joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2fc4d00b0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4d1190
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4d0ab2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f3108]
test eax, eax
je 0x2fc4d0b4a
lea rax, [0x2fc4f30e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f3110]
mov qword [rbp - 8], rax
jmp 0x2fc4d0b2e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d0b22
cmp qword [rbp - 0x10], 0
je 0x2fc4d0b22
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d0ae8
lea rax, [0x2fc4f30e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d0b4b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d0c50
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d0c78
mov eax, 0
jmp 0x2fc4d0cc6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d0ca1
mov eax, 0
jmp 0x2fc4d0cc6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d0cc1
mov eax, 0
jmp 0x2fc4d0cc6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d0ccc
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d0d4a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d0d41
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d0d41
mov rax, qword [rbp - 8]
jmp 0x2fc4d0d5f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d0d14
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d52c0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4d63a0
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4d5cc2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f8108]
test eax, eax
je 0x2fc4d5d5a
lea rax, [0x2fc4f80e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f8110]
mov qword [rbp - 8], rax
jmp 0x2fc4d5d3e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d5d32
cmp qword [rbp - 0x10], 0
je 0x2fc4d5d32
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d5cf8
lea rax, [0x2fc4f80e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d5d5b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d5e60
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d5e88
mov eax, 0
jmp 0x2fc4d5ed6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d5eb1
mov eax, 0
jmp 0x2fc4d5ed6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d5ed1
mov eax, 0
jmp 0x2fc4d5ed6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d5edc
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d5f5a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d5f51
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d5f51
mov rax, qword [rbp - 8]
jmp 0x2fc4d5f6f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d5f24
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140015880
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x118
mov r14, rcx
lea rdx, [0x1404baba8]
lea rsi, [rsp + 0x28]
mov r8d, 7
mov rcx, rsi
call fcn.140243490
cmp byte [rsi + 0x18], 3
jne 0x140015a89
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x80], rax
movups xmm0, xmmword [rsp + 0x28]
movaps xmmword [rsp + 0x70], xmm0
lea rax, [0x1403b5bde]
lea rdx, [rsp + 0xc0]
mov qword [rdx], rax
mov rcx, qword [rdx]
movabs rax, 0xda2aa37f787c8a34
mov qword [rdx], rax
mov rdx, qword [rdx]
call fcn.140204780
xorps xmm0, xmm0
movaps xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0xb0], 0
mov rcx, 0xfffffffffffffff8
lea rdx, [0x1403be6c0]
mov rbx, qword [rcx + rdx + 8]
xor rbx, qword [rax + rcx + 8]
mov qword [rsp + rcx + 0xa8], rbx
add rcx, 8
cmp rcx, 0x10
jb 0x14001591d
mov al, byte [rax + 0x18]
xor al, 0xea
lea rcx, [rsp + 0xa0]
mov byte [rcx + 0x18], al
lea rax, [rsp + 0x108]
mov qword [rax], rcx
mov qword [rax + 8], 0x19
lea rdi, [rsp + 0x70]
mov qword [rsp + 0x28], rdi
lea rcx, [0x1400099b0]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
lea rax, [0x140134850]
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0xc0]
mov qword [rdx], 0
lea rax, str.dest_is_out_of_bounds
mov qword [rdx + 0x10], rax
mov eax, 2
mov qword [rdx + 0x18], rax
mov qword [rdx + 0x20], rsi
mov qword [rdx + 0x28], rax
lea rcx, [rsp + 0x88]
call fcn.140053dd0
cmp qword [rdi], 0
je 0x1400159d5
mov r8, qword [rsp + 0x78]
mov rcx, qword [0x14051f200]
xor edx, edx
call qword [sym.imp.KERNEL32.DLL_HeapFree]
mov r12, qword [rsp + 0x88]
mov r15, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x98]
lea rsi, [rsp + 0xc0]
mov rcx, rsi
mov rdx, r15
mov r8, rbx
xor r9d, r9d
call fcn.140248460
cmp dword [rsi], 2
jne 0x140015a23
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 2
jmp 0x140015a41
lea rax, [rsp + 0x28]
lea rsi, [rsp + 0xc0]
mov ecx, 9
mov rdi, rax
rep movsq qword [rdi], qword [rsi]
cmp qword [rax], 2
jne 0x140015a52
lea rcx, [rsp + 0x30]
call fcn.14007ddf7
mov byte [r14 + 0x18], 2
jmp 0x140015a60
mov rcx, r14
mov rdx, r15
mov r8, rbx
call fcn.14025fcb0
test r12, r12
je 0x140015a77
mov rcx, qword [0x14051f200]
xor edx, edx
mov r8, r15
call qword [sym.imp.KERNEL32.DLL_HeapFree]
nop
add rsp, 0x118
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
movups xmm0, xmmword [rsp + 0x28]
movups xmm1, xmmword [rsp + 0x38]
lea r8, [rsp + 0xc0]
movaps xmmword [r8 + 0x10], xmm1
movaps xmmword [r8], xmm0
lea rax, str.src_firefox_firefox.rs
mov qword [rsp + 0x20], rax
lea rcx, [0x1404ef56b]
lea r9, fcn.140006040
mov edx, 0x2b
call fcn.1403afcb0
ud2
Function at 0x14012556a
Capabilities:
Connect socket

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rbx, rdx
mov rsi, rcx
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
lea rdx, [rsp + 0x30]
movaps xmmword [rdx + 0x10], xmm1
movaps xmmword [rdx], xmm0
lea rdi, [rsp + 0x20]
mov rcx, rdi
call fcn.140126d5f
cmp qword [rdi], 0
je 0x1401255b4
mov rax, qword [rsp + 0x28]
mov qword [rsi], rax
mov qword [rsi + 8], 0xffffffffffffffff
jmp 0x14012567e
mov r14, qword [rsp + 0x28]
mov eax, dword [rbx + 2]
movzx edi, word [rbx + 6]
mov r9, qword [rbx + 0xc]
mov r10d, dword [rbx + 0x18]
cmp word [rbx], 0
je 0x140125601
movzx ecx, di
movzx edi, word [rbx + 0x1c]
mov edx, dword [rbx + 8]
mov r11d, dword [rbx + 0x14]
rol di, 8
shr rax, 0x10
shl rdx, 0x20
shl rcx, 0x10
or rcx, rdx
or rcx, rax
mov r8d, 0x1c
mov bx, 0x17
mov eax, r11d
jmp 0x140125611
rol di, 8
mov r8d, 0x10
mov bx, 2
xor ecx, ecx
lea rdx, [rsp + 0x30]
mov word [rdx], bx
mov word [rdx + 2], di
mov dword [rdx + 4], eax
mov qword [rdx + 8], rcx
mov qword [rdx + 0x10], r9
mov dword [rdx + 0x18], r10d
mov rcx, r14
call qword [sym.imp.ws2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x14012565d
call sub.KERNEL32.DLL_GetLastError
mov rbx, rax
shl rbx, 0x20
or rbx, 2
mov ecx, eax
call fcn.14023d1d0
cmp al, 0xd
jne 0x14012566a
mov rcx, rbx
call fcn.14007eeac
mov qword [rsi], 0
mov qword [rsi + 8], r14
jmp 0x14012567e
mov qword [rsi], rbx
mov qword [rsi + 8], 0xffffffffffffffff
mov rcx, r14
call qword [sym.imp.ws2_32.dll_closesocket]
nop
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x140126d5f
Capabilities:
Set socket configuration

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, rcx
cmp word [rdx], 0
mov eax, 2
mov edi, 0x17
cmove edi, eax
mov rax, qword [0x14051f0a8]
cmp rax, 3
jne 0x140126e05
mov ecx, edi
mov edx, 1
xor r8d, r8d
call qword [sym.imp.ws2_32.dll_socket]
cmp rax, 0xffffffffffffffff
je 0x140126ddc
mov rdi, rax
lea r8, [rsp + 0x34]
mov dword [r8], 1
mov rcx, rax
mov edx, 0x8004667e
call qword [sym.imp.ws2_32.dll_ioctlsocket]
test eax, eax
je 0x140126df4
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
shl rbx, 0x20
or rbx, 2
mov rcx, rdi
call qword [sym.imp.ws2_32.dll_closesocket]
mov qword [rsi + 8], rbx
jmp 0x140126ded
call sub.KERNEL32.DLL_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
jmp 0x140126dfa
mov qword [rsi + 8], rdi
xor eax, eax
mov qword [rsi], rax
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
lea rax, [rsp + 0x33]
mov byte [rax], 1
lea r8, [rsp + 0x38]
mov qword [r8], rax
lea rax, [0x14044e928]
mov qword [rsp + 0x20], rax
lea rcx, [0x14051f0a8]
lea r9, [0x14044e1d8]
xor edx, edx
call fcn.1403b92c0
jmp 0x140126d87
Function at 0x1401b4e57
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rax, r8
mov rbx, rdx
mov r14, rcx
lea rsi, [rsp + 0x50]
mov r8d, 0xb
mov rcx, rsi
mov rdx, rax
call fcn.1401c49aa
lea r13, [rsp + 0x30]
mov dword [r13], 0x800
lea r12, [rsp + 0x34]
mov dword [r12], 0
mov ecx, 0x800
call fcn.140236205
mov rdi, rdx
lea r15, [rsp + 0x38]
mov qword [r15], rax
mov qword [r15 + 8], rdx
mov qword [r15 + 0x10], 0
mov rsi, qword [rsi + 8]
mov rbp, qword [sym.imp.advapi32.dll_RegQueryValueExW]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rdi
mov rcx, rbx
mov rdx, rsi
xor r8d, r8d
mov r9, r12
call rbp
cmp eax, 0xea
jne 0x1401b4f11
mov r8d, dword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x48]
sub rax, rdx
cmp rax, r8
jae 0x1401b4ecc
mov rcx, r15
call fcn.1403b89f8
mov rdi, qword [rsp + 0x40]
jmp 0x1401b4ecc
test eax, eax
jne 0x1401b4f33
mov eax, dword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x34]
cmp eax, 0xb
jbe 0x1401b4f5f
movabs rax, 0xde00000002
jmp 0x1401b4f3b
shl rax, 0x20
or rax, 2
mov qword [r14], rax
mov byte [r14 + 0x18], 0xc
cmp qword [rsp + 0x38], 0
je 0x1401b4f75
mov rcx, qword [0x14051f200]
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.DLL_HeapFree]
jmp 0x1401b4f75
mov rcx, qword [rsp + 0x48]
mov qword [r14 + 0x10], rcx
movups xmm0, xmmword [rsp + 0x38]
movups xmmword [r14], xmm0
mov byte [r14 + 0x18], al
cmp qword [rsp + 0x50], 0
je 0x1401b4f91
mov r8, qword [rsp + 0x58]
mov rcx, qword [0x14051f200]
xor edx, edx
call qword [sym.imp.KERNEL32.DLL_HeapFree]
nop
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1401f323b
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
movaps xmmword [rsp + 0x80], xmm6
test rcx, rcx
je 0x1401f3273
mov rdx, qword [rcx]
mov rax, qword [rcx + 8]
mov qword [rcx], 0
cmp rdx, 1
je 0x1401f3409
lea rcx, [0x14025f140]
call fcn.1400903c5
movabs r13, 0x736f6d6570736575
xor r13, rax
movabs rsi, 0x646f72616e646f6d
xor rsi, rdx
movabs rbp, 0x6c7967656e657261
mov qword [rsp + 0x28], rax
xor rbp, rax
movabs r12, 0x7465646279746573
mov r15, rdx
xor r12, rdx
mov r14d, 1
xorps xmm6, xmm6
lea rax, [rsp + 0x68]
movups xmmword [rax], xmm6
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], r12
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x30], r14
mov r8d, 8
lea rcx, [rsp + 0x38]
lea rdx, [rsp + 0x30]
call fcn.140078e87
mov rax, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x68]
shl rbx, 0x38
or rbx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x38]
add rdx, rax
rol rax, 0xd
xor rcx, rbx
xor rax, rdx
rol rdx, 0x20
mov rdi, qword [rsp + 0x40]
add rdi, rcx
rol rcx, 0x10
xor rcx, rdi
add rdx, rcx
rol rcx, 0x15
add rdi, rax
rol rax, 0x11
xor rcx, rdx
xor rax, rdi
rol rdi, 0x20
xor rdx, rbx
add rdx, rax
rol rax, 0xd
xor rax, rdx
rol rdx, 0x20
xor rdi, 0xff
add rdi, rcx
rol rcx, 0x10
xor rcx, rdi
add rdx, rcx
rol rcx, 0x15
add rdi, rax
rol rax, 0x11
xor rax, rdi
rol rdi, 0x20
xor rcx, rdx
add rdx, rax
rol rax, 0xd
xor rax, rdx
rol rdx, 0x20
add rdi, rcx
rol rcx, 0x10
xor rcx, rdi
add rdx, rcx
rol rcx, 0x15
add rdi, rax
rol rax, 0x11
xor rax, rdi
rol rdi, 0x20
xor rcx, rdx
add rdx, rax
rol rax, 0xd
add rdi, rcx
rol rcx, 0x10
xor rcx, rdi
rol rcx, 0x15
xor rax, rdx
add rdi, rax
rol rax, 0x11
mov rdx, rdi
rol rdx, 0x20
xor rax, rdi
xor rax, rcx
inc r14
xor rax, rdx
je 0x1401f32c4
mov ecx, dword [0x14051f7b8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov qword [rcx + 0xa0], 1
mov qword [rcx + 0xa8], rax
movaps xmm6, xmmword [rsp + 0x80]
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1401fff43
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x148
movaps xmmword [rsp + 0x130], xmm6
mov rdi, r9
test dil, 0xf
je 0x1401fff74
mov qword [rcx + 8], 0
jmp 0x140200178
mov rsi, r8
mov rbx, rdx
mov qword [rsp + 0x50], rcx
mov rcx, rdi
xor edx, edx
call fcn.14027db1d
mov qword [rsp + 0x48], rax
mov rbp, rdx
mov rcx, rdx
mov rdx, rsi
mov r8, rdi
call fcn.1403abad0
mov r12d, edi
shr r12d, 4
and r12d, 7
mov rsi, rdi
and rsi, 0xffffffffffffff80
mov qword [rsp + 0x28], rbp
add rsi, rbp
lea rbp, [rsp + 0xb0]
mov rcx, rbp
call fcn.14000327f
lea rdx, [rbx + 0x3c0]
mov rcx, rbp
mov qword [rsp + 0x40], rdx
call fcn.1402818b4
mov qword [rsp + 0x58], rdi
cmp rdi, 0x80
jb 0x1402000a0
lea r15, [rsp + 0x70]
mov r13, qword [rsp + 0x28]
mov r8d, 0x70
lea rcx, [rsp + 0xc0]
mov rdx, r13
call fcn.1403abad0
lea rdx, [r13 + 0x70]
mov rcx, r15
call fcn.1402818b4
mov r14d, 8
mov rdx, r13
cmp r14, 4
mov ebp, 4
cmovb rbp, r14
mov rdi, rbp
shl rdi, 4
add rdi, rdx
mov rcx, rbx
mov r8, rbp
call fcn.14002e15d
mov rdx, rdi
sub r14, rbp
jne 0x140200024
lea rbp, [r13 + 0x80]
lea rcx, [rsp + 0xb0]
xor edx, edx
inc rdx
xor edi, edi
mov al, byte [rcx + rdi]
xor byte [r13 + rdi], al
lea rax, [rdi + 1]
mov rdi, rax
cmp rax, 0x10
jne 0x140200064
add rcx, 0x10
add r13, 0x10
cmp rdx, 8
jne 0x14020005f
movups xmm0, xmmword [rsp + 0x70]
movaps xmmword [rsp + 0xb0], xmm0
mov r13, rbp
cmp rbp, rsi
jne 0x1401ffff9
lea rdi, [rsp + 0x70]
lea rdx, [rsp + 0xb0]
mov rcx, rdi
call fcn.1402818b4
movups xmm0, xmmword [rdi]
mov r15, qword [rsp + 0x40]
movups xmmword [r15], xmm0
lea rcx, [rsp + 0x30]
mov rdx, r15
call fcn.1402818b4
test r12, r12
je 0x140200150
shl r12, 4
add r12, rsi
lea r14, [rsp + 0x60]
xorps xmm6, xmm6
lea rdi, [rsp + 0x70]
mov rcx, r14
mov rdx, rsi
call fcn.1402818b4
xor eax, eax
movups xmmword [rsp + rax + 0x70], xmm6
add rax, 0x10
cmp rax, 0x40
jne 0x1402000f4
lea rbp, [rsi + 0x10]
movups xmm0, xmmword [rsi]
movaps xmmword [rsp + 0x70], xmm0
mov r8d, 4
mov rcx, rbx
mov rdx, rdi
call fcn.14002e15d
movaps xmm0, xmmword [rsp + 0x70]
movups xmmword [rsi], xmm0
xor eax, eax
mov cl, byte [rsp + rax + 0x30]
xor byte [rsi + rax], cl
lea rcx, [rax + 1]
mov rax, rcx
cmp rcx, 0x10
jne 0x14020012a
movups xmm0, xmmword [rsp + 0x60]
movaps xmmword [rsp + 0x30], xmm0
mov rsi, rbp
cmp rbp, r12
jne 0x1402000e7
movaps xmm0, xmmword [rsp + 0x30]
movups xmmword [r15], xmm0
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x48]
mov qword [rcx], rax
mov rax, qword [rsp + 0x28]
mov qword [rcx + 8], rax
mov rax, qword [rsp + 0x58]
mov qword [rcx + 0x10], rax
movaps xmm6, xmmword [rsp + 0x130]
add rsp, 0x148
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14021ccfa
Capabilities:
Get token membership

Disassembly:
push rsi
sub rsp, 0x70
xor eax, eax
lea rcx, [rsp + 0x68]
mov dword [rcx], eax
mov word [rcx + 4], 0x500
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x50], rdx
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
mov dl, 2
mov r8d, 0x20
mov r9d, 0x220
call qword [sym.imp.advapi32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x14021cd51
mov byte [rsp + 0x5f], 1
mov al, 1
jmp 0x14021cd8e
call sub.KERNEL32.DLL_GetLastError
lea r8, [rsp + 0x5f]
mov byte [r8], 0
mov rsi, qword [rsp + 0x60]
xor ecx, ecx
mov rdx, rsi
call qword [sym.imp.advapi32.dll_CheckTokenMembership]
test eax, eax
jne 0x14021cd7d
call sub.KERNEL32.DLL_GetLastError
mov byte [rsp + 0x5f], 0
mov rcx, rsi
call qword [sym.imp.advapi32.dll_FreeSid]
cmp byte [rsp + 0x5f], 0
setne al
add rsp, 0x70
pop rsi
ret
Function at 0x140223d93
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aeskeygenassist xmm0, xmmword [rdx], 2
movdqa xmmword [rcx], xmm0
ret

Function at 0x14022e420
Capabilities:
Encode data using xor

Disassembly:
cmp rdx, 0x20
jae 0x14022e42b
jmp fcn.140061a40
jmp fcn.140058900
Function at 0x14022e710
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rsi, rcx
mov rdi, qword [rcx]
test rdi, rdi
je 0x14022e762
mov r11, qword [rsi + 8]
mov r9, qword [rsi + 0x10]
cmp r9, r11
jae 0x14022e762
movzx eax, byte [rdi + r9]
cmp eax, 0x49
je 0x14022e77d
cmp eax, 0x42
jne 0x14022e762
lea rcx, [r9 + 1]
mov qword [rsi + 0x10], rcx
cmp rcx, r11
jae 0x14022e7ba
cmp byte [rdi + rcx], 0x5f
jne 0x14022e7ba
lea rax, [r9 + 2]
mov qword [rsi + 0x10], rax
xor eax, eax
jmp 0x14022e8b2
mov rcx, rsi
xor edx, edx
call fcn.14022a300
mov edi, eax
add dil, dil
mov eax, edi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
inc r9
mov qword [rsi + 0x10], r9
mov rcx, rsi
xor edx, edx
call fcn.14022a300
test al, al
jne 0x14022e7b5
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x14022e82c
lea rdx, [0x1404bc8ba]
mov r8d, 1
call fcn.140059d90
test al, al
je 0x14022e82c
mov dil, 2
jmp 0x14022e771
xor eax, eax
mov r10d, 0x3e
nop word cs:[rax + rax]
mov r8b, 1
cmp rcx, r11
jae 0x14022e90c
movzx edx, byte [rdi + rcx]
cmp dl, 0x5f
je 0x14022e8a6
lea ebx, [rdx - 0x30]
cmp bl, 0xa
jb 0x14022e80f
lea ebx, [rdx - 0x61]
cmp bl, 0x1a
jae 0x14022e7fe
add dl, 0xa9
jmp 0x14022e80d
lea ebx, [rdx - 0x41]
cmp bl, 0x1a
jae 0x14022e90c
add dl, 0xe3
mov ebx, edx
inc rcx
mov qword [rsi + 0x10], rcx
mul r10
jo 0x14022e90c
movzx edx, bl
add rax, rdx
jae 0x14022e7d0
jmp 0x14022e90c
mov rax, qword [rsi]
mov dil, 1
test rax, rax
je 0x14022e771
xor ebx, ebx
lea r14, [0x1404bcc96]
nop word cs:[rax + rax]
mov rcx, qword [rsi + 0x10]
cmp rcx, qword [rsi + 8]
jae 0x14022e864
cmp byte [rax + rcx], 0x45
je 0x14022e964
sub rbx, 1
jb 0x14022e889
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x14022e889
mov r8d, 2
mov rdx, r14
call fcn.140059d90
test al, al
jne 0x14022e7b5
mov rcx, rsi
call fcn.14022e970
test al, al
jne 0x14022e7b5
mov rax, qword [rsi]
test rax, rax
jne 0x14022e850
jmp 0x14022e771
inc rcx
mov qword [rsi + 0x10], rcx
inc rax
je 0x14022e90c
cmp rax, r9
jae 0x14022e909
mov ecx, dword [rsi + 0x18]
inc ecx
cmp ecx, 0x1f4
ja 0x14022e95d
cmp qword [rsi + 0x20], 0
je 0x14022e956
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsi + 0x10], rax
mov dword [rsi + 0x18], ecx
mov rcx, rsi
call fcn.14022e710
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm1
jmp 0x14022e773
mov r8b, 1
xor ebx, ebx
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x14022e94c
lea rax, [0x1404bcc61]
lea rdx, str.recursion_limit_reachedinvalid_syntax
test r8b, r8b
cmovne rdx, rax
xor r8b, 1
movzx eax, r8b
lea r8, [rax + rax*8]
or r8, 0x10
call fcn.140059d90
mov dil, 2
test al, al
jne 0x14022e771
mov qword [rsi], 0
mov byte [rsi + 8], bl
xor edi, edi
jmp 0x14022e771
mov bl, 1
xor r8d, r8d
jmp 0x14022e90e
inc rcx
mov qword [rsi + 0x10], rcx
jmp 0x14022e771