joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400833f0
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x680
mov rax, qword [0x140492fc0]
xor rax, rsp
mov qword [rsp + 0x670], rax
mov rax, qword [rsp + 0x6e8]
movzx r15d, r9b
mov r13, qword [rsp + 0x6e0]
movzx edi, r8b
mov qword [rsp + 0x38], rax
mov r12d, edx
mov rsi, rcx
test r8b, r8b
je 0x140083469
mov rcx, qword [rcx + 0xb0]
test rcx, rcx
je 0x140083469
call fcn.140028c30
test al, al
je 0x140083469
mov rcx, qword [rsi + 0xb0]
xor edx, edx
mov bpl, 1
call fcn.1401658f0
jmp 0x14008346c
xor bpl, bpl
xor edx, edx
lea rcx, [rsp + 0x250]
mov r8d, 0x208
call fcn.140259400
lea rbx, [rsi + 0xa8]
mov rcx, rbx
test dil, dil
je 0x1400834a6
mov rax, qword [rbx]
mov qword [rsp + 0x258], rax
mov dword [rsp + 0x250], 1
mov rdi, qword [rcx]
mov rax, rbx
mov r14, qword [rbx]
lea rcx, [rsp + 0x460]
xor edx, edx
mov r8d, 0x208
call fcn.140259400
xor r8d, r8d
mov dword [rsp + 0x40], r8d
test r15b, r15b
je 0x1400834f1
mov dword [rsp + 0x460], 1
mov qword [rsp + 0x468], r14
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x40], 1
mov eax, 0x10624dd3
lea r9, [rsp + 0x40]
imul r12d
mov ecx, r12d
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x3e8
mov dword [rsp + 0x30], edx
lea rdx, [rsp + 0x250]
sub ecx, eax
imul eax, ecx, 0x3e8
lea ecx, [rdi + 1]
test r12d, r12d
mov dword [rsp + 0x34], eax
lea rax, [rsp + 0x30]
cmovs rax, r8
lea r8, [rsp + 0x460]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_select]
mov edi, eax
test eax, eax
jle 0x140083564
mov rcx, qword [rbx]
lea rdx, [rsp + 0x40]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x140083564
dec edi
test bpl, bpl
je 0x140083577
mov rcx, qword [rsi + 0xb0]
mov dl, 1
call fcn.1401658f0
test edi, edi
jle 0x1400835b0
mov rcx, qword [rbx]
lea rdx, [rsp + 0x250]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
lea rdx, [rsp + 0x460]
setne al
mov byte [r13], al
mov rcx, qword [rbx]
call sub.WS2_32.dll___WSAFDIsSet
mov rcx, qword [rsp + 0x38]
test eax, eax
setne al
mov byte [rcx], al
mov eax, edi
mov rcx, qword [rsp + 0x670]
xor rcx, rsp
call fcn.140229fa0
mov rbx, qword [rsp + 0x6d0]
add rsp, 0x680
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400835e0
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x470
mov rax, qword [0x140492fc0]
xor rax, rsp
mov qword [rsp + 0x460], rax
movzx ebp, r8b
mov ebx, edx
mov rdi, rcx
test r8b, r8b
je 0x140083637
mov rcx, qword [rcx + 0xb0]
test rcx, rcx
je 0x140083637
call fcn.140028c30
test al, al
je 0x140083637
mov rcx, qword [rdi + 0xb0]
xor edx, edx
mov sil, 1
call fcn.1401658f0
jmp 0x14008363a
xor sil, sil
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x208
call fcn.140259400
mov r8, qword [rdi + 0xa8]
mov eax, 0x10624dd3
imul ebx
mov ecx, ebx
mov dword [rsp + 0x40], 1
sar edx, 6
mov eax, edx
mov qword [rsp + 0x48], r8
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x3e8
mov dword [rsp + 0x30], edx
sub ecx, eax
imul eax, ecx, 0x3e8
xor ecx, ecx
mov dword [rsp + 0x34], eax
lea rax, [rsp + 0x30]
test bpl, bpl
je 0x1400836b5
test ebx, ebx
lea rdx, [rsp + 0x40]
cmovs rax, rcx
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_select]
mov ebx, eax
jmp 0x140083708
mov qword [rsp + 0x258], r8
lea r9, [rsp + 0x250]
test ebx, ebx
mov dword [rsp + 0x250], 1
lea r8, [rsp + 0x40]
cmovs rax, rcx
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_select]
mov ebx, eax
test eax, eax
jle 0x140083708
mov rcx, qword [rdi + 0xa8]
lea rdx, [rsp + 0x250]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x140083708
dec ebx
test sil, sil
je 0x14008371b
mov rcx, qword [rdi + 0xb0]
mov dl, 1
call fcn.1401658f0
mov eax, ebx
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.140229fa0
mov rbx, qword [rsp + 0x4a0]
add rsp, 0x470
pop rdi
pop rsi
pop rbp
ret
Function at 0x140083c30
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rax, qword [rcx]
mov rdi, r8
mov rbx, qword [rcx + 8]
mov rsi, rdx
call qword [rax + 0x70]
test al, al
jne 0x1400710f9
lea rdx, str.QNativeSocketEngine::write___was_called_on_an_uninitialized_socket_device
lea rax, [0x140265bd0]
mov qword [rsp + 0x20], 2
xorps xmm0, xmm0
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x20]
movdqu xmmword [rsp + 0x28], xmm0
call fcn.1400afb60
mov rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
cmp dword [rbx + 0x68], 3
je 0x140071108
lea rdx, str.QNativeSocketEngine::write___was_not_called_in_QAbstractSocket::ConnectedState
jmp 0x1400710ba
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
jmp 0x140083c30
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov r14, qword [rcx + 8]
xor r13d, r13d
mov edi, r13d
mov rsi, r8
mov r15, rdx
mov rbp, rcx
mov rbx, r8
mov r12d, 0xc000
nop dword [rax + rax]
mov rcx, qword [rbp + 0xa8]
lea rax, [rdi + r15]
mov qword [rsp + 0x30], r13
lea r9, [rsp + 0x80]
mov qword [rsp + 0x28], r13
lea rdx, [rsp + 0x40]
mov r8d, 1
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x20], r13d
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x80], r13d
call qword [sym.imp.WS2_32.dll_WSASend]
mov ecx, dword [rsp + 0x80]
add rdi, rcx
cmp eax, 0xffffffff
je 0x140083cee
cmp rdi, rsi
je 0x140083ccd
cmp rbx, rcx
je 0x140083d04
mov rax, rdi
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
cmp eax, 0x2733
je 0x140083ccd
cmp eax, 0x2747
jne 0x140083d16
mov rbx, rsi
sub rbx, rdi
cmp rbx, r12
cmovg rbx, r12
jmp 0x140083c70
sub ecx, 0x2745
je 0x140083d23
cmp ecx, 1
jne 0x140083ccd
mov edx, 7
mov r8d, setsockopt
mov rcx, rbp
call fcn.140070600
mov rdx, qword [r14]
mov rcx, r14
call qword [rdx + 0xa0]
mov rax, 0xffffffffffffffff
jmp 0x140083cd0
Function at 0x1400842d0
Capabilities:
Set socket configuration

Disassembly:
mov rcx, qword [rcx + 8]
jmp 0x1400842d0
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x18], r8d
push rdi
sub rsp, 0x60
mov rdi, rcx
mov ebx, edx
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
call qword [rax + 0x70]
test al, al
je 0x140084355
test ebx, ebx
je 0x140084362
cmp ebx, 0xe
ja 0x140084305
mov eax, 0x4808
bt eax, ebx
jb 0x140084355
mov edx, dword [rdi + 0x70]
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x88]
mov ecx, ebx
call fcn.140081430
mov r8d, dword [rsp + 0x70]
cmp r8d, 0xffffffff
je 0x140084355
mov edx, dword [rsp + 0x88]
lea r9, [rsp + 0x80]
mov rcx, qword [rdi + 0xa8]
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x1400843c1
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
xor al, al
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov eax, dword [rsp + 0x80]
lea r8, [rsp + 0x88]
mov rcx, qword [rdi + 0xa8]
mov r9d, 4
mov dword [rsp + 0x88], eax
mov edx, 0x8004667e
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x70], eax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_WSAIoctl]
cmp eax, 0xffffffff
je 0x14008434f
mov rbx, qword [rsp + 0x78]
mov al, 1
add rsp, 0x60
pop rdi
ret
Function at 0x1400a15a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r13, r8
mov r14, rdx
mov r12, rcx
mov r15d, 0x20
nop dword [rax + rax]
mov rdi, qword [r14 + 0x10]
mov rcx, r14
xor ebp, ebp
call fcn.14009fbb0
cmp rdi, rax
jae 0x1400a165f
mov rcx, r14
xor ebx, ebx
call fcn.14009fbb0
sub rax, rdi
mov rdx, rdi
cmp rax, r15
mov rsi, r15
cmovb rsi, rax
shr rdx, 3
add rdx, qword [r14]
and edi, 7
add rdi, rsi
cmp rdi, 8
jbe 0x1400a1641
lea r8, [rdi - 9]
shr r8, 3
inc r8
imul rax, r8, 0xfffffffffffffff8
add rdi, rax
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdx]
inc rdx
shl ebx, 8
or ebx, eax
sub r8, 1
jne 0x1400a1630
movzx ebp, byte [rdx]
mov ecx, 8
sub cl, dil
shr ebp, cl
mov rcx, rdi
shl ebx, cl
mov ecx, r15d
sub cl, sil
or ebp, ebx
shl ebp, cl
jmp 0x1400a1661
xor esi, esi
test esi, esi
je 0x1400a176d
cmp esi, dword [r12 + 0x30]
jb 0x1400a1743
mov r10, qword [r12]
mov eax, ebp
mov r11, qword [r12 + 0x18]
mov ecx, r15d
sub ecx, dword [r10 + 4]
shr eax, cl
add eax, dword [r10 + 8]
lea rcx, [rax + rax*2]
movsd xmm0, qword [r11 + rcx*4]
mov edx, dword [r11 + rcx*4 + 8]
movsd qword [rsp + 0x20], xmm0
mov rbx, qword [rsp + 0x20]
mov rax, rbx
shr rax, 0x20
test eax, eax
je 0x1400a16fb
mov r9d, eax
mov edx, ebp
mov eax, r15d
lea rcx, [r9 + r9*2]
sub eax, dword [r10 + rcx*4 + 4]
lea r8, [r10 + rcx*4]
mov ecx, dword [r10 + rcx*4]
shl edx, cl
movzx ecx, al
shr edx, cl
add edx, dword [r8 + 8]
lea rcx, [rdx + rdx*2]
movsd xmm0, qword [r11 + rcx*4]
mov edx, dword [r11 + rcx*4 + 8]
movsd qword [rsp + 0x20], xmm0
mov rbx, qword [rsp + 0x20]
mov rax, rbx
shr rax, 0x20
cmp eax, r9d
jne 0x1400a16b1
cmp ebx, esi
ja 0x1400a1730
test ebx, ebx
je 0x1400a1722
cmp edx, 0x100
je 0x1400a1722
mov rcx, r13
call fcn.1400b0a30
mov edx, ebx
mov rcx, r14
call fcn.14009fff0
jmp 0x1400a15d0
mov edx, esi
mov rcx, r14
call fcn.14009fff0
xor al, al
jmp 0x1400a1777
mov edx, esi
mov rcx, r14
call fcn.14009fff0
cmp esi, 7
jbe 0x1400a1752
xor al, al
jmp 0x1400a1777
mov edx, esi
mov rcx, r14
call fcn.14009fff0
cmp esi, 7
ja 0x1400a172c
sub r15d, esi
mov eax, 1
movzx ecx, r15b
shr ebp, cl
mov ecx, esi
shl eax, cl
dec eax
cmp ebp, eax
sete al
jmp 0x1400a1777
mov rcx, r14
call fcn.14009fbe0
xor al, 1
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r8d, dword [0x14049bb18]
mov rdi, rcx
mov rax, qword gs:[0x58]
mov rbx, rdx
mov ecx, 8
mov rax, qword [rax + r8*8]
mov eax, dword [rcx + rax]
cmp dword [0x140497260], eax
jg 0x1400a17f0
mov r8, rbx
lea rcx, [0x140497228]
mov rdx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x1400a15a0
lea rcx, [0x140497260]
call fcn.140229e94
cmp dword [0x140497260], 0xffffffff
jne 0x1400a17d4
lea rcx, [0x140497228]
call fcn.1400a1090
lea rcx, [0x140264180]
call fcn.14022a480
lea rcx, [0x140497260]
call fcn.140229e28
jmp 0x1400a17d4
Function at 0x1400aae40
Capabilities:
Get hostname
Initialize winsock library

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x400
mov rax, qword [0x140492fc0]
xor rax, rsp
mov qword [rsp + 0x3f0], rax
mov rdi, rcx
mov qword [rsp + 0x28], rcx
mov eax, dword [0x1404976cc]
mov rbx, 0xffffffffffffffff
cmp eax, 0xfffffffe
jle 0x1400aaea0
mov ecx, dword [0x14049bb18]
mov rax, qword gs:[0x58]
mov edx, 8
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x1404976e0], ecx
jg 0x1400aaf37
mov edx, 0x200
lea rcx, [rsp + 0x1f0]
call sub.WS2_32.dll_gethostname
cmp eax, 0xffffffff
jne 0x1400aaec3
lea rax, [0x140484d90]
mov qword [rdi], rax
jmp 0x1400aaeef
mov byte [rsp + 0x3ef], 0
lea rax, [rsp + 0x1f0]
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400aaed3
mov r8, rbx
lea rdx, [rsp + 0x1f0]
mov rcx, rdi
call fcn.1400ba690
mov rax, rdi
mov rcx, qword [rsp + 0x3f0]
xor rcx, rsp
call fcn.140229fa0
mov rbx, qword [rsp + 0x418]
add rsp, 0x400
pop rdi
ret
mov dword [0x1404976cc], ebx
lea rcx, [0x140264200]
call fcn.14022a480
nop
lea rcx, [0x1404976e0]
call fcn.140229e28
jmp 0x1400aaea0
lea rcx, [0x1404976e0]
call fcn.140229e94
cmp dword [0x1404976e0], ebx
jne 0x1400aaea0
mov dword [0x1404976dc], 0
mov ecx, 2
lea rdx, [rsp + 0x50]
call sub.WS2_32.dll_WSAStartup
test eax, eax
je 0x1400aafa0
mov qword [rsp + 0x30], 2
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
lea rax, [0x140265bd0]
mov qword [rsp + 0x48], rax
lea rdx, str.QTcpSocketAPI:_WinSock_v2.0_initialization_failed.
lea rcx, [rsp + 0x30]
call fcn.1400afb60
jmp 0x1400aaf13
mov dword [0x1404976dc], 0x20
jmp 0x1400aaf13

Function at 0x1400aafb0
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
sub rsp, 0xc0
mov rax, qword [0x140492fc0]
xor rax, rsp
mov qword [rsp + 0xb0], rax
xor eax, eax
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x38], rax
lea rdx, str.SOFTWAREMicrosoftCryptography
lea rax, [rsp + 0x38]
mov rdi, rcx
mov r9d, 0x20119
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400ab090
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, str.MachineGuid
lea rax, [rsp + 0x60]
mov qword [rsp + 0xd8], rbx
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x30], 0x4a
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
mov rbx, qword [rsp + 0xd8]
jne 0x1400ab090
mov edx, dword [rsp + 0x30]
lea rax, [rsp + 0x60]
dec edx
mov qword [rsp + 0x48], rax
shr rdx, 1
mov rcx, rdi
mov qword [rsp + 0x40], rdx
lea rdx, [rsp + 0x40]
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
call fcn.1400b95a0
jmp 0x1400ab09a
lea rax, [0x140484d90]
mov qword [rdi], rax
mov rax, rdi
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140229fa0
add rsp, 0xc0
pop rdi
ret
Function at 0x1400afc60
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r14, rcx
xor ebp, ebp
lea r12, [0x140497760]
mov qword [rsp + 0x20], r12
mov ebx, 1
xor eax, eax
lock cmpxchg qword [0x140497760], rbx
je 0x1400afca7
mov rcx, r12
call fcn.1400e8250
mov byte [rsp + 0x28], bl
mov rax, qword [r14]
mov r15d, 0x7ffe
cmp dword [rax + 4], r15d
jg 0x1400afcd0
mov rcx, r14
call fcn.1400c02d0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x1400afdb5
mov ecx, 0xfffe
call fcn.14022a514
mov rsi, rax
mov edi, ebp
mov rcx, qword [r14]
cmp dword [rcx + 4], ebp
jle 0x1400afdac
lea r13, [0x140484d90]
nop dword [rax]
nop word [rax + rax]
movsxd rax, dword [rcx + 4]
mov edx, eax
sub edx, edi
cmp edx, r15d
cmovg edx, r15d
mov r8, rax
cmp rcx, r13
jne 0x1400afd1c
mov r9, rbp
jmp 0x1400afd23
mov r9, qword [rcx + 0x10]
add r9, rcx
movsxd rcx, edx
movsxd rax, edi
cmp rcx, 0xffffffffffffffff
jne 0x1400afd37
mov rbx, r8
sub rbx, rax
jmp 0x1400afd62
add rcx, rax
cmp r8, rcx
cmovl rcx, r8
mov rdx, rax
cmp r8, rax
cmovl rdx, r8
mov rbx, rbp
test rcx, rcx
cmovg rbx, rcx
mov rcx, rbp
test rdx, rdx
cmovg rcx, rdx
sub rbx, rcx
cmp r8, rax
cmovl rax, r8
mov rcx, rbp
test rax, rax
cmovg rcx, rax
lea rdx, [r9 + rcx*2]
test rdx, rdx
je 0x1400afd88
lea r8, [rbx + rbx]
mov rcx, rsi
call fcn.140258d60
movsxd rax, ebx
mov word [rsi + rax*2], bp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add edi, r15d
mov rcx, qword [r14]
cmp edi, dword [rcx + 4]
jl 0x1400afd00
mov ebx, 1
mov rcx, rsi
call fcn.140229de4
nop
mov rax, rbx
lock cmpxchg qword [0x140497760], rbp
je 0x1400afdcb
mov rcx, r12
call fcn.1400e8690
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400b0f40
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov eax, dword [rsp + 0x30]
xor r10d, r10d
mov rbx, r8
mov qword [rcx], r10
mov dword [rcx + 8], r10d
mov rbp, r9
mov rsi, rdx
mov r11, rcx
mov edi, r10d
mov r9d, r10d
mov r8d, r10d
test rbx, rbx
jle 0x1400b101c
nop dword [rax]
movsx edx, byte [r8 + rsi]
lea ecx, [rdx - 0x41]
cmp ecx, 0x19
jbe 0x1400b0fa5
lea ecx, [rdx - 0x61]
cmp ecx, 0x19
ja 0x1400b0f9a
lea ecx, [rdx - 0x47]
jmp 0x1400b0fa5
lea ecx, [rdx - 0x30]
cmp ecx, 9
ja 0x1400b0faf
lea ecx, [rdx + 4]
cmp ecx, 0xffffffff
je 0x1400b1010
jmp 0x1400b1041
mov ecx, eax
and ecx, 1
cmp edx, 0x2b
jne 0x1400b0fc4
test ecx, ecx
jne 0x1400b0fdd
mov ecx, 0x3e
jmp 0x1400b1041
cmp edx, 0x2d
jne 0x1400b0fd4
test ecx, ecx
je 0x1400b0fdd
mov ecx, 0x3e
jmp 0x1400b1041
cmp edx, 0x2f
jne 0x1400b1033
test ecx, ecx
je 0x1400b103c
bt eax, 2
jae 0x1400b1010
cmp edx, 0x3d
jne 0x1400b1083
test bl, 3
jne 0x1400b1079
lea rcx, [rbx - 1]
cmp r8, rcx
je 0x1400b1010
lea rcx, [rbx - 2]
cmp r8, rcx
jne 0x1400b106f
inc r8
cmp byte [r8 + rsi], dl
jne 0x1400b106f
inc r8
cmp r8, rbx
jl 0x1400b0f80
mov qword [r11], r9
mov rbx, qword [rsp + 0x18]
mov rax, r11
mov rbp, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
pop rdi
ret
cmp edx, 0x5f
jne 0x1400b0fdd
test ecx, ecx
je 0x1400b0fdd
mov ecx, 0x3f
shl r10d, 6
add edi, 6
or r10d, ecx
cmp edi, 8
jl 0x1400b1010
sub edi, 8
mov edx, r10d
mov ecx, edi
shr edx, cl
mov byte [r9 + rbp], dl
mov edx, 1
shl edx, cl
inc r9
dec edx
and r10d, edx
jmp 0x1400b1010
mov dword [r11 + 8], 3
jmp 0x1400b101f
mov dword [r11 + 8], 1
jmp 0x1400b101f
mov dword [r11 + 8], 2
jmp 0x1400b101f
Function at 0x1400d8410
Capabilities:
Encode data using xor

Disassembly:
push r12
push r13
push r14
sub rsp, 0x40
mov rax, qword [rdx]
mov r12, rcx
sub rax, qword [rcx]
sar rax, 3
movsxd r13, eax
mov r14, r13
sar r14, 1
test r14, r14
jle 0x1400d85ae
mov qword [rsp + 0x70], rbx
lea r8, [r13 - 1]
mov qword [rsp + 0x38], rbp
lea rdx, [0x140484d90]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], r15
mov r15, r8
sar r15, 1
nop dword [rax]
nop word [rax + rax]
mov rax, qword [r12]
dec r14
mov rbp, r14
lea rcx, [rax + r14*8]
mov rax, qword [rax + r14*8]
mov qword [rsp + 0x68], rax
mov qword [rcx], rdx
mov rdx, r14
mov rdi, qword [r12]
cmp r14, r15
jge 0x1400d84de
nop word [rax + rax]
lea rbx, [rdx + rdx]
lea rcx, [rdi + 0x10]
lea rcx, [rcx + rbx*8]
lea rdx, [rcx - 8]
call fcn.1400b6e40
mov rcx, qword [rdi + rbp*8]
movzx edx, al
xor rdx, 1
inc rdx
add rdx, rbx
mov rax, qword [rdi + rdx*8]
mov qword [rdi + rbp*8], rax
mov rbp, rdx
mov qword [rdi + rdx*8], rcx
cmp rdx, r15
jl 0x1400d84a0
lea r8, [r13 - 1]
cmp rbp, r15
jne 0x1400d84fe
test r13b, 1
jne 0x1400d84fe
mov rcx, qword [rdi + rbp*8]
mov rax, qword [rdi + r13*8 - 8]
mov qword [rdi + rbp*8], rax
mov rbp, r8
mov qword [rdi + r13*8 - 8], rcx
lea rsi, [rbp - 1]
sar rsi, 1
cmp r14, rbp
jge 0x1400d8541
nop word [rax + rax]
lea rbx, [rdi + rsi*8]
mov rcx, rbx
lea rdx, [rsp + 0x68]
call fcn.1400b6e40
test al, al
je 0x1400d8541
mov rcx, qword [rdi + rbp*8]
mov rax, qword [rbx]
mov qword [rdi + rbp*8], rax
mov rbp, rsi
dec rsi
mov qword [rbx], rcx
sar rsi, 1
cmp r14, rbp
jl 0x1400d8510
mov rcx, qword [rdi + rbp*8]
mov rax, qword [rsp + 0x68]
mov qword [rdi + rbp*8], rax
mov qword [rsp + 0x68], rcx
mov eax, dword [rcx]
test eax, eax
je 0x1400d856c
cmp eax, 0xffffffff
je 0x1400d8581
mov eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x1400d8581
mov rcx, qword [rsp + 0x68]
mov edx, 2
mov r8d, 8
call fcn.1400affb0
lea r8, [r13 - 1]
lea rdx, [0x140484d90]
test r14, r14
jg 0x1400d8470
mov r15, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop r13
pop r12
ret
Function at 0x1400d8950
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x20
lea rdi, [r8 - 1]
mov qword [rsp + 0x50], r12
sar rdi, 1
mov r14, r9
mov qword [rsp + 0x58], r13
mov r13, r8
mov rbp, rdx
mov rsi, rcx
mov r15, rdx
mov r10, rdx
cmp rdx, rdi
jge 0x1400d89d1
nop dword [rax + rax]
mov rcx, qword [rsi]
lea rbx, [r10 + r10]
add rcx, 0x10
lea rcx, [rcx + rbx*8]
lea rdx, [rcx - 8]
call fcn.1400b6e40
mov rcx, qword [rsi]
movzx r10d, al
xor r10, 1
inc r10
mov rdx, qword [rcx + rbp*8]
add r10, rbx
mov rax, qword [rcx + r10*8]
mov qword [rcx + rbp*8], rax
mov rbp, r10
mov qword [rcx + r10*8], rdx
cmp r10, rdi
jl 0x1400d8990
cmp r10, rdi
jne 0x1400d89fb
test r13b, 1
jne 0x1400d89fb
mov rax, qword [rsi]
mov rdx, qword [rax + rbp*8]
lea rcx, [rax + rbp*8]
lea rbp, [r13 - 1]
lea r8, [rax + r13*8]
mov rax, qword [rax + r13*8 - 8]
mov qword [rcx], rax
mov qword [r8 - 8], rdx
mov rdi, qword [rsi]
lea rsi, [rbp - 1]
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x50]
sar rsi, 1
cmp r15, rbp
jge 0x1400d8a4f
nop dword [rax]
nop dword [rax + rax]
lea rbx, [rdi + rsi*8]
mov rdx, r14
mov rcx, rbx
call fcn.1400b6e40
test al, al
je 0x1400d8a4f
mov rcx, qword [rdi + rbp*8]
mov rax, qword [rbx]
mov qword [rdi + rbp*8], rax
mov rbp, rsi
dec rsi
mov qword [rbx], rcx
sar rsi, 1
cmp r15, rbp
jl 0x1400d8a20
mov rax, qword [r14]
mov rcx, qword [rdi + rbp*8]
mov rbx, qword [rsp + 0x60]
mov qword [rdi + rbp*8], rax
mov qword [r14], rcx
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400df970
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov rdi, rdx
mov rcx, qword [rcx + 0x1e0]
test rcx, rcx
je 0x1400df99c
mov qword [rsp + 0x60], rdx
lea rdx, [rsp + 0x60]
mov rax, qword [rcx]
call qword [rax + select]
mov rax, qword [rdi + 0x40]
movzx ecx, byte [rdi + 0x20]
mov r9, qword [rdi + 0x18]
mov r8, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov qword [rsp + 0x48], rax
mov rax, qword [rdi + 0x38]
mov qword [rsp + 0x40], rax
mov rax, qword [rdi + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rdi + 0x28]
mov qword [rsp + 0x30], rax
mov eax, dword [rdi + 0x24]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rcx, qword [rbx + 0x108]
test eax, eax
setne dil
cmp rcx, 0xffffffffffffffff
je 0x1400dfa08
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x108], 0xffffffffffffffff
mov rcx, qword [rbx + 0x148]
cmp rcx, 0xffffffffffffffff
je 0x1400dfa26
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x148], 0xffffffffffffffff
mov rcx, qword [rbx + 0x180]
cmp rcx, 0xffffffffffffffff
je 0x1400dfa44
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x180], 0xffffffffffffffff
mov rbx, qword [rsp + 0x68]
movzx eax, dil
add rsp, 0x50
pop rdi
ret