joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000cf60
Capabilities:
Terminate process

Disassembly:
push rbp
sub rsp, 0x100
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x78], 0xfffffffffffffffe
lea rcx, [rbp - 0x48]
call fcn.14000d0a0
jmp 0x14000cf86
mov qword [rbp - 0x50], 0
lea rcx, [rbp - 0x48]
call section..text
test al, 1
jne 0x14000cfa4
jmp 0x14000cfab
xor ecx, ecx
call fcn.140033720
lea rcx, [rbp - 0x48]
call fcn.140001650
test al, 1
jne 0x14000cfc1
jmp 0x14000cfc8
xor ecx, ecx
call fcn.140033720
lea rcx, [rbp - 0x48]
call fcn.140001aa0
test al, 1
jne 0x14000cfde
jmp 0x14000cfe5
xor ecx, ecx
call fcn.140033720
mov rdx, qword [rbp - 0x50]
lea rcx, [rbp - 0x48]
call fcn.140001cf0
test al, 1
jne 0x14000cfff
jmp 0x14000d006
xor ecx, ecx
call fcn.140033720
lea rcx, [rbp - 0x48]
call fcn.140001f40
test al, 1
jne 0x14000d01c
jmp 0x14000d023
xor ecx, ecx
call fcn.140033720
lea rcx, [rbp - 0x48]
call fcn.140002770
mov byte [rbp - 0x51], al
jmp 0x14000d034
mov al, byte [rbp - 0x51]
test al, 1
jne 0x14000d044
jmp 0x14000d04b
xor ecx, ecx
call fcn.140033720
lea rcx, [rbp - 0x48]
call fcn.140002800
test al, 1
jne 0x14000d061
jmp 0x14000d068
xor ecx, ecx
call fcn.140033720
lea rcx, [rbp - 0x48]
call fcn.14000daf0
nop
add rsp, 0x100
pop rbp
ret

Function at 0x14000f4a0
Capabilities:
Accept command line arguments

Disassembly:
push rbp
sub rsp, 0xc0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x38], 0xfffffffffffffffe
mov dword [rbp + 0x34], 0
mov dword [rbp + 0x30], r9d
mov qword [rbp + 0x28], r8
mov qword [rbp + 0x20], rdx
mov qword [rbp + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rbp + 0x10]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rbp + 8], rax
cmp dword [rbp + 0x10], 1
jle 0x14000f569
mov rax, qword [rbp + 8]
mov rdx, qword [rax + 8]
lea rcx, [rbp - 0x20]
call fcn.14000db60
lea rcx, [rbp - 0x49]
mov qword [rbp - 0x58], rcx
call fcn.140002bf0
mov r9, qword [rbp - 0x58]
lea rdx, str.on4VijlfiG0355uE
lea r8, [0x140077660]
lea rcx, [rbp - 0x48]
call fcn.14000f5c0
jmp 0x14000f52e
lea rcx, [rbp - 0x20]
lea rdx, [rbp - 0x48]
call fcn.14000f6d0
test al, 1
jne 0x14000f548
jmp 0x14000f54d
jmp 0x14000f552
call fcn.14000cf60
lea rcx, [rbp - 0x48]
call fcn.140001570
lea rcx, [rbp - 0x20]
call fcn.140001570
jmp 0x14000f56e
call fcn.14000cf60
lea rcx, [rbp + 0x17]
call fcn.140010920
mov eax, dword [rbp + 0x34]
add rsp, 0xc0
pop rbp
ret
Function at 0x140011a10
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rcx
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea rax, str.expand_32_byte_k
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x28]
call fcn.140011bc0
mov ecx, eax
mov rax, qword [rsp + 0x20]
mov dword [rax], ecx
mov rcx, qword [rsp + 0x28]
add rcx, 4
call fcn.140011bc0
mov ecx, eax
mov rax, qword [rsp + 0x20]
mov dword [rax + 4], ecx
mov rcx, qword [rsp + 0x28]
add rcx, 8
call fcn.140011bc0
mov ecx, eax
mov rax, qword [rsp + 0x20]
mov dword [rax + 8], ecx
mov rcx, qword [rsp + 0x28]
add rcx, 0xc
call fcn.140011bc0
mov ecx, eax
mov rax, qword [rsp + 0x20]
mov dword [rax + 0xc], ecx
mov rcx, qword [rsp + 0x38]
call fcn.140011bc0
mov ecx, eax
mov rax, qword [rsp + 0x20]
mov dword [rax + 0x10], ecx
mov rcx, qword [rsp + 0x38]
add rcx, 4
call fcn.140011bc0
mov ecx, eax
mov rax, qword [rsp + 0x20]
mov dword [rax + 0x14], ecx
mov rcx, qword [rsp + 0x38]
add rcx, 8
call fcn.140011bc0
mov ecx, eax
mov rax, qword [rsp + 0x20]
mov dword [rax + 0x18], ecx
mov rcx, qword [rsp + 0x38]
add rcx, 0xc
call fcn.140011bc0
mov ecx, eax
mov rax, qword [rsp + 0x20]
mov dword [rax + 0x1c], ecx
mov rcx, qword [rsp + 0x38]
add rcx, 0x10
call fcn.140011bc0
mov ecx, eax
mov rax, qword [rsp + 0x20]
mov dword [rax + 0x20], ecx
mov rcx, qword [rsp + 0x38]
add rcx, 0x14
call fcn.140011bc0
mov ecx, eax
mov rax, qword [rsp + 0x20]
mov dword [rax + 0x24], ecx
mov rcx, qword [rsp + 0x38]
add rcx, 0x18
call fcn.140011bc0
mov ecx, eax
mov rax, qword [rsp + 0x20]
mov dword [rax + 0x28], ecx
mov rcx, qword [rsp + 0x38]
add rcx, 0x1c
call fcn.140011bc0
mov ecx, eax
mov rax, qword [rsp + 0x20]
mov dword [rax + 0x2c], ecx
mov dword [rax + 0x30], 0
mov dword [rax + 0x34], 0
mov rcx, qword [rsp + 0x40]
call fcn.140011bc0
mov ecx, eax
mov rax, qword [rsp + 0x20]
mov dword [rax + 0x38], ecx
mov rcx, qword [rsp + 0x40]
add rcx, 4
call fcn.140011bc0
mov ecx, eax
mov rax, qword [rsp + 0x20]
mov dword [rax + 0x3c], ecx
add rsp, 0x48
ret
Function at 0x14001c1d0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
cmp qword [rsp + 0x80], 0
jg 0x14001c1f5
xor eax, eax
jmp 0x14001c3b6
mov rax, qword [rsp + 0x70]
cmp qword [rax + 0x68], 0
je 0x14001c21d
mov r8, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
call fcn.14001b480
jmp 0x14001c3b6
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x70]
call fcn.14001b1c0
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jbe 0x14001c2ba
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x20]
call fcn.1400030c0
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x70]
call fcn.14001afc0
mov r8, qword [rsp + 0x28]
mov rdx, rax
mov rcx, qword [rsp + 0x78]
call fcn.140004ff0
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x78]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov edx, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x70]
call fcn.14001b030
nop
mov rax, qword [rsp + 0x70]
cmp qword [rax + 0x80], 0
je 0x14001c3a6
mov rcx, qword [rsp + 0x70]
call fcn.14001cb80
mov qword [rsp + 0x58], 0xfff
cmp qword [rsp + 0x20], 0xfff
jbe 0x14001c35a
mov rax, qword [rsp + 0x70]
mov r9, qword [rax + 0x80]
mov r8d, 0xfff
mov edx, 1
mov rcx, qword [rsp + 0x78]
call fcn.140040040
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x78]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x30], 0xfff
je 0x14001c358
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
jmp 0x14001c3b6
jmp 0x14001c2e0
cmp qword [rsp + 0x20], 0
jbe 0x14001c3a6
mov rax, qword [rsp + 0x70]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x20]
mov edx, 1
mov rcx, qword [rsp + 0x78]
call fcn.140040040
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
add rsp, 0x68
ret

Function at 0x14001e8a0
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x58
mov r9d, 2
lea r8, [rsp + 0x40]
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x14001e8dd
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x40]
mov r8d, dword [rsp + 0x60]
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x48]
mov edx, eax
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax]
call fcn.14001e840
add rsp, 0x58
ret
Function at 0x140020950
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.14001eee0
movzx eax, al
test eax, eax
jne 0x140020970
mov ecx, 7
call fcn.140020540
nop
mov byte [rsp + 0x20], 0
call fcn.14001ee40
mov byte [rsp + 0x21], al
cmp dword [0x140398e00], 1
jne 0x140020994
mov ecx, 7
call fcn.140020540
nop
jmp 0x1400209ec
cmp dword [0x140398e00], 0
jne 0x1400209e7
mov dword [0x140398e00], 1
lea rdx, [0x140390e10]
lea rcx, [0x140390dd0]
call fcn.14003d2c0
test eax, eax
je 0x1400209c8
mov eax, 0xff
jmp 0x140020af1
lea rdx, [0x140390dc8]
lea rcx, [0x140390c18]
call fcn.14003d250
mov dword [0x140398e00], 2
jmp 0x1400209ec
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.14001eeb0
call fcn.140020d80
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140020a49
mov rcx, qword [rsp + 0x30]
call fcn.14001edb0
movzx eax, al
test eax, eax
je 0x140020a49
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x1403a3008]
nop
call fcn.140020d90
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x140020a7d
mov rcx, qword [rsp + 0x38]
call fcn.14001edb0
movzx eax, al
test eax, eax
je 0x140020a7d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.1400337a0
nop
call fcn.140020910
mov dword [rsp + 0x28], eax
call fcn.140020450
movzx eax, al
test eax, eax
jne 0x140020a9c
mov ecx, dword [rsp + 0x28]
call fcn.140033720
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x140020aab
call fcn.140033760
nop
xor edx, edx
mov cl, 1
call fcn.14001ef30
mov eax, dword [rsp + 0x28]
jmp 0x140020af1
add rsp, 0x68
ret
Function at 0x14004ec90
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret

Function at 0x140051250
Capabilities:
Get geographical location

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
call fcn.1400520a0
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x1400512b7
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
movabs r10, 0xe375262d7cd44270
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x40]
call qword [0x1403a3018]
jmp 0x1400512d9
xor edx, edx
mov rcx, qword [rsp + 0x60]
call fcn.1400515e0
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
add rsp, 0x58
ret
Function at 0x1400621d0
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x78
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.1400623a0
lea rcx, [rsp + 0x20]
call fcn.140062470
movzx eax, al
test eax, eax
jne 0x140062215
mov qword [rsp + 0x40], 0
lea rcx, [rsp + 0x20]
call fcn.1400623c0
mov rax, qword [rsp + 0x40]
jmp 0x14006230f
lea rcx, [rsp + 0x20]
call fcn.1400623e0
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x30]
call fcn.140062350
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r9d, 0x40
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, rax
call fcn.1400348e0
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.14001e750
lea rcx, [rsp + 0x28]
call fcn.14001e7f0
movzx eax, al
test eax, eax
jne 0x1400622af
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x28]
call fcn.14001e770
lea rcx, [rsp + 0x20]
call fcn.1400623c0
mov rax, qword [rsp + 0x50]
jmp 0x14006230f
lea rcx, [rsp + 0x20]
call fcn.1400623e0
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x28]
call fcn.14001e700
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r8, rax
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
call fcn.140074930
lea rcx, [rsp + 0x28]
call fcn.140024da0
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x28]
call fcn.14001e770
lea rcx, [rsp + 0x20]
call fcn.1400623c0
mov rax, qword [rsp + 0x68]
add rsp, 0x78
ret
Function at 0x1400653c0
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.1400190c0
sub rsp, rax
mov rax, qword [0x1403974c0]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x14039a000]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x60], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x1400655b2
lea rax, [rsp + 0x147f]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x38], rax
jae 0x140065506
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x140065506
mov rax, qword [rsp + 0x48]
movzx eax, byte [rax]
mov byte [rsp + 0x31], al
mov rax, qword [rsp + 0x48]
inc rax
mov qword [rsp + 0x48], rax
movzx eax, byte [rsp + 0x31]
mov byte [rsp + 0x30], al
movsx eax, byte [rsp + 0x30]
cmp eax, 0xa
jne 0x1400654eb
mov eax, dword [rsp + 0x70]
inc eax
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x38]
mov byte [rax], 0xd
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, byte [rsp + 0x30]
mov byte [rax], cl
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
jmp 0x140065488
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8d, dword [rsp + 0x40]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140065572
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x68], eax
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x1400655d1
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x6c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x40]
cmp dword [rsp + 0x44], eax
jae 0x1400655ad
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x1400655d1
jmp 0x14006545e
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.140019120
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x1400655f0
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.1400190c0
sub rsp, rax
mov rax, qword [0x1403974c0]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x14039a000]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x1400657fd
lea rax, [rsp + 0x147e]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
cmp qword [rsp + 0x38], rax
jae 0x140065749
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x140065749
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
mov word [rsp + 0x40], ax
mov rax, qword [rsp + 0x50]
add rax, 2
mov qword [rsp + 0x50], rax
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x30], ax
movzx eax, word [rsp + 0x30]
cmp eax, 0xa
jne 0x140065729
mov eax, dword [rsp + 0x78]
add eax, 2
mov dword [rsp + 0x78], eax
mov eax, 0xd
mov rcx, qword [rsp + 0x38]
mov word [rcx], ax
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, word [rsp + 0x30]
mov word [rax], cx
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
jmp 0x1400656b8
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov eax, eax
shl rax, 1
mov dword [rsp + 0x44], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x44]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400657bd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x70], eax
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x14006581c
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x74]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x74], eax
mov eax, dword [rsp + 0x44]
cmp dword [rsp + 0x48], eax
jae 0x1400657f8
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x14006581c
jmp 0x14006568e
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.140019120
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x14006b720
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.14006bca0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x14006b75f
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1403a3008]
jmp 0x14006b769
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret
Function at 0x1400416f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, qword [rdx + 0x20]
mov r11, qword [rdx + 0x28]
lea r10, [r11 + 1]
mov qword [rdx + 0x28], r10
mov al, 1
cmp r10, rsi
jae 0x140041730
mov rax, qword [rdx + 0x18]
movzx edi, byte [rax + r10]
mov al, 1
cmp edi, 0x2b
je 0x140041725
cmp edi, 0x2d
jne 0x140041730
xor eax, eax
add r11, 2
mov qword [rdx + 0x28], r11
mov r10, r11
cmp r10, rsi
jae 0x1400418cf
mov rdi, qword [rdx + 0x18]
movzx r11d, byte [rdi + r10]
lea rbx, [r10 + 1]
mov qword [rdx + 0x28], rbx
add r11b, 0xd0
cmp r11b, 0xa
jae 0x1400418da
movzx r11d, r11b
cmp rbx, rsi
jae 0x1400417cd
mov ebx, 1
sub rbx, rsi
add r10, 2
jmp 0x14004178c
movzx esi, sil
lea r11d, [r11 + r11*4]
lea r11d, [rsi + r11*2]
lea rsi, [rbx + r10]
inc rsi
inc r10
cmp rsi, 2
je 0x1400417cd
movzx esi, byte [rdi + r10 - 1]
add sil, 0xd0
cmp sil, 0xa
jae 0x1400417cd
mov qword [rdx + 0x28], r10
cmp r11d, 0xccccccb
jle 0x140041770
cmp r11d, 0xccccccc
jne 0x1400417b8
cmp sil, 7
jbe 0x140041770
test r9, r9
sete r9b
mov byte [rsp + 0x20], al
call fcn.1402d9230
jmp 0x1400418bc
mov r10d, dword [rsp + 0x80]
test al, al
je 0x1400417ea
lea eax, [r10 + r11]
sar eax, 0x1f
add eax, 0x80000000
add r10d, r11d
jmp 0x1400417fa
xor eax, eax
cmp r10d, r11d
setns al
add eax, 0x7fffffff
sub r10d, r11d
cmovo r10d, eax
movq xmm1, r9
punpckldq xmm1, xmmword [0x1402ebef0]
subpd xmm1, xmmword [0x1402ebf00]
movapd xmm0, xmm1
unpckhpd xmm0, xmm1
addsd xmm0, xmm1
mov eax, r10d
neg eax
cmovs eax, r10d
cmp eax, 0x135
jb 0x14004186c
xorpd xmm1, xmm1
movsd xmm2, qword [0x1402ebf10]
nop dword [rax + rax]
ucomisd xmm0, xmm1
jne 0x140041848
jnp 0x1400418a5
test r10d, r10d
jns 0x140041903
divsd xmm0, xmm2
add r10d, 0x134
mov eax, r10d
neg eax
cmovs eax, r10d
cmp eax, 0x135
jae 0x140041840
mov eax, eax
mov r9, qword [0x14046a0e0]
movsd xmm1, qword [r9 + rax*8]
test r10d, r10d
js 0x1400418c4
mulsd xmm0, xmm1
movq rax, xmm0
movabs r9, 0x7fffffffffffffff
and r9, rax
movabs rax, 0x7ff0000000000000
cmp r9, rax
je 0x140041903
test r8b, r8b
jne 0x1400418b2
xorpd xmm0, xmmword [0x1402ebf20]
movsd qword [rcx + 8], xmm0
xor eax, eax
mov qword [rcx], rax
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
divsd xmm0, xmm1
test r8b, r8b
je 0x1400418aa
jmp 0x1400418b2
mov qword [rsp + 0x28], 5
jmp 0x1400418e3
mov qword [rsp + 0x28], 0xd
lea rax, [rsp + 0x28]
mov rsi, rcx
mov rcx, rdx
mov rdx, rax
call fcn.1402d92d0
mov qword [rsi + 8], rax
mov qword [rsi], 1
jmp 0x1400418bc
mov qword [rsp + 0x28], 0xe
lea rax, [rsp + 0x28]
mov rsi, rcx
mov rcx, rdx
mov rdx, rax
call fcn.1402d92d0
mov rcx, rsi
mov qword [rsi + 8], rax
mov eax, 1
jmp 0x1400418b9
Function at 0x140052450
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0xc0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x38], 0xfffffffffffffffe
mov rsi, rdx
mov rdi, rcx
add rcx, 0x48
xorps xmm0, xmm0
movaps xmmword [rbp + 0x10], xmm0
movaps xmmword [rbp], xmm0
mov rdx, rbp
mov r8d, 0x20
call fcn.140114b50
mov qword [rbp + 0x28], rax
test rax, rax
je 0x1400524c4
mov qword [rbp + 0x30], rdx
mov rax, qword [rdx]
test rax, rax
je 0x1400524a8
mov rcx, qword [rbp + 0x28]
call rax
mov rax, qword [rbp + 0x30]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x14005250d
mov r8, qword [rax + 0x10]
mov rcx, qword [rbp + 0x28]
call fcn.1400b33e0
jmp 0x14005250d
movaps xmm0, xmmword [rbp]
movaps xmm1, xmmword [rbp + 0x10]
movaps xmmword [rbp - 0x10], xmm1
movaps xmmword [rbp - 0x20], xmm0
lea rcx, [rbp - 0x50]
lea r8, [0x1402f4380]
lea rdx, [rbp - 0x20]
mov r9d, 8
call fcn.140114930
mov rax, qword [rdi + 0x30]
mov qword [rdi + 0x38], rax
movaps xmm0, xmmword [rbp - 0x50]
movaps xmm1, xmmword [rbp - 0x40]
movaps xmm2, xmmword [rbp - 0x30]
movaps xmmword [rdi], xmm0
movaps xmmword [rdi + 0x10], xmm1
movaps xmmword [rdi + 0x20], xmm2
mov qword [rdi + 0x40], 0
mov rax, 0xffffffffffffff00
add rax, qword [rdi + 0x30]
mov qword [rdi + 0x38], rax
mov rcx, rdi
mov edx, 6
mov r8, rsi
add rsp, 0xc0
pop rdi
pop rsi
pop rbp
jmp fcn.140112420