joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b1bd0
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xb0]
sub rsp, 0x1b0
mov rax, qword [0x1401c8c00]
xor rax, rsp
mov qword [rbp + 0xa0], rax
xor edx, edx
lea rcx, [rbp - 0x60]
mov r8d, 0x100
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea rcx, [0x14021dbe2]
mov r8d, 0x6d1
call sub.VCRUNTIME140.dll_memset
lea r14, [rsp + 0x40]
mov qword [rsp + 0x1e0], rdi
sub r14, 0x480
lea r15, [0x14021d968]
xor r13d, r13d
lea r12, [0x14021dc82]
mov ebx, reloc.WLDAP32.dll_Ordinal_32
movsx esi, word [r15]
cmp esi, 0xffffffff
je 0x1400b1d75
cmp ebx, 0x140
jb 0x1400b1cf0
cmp ebx, 0x14e
ja 0x1400b1cf0
mov dword [rsp + 0x40], 0x60
mov dword [rsp + 0x44], 0x61
mov dword [rsp + 0x48], 0x62
mov dword [rsp + 0x4c], 0x63
mov dword [rsp + 0x50], 0x64
mov dword [rsp + 0x54], 0x65
mov dword [rsp + 0x58], 0x66
mov dword [rsp + 0x5c], 0x67
mov dword [rsp + 0x60], WSAGetLastError
mov dword [rsp + 0x64], WSAGetLastError
mov dword [rsp + 0x68], WSAGetLastError
mov dword [rsp + 0x6c], reloc.WS2_32.dll_WSAGetLastError
mov dword [rsp + 0x70], WSAGetLastError
mov dword [rsp + 0x74], WSAGetLastError
mov dword [rsp + 0x78], WSAGetLastError
mov edi, dword [r14]
jmp 0x1400b1cff
mov edx, 1
mov ecx, esi
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov edi, eax
mov dword [rsp + 0x28], r13d
lea r9, [rbp - 0x80]
lea r8, [rbp - 0x60]
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
mov edx, esi
mov ecx, edi
call qword [sym.imp.USER32.dll_ToUnicode]
cmp eax, 0xffffffff
jne 0x1400b1d42
mov dword [rsp + 0x28], r13d
lea r9, [rbp - 0x80]
lea r8, [rbp - 0x60]
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
mov edx, esi
mov ecx, edi
call qword [sym.imp.USER32.dll_ToUnicode]
cmp eax, 1
jl 0x1400b1d75
mov qword [rsp + 0x38], r13
lea r8, [rbp - 0x80]
mov qword [rsp + 0x30], r13
mov r9d, 1
mov dword [rsp + 0x28], 5
xor edx, edx
mov ecx, 0xfde9
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
inc ebx
add r12, 5
add r14, 4
add r15, 2
cmp ebx, 0x15c
jle 0x1400b1c52
mov rdi, qword [rsp + 0x1e0]
mov rcx, qword [rbp + 0xa0]
xor rcx, rsp
call fcn.140131b90
lea r11, [rsp + 0x1b0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x1400b4ad0
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1401c8c00]
xor rax, rsp
mov qword [rsp + 0x38], rax
cmp qword [0x14021e4f8], 0
lea rax, str.libOSMesa.dll
lea rcx, str.OSMesa.dll
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], 0
je 0x1400b4b25
mov eax, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140131b90
add rsp, 0x48
ret
mov qword [rsp + 0x40], rbx
xor ebx, ebx
nop dword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x14021e4f8], rax
test rax, rax
jne 0x1400b4b68
mov rax, qword [rsp + rbx*8 + 0x28]
inc rbx
test rax, rax
jne 0x1400b4b30
lea rdx, str.OSMesa:_Library_not_found
mov ecx, 0x10006
call fcn.1400aa350
jmp 0x1400b4c8d
lea rdx, str.OSMesaCreateContextExt
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14021e4f8]
lea rdx, str.OSMesaCreateContextAttribs
mov qword [0x14021e500], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14021e4f8]
lea rdx, str.OSMesaDestroyContext
mov qword [0x14021e508], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14021e4f8]
lea rdx, str.OSMesaMakeCurrent
mov qword [0x14021e510], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14021e4f8]
lea rdx, str.OSMesaGetColorBuffer
mov qword [0x14021e518], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14021e4f8]
lea rdx, str.OSMesaGetDepthBuffer
mov qword [0x14021e520], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14021e4f8]
lea rdx, str.OSMesaGetProcAddress
mov qword [0x14021e528], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [0x14021e500], 0
mov qword [0x14021e530], rax
je 0x1400b4c5f
cmp qword [0x14021e510], 0
je 0x1400b4c5f
cmp qword [0x14021e518], 0
je 0x1400b4c5f
cmp qword [0x14021e520], 0
je 0x1400b4c5f
cmp qword [0x14021e528], 0
je 0x1400b4c5f
test rax, rax
je 0x1400b4c5f
mov eax, 1
jmp 0x1400b4c8f
lea rdx, str.OSMesa:_Failed_to_load_required_entry_points
mov ecx, 0x10008
call fcn.1400aa350
mov rcx, qword [0x14021e4f8]
test rcx, rcx
je 0x1400b4c8d
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [0x14021e4f8], 0
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140131b90
add rsp, 0x48
ret
Function at 0x1400b50f0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbx
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
mov eax, gethostname
movaps xmmword [rsp + 0x30], xmm7
xorps xmm6, xmm6
movaps xmmword [rsp + 0x20], xmm8
mov rbx, rcx
movsd xmm8, qword [0x140155900]
cvtsi2sd xmm6, rax
test rax, rax
jns 0x1400b5129
addsd xmm6, xmm8
movaps xmm0, xmm8
call qword [sym.imp.api_ms_win_crt_math_l1_1_0.dll_log2]
divsd xmm6, xmm0
movaps xmm0, xmm6
call sub.api_ms_win_crt_math_l1_1_0.dll_ceil
movsd xmm6, qword [0x1401a6a50]
mov ecx, 1
cvttsd2si eax, xmm0
xorps xmm7, xmm7
cmp eax, ecx
cmovl eax, ecx
test eax, eax
jle 0x1400b5263
mov qword [rsp + 0x60], rbp
movabs rbp, 0x38eb3ffff6d3
mov qword [rsp + 0x68], rsi
movabs rsi, 0xb5026f5aa96619e9
mov qword [rsp + 0x70], rdi
mov edi, eax
mov eax, dword [rbx]
cmp eax, 0x138
jne 0x1400b51dc
lea r8, [rbx + 0x10]
mov r9d, eax
nop word [rax + rax]
mov edx, dword [r8 - 8]
xor edx, dword [r8]
lea r8, [r8 + 8]
btr edx, 0x1f
xor rdx, qword [r8 - 0x10]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, rsi
xor rcx, qword [r8 + 0x4d0]
xor rcx, rdx
mov qword [r8 + 0x9b0], rcx
sub r9, 1
jne 0x1400b51a0
jmp 0x1400b51eb
cmp eax, 0x270
jb 0x1400b51eb
mov rcx, rbx
call fcn.1400b68d0
mov eax, dword [rbx]
xorps xmm1, xmm1
mov rcx, qword [rbx + rax*8 + 8]
inc eax
mov dword [rbx], eax
mov rax, rcx
shr rax, 0x1d
and rax, qword [rbx + 0x1388]
xor rcx, rax
mov rax, rcx
and rax, rbp
shl rax, 0x11
xor rcx, rax
mov rax, rcx
and rax, 0xffffffffffffbf77
shl rax, 0x25
xor rcx, rax
mov rax, rcx
shr rax, 0x2b
xor rax, rcx
cvtsi2sd xmm1, rax
jns 0x1400b523d
addsd xmm1, xmm8
mulsd xmm1, xmm6
mulsd xmm6, xmm8
addsd xmm7, xmm1
sub rdi, 1
jne 0x1400b5185
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
movaps xmm8, xmmword [rsp + 0x20]
divsd xmm7, xmm6
movaps xmm6, xmmword [rsp + 0x40]
movaps xmm0, xmm7
movaps xmm7, xmmword [rsp + 0x30]
add rsp, 0x50
pop rbx
ret

Function at 0x1400b68d0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov r10, rcx
lea r9, [rcx + 0x9c8]
movabs rbx, 0xb5026f5aa96619e9
mov r11d, 0x9c
nop
mov edx, dword [r9]
xor edx, dword [r9 + 8]
lea r9, [r9 + 8]
btr edx, 0x1f
xor rdx, qword [r9 - 8]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, rbx
xor rcx, qword [r9 + 0x4d8]
xor rcx, rdx
mov qword [r9 - 0x9c8], rcx
sub r11, 1
jne 0x1400b68f0
lea r9, [r10 + 0xea8]
mov r11d, 0x9b
nop word [rax + rax]
mov edx, dword [r9]
xor edx, dword [r9 + 8]
lea r9, [r9 + 8]
btr edx, 0x1f
xor rdx, qword [r9 - 8]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, rbx
xor rcx, qword [r9 - 0xea8]
xor rcx, rdx
mov qword [r9 - 0x9c8], rcx
sub r11, 1
jne 0x1400b6940
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 8]
btr edx, 0x1f
xor rdx, qword [r10 + 0x1380]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, rbx
mov rbx, qword [rsp + 8]
xor rcx, qword [r10 + 0x4e0]
xor rcx, rdx
mov qword [r10 + 0x9c0], rcx
mov dword [r10], r11d
ret
Function at 0x1400b74b0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0xae0
mov rax, qword [0x1401c8c00]
xor rax, rsp
mov qword [rsp + 0xad0], rax
mov rbx, rdx
mov dword [rsp + 0x28], reloc.WLDAP32.dll_Ordinal_32
lea rax, [rsp + 0x80]
mov r8, rcx
xor edx, edx
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
or r9d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], reloc.WLDAP32.dll_Ordinal_32
or r9d, 0xffffffff
mov qword [rsp + 0x20], rax
mov r8, rbx
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rax, [rsp + 0x38]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareValveSteam
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400b755f
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, str.Error_opening_Steam_key_n
jmp 0x1400b7627
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, str.SteamExe
lea rax, [rsp + 0xc0]
mov dword [rsp + 0x30], 0x208
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x1400b7615
mov ecx, dword [rsp + 0x30]
cmp ecx, 1
jb 0x1400b7615
shr ecx, 1
je 0x1400b75d3
lea rax, [rsp + 0xc0]
lea edx, [rbx + 0x5c]
nop
cmp word [rax], 0x2f
jne 0x1400b75c9
mov word [rax], dx
add rax, 2
sub rcx, 1
jne 0x1400b75c0
lea rax, [rsp + 0x40]
mov edx, 0x800
lea r9, [rsp + 0xc0]
mov qword [rsp + 0x20], rax
lea r8, str.__s__steam:__rungameid__s
lea rcx, [rsp + 0x2d0]
call fcn.1400b7340
lea rdx, [rsp + 0x2d0]
lea rcx, [rsp + 0x80]
call fcn.1400b6fa0
jmp 0x1400b762f
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, str.Error_reading_SteamExe_key_n
mov rcx, rax
call fcn.140058870
mov rcx, qword [rsp + 0xad0]
xor rcx, rsp
call fcn.140131b90
add rsp, 0xae0
pop rbx
ret
Function at 0x1400b76e0
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1401c8c00]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov eax, dword [0x140155b50]
xor edi, edi
movups xmm0, xmmword [str._pipediscord_ipc_0]
mov dword [rsp + 0x68], eax
mov rbx, rcx
movzx eax, word [0x140155b54]
lea rcx, [rsp + 0x40]
movups xmm1, xmmword [0x140155b38]
mov word [rsp + 0x6c], ax
mov eax, Ordinal_50
movups xmmword [rsp + 0x40], xmm0
xor r9d, r9d
mov qword [rsp + 0x30], rdi
movsd xmm0, qword [0x140155b48]
xor r8d, r8d
mov dword [rsp + 0x28], edi
mov edx, 0xc0000000
movsd qword [rsp + 0x60], xmm0
mov word [rsp + 0x6a], ax
movups xmmword [rsp + 0x50], xmm1
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbx + 8], rax
cmp rax, 0xffffffffffffffff
jne 0x1400b77e4
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x1400b7798
movzx eax, word [rsp + 0x6a]
cmp ax, 0x39
jae 0x1400b7807
inc ax
mov word [rsp + 0x6a], ax
jmp 0x1400b77b3
cmp eax, 0xe7
jne 0x1400b7807
mov edx, 0x2710
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
je 0x1400b7807
mov qword [rsp + 0x30], rdi
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x28], edi
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbx + 8], rax
cmp rax, 0xffffffffffffffff
je 0x1400b7778
mov byte [rbx], 1
mov al, 1
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140131b90
mov rbx, qword [rsp + 0x98]
add rsp, 0x80
pop rdi
ret
xor al, al
jmp 0x1400b77e9

Function at 0x1400b7810
Capabilities:
Read file on windows
Read pipe

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
test rdx, rdx
jne 0x1400b7830
xor al, al
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
test rbx, rbx
je 0x1400b7826
mov rcx, qword [rcx + 8]
cmp rcx, 0xffffffffffffffff
je 0x1400b7826
lea rax, [rsp + 0x58]
mov qword [rsp + 0x50], rbp
xor ebp, ebp
xor r9d, r9d
mov qword [rsp + 0x28], rbp
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x58], ebp
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x1400b78bb
mov eax, dword [rsp + 0x58]
cmp rax, rdi
jb 0x1400b78d0
mov rcx, qword [rbx + 8]
lea r9, [rsp + 0x68]
mov r8d, edi
mov dword [rsp + 0x68], ebp
mov rdx, rsi
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, 1
jne 0x1400b78a4
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
mov rcx, rbx
call fcn.1400b7650
mov rbp, qword [rsp + 0x50]
xor al, al
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 8], 0xffffffffffffffff
mov byte [rbx], bpl
xor al, al
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400b78e0
Capabilities:
Write file on windows

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, r8
test r8, r8
jne 0x1400b78f6
mov al, 1
add rsp, 0x30
pop rdi
ret
test rcx, rcx
jne 0x1400b7903
xor al, al
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rcx + 8]
cmp rcx, 0xffffffffffffffff
je 0x1400b78fb
test rdx, rdx
je 0x1400b78fb
mov qword [rsp + 0x40], rbx
lea r9, [rsp + 0x50]
xor ebx, ebx
mov dword [rsp + 0x50], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
jne 0x1400b793a
cmp dword [rsp + 0x50], edi
jne 0x1400b793a
mov ebx, eax
movzx eax, bl
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1400ced00
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r10, rdx
test r9, r9
je 0x1400ceea4
cmp r9, 4
jb 0x1400ced4a
mov rdx, r9
shr rdx, 2
imul rax, rdx, 0xfffffffffffffffc
add r9, rax
nop dword [rax]
nop dword [rax + rax]
mov eax, dword [r10]
add r10, 4
xor eax, dword [r8]
add r8, 4
mov dword [rcx], eax
add rcx, 4
sub rdx, 1
jne 0x1400ced30
xor r11d, r11d
test r9, r9
je 0x1400ceea4
cmp r9, 8
jb 0x1400cee7d
lea rdx, [rcx - 1]
lea rax, [r8 - 1]
add rdx, r9
add rax, r9
cmp rcx, rax
ja 0x1400ced7c
cmp rdx, r8
jae 0x1400cee7d
lea rax, [r10 - 1]
add rax, r9
cmp rcx, rax
ja 0x1400ced91
cmp rdx, r10
jae 0x1400cee7d
mov qword [rsp + 0x10], rbx
mov qword [rsp], rdi
cmp r9, 0x40
jb 0x1400cee37
mov rdi, r9
mov qword [rsp + 0x18], rsi
and edi, 0x3f
mov rsi, r9
sub rsi, rdi
mov rdx, r10
lea rax, [r8 + 0x10]
sub rdx, r8
mov rbx, rcx
sub rbx, r8
nop word [rax + rax]
movdqu xmm0, xmmword [rax - 0x10]
add r11, 0x40
movdqu xmm1, xmmword [rdx + rax - 0x10]
movdqu xmm2, xmmword [rdx + rax]
lea rax, [rax + 0x40]
xorps xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x40]
movdqu xmmword [rbx + rax - 0x50], xmm1
xorps xmm2, xmm0
movdqu xmm0, xmmword [rax - 0x30]
movdqu xmm1, xmmword [rdx + rax - 0x30]
movdqu xmmword [rbx + rax - 0x40], xmm2
xorps xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x20]
movdqu xmm2, xmmword [rdx + rax - 0x20]
movdqu xmmword [rbx + rax - 0x30], xmm1
xorps xmm2, xmm0
movdqu xmmword [rbx + rax - 0x20], xmm2
cmp r11, rsi
jb 0x1400cedd0
mov rsi, qword [rsp + 0x18]
cmp rdi, 8
jb 0x1400cee6f
mov rdx, r9
and rdx, 0xfffffffffffffff8
mov rbx, r10
lea rax, [r11 + r8]
sub rbx, r8
mov rdi, rcx
sub rdi, r8
nop
movq xmm1, qword [rax + rbx]
add r11, 8
movq xmm0, qword [rax]
lea rax, [rax + 8]
xorps xmm1, xmm0
movq qword [rax + rdi - 8], xmm1
cmp r11, rdx
jb 0x1400cee50
mov rdi, qword [rsp]
mov rbx, qword [rsp + 0x10]
cmp r11, r9
jae 0x1400ceea4
sub r10, r8
lea rdx, [r11 + r8]
sub rcx, r8
sub r9, r11
nop word [rax + rax]
movzx eax, byte [rdx + r10]
xor al, byte [rdx]
mov byte [rdx + rcx], al
lea rdx, [rdx + 1]
sub r9, 1
jne 0x1400cee90
add rsp, 8
ret
Function at 0x1400de2e0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x1400de3c2
call fcn.1400f4c60
test al, al
jne 0x1400de3c2
mov qword [rsp + 0x30], rsi
xor esi, esi
mov qword [rsp + 0x38], rdi
mov rdi, 0xffffffffffffffff
inc rdi
cmp byte [rbx + rdi], sil
jne 0x1400de312
mov r8, rdi
mov edx, reloc.WLDAP32.dll_Ordinal_46
mov rcx, rbx
call fcn.1400fe700
test rax, rax
je 0x1400de357
sub rax, rbx
mov edx, reloc.WLDAP32.dll_Ordinal_46
mov r8, rax
mov rcx, rbx
call fcn.1400fe700
mov rsi, rax
test rax, rax
je 0x1400de357
inc rsi
mov rcx, rbx
sub rcx, rsi
add rdi, rcx
test rsi, rsi
cmovne rbx, rsi
lea rsi, [rbx + rdi]
mov edi, 0x1505
cmp rbx, rsi
jae 0x1400de38b
nop dword [rax]
movzx ecx, byte [rbx]
call fcn.1400f18f0
imul rdi, rdi, 0x21
movsx rcx, al
inc rbx
xor rdi, rcx
cmp rbx, rsi
jb 0x1400de370
mov rsi, qword [rsp + 0x30]
mov rcx, rdi
movabs rax, 0x410410410410411
mul rdi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 5
imul rcx, rcx, 0x3f
sub rdi, rcx
mov rax, rdi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x1400eb5b0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
cmp byte [rcx + 0xab7], 0
mov rbp, r9
mov r14, r8
movsxd rsi, edx
mov rdi, rcx
je 0x1400eb679
cmp qword [rcx + 0x268], 0
je 0x1400eb62e
mov qword [rsp + 0x40], rbx
call fcn.1400d8930
mov dl, 1
mov rcx, rdi
movzx ebx, al
call fcn.1400d8ca0
mov rcx, qword [rdi + 0x1e0]
mov r9, rbp
mov qword [rsp + 0x20], rcx
mov r8, r14
mov rcx, rdi
mov edx, esi
call qword [rdi + 0x268]
movzx edx, bl
mov rcx, rdi
call fcn.1400d8ca0
mov rbx, qword [rsp + 0x40]
jmp 0x1400eb679
mov ecx, esi
test edx, edx
je 0x1400eb63e
sub ecx, 1
je 0x1400eb63e
cmp ecx, 1
jne 0x1400eb679
mov r9, qword [rdi + 0x1d8]
lea rax, [0x14015f3d8]
mov edx, 2
lea rcx, [rsi + rsi*2]
add rcx, rax
lea r8d, [rdx - 1]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov r9, qword [rdi + 0x1d8]
mov r8d, 1
mov rdx, rbp
mov rcx, r14
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x1400edc50
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
call sub.api_ms_win_crt_stdio_l1_1_0.dll__read
cdqe
add rsp, 0x28
ret
Function at 0x1400ee130
Capabilities:
Get common file path
Initialize winsock library

Disassembly:
sub rsp, 0x1e8
mov rax, qword [0x1401c8c00]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
test cl, 2
je 0x1400ee196
mov ecx, 0x202
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x1400ee179
movzx eax, word [rsp + 0x30]
cmp al, 2
jne 0x1400ee173
shr ax, 8
cmp al, 2
je 0x1400ee196
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 2
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.140131b90
add rsp, 0x1e8
ret
call fcn.140122200
test eax, eax
jne 0x1400ee395
mov qword [rsp + 0x200], rsi
lea rcx, str.kernel32
mov qword [rsp + 0x208], rdi
xor esi, esi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdi, rax
test rax, rax
jne 0x1400ee1d6
mov qword [0x140255568], rsi
jmp 0x1400ee352
mov qword [rsp + 0x1f0], rbx
lea rdx, str.LoadLibraryExA
mov rcx, rdi
mov qword [rsp + 0x1f8], rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rbx, str.iphlpapi.dll
mov rbp, rax
mov rcx, rbx
lea rdx, [0x14015f7a8]
call sub.api_ms_win_crt_string_l1_1_0.dll_strpbrk
test rax, rax
je 0x1400ee23a
mov rcx, rbx
test rbp, rbp
je 0x1400ee22c
xor edx, edx
lea r8d, [rdx + 8]
call rbp
mov rsi, rax
jmp 0x1400ee31a
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
jmp 0x1400ee31a
test rbp, rbp
je 0x1400ee269
lea rdx, str.AddDllDirectory
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400ee269
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call rbp
mov rsi, rax
jmp 0x1400ee31a
xor edx, edx
mov qword [rsp + 0x1e0], r14
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov r14d, eax
test eax, eax
je 0x1400ee312
lea ecx, [rax + 1]
add rcx, 0xc
call qword [sub.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
je 0x1400ee309
mov edx, r14d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1400ee309
mov rcx, 0xffffffffffffffff
mov rax, rcx
cmp byte [rdi + rax + 1], sil
lea rax, [rax + 1]
jne 0x1400ee2b5
mov word [rax + rdi], 0x5c
inc rcx
cmp byte [rdi + rcx], sil
jne 0x1400ee2c6
mov rdx, rdi
sub rdx, rbx
add rdx, rcx
nop dword [rax + rax]
movzx eax, byte [rbx]
mov byte [rdx + rbx], al
lea rbx, [rbx + 1]
test al, al
jne 0x1400ee2e0
mov rcx, rdi
test rbp, rbp
je 0x1400ee300
xor edx, edx
lea r8d, [rdx + 8]
call rbp
jmp 0x1400ee306
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
mov rcx, rdi
call qword [fcn.140132da8]
mov r14, qword [rsp + 0x1e0]
mov rbp, qword [rsp + 0x1f8]
mov rbx, qword [rsp + 0x1f0]
mov qword [0x140255568], rsi
test rsi, rsi
je 0x1400ee352
lea rdx, str.if_nametoindex
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400ee352
mov qword [0x140255560], rax
xor edx, edx
mov dword [rsp + 0x20], 3
mov r9d, 2
xor r8d, r8d
lea ecx, [rdx + 6]
call fcn.140121db0
test al, al
lea rcx, [0x140256860]
setne byte [0x140256858]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rdi, qword [rsp + 0x208]
xor eax, eax
mov rsi, qword [rsp + 0x200]
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.140131b90
add rsp, 0x1e8
ret
Function at 0x1400feeb0
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
mov rbx, rcx
movaps xmmword [rsp + 0x50], xmm6
lea rcx, [rsp + 0x30]
mov rdi, rdx
call fcn.1400de6d0
mov rcx, rbx
movups xmm6, xmmword [rax]
call case.0x1400e6e81.1
mov rcx, rdi
mov rsi, rax
call case.0x1400e6e81.1
mov r8d, 1
mov rdx, rax
mov rcx, rsi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x1400fef60
nop dword [rax]
nop word [rax + rax]
lea rcx, [rsp + 0x40]
movdqa xmmword [rsp + 0x20], xmm6
call fcn.1400de6d0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x30], xmm0
call fcn.1400de760
cmp rax, 0x3e8
ja 0x1400fef91
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, 1
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
je 0x1400fef10
test rsi, rsi
je 0x1400fef6d
mov rcx, rsi
call fcn.140132da8
test rbx, rbx
je 0x1400fef7a
mov rcx, rbx
call fcn.140132da8
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x60
pop rdi
ret
test rsi, rsi
je 0x1400fef9e
mov rcx, rsi
call fcn.140132da8
test rbx, rbx
je 0x1400fefab
mov rcx, rbx
call fcn.140132da8
mov eax, 1
jmp 0x1400fef7c