joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140015388
Capabilities:
Read .ini file

Disassembly:
mov r11d, r9d
mov r10, r8
lea r9, [rcx + 8]
mov rax, rdx
cmp qword [r9 + 0x18], 8
jb 0x14001539f
mov r9, qword [r9]
cmp qword [r8 + 0x18], 8
jb 0x1400153a9
mov r10, qword [r8]
cmp qword [rdx + 0x18], 8
jb case.default.0x1400153bc
mov rax, qword [rdx]
mov r8d, r11d
mov rdx, r10
mov rcx, rax
jmp qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
invalid
add eax, 0x8a1db377
sal dword [rdx - 0x6f24f7bb], 1
mov esi, 0xffffff4b
jle 0x14009363f
in al, dx
cmp eax, 0x36d75ccc
invalid
invalid
invalid
hlt
invalid
cmpsd dword [rsi], dword [rdi]
xor eax, 0x39afd9fe
loop 0x140093745
mov esp, 0x15091946
mov ecx, 0xa6d3431
invalid
push qword [rcx + 0x41cd2ee0]
or edi, 0xbdc2cea4
and byte [rsi - 0x3052338], ah
invalid
fsubrp st(6)
pop rsp
in al, dx
mov ebx, 0x52f6fbdb
xchg ebx, eax
add byte [rbx + rdi - 0x11], bh
cmp al, 0x98
test dword [rbx - 0x37], 0x61fef6ff
push rbp
sub eax, 0x854b81d2
invalid
sbb dword [rdi - 0x57], 0x69
xchg edi, eax
add dh, byte [rcx + 4]
invalid

Function at 0x1400153c4
Capabilities:
Read .ini file

Disassembly:
push rbx
add rcx, 8
mov r10, r9
mov r11, r8
mov rbx, rdx
cmp qword [rcx + 0x18], 8
jb case.default.0x1400153f9
mov rcx, qword [rcx]
mov eax, dword [rsp + 0x38]
mov r8, r10
mov r9, qword [rsp + 0x30]
mov rdx, r11
mov qword [rsp + 0x38], rcx
mov rcx, rbx
mov dword [rsp + 0x30], eax
pop rbx
jmp qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
movsd dword [rdi], dword [rsi]
invalid
call [rax - 0x46]
xchg edi, eax
fidiv word [rdi]
push rax
pop r12
jnp 0x140093a0f
invalid
push qword [rsi + 0x7f]
std
jg 0x1400939fe
out dx, eax
jg 0x140093a58
cmp al, 0xd5
ret 0xebfc
cld
jmp 0x140093a13
xchg esi, eax
sub dword [rcx], 0x1f9d26e3
or al, 0xea
cmp al, 0x93
cmp dword [rax], eax
pop rbx
call [rdi]
sub eax, 0xbd8fabc4
mov ch, 0x2f
xchg rbp, rax
and cl, bl
pop r8
push rdx
out 0x1f, eax
shr byte [0x1ad2340d8], 1
cld
fdiv qword [rbp - 0x28e88f73]
lea esi, [rax + 0x17]
xlatb
lea esi, [rax + 0x17]
xlatb
xor ah, byte [rax + 0x36]
xor byte [rdx + riz + 0x5b], ch
fistp qword [rbx - 0xf]
mov esi, 0xc4f1ed91
cmp al, 0x6d
and byte [rbp + 0x23], ch
ret
cmp byte [0x184d0d1fc], cl
sub dh, bl
sahf
add ah, dh
dec ecx
stosb byte [rdi], al
iretd
ror byte [rsi + 0x6e7ba689], 0xd4
pop rbx
sub byte [r8], 0xcd
xchg esp, eax
invalid
Function at 0x140018f60
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x1400561e0]
xor rax, rsp
mov qword [rsp + 0x40], rax
cmp qword [rcx + 0x18], 0
mov r14, rdx
mov rsi, rcx
je 0x1400190dc
cmp byte [rcx + 0x8c], 0
mov ebp, dword [rdx + 0x10]
je 0x1400190bb
mov edx, dword [rcx + 0x98]
mov ecx, dword [rcx + 0x84]
lea eax, [rdx + rbp]
cmp eax, ecx
jle 0x1400190bb
mov ebx, dword [rsi + 0x88]
cmp ebx, 1
jne 0x14001901a
sub ecx, edx
movsxd rbx, ecx
mov rcx, rbx
call fcn.14001b4b4
mov r8, rbx
mov edx, 0x20
mov rcx, rax
mov rdi, rax
call fcn.14001dc30
mov r9, qword [rsi + 0x18]
mov r8, rbx
mov edx, 1
mov rcx, rdi
call fcn.140025ea4
mov rcx, rdi
call fcn.14001af80
mov rcx, qword [rsi + 0x18]
xor r8d, r8d
xor edx, edx
call fcn.140026e58
and dword [rsi + 0x98], 0
jmp 0x1400190bb
jle 0x1400190bb
mov rcx, rsi
call fcn.14001867c
mov rcx, rsi
call fcn.140018a14
test al, al
je 0x1400190bb
cmp dword [rsi + 0x9c], ebx
jle 0x1400190bb
lea rdi, [rsi + 0xa8]
mov rax, qword [rdi]
mov rbx, qword [rax]
cmp rbx, rax
je 0x1400190bb
and qword [rsp + 0x20], 0
lea rdx, [rbx + 0x28]
and qword [rsp + 0x30], 0
lea rcx, [rsp + 0x20]
and qword [rsp + 0x38], 0
call fcn.140002f10
mov rdx, rbx
mov rcx, rdi
call fcn.1400185c8
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x1400190bb
mov rcx, qword [rsp + 0x20]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400190b6
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400190fe
call fcn.14001af80
cmp qword [r14 + 0x18], 0x10
jb 0x1400190c5
mov r14, qword [r14]
mov r9b, 1
mov r8d, ebp
mov rdx, r14
mov rcx, rsi
call fcn.1400193e8
add dword [rsi + 0x98], ebp
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14001af60
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.140025700
int3

Function at 0x1400193e8
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rax, rdx
movsxd r8, r8d
mov bl, r9b
mov rdi, rcx
mov r9, qword [rcx + 0x18]
mov edx, 1
mov rcx, rax
call fcn.140025ea4
test bl, bl
je 0x14001941c
mov rcx, qword [rdi + 0x18]
call fcn.140026be8
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400194ac
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
lea rdx, [rsp + 0x20]
mov rdi, rcx
call fcn.140019480
mov rbx, qword [rsp + 0x20]
test rbx, rbx
je 0x140019520
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140019520
mov edx, 0x1d4c0
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x140019504
mov eax, dword [rbx + 0x10]
mov edi, 1
mov dword [0x140057fc0], eax
mov edx, edi
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x140019525
mov rcx, rdi
call fcn.14001957c
mov rcx, rax
lea rdx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov edi, dword [rsp + 0x48]
jmp 0x140019525
mov edi, 1
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x14001956f
or eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14001956f
mov rbx, qword [rsp + 0x28]
mov rcx, rbx
mov rax, qword [rbx]
mov rax, qword [rax]
call qword [0x14003e580]
or ecx, 0xffffffff
lock xadd dword [rbx + 0xc], ecx
cmp ecx, 1
jne 0x14001956f
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rcx]
mov rax, qword [rdx + 8]
call qword [0x14003e580]
mov rbx, qword [rsp + 0x40]
mov eax, edi
add rsp, 0x30
pop rdi
ret

Function at 0x1400196ac
Capabilities:
Create thread
Resume thread

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r14
sub rsp, 0x30
mov r9, qword [rcx]
lea r8, [0x140019790]
mov rsi, rdx
mov rdi, rcx
xor edx, edx
xor ecx, ecx
lea rax, [r9 + 0x10]
mov qword [r11 - 0x10], rax
mov dword [rsp + 0x20], 4
call fcn.1400245fc
mov rcx, rax
test rax, rax
je 0x140019767
mov rax, qword [rdi]
mov rdx, rsi
mov qword [rax + 8], rcx
mov rcx, qword [rdi]
add rcx, 0x18
call fcn.140003298
mov rax, qword [rdi]
xor ecx, ecx
mov ebp, dword [rax + 0x10]
lea rax, [0x140057ef0]
cmp dword [rax], 0
je 0x140019734
inc ecx
lea rdx, [0x140058000]
add rax, 0x44
cmp rax, rdx
jl 0x14001971b
jmp 0x140019758
movsxd rax, ecx
lea r14, [0x140057eb0]
imul rbx, rax, 0x44
mov r8, rsi
mov edx, 0x40
lea rcx, [rbx + r14]
call fcn.140026314
mov dword [rbx + r14 + 0x40], ebp
mov rcx, qword [rdi]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov al, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x1415de058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1415de1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1415de089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1415de06f
add dl, dl
jne 0x1415de096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1415de0f6
xor eax, eax
add dl, dl
jne 0x1415de0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1415de1ad
add dl, dl
jne 0x1415de0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1415de0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1415de0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1415de0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1415de0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1415de07e
mov eax, 1
add dl, dl
jne 0x1415de106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1415de113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1415de0fb
sub eax, ebx
mov ebx, 1
jne 0x1415de14c
mov ecx, 1
add dl, dl
jne 0x1415de12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1415de13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1415de123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1415de07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1415de168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1415de175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1415de15d
cmp eax, 0x7d00
jae 0x1415de19b
cmp eax, 0x500
jb 0x1415de196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1415de07e
cmp eax, 0x7f
ja 0x1415de19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1415de07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1415de1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1415de07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x180001290
Capabilities:
Create process on windows
Delete file
Set file attributes
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x1b0
cmp edx, 1
jne 0x1800013c7
lea rbx, str.xxgcus95vxbw.exe
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, [rsp + 0xa0]
call fcn.1800020b0
nop
cmp qword [rsp + 0x128], 0
je 0x18000133d
mov r8d, 0x14ca448
lea rdx, [0x1800070c0]
lea rcx, [rsp + 0xa0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
lea rcx, [rsp + 0xa8]
call fcn.1800024b0
test rax, rax
jne 0x180001321
mov rax, qword [rsp + 0xa0]
movsxd rdx, dword [rax + 4]
lea rcx, [rsp + 0xa0]
add rcx, rdx
xor r8d, r8d
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
mov edx, 6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x18000135d
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
nop
lea rcx, [rsp + 0xa0]
call fcn.1800013e0
xor eax, eax
mov rbx, qword [rsp + 0x1c0]
add rsp, 0x1b0
pop rdi
ret
lea rdi, [rsp + 0x30]
xor eax, eax
mov ecx, 0x70
rep stosb byte [rdi], al
mov qword [rsp + 0x30], 0x70
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x60], eax
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x180001333
mov r9d, 0x1040
lea r8, str.MasonHacks
lea rdx, str.Start_the_game_Escape_from_Tarkov
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
lea rcx, [rsp + 0xa0]
call fcn.1800013e0
mov eax, 1
mov rbx, qword [rsp + 0x1c0]
add rsp, 0x1b0
pop rdi
ret
Function at 0x1800017d0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je case.default.0x1800017f1
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x18000181e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x180001820
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x180001879
test ecx, ecx
jle 0x180001859
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x180001879
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x180001879
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
push rax
xor dword [rbx - 0x18], ecx
ret
Function at 0x1800018a0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x1800018d1
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
je case.default.0x1800018e8
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x30], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x18000190b
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x18000190d
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x180001949
mov qword [rsp + 0x38], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x38]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x1800019de
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x180001984
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x1800019be
nop dword [rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x1800019de
cmp rbx, rax
ja 0x180001990
test rbx, rbx
je 0x1800019de
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
mov rsi, qword [rsp + 0x48]
sub rbp, rbx
mov rbx, qword [rsp + 0x30]
mov rax, rbp
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
push rsi
mov ebx, 0x30d93116
movabs byte [0xc0655da2996985d2], al
pop rax
sub al, 0xc
adc bh, dl
or al, 0xeb
pop rcx
fild word [rbx]
pop rdi
push rdx
jo 0x18000a029
push rbx
mov r14d, 0xce073027
invalid
mov cl, 0x91
cmp eax, 0x595529a6
cmp al, 0x2c
mov esi, dword [rdx]
lahf
or eax, 0xb10f52ef
js 0x18000a05d
xor bh, byte [rbx + 0x34d93116]
ret 0x741f
jg 0x18000a0c6
pop rbx
call [rsi + 0x18]
clc
invalid
Function at 0x180001e40
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x180007040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x180001e6d
xor eax, eax
jmp 0x180001fd9
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x180001ea7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x180001ea7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x180001fd9
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x180001fcc
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x180001eea
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x180001f15
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x180001fd1
lea rax, [rsp + 0x48]
mov byte [rsp + 0x40], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x41]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x180001f84
sub eax, 1
je 0x180001f84
cmp eax, 2
jne 0x180001fcc
movsx ecx, byte [rsp + 0x40]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x180001fd1
mov rsi, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x180001fb2
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x180001fcc
lea rax, [rsp + 0x40]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x50], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x180001fd1
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.180002850
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x1800023c0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x180007040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x180002493
cmp byte [rcx + 0x71], 0
je 0x180002493
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x18000248f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x180002454
sub eax, 1
je 0x180002458
cmp eax, 2
jne 0x18000248f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180002850
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x180002486
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x18000248f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x18000243c
xor al, al
jmp 0x18000243c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180002850
add rsp, 0x60
pop rbx
ret
Function at 0x140006b90
Capabilities:
Execute command

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x140030040]
xor rax, rsp
mov qword [rsp + 0x68], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
lea rdi, [rsp + 0x78]
movabs rcx, 0x7a5db90d33787107
mov qword [r11 - 0x50], rcx
mov qword [r11 - 0x48], rdi
mov rbx, qword [rdi]
mov rax, rbx
xor rax, rcx
mov qword [r11 - 0x58], rax
mov qword [rdi], 0
cmp byte [0x14005a0d8], 0
je 0x140006c1b
movups xmmword [rsp + 0x38], xmm0
lea rax, [rsp + 0x78]
mov qword [r11 - 0x38], rcx
mov qword [r11 - 0x30], rax
mov qword [r11 - 0x40], rcx
movups xmmword [rsp + 0x50], xmm0
lea rax, [rsp + 0x78]
mov qword [r11 - 0x20], rcx
mov qword [r11 - 0x18], rax
mov qword [r11 - 0x28], rcx
call fcn.1400061d0
nop
jmp 0x140006c35
mov byte [0x14005a0d8], 1
call fcn.140006c60
lea rcx, str.REM_nobody_likes_fucking_windows_telemetry__also_your_hard_bans_are_aids_please_dont_do_this_man_i_have_kids_to_feed_:_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
mov qword [rdi], rbx
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140026270
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
Function at 0x1400071e0
Capabilities:
Encode data using xor
Execute command

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rax, qword [0x140030040]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov eax, dword [0x14002b6d0]
lea rdi, [rsp + 0x38]
mov rbx, qword [rdi]
xor ecx, ecx
cmp byte [0x14002b6d3], cl
mov qword [rdi], rcx
mov dword [rsp + 0x20], eax
je 0x1400072c9
cmp dword [0x140030010], 2
jl 0x140007293
movdqa xmm3, xmmword [0x14002c530]
movdqa xmm2, xmm3
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmmword [0x14002c5d0]
punpckldq xmm2, xmm3
pmuldq xmm2, xmmword [0x14002c5d0]
shufps xmm2, xmm0, 0xdd
movdqa xmm0, xmm2
psrld xmm0, 0x1f
paddd xmm0, xmm2
pmulld xmm0, xmmword [0x14002c540]
psubd xmm3, xmm0
movd xmm0, eax
andps xmm3, xmmword [0x14002c5b0]
packuswb xmm3, xmm3
packuswb xmm3, xmm3
paddb xmm3, xmmword [0x14002c600]
xorps xmm3, xmm0
movd dword [rsp + 0x20], xmm3
jmp 0x1400072c9
lea r8, [rsp + 0x20]
nop dword [rax + rax]
mov eax, 0xaaaaaaab
lea r8, [r8 + 1]
mul ecx
shr edx, 2
movzx eax, dl
add al, al
add dl, al
movzx eax, cl
add dl, dl
inc ecx
sub al, dl
add al, 0x63
xor byte [r8 - 1], al
cmp ecx, 4
jl 0x1400072a0
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov qword [rdi], rbx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140026270
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1400072f0
Capabilities:
Encode data using xor
Execute command

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rax, qword [0x140030040]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rax, qword [0x14002a688]
lea rdi, [rsp + 0x38]
mov rbx, qword [rdi]
xor ecx, ecx
cmp byte [str.d8O8F_], cl
mov qword [rdi], rcx
mov qword [rsp + 0x20], rax
je 0x140007449
cmp dword [0x140030010], 2
jl 0x140007411
movdqa xmm2, xmmword [0x14002c530]
movdqa xmm4, xmmword [0x14002c5d0]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x14002c540]
psubd xmm2, xmm0
movd xmm0, dword [rsp + 0x20]
andps xmm2, xmmword [0x14002c5b0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x14002c600]
xorps xmm2, xmm0
movd dword [rsp + 0x20], xmm2
movdqa xmm2, xmmword [0x14002c550]
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x14002c540]
psubd xmm2, xmm0
movd xmm0, dword [rsp + 0x24]
andps xmm2, xmmword [0x14002c5b0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x14002c600]
xorps xmm2, xmm0
movd dword [rsp + 0x24], xmm2
jmp 0x140007449
lea r8, [rsp + 0x20]
nop word [rax + rax]
mov eax, 0xaaaaaaab
lea r8, [r8 + 1]
mul ecx
shr edx, 2
movzx eax, dl
add al, al
add dl, al
movzx eax, cl
add dl, dl
inc ecx
sub al, dl
add al, 0x63
xor byte [r8 - 1], al
cmp ecx, 8
jl 0x140007420
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov qword [rdi], rbx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140026270
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret