joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140057b50
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
mov ecx, 3
call fcn.1400631e0
cmp eax, 1
je 0x140057b82
mov ecx, 3
call fcn.1400631e0
test eax, eax
jne 0x140057c36
cmp dword [reloc.OLEAUT32.dll_SysReAllocString], 1
jne 0x140057c36
mov qword [rsp + 0x48], rbx
lea rbx, reloc.OLEAUT32.dll_SysReAllocString
mov qword [rsp + 0x30], rdi
mov rax, rbx
xor edi, edi
cmp dword [rax], 0xfc
je 0x140057bae
add edi, 1
add rax, 0x10
cmp edi, 0x17
jb 0x140057b98
jmp 0x140057c22
cmp edi, 0x17
jae 0x140057c22
mov ecx, 3
call fcn.1400631e0
cmp eax, 1
je 0x140057bd9
mov ecx, 3
call fcn.1400631e0
test eax, eax
jne 0x140057c22
cmp dword [reloc.OLEAUT32.dll_SysReAllocString], 1
jne 0x140057c22
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
test rax, rax
mov r11, rax
je 0x140057c22
cmp rax, 0xffffffffffffffff
je 0x140057c22
movsxd rcx, edi
xor eax, eax
lea r9, [rsp + 0x40]
add rcx, rcx
mov qword [rsp + 0x20], rax
mov rdx, qword [rbx + rcx*8 + 8]
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, 0xff
call fcn.140057910
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
add rsp, 0x38
ret

Function at 0x140057d97
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1400980c0]
jne 0x1400527da
rol rcx, 0x10
test cx, 0xffff
jne 0x1400527d6
repz ret
ror rcx, 0x10
jmp 0x140057cf0
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x1402526e0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x1402527d8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140057d75
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x1402526e0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140057d97
mov rax, qword [rsp + 0x88]
mov qword [0x1402527d8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x140252778], rax
mov rax, qword [0x1402527d8]
mov qword [0x140252650], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140252760], rax
mov dword [0x140252640], 0xc0000409
mov dword [0x140252644], 1
mov rax, qword [0x1400980c0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1400980c8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x1402526d8], eax
mov ecx, 1
call fcn.14005a5a0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x14006e2b0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x1402526d8], 0
jne 0x140057e1e
mov ecx, 1
call fcn.14005a5a0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x14005fdd0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x30
mov eax, dword [0x14025316c]
xor r12d, r12d
test eax, eax
mov ebp, r12d
jne 0x14005fe2c
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test rax, rax
mov rdi, rax
je 0x14005fe0c
mov dword [0x14025316c], 1
jmp 0x14005fe3f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x14005fe26
mov dword [0x14025316c], 2
jmp 0x14005fea9
mov eax, dword [0x14025316c]
cmp eax, 1
jne 0x14005fea0
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test rax, rax
mov rdi, rax
je 0x14005fe7a
cmp word [rdi], bp
mov rax, rdi
je 0x14005fe59
add rax, 2
cmp word [rax], bp
jne 0x14005fe47
add rax, 2
cmp word [rax], bp
jne 0x14005fe47
sub eax, edi
add eax, 2
movsxd rsi, eax
mov rcx, rsi
call fcn.1400576e0
test rax, rax
mov rbx, rax
jne 0x14005fe81
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x14005ff9b
mov r8, rsi
mov rdx, rdi
mov rcx, rax
call fcn.140055340
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbx
jmp 0x14005ff9b
cmp eax, 2
je 0x14005fea9
test eax, eax
jne 0x14005fe7a
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
test rax, rax
mov rsi, rax
je 0x14005fe7a
cmp byte [rax], bpl
mov rbx, rax
je 0x14005fef8
nop
or r9d, 0xffffffff
mov r8, rbx
xor ecx, ecx
lea edx, [r9 + 2]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x14005fe7a
or rcx, 0xffffffffffffffff
add ebp, eax
mov rdi, rbx
xor eax, eax
repne scasb al, byte [rdi]
not rcx
add rbx, rcx
cmp byte [rbx], al
jne 0x14005fec0
add ebp, 1
mov edx, 2
movsxd rcx, ebp
call fcn.140057750
test rax, rax
mov r12, rax
jne 0x14005ff1d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
xor eax, eax
jmp 0x14005ff9b
cmp byte [rsi], 0
mov qword [rsp + 0x50], r13
mov rbx, rax
mov r13, rsi
je 0x14005ff85
nop
or r9d, 0xffffffff
mov eax, ebp
mov rcx, rbx
sub rcx, r12
lea edx, [r9 + 2]
mov r8, r13
sar rcx, 1
sub eax, ecx
xor ecx, ecx
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x14005ffae
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r13
repne scasb al, byte [rdi]
mov rdi, rbx
not rcx
add r13, rcx
or rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
cmp byte [r13], al
not rcx
lea rbx, [rbx + rcx*2]
jne 0x14005ff30
mov rcx, rsi
mov word [rbx], 0
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov rax, r12
mov r13, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
mov rcx, r12
call fcn.140052ac0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
xor eax, eax
jmp 0x14005ff96
Function at 0x140062e60
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r13
push r14
sub rsp, 0x50
mov edi, r8d
mov r13, rdx
mov r14, rcx
call fcn.140056b00
xor ebx, ebx
cmp qword [0x140253178], rbx
mov rbp, rax
mov dword [rsp + 0x98], ebx
mov dword [rsp + 0x30], ebx
jne 0x140062f8c
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rsi, rax
je 0x14006309f
lea rdx, [0x14006e520]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14006309f
mov rcx, rax
call fcn.140056a30
lea rdx, [0x14006e510]
mov rcx, rsi
mov qword [0x140253178], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.140056a30
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x140253180], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.140056a30
lea rcx, [rsp + 0x98]
mov qword [0x140253188], rax
call fcn.140054350
test eax, eax
je 0x140062f3f
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.140053260
cmp dword [rsp + 0x98], 2
jne 0x140062f8c
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.140056a30
test rax, rax
mov qword [0x140253198], rax
je 0x140062f8c
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.140056a30
mov qword [0x140253190], rax
mov rcx, qword [0x140253190]
mov qword [rsp + 0x80], r12
cmp rcx, rbp
je 0x140063038
cmp qword [0x140253198], rbp
je 0x140063038
call fcn.140056bf0
mov rcx, qword [0x140253198]
mov rsi, rax
call fcn.140056bf0
test rsi, rsi
mov r12, rax
je 0x140063038
test rax, rax
je 0x140063038
call rsi
test rax, rax
je 0x140063003
lea rcx, [rsp + 0x34]
mov r9d, SafeArrayGetDim
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x140063003
test byte [rsp + 0x40], 1
jne 0x140063038
lea rcx, [rsp + 0x30]
call fcn.1400543a0
test eax, eax
je 0x140063025
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.140053260
cmp dword [rsp + 0x30], 4
jb 0x140063032
bts edi, 0x15
jmp 0x140063076
bts edi, 0x12
jmp 0x140063076
mov rcx, qword [0x140253180]
cmp rcx, rbp
je 0x140063076
call fcn.140056bf0
test rax, rax
je 0x140063076
call rax
test rax, rax
mov rbx, rax
je 0x140063076
mov rcx, qword [0x140253188]
cmp rcx, rbp
je 0x140063076
call fcn.140056bf0
test rax, rax
je 0x140063076
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x140253178]
call fcn.140056bf0
mov r12, qword [rsp + 0x80]
test rax, rax
je 0x14006309f
mov r9d, edi
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x1400630a1
xor eax, eax
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop r14
pop r13
pop rdi
pop rsi
pop rbp
ret
Function at 0x140065a70
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1400980c0]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x20]
mov r9d, 6
mov edx, 0x1004
mov byte [rsp + 0x26], 0
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x140065ab7
or eax, 0xffffffff
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400527c0
add rsp, 0x38
ret
lea rcx, [rsp + 0x20]
call fcn.140054bf0
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400527c0
add rsp, 0x38
ret
Function at 0x140069570
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rbp
push r14
sub rsp, 0x20
xor ebx, ebx
test rcx, rcx
mov r14, rdx
mov rbp, rcx
je 0x140069624
movsxd rax, dword [rcx + 0x3c]
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rdi
mov edi, dword [rax + rcx + 0x88]
mov esi, ebx
add rdi, rcx
cmp dword [rdi + 0x18], ebx
jbe 0x14006961f
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r13
mov r13, rbx
mov r12, rbx
nop
nop
mov eax, dword [rdi + 0x20]
mov rdx, r14
add rax, r13
mov ecx, dword [rax + rbp]
add rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x1400695ef
mov eax, dword [rdi + 0x24]
mov ecx, dword [rdi + 0x1c]
add rax, r12
add rcx, rbp
movzx edx, word [rax + rbp]
mov ebx, dword [rcx + rdx*4]
add rbx, rbp
add esi, 1
add r13, 4
add r12, 2
cmp esi, dword [rdi + 0x18]
jb 0x1400695c0
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x50]
mov rax, rbx
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rbp
pop rbx
ret
mov rax, rbx
jmp 0x14006960c
mov rax, rbx
add rsp, 0x20
pop r14
pop rbp
pop rbx
ret
Function at 0x140004ea0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rbx, rdx
mov rdi, rcx
mov ecx, 8
call fcn.14001074c
mov qword [rax], rbx
mov qword [rsp + 0x40], rax
lea rbx, [rdi + 8]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x1400050a0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rdi], rax
test rax, rax
je 0x140004efa
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov dword [rbx], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x14000c450
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
mov rbx, rcx
lea rdi, [rcx + 0x18]
cmp qword [rdi], 0xf
jbe 0x14000c482
mov rcx, qword [rcx]
lea rbp, [rbx + 0x18]
jmp 0x14000c485
mov rbp, rdi
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
call qword [0x14001de80]
mov rsi, rax
mov r14, rdi
cmp rax, 0xffffffffffffffff
je 0x14000c543
lea rdx, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov rcx, rsi
test eax, eax
je 0x14000c53a
xorps xmm6, xmm6
cvtsi2sd xmm6, qword [rsp + 0x70]
mulsd xmm6, qword [0x140017e80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rdi]
cmp rdx, 0xf
jbe 0x14000c527
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x14000c51e
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000c533
mov rcx, r8
call fcn.140010788
lea rdi, [rbx + 0x18]
mov qword [rdi], 0xf
movaps xmm0, xmm6
jmp 0x14000c587
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14, rbp
mov rdx, qword [rdi]
cmp rdx, 0xf
jbe 0x14000c578
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x14000c573
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000c5ad
mov rcx, r8
call fcn.140010788
mov qword [r14], 0xf
movsd xmm0, qword [0x140017eb8]
mov byte [rbx], 0
mov qword [rbx + 0x10], 0
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14000c5c0
Capabilities:
Set file attributes

Disassembly:
sub rsp, 0x258
mov r8d, 0x104
lea rdx, [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edx, 3
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x14000c60f
lea rdx, [0x140017c40]
lea rcx, [rsp + 0x20]
call fcn.1400036f0
mov rcx, rax
call fcn.14000b780
add rsp, 0x258
ret
mov qword [rsp + 0x250], rbx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
mov ebx, eax
call fcn.14000d5c0
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x14000d790]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rbx, qword [rsp + 0x250]
add rsp, 0x258
ret

Function at 0x14000ca00
Capabilities:
Enumerate process modules

Disassembly:
push rdi
mov eax, 0x1240
call fcn.1400113c0
sub rsp, rax
mov rdi, rcx
lea r8, [rsp + 0x1258]
lea rcx, [rsp + 0x230]
mov edx, 0x1000
call qword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
jne 0x14000ca3a
add rsp, 0x1240
pop rdi
ret
mov eax, dword [rsp + 0x1258]
mov qword [rsp + 0x1260], rbp
xor ebp, ebp
shr eax, 2
test eax, eax
je 0x14000cafb
mov qword [rsp + 0x1250], rbx
lea rbx, [rsp + 0x230]
mov qword [rsp + 0x1238], rsi
mov qword [rsp + 0x1230], r14
mov r14d, eax
nop dword [rax]
mov r8d, dword [rbx]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x14000cad9
mov r9d, 0x104
lea r8, [rsp + 0x20]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameW]
test eax, eax
je 0x14000cad0
cmp qword [rdi + 0x18], 7
mov rdx, rdi
jbe 0x14000cabf
mov rdx, qword [rdi]
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x14000cad0
inc ebp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub r14, 1
jne 0x14000ca80
mov r14, qword [rsp + 0x1230]
mov rsi, qword [rsp + 0x1238]
mov rbx, qword [rsp + 0x1250]
mov eax, ebp
mov rbp, qword [rsp + 0x1260]
add rsp, 0x1240
pop rdi
ret

Function at 0x140010370
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0xc
mov rdx, rax
nop dword [rax]
movzx r8d, byte [rdx]
lea rdx, [rdx + 1]
mov r9d, dword [rcx]
xor r9b, r8b
mov byte [rdx - 1], r9b
sub r10, 1
jne 0x140010380
mov byte [rcx + 0x10], r10b
ret
Function at 0x1400103d0
Capabilities:
Encode data using xor

Disassembly:
xor edx, edx
lea rax, [rcx + 4]
nop word [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, dword [rcx]
add r9b, dl
xor r9b, r8b
mov byte [rax + rdx], r9b
inc rdx
cmp rdx, 0x12
jb 0x1400103e0
mov byte [rcx + 0x16], 0
ret

Function at 0x140010400
Capabilities:
Encode data using xor

Disassembly:
xor edx, edx
lea rax, [rcx + 4]
nop word [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, dword [rcx]
add r9b, dl
xor r9b, r8b
mov byte [rax + rdx], r9b
inc rdx
cmp rdx, 0x30
jb 0x140010410
mov byte [rcx + 0x34], 0
ret

Function at 0x140010460
Capabilities:
Encode data using xor

Disassembly:
xor edx, edx
lea rax, [rcx + 4]
nop word [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, dword [rcx]
add r9b, dl
xor r9b, r8b
mov byte [rax + rdx], r9b
inc rdx
cmp rdx, 0x2f
jb 0x140010470
mov byte [rcx + 0x33], 0
ret

Function at 0x1400104c0
Capabilities:
Encode data using xor

Disassembly:
xor edx, edx
lea rax, [rcx + 4]
nop word [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, dword [rcx]
add r9b, dl
xor r9b, r8b
mov byte [rax + rdx], r9b
inc rdx
cmp rdx, 0x32
jb 0x1400104d0
mov byte [rcx + 0x36], 0
ret

Function at 0x1400104f0
Capabilities:
Encode data using xor

Disassembly:
xor edx, edx
lea rax, [rcx + 4]
nop word [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, dword [rcx]
add r9b, dl
xor r9b, r8b
mov byte [rax + rdx], r9b
inc rdx
cmp rdx, 0xd
jb 0x140010500
mov byte [rcx + 0x11], 0
ret

Function at 0x140010520
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x29
mov rdx, rax
nop dword [rax]
movzx r8d, byte [rdx]
lea rdx, [rdx + 1]
mov r9d, dword [rcx]
xor r9b, r8b
mov byte [rdx - 1], r9b
sub r10, 1
jne 0x140010530
mov byte [rcx + 0x2d], r10b
ret

Function at 0x140010550
Capabilities:
Encode data using xor

Disassembly:
xor edx, edx
lea rax, [rcx + 4]
nop word [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, dword [rcx]
add r9b, dl
xor r9b, r8b
mov byte [rax + rdx], r9b
inc rdx
cmp rdx, 0x29
jb 0x140010560
mov byte [rcx + 0x2d], 0
ret

Function at 0x1400105e0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x30
mov rbx, r9
mov rdi, r8
mov rsi, rcx
mov ecx, 0x20
call fcn.14001074c
mov rdx, qword [rsp + 0x60]
mov qword [rax], rdx
mov rdx, qword [rbx]
mov qword [rax + 8], rdx
mov rdx, qword [rdi]
mov qword [rax + 0x10], rdx
lea rcx, [0x1400066d0]
mov qword [rax + 0x18], rcx
mov qword [rsp + 0x48], rax
lea rbx, [rsi + 8]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x1400106a0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsi], rax
test rax, rax
je 0x14001066a
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov dword [rbx], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x1400110a0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400110ea
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400110ea
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400110ea
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400110ea
cmp dword [rcx + 0x84], 0xe
jbe 0x1400110ea
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400110ec
xor al, al
add rsp, 0x28
ret
Function at 0x140006590
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x1400065ed
lea rbx, [0x1400e2c60]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x1400065d4
cmp r10, 2
jb 0x1400065d4
cmp byte [r9], r8b
jne 0x1400065d4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x1400065b0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x14000662f
lea rbx, [0x1400e2c60]
cmp r8b, 0x23
jne 0x140006613
cmp byte [r9], r8b
jne 0x140006613
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140006600
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x140006770
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x14000678a
mov qword [r8], 0
lea rdx, [0x140157a5c]
call fcn.140006640
mov rbx, rax
test rax, rax
jne 0x1400067aa
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x140006881
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140006881
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x140006881
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140006881
cmp rdi, 0xffffffffffffffff
je 0x140006881
mov rax, qword [0x14016e000]
test rax, rax
je 0x14000681e
inc dword [rax + 0xfc]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x140006881
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x14000686e
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x14016e000]
test rax, rax
je 0x140006863
dec dword [rax + 0xfc]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x14000688a
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x14000687c
mov qword [r14], rdi
mov rax, rsi
jmp 0x14000688c
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret