joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400033d0
Capabilities:
Check os version

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x98]
sub rsp, 0x190
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rdi
mov rax, qword [0x14003e010]
xor rax, rsp
mov qword [rbp + 0x80], rax
mov rbx, rdx
mov qword [rsp + 0x38], rdx
xor edi, edi
mov dword [rsp + 0x20], edi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], di
lea rdx, [rsp + 0x40]
call fcn.14000b880
test al, al
jne 0x14000349f
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 7
mov word [rbx], di
mov dword [rsp + 0x20], 1
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14000362b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003495
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003665
call fcn.14001881c
jmp 0x14000362b
lea rdx, [rsp + 0x40]
call fcn.140003210
test al, al
je 0x1400035ff
mov ecx, 1
call fcn.1400187e0
mov qword [rsp + 0x28], rax
mov byte [rax], 0
xor edx, edx
mov r8d, 0x118
lea rcx, [rsp + 0x64]
call fcn.140019920
mov dword [rsp + 0x60], 0x11c
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1400034fb
cmp dword [rsp + 0x64], 6
setae cl
mov rax, qword [rsp + 0x28]
mov byte [rax], cl
lea rcx, [rsp + 0x28]
call fcn.140007c20
lea rdx, [rsp + 0x40]
call fcn.14000b880
test al, al
jne 0x14000357f
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 7
mov word [rbx], di
mov dword [rsp + 0x20], 1
lea rcx, [rsp + 0x28]
call fcn.140007380
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14000362b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003495
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000366b
jmp 0x140003495
lea rdx, [rsp + 0x40]
call fcn.140003210
test al, al
je 0x1400035f5
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 7
mov word [rbx], di
mov dword [rsp + 0x20], 1
lea rcx, [rsp + 0x28]
call fcn.140007380
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14000362b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003495
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003671
jmp 0x140003495
lea rcx, [rsp + 0x28]
call fcn.140007380
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rsp + 0x50]
movups xmmword [rbx + 0x10], xmm1
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], di
mov dword [rsp + 0x20], 1
mov rax, rbx
mov word [rsp + 0x40], di
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], rdi
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.140018000
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call fcn.14001bf2c
int3
call fcn.14001bf2c
int3
call fcn.14001bf2c
int3
Function at 0x14000b190
Capabilities:
Check mutex on windows

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov rax, qword [0x14003e010]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rsi, rdx
mov rdi, rcx
mov rcx, qword [rcx]
xor ebp, ebp
test rcx, rcx
je 0x14000b1ce
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi], rbp
mov word [rdi + 8], bp
mov qword [rsp + 0x28], rbp
lea rcx, [rsp + 0x28]
call fcn.1400135d0
nop
mov rbx, qword [rsp + 0x28]
cmp qword [rbx], 0
lea rcx, [rbx + 0x10]
jne 0x14000b1f4
mov rcx, rbp
cmp qword [rsi + 0x10], 0
je 0x14000b207
cmp qword [rsi + 0x18], 8
jb 0x14000b20a
mov rsi, qword [rsi]
jmp 0x14000b20a
mov rsi, rbp
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rdi], rax
test rax, rax
je 0x14000b22e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14000b22e
mov byte [rdi + 9], 1
cmp qword [rdi], 0
setne sil
mov rdi, qword [rbx]
test rdi, rdi
je 0x14000b255
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rbx], rbp
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14000b268
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rbx + 8], rbp
mov edx, 0x58
mov rcx, rbx
call fcn.14001881c
mov qword [rsp + 0x28], rbp
movzx eax, sil
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140018000
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret

Function at 0x14000b880
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x450
mov rax, qword [0x14003e010]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rbx, rdx
mov qword [rsp + 0x28], rdx
xor esi, esi
mov qword [rdx + 0x10], rsi
mov rax, rdx
cmp qword [rdx + 0x18], 8
jb 0x14000b8bf
mov rax, qword [rdx]
mov word [rax], si
call fcn.14000b990
movzx edi, al
mov byte [rsp + 0x20], al
jmp 0x14000b8df
test dil, dil
jne 0x14000b959
mov qword [rbx + 0x10], rsi
mov rax, rbx
cmp qword [rbx + 0x18], 8
jb 0x14000b8f5
mov rax, qword [rbx]
mov word [rax], si
xor edx, edx
mov r8d, 0x410
lea rcx, [rsp + 0x30]
call fcn.140019920
mov r8d, 0x207
lea rdx, [rsp + 0x30]
lea rcx, str.APPDATA
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rax, [rsp + 0x30]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x14000b930
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140004e30
movzx edi, dil
mov eax, 1
cmp qword [rbx + 0x10], 0
cmovne edi, eax
movzx eax, dil
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.140018000
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14000be10
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x170
mov rax, qword [0x14003e010]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x44]
mov r8d, 0x110
call fcn.140019920
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x14000be97
cmp dword [rsp + 0x44], 6
jb 0x14000be97
lea rax, [rsp + 0x34]
mov dword [rsp + 0x34], 0x207
mov r9, rbx
mov qword [rsp + 0x20], rax
lea r8, str.Progid
mov rcx, 0xffffffff80000001
lea rdx, str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociationshttpUserChoice
call fcn.14000bc40
test al, al
je 0x14000be97
cmp word [rbx], 0
jne 0x14000bf01
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0x207
mov r9, rbx
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.http_shellopencommand
mov rcx, 0xffffffff80000000
call fcn.14000bc40
test al, al
je 0x14000becc
cmp word [rbx], 0
jne 0x14000bf01
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0x207
mov r9, rbx
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SoftwareClasses.html
mov rcx, 0xffffffff80000001
call fcn.14000bc40
test al, al
je 0x14000bf05
cmp word [rbx], 0
je 0x14000bf05
mov al, 1
jmp 0x14000bf07
xor al, al
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140018000
add rsp, 0x170
pop rbx
ret
Function at 0x14000f040
Capabilities:
Delete file

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x58], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x14003e010]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rsi, r8
mov rbx, rdx
mov r8, rdx
lea rdx, [rbp - 0x30]
call fcn.14000fbf0
nop
xor eax, eax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
xor r14d, r14d
mov qword [rbp - 0x50], r14
mov word [rbp - 0x48], ax
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x50]
call fcn.14000b190
xor eax, eax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
lea rax, [rbp - 0x50]
mov qword [rbp - 0x40], rax
mov byte [rbp - 0x38], r14b
mov rcx, qword [rbp - 0x50]
test rcx, rcx
jne 0x14000f0c8
xor dil, dil
jmp 0x14000f0e6
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, 0xffffff7f
je 0x14000f0df
xor dil, dil
jmp 0x14000f0e6
mov byte [rbp - 0x48], 1
mov dil, 1
mov byte [rbp - 0x38], dil
mov byte [rbp - 0x60], 0
lea r9, [rbp - 0x60]
mov r8, rsi
mov rdx, rbx
call fcn.14000f1d0
test al, al
jne 0x14000f11a
cmp byte [rbp - 0x60], al
je 0x14000f11a
cmp qword [rbx + 0x18], 8
jb 0x14000f110
mov rbx, qword [rbx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
test dil, dil
je 0x14000f132
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x14000f12e
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov byte [rbp - 0x48], 0
mov qword [rbp - 0x40], r14
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x14000f149
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x50], r14
mov word [rbp - 0x48], 0
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x14000f18b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f186
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f1c1
call fcn.14001881c
movdqa xmm0, xmmword [0x140035a30]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x30], r14w
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140018000
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.14001bf2c
int3
Function at 0x1400116b0
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [0x14003e010]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor eax, eax
mov dword [rsp + 0x20], 0x114
mov qword [rcx + 8], rax
mov rbx, rcx
mov qword [rcx + 0x10], rax
xor edx, edx
mov qword [rcx + 0x18], rax
mov r8d, 0x110
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x28], rax
mov qword [rcx + 0x30], rax
mov qword [rcx + 0x38], rax
mov qword [rcx + 0x40], rax
mov qword [rcx + 0x48], rax
mov qword [rcx + 0x50], rax
mov byte [rcx], al
lea rcx, [rsp + 0x24]
call fcn.140019920
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov rax, rbx
je 0x140011730
cmp dword [rsp + 0x24], 6
jb 0x140011730
mov byte [rbx], 1
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140018000
add rsp, 0x150
pop rbx
ret
Function at 0x140011750
Capabilities:
Link many functions at runtime

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x70
mov qword [rax - 0x58], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov rsi, rcx
xorps xmm0, xmm0
movdqu xmmword [rax - 0x40], xmm0
movdqa xmm1, xmmword [0x140035a30]
movdqu xmmword [rax - 0x40], xmm1
xor ebp, ebp
mov word [rax - 0x50], bp
lea r8d, [rbp + 0xc]
lea rdx, str.wintrust.dll
lea rcx, [rax - 0x50]
call fcn.140004e30
nop
call fcn.1400122b0
mov rcx, rax
lea rdx, [rsp + 0x28]
call fcn.140012350
mov rbx, rax
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x1400117f6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400117f1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001199d
call fcn.14001881c
movdqa xmm0, xmmword [0x140035a30]
movdqu xmmword [rsp + 0x38], xmm0
mov word [rsp + 0x28], bp
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x58], xmm0
movdqa xmm1, xmmword [0x140035a30]
movdqu xmmword [rsp + 0x58], xmm1
mov word [rsp + 0x48], bp
mov r8d, 0xb
lea rdx, str.crypt32.dll
lea rcx, [rsp + 0x48]
call fcn.140004e30
nop
call fcn.1400122b0
mov rcx, rax
lea rdx, [rsp + 0x48]
call fcn.140012350
mov rdi, rax
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x140011894
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001188f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011997
call fcn.14001881c
movdqa xmm0, xmmword [0x140035a30]
movdqu xmmword [rsp + 0x58], xmm0
mov word [rsp + 0x48], bp
test rbx, rbx
je 0x140011981
test rdi, rdi
je 0x140011981
lea rdx, str.CryptCATAdminCalcHashFromFileHandle
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 8], rax
lea rdx, str.CryptCATAdminAcquireContext
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x10], rax
lea rdx, str.CryptCATAdminEnumCatalogFromHash
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x18], rax
lea rdx, str.CryptCATCatalogInfoFromContext
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x20], rax
lea rdx, str.CryptCATAdminReleaseCatalogContext
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x28], rax
lea rdx, str.CryptCATAdminReleaseContext
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x30], rax
lea rdx, str.WTHelperProvDataFromStateData
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x38], rax
lea rdx, str.WTHelperGetProvSignerFromChain
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x40], rax
lea rdx, str.WinVerifyTrust
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x48], rax
lea rdx, str.CertNameToStrW
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x50], rax
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call fcn.14001bf2c
int3
call fcn.14001bf2c
int3
Function at 0x140012d90
Capabilities:
Set file attributes

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rsi
mov rax, qword [0x14003e010]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov edi, edx
mov rbx, rcx
and edi, 0xffffb1af
cmp qword [rcx + 0x18], 8
jb 0x140012dcd
mov rcx, qword [rcx]
mov edx, edi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x140012de0
mov al, 1
jmp 0x140012e87
xor esi, esi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], si
lea rdx, [rsp + 0x28]
mov rcx, rbx
call fcn.1400134c0
test al, al
je 0x140012e31
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rcx, qword [rsp + 0x28]
mov edx, edi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x140012e31
mov bl, 1
jmp 0x140012e33
xor bl, bl
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x140012e71
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140012e6c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140012ea4
call fcn.14001881c
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], si
movzx eax, bl
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140018000
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
call fcn.14001bf2c
int3

Function at 0x140012eb0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rsi
mov rax, qword [0x14003e010]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, rcx
cmp qword [rcx + 0x18], 8
jb 0x140012ee5
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp eax, 0xffffffff
jne 0x140012f8f
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
movdqa xmm1, xmmword [0x140035a30]
movdqu xmmword [rsp + 0x38], xmm1
xor esi, esi
mov word [rsp + 0x28], si
lea rdx, [rsp + 0x28]
mov rcx, rbx
call fcn.1400134c0
test al, al
je 0x140012f3e
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x140012f7c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140012f77
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140012fae
call fcn.14001881c
movdqa xmm0, xmmword [0x140035a30]
movdqu xmmword [rsp + 0x38], xmm0
mov word [rsp + 0x28], si
mov eax, edi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140018000
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
call fcn.14001bf2c
int3
Function at 0x14001cb30
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14001c894
Function at 0x207c00
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
mov eax, 0x14a8
call fcn.00237180
sub rsp, rax
movaps xmmword [rsp + 0x1490], xmm15
movaps xmmword [rsp + 0x1480], xmm14
movaps xmmword [rsp + 0x1470], xmm13
movaps xmmword [rsp + 0x1460], xmm12
movaps xmmword [rsp + 0x1450], xmm11
movaps xmmword [rsp + 0x1440], xmm10
movaps xmmword [rsp + 0x1430], xmm9
movdqa xmmword [rsp + 0x1420], xmm8
movaps xmmword [rsp + 0x1410], xmm7
movaps xmmword [rsp + 0x1400], xmm6
movdqa xmm9, xmmword [0x0023f5e0]
xor eax, eax
movdqa xmm12, xmmword [0x0023f5f0]
pxor xmm2, xmm2
movdqa xmm4, xmmword [0x0023f610]
movdqa xmm6, xmmword [0x0023f630]
movdqa xmm13, xmmword [0x0023f670]
movdqa xmm14, xmmword [0x0023f680]
movdqa xmm15, xmmword [0x0023f690]
movdqa xmm7, xmmword [0x0023f6a0]
movdqa xmm10, xmmword [0x0023f6b0]
movdqa xmm11, xmmword [0x0023f6c0]
nop dword [rax + rax]
Function at 0x210140
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub cl, byte [rdi]
test byte [rsi + rcx*2 + 0x75], dh
jmp 0x101985c
test byte [rsi + 0xf000002], dh
test dword [rax + 2], esi
add byte [rax], al
add byte [rax - 0x3f7bc3fc], cl
mov rax, qword [rcx + 0x10]
mov edx, dword [rcx + 0x3c]
jmp 0x21020a
mov rdx, qword [rcx + 8]
mov word [r9 + rdx + 8], 0x5b41
mov rdx, qword [rcx + 8]
mov word [r9 + rdx + 0xa], 0x5a41
mov rdx, qword [rcx + 8]
mov word [r9 + rdx + 0xc], 0x5941
mov rdx, qword [rcx + 8]
mov word [r9 + rdx + 0xe], 0x5841
je 0x2102b4
jne 0x2102b4
jmp 0x18feb52
ret
mov qword [rcx + 0x10], rdx
jmp 0x210385
mov rdx, qword [rcx + 8]
mov word [r9 + rdx + 6], 0x5c41
jmp 0x21014e
cmp edx, 0x8664
je 0x2102d1
cmp edx, 0x14c
jne 0x21018b
je 0x21026b
jne 0x21026b
jmp 0x218bbe
jne 0x2102c6
add byte [rax], al
add byte [rax], al
jmp 0x210193
jne 0x210342
je 0x106a8d3d
mov r9, qword [rcx + 0x10]
lea rdx, [r9 + 1]
mov qword [rcx + 0x10], rdx
je 0x210303
jne 0x210303
jmp 0x2102f4
je 0x210285
jne 0x210285
add byte [rax], al
add byte [rax], al
mov rdx, qword [rcx + 8]
mov byte [rdx + r8], 0x58
mov qword [rcx + 0x10], r9
jmp 0x21018b
mov rdx, qword [rcx + 8]
mov byte [r9 + rdx + 0x11], 0x5e
mov rdx, qword [rcx + 8]
je 0x21028c
jne 0x21028c
je 0x2314706
mov byte [rax + rdx + 2], 0x5d
pop rbp
je 0x210342
jmp 0x2101e5
mov byte [rax + rdx + 4], 0x5a
mov rdx, qword [rcx + 8]
lea r8, [rax + 6]
je 0x2102c6
jmp 0x2101d7
mov byte [rax + rdx + 3], 0x5b
mov rdx, qword [rcx + 8]
jmp 0x21024b
mov rdx, qword [rcx + 8]
mov byte [rdx + rax], 0x5f
mov rdx, qword [rcx + 8]
mov byte [rax + rdx + 1], 0x5e
mov rdx, qword [rcx + 8]
je 0x21023c
jne 0x21023c
jmp 0x202972
jmp 0x2101b0
jne 0x2102f4
mov byte [r9 + rdx + 0x12], 0x5d
mov rdx, qword [rcx + 8]
mov byte [r9 + rdx + 0x13], 0x5b
mov rdx, qword [rcx + 8]
mov byte [r9 + rdx + 0x14], 0x5a
mov rdx, qword [rcx + 8]
mov byte [r9 + rdx + 0x15], 0x59
jmp 0x2102dd
je 0x8728e00
mov rdx, qword [rcx + 8]
mov byte [r9 + rdx + 0x10], 0x5f
jmp 0x210228
jne 0x210317
jmp 0x5314790
mov byte [rax + rdx + 5], 0x59
lea r9, [rax + 7]
jmp 0x2102e5
mov r8, qword [rcx + 8]
lea rdx, [rax + 1]
jmp 0x210339
lea r8, [r9 + 0x16]
add r9, 0x17
je 0x210212
jne 0x210212
jmp 0x2102b2
jmp 0x2101a0
je 0x210317
jmp 0x2102c3
mov byte [r8 + r9], 0x8b
mov r8, qword [rcx + 8]
mov r9, qword [rcx + 0x10]
je 0x210383
jne 0x210383
jmp 0x210317
mov qword [rcx + 0x10], rdx
mov byte [r8 + r9], 0xe5
mov r8, qword [rcx + 8]
mov r9, qword [rcx + 0x10]
lea rdx, [r9 + 1]
jmp 0x21035d
lea rdx, [r9 + 1]
jmp 0x2102f9
mov qword [rcx + 0x10], rdx
je 0x21036d
jne 0x21036d
jmp 0x8728e8e
mov rdx, qword [rcx + 8]
je 0x21025f
jne 0x21025f
je 0x201641
inc dword [rax]
add byte [rax], al
add byte [rdi], cl
test byte [rsi - 2], bh
invalid
je 0x2101e1
jne 0x2101e1
add byte [rax], al
add byte [rax], al
mov byte [r8 + rax], 0x48
mov r8, qword [rcx + 8]
je 0x2101ed
jne 0x2101ed
jmp 0xffffffffc664ae72
jmp 0x21032f
mov byte [r8 + r9], 0x5d
mov r8, qword [rcx + 8]
mov r9, qword [rcx + 0x10]
mov word [r8 + r9], 0x5f41
mov rdx, qword [rcx + 8]
mov word [r9 + rdx + 2], 0x5e41
mov rdx, qword [rcx + 8]
mov word [r9 + rdx + 4], 0x5d41
je 0x2102f4
jmp 0x21028a
invalid
Function at 0x21a860
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
jmp 0x21aab8
mov edi, edx
jmp 0x21ab91
je 0x21aabe
jne 0x21aabe
je 0x53770218
push rsi
push rdi
push rbp
push rbx
jmp 0x21abba
sub rsp, 0xa8
jmp 0x21a9b8

Function at 0x228c50
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov eax, dword [rdx]
mov dword [rcx + 0x10], eax
mov eax, dword [rdx + 4]
mov dword [rcx + 0x14], eax
mov eax, dword [rdx + 8]
mov dword [rcx + 0x18], eax
mov eax, dword [rdx + 0xc]
mov dword [rcx + 0x1c], eax
lea rax, [rdx + 0x10]
cmp r8d, 0x100
cmovne rax, rdx
lea r8, str.expand_32_byte_kexpand_16_byte_k
lea r9, [0x0023fbe0]
cmove r9, r8
mov edx, dword [rax]
mov dword [rcx + 0x20], edx
mov edx, dword [rax + 4]
mov dword [rcx + 0x24], edx
mov edx, dword [rax + 8]
mov dword [rcx + 0x28], edx
mov eax, dword [rax + 0xc]
mov dword [rcx + 0x2c], eax
mov dword [rcx], 0x61707865
mov rax, qword [r9 + 4]
mov qword [rcx + 4], rax
mov eax, dword [r9 + 0xc]
mov dword [rcx + 0xc], eax
ret

Function at 0x228d90
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov qword [rsp + 0x50], rcx
mov eax, dword [rdx]
mov dword [rsp + 0xc], eax
mov eax, dword [rdx + 4]
mov dword [rsp + 0x10], eax
mov eax, dword [rdx + 8]
mov dword [rsp + 0x14], eax
mov r12d, dword [rdx + 0xc]
mov r13d, dword [rdx + 0x10]
mov r14d, dword [rdx + 0x14]
mov r15d, dword [rdx + 0x18]
mov r10d, dword [rdx + 0x1c]
mov edi, dword [rdx + 0x20]
mov r11d, dword [rdx + 0x24]
mov ebx, dword [rdx + 0x28]
mov ebp, dword [rdx + 0x2c]
mov ecx, dword [rdx + 0x30]
mov eax, dword [rdx + 0x34]
mov r9d, dword [rdx + 0x38]
mov r8d, dword [rdx + 0x3c]
mov dword [rsp + 0x4c], 0xfffffff8
mov dword [rsp + 0x48], r8d
mov dword [rsp + 0x44], r9d
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x3c], ecx
mov edx, ecx
mov dword [rsp + 0x38], ebp
mov dword [rsp + 8], ebp
mov dword [rsp + 0x34], ebx
mov dword [rsp], ebx
mov dword [rsp + 0x30], r11d
mov dword [rsp + 0x2c], edi
mov ebp, edi
mov dword [rsp + 0x28], r10d
mov edi, r10d
mov dword [rsp + 0x24], r15d
mov dword [rsp + 0x20], r14d
mov ebx, r14d
mov dword [rsp + 0x1c], r13d
mov dword [rsp + 0x18], r12d
mov r14d, r12d
mov r12d, dword [rsp + 0x14]
mov r10d, dword [rsp + 0x10]
mov ecx, dword [rsp + 0xc]
nop

Function at 0x22ed00
Capabilities:
Hash data using sha512

Disassembly:
test rcx, rcx
je 0x22ed8b
mov qword [rcx + 0x48], 0
mov qword [rcx], 0
movabs rax, 0x6a09e667f3bcc908
mov qword [rcx + 8], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rcx + 0x10], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rcx + 0x18], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rcx + 0x20], rax
movabs rax, 0x510e527fade682d1
mov qword [rcx + 0x28], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rcx + 0x30], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rcx + 0x38], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rcx + 0x40], rax
xor eax, eax
ret
mov eax, 1
ret
Function at 0x22f7b0
Capabilities:
Encrypt data using curve25519

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xc0
mov rsi, rdx
mov rdi, rcx
mov edx, 0x20
mov rcx, r8
mov r8, rsi
call fcn.0022f520
and byte [rsi], 0xf8
mov al, byte [rsi + 0x1f]
and al, 0x3f
or al, 0x40
mov byte [rsi + 0x1f], al
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov rdx, rsi
call fcn.0022c170
mov rcx, rdi
mov rdx, rbx
call fcn.0022c0f0
add rsp, 0xc0
pop rbx
pop rdi
pop rsi
ret