joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140025f00
Capabilities:
Modify service

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x460
mov rax, qword [0x1400aa008]
xor rax, rsp
mov qword [rsp + 0x450], rax
xor ebx, ebx
mov r14, r8
mov rbp, rdx
xor ecx, ecx
xor edx, edx
mov edi, ebx
lea r8d, [rbx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r15, [0x14008a330]
test rsi, rsi
jne 0x140025f9d
mov r9d, eax
lea r8, str.OpenSCManager_failed.
lea rdx, str._s._Error_Code___d.
lea rcx, [rsp + 0x50]
call fcn.1400262a0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
lea r9d, [rbx + 1]
mov qword [rsp + 0x28], r15
lea r8, [0x1400abd38]
lea edx, [rbx + 0x31]
mov qword [rsp + 0x20], rbx
lea rcx, str.s:p4clientconsumermainrel3consumerplatform_vista_sharedGenericService.h
call fcn.140005e30
jmp 0x140025fb2
mov r8d, 2
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rdi, rdi
jne 0x140026006
mov r9d, eax
lea r8, str.OpenService_failed.
lea rdx, str._s._Error_Code___d.
lea rcx, [rsp + 0x50]
call fcn.1400262a0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
lea r9d, [rdi + 1]
mov qword [rsp + 0x28], r15
lea r8, [0x1400abd38]
lea edx, [rdi + 0x31]
mov qword [rsp + 0x20], rbx
lea rcx, str.s:p4clientconsumermainrel3consumerplatform_vista_sharedGenericService.h
call fcn.140005e30
lea r8, [rsp + 0x40]
mov qword [rsp + 0x40], r14
mov edx, 1
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
je 0x140026062
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
mov r9d, 2
lea r8, [0x1400abd38]
mov edx, 0x1b0
lea rax, str.Service_description_has_been_updated.
mov qword [rsp + 0x28], rax
lea rcx, str...SharedGenericService.cpp
mov qword [rsp + 0x20], rbx
call fcn.140005e30
mov ebx, 1
jmp 0x14002609b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
mov r9d, 2
lea r8, [0x1400abd38]
mov edx, 0x1b5
lea rax, str.ChangeServiceConfig2_failed.
mov qword [rsp + 0x28], rax
lea rcx, str...SharedGenericService.cpp
mov qword [rsp + 0x20], rbx
call fcn.140005e30
test rdi, rdi
je 0x1400260a9
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rsi, rsi
je 0x1400260b7
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.140030090
mov rbx, qword [rsp + 0x490]
add rsp, 0x460
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400270f0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
xor eax, eax
xor bl, bl
mov qword [rsp + 0x30], rax
mov rdi, rdx
test rcx, rcx
je 0x1400271a0
cmp ax, word [rcx]
je 0x1400271a0
mov rdx, rcx
lea r8, [0x140092a08]
lea rcx, [rsp + 0x30]
call fcn.140061d78
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400271a0
xor edx, edx
mov qword [rsp + 0x38], rsi
lea r8d, [rdx + 2]
call fcn.140061bbc
mov rcx, qword [rsp + 0x30]
call fcn.140061850
mov rcx, qword [rsp + 0x30]
xor r8d, r8d
xor edx, edx
movsxd rsi, eax
call fcn.140061bbc
test esi, esi
jle 0x140027191
mov rdx, rsi
mov rcx, rdi
mov rbx, rsi
call fcn.14001e6c0
mov r9, qword [rsp + 0x30]
mov r8d, 1
mov rcx, qword [rdi]
mov rdx, rsi
call fcn.1400620a8
cmp rax, 1
sete bl
mov rcx, qword [rsp + 0x30]
call fcn.1400618dc
mov rsi, qword [rsp + 0x38]
movzx eax, bl
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400271b0
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov qword [rax - 0x38], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov r15d, r8d
mov r12, rdx
mov rbp, rcx
xor r14b, r14b
xor r13d, r13d
mov qword [rax - 0x40], r13
lea rax, [0x140092a28]
lea rdi, [0x140092a20]
test r9b, r9b
cmovne rdi, rax
call fcn.140003500
mov rcx, rax
test rax, rax
jne 0x140027214
mov ecx, 0x80004005
call fcn.140003260
int3
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x20], rbx
or rsi, 0xffffffffffffffff
test rdi, rdi
je 0x14002726c
test rdi, 0xffffffffffff0000
jne 0x140027256
movzx edi, di
mov ecx, edi
call fcn.140006450
test rax, rax
je 0x140027284
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.140006fb0
jmp 0x14002727f
mov rax, rsi
nop dword [rax]
inc rax
cmp word [rdi + rax*2], 0
jne 0x140027260
jmp 0x14002726f
mov eax, r13d
mov r8d, eax
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.1400070c0
mov rbx, qword [rsp + 0x20]
test rbp, rbp
je 0x1400272a0
cmp r13w, word [rbp]
je 0x1400272a0
mov r8, rbx
mov rdx, rbp
lea rcx, [rsp + 0x28]
call fcn.140061d78
mov r9, qword [rsp + 0x28]
test r9, r9
je 0x1400272cd
mov rdx, r15
mov r8d, 1
mov rcx, r12
call fcn.140062674
cmp rax, 1
sete r14b
mov rcx, qword [rsp + 0x28]
call fcn.1400618dc
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x1400272e5
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
movzx eax, r14b
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140027600
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x80
xor edi, edi
lea rax, [r11 - 0x3c]
mov qword [r11 - 0x58], rax
mov rsi, r9
lea rax, [r11 - 0x28]
mov dword [rsp + 0x50], edi
mov qword [r11 - 0x60], rax
mov r14, r8
mov qword [r11 - 0x68], rdi
mov r15, rdx
mov rbp, rcx
mov dword [rsp + 0x28], 0x20019
xor r9d, r9d
mov dword [rsp + 0x20], edi
xor r8d, r8d
mov qword [r11 - 0x28], rdi
lea rdx, str.SOFTWAREWaves_AudioMaxxAudioGeneral
mov rcx, 0xffffffff80000002
mov ebx, edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400276b9
mov rbx, qword [rsp + 0x70]
lea rax, [rsp + 0x54]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x58]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x54], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.MaxxAudioGUIType
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400276b9
cmp dword [rsp + 0x58], 4
je 0x140027759
lea rax, [rsp + 0x60]
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x40], rax
lea rdx, str.SoftwareConexant
lea rax, [rsp + 0x68]
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], rdi
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0x20019
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14002777b
test rbx, rbx
je 0x140027711
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, eax
mov rbx, qword [rsp + 0x68]
test edi, edi
jne 0x14002777b
lea rax, [rsp + 0x58]
mov dword [rsp + 0x58], 4
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x54]
lea rax, [rsp + 0x50]
xor r8d, r8d
lea rdx, str.MaxxAudioGUIType
mov qword [rsp + 0x20], rax
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14002777b
cmp dword [rsp + 0x54], 4
jne 0x14002777b
mov ecx, dword [rsp + 0x50]
mov dil, 1
movzx eax, cx
mov byte [rbp], cl
shr ecx, 0x10
shr ax, 8
mov byte [r14], cl
shr cx, 8
mov byte [rsi], cl
mov byte [r15], al
jmp 0x14002777e
xor dil, dil
test rbx, rbx
je 0x14002778c
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r11, [rsp + 0x80]
movzx eax, dil
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x14002b920
Capabilities:
Check if file exists
Delete file
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1400aa008]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, qword [rcx + 0x88]
mov rsi, rcx
mov dil, 1
xor ebp, ebp
mov rbx, qword [rbx]
nop word [rax + rax]
cmp rbx, qword [rsi + 0x88]
je 0x14002ba5f
lea rdx, [rbx + 0x20]
mov qword [rsp + 0x38], 7
or r9, 0xffffffffffffffff
mov qword [rsp + 0x30], rbp
xor r8d, r8d
mov word [rsp + 0x20], bp
lea rcx, [rsp + 0x20]
call fcn.140011ed0
cmp qword [rsp + 0x38], 8
lea rcx, [rsp + 0x20]
cmovae rcx, qword [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x14002b9e9
cmp qword [rsp + 0x38], 8
lea rcx, [rsp + 0x20]
mov edx, 0x80
cmovae rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp qword [rsp + 0x38], 8
lea rcx, [rsp + 0x20]
cmovae rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne dil
mov r8, qword [rsp + 0x38]
cmp r8, 8
jb 0x14002ba06
mov rdx, qword [rsp + 0x20]
lea rcx, [rsp + 0x20]
inc r8
call fcn.140009050
cmp byte [rbx + 0x19], bpl
jne 0x14002ba56
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], bpl
jne 0x14002ba30
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], bpl
jne 0x14002ba56
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], bpl
je 0x14002ba22
jmp 0x14002ba56
mov rcx, qword [rbx + 8]
cmp byte [rcx + 0x19], bpl
jne 0x14002ba53
nop word [rax + rax]
cmp rbx, qword [rcx + 0x10]
jne 0x14002ba53
mov rbx, rcx
mov rcx, qword [rcx + 8]
cmp byte [rcx + 0x19], bpl
je 0x14002ba40
mov rbx, rcx
test dil, dil
jne 0x14002b960
movzx eax, dil
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140030090
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x14002c930
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x6e8
mov rax, qword [0x1400aa008]
xor rax, rsp
mov qword [rsp + 0x6d0], rax
xor eax, eax
lea rdx, str.SOFTWAREWaves_AudioMaxxAudioGeneral
mov dword [rsp + 0x30], eax
mov r9d, 0x20019
mov qword [rsp + 0x38], rax
xor r8d, r8d
lea rax, [rsp + 0x38]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14002c9c1
lea rax, [rsp + 0x34]
mov dword [rsp + 0x34], 4
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea rax, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.Debug
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [0x1400aae8c]
mov edx, 6
mov eax, dword [rsp + 0x30]
test eax, eax
cmovne ecx, eax
mov dword [0x1400aae8c], ecx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
lea rcx, [rsp + 0x50]
call fcn.14002cc30
lea rcx, [rsp + 0x50]
call fcn.140025170
lea rcx, [rsp + 0x50]
call fcn.14002ce20
xor eax, eax
mov rcx, qword [rsp + 0x6d0]
xor rcx, rsp
call fcn.140030090
add rsp, 0x6e8
ret
Function at 0x140032f00
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x140032f13
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.140033578
lea rdx, [0x1400a7450]
lea rcx, [rsp + 0x20]
call fcn.14005175c
int3

Function at 0x14003f340
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x1400ae768]
xor edx, edx
jmp fcn.140032f00

Function at 0x14003fd30
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x1400ae768]
jmp fcn.140032f00
Function at 0x1400687bc
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x14006865c
call fcn.14005390c
mov dword [rax], 0x16
call fcn.1400534a4
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x140068644
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x140068644
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x14006868e
lock or dword [rax + 0x14], 0x10
jmp 0x140068644
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x1400686ab
mov rcx, qword [rbp + 0x10]
call fcn.14007187c
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.1400665a0
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.14006765c
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x140068702
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x140068644
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x14006876e
mov rcx, qword [rbp + 0x10]
call fcn.1400665a0
cmp eax, 0xffffffff
je 0x140068755
mov rcx, qword [rbp + 0x10]
call fcn.1400665a0
cmp eax, 0xfffffffe
je 0x140068755
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.1400665a0
movsxd rdi, eax
lea rsi, [0x1400aed40]
mov rcx, rbx
sar rdi, 6
call fcn.1400665a0
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x14006875c
lea rax, [0x1400aa400]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x14006876e
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x1400687a4
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x1400687a0
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x1400687a0
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x140068647
jmp 0x140068614
Function at 0x1400061f0
Capabilities:
Access peb ldr_data
Encode data using xor
Get kernel32 base address
Get process filename
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1400ed520]
test rax, rax
jne 0x1400063f4
mov rax, qword gs:[0x60]
xor r8d, r8d
mov qword [rsp + 0x48], rbx
mov ebx, 0x694a8c81
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], rsi
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
mov rax, qword [rcx + 0x10]
mov rbp, qword [rax]
mov rdi, rbp
movups xmm0, xmmword [rdi + 0x58]
movd eax, xmm0
sub ax, 8
test r8d, r8d
je 0x14000628d
psrldq xmm0, 8
mov edx, 0x811c9dc5
movq rcx, xmm0
movzx eax, ax
shr rax, 1
lea r9, [rcx + rax*2]
cmp rcx, r9
je 0x140006284
movsx eax, byte [rcx]
add rcx, 2
xor eax, edx
imul edx, eax, 0x1000193
cmp rcx, r9
jne 0x140006270
cmp edx, r8d
jne 0x1400063b7
mov r10, qword [rdi + 0x30]
movsxd rax, dword [r10 + 0x3c]
mov rcx, qword [rax + r10 + 0x88]
mov r15, rcx
mov r11d, ecx
shr r15, 0x20
add r11, r10
cmp r11, r10
je 0x1400063b7
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x1400063b7
mov r14d, dword [r11 + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov edx, 0x811c9dc5
lea rax, [r14 + r9*4]
mov ecx, dword [rax + r10]
add rcx, r10
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x140006307
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x1400062f0
cmp edx, ebx
je 0x140006315
test r9d, r9d
jne 0x1400062d0
jmp 0x1400063b7
mov ecx, dword [r11 + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
cmp rax, r11
jbe 0x1400063cf
lea rcx, [r15 + r11]
cmp rax, rcx
jae 0x1400063cf
movzx ecx, byte [rax]
mov r8d, 0x811c9dc5
mov dword [rsp + 0x40], r8d
mov edx, r8d
mov dword [rsp + 0x44], edx
cmp cl, 0x2e
je 0x14000637d
nop
movsx ecx, cl
inc rax
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rax]
cmp cl, 0x2e
jne 0x140006360
mov dword [rsp + 0x40], r8d
movzx ecx, byte [rax + 1]
inc rax
test cl, cl
je 0x1400063aa
nop dword [rax + rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax]
test cl, cl
jne 0x140006390
mov dword [rsp + 0x44], edx
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rbp]
shr rbx, 0x20
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rbp
je 0x1400063cd
cmp qword [rax + 0x30], 0
jne 0x140006241
xor eax, eax
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
mov qword [0x1400ed520], rax
add rsp, 0x38
jmp rax
Function at 0x14000d5d0
Capabilities:
Encode data using xor
Get hostname

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1400eb0c0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rax, qword [str.lTPRRIQ_40eustz]
lea rdx, [rsp + 0x30]
movzx ebx, byte [0x1400d4b27]
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rsi, [0x1400ecfb0]
xor edi, edi
mov dword [rsp + 0x30], reloc.WS2_32.dll_recv
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x14000d663
xorps xmm0, xmm0
mov qword [0x1400ecfc0], rdi
movups xmmword [0x1400ecfb0], xmm0
mov qword [0x1400ecfc8], rdi
lea rax, [rsp + 0x38]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rax + r8], dil
jne 0x14000d650
lea rdx, [rsp + 0x38]
jmp 0x14000d7c5
test bl, bl
je 0x14000d793
cmp dword [reloc.WS2_32.dll_accept], 2
mov r8d, edi
jl 0x14000d75b
movdqa xmm2, xmmword [0x1400d7300]
movdqa xmm4, xmmword [0x1400d7410]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [str.7777]
psubd xmm2, xmm0
movd xmm0, dword [rsp + 0x28]
andps xmm2, xmmword [0x1400d73f0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1400d7420]
xorps xmm2, xmm0
movd dword [rsp + 0x28], xmm2
movdqa xmm2, xmmword [0x1400d7320]
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [str.7777]
psubd xmm2, xmm0
movd xmm0, dword [rsp + 0x2c]
andps xmm2, xmmword [0x1400d73f0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1400d7420]
xorps xmm2, xmm0
movd dword [rsp + 0x2c], xmm2
jmp 0x14000d793
lea r9, [rsp + 0x28]
mov eax, 0x29e4129f
lea r9, [r9 + 1]
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x37
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x39
xor byte [r9 - 1], al
cmp r8d, 8
jl 0x14000d760
xorps xmm0, xmm0
mov qword [0x1400ecfc0], rdi
movups xmmword [0x1400ecfb0], xmm0
mov qword [0x1400ecfc8], rdi
lea rax, [rsp + 0x28]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], dil
jne 0x14000d7b7
lea rdx, [rsp + 0x28]
mov rcx, rsi
call fcn.140045100
mov rax, rsi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400bbb00
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x14000d7f0
Capabilities:
Encode data using xor
Get session user name

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x160
mov rax, qword [0x1400eb0c0]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rax, qword [str.lTPRRIQ_40eustz]
lea rdx, [rsp + 0x30]
movzx ebx, byte [0x1400d4b27]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rsi, [0x1400ed040]
xor edi, edi
mov dword [rsp + 0x30], 0x101
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x14000d883
xorps xmm0, xmm0
mov qword [0x1400ed050], rdi
movups xmmword [0x1400ed040], xmm0
mov qword [0x1400ed058], rdi
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], dil
jne 0x14000d870
lea rdx, [rsp + 0x40]
jmp 0x14000d9e5
test bl, bl
je 0x14000d9b3
cmp dword [reloc.WS2_32.dll_accept], 2
mov r8d, edi
jl 0x14000d97b
movdqa xmm2, xmmword [0x1400d7300]
movdqa xmm4, xmmword [0x1400d7410]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [str.7777]
psubd xmm2, xmm0
movd xmm0, dword [rsp + 0x28]
andps xmm2, xmmword [0x1400d73f0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1400d7420]
xorps xmm2, xmm0
movd dword [rsp + 0x28], xmm2
movdqa xmm2, xmmword [0x1400d7320]
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [str.7777]
psubd xmm2, xmm0
movd xmm0, dword [rsp + 0x2c]
andps xmm2, xmmword [0x1400d73f0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1400d7420]
xorps xmm2, xmm0
movd dword [rsp + 0x2c], xmm2
jmp 0x14000d9b3
lea r9, [rsp + 0x28]
mov eax, 0x29e4129f
lea r9, [r9 + 1]
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x37
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x39
xor byte [r9 - 1], al
cmp r8d, 8
jl 0x14000d980
xorps xmm0, xmm0
mov qword [0x1400ed050], rdi
movups xmmword [0x1400ed040], xmm0
mov qword [0x1400ed058], rdi
lea rax, [rsp + 0x28]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], dil
jne 0x14000d9d7
lea rdx, [rsp + 0x28]
mov rcx, rsi
call fcn.140045100
mov rax, rsi
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1400bbb00
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret