joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400020b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov eax, dword [rcx + 0x48]
lea rbx, [rcx + 0x28]
mov rsi, qword [rcx]
lea r11, [rcx + 0x28]
add rbx, rax
mov rdi, rcx
movabs rbp, 0x9e3779b185ebca87
movabs r15, 0x27d4eb2f165667c5
movabs r14, 0xc2b2ae3d27d4eb4f
movabs r12, 0x7a1435883d4d519d
cmp rsi, 0x20
jb 0x1400021ab
mov rcx, qword [rcx + 8]
mov r8, qword [rdi + 0x18]
mov r9, qword [rdi + 0x20]
mov rax, r8
mov rdx, qword [rdi + 0x10]
mov r10, r9
rol r10, 0x12
rol rax, 0xc
add r10, rax
mov rax, rdx
rol rax, 7
add r10, rax
mov rax, rcx
rol rax, 1
add r10, rax
movabs rax, 0x85ebca77c2b2ae63
imul rcx, r14
imul rdx, r14
imul r8, r14
imul r9, r14
rol rcx, 0x1f
imul rcx, rbp
rol rdx, 0x1f
xor r10, rcx
rol r8, 0x1f
imul r10, rbp
imul rdx, rbp
imul r8, rbp
sub r10, r12
rol r9, 0x1f
xor r10, rdx
imul r10, rbp
imul r9, rbp
sub r10, r12
xor r10, r8
imul r10, rbp
sub r10, r12
xor r10, r9
imul r10, rbp
add rax, r10
add rax, rsi
jmp 0x1400021b3
lea rax, [rsi + r15]
add rax, qword [rcx + 0x18]
lea rdx, [rdi + 0x30]
cmp rdx, rbx
ja 0x1400021ea
nop dword [rax]
mov rcx, qword [r11]
add rdx, 8
imul rcx, r14
add r11, 8
rol rcx, 0x1f
imul rcx, rbp
xor rax, rcx
rol rax, 0x1b
imul rax, rbp
sub rax, r12
cmp rdx, rbx
jbe 0x1400021c0
lea rdx, [r11 + 4]
movabs r8, 0x165667b19e3779f9
cmp rdx, rbx
ja 0x140002215
mov ecx, dword [r11]
mov r11, rdx
imul rcx, rbp
xor rax, rcx
rol rax, 0x17
imul rax, r14
add rax, r8
cmp r11, rbx
jae 0x14000223b
nop word [rax + rax]
movzx ecx, byte [r11]
inc r11
imul rcx, r15
xor rax, rcx
rol rax, 0xb
imul rax, rbp
cmp r11, rbx
jb 0x140002220
mov rbx, qword [rsp + 0x20]
mov rcx, rax
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
shr rcx, 0x21
xor rcx, rax
imul rcx, r14
mov rdx, rcx
shr rdx, 0x1d
xor rdx, rcx
imul rdx, r8
mov rax, rdx
shr rax, 0x20
xor rax, rdx
pop r15
pop r14
pop r12
ret

Function at 0x14000a340
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x14002c008]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rdi, r8
lea rax, [rsp + 0x30]
mov rbx, rcx
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor ecx, ecx
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x14000a385
xor al, al
jmp 0x14000a3d2
cmp word [rbx], 0
je 0x14000a39d
nop dword [rax + rax]
add rbx, 2
dec rdi
cmp word [rbx], 0
jne 0x14000a390
cmp word [rsp + 0x30], 0
je 0x14000a3cb
lea rcx, [rsp + 0x30]
sub rcx, rbx
nop dword [rax]
cmp rdi, 1
jb 0x14000a3f3
movzx eax, word [rcx + rbx]
dec rdi
mov word [rbx], ax
add rbx, 2
cmp word [rcx + rbx], 0
jne 0x14000a3b0
xor eax, eax
mov word [rbx], ax
mov al, 1
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14000b560
mov rbx, qword [rsp + 0x270]
add rsp, 0x250
pop rdi
ret
call fcn.14000f670
int3
Function at 0x14000abd0
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x2030
call fcn.14001ee50
sub rsp, rax
mov rax, qword [0x14002c008]
xor rax, rsp
mov qword [rsp + 0x2020], rax
mov r11d, dword [0x14002dd70]
lea rsi, [0x140038da0]
mov rdi, rcx
test r11d, r11d
jne 0x14000ac49
mov r8d, 0x1000
lea rdx, str._HOME_
lea rcx, [rsp + 0x20]
call fcn.14000a400
test al, al
je 0x14000ad2f
lea rcx, [rsp + 0x20]
call fcn.140013bc8
movsxd r11, dword [0x14002dd70]
mov qword [rsi + r11*8], rax
inc r11d
mov dword [0x14002dd70], r11d
xor r9d, r9d
test r11d, r11d
jle 0x14000ac84
mov r10, rsi
mov r8, qword [r10]
mov rax, rdi
sub r8, rdi
nop dword [rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x14000ac74
add rax, 2
test ecx, ecx
jne 0x14000ac60
test edx, edx
je 0x14000aca7
inc r9d
add r10, 8
cmp r9d, r11d
jl 0x14000ac54
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rdi + rax*2], 0
jne 0x14000ac90
cmp rax, 2
jne 0x14000acab
cmp word [rdi + 2], 0x3a
jne 0x14000acab
mov al, 1
jmp 0x14000ad0e
xor edx, edx
mov qword [rsp + 0x2048], rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne bl
test eax, eax
jne 0x14000acd8
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14000acd8
mov bl, 1
jmp 0x14000acdc
test bl, bl
je 0x14000ad03
cmp dword [0x14002dd70], 0x400
jge 0x14000ad03
mov rcx, rdi
call fcn.140013bc8
movsxd rdx, dword [0x14002dd70]
mov qword [rsi + rdx*8], rax
inc edx
mov dword [0x14002dd70], edx
movzx eax, bl
mov rbx, qword [rsp + 0x2048]
mov rcx, qword [rsp + 0x2020]
xor rcx, rsp
call fcn.14000b560
mov rsi, qword [rsp + 0x2050]
add rsp, 0x2030
pop rdi
ret
lea rcx, str._HOME_
call fcn.14000aa20
int3
Function at 0x14000ae50
Capabilities:
Check if file exists
Delete file
Get file attributes
Terminate process

Disassembly:
sub rsp, 0x68
mov rcx, qword [0x14002dd78]
test rcx, rcx
je 0x14000ae8b
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14000ae7e
mov rcx, qword [0x14002dd78]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [0x14002dd78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x14003cdd0], 0
je 0x14000af7e
mov qword [rsp + 0x70], rbx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x78], rbp
lea rbp, [0x140028850]
mov qword [rsp + 0x80], rsi
lea rsi, [0x1400365a0]
mov qword [rsp + 0x88], rdi
xor edi, edi
mov qword [rsp + 0x60], r14
mov r14d, 0x414
mov word [rsp + 0x40], r14w
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rbp
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ebx, edi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000af5f
test al, 0x10
je 0x14000af5f
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbp
mov word [rsp + 0x40], r14w
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rbp
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
inc ebx
cmp ebx, 0x14
jl 0x14000af05
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov r14, qword [rsp + 0x60]
add rsp, 0x68
ret
Function at 0x14000be68
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000beb2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000beb2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000beb2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000beb2
cmp dword [rcx + 0x84], 0xe
jbe 0x14000beb2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000beb4
xor al, al
add rsp, 0x28
ret

Function at 0x14000f664
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14000f4c3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000f4c3
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000f4c3
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000f4c3
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000f4c3
cmp dword [rcx + 0x84], 0xe
jbe 0x14000f4c3
cmp dword [rcx + 0xf8], 0
je 0x14000f4c3
mov ecx, ebx
call fcn.14000f580
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14000f350
nop
cmp dword [rbp + 0x20], 0
je 0x14000f511
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000f51c
int3
xor r8d, r8d
xor edx, edx
jmp 0x14000f454
Function at 0x140018944
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1400189cb
mov rsi, rbx
cmp word [rax], bp
je 0x14001898a
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140018974
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140018970
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140016184
mov rdi, rax
test rax, rax
je 0x1400189b8
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14000d430
mov rbp, rdi
xor ecx, ecx
call fcn.1400152a4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14001ed60
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14001ed88
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14001ed88
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1400017b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
lea eax, [r9 - 0x880]
mov edx, r9d
lea r10d, [r8 - 0x3633]
xor edx, 0xcf0
lea r11d, [r9 - 0x3ac3]
mov edi, ecx
cmp edx, eax
jl 0x1400018b9
mov r9d, dword [rbx + 0x84]
xor edx, edx
mov qword [rsp + 0x30], rbp
mov ebp, dword [rbx + 0x10]
mov qword [rsp + 0x38], rsi
mov esi, dword [rbx + 0x68]
nop
mov rcx, qword [rbx + 0xe8]
mov eax, 1
sub eax, dword [rbx + 0xfc]
sub eax, r9d
add dword [rbx + 0x168], eax
lea eax, [rsi - 0x15349]
xor eax, ebp
mov dword [rbx + 0x10], eax
mov eax, dword [rbx + 0xa0]
xor dword [rcx + rdx], eax
add rdx, 4
mov ecx, dword [rbx + 4]
mov r9d, dword [rbx + 0x84]
mov esi, dword [rbx + 0x68]
mov ebp, dword [rbx + 0x10]
lea eax, [r9 - 0x15349]
add eax, esi
imul ecx, eax
mov eax, dword [rbx + 0x104]
add dword [rbx + 0xa0], eax
mov eax, dword [rbx + 0x100]
xor eax, ebp
xor eax, 0xad6172
mov dword [rbx + 4], ecx
add dword [rbx + 0x58], eax
mov ecx, dword [rbx + 0x90]
mov eax, dword [rbx + 0x48]
add ecx, 0xffe85b9a
add ecx, dword [rbx + 0x154]
xor eax, 0x13334b
sub dword [rbx + 0xd8], eax
add dword [rbx + 0xb0], ecx
cmp rdx, 0x1a3bc
jl 0x140001800
mov rax, qword [rbx + 0xe8]
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov qword [rbx + 0xa8], rax
xor r10d, 0x3ac3
cmp r11d, r10d
jge 0x1400018e4
call qword [rbx + 0xa8]
xor edi, 0x1c0
mov dword [rbx + 0x134], eax
mov eax, edi
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
or r8d, 0x35f6
sub r8d, 0x397b
cmp dword [rbx + 0x34], r8d
jb 0x140001921
mov eax, dword [rbx + 0xf8]
xor eax, dword [rbx + 0x6c]
cmp dword [rbx + 8], eax
jbe 0x140001921
mov eax, dword [rbx + 0x94]
mov ecx, dword [rbx + 0xf4]
and ecx, dword [rbx + 0xd8]
imul eax, ecx
mov dword [rbx + 0x94], eax
mov rbx, qword [rsp + 0x40]
xor edi, 0x1c0
mov eax, edi
add rsp, 0x20
pop rdi
ret
Function at 0x1400020c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x30
mov r11d, dword [rsp + 0x60]
mov rbx, r8
mov r8d, r11d
mov eax, ecx
xor r8d, 0x3107
mov r10d, r9d
xor eax, 0x220
xor r10d, 0x963
lea edi, [r8 + 0x3243]
cmp eax, edi
je 0x1400021eb
lea ecx, [rdx - 0x222]
cmp eax, ecx
je 0x140002125
mov ecx, dword [rbx + 0xb4]
mov eax, edi
xor ecx, 0xb8532
sub dword [rbx + 0x110], ecx
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
xor r9d, 0x87c
lea eax, [r11 + 0x874]
and r9d, r8d
xor r9d, eax
mov eax, dword [rbx + 0x118]
cmp eax, r9d
jge 0x1400021eb
sub r9d, eax
mov qword [rsp + 0x40], rbp
lea ebp, [rdx + 0x1b7]
mov qword [rsp + 0x48], rsi
dec r9d
mov qword [rsp + 0x50], r14
mov eax, 0xaaaaaaab
imul r14d, r10d, 0x3ac3
mul r9d
and ebp, 0x3ac3
shr edx, 1
lea esi, [rdx + 1]
nop dword [rax]
mov r8d, dword [rbx + 0x20]
mov edx, dword [rbx + 0x84]
xor r8d, 0x3765
sub r8d, dword [rbx + 0x150]
mov eax, dword [rbx + 4]
or edx, dword [rbx + 0x140]
mov r9d, dword [rbx + 0x138]
imul edx, dword [rbx + 0x8c]
sub r9d, 0x397b
mov qword [rsp + 0x28], r8
lea ecx, [rax + rax]
mov dword [rsp + 0x20], r9d
xor rcx, 0x32e6
mov r9d, r14d
mov r8d, ebp
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
sub rsi, 1
jne 0x140002180
mov r14, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
mov eax, edi
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x140002d60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push r13
push r14
push r15
sub rsp, 0x50
mov eax, dword [rsp + 0xb0]
lea esi, [rcx - 0x7b8]
mov ecx, dword [rsp + 0xa8]
lea r15d, [r8 - 0x43c]
mov ebp, dword [rsp + 0xa0]
lea r14d, [r8 - 0x3543]
xor ecx, 0xf86
add ebp, 0x321
lea r10d, [rax - 0x38bb]
xor r8d, 0x3543
lea r13d, [rax - 0x57]
mov dword [rsp + 0xb0], r10d
lea eax, [r15 - 0x287]
mov rbx, r9
cmp r8d, eax
je 0x140002e11
mov eax, esi
xor eax, 0xbb0
cmp r14d, eax
jg 0x140002f44
mov eax, dword [r9 + 0x68]
sub eax, dword [r9 + 0x128]
add eax, 0x1028b4
xor dword [r9 + 0xd8], eax
mov eax, dword [r9 + 4]
xor eax, 0x105a01
mov dword [r9 + 0x130], eax
add esi, 0x45a
jmp 0x140002f44
mov eax, dword [r9 + 0xc]
or eax, 0x3ac3
cmp esi, eax
je 0x140002f44
sub ecx, dword [r9]
cmp dword [r9 + 0x118], ecx
jbe 0x140002f44
lea eax, [rsi - 0x70f6]
cmp esi, eax
jg 0x140002f44
sub eax, esi
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x88], r12
lea r12d, [rax + 1]
nop word [rax + rax]
mov edx, dword [rbx + 0x58]
mov ecx, r14d
and edx, dword [rbx + 0x84]
mov r9d, dword [rbx + 4]
and edx, r10d
mov eax, dword [rbx + 0xc8]
or eax, dword [rbx + 0xf0]
mov r8d, dword [rbx + 0x130]
xor ecx, dword [rbx + 0x128]
add r8d, r9d
and r9d, dword [rbx + 0x44]
xor ecx, 0x3107
imul eax, eax, 0x3864
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], edx
mov rdx, rbx
call fcn.140003130
mov r8d, dword [rbx + 0x5c]
mov r9d, eax
mov eax, dword [rbx + 0x40]
mov edx, dword [rbx + 0x7c]
xor eax, r9d
and r8d, dword [rbx + 0x14]
add edx, 0x3543
mov r10d, dword [rbx + 0xb4]
xor edx, ebp
mov r11d, dword [rbx + 0x2c]
xor r10d, 0x35f6
mov edi, dword [rbx + 0x90]
and r11d, 0x3107
mov ecx, dword [rbx + 0x68]
or ebp, esi
imul r8d, dword [rbx + 0x130]
add edi, r14d
mov dword [rsp + 0x48], eax
sub ecx, r13d
mov qword [rsp + 0x40], rbx
add r9d, r15d
mov dword [rsp + 0x38], r10d
mov dword [rsp + 0x30], r11d
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], edi
call fcn.14000f950
mov r10d, dword [rsp + 0xb0]
mov ebp, eax
sub r12, 1
jne 0x140002e60
mov r12, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x80]
lea eax, [rsi + 0x362]
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop rsi
pop rbp
ret
Function at 0x140003130
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov edi, dword [rsp + 0x68]
lea eax, [r8 - 0x6a0]
xor edi, 0x1bc3
lea ebp, [rcx + 0x132]
xor eax, 0x7c3
lea r14d, [rcx - 0x3633]
lea r15d, [r9 + 0x8e5]
mov rsi, rdx
cmp ebp, eax
jge 0x1400031e8
mov eax, dword [rdx + 0x2c]
imul eax, edi
mov qword [rsp + 0x40], rbx
mov ebx, dword [rdx + 0x68]
sub eax, r14d
cmp ebx, eax
je 0x1400031c9
nop dword [rax]
cmp edi, 0xfffffece
jle 0x1400031ba
mov edx, dword [rsi + 0x154]
mov ecx, dword [rsi + 0xf0]
sub edx, 0x3ac3
mov eax, r15d
imul ecx, r15d
and rdx, rax
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov eax, dword [rsi + 0x2c]
inc ebx
imul eax, edi
sub eax, r14d
cmp ebx, eax
jne 0x140003190
mov rbx, qword [rsp + 0x40]
lea eax, [rbp - 0x1e5]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
lea eax, [rbp - 0x1e5]
jmp 0x1400031d4
Function at 0x14000fb70
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov r10d, dword [rsp + 0xb0]
lea r14d, [rdx - 0x52c]
mov eax, dword [rsp + 0xa8]
lea r13d, [rcx + 0x7b3]
mov rbx, r8
add r9d, 0xfffffc7a
mov r8d, dword [rsp + 0xc0]
mov esi, r8d
xor esi, 0xbc4
lea r12d, [r10 - 0x397b]
lea r11d, [rax - 0x300]
lea r15d, [rax + 0xb3]
lea ebp, [r8 - 0x3ac3]
lea edi, [r10 - 0x216]
cmp r9d, edx
je 0x14000fd1a
add r9d, 0x6e8
xor r10d, r10d
nop word [rax + rax]
mov rax, qword [rbx + 0xc0]
mov r8d, dword [r10 + rax]
mov eax, 0x565a1
sub eax, dword [rbx + 0x168]
add r10, 4
add dword [rbx + 0x10], eax
movsxd rcx, dword [rbx + 0x88]
imul r8d, dword [rbx + 0x74]
mov rax, qword [rbx + 0xe0]
mov edx, r8d
shr edx, 0x10
mov byte [rcx + rax], dl
mov edx, r8d
inc dword [rbx + 0x88]
mov eax, dword [rbx + 0x168]
xor eax, 0x565a1
shr edx, 8
or dword [rbx + 0xfc], eax
mov eax, dword [rbx + 0x10]
sub eax, 0xad614e
add dword [rbx + 0x118], eax
mov eax, dword [rbx + 0x34]
sub dword [rbx + 0x90], eax
movsxd rcx, dword [rbx + 0x88]
mov rax, qword [rbx + 0xe0]
mov byte [rcx + rax], dl
inc dword [rbx + 0x88]
mov eax, dword [rbx + 0xfc]
or dword [rbx + 0x168], eax
mov eax, dword [rbx + 0x5c]
sub eax, 0x10
xor dword [rbx + 0x84], eax
mov eax, 0x5d336
sub eax, dword [rbx + 0xb0]
sub eax, dword [rbx + 0x58]
add dword [rbx + 0x154], eax
movsxd rcx, dword [rbx + 0x88]
mov rax, qword [rbx + 0xe0]
mov byte [rcx + rax], r8b
inc dword [rbx + 0x88]
mov ecx, dword [rbx + 0x154]
mov eax, dword [rbx + 0x128]
xor ecx, 0xcbb78
imul eax, ecx
mov dword [rbx + 0x128], eax
mov eax, dword [rbx + 0x58]
dec eax
xor dword [rbx + 0x5c], eax
mov eax, dword [rbx + 0x10]
sub eax, dword [rbx + 0x144]
sub eax, 0xad614e
add dword [rbx + 0xd8], eax
cmp r10, 0xda50
jl 0x14000fc00
mov eax, dword [rbx + 0x154]
sub eax, 0x49313b7b
mov dword [rbx + 0x74], eax
lea eax, [r13 - 0xb3]
cmp r11d, eax
je 0x14000fd85
xor r9d, 0x27c
lea eax, [r11 + 0x621]
mov r10d, edi
lea ecx, [rdi + 0x362]
xor ebp, 0x397b
xor r10d, 0x46e
mov dword [rsp + 0x40], ebp
xor r11d, 0xaf8
mov dword [rsp + 0x38], r10d
xor esi, 0x9e4
mov dword [rsp + 0x30], r9d
xor r12d, 0x2e80
mov dword [rsp + 0x28], eax
mov r9d, r11d
mov r8d, esi
mov qword [rsp + 0x20], rbx
mov edx, r12d
call fcn.140010ac0
jmp 0x14000fdec
mov eax, dword [rbx + 0x40]
mov ebp, r14d
and eax, dword [rbx + 0x28]
cmp r14d, eax
ja 0x14000fdec
xor r15d, r12d
nop word [rax + rax]
mov ecx, dword [rbx + 8]
mov r8d, edi
mov edx, dword [rbx + 0xd0]
or ecx, esi
mov eax, dword [rbx + 0x84]
mov r9d, r15d
and r9d, dword [rbx + 0x44]
or r8d, r14d
imul ecx, esi
xor r8d, 0x3765
and rdx, rax
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov ecx, dword [rbx + 0x40]
inc ebp
mov eax, dword [rbx + 0x13c]
and eax, 0x3633
xor eax, ecx
and ecx, dword [rbx + 0x28]
sub edi, eax
cmp ebp, ecx
jbe 0x14000fda0
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
lea eax, [r13 + 0x231]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400104e0
Capabilities:
Encode data using xor

Disassembly:
mov dword [rsp + 0x18], r8d
push rsi
push r12
push r13
push r14
sub rsp, 0x28
mov r13d, ecx
lea r12d, [r9 - 0x479]
xor r13d, 0x3ac3
lea eax, [rcx - 0x7b8]
lea r8d, [rcx - 0x3ac3]
mov dword [rsp + 0x60], r8d
lea r14d, [r9 + 0x33b]
lea esi, [rdx - 0x3633]
cmp r12d, eax
jge 0x14001054b
mov rcx, qword [rsp + 0x78]
mov eax, dword [rcx + 0x144]
add eax, 0xc2e2
mov dword [rcx + 0x64], eax
mov eax, dword [rcx + 0x84]
add eax, 0x47779dcb
mov dword [rcx + 0x70], eax
jmp 0x140010621
mov qword [rsp + 0x68], rdi
mov rdi, qword [rsp + 0x78]
mov qword [rsp + 0x20], r15
mov r15d, r12d
mov eax, dword [rdi + 0x130]
or eax, esi
add eax, 0x33df
cmp r12d, eax
jbe 0x140010617
mov eax, dword [rsp + 0x70]
xor eax, 0x3765
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x70], eax
mov qword [rsp + 0x58], rbp
nop word [rax + rax]
cmp r12d, eax
jge 0x1400105f1
mov eax, dword [rdi + 0x150]
mov ebx, dword [rdi + 0xd8]
imul eax, r14d
imul eax, eax, 0x397b
cmp ebx, eax
jbe 0x1400105ed
mov eax, r13d
imul eax, r13d
imul ebp, eax, 0x3864
nop dword [rax]
mov ecx, esi
xor ecx, dword [rdi + 0x11c]
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov eax, dword [rdi + 0x150]
add ebx, 2
imul eax, r14d
imul eax, eax, 0x397b
cmp ebx, eax
ja 0x1400105c0
mov eax, dword [rsp + 0x70]
mov ecx, dword [rdi + 0x130]
add r15d, 4
or ecx, esi
add ecx, 0x33df
cmp r15d, ecx
ja 0x140010590
mov r8d, dword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x68]
mov r15, qword [rsp + 0x20]
xor r8d, 0x38e3
mov eax, r8d
add rsp, 0x28
pop r14
pop r13
pop r12
pop rsi
ret
Function at 0x140011710
Capabilities:
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov eax, dword [rsp + 0xa8]
lea r15d, [r8 - 0x33d]
mov edi, dword [rsp + 0x90]
mov r14d, ecx
mov esi, eax
mov ebp, edi
xor esi, 0x344
xor ebp, 0x648
lea ecx, [rax + 0x13c]
xor edi, 0x20c
lea eax, [r14 + 0x2b0]
mov rbx, r9
lea r9d, [r8 + 0x3fb]
cmp esi, eax
jge 0x1400117fa
lea r10d, [r9 + 0x148]
mov edx, edi
xor r10d, 0x2a7
lea eax, [r15 - 0x13c]
mov dword [rsp + 0x48], r10d
lea r11d, [rbp - 0x25d]
mov dword [rsp + 0x40], eax
lea r9d, [rcx + 0x678]
mov dword [rsp + 0x38], r15d
lea r8d, [rsi - 0x13c]
mov dword [rsp + 0x30], r11d
lea ecx, [rsi + 0x880]
xor r14d, 0x5ec
xor edx, 0x3e1
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rbx
call fcn.1400136b0
add dword [rbx + 0x18], 0x4f81b14
mov eax, dword [rbx + 0x168]
add eax, dword [rbx + 0x20]
xor eax, 0x1ac45aa7
add dword [rbx + 0xb0], 0x5d335
mov dword [rbx + 0x1c], eax
jmp 0x140011854
mov eax, dword [rbx + 0x130]
add eax, r9d
or eax, 0x3633
cmp esi, eax
jae 0x140011854
mov edx, dword [rbx + 0xd4]
and ecx, 0x8b8
sub edx, r9d
or rcx, 0x3107
xor edx, 0x35f6
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, dword [rbx + 0xb4]
sub eax, dword [rbx + 0x128]
add eax, ebp
imul edi, eax
mov eax, dword [rbx + 0x100]
add eax, dword [rbx + 0x8c]
and eax, r15d
sub dword [rbx + 0x98], eax
mov rbx, qword [rsp + 0x70]
lea eax, [rdi + 0x9c0]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop r14
pop rdi
ret