joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14009c9e0
Capabilities:
Terminate process

Disassembly:
jmp 0x14009c9e0
sub rsp, 0x28
mov rcx, qword [rcx]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x14009c9fd
xor eax, eax
add rsp, 0x28
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
add rsp, 0x28
ret

Function at 0x14009dec0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
mov eax, 0x10a8
call fcn.1400bd100
sub rsp, rax
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x1010], xmm6
mov qword [rbp + 0x1008], 0xfffffffffffffffe
mov rsi, rdx
mov rbx, rcx
mov qword [rbp + 0xfc0], rcx
mov qword [rbp + 0xfc8], rdx
lea rdi, [rbp - 0x50]
mov r8d, 0x1000
mov rcx, rdi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rbp + 0xff8], 0
xorps xmm6, xmm6
movaps xmmword [rbp + 0xfd0], xmm6
mov qword [rbp + 0xfe0], 0
lea rax, [rbp + 0xff8]
mov qword [rbp + 0xfe8], rax
lea r14, [0x1400a5ba0]
mov qword [rsp + 0x20], r14
lea r9, [rbp + 0xfd0]
mov rcx, rbx
mov rdx, rdi
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_ReadFileEx]
test eax, eax
je 0x14009e0e5
mov r15, qword [sym.imp.KERNEL32.dll_SleepEx]
mov r13d, 0xffffffff
lea r12, [rbp + 0xfd0]
mov qword [rbp + 0xff0], rbx
mov ecx, 0xffffffff
mov edx, 1
call r15
cmp dword [rbp + 0xff8], 1
jne 0x14009df90
cmp dword [rbp + 0xffc], 0
jne 0x14009e0fa
mov eax, dword [rbp + 0x1000]
mov edi, eax
mov qword [rbp + 0xfb0], 0
mov qword [rbp + 0xfb8], rdi
test eax, eax
je 0x14009e0fa
cmp eax, 0x1000
ja 0x14009e13a
xor ebx, ebx
nop word cs:[rax + rax]
cmp rbx, rdi
ja 0x14009e126
lea rdx, [rbx + rbp]
add rdx, 0xffffffffffffffb0
mov r8, rdi
sub r8, rbx
cmp r8, r13
cmovae r8, r13
mov dword [rbp + 0xff8], 0
movaps xmmword [rbp + 0xfd0], xmm6
mov qword [rbp + 0xfe0], 0
lea rax, [rbp + 0xff8]
mov qword [rbp + 0xfe8], rax
mov qword [rsp + 0x20], r14
mov rcx, rsi
mov r9, r12
call qword [sym.imp.KERNEL32.dll_WriteFileEx]
test eax, eax
je 0x14009e0ed
nop word cs:[rax + rax]
mov ecx, 0xffffffff
mov edx, 1
call r15
cmp dword [rbp + 0xff8], 1
jne 0x14009e060
cmp dword [rbp + 0xffc], 0
jne 0x14009e0f3
mov eax, dword [rbp + 0x1000]
add rbx, rax
cmp rbx, rdi
jne 0x14009dff0
mov dword [rbp + 0xff8], 0
movaps xmmword [rbp + 0xfd0], xmm6
mov qword [rbp + 0xfe0], 0
lea rax, [rbp + 0xff8]
mov qword [rbp + 0xfe8], rax
mov qword [rsp + 0x20], r14
mov rbx, qword [rbp + 0xff0]
mov rcx, rbx
lea rdx, [rbp - 0x50]
mov r8d, 0x1000
mov r9, r12
call qword [sym.imp.KERNEL32.dll_ReadFileEx]
test eax, eax
jne 0x14009df90
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14009e0fa
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rbx, qword [rbp + 0xff0]
mov rdi, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call rdi
mov rcx, rsi
call rdi
movaps xmm6, xmmword [rbp + 0x1010]
add rsp, 0x10a8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea r8, str.library_std_src_syswindowspipe.rs
mov rcx, rbx
mov rdx, rdi
call fcn.1400c2d10
jmp 0x14009e14e
lea r8, str.library_std_src_syswindowspipe.rs
mov edx, 0x1000
mov rcx, rdi
call fcn.1400c2d00
ud2
Function at 0x1400a33e0
Capabilities:
Create udp socket

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov edi, r8d
mov rsi, rcx
cmp word [rdx], 0
mov eax, 2
mov ebx, reloc.WS2_32.dll_socket
cmove ebx, eax
mov dword [rsp + 0x28], 0x81
mov dword [rsp + 0x20], 0
mov ecx, ebx
mov edx, r8d
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_WSASocketW]
cmp rax, 0xffffffffffffffff
je 0x1400a3435
mov qword [rsi + 8], rax
mov qword [rsi], 0
jmp 0x1400a34d1
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2726
je 0x1400a3449
cmp eax, 0x2739
jne 0x1400a349a
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0
mov ecx, ebx
mov edx, edi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_WSASocketW]
cmp rax, 0xffffffffffffffff
je 0x1400a3494
mov rdi, rax
mov rcx, rax
mov edx, 1
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x1400a34af
mov qword [rsi + 8], rdi
mov qword [rsi], 0
jmp 0x1400a34d1
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
jmp 0x1400a34d1
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
mov rax, rsi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400a9de0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rsi, rcx
lea rcx, [rbp - 0x30]
call fcn.1400a4c10
mov rdi, qword [rbp - 0x28]
test rdi, rdi
je 0x1400a9e2f
mov rbx, qword [rbp - 0x30]
mov r14, qword [rbp - 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400a9e9a
mov qword [rsi], rbx
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], r14
jmp 0x1400a9e8f
mov rdx, qword [rbp - 0x30]
mov eax, edx
and eax, 3
cmp eax, 1
jne 0x1400a9e87
lea rax, [rdx - 1]
mov qword [rbp - 0x18], rax
mov rcx, qword [rdx - 1]
mov qword [rbp - 0x10], rdx
mov rax, qword [rdx + 7]
call qword [rax]
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 7]
mov rdx, qword [rax + 8]
test rdx, rdx
mov rdi, qword [rbp - 0x18]
je 0x1400a9e74
mov r8, qword [rax + 0x10]
mov rcx, qword [rdi]
call fcn.140051dd0
mov edx, 0x18
mov r8d, 8
mov rcx, rdi
call fcn.140051dd0
mov qword [rsi + 8], 0
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov qword [rsi + 8], 0
test rbx, rbx
je 0x1400a9e8f
add rbx, rbx
mov r8d, 2
mov rcx, rdi
mov rdx, rbx
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
jmp fcn.140051dd0

Function at 0x1400aaa20
Capabilities:
Generate random numbers via winapi

Disassembly:
push rsi
sub rsp, 0x80
mov dword [rsp + 0x28], ecx
mov rsi, qword [0x1401002a0]
mov qword [rsp + 0x30], rsi
test rsi, rsi
jne 0x1400aaa82
lea rdx, [0x1400d03de]
lea rcx, [rsp + 0x30]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.bcrypt.dll_BCryptOpenAlgorithmProvider]
test eax, eax
js 0x1400aaab8
mov rcx, qword [rsp + 0x30]
xor eax, eax
lock cmpxchg qword [0x1401002a0], rcx
jne 0x1400aaa72
mov rsi, qword [rsp + 0x30]
jmp 0x1400aaa82
mov rsi, rax
mov rcx, qword [rsp + 0x30]
xor edx, edx
call qword [sym.imp.bcrypt.dll_BCryptCloseAlgorithmProvider]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
mov rcx, rsi
mov r8d, reloc.WS2_32.dll_recv
xor r9d, r9d
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
js 0x1400aaab8
mov rax, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
add rsp, 0x80
pop rsi
ret
mov dword [rsp + 0x2c], eax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x60], rax
lea rax, [0x1400bb830]
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x2c]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rax
lea rax, [0x1400d0430]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 2
lea rax, reloc.WS2_32.dll_bind
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 2
lea rax, [rsp + 0x60]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 2
lea rdx, str.library_std_src_syswindows_rand.rsRNG_broken:___fallback_RNG_broken:
lea rcx, [rsp + 0x30]
call fcn.1400c2820
ud2
Function at 0x1400ab1a0
Capabilities:
Create thread

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, r8
mov rbx, rdx
mov r14, rcx
mov qword [rbp - 0x20], rdx
mov qword [rbp - 0x18], r8
mov ecx, reloc.WS2_32.dll_recv
mov edx, 8
call fcn.140051dc0
mov rsi, rax
test rax, rax
je 0x1400ab27a
mov qword [rsi], rbx
mov qword [rsi + 8], rdi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x1400ab300]
xor edi, edi
xor ecx, ecx
mov rdx, r14
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x1400ab26c
mov rcx, qword [rsi]
mov rax, qword [rsi + 8]
mov qword [rbp - 0x10], rsi
call qword [rax]
mov rsi, qword [rbp - 0x10]
mov rax, qword [rsi + 8]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x1400ab244
mov r8, qword [rax + 0x10]
mov rcx, qword [rsi]
call fcn.140051dd0
mov edx, reloc.WS2_32.dll_recv
mov r8d, 8
mov rcx, rsi
call fcn.140051dd0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov edi, 1
mov rax, rdi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov qword [rbp - 0x10], rsi
mov ecx, reloc.WS2_32.dll_recv
mov edx, 8
call fcn.1400c2780
ud2

Function at 0x1400ad2f0
Capabilities:
Resolve dns

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x1f0
mov rsi, rcx
mov rdi, qword [rdx]
mov rbx, qword [rdx + 8]
movzx r14d, word [rdx + 0x10]
mov rax, qword [0x140100278]
cmp rax, 3
jne 0x1400ad3e7
cmp rbx, 0x17f
ja 0x1400ad3f9
lea rbp, [rsp + 0x70]
mov rcx, rbp
mov rdx, rdi
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rbx + 0x70], 0
inc rbx
lea rcx, [rsp + 0x28]
mov rdx, rbp
mov r8, rbx
call fcn.1400b6120
cmp qword [rsp + 0x28], 0
je 0x1400ad374
lea rax, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
jmp 0x1400ad40a
mov rcx, qword [rsp + 0x30]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x48], 1
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x40]
lea r9, [rsp + 0x20]
xor edx, edx
call qword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
je 0x1400ad3ce
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
jmp 0x1400ad40a
mov rax, qword [rsp + 0x20]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], r14w
xor eax, eax
mov qword [rsi], rax
jmp 0x1400ad40a
call fcn.1400c1d60
cmp rbx, 0x17f
jbe 0x1400ad32a
mov rcx, rsi
mov rdx, rdi
mov r8, rbx
mov r9d, r14d
call fcn.1400c1e40
mov rax, rsi
add rsp, 0x1f0
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x1400bb020
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
test r8, r8
je 0x1400bb09a
mov r11, rdx
mov rdx, qword [rsp + 0x70]
mov ebp, ecx
shr ebp, 8
lea r8, [r11 + r8*2]
xor eax, eax
mov rbx, r11
movzx edi, byte [r11 + 1]
add r11, 2
lea r10, [rax + rdi]
cmp byte [rbx], bpl
jne 0x1400bb090
cmp r10, rax
jb 0x1400bb12d
cmp r10, rdx
ja 0x1400bb141
add rax, r9
xor ebx, ebx
nop dword [rax]
cmp rdi, rbx
je 0x1400bb092
lea rsi, [rbx + 1]
cmp byte [rax + rbx], cl
mov rbx, rsi
jne 0x1400bb070
jmp 0x1400bb102
ja 0x1400bb09a
mov rax, r10
cmp r11, r8
jne 0x1400bb040
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x1400bb106
mov rsi, qword [rsp + 0x78]
add rdx, rsi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea rbx, [rsi + 1]
movzx edi, byte [rsi]
test dil, dil
js 0x1400bb0e0
mov rsi, rbx
sub ecx, edi
jns 0x1400bb0f9
jmp 0x1400bb108
cmp rbx, rdx
je 0x1400bb113
movzx ebp, byte [rsi + 1]
add rsi, 2
and edi, 0x7f
shl edi, 8
or edi, ebp
sub ecx, edi
js 0x1400bb108
xor al, 1
cmp rsi, rdx
jne 0x1400bb0c0
jmp 0x1400bb108
xor eax, eax
jmp 0x1400bb108
mov al, 1
and al, 1
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
lea rcx, [0x1400d20c9]
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.1400c2900
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, rax
mov rdx, r10
call fcn.1400c2d10
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.1400c2d00
ud2

Function at 0x1400bd610
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400bd65a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400bd65a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400bd65a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400bd65a
cmp dword [rcx + 0x84], 0xe
jbe 0x1400bd65a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400bd65c
xor al, al
add rsp, 0x28
ret
Function at 0x1400c15a0
Capabilities:
Link many functions at runtime

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
lea rcx, str.api_ms_win_core_synch_l1_2_0.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1400c1604
mov rsi, rax
lea rdx, [0x1400cd509]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400c1604
mov rbx, rax
lea rdx, [0x1400cd517]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400c1604
mov rsi, rax
mov eax, 1
jmp 0x1400c1690
lea rcx, [0x1400cd52b]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1400c1711
mov rdi, rax
lea rdx, [0x1400cd535]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400c1711
mov rbx, rax
lea rdx, [0x1400cd548]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400c1711
mov rsi, rax
lea rdx, [0x1400cd55c]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400c1711
mov rdi, rax
lea rcx, [rbp - 0x28]
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call rbx
test eax, eax
jne 0x1400c1711
mov rbx, qword [rbp - 0x28]
xor eax, eax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], rsi
mov qword [rbp - 0x10], rdi
mov ecx, 0x20
mov edx, 8
call fcn.140051dc0
test rax, rax
je 0x1400c172b
mov rcx, rax
movups xmm0, xmmword [rbp - 0x28]
movups xmm1, xmmword [rbp - 0x18]
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
xor eax, eax
lock cmpxchg qword [0x1401001a8], rcx
je 0x1400c1705
mov rsi, rax
cmp qword [rcx], 0
mov qword [rbp - 8], rcx
jne 0x1400c16ee
mov rax, qword [rbp - 8]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0x20
mov r8d, 8
mov rcx, qword [rbp - 8]
call fcn.140051dd0
mov rcx, rsi
mov rax, rcx
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop rbp
ret
lea rcx, str.parking_lot_requires_either_NT_Keyed_Events__WinXP__or_WaitOnAddress_WakeByAddress__Win8_C:UsersMiku.cargo_registry_srcgithub.com_1ecc6299db9ec823parking_lot_core_0.9.5_src_thread_parkerwindowsmod.rs_
lea r8, [0x1400cd4d0]
mov edx, 0x5b
call fcn.1400c17d0
jmp 0x1400c173a
mov ecx, 0x20
mov edx, 8
call fcn.1400c2780
ud2
Function at 0x1400c1e40
Capabilities:
Resolve dns

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov ebp, r9d
mov rsi, rcx
lea rcx, [rsp + 0x30]
call fcn.1400b51c0
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400c1e9f
lea rax, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
mov rdx, qword [rsp + 0x38]
test rdx, rdx
je 0x1400c1f18
mov r8, rdx
not r8
shr r8, 0x3f
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
jmp fcn.140051dd0
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x58], 1
mov qword [rsp + 0x28], 0
lea r8, [rsp + 0x50]
lea r9, [rsp + 0x28]
mov rcx, rdi
xor edx, edx
call qword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
je 0x1400c1f25
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
mov byte [rdi], 0
test rbx, rbx
je 0x1400c1f18
mov r8d, 1
mov rcx, rdi
mov rdx, rbx
call fcn.140051dd0
nop
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
ret
mov rax, qword [rsp + 0x28]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], bp
xor eax, eax
mov qword [rsi], rax
mov byte [rdi], 0
test rbx, rbx
jne 0x1400c1f07
jmp 0x1400c1f18
Function at 0x1400010a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x30
mov eax, dword [rsp + 0x68]
mov r8d, ecx
xor r8d, 0x429
mov esi, r9d
mov edi, ecx
lea ebx, [rax - 0x148]
lea r11d, [rax - 0x1ab2]
lea r10d, [rax - 0x440]
mov eax, r8d
xor eax, 0x746
cmp ebx, eax
jle 0x140001285
mov eax, r11d
xor eax, 0x10c0
cmp ebx, eax
je 0x1400012a3
mov r10, qword [rsp + 0x60]
lea rax, [0x1404e5060]
add ebx, 0x37c
xor r14d, r14d
mov qword [r10 + 0x90], rax
mov ecx, dword [r10 + 0x138]
sub ecx, dword [r10 + 0x128]
mov rdx, qword [section..data]
mov rax, qword [rdx + 0x90]
mov r9d, dword [r14 + rax]
add r14, 4
mov eax, dword [0x1404cd034]
add eax, 0xd5863
add ecx, eax
mov dword [0x1404cd034], ecx
mov eax, dword [r10 + 0x104]
or dword [rdx + 0x138], eax
imul r9d, dword [r10 + 0x34]
mov eax, dword [r10 + 0x5c]
add dword [r10 + 0x38], eax
mov ecx, dword [r10 + 0x54]
mov rdx, qword [section..data]
inc ecx
mov eax, dword [rdx + 0xf4]
imul eax, ecx
mov dword [rdx + 0xf4], eax
mov rax, qword [section..data]
mov ecx, dword [rax + 4]
sub dword [r10 + 0x54], ecx
mov eax, dword [r10 + 0x40]
mov ecx, dword [0x1404cd0fc]
sub eax, 0x6b655
imul ecx, eax
mov eax, dword [0x1404cd014]
mov dword [0x1404cd0fc], ecx
mov rcx, qword [section..data]
or dword [rcx + 0x128], eax
mov eax, dword [0x1404cd0b0]
mov ecx, dword [r10 + 0x5c]
add eax, 0xffc82492
mov rdx, qword [section..data]
add ecx, eax
xor dword [rdx + 0x3c], ecx
mov edx, r9d
movsxd rcx, dword [r10 + 0x74]
mov rax, qword [r10 + 0xd8]
shr edx, 0x18
mov byte [rcx + rax], dl
mov edx, r9d
inc dword [r10 + 0x74]
mov rax, qword [section..data]
shr edx, 0x10
movsxd rcx, dword [rax + 0x74]
mov rax, qword [r10 + 0xd8]
mov byte [rcx + rax], dl
mov edx, r9d
mov rax, qword [section..data]
shr edx, 8
inc dword [rax + 0x74]
mov rax, qword [section..data]
movsxd rcx, dword [rax + 0x74]
mov rax, qword [0x1404cd0e8]
mov byte [rcx + rax], dl
mov rax, qword [section..data]
inc dword [rax + 0x74]
movsxd rcx, dword [0x1404cd084]
mov rax, qword [r10 + 0xd8]
mov byte [rcx + rax], r9b
inc dword [0x1404cd084]
cmp r14, 0x3e3268
jl 0x140001118
lea eax, [rsi - 0x72b]
lea r9d, [r11 + 0x14f1]
mov dword [rsp + 0x20], eax
lea ecx, [rdi + 0x5eb]
lea rdx, [0x1404cd010]
call fcn.140016b00
jmp 0x1400012a3
mov rdx, qword [rsp + 0x60]
lea ecx, [r10 + 0x1ce6]
and ecx, r10d
mov eax, dword [rdx + 0xd0]
imul eax, ecx
mov dword [rdx + 0xd0], eax
mov rsi, qword [rsp + 0x48]
lea eax, [rbx + 0x132]
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
ret
Function at 0x1400012c0
Capabilities:
Create pipe

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov r15d, dword [rsp + 0x80]
lea r14d, [rdx + 0x64]
add r15d, 0x9ff
lea ebp, [rdx + 0x5a2]
mov rsi, r8
cmp ebp, r14d
jl 0x1400013a7
mov eax, dword [r8 + 0x154]
mov ecx, dword [r8 + 0x40]
add ecx, 0x19a981
imul eax, ecx
mov ecx, dword [r8 + 0x98]
mov dword [r8 + 0x154], eax
mov eax, 0xfff021fc
xor ecx, dword [0x1404cd0fc]
sub eax, ecx
add dword [r8 + 0x70], eax
mov rdx, qword [section..data]
mov eax, dword [0x1404cd098]
cmp dword [rdx + 0x70], eax
jbe 0x140001364
mov eax, dword [r8 + 0xd0]
xor eax, dword [r8 + 0x88]
add eax, 0x809d8
xor dword [rdx + 0x10c], eax
mov rdx, qword [section..data]
jmp 0x140001371
mov eax, dword [r8 + 0x150]
xor dword [0x1404cd048], eax
mov ecx, dword [r8 + 0x120]
cmp dword [0x1404cd0d8], ecx
jne 0x140001392
mov eax, dword [r8 + 0x1c]
sub eax, 0x1f902
add dword [r8 + 0x68], eax
jmp 0x140001482
add ecx, 0x55eb1
add ecx, dword [r8 + 0x110]
add dword [rdx + 0x68], ecx
jmp 0x140001482
mov eax, dword [r8 + 0x114]
and eax, dword [r8 + 0xec]
mov rdx, qword [section..data]
add eax, dword [0x1404cd07c]
cmp dword [rdx + 0x138], eax
jae 0x140001482
mov eax, dword [rdx + 0x150]
imul eax, dword [r8 + 0x38]
imul eax, eax, 0x14c7
cmp dword [0x1404cd148], eax
je 0x140001482
mov edi, dword [rdx + 0x44]
mov eax, 0x14f1
mov r9d, dword [rdx + 0xc8]
mov ecx, dword [r8 + 0x100]
mov r11d, dword [r8 + 0x30]
sub r11d, dword [r8 + 0x154]
add r9d, dword [r8 + 0x12c]
mov ebx, dword [r8 + 0x4c]
mov r10d, dword [r8 + 0x50]
sub ebx, r15d
add edi, dword [0x1404cd120]
mov r8d, r14d
mov edx, dword [rsi + 0x13c]
or rdi, rax
xor r9d, dword [0x1404cd04c]
or r14d, eax
mov qword [rsp + 0x38], rdi
and edx, 0x1819
imul eax, r14d, 0x1e18
and r10d, 0x12ab
sub r8d, ecx
sub edx, ecx
xor ebx, 0x10c0
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], r11d
movsxd rcx, eax
mov dword [rsp + 0x20], r10d
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov ecx, dword [rsi + 0x5c]
imul ecx, r15d
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rbx, qword [rsp + 0x60]
xor ebp, 0xba2
mov rsi, qword [rsp + 0x70]
mov eax, ebp
mov rbp, qword [rsp + 0x68]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x1400046d4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov ecx, dword [rsp + 0x28]
xor edx, 0xfb1
mov r11d, dword [rsp + 0x30]
xor ecx, 0xc08
xor r11d, 0x10c0
mov r10, r8
lea eax, [rdx - 0xa8b]
cmp ecx, eax
jl 0x140004867
mov eax, dword [r8 + 0xb0]
cmp dword [0x1404cd098], eax
je 0x140004725
lea rax, [0x1404cd170]
mov qword [r8 + 0x90], rax
jmp 0x140004731
mov eax, dword [0x1404cd130]
xor dword [0x1404cd02c], eax
xor ebx, ebx
mov eax, dword [0x1404cd14c]
mov ecx, dword [r10 + 0x128]
add eax, 0xffffffc0
imul ecx, eax
mov dword [r10 + 0x128], ecx
mov eax, dword [0x1404cd124]
mov ecx, dword [r10 + 0x120]
xor ecx, dword [0x1404cd014]
xor ecx, 1
imul eax, ecx
mov dword [0x1404cd124], eax
mov rax, qword [0x1404cd0a0]
movsxd rcx, dword [r10 + 0x74]
mov r9d, dword [rbx + rax]
add rbx, 4
imul r9d, dword [r10 + 0x34]
mov rax, qword [0x1404cd0e8]
mov edx, r9d
mov r8d, r9d
shr edx, 0x18
mov byte [rcx + rax], dl
inc dword [r10 + 0x74]
mov rax, qword [section..data]
movsxd rdx, dword [r10 + 0x74]
shr r8d, 0x10
mov rcx, qword [rax + 0xd8]
mov byte [rdx + rcx], r8b
mov edx, r9d
inc dword [r10 + 0x74]
mov rcx, qword [section..data]
mov eax, dword [r10 + 0x154]
shr edx, 8
or dword [rcx + 0xf4], eax
mov ecx, dword [0x1404cd078]
mov eax, dword [r10 + 0xb0]
xor ecx, 0x146751
imul eax, ecx
mov dword [r10 + 0xb0], eax
mov rax, qword [section..data]
movsxd rcx, dword [rax + 0x74]
mov rax, qword [0x1404cd0e8]
mov byte [rcx + rax], dl
mov rax, qword [section..data]
inc dword [rax + 0x74]
movsxd rcx, dword [r10 + 0x74]
mov rax, qword [0x1404cd0e8]
mov byte [rcx + rax], r9b
inc dword [r10 + 0x74]
mov ecx, dword [r10 + 0x40]
mov rdx, qword [section..data]
xor ecx, 0x6b657
mov eax, dword [rdx + 0x1c]
imul eax, ecx
mov dword [rdx + 0x1c], eax
mov eax, dword [0x1404cd034]
imul eax, dword [r10 + 0xb0]
mov dword [0x1404cd034], eax
cmp rbx, 0x17b20
jl 0x140004733
mov dword [r10 + 0x34], 0x172
jmp 0x1400048a4
mov r8d, dword [r8 + 0xfc]
mov r9d, ecx
sub r8d, edx
mov eax, r8d
and eax, ecx
cmp ecx, eax
jae 0x1400048a4
mov rax, qword [section..data]
mov edx, dword [rax + 0xb0]
xor edx, dword [r10 + 0x40]
xor edx, 0xfda
add ecx, edx
mov eax, r8d
and eax, ecx
add r9d, 3
cmp r9d, eax
jb 0x140004894
mov rbx, qword [rsp + 8]
lea eax, [r11 + 0x1d1c]
ret