joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140032a30
Capabilities:
Get common file path
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x230
mov rax, qword [0x1406bd868]
xor rax, rsp
mov qword [rsp + 0x220], rax
mov rbx, qword [rcx + 8]
xor ebp, ebp
mov rax, qword [rcx + 0x10]
mov rdi, rcx
sub rax, rbx
mov esi, ebp
cmp rax, 0x38
jb 0x140032a7b
lea rax, [rbx + 0x38]
mov qword [rcx + 8], rax
jmp 0x140032a88
mov edx, 0x38
call fcn.14000dd30
mov rbx, rax
xor eax, eax
test rbx, rbx
je 0x140032b6a
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
movups xmmword [rbx], xmm0
mov edx, 0x200
movups xmmword [rbx + 0x10], xmm0
movups xmmword [rbx + 0x20], xmm0
mov qword [rbx + 0x30], rax
call fcn.140033cf0
test rax, rax
je 0x140032acb
mov r8, rbx
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.140032580
mov esi, eax
mov edx, 0x200
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x140032af1
mov r8, rbx
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.140032580
add esi, eax
mov r8, rbx
lea rdx, [0x140101ea4]
mov rcx, rdi
call fcn.140032580
mov edx, 0x200
lea rcx, [rsp + 0x20]
add esi, eax
call fcn.140033c70
test rax, rax
je 0x140032b2b
mov r8, rbx
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.140032580
add esi, eax
lea rcx, str.MYSQL_HOME
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x140032b4d
mov r8, rbx
mov rdx, rax
mov rcx, rdi
call fcn.140032580
add esi, eax
mov r8, rbx
lea rdx, [0x1400fb935]
mov rcx, rdi
call fcn.140032580
add eax, esi
test eax, eax
cmovg rbx, rbp
mov rax, rbx
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.1400f2410
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140033bd0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rbx, rdx
lea rcx, str.MYSQL_TEST_LOGIN_FILE
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x140033c08
lea rcx, str.MYSQL_TEST_LOGIN_FILE
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
lea r8, [0x1400fc5d0]
jmp 0x140033c2e
lea rcx, str.APPDATA
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x140033c52
lea rcx, str.APPDATA
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
lea r8, str._sMySQL.mylogin.cnf
mov r9, rax
mov rdx, rbx
mov rcx, rdi
call fcn.14000ae80
movsxd rcx, eax
xor eax, eax
test rcx, rcx
setne al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov r8, rbx
xor edx, edx
mov rcx, rdi
call fcn.1400f35da
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret

Function at 0x140033cf0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rbx, rdx
lea rcx, [0x140101e88]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.GetSystemWindowsDirectoryA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, ebx
mov rcx, rdi
test rax, rax
je 0x140033d36
call rax
mov eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov ebx, eax
cmp rbx, 8
jbe 0x140033d63
lea rcx, [rdi - 8]
add rcx, rbx
lea rdx, str.System32
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x140033d63
sub rbx, 8
mov byte [rbx + rdi], al
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140037570
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, r8
mov rdi, rdx
xor r8d, r8d
mov rbx, rcx
call fcn.140037400
test eax, eax
jg 0x140037660
cmp byte [rbx], 0
mov ecx, 2
mov rdi, qword [rdi + 0x10]
jne 0x1400375c0
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, rsi
lea rdx, str.No_option_given_to__s_n
mov rcx, rax
call fcn.140009f30
jmp 0x1400375db
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9, rbx
lea rdx, str.Unknown_option_to__s:__s_n
mov rcx, rax
mov r8, rsi
call fcn.140009f30
mov rbx, qword [rdi]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, rbx
lea rdx, str.Alternatives_are:__s
mov rcx, rax
call fcn.140009f30
mov rbx, qword [rdi + 8]
add rdi, 8
test rbx, rbx
je 0x14003763a
nop dword [rax + rax]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, rbx
lea rdx, [0x140101f48]
mov rcx, rax
call fcn.140009f30
mov rbx, qword [rdi + 8]
lea rdi, [rdi + 8]
test rbx, rbx
jne 0x140037610
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, reloc.WS2_32.dll_ioctlsocket
call fcn.140009f30
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140040540
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rax, rdx
mov edi, r9d
mov r9, rcx
mov rsi, rcx
mov rcx, rax
mov edx, 1
mov rbx, r8
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rbp, rax
cmp rax, rbx
je 0x14004061b
test dil, 0x1a
je 0x1400405e1
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ferror]
test eax, eax
je 0x1400405b0
mov rcx, rsi
call fcn.140040530
mov ecx, eax
call fcn.1400763c0
mov rbx, rax
call fcn.140040810
mov edx, 2
mov ecx, eax
jmp 0x1400405d6
mov eax, edi
and eax, 6
je 0x1400405e1
mov rcx, rsi
call fcn.140040530
mov ecx, eax
call fcn.1400763c0
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov edx, 9
mov ecx, dword [rax]
mov r9, rbx
xor r8d, r8d
call fcn.14002bf70
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 0
je 0x1400405f6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, dword [rax]
jmp 0x1400405fb
mov ecx, 0xffffffff
call fcn.140040d80
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ferror]
test eax, eax
jne 0x140040612
and edi, 6
je 0x140040624
mov rax, 0xffffffffffffffff
jmp 0x140040627
and edi, 6
je 0x140040624
xor eax, eax
jmp 0x140040627
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x140044e80
Capabilities:
Get file size

Disassembly:
jmp 0x140077660
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x60
mov rsi, rdx
mov ebx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
xor edi, edi
mov dword [rax], edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop
mov edx, ebx
lea rcx, [rsp + 0x40]
call fcn.1400768b0
mov rbp, qword [rax]
cmp rbp, 0xffffffffffffffff
je 0x140077741
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
lea r9, [rsp + 0x90]
mov r8, rbx
mov rdx, rbp
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x140077741
xor edx, edx
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__open_osfhandle]
mov r8d, eax
test eax, eax
js 0x140077741
mov edx, eax
lea rcx, [rsp + 0x98]
call fcn.1400766f0
mov rdx, rsi
mov ecx, r8d
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__fstat64]
test eax, eax
js 0x140077723
lea rdx, [rsi + 0x18]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x140077728
mov edi, 0xffffffff
cmp byte [rsp + 0x98], 0
jne 0x140077746
mov ecx, dword [rsp + 0x9c]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__close]
jmp 0x140077746
mov edi, 0xffffffff
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jne 0x14007775c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], ebx
je 0x1400777ac
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 0
je 0x14007778c
test ebx, ebx
je 0x14007778c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov esi, dword [rax]
mov ecx, ebx
call fcn.140075c50
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp esi, dword [rax]
je 0x14007778c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], esi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 0
jne 0x14007779e
mov ecx, ebx
call fcn.140075c50
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, dword [rax]
call fcn.140040d80
nop
mov eax, edi
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
Function at 0x140072d50
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xor ebx, ebx
mov r10d, r9d
lea r9, [r10 + rdx]
cmp rdx, r9
cmova r10d, ebx
test r10, r10
je 0x140072e12
cmp r10, 0x40
jb 0x140072e12
lea r11, [rcx - 1]
lea rax, [r8 - 1]
add r11, r10
add rax, r10
cmp rcx, rax
ja 0x140072d94
cmp r11, r8
jae 0x140072e12
lea rax, [rdx - 1]
add rax, r10
cmp rcx, rax
ja 0x140072da5
cmp r11, rdx
jae 0x140072e12
and r10, 0xffffffffffffffc0
nop dword [rax]
movdqu xmm0, xmmword [rdx]
add rbx, 0x40
movdqu xmm1, xmmword [r8]
pxor xmm1, xmm0
movdqu xmm0, xmmword [rdx + 0x10]
movdqu xmmword [rcx], xmm1
movdqu xmm1, xmmword [r8 + 0x10]
pxor xmm1, xmm0
movdqu xmm0, xmmword [rdx + 0x20]
movdqu xmmword [rcx + 0x10], xmm1
movdqu xmm1, xmmword [r8 + 0x20]
pxor xmm1, xmm0
movdqu xmm0, xmmword [rdx + 0x30]
add rdx, 0x40
movdqu xmmword [rcx + 0x20], xmm1
movdqu xmm1, xmmword [r8 + 0x30]
add r8, 0x40
pxor xmm1, xmm0
movdqu xmmword [rcx + 0x30], xmm1
add rcx, 0x40
cmp rbx, r10
jb 0x140072db0
cmp rdx, r9
jae 0x140072e32
sub r8, rdx
sub rcx, rdx
nop dword [rax]
movzx eax, byte [r8 + rdx]
xor al, byte [rdx]
mov byte [rcx + rdx], al
inc rdx
cmp rdx, r9
jb 0x140072e20
mov rbx, qword [rsp + 8]
ret

Function at 0x140074000
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x20
mov rcx, qword [rcx]
lea r8, [rsp + 0x30]
mov rbx, rdx
mov edx, 0x4004667f
call qword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
je 0x140074028
mov al, 1
add rsp, 0x20
pop rbx
ret
mov eax, dword [rsp + 0x30]
mov dword [rbx], eax
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x140074300
Capabilities:
Resolve dns

Disassembly:
sub rsp, 0x48
movzx eax, word [rcx]
mov r10, rdx
xor edx, edx
cmp ax, 2
je 0x14007431f
cmp ax, 0x17
jne 0x140074324
mov edx, 0x1c
jmp 0x140074324
mov edx, reloc.WS2_32.dll_recv
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r9
mov r9d, r8d
mov r8, r10
call qword [sym.imp.WS2_32.dll_getnameinfo]
add rsp, 0x48
ret
Function at 0x140074350
Capabilities:
Get socket status

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x6d8
mov rax, qword [0x1406bd868]
xor rax, rsp
mov qword [rsp + 0x6c0], rax
mov r15, qword [rcx]
xor edi, edi
mov qword [rsp + 0x60], rdi
mov ebx, r8d
mov esi, edx
mov r14, rcx
mov ebp, edi
cmp r15, 0xffffffffffffffff
jne 0x140074394
mov eax, r15d
jmp 0x140074549
mov qword [rsp + 0x718], r12
mov qword [rsp + 0x6d0], r13
test ebx, ebx
js 0x1400743ca
mov eax, 0x10624dd3
mov ecx, ebx
mul ebx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [rsp + 0x38], edx
sub ecx, eax
imul eax, ecx, 0x3e8
mov dword [rsp + 0x3c], eax
mov dword [rsp + 0x2a0], edi
mov ecx, esi
mov dword [rsp + 0x90], edi
mov qword [rsp + 0x4b8], r15
mov dword [rsp + 0x4b0], 1
test esi, esi
je 0x140074410
sub ecx, 1
je 0x1400743fb
cmp ecx, 1
jne 0x140074423
mov qword [rsp + 0x98], r15
mov dword [rsp + 0x90], 1
jmp 0x140074423
mov qword [rsp + 0x2a8], r15
mov dword [rsp + 0x2a0], 1
movups xmm0, xmmword [r14]
psrldq xmm0, 8
movq rdx, xmm0
test rdx, rdx
je 0x14007446e
cmp byte [rdx], dil
je 0x14007446e
mov rax, qword [0x140407800]
lea rcx, [rsp + 0x40]
xor r9d, r9d
mov dword [rsp + 0x28], 0x3b0
mov r10, qword [rax + 0x18]
lea rax, str.C:_build_sb_1_13696040_1702406430.87mysql_8.0.36_vio_viosocket.cc
lea r8d, [r9 + 0xe]
mov qword [rsp + 0x20], rax
call r10
mov r13, rax
jmp 0x140074471
mov r13, rdi
test ebx, ebx
lea r12, [rsp + 0x38]
cmovs r12, rdi
nop dword [rax]
lea r9, [rsp + 0x4b0]
mov qword [rsp + 0x20], r12
lea r8, [rsp + 0x90]
lea rdx, [rsp + 0x2a0]
lea ecx, [r15 + 1]
call qword [sym.imp.WS2_32.dll_select]
mov ebx, eax
test eax, eax
jns 0x1400744c3
mov rcx, r14
call fcn.140074bd0
test al, al
je 0x1400744c3
mov ecx, ebp
inc ebp
cmp ecx, dword [r14 + 0x20]
jl 0x140074480
mov r12, qword [rsp + 0x718]
test r13, r13
je 0x1400744df
mov rax, qword [0x140407800]
xor edx, edx
mov rcx, r13
call qword [rax + 0x20]
mov r13, qword [rsp + 0x6d0]
test ebx, ebx
jne 0x1400744fa
mov ecx, 0x274c
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, ebx
jmp 0x140074549
jg 0x140074500
mov eax, ebx
jmp 0x140074549
test esi, esi
je 0x140074518
sub esi, 1
je 0x14007450e
cmp esi, 1
jne 0x14007452f
lea rdx, [rsp + 0x90]
jmp 0x140074520
lea rdx, [rsp + 0x2a0]
mov rcx, r15
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
mov ebx, edi
setne bl
lea rdx, [rsp + 0x4b0]
mov rcx, r15
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
setne dil
or edi, ebx
mov eax, edi
mov rcx, qword [rsp + 0x6c0]
xor rcx, rsp
call fcn.1400f2410
add rsp, 0x6d8
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140074960
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x90
mov rbp, r8
mov qword [rax + 8], rsi
mov r14, rdx
lea r12, str.C:_build_sb_1_13696040_1702406430.87mysql_8.0.36_vio_viosocket.cc
mov rdi, rcx
xor r15d, r15d
movups xmm0, xmmword [rdi]
movaps xmmword [rsp + 0x30], xmm0
psrldq xmm0, 8
movq rdx, xmm0
test rdx, rdx
je 0x140074a14
cmp byte [rdx], r15b
je 0x140074a14
mov rax, qword [0x140407800]
lea rcx, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x60], r15
mov dword [rsp + 0x28], __WSAFDIsSet
mov qword [rsp + 0x20], r12
mov r10, qword [rax + 0x18]
lea r8d, [r9 + 5]
call r10
mov rcx, qword [rsp + 0x30]
xor r9d, r9d
mov r8d, ebp
mov rdx, r14
mov rsi, rax
call qword [sym.imp.WS2_32.dll_recv]
movsxd rbx, eax
test rsi, rsi
je 0x140074a2b
mov rax, qword [0x140407800]
cmp rbx, 0xffffffffffffffff
mov rdx, r15
mov rcx, rsi
cmovg rdx, rbx
call qword [rax + 0x20]
jmp 0x140074a2b
mov rcx, qword [rsp + 0x30]
xor r9d, r9d
mov r8d, ebp
mov rdx, r14
call qword [sym.imp.WS2_32.dll_recv]
movsxd rbx, eax
cmp rbx, 0xffffffffffffffff
jne 0x140074a62
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
add eax, 0xffffd8cd
cmp eax, 1
ja 0x140074a62
mov rcx, rdi
call fcn.140074570
test al, al
je 0x140074a8b
xor edx, edx
mov rcx, rdi
call fcn.140075110
movsxd rbx, eax
test eax, eax
je 0x140074993
mov rax, rbx
mov rsi, qword [rsp + 0xb0]
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
mov rax, 0xffffffffffffffff
jmp 0x140074a65

Function at 0x140074b70
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx]
lea r8, [rsp + 0x38]
movzx eax, dl
mov edx, 0x8004667e
xor eax, 1
mov dword [rsp + 0x38], eax
call qword [sym.imp.WS2_32.dll_ioctlsocket]
add rsp, 0x28
ret
Function at 0x140077660
Capabilities:
Get file size

Disassembly:
jmp 0x140077660
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x60
mov rsi, rdx
mov ebx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
xor edi, edi
mov dword [rax], edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop
mov edx, ebx
lea rcx, [rsp + 0x40]
call fcn.1400768b0
mov rbp, qword [rax]
cmp rbp, 0xffffffffffffffff
je 0x140077741
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
lea r9, [rsp + 0x90]
mov r8, rbx
mov rdx, rbp
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x140077741
xor edx, edx
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__open_osfhandle]
mov r8d, eax
test eax, eax
js 0x140077741
mov edx, eax
lea rcx, [rsp + 0x98]
call fcn.1400766f0
mov rdx, rsi
mov ecx, r8d
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__fstat64]
test eax, eax
js 0x140077723
lea rdx, [rsi + 0x18]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x140077728
mov edi, 0xffffffff
cmp byte [rsp + 0x98], 0
jne 0x140077746
mov ecx, dword [rsp + 0x9c]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__close]
jmp 0x140077746
mov edi, 0xffffffff
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jne 0x14007775c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], ebx
je 0x1400777ac
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 0
je 0x14007778c
test ebx, ebx
je 0x14007778c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov esi, dword [rax]
mov ecx, ebx
call fcn.140075c50
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp esi, dword [rax]
je 0x14007778c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], esi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 0
jne 0x14007779e
mov ecx, ebx
call fcn.140075c50
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, dword [rax]
call fcn.140040d80
nop
mov eax, edi
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
Function at 0x140081780
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xor r10d, r10d
mov ebx, edx
mov r11, rcx
test edx, edx
js 0x1400817b0
mov eax, r10d
lea r11, [r11 + 1]
cdq
inc r10d
idiv r9d
movsxd rax, edx
movzx ecx, byte [rax + r8]
xor byte [r11 - 1], cl
cmp r10d, ebx
jle 0x140081791
mov rbx, qword [rsp + 8]
ret

Function at 0x140093540
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movsx ebx, cl
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ecx, ebx
mov edi, eax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_toupper]
lea ecx, [rax - 0x41]
cmp cl, 0x19
ja 0x140093580
movsx ecx, al
sub ecx, 0x41
movzx edx, cl
bt edi, edx
jae 0x140093580
mov al, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor al, al
add rsp, 0x20
pop rdi
ret

Function at 0x1400937d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword [0x1405327e8]
mov rdi, r8
mov esi, edx
mov rbx, rcx
movsxd r9, r9d
add rsi, rcx
xor edx, edx
mov rcx, rdi
mov r10d, dword [rax + r9*4]
shr r10d, 3
mov r8d, r10d
lea rbp, [r10 + rdi]
call fcn.1400f35da
mov rax, rdi
cmp rbx, rsi
jae 0x140093837
nop word [rax + rax]
movzx ecx, byte [rbx]
cmp rax, rbp
cmove rax, rdi
inc rbx
xor byte [rax], cl
inc rax
cmp rbx, rsi
jb 0x140093820
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400948f0
Capabilities:
Get inbound credentials handle via credssp

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
mov ebx, r8d
mov rdi, rdx
mov rsi, rcx
lea rax, vtable.Handshake.0
mov qword [rcx], rax
xor ebp, ebp
mov dword [rcx + 0x30], ebp
mov dword [rcx + 0x38], ebp
mov word [rcx + 0x3c], bp
mov byte [rcx + 0x3e], bpl
add rcx, 0x40
call fcn.1400949f0
nop
lea rax, [rsi + 0x28]
lea rcx, [rsi + 0x18]
mov r8d, ebp
cmp ebx, 1
setne r8b
inc r8d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbp
xor r9d, r9d
mov rdx, rdi
xor ecx, ecx
call sub.Secur32.dll_AcquireCredentialsHandleA
mov ebx, eax
test eax, eax
je 0x140094986
lea rcx, str.Could_not_obtain_local_credentials_required_for_authentication
call fcn.1400822f0
mov dword [rsi + 0x38], ebx
mov byte [rsi + 0x3d], 1
mov rax, rsi
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x1400a0560
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
shr rax, 0x21
xor rax, rcx
movabs rcx, 0xc2b2ae3d27d4eb4f
imul rax, rcx
mov rcx, rax
shr rcx, 0x1d
xor rcx, rax
movabs rax, 0x165667b19e3779f9
imul rcx, rax
mov rax, rcx
shr rax, 0x20
xor rax, rcx
ret
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r15
sub rsp, 0x20
mov rsi, r8
mov qword [rsp + 0x50], r14
and esi, 0x1f
mov r14d, r9d
mov rdi, rdx
mov rbx, rcx
movabs r15, 0x9e3779b185ebca87
cmp rsi, 8
jb 0x14009fe61
mov qword [rsp + 0x40], rbp
mov ebp, esi
shr rbp, 3
imul rax, rbp, 0xfffffffffffffff8
mov qword [rsp + 0x48], r12
movabs r12, 0x7a1435883d4d519d
add rsi, rax
cmp r14d, 1
jne 0x14009fe32
mov rcx, rdi
call fcn.14009ffd0
jmp 0x14009fe35
mov rax, qword [rdi]
mov rdx, rax
xor ecx, ecx
add rdi, 8
call fcn.14009ff40
xor rbx, rax
rol rbx, 0x1b
imul rbx, r15
sub rbx, r12
sub rbp, 1
jne 0x14009fe22
mov r12, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
cmp rsi, 4
jb 0x14009fea9
cmp r14d, 1
jne 0x14009fe77
mov rcx, rdi
call fcn.14009ffb0
jmp 0x14009fe79
mov eax, dword [rdi]
mov eax, eax
add rdi, 4
imul rax, r15
xor rbx, rax
movabs rax, 0xc2b2ae3d27d4eb4f
rol rbx, 0x17
imul rbx, rax
movabs rax, 0x165667b19e3779f9
add rbx, rax
sub rsi, 4
mov r14, qword [rsp + 0x50]
test rsi, rsi
je 0x14009fedc
movabs rcx, 0x27d4eb2f165667c5
nop dword [rax]
movzx eax, byte [rdi]
lea rdi, [rdi + 1]
imul rax, rcx
xor rbx, rax
rol rbx, 0xb
imul rbx, r15
sub rsi, 1
jne 0x14009fec0
mov rcx, rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop rdi
pop rsi
jmp 0x14009fd90
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, qword [rcx]
mov rbx, rcx
cmp rdi, 0x20
jb 0x1400a05cc
mov rdx, qword [rcx + 8]
mov rcx, qword [rcx + 0x18]
mov rax, rdx
rol rax, 1
rol rcx, 0xc
add rcx, rax
mov rax, qword [rbx + 0x10]
rol rax, 7
add rcx, rax
mov rax, qword [rbx + 0x20]
rol rax, 0x12
add rcx, rax
call fcn.14009ff00
mov rdx, qword [rbx + 0x10]
mov rcx, rax
call fcn.14009ff00
mov rdx, qword [rbx + 0x18]
mov rcx, rax
call fcn.14009ff00
mov rdx, qword [rbx + 0x20]
mov rcx, rax
call fcn.14009ff00
jmp 0x1400a05dd
mov rax, qword [rcx + 0x18]
movabs rcx, 0x27d4eb2f165667c5
add rax, rcx
lea rdx, [rbx + 0x28]
xor r9d, r9d
lea rcx, [rdi + rax]
mov r8, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x14009fdd0
Function at 0x1400ee0f0
Capabilities:
Hash data with crc32

Disassembly:
mov r8d, ecx
lea r9, [0x1403d56d0]
shr r8d, 8
movzx ecx, cl
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx edx, r8b
shr r8d, 8
xor r8d, dword [r9 + rdx*4]
mov eax, r8d
ret
Function at 0x140004010
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x14000406d
lea rbx, [0x1400c6b20]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140004054
cmp r10, 2
jb 0x140004054
cmp byte [r9], r8b
jne 0x140004054
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x140004030
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x1400040af
lea rbx, [0x1400c6b20]
cmp r8b, 0x23
jne 0x140004093
cmp byte [r9], r8b
jne 0x140004093
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140004080
mov rbx, qword [rsp + 8]
not eax
ret