joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45e5a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40280f
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
nop
call fcn.00408ea0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045c500
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x4027e0
cmp byte [0x005bb8d1], 0
je 0x45e5b5
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x45b600
jmp 0x4027e0

Function at 0x45e5c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x005bbb80]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x005bb8d1], 0
je 0x45e5f5
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x005bbec0]
aesenc xmm0, xmmword [0x005bbed0]
aesenc xmm0, xmmword [0x005bbee0]
movq rax, xmm0
ret
jmp 0x4090a0

Function at 0x45e600
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x005bbb80]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x005bb8d1], 0
je 0x45e636
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x005bbec0]
aesenc xmm0, xmmword [0x005bbed0]
aesenc xmm0, xmmword [0x005bbee0]
movq rax, xmm0
ret
jmp 0x409100

Function at 0x460020
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x30
mov rcx, 0xfffffffffffffff4
mov qword [rsp], rcx
mov rax, qword [sym.imp.kernel32.dll_GetStdHandle]
call rax
mov rcx, rax
mov qword [rsp], rcx
lea rdx, [0x005bbe40]
mov qword [rsp + 8], rdx
lea r8d, [0x005bb8e8]
mov qword [rsp + 0x10], r8
lea r9, [rsp + 0x28]
mov qword [r9], 0
mov qword [rsp + 0x18], r9
mov qword [rsp + 0x20], 0
mov rax, qword [sym.imp.kernel32.dll_WriteFile]
call rax
call fcn.0045e4e0
add rsp, 0x30
ret

Function at 0x460560
Capabilities:
Allocate thread local storage

Disassembly:
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x46058c
call fcn.0045e4e0
shl rcx, 3
add rcx, 0x1480
mov qword [0x005bbaa8], rcx
ret
Function at 0x46baa0
Capabilities:
Encode data using xor

Disassembly:
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
test rdx, 0xf
jne 0x46bb0b
mov rax, 0
movdqu xmm0, xmmword [rsi + rax]
movdqu xmm1, xmmword [rcx + rax]
pxor xmm0, xmm1
movdqu xmmword [rbx + rax], xmm0
add rax, 0x10
cmp rdx, rax
jne 0x46bac4
ret
sub rdx, 1
mov dil, byte [rsi + rdx]
mov al, byte [rcx + rdx]
xor dil, al
mov byte [rbx + rdx], dil
test rdx, 7
jne 0x46bae1
cmp rdx, 0
je 0x46bb2d
test rdx, 0xf
je 0x46babd
test rdx, 7
jne 0x46bae1
sub rdx, 8
mov rdi, qword [rsi + rdx]
mov rax, qword [rcx + rdx]
xor rdi, rax
mov qword [rbx + rdx], rdi
cmp rdx, 0x10
jge 0x46babd
ret
Function at 0x481580
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rbx]
add rax, 0x10
pxor xmm0, xmm1
sub rcx, 0xc
je 0x4815bf
jb 0x4815d4
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x20]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x30]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x40]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x50]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x60]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x70]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x80]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x90]
aesenclast xmm0, xmm1
movups xmmword [rdx], xmm0
ret
Function at 0x481640
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
add rbx, 0x10
pxor xmm4, xmm4
cmp ecx, 0xc
je 0x481710
jb 0x48176f
movups xmm2, xmmword [rax + 0x10]
movups xmmword [rbx], xmm2
add rbx, 0x10
aeskeygenassist xmm1, xmm2, 1
call fcn.00481520
aeskeygenassist xmm1, xmm0, 1
call fcn.00481540
aeskeygenassist xmm1, xmm2, 2
call fcn.00481520
aeskeygenassist xmm1, xmm0, 2
call fcn.00481540
aeskeygenassist xmm1, xmm2, 4
call fcn.00481520
aeskeygenassist xmm1, xmm0, 4
call fcn.00481540
aeskeygenassist xmm1, xmm2, 8
call fcn.00481520
aeskeygenassist xmm1, xmm0, 8
call fcn.00481540
aeskeygenassist xmm1, xmm2, 0x10
call fcn.00481520
aeskeygenassist xmm1, xmm0, 0x10
call fcn.00481540
aeskeygenassist xmm1, xmm2, 0x20
call fcn.00481520
aeskeygenassist xmm1, xmm0, 0x20
call fcn.00481540
aeskeygenassist xmm1, xmm2, 0x40
call fcn.00481520
jmp 0x4817dd
movq xmm2, qword [rax + 0x10]
aeskeygenassist xmm1, xmm2, 1
call fcn.00481480
aeskeygenassist xmm1, xmm2, 2
call fcn.004814e0
aeskeygenassist xmm1, xmm2, 4
call fcn.00481480
aeskeygenassist xmm1, xmm2, 8
call fcn.004814e0
aeskeygenassist xmm1, xmm2, 0x10
call fcn.00481480
aeskeygenassist xmm1, xmm2, 0x20
call fcn.004814e0
aeskeygenassist xmm1, xmm2, 0x40
call fcn.00481480
aeskeygenassist xmm1, xmm2, 0x80
call fcn.004814e0
jmp 0x4817dd
aeskeygenassist xmm1, xmm0, 1
call fcn.00481440
aeskeygenassist xmm1, xmm0, 2
call fcn.00481440
aeskeygenassist xmm1, xmm0, 4
call fcn.00481440
aeskeygenassist xmm1, xmm0, 8
call fcn.00481440
aeskeygenassist xmm1, xmm0, 0x10
call fcn.00481440
aeskeygenassist xmm1, xmm0, 0x20
call fcn.00481440
aeskeygenassist xmm1, xmm0, 0x40
call fcn.00481440
aeskeygenassist xmm1, xmm0, 0x80
call fcn.00481440
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.00481440
aeskeygenassist xmm1, xmm0, 0x36
call fcn.00481440
sub rbx, 0x10
movups xmm1, xmmword [rbx]
movups xmmword [rdx], xmm1
dec rcx
movups xmm1, xmmword [rbx - 0x10]
aesimc xmm0, xmm1
movups xmmword [rdx + 0x10], xmm0
sub rbx, 0x10
add rdx, 0x10
dec rcx
jne 0x4817ea
movups xmm0, xmmword [rbx - 0x10]
movups xmmword [rdx + 0x10], xmm0
ret
Function at 0x140023a60
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push rbx
push rsi
push rdi
push r15
sub rsp, 0x28
xorps xmm0, xmm0
mov rbx, rdx
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], 0
xor r8d, r8d
mov qword [rcx + 0x18], send
mov rsi, rcx
mov byte [rcx], 0
mov rax, qword [rdx + 0x10]
shr rax, 2
lea rdx, [rax + rax*2]
call fcn.140031ac0
cmp qword [rbx + 0x18], 0x10
mov r9, qword [rbx + 0x10]
jb 0x140023aab
mov rbx, qword [rbx]
cmp qword [rsi + 0x18], 0x10
mov r15, rsi
jb 0x140023ab8
mov r15, qword [rsi]
xor r8d, r8d
mov rdi, r15
test r9, r9
je 0x140023bf5
mov eax, dword [rsp + 0x50]
xor edx, edx
movzx r11d, byte [rsp + 0x52]
mov qword [rsp + 0x58], rbp
movzx ebp, byte [rsp + 0x51]
mov qword [rsp + 0x60], r12
lea r12, [0x1400f0ad0]
mov qword [rsp + 0x20], r14
movzx r14d, byte [rsp + 0x53]
nop dword [rax]
nop dword [rax + rax]
movzx ecx, byte [rbx]
dec r9
cmp cl, 0x3d
je 0x140023b90
movzx r10d, byte [rcx + r12]
cmp r10b, 0xff
je 0x140023b90
mov byte [rsp + rdx + 0x50], r10b
inc rbx
mov eax, dword [rsp + 0x50]
inc rdx
movzx r14d, byte [rsp + 0x53]
inc r8d
movzx r11d, byte [rsp + 0x52]
movzx ebp, byte [rsp + 0x51]
cmp rdx, 4
jne 0x140023b87
movzx r8d, bpl
movzx edx, r11b
shr r8b, 4
movzx ecx, al
shl cl, 2
and r8b, 3
add r8b, cl
shr dl, 2
and dl, 0xf
mov byte [rdi], r8b
movzx ecx, bpl
xor r8d, r8d
shl cl, 4
add dl, cl
movzx ecx, r11b
shl cl, 6
add cl, r14b
mov byte [rdi + 1], dl
mov byte [rdi + 2], cl
add rdi, 3
xor edx, edx
test r9, r9
jne 0x140023b00
mov r12, qword [rsp + 0x60]
test r8d, r8d
je 0x140023beb
shl al, 2
movzx ecx, bpl
shr cl, 4
and cl, 3
shl bpl, 4
add cl, al
movzx eax, r11b
shr al, 2
and al, 0xf
shl r11b, 6
add al, bpl
mov byte [rsp + 0x50], cl
add r11b, r14b
mov byte [rsp + 0x51], al
lea eax, [r8 - 1]
mov byte [rsp + 0x52], r11b
movsxd rbx, eax
test eax, eax
jle 0x140023beb
mov r8, rbx
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.1400e4ca0
add rdi, rbx
mov rbp, qword [rsp + 0x58]
mov r14, qword [rsp + 0x20]
sub rdi, r15
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call fcn.140031ac0
mov rax, rsi
add rsp, 0x28
pop r15
pop rdi
pop rsi
pop rbx
ret
Function at 0x140036c10
Capabilities:
Encrypt data using dpapi

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rdi
sub rsp, 0x80
lea rax, [r11 - 0x48]
mov qword [r11 - 0x30], rdx
mov qword [r11 - 0x58], rax
mov rdi, rcx
mov dword [r11 - 0x60], r9d
lea rcx, [r11 - 0x38]
mov dword [r11 - 0x38], r8d
xor ebx, ebx
xor r9d, r9d
mov qword [r11 - 0x68], rbx
xor r8d, r8d
xor edx, edx
call sub.CRYPT32.dll_CryptUnprotectData
test eax, eax
je 0x140036cff
xorps xmm0, xmm0
mov qword [rsp + 0x70], rbx
movups xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x60], bl
mov ebx, dword [rsp + 0x40]
mov qword [rsp + 0x78], send
test rbx, rbx
jne 0x140036c83
mov qword [rsp + 0x70], rbx
mov byte [rsp + rbx + 0x60], bl
jmp 0x140036cbd
lea rcx, [rsp + 0x60]
cmp rbx, 0xf
ja 0x140036ca4
mov r8, rbx
mov qword [rsp + 0x70], rbx
xor edx, edx
call fcn.1400e5340
mov byte [rsp + rbx + 0x60], 0
jmp 0x140036cbd
movzx r8d, byte [rsp + 0xa0]
mov r9, rbx
mov rdx, rbx
mov byte [rsp + 0x20], 0
call fcn.1400232f0
cmp qword [rsp + 0x78], 0x10
lea rcx, [rsp + 0x60]
mov r8d, dword [rsp + 0x40]
cmovae rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x48]
call fcn.1400e4ca0
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LocalFree]
movups xmm0, xmmword [rsp + 0x60]
movups xmm1, xmmword [rsp + 0x70]
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm1
mov byte [rdi + 0x20], 1
jmp 0x140036d02
mov byte [rdi + 0x20], bl
mov rbx, qword [rsp + 0x90]
mov rax, rdi
add rsp, 0x80
pop rdi
ret
Function at 0x1400ab050
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbx
push rbp
push rdi
mov eax, 0x13d0
call fcn.1400e3040
sub rsp, rax
mov rdi, rcx
call fcn.1400ea8e8
mov r9d, 0xffffffff
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x13c4], r9d
mov r8d, 1
nop dword [rax]
nop word [rax + rax]
mov edx, eax
shr edx, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
add eax, r8d
mov dword [rsp + r8*4 + 0x44], eax
inc r8
cmp r8, 0x270
jb 0x1400ab090
lea rax, [rsp + 0x40]
mov dword [rsp + 0x40], 0x270
mov qword [rsp + 0x20], rax
mov ecx, 0x40
mov rax, 0xffffffffffffffff
nop
dec rcx
shr rax, 1
cmp rax, r9
ja 0x1400ab0d0
mov rdx, qword [rdi + 8]
lea r8, [rsp + 0x20]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rdi]
mov qword [rsp + 0x30], rax
call fcn.1400aac60
mov rbx, qword [rdi]
mov rbp, qword [rdi + 8]
cmp rbx, rbp
je 0x1400ab1be
mov qword [rsp + 0x13f8], rsi
lea rax, [rsp + 0x40]
mov qword [rsp + 0x1400], r14
mov r14d, 0x80000000
mov qword [rsp + 0x13f0], rax
nop dword [rax]
lea rcx, [rsp + 0x13f0]
call fcn.140039580
mov eax, eax
imul rcx, rax, 7
cmp ecx, 3
ja 0x1400ab168
nop dword [rax + rax]
lea rcx, [rsp + 0x13f0]
call fcn.140039580
mov eax, eax
imul rcx, rax, 7
cmp ecx, 4
jb 0x1400ab150
shr rcx, 0x20
add ecx, 0x80000005
cmp ecx, r14d
lea eax, [rcx + r14]
lea esi, [rcx - 0x80000000]
cmovae esi, eax
xor edi, edi
test esi, esi
jle 0x1400ab1a5
nop dword [rax + rax]
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x1400ab1c9
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
inc edi
cmp edi, esi
jl 0x1400ab190
add rbx, 0x40
cmp rbx, rbp
jne 0x1400ab130
mov rsi, qword [rsp + 0x13f8]
mov r14, qword [rsp + 0x1400]
add rsp, 0x13d0
pop rdi
pop rbp
pop rbx
ret
call fcn.1400e9728
int3
Function at 0x1400b9f30
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x170]
sub rsp, 0x270
xor esi, esi
mov rdi, rcx
mov qword [rcx], rsi
xor edx, edx
mov qword [rcx + 8], rsi
mov r8d, 0x208
mov qword [rcx + 0x10], rsi
lea rcx, [rsp + 0x60]
call fcn.1400e5340
lea rdx, [rsp + 0x60]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
dec eax
cmp eax, 0x103
ja 0x1400ba0dc
lea rbx, [rsp + 0x60]
cmp word [rsp + 0x60], si
je 0x1400ba0dc
mov eax, dword [rbx]
mov rdx, qword [rdi + 8]
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x30], 3
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], 7
movups xmm1, xmmword [rsp + 0x30]
mov dword [rsp + 0x24], 0x5c
movups xmm0, xmmword [rsp + 0x20]
mov qword [rsp + 0x30], rsi
mov word [rsp + 0x20], si
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm1
cmp rdx, qword [rdi + 0x10]
je 0x1400ba016
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], rsi
mov qword [rdx + 0x18], rsi
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rsp + 0x50]
movups xmmword [rdx + 0x10], xmm1
add qword [rdi + 8], 0x20
jmp 0x1400ba065
lea r8, [rsp + 0x40]
mov rcx, rdi
call fcn.1400aca80
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x1400ba065
mov rcx, qword [rsp + 0x40]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ba060
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400ba0fc
call fcn.1400e2ce8
mov rdx, qword [rsp + 0x38]
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], si
cmp rdx, 8
jb 0x1400ba0b6
mov rcx, qword [rsp + 0x20]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ba0b1
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400ba0fc
call fcn.1400e2ce8
mov rax, 0xffffffffffffffff
nop dword [rax]
cmp word [rbx + rax*2 + 2], si
lea rax, [rax + 1]
jne 0x1400ba0c0
lea rbx, [rbx + rax*2]
add rbx, 2
cmp word [rbx], si
jne 0x1400b9fa3
lea r11, [rsp + 0x270]
mov rax, rdi
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.1400c4dd4
int3
Function at 0x1400bb580
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x360]
sub rsp, 0x460
mov rdi, rcx
mov dword [rbp + 0x380], 0x400
xor ecx, ecx
mov dword [rbp + 0x390], 0xf003f
xorps xmm0, xmm0
mov qword [rsp + 0x30], rcx
mov rbx, r9
mov rax, r8
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rcx
mov r10, rdx
mov qword [rdi + 0x18], send
mov byte [rdi], cl
cmp qword [r8 + 0x18], 0x10
jb 0x1400bb5d8
mov rax, qword [r8]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x488], rsi
mov qword [rsp + 0x20], rcx
mov r9d, 0x20019
mov rcx, r10
xor r8d, r8d
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400bb76c
cmp qword [rbx + 0x18], 0x10
jb 0x1400bb611
mov rbx, qword [rbx]
mov rcx, qword [rsp + 0x30]
lea rax, [rbp + 0x380]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x390]
lea rax, [rsp + 0x60]
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400bb76c
mov qword [rsp + 0x498], r14
lea rcx, [rsp + 0x38]
mov r14d, dword [rbp + 0x380]
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
cmp r14, 0x10
jae 0x1400bb691
mov r8d, r14d
mov qword [rsp + 0x48], r14
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x50], send
call fcn.1400e4ca0
mov byte [rsp + r14 + 0x38], 0
mov rsi, qword [rsp + 0x50]
jmp 0x1400bb6d4
mov eax, socket
mov rsi, r14
or rsi, 0xf
cmp rsi, rax
cmovb rsi, rax
lea rdx, [rsi + 1]
call fcn.140027ca0
mov r8, r14
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x48], r14
mov rcx, rax
mov qword [rsp + 0x50], rsi
mov rbx, rax
call fcn.1400e4ca0
mov byte [rbx + r14], 0
mov r14, qword [rsp + 0x498]
lea rax, [rsp + 0x38]
cmp rdi, rax
je 0x1400bb737
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x1400bb71c
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x1400bb717
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400bb792
mov rcx, r8
call fcn.1400e2ce8
movups xmm0, xmmword [rsp + 0x38]
mov esi, send
mov byte [rsp + 0x38], 0
movups xmm1, xmmword [rsp + 0x48]
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm1
cmp rsi, 0x10
jb 0x1400bb76c
mov rcx, qword [rsp + 0x38]
lea rdx, [rsi + 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400bb767
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400bb792
call fcn.1400e2ce8
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400bb77c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x488]
mov rax, rdi
add rsp, 0x460
pop rdi
pop rbx
pop rbp
ret
call fcn.1400c4dd4
int3

Function at 0x1400bb7a0
Capabilities:
Get hostname

Disassembly:
push rbx
mov eax, 0x10020
call fcn.1400e3040
sub rsp, rax
mov rbx, rcx
mov dword [rsp + 0x10038], 0x7fff
lea rcx, [rsp + 0x20]
lea rdx, [rsp + 0x10038]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x1400bb7ed
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140036d20
mov rax, rbx
add rsp, 0x10020
pop rbx
ret
xorps xmm0, xmm0
mov rax, rbx
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], send
mov byte [rbx], 0
add rsp, 0x10020
pop rbx
ret
Function at 0x1400bc310
Capabilities:
Create restart manager session
Enumerate processes that use resource

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xb0
mov ecx, dword [0x140113040]
xor ebx, ebx
mov rax, qword gs:[0x58]
mov edx, 4
mov dword [rbp + 0x6f], ebx
mov rax, qword [rax + rcx*8]
mov eax, dword [rdx + rax]
cmp dword [0x1401125a8], eax
jg 0x1400bc49d
xor eax, eax
mov qword [rsp + 0xa8], rsi
lea rdi, [rbp - 0x19]
mov ecx, 0x42
rep stosb byte [rdi], al
lea rcx, [rbp + 0x6f]
xor edx, edx
lea r8, [rbp - 0x19]
call sub.RstrtMgr.DLL_RmStartSession
test eax, eax
jne 0x1400bc460
mov ecx, dword [rbp + 0x6f]
lea r8, [rbp + 0x67]
mov qword [rsp + 0x30], rbx
lea edx, [rax + 1]
mov dword [rsp + 0x28], ebx
xor r9d, r9d
mov qword [rsp + 0x20], rbx
call sub.RstrtMgr.DLL_RmRegisterResources
test eax, eax
jne 0x1400bc458
lea rdi, [rbp - 0x21]
mov dword [rbp - 0x29], ebx
mov ecx, 8
mov dword [rbp + 0x77], ebx
rep stosb byte [rdi], al
mov ecx, dword [rbp + 0x6f]
lea rax, [rbp - 0x29]
xor r9d, r9d
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x7f]
mov dword [rbp + 0x7f], ebx
lea rdx, [rbp + 0x77]
call sub.RstrtMgr.DLL_RmGetList
cmp eax, 0xea
jne 0x1400bc491
mov eax, dword [rbp + 0x77]
test eax, eax
je 0x1400bc491
imul rcx, rax, 0x29c
call fcn.1400ca714
mov ecx, dword [rbp + 0x6f]
mov rsi, rax
test rax, rax
je 0x1400bc494
mov eax, dword [rbp + 0x77]
lea r8, [rbp + 0x7f]
mov dword [rbp + 0x7f], eax
lea rdx, [rbp + 0x77]
lea rax, [rbp - 0x29]
mov r9, rsi
mov qword [rsp + 0x20], rax
call sub.RstrtMgr.DLL_RmGetList
test eax, eax
jne 0x1400bc489
cmp dword [rbp + 0x77], ebx
je 0x1400bc489
mov r8d, dword [rbp + 0x7f]
mov edx, ebx
test r8d, r8d
je 0x1400bc458
mov r9d, dword [0x1401125a4]
nop
mov eax, edx
imul rcx, rax, 0x29c
mov edi, dword [rcx + rsi]
cmp edi, r9d
jne 0x1400bc475
inc edx
cmp edx, r8d
jb 0x1400bc440
mov ecx, dword [rbp + 0x6f]
call sub.RstrtMgr.DLL_RmEndSession
mov eax, ebx
mov rsi, qword [rsp + 0xa8]
add rsp, 0xb0
pop rdi
pop rbx
pop rbp
ret
mov rcx, rsi
call fcn.1400c7c34
mov ecx, dword [rbp + 0x6f]
call sub.RstrtMgr.DLL_RmEndSession
mov ebx, edi
jmp 0x1400bc460
mov rcx, rsi
call fcn.1400c7c34
mov ecx, dword [rbp + 0x6f]
call sub.RstrtMgr.DLL_RmEndSession
xor eax, eax
jmp 0x1400bc462
lea rcx, [0x1401125a8]
call fcn.1400e2fac
cmp dword [0x1401125a8], 0xffffffff
jne 0x1400bc350
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcessId]
lea rcx, [0x1401125a8]
mov dword [0x1401125a4], eax
call fcn.1400e2f40
jmp 0x1400bc350
Function at 0x1400bc4e0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, rdx
lea r9, [rsp + 0x50]
xorps xmm0, xmm0
xor esi, esi
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], rsi
mov rbx, rcx
mov edi, 7
xor r8d, r8d
mov qword [rcx + 0x18], rdi
xor edx, edx
mov word [rcx], si
mov rcx, rax
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
jne 0x1400bc5f3
mov rdx, qword [rsp + 0x50]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], si
jne 0x1400bc533
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
xorps xmm1, xmm1
movups xmmword [rsp + 0x20], xmm0
movdqu xmmword [rsp + 0x30], xmm1
call fcn.1400222b0
lea rax, [rsp + 0x20]
cmp rbx, rax
je 0x1400bc5b5
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x1400bc59d
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x1400bc598
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400bc611
mov rcx, r8
call fcn.1400e2ce8
movups xmm0, xmmword [rsp + 0x20]
mov word [rsp + 0x20], si
movups xmm1, xmmword [rsp + 0x30]
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm1
jmp 0x1400bc5ba
mov rdi, qword [rsp + 0x38]
cmp rdi, 8
jb 0x1400bc5f3
mov rcx, qword [rsp + 0x20]
lea rdx, [rdi*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400bc5ee
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400bc611
call fcn.1400e2ce8
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rsi, qword [rsp + 0x60]
mov rax, rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
call fcn.1400c4dd4
int3