joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e86a0
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x10]
mov rdx, qword [rsp + 8]
pxor xmm15, xmm15
pcmpeqd xmm14, xmm14
psubd xmm15, xmm14
movd xmm14, eax
pshufd xmm14, xmm14, 0
pxor xmm0, xmm0
pxor xmm1, xmm1
pxor xmm2, xmm2
pxor xmm3, xmm3
pxor xmm4, xmm4
pxor xmm5, xmm5
mov rax, 0x10
movdqu xmm13, xmm15
movdqu xmm12, xmm13
paddd xmm13, xmm15
pcmpeqd xmm12, xmm14
movdqu xmm6, xmmword [rdi]
movdqu xmm7, xmmword [rdi + 0x10]
movdqu xmm8, xmmword [rdi + 0x20]
movdqu xmm9, xmmword [rdi + 0x30]
movdqu xmm10, xmmword [rdi + 0x40]
movdqu xmm11, xmmword [rdi + 0x50]
add rdi, 0x60
pand xmm6, xmm12
pand xmm7, xmm12
pand xmm8, xmm12
pand xmm9, xmm12
pand xmm10, xmm12
pand xmm11, xmm12
pxor xmm0, xmm6
pxor xmm1, xmm7
pxor xmm2, xmm8
pxor xmm3, xmm9
pxor xmm4, xmm10
pxor xmm5, xmm11
dec rax
jne 0x4e86ed
movdqu xmmword [rdx], xmm0
movdqu xmmword [rdx + 0x10], xmm1
movdqu xmmword [rdx + 0x20], xmm2
movdqu xmmword [rdx + 0x30], xmm3
movdqu xmmword [rdx + 0x40], xmm4
movdqu xmmword [rdx + 0x50], xmm5
ret

Function at 0x4e8780
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x10]
mov rdx, qword [rsp + 8]
pxor xmm15, xmm15
pcmpeqd xmm14, xmm14
psubd xmm15, xmm14
movd xmm14, eax
pshufd xmm14, xmm14, 0
pxor xmm0, xmm0
pxor xmm1, xmm1
pxor xmm2, xmm2
pxor xmm3, xmm3
mov rax, 0x10
movdqu xmm13, xmm15
movdqu xmm12, xmm13
paddd xmm13, xmm15
pcmpeqd xmm12, xmm14
movdqu xmm4, xmmword [rdi]
movdqu xmm5, xmmword [rdi + 0x10]
movdqu xmm6, xmmword [rdi + 0x20]
movdqu xmm7, xmmword [rdi + 0x30]
movdqu xmm8, xmmword [rdi + 0x40]
movdqu xmm9, xmmword [rdi + 0x50]
movdqu xmm10, xmmword [rdi + 0x60]
movdqu xmm11, xmmword [rdi + 0x70]
add rdi, 0x80
pand xmm4, xmm12
pand xmm5, xmm12
pand xmm6, xmm12
pand xmm7, xmm12
movdqu xmm12, xmm13
paddd xmm13, xmm15
pcmpeqd xmm12, xmm14
pand xmm8, xmm12
pand xmm9, xmm12
pand xmm10, xmm12
pand xmm11, xmm12
pxor xmm0, xmm4
pxor xmm1, xmm5
pxor xmm2, xmm6
pxor xmm3, xmm7
pxor xmm0, xmm8
pxor xmm1, xmm9
pxor xmm2, xmm10
pxor xmm3, xmm11
dec rax
jne 0x4e87c5
movdqu xmmword [rdx], xmm0
movdqu xmmword [rdx + 0x10], xmm1
movdqu xmmword [rdx + 0x20], xmm2
movdqu xmmword [rdx + 0x30], xmm3
ret
Function at 0x4ea420
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ea554
push rbp
mov rbp, rsp
sub rsp, 0x68
mov qword [rsp + 0x80], rbx
mov rcx, qword [rax]
mov qword [rsp + 0x18], rcx
movups xmm0, xmmword [rax + 8]
movups xmmword [rsp + 0x20], xmm0
movups xmm0, xmmword [rax + 0x18]
movups xmmword [rsp + 0x30], xmm0
lea rax, [rsp + 0x18]
call fcn.004ea140
movups xmmword [rsp + 0x40], xmm15
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x58], xmm15
mov rcx, qword [rsp + 0x18]
mov qword [rsp + 0x40], rcx
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x48], rcx
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x50], rcx
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x58], rcx
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x60], rcx
mov rcx, qword [rsp + 0x80]
xor eax, eax
jmp 0x4ea4b4
inc rax
mov rcx, rbx
cmp rax, 5
jge 0x4ea4f7
mov rdx, qword [rsp + rax*8 + 0x40]
imul rsi, rax, 0x33
mov rdi, rsi
sar rsi, 0x3f
shr rsi, 0x3d
add rsi, rdi
mov r8, rsi
and rsi, 0xfffffffffffffff8
sub rdi, rsi
mov rbx, rcx
mov rcx, rdi
shl rdx, cl
cmp rcx, 0x40
sbb rsi, rsi
and rdx, rsi
mov qword [rsp + 0x10], rdx
xor ecx, ecx
jmp 0x4ea521
test byte [rcx], al
mov rax, rcx
mov ebx, 0x20
mov rcx, rbx
add rsp, 0x68
pop rbp
ret
movzx edi, byte [rbx + rsi]
movzx r9d, byte [rsp + rcx + 0x10]
or edi, r9d
mov byte [rbx + rsi], dil
inc rcx
mov r8, rdx
cmp rcx, 8
jge 0x4ea4ae
mov rdx, r8
sar r8, 3
lea rsi, [r8 + rcx]
cmp rsi, 0x20
jge 0x4ea4ae
test byte [rbx], al
nop
cmp rsi, 0x20
jb 0x4ea50a
mov rax, rsi
mov ecx, 0x20
call fcn.004588e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop
call fcn.00456660
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004ea420
Function at 0x4ed860
Capabilities:
Hash data using sha384
Hash data using sha512

Disassembly:
mov rcx, qword [rax + 0xd0]
cmp rcx, 6
jne 0x4ed8e5
movabs rcx, 0xcbbb9d5dc1059ed8
mov qword [rax], rcx
movabs rcx, 0x629a292a367cd507
mov qword [rax + 8], rcx
movabs rcx, 0x9159015a3070dd17
mov qword [rax + 0x10], rcx
movabs rcx, 0x152fecd8f70e5939
mov qword [rax + 0x18], rcx
movabs rcx, 0x67332667ffc00b31
mov qword [rax + 0x20], rcx
movabs rcx, 0x8eb44a8768581511
mov qword [rax + 0x28], rcx
movabs rcx, 0xdb0c2e0d64f98fa7
mov qword [rax + 0x30], rcx
movabs rcx, 0x47b5481dbefa4fa4
mov qword [rax + 0x38], rcx
nop dword [rax]
jmp 0x4eda46
cmp rcx, 0xe
jne 0x4ed960
movabs rcx, 0x8c3d37c819544da2
mov qword [rax], rcx
movabs rcx, 0x73e1996689dcd4d6
mov qword [rax + 8], rcx
movabs rcx, 0x1dfab7ae32ff9c82
mov qword [rax + 0x10], rcx
movabs rcx, 0x679dd514582f9fcf
mov qword [rax + 0x18], rcx
movabs rcx, 0xf6d2b697bd44da8
mov qword [rax + 0x20], rcx
movabs rcx, 0x77e36f7304c48942
mov qword [rax + 0x28], rcx
movabs rcx, 0x3f9d85a86a1d36c8
mov qword [rax + 0x30], rcx
movabs rcx, 0x1112e6ad91d692a1
mov qword [rax + 0x38], rcx
jmp 0x4eda46
cmp rcx, 0xf
jne 0x4ed9d7
movabs rcx, 0x22312194fc2bf72c
mov qword [rax], rcx
movabs rcx, 0x9f555fa3c84c64c2
mov qword [rax + 8], rcx
movabs rcx, 0x2393b86b6f53b151
mov qword [rax + 0x10], rcx
movabs rcx, 0x963877195940eabd
mov qword [rax + 0x18], rcx
movabs rcx, 0x96283ee2a88effe3
mov qword [rax + 0x20], rcx
movabs rcx, 0xbe5e1e2553863992
mov qword [rax + 0x28], rcx
movabs rcx, 0x2b0199fc2c85b8aa
mov qword [rax + 0x30], rcx
movabs rcx, 0xeb72ddc81c52ca2
mov qword [rax + 0x38], rcx
jmp 0x4eda46
movabs rcx, 0x6a09e667f3bcc908
mov qword [rax], rcx
movabs rcx, 0xbb67ae8584caa73b
mov qword [rax + 8], rcx
movabs rcx, 0x3c6ef372fe94f82b
mov qword [rax + 0x10], rcx
movabs rcx, 0xa54ff53a5f1d36f1
mov qword [rax + 0x18], rcx
movabs rcx, 0x510e527fade682d1
mov qword [rax + 0x20], rcx
movabs rcx, 0x9b05688c2b3e6c1f
mov qword [rax + 0x28], rcx
movabs rcx, 0x1f83d9abfb41bd6b
mov qword [rax + 0x30], rcx
movabs rcx, 0x5be0cd19137e2179
mov qword [rax + 0x38], rcx
movups xmmword [rax + 0xc0], xmm15
ret
Function at 0x4f3280
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f3365
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rsp + 0x50], rax
mov rdx, rdi
sar rdi, 0x3f
shr rdi, 0x3d
lea rsi, [rdi + rdx]
and rsi, 0xfffffffffffffff8
sub rdx, rsi
lea rsi, [rdx - 8]
neg rsi
cmp rsi, 8
je 0x4f3318
test rbx, rbx
je 0x4f3318
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x38], rax
cmp rsi, 8
sbb edx, edx
mov byte [rsp + 0x1f], dl
lea rax, [0x00535960]
mov rcx, rbx
call fcn.00442960
mov rdx, qword [rsp + 0x38]
movzx esi, byte [rdx]
mov rcx, qword [rsp + 0x28]
shr sil, cl
movzx edi, byte [rsp + 0x1f]
and esi, edi
mov byte [rax], sil
mov rbx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x30]
mov r8d, 1
jmp 0x4f3357
add rsp, 0x40
pop rbp
ret
movzx r9d, byte [r8 + rdx - 1]
mov r10, rcx
mov rcx, rsi
shl r9d, cl
lea r11, [r8 + 1]
cmp rcx, 0x20
sbb r12d, r12d
and r9d, r12d
mov byte [rax + r8], r9b
movzx r12d, byte [rdx + r8]
mov rcx, r10
shr r12b, cl
and r12d, edi
or r9d, r12d
mov byte [rax + r8], r9b
mov r8, r11
cmp rbx, r8
jg 0x4f331e
mov rcx, rbx
add rsp, 0x40
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00456660
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.004f3280
Function at 0x501580
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x501739
push rbp
mov rbp, rsp
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xb0], rdi
mov qword [rsp + 0xc8], r9
cmp rbx, rsi
jl 0x501725
test rsi, rsi
je 0x5015ea
nop dword [rax]
cmp rax, rdi
je 0x5015ea
mov rdx, rax
lea r11, [rdi + rsi]
lea r11, [r11 - 1]
nop
cmp r11, rdx
jb 0x5015ea
mov rdx, rdi
lea r11, [rax + rsi]
lea r11, [r11 - 1]
cmp r11, rdx
jae 0x50170f
movups xmmword [rsp + 0x40], xmm15
cmp r10, 0x18
jne 0x5016c9
mov qword [rsp + 0xc0], r8
mov qword [rsp + 0xb8], rsi
mov qword [rsp + 0xb0], rdi
mov qword [rsp + 0xa8], rcx
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xc8], r9
mov qword [rsp + 0x98], rax
movups xmmword [rsp + 0x60], xmm15
movups xmmword [rsp + 0x70], xmm15
movups xmmword [rsp + 0x50], xmm15
lea rdx, [rsp + 0x50]
cmp r9, rdx
je 0x501657
movups xmm0, xmmword [r9]
movups xmmword [rsp + 0x50], xmm0
lea rax, [rsp + 0x60]
mov rbx, rdx
mov rcx, qword [rsp + 0x90]
lea rdi, str.expand_32_byte_k
call fcn.00500040
mov rdx, qword [rsp + 0xc8]
lea rsi, [rdx + 0x10]
lea r8, [rsp + 0x40]
cmp r8, rsi
je 0x501692
mov rdx, qword [rdx + 0x10]
mov qword [rsp + 0x40], rdx
mov rax, qword [rsp + 0x98]
mov rcx, qword [rsp + 0xa8]
mov rbx, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0xb8]
mov rdi, qword [rsp + 0xb0]
mov r8, qword [rsp + 0xc0]
lea rdx, [rsp + 0x60]
jmp 0x5016e9
cmp r10, 8
jne 0x5016fc
lea rdx, [rsp + 0x40]
cmp r9, rdx
je 0x5016e1
mov rdx, qword [r9]
mov qword [rsp + 0x40], rdx
mov rdx, qword [rsp + 0x90]
lea r9, [rsp + 0x40]
mov r10, rdx
call fcn.00500320
sub rsp, 0xffffffffffffff80
pop rbp
ret
lea rax, [0x005356a0]
lea rbx, [0x005a9660]
call fcn.00430760
lea rax, [0x005356a0]
lea rbx, [0x005a9650]
nop dword [rax]
call fcn.00430760
lea rax, [0x005356a0]
lea rbx, [0x005a9640]
call fcn.00430760
nop
mov qword [rsp + 0x10], rax
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x40], r9
mov qword [rsp + 0x48], r10
mov qword [rsp + 0x50], r11
call fcn.00456660
mov rax, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov r8, qword [rsp + 0x38]
mov r9, qword [rsp + 0x40]
mov r10, qword [rsp + 0x48]
mov r11, qword [rsp + 0x50]
jmp fcn.00501580
Function at 0x1400031c0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rdi, r8
test r8, r8
je 0x1400031d9
mov qword [r8], 0
lea rdx, [0x140048a10]
call fcn.140002ff0
mov rbx, rax
test rax, rax
jne 0x1400031f8
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
xor edx, edx
mov qword [rsp + 0x30], rbp
mov rcx, rbx
mov qword [rsp + 0x38], rsi
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1400032b8
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rsi, eax
cmp esi, 0xffffffff
je 0x1400032b8
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1400032b8
mov rax, qword [0x1400e0680]
mov rbp, rsi
test rax, rax
je 0x140003255
inc dword [rax + 0x3c8]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x1400032b8
mov r9, rbx
mov r8, rbp
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rbp
je 0x1400032a5
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x1400e0680]
test rax, rax
je 0x14000329a
dec dword [rax + 0x3c8]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x1400032c1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rdi, rdi
je 0x1400032b3
mov qword [rdi], rbp
mov rax, rsi
jmp 0x1400032c3
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400138f0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push r15
sub rsp, 0x20
mov rdi, qword [0x1400e0680]
xor esi, esi
mov r15, rcx
mov dword [rdi + 0x2d9c], esi
test rcx, rcx
je 0x140013a0a
mov qword [rsp + 0x40], rbx
lea rbx, [rdi + 0x2da0]
mov dword [rdi + 0x2d9c], esi
mov ecx, dword [rbx + 4]
mov qword [rsp + 0x48], rbp
test ecx, ecx
jns 0x14001394a
mov eax, ecx
cdq
sub eax, edx
mov edx, esi
sar eax, 1
add eax, ecx
mov rcx, rbx
test eax, eax
cmovg edx, eax
call fcn.1400149f0
mov dword [rbx], esi
cmp dword [rbx + 4], esi
jne 0x14001395e
mov edx, 8
mov rcx, rbx
call fcn.1400149f0
movsxd rcx, dword [rbx]
mov ebp, esi
mov rax, qword [rbx + 8]
mov byte [rcx + rax], sil
inc dword [rbx]
cmp dword [rdi + 0x2db0], esi
jle 0x1400139aa
mov qword [rsp + 0x50], r14
mov r14, rsi
nop dword [rax]
mov r9, qword [rdi + 0x2db8]
mov r8, rbx
add r9, r14
mov rcx, rdi
mov rdx, r9
call qword [r9 + 0x20]
inc ebp
add r14, 0x30
cmp ebp, dword [rdi + 0x2db0]
jl 0x140013980
mov r14, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
cmp qword [rbx + 8], rsi
je 0x1400139b9
mov esi, dword [rbx]
dec esi
mov rax, qword [rdi + 0x2da8]
lea rdx, [0x140048a14]
test rax, rax
movsxd rsi, esi
lea rdi, [0x1400e0678]
mov rcx, r15
cmovne rdi, rax
call fcn.140002ff0
mov rbx, rax
test rax, rax
je 0x140013a05
mov r9, rax
mov r8, rsi
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r15
pop rdi
pop rsi
ret
Function at 0x14003aaf0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x10], rdx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x270
mov rbx, rdx
mov r15, rcx
xor r13d, r13d
mov edx, 0x100
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x38], xmm1
lea rax, [rsp + 0x70]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14003ab50
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x28]
call fcn.140045490
nop
mov r8d, 0x1f
lea rdx, str.SoftwareDistributionDownload_
lea rcx, [rsp + 0x28]
call fcn.140043fb0
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x58], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
mov rdx, qword [rsp + 0x40]
cmp rdx, 7
jbe 0x14003abf9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003abf4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003abf4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400465bc
movdqa xmm0, xmmword [0x1400b3520]
movdqu xmmword [rsp + 0x38], xmm0
mov word [rsp + 0x28], r13w
lea rdi, [rbx + 0x10]
mov rdx, rbx
lea r14, [rbx + 0x18]
cmp qword [rbx + 0x18], 7
jbe 0x14003ac28
mov rdx, qword [rbx]
lea rbp, [rbx + 0x10]
jmp 0x14003ac2b
mov rbp, rdi
mov r8, qword [rdi]
lea rcx, [rsp + 0x48]
call fcn.140043fb0
xorps xmm0, xmm0
movups xmmword [r15], xmm0
mov qword [r15 + 0x10], r13
mov qword [r15 + 0x18], r13
movups xmm0, xmmword [rax]
movups xmmword [r15], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [r15 + 0x10], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
lea r12, [rbx + 0x18]
mov rdx, qword [rsp + 0x60]
cmp rdx, 7
jbe 0x14003acb6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003acab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003acab
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400465bc
mov rdi, rbp
mov r12, r14
mov rdx, qword [rbx + 0x18]
cmp rdx, 7
jbe 0x14003acf1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x14003acec
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003ad24
mov rcx, r8
call fcn.1400465bc
mov qword [rdi], r13
mov qword [r12], 7
mov word [rbx], r13w
mov rax, r15
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14003ad30
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x40
xor r15d, r15d
lea r14, [rcx + 0x18]
cmp qword [r14], 7
mov rdi, rcx
mov dword [rsp + 0x60], r15d
jbe 0x14003ad61
mov rcx, qword [rcx]
lea rsi, [rdi + 0x18]
jmp 0x14003ad64
mov rsi, r14
mov qword [rsp + 0x30], r15
xor r9d, r9d
mov dword [rsp + 0x28], 2
xor r8d, r8d
mov edx, 0x10000000
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
jne 0x14003ade5
mov rdx, qword [r14]
cmp rdx, 7
jbe 0x14003add9
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14003add1
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003aedb
mov rcx, r8
call fcn.1400465bc
mov r14, rsi
mov qword [r14], 7
jmp 0x14003aebd
cmp rbp, 0xffffffffffffffff
jne 0x14003ae3b
mov rdx, qword [r14]
cmp rdx, 7
jbe 0x14003ae2d
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14003ae28
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003aedb
mov rcx, r8
lea rsi, [rdi + 0x18]
call fcn.1400465bc
mov qword [rsi], 7
xor al, al
jmp 0x14003aebf
lea r9, [rsp + 0x60]
mov qword [rsp + 0x68], rbx
mov r8d, 0x1e00
mov qword [rsp + 0x20], r15
lea rdx, [0x1400bc0b0]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbp
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [r14]
test bl, bl
mov rbx, qword [rsp + 0x68]
je 0x14003adee
cmp rdx, 7
jbe 0x14003aeb6
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14003aeb1
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003aedb
mov rcx, r8
lea rsi, [rdi + 0x18]
call fcn.1400465bc
mov qword [rsi], 7
mov al, 1
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov word [rdi], r15w
mov qword [rdi + 0x10], r15
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14003aef0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x40
xor r15d, r15d
lea r14, [rcx + 0x18]
cmp qword [r14], 7
mov rdi, rcx
mov dword [rsp + 0x60], r15d
jbe 0x14003af21
mov rcx, qword [rcx]
lea rsi, [rdi + 0x18]
jmp 0x14003af24
mov rsi, r14
mov qword [rsp + 0x30], r15
xor r9d, r9d
mov dword [rsp + 0x28], 2
xor r8d, r8d
mov edx, 0x10000000
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
jne 0x14003afa5
mov rdx, qword [r14]
cmp rdx, 7
jbe 0x14003af99
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14003af91
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003b09b
mov rcx, r8
call fcn.1400465bc
mov r14, rsi
mov qword [r14], 7
jmp 0x14003b07d
cmp rbp, 0xffffffffffffffff
jne 0x14003affb
mov rdx, qword [r14]
cmp rdx, 7
jbe 0x14003afed
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14003afe8
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003b09b
mov rcx, r8
lea rsi, [rdi + 0x18]
call fcn.1400465bc
mov qword [rsi], 7
xor al, al
jmp 0x14003b07f
lea r9, [rsp + 0x60]
mov qword [rsp + 0x68], rbx
mov r8d, 0x21a00
mov qword [rsp + 0x20], r15
lea rdx, [0x1400bdeb0]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbp
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [r14]
test bl, bl
mov rbx, qword [rsp + 0x68]
je 0x14003afae
cmp rdx, 7
jbe 0x14003b076
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14003b071
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003b09b
mov rcx, r8
lea rsi, [rdi + 0x18]
call fcn.1400465bc
mov qword [rsi], 7
mov al, 1
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov word [rdi], r15w
mov qword [rdi + 0x10], r15
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14003b340
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
sub rsp, 0x68
xor r8d, r8d
mov dword [rax - 0x28], 0x8d1c8d63
mov dword [rax - 0x24], 0x8d1e8d6f
mov edx, 0x72c1
mov dword [rax - 0x20], 0x8d038d15
mov dword [rax - 0x1c], 0x8d198d0e
mov dword [rax - 0x18], 0x8d788d00
mov dword [rax - 0x14], 0x8d7b8d70
mov dword [rax - 0x10], 0x8d03
mov byte [rax - 0xc], 1
mov eax, r8d
nop word [rax + rax]
movzx ecx, ax
sub cx, dx
xor word [rsp + rax*2 + 0x40], cx
inc rax
cmp rax, 0xd
jb 0x14003b390
mov qword [rsp + 0x30], r8
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x28], r8d
xor r9d, r9d
mov byte [rsp + 0x5c], r8b
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x1400e06b8], rax
test rax, rax
je 0x14003b3ea
cmp rax, 0xffffffffffffffff
setne al
add rsp, 0x68
ret
add rsp, 0x68
ret

Function at 0x14003b3f0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x260
xor edx, edx
mov rdi, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14003b454
nop dword [rax + rax]
mov rdx, rdi
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov rcx, rbx
test eax, eax
je 0x14003b474
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14003b430
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x1400e06b0]
mov rbx, qword [rsp + 0x270]
add rsp, 0x260
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x28]
mov rbx, qword [rsp + 0x270]
mov dword [0x1400e06b0], eax
add rsp, 0x260
pop rdi
ret

Function at 0x14003b4a0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x70
mov rsi, rcx
mov ebx, r8d
mov rcx, qword [0x1400e07b8]
mov rdi, rdx
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x14003b4d3
lea ecx, [rax - 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov eax, dword [0x1400e06b0]
lea r8, [rsp + 0x40]
xor ecx, ecx
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x38], rcx
mov edx, 0x3b2c22c
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rcx
lea r9d, [rcx + 0x28]
mov dword [rsp + 0x44], ecx
mov dword [rsp + 0x61], ecx
mov word [rsp + 0x65], cx
mov byte [rsp + 0x67], cl
mov byte [rsp + 0x60], cl
mov rcx, qword [0x1400e06b8]
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rbx
mov dword [rsp + 0x40], eax
call qword [0x1400e0860]
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret