joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ff71efa6660
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
cmp dword [rcx + 0xd0], 0
mov rdi, rdx
mov rbx, rcx
jg 0x7ff71efa6693
mov r8d, 0x706
lea rdx, [0x7ff71f00a490]
lea rcx, [0x7ff71f00f4a8]
call qword [sym.imp.ucrtbase.dll__wassert]
movss xmm2, dword [rbx + 0xf0]
lea r9, [0x7ff71f00f890]
movss xmm0, dword [rdi]
movsxd rcx, dword [rbx + 0xd0]
subss xmm0, xmm2
mov rax, qword [rbx + 0xd8]
movss xmm3, dword [rbx + 0xf4]
movss xmm1, dword [rdi + 4]
subss xmm1, xmm3
mov r8d, dword [rax + rcx*4 - 4]
not r8d
movss dword [rsp + 0x20], xmm0
movzx eax, byte [rsp + 0x20]
movss xmm0, dword [rdi + 8]
movzx ecx, r8b
subss xmm0, xmm2
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x21]
movss dword [rsp + 0x24], xmm1
movss xmm1, dword [rdi + 0xc]
xor r8d, dword [r9 + rcx*4]
subss xmm1, xmm3
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x22]
movss dword [rsp + 0x28], xmm0
movss dword [rsp + 0x2c], xmm1
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x23]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x24]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x25]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x26]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x27]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x28]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x29]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x2a]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x2b]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x2c]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
mov rbx, qword [rsp + 0x40]
xor rcx, rax
movzx eax, byte [rsp + 0x2d]
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x2e]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx ecx, byte [rsp + 0x2f]
movzx edx, r8b
shr r8d, 8
xor rdx, rcx
xor r8d, dword [r9 + rdx*4]
not r8d
mov eax, r8d
add rsp, 0x30
pop rdi
ret
Function at 0x7ff71efb5c30
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, qword [0x7ff71f15e010]
mov edi, ecx
cmp byte [rbx + 0x4a25], 0
jne 0x7ff71efb5c82
cmp byte [rbx + 0x4a26], 0
jne 0x7ff71efb5c82
movsx r9d, word [rbx + 0x5b1a]
lea r8, [0x7ff71f00e668]
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.7ff71efa36e0
test dil, 1
je 0x7ff71efb5da8
jmp 0x7ff71efb5d0b
movss xmm1, dword [rbx + 0x3898]
lea r8, [0x7ff71f00e668]
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x7ff71f052ea0]
xor eax, eax
mulss xmm1, dword [0x7ff71f052e8c]
addss xmm0, dword [rbx + 0xdfc]
lea edx, [rax + 0x10]
addss xmm1, dword [rbx + 0xe00]
mov qword [rbx + 0x4788], rax
mov dword [rbx + 0x4774], 1
movss dword [rbx + 0x4780], xmm0
movss dword [rbx + 0x4784], xmm1
movss xmm0, dword [rbx + 0x38f4]
mulss xmm0, dword [0x7ff71f052dac]
or dword [rbx + 0x4770], 0x41
movss dword [rbx + 0x47d0], xmm0
movsx r9d, word [rbx + 0x5b1a]
call fcn.7ff71efa36e0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x7ff71efb5d60
lea r11, [0x7ff71f00f890]
nop dword [rax + rax]
cmp r9b, 0x23
jne 0x7ff71efb5d43
cmp byte [r8], r9b
jne 0x7ff71efb5d43
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x7ff71efb5d30
not ecx
call fcn.7ff71efad340
test rax, rax
je 0x7ff71efb5da8
cmp byte [rax + 0x96], 0
je 0x7ff71efb5da8
mov byte [rax + 0x9d], 1
lea r8, [0x7ff71f00e668]
mov byte [rax + 0xb8], 1
lea rcx, [rsp + 0x20]
inc word [rbx + 0x5b1a]
mov edx, 0x10
movsx r9d, word [rbx + 0x5b1a]
call fcn.7ff71efa36e0
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.7ff71efafbf0
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x7ff71efbb300
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5bc8], 0
lea rbx, [rcx + 0x5bd0]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x7ff71efbb3a7
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x7ff71efbb35a
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.7ff71efbdb60
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.7ff71efa4010
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5bc8]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x5bd8]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x7ff71f15e008]
cmovne rcx, rax
call qword [sym.imp.ucrtbase.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x7ff71efbb3af
mov rcx, rbx
call fcn.7ff71efa4010
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x7ff71efbba50
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
movzx r8d, byte [rcx]
lea rdx, [rcx + 1]
mov r14, qword [0x7ff71f15e010]
mov r9d, 0xffffffff
mov ebx, r9d
test r8b, r8b
je 0x7ff71efbbab4
lea r10, [0x7ff71f00f890]
cmp r8b, 0x23
jne 0x7ff71efbba97
cmp byte [rdx], r8b
jne 0x7ff71efbba97
cmp byte [rdx + 1], r8b
cmove ebx, r9d
movzx ecx, bl
movzx eax, r8b
movzx r8d, byte [rdx]
xor rcx, rax
shr ebx, 8
inc rdx
xor ebx, dword [r10 + rcx*4]
test r8b, r8b
jne 0x7ff71efbba84
mov eax, dword [r14 + 0x5b78]
xor edi, edi
mov qword [rsp + 0x30], rbp
not ebx
mov qword [rsp + 0x38], rsi
test eax, eax
jle 0x7ff71efbbb15
mov esi, edi
mov ebp, edi
test rsi, rsi
js 0x7ff71efbbada
cmp edi, eax
jl 0x7ff71efbbaf4
mov r8d, 0x6fd
lea rdx, [0x7ff71f00a490]
lea rcx, [0x7ff71f00f408]
call qword [sym.imp.ucrtbase.dll__wassert]
mov rax, qword [r14 + 0x5b80]
cmp dword [rax + rbp + 8], ebx
je 0x7ff71efbbb32
mov eax, dword [r14 + 0x5b78]
inc edi
inc rsi
add rbp, 0x48
cmp edi, eax
jl 0x7ff71efbbad1
xor eax, eax
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
test edi, edi
js 0x7ff71efbbb3f
cmp edi, dword [r14 + 0x5b78]
jl 0x7ff71efbbb59
mov r8d, 0x6fd
lea rdx, [0x7ff71f00a490]
lea rcx, [0x7ff71f00f408]
call qword [sym.imp.ucrtbase.dll__wassert]
movsxd rax, edi
lea rcx, [rax + rax*8]
mov rax, qword [r14 + 0x5b80]
lea rax, [rax + rcx*8]
jmp 0x7ff71efbbb17
Function at 0x7ff71efdbe00
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
mov ecx, 0x210
call fcn.7ff71efb3620
cmp byte [rax], 0
je 0x7ff71efdbe99
xor edx, edx
mov ecx, 0x210
call fcn.7ff71efb4840
test al, al
je 0x7ff71efdbe99
mov ecx, 0xa0
call qword [sym.imp.user32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x7ff71efdbe99
mov rbx, qword [0x7ff71f15e010]
test rbx, rbx
jne 0x7ff71efdbe68
mov r8d, 0xf50
lea rdx, [0x7ff71f00a610]
lea rcx, [0x7ff71f00ab40]
call qword [sym.imp.ucrtbase.dll__wassert]
mov rbx, qword [0x7ff71f15e010]
cmp byte [rbx + 0x37a9], 0
je 0x7ff71efdbe85
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x210
call fcn.7ff71efa2f30
mov dword [rbx + 0x380], 0x210
mov dword [rbx + 0x940], 0xa0
mov ecx, 0x214
call fcn.7ff71efb3620
cmp byte [rax], 0
je 0x7ff71efdbf2c
xor edx, edx
mov ecx, 0x214
call fcn.7ff71efb4840
test al, al
je 0x7ff71efdbf2c
mov ecx, 0xa1
call qword [sym.imp.user32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x7ff71efdbf2c
mov rbx, qword [0x7ff71f15e010]
test rbx, rbx
jne 0x7ff71efdbefb
mov r8d, 0xf50
lea rdx, [0x7ff71f00a610]
lea rcx, [0x7ff71f00ab40]
call qword [sym.imp.ucrtbase.dll__wassert]
mov rbx, qword [0x7ff71f15e010]
cmp byte [rbx + 0x37a9], 0
je 0x7ff71efdbf18
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x214
call fcn.7ff71efa2f30
mov dword [rbx + 0x384], 0x214
mov dword [rbx + 0x950], 0xa1
mov ecx, 0x212
call fcn.7ff71efb3620
cmp byte [rax], 0
je 0x7ff71efdbfbf
xor edx, edx
mov ecx, 0x212
call fcn.7ff71efb4840
test al, al
je 0x7ff71efdbfbf
mov ecx, 0x5b
call qword [sym.imp.user32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x7ff71efdbfbf
mov rbx, qword [0x7ff71f15e010]
test rbx, rbx
jne 0x7ff71efdbf8e
mov r8d, 0xf50
lea rdx, [0x7ff71f00a610]
lea rcx, [0x7ff71f00ab40]
call qword [sym.imp.ucrtbase.dll__wassert]
mov rbx, qword [0x7ff71f15e010]
cmp byte [rbx + 0x37a9], 0
je 0x7ff71efdbfab
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x212
call fcn.7ff71efa2f30
mov dword [rbx + 0x26c], 0x212
mov dword [rbx + 0x948], 0x5b
mov ecx, 0x216
call fcn.7ff71efb3620
cmp byte [rax], 0
je 0x7ff71efdc052
xor edx, edx
mov ecx, 0x216
call fcn.7ff71efb4840
test al, al
je 0x7ff71efdc052
mov ecx, 0x5c
call qword [sym.imp.user32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x7ff71efdc052
mov rbx, qword [0x7ff71f15e010]
test rbx, rbx
jne 0x7ff71efdc021
mov r8d, 0xf50
lea rdx, [0x7ff71f00a610]
lea rcx, [0x7ff71f00ab40]
call qword [sym.imp.ucrtbase.dll__wassert]
mov rbx, qword [0x7ff71f15e010]
cmp byte [rbx + 0x37a9], 0
je 0x7ff71efdc03e
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x216
call fcn.7ff71efa2f30
mov dword [rbx + 0x270], 0x216
mov dword [rbx + 0x958], 0x5c
add rsp, 0x20
pop rbx
ret
Function at 0x7ff71efe0340
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [rcx + 0x10]
lea rdx, [rsp + 0x20]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rax, qword [rcx + 8]
mov rbx, rcx
mov r9d, 0xffffffff
mov qword [rsp + 0x28], rax
lea ecx, [r8 + 2]
call qword [sym.imp.kernel32.dll_WaitForMultipleObjects]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.kernel32.dll_CloseHandle]
xor eax, eax
lock xadd dword [0x7ff71f15ead0], eax
mov rcx, qword [rbx + 8]
test eax, eax
je 0x7ff71efe039d
xor edx, edx
call qword [sym.imp.kernel32.dll_TerminateThread]
add rsp, 0x30
pop rbx
ret
mov rdx, rcx
xor r8d, r8d
lea rcx, [fcn.7ff71efa1950]
call qword [sym.imp.kernel32.dll_QueueUserAPC]
mov rcx, qword [rbx + 8]
mov edx, 0xffffffff
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
add rsp, 0x30
pop rbx
ret
Function at 0x7ff71efe25e0
Capabilities:
Send data
Send data on socket

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov dword [rax + 0x20], r9d
push rdi
push r14
push r15
sub rsp, 0x60
mov rbx, qword [rsp + 0xa0]
lea r9, [rax + 0x20]
xor r14d, r14d
mov qword [rax - 0x48], r14
mov qword [rax - 0x50], r14
mov dword [rax - 0x58], r14d
mov dword [rax + 0x20], r14d
call qword [sym.imp.ws2_32.dll_WSASend]
mov esi, eax
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
mov rdx, qword [0x7ff71f159418]
lea rbp, [0x7ff71f159410]
movabs r15, 0x4d54ee85da812030
mov dword [rsp + 0x44], r14d
add rdx, r15
mov edi, eax
cmp rdx, 1
jbe 0x7ff71efe2666
mov rcx, qword [0x7ff71f159410]
mov edx, eax
mov r8, qword [rcx + 0x30]
mov rcx, rbp
call r8
jmp 0x7ff71efe266b
test edi, edi
setne al
movzx eax, al
movabs r10, 0x4800144005b3
add rax, 2
mov dword [rsp + 0x40], edi
mov qword [rsp + 0x48], rbp
movups xmm0, xmmword [rsp + 0x40]
mov qword [rsp + 0x50], rax
movsd xmm1, qword [rsp + 0x50]
movups xmmword [rbx], xmm0
movsd qword [rbx + 0x10], xmm1
mov r9, qword [rbx + 0x10]
cmp r9, 1
je 0x7ff71efe26ae
mov eax, dword [rbx]
mov r8d, eax
jmp 0x7ff71efe26de
mov rcx, qword [rbx + 8]
mov rax, r10
mov r8d, dword [rbx]
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul rax, rax, 0x1ffff7
sub rcx, rax
imul eax, ecx, 0x3e8
add eax, r8d
cmp eax, 0x40
jne 0x7ff71efe2720
mov rcx, qword [0x7ff71f159418]
add rcx, r15
mov dword [rsp + 0x44], r14d
cmp rcx, 1
jbe 0x7ff71efe2714
mov rax, qword [0x7ff71f159410]
mov edx, 0x2746
mov rcx, rbp
call qword [rax + 0x30]
mov dword [rsp + 0x40], 0x2746
jmp 0x7ff71efe278f
mov al, 1
mov dword [rsp + 0x40], 0x2746
jmp 0x7ff71efe278f
cmp r9, 1
jne 0x7ff71efe2753
mov rcx, qword [rbx + 8]
mov rax, r10
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul rax, rax, 0x1ffff7
sub rcx, rax
imul eax, ecx, 0x3e8
add r8d, eax
cmp r8d, 0x4d2
jne 0x7ff71efe27b3
mov rcx, qword [0x7ff71f159418]
add rcx, r15
mov dword [rsp + 0x44], r14d
cmp rcx, 1
jbe 0x7ff71efe2785
mov rax, qword [0x7ff71f159410]
mov edx, 0x274d
mov rcx, rbp
call qword [rax + 0x30]
jmp 0x7ff71efe2787
mov al, 1
mov dword [rsp + 0x40], 0x274d
movzx eax, al
mov qword [rsp + 0x48], rbp
add rax, 2
movups xmm0, xmmword [rsp + 0x40]
mov qword [rsp + 0x50], rax
movsd xmm1, qword [rsp + 0x50]
movups xmmword [rbx], xmm0
movsd qword [rbx + 0x10], xmm1
test esi, esi
je 0x7ff71efe27be
mov eax, 0xffffffff
jmp 0x7ff71efe27db
mov eax, dword [rsp + 0x98]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rsp + 0x50], r14
movsd xmm0, qword [rsp + 0x50]
movsd qword [rbx + 0x10], xmm0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x7ff71efe8c70
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x10], rdx
push rbp
push r14
push r15
sub rsp, 0x50
xor r15d, r15d
mov rbp, r9
mov r14, r8
mov dword [rsp + 0x28], r15d
mov r8, rbp
mov qword [rsp + 0x78], r15
xor edx, edx
mov qword [rsp + 0x20], r15
lea r9d, [r15 - 1]
xor ecx, ecx
call qword [sym.imp.kernel32.dll_MultiByteToWideChar]
movsxd rbx, eax
test eax, eax
jne 0x7ff71efe8cc5
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop r15
pop r14
pop rbp
ret
movabs rax, 0x7fffffffffffffff
mov qword [rsp + 0x70], rsi
mov rsi, rbx
cmp rbx, rax
ja 0x7ff71efe8e42
add rsi, rsi
mov qword [rsp + 0x80], rdi
cmp rsi, 0x1000
jb 0x7ff71efe8d1d
lea rcx, [rsi + 0x27]
cmp rcx, rsi
jbe 0x7ff71efe8e3c
call fcn.7ff71f00491c
test rax, rax
je 0x7ff71efe8e35
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x7ff71efe8d32
test rsi, rsi
je 0x7ff71efe8d2f
mov rcx, rsi
call fcn.7ff71f00491c
mov rdi, rax
jmp 0x7ff71efe8d32
mov rdi, r15
mov r8, rsi
xor edx, edx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memset
mov r9d, 0xffffffff
mov dword [rsp + 0x28], ebx
mov r8, rbp
mov qword [rsp + 0x20], rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.kernel32.dll_MultiByteToWideChar]
test eax, eax
je 0x7ff71efe8dda
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0x78]
mov qword [rsp + 0x38], rax
lea rdx, [0x7ff71f0515c8]
mov qword [rsp + 0x30], r15
xor r9d, r9d
mov dword [rsp + 0x28], 2
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], r15d
call qword [sym.imp.advapi32.dll_RegCreateKeyExW]
test eax, eax
jne 0x7ff71efe8dda
mov eax, dword [rsp + 0x98]
mov r9d, 1
mov rcx, qword [rsp + 0x78]
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov rdx, r14
mov qword [rsp + 0x20], rdi
call qword [sym.imp.advapi32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x78]
mov ebx, eax
call qword [sym.imp.advapi32.dll_RegCloseKey]
test ebx, ebx
jne 0x7ff71efe8dda
mov bl, 1
jmp 0x7ff71efe8ddc
xor bl, bl
test rdi, rdi
je 0x7ff71efe8e13
sar rsi, 1
add rsi, rsi
cmp rsi, 0x1000
jb 0x7ff71efe8e08
mov rcx, qword [rdi - 8]
add rsi, 0x27
sub rdi, rcx
lea rax, [rdi - 8]
cmp rax, 0x1f
ja 0x7ff71efe8e35
mov rdi, rcx
mov rdx, rsi
mov rcx, rdi
call fcn.7ff71f004544
mov rdi, qword [rsp + 0x80]
movzx eax, bl
mov rbx, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop r15
pop r14
pop rbp
ret
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff71efd2220
int3
call fcn.7ff71eff8be0
int3
Function at 0x7ff71efed3b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xd0
movdqa xmm0, xmmword [0x7ff71f053230]
xor r10d, r10d
movdqa xmm1, xmmword [0x7ff71f053330]
mov ecx, 0xfeac4ea7
movdqa xmmword [rbp - 0x49], xmm0
mov rbx, rdx
movdqa xmm0, xmmword [0x7ff71f053320]
mov r8d, r10d
movdqa xmmword [rbp - 0x29], xmm0
lea r9d, [r10 + 0x49]
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x39], xmm1
movdqa xmm1, xmmword [0x7ff71f053080]
movups xmmword [rbp - 1], xmm0
mov dword [rbp - 1], ecx
mov dword [rbp - 0x59], ecx
mov dword [rbp - 0x55], 0x5b0a70e4
mov dword [rbp - 0x51], 0xf8005554
mov dword [rbp - 0x4d], 0x6a122777
movdqa xmmword [rbp - 0x19], xmm1
movups xmmword [rbp + 0xf], xmm0
movups xmmword [rbp + 0x1f], xmm0
movups xmmword [rbp + 0x2f], xmm0
movups xmmword [rbp + 0x3f], xmm0
nop word [rax + rax]
movzx eax, cl
imul ecx, ecx, 0xbc8f
xor al, byte [rbp + r8 - 0x55]
mov byte [rbp + r8 + 3], al
lea r8, [r8 + 1]
mov eax, 3
mul ecx
mov eax, ecx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 0x1e
imul eax, eax, 0x7fffffff
sub ecx, eax
sub r9, 1
jne 0x7ff71efed440
movups xmm0, xmmword [rbp - 1]
lea rax, [rbp - 0x55]
mov r8, 0xffffffffffffffff
movups xmm1, xmmword [rbp + 0xf]
movups xmmword [rbp - 0x59], xmm0
movups xmm0, xmmword [rbp + 0x1f]
movups xmmword [rbp - 0x49], xmm1
movups xmm1, xmmword [rbp + 0x2f]
movups xmmword [rbp - 0x39], xmm0
movups xmm0, xmmword [rbp + 0x3f]
movups xmmword [rbp - 0x29], xmm1
xorps xmm1, xmm1
movups xmmword [rbx], xmm1
mov qword [rbx + 0x10], r10
movups xmmword [rbp - 0x19], xmm0
mov qword [rbx + 0x18], r10
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], r10b
jne 0x7ff71efed4c0
lea rdx, [rbp - 0x55]
mov rcx, rbx
call fcn.7ff71efda340
mov rax, rbx
mov rbx, qword [rsp + 0xe0]
add rsp, 0xd0
pop rbp
ret
Function at 0x7ff71eff5d90
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x1f0
movzx ebx, dl
mov rdi, rcx
mov eax, 1
lock xadd dword [0x7ff71f15eb20], eax
inc eax
cmp eax, 1
jne 0x7ff71eff5dcb
lea ecx, [rax + 1]
lea rdx, [rsp + 0x50]
call qword [sym.imp.ws2_32.dll_WSAStartup]
xchg dword [0x7ff71f15eb24], eax
test bl, bl
je 0x7ff71eff5e6f
xor ebx, ebx
lock xadd dword [0x7ff71f15eb24], ebx
test ebx, ebx
je 0x7ff71eff5e6f
movabs rcx, 0x4d54ee85da812030
mov qword [rsp + 0x200], rsi
add rcx, qword [0x7ff71f159418]
lea rsi, [0x7ff71f159410]
mov dword [rsp + 0x3c], 0
cmp rcx, 1
jbe 0x7ff71eff5e24
mov rax, qword [0x7ff71f159410]
mov edx, ebx
mov rcx, rsi
call qword [rax + 0x30]
jmp 0x7ff71eff5e26
mov al, 1
lea rcx, [0x7ff71f050b00]
movzx eax, al
add rax, 2
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x40], rsi
lea rcx, [0x7ff71f050ae8]
mov rsi, qword [rsp + 0x200]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], 0x48
mov dword [rsp + 0x34], 0x1a
test al, 1
jne 0x7ff71eff5e83
mov rbx, qword [rsp + 0x208]
mov rax, rdi
add rsp, 0x1f0
pop rdi
ret
lea r8, [rsp + 0x20]
lea rdx, [0x7ff71f050b50]
lea rcx, [rsp + 0x38]
call fcn.7ff71efdfe90
int3

Function at 0x7ff71eff72b0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x50
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x7ff71eff7379
cmp byte [rcx + 0x71], 0
je 0x7ff71eff7379
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x68], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x7ff71eff736c
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x60]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
call qword [sym.imp.msvcp140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x7ff71eff7328
sub eax, 1
je 0x7ff71eff732c
cmp eax, 2
jne 0x7ff71eff736c
mov rdi, qword [rsp + 0x68]
mov al, 1
mov byte [rbx + 0x71], 0
add rsp, 0x50
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x60]
lea rax, [rsp + 0x30]
sub rdi, rax
je 0x7ff71eff735a
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x30]
mov r8, rdi
mov edx, 1
call qword [sym.imp.ucrtbase.dll_fwrite]
cmp rdi, rax
jne 0x7ff71eff736c
cmp byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x68]
sete al
add rsp, 0x50
pop rbx
ret
mov rdi, qword [rsp + 0x68]
xor al, al
add rsp, 0x50
pop rbx
ret
mov al, 1
add rsp, 0x50
pop rbx
ret
Function at 0x7ff71f001580
Capabilities:
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x70
mov rax, qword [0x7ff71f064080]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rsi, rcx
mov ebx, r8d
lea rcx, [0x7ff71f009ef0]
mov rbp, rdx
xor r14d, r14d
call qword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
test eax, eax
mov edi, 0x80070057
cmovne edi, r14d
je 0x7ff71f0015dc
lea r8, [0x7ff71f009f00]
mov edx, ebx
mov rcx, rbp
call qword [sym.imp.ucrtbase.dll_wcscat_s]
neg eax
sbb edi, edi
and edi, 0x80070057
test edi, edi
js 0x7ff71f0016a4
mov rcx, qword [rsi + 0x10]
movabs rax, 0x7ffffffffffffffe
sub rax, rcx
cmp rax, 4
jb 0x7ff71f0016be
cmp qword [rsi + 0x18], 7
mov r9, rsi
jbe 0x7ff71f00160c
mov r9, qword [rsi]
movzx edx, byte [rsp + 0x40]
lea rax, [0x7ff71f009f50]
mov qword [rsp + 0x30], 4
mov r8, rsi
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x48]
call fcn.7ff71effe6f0
cmp qword [rsp + 0x60], 7
lea r8, [rsp + 0x48]
mov rdx, rbx
mov rcx, rbp
cmova r8, qword [rsp + 0x48]
call qword [sym.imp.ucrtbase.dll_wcscat_s]
mov rdx, qword [rsp + 0x60]
neg eax
sbb edi, edi
and edi, 0x80070057
cmp rdx, 7
jbe 0x7ff71f0016a4
mov rcx, qword [rsp + 0x48]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff71f00169f
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff71f00169f
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff71f004544
mov eax, edi
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.7ff71f004da0
add rsp, 0x70
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.7ff71efd22c0
int3