joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800566cc
Capabilities:
Encrypt data using rc4 via systemfunction033

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xc0
mov r14, qword [rcx + 8]
xor ebx, ebx
test rdx, rdx
lea r15d, [rbx + 0x10]
lea rsi, [0x180164698]
lea rax, [rbp + 0x1f]
cmovne rsi, rdx
mov rdi, rcx
mov dword [rbp - 0x49], r15d
mov dword [rbp - 0x45], r15d
mov qword [rbp - 0x41], rax
cmp qword [rsi + 8], rbx
je 0x180056827
cmp dword [rsi], ebx
je 0x180056827
cmp dword [rcx], 0x14
jb 0x18005681e
test r14, r14
je 0x18005681e
lea rcx, [rbp - 0x39]
call sub.cryptdll.dll_MD5Init
mov r8d, dword [rsi]
mov rdx, qword [rsi + 8]
lea rcx, [rbp - 0x39]
call sub.cryptdll.dll_MD5Update
lea rcx, [rbp - 0x39]
mov r8d, r15d
mov rdx, r14
call sub.cryptdll.dll_MD5Update
lea rcx, [rbp - 0x39]
call sub.cryptdll.dll_MD5Final
mov eax, dword [rdi]
lea r12, [r14 + 0x10]
sub eax, r15d
lea rdx, [rbp - 0x49]
lea rcx, [rbp - 0x59]
mov dword [rbp - 0x55], eax
mov dword [rbp - 0x59], eax
mov qword [rbp - 0x51], r12
call sub.ADVAPI32.dll_SystemFunction033
test eax, eax
js 0x180056815
mov esi, dword [rdi]
lea r15, [r14 + 0x14]
lea r9, [rbp + 0x67]
sub esi, 0x14
mov rdx, r15
mov ecx, 0x8000
mov r8d, esi
mov dword [rsp + 0x20], 4
call fcn.180043cec
test eax, eax
je 0x18005680c
mov edx, dword [rbp + 0x67]
cmp edx, dword [r12]
jne 0x1800567fa
mov r12, qword [rdi + 8]
mov ecx, esi
mov r14d, esi
call fcn.180054f48
mov qword [rdi + 8], rax
test rax, rax
je 0x180056833
mov r8d, r14d
mov rdx, r15
mov rcx, rax
call fcn.1800ca790
mov rcx, r12
mov dword [rdi], esi
mov ebx, 1
call fcn.180054f60
jmp 0x180056833
mov r8d, dword [r12]
lea rcx, str.ERROR_kull_m_rpc_drsr_ProcessGetNCChangesReply_decrypt___Checksums_dont_match__C:0x_08x___R:0x_08x__n
call fcn.18004d68c
jmp 0x180056833
lea rcx, str.ERROR_kull_m_rpc_drsr_ProcessGetNCChangesReply_decrypt___Unable_to_calculate_CRC32_n
jmp 0x18005682e
lea rcx, str.ERROR_kull_m_rpc_drsr_ProcessGetNCChangesReply_decrypt___RtlDecryptData2_n
jmp 0x18005682e
lea rcx, str.ERROR_kull_m_rpc_drsr_ProcessGetNCChangesReply_decrypt___No_valid_data_n
jmp 0x18005682e
lea rcx, str.ERROR_kull_m_rpc_drsr_ProcessGetNCChangesReply_decrypt___No_Session_Key_n
call fcn.18004d68c
lea r11, [rsp + 0xc0]
mov eax, ebx
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x180056858
Capabilities:
Encrypt data using rc4 via systemfunction032

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
xor edi, edi
test rdx, rdx
lea r15, [0x180164698]
lea eax, [rdi + 0x10]
cmovne r15, rdx
mov rsi, rcx
mov dword [rbp - 0x49], eax
mov dword [rbp - 0x45], eax
lea rax, [rbp + 0x1f]
mov qword [rbp - 0x41], rax
mov eax, dword [rcx]
lea r13d, [rax + 0x14]
cmp qword [r15 + 8], rdi
je 0x1800569ae
cmp dword [r15], edi
je 0x1800569ae
test eax, eax
je 0x1800569a5
cmp qword [rcx + 8], rdi
je 0x1800569a5
mov ecx, r13d
call fcn.180054f48
mov r14, rax
test rax, rax
je 0x1800569ba
mov r8d, dword [rsi]
mov rdx, qword [rsi + 8]
lea rcx, [rax + 0x14]
mov r12, rax
call fcn.1800ca790
mov r8d, dword [rsi]
lea r9, [r12 + 0x10]
lea rdx, [r12 + 0x14]
mov ecx, 0x8000
mov dword [rsp + 0x20], 4
call fcn.180043cec
test eax, eax
je 0x18005698f
lea ebx, [rdi + 0x10]
mov rcx, r12
mov edx, ebx
call sub.cryptdll.dll_CDGenerateRandomBits
lea rcx, [rbp - 0x39]
call sub.cryptdll.dll_MD5Init
mov r8d, dword [r15]
mov rdx, qword [r15 + 8]
lea rcx, [rbp - 0x39]
call sub.cryptdll.dll_MD5Update
lea rcx, [rbp - 0x39]
mov r8d, ebx
mov rdx, r12
call sub.cryptdll.dll_MD5Update
lea rcx, [rbp - 0x39]
call sub.cryptdll.dll_MD5Final
lea eax, [r13 - 0x10]
lea rdx, [rbp - 0x49]
mov dword [rbp - 0x55], eax
mov dword [rbp - 0x59], eax
lea rax, [r12 + 0x10]
lea rcx, [rbp - 0x59]
mov qword [rbp - 0x51], rax
call sub.ADVAPI32.dll_SystemFunction032
test eax, eax
js 0x180056986
mov r12, qword [rsi + 8]
mov dword [rsi], r13d
lea edi, [rbx - 0xf]
mov qword [rsi + 8], r14
jmp 0x18005699b
lea rcx, str.ERROR_kull_m_rpc_drsr_CreateGetNCChangesReply_encrypt___RtlEncryptData2_n
jmp 0x180056996
lea rcx, str.ERROR_kull_m_rpc_drsr_CreateGetNCChangesReply_encrypt___Unable_to_calculate_CRC32_n
call fcn.18004d68c
mov rcx, r12
call fcn.180054f60
jmp 0x1800569ba
lea rcx, str.ERROR_kull_m_rpc_drsr_CreateGetNCChangesReply_encrypt___No_valid_data_n
jmp 0x1800569b5
lea rcx, str.ERROR_kull_m_rpc_drsr_CreateGetNCChangesReply_encrypt___No_Session_Key_n
call fcn.18004d68c
lea r11, [rsp + 0xc0]
mov eax, edi
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x1800570ac
Capabilities:
Listen for remote procedure calls

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, rcx
mov rcx, qword [0x1801601a8]
xor ebx, ebx
and qword [rsp + 0x60], rbx
and qword [rsp + 0x68], rbx
mov r8, rdx
add rcx, 4
mov rdx, rax
call fcn.180056f88
mov rdi, rax
test rax, rax
je 0x18005727a
lea edx, [rbx + 0xa]
lea rcx, str.ncacn_ip_tcp
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.RPCRT4.dll_RpcServerUseProtseqEpW]
mov ebx, eax
test eax, eax
jne 0x180057263
lea edx, [rax + 9]
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.RPCRT4.dll_RpcServerRegisterAuthInfoW]
mov ebx, eax
test eax, eax
jne 0x18005725a
and qword [rsp + 0x30], 0
mov rcx, qword [0x1801601a8]
or dword [rsp + 0x28], 0xffffffff
lea r9d, [rax + 8]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 0x4d2
call qword [sym.imp.RPCRT4.dll_RpcServerRegisterIf2]
mov ebx, eax
test eax, eax
jne 0x180057251
lea rcx, [rsp + 0x60]
call qword [sym.imp.RPCRT4.dll_RpcServerInqBindings]
mov ebx, eax
test eax, eax
jne 0x180057248
mov rax, qword [rsp + 0x60]
cmp dword [rax], ebx
jbe 0x1800571c1
mov rcx, qword [rax + rbx*8 + 8]
lea rdx, [rsp + 0x68]
call qword [sym.imp.RPCRT4.dll_RpcBindingToStringBindingW]
test eax, eax
jne 0x1800571a8
mov r8, qword [rsp + 0x68]
lea rcx, str.___BindString__u_:__s_n
mov edx, ebx
call fcn.18004d68c
lea rcx, [rsp + 0x68]
call qword [sym.imp.RPCRT4.dll_RpcStringFreeW]
jmp 0x1800571b6
lea rcx, str.ERROR_kull_m_rpc_drsr_start_server___RpcBindingToStringBinding:__08x_n
mov edx, eax
call fcn.18004d68c
mov rax, qword [rsp + 0x60]
inc ebx
cmp ebx, dword [rax]
jb 0x180057174
mov rcx, qword [0x1801601a8]
lea r9, str.mimikatz_Ho__hey__Im_a_DC_:_
xor r8d, r8d
mov rdx, rax
call qword [sym.imp.RPCRT4.dll_RpcEpRegisterW]
lea rcx, [rsp + 0x60]
mov ebx, eax
call qword [sym.imp.RPCRT4.dll_RpcBindingVectorFree]
test ebx, ebx
jne 0x18005723d
lea rcx, str.___RPC_bind_registered_n
call fcn.18004d68c
lea ecx, [rbx + 1]
mov edx, 0x4d2
mov r8d, ecx
call qword [sym.imp.RPCRT4.dll_RpcServerListen]
mov ebx, eax
test eax, eax
jne 0x18005721d
lea rcx, str.___RPC_Server_is_waiting__n
call fcn.18004d68c
jmp 0x180057271
cmp eax, 0x6b1
jne 0x180057234
lea rcx, str.___RPC_Server_already_waiting__n
call fcn.18004d68c
xor ebx, ebx
jmp 0x180057271
lea rcx, str.ERROR_kull_m_rpc_drsr_start_server___RpcServerListen:__08x_n
jmp 0x18005726a
mov edx, ebx
lea rcx, str.ERROR_kull_m_rpc_drsr_start_server___RpcEpRegister:__08x_n
jmp 0x18005726c
lea rcx, str.ERROR_kull_m_rpc_drsr_start_server___RpcServerInqBindings:__08x_n
jmp 0x18005726a
lea rcx, str.ERROR_kull_m_rpc_drsr_start_server___RpcServerRegisterIf2:__08x_n
jmp 0x18005726a
lea rcx, str.ERROR_kull_m_rpc_drsr_start_server___RpcServerRegisterAuthInfo:__08x_n
jmp 0x18005726a
lea rcx, str.ERROR_kull_m_rpc_drsr_start_server___RpcServerUseProtseqEp:__08x_n
mov edx, eax
call fcn.18004d68c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x18007ef80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 0x10], rdx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
xor esi, esi
movsxd rbx, r8d
xor ebp, ebp
lea edi, [rsi + 1]
xor r13d, r13d
mov r10, rcx
lea r11, [rbx + rcx]
lea r14d, [rsi + 3]
cmp r9b, dil
jne 0x18007efc1
mov edx, edi
jmp 0x18007effe
movzx eax, r9b
mov ecx, r14d
mov edx, 2
sub ecx, eax
movsxd rax, ecx
jmp 0x18007efdf
cmp byte [rax + r10], sil
jne 0x18007efe4
add ecx, edx
add rax, rdx
cmp rax, rbx
jl 0x18007efd4
cmp ecx, r8d
movsxd r11, ecx
movzx eax, r9b
setl r13b
xor r11, rdi
and rax, rdi
add r11, r10
add r10, rax
lea rcx, [0x18013d5f0]
cmp r10, r11
jae 0x18007f03a
movzx eax, byte [r10]
test byte [rax + rcx], dil
je 0x18007f01f
movsxd rax, edx
add r10, rax
cmp r10, r11
jb 0x18007f00a
cmp r10, r11
jae 0x18007f03a
cmp byte [r10], 0x2d
jne 0x18007f02e
mov ebp, edi
jmp 0x18007f034
cmp byte [r10], 0x2b
jne 0x18007f03a
movsxd rax, edx
add r10, rax
mov r15, r10
jmp 0x18007f04b
cmp byte [r10], 0x30
jne 0x18007f050
movsxd rax, edx
add r10, rax
cmp r10, r11
jb 0x18007f03f
xor r8d, r8d
movsxd r12, edx
cmp r10, r11
jae 0x18007f0ad
mov r9, r10
movsx rbx, byte [r9]
lea eax, [rbx - 0x30]
cmp eax, 9
ja 0x18007f087
lea rcx, [rsi - 6]
add r8d, edx
add r9, r12
lea rcx, [rsi + rcx*4]
lea rsi, [rbx + rcx*2]
movsxd rcx, r8d
add rcx, r10
cmp rcx, r11
jb 0x18007f05e
movabs r9, 0x7fffffffffffffff
cmp rsi, r9
jbe 0x18007f0ad
mov rsi, qword [rsp + 0x58]
mov eax, ebp
neg eax
sbb rcx, rcx
neg rcx
add rcx, r9
mov qword [rsi], rcx
jmp 0x18007f0c1
mov rax, qword [rsp + 0x58]
test ebp, ebp
je 0x18007f0b9
neg rsi
mov qword [rax], rsi
mov rsi, qword [rsp + 0x58]
xor ebx, ebx
test r8d, r8d
jne 0x18007f0d2
cmp r15, r10
jne 0x18007f0d2
or ebx, 0xffffffff
jmp 0x18007f10a
test r13d, r13d
jne 0x18007f108
movsxd rcx, r8d
add rcx, r10
cmp rcx, r11
jae 0x18007f10a
mov r9d, r8d
lea r15, [0x18013d5f0]
movzx eax, byte [rcx]
test byte [rax + r15], dil
je 0x18007f108
add r9d, edx
add rcx, r12
movsxd rax, r9d
add rax, r10
cmp rax, r11
jae 0x18007f10a
jmp 0x18007f0ec
mov ebx, edi
imul eax, edx, 0x13
cmp r8d, eax
jge 0x18007f116
mov eax, ebx
jmp 0x18007f154
jg 0x18007f126
mov rcx, r10
call fcn.1800904c8
mov edi, eax
test eax, eax
js 0x18007f112
mov ecx, ebp
neg ecx
movabs rcx, 0x7fffffffffffffff
sbb rdx, rdx
neg rdx
add rdx, rcx
mov qword [rsi], rdx
test edi, edi
jle 0x18007f14b
mov eax, 2
jmp 0x18007f154
test ebp, ebp
cmovne r14d, ebx
mov eax, r14d
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1800a5f2c
Capabilities:
Create thread

Disassembly:
sub rsp, 0x28
mov r8, rcx
mov rcx, qword [rcx + 0x48]
xor eax, eax
test rcx, rcx
je 0x1800a5f5e
cmp dword [rcx + 0x20], eax
je 0x1800a5f56
mov rcx, qword [rcx]
lea rdx, [0x1800a6124]
add rsp, 0x28
jmp fcn.1800a51fc
mov rcx, r8
call fcn.1800a6018
add rsp, 0x28
ret

Function at 0x1800aa85c
Capabilities:
Reference sql statements

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x30
mov ebx, r8d
mov rdi, rdx
mov r8, rdx
mov dword [rax - 0x10], ebx
mov qword [rax - 0x18], rdx
lea r9, str.sqlite_master
lea rdx, str.SELECT_1_FROM___w_._s_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d_NULL
mov rsi, rcx
call fcn.180080b38
test ebx, ebx
jne 0x1800aa8af
lea r8, str.sqlite_master
lea rdx, str.SELECT_1_FROM_temp._s_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1_NULL
mov r9, rdi
mov rcx, rsi
call fcn.180080b38
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1800c96b4
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
cmp qword [0x180164bf8], 0
mov rbx, rcx
je 0x1800c9712
mov rcx, qword [0x180164bf0]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
and dword [rsp + 0x48], 0
or r8, 0xffffffffffffffff
inc r8
cmp byte [rbx + r8], 0
jne 0x1800c96e0
mov rcx, qword [0x180164bf8]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [0x180164bf0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
add rsp, 0x30
pop rbx
ret

Function at 0x1800c9720
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
push rbx
sub rsp, 0x430
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, 0x400
lea r9, str.__04x_
lea rcx, [rsp + 0x30]
lea r8d, [rbx - 1]
mov edx, ebx
mov dword [rsp + 0x20], eax
call fcn.1800c9dac
lea rcx, [rsp + 0x30]
or rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x1800c976a
lea r9, [rsp + 0x448]
lea rcx, [rsp + 0x30]
mov r8d, 0x3fd
mov qword [rsp + 0x20], r9
mov r9, qword [rsp + 0x440]
mov rdx, rbx
sub r8, rax
sub rdx, rax
add rcx, rax
call fcn.1800cdbb4
lea r8, [0x1800e5418]
lea rcx, [rsp + 0x30]
mov rdx, rbx
call fcn.1800c9df4
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [rsp + 0x30]
call fcn.1800c96b4
add rsp, 0x430
pop rbx
ret
Function at 0x140002924
Capabilities:
Encode data using xor

Disassembly:
movabs r9, 0xfffff78000000014
mov r9, qword [r9]
xor r9d, r8d
mov r8d, 0xc
sub rcx, rdx
mov al, byte [rcx + rdx]
xor al, r9b
mov byte [rdx], al
inc rdx
sub r8, 1
jne 0x14000293d
ret

Function at 0x140002dd4
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
movsxd r9, dword [rcx + 0x3c]
lea rbx, [rcx + 0x18]
add rbx, r9
xor r10d, r10d
xor edi, edi
mov r14, r8
mov r15, rdx
mov rbp, rcx
movzx eax, word [r9 + rcx + 0x14]
movzx esi, word [r9 + rcx + 6]
add rbx, rax
test esi, esi
je 0x140002e54
cmp dword [rbx], 0x45474150
je 0x140002e2e
cmp dword [rbx], 0x7865742e
jne 0x140002e4a
cmp byte [rbx + 4], 0x74
jne 0x140002e4a
mov ecx, dword [rbx + 0xc]
mov r9, r14
mov edx, dword [rbx + 8]
add rcx, rbp
mov r8, r15
call fcn.140002d60
mov r10, rax
test rax, rax
jne 0x140002e54
inc edi
add rbx, 0x28
cmp edi, esi
jb 0x140002e18
mov rbx, qword [rsp + 0x40]
mov rax, r10
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x140002e70
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x150
xor ebx, ebx
lea r9, [rax + 0x18]
mov r14, rdx
mov dword [rax + 0x18], ebx
mov r15, rcx
xor r8d, r8d
xor edx, edx
mov ebp, ebx
lea esi, [rbx + 0xb]
mov ecx, esi
call sub.ntoskrnl.exe_ZwQuerySystemInformation
cmp eax, 0xc0000004
jne 0x140002fca
mov edx, dword [rsp + 0x180]
xor ecx, ecx
mov r8d, 0x6e556353
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rdi, rax
test rax, rax
je 0x140002fca
mov r8d, dword [rsp + 0x180]
xor r9d, r9d
mov rdx, rax
mov ecx, esi
call sub.ntoskrnl.exe_ZwQuerySystemInformation
test eax, eax
js 0x140002fba
mov esi, ebx
cmp dword [rdi], ebx
jbe 0x140002fb7
mov eax, esi
mov edx, 2
imul rcx, rax, 0x128
lea rax, [rdi + 8]
add rax, rcx
lea rcx, [rsp + 0x20]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rcx], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx + 0x30], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx + 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx + 0x50], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x140002f18
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
mov rax, qword [rax + 0x20]
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm1
mov qword [rcx + 0x20], rax
lea rcx, [rsp + 0x48]
call fcn.140003028
mov rcx, rax
mov rdx, r15
call sub.ntoskrnl.exe_strstr
test rax, rax
jne 0x140002fa6
inc esi
cmp esi, dword [rdi]
jb 0x140002efe
jmp 0x140002fb7
mov rbp, qword [rsp + 0x30]
test r14, r14
je 0x140002fb7
mov eax, dword [rsp + 0x38]
mov dword [r14], eax
mov rbx, rbp
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rax, rbx
jmp 0x140002fcc
xor eax, eax
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret

Function at 0x140002fec
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov r8, rcx
test edx, edx
jne 0x140002ff6
xor eax, eax
ret
movzx eax, byte [rcx]
xor eax, 0x4f9ace2f
imul ecx, eax, 0x1000193
cmp edx, 1
jbe 0x140003023
inc r8
dec edx
movzx eax, byte [r8]
inc r8
xor eax, ecx
imul ecx, eax, 0x1000193
sub rdx, 1
jne 0x14000300e
mov eax, ecx
ret
Function at 0x1400030e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov edi, r8d
mov ebx, ecx
mov edx, r8d
mov rcx, rsi
call fcn.140002fec
xor ebx, eax
test edi, edi
je 0x14000313f
mov r8d, edi
imul ebx, ebx, 0x41c64e6d
mov eax, 0x80808081
add ebx, 0x3039
mov ecx, ebx
shr ecx, 0x10
and ecx, 0x7fff
mul ecx
shr edx, 7
imul eax, edx, 0xff
sub ecx, eax
xor byte [rsi], cl
inc rsi
sub r8, 1
jne 0x14000310b
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1800045b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
movsxd r15, dword [rcx + 0x3c]
xor r11d, r11d
mov rbp, rdx
mov rdi, rcx
mov ebx, dword [r15 + rcx + 0x88]
add rbx, rcx
mov r14d, dword [rbx + 0x24]
mov r10d, dword [rbx + 0x20]
add r14, rcx
add r10, rcx
cmp rdx, 0x10000
jae 0x180004624
mov r8d, dword [rbx + 0x10]
movzx edx, bp
cmp edx, r8d
jb 0x180004700
mov ecx, dword [rbx + 0x14]
add ecx, r8d
cmp edx, ecx
jae 0x180004700
mov ecx, dword [rbx + 0x1c]
sub edx, r8d
add rcx, rdi
mov r11, qword [rcx + rdx*8]
jmp 0x180004677
mov esi, dword [rbx + 0x18]
mov r9d, r11d
test esi, esi
je 0x18000467a
nop
mov r8d, dword [r10]
mov rax, rbp
add r8, rdi
sub r8, rbp
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x180004653
inc rax
test ecx, ecx
jne 0x180004640
test edx, edx
je 0x180004665
inc r9d
add r10, 4
cmp r9d, esi
jb 0x180004630
jmp 0x18000467a
mov ecx, dword [rbx + 0x1c]
mov eax, r9d
add rcx, rdi
movzx edx, word [r14 + rax*2]
mov r11d, dword [rcx + rdx*4]
add r11, rdi
cmp r11, rbx
jb 0x1800046e4
mov eax, dword [r15 + rdi + 0x8c]
add rax, rbx
cmp r11, rax
jae 0x1800046e4
mov rcx, r11
call fcn.18005ae63
mov rbx, rax
test rax, rax
je 0x180004700
mov edx, 0x2e
mov rcx, rax
call fcn.180009ce0
cmp qword [0x180060210], 0
mov rdi, rax
mov byte [rax], 0
je 0x180004700
mov rcx, rbx
call qword [0x180060210]
mov rcx, rbx
mov rsi, rax
call fcn.18005ae69
test rsi, rsi
je 0x180004700
lea rdx, [rdi + 1]
mov rcx, rsi
call fcn.1800045b0
mov r11, rax
mov rax, r11
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
xor eax, eax
jmp 0x1800046e7
Function at 0x180005cf0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x180079068]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r14, rdx
mov qword [rsp + 0x30], rdx
mov rsi, rcx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rdx
xor edi, edi
mov dword [rsp + 0x28], edi
call fcn.180002f40
mov dword [rsp + 0x28], 1
mov ebp, edi
mov r15d, edi
mov rcx, r14
call fcn.180009c40
mov r14, rax
test rax, rax
je 0x180005ef0
mov ebx, edi
jmp 0x180005d65
mov r15d, dword [rsp + 0x2c]
dec r14
movsxd rdx, r15d
mov rcx, qword [rsp + 0x30]
call fcn.180003cf0
movzx ecx, byte [rax]
mov byte [rsp + rbx + 0x20], cl
inc ebp
inc rbx
inc r15d
mov dword [rsp + 0x2c], r15d
movzx r13d, byte [rsp + 0x22]
movzx r15d, byte [rsp + 0x21]
movzx r12d, byte [rsp + 0x20]
cmp rbx, 3
jne 0x180005e1a
movzx eax, r12b
shr al, 2
mov byte [rsp + 0x24], al
movzx ecx, r12b
and cl, bl
shl cl, 4
movzx eax, r15b
shr al, 4
add cl, al
mov byte [rsp + 0x25], cl
movzx ecx, r15b
and cl, 0xf
shl cl, 2
movzx eax, r13b
shr al, 6
add cl, al
mov byte [rsp + 0x26], cl
movzx eax, r13b
and al, 0x3f
mov byte [rsp + 0x27], al
mov rbx, rdi
nop word [rax + rax]
movzx edx, byte [rsp + rbx + 0x24]
lea rcx, [0x1800799f8]
call fcn.180003cf0
movzx edx, byte [rax]
mov rcx, rsi
call fcn.180004030
inc rbx
cmp rbx, 4
jl 0x180005df0
mov ebp, edi
mov rbx, rdi
test r14, r14
jne 0x180005d60
test ebp, ebp
je 0x180005ef0
movsxd rax, ebp
cmp rax, 3
jge 0x180005e5a
jae 0x180005f22
mov byte [rsp + rax + 0x20], 0
inc rax
cmp rax, 3
jl 0x180005e34
movzx r13d, byte [rsp + 0x22]
movzx r15d, byte [rsp + 0x21]
movzx r12d, byte [rsp + 0x20]
movzx eax, r12b
shr al, 2
mov byte [rsp + 0x24], al
and r12b, 3
shl r12b, 4
movzx eax, r15b
shr al, 4
add r12b, al
mov byte [rsp + 0x25], r12b
and r15b, 0xf
shl r15b, 2
movzx eax, r13b
shr al, 6
add r15b, al
mov byte [rsp + 0x26], r15b
and r13b, 0x3f
mov byte [rsp + 0x27], r13b
lea eax, [rbp + 1]
movsxd rbx, eax
test eax, eax
jle 0x180005ed4
nop word [rax + rax]
movzx edx, byte [rsp + rdi + 0x24]
lea rcx, [0x1800799f8]
call fcn.180003cf0
movzx edx, byte [rax]
mov rcx, rsi
call fcn.180004030
inc rdi
cmp rdi, rbx
jl 0x180005eb0
cmp ebp, 3
jge 0x180005ef0
mov ebx, 3
sub ebx, ebp
mov dl, 0x3d
mov rcx, rsi
call fcn.180004030
sub rbx, 1
jne 0x180005ee0
mov rcx, qword [rsp + 0x30]
call fcn.180003900
mov rax, rsi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.18005b750
mov rbx, qword [rsp + 0xa0]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.18005b450
int3
Function at 0x180008d90
Capabilities:
Check for software breakpoints

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov r14, rcx
mov ebx, 1
xor ebp, ebp
mov rcx, r14
call fcn.180009c40
xor edx, edx
mov rcx, r14
lea edi, [rax - 6]
call fcn.180003cf0
mov rcx, rax
mov dword [rsp + 0x20], edi
mov r9d, ebx
lea rdx, [0x180060dbc]
mov r8d, 6
call fcn.180007130
movsxd rbx, eax
test eax, eax
jle 0x180008e4c
mov rcx, r14
call fcn.180009c40
sub rax, 0xa
cmp rbx, rax
jae 0x180008e36
inc ebp
nop dword [rax]
movsxd rsi, ebx
mov rcx, r14
inc ebx
movsxd rdx, ebx
call fcn.180003cf0
mov edx, 0xff
xor ecx, ecx
mov rdi, rax
call fcn.1800094d0
lea rdx, [rsi + 2]
mov byte [rdi], al
mov rcx, r14
call fcn.180005a70
cmp byte [rax], 0xcc
je 0x180008e00
test ebx, ebx
jle 0x180008e4c
mov rcx, r14
call fcn.180009c40
mov rcx, rax
mov eax, ebx
cmp rax, rcx
jb 0x180008db2
mov rbx, qword [rsp + 0x50]
mov eax, ebp
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret