joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001090
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
xor r9d, r9d
test r8, r8
je 0x1400010c4
movabs r10, 0x100000001b3
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r9 + rdx]
inc r9
xor rcx, rax
imul rcx, r10
cmp r9, r8
jb 0x1400010b0
mov rax, rcx
ret

Function at 0x140002b30
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov r9, qword [rcx + 0x18]
mov r8, qword [rcx + 0x10]
mov rdx, qword [rcx + 8]
mov rcx, qword [rcx]
mov r9d, dword [r9]
mov r8d, dword [r8]
mov rdx, qword [rdx]
mov rcx, qword [rcx]
jmp qword [sym.imp.WS2_32.dll_recv]

Function at 0x140002b60
Capabilities:
Send data
Send data on socket

Disassembly:
mov r9, qword [rcx + 0x18]
mov r8, qword [rcx + 0x10]
mov rdx, qword [rcx + 8]
mov rcx, qword [rcx]
mov r9d, dword [r9]
mov r8d, dword [r8]
mov rdx, qword [rdx]
mov rcx, qword [rcx]
jmp qword [sym.imp.WS2_32.dll_send]

Function at 0x140002c10
Capabilities:
Get socket status

Disassembly:
sub rsp, 0x38
mov rax, qword [rcx]
mov rdx, rcx
xor r9d, r9d
xor r8d, r8d
mov ecx, dword [rax]
mov rax, qword [rdx + 0x10]
inc ecx
mov rdx, qword [rdx + 8]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_select]
add rsp, 0x38
ret

Function at 0x140002c40
Capabilities:
Get socket status

Disassembly:
sub rsp, 0x38
mov rax, qword [rcx]
mov r8, rcx
xor r9d, r9d
xor edx, edx
mov ecx, dword [rax]
mov rax, qword [r8 + 0x10]
inc ecx
mov r8, qword [r8 + 8]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_select]
add rsp, 0x38
ret

Function at 0x140002c70
Capabilities:
Get socket status

Disassembly:
sub rsp, 0x38
mov rax, qword [rcx]
mov rdx, rcx
mov ecx, dword [rax]
mov rax, qword [rdx + 0x20]
inc ecx
mov r9, qword [rdx + 0x18]
mov r8, qword [rdx + 0x10]
mov rdx, qword [rdx + 8]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_select]
add rsp, 0x38
ret
Function at 0x140003230
Capabilities:
Resolve dns

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x468
mov rax, qword [0x140048028]
xor rax, rsp
mov qword [rsp + 0x450], rax
movzx eax, word [rcx]
mov rbx, r9
mov rsi, r8
mov ebp, edx
mov rdi, rcx
cmp ax, 2
je 0x140003268
cmp ax, 0x17
jne 0x1400032e1
movzx ecx, word [rcx + 2]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
xor edx, edx
lea rcx, [rsp + 0x40]
mov dword [rbx], eax
mov r8d, 0x401
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x40]
call fcn.14000a5a0
lea rcx, [rsp + 0x40]
mov rbx, rax
call fcn.14000a590
xor ecx, ecx
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], ecx
mov r9d, ebx
mov qword [rsp + 0x20], rcx
mov r8, rax
mov rcx, rdi
mov edx, ebp
call qword [sym.imp.WS2_32.dll_getnameinfo]
test eax, eax
jne 0x1400032e1
lea rcx, [rsp + 0x40]
call fcn.14000a590
mov rdx, rax
mov rcx, rsi
call fcn.14000e470
mov al, 1
jmp 0x1400032e3
xor al, al
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.14003a630
add rsp, 0x468
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140003d30
Capabilities:
Encode data using base64

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xe8
mov rax, qword [0x140048028]
xor rax, rsp
mov qword [rsp + 0xd0], rax
movzx edi, r9b
mov byte [rsp + 0x20], r9b
mov rbx, r8
mov r13, rcx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0xa0], rcx
xor esi, esi
mov dword [rsp + 0x24], esi
lea r8, [0x14003e9f8]
lea rcx, [rsp + 0x50]
call fcn.140014fe0
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.1400151a0
mov rbx, rax
lea rcx, [rsp + 0x28]
call fcn.14000e870
mov dword [rsp + 0x24], 4
mov rcx, rbx
call fcn.14000dde0
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.14000dd70
lea ebp, [rsi - 6]
mov rcx, rbx
call fcn.14000ddf0
mov r15, rax
mov rcx, rbx
call fcn.14000dfb0
mov r12, rax
cmp r15, rax
je 0x140003e80
lea r13, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
nop dword [rax]
shl esi, 8
movzx eax, byte [r15]
add esi, eax
add ebp, 8
js 0x140003e45
movsxd r14, esi
movsxd rbx, ebp
lea ecx, [rbp + 6]
mov eax, 0xaaaaaaab
mul ecx
shr edx, 2
mov edi, edx
imul eax, edx, 0xfffffffa
add ebp, eax
nop dword [rax + rax]
mov rdx, r14
mov rcx, rbx
sar rdx, cl
and edx, 0x3f
movzx edx, byte [rdx + r13]
lea rcx, [rsp + 0x28]
call fcn.14000de70
sub rbx, 6
sub rdi, 1
jne 0x140003e20
inc r15
cmp r15, r12
jne 0x140003df0
cmp ebp, 0xfffffffa
mov r13, qword [rsp + 0x48]
jle 0x140003e7b
shl esi, 8
movsxd rdx, esi
lea ecx, [rbp + 8]
sar rdx, cl
and edx, 0x3f
lea rax, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
movzx edx, byte [rdx + rax]
lea rcx, [rsp + 0x28]
call fcn.14000de70
movzx edi, byte [rsp + 0x20]
lea rcx, [rsp + 0x28]
call fcn.14000dde0
test al, 3
je 0x140003eaa
nop
mov dl, 0x3d
lea rcx, [rsp + 0x28]
call fcn.14000de70
lea rcx, [rsp + 0x28]
call fcn.14000dde0
test al, 3
jne 0x140003e90
lea r8, [rsp + 0x28]
lea rdx, str.Basic
lea rcx, [rsp + 0xb0]
call fcn.140015470
nop
lea rcx, [rsp + 0x28]
call fcn.14000e5c0
nop
lea rcx, [rsp + 0x78]
call fcn.14000e5c0
nop
lea rcx, [rsp + 0x50]
call fcn.14000e5c0
lea rcx, str.Proxy_Authorization
lea rax, str.Authorization
test dil, dil
cmovne rax, rcx
mov qword [rsp + 0xa0], rax
lea r8, [rsp + 0xb0]
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x50]
call fcn.140015540
nop
mov rdx, rax
mov rcx, r13
call fcn.1400154e0
nop
lea rcx, [rsp + 0x58]
call fcn.14000e5c0
nop
lea rcx, [rsp + 0xb0]
call fcn.14000e5c0
mov rax, r13
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.14003a630
add rsp, 0xe8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1400045e0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0xc0
mov rax, qword [0x140048028]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rcx, qword [rcx + 8]
mov rdi, r8
mov rbx, rdx
mov dword [rsp + 0x20], 0x80
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x140004639
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov r9, rdi
mov r8, rbx
call fcn.140003230
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.14003a630
mov rbx, qword [rsp + 0xe8]
add rsp, 0xc0
pop rdi
ret
Function at 0x14000ab20
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x50]
cmp qword [rax + 0x68], 0
je 0x14000ab59
mov r8, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x14000aca3
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x40]
cmp qword [rax], 0
je 0x14000ab83
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x58]
mov eax, dword [rax]
mov dword [rsp + 0x20], eax
jmp 0x14000ab8b
mov dword [rsp + 0x20], 0
movsxd rax, dword [rsp + 0x20]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x60], 0
jle 0x14000ac4b
cmp qword [rsp + 0x28], 0
jle 0x14000ac4b
mov rax, qword [rsp + 0x28]
cmp qword [rsp + 0x60], rax
jge 0x14000abc3
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x40]
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
mov r8, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x30]
call fcn.1400022d0
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x58]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x58]
mov ecx, dword [rsp + 0x28]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 0x58]
mov dword [rcx], eax
movsxd rax, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 0x40]
add rax, qword [rcx]
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 0x40]
mov qword [rcx], rax
cmp qword [rsp + 0x60], 0
jle 0x14000ac93
mov rax, qword [rsp + 0x50]
cmp qword [rax + 0x80], 0
je 0x14000ac93
mov rax, qword [rsp + 0x50]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x60]
mov edx, 1
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
add rsp, 0x48
ret
Function at 0x14000f2b0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xb8
mov rax, qword [0x140048028]
xor rax, rsp
mov qword [rsp + 0xa8], rax
mov rax, qword [rsp + 0xc0]
cmp qword [rax + 0x68], 0
je 0x14000f2ed
mov rax, qword [rsp + 0xc0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14000f2f4
mov al, 1
jmp 0x14000f475
mov rax, qword [rsp + 0xc0]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x60], rax
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x38], 0xffffffff
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0xc0]
call qword [rsp + 0x60]
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x48], 0xffffffff
mov eax, dword [rsp + 0x44]
cmp dword [rsp + 0x48], eax
jne 0x14000f348
mov dword [rsp + 0x3c], 1
jmp 0x14000f350
mov dword [rsp + 0x3c], 0
movzx eax, byte [rsp + 0x3c]
mov byte [rsp + 0x30], al
movzx eax, byte [rsp + 0x30]
test eax, eax
je 0x14000f369
xor al, al
jmp 0x14000f475
mov qword [rsp + 0x70], 0x20
mov rax, qword [rsp + 0xc0]
mov rax, qword [rax + 0x68]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0xa0]
mov rcx, qword [rsp + 0xc0]
add rcx, 0x74
lea rdx, [rsp + 0x78]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rsp + 0x80]
mov rdx, rcx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
je 0x14000f3dc
cmp dword [rsp + 0x34], 1
je 0x14000f3e8
cmp dword [rsp + 0x34], 3
je 0x14000f463
jmp 0x14000f473
mov rax, qword [rsp + 0xc0]
mov byte [rax + 0x71], 0
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x78]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
jbe 0x14000f43a
mov rax, qword [rsp + 0xc0]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x50]
mov edx, 1
lea rcx, [rsp + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp qword [rsp + 0x50], rax
je 0x14000f43a
xor al, al
jmp 0x14000f475
mov rax, qword [rsp + 0xc0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14000f454
mov dword [rsp + 0x40], 1
jmp 0x14000f45c
mov dword [rsp + 0x40], 0
movzx eax, byte [rsp + 0x40]
jmp 0x14000f475
mov rax, qword [rsp + 0xc0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x14000f475
xor al, al
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.14003a630
add rsp, 0xb8
ret
Function at 0x14003b2d0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14003b31a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14003b31a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14003b31a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14003b31a
cmp dword [rcx + 0x84], 0xe
jbe 0x14003b31a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14003b31c
xor al, al
add rsp, 0x28
ret
Function at 0x140001290
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x260
mov rax, qword [0x14000a040]
xor rax, rsp
mov qword [rsp + 0x250], rax
xor ebp, ebp
mov qword [rsp + 0x38], rcx
mov rsi, rcx
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor ecx, ecx
lea edx, [rbp + 0x1a]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
xorps xmm0, xmm0
lea rax, [rsp + 0x40]
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], rbp
mov rbx, 0xffffffffffffffff
mov qword [rsi + 0x18], rbp
nop dword [rax + rax]
inc rbx
cmp word [rax + rbx*2], bp
jne 0x140001300
add rbx, rbx
mov qword [rsi + 0x10], rbp
lea rax, [rsp + 0x40]
mov edi, 0xf
add rax, rbx
mov qword [rsi + 0x18], rdi
lea rcx, [rsp + 0x40]
cmp rcx, rax
jne 0x140001333
mov byte [rsi], bpl
jmp 0x14000140c
sar rbx, 1
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
ja 0x140001438
cmp rbx, rdi
jbe 0x1400013c9
mov rdi, rbx
or rdi, 0xf
cmp rdi, rax
jbe 0x140001386
mov rdi, rax
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400048f0
test rax, rax
je 0x1400013ae
lea rbp, [rax + 0x27]
and rbp, 0xffffffffffffffe0
mov qword [rbp - 8], rax
jmp 0x1400013c2
mov eax, 0x16
cmp rdi, rax
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x1400013b5
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000143e
jmp 0x14000136b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x1400013c2
call fcn.1400048f0
mov rbp, rax
mov qword [rsi], rbp
mov qword [rsi + 0x18], rdi
mov rax, rsi
cmp rdi, 0xf
jbe 0x1400013d5
mov rax, qword [rsi]
lea r8, [rsp + 0x40]
mov rdx, rax
mov r9, rbx
test rbx, rbx
je 0x140001404
nop word [rax + rax]
movzx ecx, byte [r8]
lea r8, [r8 + 2]
mov byte [rdx], cl
lea rdx, [rdx + 1]
sub r9, 1
jne 0x1400013f0
mov qword [rsi + 0x10], rbx
mov byte [rax + rbx], 0
mov rax, rsi
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400048d0
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.1400011b0
int3
call fcn.140001110
int3
Function at 0x140001ac0
Capabilities:
Create process on windows

Disassembly:
mov r11, rsp
push rbp
push rsi
push r12
push r14
lea rbp, [r11 - 0x5f]
sub rsp, 0xc8
mov rax, qword [0x14000a040]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov r14, qword [rcx + 0x10]
mov rsi, rcx
movabs rcx, 0x7fffffffffffffff
xor r12d, r12d
mov rax, rcx
sub rax, r14
cmp rax, 3
jb 0x140001ce4
cmp qword [rsi + 0x18], 0xf
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rdi
mov qword [r11 - 0x28], r15
jbe 0x140001b1c
mov rsi, qword [rsi]
lea r15, [r14 + 3]
mov ebx, 0xf
lea rdi, [rbp + 0xf]
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rbp + 0xf], xmm0
movdqu xmmword [rbp + 0x1f], xmm1
cmp r15, rbx
jbe 0x140001bb7
mov rbx, r15
or rbx, 0xf
cmp rbx, rcx
jbe 0x140001b79
movabs rax, 0x8000000000000000
mov rbx, rcx
add rax, 0x27
mov rcx, rax
call fcn.1400048f0
test rax, rax
je 0x140001ca4
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140001bb3
mov eax, 0x16
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140001ba1
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001cea
jmp 0x140001b5a
test rcx, rcx
je 0x140001bb0
call fcn.1400048f0
mov rdi, rax
jmp 0x140001bb3
mov rdi, r12
mov qword [rbp + 0xf], rdi
mov eax, dword [0x140006554]
lea rcx, [rdi + 3]
mov qword [rbp + 0x1f], r15
mov r8, r14
mov qword [rbp + 0x27], rbx
mov rdx, rsi
mov word [rdi], ax
movzx eax, byte [0x140006556]
mov byte [rdi + 2], al
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r15], r12b
lea rax, str.cmd.exe
cmp qword [rbp + 0x27], 0xf
lea rcx, [rbp - 0x69]
mov qword [rbp - 0x51], rax
xorps xmm0, xmm0
lea rax, [rbp + 0xf]
mov dword [rbp - 0x69], 0x70
cmova rax, qword [rbp + 0xf]
mov qword [rbp - 0x49], rax
xor eax, eax
mov qword [rbp - 1], rax
mov dword [rbp - 0x65], 0x40
mov qword [rbp - 0x61], r12
mov qword [rbp - 0x59], r12
mov qword [rbp - 0x41], r12
mov dword [rbp - 0x39], r12d
movups xmmword [rbp - 0x31], xmm0
movups xmmword [rbp - 0x21], xmm0
movups xmmword [rbp - 0x11], xmm0
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x140001c48
lea ebx, [rax - 1]
jmp 0x140001c72
mov rcx, qword [rbp - 1]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 1]
lea rdx, [rbp + 7]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rbp - 1]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [rbp + 7]
mov rdx, qword [rbp + 0x27]
cmp rdx, 0xf
jbe 0x140001cb0
mov rcx, qword [rbp + 0xf]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001cab
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001cab
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004934
mov rdi, qword [rsp + 0x100]
mov eax, ebx
mov rbx, qword [rsp + 0xf8]
mov r15, qword [rsp + 0xc0]
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.1400048d0
add rsp, 0xc8
pop r14
pop r12
pop rsi
pop rbp
ret
call fcn.1400011b0
int3
call fcn.140001110
int3
Function at 0x140003300
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x14000a040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14000332d
xor eax, eax
jmp 0x140003499
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140003367
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x140003367
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140003499
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14000348c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1400033aa
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x1400033d5
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140003491
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140003444
sub eax, 1
je 0x140003444
cmp eax, 2
jne 0x14000348c
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140003491
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140003472
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14000348c
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x140003491
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400048d0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140003780
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14000a040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140003853
cmp byte [rcx + 0x71], 0
je 0x140003853
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14000384f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140003814
sub eax, 1
je 0x140003818
cmp eax, 2
jne 0x14000384f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400048d0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140003846
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14000384f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1400037fc
xor al, al
jmp 0x1400037fc
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400048d0
add rsp, 0x60
pop rbx
ret

Function at 0x140005250
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000529a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000529a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000529a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000529a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000529a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000529c
xor al, al
add rsp, 0x28
ret
Function at 0x140004260
Capabilities:
Encode data using xor

Disassembly:
sub r11, 0xe4
xor r11, r11
sub rsi, rax
mov r10, qword [rsp + r11]
or r15, 2
mov r14, 0x5a5c677f
add r15, r11
mov r12, 0x5a5a3847
shl r11, 0x1f
xor r14, r12
lea r13, [r13 + 0xc8]
sub r10, r14
cmp rdi, rsi
mov r15, 0x248b8c41
push r12
pop r13
mov rax, 0x24837a19
xorps xmm2, xmm15
xor r15, rax
xor rsi, rdi
add r15, r10
sub r12, r14
mov r11, qword [r15]
pop rax
mov r12, rax
push r12
mov rdi, 0x5c6c49c2
sub r15, rbx
mov r12, 0x5c7d4022
sub rsi, 0x67
xor rdi, r12
xorps xmm9, xmm12
add rdi, r10
and rsi, r14
mov r13, 0x441cfb0c
add r14, r12
mov r15, 0x441c6753
nop
xor r13, r15
rol rbx, 0x25
mov r10, 0x99
lea rbx, [rbx + 0xf5]
mov r12, 0x9d
addps xmm6, xmm7
xor r10, r12
and rsi, 0x7a
push rdi
add rsi, 0xf3
push r13
sub rsi, 0xb8
push r11
subps xmm10, xmm5
sub rsp, 0x20
test r15, rax
mov rcx, rdi
xor r15, 0x3f
mov rdx, r13
rol r13, 0x31
mov r8, r10
pop r12
mov rdi, r12
push rdi
lea r9, [rsp]
xor r14, r10
call r11
xor r15, 0x78
add rsp, 0x20
or rbx, 0x8b
pop r12
subps xmm14, xmm2
pop r14
addps xmm13, xmm7
pop r13
addps xmm13, xmm1
xor r10, r10
and rdi, r11
lea rsi, [r13 + r10]
xchg r15, rdi
mov bl, byte [rsi]
mov rax, r11
xor bl, 0x61
or r15, r11
add bl, 0x70
test r11, rax
mov byte [rsi], bl
pop r15
mov rax, r15
push rax
inc r10
and rax, r11
cmp r10, r14
nop
jne 0x140004385
mov rdi, r11
mov r10, 0x7a
xor rbx, r15
mov r11, 0x5a
xorps xmm15, xmm3
xor r10, r11
and r15, rsi
push r13
test rsi, r15
sub rsp, 0x20
rol r15, 0x12
mov rcx, r13
nop
mov rdx, r14
lea rax, [rax + 0xf4]
mov r8, r10
pop r10
mov r11, r10
push r11
lea r9, [rsp]
mov rsi, 0x2d
call r12
shl rsi, 0xa
add rsp, 0x20
xorps xmm1, xmm0
ret
Function at 0x140007890
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x188
mov rax, qword [0x1400af118]
xor rax, rsp
mov qword [rsp + 0x180], rax
lea rcx, [rsp + 0x64]
mov r8d, 0x118
xor edx, edx
call fcn.140067c70
mov dword [rsp + 0x60], 0x11c
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x2c], 0
mov ecx, dword [rsp + 0x64]
mov edx, dword [rsp + 0x68]
lea rax, [rsp + 0x2c]
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetProductInfo]
mov ecx, 0x98
call fcn.140065764
mov rsi, rax
mov edi, dword [rsp + 0x2c]
mov eax, dword [0x1400b1000]
mov ecx, dword [0x1400b31f0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000795c
lea r8, [0x1400b0fd0]
lea rdx, [rsp + 0x60]
mov rcx, rsi
mov r9d, edi
call fcn.1400079d0
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.140065b10
mov rax, rsi
add rsp, 0x188
pop rdi
pop rsi
ret
lea rcx, [0x1400b1000]
call fcn.140065628
cmp dword [0x1400b1000], 0xffffffff
jne 0x140007928
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movaps xmm0, xmmword [rsp + 0x30]
movaps xmm1, xmmword [rsp + 0x40]
movaps xmm2, xmmword [rsp + 0x50]
movups xmmword [0x1400b0ff0], xmm2
movups xmmword [0x1400b0fe0], xmm1
movups xmmword [0x1400b0fd0], xmm0
lea rcx, [0x1400b1000]
call fcn.1400655c8
jmp 0x140007928