joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400129e0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x13f0
call fcn.1400e7700
sub rsp, rax
mov rax, qword [0x14011d080]
xor rax, rsp
mov qword [rsp + 0x13e0], rax
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
mov dword [rsp + 0x24], esi
mov ebx, reloc.WS2_32.dll_ntohs
test edx, edx
cmovg ebx, edx
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rsi
lea r8d, [rsi + 0xa]
lea rdx, str.1234567890
lea rcx, [rsp + 0x30]
call fcn.14000ec80
nop
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov edx, eax
mov dword [rsp + 0x13d4], 0xffffffff
mov dword [rsp + 0x54], eax
lea ecx, [rsi + 1]
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [rsp + rcx*4 + 0x54], edx
inc rcx
cmp rcx, 0x270
jb 0x140012a71
mov dword [rsp + 0x50], 0x270
mov r14d, dword [rsp + 0x40]
dec r14d
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], 0
mov dword [rsp + 0x24], 1
mov r13, qword [rsp + 0x48]
mov r12, qword [rsp + 0x30]
test ebx, ebx
jle 0x140012b94
mov r15d, ebx
movzx ebx, byte [rsp + 0x20]
nop word [rax + rax]
lea rcx, [rsp + 0x50]
cmp r14d, 0xffffffff
jne 0x140012af4
call fcn.14004dd90
mov ecx, eax
jmp 0x140012b38
lea esi, [r14 + 1]
call fcn.14004dd90
mov ebp, esi
mov ecx, eax
imul rcx, rbp
cmp ecx, esi
jae 0x140012b34
mov eax, esi
neg eax
xor edx, edx
div esi
mov esi, edx
cmp ecx, edx
jae 0x140012b34
nop word [rax + rax]
lea rcx, [rsp + 0x50]
call fcn.14004dd90
mov ecx, eax
imul rcx, rbp
cmp ecx, esi
jb 0x140012b20
shr rcx, 0x20
lea rdx, [rsp + 0x30]
cmp r13, 0x10
cmovae rdx, r12
movsxd rax, ecx
movzx r9d, byte [rax + rdx]
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x140012b79
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x140012b6e
mov rax, qword [rdi]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x140012b8a
movzx r8d, bl
mov edx, 1
mov rcx, rdi
call fcn.140045a50
sub r15, 1
jne 0x140012ae0
cmp r13, 0x10
jb 0x140012bcf
lea rdx, [r13 + 1]
mov rax, r12
cmp rdx, 0x1000
jb 0x140012bc7
add rdx, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140012bc7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r12
call fcn.1400e69f4
mov rax, rdi
mov rcx, qword [rsp + 0x13e0]
xor rcx, rsp
call fcn.1400e6990
lea r11, [rsp + 0x13f0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140012c10
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x13f0
call fcn.1400e7700
sub rsp, rax
mov rax, qword [0x14011d080]
xor rax, rsp
mov qword [rsp + 0x13e0], rax
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
mov dword [rsp + 0x24], esi
mov ebx, reloc.WS2_32.dll_ntohs
test edx, edx
cmovg ebx, edx
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rsi
lea r8d, [rsi + 0x10]
lea rdx, str.ABCDEF1234567890
lea rcx, [rsp + 0x30]
call fcn.14000ec80
nop
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov edx, eax
mov dword [rsp + 0x13d4], 0xffffffff
mov dword [rsp + 0x54], eax
lea ecx, [rsi + 1]
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [rsp + rcx*4 + 0x54], edx
inc rcx
cmp rcx, 0x270
jb 0x140012ca1
mov dword [rsp + 0x50], 0x270
mov r14d, dword [rsp + 0x40]
dec r14d
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], 0
mov dword [rsp + 0x24], 1
mov r13, qword [rsp + 0x48]
mov r12, qword [rsp + 0x30]
test ebx, ebx
jle 0x140012dc4
mov r15d, ebx
movzx ebx, byte [rsp + 0x20]
nop word [rax + rax]
lea rcx, [rsp + 0x50]
cmp r14d, 0xffffffff
jne 0x140012d24
call fcn.14004dd90
mov ecx, eax
jmp 0x140012d68
lea esi, [r14 + 1]
call fcn.14004dd90
mov ebp, esi
mov ecx, eax
imul rcx, rbp
cmp ecx, esi
jae 0x140012d64
mov eax, esi
neg eax
xor edx, edx
div esi
mov esi, edx
cmp ecx, edx
jae 0x140012d64
nop word [rax + rax]
lea rcx, [rsp + 0x50]
call fcn.14004dd90
mov ecx, eax
imul rcx, rbp
cmp ecx, esi
jb 0x140012d50
shr rcx, 0x20
lea rdx, [rsp + 0x30]
cmp r13, 0x10
cmovae rdx, r12
movsxd rax, ecx
movzx r9d, byte [rax + rdx]
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x140012da9
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x140012d9e
mov rax, qword [rdi]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x140012dba
movzx r8d, bl
mov edx, 1
mov rcx, rdi
call fcn.140045a50
sub r15, 1
jne 0x140012d10
cmp r13, 0x10
jb 0x140012dff
lea rdx, [r13 + 1]
mov rax, r12
cmp rdx, 0x1000
jb 0x140012df7
add rdx, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140012df7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r12
call fcn.1400e69f4
mov rax, rdi
mov rcx, qword [rsp + 0x13e0]
xor rcx, rsp
call fcn.1400e6990
lea r11, [rsp + 0x13f0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140012e40
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x13f0
call fcn.1400e7700
sub rsp, rax
mov rax, qword [0x14011d080]
xor rax, rsp
mov qword [rsp + 0x13e0], rax
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
mov dword [rsp + 0x24], esi
mov ebx, reloc.WS2_32.dll_ntohs
test edx, edx
cmovg ebx, edx
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rsi
lea r8d, [rsi + 6]
lea rdx, str.ABCDEF
lea rcx, [rsp + 0x30]
call fcn.14000ec80
nop
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov edx, eax
mov dword [rsp + 0x13d4], 0xffffffff
mov dword [rsp + 0x54], eax
lea ecx, [rsi + 1]
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [rsp + rcx*4 + 0x54], edx
inc rcx
cmp rcx, 0x270
jb 0x140012ed1
mov dword [rsp + 0x50], 0x270
mov r14d, dword [rsp + 0x40]
dec r14d
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], 0
mov dword [rsp + 0x24], 1
mov r13, qword [rsp + 0x48]
mov r12, qword [rsp + 0x30]
test ebx, ebx
jle 0x140012ff4
mov r15d, ebx
movzx ebx, byte [rsp + 0x20]
nop word [rax + rax]
lea rcx, [rsp + 0x50]
cmp r14d, 0xffffffff
jne 0x140012f54
call fcn.14004dd90
mov ecx, eax
jmp 0x140012f98
lea esi, [r14 + 1]
call fcn.14004dd90
mov ebp, esi
mov ecx, eax
imul rcx, rbp
cmp ecx, esi
jae 0x140012f94
mov eax, esi
neg eax
xor edx, edx
div esi
mov esi, edx
cmp ecx, edx
jae 0x140012f94
nop word [rax + rax]
lea rcx, [rsp + 0x50]
call fcn.14004dd90
mov ecx, eax
imul rcx, rbp
cmp ecx, esi
jb 0x140012f80
shr rcx, 0x20
lea rdx, [rsp + 0x30]
cmp r13, 0x10
cmovae rdx, r12
movsxd rax, ecx
movzx r9d, byte [rax + rdx]
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x140012fd9
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x140012fce
mov rax, qword [rdi]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x140012fea
movzx r8d, bl
mov edx, 1
mov rcx, rdi
call fcn.140045a50
sub r15, 1
jne 0x140012f40
cmp r13, 0x10
jb 0x14001302f
lea rdx, [r13 + 1]
mov rax, r12
cmp rdx, 0x1000
jb 0x140013027
add rdx, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140013027
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r12
call fcn.1400e69f4
mov rax, rdi
mov rcx, qword [rsp + 0x13e0]
xor rcx, rsp
call fcn.1400e6990
lea r11, [rsp + 0x13f0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140013070
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x13f0
call fcn.1400e7700
sub rsp, rax
mov rax, qword [0x14011d080]
xor rax, rsp
mov qword [rsp + 0x13e0], rax
mov ebx, edx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
mov dword [rsp + 0x24], esi
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rsi
lea r8d, [rsi + 0x23]
lea rdx, str.ABCDEFGHIJLMNOPQRSTUVWXYZ1234567890
lea rcx, [rsp + 0x30]
call fcn.14000ec80
nop
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov edx, eax
mov dword [rsp + 0x13d4], 0xffffffff
mov dword [rsp + 0x54], eax
lea ecx, [rsi + 1]
nop dword [rax]
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [rsp + rcx*4 + 0x54], edx
inc rcx
cmp rcx, 0x270
jb 0x140013100
mov dword [rsp + 0x50], 0x270
mov r14d, dword [rsp + 0x40]
dec r14d
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], 0
mov dword [rsp + 0x24], 1
mov r13, qword [rsp + 0x48]
mov r12, qword [rsp + 0x30]
test ebx, ebx
jle 0x14001323b
cmp r13, 0x10
setae byte [rsp + 0x20]
mov r15, rbx
movzx ebx, byte [rsp + 0x20]
movzx r13d, byte [rsp + 0x20]
nop word [rax + rax]
mov eax, r14d
cmp r14d, 0x80000000
cmovae eax, r14d
lea rcx, [rsp + 0x50]
cmp eax, 0xffffffff
jne 0x1400131a1
call fcn.14004dd90
mov ecx, eax
jmp 0x1400131db
lea esi, [rax + 1]
call fcn.14004dd90
mov ebp, esi
mov ecx, eax
imul rcx, rbp
cmp ecx, esi
jae 0x1400131d7
mov eax, esi
neg eax
xor edx, edx
div esi
mov esi, edx
cmp ecx, edx
jae 0x1400131d7
lea rcx, [rsp + 0x50]
call fcn.14004dd90
mov ecx, eax
imul rcx, rbp
cmp ecx, esi
jb 0x1400131c3
shr rcx, 0x20
lea rdx, [rsp + 0x30]
test r13b, r13b
cmovne rdx, r12
movsxd rax, ecx
movzx r9d, byte [rax + rdx]
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x14001321b
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x140013210
mov rax, qword [rdi]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x14001322c
movzx r8d, bl
mov edx, 1
mov rcx, rdi
call fcn.140045a50
sub r15, 1
jne 0x140013180
mov r13, qword [rsp + 0x48]
cmp r13, 0x10
jb 0x140013276
lea rdx, [r13 + 1]
mov rax, r12
cmp rdx, 0x1000
jb 0x14001326e
add rdx, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001326e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r12
call fcn.1400e69f4
mov rax, rdi
mov rcx, qword [rsp + 0x13e0]
xor rcx, rsp
call fcn.1400e6990
lea r11, [rsp + 0x13f0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140028a70
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov eax, 0x13d0
call fcn.1400e7700
sub rsp, rax
mov rax, qword [0x14011d080]
xor rax, rsp
mov qword [rsp + 0x13c0], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
mov dword [rsp + 0x20], esi
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov edx, eax
mov dword [rsp + 0x13b4], 0xffffffff
mov dword [rsp + 0x34], eax
lea ecx, [rsi + 1]
nop dword [rax + rax]
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [rsp + rcx*4 + 0x34], edx
inc rcx
cmp rcx, 0x270
jb 0x140028ad0
mov dword [rsp + 0x30], 0x270
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 7
mov word [rbx], si
mov dword [rsp + 0x20], 1
mov edi, reloc.WS2_32.dll_recv
lea r14, str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
lea rcx, [rsp + 0x30]
call fcn.14004dd90
mov ecx, eax
imul rax, rcx, 0x3e
cmp eax, 3
ja 0x140028b4a
lea rcx, [rsp + 0x30]
call fcn.14004dd90
mov ecx, eax
imul rax, rcx, 0x3e
cmp eax, 4
jb 0x140028b35
shr rax, 0x20
movsxd rcx, eax
movzx r9d, word [r14 + rcx*2]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x140028b83
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 8
jb 0x140028b77
mov rax, qword [rbx]
mov word [rax + rcx*2], r9w
mov word [rax + rcx*2 + 2], si
jmp 0x140028b8b
mov rcx, rbx
call fcn.140045390
sub rdi, 1
jne 0x140028b20
mov rax, rbx
mov rcx, qword [rsp + 0x13c0]
xor rcx, rsp
call fcn.1400e6990
lea r11, [rsp + 0x13d0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x1400339a0
Capabilities:
Create process on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0xd0
mov rax, qword [0x14011d080]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbx, rcx
mov qword [r11 - 0x38], rcx
mov r8, qword [rcx + 0x10]
mov rcx, qword [rcx + 0x18]
mov rax, rcx
sub rax, r8
xor r15d, r15d
cmp rax, 3
jb 0x140033a6f
lea rax, [r8 + 3]
mov qword [rbx + 0x10], rax
mov rdi, rbx
cmp rcx, 0x10
jb 0x140033a03
mov rdi, qword [rbx]
lea rax, [0x1400fca1b]
mov r14d, 3
lea rsi, [0x1400fca18]
cmp rax, rdi
jbe 0x140033a37
lea rax, [rdi + r8]
cmp rsi, rax
ja 0x140033a37
cmp rdi, rsi
ja 0x140033a2f
mov rbp, r15
jmp 0x140033a3a
mov rbp, rdi
sub rbp, rsi
jmp 0x140033a3a
mov rbp, r14
inc r8
lea rcx, [rdi + 3]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memmove
mov r8, rbp
mov rdx, rsi
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
sub r14, rbp
lea rdx, [rsi + 3]
add rdx, rbp
lea rcx, [rdi + rbp]
mov r8, r14
call sub.VCRUNTIME140.dll_memcpy
jmp 0x140033a9a
mov r14d, 3
mov qword [rsp + 0x28], r14
lea rsi, [0x1400fca18]
mov qword [rsp + 0x20], rsi
xor r9d, r9d
movzx r8d, byte [rsp + 0x30]
mov edx, r14d
mov rcx, rbx
call fcn.14000ed80
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xa0], xmm0
mov dword [rsp + 0x40], reloc.WS2_32.dll_WSASetLastError
mov dword [rsp + 0x44], 0x40
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x50], r15
lea rax, str.cmd.exe
mov qword [rsp + 0x58], rax
mov rax, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x140033afc
mov rax, qword [rbx]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], r15
mov dword [rsp + 0x70], r15d
mov qword [rsp + 0x78], r15
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x140033b32
mov edx, 0xffffffff
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rsp + 0xb8]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x140033b8d
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x140033b88
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140033bc9
mov rcx, r8
call fcn.1400e69f4
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1400e6990
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140033bd0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x14011d080]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edx, edx
mov dword [rsp + 0x20], 0x238
mov rbx, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140033d3e
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
lea rax, [rsp + 0x4c]
mov rcx, 0xffffffffffffffff
nop dword [rax]
inc rcx
cmp word [rax + rcx*2], 0
jne 0x140033c30
cmp qword [rbx + 0x18], 8
mov r9, rbx
mov r10, qword [rbx + 0x10]
jb 0x140033c4b
mov r9, qword [rbx]
cmp rcx, r10
lea rdx, [rsp + 0x4c]
mov r8, r10
cmovb r8, rcx
test r8, r8
je 0x140033c84
lea rax, [rsp + 0x4c]
sub r9, rax
nop word [rax + rax]
movzx eax, word [r9 + rdx]
cmp ax, word [rdx]
jne 0x140033c8f
add rdx, 2
sub r8, 1
jne 0x140033c70
cmp r10, rcx
jb 0x140033c8f
jbe 0x140033daf
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x140033d35
nop word [rax + rax]
lea rax, [rsp + 0x4c]
mov rcx, 0xffffffffffffffff
nop dword [rax]
inc rcx
cmp word [rax + rcx*2], 0
jne 0x140033cc0
cmp qword [rbx + 0x18], 8
mov r9, rbx
mov r10, qword [rbx + 0x10]
jb 0x140033cdb
mov r9, qword [rbx]
cmp rcx, r10
lea rdx, [rsp + 0x4c]
mov r8, r10
cmovb r8, rcx
test r8, r8
je 0x140033d14
lea rax, [rsp + 0x4c]
sub r9, rax
nop word [rax + rax]
movzx eax, word [r9 + rdx]
cmp ax, word [rdx]
jne 0x140033d1f
add rdx, 2
sub r8, 1
jne 0x140033d00
cmp r10, rcx
jb 0x140033d1f
jbe 0x140033daf
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140033cb0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x140033d7d
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140033d78
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140033e0c
mov rcx, r8
call fcn.1400e69f4
xor eax, eax
mov word [rbx], ax
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], rax
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1400e6990
mov rbx, qword [rsp + 0x288]
add rsp, 0x270
pop rdi
ret
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbx + 0x18]
mov edi, dword [rsp + 0x28]
cmp rdx, 8
jb 0x140033df7
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140033df2
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140033e0c
mov rcx, r8
call fcn.1400e69f4
xor eax, eax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], 7
mov word [rbx], ax
mov eax, edi
jmp 0x140033d8e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14003fba0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x14003fbc8
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x14003fbee
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14003fbf0
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x14003fc49
test ecx, ecx
jle 0x14003fc29
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x14003fc49
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x14003fc49
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x14003fc70
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x14003fc92
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x14003fca8
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14003fcc4
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14003fcc6
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14003fd02
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14003fd9e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x14003fd3d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x14003fd7e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x14003fd9e
cmp rbx, rax
ja 0x14003fd50
test rbx, rbx
je 0x14003fd9e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret