joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140004cc0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx - 2]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, str.Clientarea_tcfcache_theading_tkathleen_tedi_tzh_telementary_tpermanent_tphocamapskml_tsheriff_tpagamento_trunsearch_tshowpic_tvisual_taamb_tbid_tscamper_ttrend_tfin_ttestsite_tabc_tcauta_tsqlbackup_ttiki_tbannerads_tsuperadmin_tinternal_toldblog_tshoppingcart_tcampbell_tmyweb_tventana_tmegavideo_tforum_tchatbox_tadminsite_tlighthouse_tssb_tguestbook_tgi_terrorlogs_tvelux_tcpix_thouse_ttitulars_twater
mov r10, rax
sub rbx, rax
movabs rdi, 0x6d1a62681c860fb1
lea r9, [rax + 1]
nop dword [rax + rax]
movsxd r8, r11d
lea r9, [r9 + 6]
mov rax, rdi
mov rcx, r8
mul r8
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x167
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 7]
mov byte [r9 - 7], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x167
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [r9 + rbx - 6]
mov byte [r9 - 6], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x167
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 - 5]
mov byte [r9 - 5], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x167
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 - 4]
mov byte [r9 - 4], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x167
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r9 - 3]
mov byte [r9 - 3], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x167
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 2]
mov byte [r9 - 2], al
add r11d, 6
cmp r11d, 6
jb 0x140004d10
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140005ca0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, str.Clientarea_tcfcache_theading_tkathleen_tedi_tzh_telementary_tpermanent_tphocamapskml_tsheriff_tpagamento_trunsearch_tshowpic_tvisual_taamb_tbid_tscamper_ttrend_tfin_ttestsite_tabc_tcauta_tsqlbackup_ttiki_tbannerads_tsuperadmin_tinternal_toldblog_tshoppingcart_tcampbell_tmyweb_tventana_tmegavideo_tforum_tchatbox_tadminsite_tlighthouse_tssb_tguestbook_tgi_terrorlogs_tvelux_tcpix_thouse_ttitulars_twater
mov r10, rax
sub rbx, rax
movabs rdi, 0x6d1a62681c860fb1
lea r9, [rax + 2]
nop dword [rax + rax]
movsxd r8, r11d
mov rax, rdi
mul r8
mov rax, r8
mov rcx, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x167
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 2]
movsx eax, al
mov word [r9 - 2], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x167
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [r9 + rbx]
movsx eax, al
mov word [r9], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x167
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 + 2]
movsx eax, al
mov word [r9 + 2], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x167
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 + 4]
movsx eax, al
mov word [r9 + 4], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x167
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r9 + 6]
movsx eax, al
mov word [r9 + 6], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x167
sub rcx, rax
movzx eax, byte [rcx + rsi]
add r11d, 6
xor al, byte [rbx + r9 + 8]
lea r9, [r9 + 0xc]
movsx eax, al
mov word [r9 - 4], ax
cmp r11d, 6
jb 0x140005cf0
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14000c1a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
movsxd rax, dword [rcx + 0x3c]
mov r12, rdx
mov rdx, rcx
mov ecx, dword [rax + rcx + 0x88]
xor eax, eax
add rcx, rdx
mov dword [rbp - 0x2c], eax
mov qword [rbp - 0x28], rcx
mov r8d, dword [rcx + 0x1c]
mov r9d, dword [rcx + 0x20]
add r8, rdx
mov r10d, dword [rcx + 0x24]
add r9, rdx
add r10, rdx
mov qword [rbp - 0x20], r8
mov qword [rbp - 0x18], r9
mov qword [rbp - 0x10], r10
cmp dword [rcx + 0x18], eax
jbe 0x14000c3ce
mov word [rbp + 0x50], 0x6c43
mov word [rbp + 0x58], 0x6c43
nop
mov esi, dword [r9 + rax*4]
lea rcx, [rbp + 0x50]
movzx eax, word [r10 + rax*2]
add rsi, rdx
xor edi, edi
mov r15d, dword [r8 + rax*4]
add r15, rdx
mov qword [rbp - 8], r15
call fcn.1400018c0
movzx ecx, byte [rax]
cmp byte [rsi], cl
je 0x14000c254
nop dword [rax]
lea rcx, [rbp + 0x50]
inc rdi
call fcn.1400018c0
movzx ecx, byte [rax]
cmp byte [rdi + rsi], cl
jne 0x14000c240
lea rcx, [rbp + 0x58]
xor ebx, ebx
call fcn.1400018c0
movzx ecx, byte [rax]
cmp byte [r12], cl
je 0x14000c285
nop dword [rax + rax]
lea rcx, [rbp + 0x58]
inc rbx
call fcn.1400018c0
movzx ecx, byte [rax]
cmp byte [rbx + r12], cl
jne 0x14000c270
cmp rdi, rbx
jne 0x14000c3a2
mov r13, rsi
mov word [rbp - 0x50], 0x6c43
sub r13, r12
mov r14, r12
nop dword [rax]
lea rcx, [rbp - 0x50]
xor ebx, ebx
call fcn.1400018c0
movzx ecx, byte [rax]
cmp byte [rsi], cl
je 0x14000c2c6
lea rcx, [rbp - 0x50]
inc rbx
call fcn.1400018c0
movzx ecx, byte [rax]
cmp byte [rbx + rsi], cl
jne 0x14000c2b2
mov rax, r14
sub rax, r12
dec rbx
cmp rax, rbx
jae 0x14000c3c8
movsx r15d, byte [r14 + r13]
lea rcx, [rbp - 0x4e]
mov dword [rbp - 0x4e], 0x6c0022
call fcn.1400027f0
movzx eax, word [rax]
cmp r15d, eax
jl 0x14000c338
lea rcx, [rbp - 0x4a]
mov dword [rbp - 0x4a], 0x6c0039
call fcn.1400027f0
movzx ecx, word [rax]
cmp r15d, ecx
jg 0x14000c338
lea rcx, [rbp - 0x46]
mov dword [rbp - 0x46], 0x6c0022
mov dword [rbp - 0x42], 0x6c0002
call fcn.1400027f0
lea rcx, [rbp - 0x42]
movzx ebx, byte [rax]
call fcn.1400027f0
movzx ecx, byte [rax]
sub cl, bl
add r15b, cl
movsx edi, byte [r14]
lea rcx, [rbp - 0x3e]
mov dword [rbp - 0x3e], 0x6c0022
call fcn.1400027f0
movzx eax, word [rax]
cmp edi, eax
jl 0x14000c395
lea rcx, [rbp - 0x3a]
mov dword [rbp - 0x3a], 0x6c0039
call fcn.1400027f0
movzx ecx, word [rax]
cmp edi, ecx
jg 0x14000c395
lea rcx, [rbp - 0x36]
mov dword [rbp - 0x36], 0x6c0022
mov dword [rbp - 0x32], 0x6c0002
call fcn.1400027f0
lea rcx, [rbp - 0x32]
movzx ebx, byte [rax]
call fcn.1400027f0
movzx ecx, byte [rax]
sub cl, bl
add dil, cl
cmp r15b, dil
jne 0x14000c3a2
inc r14
jmp 0x14000c2a0
mov eax, dword [rbp - 0x2c]
mov rcx, qword [rbp - 0x28]
inc eax
mov dword [rbp - 0x2c], eax
cmp eax, dword [rcx + 0x18]
jae 0x14000c3ce
mov rdx, qword [rbp + 0x40]
mov r8, qword [rbp - 0x20]
mov r9, qword [rbp - 0x18]
mov r10, qword [rbp - 0x10]
jmp 0x14000c210
mov rax, qword [rbp - 8]
jmp 0x14000c3d0
xor eax, eax
mov rbx, qword [rsp + 0xb8]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000c3f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov r12d, 9
mov dword [rbp - 0x20], 0x290008
lea rcx, [rbp - 0x20]
mov word [rbp - 0xc], r12w
mov dword [rbp - 0x1c], 0x2b003b
mov dword [rbp - 0x18], 0x38002b
mov dword [rbp - 0x14], 0x330023
mov dword [rbp - 0x10], 0x240036
call fcn.140005e60
mov rcx, rax
call 0x14000c690
mov qword [0x1400181b8], rax
lea rcx, [rbp - 0x20]
mov eax, 0x65
mov dword [rbp - 0x20], 0x290008
mov word [rbp - 0x10], ax
mov dword [rbp - 0x1c], 0x2b003b
mov dword [rbp - 0x18], 0x38002b
mov dword [rbp - 0x14], 0x400052
call fcn.140002590
mov rcx, rax
call 0x14000c690
lea rcx, [rbp - 0x20]
mov qword [0x1400181a8], rax
mov dword [rbp - 0x20], 0x18002d
mov dword [rbp - 0x1c], 0x9000d
mov dword [rbp - 0x18], 0x740002
call fcn.140005ca0
mov rcx, rax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
jmp 0x14000c690
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rdi, qword [rax + 0x18]
add rdi, 0x20
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x14000c6f2
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rbx + 0x40]
mov rdx, rsi
mov r8, rax
call fcn.140009f80
test al, al
jne 0x14000c704
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x14000c6c0
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rbx + 0x20]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14000c690
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov r12d, 9
mov dword [rbp - 0x20], 0x290008
lea rcx, [rbp - 0x20]
mov word [rbp - 0xc], r12w
mov dword [rbp - 0x1c], 0x2b003b
mov dword [rbp - 0x18], 0x38002b
mov dword [rbp - 0x14], 0x330023
mov dword [rbp - 0x10], 0x240036
call fcn.140005e60
mov rcx, rax
call 0x14000c690
mov qword [0x1400181b8], rax
lea rcx, [rbp - 0x20]
mov eax, 0x65
mov dword [rbp - 0x20], 0x290008
mov word [rbp - 0x10], ax
mov dword [rbp - 0x1c], 0x2b003b
mov dword [rbp - 0x18], 0x38002b
mov dword [rbp - 0x14], 0x400052
call fcn.140002590
mov rcx, rax
call 0x14000c690
lea rcx, [rbp - 0x20]
mov qword [0x1400181a8], rax
mov dword [rbp - 0x20], 0x18002d
mov dword [rbp - 0x1c], 0x9000d
mov dword [rbp - 0x18], 0x740002
call fcn.140005ca0
mov rcx, rax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
jmp 0x14000c690
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rdi, qword [rax + 0x18]
add rdi, 0x20
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x14000c6f2
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rbx + 0x40]
mov rdx, rsi
mov r8, rax
call fcn.140009f80
test al, al
jne 0x14000c704
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x14000c6c0
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rbx + 0x20]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14000e5c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rbx, qword [0x1400181c0]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x40010
mov dword [rbp - 0x1c], 0x9000c
mov dword [rbp - 0x18], 0x470002
mov dword [rbp - 0x14], 0x5c0053
mov dword [rbp - 0x10], 0xd0001
mov dword [rbp - 0xc], 0x630065
call fcn.140002e40
mov rcx, rax
call rbx
mov rbx, qword [0x1400181c0]
lea rcx, [rbp - 0x20]
mov qword [0x1400181a0], rax
mov dword [rbp - 0x20], 0x50014
mov dword [rbp - 0x1c], 0xc0007
mov dword [rbp - 0x18], 0x110000
mov dword [rbp - 0x14], 0x5c0015
mov dword [rbp - 0x10], 0xd0001
mov dword [rbp - 0xc], 0x630065
call fcn.140002e40
mov rcx, rax
call rbx
movdqa xmm0, xmmword [0x1400167c0]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140018130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400181b0], rax
mov word [rbp - 0x10], 0x321e
mov byte [rbp - 0xe], 9
call fcn.140005220
mov rcx, qword [0x1400181a0]
mov rdx, rax
call rbx
mov rbx, qword [0x140018130]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x90c0410
mov dword [rbp - 0x1c], 0x17193102
mov dword [rbp - 0x18], 0x67d1406
mov word [rbp - 0x14], 0x6331
call fcn.140001180
mov rcx, qword [0x1400181a0]
mov rdx, rax
call rbx
mov rbx, qword [0x140018130]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x1d020a
mov dword [rbp - 0x1c], 0x6041a1c
mov dword [rbp - 0x18], 0xd6c112a
mov word [rbp - 0x14], 0x6327
call fcn.140001180
mov rcx, qword [0x1400181b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x1400168b0]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140018130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400180e8], rax
mov byte [rbp - 0x10], 0x68
call fcn.140004e60
mov rcx, qword [0x1400181b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x140016830]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140018130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400180f0], rax
mov dword [rbp - 0x10], 0x686c090c
call fcn.1400029f0
mov rcx, qword [0x1400181b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x1400167f0]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140018130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400180e0], rax
mov byte [rbp - 0x10], 0x68
call fcn.140004e60
mov rcx, qword [0x1400181b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x140016890]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140018130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400180d8], rax
mov dword [rbp - 0x10], 0x29670a01
mov byte [rbp - 0xc], 0x65
call fcn.140003790
mov rcx, qword [0x1400181b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x140016820]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140018130]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x10], 0x2406
mov byte [rbp - 0xe], 9
call fcn.140005220
mov rcx, qword [0x1400181b0]
mov rdx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rbp
jmp rax
Function at 0x140001120
Capabilities:
Execute command
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
mov edx, 0x65
xor ecx, ecx
lea r8d, [rdx - 0x5b]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x140001164
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x1400024d8]
call fcn.140001010
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x140001198
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____LoadResource_Failed_With_Error_:__d__n
call fcn.140001010
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rsi, rax
test rax, rax
jne 0x1400011cb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____LockResource_Failed_With_Error_:__d__n
call fcn.140001010
lea eax, [rsi - 1]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
test eax, eax
jne 0x140001200
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____SizeofResource_Failed_With_Error_:__d__n
call fcn.140001010
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
mov qword [rsp + 0x30], rdi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x14000122f
mov r8, rbx
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov rdx, rsi
lea rcx, str._i__pPayloadAddress_var_:_0x_p__n
call fcn.140001010
mov rdx, rbx
lea rcx, str._i__sPayloadSize_var_:__ld__n
call fcn.140001010
mov rdx, rdi
lea rcx, str._i__pTmpBuffer_var_:_0x_p__n
call fcn.140001010
mov r8, rbx
lea rcx, str.payload
mov rdx, rdi
call fcn.140001070
mov r8, rbx
lea rcx, str.PlainText
mov rdx, rdi
call fcn.140001070
lea rcx, str.___Press__Enter__To_Quit_..._n
call fcn.140001010
lea rcx, str.PAUSE
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdi, qword [rsp + 0x30]
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
Function at 0x7ff71efa3220
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push r14
sub rsp, 0x70
mov rbp, qword [0x7ff71f15e010]
mov rbx, rcx
movaps xmmword [rsp + 0x60], xmm6
mov r14, rbp
movaps xmmword [rsp + 0x50], xmm7
movaps xmm6, xmm1
movaps xmm7, xmm2
lea rax, [rbp + 8]
cmp rax, rcx
je 0x7ff71efa3277
mov r8d, 0x589
lea rdx, [0x7ff71f00a610]
lea rcx, [0x7ff71f00a670]
call qword [sym.imp.ucrtbase.dll__wassert]
mov rbp, qword [0x7ff71f15e010]
cmp byte [rbx + 0x37a1], 0
je 0x7ff71efa3421
movss xmm1, dword [0x7ff71f052fa4]
xorps xmm2, xmm2
comiss xmm7, xmm1
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x88], rdi
jbe 0x7ff71efa32c4
comiss xmm7, xmm2
cvttss2si eax, xmm7
jae 0x7ff71efa32bd
movd xmm0, eax
cvtdq2ps xmm0, xmm0
ucomiss xmm0, xmm7
jp 0x7ff71efa32bb
je 0x7ff71efa32bd
dec eax
movd xmm7, eax
cvtdq2ps xmm7, xmm7
comiss xmm6, xmm1
jbe 0x7ff71efa32e9
comiss xmm6, xmm2
cvttss2si eax, xmm6
jae 0x7ff71efa32e2
movd xmm0, eax
cvtdq2ps xmm0, xmm0
ucomiss xmm0, xmm6
jp 0x7ff71efa32e0
je 0x7ff71efa32e2
dec eax
movd xmm6, eax
cvtdq2ps xmm6, xmm6
mov esi, dword [rbp + 0x37c0]
sub esi, 1
movsxd rdi, esi
js 0x7ff71efa333f
lea rbx, [rdi + rdi*2]
shl rbx, 3
nop
cmp esi, dword [rbp + 0x37c0]
jl 0x7ff71efa3322
mov r8d, 0x6fd
lea rdx, [0x7ff71f00a490]
lea rcx, [0x7ff71f00f408]
call qword [sym.imp.ucrtbase.dll__wassert]
mov rax, qword [rbp + 0x37c8]
cmp dword [rbx + rax], 1
je 0x7ff71efa33c9
dec esi
sub rbx, 0x18
sub rdi, 1
jns 0x7ff71efa3300
movsd xmm0, qword [r14 + 0xdfc]
lea rax, [rsp + 0x28]
movsd qword [rsp + 0x28], xmm0
movss xmm0, dword [rax]
ucomiss xmm0, xmm6
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
movss xmm1, dword [rax + 4]
jp 0x7ff71efa337e
jne 0x7ff71efa337e
ucomiss xmm1, xmm7
jp 0x7ff71efa337e
je 0x7ff71efa3421
lea rbx, [r14 + 0x37c0]
movss dword [rsp + 0x38], xmm6
mov ecx, dword [rbx]
mov r8d, dword [rbx + 4]
movss dword [rsp + 0x3c], xmm7
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x34], 1
cmp ecx, r8d
jne 0x7ff71efa33ff
inc ecx
test r8d, r8d
je 0x7ff71efa33eb
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x7ff71efa33f0
movss xmm0, dword [rbx + rax + 8]
movss xmm1, dword [rbx + rax + 0xc]
lea rax, [rsp + 0x20]
movss dword [rsp + 0x20], xmm0
movss dword [rsp + 0x24], xmm1
jmp 0x7ff71efa3353
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
mov rcx, rbx
call fcn.7ff71efbdec0
movsxd rax, dword [rbx]
movups xmm0, xmmword [rsp + 0x30]
movsd xmm1, qword [rsp + 0x40]
lea rcx, [rax + rax*2]
mov rax, qword [rbx + 8]
movups xmmword [rax + rcx*8], xmm0
movsd qword [rax + rcx*8 + 0x10], xmm1
inc dword [rbx]
movaps xmm6, xmmword [rsp + 0x60]
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
movaps xmm7, xmmword [rsp + 0x50]
mov rsp, r11
pop r14
ret
Function at 0x7ff71efa3820
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x7ff71efa387d
lea rbx, [0x7ff71f00f890]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x7ff71efa3864
cmp r10, 2
jb 0x7ff71efa3864
cmp byte [r9], r8b
jne 0x7ff71efa3864
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x7ff71efa3840
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x7ff71efa38bf
lea rbx, [0x7ff71f00f890]
cmp r8b, 0x23
jne 0x7ff71efa38a3
cmp byte [r9], r8b
jne 0x7ff71efa38a3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x7ff71efa3890
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x7ff71efa3a80
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rdi, r8
mov rbx, rcx
test rcx, rcx
jne 0x7ff71efa3aaf
mov r8d, 0x77e
lea rdx, [0x7ff71f00a610]
lea rcx, [0x7ff71f00aa98]
call qword [sym.imp.ucrtbase.dll__wassert]
test rdi, rdi
je 0x7ff71efa3abb
mov qword [rdi], 0
lea rdx, [0x7ff71f00f148]
mov rcx, rbx
call fcn.7ff71efa38d0
mov rbx, rax
test rax, rax
jne 0x7ff71efa3add
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbp
mov rcx, rbx
mov qword [rsp + 0x38], rsi
call qword [sym.imp.ucrtbase.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x7ff71efa3bb4
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.ucrtbase.dll_fseek]
test eax, eax
jne 0x7ff71efa3bb4
mov rcx, rbx
call qword [sym.imp.ucrtbase.dll_ftell]
movsxd rsi, eax
cmp esi, 0xffffffff
je 0x7ff71efa3bb4
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.ucrtbase.dll_fseek]
test eax, eax
jne 0x7ff71efa3bb4
cmp rsi, 0xffffffffffffffff
je 0x7ff71efa3bb4
mov rax, qword [0x7ff71f15e010]
test rax, rax
je 0x7ff71efa3b51
inc dword [rax + 0xf4]
mov rcx, rsi
call qword [sym.imp.ucrtbase.dll_malloc]
mov rbp, rax
test rax, rax
je 0x7ff71efa3bb4
mov r9, rbx
mov r8, rsi
mov edx, 1
mov rcx, rax
call qword [sym.imp.ucrtbase.dll_fread]
mov rcx, rbx
cmp rax, rsi
je 0x7ff71efa3ba1
call qword [sym.imp.ucrtbase.dll_fclose]
mov rax, qword [0x7ff71f15e010]
test rax, rax
je 0x7ff71efa3b96
dec dword [rax + 0xf4]
mov rcx, rbp
call qword [sym.imp.ucrtbase.dll_free]
jmp 0x7ff71efa3bbd
call qword [sym.imp.ucrtbase.dll_fclose]
test rdi, rdi
je 0x7ff71efa3baf
mov qword [rdi], rsi
mov rax, rbp
jmp 0x7ff71efa3bbf
mov rcx, rbx
call qword [sym.imp.ucrtbase.dll_fclose]
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x7ff71efa6590
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0xd0], 0
mov rbx, rcx
movsxd rdi, edx
jg 0x7ff71efa65c7
mov r8d, 0x706
lea rdx, [0x7ff71f00a490]
lea rcx, [0x7ff71f00f4a8]
call qword [sym.imp.ucrtbase.dll__wassert]
mov rax, qword [rbx + 0xd8]
lea rdx, [0x7ff71f00f890]
movsxd r8, dword [rbx + 0xd0]
mov ebx, dword [rax + r8*4 - 4]
not ebx
movzx eax, dil
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x39]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x3a]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x3b]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
xor ebx, dword [rdx + rcx*4]
mov rcx, qword [0x7ff71f15e010]
not ebx
cmp dword [rcx + 0x3ee4], ebx
jne 0x7ff71efa6646
mov r8, rdi
mov edx, 4
mov ecx, ebx
call fcn.7ff71efbcc80
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret