joyce8/EMBER2024-capa huggingface dataset:
Function at 0xa18ca0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0xa18cad
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0xa18cbd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0xa18ca5
lea eax, [rcx + 1]
jmp 0xa18ccb
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0xa18cde
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0xa18cc4
sub eax, 3
jb 0xa18cfe
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0xa18d4d
sar eax, 1
movsxd rbp, eax
jb 0xa18d34
jmp 0xa18d0c
add ebx, ebx
jne 0xa18d0a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0xa18d34
inc ecx
add ebx, ebx
jne 0xa18d1a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0xa18d34
call r11
adc ecx, ecx
add ebx, ebx
jne 0xa18d2d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0xa18d1c
add ecx, 2
jmp 0xa18d39
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.00a18c62
jmp 0xa18cad
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x24b600
mov dl, 0x29
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0xa18d99
cmp rsi, rcx
jae 0xa18da1
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0xa18d80
cmp al, 0x8f
ja 0xa18d80
cmp byte [rsi - 2], 0xf
je 0xa18d86
sub al, 0xe8
cmp al, 1
ja 0xa18d6a
cmp rsi, rcx
jae 0xa18da1
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0xa18d70
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0xa18da1
lodsb al, byte [rsi]
jmp 0xa18d80
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x608000]
mov eax, dword [rdi]
or eax, eax
je 0xa18dfe
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x6196d8]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0xa18dae
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0xa18df8
mov qword [rbx], rax
add rbx, 8
jmp 0xa18dce
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0xa18e42
cmp al, 0xef
ja 0xa18e2a
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0xa18e0a
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0xa18e19
mov eax, dword [rdi]
add rdi, 4
jmp 0xa18e19
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x22f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0xa18e96
sub rsp, 0xffffffffffffff80
jmp 0x63e140
Function at 0x1400de6e5
Capabilities:
Write file on windows

Disassembly:
jmp 0x14027bcb0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x140351652]
call fcn.1400e271d
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x68], 0
je 0x14027bd07
mov r8, qword [rbp + 0x130]
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x14027be13
mov rax, qword [rbp + 0x130]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x130], 0
jle 0x14027bdac
cmp qword [rbp + 0x28], 0
jle 0x14027bdac
mov rax, qword [rbp + 0x28]
cmp qword [rbp + 0x130], rax
jge 0x14027bd4c
mov rax, qword [rbp + 0x130]
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x128]
mov rcx, rax
call fcn.1400e22a4
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x128]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov edx, dword [rbp + 0x28]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
cmp qword [rbp + 0x130], 0
jle 0x14027be02
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x80], 0
je 0x14027be02
mov rax, qword [rbp + 0x120]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x130]
mov edx, 1
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.ucrtbased.dll_fwrite]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x130]
mov rcx, qword [rbp + 8]
sub rcx, rax
mov rax, rcx
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x1400dff4a
Capabilities:
Enumerate processes

Disassembly:
jmp 0x140119380
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x538
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xe6
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x558]
mov rax, qword [0x14032be28]
xor rax, rbp
mov qword [rbp + 0x508], rax
mov qword [rbp + 0x308], 0
lea rcx, [0x140350872]
call fcn.1400e271d
mov dword [rbp + 0x10], 0x238
xor edx, edx
mov ecx, 0xf
call fcn.1400e01a7
mov qword [rbp + 0x268], rax
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x268]
call fcn.1400e0af3
mov dword [rbp + 0x284], 0
call fcn.1400e1ca5
mov dword [rbp + 0x2a4], eax
mov qword [rbp + 0x2c8], 0
mov qword [rbp + 0x2e8], 0
mov rcx, qword [rbp + 0x538]
call fcn.1400de68b
mov qword [rbp + 0x4d8], rax
lea rax, [rbp + 0x3c]
mov qword [rbp + 0x2c8], rax
cmp qword [rbp + 0x2c8], 0
jne 0x140119466
mov qword [rbp + 0x4e0], 0
jmp 0x140119551
mov rcx, qword [rbp + 0x2c8]
call qword [sym.imp.ucrtbased.dll_wcslen]
inc eax
mov dword [rbp + 0x284], eax
cmp dword [rbp + 0x284], 0x3fffffff
jle 0x140119497
mov qword [rbp + 0x4e8], 0
jmp 0x140119543
movsxd rax, dword [rbp + 0x284]
shl rax, 1
mov qword [rbp + 0x4f0], rax
movsxd rcx, dword [rbp + 0x284]
shl rcx, 1
add rcx, 0x24
mov qword [rbp + 0x4f8], rcx
mov rcx, qword [rbp + 0x4f8]
add rcx, 0xf
cmp rcx, qword [rbp + 0x4f8]
ja 0x1401194db
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400decda
sub rsp, rax
lea rax, [rsp + 0x20]
mov qword [rbp + 0x500], rax
lea r8, [rbp + 0x308]
mov rdx, qword [rbp + 0x4f8]
mov rcx, qword [rbp + 0x500]
call fcn.1400e2db2
add qword [rbp + 0x500], 0x20
mov r9d, dword [rbp + 0x2a4]
mov rax, qword [rbp + 0x4f0]
mov r8d, eax
mov rdx, qword [rbp + 0x2c8]
mov rcx, qword [rbp + 0x500]
call fcn.1400df8e2
mov qword [rbp + 0x4e8], rax
mov rax, qword [rbp + 0x4e8]
mov qword [rbp + 0x4e0], rax
mov rdx, qword [rbp + 0x4d8]
mov rcx, qword [rbp + 0x4e0]
call fcn.1400e2e11
test eax, eax
jne 0x140119592
mov rcx, qword [rbp + 0x268]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp + 0x18]
mov dword [rbp + 0x4a4], eax
mov rcx, qword [rbp + 0x538]
call fcn.1400ded11
mov eax, dword [rbp + 0x4a4]
jmp 0x1401195d3
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x268]
call fcn.1400e1d09
test eax, eax
jne 0x14011942e
mov rcx, qword [rbp + 0x268]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp + 0x4c4], 0
mov rcx, qword [rbp + 0x538]
call fcn.1400ded11
mov eax, dword [rbp + 0x4c4]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x1402b19c0]
mov r8, qword [rbp + 0x308]
call fcn.1400e0e27
mov rax, rdi
mov rcx, qword [rbp + 0x508]
xor rcx, rbp
call fcn.1400e0251
lea rsp, [rbp + 0x518]
pop rdi
pop rbp
ret
Function at 0x1400e07a6
Capabilities:
Terminate process

Disassembly:
jmp 0x140298880
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x1400e0d73
Capabilities:
Write file on windows

Disassembly:
jmp 0x14014abd0
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x140350ac6]
call fcn.1400e271d
mov r9, qword [rbp + 0xf8]
mov r8, qword [rbp + 0xf0]
mov rdx, qword [rbp + 0xe8]
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.ucrtbased.dll_fwrite]
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret

Function at 0x1400e0ddc
Capabilities:
Get geographical location

Disassembly:
jmp 0x1402825a0
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x58
mov r9d, 2
lea r8, [rsp + 0x40]
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x1402825dd
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x40]
mov r8d, dword [rsp + 0x60]
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x48]
mov edx, eax
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax]
call fcn.1400e26eb
add rsp, 0x58
ret

Function at 0x1400e0fc6
Capabilities:
Read file on windows

Disassembly:
jmp 0x14014ab60
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x140350ac6]
call fcn.1400e271d
mov r9, qword [rbp + 0xf8]
mov r8, qword [rbp + 0xf0]
mov rdx, qword [rbp + 0xe8]
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.ucrtbased.dll_fread]
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret
Function at 0x1400e0fe4
Capabilities:
Hash data with crc32

Disassembly:
jmp 0x14014cb80
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x198
lea rbp, [rsp + 0x20]
lea rcx, [0x140350ac6]
call fcn.1400e271d
mov eax, dword [rbp + 0x1a0]
not eax
mov dword [rbp + 0x1a0], eax
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x190]
mov qword [rbp + 0x28], rax
lea rax, [0x1402b2e40]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x198], 0
je 0x14014ccc5
mov rax, qword [rbp + 0x198]
mov qword [rbp + 0x158], rax
mov rax, qword [rbp + 0x198]
dec rax
mov qword [rbp + 0x198], rax
cmp qword [rbp + 0x158], 0
je 0x14014cc19
mov dword [rbp + 0x160], 1
jmp 0x14014cc23
mov dword [rbp + 0x160], 0
cmp dword [rbp + 0x160], 0
je 0x14014ccc0
mov rax, qword [rbp + 0x28]
movzx eax, byte [rax]
mov byte [rbp + 0x154], al
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
movzx eax, byte [rbp + 0x154]
mov byte [rbp + 0x64], al
movzx eax, byte [rbp + 0x64]
cmp eax, 0x23
jne 0x14014cc9a
cmp qword [rbp + 0x198], 2
jb 0x14014cc9a
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x14014cc9a
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x14014cc9a
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
movzx edx, byte [rbp + 0x64]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 4], eax
jmp 0x14014cbe4
jmp 0x14014cd5f
mov rax, qword [rbp + 0x28]
movzx eax, byte [rax]
mov byte [rbp + 0x154], al
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
movzx eax, byte [rbp + 0x154]
mov byte [rbp + 0x84], al
movzx eax, byte [rbp + 0x84]
test eax, eax
je 0x14014cd5f
movzx eax, byte [rbp + 0x84]
cmp eax, 0x23
jne 0x14014cd36
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x14014cd36
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x14014cd36
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
movzx edx, byte [rbp + 0x84]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 4], eax
jmp 0x14014ccc5
mov eax, dword [rbp + 4]
not eax
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret
Function at 0x1400e1197
Capabilities:
Parse pe header

Disassembly:
jmp 0x140299f40
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140299f60
xor al, al
jmp 0x140299fe1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140299f73
xor al, al
jmp 0x140299fe1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140299f9d
xor al, al
jmp 0x140299fe1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140299fb1
xor al, al
jmp 0x140299fe1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140299fc3
xor al, al
jmp 0x140299fe1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140299fdf
xor al, al
jmp 0x140299fe1
mov al, 1
add rsp, 0x38
ret
Function at 0x1400e1cf0
Capabilities:
Create directory

Disassembly:
jmp 0x140283bd0
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x14032be28]
xor rax, rsp
mov qword [rsp + 0x58], rax
xor edx, edx
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x140283c0d
mov byte [rsp + 0x24], 1
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x24]
jmp 0x140283c82
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0xb7
jne 0x140283c70
mov edx, 1
mov ecx, 2
call fcn.1400de28f
mov r9d, 0xffffffff
mov r8d, eax
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x70]
call fcn.1400df428
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jne 0x140283c70
mov edx, 0x10
mov ecx, dword [rsp + 0x48]
call fcn.1400de8ac
movzx eax, al
test eax, eax
jne 0x140283c70
mov dword [rsp + 0x20], 0xb7
mov byte [rsp + 0x2c], 0
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x2c]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400e0251
add rsp, 0x68
ret
Function at 0x1400e21b9
Capabilities:
Hash data with crc32

Disassembly:
jmp 0x14014ca60
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x158
lea rbp, [rsp + 0x20]
lea rcx, [0x140350ac6]
call fcn.1400e271d
mov eax, dword [rbp + 0x160]
not eax
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x150]
mov qword [rbp + 0x28], rax
lea rax, [0x1402b2e40]
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x158]
mov qword [rbp + 0x118], rax
mov rax, qword [rbp + 0x158]
dec rax
mov qword [rbp + 0x158], rax
cmp qword [rbp + 0x118], 0
je 0x14014cadf
mov dword [rbp + 0x120], 1
jmp 0x14014cae9
mov dword [rbp + 0x120], 0
cmp dword [rbp + 0x120], 0
je 0x14014cb32
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
mov rdx, qword [rbp + 0x28]
movzx edx, byte [rdx]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 0x114], eax
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
mov eax, dword [rbp + 0x114]
mov dword [rbp + 4], eax
jmp 0x14014caaa
mov eax, dword [rbp + 4]
not eax
lea rsp, [rbp + 0x138]
pop rdi
pop rbp
ret
Function at 0x1400e2240
Capabilities:
Enumerate process modules

Disassembly:
jmp 0x140112c30
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x7f8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x166
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x818]
mov rax, qword [0x14032be28]
xor rax, rbp
mov qword [rbp + 0x7c8], rax
mov qword [rbp + 0x508], 0
lea rcx, [0x140350583]
call fcn.1400e271d
mov dword [rbp + 0x10], 0x438
mov rax, qword [rbp + 0x7f0]
mov edx, dword [rax + 0x10]
mov ecx, 8
call fcn.1400e01a7
mov qword [rbp + 0x468], rax
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x468]
call fcn.1400e0c10
mov dword [rbp + 0x484], 0
call fcn.1400e1ca5
mov dword [rbp + 0x4a4], eax
mov qword [rbp + 0x4c8], 0
mov qword [rbp + 0x4e8], 0
mov rcx, qword [rbp + 0x7f8]
call fcn.1400de68b
mov qword [rbp + 0x798], rax
lea rax, [rbp + 0x40]
mov qword [rbp + 0x4c8], rax
cmp qword [rbp + 0x4c8], 0
jne 0x140112d1e
mov qword [rbp + 0x7a0], 0
jmp 0x140112e09
mov rcx, qword [rbp + 0x4c8]
call qword [sym.imp.ucrtbased.dll_wcslen]
inc eax
mov dword [rbp + 0x484], eax
cmp dword [rbp + 0x484], 0x3fffffff
jle 0x140112d4f
mov qword [rbp + 0x7a8], 0
jmp 0x140112dfb
movsxd rax, dword [rbp + 0x484]
shl rax, 1
mov qword [rbp + 0x7b0], rax
movsxd rcx, dword [rbp + 0x484]
shl rcx, 1
add rcx, 0x24
mov qword [rbp + 0x7b8], rcx
mov rcx, qword [rbp + 0x7b8]
add rcx, 0xf
cmp rcx, qword [rbp + 0x7b8]
ja 0x140112d93
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400decda
sub rsp, rax
lea rax, [rsp + 0x20]
mov qword [rbp + 0x7c0], rax
lea r8, [rbp + 0x508]
mov rdx, qword [rbp + 0x7b8]
mov rcx, qword [rbp + 0x7c0]
call fcn.1400e2db2
add qword [rbp + 0x7c0], 0x20
mov r9d, dword [rbp + 0x4a4]
mov rax, qword [rbp + 0x7b0]
mov r8d, eax
mov rdx, qword [rbp + 0x4c8]
mov rcx, qword [rbp + 0x7c0]
call fcn.1400df8e2
mov qword [rbp + 0x7a8], rax
mov rax, qword [rbp + 0x7a8]
mov qword [rbp + 0x7a0], rax
mov rdx, qword [rbp + 0x798]
mov rcx, qword [rbp + 0x7a0]
call fcn.1400e2e11
test eax, eax
jne 0x140112e4d
mov rcx, qword [rbp + 0x468]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbp + 0x38]
mov qword [rbp + 0x768], rax
mov rcx, qword [rbp + 0x7f8]
call fcn.1400ded11
mov rax, qword [rbp + 0x768]
jmp 0x140112e90
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x468]
call fcn.1400dea91
test eax, eax
jne 0x140112ce6
mov rcx, qword [rbp + 0x468]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x788], 0
mov rcx, qword [rbp + 0x7f8]
call fcn.1400ded11
mov rax, qword [rbp + 0x788]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x1402b1410]
mov r8, qword [rbp + 0x508]
call fcn.1400e0e27
mov rax, rdi
mov rcx, qword [rbp + 0x7c8]
xor rcx, rbp
call fcn.1400e0251
lea rsp, [rbp + 0x7d8]
pop rdi
pop rbp
ret
Function at 0x1400e2637
Capabilities:
Write file on windows

Disassembly:
jmp 0x140277d60
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1e8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x3e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x208]
mov rax, qword [0x14032be28]
xor rax, rbp
mov qword [rbp + 0x1a8], rax
lea rcx, [0x140351652]
call fcn.1400e271d
mov rax, qword [rbp + 0x1d0]
cmp qword [rax + 0x68], 0
je 0x140277dc6
mov rax, qword [rbp + 0x1d0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x140277dcd
mov al, 1
jmp 0x140277f3f
mov rax, qword [rbp + 0x1d0]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov qword [rbp + 0x198], rax
call fcn.1400df347
mov dword [rbp + 0x1a0], eax
mov edx, dword [rbp + 0x1a0]
mov rcx, qword [rbp + 0x1d0]
call qword [rbp + 0x198]
mov dword [rbp + 0x164], eax
call fcn.1400df347
mov dword [rbp + 0x184], eax
lea rdx, [rbp + 0x164]
lea rcx, [rbp + 0x184]
call fcn.1400e1bc4
movzx eax, al
test eax, eax
je 0x140277e32
xor al, al
jmp 0x140277f3f
mov qword [rbp + 8], 0x20
mov rax, qword [rbp + 0x1d0]
mov rax, qword [rax + 0x68]
mov qword [rbp + 0x198], rax
lea rax, [rbp + 0x48]
mov rcx, qword [rbp + 0x1d0]
add rcx, 0x74
lea rdx, [rbp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rbp + 0x28]
mov rdx, rcx
mov rcx, qword [rbp + 0x198]
call qword [sym.imp.MSVCP140D.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rbp + 0x1a0], eax
cmp dword [rbp + 0x1a0], 0
je 0x140277ea5
cmp dword [rbp + 0x1a0], 1
je 0x140277eb0
cmp dword [rbp + 0x1a0], 3
je 0x140277f2e
jmp 0x140277f3d
mov rax, qword [rbp + 0x1d0]
mov byte [rax + 0x71], 0
lea rax, [rbp + 0x28]
mov rcx, qword [rbp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jbe 0x140277f00
mov rax, qword [rbp + 0x1d0]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x88]
mov edx, 1
lea rcx, [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_fwrite]
cmp qword [rbp + 0x88], rax
je 0x140277f00
xor al, al
jmp 0x140277f3f
mov rax, qword [rbp + 0x1d0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x140277f1b
mov dword [rbp + 0x194], 1
jmp 0x140277f25
mov dword [rbp + 0x194], 0
movzx eax, byte [rbp + 0x194]
jmp 0x140277f3f
mov rax, qword [rbp + 0x1d0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x140277f3f
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x1403025a0]
call fcn.1400e1b24
mov rax, rdi
mov rcx, qword [rbp + 0x1a8]
xor rcx, rbp
call fcn.1400e0251
lea rsp, [rbp + 0x1b8]
pop rdi
pop rbp
ret

Function at 0x140004000
Capabilities:
Encode data using xor

Disassembly:
movabs rdi, 0xc9bf6971e247114c
fcmovbe st(0), st(4)
mov r10, rsp
and r10w, 0xf6b0
xor r15, r15
mov r15b, 0x5b
fxsave64 [r10]
mov r9, qword [r10 + 8]
dec r15
xor qword [r9 + r15*8 + 0x26], rdi
test r15, r15
jne 0x140004023
sbb byte [rax - 2], bl
stosb byte [rdi], al
int1
or cl, dl
invalid
Function at 0x140010000
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
xor ecx, ecx
mov dword [rbp - 0x20], 0x82e2a03
mov edx, ecx
mov dword [rbp - 0x1c], 0x252c2939
mov dword [rbp - 0x18], 0x3c383f1f
mov word [rbp - 0x14], Ordinal_41
mov byte [rbp - 0x12], 1
nop dword [rax]
lea eax, [rdx + 0x47]
xor byte [rbp + rdx - 0x20], al
inc rdx
cmp rdx, 0xd
jb 0x140010030
movdqa xmm0, xmmword [0x14008f670]
lea rax, [rbp - 0x20]
mov qword [0x1400a00d0], rax
mov rdx, rcx
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0x100363e
nop dword [rax]
nop word [rax + rax]
lea eax, [rdx + 0x47]
xor byte [rbp + rdx - 0x20], al
inc rdx
cmp rdx, 0x12
jb 0x140010070
lea rax, [rbp - 0x20]
mov dword [rbp - 0x20], 0x250a3c09
mov qword [0x1400a00e8], rax
mov dword [rbp - 0x1c], 0x20243825
mov dword [rbp - 0x18], 0x100353a
lea eax, [rcx + 0x47]
xor byte [rbp + rcx - 0x20], al
inc rcx
cmp rcx, 0xa
jb 0x1400100a0
lea rax, [rbp - 0x20]
mov qword [0x1400a0100], rax
add rsp, 0x20
pop rbp
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
xor esi, esi
mov rdi, rdx
test r8d, r8d
js 0x14002bdd5
je 0x14002bd01
movsxd rbx, r8d
jmp 0x14002bd19
mov rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp byte [rdx + rbx], sil
jne 0x14002bd10
lea r15, [rbx + 1]
mov rcx, r15
mov rbp, r15
call qword [sub.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r14, rax
test rax, rax
je 0x14002bdd5
test rbx, rbx
je 0x14002bdcb
lea r12, [0x140000000]
nop word [rax + rax]
movzx edx, byte [rdi]
dec rbx
mov r13d, edx
lea eax, [rdx - 0x2d]
cmp eax, 0x51
ja case.0x14002bd77.46
cdqe
movzx eax, byte [r12 + rax + 0x2bdfc]
mov ecx, dword [r12 + rax*4 + 0x2bdf4]
add rcx, r12
jmp rcx
mov byte [r14 + rsi], dl
mov eax, 1
jmp 0x14002bdc0
add rbp, 2
cmp rbp, r15
jbe 0x14002bda3
add r15, r15
mov rcx, r14
mov rdx, r15
call fcn.140030c80
mov r14, rax
test rax, rax
je 0x14002bdd5
lea rcx, [r14 + rsi]
mov r9d, r13d
lea r8, str.___02X
mov edx, 4
call fcn.140030e80
mov eax, 3
add rsi, rax
inc rdi
test rbx, rbx
jne 0x14002bd50
mov byte [r14 + rsi], 0
mov rax, r14
jmp 0x14002bdd7
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret