joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004f430
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
lea rsi, [rcx + 8]
mov ebx, 0x1505
mov rcx, qword [rdx]
movzx eax, word [rcx]
test ax, ax
je 0x14004f476
nop dword [rax + rax]
imul rbx, rbx, 0x21
movzx eax, ax
add rbx, rax
lea rcx, [rcx + 2]
movzx eax, word [rcx]
test ax, ax
jne 0x14004f460
mov r9, rbx
mov r8, rdx
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140043f20
mov rdi, qword [rax + 8]
xor ebp, ebp
test rdi, rdi
je 0x14004f50e
mov rcx, qword [rsi + 0x30]
and rcx, rbx
shl rcx, 4
mov rdx, qword [rsi + 0x18]
add rdx, rcx
mov rax, qword [rdx]
cmp qword [rdx + 8], rdi
jne 0x14004f4cb
cmp rax, rdi
jne 0x14004f4c1
mov rax, qword [rsi + 8]
mov qword [rdx], rax
mov qword [rdx + 8], rax
jmp 0x14004f4d6
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
jmp 0x14004f4d6
cmp rax, rdi
jne 0x14004f4d6
mov rax, qword [rdi]
mov qword [rdx], rax
lea rcx, [rsi + 8]
mov rdx, qword [rdi]
dec qword [rcx + 8]
mov rax, qword [rdi + 8]
mov qword [rax], rdx
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
lea rdx, [rdi + 0x10]
call fcn.140044500
mov edx, 0x20
mov rcx, rdi
call fcn.14006a280
nop
mov ecx, 1
jmp 0x14004f511
mov rcx, rbp
mov eax, 0x490
test rcx, rcx
cmovne eax, ebp
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x14004f540
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov rbx, qword [rdx + 0x10]
mov r8d, 0x1505
mov r9, qword [rbx + 0x10]
movzx eax, word [r9]
test ax, ax
je 0x14004f587
nop dword [rax]
imul r8, r8, 0x21
movzx eax, ax
add r8, rax
lea r9, [r9 + 2]
movzx eax, word [r9]
test ax, ax
jne 0x14004f570
mov rdx, qword [rcx + 0x38]
and rdx, r8
shl rdx, 4
add rdx, qword [rcx + 0x20]
mov rax, qword [rdx]
cmp qword [rdx + 8], rbx
jne 0x14004f5bb
cmp rax, rbx
jne 0x14004f5b1
mov rax, qword [rcx + 0x10]
mov qword [rdx], rax
mov qword [rdx + 8], rax
jmp 0x14004f5c6
mov rax, qword [rbx + 8]
mov qword [rdx + 8], rax
jmp 0x14004f5c6
cmp rax, rbx
jne 0x14004f5c6
mov rax, qword [rbx]
mov qword [rdx], rax
add rcx, 0x10
mov rdi, qword [rbx]
dec qword [rcx + 8]
mov rax, qword [rbx + 8]
mov qword [rax], rdi
mov rax, qword [rbx + 8]
mov qword [rdi + 8], rax
lea rdx, [rbx + 0x10]
call fcn.140044500
mov edx, 0x20
mov rcx, rbx
call fcn.14006a280
nop
mov qword [rsi + 0x10], rdi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14004fce0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1400d0128]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14004fdbd
cmp byte [rcx + 0x71], 0
je 0x14004fdbd
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
mov rax, qword [rax + 0x18]
call qword [case.0x14001f32b.0]
cmp eax, 0xffffffff
je 0x14004fdb9
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14004fd7b
sub eax, 1
je 0x14004fd7f
cmp eax, 2
jne 0x14004fdb9
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14006a600
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x14004fdb0
lfence
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14004fdb9
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14004fd63
xor al, al
jmp 0x14004fd63
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14006a600
add rsp, 0x60
pop rbx
ret
Function at 0x14004fde0
Capabilities:
Hash data using djb2

Disassembly:
push rdi
push r15
sub rsp, 0x38
movabs rax, 0xfffffffffffffff
mov r15, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x14005000f
lea rax, [rdx - 1]
mov qword [rsp + 0x50], rbx
mov rbx, qword [r15 + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x30], r12
inc ecx
shl rdi, cl
lea rcx, [r15 + 0x18]
lea rdx, [rdi + rdi]
call fcn.14004f990
lea rax, [rdi - 1]
mov qword [r15 + 0x38], rdi
mov qword [r15 + 0x30], rax
mov rax, qword [r15 + 8]
mov rax, qword [rax]
mov rdx, rax
cmp rax, rbx
je 0x14004ffd7
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x28], r13
lea r13, [0x1400b15a8]
mov qword [rsp + 0x20], r14
nop dword [rax]
nop dword [rax + rax]
mov rbp, qword [rax + 0x10]
mov r9d, 0x1505
mov rdx, qword [rdx]
mov r8, rbp
movzx ecx, word [rbp]
test cx, cx
je 0x14004feb7
nop dword [rax]
imul r9, r9, 0x21
movzx ecx, cx
lea r8, [r8 + 2]
add r9, rcx
movzx ecx, word [r8]
test cx, cx
jne 0x14004fea0
mov r14, qword [r15 + 0x30]
and r14, r9
shl r14, 4
add r14, qword [r15 + 0x18]
mov rsi, qword [r14]
cmp rsi, rbx
jne 0x14004feda
mov qword [r14], rax
mov qword [r14 + 8], rax
jmp 0x14004ffb7
mov rcx, qword [r14 + 8]
mov r11, r13
mov r8, qword [rcx + 0x10]
test r8, r8
cmovne r11, r8
mov r8, rbp
sub r11, rbp
movzx r10d, word [r8]
movzx r9d, word [r8 + r11]
sub r10d, r9d
jne 0x14004ff09
add r8, 2
test r9d, r9d
jne 0x14004fef2
test r10d, r10d
jne 0x14004ff3d
mov r10, qword [rcx]
cmp r10, rax
je 0x14004ff37
mov r9, qword [rax + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rcx, qword [r10 + 8]
mov qword [rcx], rax
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rax + 8], rcx
mov qword [r14 + 8], rax
jmp 0x14004ffb7
mov rdi, rcx
cmp rsi, rcx
je 0x14004ff93
nop word [rax + rax]
mov rcx, qword [rcx + 8]
mov r11, r13
mov rdi, rcx
mov r8, qword [rcx + 0x10]
test r8, r8
cmovne r11, r8
test rbp, rbp
mov r8, r13
cmovne r8, rbp
sub r11, r8
movzx r10d, word [r8]
movzx r9d, word [r8 + r11]
sub r10d, r9d
jne 0x14004ff89
add r8, 2
test r9d, r9d
jne 0x14004ff72
test r10d, r10d
je 0x14004ffe9
cmp rsi, rcx
jne 0x14004ff50
mov r9, qword [rax + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov qword [rdi + 8], r8
mov qword [rdx + 8], r9
mov qword [rax + 8], rcx
mov qword [r14], rax
mov rax, rdx
cmp rdx, rbx
jne 0x14004fe80
mov r14, qword [rsp + 0x20]
mov r13, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov r12, qword [rsp + 0x30]
add rsp, 0x38
pop r15
pop rdi
ret
mov r10, qword [rcx]
mov r9, qword [rax + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rcx, qword [r10 + 8]
mov qword [rcx], rax
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rax + 8], rcx
jmp 0x14004ffb7
lea rcx, str.invalid_hash_bucket_count
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_
int3
Function at 0x140050020
Capabilities:
Hash data using djb2

Disassembly:
push rdi
push r14
sub rsp, 0x28
movabs rax, 0xfffffffffffffff
mov r14, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x140050244
lea rax, [rdx - 1]
mov qword [rsp + 0x40], rbx
mov rbx, qword [r14 + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x20], r15
inc ecx
shl rdi, cl
lea rcx, [r14 + 0x18]
lea rdx, [rdi + rdi]
call fcn.14004f990
lea rax, [rdi - 1]
mov qword [r14 + 0x38], rdi
mov qword [r14 + 0x30], rax
mov rax, qword [r14 + 8]
mov rax, qword [rax]
mov rdx, rax
cmp rax, rbx
je 0x14005020c
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], r12
lea r12, [0x1400b15a8]
nop
mov rbp, qword [rax + 0x10]
mov r9d, 0x1505
mov rdx, qword [rdx]
mov r8, rbp
movzx ecx, word [rbp]
test cx, cx
je 0x1400500e7
nop dword [rax]
imul r9, r9, 0x21
movzx ecx, cx
lea r8, [r8 + 2]
add r9, rcx
movzx ecx, word [r8]
test cx, cx
jne 0x1400500d0
mov rsi, qword [r14 + 0x30]
and rsi, r9
shl rsi, 4
add rsi, qword [r14 + 0x18]
mov rdi, qword [rsi]
cmp rdi, rbx
jne 0x14005010a
mov qword [rsi], rax
mov qword [rsi + 8], rax
jmp 0x1400501f1
mov rcx, qword [rsi + 8]
mov r10, r12
mov r8, qword [rcx + 0x10]
test r8, r8
cmovne r10, r8
mov r8, rbp
sub r10, rbp
movzx r9d, word [r8]
cmp r9w, word [r8 + r10]
jne 0x14005013c
add r8, 2
test r9w, r9w
jne 0x140050122
xor r8d, r8d
jmp 0x140050143
sbb r8d, r8d
or r8d, 1
test r8d, r8d
jne 0x140050177
mov r10, qword [rcx]
cmp r10, rax
je 0x140050171
mov r9, qword [rax + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rcx, qword [r10 + 8]
mov qword [rcx], rax
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rax + 8], rcx
mov qword [rsi + 8], rax
jmp 0x1400501f1
mov r11, rcx
cmp rdi, rcx
je 0x1400501cd
nop
mov rcx, qword [rcx + 8]
mov r10, r12
mov r11, rcx
mov r8, qword [rcx + 0x10]
test r8, r8
cmovne r10, r8
test rbp, rbp
mov r8, r12
cmovne r8, rbp
sub r10, r8
movzx r9d, word [r8]
cmp r9w, word [r8 + r10]
jne 0x1400501bc
add r8, 2
test r9w, r9w
jne 0x1400501a2
xor r8d, r8d
jmp 0x1400501c3
sbb r8d, r8d
or r8d, 1
test r8d, r8d
je 0x14005021e
cmp rdi, rcx
jne 0x140050180
mov r9, qword [rax + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r11
mov rcx, qword [r11 + 8]
mov qword [rcx], rax
mov qword [r11 + 8], r8
mov qword [rdx + 8], r9
mov qword [rax + 8], rcx
mov qword [rsi], rax
mov rax, rdx
cmp rdx, rbx
jne 0x1400500b0
mov r12, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov r15, qword [rsp + 0x20]
add rsp, 0x28
pop r14
pop rdi
ret
mov r10, qword [rcx]
mov r9, qword [rax + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rcx, qword [r10 + 8]
mov qword [rcx], rax
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rax + 8], rcx
jmp 0x1400501f1
lea rcx, str.invalid_hash_bucket_count
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_
int3
Function at 0x140058ae0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1400d0128]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x140058b0d
xor eax, eax
jmp 0x140058c65
mov rdx, qword [rcx + 0x40]
mov rax, qword [rdx]
test rax, rax
je 0x140058b38
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, rax
cmp rax, r8
jae 0x140058b38
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x140058c65
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x140058c58
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x140058b7b
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140058ba6
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140058c5d
lea rax, [rsp + 0x48]
mov byte [rsp + 0x40], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x41]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140058c15
sub eax, 1
je 0x140058c15
cmp eax, 2
jne 0x140058c58
movsx ecx, byte [rsp + 0x40]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140058c5d
mov rsi, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140058c46
lfence
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x140058c58
lea rax, [rsp + 0x40]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x50], rax
mov eax, edi
jne 0x140058c5d
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14006a600
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x14005b6a0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x14005b6d1
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
je 0x14005b6f2
lfence
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x38], rdi
mov rdi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14005b70e
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14005b710
xor ecx, ecx
mov qword [rsp + 0x30], rbx
movsxd rax, ecx
test ecx, ecx
je 0x14005b747
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rbx
sub rdi, rbx
sub dword [rax], ebx
mov rcx, qword [rsi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14005b7e4
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x14005b782
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov rbx, rdi
cmp rdi, 0xfff
jbe 0x14005b7c1
nop
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rdi, rax
add r14, rax
mov rbx, rdi
cmp rax, 0xfff
jne 0x14005b7e4
cmp rdi, rax
ja 0x14005b790
test rbx, rbx
je 0x14005b7e4
mov r9, qword [rsi + 0x80]
mov r8, rdi
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rdi, rbx
sub rdi, rax
sub rbp, rdi
mov rax, rbp
lfence
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14005b810
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x14005b847
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x14005b868
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14005b86a
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x14005b8cb
test ecx, ecx
jle 0x14005b8a3
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
sub rbx, rbp
add r14, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x14005b8cb
cmp qword [rdi + 0x80], 0
je 0x14005b8cb
lfence
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x30]
sub rsi, rbx
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14005d050
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x1400d0128]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edx, edx
mov dword [rcx + 0x80], 0
mov rbx, rcx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14005d11b
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x234
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rdi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x14005d112
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x28], eax
jne 0x14005d0d4
mov eax, dword [rsp + 0x40]
mov dword [rbx + 0x80], eax
cmp dword [rbx + 0x80], 0
jne 0x14005d112
nop dword [rax]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x14005d112
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x28], eax
je 0x14005d108
cmp dword [rbx + 0x80], 0
je 0x14005d0e0
jmp 0x14005d112
mov eax, dword [rsp + 0x40]
mov dword [rbx + 0x80], eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.14000e6e0
mov r8d, dword [rbx + 0x80]
lea rdx, str.parent_pid:__lu_n
mov rcx, rax
call fcn.14000e830
mov r8d, dword [rbx + 0x80]
test r8d, r8d
je 0x14005d171
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbx + 0x88], rax
call fcn.14000e6e0
mov r8, qword [rbx + 0x88]
lea rdx, str.parent_process:__p_n
mov rcx, rax
call fcn.14000e830
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.14006a600
mov rbx, qword [rsp + 0x288]
add rsp, 0x270
pop rdi
ret
Function at 0x1400648b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
add r8d, 0xdeadbeef
mov rdi, rdx
add r8d, edx
mov r11, rcx
mov r10d, r8d
mov ebx, r8d
cmp rdx, 0xc
jbe 0x1400649e3
mov qword [rsp + 0x10], rsi
lea r9, [rdx - 0xd]
movabs rax, 0xaaaaaaaaaaaaaaab
mul r9
mov rsi, rdx
shr rsi, 3
inc rsi
imul rax, rsi, 0xfffffffffffffff4
add rdi, rax
nop dword [rax]
movzx eax, byte [r11 + 6]
movzx ecx, byte [r11 + 7]
movzx r9d, byte [r11 + 4]
movzx edx, byte [r11 + 8]
add r9d, r10d
shl ecx, 8
add edx, r8d
add ecx, eax
movzx eax, byte [r11 + 5]
shl ecx, 8
add ecx, eax
movzx eax, byte [r11 + 0xa]
shl ecx, 8
add r9d, ecx
movzx ecx, byte [r11 + 0xb]
shl ecx, 8
add ecx, eax
movzx eax, byte [r11 + 9]
shl ecx, 8
add ecx, eax
movzx eax, byte [r11 + 2]
shl ecx, 8
add edx, ecx
movzx ecx, byte [r11 + 3]
shl ecx, 8
mov r8d, edx
add ecx, eax
rol r8d, 4
movzx eax, byte [r11 + 1]
shl ecx, 8
add ecx, eax
movzx eax, byte [r11]
shl ecx, 8
add r11, 0xc
add ecx, eax
sub ecx, edx
add edx, r9d
add ecx, ebx
xor r8d, ecx
sub r9d, r8d
mov eax, r8d
add r8d, edx
rol eax, 6
xor eax, r9d
sub edx, eax
mov ecx, eax
add eax, r8d
rol ecx, 8
xor ecx, edx
sub r8d, ecx
mov ebx, ecx
add ecx, eax
rol ebx, 0x10
xor ebx, r8d
sub eax, ebx
mov r10d, ebx
ror r10d, 0xd
add ebx, ecx
xor r10d, eax
sub ecx, r10d
mov r8d, r10d
rol r8d, 4
add r10d, ebx
xor r8d, ecx
sub rsi, 1
jne 0x140064900
mov rsi, qword [rsp + 0x10]
cmp rdi, 0xc
ja 0x140064a6c
lea rcx, [0x140000000]
mov eax, dword [rcx + rdi*4 + 0x64acc]
add rax, rcx
jmp rax
movzx eax, byte [r11 + 0xb]
shl eax, 0x18
add r8d, eax
movzx eax, byte [r11 + 0xa]
shl eax, 0x10
add r8d, eax
movzx eax, byte [r11 + 9]
shl eax, 8
add r8d, eax
movzx eax, byte [r11 + 8]
add r8d, eax
movzx eax, byte [r11 + 7]
shl eax, 0x18
add r10d, eax
movzx eax, byte [r11 + 6]
shl eax, 0x10
add r10d, eax
movzx eax, byte [r11 + 5]
shl eax, 8
add r10d, eax
movzx eax, byte [r11 + 4]
add r10d, eax
movzx eax, byte [r11 + 3]
shl eax, 0x18
add ebx, eax
movzx eax, byte [r11 + 2]
shl eax, 0x10
add ebx, eax
movzx eax, byte [r11 + 1]
shl eax, 8
add ebx, eax
movzx eax, byte [r11]
add ebx, eax
xor r8d, r10d
mov eax, r10d
rol eax, 0xe
sub r8d, eax
mov eax, r8d
mov edx, r8d
rol eax, 0xb
xor edx, ebx
sub edx, eax
xor r10d, edx
mov eax, edx
ror eax, 7
sub r10d, eax
xor r8d, r10d
mov eax, r10d
rol eax, 0x10
sub r8d, eax
mov eax, r8d
mov ecx, r8d
rol eax, 4
xor ecx, edx
sub ecx, eax
xor r10d, ecx
mov eax, ecx
rol eax, 0xe
sub r10d, eax
mov eax, r10d
xor r8d, r10d
ror eax, 8
sub r8d, eax
mov rbx, qword [rsp + 0x18]
mov eax, r8d
pop rdi
ret
Function at 0x14006c070
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov r9d, dword [0x1400d4350]
mov rbx, rcx
mov rax, qword gs:[0x58]
xor sil, sil
mov ecx, sendto
mov r14, rdx
movsxd rbp, r8d
mov rdi, qword [rax + r9*8]
add rdi, rcx
mov eax, dword [rdi]
cmp dword [0x1400d51a0], eax
jg 0x14006c159
mov rcx, qword [rbx + 0x28]
test rcx, rcx
jne 0x14006c0d7
mov rcx, rbx
call fcn.14007dc80
test al, al
jne 0x14006c0b2
jmp 0x14006c13e
mov edi, 1
test ebp, ebp
je 0x14006c0f3
mov r9, rcx
mov r8, rbp
mov rcx, r14
mov edx, edi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
jmp 0x14006c102
mov r8, r14
lea rdx, [0x1400b259c]
call fcn.14008da80
cmp qword [0x1400d5198], 0
jl 0x14006c11f
cdqe
lock xadd qword [rbx + 0x38], rax
cmp rax, qword [0x1400d5198]
setge sil
lock xadd dword [rbx + 0x40], edi
inc edi
cmp edi, 1
jne 0x14006c13a
xor ecx, ecx
xchg dword [rbx + 0x40], ecx
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
movzx eax, sil
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
lea rcx, [0x1400d51a0]
call fcn.14006a7c0
cmp dword [0x1400d51a0], 0xffffffff
jne 0x14006c0c0
mov rax, qword [rbx + 0x48]
mov rcx, qword [rax + 0x18]
mov qword [0x1400d5198], rcx
lea rcx, [0x1400d51a0]
call fcn.14006a760
jmp 0x14006c0c0

Function at 0x14006c1a0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov r9d, dword [0x1400d4350]
mov rbx, rcx
mov rax, qword gs:[0x58]
xor sil, sil
mov ecx, sendto
mov r14, rdx
movsxd rbp, r8d
mov rdi, qword [rax + r9*8]
add rdi, rcx
mov eax, dword [rdi]
cmp dword [0x1400d51b0], eax
jg 0x14006c28c
mov rcx, qword [rbx + 0x28]
test rcx, rcx
jne 0x14006c207
mov rcx, rbx
call fcn.14007dc80
test al, al
jne 0x14006c1e2
jmp 0x14006c271
test ebp, ebp
je 0x14006c221
mov r9, rcx
mov r8, rbp
mov rcx, r14
mov edx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
jmp 0x14006c230
mov r8, r14
lea rdx, [0x1400aafe0]
call fcn.14008dad0
cmp qword [0x1400d51a8], 0
jl 0x14006c24d
cdqe
lock xadd qword [rbx + 0x38], rax
cmp rax, qword [0x1400d51a8]
setge sil
mov ecx, 1
lock xadd dword [rbx + 0x40], ecx
inc ecx
cmp ecx, 1
jne 0x14006c26d
xor ecx, ecx
xchg dword [rbx + 0x40], ecx
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
movzx eax, sil
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
lea rcx, [0x1400d51b0]
call fcn.14006a7c0
cmp dword [0x1400d51b0], 0xffffffff
jne 0x14006c1f0
mov rax, qword [rbx + 0x48]
mov rcx, qword [rax + 0x18]
mov qword [0x1400d51a8], rcx
lea rcx, [0x1400d51b0]
call fcn.14006a760
jmp 0x14006c1f0