joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140071690
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x1400aeb64], 0
jne 0x140071794
mov rdx, rdx
xor edx, edx
lea r8, [0x1400aeb60]
nop word [rax + rax]
mov ecx, edx
mov dword [rsp - 0x28], ebx
lea r8, [r8 + 4]
and ecx, 1
mov eax, edx
mov dword [rsp - 0x18], 0x5ed1e26a
shr eax, 1
neg ecx
and ecx, 0xedb88320
xchg rsp, rsp
inc edx
xor ecx, eax
mov eax, ecx
shr ecx, 1
mov dword [rsp - 0x40], esp
and eax, 1
neg eax
and eax, 0xedb88320
xchg r10, r10
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
mov dword [rsp - 0xc], 0x6c9d9a35
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
mov dword [rsp - 0x28], 0xa7dbf9a
shr ecx, 1
and eax, 1
neg eax
xchg r10, r10
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
mov dword [rsp - 0x10], esi
and ecx, 1
neg ecx
and ecx, 0xedb88320
mov dword [rsp - 0x2c], 0x61354e2e
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
xchg r9, r9
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [rsp - 0x20], ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
mov r14, r14
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
xchg rdi, rdi
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
xchg r13, r13
mov dword [r8 - 4], eax
cmp edx, 0x100
jb 0x1400716b3
ret
Function at 0x140072040
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
mov dword [rsp - 0x14], esi
sub rsp, 0x20
mov r14, rcx
mov r9d, r8d
mov rcx, rcx
shr r9, 2
mov rsi, rdx
nop
mov dword [rsp - 0x28], 0x159c7624
movabs rcx, 0xffffffff10f71784
add rcx, 0x4a41674f
sub rcx, 0x402e8ba9
xor rcx, 0x1c3da61f
mov dword [rsp - 0xc], 0x3ec230ec
add rcx, 0x1b73b647
add rcx, 0x7fffffff
xor rcx, 0x5d57f484
mov ebx, r8d
mov dword [rsp - 0x28], edx
mov eax, 0x4795c5d
xor eax, 0x7ddc2a19
xor eax, 0x66e6801c
xchg r11, r11
add eax, 0x4cc77697
sub eax, 0x5ac862a6
add eax, 0x69c181eb
xor eax, 0x7b048c30
mov dword [rsp - 0x14], 0x691e6da1
mul r9
cmovb rax, rcx
mov rcx, rax
call fcn.14007afa0
mov rsi, rsi
lea rcx, [r14 + 8]
mov r8d, ebx
mov rdx, rax
mov rdi, rax
xchg rdi, rdi
call fcn.1400686f0
test al, al
je 0x14007226f
mov r9d, dword [r14]
xchg rsi, rsi
xor edx, edx
shr ebx, 2
movd xmm1, r9d
mov dword [rsp - 0x38], esi
pshufd xmm1, xmm1, 0
test ebx, ebx
je 0x140072254
mov dword [rsp - 0x1c], ebx
cmp ebx, 0x10
jb 0x140072225
lea eax, [rbx - 1]
mov dword [rsp - 0x18], 0x4e07b041
lea r8, [rsi + rax*4]
lea rax, [rdi + rax*4]
cmp rsi, rax
mov dword [rsp - 0x2c], 0xa083030
ja 0x140072169
cmp r8, rdi
jae 0x140072225
mov r8d, ebx
xchg rdx, rdx
and r8d, 0xfffffff0
mov r10d, 0x40a0098b
add r10d, 0xdc55553
mov dword [rsp - 0x40], 0x59a3fc3c
add r10d, 0x15a3a142
sub r10d, 0x41d75cc5
add r10d, 0xb1798a8
xor r10d, 0x6ef273f5
xchg r12, r12
sub r10d, 0x43bb4fee
nop dword [rax + rax]
movdqu xmm0, xmmword [rdi + rdx*4]
lea eax, [r10 - 4]
mov dword [rsp - 0x1c], 0x26c0e194
xorps xmm0, xmm1
movdqu xmmword [rsi + rdx*4], xmm0
add edx, 0x10
mov dword [rsp - 0x2c], 0x3b9a44cd
movdqu xmm0, xmmword [rdi + rax*4]
xorps xmm0, xmm1
movdqu xmmword [rsi + rax*4], xmm0
mov eax, r10d
mov dword [rsp - 0x24], 0xed9ed21
movdqu xmm0, xmmword [rdi + rax*4]
xorps xmm0, xmm1
movdqu xmmword [rsi + rax*4], xmm0
lea eax, [r10 + 4]
mov dword [rsp - 0x34], ebx
add r10d, 0x10
movdqu xmm0, xmmword [rdi + rax*4]
xorps xmm0, xmm1
movdqu xmmword [rsi + rax*4], xmm0
xchg r10, r10
cmp edx, r8d
jb 0x1400721b3
cmp edx, ebx
jae 0x140072254
mov dword [rsp - 0x34], ebp
mov r8, rdi
lea rax, [rsi + rdx*4]
sub r8, rsi
mov dword [rsp - 0x14], edx
sub ebx, edx
mov edx, ebx
nop dword [rax]
mov ecx, r9d
mov dword [rsp - 0x1c], ebx
xor ecx, dword [rax + r8]
mov dword [rax], ecx
lea rax, [rax + 4]
sub rdx, 1
mov r9, r9
jne 0x14007223a
mov rcx, rdi
call fcn.14007afb0
mov al, 0x16
xchg rbx, rbx
xor al, 0x44
xor al, 0x49
add al, 0x44
mov dword [rsp - 0xc], ebx
sub al, 0x5e
jmp 0x14007227c
mov rcx, rdi
call fcn.14007afb0
xchg r11, r11
xor al, al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov dword [rsp - 0x44], 0xaef3e4e
add rsp, 0x20
pop r14
ret
Function at 0x1400722a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
xchg r11, r11
sub rsp, 0x20
mov r14, rcx
mov r9d, r8d
shr r9, 2
mov dword [rsp - 0x14], edi
mov rbx, rdx
nop
movabs rcx, 0xffffffff148d03c9
mov dword [rsp - 0x28], esi
add rcx, 0x47435bbe
xor rcx, 0x4e11345c
xor rcx, 0x52bf1b5a
add rcx, 0x7fffffff
xchg rsi, rsi
add rcx, 0x38818f7f
mov esi, r8d
mov eax, 0x5519d77a
mov r10, r10
add eax, 0x1cdea2f5
sub eax, 0x68e0e5a
xor eax, 0x35e8c2a3
xor eax, 0xb499206
mov dword [rsp - 0xc], esp
sub eax, 0x55cb3cac
mul r9
cmovb rax, rcx
mov rcx, rax
mov r11, r11
call fcn.14007afa0
mov r9d, dword [r14]
mov edx, esi
shr edx, 2
mov rbx, rbx
xor r8d, r8d
mov rdi, rax
movd xmm1, r9d
mov r14, r14
pshufd xmm1, xmm1, 0
test edx, edx
je 0x14007245b
cmp edx, 0x10
mov dword [rsp - 0x2c], esp
jb 0x140072435
lea eax, [rdx - 1]
lea r10, [rdi + rax*4]
mov dword [rsp - 0x1c], edi
lea rax, [rbx + rax*4]
cmp rdi, rax
ja 0x14007238b
mov r12, r12
cmp r10, rbx
jae 0x140072435
mov r10d, edx
and r10d, 0xfffffff0
mov dword [rsp - 0x38], edi
mov r11d, 0x58c203df
xor r11d, 0x1138b90c
xor r11d, 0xf7cb48
sub r11d, 0x3e620642
mov dword [rsp - 0x18], ecx
xor r11d, 0xaab6b51
nop word [rax + rax]
movdqu xmm0, xmmword [rbx + r8*4]
mov dword [rsp - 0x2c], esp
lea eax, [r11 - 4]
xorps xmm0, xmm1
movdqu xmmword [rdi + r8*4], xmm0
add r8d, 0x10
mov dword [rsp - 0x20], esi
movdqu xmm0, xmmword [rbx + rax*4]
xorps xmm0, xmm1
movdqu xmmword [rdi + rax*4], xmm0
mov eax, r11d
xchg rdi, rdi
movdqu xmm0, xmmword [rbx + rax*4]
xorps xmm0, xmm1
movdqu xmmword [rdi + rax*4], xmm0
mov dword [rsp - 0x1c], 0x7e608495
lea eax, [r11 + 4]
add r11d, 0x10
movdqu xmm0, xmmword [rbx + rax*4]
mov rbx, rbx
xorps xmm0, xmm1
movdqu xmmword [rdi + rax*4], xmm0
cmp r8d, r10d
mov dword [rsp - 0x18], esi
jb 0x1400723c5
cmp r8d, edx
jae 0x14007245b
mov rsi, rsi
sub rbx, rdi
lea rax, [rdi + r8*4]
sub edx, r8d
nop dword [rax]
xchg r13, r13
mov ecx, r9d
xor ecx, dword [rax + rbx]
mov dword [rax], ecx
lea rax, [rax + 4]
mov dword [rsp - 0x40], ebx
sub rdx, 1
jne 0x140072445
lea rcx, [r14 + 8]
mov r8d, esi
xchg r10, r10
mov rdx, rdi
call fcn.140068ad0
mov rcx, rdi
mov r12, r12
test al, al
je 0x140072492
call fcn.14007afb0
xchg r15, r15
mov al, 0x6a
add al, 0xf
sub al, 0x4d
add al, 0x52
xchg rsp, rsp
xor al, 0x46
sub al, 0x20
sub al, 0x17
jmp 0x140072499
call fcn.14007afb0
xor al, al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov dword [rsp - 0x2c], ecx
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
mov dword [rsp - 0x1c], esi
ret
Function at 0x140073f10
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x28
mov r11, qword [rcx + 0x18]
mov r10, r9
mov dword [rsp - 0x14], 0x652c3c7b
test r11, r11
je 0x140073f58
mov r9, qword [rcx + 0x10]
mov dword [rsp - 0x44], esi
lea rcx, [r9 + r11*8]
cmp r9, rcx
je 0x140073f58
mov dword [rsp - 0x14], esp
nop dword [rax]
mov rax, qword [r9]
cmp dword [rax], edx
je 0x140073f63
mov dword [rsp - 0x44], 0x5e0c5627
add r9, 8
cmp r9, rcx
jne 0x140073f40
mov rax, r10
mov r10, r10
add rsp, 0x28
ret
test rax, rax
je 0x140073f58
mov rdx, qword [rax + 0x18]
mov dword [rsp - 0x2c], ecx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x20], rdi
xor edi, edi
mov dword [rsp - 0x14], 0x6c06df3f
test rdx, rdx
je 0x140073fb8
mov rcx, qword [rax + 0x10]
mov dword [rsp - 0x40], edi
lea rdx, [rcx + rdx*8]
cmp rcx, rdx
je 0x140073fb8
nop
mov dword [rsp - 0x1c], 0x1d14e384
mov rbx, qword [rcx]
cmp dword [rbx], r8d
je 0x140073fbb
add rcx, 8
mov dword [rsp - 0x38], edx
cmp rcx, rdx
jne 0x140073fa3
mov rbx, rdi
test rbx, rbx
mov dword [rsp - 0x10], edi
je 0x140074036
cmp byte [rbx + 4], 4
jne 0x140074036
movzx ecx, word [rbx + 5]
mov dword [rsp - 0x44], 0x7e8b00da
inc rcx
call fcn.14007afa0
mov r9, rax
xchg rdx, rdx
movzx eax, word [rbx + 5]
mov byte [rax + r9], dil
cmp di, word [rbx + 5]
mov rsi, rsi
jae 0x140074021
nop dword [rax]
mov rcx, qword [rbx + 8]
movzx r8d, di
xchg rdx, rdx
inc di
movzx edx, byte [rcx + r8]
xor dl, 0x37
mov byte [r8 + r9], dl
mov dword [rsp - 0x38], 0x58e2ee96
cmp di, word [rbx + 5]
jb 0x140073ff9
mov rbx, qword [rsp + 0x30]
xchg r15, r15
mov rax, r9
mov rdi, qword [rsp + 0x20]
add rsp, 0x28
ret
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rdi, qword [rsp + 0x20]
add rsp, 0x28
mov dword [rsp - 0x44], 0x6d2d3032
ret
Function at 0x1400775d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
xchg rdx, rdx
push r12
push r13
push r14
push r15
mov r12, r12
xor r13d, r13d
movsxd rax, r8d
mov r12, r9
mov rbx, rdx
mov dword [rsp - 0x1c], 0x50d98b0d
mov rbp, rcx
mov r10d, r13d
lea r11, [rax + rax*2]
shl r11, 2
mov dword [rsp - 0x1c], edx
nop word [rax + rax]
movsxd rax, dword [r12 + r10*4]
mov r9d, r13d
mov dword [rsp - 0x18], 0x904dd2f
mov r8, qword [rbp + 8]
mov rcx, rax
and eax, 3
mov r10, r10
add r8, r11
lea rdi, [rbx + rax*2]
mov qword [r8], r13
lea rax, [rcx + 1]
mov r9, r9
mov dword [r8 + 8], r13d
and eax, 3
lea rsi, [rbx + rax*2]
mov dword [rsp - 0xc], 0x549c637c
lea rax, [rcx - 2]
and eax, 3
lea r14, [rbx + rax*2]
lea rax, [rcx - 1]
xchg r13, r13
and eax, 3
lea r15, [rbx + rax*2]
mov eax, 0x2063323
mov dword [rsp - 0x44], edi
add eax, 0x46d4cbac
xor eax, 0x1c6cfab8
xor eax, 0x2ac60292
mov r14, r14
sub eax, 0x8db9147
add eax, 0x3516350d
mov ecx, r9d
mul r9d
mov dword [rsp - 0x38], 0x32f0f6e
inc r9d
shr edx, 1
lea eax, [rdx + rdx*2]
sub ecx, eax
xchg r10, r10
movsxd rax, ecx
movzx ecx, word [rdi]
lea rdx, [r8 + rax*4]
mov eax, dword [r8 + rax*4]
mov dword [rsp - 0x2c], ebp
and ecx, 1
add eax, eax
or eax, ecx
mov dword [rsp - 0x20], 0x2dfeb0f8
not cx
mov dword [rdx], eax
movzx eax, word [rdi]
shr ax, 1
mov dword [rsp - 0x44], ebx
shl cx, 0xf
or cx, ax
mov word [rdi], cx
mov dword [rsp - 0x38], edi
movzx ecx, word [rsi]
mov eax, dword [rdx]
and ecx, 1
add eax, eax
mov dword [rsp - 0x24], esp
or eax, ecx
not cx
mov dword [rdx], eax
xchg rcx, rcx
movzx eax, word [rsi]
shr ax, 1
shl cx, 0xf
xchg r9, r9
or cx, ax
mov word [rsi], cx
movzx ecx, word [r14]
mov dword [rsp - 0x38], 0x1635c21d
mov eax, dword [rdx]
and ecx, 1
add eax, eax
mov dword [rsp - 0x14], edi
or eax, ecx
not cx
mov dword [rdx], eax
mov rsi, rsi
movzx eax, word [r14]
shr ax, 1
shl cx, 0xf
mov rcx, rcx
or cx, ax
mov word [r14], cx
movzx ecx, word [r15]
mov dword [rsp - 0x14], 0x14bbd4de
mov eax, dword [rdx]
and ecx, 1
add eax, eax
mov rbx, rbx
or eax, ecx
not cx
mov dword [rdx], eax
movzx eax, word [r15]
mov r9, r9
shr ax, 1
shl cx, 0xf
or cx, ax
mov word [r15], cx
mov rdx, rdx
cmp r9d, 0xf
jl 0x14007767b
inc r10
mov dword [rsp - 0xc], 0x31b0951
add r11, 0xc
cmp r10, 8
jl 0x140077622
xchg r11, r11
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rsi, rsi
mov rdi, qword [rsp + 0x40]
pop r15
pop r14
mov dword [rsp - 0x14], ebx
pop r13
pop r12
ret
Function at 0x140077a30
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov ebx, edx
mov r8d, ecx
test ecx, ecx
mov rbp, rbp
jne 0x140077a4d
xor eax, eax
mov rbx, qword [rsp + 8]
mov dword [rsp - 0x14], ebp
ret
xor r10d, r10d
mov r11d, r8d
mov edx, r10d
mov r9d, r8d
xchg rdi, rdi
nop dword [rax]
nop word [rax + rax]
lea eax, [r9 + r9]
xchg r12, r12
mov ecx, edx
xor ecx, r9d
mov r9d, eax
mov dword [rsp - 0x44], 0x2d8ab2f8
test r11b, 1
cmove ecx, edx
xor r9d, ebx
mov dword [rsp - 0x38], 0x1bed59a2
cmp eax, 0x100
mov edx, ecx
cmovb r9d, eax
mov r9, r9
shr r11d, 1
jne 0x140077a6a
mov r11d, r8d
mov rbx, rbx
mov r9d, r10d
test ecx, ecx
je 0x140077ae8
mov dword [rsp - 0x20], edi
lea eax, [r11 + r11]
mov ecx, r9d
xor ecx, r11d
xchg rdi, rdi
mov r11d, eax
test dl, 1
cmove ecx, r9d
xor r11d, ebx
mov dword [rsp - 0x3c], ebp
cmp eax, 0x100
mov r9d, ecx
cmovb r11d, eax
xchg r11, r11
shr edx, 1
jne 0x140077ab7
mov r11d, r9d
mov edx, r10d
mov rbp, rbp
test r9d, r9d
je 0x140077b36
nop dword [rax]
xchg rcx, rcx
nop word [rax + rax]
lea eax, [r11 + r11]
mov ecx, edx
xor ecx, r11d
mov rsi, rsi
mov r11d, eax
test r9b, 1
cmove ecx, edx
xor r11d, ebx
xchg r15, r15
cmp eax, 0x100
mov edx, ecx
cmovb r11d, eax
xchg r9, r9
shr r9d, 1
jne 0x140077b07
test edx, edx
je 0x140077b81
xchg rdi, rdi
nop word [rax + rax]
mov ecx, r10d
xor ecx, r8d
test dl, 1
mov dword [rsp - 0x2c], 0x25d6937d
cmove ecx, r10d
mov r10d, ecx
lea ecx, [r8 + r8]
mov r12, r12
mov r8d, ecx
xor r8d, ebx
cmp ecx, 0x100
mov r10, r10
cmovb r8d, ecx
shr edx, 1
jne 0x140077b43
mov dword [rsp - 0x40], 0x1374f85f
mov rbx, qword [rsp + 8]
mov eax, r10d
ret
Function at 0x140001380
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x20], rbp
mov dword [r11 + 0x18], r8d
mov qword [r11 + 0x10], rdx
push rsi
push rdi
push r14
sub rsp, 0x40
mov rsi, qword [rsp + 0x80]
mov eax, 2
mov r14, qword [0x1400b5370]
mov rbx, r9
xor ebp, ebp
mov dword [rsp + 0x70], eax
and qword [r9], rbp
xor r8d, r8d
lea r9, [r11 + 0x10]
mov dword [rsi], eax
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptDuplicateKey]
test eax, eax
je 0x140001466
and dword [rsp + 0x30], ebp
lea r8d, [rbp + 1]
mov rcx, qword [rsp + 0x68]
xor r9d, r9d
mov qword [rsp + 0x28], rsi
xor edx, edx
and qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
je 0x14000145b
mov edx, dword [rsi]
lea ecx, [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbx], rax
mov rdi, rax
test rax, rax
je 0x14000145b
mov r8d, dword [rsp + 0x70]
mov rdx, r14
mov rcx, rax
call fcn.140077320
mov ecx, dword [rsi]
lea rax, [rsp + 0x70]
mov dword [rsp + 0x30], ecx
lea r8d, [rbp + 1]
mov rcx, qword [rsp + 0x68]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor edx, edx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov ebp, eax
test eax, eax
jne 0x14000145b
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rbx], rax
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rbx, qword [rsp + 0x60]
mov eax, ebp
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret

Function at 0x14000147c
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov r14, qword [rsp + 0x70]
mov rbx, r9
mov edi, r8d
mov r15, rdx
xor esi, esi
xor r8d, r8d
and qword [r9], rsi
xor edx, edx
lea r9, [rax + 0x28]
mov dword [r14], edi
call qword [sym.imp.ADVAPI32.dll_CryptDuplicateKey]
test eax, eax
je 0x14000151e
mov edx, edi
lea ecx, [rsi + 0x40]
mov ebp, edi
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbx], rax
mov rdi, rax
test rax, rax
je 0x140001513
mov r8d, ebp
mov rdx, r15
mov rcx, rax
call fcn.140077320
mov rcx, qword [rsp + 0x70]
lea r8d, [rsi + 1]
xor r9d, r9d
mov qword [rsp + 0x28], r14
xor edx, edx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
mov esi, eax
test eax, eax
jne 0x140001513
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rbx], rax
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rbx, qword [rsp + 0x50]
mov eax, esi
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x140001638
Capabilities:
Get domain controller name

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x30
lea rax, [r11 + 0x20]
mov rsi, r8
mov rdx, rcx
mov qword [r11 - 0x10], rax
xor ebx, ebx
mov dword [rsp + 0x20], 0x40020010
xor r9d, r9d
mov qword [r11 + 0x20], rbx
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.NETAPI32.dll_DsGetDcNameW]
test eax, eax
jne 0x1400016d3
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2 + 4], bx
jne 0x140001682
lea eax, [rax*2 + 2]
mov ecx, 0x40
mov edx, eax
mov edi, eax
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsi], rax
mov rcx, rax
test rax, rax
je 0x1400016c6
mov rax, qword [rsp + 0x58]
mov r8d, edi
mov ebx, 1
mov rdx, qword [rax]
add rdx, 4
call fcn.140077320
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.NETAPI32.dll_NetApiBufferFree]
jmp 0x1400016e1
mov edx, eax
lea rcx, str.ERROR_kull_m_net_getDC___DsGetDcName:__u_n
call fcn.140001748
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x140002f18
Capabilities:
Get user security identifier

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], r9
push rdi
sub rsp, 0x50
lea rax, [r11 - 0x14]
xor esi, esi
and dword [rsp + 0x40], esi
lea r9, [r11 - 0x18]
and dword [rsp + 0x78], esi
mov rbx, rdx
mov qword [r11 - 0x28], rax
mov rdi, r8
lea rax, [r11 + 0x20]
mov rbp, rcx
mov rdx, rcx
mov qword [r11 - 0x30], rax
mov rcx, qword [rsp + 0x80]
xor r8d, r8d
and qword [r11 - 0x38], rsi
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x140003006
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140003006
mov edx, dword [rsp + 0x40]
lea ecx, [rsi + 0x40]
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbx], rax
test rax, rax
je 0x140003006
mov edx, dword [rsp + 0x78]
lea ecx, [rsi + 0x40]
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rdi], rax
test rax, rax
je 0x140002ffa
mov r8, qword [rbx]
lea rcx, [rsp + 0x44]
mov qword [rsp + 0x30], rcx
lea r9, [rsp + 0x40]
lea rcx, [rsp + 0x78]
mov rdx, rbp
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov esi, eax
test eax, eax
jne 0x140003006
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rdi], rax
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rbx], rax
mov rbx, qword [rsp + 0x60]
mov eax, esi
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret

Function at 0x14000b944
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
movsxd r10, dword [rcx + 0xc]
mov r9, rcx
movsxd r11, r8d
test r8d, r8d
jle 0x14000b99b
mov rsi, qword [rcx]
mov rbx, r10
movsxd rbp, dword [rcx + 8]
xor edi, edi
mov al, byte [rdi + rdx]
lea rcx, [rbx + 1]
xor byte [rbx + rsi], al
lea eax, [r10 + 1]
xor r10d, r10d
cmp rcx, rbp
cmovl r10d, eax
xor ebx, ebx
inc rdi
cmp rcx, rbp
cmovl rbx, rcx
cmp rdi, r11
jl 0x14000b972
add dword [r9 + 0x10], r8d
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov dword [r9 + 0xc], r10d
ret
Function at 0x14001e4e8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x28
mov rax, qword [rcx + 8]
mov r13, rcx
mov ebp, edx
mov r11, qword [rax + 8]
mov rax, qword [rcx + 0x28]
mov r14, qword [r11]
mov r10, qword [rax + 8]
movsxd rax, dword [r10 + 0x30]
movsxd r10, dword [r11 + 0x30]
mov r12, rax
cmp eax, r10d
mov ecx, r10d
cmovl ecx, eax
imul rbp, rax
mov dword [rsp + 0x78], ecx
cmp eax, r10d
je 0x14001e54c
cmp byte [r14 + 0x10], 0
je 0x14001e54c
mov ebx, 8
jmp 0x14001e63c
mov rdi, rbp
mov r15, r10
sub rdi, r12
xor ebx, ebx
cmp rdi, rbp
jge 0x14001e63c
and qword [rsp + 0x70], 0
mov rax, rdi
cqo
idiv r15
mov rsi, rdx
xor edx, edx
lea r10d, [rax + 1]
mov rax, qword [r13 + 8]
mov rcx, qword [rax + 8]
mov eax, 0x40000000
div dword [rcx + 0x30]
inc eax
cmp r10d, eax
je 0x14001e631
xor r9d, r9d
lea r8, [rsp + 0x70]
mov edx, r10d
mov rcx, r14
call qword [r14 + 0x108]
mov ebx, eax
test eax, eax
jne 0x14001e622
mov rcx, qword [rsp + 0x70]
call fcn.140010f48
mov ebx, eax
test eax, eax
jne 0x14001e622
mov rax, qword [rsp + 0x70]
movsxd r8, dword [rsp + 0x78]
add rsi, qword [rax + 8]
mov rax, rdi
cqo
mov rcx, rsi
idiv r12
add rdx, qword [rsp + 0x80]
call fcn.140077320
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 0x10]
mov byte [rcx], bl
test rdi, rdi
jne 0x14001e622
cmp dword [rsp + 0x88], edi
jne 0x14001e622
mov rax, qword [r13 + 0x28]
mov rcx, qword [rax + 8]
mov edx, dword [rcx + 0x3c]
mov eax, edx
shr eax, 0x18
mov byte [rsi + 0x1c], al
mov eax, edx
shr eax, 0x10
mov byte [rsi + 0x1d], al
mov eax, edx
shr eax, 8
mov byte [rsi + 0x1e], al
mov byte [rsi + 0x1f], dl
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14001e631
call fcn.140010954
add rdi, r15
test ebx, ebx
je 0x14001e557
mov eax, ebx
add rsp, 0x28
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140037310
Capabilities:
Reference sql statements

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x30
mov ebx, r8d
lea r9, str.sqlite_master
mov dword [rax - 0x10], ebx
mov rdi, rdx
mov qword [rax - 0x18], rdx
mov r8, rdx
lea rdx, str.SELECT_1_FROM___w_._s_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d_NULL
mov rsi, rcx
call fcn.14003b994
test ebx, ebx
jne 0x140037363
mov r9, rdi
lea r8, str.sqlite_master
lea rdx, str.SELECT_1_FROM_temp._s_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1_NULL
mov rcx, rsi
call fcn.14003b994
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret