joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1406f44e8
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xa0
mov rbx, qword [rcx]
xor r14d, r14d
mov esi, r14d
mov rdi, rdx
mov r12, rcx
call fcn.1406f4460
mov rcx, rbx
call fcn.1406f4724
mov rcx, rdi
mov rbx, rax
call fcn.1406f4724
xor edx, edx
mov qword [rbp - 0x41], rax
lea r8d, [r14 + 0x58]
mov r13, rax
lea rcx, [rbp - 0x39]
call fcn.1406eb8ec
lea r8, [rbp - 0x39]
mov rcx, rbx
lea edx, [r14 + 5]
call fcn.1406f4258
mov r15d, eax
cmp eax, 5
jb 0x1406f46f1
mov r8, qword [rbp - 0x31]
mov rcx, rbx
mov rdx, qword [rbp - 0x39]
call fcn.1406f477c
mov rsi, rax
test rax, rax
je 0x1406f46f1
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r9d, [r14 + 0x40]
mov dword [rbp + 0x7f], r14d
mov rdi, rax
mov dword [rbp + 0x77], r14d
lea rax, [rbp + 0x7f]
mov rcx, rdi
mov r8d, r15d
mov qword [rsp + 0x20], rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x1406f46d2
lea rax, [rbp + 0x77]
mov rdx, rsi
lea r9d, [r14 + 0x40]
mov qword [rsp + 0x20], rax
lea r8d, [r14 + 0x78]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x1406f46a7
lea r12, [rsi + 0x38]
mov rdx, rbx
sub rdx, r12
mov r8, rsi
sub r8, r12
mov rcx, r12
mov r9d, r15d
mov al, byte [rdx + rcx]
mov byte [rcx], al
mov byte [r8 + rcx + 0x58], al
inc rcx
sub r9, 1
jne 0x1406f45ee
lea rdx, [r15 + rbx]
lea rcx, [r15 + r12]
call fcn.1406f441c
lea r8, [rbp - 0x39]
mov rdx, rbx
mov rcx, r12
call fcn.1406f44ac
mov rcx, rbx
mov rax, r13
sub rcx, r13
sub rax, rbx
cmp r13, rbx
cmovb rax, rcx
cmp rax, 0x7fff0000
jbe 0x1406f465b
mov rdx, qword [rbp - 0x41]
lea r13, [rsi + 0x18]
mov rcx, r13
call fcn.1406f441c
sub rax, rsi
mov rdx, r13
mov rcx, rdi
lea r8, [rax - 0x18]
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov rdx, r13
mov rcx, rbx
call fcn.1406f441c
mov rax, qword [rbp - 0x41]
mov r8, r15
mov rdx, r12
mov qword [rsi + 0x10], rax
mov rcx, rdi
mov dword [rsi + 8], r15d
mov qword [rsi], rbx
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov r9d, dword [rbp + 0x77]
lea rax, [rbp + 0x77]
mov r8d, 0x78
mov qword [rsp + 0x20], rax
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov r12, qword [rbp + 0x67]
mov r8, r15
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov r9d, dword [rbp + 0x7f]
lea rax, [rbp + 0x7f]
mov r8, r15
mov qword [rsp + 0x20], rax
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
cmp qword [rsi], r14
je 0x1406f46e1
lea rax, [rsi + 0x38]
mov qword [r12], rax
jmp 0x1406f46f1
mov edx, 1
mov rcx, rsi
call fcn.1406f48cc
mov rsi, r14
lea rcx, [0x1406fd258]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0xe8]
test rsi, rsi
setne r14b
mov eax, r14d
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1406f477c
Capabilities:
Get system information on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r14
sub rsp, 0x80
xor edi, edi
cmp dword [0x1406fd254], 0x40
jae 0x1406f48aa
xorps xmm0, xmm0
lea rbx, [rcx + rdx]
add rcx, r8
mov rbp, 0xfffffffffff80000
cmp rcx, 0xffffffff80000000
movups xmmword [rsp + 0x20], xmm0
lea rax, [rcx + 0x7ff80000]
lea rcx, [r11 - 0x68]
cmovb rbp, rax
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, 0x80000000
lea rsi, [rbx - 0x7fff0000]
cmp rbx, rax
lea r14d, [rdi + 1]
cmovb rsi, r14
cmp rsi, rbp
jae 0x1406f48aa
mov r8d, 0x30
lea rdx, [rsp + 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1406f487a
cmp dword [rsp + 0x70], 0x10000
jne 0x1406f4868
mov rax, qword [rsp + 0x68]
cmp rax, 0x78
jb 0x1406f486d
mov edx, dword [rsp + 0x48]
mov ecx, edx
cmp rax, rdx
jb 0x1406f486d
lea eax, [rdx - 1]
mov r8d, 0x3000
xor edx, edx
add rax, rsi
div rcx
mov edx, 0x78
imul rcx, rax
lea r9d, [rdx - 0x58]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
jne 0x1406f487f
mov rax, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x50]
add rsi, rax
cmp rsi, rbp
jb 0x1406f4803
test rdi, rdi
je 0x1406f48aa
lea rdx, [0x1406fd280]
xor eax, eax
mov rcx, rdx
cmp qword [rcx], 0
je 0x1406f489f
add eax, r14d
add rcx, 8
cmp eax, 0x40
jb 0x1406f488b
jmp 0x1406f48aa
add dword [0x1406fd254], r14d
mov qword [rdx + rax*8], rdi
lea r11, [rsp + 0x80]
mov rax, rdi
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x1406fb9e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov eax, dword [rcx + 0x48]
lea rbx, [rcx + 0x28]
mov rsi, qword [rcx]
lea r11, [rcx + 0x28]
add rbx, rax
mov rdi, rcx
movabs rbp, 0x9e3779b185ebca87
movabs r15, 0x27d4eb2f165667c5
movabs r14, 0xc2b2ae3d27d4eb4f
movabs r12, 0x7a1435883d4d519d
cmp rsi, 0x20
jb 0x1406fbadb
mov rcx, qword [rcx + 8]
mov r8, qword [rdi + 0x18]
mov r9, qword [rdi + 0x20]
mov rax, r8
mov rdx, qword [rdi + 0x10]
mov r10, r9
rol r10, 0x12
rol rax, 0xc
add r10, rax
mov rax, rdx
rol rax, 7
add r10, rax
mov rax, rcx
rol rax, 1
add r10, rax
movabs rax, 0x85ebca77c2b2ae63
imul rcx, r14
imul rdx, r14
imul r8, r14
imul r9, r14
rol rcx, 0x1f
imul rcx, rbp
rol rdx, 0x1f
xor r10, rcx
rol r8, 0x1f
imul r10, rbp
imul rdx, rbp
imul r8, rbp
sub r10, r12
rol r9, 0x1f
xor r10, rdx
imul r10, rbp
imul r9, rbp
sub r10, r12
xor r10, r8
imul r10, rbp
sub r10, r12
xor r10, r9
imul r10, rbp
add rax, r10
add rax, rsi
jmp 0x1406fbae3
lea rax, [rsi + r15]
add rax, qword [rcx + 0x18]
lea rdx, [rdi + 0x30]
cmp rdx, rbx
ja 0x1406fbb1a
nop dword [rax]
mov rcx, qword [r11]
add rdx, 8
imul rcx, r14
add r11, 8
rol rcx, 0x1f
imul rcx, rbp
xor rax, rcx
rol rax, 0x1b
imul rax, rbp
sub rax, r12
cmp rdx, rbx
jbe 0x1406fbaf0
lea rdx, [r11 + 4]
movabs r8, 0x165667b19e3779f9
cmp rdx, rbx
ja 0x1406fbb45
mov ecx, dword [r11]
mov r11, rdx
imul rcx, rbp
xor rax, rcx
rol rax, 0x17
imul rax, r14
add rax, r8
cmp r11, rbx
jae 0x1406fbb6b
nop word [rax + rax]
movzx ecx, byte [r11]
inc r11
imul rcx, r15
xor rax, rcx
rol rax, 0xb
imul rax, rbp
cmp r11, rbx
jb 0x1406fbb50
mov rbx, qword [rsp + 0x20]
mov rcx, rax
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
shr rcx, 0x21
xor rcx, rax
imul rcx, r14
mov rdx, rcx
shr rdx, 0x1d
xor rdx, rcx
imul rdx, r8
mov rax, rdx
shr rax, 0x20
xor rax, rdx
pop r15
pop r14
pop r12
ret
Function at 0x140002d00
Capabilities:
Create thread

Disassembly:
sub rsp, 0x68
mov rax, qword [0x14004f050]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov ecx, 1
call fcn.140010f68
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x14000e6e0]
xor edx, edx
xor ecx, ecx
call fcn.14001b054
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140002d8b
cmp dword [rsp + 0x38], 0
je 0x140002d9e
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.1400106dc
test eax, eax
jne 0x140002d83
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140010f40
add rsp, 0x68
ret
mov ecx, eax
call fcn.14000f64c
nop
mov dword [rsp + 0x38], 0
mov ecx, 6
call fcn.14000f688
nop
mov ecx, 1
call fcn.14000f688
int3
Function at 0x140004c00
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov r14, r8
mov rbp, rdx
mov rdi, rcx
mov rbx, r8
je 0x140004c98
test r8, r8
jle 0x140004c90
nop word [rax + rax]
mov rcx, rdi
call fcn.1400070b0
test rax, rax
jle 0x140004c6e
cmp rbx, rax
mov rsi, rbx
mov rdx, rbp
cmovge rsi, rax
mov rax, qword [rdi + 0x40]
mov r8, rsi
mov rcx, qword [rax]
call fcn.140012e30
mov rax, qword [rdi + 0x58]
sub rbx, rsi
sub dword [rax], esi
mov rcx, qword [rdi + 0x40]
movsxd rax, esi
add qword [rcx], rax
jmp 0x140004c88
mov rax, qword [rdi]
mov rcx, rdi
movzx edx, byte [rbp]
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140004c90
dec rbx
mov esi, 1
add rbp, rsi
test rbx, rbx
jg 0x140004c30
sub r14, rbx
mov rax, r14
jmp 0x140004d16
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], r15
mov r9, qword [rax]
test r9, r9
je 0x140004cb1
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140004cb3
xor ecx, ecx
movsxd rsi, ecx
test r14, r14
jle 0x140004d0b
test ecx, ecx
jle 0x140004cec
cmp r14, rsi
mov rcx, r9
cmovl rsi, r14
mov r8, rsi
call fcn.140012e30
mov rax, qword [rdi + 0x58]
add rbp, rsi
sub r14, rsi
sub dword [rax], esi
mov rcx, qword [rdi + 0x40]
movsxd rax, esi
add qword [rcx], rax
test r14, r14
jle 0x140004d0b
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140004d0b
mov r8, r14
mov edx, 1
mov rcx, rbp
call fcn.14001d054
sub r14, rax
mov r15, qword [rsp + 0x40]
sub rbx, r14
mov rax, rbx
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x140004d30
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x140004d52
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x140004dcc
mov rdi, r14
mov rcx, rbx
call fcn.1400070d0
test rax, rax
jle 0x140004da4
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov rax, qword [rbx + 0x38]
mov r8, rbp
mov rdx, qword [rax]
call fcn.140012e30
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x140004dbc
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x140004dc4
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x140004d66
sub r14, rdi
jmp 0x140004eaf
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x140004de3
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140004de5
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140004e17
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.140012e30
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x140004eac
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140004e52
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x140004e8d
nop dword [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.14001dac0
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x140004eac
cmp rbp, rax
ja 0x140004e60
test rbp, rbp
je 0x140004eac
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.14001dac0
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
Function at 0x1400052f0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x14004f050]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14000531d
xor eax, eax
jmp 0x140005463
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140005357
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x140005357
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140005463
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x140005456
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14000539a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x1400053a9
movsx ecx, dil
jmp 0x1400053fd
lea r8, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x51]
lea r8, [rsp + 0x78]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x48]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x50]
call qword [rax + 0x38]
test eax, eax
je 0x140005417
sub eax, 1
je 0x140005417
cmp eax, 2
jne 0x140005456
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call fcn.1400170f8
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14000545b
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140005444
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call fcn.14001d054
cmp rsi, rax
jne 0x140005456
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, edi
jne 0x14000545b
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140010f40
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret

Function at 0x140011c9c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140011ce6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140011ce6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140011ce6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140011ce6
cmp dword [rcx + 0x84], 0xe
jbe 0x140011ce6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140011ce8
xor al, al
add rsp, 0x28
ret

Function at 0x1400229fc
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140022828
Function at 0x140001a3c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001a86
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001a86
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001a86
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001a86
cmp dword [rcx + 0x84], 0xe
jbe 0x140001a86
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001a88
xor al, al
add rsp, 0x28
ret

Function at 0x140003da4
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140003bd0

Function at 0x14000ccd0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14000ccf8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14000ccf8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x14000fa18
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp dword [0x1400a1094], 2
mov edi, r8d
mov esi, edx
mov rbx, rcx
jl 0x14000fa78
movdqa xmm0, xmmword [0x14006f430]
movdqa xmm1, xmmword [0x14006f420]
movdqa xmmword [0x1400858e0], xmm0
movdqa xmm0, xmmword [0x14006f400]
movdqa xmmword [0x1400858f0], xmm1
movdqa xmm1, xmmword [0x14006f410]
movdqa xmmword [0x140085900], xmm0
movdqa xmmword [0x140085910], xmm1
xor edx, edx
mov r8d, 0xf0
call fcn.140059a40
xor edx, edx
mov qword [rbx + 0x110], rdx
mov byte [rbx + 0x118], dl
mov rcx, qword [rbx + 0xf8]
lea rax, [0x14006f3e0]
mov eax, dword [rdx + rax]
mov dword [rdx + rcx], eax
add rdx, 4
cmp rdx, 0x20
jl 0x14000fa94
mov rax, qword [rbx + 0xf8]
bts edi, 0xd
shl edi, 0x10
xor dword [rax], 0x2080020
mov rax, qword [rbx + 0xf8]
xor dword [rax + 8], esi
mov rax, qword [rbx + 0xf8]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
xor dword [rax + 0xc], edi
add rsp, 0x20
pop rdi
ret

Function at 0x1400142ec
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push r14
push r15
sub rsp, 0x20
xor r15d, r15d
mov sil, dl
mov word [rcx + 0x83ea], r15w
mov rbx, rcx
mov byte [rcx + 0x83e1], r15b
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
mov r14b, 1
jmp 0x140014353
test r14b, r14b
jne 0x140014343
mov rdx, qword [rsp + 0x40]
mov rcx, rbx
test sil, sil
je 0x14001433e
call fcn.14001449c
jmp 0x140014343
call fcn.140013ff0
mov rcx, qword [rsp + 0x40]
call fcn.14005c048
mov rcx, rbp
mov r14b, r15b
lea rdx, [rsp + 0x40]
call fcn.1400137fc
mov rbp, rax
test rax, rax
jne 0x140014325
test sil, sil
jne 0x140014372
mov rcx, rbx
call fcn.140014388
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rsi
ret
Function at 0x1400173c0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x850
mov rax, qword [0x140084ee0]
xor rax, rsp
mov qword [rsp + 0x840], rax
mov rax, rdx
mov rdi, r8
mov rbx, rcx
lea rdx, [rsp + 0x40]
mov rcx, rax
mov r8d, 0x400
call fcn.14004798c
mov esi, 1
mov ecx, esi
call fcn.14005fe34
xor r14d, r14d
cmp rbx, rax
jne 0x140017419
cmp byte [0x14008713c], r14b
jne 0x14001743b
mov ebp, 2
mov ecx, ebp
call fcn.14005fe34
cmp rbx, rax
jne 0x140017503
cmp byte [0x14008713d], r14b
je 0x140017503
mov ecx, esi
call fcn.14005fe34
sub rbx, rax
neg rbx
sbb ecx, ecx
add ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbp, rax
call fcn.140006168
mov qword [rsp + 0x28], rdi
lea r9, [rsp + 0x40]
mov esi, 0x1800
mov qword [rsp + 0x20], r14
lea rdi, [0x14008a950]
mov r8d, esi
mov rcx, qword [rax]
mov rdx, rdi
call fcn.14005e884
mov ecx, dword [0x140087138]
cmp ecx, 3
jne 0x1400174a5
or r8, 0xffffffffffffffff
inc r8
cmp word [rdi + r8*2], r14w
jne 0x140017493
add r8d, r8d
mov rdx, rdi
jmp 0x1400174ee
lea rbx, [0x14008d950]
cmp ecx, 4
mov rdx, rbx
mov r8, rsi
mov rcx, rdi
jne 0x1400174c1
call fcn.14004abb4
jmp 0x1400174c6
call fcn.14004ab30
test dword [0x140087138], 0xfffffffd
jne 0x1400174de
mov rdx, rbx
mov rcx, rbx
call qword [sym.imp.USER32.dll_CharToOemA]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rbx + r8], r14b
jne 0x1400174e2
mov rdx, rbx
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], r14
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x14001756c
call fcn.140006168
mov qword [rsp + 0x28], rdi
lea r9, [rsp + 0x40]
lea rdi, [0x14008a950]
mov qword [rsp + 0x20], r14
mov r8d, 0x1800
mov rdx, rdi
mov rcx, qword [rax]
call fcn.14005e884
mov ecx, ebp
call fcn.14005fe34
mov ecx, r14d
cmp rbx, rax
setne cl
add ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
or r8, 0xffffffffffffffff
inc r8
cmp word [rdi + r8*2], r14w
jne 0x14001754c
lea r9, [rsp + 0x34]
mov qword [rsp + 0x20], r14
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.140057920
add rsp, 0x850
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140017898
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
lea rsi, [0x140093150]
mov r10, r8
mov rbx, rdx
mov r11d, ecx
test r8, r8
je 0x1400178e1
test bl, 7
je 0x1400178e1
movzx ecx, byte [rbx]
inc rbx
movzx eax, r11b
xor rcx, rax
mov eax, r11d
shr eax, 8
mov r11d, dword [rsi + rcx*4]
xor r11d, eax
sub r10, 1
jne 0x1400178bc
cmp r10, 8
jb 0x14001798b
mov rdi, r10
shr rdi, 3
imul rax, rdi, 0xfffffffffffffff8
add r10, rax
xor r11d, dword [rbx]
mov r9d, dword [rbx + 4]
add rbx, 8
mov eax, r9d
shr eax, 0x18
movzx edx, al
mov eax, r9d
shr eax, 0x10
movzx ecx, al
mov eax, r9d
shr eax, 8
mov r8d, dword [rsi + rdx*4]
xor r8d, dword [rsi + rcx*4 + 0x400]
movzx ecx, al
mov eax, r11d
shr eax, 0x18
xor r8d, dword [rsi + rcx*4 + 0x800]
movzx ecx, al
mov eax, r11d
shr eax, 0x10
xor r8d, dword [rsi + rcx*4 + 0x1000]
movzx ecx, al
mov eax, r11d
shr eax, 8
xor r8d, dword [rsi + rcx*4 + 0x1400]
movzx ecx, al
movzx eax, r9b
xor r8d, dword [rsi + rcx*4 + 0x1800]
xor r8d, dword [rsi + rax*4 + 0xc00]
movzx eax, r11b
mov r11d, r8d
xor r11d, dword [rsi + rax*4 + 0x1c00]
sub rdi, 1
jne 0x1400178f9
test r10, r10
je 0x1400179b0
movzx ecx, byte [rbx]
inc rbx
movzx eax, r11b
xor rcx, rax
mov eax, r11d
shr eax, 8
mov r11d, dword [rsi + rcx*4]
xor r11d, eax
sub r10, 1
jne 0x140017990
mov rbx, qword [rsp + 8]
mov eax, r11d
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret

Function at 0x1400179c4
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
xor esi, esi
lea r14, [0x14008f150]
mov r10, r8
mov r11, rdx
mov r9, rcx
test r8, r8
je 0x140017a16
test r11b, 7
je 0x140017a16
movzx ecx, byte [r11]
inc r11
movzx eax, r9b
xor rcx, rax
mov rax, r9
shr rax, 8
mov r9, qword [r14 + rcx*8]
xor r9, rax
sub r10, 1
jne 0x1400179ee
mov rax, r10
mov rdi, rsi
shr rax, 3
lea rbx, [rax*8 + 7]
shr rbx, 3
lea rcx, [r11 + rax*8]
cmp r11, rcx
cmova rbx, rsi
test rbx, rbx
je 0x140017ad9
mov r8, qword [r11]
inc rdi
xor r8, r9
add r11, 8
mov rdx, r8
mov rax, r8
shr rax, 0x30
movzx ecx, al
mov rax, r8
shr rax, 0x28
shr rdx, 0x38
mov r9, qword [r14 + rdx*8]
xor r9, qword [r14 + rcx*8 + 0x800]
movzx ecx, al
mov rax, r8
shr rax, 0x20
xor r9, qword [r14 + rcx*8 + 0x1000]
movzx ecx, al
mov rax, r8
shr rax, 0x18
xor r9, qword [r14 + rcx*8 + 0x1800]
movzx ecx, al
mov rax, r8
shr rax, 0x10
xor r9, qword [r14 + rcx*8 + 0x2000]
movzx ecx, al
mov rax, r8
shr rax, 8
xor r9, qword [r14 + rcx*8 + 0x2800]
movzx ecx, al
movzx eax, r8b
xor r9, qword [r14 + rcx*8 + 0x3000]
xor r9, qword [r14 + rax*8 + 0x3800]
cmp rdi, rbx
jb 0x140017a40
and r10d, 7
jbe 0x140017b01
movzx ecx, byte [r11]
inc r11
movzx eax, r9b
xor rcx, rax
mov rax, r9
shr rax, 8
mov r9, qword [r14 + rcx*8]
xor r9, rax
sub r10, 1
jne 0x140017adf
mov rbx, qword [rsp + 8]
mov rax, r9
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
mov r14, qword [rsp + 0x20]
ret