joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180051340
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xf0
mov rax, qword [0x180084088]
xor rax, rsp
mov qword [rbp + 0x47], rax
movups xmm0, xmmword [rcx]
mov rdi, rcx
xor r8d, r8d
movups xmm1, xmmword [rcx + 0x10]
lea rdx, [rbp - 0x79]
movups xmmword [rbp - 0x39], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rbp - 0x29], xmm1
movups xmm1, xmmword [rcx + 0x30]
lea rcx, [rbp - 0x39]
movups xmmword [rbp - 0x19], xmm0
movups xmmword [rbp - 9], xmm1
call fcn.180052680
mov r8d, 1
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x79]
call fcn.180052680
mov ebx, 2
lea rdx, [rbp - 0x79]
mov r8d, ebx
lea rcx, [rbp + 7]
call fcn.180052680
lea r8d, [rbx + 1]
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x79]
call fcn.180052680
lea r8d, [rbx + 2]
lea rdx, [rbp - 0x79]
lea rcx, [rbp + 7]
call fcn.180052680
lea r8d, [rbx + 3]
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x79]
call fcn.180052680
lea r8d, [rbx + 4]
lea rdx, [rbp - 0x79]
lea rcx, [rbp + 7]
call fcn.180052680
lea r8d, [rbx + 5]
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x79]
call fcn.180052680
lea r8d, [rbx + 6]
lea rdx, [rbp - 0x79]
lea rcx, [rbp + 7]
call fcn.180052680
lea r8d, [rbx + 7]
lea rdx, [rbp - 0x39]
lea rcx, [rbp - 0x79]
call fcn.180052680
xor r8d, r8d
lea rcx, [rbp + 3]
lea rax, [rdi + 0x3c]
lea edx, [rbx + 0xe]
cmp rdi, rcx
ja 0x180051452
lea rcx, [rbp - 0x39]
cmp rax, rcx
jae 0x180051491
lea rcx, [rbp - 0x39]
mov r8d, edx
sub rcx, rdi
lea rax, [rdi + 0x10]
movdqu xmm0, xmmword [rax - 0x10]
movdqu xmm1, xmmword [rcx + rax - 0x10]
movdqu xmm2, xmmword [rcx + rax]
lea rax, [rax + 0x20]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x30], xmm1
movdqu xmm0, xmmword [rax - 0x20]
pxor xmm2, xmm0
movdqu xmmword [rax - 0x20], xmm2
sub rbx, 1
jne 0x180051460
movsxd rcx, r8d
cmp rcx, rdx
jge 0x1800514c0
lea r8, [rbp - 0x39]
sub r8, rdi
lea rax, [rdi + rcx*4]
sub rdx, rcx
nop word [rax + rax]
mov ecx, dword [rax + r8]
xor dword [rax], ecx
lea rax, [rax + 4]
sub rdx, 1
jne 0x1800514b0
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.18002b180
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x180056f30
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x10
mov r11, rcx
movaps xmmword [rsp], xmm6
movdqa xmm6, xmmword [rdx]
lea rdi, str.cw
pshufd xmm0, xmm6, 0x55
mov rbx, rdx
movd eax, xmm0
movdqa xmm5, xmmword [r11]
pshufd xmm0, xmm6, 0xff
mov r9d, eax
shr rax, 0x10
movzx r8d, al
mov eax, r9d
shr rax, 0x18
pslldq xmm5, 4
movdqa xmm4, xmm5
pslldq xmm5, 4
movzx r10d, byte [r8 + rdi]
movzx eax, byte [rax + rdi]
pxor xmm4, xmmword [r11]
shl eax, 8
or r10d, eax
mov eax, r9d
shr rax, 8
movzx ecx, al
shl r10d, 8
movzx eax, byte [rcx + rdi]
or r10d, eax
movzx eax, r9b
shl r10d, 8
movzx ecx, byte [rax + rdi]
or r10d, ecx
movd eax, xmm0
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movd xmm3, r10d
movzx r8d, byte [rcx + rdi]
movzx eax, byte [rax + rdi]
shl eax, 8
or r8d, eax
mov eax, edx
shr rax, 8
movzx ecx, al
shl r8d, 8
movzx eax, byte [rcx + rdi]
or r8d, eax
movzx eax, dl
shl r8d, 8
movzx ecx, byte [rax + rdi]
mov eax, r10d
or r8d, ecx
ror eax, 8
xor eax, 8
mov ecx, r8d
ror ecx, 8
xor ecx, 8
movd xmm0, r8d
movd xmm2, eax
punpckldq xmm3, xmm0
movdqa xmm0, xmm5
movd xmm1, ecx
pxor xmm0, xmm4
punpckldq xmm2, xmm1
punpckldq xmm3, xmm2
pslldq xmm5, 4
pxor xmm0, xmm5
pshufd xmm1, xmm3, 0xff
pxor xmm1, xmm0
pshufd xmm0, xmm1, 0x55
movd eax, xmm0
movdqa xmmword [r11], xmm1
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movzx r9d, byte [rcx + rdi]
movzx eax, byte [rax + rdi]
shl eax, 8
movdqa xmm5, xmm6
or r9d, eax
pshufd xmm0, xmm1, 0xff
shl r9d, 8
mov eax, edx
shr rax, 8
movzx ecx, al
pslldq xmm5, 4
movdqa xmm4, xmm5
pslldq xmm5, 4
pxor xmm4, xmm6
movaps xmm6, xmmword [rsp]
movzx eax, byte [rcx + rdi]
or r9d, eax
movzx eax, dl
shl r9d, 8
movzx ecx, byte [rax + rdi]
movd eax, xmm0
or r9d, ecx
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movd xmm3, r9d
movzx r8d, byte [rcx + rdi]
movzx eax, byte [rax + rdi]
shl eax, 8
or r8d, eax
mov eax, edx
shr rax, 8
movzx ecx, al
shl r8d, 8
movzx eax, byte [rcx + rdi]
or r8d, eax
movzx eax, dl
shl r8d, 8
movzx ecx, byte [rax + rdi]
or r8d, ecx
mov ecx, r9d
mov eax, r8d
ror eax, 8
ror ecx, 8
movd xmm0, r8d
punpckldq xmm3, xmm0
movdqa xmm0, xmm5
movd xmm1, eax
pxor xmm0, xmm4
movd xmm2, ecx
punpckldq xmm2, xmm1
punpckldq xmm3, xmm2
pslldq xmm5, 4
pshufd xmm1, xmm3, 0xaa
pxor xmm0, xmm5
pxor xmm1, xmm0
movdqa xmmword [rbx], xmm1
mov rbx, qword [rsp + 0x20]
add rsp, 0x10
pop rdi
ret
Function at 0x1800571e0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x10
mov r11, rcx
movaps xmmword [rsp], xmm6
movdqa xmm6, xmmword [rdx]
lea rdi, str.cw
pshufd xmm0, xmm6, 0x55
mov rbx, rdx
movd eax, xmm0
movdqa xmm5, xmmword [r11]
pshufd xmm0, xmm6, 0xff
mov r9d, eax
shr rax, 0x10
movzx r8d, al
mov eax, r9d
shr rax, 0x18
pslldq xmm5, 4
movdqa xmm4, xmm5
pslldq xmm5, 4
movzx r10d, byte [r8 + rdi]
movzx eax, byte [rax + rdi]
pxor xmm4, xmmword [r11]
shl eax, 8
or r10d, eax
mov eax, r9d
shr rax, 8
movzx ecx, al
shl r10d, 8
movzx eax, byte [rcx + rdi]
or r10d, eax
movzx eax, r9b
shl r10d, 8
movzx ecx, byte [rax + rdi]
or r10d, ecx
movd eax, xmm0
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movd xmm3, r10d
movzx r8d, byte [rcx + rdi]
movzx eax, byte [rax + rdi]
shl eax, 8
or r8d, eax
mov eax, edx
shr rax, 8
movzx ecx, al
shl r8d, 8
movzx eax, byte [rcx + rdi]
or r8d, eax
movzx eax, dl
shl r8d, 8
movzx ecx, byte [rax + rdi]
mov eax, r10d
or r8d, ecx
ror eax, 8
xor eax, 4
mov ecx, r8d
ror ecx, 8
xor ecx, 4
movd xmm0, r8d
movd xmm2, eax
punpckldq xmm3, xmm0
movdqa xmm0, xmm5
movd xmm1, ecx
pxor xmm0, xmm4
punpckldq xmm2, xmm1
punpckldq xmm3, xmm2
pslldq xmm5, 4
pxor xmm0, xmm5
pshufd xmm1, xmm3, 0xff
pxor xmm1, xmm0
pshufd xmm0, xmm1, 0x55
movd eax, xmm0
movdqa xmmword [r11], xmm1
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movzx r9d, byte [rcx + rdi]
movzx eax, byte [rax + rdi]
shl eax, 8
movdqa xmm5, xmm6
or r9d, eax
pshufd xmm0, xmm1, 0xff
shl r9d, 8
mov eax, edx
shr rax, 8
movzx ecx, al
pslldq xmm5, 4
movdqa xmm4, xmm5
pslldq xmm5, 4
pxor xmm4, xmm6
movaps xmm6, xmmword [rsp]
movzx eax, byte [rcx + rdi]
or r9d, eax
movzx eax, dl
shl r9d, 8
movzx ecx, byte [rax + rdi]
movd eax, xmm0
or r9d, ecx
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movd xmm3, r9d
movzx r8d, byte [rcx + rdi]
movzx eax, byte [rax + rdi]
shl eax, 8
or r8d, eax
mov eax, edx
shr rax, 8
movzx ecx, al
shl r8d, 8
movzx eax, byte [rcx + rdi]
or r8d, eax
movzx eax, dl
shl r8d, 8
movzx ecx, byte [rax + rdi]
or r8d, ecx
mov ecx, r9d
mov eax, r8d
ror eax, 8
ror ecx, 8
movd xmm0, r8d
punpckldq xmm3, xmm0
movdqa xmm0, xmm5
movd xmm1, eax
pxor xmm0, xmm4
movd xmm2, ecx
punpckldq xmm2, xmm1
punpckldq xmm3, xmm2
pslldq xmm5, 4
pshufd xmm1, xmm3, 0xaa
pxor xmm0, xmm5
pxor xmm1, xmm0
movdqa xmmword [rbx], xmm1
mov rbx, qword [rsp + 0x20]
add rsp, 0x10
pop rdi
ret
Function at 0x180057490
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x10
mov r11, rcx
movaps xmmword [rsp], xmm6
movdqa xmm6, xmmword [rdx]
lea rdi, str.cw
pshufd xmm0, xmm6, 0x55
mov rbx, rdx
movd eax, xmm0
movdqa xmm5, xmmword [r11]
pshufd xmm0, xmm6, 0xff
mov r9d, eax
shr rax, 0x10
movzx r8d, al
mov eax, r9d
shr rax, 0x18
pslldq xmm5, 4
movdqa xmm4, xmm5
pslldq xmm5, 4
movzx r10d, byte [r8 + rdi]
movzx eax, byte [rax + rdi]
pxor xmm4, xmmword [r11]
shl eax, 8
or r10d, eax
mov eax, r9d
shr rax, 8
movzx ecx, al
shl r10d, 8
movzx eax, byte [rcx + rdi]
or r10d, eax
movzx eax, r9b
shl r10d, 8
movzx ecx, byte [rax + rdi]
or r10d, ecx
movd eax, xmm0
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movd xmm3, r10d
movzx r8d, byte [rcx + rdi]
movzx eax, byte [rax + rdi]
shl eax, 8
or r8d, eax
mov eax, edx
shr rax, 8
movzx ecx, al
shl r8d, 8
movzx eax, byte [rcx + rdi]
or r8d, eax
movzx eax, dl
shl r8d, 8
movzx ecx, byte [rax + rdi]
mov eax, r10d
or r8d, ecx
ror eax, 8
xor eax, 2
mov ecx, r8d
ror ecx, 8
xor ecx, 2
movd xmm0, r8d
movd xmm2, eax
punpckldq xmm3, xmm0
movdqa xmm0, xmm5
movd xmm1, ecx
pxor xmm0, xmm4
punpckldq xmm2, xmm1
punpckldq xmm3, xmm2
pslldq xmm5, 4
pxor xmm0, xmm5
pshufd xmm1, xmm3, 0xff
pxor xmm1, xmm0
pshufd xmm0, xmm1, 0x55
movd eax, xmm0
movdqa xmmword [r11], xmm1
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movzx r9d, byte [rcx + rdi]
movzx eax, byte [rax + rdi]
shl eax, 8
movdqa xmm5, xmm6
or r9d, eax
pshufd xmm0, xmm1, 0xff
shl r9d, 8
mov eax, edx
shr rax, 8
movzx ecx, al
pslldq xmm5, 4
movdqa xmm4, xmm5
pslldq xmm5, 4
pxor xmm4, xmm6
movaps xmm6, xmmword [rsp]
movzx eax, byte [rcx + rdi]
or r9d, eax
movzx eax, dl
shl r9d, 8
movzx ecx, byte [rax + rdi]
movd eax, xmm0
or r9d, ecx
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movd xmm3, r9d
movzx r8d, byte [rcx + rdi]
movzx eax, byte [rax + rdi]
shl eax, 8
or r8d, eax
mov eax, edx
shr rax, 8
movzx ecx, al
shl r8d, 8
movzx eax, byte [rcx + rdi]
or r8d, eax
movzx eax, dl
shl r8d, 8
movzx ecx, byte [rax + rdi]
or r8d, ecx
mov ecx, r9d
mov eax, r8d
ror eax, 8
ror ecx, 8
movd xmm0, r8d
punpckldq xmm3, xmm0
movdqa xmm0, xmm5
movd xmm1, eax
pxor xmm0, xmm4
movd xmm2, ecx
punpckldq xmm2, xmm1
punpckldq xmm3, xmm2
pslldq xmm5, 4
pshufd xmm1, xmm3, 0xaa
pxor xmm0, xmm5
pxor xmm1, xmm0
movdqa xmmword [rbx], xmm1
mov rbx, qword [rsp + 0x20]
add rsp, 0x10
pop rdi
ret
Function at 0x180057740
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x10
mov r11, rcx
movaps xmmword [rsp], xmm6
movdqa xmm6, xmmword [rdx]
lea rdi, str.cw
pshufd xmm0, xmm6, 0x55
mov rbx, rdx
movd eax, xmm0
movdqa xmm5, xmmword [r11]
pshufd xmm0, xmm6, 0xff
mov r9d, eax
shr rax, 0x10
movzx r8d, al
mov eax, r9d
shr rax, 0x18
pslldq xmm5, 4
movdqa xmm4, xmm5
pslldq xmm5, 4
movzx r10d, byte [r8 + rdi]
movzx eax, byte [rax + rdi]
pxor xmm4, xmmword [r11]
shl eax, 8
or r10d, eax
mov eax, r9d
shr rax, 8
movzx ecx, al
shl r10d, 8
movzx eax, byte [rcx + rdi]
or r10d, eax
movzx eax, r9b
shl r10d, 8
movzx ecx, byte [rax + rdi]
or r10d, ecx
movd eax, xmm0
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movd xmm3, r10d
movzx r8d, byte [rcx + rdi]
movzx eax, byte [rax + rdi]
shl eax, 8
or r8d, eax
mov eax, edx
shr rax, 8
movzx ecx, al
shl r8d, 8
movzx eax, byte [rcx + rdi]
or r8d, eax
movzx eax, dl
shl r8d, 8
movzx ecx, byte [rax + rdi]
mov eax, r10d
or r8d, ecx
ror eax, 8
xor eax, 1
mov ecx, r8d
ror ecx, 8
xor ecx, 1
movd xmm0, r8d
movd xmm2, eax
punpckldq xmm3, xmm0
movdqa xmm0, xmm5
movd xmm1, ecx
pxor xmm0, xmm4
punpckldq xmm2, xmm1
punpckldq xmm3, xmm2
pslldq xmm5, 4
pxor xmm0, xmm5
pshufd xmm1, xmm3, 0xff
pxor xmm1, xmm0
pshufd xmm0, xmm1, 0x55
movd eax, xmm0
movdqa xmmword [r11], xmm1
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movzx r9d, byte [rcx + rdi]
movzx eax, byte [rax + rdi]
shl eax, 8
movdqa xmm5, xmm6
or r9d, eax
pshufd xmm0, xmm1, 0xff
shl r9d, 8
mov eax, edx
shr rax, 8
movzx ecx, al
pslldq xmm5, 4
movdqa xmm4, xmm5
pslldq xmm5, 4
pxor xmm4, xmm6
movaps xmm6, xmmword [rsp]
movzx eax, byte [rcx + rdi]
or r9d, eax
movzx eax, dl
shl r9d, 8
movzx ecx, byte [rax + rdi]
movd eax, xmm0
or r9d, ecx
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movd xmm3, r9d
movzx r8d, byte [rcx + rdi]
movzx eax, byte [rax + rdi]
shl eax, 8
or r8d, eax
mov eax, edx
shr rax, 8
movzx ecx, al
shl r8d, 8
movzx eax, byte [rcx + rdi]
or r8d, eax
movzx eax, dl
shl r8d, 8
movzx ecx, byte [rax + rdi]
or r8d, ecx
mov ecx, r9d
mov eax, r8d
ror eax, 8
ror ecx, 8
movd xmm0, r8d
punpckldq xmm3, xmm0
movdqa xmm0, xmm5
movd xmm1, eax
pxor xmm0, xmm4
movd xmm2, ecx
punpckldq xmm2, xmm1
punpckldq xmm3, xmm2
pslldq xmm5, 4
pshufd xmm1, xmm3, 0xaa
pxor xmm0, xmm5
pxor xmm1, xmm0
movdqa xmmword [rbx], xmm1
mov rbx, qword [rsp + 0x20]
add rsp, 0x10
pop rdi
ret
Function at 0x180064cec
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0xa0
mov rax, qword [0x180084088]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rbx, rdx
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x50]
lea r8d, [rdx + 0x40]
call fcn.18002f5e0
mov rdx, rbx
mov rcx, rdi
call fcn.180064e64
mov dword [rbx + 0x50], eax
mov r8d, eax
cmp eax, 0xffffffff
jne 0x180064d40
lea eax, [r8 - 6]
jmp 0x180064e3c
cmp dword [rdi], 1
jl 0x180064da4
mov ecx, dword [rdi + 0x10]
shr ecx, 8
and ecx, 0xf
mov dword [rbx + 0xd4], ecx
mov eax, dword [rdi + 0x10]
shr eax, 4
and eax, 0xf
mov dword [rbx + 0xd8], eax
mov eax, dword [rdi + 0x10]
and eax, 0xf
mov dword [rbx + 0xdc], eax
mov eax, dword [rdi + 0x10]
mov edx, eax
shr edx, 0x10
shr eax, 0x14
and edx, 0xf
movzx r9d, al
cmp r8d, 1
jne 0x180064d8c
cmp ecx, 0xf
jl 0x180064d8f
add ecx, r9d
shl edx, 4
add edx, dword [rbx + 0xd8]
mov dword [rbx + 0xe4], edx
mov dword [rbx + 0xe0], ecx
mov eax, dword [rdi + 0x200]
sub eax, 0x8000000
cmp eax, 4
jl 0x180064e1a
movups xmm0, xmmword [rdi + 0x220]
xor ecx, ecx
mov byte [rsp + 0x80], 0
movups xmm1, xmmword [rdi + 0x230]
movups xmm2, xmm0
movaps xmmword [rsp + 0x50], xmm0
movups xmm0, xmmword [rdi + 0x240]
movd eax, xmm2
movups xmmword [rsp + 0x60], xmm1
movups xmmword [rsp + 0x70], xmm0
cmp al, 0x20
jne 0x180064dfc
lea rax, [rsp + 0x50]
inc rax
inc ecx
cmp byte [rax], 0x20
je 0x180064df2
movsxd rax, ecx
lea rdx, [rsp + 0x50]
add rdx, rax
lea rcx, [rbx + 0x10]
mov r8d, 0x40
call fcn.18002fc60
mov byte [rbx + 0x40], 0
mov rdx, rbx
mov rcx, rdi
call fcn.1800650d4
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x40]
mov dword [rbx + 0xf0], eax
xor eax, eax
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.18002b180
mov rbx, qword [rsp + 0xc0]
add rsp, 0xa0
pop rdi
ret
Function at 0x1800659fc
Capabilities:
Parse pe header

Disassembly:
push rbp
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rax, qword [0x180084088]
xor rax, rsp
mov qword [rbp], rax
mov r11d, 2
mov dword [rsp], shutdown
mov r8, rcx
mov dword [rsp + 4], 0x3a
xor ecx, ecx
mov dword [rsp + 8], reloc.WS2_32.dll_shutdown
mov r9, rdx
mov dword [rsp + 0xc], gethostname
lea edx, [r11 + 8]
mov dword [rsp + 0x10], 0x19
cmp dword [r8 + 0x200], 0x80000001
lea eax, [rdx + 1]
lea r10d, [r11 + 7]
mov dword [rbp - 0x30], eax
mov dword [rbp - 0x80], eax
mov dword [rsp + 0x14], 0x3b
mov dword [rsp + 0x18], 0x1e
mov dword [rsp + 0x1c], reloc.WS2_32.dll_gethostname
mov dword [rsp + 0x20], 0x1f
mov dword [rsp + 0x24], gethostname
mov dword [rbp - 0x70], 1
mov dword [rbp - 0x6c], 0x3f
mov dword [rbp - 0x68], r11d
mov dword [rbp - 0x64], 0x40
mov dword [rbp - 0x60], 5
mov dword [rbp - 0x5c], 0x41
mov dword [rbp - 0x58], 6
mov dword [rbp - 0x54], 0x43
mov dword [rbp - 0x50], 7
mov dword [rbp - 0x4c], 0x42
mov dword [rbp - 0x48], 8
mov dword [rbp - 0x44], 0x44
mov dword [rbp - 0x40], r10d
mov dword [rbp - 0x3c], 0x45
mov dword [rbp - 0x38], edx
mov dword [rbp - 0x34], 0x46
mov dword [rbp - 0x2c], 0x53
mov dword [rbp - 0x28], recv
mov dword [rbp - 0x24], 0x48
mov dword [rbp - 0x20], reloc.WS2_32.dll_listen
mov dword [rbp - 0x1c], 0x49
mov dword [rbp - 0x18], reloc.WS2_32.dll_recv
mov dword [rbp - 0x14], 0x55
mov dword [rbp - 0x10], reloc.WS2_32.dll_setsockopt
mov dword [rbp - 0xc], 0x56
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x34], 0x4a
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x3c], 0x4b
mov dword [rsp + 0x40], r11d
mov dword [rsp + 0x44], 0x4c
mov dword [rsp + 0x48], 3
mov dword [rsp + 0x4c], 0x4d
mov dword [rsp + 0x50], 4
mov dword [rsp + 0x54], 0x4e
mov dword [rsp + 0x58], 5
mov dword [rsp + 0x5c], 0x4f
mov dword [rsp + 0x60], 6
mov dword [rsp + 0x64], 0x50
mov dword [rsp + 0x68], 7
mov dword [rsp + 0x6c], 0x51
mov dword [rsp + 0x70], r10d
mov dword [rsp + 0x74], 0x5a
mov dword [rsp + 0x78], edx
mov dword [rsp + 0x7c], 0x5b
mov dword [rbp - 0x7c], 0x5c
mov dword [rbp - 0x78], recv
mov dword [rbp - 0x74], 0x5d
jb 0x180065c2d
mov r10d, dword [r8 + 0x21c]
mov edx, ecx
mov eax, dword [rsp + rdx*8]
bt r10d, eax
jae 0x180065bfc
movsxd rax, dword [rsp + rdx*8 + 4]
mov byte [rax + r9 + 0x54], 1
inc rdx
cmp rdx, 5
jl 0x180065be8
mov r10d, dword [r8 + 0x218]
mov rdx, rcx
mov eax, dword [rbp + rdx*8 - 0x70]
bt r10d, eax
jae 0x180065c24
movsxd rax, dword [rbp + rdx*8 - 0x6c]
mov byte [rax + r9 + 0x54], 1
inc rdx
cmp rdx, 0xd
jl 0x180065c0f
cmp dword [r8 + 0x200], 0x80000007
jb 0x180065c5e
mov edx, dword [r8 + 0x27c]
mov eax, dword [rsp + rcx*8 + 0x30]
bt edx, eax
jae 0x180065c55
movsxd rax, dword [rsp + rcx*8 + 0x34]
mov byte [rax + r9 + 0x54], 1
inc rcx
cmp rcx, 0xc
jl 0x180065c41
cmp dword [r8 + 0x200], 0x8000001a
jb 0x180065c8d
mov byte [r9 + 0x16c], 1
mov eax, dword [r8 + 0x3a0]
and al, 1
neg al
sbb ecx, ecx
and ecx, 0x40
add ecx, 0x40
mov dword [r9 + 0x168], ecx
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.18002b180
add rsp, 0x110
pop rbp
ret
Function at 0x1400a8930
Capabilities:
Check mutex on windows

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov byte [rcx], 0
mov qword [rcx + 8], 0
lea r8, str.A946A6A9_917E_4949_B9BC_6BADA8C7FD63
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsi + 8], rax
test rax, rax
je 0x1400a8970
mov rcx, rax
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
sete byte [rsi]
mov rax, rsi
add rsp, 0x20
pop rsi
ret

Function at 0x1400aa030
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov r15, qword [rcx + 0x10]
cmp r15, qword [rcx + 0x18]
je 0x1400aa06f
test r15, r15
je 0x1400aa15d
mov rax, qword [rdi]
mov qword [r15], rax
add qword [rsi + 0x10], 8
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov r14, qword [rsi]
mov rbx, qword [rsi + 8]
mov rax, rbx
sub rax, r14
jbe 0x1400aa0b9
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
lea r14, [rax + rcx]
inc r14
shr r14, 1
shl r14, 3
mov rcx, rbx
sub rcx, r14
mov r8, r15
sub r8, rbx
mov rdx, rbx
call fcn.140243eb0
sub r15, r14
mov qword [rsi + 0x10], r15
sub qword [rsi + 8], r14
jmp 0x1400aa04d
mov rax, r15
sub rax, r14
sar rax, 2
cmp r15, r14
mov r12d, 1
cmovne r12, rax
mov rax, r12
shr rax, 0x3d
jne 0x1400aa189
lea rcx, [r12*8]
call fcn.140240cd8
mov rcx, r12
and rcx, 0xfffffffffffffffc
lea rcx, [rax + rcx*2]
mov rdx, rcx
sub r15, rbx
je 0x1400aa12d
mov r8, r15
sar r8, 3
and r15, 0xfffffffffffffff8
mov rdx, r15
add rdx, rcx
shl r8, 3
xor r9d, r9d
mov r10, rcx
add r10, r9
je 0x1400aa15d
mov r11, qword [rbx + r9]
mov qword [r10], r11
add r9, 8
cmp r8, r9
jne 0x1400aa115
lea r8, [rax + r12*8]
mov qword [rsi], rax
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
mov qword [rsi + 0x18], r8
mov r15, rdx
test r14, r14
je 0x1400aa04d
mov rcx, r14
call fcn.140240d14
mov r15, qword [rsi + 0x10]
jmp 0x1400aa04d
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x23
call fcn.140280b90
call fcn.14027e620
int3
Function at 0x1400ab620
Capabilities:
Query or enumerate registry value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x88
mov rsi, rcx
mov rax, qword [0x140418038]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rdi, qword [rcx]
mov rbx, qword [rcx + 8]
cmp rbx, rdi
je 0x1400ab683
add rbx, 0xffffffffffffffd0
test rbx, rbx
je 0x1400ab820
cmp byte [rbx + 0x2f], 0
jns 0x1400ab669
mov rcx, qword [rbx + 0x18]
call fcn.140240d14
cmp byte [rbx + 0x17], 0
jns 0x1400ab677
mov rcx, qword [rbx]
call fcn.140240d14
lea rax, [rbx - 0x30]
cmp rbx, rdi
mov rbx, rax
jne 0x1400ab651
mov qword [rsi + 8], rdi
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x60]
mov qword [rdi + 0x10], rax
movaps xmm0, xmmword [0x1403aa440]
movaps xmmword [rdi], xmm0
lea r8, str.SYSTEMCurrentControlSetControlSession_Manager
mov rcx, rdi
mov rdx, 0xffffffff80000002
mov r9d, 1
call fcn.1400f7df0
mov rdi, qword [rdi]
test rdi, rdi
je 0x1400ab78b
mov dword [rsp + 0x5c], 0
xorps xmm0, xmm0
lea rbx, [rsp + 0x40]
movaps xmmword [rbx], xmm0
mov qword [rbx + 0x10], 0
mov edx, 1
mov rcx, rbx
call fcn.1401cbcd0
mov dword [rsp + 0x3c], 0xaaaaaaaa
mov rax, qword [rbx]
cmp qword [rbx + 8], rax
je 0x1400ab86a
lea r14, [rsp + 0x5c]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rax
lea rdx, str.PendingFileRenameOperations
lea r9, [rsp + 0x3c]
mov rcx, rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 2
je 0x1400ab792
cmp eax, 0xea
jne 0x1400ab7d5
mov ebx, 0x8000ffff
cmp dword [rsp + 0x3c], 7
jne 0x1400ab7e3
mov edx, dword [rsp + 0x5c]
test dl, 1
jne 0x1400ab7e3
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
mov r8, rcx
sub r8, rax
cmp r8, rdx
jae 0x1400ab799
sub rdx, r8
lea rbx, [rsp + 0x40]
mov rcx, rbx
call fcn.1401cbcd0
mov rax, qword [rbx]
mov rcx, qword [rbx + 8]
jmp 0x1400ab7a6
mov ebx, 0x80070002
jmp 0x1400ab7f7
mov ebx, 0x80070002
jmp 0x1400ab7e3
jbe 0x1400ab7a6
add rdx, rax
mov qword [rsp + 0x48], rdx
mov rcx, rdx
cmp rcx, rax
je 0x1400ab86a
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rax
lea rdx, str.PendingFileRenameOperations
lea r9, [rsp + 0x3c]
mov rcx, rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1400ab84c
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400ab7f7
mov qword [rsp + 0x48], rcx
call fcn.140240d14
lea rcx, [rsp + 0x60]
call fcn.1400f8090
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140242430
mov eax, ebx
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rax, str.null_pointer_given_to_destroy_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__loc___nullptr
mov r8d, 0x3f
call fcn.140280b90
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
sub rdx, rcx
je 0x1400ab86a
mov r8, rsi
call fcn.140282100
mov ebx, eax
jmp 0x1400ab7e3
lea rax, str.vector___index_out_of_bounds
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude_vector
lea r9, str.__n___size__
mov r8d, 0x587
call fcn.140280b90
int3
Function at 0x1400aeaf0
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rdx
mov edi, ecx
mov rax, qword [0x140418038]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r8d, 0x20
call fcn.14025a3ec
mov ebx, 6
cmp eax, 0x20
jne 0x1400aebc6
mov ecx, dword [rsi + 8]
mov rbx, qword [sym.imp.WS2_32.dll_ntohl]
call rbx
mov dword [rsi + 8], eax
mov ecx, dword [rsi + 0xc]
call rbx
mov dword [rsi + 0xc], eax
mov ecx, dword [rsi + 0x10]
call rbx
mov dword [rsi + 0x10], eax
mov ecx, dword [rsi + 0x14]
call rbx
mov dword [rsi + 0x14], eax
mov ecx, dword [rsi + 0x18]
call rbx
mov dword [rsi + 0x18], eax
mov ecx, dword [rsi + 0x1c]
call rbx
mov dword [rsi + 0x1c], eax
movaps xmm0, xmmword [0x1403aa440]
lea rdx, [rsp + 0x20]
movaps xmmword [rdx + 0x20], xmm0
movaps xmmword [rdx + 0x10], xmm0
movaps xmmword [rdx], xmm0
mov ecx, edi
call fcn.140257f4c
mov ebx, 6
test eax, eax
jne 0x1400aebc6
movabs rax, 0x303146464944424d
mov ebx, 8
cmp qword [rsi], rax
jne 0x1400aebc6
movsxd rax, dword [rsp + 0x34]
cmp rax, 0x20
jb 0x1400aebc6
add rax, 0xffffffffffffffe0
mov ecx, dword [rsi + 0x14]
sub rax, rcx
jb 0x1400aebc6
mov ecx, dword [rsi + 0x18]
sub rax, rcx
jb 0x1400aebc6
mov ecx, dword [rsi + 0x1c]
cmp rax, rcx
jb 0x1400aebc6
setne al
movzx ebx, al
shl ebx, 3
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140242430
mov eax, ebx
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret