joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100416c20
Capabilities:
Get file attributes

Disassembly:
push rsi
push rbx
sub rsp, 0xa8
mov rbx, rdx
mov rsi, rcx
mov edx, 0x2e
mov rcx, rbx
call sub.msys_2.0.dll_strchr
test rax, rax
je 0x100416ce0
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.100428750
test eax, eax
jne 0x100416ce8
mov r9d, dword [rsp + 0x30]
lea rcx, [0x100431384]
xor eax, eax
xor r8d, r8d
nop dword [rax + rax]
movzx edx, byte [rbx + rax]
test dl, dl
je 0x100416c95
cmp byte [rcx - 4], dl
je 0x100416cb0
cmp dl, 0x2e
je 0x100416cb8
cmp dl, 0x2d
jne 0x100416c95
add rax, 1
add rcx, 8
cmp rax, 0xa
jne 0x100416c70
mov edx, r8d
mov rcx, rsi
add rsp, 0xa8
pop rbx
pop rsi
jmp 0x1004282e0
or r8d, dword [rcx]
jmp 0x100416c87
test rax, rax
je 0x100416cd0
mov edx, dword [rcx]
and edx, r9d
or r8d, edx
jmp 0x100416c87
add rcx, 8
mov eax, 1
jmp 0x100416c70
xor r9d, r9d
jmp 0x100416c5f
mov eax, 0xffffffff
add rsp, 0xa8
pop rbx
pop rsi
ret
jmp qword [sym.imp.msys_2.0.dll_chmod]
Function at 0x100417dd0
Capabilities:
Query environment variable

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, str.GNUPGHOME
lea rsi, str._.gnupg
call sub.msys_2.0.dll_getenv
mov rbx, rax
test rax, rax
je 0x100417df8
cmp byte [rax], 0
jne 0x100417e08
mov rax, rsi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rcx, rax
call fcn.100417d50
test rax, rax
mov rsi, rax
cmove rsi, rbx
xor edx, edx
mov rcx, rsi
call fcn.1004139e0
xor edx, edx
lea rcx, str._.gnupg
mov rbx, rax
call fcn.1004139e0
mov rcx, rbx
mov rdi, rax
mov rdx, rax
call fcn.100413a40
mov rcx, rdi
mov ebp, eax
call sub.msys_gcrypt_20.dll_gcry_free
mov rcx, rbx
call sub.msys_gcrypt_20.dll_gcry_free
test ebp, ebp
je 0x100417df8
mov rax, rsi
mov byte [0x10043b300], 1
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x1004199c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x20
xor eax, eax
cmp byte [rcx], 0
lea rdx, [rcx + 8]
jne 0x1004199db
jmp 0x100419a40
mov rcx, rax
movzx eax, byte [rcx]
sub eax, 0x30
cmp al, 9
ja 0x100419a50
lea rax, [rcx + 1]
cmp rax, rdx
jne 0x1004199d8
xor eax, eax
cmp byte [rcx + 1], 0x54
jne 0x100419a40
lea rdx, [rcx + 2]
add rcx, 8
jmp 0x100419a03
mov rdx, rbx
movzx eax, byte [rdx]
sub eax, 0x30
cmp al, 9
ja 0x100419a50
lea rbx, [rdx + 1]
cmp rbx, rcx
jne 0x100419a00
movzx ecx, byte [rcx]
cmp cl, 0x5a
jne 0x100419a26
movzx ecx, byte [rdx + 2]
lea rbx, [rdx + 2]
test cl, cl
je 0x100419a6b
jns 0x100419a58
cmp cl, 0x2c
setne al
cmp cl, 0x3a
setne dl
and eax, edx
xor eax, 1
movzx eax, al
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret
call sub.msys_2.0.dll___locale_ctype_ptr
movsx rdx, byte [rbx]
mov rcx, rdx
test byte [rdx + rax + 1], 8
je 0x100419a2c
mov eax, 1
add rsp, 0x20
pop rbx
ret
Function at 0x1004213f0
Capabilities:
Query environment variable

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
lea rcx, str.ASSUAN_DEBUG
mov rsi, rdx
call sub.msys_2.0.dll_getenv
mov rcx, rax
mov eax, pe_nt_image_headers64
test rcx, rcx
je 0x10042141a
call sub.msys_2.0.dll_atoi
mov rdx, rbx
lea rcx, [0x1004212d0]
mov dword [0x10043b478], eax
mov qword [0x10043b470], rsi
add rsp, 0x28
pop rbx
pop rsi
jmp 0x100427f80
jmp qword [sym.imp.msys_assuan_0.dll_assuan_set_log_cb]

Function at 0x100423310
Capabilities:
Query environment variable

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov r14, rcx
mov rdi, rdx
mov r12, r8
test r8, r8
je 0x100423333
mov dword [r8], 0
test r14, r14
je 0x1004233fb
test rdi, rdi
je 0x1004233fb
cmp byte [rdi], 0
je 0x1004233fb
mov rbp, qword [r14 + 8]
test rbp, rbp
je 0x100423387
mov r13, qword [r14 + 0x10]
xor ebx, ebx
nop dword [rax]
mov rsi, qword [r13 + rbx*8]
test rsi, rsi
je 0x10042337e
lea rcx, [rsi + 0xc]
mov rdx, rdi
call sub.msys_2.0.dll_strcmp
test eax, eax
je 0x100423410
add rbx, 1
cmp rbx, rbp
jne 0x100423360
mov rcx, rdi
call sub.msys_2.0.dll_getenv
mov rbx, rax
test rax, rax
je 0x100423480
cmp byte [rax], 0
je 0x100423440
mov rcx, rdi
call sub.msys_2.0.dll_strlen
mov r9, rbx
mov rdx, rdi
mov rcx, r14
mov dword [rsp + 0x20], 1
mov r8, rax
call fcn.100422d50
mov rbp, qword [r14 + 8]
test rbp, rbp
je 0x1004233fb
mov r13, qword [r14 + 0x10]
xor ebx, ebx
nop dword [rax]
mov rsi, qword [r13 + rbx*8]
test rsi, rsi
je 0x1004233f2
lea rcx, [rsi + 0xc]
mov rdx, rdi
call sub.msys_2.0.dll_strcmp
test eax, eax
je 0x100423410
add rbx, 1
cmp rbx, rbp
jne 0x1004233d8
xor eax, eax
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
test r12, r12
je 0x100423424
mov eax, dword [rsi + 8]
test eax, eax
je 0x100423424
mov dword [r12], 1
mov rax, qword [rsi]
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
lea rdx, str.GPG_TTY
mov rcx, rdi
call sub.msys_2.0.dll_strcmp
test eax, eax
jne 0x1004233a4
xor ecx, ecx
call sub.msys_2.0.dll_ttyname
test rax, rax
je 0x1004233a4
xor ecx, ecx
call sub.msys_2.0.dll_ttyname
mov rbx, rax
test rax, rax
jne 0x1004233a4
jmp 0x1004233fb
lea rdx, str.GPG_TTY
mov rcx, rdi
call sub.msys_2.0.dll_strcmp
test eax, eax
jne 0x1004233fb
xor ecx, ecx
call sub.msys_2.0.dll_ttyname
test rax, rax
jne 0x100423467
jmp 0x1004233fb
Function at 0x1004256e0
Capabilities:
Get file attributes

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xa0
call fcn.1004253e0
mov edx, 4
mov ecx, 0x20
mov r13d, eax
call sub.msys_2.0.dll_calloc
mov r12, rax
test rax, rax
je 0x1004257c7
test r13d, r13d
jle 0x1004257a4
xor esi, esi
xor ebx, ebx
lea r14, [rsp + 0x20]
mov edi, 0x20
jmp 0x100425776
lea ebp, [rsi + 1]
movsxd rax, ebp
cmp rax, rdi
jb 0x100425767
cmp rdi, 0x100
mov rcx, r12
sbb rax, rax
and al, 0x20
lea rdi, [rdi + rax + 0x100]
lea rdx, [rdi*4]
call sub.msys_2.0.dll_realloc
test rax, rax
je 0x1004257bf
mov r12, rax
mov dword [r12 + rsi*4], ebx
add ebx, 1
movsxd rsi, ebp
cmp r13d, ebx
je 0x1004257a0
mov rdx, r14
mov ecx, ebx
call sub.msys_2.0.dll_fstat
cmp eax, 0xffffffff
jne 0x100425730
call sub.msys_2.0.dll___errno
cmp dword [rax], 9
jne 0x100425730
add ebx, 1
cmp r13d, ebx
jne 0x100425776
nop word [rax + rax]
lea rax, [r12 + rsi*4]
mov dword [rax], 0xffffffff
mov rax, r12
add rsp, 0xa0
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rcx, r12
call sub.msys_2.0.dll_free
xor r12d, r12d
jmp 0x1004257aa
Function at 0x1407cb1b8
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1407cb33f
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1407cb1e9
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407cb1cf
add dl, dl
jne 0x1407cb1f6
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407cb256
xor eax, eax
add dl, dl
jne 0x1407cb205
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407cb30d
add dl, dl
jne 0x1407cb216
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407cb223
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407cb230
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407cb23d
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1407cb24a
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1407cb1de
mov eax, 1
add dl, dl
jne 0x1407cb266
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407cb273
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407cb25b
sub eax, ebx
mov ebx, 1
jne 0x1407cb2ac
mov ecx, 1
add dl, dl
jne 0x1407cb28e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1407cb29b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407cb283
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1407cb1de
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1407cb2c8
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1407cb2d5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407cb2bd
cmp eax, 0x7d00
jae 0x1407cb2fb
cmp eax, 0x500
jb 0x1407cb2f6
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1407cb1de
cmp eax, 0x7f
ja 0x1407cb2fe
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1407cb1de
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1407cb332
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1407cb1de
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400026f0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rdi
cmp dword [0x1401448a4], 0
lea rdi, [0x1401448a0]
mov r11d, r8d
mov r9d, edx
mov r10, rcx
jne 0x1400027c8
mov qword [rsp + 0x10], rbx
xor edx, edx
mov rbx, rdi
nop dword [rax]
mov r8d, edx
lea rbx, [rbx + 4]
and r8d, 1
mov eax, edx
shr eax, 1
neg r8d
and r8d, 0xedb88320
inc edx
xor r8d, eax
mov eax, r8d
shr r8d, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, r8d
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [rbx - 4], eax
cmp edx, 0x100
jb 0x140002720
mov rbx, qword [rsp + 0x10]
not r11d
mov eax, r11d
test r9d, r9d
jle 0x1400027fe
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [r10]
lea r10, [r10 + 1]
movzx edx, al
xor rdx, rcx
shr eax, 8
xor eax, dword [rdi + rdx*4]
sub r9d, 1
jne 0x1400027e0
not eax
pop rdi
ret
movzx r9d, byte [r10]
lea r8, [r10 + 1]
test r9b, r9b
je 0x14000283f
nop dword [rax + rax]
cmp r9b, 0x23
jne 0x140002823
cmp byte [r8], r9b
jne 0x140002823
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rdi + rdx*4]
test r9b, r9b
jne 0x140002810
not eax
pop rdi
ret
Function at 0x140011f60
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push r15
sub rsp, 0x20
mov rbx, qword [0x140144590]
xor esi, esi
mov r15, rcx
mov dword [rbx + 0x2d9c], esi
test rcx, rcx
je 0x14001208a
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rdi
lea rdi, [rbx + 0x2da0]
mov dword [rbx + 0x2d9c], esi
mov r8d, dword [rdi + 4]
test r8d, r8d
jns 0x140011fc2
mov eax, r8d
mov rcx, rdi
cdq
sub eax, edx
mov edx, esi
sar eax, 1
add eax, r8d
test eax, eax
cmovg edx, eax
call fcn.140012ef0
mov r8d, dword [rdi + 4]
mov dword [rdi], esi
mov eax, esi
test r8d, r8d
jne 0x140011fd9
lea edx, [r8 + 8]
mov rcx, rdi
call fcn.140012ef0
mov eax, dword [rdi]
movsxd rcx, eax
mov ebp, esi
mov rax, qword [rdi + 8]
mov byte [rcx + rax], sil
inc dword [rdi]
cmp dword [rbx + 0x2db0], esi
jle 0x14001202a
mov qword [rsp + 0x50], r14
mov r14, rsi
nop dword [rax + rax]
mov r9, qword [rbx + 0x2db8]
mov r8, rdi
add r9, r14
mov rcx, rbx
mov rdx, r9
call qword [r9 + 0x20]
inc ebp
add r14, 0x30
cmp ebp, dword [rbx + 0x2db0]
jl 0x140012000
mov r14, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x40]
cmp qword [rdi + 8], rsi
je 0x140012039
mov esi, dword [rdi]
dec esi
mov rax, qword [rbx + 0x2da8]
lea rdi, [0x140144588]
test rax, rax
movsxd rsi, esi
lea rdx, [0x140046c74]
mov rcx, r15
cmovne rdi, rax
call fcn.140002850
mov rbx, rax
test rax, rax
je 0x140012085
mov r9, rax
mov r8, rsi
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rsi
pop rbx
ret
Function at 0x140019d10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r11, rsp
push rbp
push r13
push r14
sub rsp, 0xb0
xor eax, eax
movsxd r13, r9d
mov dword [rsp + 0xe8], eax
mov r14, rdx
mov qword [rsp + 0x60], r13
mov rbp, rcx
test r9d, r9d
jle 0x140019f5e
mov qword [r11 + 8], rbx
lea rbx, [r8 + 0x20]
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
mov qword [r11 - 0x20], r12
xor r12d, r12d
mov qword [r11 - 0x28], r15
movaps xmmword [r11 - 0x38], xmm6
movaps xmmword [r11 - 0x48], xmm7
xorps xmm7, xmm7
movaps xmmword [r11 - 0x58], xmm8
mov r11d, 0x100
movss xmm8, dword [0x1400561e0]
nop dword [rax + rax]
movss xmm6, dword [rbx - 0x20]
comiss xmm6, xmm7
jbe 0x140019dcc
movsxd r10, dword [r14 + 0x24]
mov r9, qword [r14 + 8]
movsx ecx, r11w
movzx eax, byte [r10 + r9 + 7]
movzx edx, byte [r10 + r9 + 6]
imul edx, ecx
movsx ecx, r11w
add dx, ax
movzx eax, byte [r10 + r9 + 5]
movsx r8d, dx
movzx edx, byte [r10 + r9 + 4]
imul edx, ecx
add ax, dx
cwde
sub eax, r8d
movd xmm0, eax
jmp 0x140019deb
movsxd rdx, dword [r14 + 0x1c]
xorps xmm6, xmm8
mov rax, qword [r14 + 8]
movzx ecx, byte [rdx + rax + 0x12]
movzx eax, byte [rdx + rax + 0x13]
shl ecx, 8
add ecx, eax
movd xmm0, ecx
movzx eax, byte [rbp + 0x20]
xor edi, edi
cvtdq2ps xmm0, xmm0
mov byte [rbx], al
movzx eax, byte [rbp + 0x24]
mov byte [rbx + 1], al
divss xmm6, xmm0
cmp dword [rbx - 0x10], edi
jle 0x140019f06
mov r15, qword [rsp + 0xf0]
mov rax, r12
mov r13d, dword [rsp + 0xe8]
add r15, 6
shl rax, 4
xor esi, esi
add r15, rax
nop word [rax + rax]
mov rax, qword [rbx - 0x18]
test rax, rax
jne 0x140019e40
mov edx, dword [rbx - 0x1c]
add edx, edi
jmp 0x140019e43
mov edx, dword [rax + rsi]
mov eax, dword [rbp + 0x24]
xorps xmm3, xmm3
xorps xmm2, xmm2
mov rcx, r14
cvtsi2ss xmm3, rax
mov eax, dword [rbp + 0x20]
cvtsi2ss xmm2, rax
mulss xmm3, xmm6
mulss xmm2, xmm6
call fcn.140014de0
mov edx, eax
mov rcx, r14
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
movss dword [rsp + 0x28], xmm7
movss dword [rsp + 0x20], xmm7
call fcn.1400176d0
movzx eax, word [rbp + 0x20]
inc r13d
sub ax, word [rsp + 0x50]
inc r12
dec ax
inc edi
add ax, word [rbp + 0x1c]
add rsi, 4
add ax, word [rsp + 0x54]
mov word [r15 - 2], ax
movzx eax, word [rbp + 0x24]
sub ax, word [rsp + 0x58]
dec ax
add ax, word [rbp + 0x1c]
add ax, word [rsp + 0x5c]
mov word [r15], ax
add r15, 0x10
cmp edi, dword [rbx - 0x10]
jl 0x140019e30
mov dword [rsp + 0xe8], r13d
mov r11d, 0x100
mov r13, qword [rsp + 0x60]
add rbx, 0x28
sub r13, 1
mov qword [rsp + 0x60], r13
jne 0x140019d80
mov eax, dword [rsp + 0xe8]
movaps xmm8, xmmword [rsp + 0x70]
movaps xmm7, xmmword [rsp + 0x80]
movaps xmm6, xmmword [rsp + 0x90]
mov r15, qword [rsp + 0xa0]
mov r12, qword [rsp + 0xa8]
mov rdi, qword [rsp + 0xe0]
mov rsi, qword [rsp + 0xd8]
mov rbx, qword [rsp + 0xd0]
add rsp, 0xb0
pop r14
pop r13
pop rbp
ret
Function at 0x14002fb60
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x18], 0
je 0x14002fb83
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 7]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x17
jb 0x14002fb70
mov byte [rcx + 0x18], 0
mov rax, rcx
ret
Function at 0x1400327e0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rdi
sub rsp, 0x50
mov rax, qword [0x14005e010]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor eax, eax
mov dword [rsp + 0x2c], edx
mov edx, 0x1000
mov dword [rsp + 0x28], ecx
xor ecx, ecx
mov dword [rsp + 0x20], eax
mov r8d, edx
mov dword [rsp + 0x30], eax
lea r9d, [rax + 0x40]
mov qword [rsp + 0x34], 1
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
jne 0x14003283f
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140043070
add rsp, 0x50
pop rdi
ret
movups xmm0, xmmword [0x140144850]
mov r8d, 0x28
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x20]
movups xmmword [rax], xmm0
movsd xmm1, qword [0x140144860]
lea ecx, [r8 - 0x27]
movsd qword [rax + 0x10], xmm1
mov eax, dword [0x140144868]
mov dword [rdi + 0x18], eax
movzx eax, word [0x14014486c]
mov word [rdi + 0x1c], ax
call rdi
xor edx, edx
mov r8d, 0x1000
mov rcx, rdi
mov ebx, eax
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test ebx, ebx
mov rbx, qword [rsp + 0x70]
setg al
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140043070
add rsp, 0x50
pop rdi
ret

Function at 0x1400328c0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x13c0
call fcn.140044550
sub rsp, rax
mov rax, qword [0x14005e010]
xor rax, rsp
mov qword [rsp + 0x13b0], rax
mov edi, edx
mov ebx, ecx
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rsp + 0x13a4], 0xffffffff
mov r8d, 1
mov dword [rsp + 0x24], eax
nop
mov r9d, eax
shr r9d, 0x1e
xor r9d, eax
imul eax, r9d, 0x6c078965
add eax, r8d
mov dword [rsp + r8*4 + 0x24], eax
inc r8
cmp r8, 0x270
jb 0x140032910
lea eax, [rbx - 0x80000000]
mov dword [rsp + 0x20], 0x270
mov ebp, 0x80000000
cmp ebx, ebp
lea esi, [rbx + rbp]
cmovae esi, eax
lea ebx, [rdi + rbp]
cmp edi, ebp
lea eax, [rdi - 0x80000000]
cmovae ebx, eax
sub ebx, esi
cmp ebx, 0xffffffff
jne 0x140032973
lea rcx, [rsp + 0x20]
call fcn.140042cc0
mov edx, eax
jmp 0x1400329b1
lea edi, [rbx + 1]
xor r8d, r8d
xor eax, eax
test ebx, ebx
je 0x140032991
lea rcx, [rsp + 0x20]
call fcn.140042cc0
mov r8d, eax
mov eax, 0xffffffff
xor edx, edx
div edi
mov ecx, eax
mov r9d, edx
xor edx, edx
mov eax, r8d
div edi
cmp eax, ecx
jb 0x1400329aa
cmp r9d, ebx
jne 0x140032976
xor edx, edx
mov eax, r8d
div edi
add edx, esi
cmp edx, ebp
lea ecx, [rdx - 0x80000000]
lea eax, [rdx + rbp]
cmovae eax, ecx
mov rcx, qword [rsp + 0x13b0]
xor rcx, rsp
call fcn.140043070
lea r11, [rsp + 0x13c0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400329f0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x1340]
mov eax, 0x1440
call fcn.140044550
sub rsp, rax
mov rax, qword [0x14005e010]
xor rax, rsp
mov qword [rbp + 0x1330], rax
mov r15d, edx
mov rbx, rcx
mov qword [rsp + 0x70], rcx
xor edi, edi
mov dword [rsp + 0x20], edi
movdqa xmm0, xmmword [0x1400560b0]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [0x140056050]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmm0, xmmword [0x140056040]
movdqa xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x60], 0x40404040
mov dword [rsp + 0x64], 0xd0f0d0b
mov dword [rsp + 0x68], 0x7577750b
mov dword [rsp + 0x6c], 0x1007d7b
mov eax, edi
nop word [rax + rax]
lea ecx, [rax + 7]
xor byte [rsp + rax + 0x30], cl
inc rax
cmp rax, 0x3e
jb 0x140032a90
mov byte [rsp + 0x6f], dil
mov qword [rsp + 0x78], rdi
mov qword [rbp - 0x78], rdi
mov qword [rbp - 0x70], 0xf
mov byte [rsp + 0x78], dil
lea rax, [rsp + 0x30]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], dil
jne 0x140032ac7
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x78]
call fcn.14003f4a0
nop
mov qword [rbx], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov edi, 1
mov dword [rsp + 0x20], edi
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov ecx, eax
mov dword [rbp + 0x1324], 0xffffffff
mov dword [rbp - 0x5c], eax
mov eax, ecx
shr eax, 0x1e
xor eax, ecx
imul ecx, eax, 0x6c078965
add ecx, edi
mov dword [rbp + rdi*4 - 0x5c], ecx
inc rdi
cmp rdi, 0x270
jb 0x140032b10
mov dword [rbp - 0x60], 0x270
mov r14, qword [rbp - 0x70]
mov rsi, qword [rsp + 0x78]
test r15d, r15d
jle 0x140032be4
mov rdi, r15
nop dword [rax + rax]
lea rcx, [rbp - 0x60]
call fcn.140042cc0
mov r8d, eax
mov eax, 0x8421085
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 4
cmp eax, 0x8421084
jae 0x140032b50
mov eax, 0x8421085
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 4
imul eax, eax, 0x1f
sub r8d, eax
lea rcx, [rsp + 0x78]
cmp r14, 0x10
cmovae rcx, rsi
movsxd rax, r8d
movzx r9d, byte [rax + rcx]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x140032bd2
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x140032bc7
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x140032bda
mov rcx, rbx
call fcn.140042130
sub rdi, 1
jne 0x140032b50
cmp r14, 0x10
jb 0x140032c1e
lea rdx, [r14 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140032c16
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140032c16
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.140043618
mov rax, rbx
mov rcx, qword [rbp + 0x1330]
xor rcx, rsp
call fcn.140043070
lea r11, [rsp + 0x1440]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140032c50
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xf0
mov rax, qword [0x14005e010]
xor rax, rsp
mov qword [rbp + 0x4f], rax
mov edx, 9
lea rcx, [rbp + 0x1f]
call fcn.1400329f0
lea rax, [0x1400369e0]
mov dword [rbp - 0x39], 0x50
xor ebx, ebx
mov qword [rbp - 0x31], rax
xor ecx, ecx
mov dword [rbp - 0x35], 0x40
mov qword [rbp - 0x29], rbx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp qword [rbp + 0x37], 0x10
lea rcx, [rbp - 0x39]
mov qword [rbp - 0x21], rax
xorps xmm0, xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x19], xmm0
lea rax, [rbp + 0x1f]
movdqa xmmword [rbp - 9], xmm1
cmovae rax, qword [rbp + 0x1f]
mov qword [rbp + 7], rax
mov qword [rbp + 0xf], rbx
call qword [sym.imp.USER32.dll_RegisterClassExA]
mov rcx, qword [0x1401447a8]
lea rdx, [0x1401447b0]
call qword [sym.imp.USER32.dll_GetClientRect]
mov rcx, qword [0x1401447a8]
lea rdx, [rbp + 0x17]
mov qword [rbp + 0x17], rbx
call qword [sym.imp.USER32.dll_ClientToScreen]
mov r9d, dword [0x1401447bc]
lea r8, [rbp + 0x1f]
cmp qword [rbp + 0x37], 0x10
lea rdx, [rbp + 0x1f]
mov eax, dword [rbp + 0x17]
mov r10d, dword [0x1401447b8]
cmovae r8, qword [rbp + 0x1f]
cmovae rdx, qword [rbp + 0x1f]
xor ecx, ecx
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x38], r9d
mov dword [rsp + 0x30], r10d
mov dword [0x1401447b0], eax
mov eax, dword [rbp + 0x1b]
mov dword [0x1401447a0], r9d
mov r9d, 0x90000000
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
mov dword [0x1401447b4], eax
mov dword [0x1401445a8], r10d
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov qword [0x140144828], rax
test rax, rax
jne 0x140032d91
lea ecx, [rbx + 2]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
movdqa xmm0, xmmword [0x140054d90]
lea rdx, [rbp + 0x3f]
mov rcx, rax
movdqu xmmword [rbp + 0x3f], xmm0
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov rcx, qword [0x140144828]
mov edx, 0xffffffec
mov r8d, 0x800a0
call qword [sym.imp.USER32.dll_SetWindowLongA]
mov rcx, qword [0x140144828]
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x140144828]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov rdx, qword [rbp + 0x37]
cmp rdx, 0x10
jb 0x140032e20
mov rcx, qword [rbp + 0x1f]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032e1b
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140032e1b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140043618
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.140043070
mov rbx, qword [rsp + 0x100]
add rsp, 0xf0
pop rbp
ret
Function at 0x140036c10
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xc], 0
je 0x140036c33
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 7]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xb
jb 0x140036c20
mov byte [rcx + 0xc], 0
mov rax, rcx
ret