joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14011722c
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x60
and dword [rbp - 0x3c], 0
mov r14, r8
and qword [rbp - 0x38], 0
lea r8, [rbp + 0x20]
mov rcx, rdx
mov dword [rbp - 0x40], 1
lea rdx, [rbp - 0x38]
call fcn.1401b1198
mov rsi, qword [rbp - 0x38]
mov edi, eax
test eax, eax
jns 0x14011727f
mov ecx, eax
call fcn.14007ac40
jmp 0x140117323
cmp dword [0x14045d4e0], 0
jne 0x14011728f
mov ebx, 0xc004d101
jmp 0x1401172e0
test rsi, rsi
je 0x1401172db
mov eax, dword [rbp + 0x20]
test eax, eax
je 0x1401172db
lea rcx, [0x14004c69c]
mov qword [rbp - 0x30], 3
mov qword [rbp - 0x28], rcx
lea rdx, [rbp - 0x30]
xor r9d, r9d
mov qword [rbp - 0x18], rsi
lea rcx, [rbp + 0x38]
mov dword [rbp - 0x10], eax
mov qword [rbp - 0x20], rcx
mov ecx, 0xb9
lea r8d, [r9 + 0x24]
call sub.ntdll.dll_NtQuerySystemInformation
mov ebx, dword [rbp + 0x38]
test ebx, ebx
jns 0x1401172e7
jmp 0x1401172e0
mov ebx, 0xc004d104
mov ecx, ebx
call fcn.14007ac40
mov ecx, ebx
call fcn.14007ace8
mov ecx, ebx
sub ecx, 0x4004d601
je 0x140117313
cmp ecx, 1
je 0x14011730a
mov edi, ebx
test ebx, ebx
jns 0x140117317
mov ecx, ebx
jmp 0x140117275
mov dword [rbp - 0x3c], 1
jmp 0x140117317
and dword [rbp - 0x40], 0
test r14, r14
je 0x140117323
mov rax, qword [rbp - 0x40]
mov qword [r14], rax
mov ecx, edi
call fcn.14007ace8
test rsi, rsi
je 0x140117338
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea r11, [rsp + 0x60]
mov eax, edi
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret

Function at 0x14016367c
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x140451b38]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov edi, dword [rsp + 0x3c]
mov r14, r9
mov ebp, edx
mov r15, rcx
xor esi, esi
lea rax, [rsp + 0x30]
xor ebx, ebx
lea r8, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, r15
lea r9d, [rbx + 0x24]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x1401636fb
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1401636e4
mov ebx, 0x80004005
jmp 0x1401636f2
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov ecx, ebx
call fcn.14007ac40
jmp 0x140163709
movups xmm0, xmmword [rsp + 0x60]
movups xmmword [rsp + 0x38], xmm0
mov edi, dword [rsp + 0x3c]
mov ecx, ebx
call fcn.14007ace8
test ebx, ebx
js 0x140163745
test bpl, 8
je 0x14016371f
cmp edi, 4
je 0x14016377d
test bpl, 1
je 0x14016372a
cmp edi, 1
je 0x14016377d
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0x1e
jb 0x1401636af
mov ebx, 0x800705b4
mov ecx, ebx
call fcn.14007ac40
mov ecx, ebx
call fcn.14007ace8
mov eax, ebx
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140388a40
mov rbx, qword [rsp + 0xc8]
add rsp, 0x90
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov dword [r14], edi
xor ebx, ebx
jmp 0x14016374c
Function at 0x14016ae00
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
cmp dword [rcx], 0
lea rbx, [rcx + 8]
mov rdi, rcx
je 0x14016aeb1
mov eax, dword [rcx + 4]
xor ebp, ebp
test eax, eax
cmovle ebp, eax
jle 0x14016ae87
xor esi, esi
movsxd rdx, esi
shl rdx, 4
add rdx, qword [rbx]
je 0x14016ae80
xor r9d, r9d
mov qword [rsp + 0x38], rdx
lea rax, [0x14001905c]
mov qword [rsp + 0x20], 3
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x20]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x40], 1
lea r8d, [r9 + 0x24]
mov qword [rsp + 0x30], rax
mov ecx, 0xb9
call sub.ntdll.dll_NtQuerySystemInformation
inc esi
cmp esi, dword [rdi + 4]
jl 0x14016ae32
mov rsi, qword [rbx]
test rsi, rsi
je 0x14016aea7
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
and qword [rbx], 0
and qword [rbx], 0
and dword [rdi], 0
mov dword [rdi + 4], ebp
xor ecx, ecx
call fcn.14007ace8
mov rdi, qword [rbx]
test rdi, rdi
je 0x14016aed8
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
and qword [rbx], 0
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x14016bdec
Capabilities:
Start service

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov qword [rax + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x20
xor r14d, r14d
xor edx, edx
xor ecx, ecx
mov qword [rax + 0x10], r14
mov esi, r14d
mov edi, r14d
mov ebp, r14d
lea r8d, [r14 + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
jne 0x14016be2e
mov ebx, r14d
jmp 0x14016be36
mov rcx, rax
test rax, rax
jne 0x14016be5e
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14016be47
mov ebp, 0x80004005
jmp 0x14016be55
movzx ebp, ax
or ebp, 0x80070000
test eax, eax
cmovle ebp, eax
mov ecx, ebp
call fcn.14007ac40
jmp 0x14016be79
mov r8d, SafeArrayGetElement
lea rdx, str.TrustedInstaller
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
je 0x14016be36
mov rsi, rax
mov ecx, ebp
call fcn.14007ace8
test rdi, rdi
je 0x14016be8e
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rbx, rbx
je 0x14016be9c
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test ebp, ebp
jns 0x14016bea7
mov ebx, ebp
jmp 0x14016bf6b
test rsi, rsi
lea r9, [rsp + 0x40]
mov rdi, r14
mov edx, 9
cmovne rdi, rsi
mov rcx, rdi
call fcn.14016379c
mov ebp, eax
mov ebx, eax
test eax, eax
jns 0x14016bed2
mov ecx, eax
call fcn.14007ac40
mov ecx, ebp
call fcn.14007ace8
test ebp, ebp
js 0x14016bf6b
cmp dword [rsp + 0x40], 4
jne 0x14016bef0
mov ebp, r14d
jmp 0x14016bf95
cmp qword [rsp + 0x48], r14
lea r8, [rsp + 0x48]
mov edx, r14d
mov rcx, rdi
setne dl
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x14016bf3f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
je 0x14016bf3f
test eax, eax
jne 0x14016bf28
mov ebp, 0x80004005
jmp 0x14016bea0
movzx ebp, ax
or ebp, 0x80070000
test eax, eax
cmovle ebp, eax
test ebp, ebp
jns 0x14016bf95
jmp 0x14016bea0
lea r9, [rsp + 0x40]
mov edx, 8
mov rcx, rdi
call fcn.14016379c
mov ebp, eax
mov ebx, eax
test eax, eax
jns 0x14016bf60
mov ecx, eax
call fcn.14007ac40
mov ecx, ebp
call fcn.14007ace8
test ebp, ebp
jns 0x14016bf82
mov ecx, ebx
call fcn.14007ac40
cmp ebp, 0x800705b4
mov ecx, 0x80070426
cmove ebp, ecx
jmp 0x14016bf95
cmp dword [rsp + 0x40], 4
je 0x14016bf95
mov ecx, 0x80070426
mov ebp, ecx
call fcn.14007ac40
mov ecx, ebp
call fcn.14007ace8
test rsi, rsi
je 0x14016bfaa
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test ebp, ebp
jns 0x14016bfb5
mov ecx, ebp
call fcn.14007ac40
mov ecx, ebp
call fcn.14007ace8
mov rbx, qword [rsp + 0x50]
mov eax, ebp
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x14016e03c
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x40
xor r12d, r12d
movsxd rbp, edx
mov rsi, rcx
mov ebx, r12d
cmp dword [rcx], ebp
je 0x14016e15e
mov r14d, dword [rcx + 4]
cmp ebp, r14d
cmovl r14d, ebp
test edx, edx
jle 0x14016e0dd
mov rbx, rbp
shl rbx, 5
mov ecx, r12d
call fcn.14007ace8
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
jne 0x14016e0ac
mov ebx, r12d
jmp 0x14016e0b7
mov rcx, rdi
mov rbx, rdi
test rdi, rdi
jne 0x14016e0c8
mov edi, 0x8007000e
mov ecx, edi
call fcn.14007ac40
jmp 0x14016e161
test r14d, r14d
je 0x14016e0dd
mov rdx, qword [rsi + 8]
movsxd r8, r14d
shl r8, 5
call sub.msvcrt.dll_memcpy
cmp ebp, dword [rsi + 4]
jge 0x14016e12d
mov edi, ebp
movsxd rdx, edi
shl rdx, 5
add rdx, qword [rsi + 8]
je 0x14016e126
xor r9d, r9d
mov qword [rsp + 0x38], rdx
lea rax, [0x14000891c]
mov qword [rsp + 0x20], 3
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov ecx, 0xb9
mov qword [rsp + 0x30], r12
lea r8d, [r9 + 0x20]
call sub.ntdll.dll_NtQuerySystemInformation
inc edi
cmp edi, dword [rsi + 4]
jl 0x14016e0e4
mov rdi, qword [rsi + 8]
mov r15, rbx
mov rbx, r12
test rdi, rdi
je 0x14016e154
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rsi + 8], r12
mov qword [rsi + 8], r15
mov dword [rsi + 4], r14d
mov dword [rsi], ebp
mov edi, r12d
mov ecx, edi
call fcn.14007ace8
test rbx, rbx
je 0x14016e181
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x60]
mov eax, edi
mov rdi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop r12
ret
Function at 0x14016e1ac
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
xor r12d, r12d
movsxd rbp, edx
mov rsi, rcx
mov ebx, r12d
cmp dword [rcx], ebp
je 0x14016e308
mov r14d, dword [rcx + 4]
cmp ebp, r14d
cmovl r14d, ebp
test edx, edx
jle 0x14016e280
lea r15, [rbp*2]
movabs rax, 0xaaaaaaaaaaaaaaab
add r15, rbp
mov edi, r12d
shl r15, 3
mul r15
shr rdx, 4
cmp rdx, rbp
je 0x14016e222
mov edi, 0x80070216
mov ecx, edi
call fcn.14007ac40
mov r15, qword [rsp + 0x70]
mov ecx, edi
call fcn.14007ace8
test edi, edi
jns 0x14016e239
mov ecx, edi
call fcn.14007ac40
jmp 0x14016e30b
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r15
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x14016e260
mov rcx, rax
mov rbx, rax
test rax, rax
jne 0x14016e267
mov edi, 0x8007000e
jmp 0x14016e22d
test r14d, r14d
je 0x14016e280
mov rdx, qword [rsi + 8]
movsxd rax, r14d
lea r8, [rax + rax*2]
shl r8, 3
call sub.msvcrt.dll_memcpy
cmp ebp, dword [rsi + 4]
jge 0x14016e2d7
mov edi, ebp
mov rdx, qword [rsi + 8]
movsxd rax, edi
lea rcx, [rax + rax*2]
lea rax, [rdx + rcx*8]
test rax, rax
je 0x14016e2d0
xor r9d, r9d
mov qword [rsp + 0x20], 3
lea rcx, [0x140006bdc]
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], rcx
lea rdx, [rsp + 0x20]
mov ecx, 0xb9
mov qword [rsp + 0x38], rax
lea r8d, [r9 + 0x20]
call sub.ntdll.dll_NtQuerySystemInformation
inc edi
cmp edi, dword [rsi + 4]
jl 0x14016e287
mov rdi, qword [rsi + 8]
mov r15, rbx
mov rbx, r12
test rdi, rdi
je 0x14016e2fe
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rsi + 8], r12
mov qword [rsi + 8], r15
mov dword [rsi + 4], r14d
mov dword [rsi], ebp
mov edi, r12d
mov ecx, edi
call fcn.14007ace8
test rbx, rbx
je 0x14016e32b
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea r11, [rsp + 0x40]
mov eax, edi
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14016e53c
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov rsi, rcx
movsxd r15, edx
mov ecx, dword [rcx + 4]
mov r12, r8
test ecx, ecx
jns 0x14016e566
mov edi, 0x8000ffff
mov ecx, edi
jmp 0x14016e580
lea r8, [rsp + 0x80]
mov edx, 1
call fcn.14007a2f8
mov edi, eax
test eax, eax
jns 0x14016e58a
mov ecx, eax
call fcn.14007ac40
jmp 0x14016e6ff
mov edi, dword [rsi]
test edi, edi
jns 0x14016e59e
mov edi, 0x8000ffff
mov ebx, edi
mov ecx, edi
jmp 0x14016e643
cmp dword [rsp + 0x80], edi
jg 0x14016e5ae
xor ebx, ebx
jmp 0x14016e648
mov r14d, dword [rsp + 0x80]
test edi, edi
jne 0x14016e5c3
mov edi, 0x20
xor ebx, ebx
jmp 0x14016e61d
js 0x14016e5ff
lea ecx, [rdi + rdi]
xor ebx, ebx
mov eax, ecx
shr eax, 1
cmp eax, edi
je 0x14016e5e0
mov ebx, 0x80070216
mov ecx, ebx
call fcn.14007ac40
jmp 0x14016e5e3
mov r14d, ecx
mov ecx, ebx
call fcn.14007ace8
test ebx, ebx
js 0x14016e604
test r14d, r14d
jns 0x14016e5fa
mov ebx, 0x80070216
jmp 0x14016e604
mov edi, r14d
jmp 0x14016e60b
mov ebx, 0x80070057
mov ecx, ebx
call fcn.14007ac40
mov ecx, ebx
call fcn.14007ace8
test ebx, ebx
jns 0x14016e61d
mov ecx, ebx
call fcn.14007ac40
mov ecx, ebx
call fcn.14007ace8
test ebx, ebx
js 0x14016e65c
cmp edi, dword [rsp + 0x80]
jl 0x14016e5b6
mov edx, edi
mov rcx, rsi
call fcn.1400c6bf4
mov ebx, eax
test eax, eax
jns 0x14016e648
mov ecx, eax
call fcn.14007ac40
mov ecx, ebx
call fcn.14007ace8
mov edi, ebx
test ebx, ebx
jns 0x14016e660
mov ecx, ebx
jmp 0x14016e580
mov ecx, ebx
jmp 0x14016e643
mov edx, dword [rsi + 4]
cmp r15d, edx
jge 0x14016e69f
mov rcx, qword [rsi + 8]
test rcx, rcx
jne 0x14016e676
xor r9d, r9d
jmp 0x14016e679
mov r9, rcx
sub edx, r15d
mov rax, r15
shl rax, 4
mov rbx, r15
movsxd r8, edx
shl r8, 4
lea rdx, [rax + rcx]
lea rcx, [rax + 0x10]
add rcx, r9
call sub.msvcrt.dll_memmove
jmp 0x14016e6a2
mov rbx, r15
mov rax, qword [rsi + 8]
lea rcx, [0x14001695c]
shl rbx, 4
lea rdx, [rsp + 0x20]
xorps xmm0, xmm0
xor r9d, r9d
movups xmmword [rbx + rax], xmm0
mov rax, qword [rsi + 8]
lea r8d, [r9 + 0x28]
mov qword [rsp + 0x28], rcx
add rax, rbx
lea rcx, [rsp + 0x98]
mov qword [rsp + 0x20], 3
mov qword [rsp + 0x30], rcx
mov ecx, 0xb9
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], r12
call sub.ntdll.dll_NtQuerySystemInformation
inc dword [rsi + 4]
xor edi, edi
mov ecx, edi
call fcn.14007ace8
mov rbx, qword [rsp + 0x88]
mov eax, edi
add rsp, 0x50
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14016f56c
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
push rbp
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov rbx, rdx
lea rcx, [rbp - 9]
xor edx, edx
lea r8d, [rdx + 0x40]
call sub.msvcrt.dll_memset
cmp dword [0x14045d4e0], 0
jne 0x14016f5a8
mov ecx, 0xc004d101
jmp 0x14016f631
mov rcx, 0xffffffff80000002
mov qword [rbp + 7], rbx
lea rax, str.data.dat
mov qword [rbp + 0xf], rcx
mov qword [rbp - 1], rax
lea rdx, [rbp - 0x39]
lea rax, str.SOFTWAREMicrosoftWindows_NTCurrentVersionSoftwareProtectionPlatform
mov qword [rbp + 0x1f], rcx
mov qword [rbp + 0x17], rax
xor r9d, r9d
lea rax, str.SYSTEMWPA
mov qword [rbp - 0x39], 3
mov qword [rbp + 0x27], rax
mov ecx, 0xb9
mov rax, qword [0x14045d4c0]
mov qword [rbp + 0x2f], rax
lea r8d, [r9 + 0x28]
mov rax, qword [0x14045d6c8]
mov qword [rbp - 0x21], rax
lea rax, [0x14000eddc]
mov qword [rbp - 0x31], rax
lea rax, [rbp + 0x5f]
mov qword [rbp - 0x29], rax
lea rax, [rbp - 9]
mov qword [rbp - 0x19], rax
call sub.ntdll.dll_NtQuerySystemInformation
mov ecx, dword [rbp + 0x5f]
test ecx, ecx
jns 0x14016f636
call fcn.14007ac40
call fcn.14016f308
mov ecx, eax
mov ebx, eax
call fcn.14007ace8
mov eax, ebx
mov rbx, qword [rsp + 0xa0]
add rsp, 0x90
pop rbp
ret

Function at 0x14016f660
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
xor edi, edi
mov esi, r9d
cmp dword [0x14045d4e0], edi
mov r14, r8
mov ebp, edx
mov r15, rcx
je 0x14016f6b4
test r9d, r9d
je 0x14016f6b4
mov bl, byte [r14]
lea edx, [rdi + rbp]
lea r8, [rsp + 0x48]
mov rcx, r15
call fcn.14018d9f4
xor bl, byte [rsp + 0x48]
inc edi
inc r14
mov byte [rax], bl
cmp edi, esi
jb 0x14016f692
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x14016f6d4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp dword [0x14045d4e0], 0
mov rsi, r8
mov ebx, edx
je 0x14016f73e
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x28], edx
test r9d, r9d
je 0x14016f73e
mov dword [rsp + 0x28], edx
mov edi, r9d
movaps xmm1, xmmword [rsp + 0x20]
lea r8, [rsp + 0x48]
movdqa xmm0, xmm1
inc ebx
psrldq xmm0, 8
movq rcx, xmm1
movd edx, xmm0
mov dword [rsp + 0x28], ebx
call fcn.14018d9f4
mov cl, byte [rsp + 0x48]
xor cl, byte [rax]
mov byte [rsi], cl
inc rsi
sub rdi, 1
jne 0x14016f706
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14016f7f8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
lea esi, [r8 - 1]
mov qword [rsp + 0x20], rcx
add esi, edx
mov dword [rsp + 0x28], edx
cmp dword [0x14045d4e0], 0
mov edi, edx
mov rbp, rcx
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x38], esi
je 0x14016f89e
cmp edx, esi
jae 0x14016f89e
lea r8, [rsp + 0x68]
mov edx, edi
mov rcx, rbp
call fcn.14018d9f4
movaps xmm1, xmmword [rsp + 0x20]
inc edi
mov bl, byte [rsp + 0x68]
movdqa xmm0, xmm1
psrldq xmm0, 8
mov r9d, esi
xor bl, byte [rax]
mov r8, rbp
movd edx, xmm0
movq rcx, xmm1
mov dword [rsp + 0x28], edi
call fcn.14018daf0
movaps xmm1, xmmword [rsp + 0x30]
lea r8, [rsp + 0x70]
movdqa xmm0, xmm1
dec esi
psrldq xmm0, 8
movq rcx, xmm1
movd edx, xmm0
mov dword [rsp + 0x38], esi
call fcn.14018d9f4
mov cl, byte [rsp + 0x70]
xor cl, bl
mov byte [rax], cl
cmp edi, esi
jb 0x14016f82e
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret

Function at 0x140170ad0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
and qword [rbp + 0x28], 0
mov rbx, rdx
cmp dword [0x14045d4e0], 0
jne 0x140170afd
mov ecx, 0xc004d101
call fcn.14007ac40
jmp 0x140170ba3
test rbx, rbx
jne 0x140170b09
mov ecx, 0x80070057
jmp 0x140170af3
mov rdx, rcx
lea r9, [rbp + 0x28]
mov rcx, qword [0x14045d4d8]
mov r8d, 4
call fcn.14017300c
mov ecx, eax
test eax, eax
js 0x140170af3
mov rax, qword [rbp + 0x28]
test byte [rax + 0x18], 1
jne 0x140170b39
mov ecx, 0xc004d314
jmp 0x140170af3
mov rcx, qword [rax + 0x10]
xor r9d, r9d
mov rdx, qword [0x14045d6c8]
lea rax, [0x140003b1c]
mov qword [rbp - 0x30], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rbp - 0x18], rcx
lea r8d, [r9 + 0x34]
mov qword [rbp - 0x20], rdx
mov ecx, 0xb9
lea rdx, [rbp - 0x38]
mov qword [rbp - 0xc], rax
mov qword [rbp - 0x38], 3
mov dword [rbp - 0x10], 0xa0005
call sub.ntdll.dll_NtQuerySystemInformation
mov ecx, dword [rbp + 0x20]
test ecx, ecx
js 0x140170af3
mov rax, qword [rbp - 0x40]
mov dword [rbx], eax
shr rax, 0x20
mov dword [rbx + 4], eax
call fcn.14016f308
mov ecx, eax
mov ebx, eax
call fcn.14007ace8
lea rcx, [rbp + 0x28]
call fcn.14006a9cc
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x140170bd0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
and qword [rbp - 0x40], 0
mov ebx, r8d
cmp dword [0x14045d4e0], 0
mov edi, edx
jne 0x140170bff
mov ecx, 0xc004d101
jmp 0x140170c8b
mov rdx, rcx
lea r9, [rbp - 0x40]
mov rcx, qword [0x14045d4d8]
mov r8d, 4
call fcn.14017300c
mov ecx, eax
test eax, eax
js 0x140170c8b
mov rax, qword [rbp - 0x40]
test byte [rax + 0x18], 1
jne 0x140170c2f
mov ecx, 0xc004d314
jmp 0x140170c8b
test bl, 2
je 0x140170c3b
mov ecx, 0x80070057
jmp 0x140170c8b
mov rcx, qword [rax + 0x10]
xor r9d, r9d
mov rdx, qword [0x14045d6c8]
lea rax, [0x140015f9c]
mov qword [rbp - 0x30], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 0x18], rcx
mov ecx, 0xb9
mov qword [rbp - 0x20], rdx
lea r8d, [r9 + 0x30]
lea rdx, [rbp - 0x38]
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x38], 3
mov dword [rbp - 0x10], edi
mov dword [rbp - 0xc], ebx
call sub.ntdll.dll_NtQuerySystemInformation
mov ecx, dword [rbp + 0x28]
test ecx, ecx
jns 0x140170c90
call fcn.14007ac40
call fcn.14016f308
mov ecx, eax
mov ebx, eax
call fcn.14007ace8
lea rcx, [rbp - 0x40]
call fcn.14006a9cc
mov rdi, qword [rsp + 0x78]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret

Function at 0x140170cc0
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x60
cmp dword [0x14045d4e0], 0
jne 0x140170cd6
mov ecx, 0xc004d101
jmp 0x140170d34
mov rax, qword [0x14045d6c8]
xor r9d, r9d
mov qword [rsp + 0x38], rax
lea rax, [0x14001a3dc]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x88]
mov qword [rsp + 0x40], rcx
mov ecx, 0xb9
mov qword [rsp + 0x48], rdx
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x50], r8
lea r8d, [r9 + 0x38]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x20], 3
call sub.ntdll.dll_NtQuerySystemInformation
mov ecx, dword [rsp + 0x88]
test ecx, ecx
jns 0x140170d39
call fcn.14007ac40
call fcn.14016f308
mov ecx, eax
mov ebx, eax
call fcn.14007ace8
mov eax, ebx
add rsp, 0x60
pop rbx
ret
Function at 0x140170d58
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
and qword [rbp - 0x50], 0
mov esi, r8d
and qword [rbp - 0x58], 0
mov r14, rdx
cmp dword [0x14045d4e0], 0
mov r12, rcx
jne 0x140170da1
mov edx, 0xc004d101
mov ecx, edx
call fcn.14007ac40
jmp 0x140170f4c
test r12, r12
jne 0x140170dad
mov edx, 0x80070057
jmp 0x140170d95
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 0x20]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x140170de2
and qword [rbx + 0x10], 0
mov dword [rax + 8], 1
lea rax, [0x1403bc1f8]
mov qword [rbx], rax
jmp 0x140170de4
xor ebx, ebx
mov qword [rbp - 0x50], rbx
test rbx, rbx
jne 0x140170df4
mov edx, 0x8007000e
jmp 0x140170d95
test r14, r14
jne 0x140170e04
mov edx, 0x80070057
mov edi, edx
mov ecx, edx
jmp 0x140170e40
test sil, 3
je 0x140170df9
test esi, 0xfffffff8
jne 0x140170df9
mov eax, esi
and al, 6
cmp al, 4
je 0x140170df9
lea rdx, [rbx + 0x10]
mov dword [rbx + 0x18], esi
mov rcx, r14
call fcn.14007ab14
mov edi, eax
test eax, eax
js 0x140170e3e
mov rcx, qword [rbx + 0x10]
call fcn.140189410
mov edi, eax
test eax, eax
jns 0x140170e45
mov ecx, eax
call fcn.14007ac40
mov ecx, edi
call fcn.14007ace8
mov edx, edi
test edi, edi
jns 0x140170e59
mov ecx, edi
jmp 0x140170d97
mov rax, qword [0x14045d6c8]
lea rdx, [rbp - 0x40]
mov qword [rbp - 0x28], rax
xor r9d, r9d
lea rax, [0x140003b1c]
mov qword [rbp - 0x40], 3
mov qword [rbp - 0x38], rax
mov ecx, 0xb9
lea rax, [rbp + 0x48]
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x30], rax
lea r8d, [r9 + 0x34]
lea rax, [rbp - 0x48]
mov dword [rbp - 0x18], 0xa0000
mov qword [rbp - 0x14], rax
call sub.ntdll.dll_NtQuerySystemInformation
mov edi, dword [rbp + 0x48]
xor edx, edx
mov r15d, 0xc004d315
cmp edi, r15d
cmovne edx, edi
test edx, edx
js 0x140170d95
mov rcx, qword [0x14045d4d8]
lea r9, [rbp - 0x58]
mov r8d, 4
mov rdx, rbx
call fcn.1401722c4
mov edx, eax
test eax, eax
jns 0x140170ee6
mov ecx, eax
jmp 0x140170d97
cmp edi, r15d
jne 0x140170f3f
test sil, 4
je 0x140170f97
mov rax, qword [0x14045d6c8]
lea rdx, [rbp - 0x40]
mov qword [rbp - 0x28], rax
xor r9d, r9d
lea rax, [0x14001a09c]
mov qword [rbp - 0x40], 3
mov qword [rbp - 0x38], rax
mov ecx, 0xb9
lea rax, [rbp - 0x60]
mov qword [rbp - 0x20], r14
lea r8d, [r9 + 0x34]
mov qword [rbp - 0x30], rax
call sub.ntdll.dll_NtQuerySystemInformation
mov edx, dword [rbp - 0x60]
test edx, edx
js 0x140170d95
mov rax, qword [rbp - 0x58]
and qword [rbp - 0x58], 0
mov qword [r12], rax
mov ecx, edx
call fcn.14016f308
mov ecx, eax
mov ebx, eax
call fcn.14007ace8
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x140170f6f
call fcn.14016f53c
and qword [rbp - 0x58], 0
lea rcx, [rbp - 0x50]
call fcn.14006a9cc
lea r11, [rsp + 0x80]
mov eax, ebx
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
mov edx, r15d
mov ecx, r15d
jmp 0x140170d97