joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140079480
Capabilities:
Execute command

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rax, qword [0x14009b040]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x20], rdx
mov rcx, qword [rcx + 0x10]
call fcn.14007d56c
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x1400794bc
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x1400794c9
mov rdx, qword [rdi]
mov r8, qword [rdi + 0x10]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140079bc0
lea rdx, [0x14005bf80]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
mov rdx, qword [rdi + 0x18]
cmp rdx, 0xf
jbe 0x14007952d
inc rdx
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x140079528
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140079558
mov rcx, r8
call fcn.14007d56c
mov qword [rdi + 0x10], 0
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14007d3d0
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14007df04
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14007df4e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14007df4e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14007df4e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14007df4e
cmp dword [rcx + 0x84], 0xe
jbe 0x14007df4e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14007df50
xor al, al
add rsp, 0x28
ret
Function at 0x14007f138
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x14007f172
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x14007f177
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x14007f1c0
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x140082a40]
cmp byte [rcx + rax], 0
je 0x14007f1c0
dec r8
sub rdx, 1
jne 0x14007f1a6
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x1400018f8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001942
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001942
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001942
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001942
cmp dword [rcx + 0x84], 0xe
jbe 0x140001942
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001944
xor al, al
add rsp, 0x28
ret
Function at 0x14001f740
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14001f768
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14001f768
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x141be2058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.141be21df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141be2089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141be206f
add dl, dl
jne 0x141be2096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141be20f6
xor eax, eax
add dl, dl
jne 0x141be20a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141be21ad
add dl, dl
jne 0x141be20b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141be20c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141be20d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141be20dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x141be20ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x141be207e
mov eax, 1
add dl, dl
jne 0x141be2106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141be2113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141be20fb
sub eax, ebx
mov ebx, 1
jne 0x141be214c
mov ecx, 1
add dl, dl
jne 0x141be212e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141be213b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141be2123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141be207e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141be2168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141be2175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141be215d
cmp eax, 0x7d00
jae 0x141be219b
cmp eax, 0x500
jb 0x141be2196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141be207e
cmp eax, 0x7f
ja 0x141be219e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141be207e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x141be21d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x141be207e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1d60347de
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp - 8], 0
cmp qword [rbp + 0x18], 0
je 0x1d603480e
mov rax, qword [rbp + 0x18]
mov rcx, rax
call fcn.1d60347ab
mov rdx, rax
jmp 0x1d6034813
mov edx, 0
mov rax, qword [rbp + 0x18]
mov r9, qword [rbp + 0x10]
mov r8, rdx
mov edx, 1
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov qword [rbp - 8], rax
mov dword [rbp - 0xc], 0
mov rcx, qword [rbp + 0x10]
call sub.msvcrt.dll_fflush
mov dword [rbp - 0xc], eax
nop
add rsp, 0x30
pop rbp
ret

Function at 0x1d603b0f5
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov qword [rbp - 8], 0
mov rdx, qword [rbp + 0x20]
mov rax, qword [rbp + 0x18]
mov r9, qword [rbp + 0x10]
mov r8, rdx
mov edx, 1
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov qword [rbp - 8], rax
mov dword [rbp - 0xc], 0
mov rcx, qword [rbp + 0x10]
call sub.msvcrt.dll_fflush
mov dword [rbp - 0xc], eax
nop
add rsp, 0x30
pop rbp
ret

Function at 0x1d603f35d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0x70]
mov rbx, rcx
mov rcx, qword [rbx]
mov rbx, qword [rbx + 8]
mov qword [rbp - 0x40], rcx
mov qword [rbp - 0x38], rbx
mov rbx, rdx
mov rax, qword [rbx]
mov rdx, qword [rbx + 8]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rdx
mov byte [rbp - 1], 0
mov rax, qword [rbp - 0x50]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x40]
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x10], 0
mov rax, qword [rbp - 0x20]
cmp rax, qword [rbp - 0x10]
jg 0x1d603f3bb
mov byte [rbp - 1], 1
jmp 0x1d603f4a2
nop
mov byte [rbp - 0x11], 0
mov rax, qword [rbp - 0x28]
cmp rax, qword [rbp - 0x10]
setle al
mov byte [rbp - 0x11], al
cmp byte [rbp - 0x11], 0
jne 0x1d603f453
cmp qword [rbp - 0x10], 0
js 0x1d603f3e5
mov rax, qword [rbp - 0x40]
cmp qword [rbp - 0x10], rax
jl 0x1d603f3fe
mov rax, qword [rbp - 0x40]
lea rdx, [rax - 1]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call fcn.1d6039f56
jmp 0x1d603f4a2
cmp qword [rbp - 0x10], 0
js 0x1d603f40f
mov rax, qword [rbp - 0x50]
cmp qword [rbp - 0x10], rax
jl 0x1d603f425
mov rax, qword [rbp - 0x50]
lea rdx, [rax - 1]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call fcn.1d6039f56
jmp 0x1d603f4a2
mov rdx, qword [rbp - 0x38]
mov rax, qword [rbp - 0x10]
add rax, rdx
add rax, 8
movzx edx, byte [rax]
mov rcx, qword [rbp - 0x48]
mov rax, qword [rbp - 0x10]
add rax, rcx
add rax, 8
movzx eax, byte [rax]
cmp dl, al
setne al
mov byte [rbp - 0x11], al
jmp 0x1d603f454
nop
movzx eax, byte [rbp - 0x11]
xor eax, 1
test al, al
jne 0x1d603f465
mov byte [rbp - 1], 0
jmp 0x1d603f4a2
nop
mov edx, 0
mov rax, qword [rbp - 0x10]
add rax, 1
jno 0x1d603f47a
mov edx, 1
mov rcx, rax
lea rax, [rbp - 0x30]
mov qword [rax], rcx
mov rax, rdx
and eax, 1
test al, al
je 0x1d603f495
call fcn.1d603ae1c
jmp 0x1d603f4a2
mov rax, qword [rbp - 0x30]
mov qword [rbp - 0x10], rax
jmp 0x1d603f3a8
movzx eax, byte [rbp - 1]
add rsp, 0x78
pop rbx
pop rbp
ret
Function at 0x1d6048c70
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov rax, qword gs:[0x60]
movzx rax, byte [rax + 2]
ret

Function at 0x1d604ad3d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
call fcn.1d604a560
mov qword [rbp - 0x20], rax
mov qword [rbp - 8], 0
cmp qword [rbp + 0x18], 0
je 0x1d604ae59
nop
mov rax, qword [rbp + 0x18]
mov qword [rbp - 0x28], rax
cmp qword [rbp - 0x28], 0xffffffffffffffff
jne 0x1d604ad97
mov rcx, qword [rbp + 0x10]
call fcn.1d604a8d8
mov qword [rbp - 8], rax
mov rax, qword [rbp - 0x20]
movzx eax, byte [rax]
movzx eax, al
test eax, eax
jmp 0x1d604ae5d
nop
mov qword [rbp - 0x10], 0
mov rcx, qword [rbp + 0x10]
call fcn.1d604a8d8
mov qword [rbp - 0x30], rax
mov rax, qword [rbp - 0x20]
movzx eax, byte [rax]
movzx eax, al
test eax, eax
jne 0x1d604ae5c
mov byte [rbp - 0x11], 0
mov rax, 0xffffffffffffffff
mov edx, 0
div qword [rbp - 0x28]
mov rax, rdx
not rax
cmp qword [rbp - 0x30], rax
setbe al
mov byte [rbp - 0x11], al
cmp byte [rbp - 0x11], 0
jne 0x1d604adf6
cmp qword [rbp - 0x10], 0x14
setg al
mov byte [rbp - 0x11], al
jmp 0x1d604adf7
nop
movzx eax, byte [rbp - 0x11]
xor eax, 1
test al, al
jne 0x1d604ae1c
mov rax, qword [rbp - 0x28]
lea rcx, [rax + 1]
mov rax, qword [rbp - 0x30]
mov edx, 0
div rcx
mov qword [rbp - 8], rdx
jmp 0x1d604ae5d
nop
mov edx, 0
mov rax, qword [rbp - 0x10]
add rax, 1
jno 0x1d604ae31
mov edx, 1
mov rcx, rax
lea rax, [rbp - 0x38]
mov qword [rax], rcx
mov rax, rdx
and eax, 1
test al, al
je 0x1d604ae4c
call fcn.1d603ae1c
jmp 0x1d604ae5d
mov rax, qword [rbp - 0x38]
mov qword [rbp - 0x10], rax
jmp 0x1d604ada0
nop
jmp 0x1d604ae5d
nop
mov rax, qword [rbp - 8]
add rsp, 0x60
pop rbp
ret

Function at 0x1d6052800
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call fcn.1d6059e70
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call fcn.1d6059e70
mov r8, rbx
mov rdx, qword [rbp + 0x20]
mov rcx, rax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
Function at 0x1d6053172
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x1d6068388]
test eax, eax
je 0x1d605320a
lea rax, [0x1d6068360]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x1d6068390]
mov qword [rbp - 8], rax
jmp 0x1d60531ee
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x1d60531e2
cmp qword [rbp - 0x10], 0
je 0x1d60531e2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x1d60531a8
lea rax, [0x1d6068360]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x1d605320b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x1d6053310
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1d6053338
mov eax, 0
jmp 0x1d6053386
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1d6053361
mov eax, 0
jmp 0x1d6053386
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x1d6053381
mov eax, 0
jmp 0x1d6053386
mov eax, 1
add rsp, 0x20
pop rbp
ret

Function at 0x1d605338c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x1d605340a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x1d6053401
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x1d6053401
mov rax, qword [rbp - 8]
jmp 0x1d605341f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x1d60533d4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140f83390
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140f8339a
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x140f833c3
pop rbp
sub rbp, 0x33
sub rbp, 0xf83390
sub rsp, 0x20
jmp 0x140f833e2
mov rax, 0xf83390
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0xffffffffee4119ff
xor byte [rax], dl
inc rax
dec rcx
jne 0x140f83401
jmp 0x140f83418
mov bh, 0x76
invalid
Function at 0x1400428c0
Capabilities:
Encode data using xor

Disassembly:
sub rdx, r8
sub rcx, r8
mov r10, r9
shr r9, 4
je 0x1400428f5
nop
movdqu xmm0, xmmword [rdx + r8]
pxor xmm0, xmmword [r8]
movdqu xmmword [rcx + r8], xmm0
movdqa xmmword [r8], xmm0
lea r8, [r8 + 0x10]
dec r9
jne 0x1400428d0
and r10, 0xf
je 0x140042925
mov r9d, reloc.WS2_32.dll_recv
sub r9, r10
xor eax, eax
mov al, byte [rdx + r8]
xor al, byte [r8]
mov byte [rcx + r8], al
mov byte [r8], al
lea r8, [r8 + 1]
dec r10
jne 0x140042900
xor eax, eax
mov byte [r8], al
lea r8, [r8 + 1]
dec r9
jne 0x140042919
mov rax, r8
repz ret

Function at 0x140042930
Capabilities:
Encode data using xor

Disassembly:
sub rdx, r8
sub rcx, r8
mov r10, r9
shr r9, 4
je 0x14004296d
nop
movdqu xmm0, xmmword [rdx + r8]
movdqa xmm1, xmmword [r8]
pxor xmm1, xmm0
movdqu xmmword [rcx + r8], xmm1
movdqa xmmword [r8], xmm0
lea r8, [r8 + 0x10]
dec r9
jne 0x140042940
pxor xmm1, xmm1
and r10, 0xf
je 0x1400429a3
mov r9d, reloc.WS2_32.dll_recv
sub r9, r10
xor eax, eax
xor r11, r11
mov r11b, byte [rdx + r8]
mov al, byte [r8]
xor al, r11b
mov byte [rcx + r8], al
mov byte [r8], r11b
lea r8, [r8 + 1]
dec r10
jne 0x14004297b
xor eax, eax
mov byte [r8], al
lea r8, [r8 + 1]
dec r9
jne 0x140042997
mov rax, r8
repz ret
Function at 0x140043a60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov rax, rsp
mov rdi, rcx
mov rsi, rdx
mov rdx, r8
mov rcx, r9
push rbx
push rbp
push r12
push r13
push r14
push r15
lea rdi, [rdi + 0x64]
sub rsp, 0xe8
mov r9, rsi
lea rsi, [rsp + 0x64]
not qword [rdi - 0x5c]
not qword [rdi - 0x54]
not qword [rdi - 0x24]
not qword [rdi - 4]
not qword [rdi + 0x24]
not qword [rdi + 0x3c]
lea r15, reloc.WS2_32.dll_accept
mov qword [rsi + 0x74], rcx
cmp rdx, rcx
jb 0x140043b00
shr rcx, 3
lea r8, [rdi - 0x64]
mov rax, qword [r9]
lea r9, [r9 + 8]
xor rax, qword [r8]
lea r8, [r8 + 8]
sub rdx, 8
mov qword [r8 - 8], rax
sub rcx, 1
jne 0x140043ac6
mov qword [rsi + 0x64], r9
mov qword [rsi + 0x6c], rdx
call fcn.140043700
mov r9, qword [rsi + 0x64]
mov rdx, qword [rsi + 0x6c]
mov rcx, qword [rsi + 0x74]
jmp 0x140043ab9
mov rax, rdx
not qword [rdi - 0x5c]
not qword [rdi - 0x54]
not qword [rdi - 0x24]
not qword [rdi - 4]
not qword [rdi + 0x24]
not qword [rdi + 0x3c]
add rsp, 0xe8
pop r15
pop r14
pop r13
pop r12
pop rbp
pop rbx
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
repz ret
Function at 0x140168af0
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
push r14
mov r14, rcx
mov rsi, r8
mov rbp, rdx
sub r14, qword [r8 + 0x30]
je 0x140168c72
test byte [r8 + 0x5e], 0x40
jne 0x140168b1d
xor eax, eax
mov rbp, qword [rsp + 0x30]
pop r14
pop rsi
ret
movzx edx, word [rsi + 0x14]
movzx eax, word [rsi + 6]
add rdx, 0x18
mov r8d, dword [r8 + 0xb0]
add rdx, rsi
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
cmp rdx, r9
jae 0x140168c72
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x140168b56
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x140168b6d
add rdx, 0x28
cmp rdx, r9
jb 0x140168b44
mov eax, 1
mov rbp, qword [rsp + 0x30]
pop r14
pop rsi
ret
mov qword [rsp + 0x18], rbx
mov ebx, dword [rdx + 0x14]
sub rbx, rcx
mov qword [rsp + 0x28], r15
mov r15d, dword [rsi + 0xb4]
add rbx, r8
add rbx, rbp
add r15, rbx
test rbx, rbx
je 0x140168c68
cmp rbx, r15
jae 0x140168c68
mov qword [rsp + 0x20], rdi
mov eax, dword [rbx + 4]
test eax, eax
je 0x140168c63
add eax, 0xfffffff8
shr eax, 1
je 0x140168c54
lea r11, [rbx + 8]
mov edi, eax
movzx r8d, word [r11]
movzx eax, r8w
shr ax, 0xc
and r8d, 0x80000fff
jge 0x140168be2
dec r8d
or r8d, 0xfffff000
inc r8d
cmp ax, 3
je 0x140168bee
cmp ax, 0xa
jne 0x140168c46
movzx eax, word [rsi + 0x14]
movzx ecx, word [rsi + 6]
add rax, 0x18
mov r9d, dword [rbx]
add rax, rsi
lea rdx, [rcx + rcx*4]
lea r10, [rax + rdx*8]
cmp rax, r10
jae 0x140168c3b
nop dword [rax]
mov edx, dword [rax + 0xc]
cmp r9, rdx
jb 0x140168c22
mov ecx, dword [rax + 8]
add ecx, edx
cmp r9, rcx
jb 0x140168c2d
add rax, 0x28
cmp rax, r10
jb 0x140168c10
jmp 0x140168c3b
mov ecx, dword [rax + 0x14]
sub rcx, rdx
add rcx, r9
add rcx, rbp
jne 0x140168c3e
mov rcx, rbp
movzx eax, r8w
add qword [rax + rcx], r14
add r11, 2
sub rdi, 1
jne 0x140168bc0
mov eax, dword [rbx + 4]
add rbx, rax
cmp rbx, r15
jb 0x140168ba4
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x18]
mov r15, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov eax, 1
pop r14
pop rsi
ret
Function at 0x140168c80
Capabilities:
Enumerate pe sections

Disassembly:
mov dword [rsp + 8], ecx
push rbp
push rdi
push r13
sub rsp, 0x40
movzx eax, word [r8 + 0x14]
lea r10, [r8 + 0x18]
mov r11d, dword [r8 + 0x90]
add r10, rax
movzx eax, word [r8 + 6]
mov rbp, r8
mov r13, rdx
mov edi, ecx
lea r9, [rax + rax*4]
lea r8, [r10 + r9*8]
cmp r10, r8
jae 0x140168ce1
nop dword [rax]
mov ecx, dword [r10 + 0xc]
cmp r11, rcx
jb 0x140168cd8
mov eax, dword [r10 + 8]
add eax, ecx
cmp r11, rax
jb 0x140168d75
add r10, 0x28
cmp r10, r8
jb 0x140168cc0
xor eax, eax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
test r11d, r11d
je 0x140168d4e
cmp dword [rbp + 0x94], 0
je 0x140168d4e
lea rbx, [rax + 0x10]
movzx edx, word [rbp + 0x14]
movzx eax, word [rbp + 6]
add rdx, 0x18
mov r8d, dword [rbx - 4]
add rdx, rbp
mov qword [rsp + 0x70], rbx
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
cmp rdx, r9
jae 0x140168d4e
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x140168d45
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x140168d87
add rdx, 0x28
cmp rdx, r9
jb 0x140168d33
mov eax, 1
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov r12, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop r13
pop rdi
pop rbp
ret
mov eax, dword [r10 + 0x14]
sub rax, rcx
add rax, r11
add rax, r13
jmp 0x140168ce3
mov r15d, dword [rdx + 0x14]
sub r15, rcx
add r15, r8
add r15, r13
je 0x140168d4e
mov rdx, r15
mov ecx, edi
call fcn.1401683e0
mov r12, rax
test rax, rax
je 0x140168ec2
movzx edx, word [rbp + 0x14]
movzx eax, word [rbp + 6]
add rdx, 0x18
mov r8d, dword [rbx]
add rdx, rbp
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
cmp rdx, r9
jae 0x140168deb
nop dword [rax + rax]
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x140168de2
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x140168e10
add rdx, 0x28
cmp rdx, r9
jb 0x140168dd0
xor r14d, r14d
mov rdi, qword [r14]
test rdi, rdi
je 0x140168ea7
jns 0x140168e1f
xor edx, edx
mov rcx, r15
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.DLL_LoadLibraryExA]
movzx edx, di
jmp 0x140168e70
mov r14d, dword [rdx + 0x14]
sub r14, rcx
add r14, r8
add r14, r13
jmp 0x140168dee
movzx eax, word [rbp + 0x14]
movzx ecx, word [rbp + 6]
add rax, 0x18
add rax, rbp
lea rdx, [rcx + rcx*4]
lea r8, [rax + rdx*8]
cmp rax, r8
jae 0x140168e5b
nop dword [rax + rax]
mov edx, dword [rax + 0xc]
cmp rdi, rdx
jb 0x140168e52
mov ecx, dword [rax + 8]
add ecx, edx
cmp rdi, rcx
jb 0x140168eb4
add rax, 0x28
cmp rax, r8
jb 0x140168e40
xor esi, esi
xor edx, edx
mov rcx, r15
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.DLL_LoadLibraryExA]
lea rdx, [rsi + 2]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov rdi, rax
mov rcx, rbx
sub rdi, rbx
call qword [sym.imp.KERNEL32.DLL_FreeLibrary]
lea rax, [rdi + r12]
mov qword [r14], rax
add r14, 8
mov rdi, qword [r14]
test rdi, rdi
jne 0x140168dfa
mov rbx, qword [rsp + 0x70]
mov edi, dword [rsp + 0x60]
add rbx, 0x14
jmp 0x140168d0e
mov esi, dword [rax + 0x14]
sub rsi, rdx
add rsi, rdi
add rsi, r13
jmp 0x140168e5d
jmp 0x140168d53