joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401b1970
Capabilities:
Set socket configuration

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0xb0]
mov qword [rbp + 0x10], rcx
mov esi, edx
mov edi, r8d
mov rbx, r9
xor edx, edx
mov dword [rbp - 0x40], edx
lea rdx, [rbp - 0x40]
cmp dword [rcx], ecx
call fcn.140172800
mov rcx, qword [rbp + 0x10]
mov r14, qword [rcx + 8]
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov r15d, dword [rbp + 0x30]
mov dword [rsp + 0x20], r15d
mov rcx, r14
mov qword [rbp - 0x50], rcx
mov edx, esi
mov dword [rbp - 0x44], edx
mov r8d, edi
mov dword [rbp - 0x48], r8d
mov r9, rbx
mov qword [rbp - 0x58], r9
lea rcx, [rbp - 0x80]
call fcn.140008f60
mov rcx, qword [rbp - 0x50]
mov edx, dword [rbp - 0x44]
mov r8d, dword [rbp - 0x48]
mov r9, qword [rbp - 0x58]
call sub.WS2_32.dll_setsockopt
mov esi, eax
lea rcx, [rbp - 0x80]
call fcn.140008fb0
call sub.KERNEL32.dll_GetLastError
mov edi, eax
cmp byte [rbp - 0x40], 0
je 0x1401b1a16
mov rcx, qword [rbp + 0x10]
xor edx, edx
call fcn.140172890
call fcn.140002d94
mov dword [rax + 8], edi
mov eax, esi
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x1401b1a70
Capabilities:
Set socket configuration

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0xb0]
xor eax, eax
mov qword [rbp - 0x48], rax
mov qword [rbp + 0x10], rcx
mov edi, edx
mov ebx, r8d
mov rsi, r9
xor edx, edx
mov dword [rbp - 0x40], edx
lea rdx, [rbp - 0x40]
cmp dword [rcx], ecx
call fcn.140172800
mov rcx, qword [rbp + 0x10]
mov r14, qword [rcx + 8]
mov qword [rbp - 0x48], rsi
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov r15d, dword [rbp + 0x30]
mov dword [rsp + 0x20], r15d
mov rcx, r14
mov qword [rbp - 0x58], rcx
mov edx, edi
mov dword [rbp - 0x4c], edx
mov r8d, ebx
mov dword [rbp - 0x50], r8d
mov r9, rsi
mov qword [rbp - 0x60], r9
lea rcx, [rbp - 0x88]
call fcn.140008f60
mov rcx, qword [rbp - 0x58]
mov edx, dword [rbp - 0x4c]
mov r8d, dword [rbp - 0x50]
mov r9, qword [rbp - 0x60]
call sub.WS2_32.dll_setsockopt
mov esi, eax
lea rcx, [rbp - 0x88]
call fcn.140008fb0
call sub.KERNEL32.dll_GetLastError
mov edi, eax
xor ecx, ecx
mov qword [rbp - 0x48], rcx
cmp byte [rbp - 0x40], 0
je 0x1401b1b2c
mov rcx, qword [rbp + 0x10]
xor edx, edx
call fcn.140172890
call fcn.140002d94
mov dword [rax + 8], edi
mov eax, esi
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x1401b1c90
Capabilities:
Connect socket

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x98
lea rbp, [rsp + 0xd0]
xor eax, eax
mov qword [rbp - 0x48], rax
mov qword [rbp + 0x10], rcx
mov rsi, rdx
mov edi, r8d
mov rbx, r9
xor edx, edx
mov dword [rbp - 0x40], edx
lea rdx, [rbp - 0x40]
cmp dword [rcx], ecx
call fcn.140172800
mov rcx, qword [rbp + 0x10]
mov r14, qword [rcx + 8]
test rsi, rsi
jne 0x1401b1ce0
xor r15d, r15d
jmp 0x1401b1ce4
lea r15, [rsi + 0x10]
mov qword [rbp - 0x48], r15
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rsi, qword [rbp + 0x30]
mov qword [rsp + 0x20], rsi
mov rsi, qword [rbp + 0x38]
mov qword [rsp + 0x28], rsi
mov rsi, qword [rbp + 0x40]
mov qword [rsp + 0x30], rsi
mov rcx, r14
mov qword [rbp - 0x54], rcx
mov rdx, r15
mov qword [rbp - 0x5c], rdx
mov r8d, edi
mov dword [rbp - 0x4c], r8d
mov r9, rbx
mov qword [rbp - 0x64], r9
lea rcx, [rbp - 0x90]
call fcn.140008f60
mov rcx, qword [rbp - 0x54]
mov rdx, qword [rbp - 0x5c]
mov r8d, dword [rbp - 0x4c]
mov r9, qword [rbp - 0x64]
call sub.WS2_32.dll_WSAConnect
mov esi, eax
lea rcx, [rbp - 0x90]
call fcn.140008fb0
call sub.KERNEL32.dll_GetLastError
mov edi, eax
xor ecx, ecx
mov qword [rbp - 0x48], rcx
cmp byte [rbp - 0x40], 0
je 0x1401b1d73
mov rcx, qword [rbp + 0x10]
xor edx, edx
call fcn.140172890
call fcn.140002d94
mov dword [rax + 8], edi
mov eax, esi
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x1401b2330
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x98
lea rbp, [rsp + 0xd0]
xor eax, eax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x50], rax
mov qword [rbp + 0x10], rcx
mov rdi, rdx
mov ebx, r8d
mov rsi, r9
mov r14, qword [rbp + 0x30]
xor edx, edx
mov dword [rbp - 0x40], edx
lea rdx, [rbp - 0x40]
cmp dword [rcx], ecx
call fcn.140172800
mov rcx, qword [rbp + 0x10]
mov r15, qword [rcx + 8]
mov qword [rbp - 0x48], rsi
mov qword [rbp - 0x50], r14
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov qword [rsp + 0x20], r14
mov r14, qword [rbp + 0x38]
mov qword [rsp + 0x28], r14
mov r14, qword [rbp + 0x40]
mov qword [rsp + 0x30], r14
mov rcx, r15
mov qword [rbp - 0x5c], rcx
mov rdx, rdi
mov qword [rbp - 0x64], rdx
mov r8d, ebx
mov dword [rbp - 0x54], r8d
mov r9, rsi
mov qword [rbp - 0x6c], r9
lea rcx, [rbp - 0x98]
call fcn.140008f60
mov rcx, qword [rbp - 0x5c]
mov rdx, qword [rbp - 0x64]
mov r8d, dword [rbp - 0x54]
mov r9, qword [rbp - 0x6c]
call sub.WS2_32.dll_WSARecv
mov esi, eax
lea rcx, [rbp - 0x98]
call fcn.140008fb0
call sub.KERNEL32.dll_GetLastError
mov edi, eax
xor ecx, ecx
mov qword [rbp - 0x50], rcx
xor ecx, ecx
mov qword [rbp - 0x48], rcx
cmp byte [rbp - 0x40], 0
je 0x1401b2413
mov rcx, qword [rbp + 0x10]
xor edx, edx
call fcn.140172890
call fcn.140002d94
mov dword [rax + 8], edi
mov eax, esi
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x1401b24c0
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x98
lea rbp, [rsp + 0xd0]
xor eax, eax
mov qword [rbp - 0x48], rax
mov qword [rbp + 0x10], rcx
mov rdi, rdx
mov ebx, r8d
mov rsi, r9
xor edx, edx
mov dword [rbp - 0x40], edx
lea rdx, [rbp - 0x40]
cmp dword [rcx], ecx
call fcn.140172800
mov rcx, qword [rbp + 0x10]
mov r14, qword [rcx + 8]
mov qword [rbp - 0x48], rsi
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov r15d, dword [rbp + 0x30]
mov dword [rsp + 0x20], r15d
mov r15, qword [rbp + 0x38]
mov qword [rsp + 0x28], r15
mov r15, qword [rbp + 0x40]
mov qword [rsp + 0x30], r15
mov rcx, r14
mov qword [rbp - 0x54], rcx
mov rdx, rdi
mov qword [rbp - 0x5c], rdx
mov r8d, ebx
mov dword [rbp - 0x4c], r8d
mov r9, rsi
mov qword [rbp - 0x64], r9
lea rcx, [rbp - 0x90]
call fcn.140008f60
mov rcx, qword [rbp - 0x54]
mov rdx, qword [rbp - 0x5c]
mov r8d, dword [rbp - 0x4c]
mov r9, qword [rbp - 0x64]
call sub.WS2_32.dll_WSASend
mov esi, eax
lea rcx, [rbp - 0x90]
call fcn.140008fb0
call sub.KERNEL32.dll_GetLastError
mov edi, eax
xor ecx, ecx
mov qword [rbp - 0x48], rcx
cmp byte [rbp - 0x40], 0
je 0x1401b2595
mov rcx, qword [rbp + 0x10]
xor edx, edx
call fcn.140172890
call fcn.140002d94
mov dword [rax + 8], edi
mov eax, esi
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x1401b2610
Capabilities:
Initialize winsock library

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x1f8
lea rbp, [rsp + 0x230]
xor eax, eax
mov qword [rbp - 0x1e0], rax
lea rdx, [rbp - 0x1d0]
mov qword [rbp - 0x1e8], rdx
mov ecx, 0x202
mov dword [rbp - 0x1d4], ecx
lea rcx, [rbp - 0x210]
call fcn.140008f60
mov rdx, qword [rbp - 0x1e8]
mov ecx, dword [rbp - 0x1d4]
call sub.WS2_32.dll_WSAStartup
mov esi, eax
lea rcx, [rbp - 0x210]
call fcn.140008fb0
test esi, esi
jne 0x1401b26d1
call fcn.140001326
mov qword [rbp - 0x1e0], rax
mov ecx, 1
xor eax, eax
mov rdx, qword [rbp - 0x1e0]
lock cmpxchg dword [rdx], ecx
test eax, eax
je 0x1401b26bc
lea rcx, [rbp - 0x210]
call fcn.140008f60
call sub.WS2_32.dll_WSACleanup
lea rcx, [rbp - 0x210]
call fcn.140008fb0
nop
add rsp, 0x1f8
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea rcx, [0x14024f9f0]
call fcn.1400067b0
mov rdi, rax
mov rcx, rdi
mov edx, esi
call fcn.1401afc60
mov rcx, rdi
call fcn.140006c10
int3
Function at 0x1401ba740
Capabilities:
Read file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0xb0]
xor eax, eax
mov qword [rbp - 0x40], rax
mov rsi, rcx
mov rdi, rdx
mov ebx, r8d
mov qword [rbp - 0x40], r9
mov r14, r9
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov r15, qword [rbp + 0x30]
mov qword [rsp + 0x20], r15
mov rcx, rsi
mov qword [rbp - 0x4c], rcx
mov rdx, rdi
mov qword [rbp - 0x54], rdx
mov r8d, ebx
mov dword [rbp - 0x44], r8d
mov r9, r14
mov qword [rbp - 0x5c], r9
lea rcx, [rbp - 0x88]
call fcn.140008f60
mov rcx, qword [rbp - 0x4c]
mov rdx, qword [rbp - 0x54]
mov r8d, dword [rbp - 0x44]
mov r9, qword [rbp - 0x5c]
call sub.KERNEL32.dll_ReadFile
mov esi, eax
lea rcx, [rbp - 0x88]
call fcn.140008fb0
call sub.KERNEL32.dll_GetLastError
mov edi, eax
xor eax, eax
mov qword [rbp - 0x40], rax
call fcn.140002d94
mov dword [rax + 8], edi
mov eax, esi
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x1401dd900
Capabilities:
Hash data using murmur3

Disassembly:
push rdi
push rsi
sub rsp, 0x28
mov esi, ecx
cmp edx, 0xffffffff
jne 0x1401dd914
mov edi, 0xd5313557
jmp 0x1401dd93b
mov ecx, edx
call fcn.1401dd830
mov rdx, rax
lea rcx, [0x140223d98]
lea r8, [0x140226370]
call fcn.1401267d0
mov rcx, rax
call fcn.1401dd7c0
mov edi, eax
mov eax, edi
rol eax, 0xd
add eax, edi
mov edi, eax
xor edi, esi
mov eax, edi
rol eax, 0xf
add eax, edi
add rsp, 0x28
pop rsi
pop rdi
ret

Function at 0x14020d100
Capabilities:
Hash data using murmur3

Disassembly:
xor eax, eax
mov r8d, dword [rdx + 8]
test r8d, r8d
jle 0x14020d13e
mov r9d, eax
lea r9, [rdx + r9*8 + 0x10]
mov r9, qword [r9]
mov r10, r9
test r10, r10
jne 0x14020d123
xor r10d, r10d
jmp 0x14020d127
mov r10d, dword [r9 + 0x14]
mov r9d, ecx
rol r9d, 0xd
add r9d, ecx
mov ecx, r9d
xor ecx, r10d
inc eax
cmp r8d, eax
jg 0x14020d10b
mov eax, ecx
rol eax, 0xf
add eax, ecx
ret

Function at 0x140210130
Capabilities:
Hash data using murmur3

Disassembly:
push rdi
push rsi
sub rsp, 0x28
mov esi, ecx
mov edi, edx
call fcn.14000105f
mov eax, dword [rax]
add eax, 0x165667b1
add eax, 8
imul edx, esi, 0xc2b2ae3d
add edx, eax
rol edx, 0x11
imul eax, edx, 0x27d4eb2f
imul edx, edi, 0xc2b2ae3d
add edx, eax
rol edx, 0x11
imul eax, edx, 0x27d4eb2f
mov edx, eax
shr edx, 0xf
xor eax, edx
imul eax, eax, 0x85ebca77
mov edx, eax
shr edx, 0xd
xor eax, edx
imul eax, eax, 0xc2b2ae3d
mov edx, eax
shr edx, 0x10
xor eax, edx
add rsp, 0x28
pop rsi
pop rdi
ret
Function at 0x1402101a0
Capabilities:
Hash data using murmur3

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov esi, ecx
mov edi, edx
mov ebx, r8d
call fcn.14000105f
mov eax, dword [rax]
add eax, 0x165667b1
add eax, 0xc
imul edx, esi, 0xc2b2ae3d
add edx, eax
rol edx, 0x11
imul eax, edx, 0x27d4eb2f
imul edx, edi, 0xc2b2ae3d
add edx, eax
rol edx, 0x11
imul eax, edx, 0x27d4eb2f
imul edx, ebx, 0xc2b2ae3d
add edx, eax
rol edx, 0x11
imul eax, edx, 0x27d4eb2f
mov edx, eax
shr edx, 0xf
xor eax, edx
imul eax, eax, 0x85ebca77
mov edx, eax
shr edx, 0xd
xor eax, edx
imul eax, eax, 0xc2b2ae3d
mov edx, eax
shr edx, 0x10
xor eax, edx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x140210750
Capabilities:
Hash data using murmur3

Disassembly:
push rsi
sub rsp, 0x20
mov esi, ecx
call fcn.14000105f
mov eax, dword [rax]
add eax, 0x165667b1
add eax, 4
imul edx, esi, 0xc2b2ae3d
add edx, eax
rol edx, 0x11
imul eax, edx, 0x27d4eb2f
mov edx, eax
shr edx, 0xf
xor eax, edx
imul eax, eax, 0x85ebca77
mov edx, eax
shr edx, 0xd
xor eax, edx
imul eax, eax, 0xc2b2ae3d
mov edx, eax
shr edx, 0x10
xor eax, edx
add rsp, 0x20
pop rsi
ret

Function at 0x140210970
Capabilities:
Hash data using murmur3

Disassembly:
push rdi
push rsi
push rbp
push rbx
sub rsp, 0x28
mov esi, ecx
mov edi, edx
mov ebx, r8d
mov ebp, r9d
call fcn.14000105f
mov eax, dword [rax]
lea edx, [rax + 0x24234428]
lea ecx, [rax - 0x7a143589]
mov r8d, eax
add eax, 0x61c8864f
imul r9d, esi, 0x85ebca77
add edx, r9d
rol edx, 0xd
imul edx, edx, 0x9e3779b1
imul r9d, edi, 0x85ebca77
add ecx, r9d
rol ecx, 0xd
imul ecx, ecx, 0x9e3779b1
imul r9d, ebx, 0x85ebca77
add r8d, r9d
rol r8d, 0xd
imul r8d, r8d, 0x9e3779b1
imul r9d, ebp, 0x85ebca77
add eax, r9d
rol eax, 0xd
imul eax, eax, 0x9e3779b1
rol edx, 1
rol ecx, 7
add edx, ecx
mov ecx, r8d
rol ecx, 0xc
add edx, ecx
rol eax, 0x12
add eax, edx
add eax, 0x14
imul edx, dword [rsp + 0x70], 0xc2b2ae3d
add edx, eax
rol edx, 0x11
imul eax, edx, 0x27d4eb2f
mov edx, eax
shr edx, 0xf
xor eax, edx
imul eax, eax, 0x85ebca77
mov edx, eax
shr edx, 0xd
xor eax, edx
imul eax, eax, 0xc2b2ae3d
mov edx, eax
shr edx, 0x10
xor eax, edx
add rsp, 0x28
pop rbx
pop rbp
pop rsi
pop rdi
ret

Function at 0x140213250
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push rdi
push rsi
push rbp
push rbx
sub rsp, 0x28
mov rsi, r8
mov edi, edx
xor ebx, ebx
mov ebp, dword [rsi + 8]
test ebp, ebp
jle 0x140213284
mov ecx, ebx
mov rcx, qword [rsi + rcx*8 + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x28]
mov edx, edi
rol edx, 0xd
add edx, edi
mov edi, eax
xor edi, edx
inc ebx
cmp ebp, ebx
jg 0x140213266
mov eax, edi
rol eax, 0xf
add eax, edi
add rsp, 0x28
pop rbx
pop rbp
pop rsi
pop rdi
ret
Function at 0x140010ba4
Capabilities:
Print debug messages

Disassembly:
jmp 0x140010ba4
push rbx
sub rsp, 0x540
mov rax, qword [0x140018210]
xor rax, rsp
mov qword [rsp + 0x530], rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov rbx, qword [rsp + 0x158]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.ntdll.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x140010c21
and qword [rsp + 0x38], 0
lea rcx, [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov r9, rax
mov qword [rsp + 0x30], rcx
mov r8, rbx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlVirtualUnwind]
jmp 0x140010c41
mov rax, qword [rsp + 0x548]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x548]
mov qword [rsp + 0xf8], rax
lea rcx, str.Invalid_parameter_passed_to_C_runtime_function._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [rsp + 0x530]
xor rcx, rsp
call fcn.1400107f0
add rsp, 0x540
pop rbx
ret

Function at 0x140010e6c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140010eb8
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140010eb0
cmp dword [rcx + 0x3c], edx
jl 0x140010eb0
cmp dword [rcx + 0x3c], 0x10000000
jae 0x140010eb0
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x140010eb8
mov rax, rdx
add rsp, 0x18
ret

Function at 0x1400a933e
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0xbea9bea8
stosb byte [rdi], al
adc ebp, ebp
test eax, 0xed13aabe
xor dword [rcx], edi
push rbx
jp 0x1400a9341
cmp al, 0x6b
xor dword [rcx + rax], edx
test al, 0x21
sbb byte [rsi], dl
test dword [rdi], esi
jge 0x1400a93ba
mov esp, 0xd7d832c4
cmp dword [rdx], edi
add edi, dword [rdx + 0x15d22562]
pop rdx
xchg esp, eax
sub edx, dword [rbx]
sbb byte [rdx - 2], 0x1f
lahf
adc dword [rax - 0x8ac05af], esp
test byte [rdi - 0x3bef3adf], cl
invalid
invalid
Function at 0x140001160
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x140044040]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rbx, rcx
xor edx, edx
mov ecx, 0x5c
call fcn.140001150
lea edx, [rcx - 0x5b]
mov word [rsp + 0x40], ax
call fcn.140001150
lea ecx, [rdx + 0x2d]
mov word [rsp + 0x42], ax
lea edx, [rcx - 0x2c]
call fcn.140001150
lea ecx, [rdx + 0x5a]
mov word [rsp + 0x44], ax
lea edx, [rcx - 0x59]
call fcn.140001150
lea ecx, [rdx + 0x42]
mov word [rsp + 0x46], ax
lea edx, [rcx - 0x41]
call fcn.140001150
lea ecx, [rdx + 0x45]
mov word [rsp + 0x48], ax
lea edx, [rcx - 0x44]
call fcn.140001150
lea ecx, [rdx + 0x4c]
mov word [rsp + 0x4a], ax
lea edx, [rcx - 0x4b]
call fcn.140001150
lea ecx, [rdx + 0x3e]
mov word [rsp + 0x4c], ax
lea edx, [rcx - 0x3d]
call fcn.140001150
lea ecx, [rdx + 0x4f]
mov word [rsp + 0x4e], ax
lea edx, [rcx - 0x4e]
call fcn.140001150
xor ecx, ecx
mov word [rsp + 0x50], ax
lea edx, [rcx + 9]
call fcn.140001150
lea edx, [rcx + 0xa]
mov word [rsp + 0x52], ax
movzx ecx, word [0x14003e36c]
call fcn.140001150
movzx ecx, word [0x14003e36e]
mov edx, 0xb
mov word [rsp + 0x54], ax
call fcn.140001150
movzx ecx, word [str.Unknown_exception]
mov edx, 0xc
mov word [rsp + 0x56], ax
call fcn.140001150
movzx ecx, word [0x14003e372]
mov edx, 0xd
mov word [rsp + 0x58], ax
call fcn.140001150
movzx ecx, word [0x14003e374]
mov edx, 0xe
mov word [rsp + 0x5a], ax
call fcn.140001150
movzx ecx, word [0x14003e376]
mov edx, 0xf
mov word [rsp + 0x5c], ax
call fcn.140001150
movzx ecx, word [0x14003e378]
mov edx, 0x10
mov word [rsp + 0x5e], ax
call fcn.140001150
movzx ecx, word [0x14003e37a]
mov edx, 0x11
mov word [rsp + 0x60], ax
call fcn.140001150
movzx ecx, word [0x14003e37c]
mov edx, 0x12
mov word [rsp + 0x62], ax
call fcn.140001150
mov word [rsp + 0x64], ax
mov r9d, 0x133
xor eax, eax
mov word [rsp + 0x66], ax
xor r10d, r10d
nop dword [rax]
movsxd rcx, eax
lea rdx, [rsp + 0x40]
lea rdx, [rdx + rcx*2]
lea ecx, [r9 + rax]
inc eax
xor word [rdx], cx
cmp eax, 0x13
jb 0x1400012f0
mov qword [rsp + 0x30], r10
lea rcx, [rsp + 0x40]
xor r9d, r9d
mov dword [rsp + 0x28], r10d
mov edx, 0xc0000000
mov word [rsp + 0x66], r10w
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbx + 8], rax
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14000e090
add rsp, 0x70
pop rbx
ret
Function at 0x140003a20
Capabilities:
Create process on windows
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140044040]
xor rax, rsp
mov qword [rsp + 0x48], rax
cmp qword [rdx + 0x18], 7
mov rbx, rdx
mov rdi, rcx
mov r9, rdx
jbe 0x140003a51
mov r9, qword [rdx]
cmp qword [rcx + 0x18], 7
mov r8, rdi
jbe 0x140003a5e
mov r8, qword [rcx]
mov ecx, 0x72
xor edx, edx
call fcn.140001150
lea ecx, [rdx + 0x75]
mov word [rsp + 0x30], ax
lea edx, [rcx - 0x74]
call fcn.140001150
lea ecx, [rdx + 0x6d]
mov word [rsp + 0x32], ax
lea edx, [rcx - 0x6c]
call fcn.140001150
lea ecx, [rdx + 0x5f]
mov word [rsp + 0x34], ax
lea edx, [rcx - 0x5e]
call fcn.140001150
lea ecx, [rdx + 0x70]
mov word [rsp + 0x36], ax
lea edx, [rcx - 0x6f]
call fcn.140001150
xor ecx, ecx
mov word [rsp + 0x38], ax
lea edx, [rcx + 5]
call fcn.140001150
lea edx, [rcx + 6]
mov word [rsp + 0x3a], ax
movzx ecx, word [0x14003e50c]
call fcn.140001150
movzx ecx, word [0x14003e50e]
mov edx, 7
mov word [rsp + 0x3c], ax
call fcn.140001150
movzx ecx, word [0x14003e510]
mov edx, 8
mov word [rsp + 0x3e], ax
call fcn.140001150
movzx ecx, word [0x14003e512]
mov edx, 9
mov word [rsp + 0x40], ax
call fcn.140001150
movzx ecx, word [0x14003e514]
mov edx, 0xa
mov word [rsp + 0x42], ax
call fcn.140001150
mov word [rsp + 0x44], ax
mov r10d, 0x133
xor eax, eax
mov word [rsp + 0x46], ax
xor esi, esi
nop dword [rax]
movsxd rcx, eax
lea rdx, [rsp + 0x30]
lea rdx, [rdx + rcx*2]
lea ecx, [r10 + rax]
inc eax
xor word [rdx], cx
cmp eax, 0xb
jb 0x140003b40
mov dword [rsp + 0x28], esi
lea rdx, [rsp + 0x30]
xor ecx, ecx
mov qword [rsp + 0x20], rsi
mov word [rsp + 0x46], si
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rdx, qword [rdi + 0x18]
cmp rdx, 7
jbe 0x140003bb0
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140003bab
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003c26
mov rcx, r8
call fcn.14000e3d4
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], 7
mov word [rdi], si
mov rdx, qword [rbx + 0x18]
cmp rdx, 7
jbe 0x140003bfa
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140003bf5
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003c26
mov rcx, r8
call fcn.14000e3d4
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 7
mov word [rbx], si
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14000e090
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
call fcn.1400185cc
int3
Function at 0x140003c30
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
xor ebp, ebp
mov rdi, rcx
cmp qword [rcx + 0x18], 7
mov dword [rsp + 0x40], ebp
jbe 0x140003c52
mov rcx, qword [rcx]
mov qword [rsp + 0x30], rbp
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x10000000
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
jne 0x140003ce6
mov rdx, qword [rdi + 0x18]
cmp rdx, 7
jbe 0x140003cc5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x140003cc0
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003d8f
mov rcx, r8
call fcn.14000e3d4
mov al, 1
mov rsi, qword [rsp + 0x78]
mov word [rdi], bp
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], rbp
mov rbp, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
cmp rsi, 0xffffffffffffffff
jne 0x140003d2b
mov rdx, qword [rdi + 0x18]
cmp rdx, 7
jbe 0x140003d27
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x140003d22
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003d8f
mov rcx, r8
call fcn.14000e3d4
xor al, al
jmp 0x140003cc7
lea r9, [rsp + 0x40]
mov qword [rsp + 0x68], rbx
mov r8d, 0x41200
mov qword [rsp + 0x20], rbp
lea rdx, [0x140047090]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rdi + 0x18]
test bl, bl
mov rbx, qword [rsp + 0x68]
jne 0x140003d78
cmp rax, 7
jbe 0x140003d27
lea rdx, [rax*2 + 2]
jmp 0x140003cfe
cmp rax, 7
jbe 0x140003cc5
lea rdx, [rax*2 + 2]
jmp 0x140003c98
call fcn.1400185cc
int3
Function at 0x140003da0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
xor ebp, ebp
mov rdi, rcx
cmp qword [rcx + 0x18], 7
mov dword [rsp + 0x40], ebp
jbe 0x140003dc2
mov rcx, qword [rcx]
mov qword [rsp + 0x30], rbp
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x10000000
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
jne 0x140003e56
mov rdx, qword [rdi + 0x18]
cmp rdx, 7
jbe 0x140003e35
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x140003e30
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003eff
mov rcx, r8
call fcn.14000e3d4
mov al, 1
mov rsi, qword [rsp + 0x78]
mov word [rdi], bp
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], rbp
mov rbp, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
cmp rsi, 0xffffffffffffffff
jne 0x140003e9b
mov rdx, qword [rdi + 0x18]
cmp rdx, 7
jbe 0x140003e97
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x140003e92
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003eff
mov rcx, r8
call fcn.14000e3d4
xor al, al
jmp 0x140003e37
lea r9, [rsp + 0x40]
mov qword [rsp + 0x68], rbx
mov r8d, 0x2400
mov qword [rsp + 0x20], rbp
lea rdx, [0x140044c90]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rdi + 0x18]
test bl, bl
mov rbx, qword [rsp + 0x68]
jne 0x140003ee8
cmp rax, 7
jbe 0x140003e97
lea rdx, [rax*2 + 2]
jmp 0x140003e6e
cmp rax, 7
jbe 0x140003e35
lea rdx, [rax*2 + 2]
jmp 0x140003e08
call fcn.1400185cc
int3