joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18005d660
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
test dword [rdx + 0x58], 0x1000000
lea rdi, [rdx + 0x80]
mov rbx, rdx
mov rbp, rcx
je 0x18005d6b0
mov qword [rdx + 0x238], 0
lea rcx, [0x18005e6d0]
mov rdx, rdi
mov r8d, reloc.WS2_32.dll_recv
call qword [sym.imp.KERNEL32.dll_QueueUserWorkItem]
jmp 0x18005d743
lea rcx, [rdi + 0x40]
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm0
test dword [rdx + 0x58], 0x80000
je 0x18005d6d3
mov rax, qword [rdi + 0x70]
or rax, 1
mov qword [rdi + 0x58], rax
mov qword [rsp + 0x20], rcx
lea rdx, [0x18009ae00]
mov rcx, qword [rbx + 0x118]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x18005d703
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x18005d747
test dword [rbx + 0x58], 0x80000
je 0x18005d7a6
cmp qword [rdi + 0x78], 0xffffffffffffffff
lea rcx, [rdi + 0x78]
jne 0x18005d7a6
mov rdx, qword [rdi + 0x70]
lea r8, [0x18005ada0]
mov dword [rsp + 0x28], 4
mov r9, rdi
mov dword [rsp + 0x20], 0xffffffff
call qword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
test eax, eax
jne 0x18005d7a6
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x18005d759
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x18005d767
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx eax, ax
or eax, 0x80070000
mov rdx, rdi
mov ecx, 0x40
cdqe
mov qword [rcx + rdx], rax
mov qword [rdi + 0x68], 0
mov rax, qword [rbp + 0x48]
test rax, rax
je 0x18005d79c
mov rax, qword [rax + 0x68]
mov qword [rdi + 0x68], rax
mov rax, qword [rbp + 0x48]
mov qword [rax + 0x68], rdi
mov qword [rbp + 0x48], rdi
jmp 0x18005d7c5
mov qword [rdi + 0x68], rdi
mov qword [rbp + 0x48], rdi
jmp 0x18005d7c5
mov rcx, qword [rbx + 0x128]
test rcx, rcx
je 0x18005d7c5
xor r9d, r9d
lea rdx, [0x18005ce90]
lea r8d, [r9 + 0x32]
call fcn.1800597f0
or dword [rbx + 0x58], 0x10000
inc dword [rbx + 0x78]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x18005d7f0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov ebx, r8d
mov rdi, rdx
mov rbp, rcx
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x40]
mov esi, r9d
call fcn.180057210
mov edx, ebx
lea r8, [rsp + 0x30]
mov rcx, rdi
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x30], xmm0
call qword [rdi + 0x68]
mov rdx, qword [rsp + 0x38]
test rdx, rdx
je 0x18005d8a8
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x18005d8a8
mov rcx, qword [rdi + 0x118]
lea r9, [rsp + 0x70]
cmp esi, eax
mov qword [rsp + 0x20], 0
cmova esi, eax
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x18005d893
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, [rsp + 0x40]
mov rdx, rdi
mov r8d, eax
mov rcx, rbp
call fcn.18005d8e0
jmp 0x18005d8ba
mov edx, dword [rsp + 0x70]
lea r8, [rsp + 0x30]
mov rcx, rdi
call qword [rdi + reloc.WS2_32.dll_WSASetLastError]
mov eax, dword [rsp + 0x70]
jmp 0x18005d8bc
lea r8, [rsp + 0x30]
mov rdx, 0xfffffffffffff024
mov rcx, rdi
call qword [rdi + reloc.WS2_32.dll_WSASetLastError]
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x180061590
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x478
mov rax, qword [0x180084080]
xor rax, rsp
mov qword [rsp + 0x460], rax
lea r8, [0x180324c20]
xor edx, edx
lea rcx, str.0.0.0.0
call fcn.180057220
test eax, eax
jne 0x18006172d
lea r8, [0x180324c00]
xor edx, edx
lea rcx, [0x18006a7b0]
call fcn.180057270
test eax, eax
jne 0x18006172d
lea ecx, [rax + 0x43]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cmp eax, 1
je 0x180061715
mov ecx, 0x202
lea rdx, [rsp + 0x2c0]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x180061734
mov qword [rsp + 0x480], rbx
lea edx, [rax + 1]
xor r8d, r8d
mov qword [rsp + 0x470], rdi
lea ecx, [rax + 2]
mov dword [0x180324c34], 1
call qword [sym.imp.WS2_32.dll_socket]
xor edi, edi
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180061693
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0x274
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov edx, 0xffff
mov r8d, 0x2005
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x18006168a
mov eax, dword [0x180324c34]
test dword [rsp + 0x40], 0x20000
cmovne eax, edi
mov dword [0x180324c34], eax
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
xor r8d, r8d
mov dword [0x180324c30], 1
lea edx, [r8 + 1]
lea ecx, [rdx + 0x16]
call qword [sym.imp.WS2_32.dll_socket]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180061705
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0x274
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov edx, 0xffff
mov r8d, 0x2005
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x1800616fc
mov eax, dword [0x180324c30]
test dword [rsp + 0x40], 0x20000
cmovne eax, edi
mov dword [0x180324c30], eax
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
mov rbx, qword [rsp + 0x480]
mov rdi, qword [rsp + 0x470]
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.180062330
add rsp, 0x478
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
lea rdx, str.WSAStartup
mov ecx, eax
call fcn.18005c860
int3

Function at 0x1800617ac
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x1800617e6
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x1800617eb
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x180061834
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, reloc.WS2_32.dll_accept
cmp byte [rcx + rax], 0
je 0x180061834
dec r8
sub rdx, 1
jne 0x18006181a
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x140001480
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
lea rbp, [rcx + 2]
mov qword [rsp + 0x20], 4
mov qword [rsp + 0x18], rbp
nop word [rax + rax]
movzx r9d, byte [rbp - 1]
movzx edx, byte [rbp - 2]
movzx ebx, r9b
movzx r8d, byte [rbp]
movzx eax, dl
shr al, 7
add bl, bl
movzx ecx, byte [rbp + 1]
movzx eax, al
imul eax, eax, 0x1b
mov byte [rsp + 0x78], r9b
mov byte [rsp + 0x88], dl
add dl, dl
mov byte [rsp + 0x80], r8b
xor dl, al
mov dword [rsp + 8], eax
movzx eax, dl
movzx esi, dl
shr al, 7
add sil, sil
movzx eax, al
imul eax, eax, 0x1b
xor sil, al
mov dword [rsp + 4], eax
movzx eax, r9b
movzx r9d, r8b
shr al, 7
add r9b, r9b
movzx eax, al
imul r15d, eax, 0x1b
xor bl, r15b
movzx eax, bl
movzx r10d, bl
shr al, 7
add r10b, r10b
movzx eax, al
imul eax, eax, 0x1b
xor r10b, al
mov dword [rsp + 0x10], eax
movzx eax, r8b
shr al, 7
movzx eax, al
imul r12d, eax, 0x1b
xor r9b, r12b
mov dword [rsp + 0xc], r12d
movzx eax, r9b
movzx r8d, r9b
shr al, 7
xor r9b, dl
movzx eax, al
add r8b, r8b
imul ebp, eax, 0x1b
movzx eax, cl
shr al, 7
add cl, cl
movzx eax, al
imul eax, eax, 0x1b
xor r8b, bpl
xor cl, al
mov dword [rsp + 0x14], eax
movzx eax, cl
movzx r13d, cl
shr al, 7
add r13b, r13b
movzx eax, al
imul r14d, eax, 0x1b
xor r13b, r14b
xor r9b, r13b
movzx eax, r13b
shr al, 7
xor r9b, r8b
movzx eax, al
xor r9b, r10b
imul edi, eax, 0x1b
xor r9b, sil
movzx eax, r8b
mov byte [rsp], r9b
shr al, 7
movzx eax, al
imul r11d, eax, 0x1b
movzx eax, r10b
shr al, 7
xor r13b, cl
movzx eax, al
xor r13b, r8b
imul r9d, eax, 0x1b
xor r13b, r10b
mov r12, qword [rsp + 0x18]
xor r13b, bl
movzx ebx, byte [rsp + 0x80]
xor r13b, sil
mov rcx, qword [rsp + 0x18]
movzx eax, sil
shr al, 7
movzx esi, byte [rsp + 0x78]
mov r8d, dword [rsp + 0x10]
movzx r10d, byte [rcx + 1]
movzx eax, al
imul edx, eax, 0x1b
movzx eax, byte [rsp]
xor al, byte [rsp + 0x78]
xor al, byte [rsp + 0x88]
add al, al
xor al, dl
xor al, r9b
xor al, r11b
xor al, dil
xor al, bpl
xor al, r15b
xor al, byte [rsp + 4]
xor al, byte [rsp + 8]
xor al, byte [r12 + 1]
xor al, byte [rsp + 0x80]
xor al, byte [rsp + 0x78]
mov byte [r12 - 2], al
movzx eax, r13b
mov r12d, dword [rsp + 0xc]
xor al, bl
xor al, sil
xor r13b, r10b
add al, al
xor al, dl
xor al, r9b
xor al, r11b
xor al, dil
xor al, r14b
xor al, r12b
xor al, r8b
xor al, r15b
movzx r15d, byte [rsp + 0x88]
xor r13b, r15b
xor al, r10b
add r13b, r13b
xor al, bl
xor r13b, dl
xor al, r15b
mov byte [rcx - 1], al
xor r13b, r9b
mov eax, dword [rsp + 0x14]
xor r13b, r11b
movzx ecx, byte [rsp]
xor r13b, dil
xor cl, r10b
xor r13b, r14b
xor cl, bl
xor r13b, al
add cl, cl
xor r13b, r8b
xor cl, dl
xor cl, r9b
xor cl, r11b
xor cl, dil
xor cl, al
xor cl, bpl
mov rbp, qword [rsp + 0x18]
xor cl, r12b
xor cl, byte [rsp + 4]
xor cl, r10b
xor cl, sil
xor cl, r15b
xor r13b, byte [rsp + 8]
mov byte [rbp], cl
xor r13b, bl
xor r13b, sil
xor r13b, r15b
mov byte [rbp + 1], r13b
add rbp, 4
sub qword [rsp + 0x20], 1
mov qword [rsp + 0x18], rbp
jne 0x1400014b0
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140001720
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
test r8, r8
je 0x140001933
mov rax, rsp
push rbp
sub rsp, 0x40
mov qword [rax + 8], rbx
mov rbp, rcx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax - 0x10], r12
lea r12, [r8 - 1]
mov qword [rax - 0x18], r13
lea r13, [0x14000e810]
mov qword [rax - 0x20], r14
lea r14, [rdx + 9]
mov qword [rax - 0x28], r15
mov r15, rcx
sub r15, rdx
shr r12, 4
add r15, 0xf0
inc r12
nop dword [rax]
nop word [rax + rax]
movups xmm0, xmmword [r14 - 9]
lea rbx, [r14 - 9]
mov r8d, 4
mov rcx, rbx
nop dword [rax]
nop word [rax + rax]
mov edx, 4
nop word [rax + rax]
movzx eax, byte [rcx + r15 - 0x10]
xor byte [rcx], al
inc rcx
sub rdx, 1
jne 0x1400017b0
sub r8, 1
jne 0x1400017a0
mov dil, 0xd
nop word [rax + rax]
movzx eax, byte [r14]
mov r8, rbx
movzx ecx, byte [r14 + 4]
mov r9d, 4
mov byte [r14 + 4], al
movzx eax, byte [r14 - 4]
mov byte [r14], al
movzx eax, byte [r14 - 8]
mov byte [r14 - 4], al
movzx eax, byte [r14 + 1]
mov byte [r14 - 8], cl
movzx ecx, byte [r14 - 7]
mov byte [r14 - 7], al
movzx eax, byte [r14 + 5]
mov byte [r14 + 1], cl
movzx ecx, byte [r14 - 3]
mov byte [r14 - 3], al
movzx eax, byte [r14 - 2]
mov byte [r14 + 5], cl
movzx ecx, byte [r14 - 6]
mov byte [r14 - 6], al
movzx eax, byte [r14 + 2]
mov byte [r14 - 2], al
movzx eax, byte [r14 + 6]
mov byte [r14 + 2], al
mov byte [r14 + 6], cl
nop dword [rax]
nop word [rax + rax]
mov rcx, r8
mov edx, 4
nop dword [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 4]
movzx eax, byte [rax + r13]
mov byte [rcx - 4], al
sub rdx, 1
jne 0x140001860
inc r8
sub r9, 1
jne 0x140001850
movzx r8d, dil
lea r9d, [rdx + 4]
shl r8, 4
mov rax, rbx
sub r8, rbx
add r8, rbp
nop dword [rax]
nop word [rax + rax]
mov edx, 4
nop word [rax + rax]
movzx ecx, byte [rax + r8]
xor byte [rax], cl
inc rax
sub rdx, 1
jne 0x1400018b0
sub r9, 1
jne 0x1400018a0
test dil, dil
je 0x1400018dc
mov rcx, rbx
call fcn.140001480
add dil, 0xff
jmp 0x1400017d0
mov ecx, 0x10
movzx eax, byte [r15 + rbx]
xor byte [rbx], al
lea rbx, [rbx + 1]
sub rcx, 1
jne 0x1400018e1
add r14, 0x10
add r15, 0xfffffffffffffff0
movups xmmword [rbp + 0xf0], xmm0
sub r12, 1
jne 0x140001780
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov r13, qword [rsp + 0x30]
mov r12, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x140006010
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x140006047
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x140006068
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14000606a
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x1400060c3
test ecx, ecx
jle 0x1400060a3
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
sub rbx, rbp
add r14, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x1400060c3
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x1400060c3
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x30]
sub rsi, rbx
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1400060f0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140006112
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x140006128
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140006144
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140006146
xor ecx, ecx
mov qword [rsp + 0x20], rdi
movsxd rax, ecx
test ecx, ecx
je 0x140006180
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
sub rbx, rdi
add r14, rdi
mov r8, rbx
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x140006227
mov r9, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r9], rax
jne 0x1400061bb
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r9], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov rdi, r8
cmp r8, 0xfff
jbe 0x140006201
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
add r14, rax
mov rdi, rbx
cmp rax, 0xfff
jne 0x140006240
cmp rbx, rax
ja 0x1400061d0
mov r8, rdi
test rdi, rdi
je 0x140006227
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov r8, rdi
sub r8, rax
sub rbp, r8
mov rdi, qword [rsp + 0x20]
mov rax, rbp
mov rbx, qword [rsp + 0x28]
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
sub rbp, rbx
jmp 0x14000622a
Function at 0x140006650
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140020010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14000667d
xor eax, eax
jmp 0x1400067d2
mov rdx, qword [rcx + 0x40]
mov rax, qword [rdx]
test rax, rax
je 0x1400066a8
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, rax
cmp rax, r8
jae 0x1400066a8
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x1400067d2
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x1400067c5
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x1400066eb
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140006716
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400067ca
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140006785
sub eax, 1
je 0x140006785
cmp eax, 2
jne 0x1400067c5
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400067ca
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x1400067b3
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x1400067c5
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, edi
jne 0x1400067ca
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14000c030
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140006b80
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140020010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140006c53
cmp byte [rcx + 0x71], 0
je 0x140006c53
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140006c4f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140006c14
sub eax, 1
je 0x140006c18
cmp eax, 2
jne 0x140006c4f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14000c030
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140006c46
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140006c4f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x140006bfc
xor al, al
jmp 0x140006bfc
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14000c030
add rsp, 0x60
pop rbx
ret
Function at 0x14000a750
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x140020010]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x20], rcx
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x14000a863
movsxd rax, dword [rdx + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x14000a863
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
xor edx, edx
mov qword [rsp + 0x50], rdx
mov ecx, dword [rax + rsi + 0xb0]
test ecx, ecx
jne 0x14000a7c8
mov qword [rdi], rdx
mov qword [rdi + 8], rdx
mov qword [rdi + 0x10], rdx
jmp 0x14000a870
lea rbx, [rsi + rcx]
mov ebp, dword [rax + rsi + 0xb4]
add rbp, rbx
mov rcx, qword [rsp + 0x48]
cmp rbx, rbp
jae 0x14000a851
mov r8d, dword [rbx + 4]
test r8d, r8d
je 0x14000a851
mov eax, dword [rbx]
add rax, rsi
mov qword [rsp + 0x28], rax
lea rax, [rbx + 8]
mov qword [rsp + 0x30], rax
lea rax, [r8 - 8]
shr rax, 1
mov dword [rsp + 0x38], eax
cmp rcx, rdx
je 0x14000a82a
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rcx], xmm0
movsd xmm1, qword [rsp + 0x38]
movsd qword [rcx + 0x10], xmm1
add rcx, 0x18
mov qword [rsp + 0x48], rcx
jmp 0x14000a846
lea r8, [rsp + 0x28]
mov rdx, rcx
lea rcx, [rsp + 0x40]
call fcn.14000ada0
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
mov eax, dword [rbx + 4]
add rbx, rax
cmp rbx, rbp
jb 0x14000a7e0
mov rax, qword [rsp + 0x40]
mov qword [rdi], rax
mov qword [rdi + 8], rcx
mov qword [rdi + 0x10], rdx
jmp 0x14000a870
xor edx, edx
mov qword [rcx], rdx
mov qword [rcx + 8], rdx
mov qword [rcx + 0x10], rdx
mov rax, rdi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14000c030
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14000bdf0
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push rbx
push rbp
push r14
sub rsp, 0x50
mov rax, qword [0x140020010]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor ebp, ebp
lea r9, [rsp + 0x20]
mov r14, rcx
mov dword [rsp + 0x20], ebp
xor r8d, r8d
xor edx, edx
mov ebx, ebp
lea ecx, [rbp + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x14000be7e
nop dword [rax]
test rbx, rbx
je 0x14000be46
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rax
mov ecx, 0xb
mov rbx, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x14000be30
test eax, eax
jns 0x14000be9f
test rbx, rbx
je 0x14000bea4
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
jmp 0x14000bf96
test rbx, rbx
jne 0x14000beab
xor eax, eax
jmp 0x14000bf96
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x80], rdi
mov edi, ebp
cmp dword [rbx], ebp
jbe 0x14000bf76
mov esi, edi
lea rdx, [rbx + 0x30]
imul rax, rsi, 0x128
mov qword [rsp + 0x28], rbp
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], 0xf
movzx ecx, word [rax + rbx + 0x2e]
add rcx, rax
add rdx, rcx
inc r8
cmp byte [rdx + r8], bpl
jne 0x14000bef4
lea rcx, [rsp + 0x28]
call fcn.140006ff0
cmp qword [r14 + 0x18], 0x10
mov rdx, r14
jb 0x14000bf14
mov rdx, qword [r14]
cmp qword [rsp + 0x40], 0x10
lea rcx, [rsp + 0x28]
cmovae rcx, qword [rsp + 0x28]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x14000bfac
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x14000bf6c
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000bf67
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000bffd
call fcn.14000c050
inc edi
cmp edi, dword [rbx]
jb 0x14000bec2
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14000c030
add rsp, 0x50
pop r14
pop rbp
pop rbx
ret
imul rax, rsi, 0x128
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
mov rdi, qword [rax + rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x14000c009
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c004
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000c004
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000c050
mov rax, rdi
jmp 0x14000bf89