joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140076f70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
mov rax, qword [0x14047a488]
mov rcx, qword [rax + 0x4b38]
mov r10, qword [rax + 0x3ef8]
movsxd rax, dword [rcx + 0x74]
movups xmm0, xmmword [rcx + 0x168]
movss xmm4, dword [rcx + 0x168]
movss xmm3, dword [rcx + 0x16c]
movss xmm2, dword [rcx + 0x170]
movss xmm1, dword [rcx + 0x174]
movss dword [rsp + 0x20], xmm4
movss dword [rsp + 0x24], xmm3
movss dword [rsp + 0x28], xmm2
movss dword [rsp + 0x2c], xmm1
imul r9, rax, 0x70
mov rax, qword [r10 + 0x298]
add r9, qword [rcx + 0x18]
movups xmmword [r10 + 0x238], xmm0
movss dword [rax + 0x88], xmm4
movss dword [rax + 0x8c], xmm3
movss dword [rax + 0x90], xmm2
movss dword [rax + 0x94], xmm1
mov rax, qword [r10 + 0x298]
movups xmm0, xmmword [rsp + 0x20]
movsxd r8, dword [rax + 0x58]
mov rdx, qword [rax + 0x60]
add r8, r8
movups xmmword [rdx + r8*8 - 0x10], xmm0
movzx r8d, word [r9 + 0x5c]
mov rdx, qword [r10 + 0x298]
mov rcx, qword [rcx + 0x198]
add rsp, 0x38
jmp 0x14006c2e0

Function at 0x140077040
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
mov rax, qword [0x14047a488]
mov rcx, qword [rax + 0x4b38]
mov r9, qword [rax + 0x3ef8]
movups xmm0, xmmword [r9 + 0x238]
movups xmmword [rcx + 0x168], xmm0
mov rax, qword [r9 + 0x298]
movups xmm0, xmmword [rcx + 0x148]
movss xmm4, dword [rcx + 0x148]
movss xmm3, dword [rcx + 0x14c]
movss xmm2, dword [rcx + 0x150]
movss xmm1, dword [rcx + 0x154]
movups xmmword [r9 + 0x238], xmm0
movss dword [rsp + 0x20], xmm4
movss dword [rsp + 0x24], xmm3
movss dword [rsp + 0x28], xmm2
movss dword [rsp + 0x2c], xmm1
movss dword [rax + 0x88], xmm4
movss dword [rax + 0x8c], xmm3
movss dword [rax + 0x90], xmm2
movss dword [rax + 0x94], xmm1
mov rax, qword [r9 + 0x298]
movups xmm0, xmmword [rsp + 0x20]
movsxd r8, dword [rax + 0x58]
mov rdx, qword [rax + 0x60]
add r8, r8
movups xmmword [rdx + r8*8 - 0x10], xmm0
movzx r8d, word [rcx + 0x21e]
mov rcx, qword [rcx + 0x198]
mov rdx, qword [r9 + 0x298]
add rsp, 0x38
jmp 0x14006c2e0
Function at 0x14008f6e0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140479900]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, rdx
mov rbx, rcx
mov ecx, 8
call fcn.14012c410
test rax, rax
je 0x14008f711
mov qword [rax], rdi
mov qword [rsp + 0x30], rax
lea rdi, [rbx + 8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x140090b70]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
je 0x14008f75e
mov rax, rbx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14012c2b0
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov dword [rdi], 0
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3

Function at 0x140090ea0
Capabilities:
Interact with driver via ioctl

Disassembly:
mov r11, rsp
sub rsp, 0x78
mov rax, qword [0x140479900]
xor rax, rsp
mov qword [rsp + 0x68], rax
xor ecx, ecx
lea rax, [r11 - 0x38]
cmp byte [0x14047a7b9], cl
lea r8, [r11 - 0x30]
mov qword [r11 - 0x40], rcx
mov dword [rsp + 0x4c], ecx
mov qword [r11 - 0x48], rcx
lea r9d, [rcx + 0x20]
mov dword [rsp + 0x28], ecx
mov qword [r11 - 0x20], rax
mov eax, dword [0x14047a91c]
mov qword [r11 - 0x28], rdx
mov edx, 0x2225c4
mov qword [r11 - 0x58], rcx
mov dword [rsp + 0x40], ecx
mov rcx, qword [0x14047a938]
mov qword [r11 - 0x18], 4
mov dword [rsp + 0x48], eax
jne 0x140090f0f
mov edx, 0x221458
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov eax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14012c2b0
add rsp, 0x78
ret

Function at 0x140090f30
Capabilities:
Interact with driver via ioctl

Disassembly:
mov r11, rsp
sub rsp, 0x78
mov rax, qword [0x140479900]
xor rax, rsp
mov qword [rsp + 0x68], rax
xor ecx, ecx
mov dword [rsp + 0x40], 0
cmp byte [0x14047a7b9], cl
lea rax, [r11 - 0x38]
mov qword [r11 - 0x40], rcx
lea r8, [r11 - 0x30]
mov dword [rsp + 0x4c], ecx
mov qword [r11 - 0x48], rcx
lea r9d, [rcx + 0x20]
mov dword [rsp + 0x28], ecx
mov qword [r11 - 0x20], rax
mov eax, dword [0x14047a91c]
mov qword [r11 - 0x28], rdx
mov edx, 0x2225c4
mov qword [r11 - 0x58], rcx
mov rcx, qword [0x14047a938]
mov qword [r11 - 0x18], 4
mov dword [rsp + 0x48], eax
jne 0x140090fa3
mov edx, 0x221458
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
movss xmm0, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14012c2b0
add rsp, 0x78
ret
Function at 0x140090fd0
Capabilities:
Interact with driver via ioctl

Disassembly:
mov r11, rsp
sub rsp, 0x78
mov rax, qword [0x140479900]
xor rax, rsp
mov qword [rsp + 0x68], rax
xor ecx, ecx
lea rax, [r11 - 0x38]
cmp byte [0x14047a7b9], cl
lea r8, [r11 - 0x30]
mov qword [r11 - 0x40], rcx
xorps xmm0, xmm0
mov dword [rsp + 0x4c], ecx
mov qword [r11 - 0x48], rcx
lea r9d, [rcx + 0x20]
mov dword [rsp + 0x28], ecx
mov qword [r11 - 0x20], rax
mov eax, dword [0x14047a91c]
mov qword [r11 - 0x28], rdx
mov edx, 0x2225c4
mov qword [r11 - 0x58], rcx
mov rcx, qword [0x14047a938]
mov qword [r11 - 0x18], 8
movsd qword [rsp + 0x40], xmm0
mov dword [rsp + 0x48], eax
jne 0x140091044
mov edx, 0x221458
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
movsd xmm0, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14012c2b0
add rsp, 0x78
ret

Function at 0x140091070
Capabilities:
Interact with driver via ioctl

Disassembly:
mov r11, rsp
sub rsp, 0x78
mov rax, qword [0x140479900]
xor rax, rsp
mov qword [rsp + 0x68], rax
xor ecx, ecx
lea rax, [r11 - 0x38]
cmp byte [0x14047a7b9], cl
lea r8, [r11 - 0x30]
mov qword [r11 - 0x40], rcx
mov dword [rsp + 0x4c], ecx
mov qword [r11 - 0x48], rcx
lea r9d, [rcx + 0x20]
mov dword [rsp + 0x28], ecx
mov qword [r11 - 0x20], rax
mov eax, dword [0x14047a91c]
mov qword [r11 - 0x28], rdx
mov edx, 0x2225c4
mov qword [r11 - 0x58], rcx
mov qword [r11 - 0x38], rcx
mov rcx, qword [0x14047a938]
mov qword [r11 - 0x18], 8
mov dword [rsp + 0x48], eax
jne 0x1400910df
mov edx, 0x221458
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14012c2b0
add rsp, 0x78
ret
Function at 0x1400a8720
Capabilities:
Encode data using xor
Read .ini file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0xe0
mov rax, qword [0x140479900]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov rbx, r9
mov rdi, r8
mov rsi, rdx
mov rbp, rcx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], r8
mov qword [rsp + 0x50], rbx
xor r14d, r14d
mov r8, rdx
cmp qword [rdx + 0x18], 0xf
jbe 0x1400a8770
mov r8, qword [rdx]
mov dword [rsp + 0x30], 0x3e3d2521
mov word [rsp + 0x34], 0x100
mov rcx, r14
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x6f]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 4
jb 0x1400a8790
mov byte [rsp + 0x35], 0
mov rdx, rbx
cmp qword [r9 + 0x18], 0xf
jbe 0x1400a87b2
mov rdx, qword [r9]
mov rcx, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x1400a87bf
mov rcx, qword [rdi]
mov qword [rsp + 0x28], r8
mov dword [rsp + 0x20], 0x64
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], r14
mov qword [rbp + 0x18], r14
lea rax, [rsp + 0x60]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400a8800
lea rdx, [rsp + 0x60]
mov rcx, rbp
call fcn.14003c860
nop
mov rdx, qword [rsi + 0x18]
cmp rdx, 0xf
jbe 0x1400a8852
mov rcx, qword [rsi]
inc rdx
cmp rdx, 0x1000
jb 0x1400a884d
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400a8910
mov rcx, r8
call fcn.14012c44c
mov qword [rsi + 0x10], r14
mov qword [rsi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rsi], 0
mov rdx, qword [rdi + 0x18]
cmp rdx, 0xf
jbe 0x1400a889b
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x1400a8896
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400a8917
mov rcx, r8
call fcn.14012c44c
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], 0
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x1400a88e0
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x1400a88db
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400a891e
mov rcx, r8
call fcn.14012c44c
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rax, rbp
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.14012c2b0
add rsp, 0xe0
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x1400b8b80
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
cmp dword [0x14047aa50], 0
je 0x1400b8b96
cmp dword [0x14047aa70], 0
jne 0x1400b8b9f
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
add rsp, 0x28
ret

Function at 0x1400bda00
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, qword [rcx]
mov r10d, 0x270
mov ecx, dword [r9]
cmp ecx, r10d
jne 0x1400bda61
lea r8, [r9 + 8]
nop dword [rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x1400bda20
mov ecx, dword [r9]
jmp 0x1400bdb48
cmp ecx, 0x4e0
jb 0x1400bdb48
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, eax
lea r10, [r10 + 4]
xor edx, r11d
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x1400bda80
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop dword [rax + rax]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, eax
lea r10, [r10 + 4]
xor edx, r11d
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x1400bdad0
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret

Function at 0x1400bdbb0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 3], 0
je 0x1400bdbd3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x6f]
xor byte [rax + rcx], dl
inc rax
cmp rax, 2
jb 0x1400bdbc0
mov byte [rcx + 3], 0
mov rax, rcx
ret

Function at 0x1400bdbe0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 4], 0
je 0x1400bdc03
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x6f]
xor byte [rax + rcx], dl
inc rax
cmp rax, 3
jb 0x1400bdbf0
mov byte [rcx + 4], 0
mov rax, rcx
ret

Function at 0x1400bdc10
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x1400bdc33
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x6f]
xor byte [rax + rcx], dl
inc rax
cmp rax, 4
jb 0x1400bdc20
mov byte [rcx + 5], 0
mov rax, rcx
ret
Function at 0x1400bdc40
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 6], 0
je 0x1400bdc63
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x6f]
xor byte [rax + rcx], dl
inc rax
cmp rax, 5
jb 0x1400bdc50
mov byte [rcx + 6], 0
mov rax, rcx
ret

Function at 0x1400bdc70
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 7], 0
je 0x1400bdc93
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x6f]
xor byte [rax + rcx], dl
inc rax
cmp rax, 6
jb 0x1400bdc80
mov byte [rcx + 7], 0
mov rax, rcx
ret

Function at 0x1400bdca0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 8], 0
je 0x1400bdcc3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x6f]
xor byte [rax + rcx], dl
inc rax
cmp rax, 7
jb 0x1400bdcb0
mov byte [rcx + 8], 0
mov rax, rcx
ret

Function at 0x1400bdcd0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 9], 0
je 0x1400bdcf3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x6f]
xor byte [rax + rcx], dl
inc rax
cmp rax, 8
jb 0x1400bdce0
mov byte [rcx + 9], 0
mov rax, rcx
ret

Function at 0x1400bdd00
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xa], 0
je 0x1400bdd23
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x6f]
xor byte [rax + rcx], dl
inc rax
cmp rax, 9
jb 0x1400bdd10
mov byte [rcx + 0xa], 0
mov rax, rcx
ret

Function at 0x1400bdd30
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x10], 0
je 0x1400bdd53
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x6f]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xf
jb 0x1400bdd40
mov byte [rcx + 0x10], 0
mov rax, rcx
ret

Function at 0x1400bdd60
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x12], 0
je 0x1400bdd83
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x6f]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x11
jb 0x1400bdd70
mov byte [rcx + 0x12], 0
mov rax, rcx
ret

Function at 0x1400bdd90
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x13], 0
je 0x1400bddb3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x6f]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x12
jb 0x1400bdda0
mov byte [rcx + 0x13], 0
mov rax, rcx
ret

Function at 0x1400bddc0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x15], 0
je 0x1400bdde3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x6f]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x14
jb 0x1400bddd0
mov byte [rcx + 0x15], 0
mov rax, rcx
ret

Function at 0x1400bddf0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x2a], 0
je 0x1400bde13
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x6f]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x29
jb 0x1400bde00
mov byte [rcx + 0x2a], 0
mov rax, rcx
ret

Function at 0x1400bde20
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xb], 0
je 0x1400bde43
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x6f]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xa
jb 0x1400bde30
mov byte [rcx + 0xb], 0
mov rax, rcx
ret
Function at 0x1400bde50
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xc], 0
je 0x1400bde73
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x6f]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xb
jb 0x1400bde60
mov byte [rcx + 0xc], 0
mov rax, rcx
ret

Function at 0x1400bde80
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xd], 0
je 0x1400bdea3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x6f]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xc
jb 0x1400bde90
mov byte [rcx + 0xd], 0
mov rax, rcx
ret

Function at 0x1400bdeb0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xe], 0
je 0x1400bded3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x6f]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xd
jb 0x1400bdec0
mov byte [rcx + 0xe], 0
mov rax, rcx
ret

Function at 0x1400bdee0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xf], 0
je 0x1400bdf03
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x6f]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xe
jb 0x1400bdef0
mov byte [rcx + 0xf], 0
mov rax, rcx
ret

Function at 0x1400be520
Capabilities:
Interact with driver via ioctl

Disassembly:
mov r11, rsp
sub rsp, 0x78
mov rax, qword [0x140479900]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor r9d, r9d
mov eax, r8d
cmp byte [0x14047a7b9], r9b
lea r8, [r11 - 0x38]
mov qword [r11 - 0x40], r9
mov qword [r11 - 0x48], r9
mov dword [r11 - 0x50], r9d
mov qword [r11 - 0x20], rax
mov eax, dword [0x14047a91c]
mov dword [r11 - 0x34], r9d
mov qword [r11 - 0x30], rcx
mov rcx, qword [0x14047a938]
mov qword [r11 - 0x28], rdx
mov edx, 0x2225c4
mov qword [r11 - 0x58], r9
mov r9d, reloc.WLDAP32.dll_Ordinal_32
mov dword [rsp + 0x40], eax
jne 0x1400be58a
mov edx, 0x221458
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
setne al
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14012c2b0
add rsp, 0x78
ret
Function at 0x1400c8d80
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x1400c8db4
mov eax, esi
lea ecx, [rax + 9]
xor byte [r8 + rax], cl
inc rax
cmp rax, 6
jb 0x1400c8da0
mov byte [r8 + 7], sil
add r8, 6
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.14008f770
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x1400c8dd9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14003e2c0
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x1400c8e53
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c8e4e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400c8e4e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14012c44c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x1400c8e60
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r10, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x28], rcx
xor ebx, ebx
cmp byte [r8 + 9], bl
je 0x1400c8e94
mov ecx, ebx
lea eax, [rcx + 9]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 8
jb 0x1400c8e80
mov byte [r8 + 9], bl
add r8, 8
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x50]
call fcn.14008f770
nop
cmp byte [rdi + 9], 0
je 0x1400c8ec4
lea eax, [rbx + 9]
xor byte [rbx + rdi], al
inc rbx
cmp rbx, 8
jb 0x1400c8eb1
mov byte [rdi + 9], 0
lea r8, [rdi + 8]
lea r9, [rsp + 0x20]
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.14008f770
nop
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
movzx edx, byte [rsp + 0x20]
mov rcx, rsi
call fcn.140091380
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x1400c8f34
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c8f2e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400c8f2e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14012c44c
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x1400c8f74
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c8f6f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400c8f6f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14012c44c
mov rax, rsi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400c8f80
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 9], sil
je 0x1400c8fb4
mov eax, esi
lea ecx, [rax + 9]
xor byte [r8 + rax], cl
inc rax
cmp rax, 8
jb 0x1400c8fa0
mov byte [r8 + 9], sil
add r8, 8
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.14008f770
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x1400c8fd9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14003e2c0
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x1400c9053
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c904e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400c904e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14012c44c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x1400c9060
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xa], sil
je 0x1400c9094
mov eax, esi
lea ecx, [rax + 9]
xor byte [r8 + rax], cl
inc rax
cmp rax, 9
jb 0x1400c9080
mov byte [r8 + 0xa], sil
add r8, 9
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.14008f770
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x1400c90b9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14003e2c0
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x1400c9133
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c912e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400c912e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14012c44c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret