joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140026fc0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push r12
push r14
sub rsp, 0x60
mov rax, qword [0x1400b6f80]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, qword [rsp + 0xa8]
mov r12, r9
mov r14d, edx
mov r11, rcx
mov qword [rsp + 0x20], rcx
test r8b, 0xf
je 0x140026fff
mov eax, 0xffffffda
jmp 0x1400271bd
mov qword [rsp + 0x88], rbp
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], r13
test edx, edx
jne 0x1400270ce
test r8, r8
je 0x1400271a4
mov rsi, qword [rsp + 0xa0]
lea rbp, [r8 - 1]
mov rdi, r9
shr rbp, 4
sub rdi, rbx
inc rbp
mov rax, qword [rsi]
lea rcx, [rsp + 0x28]
mov r9, rbx
mov qword [rcx], rax
mov rax, qword [rsi + 8]
mov r8, rsi
mov qword [rcx + 8], rax
mov rcx, r11
xor edx, edx
call fcn.1400268a0
lea r11, [r12 + 2]
mov ecx, 4
nop dword [rax]
movzx eax, byte [rdi + rbx]
add rbx, 4
add r11, 4
xor byte [rbx - 4], al
movzx eax, byte [r11 - 5]
xor byte [rbx - 3], al
movzx eax, byte [r11 - 4]
xor byte [rbx - 2], al
movzx eax, byte [r11 - 3]
xor byte [rbx - 1], al
sub rcx, 1
jne 0x140027070
mov r11, qword [rsp + 0x20]
lea rcx, [rsp + 0x28]
add rsi, 0x10
mov rax, qword [rcx]
sub rdi, 0x10
sub rbp, 1
mov qword [r12], rax
mov rax, qword [rcx + 8]
mov qword [r12 + 8], rax
jne 0x140027040
jmp 0x1400271a4
test r8, r8
je 0x1400271a4
mov rdi, qword [rsp + 0xa0]
lea r13, [r8 - 1]
mov rsi, r9
mov rbp, r9
shr r13, 4
sub rsi, rbx
sub rbp, rdi
inc r13
mov qword [rsp + 0x40], r15
nop dword [rax + rax]
mov r8, rbx
lea r9, [r12 + 3]
lea rdx, [rbx + 1]
mov rcx, rdi
mov r10d, 4
sub r8, rdi
nop dword [rax + rax]
movzx eax, byte [rcx + rbp]
add rdx, 4
add rcx, 4
xor al, byte [rcx - 4]
add r9, 4
mov byte [r8 + rcx - 4], al
movzx eax, byte [rdx + rsi - 4]
xor al, byte [rcx - 3]
mov byte [rdx - 4], al
movzx eax, byte [rcx - 2]
xor al, byte [r9 - 5]
mov byte [rdx - 3], al
movzx eax, byte [rcx - 1]
xor al, byte [r9 - 4]
sub r10, 1
mov byte [rdx - 2], al
jne 0x140027120
mov r9, rbx
mov r8, rbx
mov edx, r14d
mov rcx, r11
call fcn.1400268a0
mov rax, qword [rbx]
mov r11, qword [rsp + 0x20]
mov qword [r12], rax
mov rax, qword [rbx + 8]
add rdi, 0x10
sub rbp, 0x10
add rbx, 0x10
sub rsi, 0x10
sub r13, 1
mov qword [r12 + 8], rax
jne 0x140027100
mov r15, qword [rsp + 0x40]
mov r13, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x88]
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14006d1b0
add rsp, 0x60
pop r14
pop r12
pop rbx
ret
Function at 0x140027660
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
movzx eax, byte [r8 + 1]
movzx r11d, byte [r8]
movzx r13d, byte [r8 + 4]
shl r11d, 8
shl r13d, 8
mov rbx, r9
or r11d, eax
movzx eax, byte [r8 + 2]
mov r10, rcx
shl r11d, 8
mov edi, reloc.WS2_32.dll_recv
mov esi, 0xff
or r11d, eax
movzx eax, byte [r8 + 3]
shl r11d, 8
or r11d, eax
movzx eax, byte [r8 + 5]
or r13d, eax
movzx eax, byte [r8 + 6]
shl r13d, 8
or r13d, eax
movzx eax, byte [r8 + 7]
shl r13d, 8
or r13d, eax
test edx, edx
jne 0x14002774d
lea rbp, [rcx + 0x44]
xor r11d, dword [rbp]
sub rbp, 4
mov ecx, r11d
movzx r9d, r11w
mov r12d, r11d
shr ecx, 8
and r9w, si
movzx r8d, cx
shr ecx, 8
mov eax, ecx
and r8w, si
shr eax, 8
movzx edx, al
movzx eax, cx
mov r11d, dword [r10 + rdx*4 + 0x48]
movzx ecx, al
movzx eax, r8w
add r11d, dword [r10 + rcx*4 + 0x448]
xor r11d, dword [r10 + rax*4 + 0x848]
movzx eax, r9w
add r11d, dword [r10 + rax*4 + 0xc48]
xor r11d, r13d
sub rdi, 1
mov r13d, r12d
jne 0x1400276e1
mov ecx, dword [r10]
mov edx, dword [r10 + 4]
jmp 0x1400277bb
mov rbp, rcx
xor r11d, dword [rbp]
add rbp, 4
mov ecx, r11d
movzx r9d, r11w
mov r12d, r11d
shr ecx, 8
and r9w, si
movzx r8d, cx
shr ecx, 8
mov eax, ecx
and r8w, si
shr eax, 8
movzx edx, al
movzx eax, cx
mov r11d, dword [r10 + rdx*4 + 0x48]
movzx ecx, al
movzx eax, r8w
add r11d, dword [r10 + rcx*4 + 0x448]
xor r11d, dword [r10 + rax*4 + 0x848]
movzx eax, r9w
add r11d, dword [r10 + rax*4 + 0xc48]
xor r11d, r13d
sub rdi, 1
mov r13d, r12d
jne 0x140027750
mov ecx, dword [r10 + 0x44]
mov edx, dword [r10 + 0x40]
mov rbp, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
xor ecx, r12d
xor edx, r11d
mov eax, ecx
mov byte [rbx + 3], cl
mov byte [rbx + 7], dl
shr eax, 0x18
mov byte [rbx], al
mov eax, ecx
shr eax, 0x10
mov byte [rbx + 1], al
mov eax, ecx
shr eax, 8
mov byte [rbx + 2], al
mov eax, edx
shr eax, 0x18
mov byte [rbx + 4], al
mov eax, edx
shr eax, 0x10
mov byte [rbx + 5], al
mov eax, edx
shr eax, 8
mov byte [rbx + 6], al
mov rbx, qword [rsp + 0x18]
xor eax, eax
pop r13
pop r12
ret
Function at 0x140027820
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x30
mov rax, qword [0x1400b6f80]
xor rax, rsp
mov qword [rsp + 0x20], rax
mov r12, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x88]
mov rsi, r9
mov ebp, edx
mov r13, rcx
test r8b, 7
je 0x140027863
mov eax, 0xffffffe8
jmp 0x14002798c
mov qword [rsp + 0x68], rbx
test edx, edx
jne 0x1400278e3
test r8, r8
je 0x140027985
lea rbp, [r8 - 1]
shr rbp, 3
inc rbp
mov rbx, qword [r12]
mov r9, rdi
mov r8, r12
xor edx, edx
mov rcx, r13
call fcn.140027660
movzx r11d, byte [rsi]
add rdi, 8
xor byte [rdi - 8], r11b
movzx eax, byte [rsi + 1]
add r12, 8
xor byte [rdi - 7], al
movzx eax, byte [rsi + 2]
xor byte [rdi - 6], al
movzx eax, byte [rsi + 3]
xor byte [rdi - 5], al
movzx eax, byte [rsi + 4]
xor byte [rdi - 4], al
movzx eax, byte [rsi + 5]
xor byte [rdi - 3], al
movzx eax, byte [rsi + 6]
xor byte [rdi - 2], al
movzx eax, byte [rsi + 7]
xor byte [rdi - 1], al
sub rbp, 1
mov qword [rsi], rbx
jne 0x140027880
jmp 0x140027985
test r8, r8
je 0x140027985
lea rbx, [r8 - 1]
shr rbx, 3
inc rbx
nop word [rax + rax]
movzx eax, byte [r12]
mov r9, rdi
mov r8, rdi
xor al, byte [rsi]
mov edx, ebp
mov rcx, r13
mov byte [rdi], al
movzx eax, byte [r12 + 1]
xor al, byte [rsi + 1]
mov byte [rdi + 1], al
movzx eax, byte [r12 + 2]
xor al, byte [rsi + 2]
mov byte [rdi + 2], al
movzx eax, byte [r12 + 3]
xor al, byte [rsi + 3]
mov byte [rdi + 3], al
movzx eax, byte [r12 + 4]
xor al, byte [rsi + 4]
mov byte [rdi + 4], al
movzx eax, byte [r12 + 5]
xor al, byte [rsi + 5]
mov byte [rdi + 5], al
movzx eax, byte [r12 + 6]
xor al, byte [rsi + 6]
mov byte [rdi + 6], al
movzx eax, byte [r12 + 7]
xor al, byte [rsi + 7]
mov byte [rdi + 7], al
call fcn.140027660
mov r11, qword [rdi]
add r12, 8
add rdi, 8
sub rbx, 1
mov qword [rsi], r11
jne 0x140027900
mov rbx, qword [rsp + 0x68]
xor eax, eax
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.14006d1b0
add rsp, 0x30
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400284a0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push r12
push r13
sub rsp, 0x38
mov rax, qword [0x1400b6f80]
xor rax, rsp
mov qword [rsp + 0x20], rax
mov r12, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x88]
mov rsi, r9
mov r13, rcx
test r8b, 7
je 0x1400284e0
mov eax, 0xffffffce
jmp 0x140028618
mov qword [rsp + 0x68], rbx
cmp edx, 1
jne 0x140028594
test r8, r8
je 0x140028611
lea rbx, [r8 - 1]
shr rbx, 3
inc rbx
nop word [rax + rax]
movzx eax, byte [r12]
mov r8, rdi
mov rdx, rdi
xor al, byte [rsi]
mov rcx, r13
mov byte [rdi], al
movzx eax, byte [r12 + 1]
xor al, byte [rsi + 1]
mov byte [rdi + 1], al
movzx eax, byte [r12 + 2]
xor al, byte [rsi + 2]
mov byte [rdi + 2], al
movzx eax, byte [r12 + 3]
xor al, byte [rsi + 3]
mov byte [rdi + 3], al
movzx eax, byte [r12 + 4]
xor al, byte [rsi + 4]
mov byte [rdi + 4], al
movzx eax, byte [r12 + 5]
xor al, byte [rsi + 5]
mov byte [rdi + 5], al
movzx eax, byte [r12 + 6]
xor al, byte [rsi + 6]
mov byte [rdi + 6], al
movzx eax, byte [r12 + 7]
xor al, byte [rsi + 7]
mov byte [rdi + 7], al
call fcn.1400281c0
mov r11, qword [rdi]
add r12, 8
add rdi, 8
sub rbx, 1
mov qword [rsi], r11
jne 0x140028510
jmp 0x140028611
test r8, r8
je 0x140028611
mov qword [rsp + 0x30], rbp
lea rbp, [r8 - 1]
shr rbp, 3
inc rbp
nop dword [rax]
mov rbx, qword [r12]
mov r8, rdi
mov rdx, r12
mov rcx, r13
call fcn.1400281c0
movzx r11d, byte [rsi]
add rdi, 8
xor byte [rdi - 8], r11b
movzx eax, byte [rsi + 1]
add r12, 8
xor byte [rdi - 7], al
movzx eax, byte [rsi + 2]
xor byte [rdi - 6], al
movzx eax, byte [rsi + 3]
xor byte [rdi - 5], al
movzx eax, byte [rsi + 4]
xor byte [rdi - 4], al
movzx eax, byte [rsi + 5]
xor byte [rdi - 3], al
movzx eax, byte [rsi + 6]
xor byte [rdi - 2], al
movzx eax, byte [rsi + 7]
xor byte [rdi - 1], al
sub rbp, 1
mov qword [rsi], rbx
jne 0x1400285b0
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x68]
xor eax, eax
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.14006d1b0
add rsp, 0x38
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x140028b70
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push r12
push r13
sub rsp, 0x38
mov rax, qword [0x1400b6f80]
xor rax, rsp
mov qword [rsp + 0x20], rax
mov r12, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x88]
mov rsi, r9
mov r13, rcx
test r8b, 7
je 0x140028bb0
mov eax, 0xffffffce
jmp 0x140028ce8
mov qword [rsp + 0x68], rbx
cmp edx, 1
jne 0x140028c64
test r8, r8
je 0x140028ce1
lea rbx, [r8 - 1]
shr rbx, 3
inc rbx
nop word [rax + rax]
movzx eax, byte [r12]
mov r8, rdi
mov rdx, rdi
xor al, byte [rsi]
mov rcx, r13
mov byte [rdi], al
movzx eax, byte [r12 + 1]
xor al, byte [rsi + 1]
mov byte [rdi + 1], al
movzx eax, byte [r12 + 2]
xor al, byte [rsi + 2]
mov byte [rdi + 2], al
movzx eax, byte [r12 + 3]
xor al, byte [rsi + 3]
mov byte [rdi + 3], al
movzx eax, byte [r12 + 4]
xor al, byte [rsi + 4]
mov byte [rdi + 4], al
movzx eax, byte [r12 + 5]
xor al, byte [rsi + 5]
mov byte [rdi + 5], al
movzx eax, byte [r12 + 6]
xor al, byte [rsi + 6]
mov byte [rdi + 6], al
movzx eax, byte [r12 + 7]
xor al, byte [rsi + 7]
mov byte [rdi + 7], al
call fcn.140028630
mov r11, qword [rdi]
add r12, 8
add rdi, 8
sub rbx, 1
mov qword [rsi], r11
jne 0x140028be0
jmp 0x140028ce1
test r8, r8
je 0x140028ce1
mov qword [rsp + 0x30], rbp
lea rbp, [r8 - 1]
shr rbp, 3
inc rbp
nop dword [rax]
mov rbx, qword [r12]
mov r8, rdi
mov rdx, r12
mov rcx, r13
call fcn.140028630
movzx r11d, byte [rsi]
add rdi, 8
xor byte [rdi - 8], r11b
movzx eax, byte [rsi + 1]
add r12, 8
xor byte [rdi - 7], al
movzx eax, byte [rsi + 2]
xor byte [rdi - 6], al
movzx eax, byte [rsi + 3]
xor byte [rdi - 5], al
movzx eax, byte [rsi + 4]
xor byte [rdi - 4], al
movzx eax, byte [rsi + 5]
xor byte [rdi - 3], al
movzx eax, byte [rsi + 6]
xor byte [rdi - 2], al
movzx eax, byte [rsi + 7]
xor byte [rdi - 1], al
sub rbp, 1
mov qword [rsi], rbx
jne 0x140028c80
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x68]
xor eax, eax
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.14006d1b0
add rsp, 0x38
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x140029490
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x470
mov rax, qword [0x1400b6f80]
xor rax, rsp
mov qword [rsp + 0x468], rax
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x498]
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
mov qword [rsp + 0x458], rcx
mov rcx, qword [rsp + 0x458]
add rcx, 1
call fcn.14006efe4
mov qword [rsp + 0x448], rax
mov r8, qword [rsp + 0x458]
add r8, 1
mov rdx, qword [rsp + 0x498]
mov rcx, qword [rsp + 0x448]
call fcn.1400702a0
mov dword [rsp + 0x450], 0x400
call fcn.140029390
test eax, eax
je 0x140029563
lea rax, [rsp + 0x440]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
mov rdx, qword [rsp + 0x488]
mov rcx, qword [rsp + 0x480]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [rsp + 0x454], eax
jmp 0x140029596
lea rax, [rsp + 0x440]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rsp + 0x488]
mov rcx, qword [rsp + 0x480]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [rsp + 0x454], eax
cmp dword [rsp + 0x454], 0
jne 0x1400296f2
lea rax, [rsp + 0x450]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x490]
mov rcx, qword [rsp + 0x440]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [rsp + 0x454], eax
mov rcx, qword [rsp + 0x440]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x454], 0
jne 0x1400296f2
mov qword [rsp + 0x460], 0
jmp 0x14002961c
mov rax, qword [rsp + 0x460]
add rax, 1
mov qword [rsp + 0x460], rax
xor eax, eax
mov rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x40]
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
cmp qword [rsp + 0x460], rcx
jae 0x14002965f
mov rax, qword [rsp + 0x460]
movsx ecx, byte [rsp + rax + 0x40]
call fcn.140071068
mov edx, eax
mov rax, qword [rsp + 0x460]
mov byte [rsp + rax + 0x40], dl
jmp 0x140029608
mov qword [rsp + 0x460], 0
jmp 0x140029681
mov rax, qword [rsp + 0x460]
add rax, 1
mov qword [rsp + 0x460], rax
mov rax, qword [rsp + 0x458]
cmp qword [rsp + 0x460], rax
jae 0x1400296c7
mov rcx, qword [rsp + 0x460]
mov rax, qword [rsp + 0x448]
add rax, rcx
movsx ecx, byte [rax]
call fcn.140071068
mov edx, eax
mov rcx, qword [rsp + 0x460]
mov rax, qword [rsp + 0x448]
add rax, rcx
mov byte [rax], dl
jmp 0x14002966d
mov rdx, qword [rsp + 0x448]
lea rcx, [rsp + 0x40]
call fcn.140070e98
test rax, rax
je 0x1400296f2
mov rcx, qword [rsp + 0x448]
call fcn.14006d598
mov eax, 1
jmp 0x140029701
mov rcx, qword [rsp + 0x448]
call fcn.14006d598
xor eax, eax
mov rcx, qword [rsp + 0x468]
xor rcx, rsp
call fcn.14006d1b0
add rsp, 0x470
pop rdi
ret
Function at 0x140029720
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov dword [rsp + 0x20], 0xffffffff
call fcn.140029390
cmp eax, 1
jne 0x14002976d
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x28]
call fcn.1400292d0
test eax, eax
je 0x14002976b
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [rsp + 0x20], eax
mov rcx, qword [rsp + 0x28]
call fcn.140029330
jmp 0x14002977c
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0xffffffff
je 0x14002978d
mov dword [rsp + 0x30], 1
jmp 0x140029795
mov dword [rsp + 0x30], 0
mov eax, dword [rsp + 0x30]
add rsp, 0x48
ret

Function at 0x1400297a0
Capabilities:
Get local ipv4 addresses

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x68
mov rax, qword [0x1400b6f80]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x30], 0
mov byte [rsp + 0x40], 0
lea rdi, [rsp + 0x41]
xor eax, eax
mov ecx, 5
rep stosb byte [rdi], al
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0x6f
jne 0x1400298b3
mov edx, dword [rsp + 0x30]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x48], 0
je 0x1400298b3
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x48]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
cmp qword [rsp + 0x48], 0
je 0x1400298a8
mov rax, qword [rsp + 0x48]
cmp dword [rax + 0x58], 6
jne 0x140029898
lea rdi, [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsi, 0x50
mov ecx, 6
rep movsb byte [rdi], byte [rsi]
mov r8d, 3
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x80]
call fcn.1400710a0
test eax, eax
jne 0x140029898
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, 1
jmp 0x1400298b5
mov rax, qword [rsp + 0x48]
mov rax, qword [rax + 8]
mov qword [rsp + 0x48], rax
jmp 0x140029842
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14006d1b0
add rsp, 0x68
pop rdi
pop rsi
ret
Function at 0x1400298d0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov qword [rsp + 0x58], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0
jge 0x140029906
xor eax, eax
jmp 0x140029a3c
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 0xffffffff
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0
jge 0x14002995b
call qword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
jmp 0x140029a3c
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [0x14008f970]
mov r8d, 1
xor edx, edx
lea rcx, [0x14008fa40]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0
jge 0x140029999
call qword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
jmp 0x140029a3c
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rsp + 0x68], rax
mov r10, qword [rsp + 0x58]
mov r10, qword [r10]
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
call qword [r10 + Ordinal_27]
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0
jge 0x140029a0d
mov dword [rsp + 0x70], 0
jmp 0x140029a15
mov dword [rsp + 0x70], 1
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x50], eax
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rax, qword [rsp + 0x58]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x58]
call qword [rax + reloc.WS2_32.dll_recv]
mov eax, dword [rsp + 0x50]
add rsp, 0x88
ret

Function at 0x14002a1b0
Capabilities:
Enumerate processes

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x178
mov rax, qword [0x1400b6f80]
xor rax, rsp
mov qword [rsp + 0x168], rax
mov dword [rsp + 0x20], 0
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x160], rax
cmp qword [rsp + 0x160], 0xffffffffffffffff
je 0x14002a1fe
mov dword [rsp + 0x30], 0x130
jmp 0x14002a202
xor eax, eax
jmp 0x14002a280
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x160]
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x14002a22a
mov rcx, qword [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x14002a280
lea rdx, str.vboxservice.exe
lea rcx, [rsp + 0x5c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x14002a248
mov dword [rsp + 0x20], 1
lea rdx, str.vboxtray.exe
lea rcx, [rsp + 0x5c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x14002a266
mov dword [rsp + 0x20], 1
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x160]
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x14002a22a
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.14006d1b0
add rsp, 0x178
ret
Function at 0x140032030
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x1400320ef
call fcn.140031eb0
test eax, eax
jne 0x1400320ef
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rdi
xor eax, eax
mov rdi, rbx
xor esi, esi
repne scasb al, byte [rdi]
lea edx, [rsi + 0x2e]
not rcx
lea r8, [rcx - 1]
lea rdi, [rcx - 1]
mov rcx, rbx
call fcn.14005bcf0
test rax, rax
je 0x1400320a6
sub rax, rbx
lea edx, [rsi + 0x2e]
mov rcx, rbx
mov r8, rax
call fcn.14005bcf0
mov rsi, rax
test rax, rax
je 0x1400320a6
inc rsi
mov rcx, rbx
sub rcx, rsi
add rdi, rcx
test rsi, rsi
cmovne rbx, rsi
lea rsi, [rbx + rdi]
mov edi, 0x1505
cmp rbx, rsi
jae 0x1400320db
nop dword [rax + rax]
movzx ecx, byte [rbx]
call fcn.140033d80
inc rbx
movsx rcx, al
imul rdi, rdi, 0x21
xor rdi, rcx
cmp rbx, rsi
jb 0x1400320c0
mov rsi, qword [rsp + 0x30]
movzx eax, dil
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x140034250
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
call fcn.14007f5b4
cdqe
add rsp, 0x28
ret
Function at 0x140036080
Capabilities:
Get common file path

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
lea rcx, [0x1400923b8]
xor esi, esi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdi, rax
test rax, rax
jne 0x1400360aa
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret
lea rdx, str.LoadLibraryExA
mov rcx, rax
mov qword [rsp + 0x40], rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1400923a0]
mov rcx, rbx
mov rbp, rax
call fcn.140072294
test rax, rax
je 0x14003610f
test rbp, rbp
je 0x1400360f6
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 8]
call rbp
mov rbp, qword [rsp + 0x40]
mov rsi, rax
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbp, qword [rsp + 0x40]
mov rsi, rax
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret
test rbp, rbp
je 0x140036146
lea rdx, str.AddDllDirectory
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140036146
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call rbp
mov rbp, qword [rsp + 0x40]
mov rsi, rax
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x50], r13
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov r13d, eax
test eax, eax
je 0x14003620c
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
mov qword [rsp + 0x48], r12
not rcx
lea rax, [rcx - 1]
lea ecx, [r13 + 1]
add rcx, rax
call qword [fcn.14006efe4]
mov r12, rax
test rax, rax
je 0x1400361fe
mov edx, r13d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1400361fe
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r12
repne scasb al, byte [rdi]
mov eax, 0x5c
mov rdi, r12
not rcx
mov word [rcx + r12 - 1], ax
or rcx, 0xffffffffffffffff
xor eax, eax
repne scasb al, byte [rdi]
not rcx
dec rcx
add rcx, r12
nop dword [rax]
movzx eax, byte [rbx]
inc rcx
inc rbx
mov byte [rcx - 1], al
test al, al
jne 0x1400361d0
test rbp, rbp
je 0x1400361f2
xor edx, edx
mov rcx, r12
lea r8d, [rdx + 8]
call rbp
jmp 0x1400361fb
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
mov rcx, r12
call qword [fcn.14006d598]
mov r12, qword [rsp + 0x48]
mov r13, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x40]
mov rax, rsi
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret

Function at 0x140037b60
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r9
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
cmp rcx, 0xffffffffffffffff
jne 0x140037ba7
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
xor ecx, ecx
mov edx, 0x51
cmp eax, 0x2733
mov eax, gethostname
mov qword [rbx], 0
sete cl
test ecx, ecx
cmovne eax, edx
add rsp, 0x20
pop rbx
ret
mov qword [rbx], rcx
xor eax, eax
add rsp, 0x20
pop rbx
ret