joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140316350
Capabilities:
Authenticate hmac

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov eax, dword [rcx + 0x18]
add eax, eax
mov rdi, rdx
mov edx, dword [rcx + 0x20]
mov rbx, rcx
mov ebp, r8d
lea rcx, [rax + rdx + 0x18]
mov rax, qword [0x140626c80]
call qword [rax]
mov rsi, rax
test rax, rax
je 0x140316458
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsi + 0x10], rax
cmp dword [rbx + 0x1c], ebp
jae 0x1403163c6
call qword [rbx]
mov r8d, ebp
mov rdx, rdi
mov rcx, qword [rsi + 8]
call qword [rbx + 8]
mov edi, dword [rbx + 0x18]
add rdi, qword [rsi + 0x10]
mov rdx, qword [rsi + 8]
mov rcx, rdi
call qword [rbx + 0x10]
mov ebp, dword [rbx + 0x20]
mov rcx, qword [rsi + 8]
xor r12d, r12d
lea r14, [rsp + 0x2f]
call qword [rbx]
mov rcx, qword [rsi + 0x10]
call qword [rbx]
mov r13d, ebp
cmp r12, r13
jae 0x14031641d
mov al, byte [rdi + r12]
mov rcx, qword [rsi + 8]
mov r8d, 1
mov rdx, r14
xor eax, 0x36
mov byte [rsp + 0x2f], al
call qword [rbx + 8]
mov al, byte [rdi + r12]
mov rcx, qword [rsi + 0x10]
mov rdx, r14
mov r8d, 1
inc r12
xor eax, 0x5c
mov byte [rsp + 0x2f], al
call qword [rbx + 8]
jmp 0x1403163da
lea rdi, [0x140659c80]
lea rbp, [0x140659c90]
mov eax, dword [rbx + 0x1c]
cmp r13, rax
jae 0x140316458
mov rcx, qword [rsi + 8]
mov r8d, 1
mov rdx, rdi
inc r13
call qword [rbx + 8]
mov rcx, qword [rsi + 0x10]
mov r8d, 1
mov rdx, rbp
call qword [rbx + 8]
jmp 0x14031642b
mov rax, rsi
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret

Function at 0x140321bd0
Capabilities:
Write file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rbx, rcx
mov esi, edx
mov rbp, r8
mov r12, r9
test byte [rcx + 0xa36], 0x10
je 0x140321c91
cmp qword [rcx + 0x260], 0
je 0x140321c43
call fcn.14032cd80
mov rcx, rbx
mov edx, 1
mov edi, eax
call fcn.1403338e0
mov edx, esi
mov rcx, rbx
mov r9, r12
mov rax, qword [rbx + 0x1d8]
mov r8, rbp
mov qword [rsp + 0x20], rax
call qword [rbx + 0x260]
movzx edx, dil
mov rcx, rbx
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.1403338e0
cmp edx, 2
ja 0x140321c91
mov ecx, edx
mov r9, qword [rbx + 0x1d0]
mov edx, 2
lea rax, [0x1406667c0]
lea rcx, [rcx + rcx*2]
mov r8d, 1
add rcx, rax
call sub.msvcrt.dll_fwrite
mov r9, qword [rbx + 0x1d0]
mov rdx, r12
mov rcx, rbp
mov r8d, 1
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sub.msvcrt.dll_fwrite
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x140325130
Capabilities:
Resolve dns

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rax, r9
mov qword [rsp + 0x98], r9
xor r9d, r9d
mov qword [rax], r9
lea r9, [rsp + 0x28]
call qword [sym.imp.ws2_32.dll_getaddrinfo]
mov r14d, eax
test eax, eax
jne 0x14032528a
mov rbx, qword [rsp + 0x28]
xor r13d, r13d
xor r12d, r12d
test rbx, rbx
je 0x140325241
mov rcx, qword [rbx + 0x18]
xor ebp, ebp
test rcx, rcx
je 0x14032518f
call sub.msvcrt.dll_strlen
lea rbp, [rax + 1]
mov eax, dword [rbx + 4]
cmp eax, 2
je 0x1403251a7
mov r15d, 0x1c
cmp eax, 0x17
je 0x1403251ad
jmp 0x140325232
mov r15d, 0x10
cmp qword [rbx + 0x20], 0
je 0x140325232
mov rax, qword [rbx + 0x10]
cmp rax, r15
jb 0x140325232
test rax, rax
je 0x140325232
mov rax, qword [0x140626c80]
lea rcx, [r15 + rbp + 0x30]
call qword [rax]
test rax, rax
je 0x14032523b
mov edx, dword [rbx]
mov rsi, qword [rbx + 0x20]
mov rcx, r15
mov dword [rax], edx
mov edx, dword [rbx + 4]
mov dword [rax + 4], edx
mov edx, dword [rbx + 8]
mov dword [rax + 8], edx
mov edx, dword [rbx + 0xc]
mov dword [rax + 0x10], r15d
mov dword [rax + 0xc], edx
xor edx, edx
mov qword [rax + 0x18], rdx
mov qword [rax + 0x28], rdx
lea rdx, [rax + 0x30]
mov qword [rax + 0x20], rdx
mov rdi, rdx
rep movsb byte [rdi], byte [rsi]
test rbp, rbp
je 0x14032521f
mov qword [rax + 0x18], rdi
mov rsi, qword [rbx + 0x18]
mov rcx, rbp
rep movsb byte [rdi], byte [rsi]
test r12, r12
cmove r12, rax
test r13, r13
je 0x14032522f
mov qword [r13 + 0x28], rax
mov r13, rax
mov rbx, qword [rbx + 0x28]
jmp 0x140325172
mov r14d, 8
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x140325251
call qword [sym.imp.ws2_32.dll_freeaddrinfo]
test r14d, r14d
je 0x140325269
mov rcx, r12
mov r14d, 8
xor r12d, r12d
call fcn.140324f50
jmp 0x14032527f
test r12, r12
jne 0x14032527f
mov ecx, 0x2af9
mov r14d, 0x2af9
call qword [sym.imp.ws2_32.dll_WSASetLastError]
mov rax, qword [rsp + 0x98]
mov qword [rax], r12
mov eax, r14d
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14032cf10
Capabilities:
Get common file path

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbp, rcx
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rsi, rax
test rax, rax
jne 0x14032cf3b
xor ebx, ebx
jmp 0x14032d05d
lea rdx, str.LoadLibraryExA
mov rcx, rax
mov r12, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call r12
lea rdx, [0x14060fab8]
mov rcx, rbp
mov rdi, rax
call sub.msvcrt.dll_strpbrk
mov rbx, rax
test rax, rax
je 0x14032cf8a
mov r8d, 8
test rdi, rdi
jne 0x14032cfa7
mov rcx, rbp
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rdi, rdi
je 0x14032cfbe
lea rdx, str.AddDllDirectory
mov rcx, rsi
call r12
test rax, rax
je 0x14032cfbe
mov r8d, 0x800
xor edx, edx
mov rcx, rbp
mov rax, rdi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp rax
mov r13, qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
xor edx, edx
xor ecx, ecx
call r13
mov r12d, eax
test eax, eax
je 0x14032cf34
mov rcx, rbp
call sub.msvcrt.dll_strlen
lea ecx, [r12 + 1]
add rcx, rax
mov rax, qword [0x140626c80]
call qword [rax]
mov rsi, rax
test rax, rax
je 0x14032d051
mov edx, r12d
mov rcx, rax
call r13
test eax, eax
je 0x14032d051
mov rcx, rsi
call sub.msvcrt.dll_strlen
lea rdx, [0x14060facb]
lea rcx, [rsi + rax]
call sub.msvcrt.dll_strcpy
mov rcx, rsi
call sub.msvcrt.dll_strlen
mov rdx, rbp
lea rcx, [rsi + rax]
call sub.msvcrt.dll_strcpy
test rdi, rdi
je 0x14032d045
mov r8d, 8
xor edx, edx
mov rcx, rsi
call rdi
jmp 0x14032d04e
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
mov rax, qword [str.0ZJ_]
mov rcx, rsi
call qword [rax]
mov rax, rbx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
Function at 0x140332a70
Capabilities:
Move file

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movups xmmword [rsp + 0x40], xmm6
lea rdi, [rsp + 0x30]
mov rbx, rcx
lea r12, [rsp + 0x20]
mov rsi, rdx
mov rcx, rdi
call fcn.14032e250
mov rcx, rbx
movups xmm6, xmmword [rsp + 0x30]
call sub.msvcrt.dll__strdup
mov rcx, rsi
mov rbx, rax
call sub.msvcrt.dll__strdup
mov rbp, qword [sym.imp.KERNEL32.dll_MoveFileExA]
mov rsi, rax
mov r8d, 1
mov rdx, rsi
mov rcx, rbx
call rbp
test eax, eax
je 0x140332ae9
test rbx, rbx
je 0x140332ad8
mov rcx, rbx
call sub.msvcrt.dll_free
test rsi, rsi
je 0x140332ae5
mov rcx, rsi
call sub.msvcrt.dll_free
xor eax, eax
jmp 0x140332b37
mov rcx, rdi
call fcn.14032e250
mov rdx, r12
mov rcx, rdi
movups xmmword [rsp + 0x20], xmm6
call fcn.140336010
cmp rax, 0x3e8
jbe 0x140332b25
test rbx, rbx
je 0x140332b16
mov rcx, rbx
call sub.msvcrt.dll_free
test rsi, rsi
je 0x140332b32
mov rcx, rsi
call sub.msvcrt.dll_free
jmp 0x140332b32
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140332ab9
mov eax, 1
movups xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x140333ea0
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x40
xor eax, eax
mov dword [rsp + 0x38], eax
mov eax, dword [0x1404a8e40]
mov rbx, rcx
mov dword [rsp + 0x34], 0x4020
mov dword [rsp + 0x3c], 4
test eax, eax
jne 0x140333f01
xor r8d, r8d
xor edx, edx
mov r9d, 2
mov ecx, 6
mov dword [rsp + 0x20], 3
call fcn.1403d2e80
test al, al
je 0x140333ef5
mov dword [0x1404a8e40], 2
jmp 0x140333f59
mov dword [0x1404a8e40], 1
jmp 0x140333f06
cmp eax, 2
je 0x140333f59
lea rax, [rsp + 0x3c]
lea r9, [rsp + 0x38]
mov edx, 0xffff
mov rcx, rbx
mov qword [rsp + 0x20], rax
mov r8d, 0x1001
call qword [sym.imp.ws2_32.dll_getsockopt]
test eax, eax
jne 0x140333f37
mov eax, dword [rsp + 0x34]
cmp dword [rsp + 0x38], eax
jg 0x140333f59
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov edx, 0xffff
mov rcx, rbx
mov r8d, 0x1001
call qword [sym.imp.ws2_32.dll_setsockopt]
nop
add rsp, 0x40
pop rbx
ret
Function at 0x140335f80
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
xor eax, eax
mov r9, rdx
xor edx, edx
mov r8, rcx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edx
xor ecx, ecx
xor edx, edx
call qword [sym.imp.msvcrt.dll__beginthreadex]
lea rdx, [rax - 1]
cmp rdx, 0xfffffffffffffffe
mov edx, 0
cmovae rax, rdx
add rsp, 0x38
ret
Function at 0x1403393f0
Capabilities:
Initialize winsock library

Disassembly:
push rbx
sub rsp, 0x1d0
and cl, 2
je 0x140339430
lea rdx, [rsp + 0x38]
mov ecx, 0x202
call qword [sym.imp.ws2_32.dll_WSAStartup]
test eax, eax
jne 0x140339429
mov eax, dword [rsp + 0x38]
cmp al, 2
jne 0x140339423
shr ax, 8
cmp ax, 2
je 0x140339430
call qword [sym.imp.ws2_32.dll_WSACleanup]
mov ebx, 2
jmp 0x14033949f
call fcn.1403354e0
mov ebx, eax
test eax, eax
jne 0x14033949f
lea rcx, str.iphlpapi.dll
call fcn.14032cf10
mov qword [0x1404a9540], rax
mov rcx, rax
test rax, rax
je 0x14033946f
lea rdx, str.if_nametoindex
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14033946f
mov qword [0x1404a6200], rax
mov ecx, 6
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 3
call fcn.1403d2e80
lea rcx, [0x1404a61f0]
mov byte [0x1404a6210], al
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov eax, ebx
add rsp, 0x1d0
pop rbx
ret

Function at 0x1403394b0
Capabilities:
Generate random numbers via winapi

Disassembly:
push rdi
sub rsp, 0x20
xor eax, eax
mov r9d, 2
mov r10, rcx
mov rdi, rcx
mov rcx, rdx
mov r8, rdx
rep stosb byte [rdi], al
mov rdx, r10
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
setne al
movzx eax, al
add eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x14033a040
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x18
mov r11d, 1
mov eax, r8d
mov r10, rcx
mov r15, rdx
mov ecx, r9d
inc rax
shl r11, cl
mov edx, eax
add rdx, rdx
lea rdx, [rdx + r11 + 8]
cmp qword [rsp + 0x88], rdx
mov rdx, 0xffffffffffffffd2
setb dil
cmp r8d, 0xff
seta cl
or dil, cl
jne 0x14033a271
mov rdx, 0xffffffffffffffd4
cmp r9d, 0xc
ja 0x14033a271
mov edx, 1
lea esi, [r8 + 1]
lea rbx, [r10 + 4]
mov ecx, r9d
mov r8d, edx
mov dword [rsp + 8], esi
mov esi, 1
shl r8d, cl
movzx ecx, r9w
or ecx, 0x10000
lea ebp, [r8 - 1]
mov r14d, ecx
mov r12d, ecx
lea ecx, [r9 - 1]
shl edx, cl
xor ecx, ecx
mov dword [rsp + 0xc], edx
mov edx, ebp
mov r11w, word [r15 + rcx*2]
cmp r11w, 0xffff
jne 0x14033a108
mov r11d, edx
dec edx
mov byte [rbx + r11*4 + 2], cl
mov r11d, 1
jmp 0x14033a116
xor edi, edi
cmp r11w, word [rsp + 0xc]
cmovge esi, edi
mov dil, 1
mov r13, qword [rsp + 0x80]
mov word [r13 + rcx*2], r11w
mov r11d, dword [rsp + 8]
inc rcx
cmp ecx, r11d
jb 0x14033a0ea
test dil, dil
je 0x14033a143
shl esi, 0x10
movzx r14d, r14w
or r14d, esi
mov r12d, r14d
mov r11d, r8d
mov ecx, r8d
mov dword [r10], r12d
shr r11d, 1
shr ecx, 3
lea ecx, [r11 + rcx + 3]
cmp edx, ebp
jne 0x14033a1f6
add rax, rax
xor r11d, r11d
xor ebp, ebp
add rax, qword [rsp + 0x80]
movabs r14, 0x101010101010101
mov r13, r11
lea r12, [rax + rbp]
movsx rdi, word [r15 + r11*2]
imul r13, r14
mov dword [rsp + 0xc], edi
mov rsi, rdi
mov edi, 8
mov qword [r12], r13
cmp dword [rsp + 0xc], edi
jle 0x14033a1a9
mov qword [r12 + rdi], r13
add rdi, 8
jmp 0x14033a199
mov edi, dword [rsp + 8]
inc r11
add rbp, rsi
cmp r11d, edi
jb 0x14033a179
movsxd rdi, r8d
xor esi, esi
xor r11d, r11d
mov r12b, byte [rax + rsi]
mov rbp, rdx
and rbp, r11
add r11, rcx
mov byte [rbx + rbp*4 + 2], r12b
mov rbp, rdx
mov r12b, byte [rax + rsi + 1]
add rsi, 2
and rbp, r11
add r11, rcx
mov byte [rbx + rbp*4 + 2], r12b
and r11, rdx
cmp rsi, rdi
jb 0x14033a1c0
xor r11d, r11d
jmp 0x14033a230
xor r11d, r11d
xor eax, eax
movsx edi, word [r15 + r11*2]
xor esi, esi
cmp edi, esi
jle 0x14033a21a
mov r12d, eax
mov byte [rbx + r12*4 + 2], r11b
add eax, ecx
and eax, ebp
cmp edx, eax
jb 0x14033a20e
inc esi
jmp 0x14033a202
mov edi, dword [rsp + 8]
inc r11
cmp r11d, edi
jb 0x14033a1fb
or rdx, 0xffffffffffffffff
test eax, eax
je 0x14033a1f1
jmp 0x14033a271
cmp r11d, r8d
jae 0x14033a26f
movzx edx, byte [r10 + r11*4 + 6]
add rdx, rdx
add rdx, qword [rsp + 0x80]
movzx eax, word [rdx]
lea ecx, [rax + 1]
mov word [rdx], cx
bsr ecx, eax
xor ecx, 0x1f
lea ecx, [r9 + rcx - 0x1f]
shl eax, cl
mov byte [r10 + r11*4 + 7], cl
sub eax, r8d
mov word [r10 + r11*4 + 4], ax
inc r11
jmp 0x14033a230
xor edx, edx
mov rax, rdx
add rsp, 0x18
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1403bb2e0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov r8, qword [rdx + rax*8]
xor qword [rcx + rax*8], r8
inc rax
cmp rax, 8
jne 0x1403bb202
ret
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
mov ebp, 1
mov qword [rsp + 0x20], rcx
mov rdi, rdx
mov rdx, rcx
mov rcx, r8
mov rbx, r8
call 0x1403bb200
mov rcx, rbx
cmp rbp, rdi
jae 0x1403bb4be
call fcn.1403bb760
mov rcx, rbx
call fcn.1403bb680
mov r10, qword [rbx]
mov r14, qword [rbx + 8]
mov r9, qword [rbx + 0x10]
mov r8, qword [rbx + 0x18]
mov rcx, r10
mov r13, qword [rbx + 0x20]
mov r12, qword [rbx + 0x28]
call fcn.1403bb620
mov rcx, r14
mov r11, qword [rbx + 0x30]
mov rsi, qword [rbx + 0x38]
xor r10, rax
mov r15, rax
mov qword [rsp + 0x28], r10
call fcn.1403bb620
mov rcx, r9
xor r14, rax
mov r10, rax
mov qword [rsp + 0x30], r14
call fcn.1403bb620
mov rcx, r8
xor r9, rax
mov r14, rax
mov qword [rsp + 0x38], r9
call fcn.1403bb620
mov rcx, r13
xor r8, rax
mov r9, rax
mov qword [rsp + 0x40], r8
call fcn.1403bb620
mov rcx, r12
xor r13, rax
mov r8, rax
mov qword [rsp + 0x48], r13
call fcn.1403bb620
mov rcx, r11
xor r12, rax
mov r13, rax
mov qword [rsp + 0x50], r12
call fcn.1403bb620
mov rcx, rsi
xor r11, rax
mov r12, rax
mov qword [rsp + 0x58], r11
call fcn.1403bb620
mov rcx, qword [rsp + 0x28]
xor rsi, rax
mov r11, rax
call fcn.1403bb650
mov rcx, qword [rsp + 0x30]
xor r15, rax
xor r15, rsi
mov qword [rbx], r15
call fcn.1403bb650
mov rcx, qword [rsp + 0x38]
xor r10, rax
mov rax, qword [rsp + 0x28]
xor r10, rax
xor r10, rsi
mov qword [rbx + 8], r10
call fcn.1403bb650
mov rcx, qword [rsp + 0x40]
xor r14, rax
mov rax, qword [rsp + 0x30]
xor r14, rax
mov qword [rbx + 0x10], r14
call fcn.1403bb650
mov rcx, qword [rsp + 0x48]
xor r9, rax
mov rax, qword [rsp + 0x38]
xor r9, rax
xor r9, rsi
mov qword [rbx + 0x18], r9
call fcn.1403bb650
mov rcx, qword [rsp + 0x50]
xor r8, rax
mov rax, qword [rsp + 0x40]
xor r8, rax
xor r8, rsi
mov qword [rbx + 0x20], r8
call fcn.1403bb650
mov rcx, qword [rsp + 0x58]
xor r13, rax
mov rax, qword [rsp + 0x48]
xor r13, rax
mov qword [rbx + 0x28], r13
call fcn.1403bb650
mov rcx, rsi
xor r12, rax
mov rax, qword [rsp + 0x50]
xor r12, rax
mov qword [rbx + 0x30], r12
call fcn.1403bb650
mov rdx, rbp
mov rcx, rbx
inc rbp
xor r11, rax
mov rax, qword [rsp + 0x58]
shl rdx, 6
xor r11, rax
mov rax, qword [rsp + 0x20]
mov qword [rbx + 0x38], r11
add rdx, rax
call 0x1403bb200
jmp 0x1403bb30b
call fcn.1403bb760
mov rcx, rbx
shl rdi, 6
call fcn.1403bb680
mov rdx, qword [rsp + 0x20]
mov rcx, rbx
add rdx, rdi
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp 0x1403bb200
Function at 0x1403c1580
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r13
push r12
push rbp
push rsi
push rbx
sub rsp, 0x30
mov r13, qword [rsp + 0x80]
mov rbp, rdx
mov rsi, rcx
mov rdx, r8
mov r8d, r9d
test rbp, rbp
je 0x1403c161f
mov r12, qword [rcx + 0x80]
mov qword [rsp + 0x28], rdx
mov rcx, r12
call fcn.140475e20
mov rbx, rax
mov eax, 7
test rbx, rbx
je 0x1403c1632
mov rdx, qword [rsp + 0x28]
mov r9, rbx
mov r8, rbp
mov rcx, r12
call fcn.14047ef80
mov eax, dword [rbx + 0x1c]
test ax, ax
je 0x1403c15e8
cmp word [r12 + 8], ax
jae 0x1403c15f4
mov ecx, 0x10e85
call fcn.140449f10
jmp 0x1403c1602
mov r8, r13
mov rdx, rbx
mov rcx, rsi
call fcn.1404459d0
mov rdx, qword [rsi + 0x80]
mov dword [rsp + 0x28], eax
mov rcx, qword [rdx + 0x10]
mov rdx, rbx
call fcn.14044b540
mov eax, dword [rsp + 0x28]
jmp 0x1403c1632
mov r9, r13
add rsp, 0x30
pop rbx
pop rsi
pop rbp
pop r12
pop r13
jmp fcn.140447cd0
add rsp, 0x30
pop rbx
pop rsi
pop rbp
pop r12
pop r13
ret
Function at 0x1403cd120
Capabilities:
Hash data using djb2

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, rcx
test rcx, rcx
jne 0x1403cd136
xor edx, edx
jmp 0x1403cd1b8
call fcn.140326960
test al, al
jne 0x1403cd12f
mov rcx, rsi
call sub.msvcrt.dll_strlen
mov edx, 0x2e
mov rcx, rsi
mov r8, rax
mov rdi, rax
call fcn.14032d510
mov r8, rax
test rax, rax
jne 0x1403cd167
mov rbx, rsi
jmp 0x1403cd189
sub r8, rsi
mov edx, 0x2e
mov rcx, rsi
call fcn.14032d510
test rax, rax
je 0x1403cd162
lea rbx, [rax + 1]
mov rax, rbx
sub rax, rsi
sub rdi, rax
add rdi, rbx
mov eax, 0x1505
cmp rbx, rdi
jae 0x1403cd1ae
movsx ecx, byte [rbx]
imul rsi, rax, 0x21
inc rbx
call fcn.1403319b0
movsx rax, al
xor rax, rsi
jmp 0x1403cd191
mov ecx, 0x3f
xor edx, edx
div rcx
mov rax, rdx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x1403cd2b0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov r10, qword [rcx + rax*8]
mov r9, qword [rdx + rax*8]
xor r9, r10
and r9, r8
xor r9, r10
mov qword [rcx + rax*8], r9
inc rax
cmp rax, 6
jne 0x1403cd2b2
ret
Function at 0x1403cf970
Capabilities:
Query environment variable

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov esi, 1
xor ebx, ebx
mov rdi, rcx
mov rax, qword [0x140626cb0]
mov rcx, rbx
mov edx, esi
mov rbp, rbx
call qword [rax]
mov rbx, rax
test rax, rax
jne 0x1403cf9a0
mov rcx, rbp
jmp 0x1403cf9c1
mov rdx, rax
mov r8d, esi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea edx, [rax - 1]
cmp edx, 0x7fff
ja 0x1403cf9be
cmp esi, eax
jne 0x1403cf9ce
mov rcx, rbx
mov rax, qword [str.0ZJ_]
xor ebx, ebx
call qword [rax]
jmp 0x1403cf9d6
cmp eax, esi
jb 0x1403cf9d6
mov esi, eax
jmp 0x1403cf982
mov rax, rbx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x1403d2c70
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
xor eax, eax
test edx, edx
lea r8, [rsp + 0x2c]
mov edx, 0x8004667e
setne al
mov dword [rsp + 0x2c], eax
call qword [sym.imp.ws2_32.dll_ioctlsocket]
add rsp, 0x38
ret

Function at 0x1403d2ca0
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
call sub.msvcrt.dll__read
cdqe
add rsp, 0x28
ret

Function at 0x1403da380
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
neg r8
mov r10, qword [rcx + rax]
mov r9, qword [rdx + rax]
xor r9, r10
and r9, r8
xor r9, r10
mov qword [rcx + rax], r9
add rax, 8
cmp rax, 0x28
jne 0x1403da385
ret

Function at 0x1403da3b0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
neg r8
mov r10, qword [rcx + rax]
mov r9, qword [rdx + rax]
xor r9, r10
and r9, r8
xor r10, r9
mov qword [rcx + rax], r10
xor qword [rdx + rax], r9
add rax, 8
cmp rax, 0x28
jne 0x1403da3b5
ret
Function at 0x1403f7890
Capabilities:
Reference sql statements

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x98
xor edi, edi
movsxd r12, edx
mov rbp, rcx
mov r14, r8
mov r13, r9
cmp qword [rcx + r12*8 + 0x28], 0
mov r15, r12
jne 0x1403f7a78
lea rdi, [rsp + 0x38]
lea rsi, str.SELECT__s_FROM__s_T_WHERE_T._Q_____AND_T._Q_____ORDER_BY_T._Q_ASC
mov ecx, 0x16
rep movsd dword [rdi], dword [rsi]
mov rsi, qword [rbp]
cmp r12d, 4
jg 0x1403f7914
cmp r12d, 2
jg 0x1403f797a
je 0x1403f794e
test r12d, r12d
js 0x1403f79eb
mov r9, qword [rsi + 0x50]
mov r8, qword [rsi + 0x48]
mov rdx, qword [rsi + 0x60]
mov rcx, qword [rsp + r12*8 + 0x38]
mov qword [rsp + 0x28], r9
mov qword [rsp + 0x20], r9
call fcn.14048a630
jmp 0x1403f7966
cmp r12d, 0xa
jne 0x1403f79eb
mov rdx, qword [rsi + 0x60]
mov r8, qword [rsi + 0x48]
lea rcx, str.SELECT__s_FROM__s_AS_T
call fcn.14048a630
mov r9d, 5
mov rbx, rax
test rax, rax
jne 0x1403f7a1c
mov edi, 7
jmp 0x1403f7a78
mov rdx, qword [rsi + 0x60]
mov r9, qword [rsi + 0x50]
lea rcx, str.SELECT__s_FROM__s_T_WHERE_T._Q_
mov r8, qword [rsi + 0x48]
call fcn.14048a630
mov rbx, rax
mov r9d, 1
test rax, rax
jne 0x1403f7a1c
jmp 0x1403f7944
mov edi, dword [rsi + 0x18]
lea ecx, [rdi + rdi + 3]
lea ebx, [rdi + 1]
movsxd rcx, ecx
call fcn.14048a590
mov r15, rax
xor eax, eax
test r15, r15
je 0x1403f7944
cmp ebx, eax
jle 0x1403f79aa
mov byte [r15 + rax*2], 0x3f
mov byte [r15 + rax*2 + 1], 0x2c
inc rax
jmp 0x1403f7996
xor eax, eax
add rbx, rbx
inc edi
mov rcx, qword [rsp + r12*8 + 0x38]
cmovl rbx, rax
mov r9, r15
mov byte [r15 + rbx - 1], 0
mov rdx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
call fcn.14048a630
mov rcx, r15
mov rbx, rax
call fcn.140489690
mov r9d, 5
test rbx, rbx
jne 0x1403f7a1c
jmp 0x1403f7944
mov rdx, qword [rsi + 8]
mov rcx, qword [rsp + r12*8 + 0x38]
mov r8, qword [rsi + 0x10]
call fcn.14048a630
mov rbx, rax
test rax, rax
je 0x1403f7944
xor r9d, r9d
cmp r15d, 2
setg r9b
lea r9d, [r9*4 + 1]
mov rax, qword [rbp]
or r8d, 0xffffffff
mov rdx, rbx
inc dword [rax + 0x78]
xor eax, eax
mov qword [rsp + 0x28], rax
lea rax, [rbp + r12*8 + 0x28]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsi]
call fcn.14048aa60
mov rcx, rbx
mov edi, eax
mov rax, qword [rbp]
dec dword [rax + 0x78]
call fcn.140489690
test edi, edi
je 0x1403f7a78
test r13, r13
je 0x1403f7a78
mov rcx, qword [rsi]
call fcn.140488eb0
lea rcx, [0x140617b83]
mov rdx, rax
call fcn.14048a630
mov qword [r13], rax
mov rcx, qword [rbp + r12*8 + 0x28]
mov qword [r14], rcx
call fcn.14048b080
mov eax, edi
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14040fbb0
Capabilities:
Create new key via cryptacquirecontext
Initialize hashing via wincrypt

Disassembly:
push rbx
sub rsp, 0x30
xor edx, edx
mov r9d, 0x18
xor r8d, r8d
mov dword [rsp + 0x20], 0xf0000040
mov rbx, rcx
call qword [sym.imp.advapi32.dll_CryptAcquireContextA]
mov edx, eax
mov eax, 0x1b
test edx, edx
je 0x14040fc14
lea rax, [rbx + 8]
mov edx, 0x800c
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, qword [rbx]
call qword [sym.imp.advapi32.dll_CryptCreateHash]
mov edx, eax
xor eax, eax
test edx, edx
jne 0x14040fc14
mov rcx, qword [rbx]
call qword [sym.imp.advapi32.dll_CryptReleaseContext]
xor eax, eax
mov qword [rbx], rax
mov eax, 2
add rsp, 0x30
pop rbx
ret