joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140a532b0
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov r14, rcx
cmp dword [rcx + 0x388], 0
jne 0x140a532ec
lea rdi, [rsp + 0x20]
mov rcx, rdi
call sub.KERNEL32.dll_GetSystemTimeAsFileTime
mov ebx, dword [rdi]
xor ebx, dword [rdi + 4]
call sub.KERNEL32.dll_GetCurrentProcessId
xor eax, ebx
mov ecx, eax
shl ecx, 0x1f
sub ecx, eax
mov dword [r14 + 0x388], ecx
cmp byte [r14 + 0x1c8], 0
jne 0x140a532fd
mov al, 1
jmp 0x140a5345f
lea rax, [fcn.140a5b770]
mov ecx, eax
and ecx, 1
xor ecx, eax
cmp ecx, 0xffffffff
sete al
or al, 6
movzx eax, al
movzx ecx, byte [0x140d16eff]
bt ecx, eax
jb 0x140a53450
mov al, byte [0x140d16eff]
lea rcx, [fcn.140a5b770]
mov edx, ecx
and edx, 1
xor edx, ecx
cmp edx, 0xffffffff
sete cl
or cl, 6
xor cl, 7
mov bl, 1
shl bl, cl
or bl, al
lock cmpxchg byte [0x140d16eff], bl
jne 0x140a5333a
lea rcx, [fcn.140a5b770]
mov edx, ecx
and edx, 1
xor edx, ecx
cmp edx, 0xffffffff
sete cl
or cl, 6
xor cl, 7
movzx ecx, cl
movzx eax, al
bt eax, ecx
jae 0x140a533a6
lea rcx, [fcn.140a5b770]
mov eax, ecx
and eax, 1
xor eax, ecx
cmp eax, 0xffffffff
sete cl
or cl, 6
movzx ecx, cl
movzx edx, byte [0x140d16eff]
bt edx, ecx
jae 0x140a53389
jmp 0x140a53450
lea rax, [fcn.140a5b770]
mov ecx, eax
and ecx, 1
xor ecx, eax
xor eax, eax
cmp ecx, 0xffffffff
sete al
mov ecx, 0xea6ac08e
lea rdx, [rax + rcx]
add rdx, 0x1280
mov eax, edx
and al, 7
movzx eax, al
movzx ecx, byte [0x140d16eff]
bt ecx, eax
jb 0x140a5342c
lea rdi, [0x140d16ed0]
xor eax, eax
mov ebx, dword [rdi]
xor ebx, edx
mov esi, edx
mov ecx, eax
shl esi, cl
xor cl, 0x1f
shr edx, cl
mov dword [rdi], ebx
or edx, esi
not ebx
imul edx, ebx
add rdi, 4
inc eax
cmp eax, 0xb
jne 0x140a533e8
lea rax, [fcn.140a5b770]
mov ecx, eax
and ecx, 1
xor ecx, eax
cmp ecx, 0xffffffff
sete cl
or cl, 6
mov al, 1
shl al, cl
or byte [0x140d16eff], al
lea rax, [fcn.140a5b770]
mov ecx, eax
and ecx, 1
xor ecx, eax
cmp ecx, 0xffffffff
sete cl
or cl, 6
xor cl, 7
mov al, 0xfe
rol al, cl
and byte [0x140d16eff], al
lea rdx, [0x140d16ed0]
mov rcx, r14
call fcn.140a52ab0
nop
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140a58b50
Capabilities:
Encode data using xor

Disassembly:
mov r8, qword [rcx]
mov rax, qword [rcx + 8]
mov r10, qword [rcx + 0x18]
mov r9, qword [rcx + 0x10]
xor r11d, r11d
add r8, rax
rol rax, 0xd
xor rax, r8
rol r8, 0x20
add r9, r10
rol r10, 0x10
xor r10, r9
add r8, r10
rol r10, 0x15
xor r10, r8
add r9, rax
rol rax, 0x11
xor rax, r9
rol r9, 0x20
inc r11d
cmp r11d, edx
jne 0x140a58b62
mov qword [rcx + 8], rax
mov qword [rcx], r8
mov qword [rcx + 0x18], r10
mov qword [rcx + 0x10], r9
ret
Function at 0x140ab1620
Capabilities:
Encode data using base64

Disassembly:
push rsi
push rdi
push rbx
mov r10, rdx
lea rax, [rdx + 2]
movabs rsi, 0xaaaaaaaaaaaaaaab
mul rsi
movabs rax, 0x7ffffffffffffffe
and rax, rdx
lea rdx, [rax + rax]
add rdx, 1
mov eax, 0x54
cmp qword [r9], rdx
jb 0x140ab1743
mov rax, r10
mul rsi
shr rdx, 1
lea r11, [rdx + rdx*2]
xor eax, eax
test r11, r11
jne 0x140ab1673
mov rdx, r8
jmp 0x140ab16db
lea rsi, [0x140cd1004]
mov rdx, r8
movzx edi, byte [rcx]
shr rdi, 2
mov bl, byte [rdi + rsi]
mov byte [rdx], bl
movzx edi, byte [rcx]
shl rdi, 4
movzx ebx, byte [rcx + 1]
shr rbx, 4
and edi, 0x30
or rdi, rbx
mov bl, byte [rsi + rdi]
mov byte [rdx + 1], bl
movzx edi, byte [rcx + 1]
movzx ebx, byte [rcx + 2]
shr rbx, 6
and edi, 0xf
lea rdi, [rbx + rdi*4]
mov bl, byte [rsi + rdi]
mov byte [rdx + 2], bl
movzx edi, byte [rcx + 2]
and edi, 0x3f
mov bl, byte [rdi + rsi]
mov byte [rdx + 3], bl
add rdx, 4
add rcx, 3
add rax, 3
cmp rax, r11
jb 0x140ab167d
cmp rax, r10
jae 0x140ab173b
movzx esi, byte [rcx]
inc rax
xor r11d, r11d
cmp rax, r10
jae 0x140ab16f3
movzx r11d, byte [rcx + 1]
mov rdi, rsi
shr rdi, 2
shl rsi, 4
mov ecx, r11d
shr rcx, 4
and esi, 0x30
or rsi, rcx
lea rcx, [0x140cd1004]
mov bl, byte [rdi + rcx]
mov byte [rdx], bl
mov bl, byte [rcx + rsi]
mov byte [rdx + 1], bl
mov bl, 0x3d
cmp rax, r10
jae 0x140ab1730
shl r11d, 2
and r11d, 0x3c
mov bl, byte [r11 + rcx]
mov byte [rdx + 2], bl
mov byte [rdx + 3], 0x3d
add rdx, 4
mov byte [rdx], 0
sub edx, r8d
xor eax, eax
mov qword [r9], rdx
pop rbx
pop rdi
pop rsi
ret
Function at 0x140b6100f
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
cmp edx, 2
jl 0x140b61073
mov r8d, edx
mov edx, 1
lea r9, [0x140d22a20]
lea r10, [0x140d22e20]
lea r11, [0x140d23220]
lea r14, [0x140d23620]
mov rsi, rdx
shl rsi, 4
movzx edi, byte [rcx + rsi]
movzx ebx, byte [rcx + rsi + 1]
mov ebx, dword [r10 + rbx*4]
xor ebx, dword [r9 + rdi*4]
movzx edi, byte [rcx + rsi + 2]
movzx eax, byte [rcx + rsi + 3]
xor ebx, dword [r11 + rdi*4]
xor ebx, dword [r14 + rax*4]
mov dword [rcx + rsi], ebx
movzx eax, byte [rcx + rsi + 4]
movzx edi, byte [rcx + rsi + 5]
mov edi, dword [r10 + rdi*4]
xor edi, dword [r9 + rax*4]
movzx eax, byte [rcx + rsi + 6]
movzx ebx, byte [rcx + rsi + 7]
xor edi, dword [r11 + rax*4]
xor edi, dword [r14 + rbx*4]
mov dword [rcx + rsi + 4], edi
movzx eax, byte [rcx + rsi + 8]
movzx edi, byte [rcx + rsi + 9]
mov edi, dword [r10 + rdi*4]
xor edi, dword [r9 + rax*4]
movzx eax, byte [rcx + rsi + 0xa]
movzx ebx, byte [rcx + rsi + 0xb]
xor edi, dword [r11 + rax*4]
xor edi, dword [r14 + rbx*4]
mov dword [rcx + rsi + 8], edi
movzx eax, byte [rcx + rsi + 0xc]
movzx edi, byte [rcx + rsi + 0xd]
mov edi, dword [r10 + rdi*4]
xor edi, dword [r9 + rax*4]
movzx eax, byte [rcx + rsi + 0xe]
xor edi, dword [r11 + rax*4]
movzx eax, byte [rcx + rsi + 0xf]
xor edi, dword [r14 + rax*4]
mov dword [rcx + rsi + 0xc], edi
inc rdx
cmp rdx, r8
jne 0x140b60fc2
xor eax, eax
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140b662e0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
test rcx, rcx
jne 0x140b66304
mov esi, 6
jmp 0x140b6643b
xor esi, esi
lea r13, [0x140cd4410]
lea rbx, [0x140cd4440]
lea r14, [0x140cd4460]
lea r15, [0x140b697d0]
mov r12d, r15d
not r12d
and r12d, 1
mov qword [rsp + 0x30], rsi
xor r8d, r8d
xor edi, edi
mov eax, r15d
add eax, r12d
sete dil
or edi, 0x2ac766a0
add edi, 0x288
xor edi, dword [r14 + r8*4]
mov ecx, edi
and cl, 7
mov r10d, 1
shl r10d, cl
mov rsi, qword [r13 + r8*8]
movzx eax, cl
xor cl, 7
mov edx, 1
shl edx, cl
mov r9d, dword [rbx + r8*4]
lea ebp, [r9 - 1]
movzx ecx, byte [rsi + rbp]
bt ecx, eax
jb 0x140b663fe
mov al, byte [rsi + rbp]
mov ecx, eax
or cl, dl
lock cmpxchg byte [rsi + rbp], cl
jne 0x140b66384
movzx eax, al
test edx, eax
je 0x140b663a1
movzx eax, byte [rsi + rbp]
test r10d, eax
je 0x140b66396
jmp 0x140b663fe
movzx eax, byte [rsi + rbp]
test r10d, eax
jne 0x140b663f9
add r9d, 0xfffffffc
shr r9d, 2
je 0x140b663e4
xor eax, eax
mov r11, rsi
mov ebx, dword [r11]
xor ebx, edi
mov r13d, edi
mov ecx, eax
shl r13d, cl
and cl, 0x1f
xor cl, 0x1f
shr edi, cl
mov dword [r11], ebx
or edi, r13d
not ebx
imul edi, ebx
add r11, 4
inc eax
cmp eax, r9d
jne 0x140b663b9
or byte [rsi + rbp], r10b
lea rbx, [0x140cd4410]
mov r13, rbx
lea rbx, [0x140cd4440]
not dl
and byte [rsi + rbp], dl
inc r8
cmp r8, 6
jne 0x140b66334
mov rsi, qword [rsp + 0x30]
lea rax, [0x140cd3180]
mov rdx, qword [rax + rsi*8]
mov rcx, qword [rsp + 0x28]
call fcn.140b6f030
test eax, eax
jne 0x140b6643b
inc rsi
cmp rsi, 6
jb 0x140b6632c
mov esi, 0xffffffff
mov eax, esi
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140b81800
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb8
mov edi, r9d
mov rbx, r8
mov ebp, edx
mov rsi, rcx
mov ecx, edx
call fcn.140a68860
test eax, eax
jne 0x140b81927
mov dword [rsi + 0x110], ebp
test edi, edi
jne 0x140b81841
mov eax, 0x20001
jmp 0x140b81927
movsxd rax, ebp
imul r14, rax, 0x78
lea r15, [0x140d8a1d0]
mov r13d, dword [r14 + r15 + 0xc]
mov eax, 0x16
cmp r13d, 0x80
ja 0x140b81927
lea r12, [r14 + r15]
add r12, 0x10
mov eax, dword [r12]
cmp eax, edi
jae 0x140b818b7
lea rcx, [rsp + 0x2c]
mov dword [rcx], eax
lea r9, [rsi + 0x228]
mov qword [rsp + 0x20], rcx
mov ecx, ebp
mov rdx, rbx
mov r8d, edi
call fcn.140a4d5c0
test eax, eax
jne 0x140b81927
mov edx, dword [r12]
cmp edx, r13d
jbe 0x140b818ec
sub edx, r13d
lea rcx, [rsi + r13]
add rcx, 0x228
jmp 0x140b818e3
mov ebp, edi
lea rcx, [rsi + 0x228]
mov rdx, rbx
mov r8, rbp
call fcn.1408daa80
mov edx, dword [r12]
mov eax, edx
sub eax, edi
jbe 0x140b818ec
lea rcx, [rsi + rbp]
add rcx, 0x228
mov rdx, rax
call fcn.1408dc370
mov edx, dword [r12]
test edx, edx
je 0x140b8190a
mov eax, edx
xor ecx, ecx
mov dl, byte [rsi + rcx + 0x228]
xor dl, 0x36
mov byte [rsp + rcx + 0x30], dl
inc rcx
cmp rcx, rax
jb 0x140b818f4
mov rcx, rsi
call qword [r14 + r15 + 0x58]
test eax, eax
jne 0x140b81927
mov r8d, dword [r12]
lea rdx, [rsp + 0x30]
mov rcx, rsi
call qword [r14 + r15 + 0x60]
nop
add rsp, 0xb8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140b819a0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x128
mov r15, r8
mov rdi, rdx
mov rbx, rcx
mov ebp, dword [rcx + 0x110]
mov ecx, ebp
call fcn.140a68860
test eax, eax
jne 0x140b81a9f
movsxd rax, ebp
imul rbp, rax, 0x78
lea rsi, [0x140d8a1d0]
mov r14d, dword [rbp + rsi + 0xc]
lea rdx, [rsp + 0xa0]
mov rcx, rbx
call qword [rbp + rsi + 0x68]
test eax, eax
jne 0x140b81a9f
mov eax, dword [rbp + rsi + 0x10]
test rax, rax
je 0x140b81a18
xor ecx, ecx
mov dl, byte [rbx + rcx + 0x228]
xor dl, 0x5c
mov byte [rsp + rcx + 0x20], dl
inc rcx
cmp rcx, rax
jb 0x140b81a02
mov rcx, rbx
call qword [rbp + rsi + 0x58]
test eax, eax
jne 0x140b81a9f
lea rax, [rsi + rbp]
add rax, 0x10
mov r8d, dword [rax]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [rax + 0x50]
test eax, eax
jne 0x140b81a9f
lea rax, [rsi + rbp]
add rax, 0x60
lea rdx, [rsp + 0xa0]
mov rcx, rbx
mov r8d, r14d
call qword [rax]
test eax, eax
jne 0x140b81a9f
lea rax, [rsi + rbp]
add rax, 0x68
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [rax]
test eax, eax
jne 0x140b81a9f
xor eax, eax
mov ecx, 0
test r14d, r14d
je 0x140b81a9c
xor edx, edx
xor ecx, ecx
mov ebp, dword [r15]
cmp rdx, rbp
jae 0x140b81a9a
mov bl, byte [rsp + rdx + 0x20]
mov byte [rdi + rdx], bl
inc rdx
inc ecx
cmp rdx, r14
jb 0x140b81a7f
jmp 0x140b81a9c
mov ecx, edx
mov dword [r15], ecx
add rsp, 0x128
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140b9ca90
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbp
push rbx
mov r10d, dword [rsp + 0x50]
mov ebp, dword [rsp + 0x48]
mov r11d, r10d
neg r11d
mov esi, ebp
neg esi
cmp r8, 0xc
jb 0x140b9cb5e
add esi, r11d
add esi, r9d
mov eax, r10d
shr eax, 0xd
xor eax, esi
add ebp, r11d
sub ebp, eax
mov esi, eax
shl esi, 8
xor esi, ebp
sub r10d, eax
sub r10d, esi
mov edi, esi
shr edi, 0xd
xor edi, r10d
sub eax, esi
sub eax, edi
mov r9d, edi
shr r9d, 0xc
xor r9d, eax
sub esi, edi
sub esi, r9d
mov eax, r9d
shl eax, 0x10
xor eax, esi
sub edi, r9d
sub edi, eax
mov esi, eax
shr esi, 5
xor esi, edi
sub r9d, eax
sub r9d, esi
mov ebx, esi
shr ebx, 3
xor ebx, r9d
sub eax, esi
sub eax, ebx
mov edi, ebx
shl edi, 0xa
xor edi, eax
sub esi, ebx
sub esi, edi
mov eax, edi
shr eax, 0xf
xor eax, esi
mov r9d, dword [rdx]
mov ebp, dword [rdx + 4]
mov r10d, dword [rdx + 8]
xor ebx, r9d
xor edi, ebp
xor eax, r10d
mov dword [rcx], ebx
mov dword [rcx + 4], edi
mov dword [rcx + 8], eax
add rdx, 0xc
add rcx, 0xc
add r8, 0xfffffffffffffff4
mov r11d, r10d
neg r11d
mov esi, ebp
neg esi
cmp r8, 0xb
ja 0x140b9cab1
test r8, r8
je case.default.0x140b9cbf5
dec r8
cmp r8, 0xa
ja case.default.0x140b9cbf5
add esi, r11d
add esi, r9d
mov eax, r10d
shr eax, 0xd
xor eax, esi
add ebp, r11d
sub ebp, eax
mov ebx, eax
shl ebx, 8
xor ebx, ebp
sub r10d, eax
sub r10d, ebx
mov ebp, ebx
shr ebp, 0xd
xor ebp, r10d
sub eax, ebx
sub eax, ebp
mov edi, ebp
shr edi, 0xc
xor edi, eax
sub ebx, ebp
sub ebx, edi
mov esi, edi
shl esi, 0x10
xor esi, ebx
sub ebp, edi
sub ebp, esi
mov eax, esi
shr eax, 5
xor eax, ebp
sub edi, esi
sub edi, eax
mov r9d, eax
shr r9d, 3
xor r9d, edi
sub esi, eax
sub esi, r9d
mov ebp, r9d
shl ebp, 0xa
xor ebp, esi
sub eax, r9d
sub eax, ebp
mov r10d, ebp
shr r10d, 0xf
xor r10d, eax
lea rax, [0x140b9cc70]
movsxd rbx, dword [rax + r8*4]
add rbx, rax
jmp rbx
mov eax, r10d
shr eax, 0x10
xor al, byte [rdx + 0xa]
mov byte [rcx + 0xa], al
mov eax, r10d
shr eax, 8
xor al, byte [rdx + 9]
mov byte [rcx + 9], al
xor r10b, byte [rdx + 8]
mov byte [rcx + 8], r10b
mov eax, ebp
shr eax, 0x18
xor al, byte [rdx + 7]
mov byte [rcx + 7], al
mov eax, ebp
shr eax, 0x10
xor al, byte [rdx + 6]
mov byte [rcx + 6], al
shr ebp, 8
xor bpl, byte [rdx + 5]
mov byte [rcx + 5], bpl
xor sil, byte [rdx + 4]
mov byte [rcx + 4], sil
mov eax, r9d
shr eax, 0x18
xor al, byte [rdx + 3]
mov byte [rcx + 3], al
mov eax, r9d
shr eax, 0x10
xor al, byte [rdx + 2]
mov byte [rcx + 2], al
mov eax, r9d
shr eax, 8
xor al, byte [rdx + 1]
mov byte [rcx + 1], al
xor r9b, byte [rdx]
mov byte [rcx], r9b
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x141122058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1411221df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141122089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14112206f
add dl, dl
jne 0x141122096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1411220f6
xor eax, eax
add dl, dl
jne 0x1411220a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1411221ad
add dl, dl
jne 0x1411220b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1411220c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1411220d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1411220dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1411220ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14112207e
mov eax, 1
add dl, dl
jne 0x141122106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141122113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1411220fb
sub eax, ebx
mov ebx, 1
jne 0x14112214c
mov ecx, 1
add dl, dl
jne 0x14112212e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14112213b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141122123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14112207e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141122168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141122175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14112215d
cmp eax, 0x7d00
jae 0x14112219b
cmp eax, 0x500
jb 0x141122196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14112207e
cmp eax, 0x7f
ja 0x14112219e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14112207e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1411221d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14112207e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x100001000
Capabilities:
Allocate or change rwx memory
Create thread
Enumerate process modules
Inject thread
Spawn thread to rwx shellcode
Terminate process

Disassembly:
sub rsp, 0x11f8
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], rsi
lea rcx, [rsp + 0x48]
mov edx, 0xfa0
lea r8, [rsp + 0xfe8]
call qword [sym.imp.kernel32.dll_K32EnumProcesses]
test al, al
je 0x100001196
mov esi, dword [rsp + 0xfe8]
mov ecx, 0x43a
xor rdx, rdx
mov r8d, dword [rsp + rsi + 0x44]
call qword [sym.imp.kernel32.dll_OpenProcess]
test rax, rax
je 0x100001093
mov rbp, rax
mov rcx, rbp
xor rdx, rdx
lea r8, [rsp + 0xfe8]
mov r9d, 0x100
call qword [sym.imp.kernel32.dll_K32GetModuleBaseNameW]
test eax, eax
je 0x10000108a
lea rcx, [rsp + 0xfe8]
lea rdx, [0x100006140]
call qword [sym.imp.kernel32.dll_lstrcmpiW]
test eax, eax
je 0x1000010ba
mov rcx, rbp
call qword [sym.imp.kernel32.dll_CloseHandle]
sub esi, 4
jne 0x100001038
xor rcx, rcx
lea rdx, [0x100006174]
lea r8, [0x100006170]
mov r9d, 0x10040
call qword [sym.imp.user32.dll_MessageBoxW]
jmp 0x1000011b3
mov rcx, rbp
xor rdx, rdx
mov r8d, 0xc650
mov r9d, 0x1000
mov dword [rsp + 0x20], pe_nt_image_headers64
call qword [sym.imp.kernel32.dll_VirtualAllocEx]
test rax, rax
je 0x10000118d
mov rsi, rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov rax, qword [rax]
mov rax, qword [rax]
mov rax, qword [rax + 0x30]
sub qword [sym.imp.kernel32.dll_LoadLibraryA], rax
sub qword [sym.imp.kernel32.dll_GetProcAddress], rax
mov rcx, rbp
mov rdx, rsi
lea r8, [entry0]
mov r9d, 0xc650
mov qword [rsp + 0x20], 0
call qword [sym.imp.kernel32.dll_WriteProcessMemory]
test al, al
je 0x100001175
mov rcx, rbp
xor rdx, rdx
mov r8d, 0x1000
lea r9, [rsi + 0x1ce]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rdx
call qword [sym.imp.kernel32.dll_CreateRemoteThread]
test rax, rax
je 0x100001175
mov rcx, rax
call qword [sym.imp.kernel32.dll_CloseHandle]
mov rcx, rbp
call qword [sym.imp.kernel32.dll_CloseHandle]
jmp 0x1000011b3
mov rcx, rbp
mov rdx, rsi
mov r8d, 0xc650
mov r9d, 0x4000
call qword [sym.imp.kernel32.dll_VirtualFreeEx]
mov rcx, rbp
call qword [sym.imp.kernel32.dll_CloseHandle]
xor rcx, rcx
lea rdx, [0x1000061a4]
lea r8, [0x100006170]
mov r9d, 0x10010
call qword [sym.imp.user32.dll_MessageBoxW]
xor rcx, rcx
call qword [sym.imp.kernel32.dll_ExitProcess]
Function at 0x140149e08
Capabilities:
Encode data using xor

Disassembly:
lea rsp, [rsp + 0x18]
je 0x140164f62
mov r8d, 0x7d8f2cb2
ror r8b, 0x62
bswap r8
push r10
lea r8, [0x14016fe38]
movzx r10d, byte [r9]
push 0xffffffffd7118212
xor r10d, edx
and r10d, 0xff
mov r10d, dword [r8 + r10*4]
shr edx, 8
xor edx, r10d
inc r9
xor edx, 0x66219c10
dec rax
lea rsp, [rsp + 8]
jne 0x140149e29
call fcn.140164f58
mov esi, 0xedb2388e
add sil, sil
movzx ebx, si
mov rsi, qword [r11 + rbx*2 - 0x7038]
ror ebx, 0xb5
mov rbx, qword [r11 + rbx*2 - 0x381bff8]
call fcn.14015ac04
not edx
mov dword [rbp + riz], edx
push 0x6924b217
call fcn.14014ad11
mov eax, 0x5fb0dd94
mov rdx, qword [r11 + rax - 0x5fb0dd94]
mov r9d, eax
lea r10, [r9 + r9*4 - 0x4ecfdfcd]
mov ebp, r10d
lea r11, [r11 + rax - 0x5fb0dd8c]
xchg rdx, r11
mov rbx, rdx
bswap rbp
jmp fcn.140149725

Function at 0x14016c6cb
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x908f37be
push r10
lea r10, [0x140158140]
mov edx, 0xc29b332b
movzx edx, byte [rsi]
xor edx, r11d
push 0x7539f188
and edx, 0xff
ror byte [rsp + 7], 0x62
mov edx, dword [r10 + rdx*4]
sub byte [rsp + 7], 0x20
shr r11d, 8
xor r11d, edx
inc rsi
xor r11d, 0x7d849b37
dec rcx
push 0xffffffff9b04982b
lea rsp, [rsp + 0x10]
jne 0x14013b960
pop r10
not r11d
push 0xffffffffd3b6203e
mov dword [r10], r11d
push 0xffffffffa3153986
lea rsp, [rsp + 0x10]
jmp fcn.14013a8c1
lea rsp, [rsp + 0x10]
je 0x14013b9aa
jmp 0x14013b952
Function at 0x140050600
Capabilities:
Write file on windows

Disassembly:
push rbp
sub rsp, 0x80
lea rbp, [rsp + 0x30]
lea r8, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov qword [rbp + 0x60], rcx
mov qword [rbp + 0x18], rsi
mov rsi, qword [rbp + 0x60]
mov qword [rbp + 0x10], rdi
mov rax, qword [0x1400b8bc0]
xor rax, rbp
mov qword [rbp + 0x40], rax
mov qword [rbp + 8], 0xfffffffffffffffe
mov qword [rsi], r8
cmp qword [rsi + 0x80], 0
je 0x140050658
mov rdi, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp rax, qword [rdi]
je 0x1400507f0
cmp byte [rsi + 0x7c], 0
je 0x140050780
cmp qword [rsi + 0x80], 0
je 0x140050722
mov rdi, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp rax, qword [rdi]
je 0x1400507c3
cmp qword [rsi + 0x68], 0
je 0x140050711
cmp byte [rsi + 0x71], 0
je 0x140050711
mov rax, qword [rsi]
mov rcx, rsi
mov edx, 0xffffffff
call qword [rax + 0x18]
mov rsi, qword [rbp + 0x60]
cmp eax, 0xffffffff
je 0x140050711
mov rdi, rsp
lea r8, [rbp + 0x20]
mov rcx, qword [rsi + 0x68]
add rsi, 0x74
mov rdx, rsi
lea r9, [rbp + 0x40]
lea rax, [rbp]
mov r10, qword [rcx]
mov qword [rdi + 0x20], rax
call qword [r10 + 0x40]
mov rsi, qword [rbp + 0x60]
test eax, eax
je 0x1400506e6
cmp eax, 1
je 0x1400506ea
cmp eax, 3
jne 0x140050711
mov byte [rsi + 0x71], 0
jmp 0x140050711
mov byte [rsi + 0x71], 0
mov r8, qword [rbp]
lea rax, [rbp + 0x20]
sub r8, rax
je 0x140050711
mov r9, qword [rsi + 0x80]
lea rcx, [rbp + 0x20]
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rsi, qword [rbp + 0x60]
mov rcx, qword [rsi + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rsi, qword [rbp + 0x60]
xor edx, edx
lea r10, [rsi + 8]
mov byte [rsi + 0x7c], dl
lea rdi, [rsi + 0x10]
mov byte [rsi + 0x71], dl
lea r11, [rsi + 0x28]
mov qword [rsi + 0x18], r10
lea r8, [rsi + 0x30]
mov qword [rsi + 0x20], rdi
lea rcx, [rsi + 0x48]
mov qword [rsi + 0x38], r11
lea r9, [rsi + 0x4c]
mov qword [rsi + 0x40], r8
xor eax, eax
mov qword [rdi], rax
mov qword [r8], rax
mov dword [r9], edx
mov qword [r10], rax
mov qword [r11], rax
mov dword [rcx], edx
mov rdi, qword [0x1400c5500]
mov qword [rsi + 0x50], rcx
mov qword [rsi + 0x58], r9
mov qword [rcx + 0x38], rax
mov qword [rsi + 0x74], rdi
mov qword [rsi + 0x68], rax
mov rax, qword [sym.imp.MSVCP140.dll_const_std::basic_streambuf_char__struct_std::char_traits_char__::vftable]
mov rcx, qword [rsi + 0x60]
mov qword [rsi], rax
test rcx, rcx
je 0x14005079d
mov edx, 1
call fcn.1400533c0
mov rcx, qword [rbp + 0x40]
mov qword [rbp + 0x40], 0
xor rcx, rbp
cmp rcx, qword [0x1400b8bc0]
jne 0x1400507ea
mov rsi, qword [rbp + 0x18]
mov rdi, qword [rbp + 0x10]
lea rsp, [rbp + 0x50]
pop rbp
ret
mov rax, qword [rsi + 0x88]
mov r8, qword [rsi + 0x90]
mov qword [rdi], rax
sub r8, rax
mov rdi, qword [rsi + 0x38]
mov qword [rdi], rax
mov r9, qword [rsi + 0x50]
mov dword [r9], r8d
jmp 0x140050681
call fcn.140097240
nop
mov rax, qword [rsi + 0x88]
mov r8, qword [rsi + 0x90]
mov qword [rdi], rax
sub r8, rax
mov rdi, qword [rsi + 0x38]
mov qword [rdi], rax
mov r9, qword [rsi + 0x50]
mov dword [r9], r8d
jmp 0x140050658