ccfd
xor r9d, r9d
xor esi, esi
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x14001cc72
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x14001cc89
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x14001cca9
add r11, r8
jmp 0x14001cdda
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x14001cd72
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x14001cd20
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 3
jbe 0x14001cd90
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x14001cda2
jmp 0x14001cdbc
xor r8d, r8d
xor r9d, r9d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x14001cdbc
lea rcx, [r8 + r10]
movzx esi, word [rdx + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x14001cdd6
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400766c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x100
mov r9, r8
mov r8, rdx
mov rsi, rcx
mov qword [rsp + 0xf8], 0
mov qword [rsp + 0xd8], 0
mov qword [rsp + 0xe8], 0
lea rcx, [rsp + 0x80]
lea rdx, [rsp + 0xd8]
call fcn.1400fa5e0
mov edi, dword [rsp + 0x98]
cmp edi, 2
jne 0x1400767c1
movzx ebx, byte [rsp + 0x80]
mov rcx, qword [0x140195bd0]
test rcx, rcx
jne 0x140076749
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x140076918
mov rcx, rax
mov qword [0x140195bd0], rax
mov r8d, 1
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapAlloc]
test rax, rax
je 0x140076918
mov rdi, rax
mov byte [rax], bl
mov rcx, qword [0x140195bd0]
test rcx, rcx
jne 0x14007678a
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x140076907
mov rcx, rax
mov qword [0x140195bd0], rax
mov r8d, 0x70
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapAlloc]
test rax, rax
je 0x140076907
mov qword [rax], rdi
lea rcx, [0x140155ef8]
mov qword [rax + 8], rcx
mov dword [rax + 0x28], 2
mov word [rax + 0x68], 0
jmp 0x1400768f2
mov rbx, qword [rsp + 0x80]
movups xmm0, xmmword [rsp + 0x88]
movaps xmmword [rsp + 0x70], xmm0
movups xmm0, xmmword [rsp + 0x9c]
movaps xmmword [rsp + 0x40], xmm0
movups xmm0, xmmword [rsp + 0xac]
movaps xmmword [rsp + 0x50], xmm0
mov eax, dword [rsp + 0xbc]
mov dword [rsp + 0x60], eax
movzx eax, byte [rsp + 0xc0]
movups xmm0, xmmword [rsp + 0xc1]
movaps xmmword [rsp + 0x20], xmm0
mov rcx, qword [rsp + 0xd0]
mov qword [rsp + 0x2f], rcx
test al, al
je 0x140076863
mov qword [rsi], rbx
movaps xmm0, xmmword [rsp + 0x70]
movups xmmword [rsi + 8], xmm0
mov dword [rsi + 0x18], edi
movaps xmm0, xmmword [rsp + 0x40]
movaps xmm1, xmmword [rsp + 0x50]
movups xmmword [rsi + 0x1c], xmm0
movups xmmword [rsi + 0x2c], xmm1
mov ecx, dword [rsp + 0x60]
mov dword [rsi + 0x3c], ecx
mov byte [rsi + 0x40], al
movaps xmm0, xmmword [rsp + 0x20]
movups xmmword [rsi + 0x41], xmm0
mov rax, qword [rsp + 0x2f]
mov qword [rsi + 0x50], rax
jmp 0x1400768fc
mov rcx, qword [0x140195bd0]
test rcx, rcx
jne 0x140076888
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x140076907
mov rcx, rax
mov qword [0x140195bd0], rax
mov r8d, 0x70
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapAlloc]
test rax, rax
je 0x140076907
mov qword [rax], 1
lea rcx, [0x1401561c8]
mov qword [rax + 8], rcx
mov word [rax + 0x68], 0
mov qword [rax + 0x10], rbx
movaps xmm0, xmmword [rsp + 0x70]
movups xmmword [rax + 0x18], xmm0
mov dword [rax + 0x28], edi
movaps xmm0, xmmword [rsp + 0x40]
movaps xmm1, xmmword [rsp + 0x50]
movups xmmword [rax + 0x2c], xmm0
movups xmmword [rax + 0x3c], xmm1
mov ecx, dword [rsp + 0x60]
mov dword [rax + 0x4c], ecx
mov byte [rax + 0x50], 0
movaps xmm0, xmmword [rsp + 0x20]
movups xmmword [rax + 0x51], xmm0
mov rcx, qword [rsp + 0x2f]
mov qword [rax + 0x60], rcx
mov qword [rsi], rax
mov dword [rsi + 0x18], 2
add rsp, 0x100
pop rbx
pop rdi
pop rsi
ret
mov ecx, 0x70
mov edx, 8
call fcn.14011dd70
ud2
mov ecx, 1
mov edx, 1
call fcn.14011dd70
ud2
Function at 0x140077f60
Capabilities:
Generate random numbers via winapi

Disassembly:
sub rsp, 0x38
test rcx, rcx
je 0x140077f81
mov r8, qword [rcx]
mov rax, qword [rcx + 8]
mov rdx, qword [rcx + 0x10]
mov qword [rcx], 0
cmp r8, 1
je 0x140077fb7
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x10
mov r9d, 2
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
js 0x140077fb2
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
jmp 0x140077fb7
call fcn.1400e80b0
mov ecx, dword [0x140195c60]
mov r8, qword gs:[0x58]
mov rcx, qword [r8 + rcx*8]
mov qword [rcx + 0x48], 1
mov qword [rcx + 0x50], rax
mov qword [rcx + 0x58], rdx
add rsp, 0x38
ret
Function at 0x1400a5740
Capabilities:
Get number of processors

Disassembly:
push rsi
push rdi
sub rsp, 0xb8
movaps xmmword [rsp + 0xa0], xmm6
mov rsi, rcx
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
movaps xmmword [rsp + 0x40], xmm1
movaps xmmword [rsp + 0x30], xmm0
mov rdi, qword [rcx + 8]
mov eax, dword [0x140195c60]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rcx, qword [rax + 0xd0]
lea rax, [rax + 0xd8]
test rcx, rcx
cmove rax, rcx
je 0x1400a57aa
test rax, rax
je 0x1400a57b6
movups xmm6, xmmword [rax + 0x20]
mov qword [rax + 0x20], 1
mov qword [rax + 0x28], rdi
jmp 0x1400a57b9
xor ecx, ecx
call fcn.1400f2bf0
test rax, rax
jne 0x1400a5798
xorps xmm6, xmm6
lea rdi, [rsi + 0x10]
movzx eax, byte [rsi + 0x80]
lea ecx, [rax - 3]
movzx edx, cl
lea r8, [rdx + 1]
xor ecx, ecx
cmp dl, 2
cmovb rcx, r8
cmp rcx, 1
je 0x1400a57f0
test rcx, rcx
jne 0x1400a582e
cmp al, 2
je 0x1400a582e
mov rcx, rdi
call fcn.140042dd0
jmp 0x1400a582e
cmp qword [rdi], 0
je 0x1400a582e
mov rcx, qword [rsi + 0x18]
test rcx, rcx
je 0x1400a582e
mov rax, qword [rsi + 0x20]
call qword [rax]
mov rax, qword [rsi + 0x20]
cmp qword [rax + 8], 0
je 0x1400a582e
mov r8, qword [rsi + 0x18]
cmp qword [rax + 0x10], 0x11
jb 0x1400a581f
mov r8, qword [r8 - 8]
mov rcx, qword [0x140195bd0]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
movaps xmm0, xmmword [rsp + 0x90]
movups xmmword [rdi + 0x60], xmm0
movaps xmm0, xmmword [rsp + 0x80]
movups xmmword [rdi + 0x50], xmm0
movaps xmm0, xmmword [rsp + 0x70]
movups xmmword [rdi + 0x40], xmm0
movaps xmm0, xmmword [rsp + 0x30]
movaps xmm1, xmmword [rsp + 0x40]
movaps xmm2, xmmword [rsp + 0x50]
movaps xmm3, xmmword [rsp + 0x60]
movups xmmword [rdi + 0x30], xmm3
movups xmmword [rdi + 0x20], xmm2
movups xmmword [rdi + 0x10], xmm1
movups xmmword [rdi], xmm0
mov byte [rsi + 0x80], 3
mov eax, dword [rsp + 0x29]
mov ecx, dword [rsp + 0x2c]
mov dword [rsi + 0x84], ecx
mov dword [rsi + 0x81], eax
mov eax, dword [0x140195c60]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rcx, qword [rax + 0xd0]
lea rax, [rax + 0xd8]
test rcx, rcx
cmove rax, rcx
jne 0x1400a58be
xor ecx, ecx
call fcn.1400f2bf0
test rax, rax
je 0x1400a58c7
movups xmmword [rax + 0x20], xmm6
movaps xmm6, xmmword [rsp + 0xa0]
add rsp, 0xb8
pop rdi
pop rsi
ret