joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140099bc0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rdi, qword [rdx]
add dword [rcx], 2
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rbx
lea rdx, [0x1400c9d5f]
lea r8, str.StringLiteral
mov rcx, rax
call fcn.140083f20
mov rdi, qword [rdi + 0x18]
mov ecx, 2
call rbx
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x140099c3a
xor ebp, ebp
nop word cs:[rax + rax]
mov ecx, 2
call rbx
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
inc ebp
cmp ebp, dword [rsi]
jne 0x140099c20
mov byte [rsi + 4], 0
test rdi, rdi
je 0x140099c50
mov rcx, rdi
mov rdx, rsi
call fcn.140093a50
jmp 0x140099c75
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rsi + 4], 1
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x29
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add dword [rsi], 0xfffffffe
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret

Function at 0x140099ca0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rdi, qword [rdx]
add dword [rcx], 2
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rbx
lea rdx, [0x1400c9d5f]
lea r8, str.LambdaExpr
mov rcx, rax
call fcn.140083f20
mov rdi, qword [rdi + 0x18]
mov ecx, 2
call rbx
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x140099d1a
xor ebp, ebp
nop word cs:[rax + rax]
mov ecx, 2
call rbx
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
inc ebp
cmp ebp, dword [rsi]
jne 0x140099d00
mov byte [rsi + 4], 0
test rdi, rdi
je 0x140099d30
mov rcx, rdi
mov rdx, rsi
call fcn.140093a50
jmp 0x140099d55
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rsi + 4], 1
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x29
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add dword [rsi], 0xfffffffe
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x140099d80
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov rsi, rcx
mov r14, qword [rdx]
add dword [rcx], 2
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rbx
lea rdx, [0x1400c9d5f]
lea r8, str.EnumLiteral
mov rcx, rax
call fcn.140083f20
mov rdi, qword [r14 + 0x18]
movups xmm0, xmmword [r14 + 0x20]
movaps xmmword [rsp + 0x20], xmm0
mov ecx, 2
call rbx
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x140099dfa
xor ebp, ebp
mov ecx, 2
call rbx
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
inc ebp
cmp ebp, dword [rsi]
jne 0x140099de0
mov byte [rsi + 4], 0
test rdi, rdi
je 0x140099e10
mov rcx, rdi
mov rdx, rsi
call fcn.140093a50
jmp 0x140099e35
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rsi + 4], 1
movaps xmm0, xmmword [rsp + 0x20]
movaps xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.140095390
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x29
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add dword [rsi], 0xfffffffe
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x140099e80
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rbx, qword [rdx]
add dword [rcx], 2
mov r15, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call r15
lea rdx, [0x1400c9d5f]
lea r8, str.BracedExpr
mov rcx, rax
call fcn.140083f20
mov r14, qword [rbx + 0x18]
mov rdi, qword [rbx + 0x20]
movzx ebx, byte [rbx + 0x28]
mov ecx, 2
call r15
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x140099f0b
xor ebp, ebp
nop word cs:[rax + rax]
mov ecx, 2
call r15
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
inc ebp
cmp ebp, dword [rsi]
jne 0x140099ef0
mov byte [rsi + 4], 0
test r14, r14
je 0x140099f21
mov rcx, r14
mov rdx, rsi
call fcn.140093a50
jmp 0x140099f46
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rsi + 4], 1
mov rcx, rsi
mov rdx, rdi
call fcn.1400951d0
mov rcx, rsi
mov edx, ebx
call fcn.1400970f0
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x29
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add dword [rsi], 0xfffffffe
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140099f90
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rdi, qword [rdx]
add dword [rcx], 2
mov r15, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call r15
lea rdx, [0x1400c9d5f]
lea r8, str.BracedRangeExpr
mov rcx, rax
call fcn.140083f20
mov r14, qword [rdi + 0x18]
mov rbx, qword [rdi + 0x20]
mov rdi, qword [rdi + 0x28]
mov ecx, 2
call r15
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x14009a01b
xor ebp, ebp
nop word cs:[rax + rax]
mov ecx, 2
call r15
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
inc ebp
cmp ebp, dword [rsi]
jne 0x14009a000
mov byte [rsi + 4], 0
test r14, r14
je 0x14009a031
mov rcx, r14
mov rdx, rsi
call fcn.140093a50
jmp 0x14009a056
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rsi + 4], 1
mov rcx, rsi
mov rdx, rbx
call fcn.1400951d0
mov rcx, rsi
mov rdx, rdi
call fcn.1400951d0
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x29
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add dword [rsi], 0xfffffffe
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400b3fd0
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov al, byte [0x1400ecf98]
test al, al
je 0x1400b40cf
cmp qword [0x142255880], 0
je 0x1400b4040
mov rax, qword [str.XP_B]
mov rcx, qword [rax]
mov rdx, qword [rcx - 0x18]
lea rcx, [rax + rdx]
mov r8, qword [0x1422559d8]
mov qword [rax + rdx + 0x28], r8
xor edx, edx
call fcn.140023920
mov rax, qword [0x1400d4320]
mov rcx, qword [rax]
mov rdx, qword [rcx - 0x18]
lea rcx, [rax + rdx]
mov r8, qword [0x142255988]
mov qword [rax + rdx + 0x28], r8
xor edx, edx
call fcn.140023920
call fcn.1400b41e0
movzx eax, byte [rsi]
test al, 1
je 0x1400b404d
mov rax, qword [rsi + 8]
jmp 0x1400b404f
shr eax, 1
test rax, rax
je 0x1400b40c7
lea rcx, [0x142255800]
mov rdx, rsi
mov r8d, 0x10
call fcn.1400b4220
cmp qword [0x142255880], 0
je 0x1400b4105
mov rax, qword [0x1400d4320]
mov rcx, qword [rax]
mov rdx, qword [rcx - 0x18]
lea rcx, [rax + rdx]
lea r8, [0x142255948]
mov qword [rax + rdx + 0x28], r8
xor edx, edx
call fcn.140023920
mov rax, qword [str.XP_B]
mov rcx, qword [rax]
mov rdx, qword [rcx - 0x18]
lea rcx, [rax + rdx]
lea r8, [0x142255998]
mov qword [rax + rdx + 0x28], r8
xor edx, edx
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140023920
nop
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x1400ecf98]
call fcn.140033cb0
test eax, eax
je 0x1400b3fe7
call fcn.1400b4140
lea rcx, [0x1400b41d0]
call fcn.140030940
lea rcx, [0x1400ecf98]
call fcn.140033d8b
jmp 0x1400b3fe7
mov rdi, qword [0x1400d4328]
lea rdx, str.Unable_to_open_debug_log_file
mov rcx, rdi
call fcn.140018990
mov rcx, rdi
mov rdx, rsi
call fcn.140018170
mov rcx, rdi
call fcn.1400185c0
mov ecx, 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
int3

Function at 0x1400b9570
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r9d, 0xffffffff
lea r8, [0x1400d3480]
cmp rdx, 4
jb 0x1400b95d6
mov eax, r9d
xor r9b, byte [rcx]
shr eax, 8
movzx r9d, r9b
xor eax, dword [r8 + r9*4]
mov r9d, eax
xor al, byte [rcx + 1]
shr r9d, 8
movzx eax, al
xor r9d, dword [r8 + rax*4]
mov eax, r9d
xor r9b, byte [rcx + 2]
shr eax, 8
movzx r9d, r9b
xor eax, dword [r8 + r9*4]
mov r9d, eax
xor al, byte [rcx + 3]
shr r9d, 8
movzx eax, al
xor r9d, dword [r8 + rax*4]
add rcx, 4
add rdx, 0xfffffffffffffffc
cmp rdx, 3
ja 0x1400b9583
test rdx, rdx
je 0x1400b95fd
xor r10d, r10d
mov eax, r9d
xor r9b, byte [rcx + r10]
shr eax, 8
movzx r9d, r9b
xor eax, dword [r8 + r9*4]
inc r10
mov r9d, eax
cmp rdx, r10
jne 0x1400b95e1
jmp 0x1400b9600
mov eax, r9d
not eax
ret
Function at 0x140032317
Capabilities:
Inspect section memory permissions

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov dword [rsp + 4], 0
mov dword [rsp + 8], 0
mov dword [rsp + 0xc], 0
mov dword [rsp], 0
mov eax, dword [rsp + 0x40]
and eax, 0x20000000
test eax, eax
je 0x140032357
mov dword [rsp + 4], 1
mov eax, dword [rsp + 0x40]
and eax, 0x40000000
test eax, eax
je 0x140032370
mov dword [rsp + 8], 1
mov eax, dword [rsp + 0x40]
and eax, 0x80000000
test eax, eax
je 0x140032389
mov dword [rsp + 0xc], 1
mov dword [rsp + 0x10], 1
mov dword [rsp + 0x14], 8
mov dword [rsp + 0x18], 2
mov dword [rsp + 0x1c], 4
mov dword [rsp + 0x20], 0x10
mov dword [rsp + 0x24], 0x80
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x2c], 0x40
movsxd rax, dword [rsp + 4]
imul rax, rax, 0x10
lea rax, [rsp + rax + 0x10]
movsxd rcx, dword [rsp + 8]
lea rax, [rax + rcx*8]
movsxd rcx, dword [rsp + 0xc]
mov eax, dword [rax + rcx*4]
mov dword [rsp], eax
mov eax, dword [rsp + 0x40]
and eax, 0x4000000
test eax, eax
je 0x140032406
mov eax, dword [rsp]
bts eax, 9
mov dword [rsp], eax
mov eax, dword [rsp]
add rsp, 0x38
ret
Function at 0x14003b56a
Capabilities:
Encode data using xor

Disassembly:
call fcn.14008be7b
mov qword [rsp + 0x38], rax
jmp 0x14003b400
push rax
jmp 0x14003b407
lahf
jmp 0x14003b410
jmp 0x14003b418
call 0x14003b423
sub dword [rax + 0x478b7c22], ecx
inc rsp
clc
jae 0x14003b42b
loope 0x14003b474
inc rsp
inc esp
clc
jae 0x14003b434
ret 0xf03e
inc rsp
cmp cl, cl
jmp 0x14003b43d
je 0x14003b446
invalid
inc rsp
stc
jmp 0x14003b451
jb 0x14003b455
lea eax, [rdx + 0x48]
inc esp
inc rsp
cmp cl, cl
jmp 0x14003b462
je 0x14003b468
mov fs, esp
invalid
inc rsp
cmp bh, bh
jmp 0x14003b476
add cl, bl
invalid
invalid
je 0x14003b47a
invalid
inc rsp
cmp cl, cl
je 0x14003b487
jb 0x14003b471
xchg ebx, eax
invalid
inc rsp
clc
jmp 0x14003b495
jae 0x14003b499
shr byte [rax + 0x5e9], cl
add byte [rax + 0x3b99d6f9], cl
jmp 0x14003b4a3
sahf
mov rax, qword [rsp]
jmp 0x14003b4af
lea rsp, [rsp + 8]
jmp 0x14003b4bd
jmp 0x14003b4c8
lea rax, [rsp + 0x68]
mov r9, qword [rsp + 0x78]
jmp 0x14003b4de
lea rsp, [rsp - 8]
mov qword [rsp], rax
jmp 0x14003b4ef
lahf
clc
jmp 0x14003b4f6
jae 0x14003b4fe
pop rdx
sbb r9d, dword [rbx + 0x2e88d6e]
add byte [rax], al
add byte [rdi + rax*8], ah
call 0x14003b505
and al, 0xc7
add qword [rsp], 0x10
clc
jae 0x14003b510
movabs eax, dword [0x2107eb496dc3cb6b]
cmp eax, edx
and ch, byte [rax + 0x489ebf1c]
mov eax, dword [rsp]
jmp 0x14003b527
ret
lea rsp, [rsp + 8]
jmp 0x14003b537
jmp 0x14003b53f
mov r8, qword [rsp + 0x70]
mov rdx, rax
mov ecx, dword [rsp + 0x24]
call qword [rsp + 0x38]
pushfq
cmp bl, bl
jmp 0x14003b55b
je 0x14003b562
stosb byte [rdi], al
sal bl, 1
mov r8d, ebp
add eax, dword [rax]
add byte [rax], al
call 0x14003b56a
push 0xffffffffffffffb9
xchg edi, eax
inc rsp
cmp dh, dh
jmp 0x14003b579
je 0x14003b57f
push rax
mov bl, 0x1b
je 0x14003b5c8
inc rsp
inc esp
inc rsp
stc
jb 0x14003b58f
movsb byte [rdi], byte [rsi]
movsd dword [rdi], dword [rsi]
sbb dword [rdx - 0x7d], esp
pop rbx
test byte [rax - 1], cl
invalid
inc rsp
jmp 0x14003b59e
inc rsp
stc
jmp 0x14003b5aa
jb 0x14003b5b0
invalid
inc rsp
cmp ch, ch
jmp 0x14003b5be
je 0x14003b5c2
push 0x55
inc rsp
inc rsp
clc
jmp 0x14003b5d2
out 0x73, eax
add al, 0x55
jae 0x14003b5d8
push rbp
xor dword [rdx*2 + 0x4e03eb9d], 0x7eb2de2
fistp qword [rax - 0x34939f3e]
jrcxz 0x14003b5d1
popfq
jmp 0x14003b5de
jmp 0x14003b5e7
jmp fcn.14003b6a7
mov ebx, 0x9c000000
jmp 0x14003b5f6
stc
jmp 0x14003b5ff
jb 0x14003b608
in al, dx
movabs byte [0x3e89f6a6fd214], al
add byte [rax], al
call 0x14003b610
xchg edx, eax
xor dword [rdx], 0x48
inc esp
stc
jmp 0x14003b620
jb 0x14003b628
retf 0x8cf0
inc rsp
jmp 0x14003b634
inc rsp
clc
jmp 0x14003b641
jae 0x14003b649
outsd dx, dword [rsi]
enter 0xffffffffffffd655, 0x5d
inc rsp
inc rsp
cmp ch, ch
jmp 0x14003b656
je 0x14003b65f
xlatb
loope 0x14003b673
and dword [rdx + rdi*4 - 0x1f], 0x48c4ff48
inc esp
inc rsp
inc rsp
cmp ch, ch
je 0x14003b670
mov esp, 0x4026ddd5
iretd
inc rsp
stc
jb 0x14003b679
pop rbx
retf 0x4857
inc rsp
jmp 0x14003b681
jmp 0x14003b68b
popfq
jmp 0x14003b696
jmp 0x14003b6a2
jmp fcn.14003b6a7
Function at 0x1400129c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x58
movaps xmmword [rsp + 0x40], xmm10
movaps xmmword [rsp + 0x30], xmm9
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x10], xmm7
movaps xmmword [rsp], xmm6
aesimc xmm0, xmmword [rdx + 0x10]
aesimc xmm1, xmmword [rdx + 0x20]
aesimc xmm2, xmmword [rdx + 0x30]
aesimc xmm3, xmmword [rdx + 0x40]
aesimc xmm4, xmmword [rdx + 0x50]
aesimc xmm5, xmmword [rdx + 0x60]
aesimc xmm6, xmmword [rdx + 0x70]
aesimc xmm7, xmmword [rdx + 0x80]
aesimc xmm8, xmmword [rdx + 0x90]
movaps xmm9, xmmword [rdx]
movaps xmm10, xmmword [rdx + 0xa0]
movaps xmmword [rcx], xmm9
movdqa xmmword [rcx + 0x10], xmm0
movdqa xmmword [rcx + 0x20], xmm1
movdqa xmmword [rcx + 0x30], xmm2
movdqa xmmword [rcx + 0x40], xmm3
movdqa xmmword [rcx + 0x50], xmm4
movdqa xmmword [rcx + 0x60], xmm5
movdqa xmmword [rcx + 0x70], xmm6
movdqa xmmword [rcx + 0x80], xmm7
movdqa xmmword [rcx + 0x90], xmm8
movaps xmmword [rcx + 0xa0], xmm10
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
add rsp, 0x58
ret
Function at 0x140015b50
Capabilities:
Delete file

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov r8, rdx
mov rdx, rcx
lea rcx, [rsp + 0x28]
call fcn.140153800
mov rax, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
test rax, rax
je 0x140015bce
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rcx
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x28]
call fcn.140159c60
mov rsi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
test rsi, rsi
je 0x140015bce
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x140015c16
test rbx, rbx
je 0x140015bd6
mov rcx, qword [0x14023c280]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x140015bd6
mov rdi, rbx
test rbx, rbx
jne 0x140015c0b
lea rax, str.File_deleted_successfully._n
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 1
lea rax, [0x1401e7aa8]
mov qword [rsp + 0x38], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x28]
call fcn.14015b7b0
xor edi, edi
mov rax, rdi
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
call sub.KERNEL32.dll_GetLastError
mov edi, eax
shl rdi, 0x20
or rdi, 2
test rbx, rbx
je 0x140015c0b
mov rcx, qword [0x14023c280]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x140015c0b

Function at 0x14001c3c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rax, rdx
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x14001c450
cmp r11, r10
ja 0x14001c4c6
cmp r10, rdx
ja 0x14001c4da
add r11, r9
xor r15d, r15d
nop word cs:[rax + rax]
cmp r14, r15
je 0x14001c452
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x14001c430
jmp 0x14001c4b4
ja 0x14001c45a
mov r11, r10
cmp rax, r8
jne 0x14001c3f4
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x14001c490
mov rdi, r8
sub ecx, edx
jns 0x14001c4ab
jmp 0x14001c4b6
cmp r8, rsi
je 0x14001c4eb
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x14001c4b6
xor al, 1
cmp rdi, rsi
jne 0x14001c470
jmp 0x14001c4b6
xor eax, eax
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.140184f00
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.140184c70
ud2
lea rcx, str.called__Option::unwrap____on_a__None__value
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.140184cf0
ud2
Function at 0x14002d4f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x78
mov rsi, rdx
cmp dword [rcx], 2
jne 0x14002d586
movdqu xmm0, xmmword [rcx + 8]
pshufd xmm1, xmm0, 0x44
pxor xmm1, xmmword [str.uespemosarenegylmodnarodsetybdettttttttttttttttt]
movdqa xmmword [rsp + 0x30], xmm1
pshufd xmm1, xmm0, 0xee
pxor xmm1, xmmword [0x14018c720]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmmword [rsp + 0x50], xmm0
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov rdi, qword [rsi]
xor eax, eax
test rdi, rdi
setne al
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.14002d7c0
test rdi, rdi
je 0x14002d615
mov rdx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
lea rcx, [rsp + 0x30]
jmp 0x14002d62e
mov rdx, qword [rsi]
xor ecx, ecx
test rdx, rdx
setne cl
movabs rax, 0xcbf29ce484222325
xor rax, rcx
movabs rcx, 0x1efac7090aef4a21
imul rax, rcx
test rdx, rdx
je 0x14002d726
mov r9, qword [rsi + 0x10]
test r9, r9
je 0x14002d7a8
mov rcx, qword [rsi + 8]
movabs rdx, 0x100000001b3
mov r10, r9
and r10, 7
je 0x14002d733
mov r11, rax
mov r8, rcx
nop word cs:[rax + rax]
movzx eax, byte [r8]
inc r8
xor rax, r11
imul rax, rdx
mov r11, rax
dec r10
jne 0x14002d5f0
cmp r9, 8
jae 0x14002d73c
jmp 0x14002d7a8
movzx eax, byte [rsi + 8]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.14002d7c0
mov rcx, qword [rsp + 0x40]
mov r9, qword [rsp + 0x60]
shl r9, 0x38
or r9, qword [rsp + 0x68]
mov rax, qword [rsp + 0x48]
mov r8, qword [rsp + 0x30]
add r8, rcx
rol rcx, 0xd
xor rax, r9
xor rcx, r8
rol r8, 0x20
mov rdx, qword [rsp + 0x38]
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rax, r8
xor rcx, rdx
rol rdx, 0x20
xor r8, r9
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
xor rdx, 0xff
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
add rdx, rax
shl rax, 0x10
xor rax, rdx
shr rax, 0x2b
add rdx, rcx
shr rcx, 0x2f
xor rcx, rax
mov rax, rdx
shr rax, 0x20
xor rax, rdx
xor rax, rcx
jmp 0x14002d7a8
movzx edx, byte [rsi + 8]
xor rax, rdx
imul rax, rcx
jmp 0x14002d7a8
mov r8, rcx
cmp r9, 8
jb 0x14002d7a8
add rcx, r9
nop
movzx r9d, byte [r8]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 1]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 2]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 3]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 4]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 5]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 6]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 7]
add r8, 8
xor rax, r9
imul rax, rdx
cmp r8, rcx
jne 0x14002d740
and eax, 0x7fff
add rsp, 0x78
pop rdi
pop rsi
ret
Function at 0x14002d7c0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x14002d802
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 3
jbe 0x14002d80a
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x14002d81b
jmp 0x14002d832
xor r10d, r10d
jmp 0x14002d8bd
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x14002d832
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x14002d849
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x14002d869
add r11, r8
jmp 0x14002d99a
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x14002d932
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x14002d8e0
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 3
jbe 0x14002d950
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x14002d962
jmp 0x14002d97c
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x14002d97c
lea rcx, [r8 + r10]
movzx esi, word [rdx + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x14002d996
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x140038770
Capabilities:
Generate random numbers via winapi

Disassembly:
sub rsp, 0x38
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
xor ecx, ecx
mov r8d, reloc.WS2_32.dll_recv
mov r9d, 2
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
js 0x1400387a5
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
jmp 0x1400387aa
call fcn.14015ce30
mov ecx, dword [0x14023c31c]
mov r8, qword gs:[0x58]
mov rcx, qword [r8 + rcx*8]
mov qword [rcx + 0x58], 1
mov qword [rcx + 0x60], rax
mov qword [rcx + 0x68], rdx
add rsp, 0x38
ret