joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001154
Capabilities:
Terminate process

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x10], 0
mov dword [rbp - 0x1c], 0x30
mov eax, dword [rbp - 0x1c]
mov rax, qword gs:[rax]
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x28]
mov rax, qword [rax + 8]
mov qword [rbp - 0x18], rax
mov dword [rbp - 4], 0
jmp 0x1400011ac
mov rax, qword [rbp - 0x10]
cmp rax, qword [rbp - 0x18]
jne 0x14000119e
mov dword [rbp - 4], 1
jmp 0x1400011e3
mov ecx, 0x3e8
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov rax, qword [0x140073490]
mov qword [rbp - 0x30], rax
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x40], 0
mov rcx, qword [rbp - 0x38]
mov rax, qword [rbp - 0x40]
mov rdx, qword [rbp - 0x30]
lock cmpxchg qword [rdx], rcx
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
jne 0x14000118b
mov rax, qword [0x1400734a0]
mov eax, dword [rax]
cmp eax, 1
jne 0x1400011fd
mov ecx, 0x1f
call sym._amsg_exit
jmp 0x14000123c
mov rax, qword [0x1400734a0]
mov eax, dword [rax]
test eax, eax
jne 0x140001232
mov rax, qword [0x1400734a0]
mov dword [rax], 1
mov rax, qword [0x1400734f0]
mov rdx, rax
mov rax, qword [0x1400734e0]
mov rcx, rax
call sym._initterm
jmp 0x14000123c
mov dword [0x14007e024], 1
mov rax, qword [0x1400734a0]
mov eax, dword [rax]
cmp eax, 1
jne 0x140001270
mov rax, qword [0x1400734d0]
mov rdx, rax
mov rax, qword [0x1400734c0]
mov rcx, rax
call sym._initterm
mov rax, qword [0x1400734a0]
mov dword [rax], 2
cmp dword [rbp - 4], 0
jne 0x140001294
mov rax, qword [0x140073490]
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x50], 0
mov rdx, qword [rbp - 0x50]
mov rax, qword [rbp - 0x48]
xchg qword [rax], rdx
mov rax, qword [0x1400733f0]
mov rax, qword [rax]
test rax, rax
je 0x1400012bf
mov rax, qword [0x1400733f0]
mov rax, qword [rax]
mov r8d, 0
mov edx, 2
mov ecx, 0
call rax
call sym._pei386_runtime_relocator
mov rax, qword [sym._gnu_exception_handler]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call rax
mov rdx, qword [0x140073480]
mov qword [rdx], rax
lea rax, [sym.__mingw_invalidParameterHandler]
mov rcx, rax
call sym._set_invalid_parameter_handler
call sym._fpreset
mov eax, dword [0x14007e004]
lea rdx, [0x14007e008]
mov ecx, eax
call sym.duplicate_ppstrings
call sym.__main
mov rax, qword [0x140073410]
mov rax, qword [rax]
mov rdx, qword [0x14007e010]
mov qword [rax], rdx
mov rcx, qword [0x14007e010]
mov rdx, qword [0x14007e008]
mov eax, dword [0x14007e004]
mov r8, rcx
mov ecx, eax
call dbg.main
mov dword [0x14007e01c], eax
mov eax, dword [0x14007e020]
test eax, eax
jne 0x14000135d
mov eax, dword [0x14007e01c]
mov ecx, eax
call sym.exit
mov eax, dword [0x14007e024]
test eax, eax
jne 0x14000136c
call sym._cexit
mov eax, dword [0x14007e01c]
add rsp, 0x70
pop rbp
ret
Function at 0x140001378
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x140073440]
mov dword [rax], 1
mov rax, qword [0x140073450]
mov dword [rax], 1
mov rax, qword [0x140073460]
mov dword [rax], 1
mov rax, qword [0x1400733b0]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400013c9
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400013f5
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000141b
cmp eax, 0x20b
je 0x140001442
jmp 0x140001471
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000142e
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x14000145d
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x1400016e0
Capabilities:
Encode data using base64

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
mov rbx, rcx
mov rsi, rdx
cmp r9, 2
jbe 0x140001814
mov edx, 3
xor r10d, r10d
lea rcx, [0x140056060]
jmp 0x140001783
movzx eax, byte [r8 + rdx - 3]
movzx edi, byte [r8 + rdx - 2]
movzx r13d, byte [r8 + rdx - 1]
shl edi, 8
shl eax, 0x10
or eax, edi
mov rdi, rcx
or r13d, eax
mov ebp, eax
shr eax, 0xc
mov r14d, r13d
and r13d, 0x3f
mov r12d, eax
shr ebp, 0x12
shr r14d, 6
movzx eax, byte [rcx + r13]
and r12d, 0x3f
movzx ebp, byte [rcx + rbp]
and r14d, 0x3f
movzx r12d, byte [rcx + r12]
movzx r13d, byte [rcx + r14]
shl eax, 8
or eax, r13d
shl eax, 8
or eax, r12d
shl eax, 8
or eax, ebp
mov dword [rbx + r10 - 4], eax
lea rax, [rdx + 3]
cmp r9, rax
jb 0x1400017a0
mov rdx, rax
mov r11, r10
lea r10, [r10 + 4]
cmp rsi, r10
jae 0x140001710
mov rax, r11
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
lea rcx, [rdx + 2]
lea rax, [rdx + 1]
cmp r9, rcx
jb 0x140001820
lea rbp, [r11 + 8]
cmp rsi, rbp
jb 0x140001820
lea rsi, [r11 + 5]
lea r9, [r11 + 6]
add rdx, r8
add r10, rbx
lea rcx, [r11 + 7]
mov r11, rbp
movzx eax, byte [r8 + rax]
movzx edx, byte [rdx]
shl eax, 8
shl edx, 0x10
or eax, edx
shr edx, 0x12
movzx edx, byte [rdi + rdx]
mov byte [r10], dl
mov edx, eax
shr eax, 6
shr edx, 0xc
and eax, 0x3c
and edx, 0x3f
movzx eax, byte [rdi + rax]
movzx edx, byte [rdi + rdx]
mov byte [rbx + rsi], dl
mov byte [rbx + r9], al
mov rax, r11
mov byte [rbx + rcx], 0x3d
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
je 0x140001875
mov eax, 1
xor r10d, r10d
xor edx, edx
mov r11, r10
cmp r9, rax
jb 0x14000178f
add r11, 4
cmp rsi, r11
jb 0x14000186d
movzx eax, byte [r8 + rdx]
lea rcx, [0x140056060]
mov edx, eax
shl eax, 4
and eax, 0x30
shr edx, 2
movzx eax, byte [rcx + rax]
movzx edx, byte [rcx + rdx]
mov byte [rbx + r10 + 1], al
mov eax, 0x3d3d
mov byte [rbx + r10], dl
mov word [rbx + r10 + 2], ax
jmp 0x14000178f
mov r11, r10
jmp 0x14000178f
xor r11d, r11d
cmp rdx, 3
jbe 0x14000178f
mov r10, rcx
mov rdx, r8
mov ecx, 3
mov esi, 1
mov eax, 1
mov r11d, 4
lea rdi, [0x140056060]
jmp 0x1400017cb
Function at 0x1400018b0
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push rbp
push rdi
push rsi
push rbx
xor esi, esi
xor eax, eax
lea r10, [0x1400560c0]
mov r11, rcx
mov rbx, rdx
cmp rsi, r9
jb 0x1400018e9
jmp 0x14000193b
add rax, 1
cmp r9, rax
je 0x14000193b
movzx edx, byte [r8 + rax]
mov rcx, rdx
movzx edx, byte [r10 + rdx]
cmp edx, 0x40
ja 0x1400018e0
cmp cl, 0x3d
jne 0x140001932
jmp 0x14000193b
movzx ecx, byte [r8 + rax]
mov rdi, rcx
movzx ecx, byte [r10 + rcx]
cmp ecx, 0x40
jbe 0x140001950
add rax, 1
cmp rax, r9
jb 0x140001920
cmp rsi, rbx
jae 0x140001945
mov byte [r11 + rsi], 0
mov rax, rsi
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp dil, 0x3d
je 0x14000193b
lea rbp, [rax + 1]
cmp rsi, rbx
jae 0x140001977
mov edi, ecx
shl edx, 2
shr edi, 4
movzx edx, dl
and edi, 3
or edx, edi
mov byte [r11 + rsi], dl
add rsi, 1
cmp rbp, r9
jae 0x14000193b
movzx edx, byte [r8 + rbp]
cmp dl, 0x3d
je 0x14000193b
movzx edx, byte [r10 + rdx]
nop dword [rax + rax]
cmp edx, 0x40
ja 0x140001990
lea rbp, [rax + 2]
cmp rsi, rbx
jae 0x1400019b6
mov edi, edx
shl ecx, 4
shr edi, 2
movzx ecx, cl
and edi, 0xf
or ecx, edi
mov byte [r11 + rsi], cl
add rsi, 1
cmp rbp, r9
jae 0x14000193b
movzx ecx, byte [r8 + rbp]
cmp cl, 0x3d
je 0x14000193b
movzx ecx, byte [r10 + rcx]
nop
cmp ecx, 0x40
ja 0x1400019d0
add rax, 3
cmp rsi, rbx
jae 0x1400019ee
shl edx, 6
movzx edx, dl
or edx, ecx
mov byte [r11 + rsi], dl
add rsi, 1
cmp rax, r9
jb 0x1400018e9
jmp 0x14000193b
Function at 0x140001a00
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x178
xor ecx, ecx
lea rsi, [rsp + 0x20]
lea rbp, [rsp + 0x90]
call sub.api_ms_win_crt_time_l1_1_0.dll__time64
mov r9d, 5
mov edx, 0x64
mov rcx, rsi
lea r8, [0x1400560a1]
mov ebx, eax
call dbg.base64_encode
mov r8, rsi
mov edx, 0x64
mov rcx, rbp
mov r9, rax
call dbg.base64_decode
cmp rax, 5
je 0x140001aa9
cmp dword [rsp + 0x90], 0x6c6c6568
je 0x140001a9f
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, 0x18
mov edx, 1
lea rcx, str.base64:_selftest_failed_n
mov r9, rax
call sym.fwrite
mov eax, 1
add rsp, 0x178
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
cmp byte [rsp + 0x94], 0x6f
jne 0x140001a65
mov edi, 0x64
lea r12, [rsp + 0x100]
nop word cs:[rax + rax]
imul ebx, ebx, 0x343fd
add ebx, 0x269ec3
mov edx, ebx
shr edx, 0x10
and edx, 0x7fff
mov eax, edx
imul rax, rax, 0x51eb851f
shr rax, 0x24
imul ecx, eax, 0x32
mov eax, edx
sub eax, ecx
mov r13d, eax
je 0x140001b80
mov rax, rsi
lea rcx, [rsi + r13]
nop dword [rax + rax]
imul ebx, ebx, 0x343fd
add rax, 1
add ebx, 0x269ec3
mov edx, ebx
shr edx, 0x10
mov byte [rax - 1], dl
cmp rax, rcx
jne 0x140001b00
mov r9, r13
mov r8, rsi
mov edx, 0x64
mov rcx, rbp
call dbg.base64_encode
mov r8, rbp
mov edx, 0x64
mov rcx, r12
mov r9, rax
call dbg.base64_decode
cmp r13, rax
je 0x140001b5e
mov r8, r13
mov rdx, rsi
mov rcx, r12
call sym.memcmp
test eax, eax
jne 0x140001a65
sub edi, 1
jne 0x140001ac0
xor eax, eax
add rsp, 0x178
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
xor r9d, r9d
mov r8, rsi
mov rcx, rbp
mov edx, 0x64
call dbg.base64_encode
mov r8, rbp
mov edx, 0x64
mov rcx, r12
mov r9, rax
call dbg.base64_decode
jmp 0x140001b5e
Function at 0x140002ba0
Capabilities:
Encrypt data using des

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
mov rsi, qword [rsp + 0x68]
mov rbx, rdx
mov rax, r9
xor edx, edx
div rbx
mov r9, rax
mov r11, rdx
test cl, 1
jne 0x140002bd5
test ecx, ecx
je 0x140002cc8
mov r11, rax
mov r9, rdx
lea r14, [0x140056780]
lea r13, [0x140056980]
lea r12, [0x140056580]
lea rbp, [0x140056b80]
jmp 0x140002c41
mov eax, dword [r14 + rax*4]
xor eax, dword [r13 + rdx*4]
mov edx, dword [r12 + r15*4]
xor edx, eax
xor edx, dword [rbp + r10*4]
cmp r11, rdx
jae 0x140002ce0
mov rax, rdx
xor edx, edx
sub rax, r11
mov r11, rbx
div rbx
xor eax, eax
sub r11, rdx
cmp rbx, r11
cmove r11, rax
sub ecx, 1
je 0x140002cc8
mov rax, r9
mov r9, r11
mov r11, rax
mov r10, rsi
ror r10, cl
xor r10, r9
mov rax, r10
mov rdx, r10
mov r15, r10
shr r10, 0x18
shr rax, 8
shr rdx, 0x10
and r15d, 0x3f
and r10d, 0x3f
and eax, 0x3f
and edx, 0x3f
test cl, 1
jne 0x140002bf8
lea rdi, [0x140056880]
mov eax, dword [rdi + rax*4]
lea rdi, [0x140056a80]
xor eax, dword [rdi + rdx*4]
mov edx, eax
lea rax, [0x140056680]
xor edx, dword [rax + r15*4]
lea rax, [0x140056c80]
xor edx, dword [rax + r10*4]
cmp r11, rdx
jae 0x140002cf8
mov rax, rdx
xor edx, edx
sub rax, r11
mov r11, r8
div r8
xor eax, eax
sub r11, rdx
cmp r8, r11
cmove r11, rax
sub ecx, 1
jmp 0x140002c38
imul rbx, r9
lea rax, [rbx + r11]
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rax, r11
sub rax, rdx
xor edx, edx
div rbx
mov r11, rdx
jmp 0x140002c2f
mov rax, r11
sub rax, rdx
xor edx, edx
div r8
mov r11, rdx
jmp 0x140002cbd
Function at 0x1400031b0
Capabilities:
Encrypt data using des

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rsi, qword [rcx + 0x18]
mov r8, qword [rcx + 0x10]
mov rbx, qword [rcx + 8]
mov r15d, dword [rcx + 0x20]
mov qword [rsp + 0x20], rsi
mov rdi, rcx
mov r9, rdx
mov ecx, r15d
mov rdx, rbx
call sym.DECRYPT
mov rcx, qword [rdi]
mov qword [rsp + 0x30], rcx
cmp rax, rcx
jb 0x14000334f
mov edi, r15d
mov dword [rsp + 0x38], r15d
lea r14, [0x140056880]
and edi, 1
mov dword [rsp + 0x3c], edi
nop dword [rax]
xor edx, edx
mov ecx, dword [rsp + 0x3c]
div rbx
mov r10, rdx
mov r11, rax
test ecx, ecx
je 0x140003370
mov ecx, dword [rsp + 0x38]
lea r13, [0x140056780]
lea r12, [0x140056980]
lea rbp, [0x140056580]
jmp 0x140003296
mov eax, dword [r13 + rax*4]
xor eax, dword [r12 + r9*4]
xor eax, dword [rbp + r15*4]
mov r15d, eax
lea rax, [0x140056b80]
xor r15d, dword [rax + rdx*4]
cmp r10, r15
jae 0x140003320
mov rax, r15
xor edx, edx
mov r9, rbx
sub rax, r10
div rbx
xor eax, eax
sub r9, rdx
cmp rbx, r9
cmove r9, rax
sub ecx, 1
je 0x140003337
mov r10, r11
mov r11, r9
mov rdx, rsi
ror rdx, cl
xor rdx, r11
mov rax, rdx
mov r9, rdx
mov r15, rdx
shr rdx, 0x18
shr rax, 8
shr r9, 0x10
and r15d, 0x3f
and edx, 0x3f
and eax, 0x3f
and r9d, 0x3f
test cl, 1
jne 0x140003248
lea rdi, [0x140056a80]
mov eax, dword [r14 + rax*4]
xor eax, dword [rdi + r9*4]
lea rdi, [0x140056680]
xor eax, dword [rdi + r15*4]
lea rdi, [0x140056c80]
mov r15d, eax
xor r15d, dword [rdi + rdx*4]
cmp r10, r15
jae 0x140003360
mov rax, r15
xor edx, edx
mov r9, r8
sub rax, r10
div r8
xor eax, eax
sub r9, rdx
cmp r8, r9
cmove r9, rax
sub ecx, 1
jmp 0x140003290
mov rax, r10
xor edx, edx
sub rax, r15
div rbx
mov r9, rdx
sub ecx, 1
jne 0x140003290
mov rax, r11
mov rdi, qword [rsp + 0x30]
imul rax, rbx
add rax, r9
cmp rax, rdi
jae 0x140003210
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rax, r10
xor edx, edx
sub rax, r15
div r8
mov r9, rdx
jmp 0x14000330e
mov edx, dword [rsp + 0x38]
test edx, edx
je 0x140003388
mov r11, r10
mov r10, rax
jmp 0x140003227
mov rdx, r10
jmp 0x1400033a5
xor edx, edx
div rbx
mov rsi, qword [rsp + 0x30]
imul rax, rbx
add rax, rdx
cmp rax, rsi
jae 0x1400033a0
jmp 0x14000334f
Function at 0x140003e60
Capabilities:
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov esi, 0xa
mov ebx, 0x2355
lea rbp, [rsp + 0x28]
lea rdi, [rsp + 0x20]
add rbx, rsi
xor r9d, r9d
mov r8, rbp
mov rdx, rdi
mov qword [rsp + 0x28], 0
mov rcx, rbx
call dbg.lcg_calculate_constants
mov rdx, qword [rsp + 0x28]
mov r9, rbx
mov r8, rbx
mov rcx, qword [rsp + 0x20]
call dbg.lcg_verify
test eax, eax
je 0x140003ed0
add rsi, 1
cmp rsi, 0xf
jne 0x140003e7c
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, 0x1a
mov edx, 1
lea rcx, str.LCG:_randomization_failed_n
mov r9, rax
call sym.fwrite
mov eax, 1
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x140003f40
Capabilities:
Encode data using xor

Disassembly:
push rdi
push rsi
push rbx
mov r11, rcx
lea eax, [rdx + rdx + 0xf]
lea r10d, [r8 + 0xf]
mov rcx, r9
add rcx, 0x3b9aca00
jns 0x140003f79
movsxd rdx, eax
nop dword [rax]
add rcx, rdx
mov rax, rdx
add rdx, 0x1e
test rcx, rcx
js 0x140003f60
add eax, 0x1e
lea r9, [rcx - 0x3b9aca00]
mov ecx, r9d
cmp r9d, 0x1f47f
jg 0x140004033
nop dword [rax]
add ecx, eax
mov edi, eax
add eax, 0x1e
cmp ecx, 0x1f47f
jle 0x140003f90
lea rsi, [0x140057860]
cmp edi, 0xf
jle 0x14000402f
nop
sub ecx, edi
jns 0x140003fcb
nop word cs:[rax + rax]
nop
add ecx, r10d
add r10d, 0x1e
test ecx, ecx
js 0x140003fc0
mov edx, ecx
mov r9d, r10d
cmp ecx, 0x1f47f
jg 0x140004027
nop word cs:[rax + rax]
nop word cs:[rax + rax]
nop word cs:[rax + rax]
nop dword [rax]
mov eax, edx
mov r8d, edx
add edx, r9d
add r9d, 0x1e
shr eax, 5
and r8d, 0x1f
lea rbx, [r11 + rax*4]
mov eax, dword [rbx]
xor eax, dword [rsi + r8*4]
mov dword [rbx], eax
cmp edx, 0x1f47f
jle 0x140004000
sub edi, 0x1e
cmp edi, 0xf
jg 0x140003fb0
pop rbx
pop rsi
pop rdi
ret
lea edi, [rax - 0x1e]
jmp 0x140003f9f

Function at 0x140004040
Capabilities:
Encode data using xor

Disassembly:
push rdi
push rsi
push rbx
mov r11, rcx
lea eax, [rdx + 5]
lea r10d, [r8 + 0xf]
mov rcx, r9
add rcx, 0x3b9aca00
jns 0x140004079
movsxd rdx, eax
nop dword [rax]
add rcx, rdx
mov rax, rdx
add rdx, 0xa
test rcx, rcx
js 0x140004060
add eax, 0xa
lea r9, [rcx - 0x3b9aca00]
mov ecx, r9d
cmp r9d, 0x1f47f
jg 0x140004133
nop dword [rax]
add ecx, eax
mov edi, eax
add eax, 0xa
cmp ecx, 0x1f47f
jle 0x140004090
lea rsi, [0x140057860]
cmp edi, 5
jle 0x14000412f
nop
sub ecx, edi
jns 0x1400040cb
nop word cs:[rax + rax]
nop
add ecx, r10d
add r10d, 0x1e
test ecx, ecx
js 0x1400040c0
mov edx, ecx
mov r9d, r10d
cmp ecx, 0x1f47f
jg 0x140004127
nop word cs:[rax + rax]
nop word cs:[rax + rax]
nop word cs:[rax + rax]
nop dword [rax]
mov eax, edx
mov r8d, edx
add edx, r9d
add r9d, 0x1e
shr eax, 5
and r8d, 0x1f
lea rbx, [r11 + rax*4]
mov eax, dword [rbx]
xor eax, dword [rsi + r8*4]
mov dword [rbx], eax
cmp edx, 0x1f47f
jle 0x140004100
sub edi, 0xa
cmp edi, 5
jg 0x1400040b0
pop rbx
pop rsi
pop rdi
ret
lea edi, [rax - 0xa]
jmp 0x14000409f
Function at 0x140005440
Capabilities:
Encode data using xor

Disassembly:
push rdi
push rsi
push rbx
movabs rax, 0x6c7967656e657261
mov rsi, qword [r9 + 8]
mov rdi, qword [r9]
movabs r9, 0x646f72616e646f6d
xor rax, rdi
mov r11, r8
mov r10, rcx
mov rcx, rdx
mov ebx, r8d
and r11, 0xfffffffffffffff8
and ebx, 7
shl r8, 0x38
add r11, rdx
movabs rdx, 0x7465646279746573
xor rdx, rsi
xor rsi, r9
movabs r9, 0x736f6d6570736575
xor rdi, r9
cmp rcx, r11
je 0x140005512
nop dword [rax]
mov r9, qword [rcx]
add rdi, rsi
rol rsi, 0xd
add rcx, 8
xor rsi, rdi
rol rdi, 0x20
xor rdx, r9
add rax, rdx
rol rdx, 0x10
xor rdx, rax
add rax, rsi
rol rsi, 0x11
add rdi, rdx
rol rdx, 0x15
xor rsi, rax
xor rdx, rdi
rol rax, 0x20
add rdi, rsi
add rax, rdx
rol rsi, 0xd
rol rdx, 0x10
xor rsi, rdi
rol rdi, 0x20
xor rdx, rax
add rax, rsi
rol rsi, 0x11
add rdi, rdx
rol rdx, 0x15
xor rsi, rax
xor rdx, rdi
rol rax, 0x20
xor rdi, r9
cmp r11, rcx
jne 0x1400054a0
lea r9, [0x140057980]
movsxd rcx, dword [r9 + rbx*4]
add rcx, r9
jmp rcx
movzx ecx, byte [r11 + 6]
shl rcx, 0x30
or r8, rcx
movzx ecx, byte [r11 + 5]
shl rcx, 0x28
or r8, rcx
movzx ecx, byte [r11 + 4]
shl rcx, 0x20
or r8, rcx
movzx ecx, byte [r11 + 3]
shl rcx, 0x18
or r8, rcx
movzx ecx, byte [r11 + 2]
shl rcx, 0x10
or r8, rcx
movzx ecx, byte [r11 + 1]
shl rcx, 8
or r8, rcx
movzx ecx, byte [r11]
or r8, rcx
xor rdx, r8
lea r9, [rsi + rdi]
rol rsi, 0xd
add rax, rdx
rol rdx, 0x10
xor rsi, r9
mov rdi, r9
mov rcx, rdx
rol rdi, 0x20
lea rdx, [rsi + rax]
xor rcx, rax
mov rax, rsi
lea r9, [rdi + rcx]
rol rax, 0x11
rol rcx, 0x15
xor rcx, r9
xor rax, rdx
rol rdx, 0x20
add r9, rax
add rdx, rcx
rol rax, 0xd
rol rcx, 0x10
xor rax, r9
rol r9, 0x20
xor rcx, rdx
add rdx, rax
rol rax, 0x11
add r9, rcx
xor rax, rdx
rol rcx, 0x15
xor r8, r9
rol rdx, 0x20
xor rcx, r9
add r8, rax
xor dl, 0xff
rol rax, 0xd
xor rax, r8
rol r8, 0x20
add rdx, rcx
rol rcx, 0x10
xor rcx, rdx
add rdx, rax
rol rax, 0x11
add r8, rcx
rol rcx, 0x15
xor rax, rdx
xor rcx, r8
rol rdx, 0x20
add r8, rax
add rdx, rcx
rol rax, 0xd
rol rcx, 0x10
xor rax, r8
rol r8, 0x20
xor rcx, rdx
add rdx, rax
rol rax, 0x11
add r8, rcx
rol rcx, 0x15
xor rax, rdx
xor rcx, r8
rol rdx, 0x20
add r8, rax
add rdx, rcx
rol rax, 0xd
rol rcx, 0x10
xor rax, r8
rol r8, 0x20
xor rcx, rdx
add r8, rcx
rol rcx, 0x15
add rdx, rax
rol rax, 0x11
xor rcx, r8
xor rax, rdx
rol rdx, 0x20
add r8, rax
rol rax, 0xd
xor r8, rax
lea rax, [rcx + rdx]
rol rcx, 0x10
mov rdx, rcx
xor rdx, rax
add rax, r8
rol r8, 0x11
rol rdx, 0x15
xor rdx, rax
rol rax, 0x20
xor rdx, r8
xor rax, rdx
mov qword [r10], rax
pop rbx
pop rsi
pop rdi
ret
Function at 0x140005d80
Capabilities:
Write file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xb0
mov rbp, rcx
mov edi, edx
mov rcx, r8
mov r11, r9
mov qword [rsp + 0x78], 4
cmp r9, 3
ja 0x140005e18
mov dword [rsp + 0x80], 0xffffffff
mov byte [rsp + 0xa0], 0xff
mov eax, 0xffffffff
mov word [rsp + 0xa2], ax
mov byte [rsp + 0xa4], 0xff
mov byte [rsp + 0xa5], 0xff
mov byte [rsp + 0x98], 0xff
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, 0x13
mov edx, 1
lea rcx, str.____corrupt_record_n
mov r9, rax
call sym.fwrite
nop
add rsp, 0xb0
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov esi, dword [r8]
bswap esi
mov dword [rsp + 0x80], esi
cmp r9, 4
je 0x140005fe0
movzx eax, byte [r8 + 4]
mov byte [rsp + 0xa0], al
cmp r9, 6
jbe 0x140005dba
movzx ebx, word [r8 + 5]
rol bx, 8
mov word [rsp + 0xa2], bx
cmp r9, 7
je 0x140005dc7
movzx eax, byte [r8 + 7]
mov byte [rsp + 0xa4], al
cmp r9, 8
je 0x140005dcf
movzx eax, byte [r8 + 8]
mov byte [rsp + 0xa5], al
cmp r9, 9
je 0x140005dd7
mov qword [rsp + 0x78], 0xa
movzx eax, byte [r8 + 9]
mov byte [rsp + 0x98], al
cmp al, 6
jne 0x140005ddf
lea r12, [rsp + 0x78]
mov rdx, r9
mov r8, r12
call dbg._get_long
mov r8, r12
mov rdx, r11
mov qword [rsp + 0x88], rax
call dbg._get_long
cmp qword [rbp + 0x228], 0
mov qword [rsp + 0x90], rax
je 0x140005f80
mov rax, qword [rsp + 0x100]
cmp qword [rax + 0x78], 0
jne 0x140005f9c
mov rax, qword [rsp + 0x100]
cmp qword [rax + 0x70], 0
jne 0x140005ff0
mov rax, qword [rsp + 0x98]
lea r9, [rsp + 0x50]
mov r8d, edi
mov rcx, rbp
movdqu xmm0, xmmword [rsp + 0x88]
mov edx, dword [rsp + 0x80]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0xa6]
mov qword [rsp + 0x40], rax
movzx eax, byte [rsp + 0xa5]
movaps xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x38], eax
movzx eax, byte [rsp + 0xa4]
mov dword [rsp + 0x30], eax
movzx eax, bx
mov dword [rsp + 0x28], eax
movzx eax, byte [rsp + 0xa0]
mov dword [rsp + 0x20], eax
call dbg.output_report_status
nop
add rsp, 0xb0
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, esi
mov qword [rbp + 0x228], rax
mov rax, qword [rsp + 0x100]
cmp qword [rax + 0x78], 0
je 0x140005ef4
movdqu xmm1, xmmword [rsp + 0x88]
mov rax, qword [rsp + 0x98]
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x100]
mov qword [rsp + 0x60], rax
movaps xmmword [rsp + 0x50], xmm1
call dbg.massip_has_ip
test eax, eax
je 0x140005e05
movzx ebx, word [rsp + 0xa2]
jmp 0x140005ef4
mov byte [rsp + 0xa0], 0xff
jmp 0x140005dba
movzx edx, bx
mov rcx, rax
call dbg.massip_has_port
test eax, eax
je 0x140005e05
movzx ebx, word [rsp + 0xa2]
jmp 0x140005f07
Function at 0x140006d40
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x30
cmp qword [0x14007e120], 0
je 0x140006d58
add rsp, 0x30
pop rbx
ret
xor edx, edx
lea rcx, str.readscan_x509_names
call dbg.smack_create
mov rdx, qword [str.nasend_]
mov qword [0x14007e120], rax
mov rcx, rax
test rdx, rdx
je 0x140006db8
lea rbx, [0x1400513e0]
nop word cs:[rax + rax]
nop
mov dword [rsp + 0x20], 0
mov r9d, dword [rbx]
add rbx, 0x10
mov r8d, dword [rbx - 0xc]
call dbg.smack_add_pattern
mov rdx, qword [rbx + 8]
mov rcx, qword [0x14007e120]
test rdx, rdx
jne 0x140006d90
add rsp, 0x30
pop rbx
jmp dbg.smack_compile

Function at 0x140007740
Capabilities:
Terminate process
Write file on windows

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbp, rcx
mov rcx, qword [rcx + 0x10]
mov rbx, r8
test rcx, rcx
je 0x140007790
mov r8, qword [rbp + 0xf40]
test r8, r8
jne 0x140007770
mov eax, dword [rbp + 0x18]
test eax, eax
je 0x14000777c
lea rdx, str.rotate_size___llu_n
call sym.fprintf_1
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
movzx edx, byte [r8]
xor r12d, r12d
mov eax, edx
sub edx, 0x30
cmp edx, 9
ja 0x1400077e0
nop word cs:[rax + rax]
nop word cs:[rax + rax]
nop word [rax + rax]
sub eax, 0x30
lea rdx, [r12 + r12*4]
add rbx, 1
movsx rax, al
lea r12, [rax + rdx*2]
movzx edx, byte [rbx]
mov eax, edx
sub edx, 0x30
cmp edx, 9
jbe 0x1400077c0
mov r13, qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_ispunct]
mov r14, qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isspace]
jmp 0x1400077f4
add rbx, 1
movsx esi, byte [rbx]
mov ecx, esi
call r13
test eax, eax
jne 0x1400077f0
mov ecx, esi
call r14
test eax, eax
jne 0x1400077f0
mov ecx, esi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isalpha]
test r12, r12
mov edx, eax
mov eax, 1
cmovne rax, r12
test edx, edx
cmovne r12, rax
test sil, sil
je 0x140007850
mov ecx, esi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
sub eax, 0x65
cmp eax, 0xf
ja case.0x140007848.102
lea rdx, [0x14005860c]
movsxd rax, dword [rdx + rax*4]
add rax, rdx
jmp rax
shl r12, 0x32
nop
mov qword [rbp + 0xf40], r12
jmp 0x14000777c
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, 0x21
mov edx, 1
lea rcx, str.__rotate_size:_unknown_character_n
mov r9, rax
call sym.fwrite
mov ecx, 1
call sym.exit
nop dword [rax + rax]
shl r12, 0x28
jmp 0x140007850
shl r12, 0x14
jmp 0x140007850
shl r12, 0xa
jmp 0x140007850
shl r12, 0x1e
jmp 0x140007850
shl r12, 0x3c
jmp 0x140007850