joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180153af0
Capabilities:
Encode data using xor

Disassembly:
mov eax, gethostname
call fcn.18009f1d0
sub rsp, rax
cmp dword [rsp + 0x68], 0
je 0x180153b19
lea rax, [0x180152160]
mov qword [rsp + 0x68], rax
add rsp, 0x38
jmp fcn.180126440
lea rax, [0x180151320]
mov qword [rsp + 0x68], rax
add rsp, 0x38
jmp fcn.180126190

Function at 0x180174750
Capabilities:
Encode data using xor

Disassembly:
mov eax, gethostname
call fcn.18009f1d0
sub rsp, rax
mov r10, rdx
mov dword [rsp + 0x40], reloc.WS2_32.dll_recv
add rdx, 0xf
lea rax, [r8 + 0xf]
mov r11, rcx
cmp r10, rax
ja 0x1801747a3
xor ecx, ecx
cmp rdx, r8
jb 0x1801747a3
sub r8, r10
lea rax, [rcx + r10]
mov edx, reloc.WS2_32.dll_recv
sub rdx, rcx
nop
movzx ecx, byte [r8 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x180174790
jmp 0x1801747b6
movdqu xmm1, xmmword [r10]
movdqu xmm0, xmmword [r8]
pxor xmm1, xmm0
movdqu xmmword [r10], xmm1
mov rcx, qword [r11 + 8]
lea r8, [rsp + 0x40]
mov r9, r10
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
mov rdx, r10
call fcn.180108c20
test eax, eax
je 0x1801747e7
cmp dword [rsp + 0x40], 0x10
jne 0x1801747e7
mov eax, 1
add rsp, 0x38
ret
xor eax, eax
add rsp, 0x38
ret

Function at 0x180174990
Capabilities:
Encode data using xor

Disassembly:
mov r10, rcx
test rdx, rdx
je 0x180174a18
test r8, r8
je 0x180174a18
mov rax, qword [rcx + 0x18]
cmp r8, rax
mov r9, rax
cmovb r9, r8
test r9, r9
je 0x1801749d6
add rcx, 0x20
mov r11, rdx
sub r11, r10
nop
movzx eax, byte [r11 + rcx - 0x20]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub r9, 1
jne 0x1801749c0
mov rax, qword [r10 + 0x18]
cmp r8, rax
jbe 0x180174a18
sub r8, rax
cmp r8, 0x10
jbe 0x1801749ec
mov r8d, reloc.WS2_32.dll_recv
jmp 0x1801749f1
test r8, r8
je 0x180174a18
xor ecx, ecx
nop dword [rax]
nop word [rax + rax]
mov rax, qword [r10 + 0x18]
add rax, rcx
movzx eax, byte [rax + rdx]
xor byte [r10 + rcx + 0x40], al
inc rcx
cmp rcx, r8
jb 0x180174a00
ret
Function at 0x1801b1a89
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x1801b1c7a
push rbx
mov eax, 0xd0
call fcn.18009f1d0
sub rsp, rax
mov rax, qword [0x1802a0088]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xe8], rbp
mov rbx, rdx
mov qword [rsp + 0xf0], rsi
lea rbp, [r8 - 1]
mov qword [rsp + 0xf8], rdi
mov qword [rsp + 0xc8], r14
lea r14, [rcx + 0xc]
shr rbp, 3
mov qword [rsp + 0xc0], r15
inc rbp
lea r15, [rcx + 0x14]
nop word [rax + rax]
movzx eax, byte [rbx + 1]
mov rcx, r14
movzx edi, byte [rbx]
movzx esi, byte [rbx + 4]
lea rbx, [rbx + 8]
shl eax, 8
or edi, eax
movzx eax, byte [rbx - 6]
shl eax, 0x10
or edi, eax
movzx eax, byte [rbx - 5]
shl eax, 0x18
or edi, eax
movzx eax, byte [rbx - 3]
shl eax, 8
or esi, eax
mov dword [rsp + 0x20], edi
movzx eax, byte [rbx - 2]
shl eax, 0x10
or esi, eax
mov dword [rsp + 0x28], edi
movzx eax, byte [rbx - 1]
and byte [r14], 0xdf
and byte [r15], 0xbf
or byte [r14], 0x40
or byte [r15], 0x20
shl eax, 0x18
or esi, eax
mov dword [rsp + 0x24], esi
mov dword [rsp + 0x2c], esi
call fcn.1801474f0
lea rdx, [rsp + 0x30]
mov rcx, r14
call fcn.180146e90
mov r8d, 1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x28]
call fcn.180143b10
mov rcx, r15
call fcn.1801474f0
lea rdx, [rsp + 0x30]
mov rcx, r15
call fcn.180146e90
mov r8d, 1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call fcn.180143b10
mov r8d, dword [rsp + 0x20]
mov edx, dword [rsp + 0x24]
xor r8d, edi
xor edi, dword [rsp + 0x28]
xor edx, esi
xor esi, dword [rsp + 0x2c]
mov eax, edi
shr eax, 8
mov byte [r14 + 1], al
mov eax, edi
shr eax, 0x10
mov byte [r14 + 2], al
mov eax, edx
shr eax, 8
mov byte [r14 + 5], al
mov eax, edx
shr eax, 0x10
mov byte [r14 + 6], al
mov eax, r8d
shr eax, 8
mov byte [r15 + 1], al
mov eax, r8d
shr eax, 0x10
mov byte [r14], dil
shr edi, 0x18
mov byte [r14 + 4], dl
shr edx, 0x18
mov byte [r15], r8b
shr r8d, 0x18
mov byte [r15 + 3], r8b
mov byte [r14 + 3], dil
mov byte [r14 + 7], dl
mov byte [r15 + 2], al
mov byte [r15 + 4], sil
mov eax, esi
shr eax, 8
mov byte [r15 + 5], al
mov eax, esi
shr eax, 0x10
shr esi, 0x18
mov byte [r15 + 6], al
mov byte [r15 + 7], sil
sub rbp, 1
jne 0x1801b1af0
mov r15, qword [rsp + 0xc0]
mov r14, qword [rsp + 0xc8]
mov rdi, qword [rsp + 0xf8]
mov rsi, qword [rsp + 0xf0]
mov rbp, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.18009f190
add rsp, 0xd0
pop rbx
ret
Function at 0x1801d2374
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x1801d224b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1801d224b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1801d224b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1801d224b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1801d224b
cmp dword [rcx + 0x84], 0xe
jbe 0x1801d224b
cmp dword [rcx + 0xf8], 0
je 0x1801d224b
mov ecx, ebx
call fcn.1801d22ec
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.1801d20dc
cmp dword [rbp + 0x20], 0
je 0x1801d2298
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1801d22a0
int3
xor r8d, r8d
xor edx, edx
jmp 0x1801d21e4

Function at 0x1801d2ecc
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov rdx, rcx
test rcx, rcx
jne 0x1801d2ea9
call fcn.1801d3b3c
mov dword [rax], socket
call fcn.1801c895c
or eax, 0xffffffff
jmp 0x1801d2ec6
sub dword [rcx + 0x10], 1
jns 0x1801d2eb8
add rsp, 0x28
jmp fcn.1801de528
mov rax, qword [rcx]
movzx ecx, byte [rax]
inc rax
mov qword [rdx], rax
mov eax, ecx
add rsp, 0x28
ret
jmp 0x1801d2e88
Function at 0x140001e90
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
push rdi
sub rsp, 0xa0
mov qword [rax + 8], rbx
mov edx, 2
mov qword [rax + 0x18], rbp
mov edi, 0xc0000022
mov rbp, rcx
mov qword [rax + 0x20], rsi
xor ecx, ecx
mov qword [rax + 0x10], 0
call qword [sym.imp.ole32.dll_CoInitializeEx]
movups xmm0, xmmword [0x140004550]
xor ecx, ecx
cmp dword [0x140006050], 2
mov esi, eax
movups xmm1, xmmword [0x140004560]
mov eax, dword [0x140004598]
movups xmmword [rsp + 0x30], xmm0
movups xmm0, xmmword [0x140004570]
movups xmmword [rsp + 0x50], xmm0
movsd xmm0, qword [0x140004590]
movups xmmword [rsp + 0x40], xmm1
movups xmm1, xmmword [0x140004580]
mov dword [rsp + 0x78], eax
movzx eax, word [0x14000459c]
movsd qword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x60], xmm1
mov word [rsp + 0x7c], ax
jl 0x14000206c
movdqa xmm5, xmmword [0x1400045b0]
lea rdx, [rsp + 0x30]
movdqa xmm4, xmmword [0x140004600]
movaps xmmword [rsp + 0x90], xmm6
movdqa xmm6, xmmword [str.1111]
movaps xmmword [rsp + 0x80], xmm7
movdqa xmm7, xmmword [0x1400045d0]
nop dword [rax]
nop word [rax + rax]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 0x10]
paddd xmm2, xmm5
add ecx, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm7
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rdx - 0x10]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
xorps xmm3, xmm0
movq qword [rdx - 0x10], xmm3
paddd xmm2, xmm5
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm7
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rdx - 8]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
xorps xmm3, xmm0
movq qword [rdx - 8], xmm3
cmp ecx, 0x20
jl 0x140001f70
movaps xmm7, xmmword [rsp + 0x80]
movaps xmm6, xmmword [rsp + 0x90]
cmp ecx, 0x27
jge 0x1400020b1
movsxd rax, ecx
lea r8, [rsp + 0x30]
lea r8, [r8 + rax*2]
nop dword [rax + rax]
mov eax, 0x5397829d
lea r8, [r8 + 2]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul edx, eax, 0x31
movzx eax, cx
inc ecx
sub ax, dx
add ax, 0x37
xor word [r8 - 2], ax
cmp ecx, 0x27
jl 0x140002080
lea r9, [rsp + 0xb8]
lea rcx, [rsp + 0x30]
call fcn.1400011c0
mov rbx, qword [rsp + 0xb8]
test eax, eax
jne 0x1400020fb
test rbx, rbx
je 0x140002109
mov rax, qword [rbx]
xor r9d, r9d
mov dword [rsp + 0x28], 0
xor r8d, r8d
mov rdx, rbp
mov dword [rsp + 0x20], 0
mov rcx, rbx
call qword [rax + 0x48]
sar eax, 0x1f
and edi, eax
test rbx, rbx
je 0x140002109
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + 0x10]
mov rbp, qword [rsp + 0xc0]
test esi, esi
mov rsi, qword [rsp + 0xc8]
mov rbx, qword [rsp + 0xb0]
jne 0x14000212b
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, edi
add rsp, 0xa0
pop rdi
ret
Function at 0x140002140
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x250
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov qword [rsp + 0x28], rcx
lea rdx, [rsp + 0x28]
mov rdi, rcx
mov dword [rsp + 0x28], 0x208
lea rcx, [rsp + 0x30]
xor r14d, r14d
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
xorps xmm0, xmm0
lea rax, [rsp + 0x30]
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], r14
mov rbx, 0xffffffffffffffff
mov qword [rdi + 0x18], r14
nop
inc rbx
cmp word [rax + rbx*2], r14w
jne 0x1400021a0
movabs rbp, 0x7ffffffffffffffe
cmp rbx, rbp
ja 0x1400022d5
mov qword [rsp + 0x278], rsi
cmp rbx, 7
ja 0x1400021f4
mov qword [rdi + 0x10], rbx
lea rdx, [rsp + 0x30]
add rbx, rbx
mov qword [rdi + 0x18], 7
mov r8, rbx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov word [rbx + rdi], r14w
jmp 0x1400022a6
mov rax, rbx
or rax, 7
cmp rax, rbp
jbe 0x140002210
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
jmp 0x140002242
mov ecx, 0xa
mov rbp, rax
cmp rax, rcx
movabs rax, 0x7fffffffffffffff
cmovb rbp, rcx
lea rcx, [rbp + 1]
cmp rcx, rax
ja 0x1400022db
add rcx, rcx
cmp rcx, 0x1000
jb 0x140002271
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400022db
mov rcx, rax
call fcn.1400028a0
test rax, rax
je 0x14000226a
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140002283
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140002280
call fcn.1400028a0
mov rsi, rax
jmp 0x140002283
mov rsi, r14
mov qword [rdi + 0x10], rbx
lea rdx, [rsp + 0x30]
add rbx, rbx
mov qword [rdi], rsi
mov r8, rbx
mov qword [rdi + 0x18], rbp
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov word [rbx + rsi], r14w
mov rsi, qword [rsp + 0x278]
mov rax, rdi
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140002880
mov rbx, qword [rsp + 0x280]
add rsp, 0x250
pop r14
pop rdi
pop rbp
ret
call fcn.1400011a0
int3
call fcn.140001100
int3

Function at 0x140003200
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000324a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000324a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000324a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000324a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000324a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000324c
xor al, al
add rsp, 0x28
ret
Function at 0x14003173c
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd r8, dword [0x14000003c]
lea rsi, [0x140000000]
add r8, rsi
mov rbx, rdx
mov rdi, rcx
cmp dword [r8 + 0x84], 0xd
jbe 0x1400317b4
mov r10d, dword [r8 + 0xf0]
xor r9d, r9d
test r10d, r10d
je 0x1400317b4
movzx ecx, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rcx, 0x18
mov r10d, dword [r10 + rsi + 0xc]
add rcx, r8
test r11d, r11d
je 0x1400317b4
mov eax, dword [rcx + 0xc]
cmp r10d, eax
jb 0x1400317a8
mov edx, dword [rcx + 8]
add eax, edx
cmp r10d, eax
jb 0x1400317c6
inc r9d
add rcx, 0x28
cmp r9d, r11d
jb 0x140031796
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov dword [rdi], edx
mov eax, dword [rcx + 0x24]
mov dword [rbx], eax
mov eax, dword [rcx + 0xc]
add rax, rsi
jmp 0x1400317b6

Function at 0x140033300
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14003334a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14003334a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14003334a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14003334a
cmp dword [rcx + 0x84], 0xe
jbe 0x14003334a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14003334c
xor al, al
add rsp, 0x28
ret

Function at 0x14003c094
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14003bdf8

Function at 0x140045fb0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140045fd8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140045fd8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x100403a20
Capabilities:
Encode data using xor

Disassembly:
xor al, 0x6c
xor al, 0x64
xor al, 0x67
xor al, 0x41
xor al, 0x3e
xor al, 0x7d
xor al, 0xa2
xor al, 0x9a
xor al, 0xa3
xor al, 0x88
xor al, 0x9d
xor al, 0xa4
xor al, 0x71
xor al, 0x74
xor al, 0x59
xor al, 0x87
xchg dword [rbp*4 - 0x57cb58cc], esi
xor al, 0x99
xor al, 0xa1
xor al, 0x86
xor al, 0xa3
xor al, 0xa3
movabs dword [0xa73490345934a834], eax
xor al, 0xad
xor al, 0xa7
xor al, 0xa8
xor al, 0x99
cdq
xor al, 0xa1
xor al, 0x67
xor al, 0x66
xor al, 0x90
xor al, 0xa7
xor al, 0x9c
xor al, 0x99
xor al, 0xa0
xor al, 0xa0
xor al, 0x67
xor al, 0x66
xor al, 0x62
Function at 0x140001210
Capabilities:
Create directory

Disassembly:
mov rax, qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, 0x65
call rax
lea rcx, str.:
mov rax, qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
xor edx, edx
call rax
mov rcx, qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x2c], eax
call rcx
sub eax, 3
sbb r8d, r8d
and r8d, 1
mov dword [rsp + 0x28], eax
mov eax, r8d
add rsp, 0x58
ret
mov ecx, eax
mov eax, dword [rsp + 0x38]
add eax, 0x5008bf9e
mov dword [rsp + 0x54], eax
mov qword [rsp + 0x40], 0x29ed8b53
mov rdx, qword [rsp + 0x30]
mov qword [rsp + 0x20], rcx
mov rcx, rdx
shl rdx, cl
mov qword [rsp + 0x48], rdx
mov rdx, qword [rsp + 0x40]
sub rdx, 0x67b8bbca
mov eax, dword [rsp + 0x38]
and eax, 0x4169a3e1
mov dword [rsp + 0x54], eax
mov r8, qword [rsp + 0x20]
cmp r8, rdx
ja 0x1400011b9
jmp 0x1400011b9

Function at 0x140001270
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
add byte [r8], r8b

Function at 0x140001278
Capabilities:
Terminate process

Disassembly:
add byte [r8], r8b
call rax
cmp eax, 4
jae 0x140001292
mov rax, qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 0xfffffffe
call rax
ud2
add rsp, 0x28
ret

Function at 0x1400012a0
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x2a8
add byte [rcx], dh
ror byte [rcx - 0x6b72b73f], 0x24
add byte [rax], 0
add byte [rbp + rcx*4 + 0x44], cl
and al, 0x7c

Function at 0x1400012a8
Capabilities:
Terminate process

Disassembly:
add byte [rcx], dh
ror byte [rcx - 0x6b72b73f], 0x24
add byte [rax], 0
add byte [rbp + rcx*4 + 0x44], cl
and al, 0x7c
mov dword [rsp + 0x2a4], 0x5610dee9
mov qword [rsp + 0x288], 0x943ca17
mov r9, rdx
mov dword [rsp + 0x7c], 0xffffffff
mov r10, qword [rsp + 0x298]
mov qword [rsp + 0x298], 0x2921e42d
mov r11, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor eax, eax
mov esi, eax
mov qword [rsp + 0x70], rcx
mov rcx, rsi
mov qword [rsp + 0x68], r10
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x58], r9
mov qword [rsp + 0x50], r8
and al, 0x50

Function at 0x140001314
Capabilities:
Terminate process

Disassembly:
and al, 0x50
call r11
mov edi, 0x200
mov rcx, qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov r8d, 0x200
mov qword [rsp + 0x48], rcx
mov rcx, rax
mov rdx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x48]
mov dword [rsp + 0x44], edi
call rax
lea rcx, [rsp + 0x7c]
mov rdx, qword [sym.imp.KERNEL32.dll_GetBinaryTypeW]
lea r9, [rsp + 0x7c]
mov r10, qword [rsp + 0x60]
and al, 0x60
mov qword [rsp + 0x38], rcx

Function at 0x140001358
Capabilities:
Terminate process

Disassembly:
and al, 0x50
call r11
mov edi, 0x200
mov rcx, qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov r8d, 0x200
mov qword [rsp + 0x48], rcx
mov rcx, rax
mov rdx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x48]
mov dword [rsp + 0x44], edi
call rax
lea rcx, [rsp + 0x7c]
mov rdx, qword [sym.imp.KERNEL32.dll_GetBinaryTypeW]
lea r9, [rsp + 0x7c]
mov r10, qword [rsp + 0x60]
and al, 0x60
mov qword [rsp + 0x38], rcx

Function at 0x1400013e8
Capabilities:
Terminate process

Disassembly:
add byte [rcx + 7], bh
call rax
ud2
Function at 0x1400037f0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x80
xor eax, eax
mov dword [rsp + 0x6c], 0x6669cab2
mov r9d, dword [rsp + 0x6c]
xor r9d, 0x6669cab2
mov r10d, r8d
xor r10d, 0xffffffff
mov dword [rsp + 0x7c], r10d
cmp r8d, r9d
mov qword [rsp + 0x60], rdx
mov dword [rsp + 0x5c], r8d
mov qword [rsp + 0x50], rcx
mov dword [rsp + 0x4c], eax
je 0x1400038a4
mov eax, dword [rsp + 0x4c]
lea rcx, [0x1400252c0]
mov edx, eax
and edx, 0xf
mov edx, edx
mov r8d, edx
mov edx, dword [rsp + 0x6c]
xor edx, 0x6669cab3
mov r9, qword [rsp + 0x50]
mov qword [rsp + 0x40], rcx
mov rcx, r9
mov r10, qword [rsp + 0x60]
mov dword [rsp + 0x3c], edx
mov rdx, r10
mov qword [rsp + 0x30], r8
mov r8d, eax
mov r11, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x30]
movzx r9d, byte [r11 + rsi]
mov dword [rsp + 0x2c], eax
call fcn.1400010e0
mov eax, dword [rsp + 0x2c]
mov r8d, dword [rsp + 0x3c]
add eax, r8d
mov r8d, dword [rsp + 0x5c]
cmp eax, r8d
mov dword [rsp + 0x4c], eax
jne 0x140003832
add rsp, 0x80
pop rsi
ret

Function at 0x140003980
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x48
mov eax, 0x173a69d7
mov edx, 0x4223d576
mov dword [rsp + 0x3c], 0x25b1be8b
sub edx, dword [rsp + 0x3c]
mov dword [rsp + 0x38], edx
mov edx, dword [rsp + 0x38]
add edx, 0x496e9615
mov r8d, dword [rcx + 0x3c]
mov qword [rsp + 0x40], 0x3a880ee1
movsxd r9, r8d
mov r10, rcx
add r10, r9
mov r8d, dword [rcx + r9]
cmp eax, edx
mov qword [rsp + 0x30], r10
mov dword [rsp + 0x2c], r8d
jae 0x1400039f3
xor eax, eax
mov ecx, dword [rsp + 0x2c]
sub ecx, 0x4550
mov edx, eax
mov r8, qword [rsp + 0x30]
cmove rdx, r8
mov rax, rdx
mov dword [rsp + 0x28], ecx
add rsp, 0x48
ret
mov rax, qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 0x3a59ad19
call rax
xor ecx, ecx
mov eax, ecx
add rsp, 0x48
ret
Function at 0x1400024d0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov rax, qword [0x14000b040]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp dword [0x14000ba00], 0
je 0x1400026bf
cmp qword [0x14000ba08], 0
je 0x1400026bf
cmp qword [0x14000ba10], 0
jbe 0x1400026bf
call fcn.1400022b0
test al, al
je 0x1400026bf
movzx eax, byte [0x14000ba18]
mov qword [rsp + 0x30], rbx
xor ebx, ebx
mov dword [rsp + 0x20], ebx
test al, al
je 0x140002538
cmp dword [0x14000ba00], 2
jne 0x14000256c
mov rdx, qword [0x14000ba10]
lea r9, [0x14000ba20]
mov rcx, qword [0x14000ba08]
mov r8d, 4
call qword [section..rdata]
lea rcx, str.____Flipped_to_RW.
call fcn.140003b50
movzx eax, byte [0x14000ba18]
test al, al
lea rdx, str.____Decoding...
lea rcx, str.____Encoding...
cmovne rcx, rdx
call fcn.140003b50
mov edx, dword [0x14000ba1c]
mov r9, qword [0x14000ba10]
mov rcx, qword [0x14000ba08]
mov rax, r9
shr rax, 2
movd xmm2, edx
pshufd xmm2, xmm2, 0
test rax, rax
je 0x14000262b
cmp rax, 0x10
jb 0x140002620
mov r10, rax
lea r8, [rcx + 0x20]
and r10, 0xfffffffffffffff0
nop
movdqu xmm0, xmmword [r8 - 0x20]
lea r8, [r8 + 0x40]
add rbx, 0x10
movdqa xmm1, xmm2
xorps xmm0, xmm2
movdqu xmmword [r8 - 0x60], xmm0
movdqu xmm0, xmmword [r8 - 0x50]
xorps xmm1, xmm0
movdqu xmmword [r8 - 0x50], xmm1
movdqa xmm1, xmm2
movdqu xmm0, xmmword [r8 - 0x40]
xorps xmm1, xmm0
movdqu xmmword [r8 - 0x40], xmm1
movdqu xmm0, xmmword [r8 - 0x30]
xorps xmm0, xmm2
movdqu xmmword [r8 - 0x30], xmm0
cmp rbx, r10
jb 0x1400025c0
cmp rbx, rax
jae 0x14000262b
nop word [rax + rax]
xor dword [rcx + rbx*4], edx
inc rbx
cmp rbx, rax
jb 0x140002620
mov rbx, qword [rsp + 0x30]
lea rax, [rax*4]
cmp rax, r9
jae 0x14000264b
nop dword [rax]
xor byte [rcx + rax], dl
inc rax
cmp rax, r9
jb 0x140002640
cmp byte [0x14000ba18], 0
jne 0x140002685
cmp dword [0x14000ba00], 2
jne 0x1400026b1
mov rdx, qword [0x14000ba10]
lea r9, [rsp + 0x20]
mov rcx, qword [0x14000ba08]
mov r8d, 1
call qword [section..rdata]
lea rcx, str.____Flipped_to_No_Access._n
jmp 0x1400026ac
mov r8d, dword [0x14000ba20]
lea r9, [rsp + 0x20]
mov rdx, qword [0x14000ba10]
mov rcx, qword [0x14000ba08]
call qword [section..rdata]
lea rcx, str.____Flipped_back_to_RX_RWX._n
call fcn.140003b50
cmp byte [0x14000ba18], 0
sete byte [0x14000ba18]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140005330
add rsp, 0x38
ret

Function at 0x140005ed8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [0x1400070d0]
test rax, rax
je 0x140005f22
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140005f22
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140005f22
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140005f22
cmp dword [rcx + 0x84], 0xe
jbe 0x140005f22
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140005f24
xor al, al
add rsp, 0x28
ret
Function at 0x140003d80
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je case.default.0x140003da1
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x140003dce
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140003dd0
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140003e29
test ecx, ecx
jle 0x140003e09
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140003e29
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140003e29
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
pop rdi
mov ecx, 0x6bb3c13a
add eax, 0x409a5026
ror dword [rbp + 0x4fd5a33a], cl
pop rsi
or byte [rdx], 0xff
mov esp, 0x1775bb14
wait
stosb byte [rdi], al
invalid
sub qword [r15 + 0x32120476], rbx
add ah, byte [rcx - 0x10]
mov bl, 0xfa
ret
in eax, dx
jl 0x140016723
jo 0x1400166c8
and al, 0x4f
invalid