joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003530
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, str.Rdiffauth_tvdaemon_tfirmas_tquisommesnous_tnewsletters_tmock_tenv_tmcart_tshim_tadlinks_tskiprint_tbirthday_thws_tregistrazione_tauthorization_toptin_tadg_tvpsinfo_tlistuse_twishsort_tnotebook_tstreet_tonlinehelp_tdebt_tpoohbear_teses_tprofessional_tauthoring_tproxy_tdecryption_timieniny_tscottsdale_tcathy_titunes_tcoverimage_tpow_theader_tflickrca_tplayers_tsitemapgen_tzombie_tsearch_tgewerbe_tmsgs_tcfformprotect_tpainter_twpadmin_tTODO_treviewer_temails_ttolyatti_tbryansk
mov r10, rax
sub rbx, rax
movabs rdi, 0x323e34a2b10bf66f
lea r9, [rax + 1]
nop dword [rax + rax]
movsxd r8, r11d
mov rax, rdi
mul r8
mov rax, r8
mov rcx, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1ac
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 1]
mov byte [r9 - 1], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1ac
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [rbx + r9]
mov byte [r9], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1ac
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 + 1]
mov byte [r9 + 1], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1ac
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 + 2]
mov byte [r9 + 2], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1ac
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r9 + 3]
mov byte [r9 + 3], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1ac
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 6]
xor al, byte [rbx + r9 + 4]
mov byte [r9 + 4], al
mov rax, rdi
mul rcx
mov rax, rcx
lea r9, [r9 + 0xa]
sub rax, rdx
add r11d, 0xa
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1ac
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 7]
xor al, byte [rbx + r9 - 5]
mov byte [r9 - 5], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1ac
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 8]
xor al, byte [rbx + r9 - 4]
mov byte [r9 - 4], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1ac
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 9]
xor al, byte [rbx + r9 - 3]
mov byte [r9 - 3], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1ac
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 2]
mov byte [r9 - 2], al
cmp r11d, 0xa
jb 0x140003580
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140004cc0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx - 2]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, str.Rdiffauth_tvdaemon_tfirmas_tquisommesnous_tnewsletters_tmock_tenv_tmcart_tshim_tadlinks_tskiprint_tbirthday_thws_tregistrazione_tauthorization_toptin_tadg_tvpsinfo_tlistuse_twishsort_tnotebook_tstreet_tonlinehelp_tdebt_tpoohbear_teses_tprofessional_tauthoring_tproxy_tdecryption_timieniny_tscottsdale_tcathy_titunes_tcoverimage_tpow_theader_tflickrca_tplayers_tsitemapgen_tzombie_tsearch_tgewerbe_tmsgs_tcfformprotect_tpainter_twpadmin_tTODO_treviewer_temails_ttolyatti_tbryansk
mov r10, rax
sub rbx, rax
movabs rdi, 0x323e34a2b10bf66f
lea r9, [rax + 1]
nop dword [rax + rax]
movsxd r8, r11d
lea r9, [r9 + 6]
mov rax, rdi
mov rcx, r8
mul r8
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1ac
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 7]
mov byte [r9 - 7], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1ac
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [r9 + rbx - 6]
mov byte [r9 - 6], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1ac
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 - 5]
mov byte [r9 - 5], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1ac
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 - 4]
mov byte [r9 - 4], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1ac
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r9 - 3]
mov byte [r9 - 3], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1ac
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 2]
mov byte [r9 - 2], al
add r11d, 6
cmp r11d, 6
jb 0x140004d10
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140005ca0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, str.Rdiffauth_tvdaemon_tfirmas_tquisommesnous_tnewsletters_tmock_tenv_tmcart_tshim_tadlinks_tskiprint_tbirthday_thws_tregistrazione_tauthorization_toptin_tadg_tvpsinfo_tlistuse_twishsort_tnotebook_tstreet_tonlinehelp_tdebt_tpoohbear_teses_tprofessional_tauthoring_tproxy_tdecryption_timieniny_tscottsdale_tcathy_titunes_tcoverimage_tpow_theader_tflickrca_tplayers_tsitemapgen_tzombie_tsearch_tgewerbe_tmsgs_tcfformprotect_tpainter_twpadmin_tTODO_treviewer_temails_ttolyatti_tbryansk
mov r10, rax
sub rbx, rax
movabs rdi, 0x323e34a2b10bf66f
lea r9, [rax + 2]
nop dword [rax + rax]
movsxd r8, r11d
mov rax, rdi
mul r8
mov rax, r8
mov rcx, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1ac
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 2]
movsx eax, al
mov word [r9 - 2], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1ac
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [r9 + rbx]
movsx eax, al
mov word [r9], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1ac
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 + 2]
movsx eax, al
mov word [r9 + 2], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1ac
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 + 4]
movsx eax, al
mov word [r9 + 4], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1ac
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r9 + 6]
movsx eax, al
mov word [r9 + 6], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1ac
sub rcx, rax
movzx eax, byte [rcx + rsi]
add r11d, 6
xor al, byte [rbx + r9 + 8]
lea r9, [r9 + 0xc]
movsx eax, al
mov word [r9 - 4], ax
cmp r11d, 6
jb 0x140005cf0
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14000e120
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
movsxd rax, dword [rcx + 0x3c]
mov r12, rdx
mov rdx, rcx
mov ecx, dword [rax + rcx + 0x88]
xor eax, eax
add rcx, rdx
mov dword [rbp - 0x2c], eax
mov qword [rbp - 0x28], rcx
mov r8d, dword [rcx + 0x1c]
mov r9d, dword [rcx + 0x20]
add r8, rdx
mov r10d, dword [rcx + 0x24]
add r9, rdx
add r10, rdx
mov qword [rbp - 0x20], r8
mov qword [rbp - 0x18], r9
mov qword [rbp - 0x10], r10
cmp dword [rcx + 0x18], eax
jbe 0x14000e34e
mov word [rbp + 0x50], 0x6452
mov word [rbp + 0x58], 0x6452
nop
mov esi, dword [r9 + rax*4]
lea rcx, [rbp + 0x50]
movzx eax, word [r10 + rax*2]
add rsi, rdx
xor edi, edi
mov r15d, dword [r8 + rax*4]
add r15, rdx
mov qword [rbp - 8], r15
call fcn.1400018c0
movzx ecx, byte [rax]
cmp byte [rsi], cl
je 0x14000e1d4
nop dword [rax]
lea rcx, [rbp + 0x50]
inc rdi
call fcn.1400018c0
movzx ecx, byte [rax]
cmp byte [rdi + rsi], cl
jne 0x14000e1c0
lea rcx, [rbp + 0x58]
xor ebx, ebx
call fcn.1400018c0
movzx ecx, byte [rax]
cmp byte [r12], cl
je 0x14000e205
nop dword [rax + rax]
lea rcx, [rbp + 0x58]
inc rbx
call fcn.1400018c0
movzx ecx, byte [rax]
cmp byte [rbx + r12], cl
jne 0x14000e1f0
cmp rdi, rbx
jne 0x14000e322
mov r13, rsi
mov word [rbp - 0x50], 0x6452
sub r13, r12
mov r14, r12
nop dword [rax]
lea rcx, [rbp - 0x50]
xor ebx, ebx
call fcn.1400018c0
movzx ecx, byte [rax]
cmp byte [rsi], cl
je 0x14000e246
lea rcx, [rbp - 0x50]
inc rbx
call fcn.1400018c0
movzx ecx, byte [rax]
cmp byte [rbx + rsi], cl
jne 0x14000e232
mov rax, r14
sub rax, r12
dec rbx
cmp rax, rbx
jae 0x14000e348
movsx r15d, byte [r14 + r13]
lea rcx, [rbp - 0x4e]
mov dword [rbp - 0x4e], 0x640033
call fcn.1400027f0
movzx eax, word [rax]
cmp r15d, eax
jl 0x14000e2b8
lea rcx, [rbp - 0x4a]
mov dword [rbp - 0x4a], 0x640028
call fcn.1400027f0
movzx ecx, word [rax]
cmp r15d, ecx
jg 0x14000e2b8
lea rcx, [rbp - 0x46]
mov dword [rbp - 0x46], 0x640033
mov dword [rbp - 0x42], 0x640013
call fcn.1400027f0
lea rcx, [rbp - 0x42]
movzx ebx, byte [rax]
call fcn.1400027f0
movzx ecx, byte [rax]
sub cl, bl
add r15b, cl
movsx edi, byte [r14]
lea rcx, [rbp - 0x3e]
mov dword [rbp - 0x3e], 0x640033
call fcn.1400027f0
movzx eax, word [rax]
cmp edi, eax
jl 0x14000e315
lea rcx, [rbp - 0x3a]
mov dword [rbp - 0x3a], 0x640028
call fcn.1400027f0
movzx ecx, word [rax]
cmp edi, ecx
jg 0x14000e315
lea rcx, [rbp - 0x36]
mov dword [rbp - 0x36], 0x640033
mov dword [rbp - 0x32], 0x640013
call fcn.1400027f0
lea rcx, [rbp - 0x32]
movzx ebx, byte [rax]
call fcn.1400027f0
movzx ecx, byte [rax]
sub cl, bl
add dil, cl
cmp r15b, dil
jne 0x14000e322
inc r14
jmp 0x14000e220
mov eax, dword [rbp - 0x2c]
mov rcx, qword [rbp - 0x28]
inc eax
mov dword [rbp - 0x2c], eax
cmp eax, dword [rcx + 0x18]
jae 0x14000e34e
mov rdx, qword [rbp + 0x40]
mov r8, qword [rbp - 0x20]
mov r9, qword [rbp - 0x18]
mov r10, qword [rbp - 0x10]
jmp 0x14000e190
mov rax, qword [rbp - 8]
jmp 0x14000e350
xor eax, eax
mov rbx, qword [rsp + 0xb8]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000f260
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rdi, qword [rax + 0x18]
add rdi, 0x20
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x14000f2c2
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rbx + 0x40]
mov rdx, rsi
mov r8, rax
call fcn.14000ebf0
test al, al
jne 0x14000f2d4
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x14000f290
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rbx + 0x20]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov eax, 0x76
mov dword [rbp - 0x20], 0x210019
lea rcx, [rbp - 0x20]
mov word [rbp - 0xc], ax
mov dword [rbp - 0x1c], 0x28003b
mov dword [rbp - 0x18], 0x2d0023
mov dword [rbp - 0x14], 0x350037
mov dword [rbp - 0x10], 0x4c003b
call fcn.140005e60
mov rcx, rax
call 0x14000f260
mov qword [0x1400181b8], rax
lea rcx, [rbp - 0x20]
mov eax, 0x68
mov dword [rbp - 0x20], 0x210019
mov word [rbp - 0x10], ax
mov dword [rbp - 0x1c], 0x28003b
mov dword [rbp - 0x18], 0x2d0023
mov dword [rbp - 0x14], 0x460046
call fcn.140002590
mov rcx, rax
call 0x14000f260
lea rcx, [rbp - 0x20]
mov qword [0x1400181a8], rax
mov dword [rbp - 0x20], 0x10003c
mov dword [rbp - 0x1c], 0xa000d
mov dword [rbp - 0x18], 0x61000a
call fcn.140005ca0
mov rcx, rax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
jmp 0x14000f260
Function at 0x14000fac0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rbx, qword [0x1400181c0]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0xc0001
mov dword [rbp - 0x1c], 0xa000c
mov dword [rbp - 0x18], 0x52000a
mov dword [rbp - 0x14], 0x5a0047
mov dword [rbp - 0x10], 0x65000c
mov dword [rbp - 0xc], 0x64001a
call fcn.140002e40
mov rcx, rax
call rbx
mov rbx, qword [0x1400181c0]
lea rcx, [rbp - 0x20]
mov qword [0x1400181a0], rax
mov dword [rbp - 0x20], 0xd0005
mov dword [rbp - 0x1c], 0xf0007
mov dword [rbp - 0x18], 0x40008
mov dword [rbp - 0x14], 0x5a0001
mov dword [rbp - 0x10], 0x65000c
mov dword [rbp - 0xc], 0x64001a
call fcn.140002e40
mov rcx, rax
call rbx
movdqa xmm0, xmmword [0x140017490]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140018130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400181b0], rax
mov word [rbp - 0x10], 0x5e18
mov byte [rbp - 0xe], 0x66
call fcn.140005220
mov rcx, qword [0x1400181a0]
mov rdx, rax
call rbx
mov rbx, qword [0x140018130]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0xa0c0c01
mov dword [rbp - 0x1c], 0x110d240a
mov dword [rbp - 0x18], 0x1027c0b
mov word [rbp - 0x14], 0x6536
call fcn.140001180
mov rcx, qword [0x1400181a0]
mov rdx, rax
call rbx
mov rbx, qword [0x140018130]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x31d0a1b
mov dword [rbp - 0x1c], 0x100f14
mov dword [rbp - 0x18], 0xa137927
mov word [rbp - 0x14], 0x6520
call fcn.140001180
mov rcx, qword [0x1400181b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x140017570]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140018130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400180e8], rax
mov byte [rbp - 0x10], 0x6e
call fcn.140004e60
mov rcx, qword [0x1400181b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x140017460]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140018130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400180f0], rax
mov dword [rbp - 0x10], 0x6903650a
call fcn.1400029f0
mov rcx, qword [0x1400181b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x1400174b0]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140018130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400180e0], rax
mov byte [rbp - 0x10], 0x6e
call fcn.140004e60
mov rcx, qword [0x1400181b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x140017530]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140018130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400180d8], rax
mov dword [rbp - 0x10], 0x28086607
mov byte [rbp - 0xc], 0x72
call fcn.140003790
mov rcx, qword [0x1400181b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x140017420]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140018130]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x10], 0x4800
mov byte [rbp - 0xe], 0x66
call fcn.140005220
mov rcx, qword [0x1400181b0]
mov rdx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rbp
jmp rax
Function at 0x14000fd40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rdi, qword [rax + 0x18]
add rdi, 0x20
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x14000f2c2
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rbx + 0x40]
mov rdx, rsi
mov r8, rax
call fcn.14000ebf0
test al, al
jne 0x14000f2d4
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x14000f290
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rbx + 0x20]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov eax, 0x76
mov dword [rbp - 0x20], 0x210019
lea rcx, [rbp - 0x20]
mov word [rbp - 0xc], ax
mov dword [rbp - 0x1c], 0x28003b
mov dword [rbp - 0x18], 0x2d0023
mov dword [rbp - 0x14], 0x350037
mov dword [rbp - 0x10], 0x4c003b
call fcn.140005e60
mov rcx, rax
call 0x14000f260
mov qword [0x1400181b8], rax
lea rcx, [rbp - 0x20]
mov eax, 0x68
mov dword [rbp - 0x20], 0x210019
mov word [rbp - 0x10], ax
mov dword [rbp - 0x1c], 0x28003b
mov dword [rbp - 0x18], 0x2d0023
mov dword [rbp - 0x14], 0x460046
call fcn.140002590
mov rcx, rax
call 0x14000f260
lea rcx, [rbp - 0x20]
mov qword [0x1400181a8], rax
mov dword [rbp - 0x20], 0x10003c
mov dword [rbp - 0x1c], 0xa000d
mov dword [rbp - 0x18], 0x61000a
call fcn.140005ca0
mov rcx, rax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
jmp 0x14000f260
Function at 0x14000721c
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp dword [0x140072044], 2
mov edi, r8d
mov esi, edx
mov rbx, rcx
jl 0x14000727c
movdqa xmm0, xmmword [0x140047bb0]
movdqa xmm1, xmmword [0x140047ba0]
movdqa xmmword [0x14005cda0], xmm0
movdqa xmm0, xmmword [0x140047b80]
movdqa xmmword [0x14005cdb0], xmm1
movdqa xmm1, xmmword [0x140047b90]
movdqa xmmword [0x14005cdc0], xmm0
movdqa xmmword [0x14005cdd0], xmm1
xor edx, edx
mov r8d, 0xf0
call fcn.140032b80
xor edx, edx
mov qword [rbx + 0x110], rdx
mov byte [rbx + 0x118], dl
mov rcx, qword [rbx + 0xf8]
lea rax, [0x140047b60]
mov eax, dword [rdx + rax]
mov dword [rdx + rcx], eax
add rdx, 4
cmp rdx, 0x20
jl 0x140007298
mov rax, qword [rbx + 0xf8]
bts edi, 0xd
shl edi, 0x10
xor dword [rax], 0x2080020
mov rax, qword [rbx + 0xf8]
xor dword [rax + 8], esi
mov rax, qword [rbx + 0xf8]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
xor dword [rax + 0xc], edi
add rsp, 0x20
pop rdi
ret

Function at 0x14000822c
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
xor r14d, r14d
mov bpl, dl
mov word [rcx + 0x93ea], r14w
mov rsi, rcx
mov byte [rcx + 0x93e1], r14b
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x40]
call fcn.14000787c
mov rdi, rax
test rax, rax
je 0x1400082b1
mov rbx, qword [rsp + 0x40]
mov rcx, rbx
call fcn.14003651c
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.14000787c
mov rdi, rax
test rax, rax
je 0x1400082b1
mov rbx, qword [rsp + 0x40]
mov rcx, rsi
mov rdx, rbx
test bpl, bpl
je 0x1400082aa
call fcn.1400083f4
jmp 0x140008276
call fcn.140007f6c
jmp 0x140008276
test bpl, bpl
jne 0x1400082be
mov rcx, rsi
call fcn.1400082d4
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x14000a8c0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x850
mov rax, qword [0x14005c318]
xor rax, rsp
mov qword [rsp + 0x840], rax
mov rax, rdx
mov rdi, r8
mov rbx, rcx
lea rdx, [rsp + 0x40]
mov rcx, rax
mov r8d, 0x400
call fcn.1400237cc
mov esi, 1
mov ecx, esi
call fcn.140039ba0
xor r14d, r14d
cmp rbx, rax
jne 0x14000a919
cmp byte [0x14005ddfd], r14b
jne 0x14000a93b
mov ebp, 2
mov ecx, ebp
call fcn.140039ba0
cmp rbx, rax
jne 0x14000aa03
cmp byte [0x14005ddfe], r14b
je 0x14000aa03
mov ecx, esi
call fcn.140039ba0
sub rbx, rax
neg rbx
sbb ecx, ecx
add ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbp, rax
call fcn.140005cc4
mov qword [rsp + 0x28], rdi
lea r9, [rsp + 0x40]
mov esi, 0x1800
mov qword [rsp + 0x20], r14
lea rdi, [0x140060600]
mov r8d, esi
mov rcx, qword [rax]
mov rdx, rdi
call fcn.14003894c
mov ecx, dword [0x14005ddf8]
cmp ecx, 3
jne 0x14000a9a5
or r8, 0xffffffffffffffff
inc r8
cmp word [rdi + r8*2], r14w
jne 0x14000a993
add r8d, r8d
mov rdx, rdi
jmp 0x14000a9ee
lea rbx, [0x140063600]
cmp ecx, 4
mov rdx, rbx
mov r8, rsi
mov rcx, rdi
jne 0x14000a9c1
call fcn.140025ee4
jmp 0x14000a9c6
call fcn.140025e4c
test dword [0x14005ddf8], 0xfffffffd
jne 0x14000a9de
mov rdx, rbx
mov rcx, rbx
call qword [sym.imp.USER32.dll_CharToOemA]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rbx + r8], r14b
jne 0x14000a9e2
mov rdx, rbx
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], r14
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x14000aa6c
call fcn.140005cc4
mov qword [rsp + 0x28], rdi
lea r9, [rsp + 0x40]
lea rdi, [0x140060600]
mov qword [rsp + 0x20], r14
mov r8d, 0x1800
mov rdx, rdi
mov rcx, qword [rax]
call fcn.14003894c
mov ecx, ebp
call fcn.140039ba0
mov ecx, r14d
cmp rbx, rax
setne cl
add ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
or r8, 0xffffffffffffffff
inc r8
cmp word [rdi + r8*2], r14w
jne 0x14000aa4c
lea r9, [rsp + 0x34]
mov qword [rsp + 0x20], r14
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.140030e20
add rsp, 0x850
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret