joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400036d0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x1400036e8
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x1400036f0
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x140003700
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx r8d, word [rcx + 6]
movzx eax, word [rcx + 0x14]
test r8w, r8w
lea rax, [rcx + rax + 0x18]
je 0x14000374d
lea ecx, [r8 - 1]
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
cmp rdx, r8
mov rcx, r8
jb 0x140003744
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x14000374f
add rax, 0x28
cmp rax, r9
jne 0x140003730
xor eax, eax
ret

Function at 0x140003750
Capabilities:
Parse pe header

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, rcx
call sym.strlen
cmp rax, 8
ja 0x1400037e0
mov rdx, qword [0x140006d30]
xor ebx, ebx
cmp word [rdx], 0x5a4d
jne 0x1400037ce
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
jne 0x1400037ce
cmp word [rax + 0x18], 0x20b
jne 0x1400037ce
movzx edx, word [rax + 0x14]
lea rbx, [rax + rdx + 0x18]
movzx edx, word [rax + 6]
test dx, dx
je 0x1400037e0
lea eax, [rdx - 1]
lea rax, [rax + rax*4]
lea rdi, [rbx + rax*8 + 0x28]
jmp 0x1400037b9
add rbx, 0x28
cmp rbx, rdi
je 0x1400037e0
mov r8d, 8
mov rdx, rsi
mov rcx, rbx
call sym.strncmp
test eax, eax
jne 0x1400037b0
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
xor ebx, ebx
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x1400037f0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140006d30]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140003810
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140003818
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140003810
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x14000386d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x140003864
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140003810
add rax, 0x28
cmp rax, r9
jne 0x140003850
xor eax, eax
ret

Function at 0x140003870
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140006d30]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x14000388f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140003898
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x14000388f
movzx ecx, word [rax + 6]
mov eax, ecx
ret
Function at 0x1400038b0
Capabilities:
Parse pe header

Disassembly:
mov r8, qword [0x140006d30]
xor eax, eax
cmp word [r8], 0x5a4d
jne 0x1400038d0
movsxd rdx, dword [r8 + 0x3c]
add rdx, r8
cmp dword [rdx], 0x4550
je 0x1400038d8
ret
cmp word [rdx + 0x18], 0x20b
jne 0x1400038d0
movzx r8d, word [rdx + 6]
movzx eax, word [rdx + 0x14]
test r8w, r8w
lea rax, [rdx + rax + 0x18]
je 0x140003920
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea rdx, [rax + rdx*8 + 0x28]
nop dword [rax]
test byte [rax + 0x27], 0x20
je 0x140003917
test rcx, rcx
je 0x1400038d0
sub rcx, 1
add rax, 0x28
cmp rax, rdx
jne 0x140003908
xor eax, eax
ret

Function at 0x140003930
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140006d30]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x14000394f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140003958
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x140003970
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140006d30]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140003990
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140003998
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140003990
movzx r9d, word [r8 + 6]
sub rcx, rdx
movzx edx, word [r8 + 0x14]
test r9w, r9w
lea rdx, [r8 + rdx + 0x18]
je 0x140003990
lea eax, [r9 - 1]
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
cmp rcx, r8
mov rax, r8
jb 0x1400039e4
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x1400039f0
add rdx, 0x28
cmp r9, rdx
jne 0x1400039d0
xor eax, eax
ret
mov eax, dword [rdx + 0x24]
not eax
shr eax, 0x1f
ret

Function at 0x140003a00
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x140006d30]
xor r9d, r9d
cmp word [r11], 0x5a4d
jne 0x140003a22
movsxd r8, dword [r11 + 0x3c]
add r8, r11
cmp dword [r8], 0x4550
je 0x140003a30
mov rax, r9
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140003a22
mov eax, dword [r8 + 0x90]
test eax, eax
je 0x140003a22
movzx r10d, word [r8 + 6]
movzx edx, word [r8 + 0x14]
test r10w, r10w
lea rdx, [r8 + rdx + 0x18]
je 0x140003a22
lea r8d, [r10 - 1]
lea r8, [r8 + r8*4]
lea r10, [rdx + r8*8 + 0x28]
nop word cs:[rax + rax]
mov r9d, dword [rdx + 0xc]
cmp rax, r9
mov r8, r9
jb 0x140003a85
add r8d, dword [rdx + 8]
cmp rax, r8
jb 0x140003a98
add rdx, 0x28
cmp rdx, r10
jne 0x140003a70
xor r9d, r9d
mov rax, r9
ret
add rax, r11
jmp 0x140003aa7
sub ecx, 1
add rax, 0x14
mov r8d, dword [rax + 4]
test r8d, r8d
jne 0x140003ab7
mov edx, dword [rax + 0xc]
test edx, edx
je 0x140003a8e
test ecx, ecx
jg 0x140003aa0
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
ret
Function at 0x1400170f0
Capabilities:
Parse pe header

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x228
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x1a0], 0xfffffffffffffffe
mov r13, rcx
mov qword [rbp - 8], rdx
mov qword [rbp], r8
mov dword [rbp + 8], 2
mov dword [rbp + 8], 3
mov dword [rbp + 8], 4
mov dword [rbp + 8], 5
mov dword [rbp + 8], 6
mov dword [rbp + 8], 7
mov dword [rbp + 8], 8
mov dword [rbp + 8], 9
mov dword [rbp + 8], 0xa
mov dword [rbp + 8], 0xb
mov dword [rbp + 8], 0xc
mov dword [rbp + 8], 0xd
mov dword [rbp + 8], 0xe
mov dword [rbp + 8], 0xf
mov dword [rbp + 8], 0x10
mov dword [rbp + 8], 0x11
mov dword [rbp + 8], 0x12
mov dword [rbp + 8], 0x13
mov dword [rbp + 8], 0x14
mov dword [rbp + 8], 0x15
mov dword [rbp + 8], 0x16
mov dword [rbp + 8], 0x17
mov dword [rbp + 8], 0x18
mov dword [rbp + 8], 0x19
mov dword [rbp + 8], 0x1a
mov dword [rbp + 8], 0x1b
mov dword [rbp + 8], 0x1c
mov dword [rbp + 8], 0x1d
mov dword [rbp + 8], 0x1e
mov dword [rbp + 8], 0x1f
mov dword [rbp + 8], 0x20
mov dword [rbp + 8], 0x21
mov dword [rbp + 8], 0x22
mov dword [rbp + 8], 0x23
mov dword [rbp + 8], 0x24
mov dword [rbp + 8], 0x25
mov dword [rbp + 8], 0x26
mov dword [rbp + 8], 0x27
mov dword [rbp + 8], 0x28
mov dword [rbp + 8], 0x29
mov dword [rbp + 8], 0x2a
mov dword [rbp + 8], 0x2b
mov dword [rbp + 8], 0x2c
mov dword [rbp + 8], 0x2d
mov dword [rbp + 8], 0x2e
mov dword [rbp + 8], 0x2f
mov dword [rbp + 8], 0x30
mov dword [rbp + 8], 0x31
mov dword [rbp + 8], 0x32
mov dword [rbp + 8], 0x33
mov dword [rbp + 8], 0x34
mov dword [rbp + 8], 0x35
mov dword [rbp + 8], 0x36
mov dword [rbp + 8], 0x37
mov dword [rbp + 8], 0x38
mov dword [rbp + 8], 0x39
mov dword [rbp + 8], 0x3a
mov dword [rbp + 8], 0x3b
mov dword [rbp + 8], 0x3c
mov dword [rbp + 8], 0x3d
mov dword [rbp + 8], 0x3e
mov dword [rbp + 8], 0x3f
mov dword [rbp + 8], 0x40
mov dword [rbp + 8], 0x41
mov dword [rbp + 8], 0x42
mov dword [rbp + 8], 0x43
mov dword [rbp + 8], 0x44
mov dword [rbp + 8], 0x45
mov dword [rbp + 8], 0x46
mov dword [rbp + 8], 0x47
mov dword [rbp + 8], 0x48
mov dword [rbp + 8], 0x49
mov dword [rbp + 8], 0x4a
mov dword [rbp + 8], 0x4b
mov dword [rbp + 8], 0x4c
mov dword [rbp + 8], 0x4d
mov dword [rbp + 8], 0x4e
mov dword [rbp + 8], 0x4f
mov dword [rbp + 8], 0x50
mov dword [rbp + 8], 0x51
mov dword [rbp + 8], 0x52
mov dword [rbp + 8], 0x53
mov dword [rbp + 8], 0x54
mov dword [rbp + 8], 0x55
mov dword [rbp + 8], 0x56
mov dword [rbp + 8], 0x57
mov dword [rbp + 8], 0x58
mov dword [rbp + 8], 0x59
mov dword [rbp + 8], 0x5a
mov dword [rbp + 8], 0x5b
mov dword [rbp + 8], 0x5c
mov dword [rbp + 8], 0x5d
mov dword [rbp + 8], 0x5e
mov dword [rbp + 8], 0x5f
mov dword [rbp + 8], 0x60
mov dword [rbp + 8], 0x61
mov dword [rbp + 8], 0x62
mov dword [rbp + 8], 0x63
mov dword [rbp + 8], 0x64
mov dword [rbp + 8], 0x65
mov ecx, 2
xor edx, edx
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov rdi, rax
cmp rax, 0xffffffffffffffff
mov eax, 0x10
mov ecx, 0x78
cmove ecx, eax
lea r12, [0x1401ef650]
movabs r15, 0xea9d636c3c0038a9
mov rax, qword [rcx + r12]
add rax, r15
jmp rax
Function at 0x140024a90
Capabilities:
Get memory capacity

Disassembly:
push rsi
sub rsp, 0xe0
movaps xmmword [rsp + 0xd0], xmm6
mov rsi, rcx
xorps xmm6, xmm6
movaps xmmword [rsp + 0x90], xmm6
movaps xmmword [rsp + 0xc0], xmm6
movaps xmmword [rsp + 0xb0], xmm6
movaps xmmword [rsp + 0xa0], xmm6
mov dword [rsp + 0x90], 0x40
lea rcx, [rsp + 0x90]
call sub.kernel32.dll_GlobalMemoryStatusEx
movups xmm0, xmmword [rsp + 0x98]
movups xmmword [rsi + 0x138], xmm0
movaps xmmword [rsp + 0x70], xmm6
movaps xmmword [rsp + 0x60], xmm6
movaps xmmword [rsp + 0x50], xmm6
movaps xmmword [rsp + 0x40], xmm6
movaps xmmword [rsp + 0x30], xmm6
movaps xmmword [rsp + 0x20], xmm6
mov qword [rsp + 0x80], 0
lea rcx, [rsp + 0x20]
mov edx, 0x68
call sub.psapi.dll_GetPerformanceInfo
cmp eax, 1
jne 0x140024b7c
mov rdx, qword [rsp + 0x30]
mov r9, qword [rsp + 0x40]
xor r10d, r10d
sub rdx, r9
cmovb rdx, r10
mov rcx, qword [rsp + 0x70]
mov rax, rcx
mul rdx
mov r8, rax
mov r11, 0xffffffffffffffff
cmovo r8, r11
mov rdx, qword [rsp + 0x28]
sub rdx, r9
cmovb rdx, r10
mov rax, rcx
mul rdx
cmovo rax, r11
mov qword [rsi + 0x148], r8
mov qword [rsi + 0x150], rax
movaps xmm6, xmmword [rsp + 0xd0]
add rsp, 0xe0
pop rsi
ret
Function at 0x140025280
Capabilities:
Get hostname

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x60
lea rbp, [rsp + 0x60]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rsi, rcx
mov dword [rbp - 0xc], 0
lea r8, [rbp - 0xc]
mov ecx, 5
xor edx, edx
call sub.kernel32.dll_GetComputerNameExW
mov ebx, dword [rbp - 0xc]
test rbx, rbx
je 0x140025316
lea rdi, [rbx + rbx]
mov edx, 2
mov rcx, rdi
call fcn.140021c20
test rax, rax
je 0x1400253c3
mov r14, rax
lea r8, [rbp - 0xc]
mov ecx, 5
mov rdx, rax
call sub.kernel32.dll_GetComputerNameExW
cmp eax, 1
jne 0x14002536c
xor r8d, r8d
mov qword [rbp - 0x18], rbx
nop word [rax + rax]
cmp word [r14 + r8*2], 0
je 0x14002533b
inc r8
add rdi, 0xfffffffffffffffe
jne 0x140025300
mov r8, rbx
jmp 0x14002533b
mov r14d, 2
lea r8, [rbp - 0xc]
mov edx, 2
mov ecx, 5
call sub.kernel32.dll_GetComputerNameExW
cmp eax, 1
jne 0x14002537d
mov qword [rbp - 0x18], rbx
xor r8d, r8d
lea rcx, [rbp - 0x38]
mov qword [rbp - 0x20], r14
mov rdx, r14
call fcn.14011e2c0
movabs rax, 0x8000000000000000
cmp qword [rbp - 0x38], rax
jne 0x14002538c
mov qword [rsi], rax
mov rdx, qword [rbp - 0x18]
test edx, edx
mov rcx, qword [rbp - 0x20]
jne 0x1400253a7
jmp 0x1400253b5
mov r8d, 2
mov rcx, r14
mov rdx, rdi
call fcn.140021c00
movabs rax, 0x8000000000000000
mov qword [rsi], rax
jmp 0x1400253b5
mov rax, qword [rbp - 0x28]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rbp - 0x38]
movups xmmword [rsi], xmm0
mov rdx, qword [rbp - 0x18]
test edx, edx
mov rcx, qword [rbp - 0x20]
je 0x1400253b5
add rdx, rdx
mov r8d, 2
call fcn.140021c00
mov rax, rsi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov ecx, 2
mov rdx, rdi
call fcn.14013d680
int3
Function at 0x140026370
Capabilities:
Reference wmi statements

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x30], 0
mov r15, qword [rdx + 0x10]
test r15, r15
je 0x140026447
lea rcx, [0x140141dc6]
call sub.oleaut32.dll_SysAllocString
mov rbx, rax
lea rcx, str.SELECT__FROM_MSAcpi_ThermalZoneTemperature
call sub.oleaut32.dll_SysAllocString
mov r14, rax
mov rcx, qword [rsi + 0x18]
mov rax, qword [rcx]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], 0
mov rdx, rbx
mov r8, r14
mov r9d, 0x30
call qword [rax + 0xa0]
mov ebp, eax
mov rcx, rbx
call sub.oleaut32.dll_SysFreeString
mov rcx, r14
call sub.oleaut32.dll_SysFreeString
test ebp, ebp
js 0x140026447
mov rbx, qword [rsp + 0x30]
cmp qword [rsi + 0x20], 0
je 0x140026413
mov rcx, qword [rsi + 0x28]
test rcx, rcx
je 0x140026413
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsi + 0x20], 1
mov qword [rsi + 0x28], rbx
mov rax, qword [rsi + 0x30]
mov qword [rdi + 0x30], rax
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movups xmmword [rdi + 0x10], xmm1
movups xmmword [rdi], xmm0
mov rax, qword [rsi + 0x20]
mov qword [rdi + 0x20], rax
mov rax, qword [rsi + 0x28]
mov qword [rdi + 0x28], rax
jmp 0x1400264af
mov qword [rdi], 2
mov rcx, qword [rsi + 0x28]
cmp qword [rsi + 0x20], 0
mov qword [rsi + 0x20], 0
je 0x14002646c
test rcx, rcx
je 0x14002646c
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x18]
mov qword [rsi + 0x10], 0
test r15, r15
je 0x140026488
test rcx, rcx
je 0x140026488
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsi + 8]
cmp qword [rsi], 0
mov qword [rsi], 0
je 0x1400264a4
test rcx, rcx
je 0x1400264a4
mov rax, qword [rcx]
call qword [rax + 0x10]
cmp byte [rsi + 0x30], 0
je 0x1400264af
call fcn.140133bcb
nop
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400271e0
Capabilities:
Get disk size

Disassembly:
push rsi
sub rsp, 0x30
cmp qword [rcx + 0x78], 0
je 0x140027223
mov rsi, rcx
mov qword [rsp + 0x28], 0
mov rcx, qword [rcx + 0x50]
lea r9, [rsp + 0x28]
xor edx, edx
xor r8d, r8d
call sub.kernel32.dll_GetDiskFreeSpaceExW
test eax, eax
je 0x140027223
mov rax, qword [rsp + 0x28]
mov qword [rsi + 0x80], rax
mov al, 1
add rsp, 0x30
pop rsi
ret
xor eax, eax
add rsp, 0x30
pop rsi
ret

Function at 0x140028ea0
Capabilities:
Accept command line arguments

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0x80]
mov qword [rbp], 0xfffffffffffffffe
mov rax, rdx
mov rdi, rcx
lea rdx, [rbp - 4]
mov rcx, rax
call sub.shell32.dll_CommandLineToArgvW
test rax, rax
je 0x140028fa2
mov rsi, rax
mov qword [rbp - 0x28], rdi
movsxd rax, dword [rbp - 4]
mov qword [rbp - 0x20], 0
mov qword [rbp - 0x18], 8
mov qword [rbp - 0x10], 0
lea r13, [rsi + rax*8]
lea rbx, [rbp - 0x40]
lea r14, [rbp - 0x58]
lea r15, [rbp - 0x20]
mov rdi, rsi
jmp 0x140028f44
add rdi, 8
mov rax, qword [rbp - 0x18]
lea rcx, [r12 + r12*2]
mov rdx, qword [rbp - 0x30]
mov qword [rax + rcx*8 + 0x10], rdx
movups xmm0, xmmword [rbp - 0x40]
movups xmmword [rax + rcx*8], xmm0
inc r12
mov qword [rbp - 0x10], r12
cmp rdi, r13
je 0x140028f85
mov r12, qword [rdi]
mov rcx, r12
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
lea rax, [r12 + rax*2]
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x50], rax
mov word [rbp - 0x48], 0
mov rcx, rbx
mov rdx, r14
call fcn.140032660
mov r12, qword [rbp - 0x10]
cmp r12, qword [rbp - 0x20]
jne 0x140028f20
mov rcx, r15
call fcn.14002fc30
jmp 0x140028f20
mov rcx, rsi
call sub.kernel32.dll_LocalFree
movups xmm0, xmmword [rbp - 0x20]
mov rcx, qword [rbp - 0x28]
movups xmmword [rcx], xmm0
mov rax, qword [rbp - 0x10]
mov qword [rcx + 0x10], rax
jmp 0x140028fb9
mov qword [rdi], 0
mov qword [rdi + 8], 8
mov qword [rdi + 0x10], 0
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x14002c540
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x14002c582
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 4
jb 0x14002c58a
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x14002c59b
jmp 0x14002c5b2
xor r10d, r10d
jmp 0x14002c63d
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x14002c5b2
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x14002c5c9
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x14002c5e9
add r11, r8
jmp 0x14002c71b
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x14002c6b2
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x14002c660
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 4
jb 0x14002c6d0
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x14002c6e2
jmp 0x14002c6fd
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x14002c6fd
lea rcx, [rdx + r8]
movzx esi, word [r10 + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x14002c717
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x14002e690
Capabilities:
Get local ipv4 addresses

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x20], 0xfffffffffffffffe
mov rsi, rcx
mov dword [rbp + 0x1c], 0x3c00
mov dword [rbp + 0x18], 0
xor r15d, r15d
lea rdi, [rbp + 0x1c]
xor ebx, ebx
nop dword [rax]
mov edx, dword [rbp + 0x1c]
mov rcx, r15
call sub.api_ms_win_crt_heap_l1_1_0.dll_realloc
mov r14, rax
test rax, rax
je 0x14002e785
mov qword [rsp + 0x20], rdi
xor ecx, ecx
mov edx, 0xe
xor r8d, r8d
mov r9, r14
call sub.iphlpapi.dll_GetAdaptersAddresses
mov dword [rbp + 0x18], eax
test eax, eax
je 0x14002e7e6
cmp ebx, 1
ja 0x14002e718
inc ebx
mov r15, r14
cmp eax, 0x6f
je 0x14002e6d0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x10], rax
lea rax, [0x14012b8a0]
mov qword [rbp - 8], rax
lea rax, [0x140142510]
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], 1
mov qword [rbp - 0x38], 0
lea rax, [rbp - 0x10]
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], 1
mov qword [rbp + 8], r14
lea rcx, [rbp - 0x28]
lea rdx, [rbp - 0x58]
mov qword [rbp + 0x10], r14
call fcn.14011e110
mov rax, qword [rbp - 0x18]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rbp - 0x28]
movups xmmword [rsi], xmm0
mov rcx, qword [rbp + 0x10]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
jmp 0x14002e7fb
movzx eax, byte [0x1401f1d21]
mov ecx, 0x32
mov edx, 1
call fcn.140021bf0
test rax, rax
je 0x14002e80e
mov rdi, rax
movups xmm0, xmmword [0x1401424d0]
movups xmmword [rax + 0x20], xmm0
movups xmm0, xmmword [0x1401424c0]
movups xmmword [rax + 0x10], xmm0
movups xmm0, xmmword [str.failed_to_allocate_memory_for_IP_ADAPTER_ADDRESSESGetAdaptersAddresses___failed_with_code]
movups xmmword [rax], xmm0
mov word [rax + 0x30], 0x5345
mov rcx, r15
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rsi], 0x32
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], 0x32
jmp 0x14002e7fb
mov qword [rsi + 8], r14
mov qword [rsi + 0x10], r14
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov rax, rsi
add rsp, 0xa8
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
mov qword [rbp], r15
mov qword [rbp + 0x10], r14
mov ecx, 1
mov edx, 0x32
call fcn.14013d680
ud2
Function at 0x140096af0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x10
test rdx, rdx
je 0x140096c1f
movzx r8d, byte [rcx]
dec rdx
inc rcx
mov eax, edx
and eax, 0xf
mov r9, rdx
and r9, 0xfffffffffffffff0
je 0x140096b7a
xor r10d, r10d
movdqa xmm0, xmmword [0x140153a20]
movdqa xmm1, xmmword [0x140142590]
nop dword [rax]
movdqu xmm2, xmmword [rcx + r10]
movdqa xmm3, xmm2
pslldq xmm3, 1
movzx r8d, r8b
movd xmm4, r8d
movdqa xmm5, xmm0
pandn xmm5, xmm4
por xmm5, xmm3
movdqa xmm3, xmm2
psubb xmm3, xmm5
pxor xmm3, xmm1
movdqu xmmword [rcx + r10], xmm3
movdqa xmmword [rsp], xmm2
movzx r8d, byte [rsp + 0xf]
add r10, 0x10
cmp r9, r10
jne 0x140096b30
test rax, rax
je 0x140096c1f
add rcx, r9
and rdx, 3
je 0x140096bb6
mov r11, rcx
nop
lea r9, [r11 + 1]
movzx r10d, byte [r11]
mov ebx, r10d
sub bl, r8b
add bl, 0x80
mov byte [r11], bl
mov r8d, r10d
mov r11, r9
dec rdx
jne 0x140096b90
cmp eax, 4
jae 0x140096bc1
jmp 0x140096c1f
mov r10d, r8d
mov r9, rcx
cmp eax, 4
jb 0x140096c1f
add rcx, rax
nop word cs:[rax + rax]
movzx eax, byte [r9]
movzx edx, byte [r9 + 1]
mov r8d, edx
sub r8b, al
sub al, r10b
add al, 0x80
mov byte [r9], al
add r8b, 0x80
mov byte [r9 + 1], r8b
movzx eax, byte [r9 + 2]
mov r8d, eax
sub r8b, dl
add r8b, 0x80
mov byte [r9 + 2], r8b
movzx r10d, byte [r9 + 3]
mov edx, r10d
sub dl, al
add dl, 0x80
mov byte [r9 + 3], dl
lea rax, [r9 + 4]
mov r9, rax
cmp rax, rcx
jne 0x140096bd0
add rsp, 0x10
pop rbx
ret
Function at 0x1400a41f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r8
mov rdi, rdx
cmp r9, 8
jb 0x1400a4265
shr r9, 3
mov rbx, r9
shl rbx, 4
lea rdx, [rcx + rbx]
lea rax, [r9 + r9*8]
lea r14, [rax + rax*2]
add r14, r9
lea r8, [rcx + r14]
mov r15, r9
call fcn.1400a41f0
mov r12, rax
lea rdx, [rdi + rbx]
lea r8, [rdi + r14]
mov rcx, rdi
mov r9, r15
call fcn.1400a41f0
mov rdi, rax
add rbx, rsi
add r14, rsi
mov rcx, rsi
mov rdx, rbx
mov r8, r14
mov r9, r15
call fcn.1400a41f0
mov rsi, rax
mov rcx, r12
movzx r9d, byte [rcx]
movzx edx, byte [rdi]
cmp r9b, dl
setb al
jne 0x1400a4296
movzx eax, byte [rcx + 1]
cmp al, byte [rdi + 1]
setb al
jne 0x1400a4296
movzx eax, byte [rcx + 2]
cmp al, byte [rdi + 2]
setb al
jne 0x1400a4296
movzx eax, byte [rcx + 3]
cmp al, byte [rdi + 3]
setb al
movzx r8d, byte [rsi]
cmp r9b, r8b
setb r9b
jne 0x1400a42ce
movzx r9d, byte [rcx + 1]
cmp r9b, byte [rsi + 1]
setb r9b
jne 0x1400a42ce
movzx r9d, byte [rcx + 2]
cmp r9b, byte [rsi + 2]
setb r9b
jne 0x1400a42ce
movzx r9d, byte [rcx + 3]
cmp r9b, byte [rsi + 3]
setb r9b
cmp al, r9b
jne 0x1400a4306
cmp dl, r8b
setb cl
jne 0x1400a42fd
movzx ecx, byte [rdi + 1]
cmp cl, byte [rsi + 1]
setb cl
jne 0x1400a42fd
movzx ecx, byte [rdi + 2]
cmp cl, byte [rsi + 2]
setb cl
jne 0x1400a42fd
movzx ecx, byte [rdi + 3]
cmp cl, byte [rsi + 3]
setb cl
xor al, cl
cmovne rdi, rsi
mov rcx, rdi
mov rax, rcx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret