joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b56d0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x1088
call fcn.004cd0c0
sub rsp, rax
movaps xmmword [rsp + 0x1070], xmm6
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rdx
lea rbx, [rsp + 0x70]
mov r8d, 0x1000
mov rcx, rbx
xor edx, edx
call sub.ntdll.dll_memset
mov dword [rsp + 0x30], 0
xorps xmm6, xmm6
movaps xmmword [rsp + 0x40], xmm6
mov qword [rsp + 0x50], 0
lea r13, [rsp + 0x30]
mov qword [rsp + 0x58], r13
lea rbp, [0x004ad300]
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x40]
mov rcx, rdi
mov rdx, rbx
mov r8d, 0x1000
call sub.KERNEL32.dll_ReadFileEx
test eax, eax
je 0x4b5865
lea rbx, [rsp + 0x40]
lea r14, [rsp + 0x70]
mov ecx, 0xffffffff
mov edx, 1
call sub.KERNEL32.dll_SleepEx
cmp dword [rsp + 0x30], 0
je 0x4b576d
cmp dword [rsp + 0x34], 0
jne 0x4b586a
mov r15d, dword [rsp + 0x38]
test r15, r15
je 0x4b586a
cmp r15d, 0x1000
ja 0x4b58aa
xor r12d, r12d
nop dword [rax]
cmp r12, r15
ja 0x4b5896
lea rdx, [rsp + r12]
add rdx, 0x70
mov r8d, r15d
sub r8d, r12d
mov dword [rsp + 0x30], 0
movaps xmmword [rsp + 0x40], xmm6
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x20], rbp
mov rcx, rsi
mov r9, rbx
call sub.KERNEL32.dll_WriteFileEx
test eax, eax
je 0x4b5865
nop word cs:[rax + rax]
mov ecx, 0xffffffff
mov edx, 1
call sub.KERNEL32.dll_SleepEx
cmp dword [rsp + 0x30], 0
je 0x4b5800
cmp dword [rsp + 0x34], 0
jne 0x4b586a
mov eax, dword [rsp + 0x38]
add r12, rax
cmp r12, r15
jne 0x4b57b0
mov dword [rsp + 0x30], 0
movaps xmmword [rsp + 0x40], xmm6
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x20], rbp
mov rcx, rdi
mov rdx, r14
mov r8d, 0x1000
mov r9, rbx
call sub.KERNEL32.dll_ReadFileEx
test eax, eax
jne 0x4b576d
call sub.KERNEL32.dll_GetLastError
mov rcx, rdi
call sub.KERNEL32.dll_CloseHandle
mov rcx, rsi
call sub.KERNEL32.dll_CloseHandle
movaps xmm6, xmmword [rsp + 0x1070]
add rsp, 0x1088
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea r8, str.library_std_src_syswindowspipe.rs
mov rcx, r12
mov rdx, r15
call fcn.004125d0
jmp 0x4b58be
lea r8, str.library_std_src_syswindowspipe.rs
mov edx, 0x1000
mov rcx, r15
call fcn.00411b70
ud2

Function at 0x4b5910
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rsi
sub rsp, 0x80
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x30]
mov edx, 0x10
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x4b5946
mov rax, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
add rsp, 0x80
pop rsi
ret
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x40], rax
lea rax, [fcn.004a7e40]
mov qword [rsp + 0x48], rax
lea rax, [0x005090b0]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 1
mov qword [rsp + 0x50], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 1
lea rdx, str.library_std_src_syswindows_rand.rs
lea rcx, [rsp + 0x50]
call fcn.00411160
ud2
Function at 0x4ba740
Capabilities:
Generate random numbers via winapi
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rsi, rcx
mov ecx, dword [0x004d0090]
test ecx, ecx
je 0x4ba855
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x4ba776
mov rcx, rax
cmp qword [rax], 0
je 0x4ba776
add rcx, 8
jmp 0x4ba84b
mov ecx, dword [0x004d0090]
test ecx, ecx
je 0x4ba868
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x4ba82f
mov rdi, rax
test rax, rax
jne 0x4ba7e2
mov ecx, 0x20
mov edx, 8
call fcn.0040c730
test rax, rax
je 0x4ba88e
mov rdi, rax
mov qword [rax], 0
lea rax, [0x004d0078]
mov qword [rdi + 0x18], rax
mov ecx, dword [0x004d0090]
test ecx, ecx
je 0x4ba87b
dec ecx
mov rdx, rdi
call sub.KERNEL32.dll_TlsSetValue
test rsi, rsi
je 0x4ba7ff
mov rcx, qword [rsi]
mov rax, qword [rsi + 8]
mov rdx, qword [rsi + 0x10]
mov qword [rsi], 0
cmp rcx, 1
je 0x4ba838
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x10
mov r9d, 2
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
js 0x4ba833
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
jmp 0x4ba838
xor ecx, ecx
jmp 0x4ba84b
call fcn.004b5910
mov qword [rdi], 1
lea rcx, [rdi + 8]
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], rdx
mov rax, rcx
add rsp, 0x38
pop rdi
pop rsi
ret
lea rcx, [0x004d0078]
call fcn.004896b0
mov ecx, eax
jmp 0x4ba759
lea rcx, [0x004d0078]
call fcn.004896b0
mov ecx, eax
jmp 0x4ba786
lea rcx, [0x004d0078]
call fcn.004896b0
mov ecx, eax
jmp 0x4ba7da
mov ecx, 0x20
mov edx, 8
call fcn.0040e250
ud2
Function at 0x4ba920
Capabilities:
Copy file

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x80
mov rbx, r9
mov rdi, rcx
lea rcx, [rsp + 0x38]
call fcn.0048b840
mov r14, qword [rsp + 0x38]
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x4baa47
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rcx
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0x38]
mov r8b, 1
call fcn.004a6a50
mov r14, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
test rsi, rsi
je 0x4baa47
mov r8, qword [rsp + 0xd0]
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0x38]
mov rdx, rbx
call fcn.0048b840
mov r15, qword [rsp + 0x38]
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x4baa54
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rcx
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0x38]
mov r8b, 1
call fcn.004a6a50
mov r15, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
test rbx, rbx
je 0x4baa54
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r8, [0x004baad0]
lea r9, [rsp + 0x38]
mov rcx, rsi
mov rdx, rbx
call sub.KERNEL32.dll_CopyFileExW
test eax, eax
je 0x4baa61
mov rax, qword [rsp + 0x38]
mov qword [rdi + 8], rax
mov qword [rdi], 0
test r15, r15
jne 0x4baa7e
jmp 0x4baa8b
mov qword [rdi + 8], r14
mov qword [rdi], 1
jmp 0x4baa9d
mov qword [rdi + 8], r15
mov qword [rdi], 1
jmp 0x4baa8b
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rdi + 8], rax
mov qword [rdi], 1
test r15, r15
je 0x4baa8b
mov edx, 2
mov rcx, rbx
call fcn.0040c7c0
test r14, r14
je 0x4baa9d
mov edx, 2
mov rcx, rsi
call fcn.0040c7c0
nop
add rsp, 0x80
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x4bad20
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov rbx, r8
mov rsi, rcx
test rdx, rdx
je 0x4bad4b
mov qword [rsi + 8], rbx
mov qword [rsi], 1
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
mov rax, qword [0x00542108]
cmp rax, 3
jne 0x4baec7
cmp word [rbx], 0
mov eax, 2
mov ebp, 0x17
cmove ebp, eax
mov dword [rsp + 0x28], 0x81
mov dword [rsp + 0x20], 0
mov ecx, ebp
mov edx, 2
xor r8d, r8d
xor r9d, r9d
call sub.WS2_32.dll_WSASocketW
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x4badc0
cmp word [rbx], 0
je 0x4bae36
movups xmm0, xmmword [rbx + 4]
mov eax, dword [rbx + 0x14]
mov edx, dword [rbx + 0x18]
movzx ecx, word [rbx + 0x1c]
mov r8d, 0x1c
mov r9w, 0x17
jmp 0x4bae4b
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x2739
je 0x4badda
mov r14d, eax
cmp eax, 0x2726
jne 0x4baeb6
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0
mov ecx, ebp
mov edx, 2
xor r8d, r8d
xor r9d, r9d
call sub.WS2_32.dll_WSASocketW
cmp rax, 0xffffffffffffffff
je 0x4baeae
mov rdi, rax
mov rcx, rax
mov edx, 1
xor r8d, r8d
call sub.KERNEL32.dll_SetHandleInformation
test eax, eax
jne 0x4bad98
call sub.KERNEL32.dll_GetLastError
mov r14d, eax
mov rcx, rdi
call fcn.004cd648
jmp 0x4baeb6
mov eax, dword [rbx + 2]
movzx ecx, word [rbx + 6]
xorps xmm0, xmm0
mov r8d, 0x10
mov r9w, 2
rol cx, 8
mov word [rsp + 0x30], r9w
mov word [rsp + 0x32], cx
mov dword [rsp + 0x34], eax
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x48], edx
lea rdx, [rsp + 0x30]
mov rcx, rdi
call sub.WS2_32.dll_bind
cmp eax, 0xffffffff
je 0x4bae89
mov qword [rsi + 8], rdi
mov qword [rsi], 0
jmp 0x4bad40
call sub.WS2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
mov rcx, rdi
call fcn.004cd648
jmp 0x4bad40
call sub.WS2_32.dll_WSAGetLastError
mov r14d, eax
shl r14, 0x20
or r14, 2
mov qword [rsi + 8], r14
jmp 0x4bad39
call fcn.004ac580
jmp 0x4bad5c
Function at 0x4bc2bd
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xc8
mov r14, rcx
lea rcx, [0x004d0150]
call fcn.00419b22
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x4bc2f7
mov rbx, rax
cmp qword [rax], 0
je 0x4bc2f7
add rbx, 8
jmp 0x4bc3c8
lea rsi, [0x004d0150]
mov rcx, rsi
call fcn.00419b22
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x4bc370
mov rbx, rax
test rax, rax
jne 0x4bc347
mov ecx, 0x60
mov edx, 8
call fcn.004bc3d8
mov rbx, rax
and qword [rax], 0
mov qword [rax + 0x58], rsi
mov rcx, rsi
call fcn.00419b22
mov ecx, eax
mov rdx, rbx
call sub.KERNEL32.dll_TlsSetValue
test r14, r14
je 0x4bc37e
lea rax, [rsp + 0x20]
mov ecx, 0xb
mov rdi, rax
mov rsi, r14
rep movsq qword [rdi], qword [rsi]
and qword [r14], 0
cmp qword [rax], 0
je 0x4bc374
lea rsi, [rsp + 0x28]
jmp 0x4bc385
xor ebx, ebx
jmp 0x4bc3c8
lea rcx, [rsp + 0x20]
call fcn.004bb3aa
lea rsi, [0x0050b368]
lea rdi, [rsp + 0x78]
mov ecx, 0xa
rep movsq qword [rdi], qword [rsi]
lea rax, [rsp + 0x20]
mov ecx, 0xb
mov rdi, rax
mov rsi, rbx
rep movsq qword [rdi], qword [rsi]
mov qword [rbx], 1
add rbx, 8
lea rsi, [rsp + 0x78]
mov ecx, 0xa
mov rdi, rbx
rep movsq qword [rdi], qword [rsi]
mov rcx, rax
call fcn.004bb3aa
mov rax, rbx
add rsp, 0xc8
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x4c1b70
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx]
mov rdx, rax
xor rdx, 3
lock cmpxchg qword [rcx], rdx
jne 0x4c1b77
test al, 1
je 0x4c1b96
test al, 2
jne 0x4c1bab
xor rax, 3
add rsp, 0x28
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x0050cb38]
mov edx, 0x23
jmp 0x4c1bbe
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x0050cb78]
mov edx, 0x25
call fcn.00411f40
ud2
Function at 0x4c2744
Capabilities:
Send data
Send data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov r15, r9
mov rbx, r8
mov r14, rdx
mov qword [rsp + 0x28], rcx
mov rax, qword [rsp + 0xc0]
lea rdi, [rdx + 0x10]
lea rbp, [rsp + 0x3a]
xor r12d, r12d
cmp qword [rdx + 8], 0xffffffffffffffff
cmovne r12, rdx
mov r13d, 0x7fffffff
cmp rax, r13
cmovb r13, rax
lea rsi, [rsp + 0x30]
mov qword [rsp + 0x40], r12
mov rdx, qword [r14 + 0x20]
mov rcx, rsi
mov r8, rbx
call fcn.004c24cc
mov al, byte [rsp + 0x39]
cmp al, 3
je 0x4c28b6
mov rcx, qword [rsp + 0x30]
cmp al, 2
je 0x4c28c4
mov dl, byte [rsp + 0x38]
movzx r8d, word [rbp + 4]
lea r9, [rsp + 0x52]
mov word [r9 + 4], r8w
mov r8d, dword [rbp]
mov dword [r9], r8d
mov qword [rsp + 0x48], rcx
mov byte [rsp + 0x50], dl
mov byte [rsp + 0x51], al
mov rcx, r12
lea rdx, str._cargo_registry_src_index.crates.io_6f17d22bba15001f_tokio_1.29.0_src_io_poll_evented.rs
call fcn.004c11be
mov rcx, qword [r12 + 8]
mov rdx, r15
mov r8d, r13d
xor r9d, r9d
call sub.WS2_32.dll_send
cmp eax, 0xffffffff
jne 0x4c28d2
call sub.WS2_32.dll_WSAGetLastError
mov esi, eax
shl rsi, 0x20
or rsi, 2
mov rcx, rsi
call fcn.0041f3be
cmp al, 0xd
jne 0x4c2886
mov rax, qword [r12]
test rax, rax
je 0x4c2886
mov rcx, qword [rax + 8]
mov rdx, qword [rax + 0x10]
lock inc qword [rdx]
jle 0x4c2905
mov r12, r13
mov r13, rbx
add rcx, 0x10
mov r8, qword [rax]
mov r9b, byte [rax + 0x18]
call fcn.0043b631
mov rbx, rax
xor ecx, ecx
call fcn.0043a3e6
test rbx, rbx
je 0x4c287b
mov ecx, 1
mov rdx, rsi
call fcn.0043b758
mov rsi, rbx
mov rbx, r13
mov r13, r12
mov r12, qword [rsp + 0x40]
mov rcx, rsi
call fcn.004be286
cmp al, 0xd
jne 0x4c28e4
mov qword [rsp + 0x30], rsi
mov rcx, rdi
lea rdx, [rsp + 0x48]
call fcn.004c2274
lea rsi, [rsp + 0x30]
mov rcx, rsi
call fcn.004bc402
jmp 0x4c2796
mov rax, qword [rsp + 0x28]
mov qword [rax], 2
jmp 0x4c28f4
mov rax, qword [rsp + 0x28]
mov qword [rax], 1
jmp 0x4c28de
movsxd rcx, eax
mov rax, qword [rsp + 0x28]
and qword [rax], 0
mov qword [rax + 8], rcx
jmp 0x4c28f4
mov rax, qword [rsp + 0x28]
mov qword [rax], 1
mov qword [rax + 8], rsi
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
ud2

Function at 0x4c2b6a
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
lea rcx, [0x004d0170]
call fcn.00419b22
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x4c2b92
mov rsi, rax
cmp qword [rax], 0
jne 0x4c2bfe
lea rdi, [0x004d0170]
mov rcx, rdi
call fcn.00419b22
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x4c2bfc
mov rsi, rax
test rax, rax
jne 0x4c2be2
mov ecx, 0x10
mov edx, 8
call fcn.004bc3d8
mov rsi, rax
and qword [rax], 0
mov qword [rax + 8], rdi
mov rcx, rdi
call fcn.00419b22
mov ecx, eax
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
call fcn.004bfa78
mov rdx, qword [rsi]
lea rcx, [rsp + 0x20]
mov qword [rcx], rdx
mov qword [rsi], rax
call fcn.004bfaac
jmp 0x4c2bfe
xor esi, esi
mov rax, rsi
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x4ce410
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rsi, rcx
mov ecx, dword [0x005427c4]
mov rdi, rdx
mov rbp, r8
test ecx, ecx
jle 0x4ce530
mov rax, qword [0x005427c8]
xor ebx, ebx
add rax, 0x18
mov rdx, qword [rax]
cmp rsi, rdx
jb 0x4ce45c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rsi, rdx
jb 0x4ce516
add ebx, 1
add rax, 0x28
cmp ebx, ecx
jne 0x4ce440
mov rcx, rsi
call fcn.004cf050
test rax, rax
mov r12, rax
je 0x4ce568
movsxd rbx, ebx
lea rbx, [rbx + rbx*4]
shl rbx, 3
mov r13, rbx
add r13, qword [0x005427c8]
mov qword [r13 + 0x20], rax
mov dword [r13], 0
call fcn.004cf1a0
mov edx, dword [r12 + 0xc]
mov r8d, 0x30
add rax, rdx
lea rdx, [rsp + 0x20]
mov qword [r13 + 0x18], rax
mov rax, qword [0x005427c8]
mov rcx, qword [rax + rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x4ce54b
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x4ce50f
sub eax, 0x40
and eax, 0xffffffbf
je 0x4ce50f
add rbx, qword [0x005427c8]
mov rcx, qword [rsp + 0x20]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov r9, rbx
mov qword [rbx + 8], rcx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x4ce537
add dword [0x005427c4], 1
mov r8, rbp
mov rdx, rdi
mov rcx, rsi
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sub.ntdll.dll_memcpy
xor ebx, ebx
jmp 0x4ce467
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.004ce3a0
mov rax, qword [0x005427c8]
mov edx, dword [r12 + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.004ce3a0
lea rcx, str.Address__p_has_no_image_section
mov rdx, rsi
call fcn.004ce3a0
nop
nop dword [rax + rax]

Function at 0x4cecc0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x00542aa0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x00542a80]
test rbx, rbx
je 0x4ced14
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x4ced0b
test rsi, rsi
je 0x4ced0b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x4cecf0
lea rcx, [0x00542aa0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x4cf050
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x00532c80]
xor edx, edx
mov r8, rcx
cmp word [r9], 0x5a4d
je 0x4cf070
mov rax, rdx
add rsp, 0x28
ret
mov rcx, r9
call fcn.004cef30
test eax, eax
je 0x4cf068
movsxd rax, dword [r9 + 0x3c]
mov rcx, r8
sub rcx, r9
add rax, r9
movzx edx, word [rax + 0x14]
lea rdx, [rax + rdx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x4cf0cd
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
cmp rcx, r8
mov rax, r8
jb 0x4cf0c4
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x4cf068
add rdx, 0x28
cmp rdx, r9
jne 0x4cf0b0
xor edx, edx
mov rax, rdx
add rsp, 0x28
ret
Function at 0x180001e90
Capabilities:
Create thread

Disassembly:
sub rsp, 0x68
mov rax, qword [0x180006040]
xor rax, rsp
mov qword [rsp + 0x50], rax
cmp edx, 1
jne 0x180001f22
mov edx, 0x1f4
mov ecx, 0x190
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 8
call fcn.180002814
lea rcx, [0x180001ca0]
mov qword [rax], rcx
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x180002780]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x180001f45
cmp dword [rsp + 0x38], 0
je 0x180001f39
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x180001f39
mov eax, 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1800027c0
add rsp, 0x68
ret
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x38], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x140006860
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aeskeygenassist xmm0, xmmword [rdx], 2
movdqa xmmword [rcx], xmm0
ret
Function at 0x140007980
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x68
movaps xmmword [rsp + 0x50], xmm11
movaps xmmword [rsp + 0x40], xmm10
movaps xmmword [rsp + 0x30], xmm9
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x10], xmm7
movaps xmmword [rsp], xmm6
movdqu xmm0, xmmword [rcx]
movdqu xmm1, xmmword [rcx + 0x10]
movdqu xmm2, xmmword [rcx + 0x20]
movdqu xmm3, xmmword [rcx + 0x30]
movdqu xmm4, xmmword [rcx + 0x40]
movdqu xmm5, xmmword [rcx + 0x50]
movdqu xmm6, xmmword [rcx + 0x60]
movdqu xmm7, xmmword [rcx + 0x70]
movdqa xmm8, xmmword [rdx + 0xa0]
pxor xmm0, xmm8
pxor xmm1, xmm8
pxor xmm2, xmm8
pxor xmm3, xmm8
pxor xmm4, xmm8
pxor xmm5, xmm8
pxor xmm6, xmm8
movdqa xmm9, xmmword [rdx + 0x90]
aesdec xmm0, xmm9
aesdec xmm1, xmm9
aesdec xmm2, xmm9
aesdec xmm3, xmm9
aesdec xmm4, xmm9
aesdec xmm5, xmm9
aesdec xmm6, xmm9
pxor xmm7, xmm8
aesdec xmm7, xmm9
movdqa xmm8, xmmword [rdx + 0x80]
aesdec xmm0, xmm8
aesdec xmm1, xmm8
aesdec xmm2, xmm8
aesdec xmm3, xmm8
aesdec xmm4, xmm8
aesdec xmm5, xmm8
aesdec xmm6, xmm8
aesdec xmm7, xmm8
movdqa xmm8, xmmword [rdx + 0x70]
aesdec xmm0, xmm8
aesdec xmm1, xmm8
aesdec xmm2, xmm8
aesdec xmm3, xmm8
aesdec xmm4, xmm8
aesdec xmm5, xmm8
aesdec xmm6, xmm8
aesdec xmm7, xmm8
movdqa xmm8, xmmword [rdx + 0x60]
aesdec xmm0, xmm8
aesdec xmm1, xmm8
aesdec xmm2, xmm8
aesdec xmm3, xmm8
aesdec xmm4, xmm8
aesdec xmm5, xmm8
aesdec xmm6, xmm8
aesdec xmm7, xmm8
movdqa xmm8, xmmword [rdx + 0x50]
aesdec xmm0, xmm8
aesdec xmm1, xmm8
aesdec xmm2, xmm8
aesdec xmm3, xmm8
aesdec xmm4, xmm8
aesdec xmm5, xmm8
aesdec xmm6, xmm8
aesdec xmm7, xmm8
movdqa xmm8, xmmword [rdx + 0x40]
aesdec xmm0, xmm8
aesdec xmm1, xmm8
aesdec xmm2, xmm8
aesdec xmm3, xmm8
aesdec xmm4, xmm8
aesdec xmm5, xmm8
aesdec xmm6, xmm8
aesdec xmm7, xmm8
movdqa xmm8, xmmword [rdx]
movdqa xmm9, xmmword [rdx + 0x10]
movdqa xmm10, xmmword [rdx + 0x20]
movdqa xmm11, xmmword [rdx + 0x30]
aesdec xmm0, xmm11
aesdec xmm1, xmm11
aesdec xmm2, xmm11
aesdec xmm3, xmm11
aesdec xmm4, xmm11
aesdec xmm5, xmm11
aesdec xmm6, xmm11
aesdec xmm7, xmm11
aesdec xmm0, xmm10
aesdec xmm1, xmm10
aesdec xmm2, xmm10
aesdec xmm3, xmm10
aesdec xmm4, xmm10
aesdec xmm5, xmm10
aesdec xmm6, xmm10
aesdec xmm7, xmm10
aesdec xmm0, xmm9
aesdec xmm1, xmm9
aesdec xmm2, xmm9
aesdec xmm3, xmm9
aesdec xmm4, xmm9
aesdec xmm5, xmm9
aesdec xmm6, xmm9
aesdec xmm7, xmm9
aesdeclast xmm0, xmm8
aesdeclast xmm1, xmm8
aesdeclast xmm2, xmm8
aesdeclast xmm3, xmm8
aesdeclast xmm4, xmm8
aesdeclast xmm5, xmm8
aesdeclast xmm6, xmm8
aesdeclast xmm7, xmm8
movdqu xmmword [rcx], xmm0
movdqu xmmword [rcx + 0x10], xmm1
movdqu xmmword [rcx + 0x20], xmm2
movdqu xmmword [rcx + 0x30], xmm3
movdqu xmmword [rcx + 0x40], xmm4
movdqu xmmword [rcx + 0x50], xmm5
movdqu xmmword [rcx + 0x60], xmm6
movdqu xmmword [rcx + 0x70], xmm7
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
movaps xmm11, xmmword [rsp + 0x50]
add rsp, 0x68
ret
Function at 0x14000bdc0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x14000be02
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 4
jb 0x14000be0a
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x14000be1b
jmp 0x14000be32
xor r10d, r10d
jmp 0x14000bebd
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x14000be32
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x14000be49
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x14000be69
add r11, r8
jmp 0x14000bf9b
mov rcx, qword [rax + 0x18]
xor rcx, rsi
mov rdi, qword [rax + 0x10]
mov r9, qword [rax]
add r9, rdi
mov r11, qword [rax + 8]
add r11, rcx
rol rdi, 0xd
xor rdi, r9
rol rcx, 0x10
rol r9, 0x20
xor rcx, r11
add r11, rdi
rol rdi, 0x11
add r9, rcx
xor rdi, r11
rol rcx, 0x15
mov qword [rax + 0x10], rdi
xor rcx, r9
rol r11, 0x20
mov qword [rax + 0x18], rcx
mov qword [rax + 8], r11
xor r9, rsi
mov qword [rax], r9
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x14000bf32
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
mov rbx, qword [rdx + r10]
xor rdi, rbx
add rcx, rsi
rol rsi, 0xd
add r9, rdi
xor rsi, rcx
rol rdi, 0x10
xor rdi, r9
rol rcx, 0x20
add r9, rsi
add rcx, rdi
rol rsi, 0x11
xor rsi, r9
rol rdi, 0x15
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x14000bee0
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 4
jb 0x14000bf50
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x14000bf62
jmp 0x14000bf7d
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x14000bf7d
lea rcx, [rdx + r8]
movzx esi, word [r10 + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x14000bf97
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret