joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401a76c0
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x240
mov rax, qword [0x140289cf0]
xor rax, rsp
mov qword [rsp + 0x230], rax
lea rdx, [0x14025a0b8]
mov rbp, rcx
call fcn.1401b104c
xor edi, edi
test rax, rax
je 0x1401a77a6
mov ebx, edi
call fcn.1401a47dc
mov r14d, dword [rax]
call fcn.1401a47dc
mov r8d, 0x104
lea rcx, [rsp + 0x20]
mov rdx, rbp
mov dword [rax], edi
call fcn.1401b9a54
mov rsi, rax
test rax, rax
je 0x1401a7737
call fcn.1401a47dc
mov dword [rax], r14d
jmp 0x1401a7761
call fcn.1401a47dc
cmp dword [rax], 0x22
jne 0x1401a779e
call fcn.1401a47dc
xor r8d, r8d
mov rdx, rbp
xor ecx, ecx
mov dword [rax], r14d
call fcn.1401b9a54
mov rbx, rax
mov rsi, rax
test rax, rax
je 0x1401a779e
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], di
jne 0x1401a7765
cmp rax, 3
je 0x1401a7780
mov rcx, rsi
call fcn.1401a761c
test al, al
je 0x1401a7791
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x1401a7791
mov dil, 1
mov rcx, rbx
call fcn.140192634
mov al, dil
jmp 0x1401a77a8
mov rcx, rbx
call fcn.140192634
xor al, al
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1401889e0
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1401ace70
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rsi, rcx
test rcx, rcx
jne 0x1401acea2
call fcn.1401a47dc
mov dword [rax], 0x16
call fcn.14019259c
jmp 0x1401acfc1
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x1401acfc1
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x1401acfc1
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x1401aced1
lock or dword [rcx + 0x14], 0x10
jmp 0x1401acfc1
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x1401acee5
call fcn.1401b5238
mov rdi, qword [rsi + 8]
mov rcx, rsi
mov ebx, dword [rsi + 0x20]
mov qword [rsi], rdi
call fcn.1401a6ce8
mov r8d, ebx
mov rdx, rdi
mov ecx, eax
call fcn.1401b696c
mov dword [rsi + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 1
jbe 0x1401acfaf
mov eax, dword [rsi + 0x14]
or edi, 0xffffffff
test al, 6
jne 0x1401acf7a
mov rcx, rsi
call fcn.1401a6ce8
cmp eax, edi
je 0x1401acf65
mov rcx, rsi
call fcn.1401a6ce8
cmp eax, 0xfffffffe
je 0x1401acf65
mov rcx, rsi
call fcn.1401a6ce8
movsxd rbx, eax
lea r14, [0x140290800]
mov rcx, rsi
sar rbx, 6
call fcn.1401a6ce8
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rbx*8]
lea rdx, [rax + rcx*8]
jmp 0x1401acf6c
lea rdx, [0x140289f50]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x1401acf7a
lock or dword [rsi + 0x14], 0x20
cmp dword [rsi + 0x20], 0x200
jne 0x1401acf9e
mov eax, dword [rsi + 0x14]
shr eax, 6
test al, 1
je 0x1401acf9e
mov eax, dword [rsi + 0x14]
shr eax, 8
test al, 1
jne 0x1401acf9e
mov dword [rsi + 0x20], 0x1000
mov rax, qword [rsi]
add dword [rsi + 0x10], edi
movzx edi, byte [rax]
inc rax
mov qword [rsi], rax
jmp 0x1401acfc4
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rsi + 0x14], eax
and dword [rsi + 0x10], 0
or edi, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop r14
ret
Function at 0x1401b64c0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x30
movsxd rbp, ecx
mov r9, r8
mov rax, rbp
lea rcx, [0x140290800]
and eax, 0x3f
mov r10, rbp
sar r10, 6
xor edi, edi
mov rsi, rdx
mov r14, rbp
lea r8, [rax + rax*8]
mov rax, qword [rcx + r10*8]
mov ecx, 4
mov qword [rsp + 0x78], rcx
mov r11, qword [rax + r8*8 + 0x28]
lea r12d, [rcx + 6]
test r9, r9
je 0x1401b651e
cmp word [rdx], r12w
jne 0x1401b651e
or byte [rax + r8*8 + 0x38], cl
jmp 0x1401b6524
and byte [rax + r8*8 + 0x38], 0xfb
lea rdx, [rdx + r9*2]
mov rcx, rsi
mov rbx, rsi
cmp rsi, rdx
jae 0x1401b667f
mov r9d, 0x1a
lea r13d, [r9 - 0xd]
movzx eax, word [rcx]
cmp ax, r9w
je 0x1401b665a
lea r9, [rcx + 2]
cmp ax, r13w
je 0x1401b655d
mov rcx, r9
jmp 0x1401b6580
cmp r9, rdx
jae 0x1401b6597
cmp word [r9], r12w
mov eax, 2
cmove rax, qword [rsp + 0x78]
add rcx, rax
mov eax, r12d
cmp word [r9], r12w
cmovne ax, r13w
mov word [rbx], ax
mov r9d, 0x1a
add rbx, 2
cmp rcx, rdx
jb 0x1401b6541
jmp 0x1401b667f
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rdi
mov r8d, 2
lea rdx, [rsp + 0x70]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1401b6654
cmp dword [rsp + 0x80], edi
je 0x1401b6654
mov rdx, r14
lea r11, [0x140290800]
sar rdx, 6
and r14d, 0x3f
mov rax, qword [r11 + rdx*8]
lea r8, [r14 + r14*8]
test byte [rax + r8*8 + 0x38], 0x48
je 0x1401b662d
movzx eax, word [rsp + 0x70]
cmp ax, r12w
jne 0x1401b6600
mov word [rbx], r12w
jmp 0x1401b667b
mov word [rbx], r13w
mov word [rsp + 0x78], ax
mov rax, qword [r11 + rdx*8]
lea rcx, [rax + r8*8]
mov al, byte [rsp + rdi + 0x78]
mov byte [rcx + rdi + 0x3a], al
inc rdi
cmp rdi, 2
jl 0x1401b6609
mov rax, qword [r11 + rdx*8]
mov byte [rax + r8*8 + 0x3c], r12b
jmp 0x1401b667b
cmp word [rsp + 0x70], r12w
jne 0x1401b663a
cmp rbx, rsi
je 0x1401b65fa
mov rdx, 0xfffffffffffffffe
mov ecx, ebp
lea r8d, [rdx + 3]
call fcn.1401b641c
cmp word [rsp + 0x70], r12w
je 0x1401b667f
mov word [rbx], r13w
jmp 0x1401b667b
lea r11, [0x140290800]
mov rcx, qword [r11 + r10*8]
mov al, byte [rcx + r8*8 + 0x38]
test al, 0x40
jne 0x1401b6677
or al, 2
mov byte [rcx + r8*8 + 0x38], al
jmp 0x1401b667f
mov word [rbx], r9w
add rbx, 2
sub rbx, rsi
sar rbx, 1
lea eax, [rbx + rbx]
add rsp, 0x30
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1401bafa0
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1401bafd0
xor eax, eax
jmp 0x1401bb093
mov rbp, rbx
cmp word [rax], si
je 0x1401baff5
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1401bafdc
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1401bafd8
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1401b74c0
movsxd r14, eax
test eax, eax
jne 0x1401bb033
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1401bafc9
mov rcx, r14
call fcn.1401ad964
mov rdi, rax
test rax, rax
jne 0x1401bb04c
xor ecx, ecx
call fcn.1401ad928
jmp 0x1401bb028
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1401b74c0
test eax, eax
jne 0x1401bb07d
mov rcx, rdi
call fcn.1401ad928
jmp 0x1401bb087
xor ecx, ecx
call fcn.1401ad928
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x1401bb0b0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1401bb137
mov rsi, rbx
cmp word [rax], bp
je 0x1401bb0f6
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x1401bb0e0
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1401bb0dc
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.1401ad964
mov rdi, rax
test rax, rax
je 0x1401bb124
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14018d9c0
mov rbp, rdi
xor ecx, ecx
call fcn.1401ad928
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1401bdde4
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.14019dbec
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x1401bde6e
cmp byte [rbp - 0x21], r15b
je 0x1401bde69
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x1401bdea4
call fcn.1401b3940
test eax, eax
jne 0x1401bde90
cmp byte [rbp - 0x21], r15b
je 0x1401bde88
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x1401bdea4
cmp byte [rbp - 0x21], r15b
je 0x1401bdea1
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.1401a6f64
test eax, eax
jne 0x1401bdf44
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.14019dbec
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x1401bdee3
cmp byte [rbp - 0x21], r15b
je 0x1401bdf18
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x1401bdf18
call fcn.1401b3940
test eax, eax
jne 0x1401bdf04
cmp byte [rbp - 0x21], r15b
je 0x1401bdefd
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x1401bdf18
cmp byte [rbp - 0x21], r15b
je 0x1401bdf15
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.1401a6f64
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x1401bdf44
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x1401bdf47
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x1401bdf55
mov rcx, rdi
call fcn.1401ad928
cmp byte [rbp + 0x3f], r15b
je 0x1401bdf64
mov rcx, qword [rbp + 0x27]
call fcn.1401ad928
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1401bf500
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.1401b641c
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.1401b641c
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x1401bf650
cmp rax, 0xffffffffffffffff
je 0x1401bf650
xor edi, edi
test rbp, rbp
jle 0x1401bf5fb
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.1401afbf4
mov rbx, rax
test rax, rax
jne 0x1401bf588
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x1401bf5f1
mov edx, 0x8000
mov ecx, r14d
call fcn.1401a6e84
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.1401b5e94
cmp eax, 0xffffffff
je 0x1401bf5d1
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1401bf598
mov edx, r15d
mov ecx, r14d
call fcn.1401a6e84
jmp 0x1401bf5f1
cmp byte [rsi + 0x38], dil
je 0x1401bf5e8
cmp dword [rsi + 0x34], 5
jne 0x1401bf5e8
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], recv
cmp byte [rsi + 0x30], dil
je 0x1401bf5f1
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.1401ad928
jmp 0x1401bf664
jns 0x1401bf664
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.1401b641c
cmp rax, 0xffffffffffffffff
jne 0x1401bf61c
cmp byte [rsi + 0x30], dil
je 0x1401bf664
mov edi, dword [rsi + 0x2c]
jmp 0x1401bf664
mov ecx, r14d
call fcn.1401b9698
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1401bf664
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, recv
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], recv
jmp 0x1401bf664
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1401bf65d
mov eax, dword [rsi + 0x2c]
jmp 0x1401bf662
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.1401b641c
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x1401c1400
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x140289cf0]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rsi, qword [rcx + 0x30]
mov edi, edx
mov r8, rcx
mov rbx, rsi
mov rax, qword [rsi + 8]
cmp byte [rax + 0x19], 0
jne 0x1401c1457
nop word [rax + rax]
cmp dword [rax + 0x20], edi
jae 0x1401c144b
mov rax, qword [rax + 0x10]
jmp 0x1401c1451
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1401c1440
cmp byte [rbx + 0x19], 0
jne 0x1401c1480
cmp edi, dword [rbx + 0x20]
jb 0x1401c1480
cmp rbx, rsi
je 0x1401c1483
mov rax, qword [rbx + 0x28]
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
mov ecx, dword [rdx + rax + 0x10]
shr ecx, 2
test cl, 1
jne 0x1401c1483
jmp 0x1401c14cb
mov rbx, rsi
cmp byte [r8 + 0x29], 0
je 0x1401c14c9
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x208
call fcn.14018e070
lea rax, [0x140267d08]
cmp rbx, rsi
lea rdx, str.Log_in_bad_state_____d_n
mov r8d, edi
cmove rdx, rax
lea rcx, [rsp + 0x20]
call fcn.1400a5d60
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1401889e0
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x1401c61e0
Capabilities:
Query environment variable

Disassembly:
push rbx
mov eax, 0x10030
call fcn.140189640
sub rsp, rax
mov rax, qword [0x140289cf0]
xor rax, rsp
mov qword [rsp + 0x10020], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0xfffe
call fcn.14018e070
cmp qword [rbx + 0x18], 8
mov rcx, rbx
jb 0x1401c6223
mov rcx, qword [rbx]
mov r8d, 0x7fff
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rax, [rsp + 0x20]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x1401c6240
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14009b670
mov rcx, rbx
call fcn.1401c5e90
mov rcx, qword [rsp + 0x10020]
xor rcx, rsp
call fcn.1401889e0
add rsp, 0x10030
pop rbx
ret
Function at 0x1401c94f0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push r14
push r15
sub rsp, 0x58
mov rax, qword [0x140289cf0]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov r14, rcx
mov r15, r9
xor ecx, ecx
mov rbx, r8
mov rsi, rdx
mov dword [rsp + 0x34], ecx
mov dword [r14 + 0xc], ecx
cmp qword [rdx + 0x18], 8
jb 0x1401c952a
mov rdx, qword [rdx]
lea rax, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov rcx, qword [r14]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [r14 + 0x10], eax
test eax, eax
jne 0x1401c960c
mov eax, dword [rsp + 0x34]
test eax, eax
jne 0x1401c9567
mov rax, qword [rbx]
mov qword [rbx + 8], rax
mov al, 1
jmp 0x1401c960e
mov rdx, qword [rbx]
mov qword [rsp + 0x50], rbp
mov rbp, qword [rbx + 8]
mov rcx, rbp
mov qword [rsp + 0x48], rdi
sub rcx, rdx
mov byte [rsp + 0x30], 0
mov rdi, rax
cmp rax, rcx
jae 0x1401c9590
add rax, rdx
jmp 0x1401c95c4
jbe 0x1401c95c8
mov rax, qword [rbx + 0x10]
sub rax, rdx
cmp rdi, rax
jbe 0x1401c95b0
lea r8, [rsp + 0x30]
mov rdx, rdi
mov rcx, rbx
call fcn.1400a7ed0
jmp 0x1401c95c8
sub rdi, rcx
xor edx, edx
mov r8, rdi
mov rcx, rbp
call fcn.14018e070
lea rax, [rdi + rbp]
mov qword [rbx + 8], rax
cmp qword [rsi + 0x18], 8
mov rdi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
jb 0x1401c95dc
mov rsi, qword [rsi]
mov rcx, qword [r14]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
mov r9, r15
mov rax, qword [rbx]
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [r14 + 0x10], eax
test eax, eax
je 0x1401c9560
xor al, al
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1401889e0
add rsp, 0x58
pop r15
pop r14
pop rsi
pop rbx
ret
Function at 0x1401cb7b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov r14, rcx
mov qword [rsp + 0x28], rcx
lea rax, vtable.Esg::Encoders::AESImpl.0
mov qword [rcx], rax
mov dword [rcx + 8], 0x1a
add rcx, 0x10
xor edi, edi
mov qword [rcx], rdi
mov qword [rcx + 8], rdi
mov qword [rcx + 0x10], rdi
mov eax, dword [r14 + 8]
test al, 8
je 0x1401cb7f9
lea edx, [rdi + 0x20]
jmp 0x1401cb802
test al, 4
je 0x1401cb808
mov edx, reloc.WS2_32.dll_recv
call fcn.1400937a0
nop
lea rax, vtable.Esg::Encoders::AESLegacy.0
mov qword [r14], rax
cmp byte [0x1402917bc], 0
jne 0x1401cb941
mov bl, 1
call fcn.1401d6620
test al, al
cmove ebx, edi
call fcn.1401d63e0
movzx ebx, bl
test al, al
cmove ebx, edi
call fcn.1401d6620
test al, al
jne 0x1401cb846
xor bpl, bpl
jmp 0x1401cb89e
call fcn.1401d63e0
test al, al
jne 0x1401cb854
xor bpl, bpl
jmp 0x1401cb89e
mov edx, edi
movzx r9d, byte [0x140296330]
lea r8, [0x140296430]
lea r10, [0x140296330]
nop dword [rax]
mov eax, edi
cmp r9d, edx
je 0x1401cb88b
nop word [rax + rax]
inc eax
movzx ecx, byte [rax + r10]
cmp ecx, edx
jne 0x1401cb880
mov byte [r8], al
inc edx
inc r8
cmp edx, 0xff
jbe 0x1401cb870
mov bpl, 1
and bpl, bl
mov r9b, 1
mov dword [0x140296530], edi
mov edi, 1
lea rsi, [0x140296534]
nop word [rax + rax]
movzx eax, r9b
mov dword [rsi], eax
mov r10b, 2
movzx r8d, r9b
xor bl, bl
mov r11d, 8
nop word [rax + rax]
movzx ecx, r10b
movzx eax, bl
xor al, r8b
movzx r9d, al
movzx eax, bl
and cl, 1
cmove r9d, eax
movzx eax, r8b
add al, al
movzx edx, al
shr r10b, 1
movzx ebx, r9b
movzx ecx, r8b
movzx eax, dl
xor al, 0x1b
movzx r8d, al
test cl, cl
cmovns r8d, edx
sub r11d, 1
jne 0x1401cb8e0
inc edi
add rsi, 4
cmp edi, 0x3b
jb 0x1401cb8c0
call fcn.1401d66e0
test al, al
je 0x1401cb957
mov byte [0x1402917bc], bpl
test bpl, bpl
je 0x1401cb95d
mov rax, r14
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
mov byte [0x1402917bc], al
lea rax, str.Tables_failed_to_initialize
mov qword [rsp + 0x20], rax
lea rdx, [0x140285b90]
lea rcx, [rsp + 0x20]
call fcn.14018e680
int3
Function at 0x1401d63e0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
call fcn.1401d6620
test al, al
jne 0x1401d63f2
add rsp, 0x38
ret
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov ebp, 0x100
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], r14
xor r14d, r14d
mov qword [rsp + 0x20], r15
lea r15, [0x140000000]
nop
movzx r9d, byte [r14 + r15 + 0x296230]
movzx eax, r9b
and al, 0xf1
movzx edi, al
shr al, 4
and dil, 0xf
xor dil, al
movzx eax, r9b
and al, 0xe3
movzx ebx, al
shr al, 4
and bl, 0xf
xor bl, al
movzx eax, r9b
and al, 0xc7
movzx r11d, al
shr al, 4
and r11b, 0xf
xor r11b, al
movzx eax, r9b
and al, 0x8f
movzx r10d, al
shr al, 4
and r10b, 0xf
xor r10b, al
movzx eax, r9b
and al, 0x1f
movzx r8d, al
shr al, 4
and r8b, 0xf
xor r8b, al
movzx eax, r9b
and al, 0x3e
movzx edx, al
shr al, 4
and dl, 0xf
xor dl, al
movzx eax, r9b
and al, 0x7c
and r9b, 0xf8
movzx ecx, al
shr al, 4
and cl, 0xf
xor cl, al
movzx eax, r9b
and al, 0xf
shr r9b, 4
xor al, r9b
movzx eax, al
mov r9d, eax
and eax, 3
shr r9d, 2
xor r9d, eax
movzx eax, cl
mov ecx, eax
and eax, 3
shr ecx, 2
xor ecx, eax
movzx eax, dl
mov edx, eax
and eax, 3
shr edx, 2
xor edx, eax
movzx eax, r8b
mov r8d, eax
and eax, 3
shr r8d, 2
xor r8d, eax
movzx eax, r10b
mov r10d, eax
and eax, 3
shr r10d, 2
xor r10d, eax
movzx eax, r11b
mov r11d, eax
and eax, 3
shr r11d, 2
xor r11d, eax
movzx eax, bl
mov ebx, eax
shr ebx, 2
and eax, 3
lea r14, [r14 + 1]
xor ebx, eax
mov esi, r9d
shr esi, 1
and r9d, 1
xor esi, r9d
movzx eax, dil
mov edi, eax
add esi, esi
and eax, 3
shr edi, 2
xor edi, eax
mov eax, ecx
shr eax, 1
and ecx, 1
xor eax, ecx
or esi, eax
mov eax, edx
shr eax, 1
add esi, esi
and edx, 1
xor eax, edx
or esi, eax
mov eax, r8d
shr eax, 1
add esi, esi
and r8d, 1
xor eax, r8d
or esi, eax
mov eax, r10d
shr eax, 1
add esi, esi
and r10d, 1
xor eax, r10d
or esi, eax
mov eax, r11d
shr eax, 1
add esi, esi
and r11d, 1
xor eax, r11d
or esi, eax
mov eax, ebx
shr eax, 1
add esi, esi
and ebx, 1
xor eax, ebx
or esi, eax
mov eax, edi
add esi, esi
shr eax, 1
and edi, 1
xor eax, edi
or esi, eax
xor esi, 0x63
mov byte [r14 + r15 + 0x29632f], sil
sub rbp, 1
jne 0x1401d6420
mov r15, qword [rsp + 0x20]
mov al, 1
mov r14, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
add rsp, 0x38
ret
Function at 0x1401d6620
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov byte [0x140296230], 0
lea rsi, [0x140296231]
mov edi, 1
nop dword [rax]
nop word [rax + rax]
mov ebx, 1
movzx r10d, bl
movzx eax, dil
xor r9b, r9b
mov r11d, 8
nop word [rax + rax]
movzx ecx, r9b
movzx r8d, r10b
xor cl, al
movzx edx, cl
and r8b, 1
movzx ecx, r9b
cmove edx, ecx
movzx ecx, al
add cl, cl
shr r10b, 1
movzx r9d, dl
movzx edx, cl
movzx ecx, al
movzx eax, dl
xor al, 0x1b
test cl, cl
movzx eax, al
cmovns eax, edx
sub r11d, 1
jne 0x1401d6670
cmp r9b, 1
je 0x1401d66b7
inc ebx
jmp 0x1401d6655
mov byte [rsi], bl
inc edi
inc rsi
cmp edi, 0xff
jbe 0x1401d6650
mov rbx, qword [rsp + 8]
mov al, 1
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret