joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180001240
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov rax, qword gs:[0x30]
mov rbx, rcx
mov rdx, qword [rax + 0x60]
mov rdi, qword [rdx + 0x18]
add rdi, 0x20
mov r10, qword [rdi]
cmp r10, rdi
je 0x1800012d1
nop word [rax + rax]
test rbx, rbx
je 0x1800012de
mov r9, qword [r10 + 0x50]
mov r11, rbx
test r9, r9
je 0x1800012c9
nop dword [rax]
nop word [rax + rax]
movsx edx, byte [r11]
lea r11, [r11 + 1]
movzx r8d, word [r9]
lea r9, [r9 + 2]
lea ecx, [rdx - 0x41]
cmp cx, 0x19
lea eax, [rdx + 0x20]
lea ecx, [r8 - 0x41]
cmova ax, dx
cmp cx, 0x19
lea edx, [r8 + 0x20]
cmova dx, r8w
test ax, ax
je 0x1800012de
cmp ax, dx
je 0x180001290
mov r10, qword [r10]
cmp r10, rdi
jne 0x180001270
xor eax, eax
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
mov rax, qword [r10 + 0x20]
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret

Function at 0x1800012f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
movsxd rax, dword [rcx + 0x3c]
xor r11d, r11d
mov rdi, rdx
mov rbx, rcx
mov esi, dword [rax + rcx + 0x88]
add rsi, rcx
mov ebp, dword [rsi + 0x18]
test ebp, ebp
je 0x1800013a4
mov r15d, dword [rsi + 0x24]
mov r12d, dword [rsi + 0x20]
lea rax, [r15 + r11*2]
movzx r14d, word [rax + rbx]
lea rax, [r12 + r11*4]
mov r9d, dword [rax + rbx]
add r9, rbx
test rdi, rdi
je 0x18000139c
test r9, r9
je 0x18000139c
mov r10, rdi
sub r10, r9
nop dword [rax]
nop dword [rax + rax]
movsx ecx, byte [r10 + r9]
movsx edx, byte [r9]
lea r9, [r9 + 1]
lea eax, [rcx - 0x41]
cmp ax, 0x19
lea r8d, [rcx + 0x20]
lea eax, [rdx + 0x20]
cmova r8w, cx
lea ecx, [rdx - 0x41]
cmp cx, 0x19
cmova ax, dx
test r8w, r8w
jne 0x180001396
test ax, ax
je 0x1800013c1
cmp r8w, ax
je 0x180001360
inc r11d
cmp r11d, ebp
jb 0x180001330
xor eax, eax
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
pop r15
pop r14
pop r12
ret
mov ecx, dword [rsi + 0x1c]
add rcx, rbx
mov eax, dword [rcx + r14*4]
add rax, rbx
jmp 0x1800013a6
Function at 0x180002450
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rsi
mov r11, rcx
rdtsc
shl rdx, 0x20
or rax, rdx
mov r8, rax
rdtsc
shl rdx, 0x20
or rax, rdx
imul r8, rax
rdtsc
shl rdx, 0x20
movabs rsi, 0xaaaaaaaaaaaaaaab
or rax, rdx
xor r9d, r9d
imul r8, rax
mov rax, rsi
mul r8
shr rdx, 3
lea rax, [rdx + rdx*2]
shl rax, 2
sub r8, rax
add r8d, 8
movsxd r10, r8d
test r8d, r8d
jle 0x1800025f6
mov qword [rsp + 0x10], rbx
mov r8d, r9d
mov qword [rsp + 0x18], rdi
movabs rbx, 0x4ec4ec4ec4ec4ec5
movabs rdi, 0xcccccccccccccccd
nop
rdtsc
shl rdx, 0x20
or rax, rdx
mov rcx, rax
rdtsc
shl rdx, 0x20
or rax, rdx
imul rcx, rax
rdtsc
shl rdx, 0x20
or rax, rdx
imul rcx, rax
mov rax, rsi
mul rcx
shr rdx, 1
lea rax, [rdx + rdx*2]
sub rcx, rax
je 0x180002597
sub rcx, 1
je 0x18000255b
cmp rcx, 1
jne 0x1800025d9
rdtsc
shl rdx, 0x20
or rax, rdx
mov rcx, rax
rdtsc
shl rdx, 0x20
or rax, rdx
imul rcx, rax
rdtsc
shl rdx, 0x20
or rax, rdx
imul rcx, rax
mov rax, rdi
mul rcx
shr rdx, 3
lea rax, [rdx + rdx*4]
add rax, rax
sub rcx, rax
add cl, 0x30
jmp 0x1800025d1
rdtsc
shl rdx, 0x20
or rax, rdx
mov rcx, rax
rdtsc
shl rdx, 0x20
or rax, rdx
imul rcx, rax
rdtsc
shl rdx, 0x20
or rax, rdx
imul rcx, rax
mov rax, rbx
mul rcx
shr rdx, 3
imul rax, rdx, 0x1a
sub rcx, rax
add cl, 0x61
jmp 0x1800025d1
rdtsc
shl rdx, 0x20
or rax, rdx
mov rcx, rax
rdtsc
shl rdx, 0x20
or rax, rdx
imul rcx, rax
rdtsc
shl rdx, 0x20
or rax, rdx
imul rcx, rax
mov rax, rbx
mul rcx
shr rdx, 3
imul rax, rdx, 0x1a
sub rcx, rax
add cl, 0x41
movsx eax, cl
mov word [r11 + r8*2], ax
inc r8
cmp r8, r10
jl 0x1800024d0
mov rdi, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x10]
mov word [r11 + r10*2], r9w
pop rsi
ret
mov word [rcx + r10*2], r9w
pop rsi
ret

Function at 0x180002970
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
lea rax, [0x180183440]
nop word [rax + rax]
movzx ecx, r8b
lea rax, [rax + 1]
imul edx, ecx, 0x22
inc r8d
add dl, 0x7b
xor byte [rax - 1], dl
cmp r8d, 0x3aa0
jb 0x180002980
ret
Function at 0x180003840
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
push r14
mov rbp, rdx
mov r14, r8
mov rsi, rcx
sub rbp, qword [rcx + 0x30]
je 0x1800039af
movzx eax, word [rcx + 0x14]
lea r9, [rcx + 0x18]
mov r10d, dword [rcx + 0xb0]
add r9, rax
movzx eax, word [rcx + 6]
lea rdx, [rax + rax*4]
lea r8, [r9 + rdx*8]
cmp r9, r8
jae 0x1800039af
mov ecx, dword [r9 + 0xc]
cmp r10, rcx
jb 0x180003896
mov eax, dword [r9 + 8]
add eax, ecx
cmp r10, rax
jb 0x1800038a8
add r9, 0x28
cmp r9, r8
jb 0x180003882
mov rbp, qword [rsp + 0x30]
pop r14
pop rsi
ret
mov eax, dword [rsi + 0xb4]
mov qword [rsp + 0x18], rbx
mov ebx, dword [r9 + 0x14]
sub rbx, rcx
mov qword [rsp + 0x28], r15
add rbx, r10
add rbx, r14
lea r15, [rbx + rax]
je 0x1800039a5
test eax, eax
je 0x1800039a5
cmp rbx, r15
jae 0x1800039a5
mov qword [rsp + 0x20], rdi
mov eax, dword [rbx + 4]
test eax, eax
je 0x1800039a0
lea ecx, [rax - 8]
shr ecx, 1
je 0x180003994
lea r11, [rbx + 8]
mov edi, ecx
movzx r8d, word [r11]
movzx eax, r8w
shr ax, 0xc
and r8d, 0x80000fff
jge 0x180003923
dec r8d
or r8d, 0xfffff000
inc r8d
cmp ax, 3
je 0x18000392f
cmp ax, 0xa
jne 0x180003983
movzx eax, word [rsi + 0x14]
movzx ecx, word [rsi + 6]
add rax, 0x18
mov r9d, dword [rbx]
add rax, rsi
lea rdx, [rcx + rcx*4]
lea r10, [rax + rdx*8]
cmp rax, r10
jae 0x180003983
nop
mov edx, dword [rax + 0xc]
cmp r9, rdx
jb 0x180003962
mov ecx, dword [rax + 8]
add ecx, edx
cmp r9, rcx
jb 0x18000396d
add rax, 0x28
cmp rax, r10
jb 0x180003950
jmp 0x180003983
mov ecx, dword [rax + 0x14]
sub rcx, rdx
add rcx, r9
add rcx, r14
je 0x180003983
movzx eax, r8w
add qword [rax + rcx], rbp
add r11, 2
sub rdi, 1
jne 0x180003901
mov eax, dword [rbx + 4]
add rbx, rax
cmp rbx, r15
jb 0x1800038e5
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x18]
mov r15, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
pop r14
pop rsi
ret
Function at 0x180004890
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
xor ebp, ebp
mov rdi, rcx
cmp qword [rcx + 0x18], 8
mov dword [rsp + 0x50], ebp
jb 0x1800048b2
mov rcx, qword [rcx]
mov qword [rsp + 0x30], rbp
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x10000000
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
jne 0x180004946
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x180004925
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x180004920
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1800049f2
mov rcx, r8
call fcn.180005380
mov al, 1
mov word [rdi], bp
mov qword [rdi + 0x10], rbp
mov qword [rdi + 0x18], 7
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
cmp rsi, 0xffffffffffffffff
jne 0x180004960
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x1800049d4
lea rdx, [rdx*2 + 2]
jmp 0x1800049ab
lea r9, [rsp + 0x50]
mov qword [rsp + 0x58], rbx
mov r8d, 0x17a400
mov qword [rsp + 0x20], rbp
lea rdx, [0x180009040]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rdi + 0x18]
test bl, bl
mov rbx, qword [rsp + 0x58]
jne 0x1800049db
cmp rax, 8
jb 0x1800049d4
lea rdx, [rax*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x1800049cf
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1800049f2
mov rcx, r8
call fcn.180005380
xor al, al
jmp 0x180004927
cmp rax, 8
jb 0x180004925
lea rdx, [rax*2 + 2]
jmp 0x1800048f8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x180004a00
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
xor ebp, ebp
mov rdi, rcx
cmp qword [rcx + 0x18], 8
mov dword [rsp + 0x50], ebp
jb 0x180004a22
mov rcx, qword [rcx]
mov qword [rsp + 0x30], rbp
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x10000000
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
jne 0x180004ab6
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x180004a95
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x180004a90
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180004b62
mov rcx, r8
call fcn.180005380
mov al, 1
mov word [rdi], bp
mov qword [rdi + 0x10], rbp
mov qword [rdi + 0x18], 7
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
cmp rsi, 0xffffffffffffffff
jne 0x180004ad0
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x180004b44
lea rdx, [rdx*2 + 2]
jmp 0x180004b1b
lea r9, [rsp + 0x50]
mov qword [rsp + 0x58], rbx
mov r8d, 0x22c00
mov qword [rsp + 0x20], rbp
lea rdx, [0x1801898e0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rdi + 0x18]
test bl, bl
mov rbx, qword [rsp + 0x58]
jne 0x180004b4b
cmp rax, 8
jb 0x180004b44
lea rdx, [rax*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x180004b3f
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180004b62
mov rcx, r8
call fcn.180005380
xor al, al
jmp 0x180004a97
cmp rax, 8
jb 0x180004a95
lea rdx, [rax*2 + 2]
jmp 0x180004a68
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14001b250
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x14001b284
mov eax, esi
lea ecx, [rax - 0x60]
xor byte [r8 + rax], cl
inc rax
cmp rax, 6
jb 0x14001b270
mov byte [r8 + 7], sil
add r8, 6
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140019ec0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x14001b2a9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140026d30
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14001b323
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b31e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001b31e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007c980
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x14001b330
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 9], sil
je 0x14001b364
mov eax, esi
lea ecx, [rax - 0x60]
xor byte [r8 + rax], cl
inc rax
cmp rax, 8
jb 0x14001b350
mov byte [r8 + 9], sil
add r8, 8
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140019ec0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x14001b389
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140026d30
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14001b403
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b3fe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001b3fe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007c980
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x14001b410
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xa], sil
je 0x14001b444
mov eax, esi
lea ecx, [rax - 0x60]
xor byte [r8 + rax], cl
inc rax
cmp rax, 9
jb 0x14001b430
mov byte [r8 + 0xa], sil
add r8, 9
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140019ec0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x14001b469
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140026d30
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14001b4e3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b4de
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001b4de
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007c980
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x14001b4f0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xc], sil
je 0x14001b524
mov eax, esi
lea ecx, [rax - 0x60]
xor byte [r8 + rax], cl
inc rax
cmp rax, 0xb
jb 0x14001b510
mov byte [r8 + 0xc], sil
add r8, 0xb
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140019ec0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x14001b549
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140026d30
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14001b5c3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b5be
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001b5be
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007c980
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140022310
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 9], al
je 0x140022333
lea edx, [rax - 0x60]
xor byte [rax + rcx], dl
inc rax
cmp rax, 8
jb 0x140022320
mov byte [rcx + 9], 0
lea r8, [rcx + 8]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.140019ec0
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x140022350
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 0x10], al
je 0x140022373
lea edx, [rax - 0x60]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xf
jb 0x140022360
mov byte [rcx + 0x10], 0
lea r8, [rcx + 0xf]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.140019ec0
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140023120
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x140023143
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x60]
xor byte [rax + rcx], dl
inc rax
cmp rax, 4
jb 0x140023130
mov byte [rcx + 5], 0
mov rax, rcx
ret

Function at 0x140023150
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x136], 0
je 0x140023178
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x60]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x135
jb 0x140023160
mov byte [rcx + 0x136], 0
mov rax, rcx
ret

Function at 0x140023180
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x44], 0
je 0x1400231a3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x60]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x43
jb 0x140023190
mov byte [rcx + 0x44], 0
mov rax, rcx
ret

Function at 0x1400231b0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x47], 0
je 0x1400231d3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x60]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x46
jb 0x1400231c0
mov byte [rcx + 0x47], 0
mov rax, rcx
ret

Function at 0x1400231e0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0xa8
xor eax, eax
cmp byte [0x14009c658], al
jne 0x140023291
movdqa xmm0, xmmword [0x14007fed0]
movdqa xmm1, xmmword [0x140080090]
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmm0, xmmword [0x140080120]
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmm0, xmmword [0x14007fe80]
movdqa xmmword [rsp + 0x50], xmm1
movdqa xmm1, xmmword [0x14007ff90]
movdqa xmmword [rsp + 0x80], xmm0
movdqa xmmword [rsp + 0x70], xmm1
mov dword [rsp + 0x90], 0x100829e
nop dword [rax]
lea ecx, [rax - 0x60]
xor byte [rsp + rax + 0x40], cl
inc rax
cmp rax, 0x52
jb 0x140023250
lea r9, [rsp + 0xb0]
mov byte [rsp + 0x93], 0
lea r8, [rsp + 0x92]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.140019ec0
lea rcx, [rsp + 0x20]
call fcn.1400248f0
add rsp, 0xa8
ret
Function at 0x1400248f0
Capabilities:
Encode data using xor
Execute command

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
mov rax, qword [0x14009c0c0]
xor rax, rsp
mov qword [rbp + 0x4f], rax
mov rbx, rcx
mov qword [rbp + 0x27], rcx
movdqa xmm0, xmmword [0x14007ff30]
movdqu xmmword [rbp - 0x49], xmm0
mov word [rbp - 0x39], 0x100
xor ecx, ecx
nop dword [rax]
lea eax, [rcx - 0x60]
xor byte [rbp + rcx - 0x49], al
inc rcx
cmp rcx, 0x10
jb 0x140024930
mov byte [rbp - 0x38], 0
movdqa xmm0, xmmword [0x140080040]
movdqu xmmword [rbp - 0x31], xmm0
movdqa xmm1, xmmword [0x140080070]
movdqu xmmword [rbp - 0x21], xmm1
mov dword [rbp - 0x11], 0xe3b0aeb2
mov dword [rbp - 0xd], 0xa2e6e3e2
mov dword [rbp - 9], 0xeba5a1ab
mov word [rbp - 5], 0x100
xor ecx, ecx
nop dword [rax + rax]
lea eax, [rcx - 0x60]
xor byte [rbp + rcx - 0x31], al
inc rcx
cmp rcx, 0x2c
jb 0x140024980
mov byte [rbp - 4], 0
mov r8, rbx
lea rdx, [rbp - 0x31]
lea rcx, [rbp + 7]
call fcn.14001b0f0
nop
lea rcx, [rbp - 0x49]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rcx + r8], 0
jne 0x1400249b0
lea rdx, [rbp - 0x49]
mov rcx, rax
call fcn.140018d40
xorps xmm0, xmm0
movups xmmword [rbp + 0x2f], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x3f], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x2f], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x3f], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0xf
jbe 0x140024a35
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140024a30
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140024a30
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007c980
lea rcx, [rbp + 0x2f]
cmp qword [rbp + 0x47], 0xf
cmova rcx, qword [rbp + 0x2f]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor ecx, ecx
int 0x29
mov rdx, qword [rbp + 0x47]
cmp rdx, 0xf
jbe 0x140024a8b
inc rdx
mov rcx, qword [rbp + 0x2f]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140024a86
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140024a86
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007c980
movdqa xmm0, xmmword [0x140091210]
movdqu xmmword [rbp + 0x3f], xmm0
mov byte [rbp + 0x2f], 0
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x140024ad2
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x140024acd
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140024b02
mov rcx, r8
call fcn.14007c980
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.14007c530
mov rbx, qword [rsp + 0xd8]
add rsp, 0xc0
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140028560
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x14009c0c0]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rdx
mov rsi, rcx
mov qword [rbp - 0x18], rdx
xor ebx, ebx
mov dword [rbp - 0x50], 0xc0c1d4d3
mov dword [rbp - 0x4c], 0xd5d6c1
mov byte [rbp - 0x48], 1
mov ecx, ebx
nop dword [rax]
lea eax, [rcx - 0x60]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 7
jb 0x1400285a0
mov byte [rbp - 0x48], 0
lea r9, [rbp - 0x40]
lea r8, [rbp - 0x49]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x38]
call fcn.140019ec0
nop
cmp byte [rdi], 0
jne 0x1400285db
mov byte [rdi], 1
call fcn.14001d1e0
mov qword [rdi + 8], rax
cmp byte [rdi], 1
jne 0x1400285f2
lea rdx, [rbp - 0x38]
mov rcx, qword [rdi + 8]
call fcn.140022220
mov rcx, rax
jmp 0x1400285f6
mov rcx, qword [rbp - 0x18]
lea rax, [rcx + 8]
cmp byte [rcx], 4
cmovne rax, rbx
movzx eax, byte [rax]
mov byte [rsi + 0x210], al
mov rdx, qword [rbp - 0x20]
cmp rdx, 0xf
jbe 0x140028648
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140028643
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140028643
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007c980
mov dword [rbp - 0x50], 0xd0d1c4cd
mov dword [rbp - 0x4c], 0xc3c2c5
mov byte [rbp - 0x48], 1
nop word [rax + rax]
lea eax, [rbx - 0x60]
xor byte [rbp + rbx - 0x50], al
inc rbx
cmp rbx, 7
jb 0x140028660
mov byte [rbp - 0x48], 0
lea r9, [rbp - 0x40]
lea r8, [rbp - 0x49]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x38]
call fcn.140019ec0
nop
cmp byte [rdi], 0
jne 0x14002869b
mov byte [rdi], 1
call fcn.14001d1e0
mov qword [rdi + 8], rax
cmp byte [rdi], 1
jne 0x1400286af
lea rdx, [rbp - 0x38]
mov rcx, qword [rdi + 8]
call fcn.140022220
jmp 0x1400286b3
mov rax, qword [rbp - 0x18]
lea rcx, [rsi + 0x218]
mov rdx, rax
call fcn.14001af20
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0xf
jbe 0x140028702
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400286fc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400286fc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007c980
nop
lea rcx, [rdi + 8]
movzx edx, byte [rdi]
call fcn.140023f60
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14007c530
mov rbx, qword [rsp + 0xa0]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
Function at 0x140032220
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
cdqe
add rsp, 0x28
ret