joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140068740
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 8]
mov rsi, r8
mov ebx, edx
call fcn.14001e7e0
mov rdx, rsi
mov rcx, rdi
mov qword [rdi + 8], 0
mov dword [rdi], ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.140067450
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
test rdx, rdx
lea rsi, [0x1400e03d8]
mov rbx, r8
cmovne rsi, rdx
mov rdi, rcx
movzx eax, byte [rsi]
cmp al, 0x21
jne 0x1400686c3
mov edx, 0x1a
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x140067590
cmp al, 0x5e
jne 0x1400686ee
call qword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
jne 0x1400686ee
lea edx, [rax + 0xf]
mov r8, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x140067590
lea rdx, [0x1400e51e4]
mov r8, rbx
mov rcx, rsi
call fcn.140067e20
mov r8, rbx
mov rcx, rdi
test eax, eax
jne 0x140068721
lea edx, [rax + 3]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x140067590
mov rdx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.140067540
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
xor esi, esi
mov rbp, rcx
lea rcx, str.FNP_FAKE_VM
mov rbx, rdx
mov r12, rsi
mov r13, rsi
mov r14, rsi
call fcn.140038738
mov rdi, rax
test rax, rax
je 0x140068819
mov rdx, rbx
mov rcx, rax
call fcn.140067f60
mov r8, rbx
lea rcx, [0x1401687f0]
mov rdx, rdi
cmp rax, 0x400
jb 0x1400687ae
lea rdx, str._:FAKE_VM_TOO_LONG:FAKE_VM_TOO_LONG:FAKE_VM_TOO_LONG:FAKE_VM_TOO_LONG
call fcn.140067cf0
lea rdx, [0x1400ed444]
lea rcx, [0x1401687f0]
mov r8, rbx
call fcn.140067fb0
lea rdx, [0x1400ed444]
mov r8, rbx
xor ecx, ecx
call fcn.140067fb0
lea rdx, [0x1400ed444]
mov r8, rbx
xor ecx, ecx
mov rsi, rax
call fcn.140067fb0
lea rdx, [0x1400ed444]
mov r8, rbx
xor ecx, ecx
mov r12, rax
call fcn.140067fb0
lea rdx, [0x1400ed444]
mov r8, rbx
xor ecx, ecx
mov r13, rax
call fcn.140067fb0
mov r14, rax
lea rcx, [rbp + 8]
mov r8, rbx
mov rdx, rsi
call 0x140068680
lea rcx, [rbp + 0x18]
mov r8, rbx
mov rdx, r12
call 0x140068680
lea rcx, [rbp + 0x28]
mov r8, rbx
xor edx, edx
call 0x140068680
lea rcx, [rbp + 0x38]
mov r8, rbx
mov rdx, r13
call 0x140068680
lea rcx, [rbp + 0x48]
mov r8, rbx
mov rdx, r14
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
jmp 0x140068680
Function at 0x1400688a0
Capabilities:
Reference wmi statements

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x50
mov rbx, qword [rcx]
xor r12d, r12d
lea rcx, [0x1400ed568]
mov edi, r12d
mov qword [rsp + 0x90], r12
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
lea rcx, str.SELECT__FROM_Win32_BaseBoard
mov rsi, rax
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
lea rcx, [rsp + 0x90]
xor r9d, r9d
mov rbp, rax
mov rax, qword [rbx]
mov qword [rsp + 0x28], rcx
mov r8, rbp
mov rdx, rsi
mov rcx, rbx
mov qword [rsp + 0x20], r12
call qword [rax + 0xa0]
test eax, eax
js 0x1400689f9
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x140068a0c
lea rdx, [rsp + 0x80]
mov qword [rsp + 0x88], r12
mov dword [rsp + 0x80], r12d
mov rax, qword [rcx]
mov qword [rsp + 0x20], rdx
mov ebx, 1
lea r9, [rsp + 0x88]
or edx, 0xffffffff
mov r8d, ebx
call qword [rax + 0x20]
test eax, eax
jne 0x1400689f9
nop word [rax + rax]
mov rcx, qword [rsp + 0x88]
lea r9, [rsp + 0x30]
lea rdx, str.Product
mov rax, qword [rcx]
xor r8d, r8d
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
call qword [rax + 0x20]
test eax, eax
js 0x1400689ba
cmp word [rsp + 0x30], 8
jne 0x1400689ba
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400689ba
lea rdx, str.Virtual_Machine
call fcn.1400ad18c
lea rcx, [rsp + 0x30]
test rax, rax
cmovne edi, ebx
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rsp + 0x88]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rsp + 0x90]
lea rdx, [rsp + 0x80]
mov rax, qword [rcx]
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x88]
mov r8d, ebx
or edx, 0xffffffff
call qword [rax + 0x20]
test eax, eax
je 0x140068960
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x140068a0c
mov rdx, qword [rcx]
call qword [rdx + reloc.WS2_32.dll_recv]
mov rcx, rbp
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, edi
add rsp, 0x50
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140068a30
Capabilities:
Reference wmi statements

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x50
mov rbx, qword [rcx]
xor r12d, r12d
lea rcx, [0x1400ed568]
mov edi, r12d
mov qword [rsp + 0x90], r12
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
lea rcx, str.SELECT__FROM_Win32_BIOS
mov rsi, rax
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
lea rcx, [rsp + 0x90]
xor r9d, r9d
mov rbp, rax
mov rax, qword [rbx]
mov qword [rsp + 0x28], rcx
mov r8, rbp
mov rdx, rsi
mov rcx, rbx
mov qword [rsp + 0x20], r12
call qword [rax + 0xa0]
test eax, eax
js 0x140068b90
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x140068ba3
lea rdx, [rsp + 0x80]
mov qword [rsp + 0x88], r12
mov dword [rsp + 0x80], r12d
mov rax, qword [rcx]
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x88]
lea r8d, [r12 + 1]
or edx, 0xffffffff
call qword [rax + 0x20]
test eax, eax
jne 0x140068b90
nop word [rax + rax]
mov rcx, qword [rsp + 0x88]
lea r9, [rsp + 0x30]
lea rdx, str.SerialNumber
mov rax, qword [rcx]
xor r8d, r8d
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
call qword [rax + 0x20]
test eax, eax
js 0x140068b4e
cmp word [rsp + 0x30], 8
jne 0x140068b4e
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140068b4e
lea rdx, str.VMware
call fcn.1400ad18c
lea rcx, [rsp + 0x30]
mov edi, r12d
test rax, rax
setne dil
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rsp + 0x88]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rsp + 0x90]
lea rdx, [rsp + 0x80]
mov rax, qword [rcx]
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x88]
mov r8d, 1
or edx, 0xffffffff
call qword [rax + 0x20]
test eax, eax
je 0x140068af0
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x140068ba3
mov rdx, qword [rcx]
call qword [rdx + reloc.WS2_32.dll_recv]
mov rcx, rbp
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, edi
add rsp, 0x50
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140068bd0
Capabilities:
Reference wmi statements

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x50
mov rbx, qword [rcx]
xor r12d, r12d
lea rcx, [0x1400ed568]
mov edi, r12d
mov qword [rsp + 0x90], r12
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
lea rcx, str.SELECT__FROM_Win32_BIOS
mov rsi, rax
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
lea rcx, [rsp + 0x90]
xor r9d, r9d
mov rbp, rax
mov rax, qword [rbx]
mov qword [rsp + 0x28], rcx
mov r8, rbp
mov rdx, rsi
mov rcx, rbx
mov qword [rsp + 0x20], r12
call qword [rax + 0xa0]
test eax, eax
js 0x140068d78
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x140068d8b
lea rdx, [rsp + 0x80]
mov qword [rsp + 0x88], r12
mov dword [rsp + 0x80], r12d
mov rax, qword [rcx]
mov qword [rsp + 0x20], rdx
mov ebx, 1
lea r9, [rsp + 0x88]
or edx, 0xffffffff
mov r8d, ebx
call qword [rax + 0x20]
test eax, eax
jne 0x140068d78
nop word [rax + rax]
mov rcx, qword [rsp + 0x88]
lea r9, [rsp + 0x30]
lea rdx, str.Manufacturer
mov rax, qword [rcx]
xor r8d, r8d
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
call qword [rax + 0x20]
test eax, eax
js 0x140068cdf
cmp word [rsp + 0x30], 8
jne 0x140068cdf
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140068cdf
lea rdx, str.innotek_GmbH
call fcn.1400ad18c
test rax, rax
cmovne edi, ebx
mov rcx, qword [rsp + 0x88]
lea r9, [rsp + 0x30]
lea rdx, str.SMBIOSBIOSVersion
mov rax, qword [rcx]
xor r8d, r8d
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
call qword [rax + 0x20]
test eax, eax
js 0x140068d2e
cmp word [rsp + 0x30], 8
jne 0x140068d2e
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140068d2e
lea rdx, str.VirtualBox
call fcn.1400ad18c
test rax, rax
cmovne edi, ebx
lea rcx, [rsp + 0x30]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rsp + 0x88]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rsp + 0x90]
lea rdx, [rsp + 0x80]
mov rax, qword [rcx]
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x88]
mov r8d, ebx
or edx, 0xffffffff
call qword [rax + 0x20]
test eax, eax
je 0x140068c90
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x140068d8b
mov rdx, qword [rcx]
call qword [rdx + reloc.WS2_32.dll_recv]
mov rcx, rbp
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, edi
add rsp, 0x50
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140068db0
Capabilities:
Reference wmi statements

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x50
mov rbx, qword [rcx]
xor r12d, r12d
lea rcx, [0x1400ed568]
mov edi, r12d
mov qword [rsp + 0x90], r12
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
lea rcx, str.SELECT__FROM_Win32_ComputerSystem
mov rsi, rax
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
lea rcx, [rsp + 0x90]
xor r9d, r9d
mov rbp, rax
mov rax, qword [rbx]
mov qword [rsp + 0x28], rcx
mov r8, rbp
mov rdx, rsi
mov rcx, rbx
mov qword [rsp + 0x20], r12
call qword [rax + 0xa0]
test eax, eax
js 0x140068f09
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x140068f1c
lea rdx, [rsp + 0x80]
mov qword [rsp + 0x88], r12
mov dword [rsp + 0x80], r12d
mov rax, qword [rcx]
mov qword [rsp + 0x20], rdx
mov ebx, 1
lea r9, [rsp + 0x88]
or edx, 0xffffffff
mov r8d, ebx
call qword [rax + 0x20]
test eax, eax
jne 0x140068f09
nop word [rax + rax]
mov rcx, qword [rsp + 0x88]
lea r9, [rsp + 0x30]
lea rdx, str.Manufacturer
mov rax, qword [rcx]
xor r8d, r8d
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
call qword [rax + 0x20]
test eax, eax
js 0x140068ebf
cmp word [rsp + 0x30], 8
jne 0x140068ebf
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140068ebf
lea rdx, str.Parallels
call fcn.1400ad18c
test rax, rax
cmovne edi, ebx
lea rcx, [rsp + 0x30]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rsp + 0x88]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rsp + 0x90]
lea rdx, [rsp + 0x80]
mov rax, qword [rcx]
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x88]
mov r8d, ebx
or edx, 0xffffffff
call qword [rax + 0x20]
test eax, eax
je 0x140068e70
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x140068f1c
mov rdx, qword [rcx]
call qword [rdx + reloc.WS2_32.dll_recv]
mov rcx, rbp
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, edi
add rsp, 0x50
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14006a9b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor ebx, ebx
mov rdi, rcx
test rcx, rcx
je 0x14006a9ea
cmp byte [rcx], 0xbc
jne 0x14006a9f8
cmp byte [rcx + 1], 0xbd
jne 0x14006a9f8
add rcx, 2
call fcn.140021780
xor edx, edx
mov rcx, rdi
mov rbx, rax
call fcn.140067f60
mov byte [rax + rbx - 4], 0
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
xor edx, edx
call fcn.140067f60
lea rcx, [rax + 1]
call fcn.14001e820
mov r11, rax
movzx eax, byte [rdi]
xor al, 0x23
mov byte [r11], al
cmp byte [rdi], bl
je 0x14006aa37
mov rcx, r11
sub rcx, rdi
nop dword [rax]
movzx eax, byte [rdi + 1]
inc rdi
inc ebx
dec al
xor al, byte [rcx + rdi - 1]
mov byte [rcx + rdi], al
cmp byte [rdi], 0
jne 0x14006aa20
movsxd rax, ebx
mov rbx, qword [rsp + 0x30]
mov byte [rax + r11], 0
mov rax, r11
add rsp, 0x20
pop rdi
ret

Function at 0x14006ab20
Capabilities:
Get socket status

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x660
xor eax, eax
mov qword [r11 - 0x420], rcx
mov rbx, rdx
mov dword [r11 + 0xc], eax
lea rax, [r11 + 8]
mov rdi, rcx
xor esi, esi
mov qword [rsp + 0x38], rcx
lea r9, [rsp + 0x30]
lea r8, [r11 - 0x428]
lea rdx, [r11 - 0x218]
inc ecx
mov qword [rsp + 0x20], rax
mov dword [r11 + 8], esi
mov dword [r11 + 0xc], 0x186a0
mov dword [rsp + 0x450], esi
mov dword [rsp + 0x240], 1
mov dword [rsp + 0x30], 1
call qword [sym.imp.WS2_32.dll_select]
test eax, eax
jle 0x14006ac00
lea rdx, [rsp + 0x240]
mov rcx, rdi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x14006abb7
or esi, 0xffffffff
jmp 0x14006ac41
lea rdx, [rsp + 0x30]
mov rcx, rdi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x14006abd9
mov rcx, rdi
call fcn.14006aae0
lea rdx, str.Exception_on_socket_fd:_Connection_failed__SO_ERROR_d
jmp 0x14006ac36
test rbx, rbx
je 0x14006ac41
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x14006ac41
mov rcx, qword [rbx]
lea r8, str.Select_on_socket_fd_returned_no_data
mov r9d, 0xa6
mov edx, 9
call rax
jmp 0x14006ac41
jne 0x14006ac29
test rbx, rbx
je 0x14006ac41
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x14006ac41
mov rcx, qword [rbx]
lea r8, str.Timed_out_waiting_for_socket_to_connect
mov r9d, 0xad
mov edx, 9
call rax
jmp 0x14006ac41
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Select_on_socket_fd_failed_with_error:__d
mov r8d, eax
mov rcx, rbx
call fcn.14006aa50
lea r11, [rsp + 0x660]
mov eax, esi
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14006ac60
Capabilities:
Connect socket
Initialize winsock library
Set socket configuration

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x1f0
mov rax, qword [0x14014ee68]
xor rax, rsp
mov qword [rsp + 0x1e0], rax
xor eax, eax
mov esi, edx
mov rbx, rcx
lea rdx, [rsp + 0x40]
mov ecx, 0x202
mov rdi, r8
mov word [rsp + 0x28], ax
mov qword [rsp + 0x2a], rax
mov dword [rsp + 0x32], eax
mov word [rsp + 0x36], ax
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x14006accf
lea rdx, str.WSAStartup_function_failed_with_error:__d
mov r8d, eax
mov rcx, rdi
call fcn.14006aa50
call qword [sym.imp.WS2_32.dll_WSACleanup]
or rax, 0xffffffffffffffff
jmp 0x14006ade4
mov qword [rsp + 0x228], rbp
mov ebp, 2
movzx ecx, si
mov word [rsp + 0x28], bp
call qword [sym.imp.WS2_32.dll_htons]
mov rcx, rbx
mov word [rsp + 0x2a], ax
call qword [sym.imp.WS2_32.dll_inet_addr]
lea edx, [rbp - 1]
xor r8d, r8d
mov ecx, ebp
mov dword [rsp + 0x2c], eax
call qword [sym.imp.WS2_32.dll_socket]
mov rbp, qword [rsp + 0x228]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14006ad38
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Socket_creation_error:__d
mov rcx, rdi
mov r8d, eax
call fcn.14006aa50
jmp 0x14006adc6
lea r8, [rsp + 0x20]
mov edx, 0x8004667e
mov rcx, rax
mov dword [rsp + 0x20], 1
call qword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x14006ad72
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Ioctlsocket_error:__d
mov rcx, rdi
mov r8d, eax
call fcn.14006aa50
jmp 0x14006adc6
lea rdx, [rsp + 0x28]
mov r8d, reloc.WS2_32.dll_recv
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x14006ade1
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x14006ad9f
cmp eax, 0x2734
jne 0x14006adae
mov rdx, rdi
mov rcx, rbx
call fcn.14006ab20
test eax, eax
jne 0x14006ade1
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Connect_on_socket_fd_failed_with_error:__d
mov rcx, rdi
mov r8d, eax
call fcn.14006aa50
cmp rbx, 0xffffffffffffffff
je 0x14006add5
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
or rax, 0xffffffffffffffff
jmp 0x14006ade4
mov rax, rbx
mov rcx, qword [rsp + 0x1e0]
xor rcx, rsp
call fcn.14001e7c0
add rsp, 0x1f0
pop rdi
pop rsi
pop rbx
ret
Function at 0x14006f960
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
or r10d, 0xffffffff
mov r11, rdx
mov rbx, rcx
test rdx, rdx
je 0x14006f9b1
call fcn.14006f8f0
xor r8d, r8d
test r11, r11
je 0x14006f9b1
lea r9, [0x140168f80]
nop dword [rax]
movzx edx, byte [r8 + rbx]
movzx eax, r10b
mov ecx, r10d
xor rdx, rax
shr ecx, 8
inc r8
mov r10d, dword [r9 + rdx*4]
xor r10d, ecx
cmp r8, r11
jb 0x14006f990
not r10d
mov eax, r10d
add rsp, 0x20
pop rbx
ret

Function at 0x140077d30
Capabilities:
Generate random numbers via winapi

Disassembly:
push rdi
sub rsp, 0xb0
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0xc0], rbx
mov rbx, r8
mov rdi, rdx
mov eax, dword [0x140169390]
test al, 1
jne 0x140077de5
or eax, 1
mov dword [0x140169390], eax
mov dword [rsp + 0x20], 0xf0000000
mov r9d, 1
xor r8d, r8d
xor edx, edx
lea rcx, [0x140169388]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x140077dd8
mov qword [rsp + 0x50], send
mov qword [rsp + 0x48], 0
mov byte [rsp + 0x38], al
lea r8d, [rax + 0x13]
lea rdx, str.CryptAcquireContext
lea rcx, [rsp + 0x30]
call fcn.140002ce0
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x60]
call fcn.140077ae0
lea rdx, [0x140148a18]
lea rcx, [rsp + 0x60]
call fcn.14001f30c
nop
lea rcx, [0x1400c3e00]
call fcn.14001e708
nop
mov r8, rdi
mov edx, ebx
mov rcx, qword [0x140169388]
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x140077e48
mov qword [rsp + 0x50], send
mov qword [rsp + 0x48], 0
mov byte [rsp + 0x38], al
lea r8d, [rax + 0xe]
lea rdx, [0x1400f5b50]
lea rcx, [rsp + 0x30]
call fcn.140002ce0
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x60]
call fcn.140077ae0
lea rdx, [0x140148a18]
lea rcx, [rsp + 0x60]
call fcn.14001f30c
nop
mov rbx, qword [rsp + 0xc0]
add rsp, 0xb0
pop rdi
ret

Function at 0x140079040
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx]
call qword [rax + 0x18]
mov r8d, 4
movzx edx, al
movzx ecx, r8b
shr dl, cl
xor al, dl
shr r8d, 1
jne 0x140079050
movzx eax, al
and eax, 1
add rsp, 0x28
ret
Function at 0x14007ab40
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Encrypt data using des

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov rdi, qword [rcx + 0x90]
mov r11d, dword [rdx]
mov ebx, dword [r8]
add rdi, 8
mov r9, r8
mov r10, rdx
mov esi, 8
lea rbp, [0x1400f82b0]
nop word [rax + rax]
mov eax, ebx
add rdi, 0x10
ror eax, 4
xor eax, dword [rdi - 0x18]
mov r8d, eax
mov ecx, eax
shr rax, 0x10
and eax, 0x3f
shr rcx, 0x18
and ecx, 0x3f
mov edx, dword [rbp + rcx*4]
xor edx, dword [rbp + rax*4 + 0x200]
mov rax, r8
and r8d, 0x3f
shr rax, 8
and eax, 0x3f
xor edx, dword [rbp + rax*4 + 0x400]
mov eax, dword [rdi - 0x14]
xor edx, dword [rbp + r8*4 + 0x600]
xor eax, ebx
mov r8d, eax
mov ecx, eax
shr rax, 0x10
and eax, 0x3f
xor r11d, edx
shr rcx, 0x18
and ecx, 0x3f
mov edx, dword [rbp + rcx*4 + 0x100]
xor edx, dword [rbp + rax*4 + 0x300]
mov rax, r8
and r8d, 0x3f
shr rax, 8
and eax, 0x3f
xor edx, dword [rbp + rax*4 + 0x500]
xor edx, dword [rbp + r8*4 + 0x700]
xor r11d, edx
mov eax, r11d
ror eax, 4
xor eax, dword [rdi - 0x10]
mov r8d, eax
mov ecx, eax
shr rax, 0x10
and eax, 0x3f
shr rcx, 0x18
and ecx, 0x3f
mov edx, dword [rbp + rcx*4]
xor edx, dword [rbp + rax*4 + 0x200]
mov rax, r8
and r8d, 0x3f
shr rax, 8
and eax, 0x3f
xor edx, dword [rbp + rax*4 + 0x400]
mov eax, dword [rdi - 0xc]
xor edx, dword [rbp + r8*4 + 0x600]
xor eax, r11d
mov r8d, eax
mov ecx, eax
xor ebx, edx
shr rax, 0x10
shr rcx, 0x18
and eax, 0x3f
and ecx, 0x3f
mov edx, dword [rbp + rcx*4 + 0x100]
xor edx, dword [rbp + rax*4 + 0x300]
mov rax, r8
and r8d, 0x3f
shr rax, 8
and eax, 0x3f
xor edx, dword [rbp + rax*4 + 0x500]
xor edx, dword [rbp + r8*4 + 0x700]
xor ebx, edx
sub rsi, 1
jne 0x14007ab80
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov dword [r10], r11d
mov dword [r9], ebx
mov rbx, qword [rsp + 8]
ret
Function at 0x14007c770
Capabilities:
Encode data using xor
Encrypt data using blowfish
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x20
mov r9, qword [rcx + 0x68]
mov rax, qword [0x1400faab0]
xor esi, esi
mov qword [r9], rax
mov rax, qword [0x1400faab8]
mov rdi, rcx
mov qword [r9 + 8], rax
mov rax, qword [0x1400faac0]
mov rbp, rdx
mov qword [r9 + 0x10], rax
mov rax, qword [0x1400faac8]
mov ebx, r8d
mov qword [r9 + 0x18], rax
mov rax, qword [0x1400faad0]
lea rdx, [0x1400fab00]
mov qword [r9 + 0x20], rax
mov rax, qword [0x1400faad8]
mov r8d, 0x1000
mov qword [r9 + 0x28], rax
mov rax, qword [0x1400faae0]
mov dword [rsp + 0x40], esi
mov qword [r9 + 0x30], rax
mov rax, qword [0x1400faae8]
mov dword [rsp + 0x44], esi
mov qword [r9 + 0x38], rax
mov rax, qword [0x1400faaf0]
mov qword [r9 + 0x40], rax
mov rcx, qword [rcx + 0x1080]
call fcn.14001e9d0
mov r11, rsi
mov r9d, 2
lea r10d, [rsi + 0x12]
nop word [rax + rax]
xor edx, edx
lea eax, [r9 - 2]
add r11, 4
div ebx
lea eax, [r9 - 1]
movzx r8d, byte [rdx + rbp]
xor edx, edx
div ebx
shl r8d, 8
movzx eax, byte [rdx + rbp]
xor edx, edx
or r8d, eax
mov eax, r9d
div ebx
shl r8d, 8
movzx eax, byte [rdx + rbp]
xor edx, edx
or r8d, eax
lea eax, [r9 + 1]
add r9d, 4
div ebx
shl r8d, 8
movzx eax, byte [rdx + rbp]
or r8d, eax
mov rax, qword [rdi + 0x68]
xor dword [r11 + rax - 4], r8d
sub r10, 1
jne 0x14007c830
mov r8, qword [rdi + 0x68]
lea rdx, [rsp + 0x40]
lea rcx, [rdi - 8]
call fcn.14007c4c0
mov r11, rsi
mov r12d, 8
nop word [rax + rax]
mov rax, qword [rdi + 0x68]
lea rbx, [r11 + 8]
lea rcx, [rdi - 8]
lea r8, [rbx + rax]
lea rdx, [r11 + rax]
call fcn.14007c4c0
sub r12, 1
mov r11, rbx
jne 0x14007c8b0
mov rdx, qword [rdi + 0x68]
mov r8, qword [rdi + 0x1080]
lea rcx, [rdi - 8]
add rdx, 0x40
call fcn.14007c4c0
mov r11, rsi
mov r12d, 0x1ff
nop word [rax + rax]
mov rax, qword [rdi + 0x1080]
lea rbx, [r11 + 8]
lea rcx, [rdi - 8]
lea r8, [rbx + rax]
lea rdx, [r11 + rax]
call fcn.14007c4c0
sub r12, 1
mov r11, rbx
jne 0x14007c900
mov rax, qword [rdi - 8]
lea rcx, [rdi - 8]
call qword [rax + 0x38]
test al, al
jne 0x14007c969
mov r9d, 0x44
lea r10d, [r12 + 9]
nop
mov rax, qword [rdi + 0x68]
lea rdx, [r9 + rax]
lea r8, [rsi + rax]
cmp r8, rdx
je 0x14007c95b
mov eax, dword [rdx]
mov ecx, dword [r8]
mov dword [r8], eax
mov dword [rdx], ecx
sub r9, 4
add rsi, 4
sub r10, 1
jne 0x14007c940
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r12
pop rdi
pop rsi
ret
Function at 0x14007c980
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
mov r11d, dword [rdx]
mov eax, dword [rdx + 4]
mov rbp, qword [rcx + 0x70]
mov rsi, qword [rcx + 0x1088]
mov r10d, r11d
mov ebx, eax
ror r10d, 8
rol r11d, 8
ror ebx, 8
xor r11d, r10d
and ebx, 0xff00ff00
rol eax, 8
and r11d, 0xff00ff
and eax, 0xff00ff
mov rdi, r9
xor r11d, r10d
or ebx, eax
mov r9, r8
xor r11d, dword [rbp]
lea r10, [rbp + 8]
mov r12d, 8
nop dword [rax + rax]
mov eax, r11d
add r10, 8
shr eax, 0x10
movzx edx, al
mov eax, r11d
shr eax, 0x18
add edx, 0x100
mov r8d, dword [rsi + rdx*4]
movzx ecx, al
mov eax, r11d
add r8d, dword [rsi + rcx*4]
shr eax, 8
movzx ecx, al
movzx eax, r11b
add eax, 0x300
add ecx, 0x200
xor r8d, dword [rsi + rcx*4]
add r8d, dword [rsi + rax*4]
xor r8d, dword [r10 - 0xc]
xor ebx, r8d
mov eax, ebx
shr eax, 0x10
movzx edx, al
mov eax, ebx
shr eax, 0x18
add edx, 0x100
mov r8d, dword [rsi + rdx*4]
movzx ecx, al
mov eax, ebx
add r8d, dword [rsi + rcx*4]
shr eax, 8
movzx ecx, al
movzx eax, bl
add ecx, 0x200
add eax, 0x300
xor r8d, dword [rsi + rcx*4]
add r8d, dword [rsi + rax*4]
xor r8d, dword [r10 - 8]
xor r11d, r8d
sub r12, 1
jne 0x14007c9f0
mov ecx, dword [rbp + 0x44]
xor ecx, ebx
mov eax, ecx
ror eax, 8
and eax, 0xff00ff00
rol ecx, 8
and ecx, 0xff00ff
or eax, ecx
test r9, r9
je 0x14007caaa
xor eax, dword [r9]
mov dword [rdi], eax
test r9, r9
je 0x14007cad5
add r9, 4
je 0x14007cad5
mov eax, r11d
ror eax, 8
and eax, 0xff00ff00
rol r11d, 8
and r11d, 0xff00ff
or eax, r11d
xor eax, dword [r9]
jmp 0x14007caee
mov eax, r11d
ror eax, 8
and eax, 0xff00ff00
rol r11d, 8
and r11d, 0xff00ff
or eax, r11d
mov rbx, qword [rsp + 0x10]
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
mov dword [rdi + 4], eax
mov rdi, qword [rsp + 0x28]
pop r12
ret