joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005c380
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x140092010]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x20], rcx
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x14005c498
movsxd rax, dword [rdx + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x14005c498
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
xor edx, edx
mov qword [rsp + 0x50], rdx
mov ecx, dword [rax + rsi + 0xb0]
test ecx, ecx
jne 0x14005c3f8
mov qword [rdi], rdx
mov qword [rdi + 8], rdx
mov qword [rdi + 0x10], rdx
jmp 0x14005c4a5
lea rbx, [rsi + rcx]
mov ebp, dword [rax + rsi + 0xb4]
add rbp, rbx
mov rcx, qword [rsp + 0x48]
cmp rbx, rbp
jae 0x14005c486
mov r8d, dword [rbx + 4]
test r8d, r8d
je 0x14005c486
mov eax, dword [rbx]
add rax, rsi
mov qword [rsp + 0x28], rax
lea rax, [rbx + 8]
mov qword [rsp + 0x30], rax
lea rax, [r8 - 8]
shr rax, 1
mov dword [rsp + 0x38], eax
cmp rcx, rdx
je 0x14005c45f
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rcx], xmm0
movsd xmm1, qword [rsp + 0x38]
movsd qword [rcx + 0x10], xmm1
mov rcx, qword [rsp + 0x48]
add rcx, 0x18
mov qword [rsp + 0x48], rcx
jmp 0x14005c476
lea r8, [rsp + 0x28]
mov rdx, rcx
lea rcx, [rsp + 0x40]
call fcn.14005c9d0
mov rcx, qword [rsp + 0x48]
mov eax, dword [rbx + 4]
add rbx, rax
mov rdx, qword [rsp + 0x50]
cmp rbx, rbp
jb 0x14005c410
mov rax, qword [rsp + 0x40]
mov qword [rdi], rax
mov qword [rdi + 8], rcx
mov qword [rdi + 0x10], rdx
jmp 0x14005c4a5
xor edx, edx
mov qword [rcx], rdx
mov qword [rcx + 8], rdx
mov qword [rcx + 0x10], rdx
mov rax, rdi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14006c790
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14005e080
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x140092010]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r14, rcx
xor ebp, ebp
mov ebx, ebp
mov dword [rsp + 0x20], ebp
lea r9, [rsp + 0x20]
xor r8d, r8d
xor edx, edx
lea ecx, [rbp + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x14005e114
test rbx, rbx
je 0x14005e0dc
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rsp + 0x20]
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
lea r9, [rsp + 0x20]
mov r8d, dword [rsp + 0x20]
mov rdx, rax
mov ecx, 0xb
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x14005e0c6
test eax, eax
jns 0x14005e153
test rbx, rbx
je 0x14005e12e
mov r8d, 0x8000
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14006c790
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
test rbx, rbx
je 0x14005e12e
mov edi, ebp
cmp dword [rbx], ebp
jbe 0x14005e11d
nop
mov esi, edi
imul rax, rsi, 0x128
movzx ecx, word [rax + rbx + 0x2e]
add rcx, rax
lea rdx, [rbx + 0x30]
add rdx, rcx
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], socket
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x14005e192
lea rcx, [rsp + 0x28]
call fcn.140054910
mov rdx, r14
cmp qword [r14 + 0x18], 0x10
jb 0x14005e1b3
mov rdx, qword [r14]
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 0x10
cmovae rcx, qword [rsp + 0x28]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x14005e216
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x14005e207
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005e202
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005e267
call fcn.14006c880
inc edi
cmp edi, dword [rbx]
jb 0x14005e160
jmp 0x14005e11d
imul rax, rsi, 0x128
mov rdi, qword [rax + rbx + 0x18]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x14005e273
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005e26e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005e26e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006c880
mov rax, rdi
jmp 0x14005e130
Function at 0x140063c00
Capabilities:
Create thread
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140092010]
xor rax, rsp
mov qword [rbp - 8], rax
mov edi, dword [0x14009318c]
movsxd rax, dword [0x1400920bc]
xor esi, esi
mov edx, esi
cmp eax, 0x7b
ja 0x140063c46
lea rdx, [0x1400920f0]
mov rdx, qword [rdx + rax*8]
mov qword [rbp - 0x28], rsi
mov qword [rbp - 0x18], rsi
mov qword [rbp - 0x10], recv
mov byte [rbp - 0x28], 0
test rdx, rdx
jne 0x140063cb2
mov dword [rbp - 0x40], 0x9c9492a5
mov dword [rbp - 0x3c], 0xb6dc8f99
mov dword [rbp - 0x38], 0x100869b
mov rcx, rsi
nop word [rax + rax]
lea eax, [rcx - 0xa]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xa
jb 0x140063c80
mov byte [rbp - 0x35], 0
lea rax, [rbp - 0x40]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x140063ca2
lea rdx, [rbp - 0x40]
jmp 0x140063cca
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x140063cc0
lea rcx, [rbp - 0x28]
call fcn.140054910
cmp edi, 1
jne 0x140063d39
movdqa xmm0, xmmword [0x140087220]
movdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x30], 0x62
mov byte [rbp - 0x2e], dil
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0xa]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0x11
jb 0x140063d00
mov byte [rbp - 0x2e], 0
lea rax, [rbp - 0x40]
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140063d20
mov r8, rbx
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x28]
call fcn.140054910
movss xmm0, dword [0x1400867c8]
movss dword [rbp - 0x40], xmm0
movss xmm1, dword [0x140086790]
movss dword [rbp - 0x3c], xmm1
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 0x10
cmovae rcx, qword [rbp - 0x28]
lea rdx, [rbp - 0x40]
call fcn.14003e2c0
test al, al
je 0x140063d90
test edi, edi
jne 0x140063d90
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
xor r9d, r9d
lea r8, [0x14005f5b0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop
mov rdx, qword [rbp - 0x10]
cmp rdx, 0x10
jb 0x140063dce
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140063dc9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140063dc9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006c880
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14006c790
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret

Function at 0x140063df0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x12], 0
je 0x140063e13
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0xa]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x11
jb 0x140063e00
mov byte [rcx + 0x12], 0
mov rax, rcx
ret
Function at 0x140064500
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
movdqa xmm0, xmmword [0x1400871b0]
xor eax, eax
movdqu xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x30], 0x6c64776b
mov dword [rsp + 0x34], 0x616d682a
mov dword [rsp + 0x38], 0x746a62
mov byte [rsp + 0x3c], 1
nop dword [rax]
nop word [rax + rax]
lea edx, [rax - 0xa]
xor byte [rsp + rax + 0x20], dl
inc rax
cmp rax, 0x1b
jb 0x140064540
mov rcx, qword [0x14006f250]
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x3c], 0
call fcn.1400590a0
lea rdx, [0x140054ca0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov al, 1
add rsp, 0x48
ret
Function at 0x140065930
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 7], 0
je 0x140065953
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0xa]
xor byte [rax + rcx], dl
inc rax
cmp rax, 6
jb 0x140065940
mov byte [rcx + 7], 0
mov rax, rcx
ret
Function at 0x1400695d0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x11], 0
je 0x1400695f3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0xa]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x10
jb 0x1400695e0
mov byte [rcx + 0x11], 0
mov rax, rcx
ret
Function at 0x14006a910
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x34], 0
je 0x14006a933
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0xa]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x33
jb 0x14006a920
mov byte [rcx + 0x34], 0
mov rax, rcx
ret

Function at 0x1400a36e0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x50
mov r12, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x1400a370d
xor al, al
jmp 0x1400a386f
mov rax, qword [0x1400c46c0]
lea rcx, [rsp]
xor r11d, r11d
mov qword [rcx], rax
mov rax, qword [0x1400c46c8]
mov qword [rsp + 0x60], rbp
mov qword [rcx + 8], rax
mov rax, qword [0x1400c46d0]
mov rdx, r11
mov qword [rcx + 0x10], rax
mov rax, qword [0x1400c46d8]
mov qword [rcx + 0x18], rax
mov rax, qword [0x1400c46e0]
mov qword [rcx + 0x20], rax
mov rax, qword [0x1400c46e8]
mov qword [rcx + 0x28], rax
mov rax, qword [0x1400c46f0]
mov qword [rcx + 0x30], rax
mov rax, qword [0x1400c46f8]
mov qword [rcx + 0x38], rax
movzx eax, byte [0x1400c4700]
mov byte [rcx + 0x40], al
mov rax, qword [r9]
mov rcx, r8
lea rbp, [r8 + rax]
test rbx, rbx
je 0x1400a3861
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x1400a37b9
mov r11d, 2
jmp 0x1400a37dd
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x1400a37d3
mov r11d, 1
jmp 0x1400a37dd
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, rbp
ja 0x1400a3885
mov rax, r10
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov rax, r10
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x1400a3822
mov byte [rcx + 2], 0x3d
add rcx, 3
add r8, 3
jmp 0x1400a383a
shr r10, 6
add rcx, 3
and r10d, 0x3f
add r8, 3
movzx eax, byte [rsp + r10]
mov byte [rcx - 1], al
test r11, r11
je 0x1400a384a
mov byte [rcx], 0x3d
inc rcx
inc r8
jmp 0x1400a3858
movzx eax, byte [rsp + r9]
inc rcx
inc r8
mov byte [rcx - 1], al
cmp rdx, rbx
jb 0x1400a37a0
sub rcx, rsi
mov al, 1
mov qword [r12], rcx
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
xor al, al
jmp 0x1400a386a

Function at 0x40c280
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x00417b20]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x40c2ed
mov rcx, r8
call fcn.0040c160
test eax, eax
je 0x40c2ed
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x40c2ed
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x40c2e4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x40c2ef
add rax, 0x28
cmp rax, r9
jne 0x40c2d0
xor eax, eax
add rsp, 0x28
ret
Function at 0x1800029e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rbp, rcx
movzx ebx, dl
mov rcx, qword [rcx + 0x38]
mov r14, r8
call qword [0x18000b370]
xor edi, edi
mov rsi, rax
shl ebx, 2
nop word [rax + rax]
mov edx, edi
mov eax, edi
shr edx, 2
and eax, 3
add edx, ebx
mov rcx, r14
imul edx, dword [rbp + 0x10]
add edx, eax
call qword [0x18000b320]
xor byte [rsi], al
inc edi
lea rsi, [rsi + 1]
cmp edi, 0x10
jl 0x180002a20
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x180002a70
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x10], rdx
push rdi
push r14
push r15
sub rsp, 0x30
mov r15, r9
mov rbp, r8
mov rsi, rdx
xor edi, edi
mov dword [rsp + 0x20], edi
mov rcx, r8
call qword [0x18000b378]
mov rbx, rax
mov rcx, r15
call qword [0x18000b378]
mov r14, rax
mov rcx, rsi
call qword [0x18000b2f8]
mov dword [rsp + 0x20], 1
mov rcx, qword [r15]
mov r8d, dword [rcx + 4]
mov rcx, qword [rbp]
mov edx, dword [rcx + 4]
cmp r8d, edx
cmovl edx, r8d
test edx, edx
jle 0x180002b10
sub r14, rbx
movzx r8d, byte [r14 + rbx]
xor r8b, byte [rbx]
mov edx, edi
mov rcx, rsi
call qword [0x18000b358]
inc edi
lea rbx, [rbx + 1]
mov rax, qword [r15]
mov edx, dword [rax + 4]
mov rax, qword [rbp]
mov ecx, dword [rax + 4]
cmp edx, ecx
cmovl ecx, edx
cmp edi, ecx
jl 0x180002ae1
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x180003d00
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x10], rdx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r14, r8
mov r13, rdx
mov rsi, rcx
xor ebp, ebp
mov dword [rsp + 0x20], ebp
mov rdx, r9
mov rcx, r13
call qword [0x18000b308]
mov dword [rsp + 0x20], 1
mov qword [rsi + 0x38], r13
mov r8, r14
movzx edx, byte [rsi + 0x28]
mov rcx, rsi
call fcn.1800029e0
movzx r12d, byte [rsi + 0x28]
sub r12b, 1
je 0x180003e3b
mov rcx, qword [rsi + 0x38]
call qword [0x18000b370]
mov r8, rax
movzx edx, byte [rax + 0xd]
movzx ecx, byte [rax + 9]
mov byte [rax + 0xd], cl
movzx ecx, byte [rax + 5]
mov byte [rax + 9], cl
movzx ecx, byte [rax + 1]
mov byte [rax + 5], cl
mov byte [rax + 1], dl
movzx ecx, byte [rax + 0xa]
movzx eax, byte [rax + 2]
mov byte [r8 + 0xa], al
mov byte [r8 + 2], cl
movzx ecx, byte [r8 + 0xe]
movzx eax, byte [r8 + 6]
mov byte [r8 + 0xe], al
mov byte [r8 + 6], cl
movzx ecx, byte [r8 + 7]
movzx eax, byte [r8 + 0xb]
mov byte [r8 + 7], al
movzx eax, byte [r8 + 0xf]
mov byte [r8 + 0xb], al
movzx eax, byte [r8 + 3]
mov byte [r8 + 0xf], al
mov byte [r8 + 3], cl
mov rcx, rsi
call fcn.1800041c0
mov rcx, qword [rsi + 0x38]
call qword [0x18000b370]
mov rdi, rax
mov ebx, ebp
movzx r15d, r12b
shl r15d, 2
nop dword [rax]
nop dword [rax + rax]
mov edx, ebx
shr edx, 2
add edx, r15d
imul edx, dword [rsi + 0x10]
mov eax, ebx
and eax, 3
add edx, eax
mov rcx, r14
call qword [0x18000b320]
xor byte [rdi], al
inc ebx
lea rdi, [rdi + 1]
cmp ebx, 0x10
jl 0x180003e00
mov rcx, rsi
call fcn.180003f10
add r12b, 0xff
jne 0x180003d66
mov rcx, qword [rsi + 0x38]
call qword [0x18000b370]
mov r8, rax
movzx edx, byte [rax + 0xd]
movzx ecx, byte [rax + 9]
mov byte [rax + 0xd], cl
movzx ecx, byte [rax + 5]
mov byte [rax + 9], cl
movzx ecx, byte [rax + 1]
mov byte [rax + 5], cl
mov byte [rax + 1], dl
movzx ecx, byte [rax + 0xa]
movzx eax, byte [rax + 2]
mov byte [r8 + 0xa], al
mov byte [r8 + 2], cl
movzx ecx, byte [r8 + 0xe]
movzx eax, byte [r8 + 6]
mov byte [r8 + 0xe], al
mov byte [r8 + 6], cl
movzx ecx, byte [r8 + 7]
movzx eax, byte [r8 + 0xb]
mov byte [r8 + 7], al
movzx eax, byte [r8 + 0xf]
mov byte [r8 + 0xb], al
movzx eax, byte [r8 + 3]
mov byte [r8 + 0xf], al
mov byte [r8 + 3], cl
mov rcx, rsi
call fcn.1800041c0
mov rcx, qword [rsi + 0x38]
call qword [0x18000b370]
mov rbx, rax
nop
mov edx, ebp
shr edx, 2
imul edx, dword [rsi + 0x10]
mov ecx, ebp
and ecx, 3
add edx, ecx
mov rcx, r14
call qword [0x18000b320]
xor byte [rbx], al
inc ebp
lea rbx, [rbx + 1]
cmp ebp, 0x10
jl 0x180003ec0
mov rax, r13
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1801c6afe
Capabilities:
Encode data using xor

Disassembly:
push qword [rsp + 0x28]
popfq
lea rsp, [rsp + 0x30]
call fcn.18045e18c
add byte [rax], al
add byte [rdi], bh
js 0x1801c6b79
invalid
insb byte [rdi], dx
invalid
xor esp, dword [rbp + rdi*4 + 0x1b]
mov ebp, 0xacda34ac
cmp ch, bl
pop rbp
loop 0x1801c6b40
cmp eax, 0x4029cc60
sub dh, bh
invalid
Function at 0x140001000
Capabilities:
Create thread
Enumerate processes
Inject thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x290
mov rax, qword [0x140004008]
xor rax, rsp
mov qword [rsp + 0x288], rax
xor ebp, ebp
lea rsi, str.RustClient.exe
xor edx, edx
mov edi, ebp
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400010a8
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400010a8
lea rdx, [rsp + 0x6c]
mov rax, 0xffffffffffffffff
nop
movzx ecx, word [rdx + rax*2 + 2]
cmp cx, word [rsi + rax*2 + 2]
jne 0x140001090
add rax, 2
cmp rax, 0xf
je 0x1400010a4
movzx ecx, word [rdx + rax*2]
cmp cx, word [rsi + rax*2]
je 0x140001070
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140001062
jmp 0x1400010a8
mov edi, dword [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x1e
call qword [sym.imp.KERNEL32.dll_Sleep]
test edi, edi
je 0x140001032
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x1400011bd
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtOpenFile
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x140001143
mov r9d, 5
mov qword [rsp + 0x20], rbp
lea r8, [rsp + 0x280]
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r9d, 5
mov qword [rsp + 0x20], rbp
lea r8, [rsp + 0x280]
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xor edx, edx
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8d, 0x104
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r9d, 0x18
mov qword [rsp + 0x20], rbp
mov rdx, rax
lea r8, str.C:ggez.dll
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r9, qword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor r8d, r8d
mov qword [rsp + 0x30], rbp
xor edx, edx
mov dword [rsp + 0x28], ebp
mov rcx, rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test rax, rax
je 0x1400011b4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x288]
xor rcx, rsp
call fcn.140001200
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x140001adc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001b26
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001b26
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001b26
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001b26
cmp dword [rcx + 0x84], 0xe
jbe 0x140001b26
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001b28
xor al, al
add rsp, 0x28
ret
Function at 0x180e7b7f8
Capabilities:
Encode data using xor

Disassembly:
jmp 0x180e7b802
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x180e7b82b
pop rbp
sub rbp, 0x33
sub rbp, 0xe7b7f8
cmp edx, 1
je 0x180e7b86e
ldmxcsr dword [rsp]
add rsp, 8
popfq
pop r15
pop r14
pop r13
pop r12
pop r11
pop r10
pop r9
pop r8
pop rdi
pop rsi
pop rbp
pop rbx
pop rdx
pop rcx
pop rax
xor rax, rax
ret
sub rsp, 0x20
jmp 0x180e7b87e
mov rax, 0xe7b7f8
add rax, rbp
add rax, 0xb8
mov rcx, 0x60b
mov rdx, 0x2aae2902
xor byte [rax], dl
inc rax
dec rcx
jne 0x180e7b89d
jmp 0x180e7b8b4
mov rbp, rbx
mov dword [rbx + 0x202023e], ecx
add rbx, 0xa
add eax, dword [rdx]
add cl, byte [rdx + 3]
jmp 0x180e7b912
invalid
Function at 0x140003910
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
mov qword [rsp + 0x58], rdx
mov rbx, r8
xor edx, edx
test rcx, rcx
je 0x140003944
cmp word [rcx], 0x5a4d
jne 0x140003944
movsxd rax, dword [rcx + 0x3c]
cmp eax, 0x400
jg 0x140003944
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140003944
mov edx, dword [rcx + 0x28]
add rdx, qword [rsp + 0x58]
mov rcx, rbx
call fcn.140003850
test eax, eax
jne 0x140003960
xor eax, eax
add rsp, 0x40
pop rbx
ret
mov rcx, rbx
call fcn.1400038c0
test rax, rax
je 0x140003955
lea rdx, [rax + 0x10]
lea rax, [rsp + 0x38]
mov rcx, qword [rbx]
mov r9d, 8
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x58]
mov qword [rsp + 0x38], 0
call fcn.14000410f
not eax
shr eax, 0x1f
add rsp, 0x40
pop rbx
ret

Function at 0x140004010
Capabilities:
Execute syscall

Disassembly:
pop rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov rcx, r10
call fcn.140003fb0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x140004474
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rax, qword [0x14000d9d8]
xor ebx, ebx
add rax, 0x18
mov r12, rcx
mov ecx, dword [0x14000d9d4]
mov rsi, rdx
mov rdi, r8
cmp ebx, ecx
jge 0x1400044c2
mov rdx, qword [rax]
cmp r12, rdx
jb 0x1400044ba
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x1400045a9
inc ebx
add rax, 0x28
jmp 0x14000449a
mov rcx, r12
call fcn.140004ca1
mov rbp, rax
test rax, rax
jne 0x1400044e1
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.140004410
movsxd rbx, ebx
mov rax, qword [0x14000d9d8]
xor edx, edx
imul rbx, rbx, 0x28
add rax, rbx
mov dword [rax], edx
mov qword [rax + 0x20], rbp
call fcn.140004d4f
mov edx, dword [rbp + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x14000d9d8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x140004543
mov rax, qword [0x14000d9d8]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.140004410
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x1400045a3
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x1400045a3
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x14000d9d8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1400045a3
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140004410
inc dword [0x14000d9d4]
mov ecx, edi
mov rdi, r12
rep movsb byte [rdi], byte [rsi]
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret