joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007bc60
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
xor eax, eax
mov rbx, rcx
xchg byte [rcx + 8], al
mov rcx, qword [rcx + 0x18]
mov rdi, rdx
test rcx, rcx
jne 0x14007bcc5
call sub.libssl_1_1_x64.dll_TLS_method
test rax, rax
je 0x14007bcb8
mov rcx, rax
call sub.libssl_1_1_x64.dll_SSL_CTX_new
mov qword [rbx + 0x18], rax
test rax, rax
je 0x14007bcb8
call fcn.140042490
mov rcx, rax
call fcn.14004c2c0
test al, al
je 0x14007bcb8
mov rcx, qword [rbx + 0x18]
mov edx, 0x6000000
call sub.libssl_1_1_x64.dll_SSL_CTX_set_options
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x14007bd75
call sub.libssl_1_1_x64.dll_BIO_new_ssl_connect
mov qword [rbx + 0x20], rax
test rax, rax
je 0x14007bd75
xor r9d, r9d
mov dword [rsp + 0x40], 1
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 0x69]
call sub.libcrypto_1_1_x64.dll_BIO_ctrl
mov edx, 6
movsxd rcx, eax
lea r9, [rsp + 0x40]
mov dword [rsp + 0x20], 4
lea r8d, [rdx - 5]
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, qword [rbx + 0x20]
xor r8d, r8d
mov r9, rdi
lea edx, [r8 + 0x64]
call sub.libcrypto_1_1_x64.dll_BIO_ctrl
cmp eax, 1
jne 0x14007bd75
mov rcx, qword [rbx + 0x20]
lea r9, [rbx + 0x28]
xor r8d, r8d
lea edx, [rax + 0x6d]
call sub.libcrypto_1_1_x64.dll_BIO_ctrl
cmp qword [rbx + 0x28], 0
je 0x14007bd75
call fcn.140042490
mov rcx, rax
call fcn.14004c2c0
test al, al
je 0x14007bd68
mov rcx, qword [rbx + 0x28]
lea rdx, str.HIGH:_aNULL:_PSK:_SRP:_MD5:_RC4:_SHA1
call sub.libssl_1_1_x64.dll_SSL_set_cipher_list
cmp eax, 1
jne 0x14007bd75
mov al, 1
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rcx, rbx
call fcn.14007b930
mov rbx, qword [rsp + 0x48]
xor al, al
add rsp, 0x30
pop rdi
ret
Function at 0x14007bd90
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
xor eax, eax
mov rbx, rcx
xchg byte [rcx + 8], al
mov rcx, qword [rcx + 0x18]
mov rdi, rdx
test rcx, rcx
jne 0x14007bdf5
call sub.libssl_1_1_x64.dll_TLS_method
test rax, rax
je 0x14007bde8
mov rcx, rax
call sub.libssl_1_1_x64.dll_SSL_CTX_new
mov qword [rbx + 0x18], rax
test rax, rax
je 0x14007bde8
call fcn.140042490
mov rcx, rax
call fcn.14004c2c0
test al, al
je 0x14007bde8
mov rcx, qword [rbx + 0x18]
mov edx, 0x6000000
call sub.libssl_1_1_x64.dll_SSL_CTX_set_options
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x14007bea5
call sub.libssl_1_1_x64.dll_BIO_new_ssl_connect
mov qword [rbx + 0x20], rax
test rax, rax
je 0x14007bea5
xor r9d, r9d
mov dword [rsp + 0x40], 1
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 0x69]
call sub.libcrypto_1_1_x64.dll_BIO_ctrl
mov edx, 6
movsxd rcx, eax
lea r9, [rsp + 0x40]
mov dword [rsp + 0x20], 4
lea r8d, [rdx - 5]
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, qword [rbx + 0x20]
xor r8d, r8d
mov r9, rdi
lea edx, [r8 + 0x64]
call sub.libcrypto_1_1_x64.dll_BIO_ctrl
cmp eax, 1
jne 0x14007bea5
mov rcx, qword [rbx + 0x20]
lea r9, [rbx + 0x28]
xor r8d, r8d
lea edx, [rax + 0x6d]
call sub.libcrypto_1_1_x64.dll_BIO_ctrl
cmp qword [rbx + 0x28], 0
je 0x14007bea5
call fcn.140042490
mov rcx, rax
call fcn.14004c2c0
test al, al
je 0x14007be98
mov rcx, qword [rbx + 0x28]
lea rdx, str.HIGH:_aNULL:_PSK:_SRP:_MD5:_RC4:_SHA1
call sub.libssl_1_1_x64.dll_SSL_set_cipher_list
cmp eax, 1
jne 0x14007bea5
mov al, 1
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rcx, rbx
call fcn.14007b990
mov rbx, qword [rsp + 0x48]
xor al, al
add rsp, 0x30
pop rdi
ret
Function at 0x14007d000
Capabilities:
Manipulate user privileges

Disassembly:
push rbp
push rbx
push rsi
push r14
lea rbp, [rsp - 0x3f]
sub rsp, 0xb8
xor esi, esi
mov r14d, esi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp - 0x41]
lea edx, [rsi + 8]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
cmp eax, 1
jne 0x14007d215
mov rcx, qword [rbp - 0x41]
lea rax, [rbp + 0x7f]
lea r9d, [rsi + 4]
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x49]
mov dword [rbp + 0x7f], 4
lea edx, [rsi + 0x14]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov rcx, qword [rbp - 0x41]
lea edx, [rsi + 1]
test eax, eax
mov dword [rbp + 0x67], esi
lea rax, [rbp + 0x67]
mov ebx, esi
cmovne ebx, dword [rbp - 0x49]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov eax, dword [rbp + 0x67]
test eax, eax
je 0x14007d0b8
test ebx, ebx
je 0x14007d0b8
mov edx, eax
lea ecx, [rsi + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r9d, dword [rbp + 0x67]
lea edx, [rsi + 1]
mov rcx, qword [rbp - 0x41]
mov r14, rax
lea rax, [rbp + 0x67]
mov r8, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14, r14
je 0x14007d215
xor eax, eax
lea r9, [rbp - 0x31]
mov r8d, 0xf0fff
mov qword [rbp - 0x19], rax
lea rdx, [rbp - 0x19]
mov qword [rbp - 0x11], rax
xor ecx, ecx
mov qword [rbp - 9], rax
mov qword [rbp - 1], rax
mov qword [rbp + 7], rax
mov qword [rbp + 0xf], rax
call sub.ADVAPI32.dll_LsaOpenPolicy
test eax, eax
jne 0x14007d1fd
mov rdx, qword [r14]
lea rax, [0x14009edf0]
mov rcx, qword [rbp - 0x31]
lea r9, [rbp + 0x6f]
lea r8, [rbp - 0x39]
mov qword [rbp - 0x21], rax
mov dword [rbp - 0x29], 0x2c002a
mov qword [rbp - 0x39], rsi
mov dword [rbp + 0x6f], esi
mov dword [rbp + 0x77], esi
call sub.ADVAPI32.dll_LsaEnumerateAccountRights
test eax, eax
jne 0x14007d1d8
mov rax, qword [rbp - 0x39]
mov qword [rsp + 0xb0], rdi
mov rdi, rsi
mov qword [rsp + 0x98], r15
mov r15d, dword [rbp + 0x6f]
test r15, r15
je 0x14007d1bb
mov qword [rsp + 0xa8], r12
mov rbx, rax
movzx r12d, word [rbp - 0x29]
mov qword [rsp + 0xa0], r13
mov r13, qword [rbp - 0x21]
cmp word [rbx], r12w
jne 0x14007d192
mov rcx, qword [rbx + 8]
mov r8d, 0x2a
mov rdx, r13
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14007d1a0
inc rdi
add rbx, 0x10
cmp rdi, r15
jb 0x14007d176
jmp 0x14007d1a7
mov dword [rbp + 0x77], 1
mov rax, qword [rbp - 0x39]
mov r12, qword [rsp + 0xa8]
mov r13, qword [rsp + 0xa0]
mov rcx, rax
call sub.ADVAPI32.dll_LsaFreeMemory
mov r15, qword [rsp + 0x98]
mov rdi, qword [rsp + 0xb0]
cmp dword [rbp + 0x77], esi
jne 0x14007d1f4
mov rdx, qword [r14]
lea r8, [rbp - 0x29]
mov rcx, qword [rbp - 0x31]
mov r9d, 1
call sub.ADVAPI32.dll_LsaAddAccountRights
test eax, eax
sete sil
mov rcx, qword [rbp - 0x31]
call sub.ADVAPI32.dll_LsaClose
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, esi
add rsp, 0xb8
pop r14
pop rsi
pop rbx
pop rbp
ret
xor eax, eax
add rsp, 0xb8
pop r14
pop rsi
pop rbx
pop rbp
ret
Function at 0x14007ffd0
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
push rbp
push rsi
push r14
push r15
mov rbp, rsp
sub rsp, 0x78
mov rax, qword [0x1400b89e8]
xor rax, rsp
mov qword [rbp - 0x18], rax
mov r15, rcx
lea r9, [r8 + 1]
movabs rax, 0x5851f42d4c957f2d
movabs rcx, 0x810a978a59f5a1fc
imul r9, rax
xor r14d, r14d
mov rsi, rdx
mov rax, r9
mov qword [rbp - 0x58], r9
xor rax, rcx
movabs rcx, 0xa77099df38c2d846
mov qword [rbp - 0x50], rax
mov rax, r9
xor rax, rcx
movabs rcx, 0x8126b91cbf22495c
mov qword [rbp - 0x48], rax
mov rax, r9
xor rax, rcx
movabs rcx, 0x494d2597179f8a62
mov qword [rbp - 0x40], rax
mov rax, r9
xor rax, rcx
movabs rcx, 0x9237efb9ceaaec0c
mov qword [rbp - 0x38], rax
mov rax, r9
xor rax, rcx
movabs rcx, 0x2f2a56746ce62d78
mov qword [rbp - 0x30], rax
mov rax, r9
xor rax, rcx
mov qword [rbp - 0x28], rax
movabs rax, 0x84853bf7b62ce54e
xor r9, rax
cmp dword [0x1400be3e8], r14d
mov qword [rbp - 0x20], r9
jbe 0x14008015d
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rdi
mov qword [r11 - 0x28], r12
nop
mov edi, dword [0x1400be3d0]
shl edi, 0xa
shr edi, 6
dec edi
and rdi, r8
shl rdi, 6
add rdi, qword [r15]
prefetchnta byte [rdi]
mov eax, r14d
lea rdx, [r15 + 0x28]
imul rbx, rax, 0x1878
lea r8, [r15 + 0x187a8]
add rdx, rbx
lea rcx, [rbp - 0x58]
call fcn.140084cd0
mov rax, qword [rdi]
inc r14d
xor qword [rbp - 0x58], rax
mov rax, qword [rdi + 8]
xor qword [rbp - 0x50], rax
mov rax, qword [rdi + 0x10]
xor qword [rbp - 0x48], rax
mov rax, qword [rdi + 0x18]
xor qword [rbp - 0x40], rax
mov rax, qword [rdi + 0x20]
xor qword [rbp - 0x38], rax
mov rax, qword [rdi + 0x28]
xor qword [rbp - 0x30], rax
mov rax, qword [rdi + 0x30]
xor qword [rbp - 0x28], rax
mov rax, qword [rdi + 0x38]
xor qword [rbp - 0x20], rax
cmp r14d, dword [0x1400be3e8]
movsxd rax, dword [rbx + r15 + 0x183c]
mov r8, qword [rbp + rax*8 - 0x58]
jb 0x1400800b0
mov r12, qword [rsp + 0x70]
mov rdi, qword [rsp + 0xb8]
mov rbx, qword [rsp + 0xb0]
movaps xmm0, xmmword [rbp - 0x58]
movaps xmm1, xmmword [rbp - 0x48]
movups xmmword [rsi], xmm0
movaps xmm0, xmmword [rbp - 0x38]
movups xmmword [rsi + 0x10], xmm1
movaps xmm1, xmmword [rbp - 0x28]
movups xmmword [rsi + 0x20], xmm0
movups xmmword [rsi + 0x30], xmm1
mov rcx, qword [rbp - 0x18]
xor rcx, rsp
call fcn.14008ccd0
add rsp, 0x78
pop r15
pop r14
pop rsi
pop rbp
ret
Function at 0x140080260
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [0x1400be404]
lea r8, [rcx + 0x40]
mov r9, rdx
mov rcx, r9
lea edx, [rax*8 + 0x80]
jmp 0x140088120
sub rsp, 0x68
movdqa xmm4, xmmword [0x1400be490]
lea r9, [rdx + r8]
movdqa xmm5, xmmword [0x1400be4a0]
movdqu xmm0, xmmword [rcx]
movdqu xmm1, xmmword [rcx + 0x10]
movdqu xmm2, xmmword [rcx + 0x20]
movdqu xmm3, xmmword [rcx + 0x30]
movaps xmmword [rsp + 0x50], xmm6
movdqa xmm6, xmmword [0x1400be4b0]
movaps xmmword [rsp + 0x40], xmm7
movdqa xmm7, xmmword [0x1400be4c0]
movaps xmmword [rsp + 0x30], xmm8
movdqa xmm8, xmmword [0x1400be4d0]
movaps xmmword [rsp + 0x20], xmm9
movdqa xmm9, xmmword [0x1400be4e0]
movaps xmmword [rsp + 0x10], xmm10
movdqa xmm10, xmmword [0x1400be4f0]
movaps xmmword [rsp], xmm11
movdqa xmm11, xmmword [0x1400be500]
cmp r8, r9
jae 0x140088229
lea rcx, [r8 + 0x20]
nop dword [rax]
aesdec xmm0, xmm4
aesenc xmm1, xmm4
aesdec xmm2, xmm8
aesenc xmm3, xmm8
aesdec xmm0, xmm5
aesenc xmm1, xmm5
aesdec xmm2, xmm9
aesenc xmm3, xmm9
aesdec xmm0, xmm6
aesenc xmm1, xmm6
aesdec xmm0, xmm7
movdqu xmmword [rcx - 0x20], xmm0
lea rcx, [rcx + 0x40]
aesdec xmm2, xmm10
aesenc xmm1, xmm7
movdqu xmmword [rcx - 0x50], xmm1
lea rax, [rcx - 0x20]
aesenc xmm3, xmm10
aesdec xmm2, xmm11
movdqu xmmword [rcx - 0x40], xmm2
aesenc xmm3, xmm11
movdqu xmmword [rcx - 0x30], xmm3
cmp rax, r9
jb 0x1400881b0
movaps xmm6, xmmword [rsp + 0x50]
movaps xmm7, xmmword [rsp + 0x40]
movaps xmm8, xmmword [rsp + 0x30]
movaps xmm9, xmmword [rsp + 0x20]
movaps xmm10, xmmword [rsp + 0x10]
movaps xmm11, xmmword [rsp]
add rsp, 0x68
ret

Function at 0x140080460
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
mov r8, qword [rcx + 0x11f0]
mov rax, rdx
mov edx, dword [0x1400be400]
mov rcx, rax
jmp 0x140086c60
sub rsp, 0x28
movdqa xmm4, xmmword [0x1400a0120]
lea r10, [rdx + r8]
movdqa xmm5, xmmword [0x1400a00d0]
mov r9, rcx
movdqu xmm0, xmmword [rcx]
movdqu xmm1, xmmword [rcx + 0x10]
movdqu xmm2, xmmword [rcx + 0x20]
movdqu xmm3, xmmword [rcx + 0x30]
movaps xmmword [rsp + 0x10], xmm6
movdqa xmm6, xmmword [0x1400a00e0]
movaps xmmword [rsp], xmm7
movdqa xmm7, xmmword [0x1400a00f0]
cmp r8, r10
jae 0x140086ce5
lea rcx, [r8 + 0x20]
aesdec xmm0, xmm4
movdqu xmmword [rcx - 0x20], xmm0
lea rcx, [rcx + 0x40]
aesenc xmm1, xmm5
movdqu xmmword [rcx - 0x50], xmm1
lea rax, [rcx - 0x20]
aesdec xmm2, xmm6
movdqu xmmword [rcx - 0x40], xmm2
aesenc xmm3, xmm7
movdqu xmmword [rcx - 0x30], xmm3
cmp rax, r10
jb 0x140086cb0
movaps xmm6, xmmword [rsp + 0x10]
movaps xmm7, xmmword [rsp]
movdqu xmmword [r9], xmm0
movdqu xmmword [r9 + 0x10], xmm1
movdqu xmmword [r9 + 0x20], xmm2
movdqu xmmword [r9 + 0x30], xmm3
add rsp, 0x28
ret
Function at 0x140082780
Capabilities:
Hash data using sha512

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xb0]
sub rsp, 0x1b0
mov rax, qword [0x1400b89e8]
xor rax, rsp
mov qword [rbp + 0x90], rax
mov rsi, qword [rbp + 0x110]
mov r12, r9
mov r13, r8
mov rdi, rdx
mov r15, rcx
mov r14d, 0xffffffff
test r8, r8
jne 0x1400827d3
test r9, r9
jne 0x140082979
test r15, r15
je 0x140082979
lea rax, [rdx - 1]
cmp rax, 0x3f
ja 0x140082979
mov qword [rsp + 0x1a8], rbx
mov rbx, qword [rbp + 0x118]
test rsi, rsi
jne 0x140082807
test rbx, rbx
jne 0x140082971
cmp rbx, 0x40
ja 0x140082971
test rbx, rbx
je 0x14008293c
test rsi, rsi
je 0x140082971
xor eax, eax
mov byte [rbp + 0x10], dil
xor edx, edx
mov qword [rbp + 0x22], rax
mov r8d, 0xa4
mov qword [rbp + 0x2a], rax
lea rcx, [rsp + 0x60]
mov qword [rbp + 0x32], rax
mov qword [rbp + 0x3a], rax
mov qword [rbp + 0x42], rax
mov dword [rbp + 0x4a], eax
mov word [rbp + 0x4e], ax
mov byte [rbp + 0x11], bl
mov word [rbp + 0x12], 0x101
mov dword [rbp + 0x14], 0
mov word [rbp + 0x20], 0
call sub.VCRUNTIME140.dll_memset
movaps xmm0, xmmword [0x14009f850]
xor eax, eax
movaps xmm1, xmmword [0x14009f860]
movabs rcx, 0x6a09e667f3bcc908
movaps xmm2, xmmword [0x14009f880]
xor edx, edx
mov qword [rbp + 8], rax
mov r8d, 0x80
mov rax, qword [rbp + 0x10]
xor rax, rcx
movaps xmmword [rsp + 0x20], xmm0
movaps xmm0, xmmword [0x14009f870]
lea rcx, [rbp + 0x10]
xor qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
movq rax, xmm1
xor rax, qword [rbp + 0x20]
movaps xmmword [rsp + 0x30], xmm1
mov qword [rsp + 0x30], rax
mov rax, qword [rbp + 0x28]
xor qword [rsp + 0x38], rax
movq rax, xmm0
xor rax, qword [rbp + 0x30]
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x40], rax
mov rax, qword [rbp + 0x38]
xor qword [rsp + 0x48], rax
movaps xmmword [rsp + 0x50], xmm2
psrldq xmm2, 8
movq rax, xmm2
xor rax, qword [rbp + 0x48]
mov qword [rsp + 0x58], rax
movzx eax, dil
mov dword [rbp + 4], eax
call sub.VCRUNTIME140.dll_memset
mov r8, rbx
lea rcx, [rbp + 0x10]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov r8d, 0x80
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x20]
call fcn.140083110
jmp 0x14008294a
lea rcx, [rsp + 0x20]
call fcn.140082ff0
test eax, eax
js 0x140082971
mov r8, r12
lea rcx, [rsp + 0x20]
mov rdx, r13
call fcn.140083110
test eax, eax
js 0x140082971
mov r8, rdi
lea rcx, [rsp + 0x20]
mov rdx, r15
call fcn.140082ed0
mov r14d, eax
mov rbx, qword [rsp + 0x1a8]
mov eax, r14d
mov rcx, qword [rbp + 0x90]
xor rcx, rsp
call fcn.14008ccd0
add rsp, 0x1b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140082ff0
Capabilities:
Hash data using sha512

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x1400b89e8]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x1400830ec
lea rax, [rdx - 1]
cmp rax, 0x3f
ja 0x1400830d3
xor eax, eax
mov byte [rsp + 0x20], dil
xor edx, edx
mov qword [rsp + 0x32], rax
mov r8d, 0xf0
mov qword [rsp + 0x3a], rax
mov qword [rsp + 0x42], rax
mov qword [rsp + 0x4a], rax
mov word [rsp + 0x21], 0x100
mov byte [rsp + 0x23], 1
mov dword [rsp + 0x24], 0
mov word [rsp + 0x30], 0
call sub.VCRUNTIME140.dll_memset
movaps xmm0, xmmword [0x14009f850]
mov rax, qword [rsp + 0x20]
movups xmmword [rbx], xmm0
movaps xmm1, xmmword [0x14009f860]
movups xmmword [rbx + 0x10], xmm1
movaps xmm0, xmmword [0x14009f870]
movups xmmword [rbx + 0x20], xmm0
movaps xmm1, xmmword [0x14009f880]
movups xmmword [rbx + 0x30], xmm1
xor qword [rbx], rax
mov rax, qword [rsp + 0x30]
xor qword [rbx + 0x10], rax
mov rax, qword [rsp + 0x38]
xor qword [rbx + 0x18], rax
mov rax, qword [rsp + 0x40]
xor qword [rbx + 0x20], rax
mov rax, qword [rsp + 0x48]
xor qword [rbx + 0x28], rax
xor qword [rbx + 8], 0
movzx eax, dil
mov dword [rbx + 0xe4], eax
xor eax, eax
jmp 0x1400830f1
cmp byte [rcx + 0xe8], 0
je 0x1400830e4
mov qword [rcx + 0x58], 0xffffffffffffffff
mov qword [rcx + 0x50], 0xffffffffffffffff
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14008ccd0
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
ret

Function at 0x140086700
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rdx + 0x3f8]
mov r8d, 0x80
lea r10, [rcx + 0x3f8]
cmp rcx, rax
ja 0x140086721
xor r9d, r9d
cmp r10, rdx
jae 0x140086791
mov r9, rdx
lea rax, [rcx + 0x10]
sub r9, rcx
mov r10d, reloc.WS2_32.dll_recv
movdqu xmm0, xmmword [rax - 0x10]
movdqu xmm1, xmmword [r9 + rax - 0x10]
movdqu xmm2, xmmword [r9 + rax]
lea rax, [rax + 0x40]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x50], xmm1
movdqu xmm0, xmmword [rax - 0x40]
movdqu xmm1, xmmword [r9 + rax - 0x30]
pxor xmm2, xmm0
movdqu xmmword [rax - 0x40], xmm2
movdqu xmm0, xmmword [rax - 0x30]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x30], xmm1
movdqu xmm0, xmmword [rax - 0x20]
movdqu xmm1, xmmword [r9 + rax - 0x20]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x20], xmm1
sub r10, 1
jne 0x140086731
mov r9, r8
cmp r9, r8
jae 0x1400867b1
sub rdx, rcx
lea rax, [rcx + r9*8]
sub r8, r9
mov rcx, qword [rax + rdx]
xor qword [rax], rcx
lea rax, [rax + 8]
sub r8, 1
jne 0x1400867a0
ret
Function at 0x140086c60
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
mov r8, qword [rcx + 0x11f0]
mov rax, rdx
mov edx, dword [0x1400be400]
mov rcx, rax
jmp 0x140086c60
sub rsp, 0x28
movdqa xmm4, xmmword [0x1400a0120]
lea r10, [rdx + r8]
movdqa xmm5, xmmword [0x1400a00d0]
mov r9, rcx
movdqu xmm0, xmmword [rcx]
movdqu xmm1, xmmword [rcx + 0x10]
movdqu xmm2, xmmword [rcx + 0x20]
movdqu xmm3, xmmword [rcx + 0x30]
movaps xmmword [rsp + 0x10], xmm6
movdqa xmm6, xmmword [0x1400a00e0]
movaps xmmword [rsp], xmm7
movdqa xmm7, xmmword [0x1400a00f0]
cmp r8, r10
jae 0x140086ce5
lea rcx, [r8 + 0x20]
aesdec xmm0, xmm4
movdqu xmmword [rcx - 0x20], xmm0
lea rcx, [rcx + 0x40]
aesenc xmm1, xmm5
movdqu xmmword [rcx - 0x50], xmm1
lea rax, [rcx - 0x20]
aesdec xmm2, xmm6
movdqu xmmword [rcx - 0x40], xmm2
aesenc xmm3, xmm7
movdqu xmmword [rcx - 0x30], xmm3
cmp rax, r10
jb 0x140086cb0
movaps xmm6, xmmword [rsp + 0x10]
movaps xmm7, xmmword [rsp]
movdqu xmmword [r9], xmm0
movdqu xmmword [r9 + 0x10], xmm1
movdqu xmmword [r9 + 0x20], xmm2
movdqu xmmword [r9 + 0x30], xmm3
add rsp, 0x28
ret
Function at 0x140088120
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [0x1400be404]
lea r8, [rcx + 0x40]
mov r9, rdx
mov rcx, r9
lea edx, [rax*8 + 0x80]
jmp 0x140088120
sub rsp, 0x68
movdqa xmm4, xmmword [0x1400be490]
lea r9, [rdx + r8]
movdqa xmm5, xmmword [0x1400be4a0]
movdqu xmm0, xmmword [rcx]
movdqu xmm1, xmmword [rcx + 0x10]
movdqu xmm2, xmmword [rcx + 0x20]
movdqu xmm3, xmmword [rcx + 0x30]
movaps xmmword [rsp + 0x50], xmm6
movdqa xmm6, xmmword [0x1400be4b0]
movaps xmmword [rsp + 0x40], xmm7
movdqa xmm7, xmmword [0x1400be4c0]
movaps xmmword [rsp + 0x30], xmm8
movdqa xmm8, xmmword [0x1400be4d0]
movaps xmmword [rsp + 0x20], xmm9
movdqa xmm9, xmmword [0x1400be4e0]
movaps xmmword [rsp + 0x10], xmm10
movdqa xmm10, xmmword [0x1400be4f0]
movaps xmmword [rsp], xmm11
movdqa xmm11, xmmword [0x1400be500]
cmp r8, r9
jae 0x140088229
lea rcx, [r8 + 0x20]
nop dword [rax]
aesdec xmm0, xmm4
aesenc xmm1, xmm4
aesdec xmm2, xmm8
aesenc xmm3, xmm8
aesdec xmm0, xmm5
aesenc xmm1, xmm5
aesdec xmm2, xmm9
aesenc xmm3, xmm9
aesdec xmm0, xmm6
aesenc xmm1, xmm6
aesdec xmm0, xmm7
movdqu xmmword [rcx - 0x20], xmm0
lea rcx, [rcx + 0x40]
aesdec xmm2, xmm10
aesenc xmm1, xmm7
movdqu xmmword [rcx - 0x50], xmm1
lea rax, [rcx - 0x20]
aesenc xmm3, xmm10
aesdec xmm2, xmm11
movdqu xmmword [rcx - 0x40], xmm2
aesenc xmm3, xmm11
movdqu xmmword [rcx - 0x30], xmm3
cmp rax, r9
jb 0x1400881b0
movaps xmm6, xmmword [rsp + 0x50]
movaps xmm7, xmmword [rsp + 0x40]
movaps xmm8, xmmword [rsp + 0x30]
movaps xmm9, xmmword [rsp + 0x20]
movaps xmm10, xmmword [rsp + 0x10]
movaps xmm11, xmmword [rsp]
add rsp, 0x68
ret
Function at 0x140089010
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
movdqa xmm2, xmmword [0x1400a0130]
lea r9, [rcx + rdx]
movdqa xmm3, xmmword [0x1400a0110]
movdqa xmm4, xmmword [0x1400a0140]
movdqa xmm5, xmmword [0x1400a0100]
cmp rcx, r9
jae 0x140089064
add rcx, 0x20
nop dword [rax]
aesenc xmm2, xmmword [rcx - 0x20]
aesdec xmm3, xmmword [rcx - 0x10]
aesenc xmm4, xmmword [rcx]
aesdec xmm5, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x40]
lea rax, [rcx - 0x20]
cmp rax, r9
jb 0x140089040
movdqa xmm0, xmmword [0x1400a00c0]
movdqa xmm1, xmmword [0x1400a0150]
aesenc xmm2, xmm0
aesdec xmm3, xmm0
aesenc xmm2, xmm1
movdqu xmmword [r8], xmm2
aesenc xmm4, xmm0
aesdec xmm3, xmm1
movdqu xmmword [r8 + 0x10], xmm3
aesdec xmm5, xmm0
aesenc xmm4, xmm1
aesdec xmm5, xmm1
movdqu xmmword [r8 + 0x20], xmm4
movdqu xmmword [r8 + 0x30], xmm5
ret
Function at 0x14008a340
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
push rbx
sub rsp, 0x60
movdqu xmm0, xmmword [r9]
mov rbx, r8
movdqu xmm1, xmmword [r9 + 0x10]
lea r8, [rdx - 0x1000]
movdqa xmm2, xmmword [0x1400a0130]
mov r11, r9
movdqa xmm3, xmmword [0x1400a0110]
mov r10, rcx
movdqa xmm4, xmmword [0x1400a0140]
mov rax, rcx
movdqa xmm5, xmmword [0x1400a0100]
add r8, rcx
movaps xmmword [rsp + 0x50], xmm6
mov edx, 2
movdqu xmm6, xmmword [r9 + 0x20]
movaps xmmword [rsp + 0x40], xmm7
movdqu xmm7, xmmword [r9 + 0x30]
lea r9, [rcx + 0x1000]
movaps xmmword [rsp + 0x30], xmm8
movdqa xmm8, xmmword [0x1400a0120]
movaps xmmword [rsp + 0x20], xmm9
movdqa xmm9, xmmword [0x1400a00d0]
movaps xmmword [rsp + 0x10], xmm10
movdqa xmm10, xmmword [0x1400a00e0]
movaps xmmword [rsp], xmm11
movdqa xmm11, xmmword [0x1400a00f0]
cmp rax, r8
jae 0x14008a442
lea rcx, [rax + 0x20]
sub r9, rax
aesenc xmm2, xmmword [rax]
aesdec xmm3, xmmword [rcx - 0x10]
aesenc xmm4, xmmword [rcx]
aesdec xmm5, xmmword [rcx + 0x10]
aesdec xmm0, xmm8
movdqu xmmword [rax], xmm0
aesenc xmm1, xmm9
movdqu xmmword [rcx - 0x10], xmm1
aesdec xmm6, xmm10
aesenc xmm7, xmm11
movdqu xmmword [rcx], xmm6
movdqu xmmword [rcx + 0x10], xmm7
prefetcht0 byte [r9 + rax]
add rax, 0x40
lea rcx, [rcx + 0x40]
cmp rax, r8
jb 0x14008a3f0
add r8, 0x1000
mov r9, r10
sub rdx, 1
jne 0x14008a3e4
movaps xmm8, xmmword [rsp + 0x30]
movaps xmm9, xmmword [rsp + 0x20]
movaps xmm10, xmmword [rsp + 0x10]
movaps xmm11, xmmword [rsp]
movdqu xmmword [r11], xmm0
movdqa xmm0, xmmword [0x1400a00c0]
movdqu xmmword [r11 + 0x10], xmm1
movdqa xmm1, xmmword [0x1400a0150]
movdqu xmmword [r11 + 0x20], xmm6
movaps xmm6, xmmword [rsp + 0x50]
movdqu xmmword [r11 + 0x30], xmm7
movaps xmm7, xmmword [rsp + 0x40]
aesenc xmm2, xmm0
aesdec xmm3, xmm0
aesenc xmm2, xmm1
movdqu xmmword [rbx], xmm2
aesenc xmm4, xmm0
aesdec xmm3, xmm1
movdqu xmmword [rbx + 0x10], xmm3
aesdec xmm5, xmm0
aesenc xmm4, xmm1
aesdec xmm5, xmm1
movdqu xmmword [rbx + 0x20], xmm4
movdqu xmmword [rbx + 0x30], xmm5
add rsp, 0x60
pop rbx
ret

Function at 0x14008b030
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov rdx, rcx
mov r9d, 0x40
xor ecx, ecx
mov r8d, 0x3000
jmp qword [sym.imp.KERNEL32.dll_VirtualAlloc]
Function at 0x14008e790
Capabilities:
Delete service
Stop service

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1400b89e8]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rcx, qword [0x1400c2418]
lea r8, [rsp + 0x20]
mov edx, 1
mov bl, 1
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x14008e7e5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call fcn.140042690
mov rcx, rax
lea r8, str.Failed_to_stop_WinRing0_driver__error__u
mov r9d, ebx
xor edx, edx
call fcn.140047680
xor bl, bl
mov rcx, qword [0x1400c2418]
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x14008e82c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call fcn.140042690
mov rcx, rax
lea r8, str.Failed_to_remove_WinRing0_driver__error__u
mov r9d, ebx
xor edx, edx
call fcn.140047680
xor al, al
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14008ccd0
add rsp, 0x50
pop rbx
ret
movzx eax, bl
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14008ccd0
add rsp, 0x50
pop rbx
ret