joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ff65eccda30
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov r15d, edx
lea r14d, [rdx - 1]
mov rdi, rcx
xor r12d, r12d
nop word [rax + rax]
mov esi, r12d
mov ebp, r12d
test r14d, r14d
je 0x7ff65eccdc3a
mov r8, qword [rdi + 8]
nop dword [rax]
nop word [rax + rax]
lea ecx, [r8 + 0xff]
shl esi, cl
add esi, esi
nop dword [rax + rax]
mov r10, qword [rdi]
mov ecx, dword [r10]
cmp ecx, 0x270
jne 0x7ff65eccdaf4
lea rax, [r10 + 8]
mov r9d, ecx
nop word [rax + rax]
mov r8d, dword [rax - 4]
xor r8d, dword [rax]
lea rax, [rax + 4]
btr r8d, 0x1f
xor r8d, dword [rax - 8]
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0x9908b0df
xor edx, dword [rax + 0x62c]
xor edx, r8d
mov dword [rax + 0x9b8], edx
sub r9, 1
jne 0x7ff65eccdab0
mov ecx, dword [r10]
jmp 0x7ff65eccdbd7
cmp ecx, 0x4e0
jb 0x7ff65eccdbd7
lea r11, [r10 + 0x9c4]
mov ebx, 0xe3
mov eax, dword [r11]
nop
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x7ff65eccdb10
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x7ff65eccdb60
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
mov ecx, r12d
mov dword [r10], r12d
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
mov edx, dword [rdi + 0x10]
cmp eax, edx
ja 0x7ff65eccda90
mov r8, qword [rdi + 8]
or esi, eax
lea ecx, [r8 + 0xff]
shl ebp, cl
add ebp, ebp
or ebp, edx
cmp ebp, r14d
jb 0x7ff65eccda80
xor edx, edx
mov eax, ebp
div r15d
mov ecx, eax
mov r8d, edx
xor edx, edx
mov eax, esi
div r15d
cmp eax, ecx
jb 0x7ff65eccdc5a
cmp r8d, r14d
jne 0x7ff65eccda60
mov rbx, qword [rsp + 0x20]
mov eax, esi
mov rbp, qword [rsp + 0x28]
xor edx, edx
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
div r15d
mov eax, edx
pop r15
pop r14
pop r12
ret
Function at 0x7ff65eceb690
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rbx, rcx
mov rsi, qword [rdx]
mov rbp, qword [rdx + 8]
xor r15d, r15d
cmp rsi, rbp
je 0x7ff65eceb737
mov ecx, 0x70
call fcn.7ff65efe06d0
mov r14, rax
mov qword [rsp + 0x88], rax
mov rdx, qword [rbx + 8]
sub rdx, qword [rbx]
sar rdx, 3
mov rcx, qword [rbx + 0x18]
mov rdi, qword [rcx]
mov qword [rax], rdx
lea rcx, [rax + 8]
mov rdx, rsi
call fcn.7ff65ecec7e0
mov qword [r14 + 0x50], rdi
mov qword [r14 + 0x58], r15
xorps xmm0, xmm0
movups xmmword [r14 + 0x60], xmm0
mov qword [rsp + 0x80], r14
mov rdx, qword [rbx + 8]
cmp rdx, qword [rbx + 0x10]
je 0x7ff65eceb718
mov qword [rdx], r14
add qword [rbx + 8], 8
jmp 0x7ff65eceb728
lea r8, [rsp + 0x80]
mov rcx, rbx
call fcn.7ff65eca6300
mov rax, qword [rbx + 8]
add rsi, 0x48
cmp rsi, rbp
jne 0x7ff65eceb6b6
jmp 0x7ff65eceb73b
mov rax, qword [rcx + 8]
sub rax, qword [rbx]
sar rax, 3
mov qword [rsp + 0x88], rax
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x40]
call fcn.7ff65ecec890
mov rcx, qword [rbx + 0x18]
add rcx, 0x18
mov rdx, rax
call fcn.7ff65ecb74b0
mov rdi, qword [rsp + 0x48]
test rdi, rdi
je 0x7ff65eceb7a2
mov esi, 0xffffffff
mov eax, esi
lock xadd dword [rdi + 8], eax
cmp eax, 1
jne 0x7ff65eceb7a2
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax]
lock xadd dword [rdi + 0xc], esi
cmp esi, 1
jne 0x7ff65eceb7a2
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 8]
lock inc qword [0x7ff65f191358]
mov rdi, qword [rbx]
mov rsi, qword [rbx + 8]
cmp rdi, rsi
je 0x7ff65eceb829
lea rbp, [0x7ff65eceba40]
nop dword [rax]
mov rbx, qword [rdi]
mov ecx, 0x10
call fcn.7ff65efe06d0
mov qword [rax], rbx
mov qword [rax + 8], rbp
mov qword [rsp + 0x80], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r15d
mov r9, rax
lea r8, [0x7ff65ececa90]
xor edx, edx
xor ecx, ecx
call fcn.7ff65efeeb2c
mov qword [rsp + 0x30], rax
test rax, rax
je 0x7ff65eceb843
cmp dword [rbx + 0x68], 0
jne 0x7ff65eceb83d
xorps xmm0, xmm0
movaps xmm1, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
movups xmmword [rbx + 0x60], xmm1
add rdi, 8
cmp rdi, rsi
jne 0x7ff65eceb7c0
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.7ff65efebbe8
nop
mov dword [rsp + 0x38], r15d
mov ecx, 6
call fcn.7ff65efdec80
int3
Function at 0x7ff65ed155d0
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [str.e41k2]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor r9d, r9d
mov qword [rsp + 0x20], rcx
mov rbx, rcx
lea rdx, [rsp + 0x30]
xor ecx, ecx
lea r8d, [r9 + 0x1c]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov qword [rbx + 0x18], 0xf
test eax, eax
je 0x7ff65ed15649
xor eax, eax
mov r8, 0xffffffffffffffff
mov qword [rbx], rax
mov qword [rbx + 0x10], rax
mov byte [rbx], al
lea rax, [rsp + 0x30]
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x7ff65ed15630
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.7ff65ec85ad0
jmp 0x7ff65ed1565b
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 0x10], 1
mov word [rbx], 0x2e
mov rax, rbx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.7ff65efe06b0
add rsp, 0x150
pop rbx
ret
Function at 0x7ff65ed2f160
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
mov rbp, rcx
nop dword [rax]
xor r9d, r9d
mov r8d, edi
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_recv]
movsxd rbx, eax
test eax, eax
jns 0x7ff65ed2f1a3
call fcn.7ff65efebff0
cmp dword [rax], 4
je 0x7ff65ed2f180
mov rbp, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x7ff65ed2f1c0
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x260
mov rax, qword [str.e41k2]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rdi, rcx
mov qword [rsp + 0x48], rcx
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x34], r8d
nop dword [rax + rax]
lea rax, [rsp + 0x30]
xor r9d, r9d
lea ecx, [rdi + 1]
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_select]
movsxd rbx, eax
test eax, eax
jns 0x7ff65ed2f22f
call fcn.7ff65efebff0
cmp dword [rax], 4
je 0x7ff65ed2f200
mov rax, rbx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.7ff65efe06b0
mov rbx, qword [rsp + 0x270]
add rsp, 0x260
pop rdi
ret

Function at 0x7ff65ed2f260
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x260
mov rax, qword [str.e41k2]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rdi, rcx
mov qword [rsp + 0x48], rcx
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x34], r8d
nop dword [rax + rax]
lea rax, [rsp + 0x30]
xor r9d, r9d
lea ecx, [rdi + 1]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x40]
xor edx, edx
call qword [sym.imp.WS2_32.dll_select]
movsxd rbx, eax
test eax, eax
jns 0x7ff65ed2f2ce
call fcn.7ff65efebff0
cmp dword [rax], 4
je 0x7ff65ed2f2a0
mov rax, rbx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.7ff65efe06b0
mov rbx, qword [rsp + 0x270]
add rsp, 0x260
pop rdi
ret
Function at 0x7ff65ed2f840
Capabilities:
Resolve dns

Disassembly:
push rbx
push rsi
sub rsp, 0x4f8
mov rax, qword [str.e41k2]
xor rax, rsp
mov qword [rsp + 0x4e0], rax
mov rbx, r8
mov dword [rsp + 0x40], 0x80
mov rsi, rdx
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
jne 0x7ff65ed2f92a
movzx eax, word [rsp + 0x50]
mov qword [rsp + 0x4f0], rdi
mov edi, dword [rsp + 0x40]
cmp ax, 2
je 0x7ff65ed2f89f
cmp ax, 0x17
jne 0x7ff65ed2f8af
movzx ecx, word [rsp + 0x52]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
mov dword [rbx], eax
xor edx, edx
lea rcx, [rsp + 0xd0]
mov r8d, 0x401
call fcn.7ff65efe35e0
xor eax, eax
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], eax
lea r8, [rsp + 0xd0]
mov r9d, 0x401
mov qword [rsp + 0x20], rax
mov edx, edi
lea rcx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_getnameinfo]
mov rdi, qword [rsp + 0x4f0]
test eax, eax
jne 0x7ff65ed2f92a
lea rax, [rsp + 0xd0]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x7ff65ed2f910
lea rdx, [rsp + 0xd0]
mov rcx, rsi
call fcn.7ff65ec85ad0
mov rcx, qword [rsp + 0x4e0]
xor rcx, rsp
call fcn.7ff65efe06b0
add rsp, 0x4f8
pop rsi
pop rbx
ret
mov rcx, qword [rcx + 8]
jmp 0x7ff65ed2f840

Function at 0x7ff65ed343d0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx]
mov rdi, r8
mov rbp, rdx
mov rsi, rcx
call qword [rax + 0x10]
test al, al
jne 0x7ff65ed34409
mov rax, 0xffffffffffffffff
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rsi, qword [rsi + 8]
mov eax, 0x7fffffff
cmp rdi, rax
mov qword [rsp + 0x30], rbx
cmova rdi, rax
nop
xor r9d, r9d
mov r8d, edi
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_send]
movsxd rbx, eax
test eax, eax
jns 0x7ff65ed34443
call fcn.7ff65efebff0
cmp dword [rax], 4
je 0x7ff65ed34420
mov rbp, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x7ff65ed34460
Capabilities:
Resolve dns

Disassembly:
push rbx
push rsi
sub rsp, 0x4f8
mov rax, qword [str.e41k2]
xor rax, rsp
mov qword [rsp + 0x4e0], rax
mov rbx, r8
mov dword [rsp + 0x40], 0x80
mov rsi, rdx
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
jne 0x7ff65ed2f92a
movzx eax, word [rsp + 0x50]
mov qword [rsp + 0x4f0], rdi
mov edi, dword [rsp + 0x40]
cmp ax, 2
je 0x7ff65ed2f89f
cmp ax, 0x17
jne 0x7ff65ed2f8af
movzx ecx, word [rsp + 0x52]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
mov dword [rbx], eax
xor edx, edx
lea rcx, [rsp + 0xd0]
mov r8d, 0x401
call fcn.7ff65efe35e0
xor eax, eax
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], eax
lea r8, [rsp + 0xd0]
mov r9d, 0x401
mov qword [rsp + 0x20], rax
mov edx, edi
lea rcx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_getnameinfo]
mov rdi, qword [rsp + 0x4f0]
test eax, eax
jne 0x7ff65ed2f92a
lea rax, [rsp + 0xd0]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x7ff65ed2f910
lea rdx, [rsp + 0xd0]
mov rcx, rsi
call fcn.7ff65ec85ad0
mov rcx, qword [rsp + 0x4e0]
xor rcx, rsp
call fcn.7ff65efe06b0
add rsp, 0x4f8
pop rsi
pop rbx
ret
mov rcx, qword [rcx + 8]
jmp 0x7ff65ed2f840
Function at 0x7ff65ed3b5c0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rdi, qword [rcx + 0x400]
mov rbp, rcx
mov r14, qword [rdx]
mov rbx, rdx
mov qword [rsp + 0x20], rcx
add rcx, 0x408
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x30], rdx
call fcn.7ff65efdef50
test eax, eax
jne 0x7ff65ed3b769
mov rcx, rdi
mov qword [rsp + 0x68], r15
call fcn.7ff65ee7e150
lea rcx, [rbp + 0x408]
mov rdi, rax
call fcn.7ff65efdef74
test rdi, rdi
je 0x7ff65ed3b71d
lea r8, [rsp + 0x60]
mov dword [rsp + 0x60], 1
mov edx, 0x8004667e
mov rcx, r14
call qword [sym.imp.WS2_32.dll_ioctlsocket]
xor edx, edx
mov ecx, r14d
call fcn.7ff65eec26c0
xor r9d, r9d
mov rcx, rax
mov r15, rax
lea edx, [r9 + 0x66]
lea r8d, [r9 + 1]
call fcn.7ff65eebdd80
mov r8, r15
mov rdx, r15
mov rcx, rdi
call fcn.7ff65ee7e960
cmp qword [rbp + 0x20], 0x10
lea r9, [rbp + 8]
jb 0x7ff65ed3b681
mov r9, qword [r9]
xor r8d, r8d
mov rcx, rdi
lea edx, [r8 + 0x37]
call fcn.7ff65ee7d280
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.7ff65ed3b780
cmp al, 1
jne 0x7ff65ed3b6d6
xor r9d, r9d
xor r8d, r8d
mov rcx, r15
lea edx, [r9 + 0x66]
call fcn.7ff65eebdd80
lea r8, [rsp + 0x60]
mov dword [rsp + 0x60], 0
mov edx, 0x8004667e
mov rcx, r14
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov al, 1
mov qword [rbx + 8], rdi
jmp 0x7ff65ed3b749
mov rcx, rdi
call fcn.7ff65ee7ecc0
lea rcx, [rbp + 0x408]
call fcn.7ff65efdef50
test eax, eax
jne 0x7ff65ed3b761
mov rcx, rdi
call fcn.7ff65ee7d730
lea rcx, [rbp + 0x408]
call fcn.7ff65efdef74
lea r8, [rsp + 0x60]
mov dword [rsp + 0x60], 0
mov edx, 0x8004667e
mov rcx, r14
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov rcx, qword [rbx]
cmp rcx, 0xffffffffffffffff
je 0x7ff65ed3b747
mov edx, 2
call qword [sym.imp.WS2_32.dll_shutdown]
mov rcx, qword [rbx]
cmp rcx, 0xffffffffffffffff
je 0x7ff65ed3b747
call qword [sym.imp.WS2_32.dll_closesocket]
mov qword [rbx], 0xffffffffffffffff
xor al, al
mov r15, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
mov ecx, eax
call fcn.7ff65efdec44
int3
mov ecx, eax
call fcn.7ff65efdec44
int3
Function at 0x7ff65ed3bb40
Capabilities:
Convert ip address from string

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r15
sub rsp, 0x58
mov rax, qword [str.e41k2]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor ebx, ebx
mov qword [rsp + 0x30], rcx
cmp qword [rcx + 0x20], 0x10
lea rsi, [rcx + 8]
mov rbp, rdx
mov byte [rsp + 0x20], 0
mov edi, 2
mov r15d, ebx
mov rdx, rsi
jb 0x7ff65ed3bb84
mov rdx, qword [rsi]
lea r8, [rsp + 0x38]
mov ecx, 0x17
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
je 0x7ff65ed3bba0
mov r15d, 0x10
jmp 0x7ff65ed3bbc4
cmp qword [rsi + 0x18], 0x10
jb 0x7ff65ed3bbaa
mov rsi, qword [rsi]
lea r8, [rsp + 0x24]
mov rdx, rsi
mov ecx, edi
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
je 0x7ff65ed3bbc9
mov r15d, 4
mov edi, 7
xor r9d, r9d
xor r8d, r8d
mov rcx, rbp
lea edx, [r9 + 0x55]
call fcn.7ff65eec1470
mov r12, rax
test rax, rax
je 0x7ff65ed3bcb2
mov qword [rsp + 0xa0], r13
mov rcx, rax
mov qword [rsp + 0x50], r14
xor r13b, r13b
xor r14b, r14b
call fcn.7ff65eec2d90
mov dword [rsp + 0x28], eax
test eax, eax
jle 0x7ff65ed3bca5
nop
test r14b, r14b
jne 0x7ff65ed3bca0
mov edx, ebx
mov rcx, r12
call fcn.7ff65eec2fc0
mov rsi, rax
cmp dword [rax], edi
jne 0x7ff65ed3bc8a
mov rcx, qword [rax + 8]
call fcn.7ff65ec9fa30
mov rcx, qword [rsi + 8]
mov rbp, rax
call fcn.7ff65ee7ed80
movsxd r8, eax
cmp edi, 2
je 0x7ff65ed3bc79
cmp edi, 7
jne 0x7ff65ed3bc8a
mov r8, r15
lea rcx, [rsp + 0x38]
mov rdx, rbp
call fcn.7ff65efe2e30
test eax, eax
je 0x7ff65ed3bc74
mov r8, r15
lea rcx, [rsp + 0x24]
mov rdx, rbp
call fcn.7ff65efe2e30
test eax, eax
jne 0x7ff65ed3bc8a
mov r13b, 1
jmp 0x7ff65ed3bc8a
mov rcx, qword [rsp + 0x30]
mov rdx, rbp
call fcn.7ff65ed3bce0
movzx r14d, al
inc ebx
cmp ebx, dword [rsp + 0x28]
jl 0x7ff65ed3bc10
test r14b, r14b
jne 0x7ff65ed3bca0
test r13b, r13b
je 0x7ff65ed3bca5
mov byte [rsp + 0x20], 1
mov r13, qword [rsp + 0xa0]
mov r14, qword [rsp + 0x50]
mov rcx, r12
call fcn.7ff65eec3250
movzx eax, byte [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.7ff65efe06b0
add rsp, 0x58
pop r15
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x7ff65ed59c00
Capabilities:
Get system firmware table

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x70
mov rax, qword [str.e41k2]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rsi, rcx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x52534d42
call qword [sym.imp.KERNEL32.dll_GetSystemFirmwareTable]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8d, edi
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x7ff65ed59c80
mov r9d, edi
mov r8, rax
xor edx, edx
mov ecx, 0x52534d42
call qword [sym.imp.KERNEL32.dll_GetSystemFirmwareTable]
cmp eax, edi
je 0x7ff65ed59c84
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor al, al
jmp 0x7ff65ed59cf1
movzx edx, byte [rbx + 1]
shl edx, 0x10
movzx eax, byte [rbx + 2]
shl eax, 8
add edx, eax
movzx eax, byte [rbx + 3]
add edx, eax
mov dword [rsi + 0x5c], edx
mov eax, dword [rbx + 4]
mov dword [rsi + 0x58], eax
lea rax, vtable.std::_Func_impl_no_alloc_class__lambda_b1841b2b3d7edfd58a8a013d8118f4e5___void___.0
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbx
lea rax, [rsp + 0x20]
mov qword [rsp + 0x58], rax
lea rdx, [rbx + 8]
lea r8, [rsp + 0x20]
mov rcx, rsi
call fcn.7ff65ed59730
movzx ebx, al
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x7ff65ed59cee
mov r8, qword [rcx]
lea rax, [rsp + 0x20]
cmp rcx, rax
setne dl
call qword [r8 + 0x20]
movzx eax, bl
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.7ff65efe06b0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x7ff65ed5d700
Capabilities:
Hash data using sha256

Disassembly:
push rbx
sub rsp, 0xb0
mov rax, qword [str.e41k2]
xor rax, rsp
mov qword [rsp + 0xa0], rax
xor eax, eax
mov dword [rsp + 0x20], 0x6a09e667
mov rbx, rcx
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x50], rax
lea r8, [r8*8]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x24], 0xbb67ae85
mov dword [rsp + 0x28], 0x3c6ef372
mov dword [rsp + 0x2c], 0xa54ff53a
mov dword [rsp + 0x30], 0x510e527f
mov dword [rsp + 0x34], 0x9b05688c
mov dword [rsp + 0x38], 0x1f83d9ab
mov qword [rsp + 0x3c], 0x5be0cd19
call fcn.7ff65ed5d370
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.7ff65ed5d490
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.7ff65efe06b0
add rsp, 0xb0
pop rbx
ret
mov rax, r8
mov r8, rdx
mov rdx, rcx
mov rcx, rax
jmp 0x7ff65ed5d700
Function at 0x7ff65ed62160
Capabilities:
Allocate or change rwx memory

Disassembly:
test r9, r9
je 0x7ff65ed62216
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
xor r12d, r12d
mov qword [rsp + 0x40], rbx
mov edi, r12d
mov rbp, r9
mov r14, r8
mov rsi, rdx
mov r15, rcx
nop dword [rax]
mov edx, 0x1000
mov ecx, 0x1c0
call fcn.7ff65efefe20
xor ecx, ecx
mov edx, 0x4000
mov r8d, 0x3000
mov rbx, rax
mov qword [rax + 0xe0], rsi
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [rbx + 0x120], r12d
add rsi, r14
mov qword [rbx + 0x118], rax
mov qword [rbx + 0x128], 0xffffffffffffffff
mov qword [r15 + rdi*8], rbx
inc rdi
cmp rdi, rbp
jb 0x7ff65ed621a0
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x7ff65ed62220
Capabilities:
Hash data using sha256

Disassembly:
push rbx
sub rsp, 0xb0
mov rax, qword [str.e41k2]
xor rax, rsp
mov qword [rsp + 0xa0], rax
xor eax, eax
mov dword [rsp + 0x20], 0x6a09e667
mov rbx, rcx
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x50], rax
lea r8, [r8*8]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x24], 0xbb67ae85
mov dword [rsp + 0x28], 0x3c6ef372
mov dword [rsp + 0x2c], 0xa54ff53a
mov dword [rsp + 0x30], 0x510e527f
mov dword [rsp + 0x34], 0x9b05688c
mov dword [rsp + 0x38], 0x1f83d9ab
mov qword [rsp + 0x3c], 0x5be0cd19
call fcn.7ff65ed5d370
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.7ff65ed5d490
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.7ff65efe06b0
add rsp, 0xb0
pop rbx
ret
mov rax, r8
mov r8, rdx
mov rdx, rcx
mov rcx, rax
jmp 0x7ff65ed5d700
Function at 0x7ff65edffde0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x10
mov r11, rcx
movaps xmmword [rsp], xmm6
movdqu xmm6, xmmword [rdx]
lea rdi, str.cw
pshufd xmm0, xmm6, 0x55
mov rbx, rdx
movd eax, xmm0
movdqu xmm5, xmmword [r11]
pshufd xmm0, xmm6, 0xff
mov r9d, eax
shr rax, 0x10
movzx r8d, al
mov eax, r9d
shr rax, 0x18
pslldq xmm5, 4
movdqa xmm4, xmm5
pslldq xmm5, 4
movzx r10d, byte [r8 + rdi]
movzx eax, byte [rax + rdi]
pxor xmm4, xmmword [r11]
shl eax, 8
or r10d, eax
mov eax, r9d
shr rax, 8
movzx ecx, al
shl r10d, 8
movzx eax, byte [rcx + rdi]
or r10d, eax
movzx eax, r9b
shl r10d, 8
movzx ecx, byte [rax + rdi]
or r10d, ecx
movd eax, xmm0
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movd xmm3, r10d
movzx r8d, byte [rcx + rdi]
movzx eax, byte [rax + rdi]
shl eax, 8
or r8d, eax
mov eax, edx
shr rax, 8
movzx ecx, al
shl r8d, 8
movzx eax, byte [rcx + rdi]
or r8d, eax
movzx eax, dl
shl r8d, 8
movzx ecx, byte [rax + rdi]
mov eax, r10d
or r8d, ecx
ror eax, 8
xor eax, 1
mov ecx, r8d
ror ecx, 8
xor ecx, 1
movd xmm2, r8d
movd xmm0, eax
punpckldq xmm3, xmm0
movdqa xmm0, xmm5
movd xmm1, ecx
pxor xmm0, xmm4
punpckldq xmm2, xmm1
punpcklqdq xmm3, xmm2
pslldq xmm5, 4
pxor xmm0, xmm5
pshufd xmm1, xmm3, 0xff
pxor xmm1, xmm0
pshufd xmm0, xmm1, 0x55
movd eax, xmm0
movdqu xmmword [r11], xmm1
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movzx r9d, byte [rcx + rdi]
movzx eax, byte [rax + rdi]
shl eax, 8
movdqa xmm5, xmm6
or r9d, eax
pshufd xmm0, xmm1, 0xff
shl r9d, 8
mov eax, edx
shr rax, 8
movzx ecx, al
pslldq xmm5, 4
movdqa xmm4, xmm5
pslldq xmm5, 4
pxor xmm4, xmm6
movaps xmm6, xmmword [rsp]
movzx eax, byte [rcx + rdi]
or r9d, eax
movzx eax, dl
shl r9d, 8
movzx ecx, byte [rax + rdi]
movd eax, xmm0
or r9d, ecx
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movd xmm3, r9d
movzx r8d, byte [rcx + rdi]
movzx eax, byte [rax + rdi]
shl eax, 8
or r8d, eax
mov eax, edx
shr rax, 8
movzx ecx, al
shl r8d, 8
movzx eax, byte [rcx + rdi]
or r8d, eax
movzx eax, dl
shl r8d, 8
movzx ecx, byte [rax + rdi]
or r8d, ecx
mov ecx, r9d
mov eax, r8d
ror eax, 8
ror ecx, 8
movd xmm2, r8d
movd xmm1, eax
punpckldq xmm2, xmm1
movd xmm0, ecx
punpckldq xmm3, xmm0
movdqa xmm0, xmm5
pxor xmm0, xmm4
punpcklqdq xmm3, xmm2
pslldq xmm5, 4
pxor xmm0, xmm5
pshufd xmm1, xmm3, 0xaa
pxor xmm1, xmm0
movdqu xmmword [rbx], xmm1
mov rbx, qword [rsp + 0x20]
add rsp, 0x10
pop rdi
ret