joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14013ba10
Capabilities:
Check http status code

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rbp, qword [rcx + 0x18]
lea eax, [rdx - 0xc8]
xor edi, edi
mov esi, r8d
mov rbx, rcx
cmp eax, 0x64
jb 0x14013ba4f
lea rdx, str.Couldnt_set_desired_mode
call fcn.14010d280
lea eax, [rdi + 0x11]
jmp 0x14013bbbb
cmp edx, 0xc8
je 0x14013ba66
mov r8d, edx
lea rdx, str.Got_a__03d_response_code_instead_of_the_assumed_200_n
call fcn.14010d3e0
cmp esi, 0x13
jne 0x14013ba7b
mov rdx, rbp
mov rcx, rbx
call fcn.14013b910
jmp 0x14013bbb7
cmp esi, 0x14
jne 0x14013bb99
cmp dword [rbx + 0x730], 2
mov rbp, qword [rbx + 0x18]
jne 0x14013bafe
mov rax, qword [rbx + 0x1b8]
mov rdx, qword [rax]
test rdx, rdx
je 0x14013bafe
mov dword [rsp + 0x28], 3
lea r9, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov rcx, rbx
mov qword [rsp + 0x40], rdi
call fcn.140106aa0
test eax, eax
jne 0x14013bbb7
mov rcx, qword [rsp + 0x40]
lea edx, [rsi + 0x1b]
call sub.VCRUNTIME140.dll_strrchr
test rax, rax
je 0x14013baf3
mov rdi, qword [rsp + 0x40]
mov ecx, 1
sub rax, rdi
cmovne rcx, rax
mov byte [rcx + rdi], 0
jmp 0x14013bafe
mov rcx, qword [rsp + 0x40]
call qword [fcn.140262bb8]
mov rdx, qword [rbx + 0x798]
test rdx, rdx
jne 0x14013bb23
cmp byte [rbx + 0xadd], 0
lea rax, str.NLST
lea rdx, str.LIST
cmovne rdx, rax
lea r8, [0x14027ae48]
test rdi, rdi
mov r9, r8
lea rax, [0x14027c234]
cmovne r9, rdi
lea rcx, [0x140292768]
cmovne r8, rax
call fcn.14010e070
mov rcx, rdi
mov rsi, rax
call qword [fcn.140262bb8]
test rsi, rsi
jne 0x14013bb61
lea edi, [rsi + 0x1b]
jmp 0x14013bbb9
lea rdx, [rbp + 0x6d8]
mov r9, rsi
lea r8, [0x1402970a8]
mov rcx, rbx
call fcn.14014f920
mov rcx, rsi
mov edi, eax
call qword [fcn.140262bb8]
test edi, edi
jne 0x14013bbb9
mov rcx, qword [rbx + 0x18]
mov dword [rcx + 0x7a8], 0x1f
jmp 0x14013bbb9
cmp esi, 0x15
jne 0x14013bba4
lea r8d, [rsi - 8]
jmp 0x14013bbad
cmp esi, 0x16
jne 0x14013bbb9
lea r8d, [rsi - 8]
mov dl, 1
mov rcx, rbx
call fcn.14013b3e0
mov edi, eax
mov eax, edi
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x140141e60
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
cmp byte [rcx + 0xaee], 0
movsxd r10, r9d
je 0x140141f84
cmp r8d, 0xff
jne 0x140141ec1
lea eax, [r10 - 0xec]
cmp eax, 0x13
ja 0x140141eab
lea r8, [0x140000000]
mov r9, qword [r8 + r10*8 + 0x2990e0]
mov r8, rdx
lea rdx, str._s_IAC__s_n
add rsp, 0x38
jmp fcn.14010d3e0
mov r8, rdx
mov r9d, r10d
lea rdx, str._s_IAC__d_n
add rsp, 0x38
jmp fcn.14010d3e0
cmp r8d, 0xfb
jne 0x140141ed3
lea r9, str.WILL
jmp 0x140141f11
cmp r8d, 0xfc
jne 0x140141ee5
lea r9, str.WONT
jmp 0x140141f11
cmp r8d, 0xfd
jne 0x140141ef7
lea r9, [0x140299b04]
jmp 0x140141f11
xor r9d, r9d
lea rax, str.DONT
cmp r8d, 0xfe
cmove r9, rax
test r9, r9
je 0x140141f6d
cmp r10d, 0x27
jg 0x140141f44
lea r8, [0x140000000]
mov r8, qword [r8 + r10*8 + 0x299700]
test r8, r8
jne 0x140141f54
mov r8, rdx
mov dword [rsp + 0x20], r10d
lea rdx, str._s__s__d_n
call fcn.14010d3e0
add rsp, 0x38
ret
cmp r10d, 0xff
jne 0x140141f2b
lea r8, str.EXOPL
mov qword [rsp + 0x20], r8
mov r8, rdx
lea rdx, str._s__s__s_n
call fcn.14010d3e0
add rsp, 0x38
ret
mov r9d, r8d
mov dword [rsp + 0x20], r10d
mov r8, rdx
lea rdx, str._s__d__d_n
call fcn.14010d3e0
add rsp, 0x38
ret

Function at 0x1401422d0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov byte [rsp + 0x38], 0xff
mov rcx, qword [rcx + 0x18]
mov edi, r8d
mov esi, edx
mov byte [rsp + 0x3a], dil
xor r9d, r9d
mov byte [rsp + 0x39], sil
lea rdx, [rsp + 0x38]
mov rcx, qword [rcx + 0x1f0]
lea r8d, [r9 + 3]
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x14014232f
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbx
mov r8d, eax
call fcn.14010d280
mov r9d, edi
lea rdx, str.SENT
mov r8d, esi
mov rcx, rbx
call fcn.140141e60
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1401424d0
Capabilities:
Send data
Send data on socket

Disassembly:
cmp edx, 0x1f
jne 0x14014267e
push rbp
push rdi
push r15
sub rsp, 0x20
mov rdi, qword [rcx + 0x1b8]
mov rbp, rcx
mov r15, qword [rcx + 0x18]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rsi
lea rsi, [rdi + 0x1cb8]
mov qword [rsp + 0x58], r14
lea rbx, [rdi + 0x1eb8]
mov qword [rbx], rsi
cmp rsi, rbx
jae 0x14014251f
mov byte [rsi], 0xff
inc qword [rbx]
mov rax, qword [rbx]
jmp 0x140142522
mov rax, rsi
cmp rax, rbx
jae 0x14014253b
mov byte [rax], 0xfa
inc qword [rbx]
mov rax, qword [rbx]
cmp rax, rbx
jae 0x14014253b
mov byte [rax], 0x1f
inc qword [rbx]
movzx ecx, word [rdi + 0x1ca8]
call qword [sym.imp.WS2_32.dll_htons]
movzx ecx, word [rdi + 0x1caa]
movzx r14d, ax
mov word [rsp + 0x48], ax
call qword [sym.imp.WS2_32.dll_htons]
mov r9, qword [rbx]
movzx ecx, ax
cmp r9, rbx
jae 0x140142572
mov byte [r9], r14b
inc qword [rbx]
mov r9, qword [rbx]
mov r14, qword [rsp + 0x58]
cmp r9, rbx
jae 0x1401425c8
movzx eax, byte [rsp + 0x49]
mov byte [r9], al
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x1401425c8
mov byte [r9], cl
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x1401425c8
shr cx, 8
mov byte [r9], cl
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x1401425c8
mov byte [r9], 0xff
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x1401425c8
mov byte [r9], 0xf0
mov r9, qword [rbx]
inc r9
mov qword [rdi + 0x1ec0], r9
lea r8, [rdi + 0x1cba]
sub r9, rsi
mov qword [rbx], rsi
sub r9, 2
mov edx, 0x3e
mov rcx, rbp
call fcn.140141f90
mov rcx, qword [r15 + 0x1f0]
xor r9d, r9d
mov rdx, rsi
lea r8d, [r9 + 3]
call qword [sym.imp.WS2_32.dll_send]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
test eax, eax
jns 0x14014262a
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbp
mov r8d, eax
call fcn.14010d280
lea rdx, [rdi + 0x1cbb]
mov r8d, 4
mov rcx, rbp
call fcn.140142360
mov rcx, qword [r15 + 0x1f0]
lea rdx, [rdi + 0x1cbf]
xor r9d, r9d
lea r8d, [r9 + 2]
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x140142676
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbp
mov r8d, eax
call fcn.14010d280
add rsp, 0x20
pop r15
pop rdi
pop rbp
ret
Function at 0x140143d80
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xd0
mov rax, qword [0x1403644c8]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rax, qword [rcx + 0x18]
mov rsi, rcx
xor r9d, r9d
mov rdi, qword [rax + 0x6d8]
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0x80
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r8d, dword [rdi + 0x154]
mov rdx, qword [rdi + 0x160]
add r8d, 4
mov rcx, qword [rdi + 0x18]
call qword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [rdi + 0x148], 0
mov dword [rdi + 0x14c], eax
jne 0x140143e17
movsxd r8, dword [rsp + 0x30]
lea rcx, [rdi + 0xc8]
lea rdx, [rsp + 0x40]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rsp + 0x30]
mov dword [rdi + 0x148], eax
mov r8d, dword [rdi + 0x14c]
mov qword [rsp + 0xe8], rbx
mov qword [rsp + 0xf0], rbp
cmp r8d, 4
jge 0x140143e7d
lea rdx, str.Received_too_short_packet
mov rcx, rsi
call fcn.14010d280
mov dword [rdi + 0xc], 7
xor eax, eax
mov rbp, qword [rsp + 0xf0]
mov rbx, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1400e39a0
mov rsi, qword [rsp + 0xf8]
add rsp, 0xd0
pop rdi
ret
mov rax, qword [rdi + 0x160]
movzx ecx, byte [rax]
movzx edx, byte [rax + 1]
shl ecx, 8
or edx, ecx
mov dword [rdi + 0xc], edx
sub edx, 3
je 0x140143f2d
sub edx, 1
je 0x140143fa6
sub edx, 1
je 0x140143ee7
cmp edx, 1
je 0x140143eca
lea r8, str.Internal_error:_Unexpected_packet
mov rcx, rsi
lea rdx, [0x1402970a8]
call fcn.14010d280
jmp 0x140143fa6
add r8d, 0xfffffffe
lea rdx, [rax + 2]
mov rcx, rdi
call fcn.140143ab0
test eax, eax
je 0x140143fa6
jmp 0x140143e4c
mov rdx, rax
lea rbp, [rax + 4]
lea eax, [r8 - 4]
movsxd rbx, eax
movzx ecx, byte [rdx + 2]
movzx eax, byte [rdx + 3]
mov rdx, rbx
shl ecx, 8
or ecx, eax
mov dword [rdi + 8], ecx
mov rcx, rbp
call fcn.140144ad0
cmp rax, rbx
jae 0x140143fa6
mov r8, rbp
lea rdx, str.TFTP_error:__s_n
mov rcx, rsi
call fcn.14010d3e0
jmp 0x140143fa6
cmp r8d, 4
jle 0x140143fa6
movzx ecx, byte [rax + 2]
mov rdx, rax
movzx eax, byte [rax + 3]
shl ecx, 8
or ecx, eax
movzx eax, word [rdi + 0x15c]
inc eax
movzx eax, ax
cmp eax, ecx
jne 0x140143fa6
lea eax, [r8 - 4]
mov rcx, rsi
lea r8, [rdx + 4]
movsxd r9, eax
mov edx, 1
call fcn.14010d190
mov ebx, eax
test eax, eax
je 0x140143f85
mov edx, 5
mov rcx, rdi
call fcn.140144a50
mov eax, ebx
jmp 0x140143e4c
mov eax, dword [rdi + 0x14c]
mov rcx, rsi
sub eax, 4
cdqe
add qword [rsi + 0x100], rax
mov rdx, qword [rsi + 0x100]
call fcn.14012bff0
mov rcx, rsi
call fcn.14012c300
test eax, eax
je 0x140143e4a
mov edx, 5
mov rcx, rdi
call fcn.140144a50
mov eax, 0x2a
jmp 0x140143e4c
Function at 0x140152440
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [sub.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x140152482
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x1401524c9
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x140152522
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
sub rbp, 1
jne 0x1401524e0
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x140152563
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x14029c5d4]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x14029c5d5]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x140152530
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
Function at 0x140154480
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rdi, r9
mov rsi, r8
mov r12, rdx
mov r15, rcx
mov r14, qword [r8 + 0x10]
mov r9, qword [r8 + 0x18]
cmp r9, 0x10
jb 0x1401544bf
mov r8, qword [r8]
movabs rdx, 0xcbf29ce484222325
xor ecx, ecx
test r14, r14
je 0x1401544f4
movabs r10, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rcx + r8]
xor rdx, rax
imul rdx, r10
inc rcx
cmp rcx, r14
jb 0x1401544e0
mov r8, qword [r15 + 0x30]
and r8, rdx
shl r8, 4
mov qword [rsp + 0x80], r8
mov r13, qword [r15 + 0x18]
add r13, r8
mov rbx, qword [r15 + 8]
cmp rbx, qword [r13]
je 0x1401545a3
mov rbx, qword [r13 + 8]
mov rbx, qword [rbx]
cmp rbx, qword [r13]
je 0x1401545a3
mov rbx, qword [rbx + 8]
lea rdx, [rbx + 0x10]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x14015453f
mov rdx, qword [rdx]
mov rcx, rsi
cmp r9, 0x10
jb 0x14015454b
mov rcx, qword [rsi]
cmp r14, rax
jne 0x140154523
mov r8, r14
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
mov r9, qword [rsi + 0x18]
jne 0x140154523
mov rcx, qword [rdi + 8]
mov rax, qword [rdi]
mov qword [rcx], rax
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
dec qword [r15 + 0x10]
lea rcx, [rdi + 0x10]
call fcn.1400827c0
nop
mov edx, 0x30
mov rcx, rdi
call fcn.140082ab0
nop
mov qword [r12], rbx
mov byte [r12 + 8], 0
mov rax, r12
jmp 0x140154640
mov rax, qword [rdi]
cmp rbx, rax
je 0x1401545d8
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rdx, qword [r15 + 0x18]
mov r8, qword [rsp + 0x80]
add rdx, r8
mov rax, qword [rdx]
cmp rax, qword [r15 + 8]
jne 0x1401545fe
mov qword [rdx], rdi
mov rax, qword [r15 + 0x18]
mov qword [rax + r8 + 8], rdi
jmp 0x14015462a
cmp rax, rbx
jne 0x140154608
mov qword [rdx], rdi
jmp 0x14015462a
mov rax, qword [rdx + 8]
mov rcx, qword [rax]
mov qword [rdx + 8], rcx
cmp rcx, rdi
je 0x14015462a
mov rdx, qword [r15 + 0x18]
mov rax, qword [rdx + r8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8 + 8], rcx
mov rcx, r15
call fcn.1401548f0
nop
mov qword [r12], rdi
mov byte [r12 + 8], 1
mov rax, r12
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x140154da0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], r14
mov rdi, r8
mov r15, rdx
mov rsi, rcx
mov r11, qword [r8 + 0x20]
lea r10, [r8 + 0x10]
cmp qword [r8 + 0x28], 0x10
jb 0x140154ddf
mov r10, qword [r8 + 0x10]
movabs r9, 0xcbf29ce484222325
xor r8d, r8d
test r11, r11
je 0x140154e14
movabs rcx, 0x100000001b3
nop dword [rax + rax]
movzx eax, byte [r8 + r10]
xor r9, rax
imul r9, rcx
inc r8
cmp r8, r11
jb 0x140154e00
mov rdx, qword [rsi + 0x30]
and rdx, r9
shl rdx, 4
mov rcx, qword [rsi + 0x18]
add rcx, rdx
cmp qword [rcx + 8], rdi
jne 0x140154e51
cmp qword [rcx], rdi
jne 0x140154e47
mov rax, qword [rsi + 8]
mov qword [rcx], rax
mov rax, qword [rsi + 8]
mov rcx, qword [rsi + 0x18]
mov qword [rdx + rcx + 8], rax
jmp 0x140154e5c
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
jmp 0x140154e5c
cmp qword [rcx], rdi
jne 0x140154e5c
mov rax, qword [rdi]
mov qword [rcx], rax
mov rbx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rax], rbx
mov rdx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
dec qword [rsi + 0x10]
lea rcx, [rdi + 0x10]
call fcn.1400827c0
nop
mov edx, 0x30
mov rcx, rdi
call fcn.140082ab0
nop
mov qword [r15], rbx
mov rax, r15
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov r14, qword [rsp + 0x58]
add rsp, 0x30
pop r15
ret
Function at 0x14015a5a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x20
mov r11, qword [r8 + 0x18]
mov rdi, r8
mov r14, qword [r8 + 0x10]
mov r12, rdx
mov rsi, rcx
mov r10, r8
cmp r11, 0x10
jb 0x14015a5ce
mov r10, qword [r8]
xor r8d, r8d
movabs r9, 0xcbf29ce484222325
test r14, r14
je 0x14015a604
movabs rcx, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [r8 + r10]
inc r8
xor r9, rax
imul r9, rcx
cmp r8, r14
jb 0x14015a5f0
mov rax, qword [rsi + 0x18]
mov rcx, qword [rsi + 0x30]
mov rsi, qword [rsi + 8]
and rcx, r9
shl rcx, 4
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], r15
mov r13, qword [rcx + rax]
add rax, 8
add rax, rcx
mov rbx, r13
mov qword [rsp + 0x50], rax
cmp r13, rsi
jne 0x14015a63e
mov rax, rsi
jmp 0x14015a644
mov rax, qword [rax]
mov rax, qword [rax]
cmp rbx, rax
je 0x14015a6bd
lea rcx, [rbx + 0x10]
mov rdx, rdi
cmp r11, 0x10
jb 0x14015a659
mov rdx, qword [rdi]
mov r15, qword [rcx + 0x18]
mov rbp, qword [rcx + 0x10]
cmp r15, 0x10
jb 0x14015a66a
mov rcx, qword [rcx]
cmp rbp, r14
jne 0x14015a67f
mov r8, rbp
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14015a689
mov r11, qword [rdi + 0x18]
mov rbx, qword [rbx]
mov rax, qword [rsp + 0x50]
jmp 0x14015a634
lea rdx, [rbx + 0x10]
cmp r15, 0x10
jb 0x14015a696
mov rdx, qword [rdx]
cmp qword [rdi + 0x18], 0x10
jb 0x14015a6a0
mov rdi, qword [rdi]
cmp r14, rbp
jne 0x14015a6b4
mov r8, r14
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14015a6b7
mov rbx, rsi
mov qword [r12], rbx
jmp 0x14015a6c1
mov qword [r12], rsi
mov r15, qword [rsp + 0x60]
mov rax, r12
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x68]
add rsp, 0x20
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x14015f6d0
Capabilities:
Get hostname

Disassembly:
mov r11, rsp
push rsi
push rdi
push r14
sub rsp, 0x2c0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov rax, qword [0x1403644c8]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
mov rdi, rdx
mov r14, rcx
mov qword [rsp + 0x20], rdx
xor esi, esi
mov dword [rsp + 0x28], esi
mov rax, qword [rcx]
cmp qword [rax + 0x10], rsi
je 0x14015f851
mov dword [rsp + 0x20], 0x20
lea rdx, [rsp + 0x20]
lea rcx, [r11 - 0x48]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x14015f7a3
xor r8d, r8d
lea edx, [rsi + 2]
lea rcx, [rsp + 0x60]
call fcn.14025b540
nop
lea rcx, [rsp + 0x60]
call fcn.14025c1a0
test al, al
je 0x14015f77a
lea rdx, str.device:_GetComputerName_failed:
lea rcx, [rsp + 0x60]
call fcn.140253210
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call fcn.140253100
nop
lea rcx, [rsp + 0x60]
call fcn.140252b50
movdqa xmm0, xmmword [0x14027bc70]
movdqu xmmword [rsp + 0x48], xmm0
mov word [rsp + 0x38], si
xor r8d, r8d
lea rdx, [0x14027add0]
jmp 0x14015f7d7
movdqa xmm0, xmmword [0x14027bc70]
movdqu xmmword [rsp + 0x48], xmm0
mov word [rsp + 0x38], si
lea rax, [rsp + 0x290]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], si
jne 0x14015f7c5
lea rdx, [rsp + 0x290]
lea rcx, [rsp + 0x38]
call fcn.140086f50
mov esi, 5
mov r9, qword [r14]
lea rax, [rsp + 0x38]
mov r10, qword [rsp + 0x38]
mov r11, qword [rsp + 0x50]
cmp r11, 8
cmovae rax, r10
mov rcx, qword [r9 + 0x10]
cmp qword [r9 + 0x18], 8
jb 0x14015f80e
mov r9, qword [r9]
cmp rcx, qword [rsp + 0x48]
jne 0x14015f84d
test rcx, rcx
je 0x14015f85b
movzx edx, word [r9]
movzx r8d, word [rax]
cmp dx, r8w
jb 0x14015f84d
sub r9, rax
cmp dx, r8w
ja 0x14015f84d
cmp rcx, 1
je 0x14015f85b
dec rcx
add rax, 2
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jae 0x14015f82f
mov bl, 1
jmp 0x14015f85d
mov r11, qword [rsp + 0x50]
mov r10, qword [rsp + 0x38]
xor bl, bl
test sil, 1
je 0x14015f8a2
cmp r11, 8
jb 0x14015f8a2
lea rdx, [r11*2 + 2]
mov rax, r10
cmp rdx, 0x1000
jb 0x14015f899
add rdx, 0x27
mov r10, qword [r10 - 8]
sub rax, r10
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14015f899
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r10
call fcn.140082ab0
nop
test bl, bl
je 0x14015f8c4
mov rdx, qword [r14]
mov r8, qword [rdx + 0x10]
add r8, r8
cmp qword [rdx + 0x18], 8
jb 0x14015f8ba
mov rdx, qword [rdx]
mov rcx, rdi
call fcn.140161530
jmp 0x14015f8d4
mov r8b, 0x78
mov edx, 0x20
mov rcx, rdi
call fcn.1400a5430
mov rax, rdi
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.1400e39a0
mov rbx, qword [rsp + 0x2f0]
add rsp, 0x2c0
pop r14
pop rdi
pop rsi
ret
Function at 0x1401614a0
Capabilities:
Get session user name

Disassembly:
push rbx
sub rsp, 0x240
mov rax, qword [0x1403644c8]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov qword [rsp + 0x20], rdx
lea rcx, [rsp + 0x30]
mov rbx, rdx
mov dword [rsp + 0x20], 0x100
xor edx, edx
mov r8d, 0x200
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov r8d, dword [rsp + 0x20]
lea rdx, [rsp + 0x30]
xor eax, eax
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], rax
mov rcx, rbx
mov word [rbx], ax
call fcn.140086f50
mov rax, rbx
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1400e39a0
add rsp, 0x240
pop rbx
ret

Function at 0x140161710
Capabilities:
Get user security identifier

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [rsp + 0x88]
mov r10, r9
mov r9, qword [rsp + 0x70]
mov r11, r8
mov qword [rsp + 0x30], rax
mov rcx, rdx
mov rax, qword [rsp + 0x80]
mov r8, r10
mov qword [rsp + 0x28], rax
mov rdx, r11
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
setne al
add rsp, 0x40
pop rbx
ret
Function at 0x140164a10
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rax, rdx
mov rbx, rcx
xor ecx, ecx
mov dword [rsp + 0x20], ecx
mov qword [rsp + 0x50], rcx
mov qword [rbx + 0x10], rcx
mov qword [rbx + 0x18], 7
mov word [rbx], cx
mov dword [rsp + 0x20], 1
lea r9, [rsp + 0x50]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
js 0x140164a8e
mov rdx, qword [rsp + 0x50]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x140164a70
mov rcx, rbx
call fcn.140086f50
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x140170140
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov dword [rsp + 0x58], 4
mov dword [r8], eax
lea r9, [rsp + 0x58]
mov rcx, qword [rcx]
mov rbx, r8
mov dword [rsp + 0x40], eax
xor r8d, r8d
lea rax, [rsp + 0x50]
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140170199
mov eax, dword [rsp + 0x40]
mov dword [rbx], eax
mov al, 1
add rsp, 0x30
pop rbx
ret
xor al, al
add rsp, 0x30
pop rbx
ret

Function at 0x1401701b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov qword [r11 - 0x38], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov rbp, r8
mov r15, rdx
mov r12, rcx
xor sil, sil
mov dword [r11 + 0x20], 1
mov dword [rsp + 0x70], 0
lea rax, [r11 + 8]
mov qword [r11 - 0x40], rax
mov qword [r11 - 0x48], 0
lea r9, [r11 + 0x20]
xor r8d, r8d
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401702cf
mov eax, dword [rsp + 0x70]
test eax, eax
je 0x1401702cf
mov ecx, eax
mov eax, 2
mul rcx
mov r14, rax
mov rbx, 0xffffffffffffffff
cmovo r14, rbx
mov rcx, r14
call fcn.1400e3560
mov rdi, rax
test rax, rax
je 0x140170256
mov r8, r14
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
jmp 0x140170258
xor edi, edi
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x88]
xor r8d, r8d
mov rdx, r15
mov rcx, qword [r12]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401702ad
nop dword [rax + rax]
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x140170290
mov r8, rbx
mov rdx, rdi
mov rcx, rbp
call fcn.140086f50
mov sil, 1
jmp 0x1401702c0
xor r8d, r8d
lea rdx, [0x14027add0]
mov rcx, rbp
call fcn.140086f50
nop
test rdi, rdi
je 0x1401702e1
mov rcx, rdi
call fcn.140082ab0
jmp 0x1401702e1
xor r8d, r8d
lea rdx, [0x14027add0]
mov rcx, rbp
call fcn.140086f50
movzx eax, sil
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret