joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180005910
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov r15d, dword [r8]
mov r12, qword [rsp + 0x90]
xor edi, edi
lea eax, [r15 + 1]
mov r14, r9
mov rbp, rdx
mov rsi, rcx
mov dword [r8], eax
test r9, r9
je 0x180005970
mov r8, qword [rdx + 0x38]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], rdi
lea edx, [rdi + 1]
mov r9d, r15d
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
call r14
test eax, eax
je 0x180005aac
cmp rsi, 0xffffffffffffffff
je 0x180005aac
lea r9, [rsp + 0x78]
lea rdx, [0x180054294]
mov r8d, 1
mov rcx, rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180005aac
cmp dword [rsp + 0x78], 1
jne 0x180005aac
mov rdx, qword [rbp + 0x38]
mov ebx, edi
mov rax, rdx
test rdx, rdx
je 0x1800059cb
cmp byte [rdx], bl
je 0x1800059cb
nop
lea rax, [rax + 1]
inc ebx
cmp byte [rax], dil
jne 0x1800059c0
lea r9, [rsp + 0x78]
mov r8d, ebx
mov rcx, rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180005aac
cmp ebx, dword [rsp + 0x78]
jne 0x180005aac
lea r9, [rsp + 0x78]
lea rdx, [0x180054298]
mov r8d, 3
mov rcx, rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180005aac
cmp dword [rsp + 0x78], 3
jne 0x180005aac
mov rax, qword [rbp + 0x40]
mov dword [rsp + 0x78], edi
mov rbx, qword [rax + 0x10]
test rbx, rbx
je 0x180005a76
nop word [rax + rax]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], r12
mov r9, rbx
mov r8d, r15d
mov rdx, rbp
mov rcx, rsi
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rax
call fcn.180005ad0
test eax, eax
je 0x180005a81
mov rax, qword [rbx + 0x18]
mov rbx, qword [rax + 0x10]
test rbx, rbx
jne 0x180005a40
test r14, r14
jne 0x180005a85
lea edi, [r14 + 1]
jmp 0x180005aac
xor eax, eax
jmp 0x180005aae
mov r8, qword [rbp + 0x38]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], rdi
mov r9d, r15d
mov edx, 4
mov rcx, rsi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
call r14
mov edi, eax
mov eax, edi
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x180005ad0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
push r13
sub rsp, 0x48
mov rdi, r9
mov r9, qword [r9 + 0x40]
xor ebx, ebx
mov r13, rdx
mov rsi, rcx
mov rax, r9
test r9, r9
je 0x180005b10
mov r10d, ebx
cmp byte [r9], bl
je 0x180005b10
nop dword [rax]
lea rax, [rax + 1]
inc r10d
cmp byte [rax], bl
jne 0x180005b00
test r10d, r10d
jne 0x180005b2d
mov rax, qword [rdi + 0x30]
mov rcx, qword [rax + 0x30]
test byte [rcx + 0xc], 0x20
je 0x180005b2d
mov eax, 1
add rsp, 0x48
pop r13
pop rdi
pop rsi
pop rbx
ret
mov rcx, qword [rsp + 0x90]
mov qword [rsp + 0x70], rbp
mov rbp, qword [rsp + 0x98]
mov qword [rsp + 0x78], r12
mov r12, qword [rsp + 0xa0]
mov qword [rsp + 0x80], r14
test r9, r9
mov qword [rsp + 0x40], r15
mov r15d, dword [rcx]
lea eax, [r15 + 1]
lea r14, [0x18005429c]
cmovne r14, r9
mov dword [rcx], eax
mov rax, qword [rdi + 0x38]
test rbp, rbp
je 0x180005ba9
mov qword [rsp + 0x38], r12
mov r9d, r8d
mov r8, qword [rdx + 0x38]
mov qword [rsp + 0x30], r14
mov edx, 2
mov rcx, rsi
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rax
call rbp
test eax, eax
je 0x180005ca3
mov rdx, qword [rdi + 0x38]
mov edi, ebx
mov rax, rdx
test rdx, rdx
je 0x180005bca
cmp byte [rdx], bl
je 0x180005bca
nop dword [rax + rax]
lea rax, [rax + 1]
inc edi
cmp byte [rax], bl
jne 0x180005bc0
cmp rsi, 0xffffffffffffffff
je 0x180005ca3
lea r9, [rsp + 0x88]
mov r8d, edi
mov rcx, rsi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180005ca3
cmp edi, dword [rsp + 0x88]
jne 0x180005ca3
lea r9, [rsp + 0x88]
lea rdx, [0x1800542a0]
mov r8d, 3
mov rcx, rsi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180005ca3
cmp dword [rsp + 0x88], 3
jne 0x180005ca3
mov rdx, r14
mov rcx, rsi
call fcn.180005cd0
test eax, eax
je 0x180005ca3
lea r9, [rsp + 0x88]
lea rdx, [0x1800542a4]
mov r8d, 2
mov rcx, rsi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180005ca3
cmp dword [rsp + 0x88], 2
jne 0x180005ca3
test rbp, rbp
jne 0x180005c7d
lea ebx, [rbp + 1]
jmp 0x180005ca3
mov r8, qword [r13 + 0x38]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], rbx
mov r9d, r15d
mov edx, 4
mov rcx, rsi
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
call rbp
mov ebx, eax
mov r15, qword [rsp + 0x40]
mov r14, qword [rsp + 0x80]
mov r12, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x70]
mov eax, ebx
add rsp, 0x48
pop r13
pop rdi
pop rsi
pop rbx
ret
Function at 0x180005cd0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rdi
push r14
push r15
sub rsp, 0x30
xor r15d, r15d
mov rdi, rdx
mov ebp, 1
movzx eax, byte [rdi]
mov r14, rcx
mov ebx, r15d
mov r8d, ebp
mov r10d, r15d
mov edx, r15d
mov r9, rdi
test al, al
je 0x180005e99
lea r11, [0x180054110]
nop dword [rax + rax]
movzx eax, al
movzx ecx, byte [rax + r11]
cmp cl, 8
jne 0x180005d26
test r8d, r8d
jne 0x180005d4b
mov edx, ebp
jmp 0x180005d38
cmp cl, 5
je 0x180005d4b
cmp cl, bpl
jne 0x180005d35
test r8d, r8d
jne 0x180005d4b
mov edx, r15d
movzx eax, byte [r9 + 1]
inc r9
inc ebx
mov r8d, r15d
test al, al
jne 0x180005d10
jmp 0x180005d4e
mov r10d, ebp
test edx, edx
jne 0x180005d5b
test r10d, r10d
je 0x180005e99
cmp r14, 0xffffffffffffffff
je 0x180005e8b
lea r9, [rsp + 0x68]
lea rdx, [0x1800542a8]
mov r8d, ebp
mov rcx, r14
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180005e8b
cmp dword [rsp + 0x68], ebp
jne 0x180005e8b
movzx eax, byte [rdi]
mov qword [rsp + 0x60], rsi
mov rbx, rdi
test al, al
je 0x180005e4e
cmp al, 0x22
jne 0x180005e06
cmp rdi, rbx
je 0x180005dd7
mov esi, ebx
lea r9, [rsp + 0x68]
mov rdx, rdi
sub esi, edi
mov rcx, r14
mov qword [rsp + 0x20], r15
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180005e3b
cmp esi, dword [rsp + 0x68]
jne 0x180005e3b
lea r9, [rsp + 0x70]
lea rdx, [0x1800542ac]
mov r8d, 2
mov rcx, r14
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180005e3b
cmp dword [rsp + 0x70], 2
jne 0x180005e3b
lea rdi, [rbx + 1]
movzx eax, byte [rbx + 1]
inc rbx
test al, al
jne 0x180005da7
cmp rbx, rdi
jbe 0x180005e4e
sub ebx, edi
lea r9, [rsp + 0x68]
mov rdx, rdi
mov rcx, r14
mov r8d, ebx
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180005e3b
cmp ebx, dword [rsp + 0x68]
je 0x180005e4e
xor eax, eax
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rbp
pop rbx
ret
lea r9, [rsp + 0x68]
lea rdx, [0x1800542a8]
mov r8d, ebp
mov rcx, r14
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180005e75
cmp dword [rsp + 0x68], ebp
je 0x180005e78
mov ebp, r15d
mov eax, ebp
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rbp
pop rbx
ret
xor eax, eax
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rbp
pop rbx
ret
cmp r14, 0xffffffffffffffff
je 0x180005ec2
lea r9, [rsp + 0x68]
mov r8d, ebx
mov rdx, rdi
mov rcx, r14
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180005ec2
cmp ebx, dword [rsp + 0x68]
je 0x180005ec5
mov ebp, r15d
mov eax, ebp
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rbp
pop rbx
ret
Function at 0x1800065c0
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x50
xor r15d, r15d
mov r14, r9
mov rsi, r8
mov rax, rdx
mov rbp, rcx
mov edi, r15d
test rcx, rcx
je 0x180006701
test rdx, rdx
je 0x180006701
mov qword [rsp + 0x30], r15
lea r8d, [r15 + 1]
xor r9d, r9d
mov edx, 0x40000000
mov rcx, rax
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rcx, rax
mov qword [rsp + 0x40], rax
cmp rax, 0xffffffffffffffff
je 0x180006701
mov qword [rsp + 0x78], rbx
test rsi, rsi
je 0x180006661
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
call rsi
test eax, eax
je 0x1800066d7
mov rcx, qword [rsp + 0x40]
mov rax, qword [rbp + 0x18]
mov dword [rsp + 0x70], r15d
mov rbx, qword [rax + 0x10]
test rbx, rbx
je 0x1800066ab
nop dword [rax]
nop word [rax + rax]
lea r8, [rsp + 0x70]
mov r9, rsi
mov rdx, rbx
mov qword [rsp + 0x20], r14
call fcn.180005910
test eax, eax
je 0x1800066d7
mov rax, qword [rbx + 0x18]
mov rcx, qword [rsp + 0x40]
mov rbx, qword [rax + 0x10]
test rbx, rbx
jne 0x180006680
test rsi, rsi
jne 0x1800066b5
lea edi, [rsi + 1]
jmp 0x1800066dc
mov qword [rsp + 0x38], r14
xor r9d, r9d
mov qword [rsp + 0x30], r15
lea edx, [r9 + 5]
xor r8d, r8d
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
call rsi
mov edi, eax
mov rcx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x78]
cmp rcx, 0xffffffffffffffff
je 0x1800066ed
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x1800066fd
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x180006701
mov dword [rbp + 8], r15d
lea r11, [rsp + 0x50]
mov eax, edi
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x180030a10
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x590
mov rax, qword [0x180066020]
xor rax, rsp
mov qword [rsp + 0x580], rax
mov rdi, rdx
mov esi, r8d
mov rbx, rcx
lea rdx, [0x180053ef0]
xor r8d, r8d
mov rcx, rdi
call fcn.180001750
cmp eax, 0x208
jae 0x180030be7
lea r8, [rsp + 0x160]
lea rdx, [0x180053ef0]
mov rcx, rdi
mov qword [rsp + 0x5c8], rbp
call fcn.180001750
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x180030bdf
mov ecx, dword [rsp + 0x20]
test cl, 0x10
je 0x180030b16
lea rdx, [0x180053ee8]
lea rcx, [rsp + 0x4c]
call fcn.1800040c0
test eax, eax
je 0x180030bc0
lea rdx, [0x180053eec]
lea rcx, [rsp + 0x4c]
call fcn.1800040c0
test eax, eax
je 0x180030bc0
lea rdx, [rsp + 0x4c]
xor r8d, r8d
mov rcx, rdi
call fcn.180001750
cmp eax, 0x208
jae 0x180030bc0
lea r8, [rsp + 0x370]
lea rdx, [rsp + 0x4c]
mov rcx, rdi
call fcn.180001750
lea r8d, [rsi + 1]
lea rdx, [rsp + 0x370]
mov rcx, rbx
call fcn.180030a10
jmp 0x180030bc0
test cl, 0x40
jne 0x180030bc0
mov eax, dword [rbx]
cmp eax, 0x3e7
jae 0x180030bd6
cmp dword [rsp + 0x3c], 0
jne 0x180030bc0
cmp dword [rsp + 0x40], 0
jl 0x180030bc0
imul rcx, rax, 0x210
lea rdx, [rsp + 0x4c]
xor r8d, r8d
mov dword [rcx + rbx + 0x38], esi
mov eax, dword [rbx]
imul rcx, rax, 0x210
mov eax, dword [rsp + 0x40]
mov dword [rcx + rbx + 0x3c], eax
mov rcx, rdi
call fcn.180001750
mov edx, dword [rbx + 0x80ca8]
sub eax, edx
cmp eax, 0x208
jae 0x180030bbe
mov eax, dword [rbx]
lea r8, [rbx + 0x40]
imul rcx, rax, 0x210
xor eax, eax
add r8, rcx
cmp esi, 1
lea rcx, [rdi - 1]
setne al
add rcx, rax
add rcx, rdx
lea rdx, [rsp + 0x4c]
call fcn.180001750
mov eax, dword [rbx]
imul rcx, rax, 0x210
add rcx, 0x40
add rcx, rbx
call fcn.180003f80
inc dword [rbx]
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x180030a92
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rbp, qword [rsp + 0x5c8]
mov rcx, qword [rsp + 0x580]
xor rcx, rsp
call fcn.180036b90
add rsp, 0x590
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400018d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, rcx
mov r11, qword [rdx + 8]
mov r10, qword [rdx + 0x10]
lea rcx, [r10 + 1]
mov qword [rdx + 0x10], rcx
mov al, 1
cmp rcx, r11
jae 0x140001911
mov rax, qword [rdx]
movzx edi, byte [rax + rcx]
mov al, 1
cmp edi, 0x2b
je 0x140001906
cmp edi, 0x2d
jne 0x140001911
xor eax, eax
add r10, 2
mov qword [rdx + 0x10], r10
mov rcx, r10
cmp rcx, r11
jae 0x140001aaa
mov rdi, qword [rdx]
movzx r10d, byte [rdi + rcx]
lea rbx, [rcx + 1]
mov qword [rdx + 0x10], rbx
add r10b, 0xd0
cmp r10b, 0xa
jae 0x140001ab5
movzx r10d, r10b
cmp rbx, r11
jae 0x1400019b0
mov ebx, 1
sub rbx, r11
add rcx, 2
jmp 0x14000196c
movzx r11d, r11b
lea r10d, [r10 + r10*4]
lea r10d, [r11 + r10*2]
lea r11, [rbx + rcx]
inc r11
inc rcx
cmp r11, 2
je 0x1400019b0
movzx r11d, byte [rdi + rcx - 1]
add r11b, 0xd0
cmp r11b, 0xa
jae 0x1400019b0
mov qword [rdx + 0x10], rcx
cmp r10d, 0xccccccb
jle 0x140001950
cmp r10d, 0xccccccc
jne 0x140001998
cmp r11b, 7
jbe 0x140001950
test r9, r9
sete r9b
mov byte [rsp + 0x20], al
mov rcx, rsi
call fcn.140118390
jmp 0x140001a97
mov ecx, dword [rsp + 0x80]
test al, al
je 0x1400019cc
lea eax, [rcx + r10]
sar eax, 0x1f
add eax, 0x80000000
add ecx, r10d
jmp 0x1400019dc
xor eax, eax
cmp ecx, r10d
setns al
add eax, 0x7fffffff
sub ecx, r10d
cmovo ecx, eax
movq xmm1, r9
punpckldq xmm1, xmmword [0x14011f000]
subpd xmm1, xmmword [0x14011f010]
movapd xmm0, xmm1
unpckhpd xmm0, xmm1
addsd xmm0, xmm1
mov eax, ecx
neg eax
cmovs eax, ecx
cmp eax, 0x135
jb 0x140001a48
xorpd xmm1, xmm1
movsd xmm2, qword [0x14011f020]
nop word [rax + rax]
ucomisd xmm0, xmm1
jne 0x140001a28
jnp 0x140001a80
test ecx, ecx
jns 0x140001adb
divsd xmm0, xmm2
add ecx, 0x134
mov eax, ecx
neg eax
cmovs eax, ecx
cmp eax, 0x134
ja 0x140001a20
mov eax, eax
mov r9, qword [section..data]
movsd xmm1, qword [r9 + rax*8]
test ecx, ecx
js 0x140001a9f
mulsd xmm0, xmm1
movq rax, xmm0
movabs rcx, 0x7fffffffffffffff
and rcx, rax
movabs rax, 0x7ff0000000000000
cmp rcx, rax
je 0x140001adb
test r8b, r8b
jne 0x140001a8d
xorpd xmm0, xmmword [0x14011f030]
movsd qword [rsi + 8], xmm0
xor eax, eax
mov qword [rsi], rax
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
divsd xmm0, xmm1
test r8b, r8b
je 0x140001a85
jmp 0x140001a8d
mov qword [rsp + 0x28], 5
jmp 0x140001abe
mov qword [rsp + 0x28], 0xd
lea rax, [rsp + 0x28]
mov rcx, rdx
mov rdx, rax
call fcn.140118430
mov qword [rsi + 8], rax
mov qword [rsi], 1
jmp 0x140001a97
mov qword [rsp + 0x28], 0xe
lea rax, [rsp + 0x28]
mov rcx, rdx
mov rdx, rax
call fcn.140118430
mov qword [rsi + 8], rax
mov eax, 1
jmp 0x140001a94
Function at 0x140007bb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0x70]
mov qword [rbp], 0xfffffffffffffffe
mov r15, r8
mov rsi, rcx
mov rdi, qword [r8]
mov rcx, qword [r8 + 0x10]
test rcx, rcx
je 0x140007c91
mov rbx, rdx
mov edx, ecx
and edx, 7
cmp rcx, 8
jae 0x140007bf4
xor eax, eax
mov r8, rdi
jmp 0x140007c49
mov r9, rcx
and r9, 0xfffffffffffffff8
xor eax, eax
mov r8, rdi
movzx r10d, byte [r8]
add r10, rax
movzx eax, byte [r8 + 1]
movzx r11d, byte [r8 + 2]
add r11, rax
add r11, r10
movzx eax, byte [r8 + 3]
movzx r10d, byte [r8 + 4]
add r10, rax
movzx r14d, byte [r8 + 5]
add r14, r10
add r14, r11
movzx r10d, byte [r8 + 6]
movzx eax, byte [r8 + 7]
add r8, 8
add rax, r10
add rax, r14
add r9, 0xfffffffffffffff8
jne 0x140007c00
test rdx, rdx
je 0x140007c70
xor r9d, r9d
nop word cs:[rax + rax]
movzx r10d, byte [r8 + r9]
add rax, r10
inc r9
cmp rdx, r9
jne 0x140007c60
xor rax, qword [rbx + 8]
xor edx, edx
div rcx
movzx eax, byte [rdi + rdx]
lea r14d, [rax - 0x30]
cmp r14b, 0xa
jb 0x140007cb5
lea r8d, [rax - 0x57]
cmp r8b, 0xe9
ja 0x140007cb0
lea rax, [0x140120239]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], 0x1f
mov qword [rsi], 0
jmp 0x140007d95
add al, 0xc9
mov r14d, eax
mov qword [rbp - 0x10], r15
lea rax, [rdx + 1]
sub rcx, rax
lea rax, [rdi + rdx]
inc rax
mov qword [rbp - 0x30], rdi
mov qword [rbp - 0x28], rdx
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rcx
lea rcx, [rbp - 0x48]
lea rdx, [rbp - 0x30]
mov r8d, 2
call fcn.1400094f0
mov r8, qword [rbp - 0x48]
mov r9, qword [rbp - 0x38]
lea rdx, [0x140120038]
lea rcx, [rbp - 0x30]
mov qword [rbp - 8], r8
call fcn.14000a2e0
mov rax, qword [rbp - 0x30]
test rax, rax
je 0x140007d5f
movups xmm0, xmmword [rbp - 0x28]
mov byte [rbp - 0x30], r14b
mov qword [rbp - 0x28], rax
movups xmmword [rbp - 0x20], xmm0
lea r8, [rbp - 0x30]
mov rcx, rsi
mov rdx, rbx
call fcn.14000de70
mov rdx, qword [rbp - 0x40]
test rdx, rdx
je 0x140007d46
mov r8d, 1
mov rcx, qword [rbp - 8]
call fcn.14000a790
mov rdx, qword [rbp - 0x20]
test rdx, rdx
mov r15, qword [rbp - 0x10]
je 0x140007d95
mov rcx, qword [rbp - 0x28]
mov r8d, 1
jmp 0x140007d90
lea rax, [0x140120239]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], 0x1f
mov qword [rsi], 0
mov rdx, qword [rbp - 0x40]
test rdx, rdx
mov r15, qword [rbp - 0x10]
je 0x140007d95
mov r8d, 1
mov rcx, qword [rbp - 8]
call fcn.14000a790
mov rdx, qword [r15 + 8]
test rdx, rdx
je 0x140007dac
mov r8d, 1
mov rcx, rdi
call fcn.14000a790
mov rax, rsi
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
Function at 0x140009220
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], 8
mov r10, qword [rcx + 0x40]
test r10, r10
je 0x140009267
mov esi, 8
mov r9d, 8
sub r9, r10
cmp r9, 8
cmovb rsi, r9
cmp rsi, 3
jbe 0x14000926f
mov r11d, dword [rdx]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, rsi
jb 0x140009281
jmp 0x140009298
xor r9d, r9d
jmp 0x140009325
xor r11d, r11d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, rsi
jae 0x140009298
movzx edi, word [rdx + r8]
lea ecx, [r8*8]
shl rdi, cl
or r11, rdi
or r8, 2
cmp r8, rsi
jae 0x1400092af
movzx esi, byte [rdx + r8]
shl r8d, 3
mov ecx, r8d
shl rsi, cl
or r11, rsi
lea ecx, [r10*8]
shl r11, cl
or r11, qword [rax + 0x38]
mov qword [rax + 0x38], r11
cmp r10, 8
jbe 0x1400092d1
add r10, 8
jmp 0x14000940a
mov r10, qword [rax + 0x18]
mov r8, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r8
rol r8, 0xd
xor r10, r11
xor r8, rcx
rol rcx, 0x20
mov rsi, qword [rax + 8]
add rsi, r10
rol r10, 0x10
xor r10, rsi
add rcx, r10
rol r10, 0x15
xor r10, rcx
add rsi, r8
rol r8, 0x11
mov qword [rax + 0x18], r10
xor r8, rsi
rol rsi, 0x20
mov qword [rax + 0x10], r8
mov qword [rax + 8], rsi
xor rcx, r11
mov qword [rax], rcx
mov ecx, 8
sub rcx, r9
mov r10d, ecx
and r10d, 7
and rcx, 0xfffffffffffffff8
cmp r9, rcx
jae 0x1400093a2
mov r8, qword [rax]
mov r11, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop dword [rax]
add r8, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r9]
xor rsi, r8
rol r8, 0x20
xor rdi, rbx
add r11, rdi
rol rdi, 0x10
xor rdi, r11
add r8, rdi
rol rdi, 0x15
add r11, rsi
rol rsi, 0x11
xor rsi, r11
rol r11, 0x20
xor rdi, r8
xor r8, rbx
add r9, 8
cmp r9, rcx
jb 0x140009350
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r11
mov qword [rax], r8
cmp r10d, 3
jbe 0x1400093c0
mov r11d, dword [rdx + r9]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r10
jb 0x1400093d2
jmp 0x1400093ec
xor r11d, r11d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r10
jae 0x1400093ec
lea rcx, [r8 + r9]
movzx esi, word [rdx + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r11, rsi
or r8, 2
cmp r8, r10
jae 0x140009406
add r9, r8
movzx edx, byte [rdx + r9]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r11, rdx
mov qword [rax + 0x38], r11
mov qword [rax + 0x40], r10
pop rbx
pop rdi
pop rsi
ret
Function at 0x14000aa20
Capabilities:
Get session user name

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0x70]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rcx
mov dword [rbp - 4], 0
lea rdx, [rbp - 4]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x14000ab4a
mov ebx, dword [rbp - 4]
test rbx, rbx
je 0x14000aa87
lea rdi, [rbx + rbx]
movzx eax, byte [0x1401e1329]
mov edx, 2
mov rcx, rdi
call fcn.14000a780
test rax, rax
jne 0x14000aa8c
mov ecx, 2
mov rdx, rdi
call fcn.14011cc30
ud2
mov eax, 2
mov qword [rbp - 0x18], rbx
mov dword [rbp - 4], ebx
lea rdx, [rbp - 4]
mov qword [rbp - 0x10], rax
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x14000aae8
mov eax, dword [rbp - 4]
lea r8, [rax - 1]
test rax, rax
cmove r8, rax
mov rcx, rsi
mov rdx, qword [rbp - 0x10]
call fcn.1400ec4a0
mov rdx, qword [rbp - 0x18]
test edx, edx
je 0x14000aadc
add rdx, rdx
mov r8d, 2
mov rcx, qword [rbp - 0x10]
call fcn.14000a790
mov rax, rsi
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop rbp
ret
movzx eax, byte [0x1401e1329]
mov ecx, 7
mov edx, 1
call fcn.14000a780
test rax, rax
je 0x14000ab64
mov dword [rax + 3], 0x6e776f6e
mov dword [rax], 0x6e6b6e75
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 7
mov qword [rbp - 0x20], 7
lea rcx, [rbp - 0x50]
lea rdx, [rbp - 0x30]
call fcn.1400f3710
movups xmm0, xmmword [rbp - 0x50]
movups xmm1, xmmword [rbp - 0x40]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rdx, qword [rbp - 0x18]
test edx, edx
jne 0x14000aaca
jmp 0x14000aadc
lea rcx, str.assertion_failed:_successC:Users_noctu.cargo_registry_srcindex.crates.io_6f17d22bba15001fwhoami_1.4.1_srcwindows.rsi_v
lea r8, [0x140120bc8]
mov edx, 0x19
call fcn.14011ce20
ud2
mov ecx, 1
mov edx, 7
call fcn.14011cc30
ud2
Function at 0x14000abb0
Capabilities:
Get hostname

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x98
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x10], 0xfffffffffffffffe
mov rsi, rcx
mov dword [rbp + 0xc], 0
lea r8, [rbp + 0xc]
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
mov ebx, dword [rbp + 0xc]
test rbx, rbx
je 0x14000ac17
lea rdi, [rbx + rbx]
movzx eax, byte [0x1401e1329]
mov edx, 2
mov rcx, rdi
call fcn.14000a780
test rax, rax
jne 0x14000ac1c
mov ecx, 2
mov rdx, rdi
call fcn.14011cc30
ud2
mov eax, 2
mov qword [rbp - 8], rbx
mov dword [rbp + 0xc], ebx
lea r8, [rbp + 0xc]
xor ecx, ecx
mov qword [rbp], rax
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
je 0x14000ac80
mov r8d, dword [rbp + 0xc]
lea rcx, [rbp - 0x40]
mov rdx, qword [rbp]
call fcn.1400ec4a0
mov rdx, qword [rbp - 8]
test edx, edx
je 0x14000ac65
add rdx, rdx
mov r8d, 2
mov rcx, qword [rbp]
call fcn.14000a790
lea rdx, [rbp - 0x40]
mov rcx, rsi
call fcn.14000a810
mov rax, rsi
add rsp, 0x98
pop rbx
pop rdi
pop rsi
pop rbp
ret
movzx eax, byte [0x1401e1329]
mov ecx, 9
mov edx, 1
call fcn.14000a780
test rax, rax
je 0x14000acee
movabs rcx, 0x736f686c61636f6c
mov qword [rax], rcx
mov byte [rax + 8], 0x74
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], 9
mov qword [rbp - 0x10], 9
lea rcx, [rbp - 0x60]
lea rdx, [rbp - 0x20]
call fcn.1400f3710
movups xmm0, xmmword [rbp - 0x60]
movups xmm1, xmmword [rbp - 0x50]
movaps xmmword [rbp - 0x30], xmm1
movaps xmmword [rbp - 0x40], xmm0
mov rdx, qword [rbp - 8]
test edx, edx
jne 0x14000ac53
jmp 0x14000ac65
mov ecx, 1
mov edx, 9
call fcn.14011cc30
ud2