joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400ce890
Capabilities:
Set socket configuration

Disassembly:
push r12
mov r12, rdx
push rsi
push rbx
mov ebx, ecx
sub rsp, 0x50
cmp ecx, 1
je 0x1400ce8f0
test ecx, 0xfffffff7
je 0x1400ce990
lea rax, str.Cant_create_socket_type__d
mov dword [rsp + 0x28], ecx
xor r12d, r12d
mov r9d, 8
mov qword [rsp + 0x20], rax
lea r8, str.dap_events_socket
mov edx, 0x1d3
lea rcx, str.dap_events_socket_create
call fcn.14005aec0
add rsp, 0x50
mov rax, r12
pop rbx
pop rsi
pop r12
ret
mov edx, 2
xor r8d, r8d
mov ecx, 2
call qword [sym.imp.WS2_32.dll_socket]
lea r8, [rsp + 0x4c]
mov edx, 0x8004667e
mov dword [rsp + 0x4c], 1
mov rsi, rax
mov rcx, rax
call qword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
jne 0x1400ce9a0
mov rdx, r12
mov rcx, rsi
call fcn.1400cfa20
mov r12, rax
test rax, rax
je 0x1400ce9d8
mov dword [rax + 0x34], ebx
mov rax, qword [0x1403e17e0]
lea r8, str.dap_events_socket
cmp byte [rax], 0
mov eax, 0
mov dword [rsp + 0x30], ebx
cmove r8, rax
lea rax, str.Created_socket__llu_type__d
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x28], rsi
xor ecx, ecx
mov qword [rsp + 0x20], rax
call fcn.14005aec0
add rsp, 0x50
mov rax, r12
pop rbx
pop rsi
pop r12
ret
mov edx, 1
jmp 0x1400ce8f5
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r9d, 7
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], eax
lea rax, str.Error_ioctl__d
lea r8, str.dap_events_socket
mov qword [rsp + 0x20], rax
call fcn.14005aec0
jmp 0x1400ce925
lea rax, str.Cant_allocate_memory_for_the_new_esocket
mov r9d, 8
lea r8, str.dap_events_socket
mov edx, 0x1e9
mov qword [rsp + 0x20], rax
lea rcx, str.dap_events_socket_create
call fcn.14005aec0
jmp 0x1400ce8df

Function at 0x1400ced20
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
mov edx, 2
mov rbp, rsp
push r12
and rsp, 0xfffffffffffffff0
sub rsp, 0x40
movzx eax, word [rcx + 0x1c]
mov r12, qword [rcx]
mov ecx, 0x7f000001
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov word [rsp + 0x30], dx
mov word [rsp + 0x32], ax
call qword [sym.imp.WS2_32.dll_htonl]
xor r9d, r9d
mov rcx, r12
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x34], eax
lea rax, [rsp + 0x30]
mov r8d, 1
lea rdx, [0x1402bccd0]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_sendto]
cmp eax, 0xffffffff
je 0x1400ceda0
mov r12, qword [rbp - 8]
xor eax, eax
leave
ret
mov r12, qword [rbp - 8]
leave
jmp qword [sym.imp.WS2_32.dll_WSAGetLastError]
Function at 0x1400cf1f0
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
mov rbp, rsp
push r12
push rbx
mov rbx, rcx
and rsp, 0xfffffffffffffff0
sub rsp, 0x50
mov rax, qword [0x1403e17e0]
mov qword [rbp + 0x18], rdx
cmp byte [rax], 0
je 0x1400cf24f
mov eax, 0xffffffff
test rcx, rcx
je 0x1400cf21e
mov eax, dword [rcx]
mov dword [rsp + 0x38], eax
mov rax, qword [rbp + 0x18]
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x30], rbx
lea r8, str.dap_events_socket
xor ecx, ecx
mov qword [rsp + 0x28], rax
lea rax, str.Sent_ptr__p_to_esocket_queue__p___d_
mov qword [rsp + 0x20], rax
call fcn.14005aec0
mov edx, 0x10
mov ecx, 0x20
call qword [sym.imp.msvcrt.dll__aligned_malloc]
mov rdx, rax
mov rax, qword [rbp + 0x18]
mov qword [rdx + 0x10], rax
mov rcx, qword [rbx + 0x2f0]
call qword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
movzx eax, word [rbx + 0x1c]
mov edx, 2
mov qword [rsp + 0x40], 0
mov r12, qword [rbx]
mov word [rsp + 0x40], dx
mov ecx, 0x7f000001
mov qword [rsp + 0x48], 0
mov word [rsp + 0x42], ax
call qword [sym.imp.WS2_32.dll_htonl]
lea rdx, [rbp + 0x18]
xor r9d, r9d
mov rcx, r12
mov dword [rsp + 0x44], eax
lea rax, [rsp + 0x40]
mov r8d, 8
mov dword [rsp + 0x28], 0x10
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_sendto]
mov r8d, eax
xor eax, eax
cmp r8d, 0xffffffff
je 0x1400cf2f0
lea rsp, [rbp - 0x10]
pop rbx
pop r12
pop rbp
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rsp, [rbp - 0x10]
pop rbx
pop r12
pop rbp
ret

Function at 0x1400d0a30
Capabilities:
Read file on windows

Disassembly:
test rcx, rcx
je 0x1400d0a90
push r12
mov r12, rdx
push rbx
sub rsp, 0x28
test rdx, rdx
je 0x1400d0a80
mov qword [rdx], 0
mov rbx, r8
test r8, r8
je 0x1400d0a5a
mov qword [r8], 0
lea rdx, [0x1403dec35]
call sub.msvcrt.dll_fopen
mov rcx, rax
test rax, rax
je 0x1400d0a80
add rsp, 0x28
mov r8, rbx
mov rdx, r12
pop rbx
pop r12
jmp fcn.1401203e0
add rsp, 0x28
xor eax, eax
pop rbx
pop r12
ret
xor eax, eax
ret

Function at 0x1400d0aa0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
test rcx, rcx
je 0x1400d0ac0
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
setne al
add rsp, 0x28
ret
xor eax, eax
ret

Function at 0x1400d0ad0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
test rcx, rcx
je 0x1400d0b00
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400d0af0
shr al, 7
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret
xor eax, eax
ret
Function at 0x1400d7770
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push r13
push r12
sub rsp, 0x58
test r8, r8
je 0x1400d7939
lea rax, str.Checking_url_path__s
mov r12, r8
xor r9d, r9d
mov r15, rcx
mov qword [rsp + 0x28], r8
xor ecx, ecx
mov r14, rdx
lea r8, str.dap_http_folder
mov qword [rsp + 0x20], rax
xor edx, edx
call fcn.14005aec0
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400d78c0
test al, 0x10
je 0x1400d78c0
lea rax, str.File_service_for__s____s
mov qword [rsp + 0x30], r12
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov r9d, 2
lea r8, str.dap_http_folder
mov qword [rsp + 0x28], r14
call fcn.14005aec0
mov edx, 0x1008
mov ecx, 1
call sub.msvcrt.dll_calloc
mov r13, rax
test rax, rax
je 0x1400d797f
mov r8d, 0xfff
mov rdx, r12
mov rcx, rax
call sub.msvcrt.dll_strncpy
mov ecx, 0x492
call fcn.1400019f8
mov qword [r13 + 0x1000], rax
mov rcx, rax
test rax, rax
je 0x1400d7942
lea rdx, str.data.mag
call fcn.140001b7e
mov r12d, eax
test eax, eax
jne 0x1400d78f0
lea rax, [0x1400d79d0]
xor r9d, r9d
mov r8, r13
mov rdx, r14
mov qword [rsp + 0x40], rax
lea rax, [0x1400d79c0]
mov rcx, r15
mov qword [rsp + 0x38], rax
lea rax, [0x1400d7b20]
mov qword [rsp + 0x30], rax
lea rax, [0x1400d7ac0]
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
call fcn.1400d5090
add rsp, 0x58
mov eax, r12d
pop r12
pop r13
pop r14
pop r15
ret
lea rax, str.Directory_Not_Found_
mov qword [rsp + 0x20], rax
mov r9d, 7
xor edx, edx
xor ecx, ecx
lea r8, str.dap_http_folder
mov r12d, 0xfffffff5
call fcn.14005aec0
jmp 0x1400d78ab
lea rax, str.Cant_load_MIME_magic_detection_database
mov r9d, 8
lea r8, str.dap_http_folder
mov edx, 0x8c
mov qword [rsp + 0x20], rax
lea rcx, str.dap_http_folder_add
mov r12d, 0xfffffffe
call fcn.14005aec0
mov rcx, qword [r13 + 0x1000]
call fcn.140001b59
mov rcx, r13
call sub.msvcrt.dll_free
jmp 0x1400d78ab
lea rax, str.Directory_Path_parameter_is_empty_
jmp 0x1400d78c7
lea rax, str.Cant_init_MIME_detection_library
mov r9d, 8
lea r8, str.dap_http_folder
mov edx, 0x81
mov qword [rsp + 0x20], rax
lea rcx, str.dap_http_folder_add
mov r12d, 0xffffffff
call fcn.14005aec0
mov rcx, r13
call sub.msvcrt.dll_free
jmp 0x1400d78ab
lea rax, [0x1402b95d8]
mov r9d, 8
or r12d, 0xffffffff
mov edx, 0x79
mov qword [rsp + 0x20], rax
lea r8, str.dap_http_folder
lea rcx, str.dap_http_folder_add
call fcn.14005aec0
jmp 0x1400d78ab
Function at 0x1400f7b90
Capabilities:
Send data
Send data on socket

Disassembly:
push r12
push rbp
mov rbp, rcx
push rdi
mov rdi, r8
push rsi
mov rsi, rdx
push rbx
mov ebx, r9d
sub rsp, 0x50
cmp r9d, 3
jg 0x1400f7c38
mov edx, 0x18
mov ecx, 1
call sub.msvcrt.dll_calloc
mov r12, rax
test rax, rax
je 0x1400f7c79
mov qword [rax], rsi
lea r8, str.dap_proc_queue
mov qword [rax + 8], rdi
mov dword [rax + 0x14], ebx
mov rax, qword [0x1403e17e0]
cmp byte [rax], 0
mov eax, 0
mov dword [rsp + 0x40], ebx
cmove r8, rax
lea rax, str.Requested_l_msg:_p__callback:__p__p__pri:__d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x38], rdi
xor r9d, r9d
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
call fcn.14005aec0
mov rax, qword [rbp + 8]
mov rdx, r12
mov rcx, qword [rax + 8]
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.1400cf1f0
lea rax, str.Priority_level__d_is_incorrect__should_be_is_in_range__d__d_
mov dword [rsp + 0x28], r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov r9d, 5
mov ebx, 2
lea r8, str.dap_proc_queue
mov dword [rsp + 0x38], 3
mov dword [rsp + 0x30], 1
call fcn.14005aec0
jmp 0x1400f7bb0
add rsp, 0x50
mov eax, 0xfffffff4
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x1400f9370
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi

Disassembly:
sub rsp, 0x48
xor r8d, r8d
xor edx, edx
mov r9d, 1
mov dword [rsp + 0x20], 0xf0000000
lea rcx, [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x1400f93a0
movzx eax, word [rsp + 0x36]
add rsp, 0x48
ret
mov rcx, qword [rsp + 0x38]
lea r8, [rsp + 0x36]
mov edx, 2
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x1400f9396
mov rcx, qword [rsp + 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
movzx eax, word [rsp + 0x36]
add rsp, 0x48
ret

Function at 0x1400f93d0
Capabilities:
Delete directory
Delete file

Disassembly:
jmp qword [sym.imp.msvcrt.dll__rmdir]
push r14
mov r14, rcx
push r13
push r12
sub rsp, 0x20
call fcn.140035ff0
mov r12, rax
test rax, rax
je 0x1400f946e
nop
mov rcx, r12
call fcn.140036200
test rax, rax
je 0x1400f943d
cmp byte [rax + 8], 0x2e
lea rdx, [rax + 8]
jne 0x1400f940d
cmp byte [rdx + 1], 0
je 0x1400f93f0
cmp byte [rdx], 0x2e
je 0x1400f9460
xor r8d, r8d
mov rcx, r14
call fcn.1400740f0
mov r13, rax
mov rcx, rax
call fcn.1400f93d0
mov rcx, r13
call sub.msvcrt.dll_free
mov rcx, r12
call fcn.140036200
test rax, rax
jne 0x1400f93fd
mov rcx, r12
call fcn.140036450
add rsp, 0x20
mov rcx, r14
pop r12
pop r13
pop r14
jmp 0x140044948
cmp byte [rdx + 1], 0x2e
jne 0x1400f9412
cmp byte [rdx + 2], 0
je 0x1400f93f0
jmp 0x1400f9412
add rsp, 0x20
mov rcx, r14
pop r12
pop r13
pop r14
jmp fcn.140044838
Function at 0x140104010
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
test r8, r8
je 0x1401040db
test r9d, r9d
je 0x1401040db
movsxd r9, r9d
mov rbx, r8
shl r9, 4
lea rdi, [r8 + r9]
cmp r8, rdi
jae 0x1401040d7
mov r12, qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbp, rcx
xor esi, esi
lea r13, [rsp + 0x3c]
jmp 0x14010406d
add rbx, 0x10
add esi, dword [rsp + 0x3c]
cmp rdi, rbx
jbe 0x1401040c8
mov qword [rsp + 0x20], 0
mov r9, r13
mov r8d, dword [rbx + 8]
mov rcx, rbp
mov dword [rsp + 0x3c], 0
mov rdx, qword [rbx]
call r12
test eax, eax
jne 0x140104060
cmp qword [rsp + 0xa0], 0
je 0x1401040ad
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, qword [rsp + 0xa0]
mov dword [rdx], eax
mov rax, 0xffffffffffffffff
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
add rsp, 0x48
mov eax, esi
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
xor eax, eax
jmp 0x1401040b4
lea rax, str.Bad_input_data
mov r9d, 7
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
lea r8, [0x1403de2b0]
call fcn.14005aec0
mov rax, 0xffffffffffffffff
jmp 0x1401040b4

Function at 0x140105160
Capabilities:
Encode data using xor

Disassembly:
test rdx, rdx
je 0x140105180
test r8, r8
je 0x140105180
test rcx, rcx
je 0x140105180
test r9, r9
je 0x140105180
cmp qword [rcx + 0x20], 0
je 0x140105180
jmp fcn.140070cf0
mov eax, 0xffffffff
ret
Function at 0x1401196d0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rcx
mov eax, 1
mov ecx, edx
push rbp
shl rax, cl
mov rdx, rax
shr rdx, 1
mov rbp, rsp
and rsp, 0xfffffffffffffff0
cmp rax, rdx
jbe 0x140119750
mov rcx, rax
sub rcx, rdx
cmp rcx, 1
je 0x14011973c
mov r9, rcx
lea rax, [r8 + rdx*8]
movapd xmm1, xmmword [0x1403c9150]
shr r9, 1
shl r9, 4
add r9, rax
nop dword [rax]
movupd xmm0, xmmword [rax]
add rax, 0x10
xorpd xmm0, xmm1
movups xmmword [rax - 0x10], xmm0
cmp r9, rax
jne 0x140119718
mov rax, rcx
and rax, 0xfffffffffffffffe
add rdx, rax
cmp rcx, rax
je 0x140119750
lea rax, [r8 + rdx*8]
movsd xmm0, qword [rax]
xorpd xmm0, xmmword [0x1403c9140]
movsd qword [rax], xmm0
leave
ret

Function at 0x140119ef0
Capabilities:
Encode data using xor

Disassembly:
mov r9, rcx
mov eax, 1
mov ecx, r8d
shl rax, cl
mov r11, rax
shr r11, 1
je 0x14011a0a0
push rbp
lea r8, [r11*8]
mov r10, rdx
lea rdx, [r11*8 + 0x10]
lea rcx, [r9 + r8]
mov rbp, rsp
push rbx
lea rbx, [r9 + 0x10]
sub rsp, 0x10
and rsp, 0xfffffffffffffff0
cmp rcx, rbx
setae bl
test rdx, rdx
movaps xmmword [rsp], xmm6
setle dl
or bl, dl
je 0x14011a030
cmp r11, 1
je 0x14011a030
shr rax, 2
movapd xmm5, xmmword [0x1403c9150]
add r8, r10
mov rbx, rax
mov rdx, rax
xor eax, eax
shl rbx, 4
nop
movupd xmm0, xmmword [rcx + rax]
movupd xmm2, xmmword [r8 + rax]
movupd xmm1, xmmword [r9 + rax]
movupd xmm3, xmmword [r10 + rax]
movupd xmm6, xmmword [r10 + rax]
xorpd xmm2, xmm5
movapd xmm4, xmm0
mulpd xmm3, xmm1
mulpd xmm4, xmm2
mulpd xmm0, xmm6
mulpd xmm1, xmm2
subpd xmm3, xmm4
addpd xmm0, xmm1
movups xmmword [r9 + rax], xmm3
movups xmmword [rcx + rax], xmm0
add rax, 0x10
cmp rax, rbx
jne 0x140119f70
lea rcx, [rdx + rdx]
cmp r11, rcx
je 0x14011a021
mov rax, rdx
lea rdx, [r11 + rcx]
shl rax, 4
lea rcx, [r9 + rdx*8]
movsd xmm2, qword [r10 + rdx*8]
xorpd xmm2, xmmword [0x1403c9140]
lea r8, [r9 + rax]
movsd xmm0, qword [rcx]
movsd xmm4, qword [r10 + rax]
movsd xmm1, qword [r8]
movapd xmm5, xmm0
mulsd xmm5, xmm2
movapd xmm3, xmm1
mulsd xmm3, xmm4
mulsd xmm0, xmm4
mulsd xmm1, xmm2
subsd xmm3, xmm5
addsd xmm0, xmm1
movsd qword [r8], xmm3
movsd qword [rcx], xmm0
movaps xmm6, xmmword [rsp]
mov rbx, qword [rbp - 8]
leave
ret
movq xmm6, qword [0x1403c9140]
add r8, r10
xor eax, eax
nop dword [rax]
movsd xmm1, qword [r8 + rax*8]
movsd xmm2, qword [r10 + rax*8]
movsd xmm4, qword [r9 + rax*8]
movsd xmm3, qword [rcx + rax*8]
xorpd xmm1, xmm6
movapd xmm0, xmm1
movapd xmm1, xmm2
mulsd xmm1, xmm4
movapd xmm5, xmm0
mulsd xmm5, xmm3
mulsd xmm0, xmm4
mulsd xmm2, xmm3
subsd xmm1, xmm5
addsd xmm0, xmm2
movsd qword [r9 + rax*8], xmm1
movsd qword [rcx + rax*8], xmm0
add rax, 1
cmp rax, r11
jne 0x14011a040
movaps xmm6, xmmword [rsp]
mov rbx, qword [rbp - 8]
leave
ret
ret
Function at 0x14011a230
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov r8, rcx
mov r9d, 1
mov ecx, edx
shl r9, cl
mov rbp, rsp
and rsp, 0xfffffffffffffff0
test edx, edx
je 0x14011a2a0
mov rdx, r9
movapd xmm1, xmmword [0x1403c9150]
mov rax, r8
shr rdx, 1
shl rdx, 4
add rdx, r8
nop word [rax + rax]
movupd xmm0, xmmword [rax]
add rax, 0x10
xorpd xmm0, xmm1
movups xmmword [rax - 0x10], xmm0
cmp rdx, rax
jne 0x14011a268
mov rax, r9
and rax, 0xfffffffffffffffe
and r9d, 1
je 0x14011a29e
lea rax, [r8 + rax*8]
movsd xmm0, qword [rax]
xorpd xmm0, xmmword [0x1403c9140]
movsd qword [rax], xmm0
leave
ret
xor eax, eax
jmp 0x14011a28a
Function at 0x14014b910
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
test rcx, rcx
je 0x14014bb6b
push rbp
mov eax, 7
mov rbp, rsp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
mov rbx, rcx
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov r8, qword [rcx]
cmp r8, 0xf
jbe 0x14014bafa
mov rdx, r8
lea r9, [rcx + 0x30]
lea rdi, [rcx + 0x38]
mov qword [rcx + 0x30], 0
shr rdx, 2
and rdi, 0xfffffffffffffff8
mov qword [rcx + 0x118], 0
lea r14, [0x1402c9b00]
lea rax, [rdx + 7]
movq xmm1, rdx
lea rdx, [rbx + 8]
movq xmm0, rax
shl rax, 4
punpcklqdq xmm0, xmm1
mov qword [rcx + 0x28], rax
xor eax, eax
movups xmmword [rcx + 0x120], xmm0
mov rcx, r9
sub rcx, rdi
add ecx, 0xf0
shr ecx, 3
rep stosq qword [rdi], rax
mov rcx, r9
call sub.msvcrt.dll_memcpy
mov r12, qword [rbx + 0x128]
mov r9, rax
mov rax, qword [rbx + 0x120]
mov r8, r9
mov rcx, r12
lea r13, [rax*4]
cmp r13, r12
ja 0x14014ba3f
jmp 0x14014baf8
mov eax, r9d
mov r15d, r9d
movzx eax, ah
shr r15d, 0x10
mov r11d, eax
mov eax, r9d
mov edi, r15d
shr eax, 0x18
mov esi, eax
cmp rdx, 4
jne 0x14014ba0b
cmp r12, 6
ja 0x14014bb10
xor r10b, byte [r8]
add r8, 4
mov byte [rbx + rcx*4 + 0x30], r10b
xor r11b, byte [r8 - 3]
mov byte [rbx + rcx*4 + 0x31], r11b
xor dil, byte [r8 - 2]
mov byte [rbx + rcx*4 + 0x32], dil
xor sil, byte [r8 - 1]
mov byte [rbx + rcx*4 + 0x33], sil
add rcx, 1
cmp r13, rcx
je 0x14014baf8
mov rax, rcx
xor edx, edx
mov r9d, dword [rbx + rcx*4 + 0x2c]
div r12
mov dword [rsp + 0x28], r9d
mov r10d, r9d
test rdx, rdx
jne 0x14014b9e0
movzx edx, word [rsp + 0x29]
mov byte [rsp + 0x2f], r9b
mov word [rsp + 0x2c], dx
movzx edx, byte [rsp + 0x2b]
mov byte [rsp + 0x2e], dl
mov edx, dword [rsp + 0x2c]
movzx esi, dh
mov r9d, esi
mov r10, r9
and r9d, 0xf0
and r10d, 0xf
add r9, r14
movzx r11d, byte [r9 + r10]
mov r9d, edx
shr r9d, 0x10
mov r10d, r9d
and r9d, 0xf0
and r10d, 0xf
add r9, r14
movzx edi, byte [r9 + r10]
mov r9d, edx
shr r9d, 0x18
mov r10d, r9d
and r9d, 0xf0
and r10d, 0xf
add r9, r14
movzx esi, byte [r9 + r10]
mov r9d, edx
and edx, 0xf0
add rdx, r14
and r9d, 0xf
movzx r10d, byte [rdx + r9]
lea rdx, [0x1402c9c00]
xor r10b, byte [rdx + rax - 1]
jmp 0x14014ba0b
xor eax, eax
lea rsp, [rbp - 0x38]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov r10d, r9d
and r9d, 0xf0
lea rdx, [r14 + r9]
and r10d, 0xf
mov r9, r11
and r11d, 0xf0
and r9d, 0xf
movzx r10d, byte [rdx + r10]
lea rdx, [r14 + r11]
movzx r11d, byte [rdx + r9]
mov r9d, r15d
and r15d, 0xf0
lea rdx, [r14 + r15]
and r9d, 0xf
movzx edi, byte [rdx + r9]
mov edx, eax
and eax, 0xf0
and edx, 0xf
add rax, r14
movzx esi, byte [rax + rdx]
jmp 0x14014ba0b
mov eax, 2
ret
Function at 0x14014f5b0
Capabilities:
Encode data using xor

Disassembly:
push r15
mov eax, 1
lea r15, [0x1402cd5c0]
push r14
push r13
push r12
push rbp
push rdi
push rsi
mov rsi, rcx
mov ecx, r8d
push rbx
shl rax, cl
mov ecx, 0xa
lea rdi, [rax - 1]
sub ecx, r8d
sub rsp, 0x68
mov qword [rsp + 0xb8], rdx
mov edx, 1
lea rbp, [rsp + 0x58]
add rax, qword [rsp + 0xb8]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0xb8]
shl edx, cl
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x2c], 0
mov qword [rsp + 0x30], rdi
movabs rdi, 0x7fffffffffffffff
mov rax, qword [rsp + 0x40]
sub rax, qword [rsp + 0xb8]
mov qword [rsp + 0x38], rax
xor r14d, r14d
xor r12d, r12d
nop word [rax + rax]
mov r8d, 8
mov rdx, rbp
mov rcx, rsi
call fcn.1401115a0
mov r13, qword [rsp + 0x58]
mov rcx, rsi
mov rdx, rbp
movabs rax, 0xee2ec827d20d54a8
mov r8d, 8
mov rbx, r13
and r13, rdi
add r13, rax
shr rbx, 0x3f
call fcn.1401115a0
mov r10, qword [rsp + 0x58]
shr r13, 0x3f
xor r8d, r8d
mov ecx, 1
and r10, rdi
nop word [rax + rax]
mov rdx, r10
sub rdx, qword [r15 + rcx*8]
mov eax, r13d
shr rdx, 0x3f
xor eax, 1
xor edx, 1
and eax, edx
or r13d, edx
neg eax
and eax, ecx
add rcx, 1
or r8d, eax
cmp rcx, 0x1b
jne 0x14014f6a0
mov eax, ebx
add r14d, 1
neg eax
xor eax, r8d
add eax, ebx
add r12d, eax
cmp dword [rsp + 0x28], r14d
ja 0x14014f648
lea eax, [r12 + 0x7f]
cmp eax, 0xfe
ja 0x14014f63c
mov eax, r12d
mov rcx, qword [rsp + 0x38]
and eax, 1
cmp qword [rsp + 0x30], rcx
jne 0x14014f740
cmp dword [rsp + 0x2c], eax
je 0x14014f63c
mov ebx, r12d
mov rax, qword [rsp + 0x40]
mov byte [rax], bl
add rax, 1
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x48], rax
jne 0x14014f62a
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
xor dword [rsp + 0x2c], eax
mov ebx, r12d
jmp 0x14014f714
Function at 0x14015dcd0
Capabilities:
Generate random numbers via winapi

Disassembly:
push rbx
xor r8d, r8d
mov ebx, ecx
xor edx, edx
mov r9d, 1
sub rsp, 0x40
mov dword [rsp + 0x20], 0xf0000000
lea rcx, [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x14015dd10
mov eax, dword [rsp + 0x34]
xor edx, edx
add rsp, 0x40
div ebx
pop rbx
mov eax, edx
ret
mov rcx, qword [rsp + 0x38]
lea r8, [rsp + 0x34]
mov edx, 4
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x14015dcf9
mov rcx, qword [rsp + 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [rsp + 0x34]
xor edx, edx
add rsp, 0x40
div ebx
pop rbx
mov eax, edx
ret

Function at 0x14015dd50
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi

Disassembly:
push r12
xor r8d, r8d
mov r12d, edx
mov r9d, 1
push rbx
xor edx, edx
mov rbx, rcx
sub rsp, 0x48
mov dword [rsp + 0x20], 0xf0000000
lea rcx, [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x14015dd90
add rsp, 0x48
mov eax, 1
pop rbx
pop r12
ret
mov rcx, qword [rsp + 0x38]
mov r8, rbx
mov edx, r12d
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x14015dd7f
mov rcx, qword [rsp + 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
add rsp, 0x48
xor eax, eax
pop rbx
pop r12
ret

Function at 0x14015dde0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
mov rbp, rsp
push rbx
lea rbx, [0x1403ee7a0]
mov rcx, rbx
and rsp, 0xfffffffffffffff0
sub rsp, 0xa0
call sub.msvcrt.dll_strlen
mov r8, rax
mov rax, rbx
cmp r8, 3
jbe 0x14015de18
mov rbx, qword [rbp - 8]
leave
ret
xor r8d, r8d
mov byte [rsp + 0x90], 0
movabs rax, 0x4552415754464f53
movabs rdx, 0x6f736f7263694d5c
mov qword [rsp + 0x50], rax
mov r9d, 0x20019
movabs rax, 0x6f646e69575c7466
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x58], rdx
movabs rdx, 0x65727275435c7377
mov qword [rsp + 0x60], rax
movabs rax, 0x6f6973726556746e
mov qword [rsp + 0x68], rdx
movabs rdx, 0x726f6c7078455c6e
mov qword [rsp + 0x70], rax
movabs rax, 0x6c6c6568535c7265
mov qword [rsp + 0x78], rdx
movabs rdx, 0x737265646c6f4620
mov qword [rsp + 0x80], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x88], rdx
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov r8d, eax
xor eax, eax
test r8d, r8d
jne 0x14015de0b
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rbx
xor edx, edx
mov rcx, qword [rsp + 0x48]
mov dword [rsp + 0x44], 0x104
mov r9d, 2
lea r8, [0x1403e021a]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rbx
mov rbx, qword [rbp - 8]
leave
ret
Function at 0x140206320
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
and rsp, 0xfffffffffffffff0
test edx, edx
je 0x14020646a
lea eax, [rdx - 1]
cmp eax, 2
jbe 0x14020646c
mov r8d, edx
movdqa xmm4, xmmword [0x1402d0c00]
movdqa xmm3, xmmword [0x1402d0c10]
mov rax, rcx
shr r8d, 2
sub r8d, 1
shl r8, 4
lea r8, [rcx + r8 + 0x10]
nop dword [rax + rax]
movdqu xmm1, xmmword [rax]
add rax, 0x10
movdqa xmm0, xmm1
movdqa xmm2, xmm1
psrld xmm0, 8
psrld xmm2, 0x10
pslld xmm0, 0x10
pslld xmm2, 8
pand xmm2, xmm3
pand xmm0, xmm4
pxor xmm0, xmm2
movdqa xmm2, xmm1
pslld xmm2, 0x18
psrld xmm1, 0x18
pxor xmm1, xmm2
pxor xmm0, xmm1
movups xmmword [rax - 0x10], xmm0
cmp rax, r8
jne 0x140206368
mov eax, edx
and eax, 0xfffffffc
test dl, 3
je 0x14020646a
sub edx, eax
cmp edx, 1
je 0x14020643a
movq xmm2, qword [0x1402d0c00]
mov r8d, eax
movq xmm3, qword [0x1402d0c10]
lea r8, [rcx + r8*4]
movq xmm1, qword [r8]
movdqa xmm0, xmm1
psrld xmm0, 8
pslld xmm0, 0x10
pand xmm0, xmm2
movdqa xmm2, xmm1
psrld xmm2, 0x10
pslld xmm2, 8
pand xmm2, xmm3
pxor xmm0, xmm2
movdqa xmm2, xmm1
pslld xmm2, 0x18
psrld xmm1, 0x18
pxor xmm1, xmm2
pxor xmm0, xmm1
movq qword [r8], xmm0
mov r8d, edx
and r8d, 0xfffffffe
add eax, r8d
cmp edx, r8d
je 0x14020646a
lea r8, [rcx + rax*4]
mov eax, dword [r8]
mov edx, eax
mov ecx, eax
mov r9d, eax
shr eax, 8
shl edx, 8
shl ecx, 0x18
and eax, 0xff00
shr r9d, 0x18
and edx, 0xff0000
xor ecx, r9d
xor edx, ecx
xor eax, edx
mov dword [r8], eax
leave
ret
xor eax, eax
jmp 0x1402063c5