joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140048810
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rax, qword [0x14013aa80]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov dil, 1
cmp qword [rcx + 0x68], 0
je 0x1400488ba
mov rsi, rcx
cmp byte [rcx + 0x71], 0
je 0x1400488ba
mov rax, qword [rsi]
mov rcx, rsi
mov edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x1400488b8
mov rcx, qword [rsi + 0x68]
lea r9, [rsp + 0x50]
lea rdx, [rsi + 0x74]
mov rax, qword [rcx]
lea r8, [rsp + 0x28]
mov qword [rsp + 0x20], r8
lea rdi, [rsp + 0x30]
mov r8, rdi
call qword [rax + 0x40]
cmp eax, 3
je 0x1400488d1
cmp eax, 1
je 0x140048887
test eax, eax
jne 0x1400488b8
mov byte [rsi + 0x71], 0
mov rbx, qword [rsp + 0x28]
sub rbx, rdi
je 0x1400488ae
mov r9, qword [rsi + 0x80]
mov edx, 1
mov rcx, rdi
mov r8, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbx, rax
jne 0x1400488b8
cmp byte [rsi + 0x71], 0
sete dil
jmp 0x1400488ba
xor edi, edi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400d2000
mov eax, edi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
mov byte [rsi + 0x71], 0
mov dil, 1
jmp 0x1400488ba
Function at 0x14004ce10
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x188
mov rdi, r8
mov rsi, rdx
mov r12, rcx
mov rax, qword [0x14013aa80]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov rcx, qword [rcx + 0x38]
mov rax, qword [rcx]
lea r8, [rsp + 0x140]
mov r9d, 0x40
call qword [rax + reloc.WS2_32.dll_recv]
xor r14d, r14d
test al, al
je 0x14004cf90
movzx eax, word [rsp + 0x140]
cmp eax, 0x5a4d
jne 0x14004cf90
mov rcx, qword [r12 + 0x38]
movsxd rdx, dword [rsp + 0x17c]
add rdx, rsi
mov rax, qword [rcx]
lea r8, [rsp + 0x38]
mov r9d, 0x108
call qword [rax + reloc.WS2_32.dll_recv]
xor r14d, r14d
test al, al
je 0x14004cf90
cmp dword [rsp + 0x38], 0x4550
jne 0x14004cf90
mov r14d, dword [rsp + 0xc0]
test r14, r14
je 0x14004cf7f
mov r15d, dword [rsp + 0xc4]
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
mov rcx, qword [r12 + 0x38]
lea rdx, [r14 + rsi]
mov rax, qword [rcx]
mov r8, rbx
mov r9, r15
call qword [rax + reloc.WS2_32.dll_recv]
test al, al
je 0x14004cf7f
mov r12d, dword [rbx + 0x14]
test r12, r12
je 0x14004cf84
mov rbp, rbx
sub rbp, r14
mov eax, dword [rbx + 0x1c]
mov ecx, dword [rbx + 0x24]
mov r13d, dword [rbx + 0x20]
cmp qword [rdi + 0x18], 0x10
jb 0x14004cf17
mov rdi, qword [rdi]
mov qword [rsp + 0x20], rdi
add rax, rbp
mov qword [rsp + 0x30], rax
add rcx, rbp
mov qword [rsp + 0x28], rcx
add r13, rbp
add r15, rbx
xor r14d, r14d
xor edi, edi
jmp 0x14004cf48
inc rdi
cmp r12, rdi
je 0x14004cf87
mov ecx, dword [r13 + rdi*4]
add rcx, rbp
cmp rbx, rcx
ja 0x14004cf40
cmp r15, rcx
jb 0x14004cf40
mov rdx, qword [rsp + 0x20]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
jne 0x14004cf40
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + rdi*2]
mov rcx, qword [rsp + 0x30]
mov r14d, dword [rcx + rax*4]
add r14, rsi
jmp 0x14004cf87
xor r14d, r14d
jmp 0x14004cf90
xor r14d, r14d
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.1400d2000
mov rax, r14
add rsp, 0x188
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140052930
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rsi, rcx
mov rax, qword [0x14013aa80]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea rdx, str.HARDWARERESOURCEMAPSystem_ResourcesPhysical_Memory
xor ebx, ebx
mov rcx, 0xffffffff80000002
xor r8d, r8d
mov r9d, 0x20019
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140052a9d
mov rcx, qword [rsp + 0x58]
lea rdi, [rsp + 0x50]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], 0
lea rdx, str..Translated
lea r9, [rsp + 0x54]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
sete bl
jne 0x140052a92
mov dword [rsp + 0x3c], ebx
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
lea rdx, str..Translated
lea r9, [rsp + 0x54]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [rbx]
test eax, eax
je 0x140052a85
mov r15, rbx
add r15, 0x20
xor r12d, r12d
lea r14, [rsp + 0x40]
jmp 0x140052a20
mov eax, dword [rbx]
inc r12
mov ecx, eax
add r15, 0x24
cmp r12, rcx
jae 0x140052a85
lea rcx, [r12*4]
lea r13, [rcx + rcx*8]
cmp dword [rbx + r13 + 0x10], 0
je 0x140052a12
mov rbp, r15
xor edi, edi
jmp 0x140052a5c
mov rcx, rsi
mov r8, r14
call fcn.1400549f0
inc rdi
mov eax, dword [rbx + r13 + 0x10]
add rbp, 0x14
cmp rdi, rax
jae 0x140052a10
mov rax, qword [rbp - 8]
mov ecx, dword [rbp]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], ecx
mov rdx, qword [rsi + 8]
cmp rdx, qword [rsi + 0x10]
je 0x140052a40
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rdx], xmm0
add qword [rsi + 8], 0x10
jmp 0x140052a4b
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ebx, dword [rsp + 0x3c]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400d2000
mov eax, ebx
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140052ac0
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rcx
mov rax, qword [0x14013aa80]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x2c], 0x20
lea rdx, [rsp + 0x30]
lea r9, [rsp + 0x2c]
mov ecx, reloc.WS2_32.dll_recv
mov r8d, 0x20
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov ebx, dword [rsp + 0x2c]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
test rax, rax
je 0x140052b84
mov rdi, rax
lea r9, [rsp + 0x2c]
mov ecx, reloc.WS2_32.dll_recv
mov rdx, rax
mov r8d, ebx
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
js 0x140052b7b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [rdi]
test rcx, rcx
je 0x140052b7b
shl rcx, 3
lea rdx, [rcx + rcx*2]
xor ecx, ecx
jmp 0x140052b59
add rcx, 0x18
cmp rdx, rcx
je 0x140052b7b
movzx r8d, word [rdi + rcx + 8]
cmp eax, r8d
jne 0x140052b50
cmp word [rdi + rcx + 0xe], si
jne 0x140052b50
mov rsi, qword [rdi + rcx + 0x10]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140052b86
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor esi, esi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400d2000
mov rax, rsi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret

Function at 0x140052ba0
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x60
mov rsi, r8
mov ebx, edx
mov ebp, ecx
mov rax, qword [0x14013aa80]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x2c], 0x20
lea rdx, [rsp + 0x30]
lea r9, [rsp + 0x2c]
mov ecx, 5
mov r8d, 0x20
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov r14d, dword [rsp + 0x2c]
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
test rax, rax
je 0x140052c86
mov rdi, rax
lea r9, [rsp + 0x2c]
mov ecx, 5
mov rdx, rax
mov r8d, r14d
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
js 0x140052c7d
mov eax, ebp
mov ecx, ebx
mov rdx, rdi
jmp 0x140052c2b
mov r8d, dword [rdx]
add rdx, r8
test r8, r8
je 0x140052c7d
cmp qword [rdx + 0x50], rax
jne 0x140052c20
mov r8d, dword [rdx + 4]
test r8, r8
je 0x140052c20
shl r8, 4
lea r8, [r8 + r8*4]
xor r9d, r9d
nop word cs:[rax + rax]
cmp qword [rdx + r9 + 0x130], rcx
je 0x140052c65
add r9, 0x50
cmp r8, r9
jne 0x140052c50
jmp 0x140052c20
mov eax, dword [rdx + r9 + 0x144]
mov dword [rsi], eax
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov sil, 1
jmp 0x140052c88
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor esi, esi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400d2000
mov eax, esi
add rsp, 0x60
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x140052cb0
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rsi, r8
mov r14, rdx
mov r15, rcx
mov rax, qword [0x14013aa80]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x2c], 0x20
lea rdx, [rsp + 0x30]
lea r9, [rsp + 0x2c]
mov ecx, reloc.WS2_32.dll_inet_addr
mov r8d, 0x20
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov ebx, dword [rsp + 0x2c]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
test rax, rax
je 0x140052d75
mov rdi, rax
lea r9, [rsp + 0x2c]
mov ecx, reloc.WS2_32.dll_inet_addr
mov rdx, rax
mov r8d, ebx
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
js 0x140052d6c
cmp dword [rdi], 0
setne bl
je 0x140052d9c
mov rax, qword [rdi + 0x18]
mov qword [r15], rax
mov eax, dword [rdi + 0x20]
mov qword [r14], rax
movzx eax, word [rdi + 0x2e]
lea r14, [rdi + rax]
add r14, 0x30
mov rcx, r14
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov r15, rax
mov rax, qword [rsi + 0x18]
cmp rax, r15
jae 0x140052d79
mov rcx, rsi
mov rdx, r15
mov r9, r14
call fcn.1400038c0
jmp 0x140052d9c
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor ebx, ebx
jmp 0x140052da5
mov r12, rsi
cmp rax, 0x10
jb 0x140052d85
mov r12, qword [rsi]
mov qword [rsi + 0x10], r15
mov rcx, r12
mov rdx, r14
mov r8, r15
call sub.VCRUNTIME140.dll_memmove
mov byte [r12 + r15], 0
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400d2000
mov eax, ebx
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x140053a00
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rcx
mov rax, qword [0x14013aa80]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x2c], 0x20
lea rdx, [rsp + 0x30]
lea r9, [rsp + 0x2c]
mov ecx, reloc.WS2_32.dll_inet_addr
mov r8d, 0x20
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov ebx, dword [rsp + 0x2c]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
test rax, rax
je 0x140053ac9
mov rdi, rax
lea r9, [rsp + 0x2c]
mov ecx, reloc.WS2_32.dll_inet_addr
mov rdx, rax
mov r8d, ebx
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
js 0x140053ac0
cmp dword [rdi], 0
je 0x140053ac0
mov rbx, rdi
add rbx, 0x30
xor r14d, r14d
mov r15, qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strnicmp]
nop word cs:[rax + rax]
cmp qword [rsi + 0x18], 0x10
mov rdx, rsi
jb 0x140053a9d
mov rdx, qword [rsi]
mov r8, qword [rsi + 0x10]
movzx ecx, word [rbx - 2]
add rcx, rbx
call r15
test eax, eax
je 0x140053ae7
inc r14
mov eax, dword [rdi]
add rbx, 0x128
cmp r14, rax
jb 0x140053a90
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor esi, esi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400d2000
mov rax, rsi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov rsi, qword [rbx - 0x18]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140053acb
Function at 0x140053e00
Capabilities:
Enumerate pe sections

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov rsi, rcx
mov rax, qword [0x14013aa80]
xor rax, rsp
mov qword [rsp + 0x50], rax
lea rcx, [0x14011c55e]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp qword [rsi + 0x18], 0x10
jb 0x140053e39
mov rsi, qword [rsi]
mov rcx, rax
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140053fa0
cmp byte [rax + 3], 0xb8
jne 0x140053fa0
mov eax, dword [rax + 4]
movups xmm0, xmmword [0x1400de3df]
movups xmmword [rsp + 0x3f], xmm0
movaps xmm0, xmmword [0x1400de3d0]
movaps xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x45], eax
mov rax, qword [0x14013b970]
movsxd rdx, dword [rax + 0x3c]
movzx ecx, word [rax + rdx + 6]
test rcx, rcx
je 0x140053fa0
lea r8, [rax + rdx]
movzx edx, word [rax + rdx + 0x14]
add r8, rdx
add r8, 0x18
mov rdx, qword [0x14013b978]
mov qword [rsp + 0x28], rdx
add rax, 2
xor r10d, r10d
jmp 0x140053ecc
test r14b, 1
jne 0x140053fc3
nop
inc r10
cmp r10, rcx
je 0x140053fa0
lea rdx, [r10 + r10*4]
mov r9d, dword [r8 + rdx*8 + 0x24]
mov r11d, 0x22000000
and r9d, r11d
cmp r9d, 0x20000000
jne 0x140053ec0
lea rdx, [r8 + rdx*8]
mov r11d, dword [rdx + 8]
cmp r11, 0x1e
je 0x140053ec0
add r11, 0xffffffffffffffe2
cmp r11, 2
mov edi, 1
cmovae rdi, r11
mov ebx, dword [rdx + 0xc]
mov r14b, 1
mov ebp, ebx
xor r15d, r15d
jmp 0x140053f37
test sil, 1
jne 0x140053eb5
inc r15
cmp r15, r11
setb r14b
inc ebp
cmp r15, rdi
je 0x140053ec0
mov r13d, ebp
add r13, rax
lea r12d, [rbx + r15]
xor esi, esi
xor edx, edx
jmp 0x140053f65
cmp rdx, 0x1b
lea r9, [rdx + 3]
setae sil
mov rdx, r9
cmp r9, 0x1e
je 0x140053f20
movzx r9d, byte [rsp + rdx + 0x30]
cmp r9b, 0xff
je 0x140053f78
cmp r9b, byte [r13 + rdx - 2]
jne 0x140053f20
movzx r9d, byte [rsp + rdx + 0x31]
cmp r9b, 0xff
je 0x140053f8b
cmp r9b, byte [r13 + rdx - 1]
jne 0x140053f26
movzx r9d, byte [rsp + rdx + 0x32]
cmp r9b, 0xff
je 0x140053f50
cmp r9b, byte [r13 + rdx]
je 0x140053f50
jmp 0x140053f26
xor esi, esi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400d2000
mov rax, rsi
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov eax, r12d
mov rsi, qword [rsp + 0x28]
add rsi, rax
jmp 0x140053fa2
Function at 0x140079040
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x30
cmp byte [rcx + 0xa38], 0
je 0x140079107
mov rsi, r9
mov rdi, r8
mov ebp, edx
mov rbx, rcx
cmp qword [rcx + 0x268], 0
je 0x1400790b3
mov rcx, rbx
call fcn.140085af0
mov r14d, eax
mov rcx, rbx
mov dl, 1
call fcn.140085ac0
mov rax, qword [rbx + 0x1e0]
mov qword [rsp + 0x20], rax
mov rcx, rbx
mov edx, ebp
mov r8, rdi
mov r9, rsi
call qword [rbx + 0x268]
mov rcx, rbx
mov edx, r14d
add rsp, 0x30
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
jmp fcn.140085ac0
cmp ebp, 2
ja 0x140079107
mov r9, qword [rbx + 0x1d8]
mov eax, ebp
lea rax, [rax + rax*2]
lea rcx, [0x1400ffbc0]
add rcx, rax
mov r14, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov edx, 2
mov r8d, 1
call r14
mov r9, qword [rbx + 0x1d8]
mov r8d, 1
mov rcx, rdi
mov rdx, rsi
mov rax, r14
add rsp, 0x30
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
jmp rax
nop
add rsp, 0x30
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x14007bc70
Capabilities:
Initialize winsock library

Disassembly:
push rsi
sub rsp, 0x1d0
mov rax, qword [0x14013aa80]
xor rax, rsp
mov qword [rsp + 0x1c8], rax
test cl, 2
jne 0x14007bd06
call fcn.1400adc30
mov esi, eax
test eax, eax
jne 0x14007bd34
lea rcx, str.iphlpapi.dll
call fcn.14007bd50
mov qword [0x14013bb68], rax
test rax, rax
je 0x14007bcd2
lea rdx, str.if_nametoindex
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14007bcd2
mov qword [0x14013bb60], rax
mov dword [rsp + 0x20], 3
xor esi, esi
mov ecx, 6
xor edx, edx
xor r8d, r8d
mov r9d, 2
call fcn.1400adea0
mov byte [0x14013bb70], al
lea rcx, [0x14013bb78]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
jmp 0x14007bd34
lea rdx, [rsp + 0x30]
mov cx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x14007bd2f
movzx eax, word [rsp + 0x30]
cmp eax, 0x202
je 0x14007bc8f
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov esi, 2
mov rcx, qword [rsp + 0x1c8]
xor rcx, rsp
call fcn.1400d2000
mov eax, esi
add rsp, 0x1d0
pop rsi
ret

Function at 0x14007bd50
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x14007bdb0
mov rdi, rax
lea rdx, [0x14011fce1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rdx, [0x140120a4e]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strpbrk]
test rax, rax
je 0x14007bdc1
test rbx, rbx
je 0x14007bdfa
mov rax, rbx
mov rcx, rsi
xor edx, edx
mov r8d, 8
jmp 0x14007bdec
xor ebx, ebx
mov rax, rbx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov r15, rbx
test rbx, rbx
je 0x14007be0f
lea rdx, str.AddDllDirectory
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14007be0f
mov rcx, rsi
xor edx, edx
mov r8d, 0x800
mov rax, r15
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp rax
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp qword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor ebx, ebx
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x14007bdb2
mov r14d, eax
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
lea ecx, [r14 + 1]
add rcx, rax
call qword [str.0__r_]
mov rdi, rax
test rax, rax
je 0x14007be88
mov rcx, rdi
mov edx, r14d
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x14007be88
mov rcx, rdi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov word [rdi + rax], 0x5c
mov rcx, rdi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rcx, rdi
add rcx, rax
mov rdx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy
mov rcx, rdi
test r15, r15
je 0x14007be8c
xor edx, edx
mov r8d, 8
call r15
jmp 0x14007be92
xor ebx, ebx
jmp 0x14007be95
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
mov rcx, rdi
call qword [0x140136438]
jmp 0x14007bdb2
Function at 0x14008c0e0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
test rcx, rcx
je 0x14008c0f8
mov rsi, rcx
call fcn.1400aefd0
test al, al
je 0x14008c0ff
xor eax, eax
jmp 0x14008c18a
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rdi, rax
mov rcx, rsi
mov edx, 0x2e
mov r8, rax
call fcn.1400be1d0
test rax, rax
je 0x14008c142
sub rax, rsi
mov rcx, rsi
mov edx, 0x2e
mov r8, rax
call fcn.1400be1d0
test rax, rax
je 0x14008c142
inc rax
add rdi, rsi
sub rdi, rax
jmp 0x14008c144
xor eax, eax
test rax, rax
cmovne rsi, rax
test rdi, rdi
jle 0x14008c185
add rdi, rsi
mov eax, 0x1505
nop dword [rax + rax]
mov rbx, rax
shl rbx, 5
add rbx, rax
movzx ecx, byte [rsi]
inc rsi
call fcn.140090fd0
movzx eax, al
xor rax, rbx
cmp rsi, rdi
jb 0x14008c160
movzx eax, al
jmp 0x14008c18a
mov eax, 5
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x140090ff0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
test rcx, rcx
je 0x140091047
test rdx, rdx
je 0x140091047
movzx eax, byte [rcx]
test al, al
je 0x140091034
inc rcx
lea r8, [0x140100110]
nop dword [rax + rax]
movzx r9d, byte [rdx]
test r9, r9
je 0x140091036
movzx eax, al
movzx eax, byte [rax + r8]
cmp al, byte [r9 + r8]
jne 0x140091051
inc rdx
movzx eax, byte [rcx]
inc rcx
test al, al
jne 0x140091010
xor eax, eax
test al, al
setne cl
cmp byte [rdx], 0
sete al
xor al, cl
movzx eax, al
ret
or rcx, rdx
sete al
movzx eax, al
ret
xor eax, eax
movzx eax, al
ret

Function at 0x140091740
Capabilities:
Generate random numbers via winapi

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rax, qword [0x14013aa80]
xor rax, rsp
mov qword [rsp + 0x30], rax
test r8, r8
je 0x140091886
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
lea r14, [rsp + 0x2c]
jmp 0x140091789
sub rsi, r15
je 0x14009188d
cmp rsi, 4
mov r15d, 4
cmovb r15, rsi
mov r8d, 4
mov rcx, rbx
mov rdx, r14
call fcn.14007a340
test eax, eax
je 0x1400917e2
mov ebp, eax
cmp eax, 4
jne 0x14009188f
mov dword [rsp + 0x2c], 0
mov ebp, 2
xor ecx, ecx
mov rdx, r14
mov r8d, 4
mov r9d, 2
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
jne 0x14009188f
mov eax, dword [rsp + 0x2c]
lea rdx, [r15 - 1]
mov rcx, r15
and rcx, 3
je 0x140091830
xor r8d, r8d
nop word cs:[rax + rax]
mov byte [rdi + r8], al
mov eax, dword [rsp + 0x2c]
shr eax, 8
mov dword [rsp + 0x2c], eax
inc r8
cmp rcx, r8
jne 0x140091800
mov rcx, r15
sub rcx, r8
add rdi, r8
cmp rdx, 3
jae 0x140091840
jmp 0x140091780
mov rcx, r15
cmp rdx, 3
jb 0x140091780
nop dword [rax]
mov byte [rdi], al
mov eax, dword [rsp + 0x2c]
shr eax, 8
mov dword [rsp + 0x2c], eax
mov byte [rdi + 1], al
mov eax, dword [rsp + 0x2c]
shr eax, 8
mov dword [rsp + 0x2c], eax
mov byte [rdi + 2], al
mov eax, dword [rsp + 0x2c]
shr eax, 8
mov dword [rsp + 0x2c], eax
mov byte [rdi + 3], al
add rdi, 4
mov eax, dword [rsp + 0x2c]
shr eax, 8
mov dword [rsp + 0x2c], eax
add rcx, 0xfffffffffffffffc
jne 0x140091840
jmp 0x140091780
mov ebp, 0x2b
jmp 0x14009188f
xor ebp, ebp
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400d2000
mov eax, ebp
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400918b0
Capabilities:
Generate random numbers via winapi

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb8
mov rax, qword [0x14013aa80]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rax, r8
and rax, 0xffffffffffffff01
mov ebp, 0x2b
cmp rax, 1
jne 0x140091a74
mov rdi, r8
dec rdi
cmp rdi, 2
jb 0x140091a74
mov rsi, rdx
mov rbx, rcx
mov r15, rdi
shr r15, 1
lea r12, [rsp + 0x30]
lea r14, [rsp + 0x2c]
jmp 0x140091929
sub r15, r13
je 0x140091a2e
cmp r15, 4
mov r13d, 4
cmovb r13, r15
mov r8d, 4
mov rcx, rbx
mov rdx, r14
call fcn.14007a340
test eax, eax
je 0x140091982
mov ebp, eax
cmp eax, 4
jne 0x140091a74
mov dword [rsp + 0x2c], 0
mov ebp, 2
xor ecx, ecx
mov rdx, r14
mov r8d, 4
mov r9d, 2
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
jne 0x140091a74
mov eax, dword [rsp + 0x2c]
lea rdx, [r13 - 1]
mov rcx, r13
and rcx, 3
je 0x1400919d0
xor r8d, r8d
nop word cs:[rax + rax]
mov byte [r12 + r8], al
mov eax, dword [rsp + 0x2c]
shr eax, 8
mov dword [rsp + 0x2c], eax
inc r8
cmp rcx, r8
jne 0x1400919a0
mov rcx, r13
sub rcx, r8
add r12, r8
cmp rdx, 3
jae 0x1400919e0
jmp 0x140091920
mov rcx, r13
cmp rdx, 3
jb 0x140091920
nop dword [rax]
mov byte [r12], al
mov eax, dword [rsp + 0x2c]
shr eax, 8
mov dword [rsp + 0x2c], eax
mov byte [r12 + 1], al
mov eax, dword [rsp + 0x2c]
shr eax, 8
mov dword [rsp + 0x2c], eax
mov byte [r12 + 2], al
mov eax, dword [rsp + 0x2c]
shr eax, 8
mov dword [rsp + 0x2c], eax
mov byte [r12 + 3], al
add r12, 4
mov eax, dword [rsp + 0x2c]
shr eax, 8
mov dword [rsp + 0x2c], eax
add rcx, 0xfffffffffffffffc
jne 0x1400919e0
jmp 0x140091920
lea rcx, [rsp + 0x30]
xor eax, eax
lea rdx, str.0123456789abcdef
nop dword [rax]
movzx r8d, byte [rcx]
mov r9, r8
shr r9, 4
movzx r9d, byte [r9 + rdx]
mov byte [rsi + rax], r9b
and r8d, 0xf
movzx r8d, byte [r8 + rdx]
mov byte [rsi + rax + 1], r8b
inc rcx
add rax, 2
cmp rdi, rax
jne 0x140091a40
mov byte [rsi + rax], 0
xor ebp, ebp
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1400d2000
mov eax, ebp
add rsp, 0xb8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14009ed00
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
call fcn.14009b9c0
mov ebx, dword [rdi + 0x54]
mov ecx, dword [rdi + 0x58]
cmp ebx, ecx
jle 0x14009ed28
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
mov eax, dword [rdi + 0x50]
jmp 0x14009ed39
lea edx, [rbx + 1]
cmp ebx, ecx
mov ebx, edx
jge 0x14009ed1e
mov r14d, dword [rdi + 0x4c]
cmp r14d, eax
jg 0x14009ed30
nop word cs:[rax + rax]
mov rcx, rsi
mov edx, r14d
mov r8d, ebx
call fcn.1400a0650
xor byte [rax], 8
lea ecx, [r14 + 1]
mov eax, dword [rdi + 0x50]
cmp r14d, eax
mov r14d, ecx
jl 0x14009ed50
mov ecx, dword [rdi + 0x58]
jmp 0x14009ed30