joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140081a70
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x140081a8a
mov qword [r8], 0
lea rdx, [0x140ccf858]
call fcn.140081940
mov rbx, rax
test rax, rax
jne 0x140081aaa
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x140081b83
xor edx, edx
mov r8d, 2
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140081b83
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x140081b83
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140081b83
cmp rdi, 0xffffffffffffffff
je 0x140081b83
mov rax, qword [0x1411df5e0]
test rax, rax
je 0x140081b20
inc dword [rax + 0x3b4]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x140081b83
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x140081b70
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x1411df5e0]
test rax, rax
je 0x140081b65
dec dword [rax + 0x3b4]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140081b8c
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x140081b7e
mov qword [r14], rdi
mov rax, rsi
jmp 0x140081b8e
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x140084130
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov rax, qword [rcx + 0xe0]
movss xmm0, dword [rdx]
subss xmm0, dword [rcx + 0x20]
movss xmm1, dword [rdx + 8]
subss xmm1, dword [rcx + 0x20]
cvttss2si r8d, xmm0
movss xmm0, dword [rdx + 4]
subss xmm0, dword [rcx + 0x24]
mov r10d, r8d
cvttss2si ebx, xmm1
cvttss2si r9d, xmm0
mov edi, ebx
movss xmm0, dword [rdx + 0xc]
subss xmm0, dword [rcx + 0x24]
movsxd rcx, dword [rcx + 0xd8]
mov r11d, r9d
shr r11, 0x18
mov r14d, dword [rax + rcx*4 - 4]
not r14d
movzx eax, r8b
movzx ecx, r14b
lea r8, [0x1401ee440]
xor rcx, rax
shr r14d, 8
mov eax, r10d
shr eax, 8
movzx edx, al
mov eax, r10d
xor r14d, dword [r8 + rcx*4]
movzx ecx, r14b
xor rdx, rcx
shr r14d, 8
shr eax, 0x10
shr r10, 0x18
cvttss2si esi, xmm0
xor r14d, dword [r8 + rdx*4]
movzx ecx, r14b
shr r14d, 8
movzx edx, al
xor rdx, rcx
movzx eax, r9b
mov ebp, esi
xor r14d, dword [r8 + rdx*4]
movzx ecx, r14b
shr r14d, 8
xor r10, rcx
xor r14d, dword [r8 + r10*4]
movzx ecx, r14b
xor rcx, rax
shr r14d, 8
mov eax, r9d
shr eax, 8
movzx edx, al
mov eax, r9d
xor r14d, dword [r8 + rcx*4]
movzx ecx, r14b
xor rdx, rcx
shr r14d, 8
shr eax, 0x10
xor r14d, dword [r8 + rdx*4]
movzx ecx, r14b
shr r14d, 8
movzx edx, al
xor rdx, rcx
movzx eax, bl
xor r14d, dword [r8 + rdx*4]
movzx ecx, r14b
xor r11, rcx
shr r14d, 8
xor r14d, dword [r8 + r11*4]
movzx ecx, r14b
xor rcx, rax
shr r14d, 8
mov eax, ebx
shr eax, 8
movzx edx, al
xor r14d, dword [r8 + rcx*4]
movzx ecx, r14b
xor rdx, rcx
shr r14d, 8
xor r14d, dword [r8 + rdx*4]
movzx ecx, r14b
mov eax, ebx
shr r14d, 8
shr eax, 0x10
movzx edx, al
xor rdx, rcx
movzx eax, sil
shr rdi, 0x18
shr rbp, 0x18
xor r14d, dword [r8 + rdx*4]
movzx ecx, r14b
shr r14d, 8
xor rdi, rcx
xor r14d, dword [r8 + rdi*4]
movzx ecx, r14b
xor rcx, rax
shr r14d, 8
mov eax, esi
shr eax, 8
movzx edx, al
mov eax, esi
xor r14d, dword [r8 + rcx*4]
movzx ecx, r14b
shr r14d, 8
xor rdx, rcx
shr eax, 0x10
xor r14d, dword [r8 + rdx*4]
movzx ecx, r14b
shr r14d, 8
movzx edx, al
mov rax, qword [0x1411df5e0]
xor rdx, rcx
xor r14d, dword [r8 + rdx*4]
movzx ecx, r14b
shr r14d, 8
xor rbp, rcx
xor r14d, dword [r8 + rbp*4]
not r14d
cmp dword [rax + 0x1c94], r14d
jne 0x140084313
mov dword [rax + 0x1c98], r14d
cmp dword [rax + 0x1cd0], r14d
jne 0x140084323
mov byte [rax + 0x1cd4], 1
mov rbx, qword [rsp + 0x10]
mov eax, r14d
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
pop r14
ret
Function at 0x14008dd90
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rax, qword [0x1411df5e0]
lea r10, [0x1401ee440]
mov r8, rcx
mov rbx, qword [rax + 0x1c10]
add rbx, 0xd8
movsxd r9, dword [rbx]
mov rax, qword [rbx + 8]
mov edi, dword [rax + r9*4 - 4]
not edi
movzx eax, r8b
movzx ecx, dil
xor rcx, rax
shr edi, 8
mov rax, r8
shr rax, 8
movzx edx, al
mov rax, r8
xor edi, dword [r10 + rcx*4]
movzx ecx, dil
xor rdx, rcx
shr edi, 8
shr rax, 0x10
xor edi, dword [r10 + rdx*4]
movzx ecx, dil
shr edi, 8
movzx edx, al
mov rax, r8
xor rdx, rcx
shr rax, 0x18
xor edi, dword [r10 + rdx*4]
movzx ecx, dil
shr edi, 8
movzx edx, al
mov rax, r8
xor rdx, rcx
shr rax, 0x20
xor edi, dword [r10 + rdx*4]
movzx ecx, dil
shr edi, 8
movzx edx, al
mov rax, r8
xor rdx, rcx
shr rax, 0x28
xor edi, dword [r10 + rdx*4]
movzx ecx, dil
shr edi, 8
movzx edx, al
mov rax, r8
xor rdx, rcx
shr r8, 0x38
shr rax, 0x30
xor edi, dword [r10 + rdx*4]
movzx ecx, dil
shr edi, 8
movzx edx, al
xor rdx, rcx
xor edi, dword [r10 + rdx*4]
movzx ecx, dil
xor rcx, r8
shr edi, 8
mov r8d, dword [rbx + 4]
xor edi, dword [r10 + rcx*4]
not edi
cmp r9d, r8d
jne 0x14008deb0
lea ecx, [r9 + 1]
test r8d, r8d
je 0x14008de9c
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x14008dea1
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
mov rcx, rbx
call fcn.140095b80
movsxd rcx, dword [rbx]
mov rax, qword [rbx + 8]
mov dword [rax + rcx*4], edi
inc dword [rbx]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14008ded0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rax, qword [0x1411df5e0]
lea r10, [0x1401ee440]
mov r8d, ecx
mov rbx, qword [rax + 0x1c10]
add rbx, 0xd8
movsxd r9, dword [rbx]
mov rax, qword [rbx + 8]
mov edi, dword [rax + r9*4 - 4]
not edi
movzx eax, r8b
movzx ecx, dil
xor rcx, rax
shr edi, 8
mov eax, r8d
shr eax, 8
movzx edx, al
mov eax, r8d
xor edi, dword [r10 + rcx*4]
movzx ecx, dil
xor rdx, rcx
shr edi, 8
shr eax, 0x10
xor edi, dword [r10 + rdx*4]
movzx ecx, dil
shr edi, 8
movzx edx, al
mov eax, r8d
mov r8d, dword [rbx + 4]
xor rdx, rcx
shr rax, 0x18
xor edi, dword [r10 + rdx*4]
movzx ecx, dil
shr edi, 8
xor rcx, rax
xor edi, dword [r10 + rcx*4]
not edi
cmp r9d, r8d
jne 0x14008df91
lea ecx, [r9 + 1]
test r8d, r8d
je 0x14008df7d
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x14008df82
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
mov rcx, rbx
call fcn.140095b80
movsxd rcx, dword [rbx]
mov rax, qword [rbx + 8]
mov dword [rax + rcx*4], edi
inc dword [rbx]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14008efb0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140cf0080]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x1411df5e0]
mov edi, edx
cmp byte [rbx + 0x1f85], 0
jne 0x14008f010
cmp byte [rbx + 0x1f86], 0
jne 0x14008f010
mov r9d, dword [rbx + 0x3028]
lea r8, [0x140ccfe80]
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x20]
call fcn.140081810
test dil, 1
je 0x14008f136
jmp 0x14008f09a
movss xmm1, dword [rbx + 0x1614]
lea r8, [0x140ccfe80]
mov r9d, dword [rbx + 0x3028]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x140cd20fc]
mov edx, reloc.WS2_32.dll_recv
mulss xmm1, dword [0x140cd20d8]
addss xmm0, dword [rbx + 0x128]
addss xmm1, dword [rbx + 0x12c]
mov qword [rbx + 0x1d00], rax
mov dword [rbx + 0x1cec], 1
movss dword [rbx + 0x1cf8], xmm0
movss dword [rbx + 0x1cfc], xmm1
movss xmm0, dword [rbx + 0x1670]
mulss xmm0, dword [0x140cd1f94]
or dword [rbx + 0x1ce8], 0x41
movss dword [rbx + 0x1d48], xmm0
call fcn.140081810
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x14008f0f0
lea r11, [0x1401ee440]
nop word [rax + rax]
cmp r9b, 0x23
jne 0x14008f0d3
cmp byte [r8], r9b
jne 0x14008f0d3
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x14008f0c0
not ecx
call fcn.1400887b0
test rax, rax
je 0x14008f136
cmp byte [rax + 0x9e], 0
je 0x14008f136
mov byte [rax + 0xa5], 1
lea r8, [0x140ccfe80]
mov byte [rax + 0xbc], 1
lea rcx, [rsp + 0x20]
inc dword [rbx + 0x3028]
mov edx, reloc.WS2_32.dll_recv
mov r9d, dword [rbx + 0x3028]
call fcn.140081810
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.14008ade0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14013f230
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x140093c50
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x30c8], 0
lea rbx, [rcx + 0x30d0]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x140093cf7
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x140093caa
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.140095900
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.140082140
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x30c8]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x30d8]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x1411de204]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x140093cff
mov rcx, rbx
call fcn.140082140
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x1400a7870
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x140cf0080]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rcx, qword [0x141215f68]
lea rdx, [rsp + 0x28]
mov rdi, qword [0x1411df5e0]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x28], xmm0
call qword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [rsp + 0x30]
lea rcx, [rsp + 0x40]
sub eax, dword [rsp + 0x28]
mov qword [rsp + 0x40], 0
movd xmm1, eax
mov eax, dword [rsp + 0x34]
sub eax, dword [rsp + 0x2c]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [rdi + 0x10], xmm1
movss dword [rdi + 0x14], xmm0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rcx, qword [rsp + 0x40]
xorps xmm1, xmm1
mov rax, rcx
xorps xmm0, xmm0
sub rax, qword [0x141215f70]
cvtsi2ss xmm0, qword [0x141215f78]
cvtsi2ss xmm1, rax
divss xmm1, xmm0
movss dword [rdi + 0x18], xmm1
mov qword [0x141215f70], rcx
mov ecx, reloc.WS2_32.dll_recvfrom
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, reloc.WS2_32.dll_recv
and al, 1
mov byte [rdi + 0x140], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, reloc.WS2_32.dll_select
and al, 1
mov byte [rdi + 0x141], al
call qword [sym.imp.USER32.dll_GetKeyState]
mov rbx, qword [0x1411df5e0]
shr eax, 0xf
and al, 1
mov byte [rdi + 0x143], 0
mov byte [rdi + 0x142], al
cmp byte [rbx + 0x39b], 0
je 0x1400a79af
cvttss2si eax, dword [rbx + 0x128]
mov rcx, qword [0x141215f68]
lea rdx, [rsp + 0x38]
mov dword [rsp + 0x38], eax
cvttss2si eax, dword [rbx + 0x12c]
mov dword [rsp + 0x3c], eax
call qword [sym.imp.USER32.dll_ClientToScreen]
test eax, eax
je 0x1400a79af
mov edx, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x38]
call qword [sym.imp.USER32.dll_SetCursorPos]
mov dword [rbx + 0x128], 0xff7fffff
mov dword [rbx + 0x12c], 0xff7fffff
call qword [sym.imp.USER32.dll_GetForegroundWindow]
test rax, rax
je 0x1400a7a2e
mov rdx, qword [0x141215f68]
cmp rax, rdx
je 0x1400a79e7
mov rcx, rax
call qword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x1400a7a2e
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x1400a7a2e
mov rcx, qword [0x141215f68]
lea rdx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x1400a7a2e
movd xmm0, dword [rsp + 0x20]
movd xmm1, dword [rsp + 0x24]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [rbx + 0x128], xmm0
movss dword [rbx + 0x12c], xmm1
cmp byte [rdi + 0xc8], 0
je 0x1400a7a3e
mov eax, 0xffffffff
jmp 0x1400a7a4b
mov rax, qword [0x1411df5e0]
mov eax, dword [rax + 0x1f80]
cmp dword [reloc.WS2_32.dll_htons], eax
je 0x1400a7a5e
mov dword [reloc.WS2_32.dll_htons], eax
call fcn.1400a7420
call fcn.1400a75a0
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14013f230
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x1400c0c30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x140cf0080]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx eax, byte [rcx]
mov ebx, edx
mov r10, rcx
test al, al
je 0x1400c0c70
cmp al, 0x25
jne 0x1400c0c64
cmp byte [r10 + 1], al
jne 0x1400c0c70
inc r10
movzx eax, byte [r10 + 1]
inc r10
test al, al
jne 0x1400c0c57
cmp byte [r10], 0x25
jne 0x1400c0d90
cmp byte [r10 + 1], 0x25
je 0x1400c0d90
mov rcx, r10
lea r11, [rsp + 0x20]
call fcn.1400b1080
mov r8, rax
cmp r10, rax
jae 0x1400c0cd0
movabs r9, 0x800000000000009
nop dword [rax]
nop dword [rax + rax]
movzx edx, byte [r10]
inc r10
lea ecx, [rdx - 0x24]
cmp cl, 0x3b
ja 0x1400c0cc5
bt r9, rcx
jb 0x1400c0ccb
mov byte [r11], dl
inc r11
cmp r10, r8
jb 0x1400c0cb0
xorps xmm3, xmm3
mov byte [r11], 0
cvtss2sd xmm3, xmm2
lea r8, [rsp + 0x20]
mov edx, 0x40
lea rcx, [rsp + 0x40]
movq r9, xmm3
call fcn.140081810
cmp byte [rsp + 0x40], 0x20
lea rcx, [rsp + 0x40]
jne 0x1400c0d08
inc rcx
cmp byte [rcx], 0x20
je 0x1400c0d00
lea eax, [rbx - 8]
cmp eax, 1
jbe 0x1400c0d7e
movzx edx, byte [rcx]
movzx r8d, dl
cmp dl, 0x2d
jne 0x1400c0d21
movzx r8d, byte [rcx + 1]
lea rax, [rcx + 1]
xorps xmm1, xmm1
cmovne rax, rcx
cmp r8b, 0x2b
lea rcx, [rax + 1]
cmovne rcx, rax
movzx eax, byte [rcx]
cmp al, 0x30
jl 0x1400c0d6d
movss xmm2, dword [0x140cd20e0]
cmp al, 0x39
ja 0x1400c0d6d
movsx eax, byte [rcx]
inc rcx
sub eax, 0x30
mulss xmm1, xmm2
movd xmm0, eax
movzx eax, byte [rcx]
cvtdq2ps xmm0, xmm0
addss xmm0, xmm1
movaps xmm1, xmm0
cmp al, 0x30
jge 0x1400c0d47
cmp dl, 0x2d
jne 0x1400c0d8b
xorps xmm1, xmmword [0x140cd4a80]
movaps xmm0, xmm1
jmp 0x1400c0d93
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
movaps xmm0, xmm1
jmp 0x1400c0d93
movaps xmm0, xmm2
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14013f230
add rsp, 0x90
pop rbx
ret
Function at 0x1400c0e30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x140cf0080]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx eax, byte [rcx]
mov ebx, edx
mov r10, rcx
test al, al
je 0x1400c0e70
cmp al, 0x25
jne 0x1400c0e64
cmp byte [r10 + 1], al
jne 0x1400c0e70
inc r10
movzx eax, byte [r10 + 1]
inc r10
test al, al
jne 0x1400c0e57
cmp byte [r10], 0x25
jne 0x1400c0f8a
cmp byte [r10 + 1], 0x25
je 0x1400c0f8a
mov rcx, r10
lea r11, [rsp + 0x20]
call fcn.1400b1080
mov r8, rax
cmp r10, rax
jae 0x1400c0ed0
movabs r9, 0x800000000000009
nop dword [rax]
nop dword [rax + rax]
movzx edx, byte [r10]
inc r10
lea ecx, [rdx - 0x24]
cmp cl, 0x3b
ja 0x1400c0ec5
bt r9, rcx
jb 0x1400c0ecb
mov byte [r11], dl
inc r11
cmp r10, r8
jb 0x1400c0eb0
movaps xmm3, xmm2
mov byte [r11], 0
movq r9, xmm2
lea r8, [rsp + 0x20]
mov edx, 0x40
lea rcx, [rsp + 0x40]
call fcn.140081810
cmp byte [rsp + 0x40], 0x20
lea rcx, [rsp + 0x40]
jne 0x1400c0f08
nop dword [rax]
inc rcx
cmp byte [rcx], 0x20
je 0x1400c0f00
lea eax, [rbx - 8]
cmp eax, 1
jbe 0x1400c0f7c
movzx edx, byte [rcx]
movzx r8d, dl
cmp dl, 0x2d
jne 0x1400c0f21
movzx r8d, byte [rcx + 1]
lea rax, [rcx + 1]
xorps xmm1, xmm1
cmovne rax, rcx
cmp r8b, 0x2b
lea rcx, [rax + 1]
cmovne rcx, rax
movzx eax, byte [rcx]
cmp al, 0x30
jl 0x1400c0f6b
movsd xmm2, qword [0x140cd2078]
cmp al, 0x39
ja 0x1400c0f6b
movsx eax, byte [rcx]
inc rcx
sub eax, 0x30
mulsd xmm1, xmm2
movd xmm0, eax
movzx eax, byte [rcx]
cvtdq2pd xmm0, xmm0
addsd xmm1, xmm0
cmp al, 0x30
jge 0x1400c0f47
cmp dl, 0x2d
jne 0x1400c0f85
xorps xmm1, xmmword [0x140cd4a70]
movaps xmm0, xmm1
jmp 0x1400c0f8d
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
movaps xmm1, xmm0
movaps xmm0, xmm1
jmp 0x1400c0f8d
movaps xmm0, xmm2
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14013f230
add rsp, 0x90
pop rbx
ret

Function at 0x1400c1000
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140cf0080]
xor rax, rsp
mov qword [rsp + 0x48], rax
cmp qword [r9 + 0x18], 0xf
mov rax, r9
mov edi, r8d
mov rbx, rdx
jbe 0x1400c102a
mov rax, qword [r9]
mov qword [rsp + 0x30], 0
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0xc0000000
mov dword [rsp + 0x20], 1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1400c109e
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], 0
mov r8d, edi
mov qword [rsp + 0x20], 0
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x1400c109e
cmp dword [rsp + 0x40], edi
jne 0x1400c109e
mov al, 1
jmp 0x1400c10a0
xor al, al
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14013f230
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400c1370
Capabilities:
Delete file
Delete service
Modify service
Stop service

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x90
mov rax, qword [0x140cf0080]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, qword [0x1411df600]
movzx ecx, byte [rbx]
test cl, cl
je 0x1400c13a3
mov word [rbx + 0x78], 0
cmp byte [rbx + 0x78], 0
je 0x1400c13b4
test cl, cl
jne 0x1400c13b4
mov al, 1
jmp 0x1400c14fa
xor edx, edx
mov qword [rsp + 0xa8], rsi
xor ecx, ecx
mov r8d, 1
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rsi, rax
test rax, rax
je 0x1400c1531
cmp byte [rbx + 0x79], 0
lea rdx, [rbx + 0x48]
mov eax, 0x10020
mov ecx, reloc.WLDAP32.dll_Ordinal_32
cmovne eax, ecx
mov r8d, eax
or r8d, 2
cmp byte [rbx + 0x7a], 0
cmove r8d, eax
cmp qword [rdx + 0x18], 0xf
jbe 0x1400c1406
mov rdx, qword [rdx]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rdi, rax
test rax, rax
je 0x1400c1528
lea r8, [rsp + 0x60]
mov edx, 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x1400c151f
cmp byte [rbx + 0x7a], 0
je 0x1400c1480
xor eax, eax
mov edx, 0xffffffff
mov qword [rsp + 0x50], rax
mov r9d, edx
mov qword [rsp + 0x48], rax
mov r8d, 4
mov qword [rsp + 0x40], rax
mov rcx, rdi
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
test eax, eax
je 0x1400c151f
cmp byte [rbx + 0x79], 0
je 0x1400c14a1
cmp byte [rbx], 0
jne 0x1400c14a1
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, 1
jmp 0x1400c14f2
mov rcx, rdi
mov qword [rsp + 0xa0], rbp
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov rcx, rdi
mov ebp, eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp byte [rbx + 0x7b], 0
je 0x1400c151b
cmp byte [rbx], 0
je 0x1400c151b
cmp qword [rbx + 0x20], 0xf
lea rcx, [rbx + 8]
jbe 0x1400c14df
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
mov rbp, qword [rsp + 0xa0]
setne al
mov rsi, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14013f230
mov rbx, qword [rsp + 0xb0]
add rsp, 0x90
pop rdi
ret
test ebp, ebp
jmp 0x1400c14e7
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
jmp 0x1400c14f2
Function at 0x1400cc610
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
cmp byte [rcx + 0x41], 0
je 0x1400cc7a2
movdqa xmm2, xmmword [0x140cd2380]
lea r10, [rcx + 4]
movdqa xmm3, xmmword [0x140cd2490]
mov r8, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x140cd2530]
mov r9d, 2
sub r8, rcx
sub r9, rcx
mov rdx, 0xfffffffffffffffc
sub rdx, rcx
nop dword [rax]
nop word [rax + rax]
lea rax, [rdx + r10]
movq xmm0, rax
movzx eax, word [r10 - 4]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
pshufd xmm1, xmm0, 0xd8
movq xmm0, xmm3
paddd xmm1, xmm0
movd xmm0, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm4
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd eax, xmm1
mov word [r10 - 4], ax
lea rax, [r8 + r10]
movq xmm0, rax
movzx eax, word [r10 - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
pshufd xmm1, xmm0, 0xd8
movq xmm0, xmm3
paddd xmm1, xmm0
movd xmm0, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm4
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd eax, xmm1
mov word [r10 - 2], ax
mov rax, r10
sub rax, rcx
movq xmm0, rax
movzx eax, word [r10]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
pshufd xmm1, xmm0, 0xd8
movq xmm0, xmm3
paddd xmm1, xmm0
movd xmm0, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm4
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd eax, xmm1
mov word [r10], ax
lea rax, [r9 + r10]
movq xmm0, rax
movzx eax, word [r10 + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
pshufd xmm1, xmm0, 0xd8
movq xmm0, xmm3
paddd xmm1, xmm0
movd xmm0, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm4
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd eax, xmm1
mov word [r10 + 2], ax
add r10, 8
lea rax, [rdx + r10]
cmp rax, 0x40
jb 0x1400cc660
mov byte [rcx + 0x41], 0
ret