joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1402a6b90
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
push r12
push r15
sub rsp, 0x20
xor edi, edi
mov r12, r8
mov r15, rdx
mov rbx, rcx
cmp dword [rcx + 0x40], edi
jne 0x1402a6bcc
cmp qword [rcx + 0x20], rdi
jne 0x1402a6bcc
mov r9, qword [rcx + 0x10]
lea rdx, str.SELECT_data_FROM__Q._q_node_WHERE_nodeno_
mov r8, qword [rcx + 8]
call fcn.1402a71c0
mov qword [rbx + 0x20], rax
cmp dword [rbx + 0x40], edi
jne 0x1402a6d1a
mov rcx, qword [rbx + 0x20]
mov r8, r15
mov edx, 1
call fcn.140227ce0
mov rcx, qword [rbx + 0x20]
call fcn.140228410
cmp eax, 0x64
jne 0x1402a6cea
mov rcx, qword [rbx + 0x20]
xor edx, edx
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x40], rbp
call fcn.140228ea0
mov rsi, qword [rbx + 0x20]
movsxd r14, eax
test rsi, rsi
jne 0x1402a6c2f
lea rcx, [0x140350330]
call fcn.1401fc1b0
mov rbp, rax
jmp 0x1402a6ca7
mov rax, qword [rsi]
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x1402a6c41
call qword [0x14046b0b0]
mov rcx, qword [rsi + 0xa0]
test rcx, rcx
je 0x1402a6c56
cmp di, word [rsi + 0xc0]
jb 0x1402a6c71
mov rcx, qword [rsi]
mov edx, 0x19
mov dword [rcx + 0x50], 0x19
call fcn.1402c0010
lea rcx, [0x140350330]
call fcn.1401fc1b0
mov rcx, qword [rsi]
mov rbp, rax
mov edx, dword [rsi + 0x34]
cmp byte [rcx + 0x67], dil
jne 0x1402a6c8d
test edx, edx
jne 0x1402a6c8d
mov eax, edi
jmp 0x1402a6c92
call fcn.14022e8e0
mov dword [rsi + 0x34], eax
mov rax, qword [rsi]
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x1402a6ca7
call qword [0x14046b0c0]
call fcn.140319ef0
test eax, eax
jne 0x1402a6cc0
mov rcx, r14
call fcn.1402e5070
mov rdi, rax
test rax, rax
jne 0x1402a6cc9
mov dword [rbx + 0x40], 7
jmp 0x1402a6cdb
mov r8, r14
mov rdx, rbp
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov dword [r12], r14d
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov r14, qword [rsp + 0x50]
mov rcx, qword [rbx + 0x20]
call fcn.1402296c0
mov ecx, dword [rbx + 0x40]
test ecx, ecx
jne 0x1402a6d1a
mov dword [rbx + 0x40], eax
mov ecx, eax
test eax, eax
jne 0x1402a6d1a
test rdi, rdi
jne 0x1402a6d1a
mov r8, r15
lea rdx, str.Node__lld_missing_from_database
mov rcx, rbx
call fcn.1402a6b10
mov rbx, qword [rsp + 0x58]
mov rax, rdi
add rsp, 0x20
pop r15
pop r12
pop rdi
ret
Function at 0x1402a6d30
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x50
lea rax, str.SELECT_parentnode_FROM__Q._q_parent_WHERE_nodeno_1
movsxd r15, edx
mov rdi, qword [rcx + r15*8 + 0x28]
lea r14, [rcx + r15*8]
mov qword [rsp + 0x40], rax
lea rax, str.SELECT_nodeno_FROM__Q._q_rowid_WHERE_rowid_1
mov qword [rsp + 0x48], rax
mov rbp, r9
mov rsi, r8
mov rbx, rcx
test rdi, rdi
jne 0x1402a6d93
mov r9, qword [rcx + 0x10]
mov r8, qword [rcx + 8]
mov rdx, qword [rsp + r15*8 + 0x40]
call fcn.1402a71c0
mov rdi, rax
mov qword [r14 + 0x28], rax
cmp dword [rbx + 0x40], 0
jne 0x1402a6e49
mov r8, rsi
mov edx, 1
mov rcx, rdi
call fcn.140227ce0
mov rcx, rdi
call fcn.140228410
cmp eax, 0x65
jne 0x1402a6deb
test r15d, r15d
lea rcx, str.__rowid
lea rax, str.__parent
mov r9, rbp
cmovne rax, rcx
lea rdx, str.Mapping___lld_____lld__missing_from__s_table
mov rcx, rbx
mov qword [rsp + 0x20], rax
mov r8, rsi
call fcn.1402a6b10
jmp 0x1402a6e38
cmp eax, 0x64
jne 0x1402a6e38
xor edx, edx
mov rcx, rdi
call fcn.140228ad0
mov r9, rax
cmp rax, rbp
je 0x1402a6e38
test r15d, r15d
mov qword [rsp + 0x30], rbp
lea rcx, str.__rowid
mov qword [rsp + 0x28], rsi
lea rax, str.__parent
mov r8, rsi
cmovne rax, rcx
lea rdx, str.Found___lld_____lld__in__s_table__expected___lld_____lld_
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.1402a6b10
mov rcx, rdi
call fcn.1402296c0
cmp dword [rbx + 0x40], 0
jne 0x1402a6e49
mov dword [rbx + 0x40], eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop r14
pop rdi
ret
Function at 0x1402c7b30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
push rsi
push rdi
push r14
sub rsp, 0x28
xor r11d, r11d
mov rdi, r8
mov ebx, r11d
mov r14, rdx
mov rsi, rcx
cmp dword [rcx + 0x28], ebx
jle 0x1402c7c39
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], r12
lea r12, [0x140355900]
mov qword [rsp + 0x20], r15
lea r15, [0x14034f200]
nop
mov rax, qword [rsi + 0x20]
mov r10d, ebx
xor r10d, 1
cmp ebx, 2
cmovge r10d, ebx
movsxd rcx, r10d
shl rcx, 5
mov rbp, qword [rcx + rax + 0x18]
test rdi, rdi
je 0x1402c7bb1
mov r8, qword [rcx + rax]
mov r9, rdi
sub r9, r8
nop dword [rax]
movzx ecx, byte [r8]
movzx eax, byte [r9 + r8]
cmp ecx, eax
jne 0x1402c7bec
test ecx, ecx
jne 0x1402c7bfa
lea rcx, [rbp + 0x20]
xor r8d, r8d
mov rdx, r14
call fcn.140243e90
mov r11, qword [rax + 0x10]
test r11, r11
jne 0x1402c7bd0
inc ebx
cmp ebx, dword [rsi + 0x28]
jl 0x1402c7b70
mov r12, qword [rsp + 0x60]
mov rax, r11
mov rbp, qword [rsp + 0x58]
mov r15, qword [rsp + 0x20]
add rsp, 0x28
pop r14
pop rdi
pop rsi
pop rbx
ret
movzx edx, byte [rax + r15]
movzx ecx, byte [rcx + r15]
cmp ecx, edx
jne 0x1402c7bff
inc r8
jmp 0x1402c7ba0
test r10d, r10d
jne 0x1402c7bc9
mov r9, rdi
mov rax, r12
sub r9, r12
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [r9 + rax]
cmp edx, ecx
jne 0x1402c7c25
test edx, edx
je 0x1402c7bb1
inc rax
jmp 0x1402c7c10
movzx r8d, byte [rcx + r15]
movzx edx, byte [rdx + r15]
cmp edx, r8d
jne 0x1402c7bc9
inc rax
jmp 0x1402c7c10
mov rax, r11
add rsp, 0x28
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x1402d6260
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r14
sub rsp, 0x20
xor r14d, r14d
mov rbx, rcx
mov edi, r14d
mov qword [rsp + 0x48], r14
cmp dword [rcx + 0x20], r14d
jne 0x1402d6287
cmp dword [rcx + 0x34], r14d
je 0x1402d62a3
call fcn.14026d410
cmp dword [rbx + 0x3c], r14d
jne 0x1402d62a3
mov rcx, qword [rbx + 0x18]
call fcn.1402d42a0
mov dword [rbx + 0x20], r14d
mov qword [rbx + 0x34], r14
cmp qword [rbx + 0x90], r14
jne 0x1402d62d0
mov rcx, rbx
call fcn.14026f130
mov qword [rbx + 0x88], rax
cmp dword [rbx + 0x3c], r14d
jne 0x1402d62d6
mov rcx, rbx
call fcn.1402815f0
mov qword [rbx + 0x90], rax
cmp dword [rbx + 0x3c], r14d
je 0x1402d62db
mov rsi, r14
jmp 0x1402d62eb
mov rax, qword [rbx + 0x90]
inc dword [rax]
mov rsi, qword [rbx + 0x90]
mov rcx, qword [rbx + 0x90]
test rcx, rcx
je 0x1402d6303
call fcn.1402817f0
mov qword [rbx + 0x90], r14
test rsi, rsi
je 0x1402d631b
mov rdx, rsi
mov rcx, rbx
call fcn.140272370
mov rdi, rax
mov qword [rsp + 0x48], rax
mov rcx, rsi
call fcn.1402817f0
test rdi, rdi
je 0x1402d6398
mov esi, r14d
cmp dword [rdi + 0x24], r14d
jne 0x1402d6340
lea rax, [rdi + 0x24]
inc esi
lea rax, [rax + 0x10]
cmp dword [rax], r14d
je 0x1402d6335
cmp dword [rbx + 0x3c], r14d
jne 0x1402d6385
mov qword [rsp + 0x50], rbp
movsxd rbp, esi
add rbp, rbp
cmp dword [rdi + rbp*8 + 0x24], r14d
jle 0x1402d6380
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], 0x3e8
mov r8d, esi
lea rdx, [rsp + 0x48]
mov rcx, rbx
call fcn.140271260
mov rdi, qword [rsp + 0x48]
cmp dword [rbx + 0x3c], r14d
je 0x1402d6351
mov rbp, qword [rsp + 0x50]
mov rdx, rdi
mov rcx, rbx
call fcn.140281920
mov rcx, rdi
call fcn.1402817f0
mov eax, dword [rbx + 0x3c]
mov dword [rbx + 0x3c], r14d
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x1402db480
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x20
mov r15, qword [rsp + 0x70]
xor r13d, r13d
movsxd rdi, r9d
mov r14d, edx
mov rsi, r8
mov rdx, rcx
mov r9d, r14d
mov dword [r15], r13d
test rcx, rcx
je 0x1402db5c3
lea eax, [rdi - 1]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], r12
lea r10d, [r13 + 0xd]
movsxd r8, eax
test eax, eax
js 0x1402db4e8
nop dword [rax + rax]
movsx ecx, byte [r8 + rsi]
lea eax, [r10*8]
xor ecx, eax
xor r10d, ecx
sub r8, 1
jns 0x1402db4d0
lea ecx, [r10*8]
mov eax, r10d
xor rcx, r9
xor rcx, rax
and ecx, 0x1ff
mov rbx, qword [rdx + rcx*8]
lea r12, [rdx + rcx*8]
test rbx, rbx
je 0x1402db536
nop dword [rax]
cmp dword [rbx + 0xc], r14d
jne 0x1402db52d
cmp dword [rbx + 8], edi
jne 0x1402db52d
mov rcx, qword [rbx]
mov r8, rdi
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1402db5a9
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x1402db510
mov qword [rsp + 0x58], rbp
lea rbp, [rdi + 0x18]
call fcn.140319ef0
test eax, eax
jne 0x1402db5b5
mov rcx, rbp
call fcn.1402e5070
mov rbx, rax
test rax, rax
je 0x1402db5b5
mov r8, rbp
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbx + 0x18]
mov dword [rbx + 8], edi
mov r8, rdi
mov qword [rbx], rcx
mov rdx, rsi
mov dword [rbx + 0xc], r14d
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [r12]
mov eax, r13d
mov qword [rbx + 0x10], rcx
mov qword [r12], rbx
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov r12, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret
mov dword [r15], 1
mov eax, r13d
jmp 0x1402db592
test rbp, rbp
mov eax, 7
cmovle eax, r13d
jmp 0x1402db58d
mov eax, r13d
add rsp, 0x20
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret

Function at 0x1402dbba0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rdi
sub rsp, 0x20
mov edi, edx
cmp ecx, 0x80
jge 0x1402dbbc2
lea edx, [rcx - 0x41]
cmp edx, 0x19
lea eax, [rcx + 0x20]
cmova eax, ecx
add rsp, 0x20
pop rdi
ret
cmp ecx, 0x10000
jge 0x1402dbc87
xor r10d, r10d
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rsi
mov r9d, 0xa2
mov r11d, r10d
lea rsi, [0x140000000]
lea ebx, [r10 - 1]
nop
lea eax, [r11 + r9]
mov r8d, ecx
cdq
sub eax, edx
sar eax, 1
movsxd rdx, eax
movzx edx, word [rsi + rdx*4 + 0x34e740]
sub r8d, edx
mov edx, eax
cmovs edx, ebx
test r8d, r8d
movsxd rbx, edx
lea edx, [rax + 1]
cmovs edx, r11d
dec eax
test r8d, r8d
mov r11d, edx
cmovs r9d, eax
cmp r9d, edx
jge 0x1402dbbf0
lea r8, [rbx*4 + 0x34e740]
mov rbx, qword [rsp + 0x30]
movzx edx, word [r8 + rsi]
movzx eax, byte [r8 + rsi + 3]
add eax, edx
cmp ecx, eax
jge 0x1402dbc6a
movzx eax, byte [r8 + rsi + 2]
xor edx, ecx
and edx, eax
test dl, 1
jne 0x1402dbc6a
shr rax, 1
movzx eax, word [rsi + rax*2 + 0x34e9d0]
add eax, ecx
movzx ecx, ax
mov rsi, qword [rsp + 0x38]
test edi, edi
je 0x1402dbc95
cmp edi, 2
sete r10b
mov edx, r10d
add rsp, 0x20
pop rdi
jmp fcn.140285010
lea eax, [rcx - 0x10400]
cmp eax, 0x27
lea eax, [rcx + 0x28]
jbe 0x1402dbc97
mov eax, ecx
add rsp, 0x20
pop rdi
ret
Function at 0x1403225d0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push r14
push r15
sub rsp, 0x30
mov r14, rcx
mov qword [rcx], 0
mov ecx, 0x28
mov rbp, r8
mov r15, rdx
call fcn.1402e5070
mov rbx, rax
test rax, rax
jne 0x140322612
lea eax, [rbx + 7]
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rbp
ret
cmp byte [0x14046b034], 0
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rdi
je 0x140322677
mov rax, qword [0x14046b1c0]
test rax, rax
je 0x14032263c
mov ecx, 0xc8
call rax
test eax, eax
jne 0x140322677
lea rsi, [rbx + 8]
mov qword [rbx + 0x10], r15
lea rdi, [rbx + 0x10]
mov qword [rsp + 0x28], rsi
mov r9, rbx
mov dword [rsp + 0x20], 0
lea r8, [0x1402f9c30]
mov qword [rbx + 0x18], rbp
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
jne 0x14032268f
jmp 0x14032267f
lea rdi, [rbx + 0x10]
lea rsi, [rbx + 8]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
mov qword [rbx + 0x20], rax
cmp qword [rdi], 0
mov rdi, qword [rsp + 0x58]
jne 0x1403226ac
call qword [sym.imp.kernel32.dll_GetCurrentThreadId]
mov rcx, rbp
mov dword [rsi], eax
call r15
mov qword [rbx + 0x20], rax
mov rsi, qword [rsp + 0x50]
xor eax, eax
mov qword [r14], rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rbp
ret
Function at 0x140339dec
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
test rax, rax
je 0x140339e36
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140339e36
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140339e36
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140339e36
cmp dword [rcx + 0x84], 0xe
jbe 0x140339e36
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140339e38
xor al, al
add rsp, 0x28
ret
Function at 0x1403445f0
Capabilities:
Resolve dns

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov ebp, r9d
mov rsi, rcx
lea rcx, [rsp + 0x30]
call fcn.1401ecdf0
mov rdx, qword [rsp + 0x30]
movabs rax, 0x8000000000000000
cmp rdx, rax
jne 0x140344689
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x58], 1
mov qword [rsp + 0x28], 0
lea r8, [rsp + 0x50]
lea r9, [rsp + 0x28]
mov rcx, rdi
xor edx, edx
call qword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x1403446bb
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
mov byte [rdi], 0
test rbx, rbx
jne 0x1403446d9
jmp 0x1403446ea
lea rax, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
test rdx, rdx
je 0x1403446ea
mov rcx, qword [rsp + 0x38]
mov r8d, 1
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
jmp fcn.140020a10
mov rax, qword [rsp + 0x28]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], bp
xor eax, eax
mov qword [rsi], rax
mov byte [rdi], 0
test rbx, rbx
je 0x1403446ea
mov r8d, 1
mov rcx, rdi
mov rdx, rbx
call fcn.140020a10
nop
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x1800020b0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je case.default.0x1800020d1
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x1800020fe
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x180002100
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x180002159
test ecx, ecx
jle 0x180002139
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x180002159
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x180002159
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
mov eax, 0x1340c0ff
and ah, byte [rsp + rsi]
nop
adc eax, 0x700215a0
adc eax, 0xef0215f0
adc eax, 0x13260201
mov eax, 0x9b3c0ff
or al, 0x34
adc edi, dword [rax + 0xc40c0ff]
and byte [rsp + rsi], ah
movabs al, byte [0x143c130113f00113]
adc ah, dh
jno 0x1801081c4
sub ebp, dword [rbx]
in eax, dx
pop rbp
jno 0x1801081ca
sub edx, dword [rax]
div byte [rcx + 0x72]
jno 0x1801081cf
sub ebp, dword [rbx]
in eax, dx
add byte [rdi], bh
cmp al, 0x3f
in eax, dx
xor dword [rax], esi
add byte [rbp + 0x71], bl
adc esp, dword [rcx]
adc dword [rsi + rdx], edx
xor esi, dword [rdx]
xor eax, 0x14112111
invalid
jbe 0x18010811d
mov al, 2
and dh, bh
or eax, 0x8e88edd6
in al, dx
rol dword [rax], 1
add byte [rcx], al
add byte [rcx], dl
invalid
or byte [0x188b58474], al
invalid
Function at 0x180002180
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x1800021b1
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
je case.default.0x1800021c8
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x30], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x1800021eb
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1800021ed
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x180002229
mov qword [rsp + 0x38], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x38]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x1800022be
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x180002264
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x18000229e
nop dword [rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x1800022be
cmp rbx, rax
ja 0x180002270
test rbx, rbx
je 0x1800022be
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
mov rsi, qword [rsp + 0x48]
sub rbp, rbx
mov rbx, qword [rsp + 0x30]
mov rax, rbp
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x180003160
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x60
cmp byte [0x180095f27], 0
mov rbx, rcx
movups xmm0, xmmword [0x180095f10]
movups xmmword [rsp + 0x30], xmm0
movsd xmm0, qword [0x180095f20]
movsd qword [rsp + 0x40], xmm0
je 0x180003321
xor r8d, r8d
cmp dword [0x1800a1010], 2
jl 0x1800032e8
movdqa xmm0, xmmword [str.1111111111111111]
lea rcx, [rsp + 0x34]
movdqa xmm5, xmmword [0x180097460]
movdqa xmm4, xmmword [0x180097950]
movdqa xmmword [rsp + 0x20], xmm0
mov edx, dword [rsp + 0x20]
movaps xmmword [rsp + 0x50], xmm6
movdqa xmm6, xmmword [0x1800974b0]
nop dword [rax]
nop dword [rax + rax]
movd xmm2, r8d
lea eax, [r8 + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add r8d, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x1800974d0]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 0xc]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rcx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, edx
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1800974d0]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rcx - 8]
xorps xmm2, xmm0
movd dword [rcx - 8], xmm2
cmp r8d, 0x18
jl 0x1800031e0
movaps xmm6, xmmword [rsp + 0x50]
jmp 0x180003321
lea r9, [rsp + 0x30]
nop dword [rax]
mov eax, 0x4d4873ed
lea r9, [r9 + 1]
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x35
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9 - 1], al
cmp r8d, 0x18
jl 0x1800032f0
mov rcx, qword [0x1801bb580]
lea rdx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov rcx, rbx
call rax
add rsp, 0x60
pop rbx
ret
Function at 0x180003340
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x60
movups xmm0, xmmword [0x180095b80]
mov eax, dword [0x180095b98]
xor r8d, r8d
cmp dword [0x1800a1010], 2
mov rbx, rcx
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x48], eax
movsd xmm0, qword [0x180095b90]
movzx eax, byte [0x180095b9c]
movsd qword [rsp + 0x40], xmm0
mov qword [rsp + 0x78], r8
mov byte [rsp + 0x4c], al
jl 0x1800034cf
movdqa xmm0, xmmword [str.1111111111111111]
lea rcx, [rsp + 0x34]
movdqa xmm5, xmmword [0x180097460]
movdqa xmm4, xmmword [0x180097950]
movdqa xmmword [rsp + 0x20], xmm0
mov edx, dword [rsp + 0x20]
movaps xmmword [rsp + 0x50], xmm6
movdqa xmm6, xmmword [0x1800974b0]
movd xmm2, r8d
lea eax, [r8 + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add r8d, 8
pmuldq xmm1, xmm4
mov eax, r8d
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x1800974d0]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 0xc]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rcx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, edx
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1800974d0]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rcx - 8]
xorps xmm2, xmm0
movd dword [rcx - 8], xmm2
cmp r8d, 0x18
jl 0x1800033c1
movaps xmm6, xmmword [rsp + 0x50]
cmp eax, 0x1d
jge 0x180003511
movsxd rax, r8d
lea r9, [rsp + 0x30]
add r9, rax
nop word [rax + rax]
mov eax, 0x4d4873ed
lea r9, [r9 + 1]
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x35
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9 - 1], al
cmp r8d, 0x1d
jl 0x1800034e0
mov rcx, qword [0x1801bb580]
lea rdx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
lea rdx, [rsp + 0x78]
mov rcx, rbx
call rax
add rsp, 0x60
pop rbx
ret