joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140039c90
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x66], 0
je 0x140039cb5
xor eax, eax
mov r8d, 0x15d7
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x32
jb 0x140039ca0
mov byte [rcx + 0x66], 0
ret

Function at 0x14003a050
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je case.default.0x14003a071
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x14003a09e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14003a0a0
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x14003a0f9
test ecx, ecx
jle 0x14003a0d9
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x14003a0f9
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x14003a0f9
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
invalid
Function at 0x14003a120
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x14003a142
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je case.default.0x14003a151
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14003a174
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14003a176
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14003a1b2
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14003a24e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x14003a1ed
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x14003a22e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x14003a24e
cmp rbx, rax
ja 0x14003a200
test rbx, rbx
je 0x14003a24e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
push rax
Function at 0x14003a6c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1400d0080]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14003a6ed
xor eax, eax
jmp 0x14003a859
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x14003a727
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x14003a727
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x14003a859
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14003a84c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14003a76a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14003a795
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14003a851
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14003a804
sub eax, 1
je 0x14003a804
cmp eax, 2
jne 0x14003a84c
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14003a851
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x14003a832
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14003a84c
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x14003a851
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400a9330
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret

Function at 0x14003aa30
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x4a], 0
je 0x14003aa55
xor eax, eax
mov r8d, 0x15d7
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x24
jb 0x14003aa40
mov byte [rcx + 0x4a], 0
ret

Function at 0x14003aa60
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x50], 0
je 0x14003aa85
xor eax, eax
mov r8d, 0x15d7
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x27
jb 0x14003aa70
mov byte [rcx + 0x50], 0
ret
Function at 0x14003aa90
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x3e], 0
je 0x14003aab5
xor eax, eax
mov r8d, 0x15d7
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x1e
jb 0x14003aaa0
mov byte [rcx + 0x3e], 0
ret

Function at 0x14003aac0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x4c], 0
je 0x14003aae5
xor eax, eax
mov r8d, 0x15d7
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x25
jb 0x14003aad0
mov byte [rcx + 0x4c], 0
ret

Function at 0x14003aaf0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x58], 0
je 0x14003ab15
xor eax, eax
mov r8d, 0x15d7
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x2b
jb 0x14003ab00
mov byte [rcx + 0x58], 0
ret

Function at 0x14003b0a0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1400d0080]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14003b173
cmp byte [rcx + 0x71], 0
je 0x14003b173
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + Ordinal_26]
cmp eax, 0xffffffff
je 0x14003b16f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14003b134
sub eax, 1
je 0x14003b138
cmp eax, 2
jne 0x14003b16f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400a9330
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x14003b166
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14003b16f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14003b11c
xor al, al
jmp 0x14003b11c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400a9330
add rsp, 0x60
pop rbx
ret
Function at 0x140041f20
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x1400d0080]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x40], rcx
xor r8d, r8d
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x140042037
movsxd rax, dword [rdx + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x140042037
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x48], xmm1
mov qword [rsp + 0x58], r8
mov ecx, dword [rax + rdx + 0xb0]
test ecx, ecx
jne 0x140041f99
mov qword [rdi], r8
mov qword [rdi + 8], r8
mov qword [rdi + 0x10], r8
jmp 0x140042042
lea rbx, [rdx + rcx]
mov ebp, dword [rax + rdx + 0xb4]
add rbp, rbx
mov rcx, qword [rsp + 0x50]
cmp rbx, rbp
jae 0x140042025
mov edx, dword [rbx + 4]
test edx, edx
je 0x140042025
mov eax, dword [rbx]
add rax, rsi
mov qword [rsp + 0x28], rax
lea rax, [rbx + 8]
mov qword [rsp + 0x30], rax
lea rax, [rdx - 8]
shr rax, 1
mov dword [rsp + 0x38], eax
cmp rcx, r8
je 0x140041ffe
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rcx], xmm0
movsd xmm1, qword [rsp + 0x38]
movsd qword [rcx + 0x10], xmm1
mov rcx, qword [rsp + 0x50]
add rcx, 0x18
mov qword [rsp + 0x50], rcx
jmp 0x140042015
lea r8, [rsp + 0x28]
mov rdx, rcx
lea rcx, [rsp + 0x48]
call fcn.140042a40
mov rcx, qword [rsp + 0x50]
mov eax, dword [rbx + 4]
add rbx, rax
mov r8, qword [rsp + 0x58]
cmp rbx, rbp
jb 0x140041fb1
mov rax, qword [rsp + 0x48]
mov qword [rdi], rax
mov qword [rdi + 8], rcx
mov qword [rdi + 0x10], r8
jmp 0x140042042
mov qword [rcx], r8
mov qword [rcx + 8], r8
mov qword [rcx + 0x10], r8
mov rax, rdi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400a9330
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400443b0
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1400d0080]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor edi, edi
lea r9, [rsp + 0x20]
mov rsi, rcx
mov dword [rsp + 0x20], edi
xor r8d, r8d
xor edx, edx
mov ebx, edi
lea ecx, [rdi + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x140044441
test rbx, rbx
je 0x140044409
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rax
mov ecx, ntohl
mov rbx, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x1400443f3
test eax, eax
jns 0x140044462
test rbx, rbx
je 0x140044467
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
jmp 0x14004452d
test rbx, rbx
jne 0x14004446e
xor eax, eax
jmp 0x14004452d
mov qword [rsp + 0x68], rbp
cmp dword [rbx], edi
jbe 0x140044515
nop dword [rax + rax]
mov eax, edi
imul rcx, rax, 0x128
movzx edx, word [rcx + rbx + 0x2e]
lea rbp, [rcx + rbx]
add rcx, 0x30
add rdx, rcx
lea rcx, [rsp + 0x28]
add rdx, rbx
call fcn.14003ae60
cmp qword [rsi + 0x18], 0xf
mov rdx, rsi
jbe 0x1400444b3
mov rdx, qword [rsi]
cmp qword [rsp + 0x40], 0xf
lea rcx, [rsp + 0x28]
cmova rcx, qword [rsp + 0x28]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x14004454a
mov rdx, qword [rsp + 0x40]
cmp rdx, 0xf
jbe 0x14004450b
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140044506
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140044593
call fcn.1400a9350
inc edi
cmp edi, dword [rbx]
jb 0x140044480
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rbp, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400a9330
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
mov rdi, qword [rbp + 0x18]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, qword [rsp + 0x40]
cmp rdx, 0xf
jbe 0x14004459f
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004459a
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004459a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400a9350
mov rax, rdi
jmp 0x140044528
Function at 0x1400447a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
movdqa xmm0, xmmword [0x1400c4170]
xor eax, eax
movdqa xmm1, xmmword [0x1400c4140]
mov rbx, rdx
movdqu xmmword [rbp - 0x30], xmm0
mov edx, eax
mov dword [rbp - 0x10], 0x2f2a29
movdqu xmmword [rbp - 0x20], xmm1
mov byte [rbp - 0xc], 1
nop dword [rax]
lea ecx, [rdx + 0x28]
xor byte [rbp + rdx - 0x30], cl
inc rdx
cmp rdx, 0x23
jb 0x1400447e0
mov byte [rbp - 0xc], al
mov dword [rbp - 0x40], 0x1844405f
mov dword [rbp - 0x3c], 0x4b00581e
mov dword [rbp - 0x38], 0x1005d5c
nop dword [rax + rax]
lea ecx, [rax + 0x28]
xor byte [rbp + rax - 0x40], cl
inc rax
cmp rax, 0xa
jb 0x140044810
lea rcx, [rbp - 0x40]
mov byte [rbp - 0x35], 0
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140044870
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.____driver::send_instruction_get_NtDxgkVailPromoteCompositionSurface_failed
call fcn.1400418d0
lea rdx, [0x140041ac0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor eax, eax
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
mov rcx, rbx
call rax
mov rbx, qword [rsp + 0x70]
mov eax, 1
add rsp, 0x60
pop rbp
ret
Function at 0x140044e50
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
push r14
mov r14, rcx
mov rsi, r8
mov rbp, rdx
sub r14, qword [r8 + 0x30]
je 0x140044fd2
test byte [r8 + 0x5e], 0x40
jne 0x140044e7d
xor eax, eax
mov rbp, qword [rsp + 0x30]
pop r14
pop rsi
ret
movzx edx, word [rsi + 0x14]
movzx eax, word [rsi + 6]
add rdx, 0x18
mov r8d, dword [r8 + 0xb0]
add rdx, rsi
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
cmp rdx, r9
jae 0x140044fd2
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x140044eb6
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x140044ecd
add rdx, 0x28
cmp rdx, r9
jb 0x140044ea4
mov eax, 1
mov rbp, qword [rsp + 0x30]
pop r14
pop rsi
ret
mov qword [rsp + 0x18], rbx
mov ebx, dword [rdx + 0x14]
sub rbx, rcx
mov qword [rsp + 0x28], r15
mov r15d, dword [rsi + 0xb4]
add rbx, r8
add rbx, rbp
add r15, rbx
test rbx, rbx
je 0x140044fc8
cmp rbx, r15
jae 0x140044fc8
mov qword [rsp + 0x20], rdi
mov eax, dword [rbx + 4]
test eax, eax
je 0x140044fc3
add eax, 0xfffffff8
shr eax, 1
je 0x140044fb4
lea r11, [rbx + 8]
mov edi, eax
movzx r8d, word [r11]
movzx eax, r8w
shr ax, 0xc
and r8d, 0x80000fff
jge 0x140044f42
dec r8d
or r8d, 0xfffff000
inc r8d
cmp ax, 3
je 0x140044f4e
cmp ax, 0xa
jne 0x140044fa6
movzx eax, word [rsi + 0x14]
movzx ecx, word [rsi + 6]
add rax, 0x18
mov r9d, dword [rbx]
add rax, rsi
lea rdx, [rcx + rcx*4]
lea r10, [rax + rdx*8]
cmp rax, r10
jae 0x140044f9b
nop dword [rax]
mov edx, dword [rax + 0xc]
cmp r9, rdx
jb 0x140044f82
mov ecx, dword [rax + 8]
add ecx, edx
cmp r9, rcx
jb 0x140044f8d
add rax, 0x28
cmp rax, r10
jb 0x140044f70
jmp 0x140044f9b
mov ecx, dword [rax + 0x14]
sub rcx, rdx
add rcx, r9
add rcx, rbp
jne 0x140044f9e
mov rcx, rbp
movzx eax, r8w
add qword [rax + rcx], r14
add r11, 2
sub rdi, 1
jne 0x140044f20
mov eax, dword [rbx + 4]
add rbx, rax
cmp rbx, r15
jb 0x140044f04
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x18]
mov r15, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov eax, 1
pop r14
pop rsi
ret
Function at 0x140044fe0
Capabilities:
Enumerate pe sections

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r13
sub rsp, 0x38
movzx eax, word [r9 + 0x14]
lea r10, [r9 + 0x18]
mov r11d, dword [r9 + 0x90]
add r10, rax
movzx eax, word [r9 + 6]
mov rbp, r9
mov r13, r8
mov edi, edx
mov rsi, rcx
lea r9, [rax + rax*4]
lea r8, [r10 + r9*8]
cmp r10, r8
jae 0x140045043
mov ecx, dword [r10 + 0xc]
cmp r11, rcx
jb 0x14004503a
mov eax, dword [r10 + 8]
add eax, ecx
cmp r11, rax
jb 0x1400450ce
add r10, 0x28
cmp r10, r8
jb 0x140045022
xor eax, eax
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
test r11d, r11d
je 0x1400450ab
cmp dword [rbp + 0x94], 0
je 0x1400450ab
lea rbx, [rax + 0x10]
movzx edx, word [rbp + 0x14]
movzx eax, word [rbp + 6]
add rdx, 0x18
mov r8d, dword [rbx - 4]
add rdx, rbp
mov qword [rsp + 0x78], rbx
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
cmp rdx, r9
jae 0x1400450ab
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x1400450a2
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x1400450e0
add rdx, 0x28
cmp rdx, r9
jb 0x140045090
mov eax, 1
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov r12, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x70]
add rsp, 0x38
pop r13
pop rdi
pop rsi
pop rbp
ret
mov eax, dword [r10 + 0x14]
sub rax, rcx
add rax, r11
add rax, r13
jmp 0x140045045
mov r15d, dword [rdx + 0x14]
sub r15, rcx
add r15, r8
add r15, r13
je 0x1400450ab
mov r8, r15
mov edx, edi
mov rcx, rsi
call fcn.140044890
mov r12, rax
test rax, rax
je 0x140045219
movzx edx, word [rbp + 0x14]
movzx eax, word [rbp + 6]
add rdx, 0x18
mov r8d, dword [rbx]
add rdx, rbp
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
cmp rdx, r9
jae 0x140045142
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x140045139
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x140045167
add rdx, 0x28
cmp rdx, r9
jb 0x140045127
xor r14d, r14d
mov rdi, qword [r14]
test rdi, rdi
je 0x1400451fe
jns 0x140045176
xor edx, edx
mov rcx, r15
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
movzx edx, di
jmp 0x1400451c2
mov r14d, dword [rdx + 0x14]
sub r14, rcx
add r14, r8
add r14, r13
jmp 0x140045145
movzx eax, word [rbp + 0x14]
movzx ecx, word [rbp + 6]
add rax, 0x18
add rax, rbp
lea rdx, [rcx + rcx*4]
lea r8, [rax + rdx*8]
cmp rax, r8
jae 0x1400451ad
mov edx, dword [rax + 0xc]
cmp rdi, rdx
jb 0x1400451a4
mov ecx, dword [rax + 8]
add ecx, edx
cmp rdi, rcx
jb 0x14004520b
add rax, 0x28
cmp rax, r8
jb 0x140045192
xor esi, esi
xor edx, edx
mov rcx, r15
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
lea rdx, [rsi + 2]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov rcx, rbx
sub rdi, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rax, [rdi + r12]
mov qword [r14], rax
add r14, 8
mov rdi, qword [r14]
test rdi, rdi
jne 0x140045151
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x60]
mov edi, dword [rsp + 0x68]
add rbx, 0x14
jmp 0x14004506b
mov esi, dword [rax + 0x14]
sub rsi, rdx
add rsi, rdi
add rsi, r13
jmp 0x1400451af
jmp 0x1400450b0
Function at 0x140048d60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 7], dil
je 0x140048d94
mov ecx, edi
nop dword [rax]
lea eax, [rcx + 0x7d]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 6
jb 0x140048d80
mov byte [r8 + 7], dil
lea rax, [r8 + 6]
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x140048dc1
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x140048de0
mov qword [rsp + 0x30], 6
mov eax, dword [r8]
mov dword [rsp + 0x20], eax
movzx eax, word [r8 + 4]
mov word [rsp + 0x24], ax
mov byte [rsp + 0x26], dil
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x140048dee
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.140054dc0
mov qword [rbx], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140048e65
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140048e60
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140048e60
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400a9350
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x140048e80
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 9], dil
je 0x140048eb4
mov ecx, edi
nop dword [rax]
lea eax, [rcx + 0x7d]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 8
jb 0x140048ea0
mov byte [r8 + 9], dil
lea rax, [r8 + 8]
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x140048ee1
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x140048ef7
mov qword [rsp + 0x30], 8
mov rax, qword [r8]
mov qword [rsp + 0x20], rax
mov byte [rsp + 0x28], dil
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x140048f05
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.140054dc0
mov qword [rbx], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140048f7c
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140048f77
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140048f77
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400a9350
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret