joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400389b0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x1400389bd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x1400389cd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x1400389b5
lea eax, [rcx + 1]
jmp 0x1400389db
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x1400389ee
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x1400389d4
sub eax, 3
jb 0x140038a0e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x140038a5d
sar eax, 1
movsxd rbp, eax
jb 0x140038a44
jmp 0x140038a1c
add ebx, ebx
jne 0x140038a1a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140038a44
inc ecx
add ebx, ebx
jne 0x140038a2a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140038a44
call r11
adc ecx, ecx
add ebx, ebx
jne 0x140038a3d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x140038a2c
add ecx, 2
jmp 0x140038a49
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.140038972
jmp 0x1400389bd
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x21e00
mov dl, 6
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x140038aad
cmp rsi, rcx
jae 0x140038ab5
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x140038a94
cmp al, 0x8f
ja 0x140038a94
cmp byte [rsi - 2], 0xf
je 0x140038a9a
sub al, 0xe8
cmp al, 1
ja 0x140038a7e
cmp rsi, rcx
jae 0x140038ab5
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x140038a84
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x140038ab5
lodsb al, byte [rsi]
jmp 0x140038a94
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x36000]
mov eax, dword [rdi]
or eax, eax
je 0x140038b12
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x39880]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140038ac2
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140038b0c
mov qword [rbx], rax
add rbx, 8
jmp 0x140038ae2
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x140038b4c
cmp al, 0xef
ja 0x140038b3e
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140038b1e
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x140038b2d
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.140038bcb], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.140038bcb
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140038bbb
sub rsp, 0xffffffffffffff80
jmp 0x1400013d0
Function at 0x1800010f4
Capabilities:
Get common file path

Disassembly:
push rbp
push rsi
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rcx
lea rcx, [0x18009c838]
lea r9, [rbp - 8]
xor edx, edx
xor r8d, r8d
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
js 0x18000113a
lea rcx, [rsi + 0x58]
lea rdx, [rbp - 8]
call fcn.180001330
mov rcx, qword [rbp - 8]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
add rsi, 0x58
cmp byte [0x1800acdad], 0
jne 0x1800012f9
mov rax, qword [0x1800a8018]
movabs rcx, 0xb0c8897f1e99dbe4
mov cl, byte [rax + rcx]
movabs rdx, 0xb0c8897f1e99dbf7
xor cl, byte [rax + rdx]
mov byte [0x1800acda0], cl
movabs rcx, 0xb0c8897f1e99dbe5
mov cl, byte [rax + rcx]
movabs rdx, 0xb0c8897f1e99dbf8
xor cl, byte [rax + rdx]
mov byte [0x1800acda1], cl
movabs rcx, 0xb0c8897f1e99dbe6
mov cl, byte [rax + rcx]
movabs rdx, 0xb0c8897f1e99dbf9
xor cl, byte [rax + rdx]
mov byte [0x1800acda2], cl
movabs rcx, 0xb0c8897f1e99dbe7
mov cl, byte [rax + rcx]
movabs rdx, 0xb0c8897f1e99dbfa
xor cl, byte [rax + rdx]
mov byte [0x1800acda3], cl
movabs rcx, 0xb0c8897f1e99dbe8
mov cl, byte [rax + rcx]
movabs rdx, 0xb0c8897f1e99dbfb
xor cl, byte [rax + rdx]
mov byte [0x1800acda4], cl
movabs rcx, 0xb0c8897f1e99dbe9
mov cl, byte [rax + rcx]
movabs rdx, 0xb0c8897f1e99dbfc
xor cl, byte [rax + rdx]
mov byte [0x1800acda5], cl
movabs rcx, 0xb0c8897f1e99dbea
mov cl, byte [rax + rcx]
movabs rdx, 0xb0c8897f1e99dbfd
xor cl, byte [rax + rdx]
mov byte [0x1800acda6], cl
movabs rcx, 0xb0c8897f1e99dbeb
mov cl, byte [rax + rcx]
movabs rdx, 0xb0c8897f1e99dbfe
xor cl, byte [rax + rdx]
mov byte [0x1800acda7], cl
movabs rcx, 0xb0c8897f1e99dbec
mov cl, byte [rax + rcx]
movabs rdx, 0xb0c8897f1e99dbff
xor cl, byte [rax + rdx]
mov byte [0x1800acda8], cl
movabs rcx, 0xb0c8897f1e99dbed
mov cl, byte [rax + rcx]
movabs rdx, 0xb0c8897f1e99dc00
xor cl, byte [rax + rdx]
mov byte [0x1800acda9], cl
movabs rcx, 0xb0c8897f1e99dbee
mov cl, byte [rax + rcx]
movabs rdx, 0xb0c8897f1e99dc01
xor cl, byte [rax + rdx]
mov byte [0x1800acdaa], cl
movabs rcx, 0xb0c8897f1e99dbef
mov cl, byte [rax + rcx]
movabs rdx, 0xb0c8897f1e99dc02
xor cl, byte [rax + rdx]
mov byte [0x1800acdab], cl
movabs rcx, 0xb0c8897f1e99dbf0
mov cl, byte [rax + rcx]
movabs rdx, 0xb0c8897f1e99dc03
xor cl, byte [rax + rdx]
mov byte [0x1800acdac], cl
mov byte [0x1800acdad], 1
movabs rdx, 0xb0c8897f1e99dbcc
add rdx, qword [0x1800a8020]
mov rcx, rsi
call fcn.1800013a6
nop
add rsp, 0x38
pop rsi
pop rbp
ret
Function at 0x1800022b2
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0xa0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x18], 0xfffffffffffffffe
mov rsi, rdx
mov rdi, rcx
mov al, byte [rcx]
test al, al
jne 0x1800022e6
mov byte [rdi], 1
call fcn.1800091ba
mov qword [rdi + 8], rax
mov al, byte [rdi]
cmp al, 1
jne 0x18000230f
mov rcx, qword [rdi + 8]
lea rdi, [rbp - 8]
mov rdx, rdi
mov r8, rsi
call fcn.180009d4e
mov rax, qword [rdi]
add rax, 0x40
add rsp, 0xa0
pop rdi
pop rsi
pop rbp
ret
mov rcx, rdi
call fcn.1800095f6
lea rcx, [rbp - 0x28]
mov rdx, rax
call fcn.18000249c
cmp byte [0x1800ad034], 0
jne 0x18000238c
mov rdx, qword [0x1800a80c0]
movabs rax, 0xeff01d68b847fb2
add rax, rdx
movabs rcx, 0xeff01d68b847f9f
add rcx, rdx
xor edx, edx
movabs r8, 0xd79435e50d79435f
lea r9, [0x1800ad001]
mulx r10, r10, r8
shr r10, 4
imul r10, r10, 0xffffffffffffffed
add r10, rcx
mov r10b, byte [rdx + r10]
xor r10b, byte [rax + rdx]
mov byte [rdx + r9], r10b
inc rdx
cmp rdx, 0x33
jne 0x180002360
mov byte [0x1800ad034], 1
movabs rsi, 0xeff01d68b84781a
mov rdx, qword [0x1800a80c8]
add rdx, rsi
lea rcx, [rbp - 8]
lea r8, [rbp - 0x28]
call fcn.1800095a4
lea rcx, [rbp - 0x60]
lea r8, [rbp - 8]
mov edx, 0x131
call fcn.180009232
add rsi, qword [0x1800a80d0]
lea rcx, [rbp - 0x60]
mov rdx, rsi
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x18000250a
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x20], 0xfffffffffffffffe
mov rsi, rdx
mov rdi, rcx
mov al, byte [rcx]
test al, al
jne 0x18000253f
mov byte [rdi], 1
call fcn.1800091ba
mov qword [rdi + 8], rax
mov al, byte [rdi]
cmp al, 1
jne 0x1800025a7
mov rdi, qword [rdi + 8]
vxorps xmm0, xmm0, xmm0
mov rbx, rbp
vmovups ymmword [rbx], ymm0
mov rcx, rsi
vzeroupper
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rcx, rbx
mov rdx, rsi
mov r8, rax
call fcn.1800058e4
lea rdx, [rbp - 0x20]
mov rcx, rdi
mov r8, rbx
call fcn.18000afca
mov rsi, qword [rbp - 0x20]
mov rdx, qword [rbp + 0x18]
cmp rdx, 0x10
jb 0x180002594
mov rcx, qword [rbp]
inc rdx
call fcn.18000506c
add rsi, 0x40
mov rax, rsi
add rsp, 0xa8
pop rbx
pop rdi
pop rsi
pop rbp
ret
mov rcx, rdi
call fcn.1800095f6
lea rcx, [rbp - 0x20]
mov rdx, rax
call fcn.18000249c
cmp byte [0x1800ad034], 0
jne 0x180002624
mov rdx, qword [0x1800a80e0]
movabs rax, 0x6320a5b61625c138
add rax, rdx
movabs rcx, 0x6320a5b61625c125
add rcx, rdx
xor edx, edx
movabs r8, 0xd79435e50d79435f
lea r9, [0x1800ad001]
mulx r10, r10, r8
shr r10, 4
imul r10, r10, 0xffffffffffffffed
add r10, rcx
mov r10b, byte [rdx + r10]
xor r10b, byte [rax + rdx]
mov byte [rdx + r9], r10b
inc rdx
cmp rdx, 0x33
jne 0x1800025f8
mov byte [0x1800ad034], 1
movabs rsi, 0x6320a5b61625b9a0
mov rdx, qword [0x1800a80e8]
add rdx, rsi
mov rcx, rbp
lea r8, [rbp - 0x20]
call fcn.1800095a4
lea rcx, [rbp - 0x58]
mov r8, rbp
mov edx, 0x131
call fcn.180009232
add rsi, qword [0x1800a80f0]
lea rcx, [rbp - 0x58]
mov rdx, rsi
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x1800045da
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0xa0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x18], 0xfffffffffffffffe
mov rdi, rcx
cmp byte [rcx], 1
jne 0x180004693
mov rsi, r8
mov r8, rdx
lea rdx, [rbp - 0x28]
mov rcx, rdi
call fcn.18001e124
mov qword [rbp - 8], rdi
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rbp], xmm0
movabs rax, 0x8000000000000000
mov qword [rbp + 0x10], rax
movzx eax, byte [rdi]
cmp eax, 2
je 0x180004647
cmp eax, 1
jne 0x180004655
mov rax, qword [rdi + 8]
mov rax, qword [rax]
mov qword [rbp], rax
jmp 0x18000465d
mov rax, qword [rdi + 8]
mov rax, qword [rax + 8]
mov qword [rbp + 8], rax
jmp 0x18000465d
mov qword [rbp + 0x10], 1
lea rcx, [rbp - 0x28]
lea rdx, [rbp - 8]
call fcn.18001e2c8
test al, al
jne 0x180004686
lea rcx, [rbp - 0x28]
call fcn.18001e192
lea rsi, [rbp - 8]
mov rcx, rax
mov rdx, rsi
call fcn.18001f392
mov eax, dword [rsi]
add rsp, 0xa0
pop rdi
pop rsi
pop rbp
ret
mov rcx, rdi
call fcn.1800095f6
lea rcx, [rbp - 8]
mov rdx, rax
call fcn.18000249c
cmp byte [0x1800ae09b], 0
jne 0x1800046f6
mov rdx, qword [0x1800a81a0]
movabs rax, 0x7aa808bb91d42ebb
add rax, rdx
movabs rcx, 0x7aa808bb91d42ed5
add rcx, rdx
xor edx, edx
lea r8, [0x1800ae082]
mov r9b, byte [rax + rdx]
xor r9b, byte [rcx + rdx]
mov byte [rdx + r8], r9b
inc rdx
cmp rdx, 0x19
jne 0x1800046da
mov byte [0x1800ae09b], 1
movabs rsi, 0x7aa808bb91d3ffbc
mov rdx, qword [0x1800a81a8]
add rdx, rsi
lea rcx, [rbp - 0x28]
lea r8, [rbp - 8]
call fcn.1800095a4
lea rcx, [rbp - 0x60]
lea r8, [rbp - 0x28]
mov edx, 0x132
call fcn.180009232
add rsi, qword [0x1800a81b0]
lea rcx, [rbp - 0x60]
mov rdx, rsi
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x180004872
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0xa0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x18], 0xfffffffffffffffe
mov rdi, rcx
cmp byte [rcx], 1
jne 0x18000492b
mov rsi, r8
mov r8, rdx
lea rdx, [rbp - 0x28]
mov rcx, rdi
call fcn.18001e124
mov qword [rbp - 8], rdi
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rbp], xmm0
movabs rax, 0x8000000000000000
mov qword [rbp + 0x10], rax
movzx eax, byte [rdi]
cmp eax, 2
je 0x1800048df
cmp eax, 1
jne 0x1800048ed
mov rax, qword [rdi + 8]
mov rax, qword [rax]
mov qword [rbp], rax
jmp 0x1800048f5
mov rax, qword [rdi + 8]
mov rax, qword [rax + 8]
mov qword [rbp + 8], rax
jmp 0x1800048f5
mov qword [rbp + 0x10], 1
lea rcx, [rbp - 0x28]
lea rdx, [rbp - 8]
call fcn.18001e2c8
test al, al
jne 0x18000491e
lea rcx, [rbp - 0x28]
call fcn.18001e192
lea rsi, [rbp - 8]
mov rcx, rax
mov rdx, rsi
call fcn.18001e8cf
mov al, byte [rsi]
add rsp, 0xa0
pop rdi
pop rsi
pop rbp
ret
mov rcx, rdi
call fcn.1800095f6
lea rcx, [rbp - 8]
mov rdx, rax
call fcn.18000249c
cmp byte [0x1800ae09b], 0
jne 0x18000498e
mov rdx, qword [0x1800a81c0]
movabs rax, 0xe85104cc375cfca9
add rax, rdx
movabs rcx, 0xe85104cc375cfcc3
add rcx, rdx
xor edx, edx
lea r8, [0x1800ae082]
mov r9b, byte [rax + rdx]
xor r9b, byte [rcx + rdx]
mov byte [rdx + r8], r9b
inc rdx
cmp rdx, 0x19
jne 0x180004972
mov byte [0x1800ae09b], 1
movabs rsi, 0xe85104cc375ccdaa
mov rdx, qword [0x1800a81c8]
add rdx, rsi
lea rcx, [rbp - 0x28]
lea r8, [rbp - 8]
call fcn.1800095a4
lea rcx, [rbp - 0x60]
lea r8, [rbp - 0x28]
mov edx, 0x132
call fcn.180009232
add rsi, qword [0x1800a81d0]
lea rcx, [rbp - 0x60]
mov rdx, rsi
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x180004a4e
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0xa0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x18], 0xfffffffffffffffe
mov rdi, rcx
cmp byte [rcx], 1
jne 0x180004b09
mov rsi, r8
mov r8, rdx
lea rdx, [rbp - 0x28]
mov rcx, rdi
call fcn.18001e124
mov qword [rbp - 8], rdi
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rbp], xmm0
movabs rax, 0x8000000000000000
mov qword [rbp + 0x10], rax
movzx eax, byte [rdi]
cmp eax, 2
je 0x180004abb
cmp eax, 1
jne 0x180004ac9
mov rax, qword [rdi + 8]
mov rax, qword [rax]
mov qword [rbp], rax
jmp 0x180004ad1
mov rax, qword [rdi + 8]
mov rax, qword [rax + 8]
mov qword [rbp + 8], rax
jmp 0x180004ad1
mov qword [rbp + 0x10], 1
lea rcx, [rbp - 0x28]
lea rdx, [rbp - 8]
call fcn.18001e2c8
test al, al
jne 0x180004afa
lea rcx, [rbp - 0x28]
call fcn.18001e192
lea rsi, [rbp - 8]
mov rcx, rax
mov rdx, rsi
call fcn.18001ea2e
vmovss xmm0, dword [rsi]
add rsp, 0xa0
pop rdi
pop rsi
pop rbp
ret
mov rcx, rdi
call fcn.1800095f6
lea rcx, [rbp - 8]
mov rdx, rax
call fcn.18000249c
cmp byte [0x1800ae09b], 0
jne 0x180004b6c
mov rdx, qword [0x1800a81e0]
movabs rax, 0xba9ce5c3c50434b5
add rax, rdx
movabs rcx, 0xba9ce5c3c50434cf
add rcx, rdx
xor edx, edx
lea r8, [0x1800ae082]
mov r9b, byte [rax + rdx]
xor r9b, byte [rcx + rdx]
mov byte [rdx + r8], r9b
inc rdx
cmp rdx, 0x19
jne 0x180004b50
mov byte [0x1800ae09b], 1
movabs rsi, 0xba9ce5c3c50405b6
mov rdx, qword [0x1800a81e8]
add rdx, rsi
lea rcx, [rbp - 0x28]
lea r8, [rbp - 8]
call fcn.1800095a4
lea rcx, [rbp - 0x60]
lea r8, [rbp - 0x28]
mov edx, 0x132
call fcn.180009232
add rsi, qword [0x1800a81f0]
lea rcx, [rbp - 0x60]
mov rdx, rsi
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x180005a16
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
cmp byte [0x1800acf76], 0
jne 0x180005a82
mov rdx, qword [0x1800a8270]
movabs rcx, 0x2265b1ee0df6c616
add rcx, rdx
movabs r8, 0x2265b1ee0df6c603
add r8, rdx
xor edx, edx
movabs r9, 0xd79435e50d79435f
lea r10, [0x1800acf61]
mulx r11, r11, r9
shr r11, 4
imul r11, r11, 0xffffffffffffffed
add r11, r8
mov r11b, byte [rdx + r11]
xor r11b, byte [rcx + rdx]
mov byte [rdx + r10], r11b
inc rdx
cmp rdx, 0x15
jne 0x180005a56
mov byte [0x1800acf76], 1
mov qword [rax + 0x10], 0
lea rcx, [0x1800acf61]
mov qword [rax + 8], rcx
lea rcx, vtable.std::bad_array_new_length.0
mov qword [rax], rcx
ret
Function at 0x180006d50
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov rax, qword [0x1800acd00]
xor rax, rsp
mov qword [rsp + 0x80], rax
cmp edx, 0xffffffff
je 0x180006e7c
mov esi, edx
mov rdi, rcx
mov rax, qword [rcx + 0x40]
cmp qword [rax], 0
je 0x180006dad
mov rax, qword [rdi + 0x58]
mov ecx, dword [rax]
test ecx, ecx
jle 0x180006dad
dec ecx
mov dword [rax], ecx
mov rax, qword [rdi + 0x40]
mov rcx, qword [rax]
lea rdx, [rcx + 1]
mov qword [rax], rdx
mov byte [rcx], sil
jmp 0x180006ec1
cmp qword [rdi + 0x80], 0
je 0x180006e80
mov rax, qword [rdi + 0x18]
lea rcx, [rdi + 0x70]
cmp qword [rax], rcx
jne 0x180006de7
mov ecx, dword [rdi + 0x90]
mov rdx, qword [rdi + 0x88]
mov qword [rax], rdx
mov rax, qword [rdi + 0x38]
mov qword [rax], rdx
sub ecx, edx
mov rax, qword [rdi + 0x50]
mov dword [rax], ecx
mov rcx, qword [rdi + 0x68]
test rcx, rcx
je 0x180006e87
lea r9, [rsp + 0x60]
mov byte [r9 - 1], sil
lea rax, [rsp + 0x80]
lea rdx, [rdi + 0x74]
mov r10, qword [rcx]
lea r8, [rsp + 0x48]
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rax
lea r14, [rsp + 0x60]
mov qword [rsp + 0x28], r14
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea rbx, [rsp + 0x5f]
mov r8, rbx
call qword [r10 + 0x38]
mov ebp, 0xffffffff
cmp eax, 2
jae 0x180006ea0
mov r15, qword [rsp + 0x48]
sub r15, r14
je 0x180006e6c
mov r9, qword [rdi + 0x80]
mov edx, 1
mov rcx, r14
mov r8, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp r15, rax
jne 0x180006ebf
mov byte [rdi + 0x71], 1
cmp qword [rsp + 0x50], rbx
mov eax, 0xffffffff
jmp 0x180006eba
xor esi, esi
jmp 0x180006ec1
mov esi, 0xffffffff
jmp 0x180006ec1
mov rdx, qword [rdi + 0x80]
movsx ecx, sil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
cmp eax, 0xffffffff
cmove esi, eax
jmp 0x180006ec1
cmp eax, 3
jne 0x180006ebf
mov rdx, qword [rdi + 0x80]
movsx ecx, byte [rsp + 0x5f]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
cmp eax, 0xffffffff
cmove esi, eax
mov ebp, esi
mov esi, ebp
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.180083460
mov eax, esi
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x180007282
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
test r8, r8
jle 0x1800072bd
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0x68], 0
je 0x1800072c4
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
xor esi, esi
jmp 0x1800073a7
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x18000730a
mov rax, qword [rbx + 0x50]
movsxd r15, dword [rax]
test r15, r15
je 0x18000730a
cmp r15, rsi
cmovae r15, rsi
mov rcx, rdi
mov r8, r15
call fcn.180084d00
add rdi, r15
mov r14, rsi
sub r14, r15
mov rax, qword [rbx + 0x50]
sub dword [rax], r15d
mov rax, qword [rbx + 0x38]
movsxd rcx, r15d
add qword [rax], rcx
jmp 0x18000730d
mov r14, rsi
cmp qword [rbx + 0x80], 0
je 0x1800073a4
mov rax, qword [rbx + 0x18]
lea rcx, [rbx + 0x70]
cmp qword [rax], rcx
jne 0x180007347
mov ecx, dword [rbx + 0x90]
mov rdx, qword [rbx + 0x88]
mov qword [rax], rdx
mov rax, qword [rbx + 0x38]
mov qword [rax], rdx
sub ecx, edx
mov rax, qword [rbx + 0x50]
mov dword [rax], ecx
mov r15, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp r14, 0x1000
jb 0x18000737f
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rdi
call r15
add rdi, rax
sub r14, rax
cmp rax, 0xfff
je 0x18000734e
jmp 0x1800073a4
test r14, r14
je 0x1800073a1
mov r9, qword [rbx + 0x80]
mov edx, 1
mov rcx, rdi
mov r8, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub r14, rax
jmp 0x1800073a4
xor r14d, r14d
sub rsi, r14
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x1800073b6
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0x68], 0
je 0x1800073ec
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rbx + 0x40]
mov rcx, qword [rax]
test rcx, rcx
je 0x180007434
test rsi, rsi
jle 0x180007434
mov rax, qword [rbx + 0x58]
mov r15d, dword [rax]
test r15d, r15d
jle 0x180007434
cmp r15, rsi
cmovae r15, rsi
mov rdx, rdi
mov r8, r15
call fcn.180084d00
add rdi, r15
mov r14, rsi
sub r14, r15
mov rax, qword [rbx + 0x58]
sub dword [rax], r15d
mov rax, qword [rbx + 0x40]
add qword [rax], r15
jmp 0x180007437
mov r14, rsi
test r14, r14
jle 0x18000745c
mov r9, qword [rbx + 0x80]
test r9, r9
je 0x18000745c
mov edx, 1
mov rcx, rdi
mov r8, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub r14, rax
sub rsi, r14
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x180007758
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rax, qword [0x1800acd00]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov dil, 1
cmp qword [rcx + 0x68], 0
je 0x18000780f
mov rsi, rcx
cmp byte [rcx + 0x71], 0
je 0x18000780f
mov rax, qword [rsi]
mov rcx, rsi
mov edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x180007804
mov rcx, qword [rsi + 0x68]
lea r9, [rsp + 0x50]
lea rdx, [rsi + 0x74]
mov rax, qword [rcx]
lea r8, [rsp + 0x28]
mov qword [rsp + 0x20], r8
lea rdi, [rsp + 0x30]
mov r8, rdi
call qword [rax + 0x40]
cmp eax, 3
je 0x180007808
cmp eax, 1
je 0x1800077d3
test eax, eax
jne 0x180007804
mov byte [rsi + 0x71], 0
mov rbx, qword [rsp + 0x28]
sub rbx, rdi
je 0x1800077fa
mov r9, qword [rsi + 0x80]
mov edx, 1
mov rcx, rdi
mov r8, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbx, rax
jne 0x180007804
cmp byte [rsi + 0x71], 0
sete dil
jmp 0x18000780f
xor edi, edi
jmp 0x18000780f
mov byte [rsi + 0x71], 0
mov dil, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180083460
mov eax, edi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
Function at 0x18000fb62
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
call fcn.180011b50
cmp eax, 0x2f
je 0x18000fba8
cmp eax, 0x2a
jne 0x18000fbc8
mov rcx, rsi
call fcn.180011b50
cmp eax, 0x2a
je 0x18000fb91
inc eax
cmp eax, 1
ja 0x18000fb7b
jmp 0x18000fbdd
mov rcx, rsi
call fcn.180011b50
cmp eax, 0x2f
je 0x18000fbc1
mov rcx, rsi
call fcn.180011bf4
jmp 0x18000fb7b
mov edi, 0x4803
mov rcx, rsi
call fcn.180011b50
inc eax
cmp eax, 0xf
jae 0x18000fbad
bt edi, eax
jae 0x18000fbad
mov al, 1
jmp 0x18000fcdd
cmp byte [0x1800ad288], 0
je 0x18000fbf2
lea rax, [0x1800a8610]
jmp 0x18000fcca
cmp byte [0x1800ad257], 0
je 0x18000fc5a
lea rax, [0x1800a8608]
jmp 0x18000fcca
mov rax, qword [0x1800a8600]
movabs r8, 0x7ef4208353acc9e
add r8, rax
movabs r9, 0x7ef4208353acc84
add r9, rax
xor edx, edx
movabs r10, 0x4ec4ec4ec4ec4ec5
lea r11, [0x1800ad258]
lea rax, [0x1800a8610]
lea rcx, [0x1800ad288]
mulx rdi, rdi, r10
shr rdi, 3
imul rdi, rdi, 0xffffffffffffffe6
add rdi, r9
mov bl, byte [rdx + rdi]
xor bl, byte [r8 + rdx]
mov byte [rdx + r11], bl
inc rdx
cmp rdx, 0x30
jne 0x18000fc34
jmp 0x18000fcc7
mov rax, qword [0x1800a8600]
movabs r8, 0x7ef4208353acc4e
add r8, rax
movabs r9, 0x7ef4208353acc3c
add r9, rax
xor edx, edx
movabs r10, 0xe38e38e38e38e38f
lea r11, [0x1800ad231]
lea rax, [0x1800a8608]
lea rcx, [0x1800ad257]
mulx rdi, rdi, r10
shr rdi, 3
and rdi, 0xfffffffffffffffe
lea rdi, [rdi + rdi*8]
mov rbx, r9
sub rbx, rdi
mov bl, byte [rbx + rdx]
xor bl, byte [r8 + rdx]
mov byte [rdx + r11], bl
inc rdx
cmp rdx, 0x26
jne 0x18000fc9c
mov byte [rcx], 1
movabs rcx, 0x7ef4208353abac2
add rcx, qword [rax]
mov qword [rsi + 0x70], rcx
xor eax, eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x180011e90
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rbx, rdx
mov rsi, rcx
mov dl, byte [rcx + 0x14]
lea r14, [rcx + 0x50]
mov rcx, r14
call fcn.18000791e
mov r15, qword [rbx]
mov dil, 1
cmp r15, qword [rbx + 8]
je 0x180011f64
mov rcx, rsi
call fcn.180011b50
mov edx, dword [rsi + 0x14]
cmp dword [r15], edx
jg 0x180011ee4
cmp edx, dword [r15 + 4]
jg 0x180011ee4
mov rcx, r14
call fcn.18000791e
add r15, 8
jmp 0x180011eb6
cmp byte [0x1800add25], 0
jne 0x180011f4d
mov rdx, qword [0x1800a87b8]
movabs rax, 0xeedf691395cf131e
add rax, rdx
movabs rcx, 0xeedf691395cf1303
add rcx, rdx
xor edx, edx
movabs r8, 0x97b425ed097b425f
lea r9, [0x1800adcff]
mulx r10, r10, r8
shr r10, 4
imul r10, r10, 0xffffffffffffffe5
add r10, rcx
mov r10b, byte [rdx + r10]
xor r10b, byte [rax + rdx]
mov byte [rdx + r9], r10b
inc rdx
cmp rdx, 0x26
jne 0x180011f21
mov byte [0x1800add25], 1
movabs rax, 0xeedf691395ceefe0
add rax, qword [0x1800a87c0]
mov qword [rsi + 0x70], rax
xor edi, edi
mov eax, edi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret