joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140111160
Capabilities:
Check for software breakpoints

Disassembly:
mov eax, gethostname
call fcn.1401a62f0
sub rsp, rax
mov r11, rcx
cmp dword [rsp + 0x60], r9d
jne 0x14011123c
movzx r10d, byte [r8]
lea eax, [r10 - 0x6a]
cmp al, 1
ja 0x14011123c
lea rdx, [r8 + 1]
mov qword [rsp + 0x30], rbx
xor r8d, r8d
cmp r10b, 0x6b
jne 0x1401111f2
lea ebx, [r9 - 3]
mov eax, r8d
test ebx, ebx
jle 0x1401111c6
nop dword [rax + rax]
movzx ecx, byte [rdx]
inc rdx
cmp cl, 0xba
je 0x1401111c6
cmp cl, 0xbb
jne 0x1401111cc
inc eax
cmp eax, ebx
jl 0x1401111b0
sub ebx, eax
test eax, eax
jne 0x1401111f6
mov edx, 0x80
mov dword [rsp + 0x20], r8d
xor r9d, r9d
lea ecx, [rdx - 0x7c]
lea r8d, [rdx + 0xa]
call fcn.1400a8770
mov rbx, qword [rsp + 0x30]
or eax, 0xffffffff
add rsp, 0x38
ret
lea ebx, [r9 - 2]
movsxd rax, ebx
cmp byte [rax + rdx], 0xcc
je 0x140111225
mov edx, 0x80
mov dword [rsp + 0x20], r8d
xor r9d, r9d
lea ecx, [rdx - 0x7c]
lea r8d, [rdx + 0xb]
call fcn.1400a8770
mov rbx, qword [rsp + 0x30]
or eax, 0xffffffff
add rsp, 0x38
ret
mov r8d, ebx
mov rcx, r11
call fcn.1401a6b60
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
ret
mov edx, 0x80
xor r8d, r8d
mov dword [rsp + 0x20], r8d
xor r9d, r9d
lea ecx, [rdx - 0x7c]
lea r8d, [rdx + 9]
call fcn.1400a8770
or eax, 0xffffffff
add rsp, 0x38
ret

Function at 0x14011ccd0
Capabilities:
Encode data using xor

Disassembly:
mov eax, gethostname
call fcn.1401a62f0
sub rsp, rax
mov r10, rdx
mov dword [rsp + 0x40], reloc.WS2_32.dll_recv
xor edx, edx
lea rax, [r8 + 0xf]
mov r11, rcx
lea r9, [r10 + 0xf]
cmp r10, rax
ja 0x14011ccff
cmp r9, r8
jae 0x14011cd17
movdqu xmm1, xmmword [r10]
mov edx, reloc.WS2_32.dll_recv
movdqu xmm0, xmmword [r8]
pxor xmm1, xmm0
movdqu xmmword [r10], xmm1
movsxd rcx, edx
cmp rcx, 0x10
jge 0x14011cd41
sub r8, r10
lea rax, [rcx + r10]
mov edx, reloc.WS2_32.dll_recv
sub rdx, rcx
nop
movzx ecx, byte [r8 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x14011cd30
mov rcx, qword [r11 + 8]
lea r8, [rsp + 0x40]
mov r9, r10
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
mov rdx, r10
call fcn.1400a14a0
test eax, eax
je 0x14011cd72
cmp dword [rsp + 0x40], 0x10
jne 0x14011cd72
mov eax, 1
add rsp, 0x38
ret
xor eax, eax
add rsp, 0x38
ret

Function at 0x14011cfd0
Capabilities:
Encode data using xor

Disassembly:
mov r10, rcx
test rdx, rdx
je 0x14011d058
test r8, r8
je 0x14011d058
mov r9, qword [rcx + 0x18]
cmp r8, r9
cmovb r9, r8
test r9, r9
je 0x14011d012
add rcx, 0x20
mov r11, rdx
sub r11, r10
nop dword [rax + rax]
movzx eax, byte [r11 + rcx - 0x20]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub r9, 1
jne 0x14011d000
mov rax, qword [r10 + 0x18]
cmp r8, rax
jbe 0x14011d058
sub r8, rax
mov eax, reloc.WS2_32.dll_recv
cmp r8, rax
cmova r8, rax
xor ecx, ecx
test r8, r8
je 0x14011d058
nop dword [rax]
nop word [rax + rax]
mov rax, qword [r10 + 0x18]
add rax, rcx
movzx eax, byte [rax + rdx]
xor byte [r10 + rcx + 0x40], al
inc rcx
cmp rcx, r8
jb 0x14011d040
ret
Function at 0x140152870
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Encrypt data using salsa20 or chacha

Disassembly:
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x3f]
mov eax, 0xb0
call fcn.1401a62f0
sub rsp, rax
mov rax, qword [0x1402ccee0]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov rax, qword [rbp + 0x7f]
mov r14, r8
mov dword [rbp - 0x11], 0x61707865
mov rsi, rdx
mov dword [rbp - 0xd], 0x3320646e
mov rdi, rcx
mov dword [rbp - 9], 0x79622d32
mov dword [rbp - 5], 0x6b206574
movups xmm0, xmmword [r9]
movups xmm1, xmmword [r9 + 0x10]
movups xmmword [rbp - 1], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xf], xmm1
movups xmmword [rbp + 0x1f], xmm0
test r8, r8
je 0x140152a04
mov qword [rsp + 0xd8], rbx
nop dword [rax + rax]
mov ebx, 0x40
lea rdx, [rbp - 0x11]
cmp r14, rbx
lea rcx, [rbp - 0x51]
cmovb rbx, r14
call fcn.140152a30
xor eax, eax
test rbx, rbx
je 0x1401529ea
cmp rbx, 0x20
jb 0x1401529b5
lea rdx, [rdi - 1]
add rdx, rbx
lea rcx, [rbp + rbx - 0x52]
cmp rdi, rcx
ja 0x140152938
lea rcx, [rbp - 0x51]
cmp rdx, rcx
jae 0x1401529b5
lea rcx, [rsi - 1]
add rcx, rbx
cmp rdi, rcx
ja 0x140152949
cmp rdx, rsi
jae 0x1401529b5
lea rcx, [rbp - 0x51]
mov rdx, rsi
sub rdx, rcx
mov r9, rbx
lea rcx, [rbp - 0x51]
and r9, 0xffffffffffffffe0
mov r8, rdi
sub r8, rcx
nop dword [rax]
nop dword [rax + rax]
movdqu xmm0, xmmword [rbp + rax - 0x51]
lea rcx, [rdx + rax]
movdqu xmm1, xmmword [rbp + rcx - 0x51]
lea rcx, [r8 + rax]
pxor xmm1, xmm0
movdqu xmm0, xmmword [rbp + rax - 0x41]
movdqu xmmword [rbp + rcx - 0x51], xmm1
lea rcx, [rdx + rax]
movdqu xmm1, xmmword [rbp + rcx - 0x41]
lea rcx, [r8 + rax]
add rax, 0x20
pxor xmm1, xmm0
movdqu xmmword [rbp + rcx - 0x41], xmm1
cmp rax, r9
jb 0x140152970
cmp rax, rbx
jae 0x1401529ea
lea rcx, [rbp - 0x51]
mov r8, rsi
sub r8, rcx
mov r9, rdi
lea rcx, [rbp - 0x51]
sub r9, rcx
nop
lea rdx, [rbp - 0x51]
add rdx, rax
inc rax
movzx ecx, byte [r8 + rdx]
xor cl, byte [rdx]
mov byte [r9 + rdx], cl
cmp rax, rbx
jb 0x1401529d0
inc dword [rbp + 0x1f]
add rdi, rbx
add rsi, rbx
sub r14, rbx
jne 0x1401528f0
mov rbx, qword [rsp + 0xd8]
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.1401a5d00
mov rsi, qword [rsp + 0xe0]
add rsp, 0xb0
pop r14
pop rdi
pop rbp
ret
Function at 0x1401593c0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
mov eax, 0xf0
call fcn.1401a62f0
sub rsp, rax
mov r14, r9
mov r15, r9
shr r14, 3
mov rbp, r8
mov rsi, rdx
mov rdi, rcx
cmp r8, r9
jb 0x1401594bf
mov qword [rsp + 0x110], rbx
xor edx, edx
test r14, r14
je 0x140159470
nop word [rax + rax]
movzx eax, byte [rsi + 6]
movzx ecx, byte [rsi + 7]
shl rcx, 8
or rcx, rax
movzx eax, byte [rsi + 5]
shl rcx, 8
or rcx, rax
movzx eax, byte [rsi + 4]
shl rcx, 8
or rcx, rax
movzx eax, byte [rsi + 3]
shl rcx, 8
or rcx, rax
movzx eax, byte [rsi + 2]
shl rcx, 8
or rcx, rax
movzx eax, byte [rsi + 1]
shl rcx, 8
or rcx, rax
movzx eax, byte [rsi]
shl rcx, 8
add rsi, 8
or rcx, rax
xor qword [rdi + rdx*8], rcx
inc rdx
cmp rdx, r14
jb 0x140159410
xor ebx, ebx
nop dword [rax]
nop word [rax + rax]
mov r8, rbx
lea rcx, [rsp + 0x20]
mov rdx, rdi
call fcn.140158ff0
lea r8, [rbx + 1]
mov rcx, rdi
lea rdx, [rsp + 0x20]
call fcn.140158ff0
add rbx, 2
cmp rbx, 0x18
jb 0x140159480
sub rbp, r15
cmp rbp, r15
jae 0x140159400
mov rbx, qword [rsp + 0x110]
lea r11, [rsp + 0xf0]
mov rax, rbp
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x1401a83f8
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x1401a81cc
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1401a81cc
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1401a81cc
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1401a81cc
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1401a81cc
cmp dword [rcx + 0x84], 0xe
jbe 0x1401a81cc
cmp dword [rcx + 0xf8], esi
je 0x1401a81cc
mov ecx, r14d
call fcn.1401a8314
mov ecx, 2
call fcn.1401ba910
nop
cmp byte [0x1402cef30], 0
jne 0x1401a8296
mov r15d, 1
mov eax, r15d
xchg dword [0x1402cef20], eax
test ebx, ebx
jne 0x1401a823f
mov rdi, qword [0x1402ccee0]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x1402cef28]
cmp rcx, rax
je 0x1401a8236
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [fcn.140003540]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x1402cf2e0]
jmp 0x1401a824b
cmp ebx, r15d
jne 0x1401a8251
lea rcx, [0x1402cf2f8]
call fcn.1401ba564
nop
test ebx, ebx
jne 0x1401a8268
lea rdx, [0x1401d2c78]
lea rcx, [0x1401d2c58]
call fcn.1401b9fa4
lea rdx, [0x1401d2c88]
lea rcx, [0x1401d2c80]
call fcn.1401b9fa4
movzx eax, byte [0x1402cef30]
test esi, esi
cmove eax, r15d
mov byte [0x1402cef30], al
jmp 0x1401a8296
mov ecx, 2
call fcn.1401ba964
test esi, esi
jne 0x1401a82ad
mov ecx, r14d
call fcn.1401a82c8
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x1401a815c

Function at 0x1401b4910
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1401b4930
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1401acd2c
or eax, 0xffffffff
jmp 0x1401b4932
xor eax, eax
add rsp, 0x28
ret

Function at 0x1401b4938
Capabilities:
Delete directory

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x1401b4958
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1401acd2c
or eax, 0xffffffff
jmp 0x1401b495a
xor eax, eax
add rsp, 0x28
ret
Function at 0x1401bedcc
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x1401bec6c
call fcn.1401acd9c
mov dword [rax], reloc.WS2_32.dll_shutdown
call fcn.1401ac8bc
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x1401bec54
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x1401bec54
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x1401bec9e
lock or dword [rax + 0x14], 0x10
jmp 0x1401bec54
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x1401becbb
mov rcx, qword [rbp + 0x10]
call fcn.1401c5d50
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.1401b8400
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.1401bb9d8
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x1401bed12
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x1401bec54
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x1401bed7e
mov rcx, qword [rbp + 0x10]
call fcn.1401b8400
cmp eax, 0xffffffff
je 0x1401bed65
mov rcx, qword [rbp + 0x10]
call fcn.1401b8400
cmp eax, 0xfffffffe
je 0x1401bed65
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.1401b8400
movsxd rdi, eax
lea rsi, [0x1402cf6d0]
mov rcx, rbx
sar rdi, 6
call fcn.1401b8400
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x1401bed6c
lea rax, [0x1402cd1f0]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x1401bed7e
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x1401bedb4
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x1401bedb0
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x1401bedb0
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x1401bec57
jmp 0x1401bec24

Function at 0x1401bee18
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov rdx, rcx
test rcx, rcx
jne 0x1401bedf5
call fcn.1401acd9c
mov dword [rax], reloc.WS2_32.dll_shutdown
call fcn.1401ac8bc
or eax, 0xffffffff
jmp 0x1401bee12
sub dword [rcx + 0x10], 1
jns 0x1401bee04
add rsp, 0x28
jmp fcn.1401bedcc
mov rax, qword [rcx]
movzx ecx, byte [rax]
inc rax
mov qword [rdx], rax
mov eax, ecx
add rsp, 0x28
ret
jmp 0x1401bedd4
Function at 0x140012a30
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x1400b30a0]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor eax, eax
mov dword [rsp + 0x28], r9d
xorps xmm0, xmm0
mov dword [rsp + 0x2c], eax
mov dword [rsp + 0x3c], eax
xor r9d, r9d
mov dword [rsp + 0x4c], eax
mov rbx, rcx
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0xc8]
mov dword [rsp + 0x38], edx
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x40], r8
lea r8d, [r9 + 0x30]
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x20], 0x9f703546
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x140012aec
xor r9d, r9d
lea rdx, [rsp + 0x50]
mov rcx, rbx
lea r8d, [r9 + 0x30]
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
cmp rcx, 8
jb 0x140012aec
cmp dword [rsp + 0x50], 0x9f703546
jne 0x140012aec
cmp dword [rsp + 0x54], 3
jne 0x140012aec
mov eax, dword [rsp + 0x58]
jmp 0x140012aee
xor eax, eax
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140089250
add rsp, 0x90
pop rbx
ret

Function at 0x140012b10
Capabilities:
Connect socket
Connect udp socket
Create udp socket

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x1400b30a0]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov ebx, 2
mov qword [rsp + 0x28], 0
mov ecx, 0x7f000001
mov word [rsp + 0x20], bx
call qword [sym.imp.WS2_32.dll_htonl]
mov ecx, 0x4bee
mov dword [rsp + 0x24], eax
call qword [sym.imp.WS2_32.dll_htons]
xor r8d, r8d
lea edx, [rbx - 1]
mov ecx, ebx
mov word [rsp + 0x22], ax
call qword [sym.imp.WS2_32.dll_socket]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140012b90
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x140012baa
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
mov rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140089250
add rsp, 0x40
pop rbx
ret
mov rax, rbx
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140089250
add rsp, 0x40
pop rbx
ret
Function at 0x140012bc0
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x1400b30a0]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, qword [0x1400b4518]
lea rdx, [rsp + 0x20]
mov eax, dword [0x1400b41e4]
xor ecx, ecx
xorps xmm0, xmm0
mov qword [rsp + 0x2c], rcx
mov qword [rsp + 0x44], rcx
xor r9d, r9d
mov dword [rsp + 0x4c], ecx
lea r8d, [rcx + 0x30]
mov dword [rsp + 0x20], 0x9f703546
mov rcx, rbx
mov dword [rsp + 0x24], 2
movdqu xmmword [rsp + 0x34], xmm0
mov dword [rsp + 0x28], eax
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x140012c74
xor r9d, r9d
lea rdx, [rsp + 0x50]
mov rcx, rbx
lea r8d, [r9 + 0x30]
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
cmp rcx, 8
jb 0x140012c74
cmp dword [rsp + 0x50], 0x9f703546
jne 0x140012c74
cmp dword [rsp + 0x54], 3
jne 0x140012c74
mov rax, qword [rsp + 0x58]
jmp 0x140012c76
xor eax, eax
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140089250
add rsp, 0x90
pop rbx
ret

Function at 0x140012c90
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x160
mov rax, qword [0x1400b30a0]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor edx, edx
mov rbx, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140012ccd
xor eax, eax
jmp 0x140012d7f
xor edx, edx
mov qword [rsp + 0x170], rsi
mov r8d, Ordinal_301
lea rcx, [rsp + 0x24]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rdi
xor sil, sil
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x140012d64
nop dword [rax]
nop dword [rax + rax]
lea rcx, [rsp + 0x4c]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rcx + rax], sil
jne 0x140012d20
cmp qword [rbx + 0x18], 0x10
mov rcx, rbx
mov r8, qword [rbx + 0x10]
jb 0x140012d3a
mov rcx, qword [rbx]
cmp r8, rax
jne 0x140012d4d
lea rdx, [rsp + 0x4c]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140012d61
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140012d10
jmp 0x140012d64
mov sil, 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
test sil, sil
mov rsi, qword [rsp + 0x170]
cmovne eax, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140089250
mov rbx, qword [rsp + 0x178]
add rsp, 0x160
pop rdi
ret

Function at 0x140013410
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xa], 0
je 0x140013433
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x6b]
xor byte [rax + rcx], dl
inc rax
cmp rax, 9
jb 0x140013420
mov byte [rcx + 0xa], 0
mov rax, rcx
ret

Function at 0x140013440
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xd], 0
je 0x140013463
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x6b]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xc
jb 0x140013450
mov byte [rcx + 0xd], 0
mov rax, rcx
ret
Function at 0x1400137d0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x140013807
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x140013828
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14001382a
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140013883
test ecx, ecx
jle 0x140013863
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
sub rbx, rbp
add r14, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140013883
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140013883
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x30]
sub rsi, rbx
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1400138b0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x1400138d2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x1400138e8
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140013904
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140013906
xor ecx, ecx
mov qword [rsp + 0x20], rdi
movsxd rax, ecx
test ecx, ecx
je 0x140013940
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
sub rbx, rdi
add r14, rdi
mov r8, rbx
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x1400139e7
mov r9, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r9], rax
jne 0x14001397b
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r9], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov rdi, r8
cmp r8, 0xfff
jbe 0x1400139c1
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
add r14, rax
mov rdi, rbx
cmp rax, 0xfff
jne 0x140013a00
cmp rbx, rax
ja 0x140013990
mov r8, rdi
test rdi, rdi
je 0x1400139e7
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov r8, rdi
sub r8, rax
sub rbp, r8
mov rdi, qword [rsp + 0x20]
mov rax, rbp
mov rbx, qword [rsp + 0x28]
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
sub rbp, rbx
jmp 0x1400139ea
Function at 0x140013e00
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1400b30a0]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x140013e2d
xor eax, eax
jmp 0x140013f82
mov rdx, qword [rcx + 0x40]
mov rax, qword [rdx]
test rax, rax
je 0x140013e58
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, rax
cmp rax, r8
jae 0x140013e58
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x140013f82
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x140013f75
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x140013e9b
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140013ec6
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140013f7a
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140013f35
sub eax, 1
je 0x140013f35
cmp eax, 2
jne 0x140013f75
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140013f7a
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140013f63
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x140013f75
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, edi
jne 0x140013f7a
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140089250
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret