joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007a000
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
cmp byte [rcx + 0xf1e], 0
movsxd r10, r9d
je 0x14007a124
cmp r8d, 0xff
jne 0x14007a061
lea eax, [r10 - 0xec]
cmp eax, 0x13
ja 0x14007a04b
lea r8, [0x140000000]
mov r9, qword [r8 + r10*8 + 0x9e4c0]
mov r8, rdx
lea rdx, str._s_IAC__s_n
add rsp, 0x38
jmp fcn.140056660
mov r8, rdx
mov r9d, r10d
lea rdx, str._s_IAC__d_n
add rsp, 0x38
jmp fcn.140056660
cmp r8d, 0xfb
jne 0x14007a073
lea r9, str.WILL
jmp 0x14007a0b1
cmp r8d, 0xfc
jne 0x14007a085
lea r9, str.WONT
jmp 0x14007a0b1
cmp r8d, 0xfd
jne 0x14007a097
lea r9, [0x14009eee4]
jmp 0x14007a0b1
xor r9d, r9d
lea rax, str.DONT
cmp r8d, 0xfe
cmove r9, rax
test r9, r9
je 0x14007a10d
cmp r10d, 0x27
jg 0x14007a0e4
lea r8, [0x140000000]
mov r8, qword [r8 + r10*8 + 0x9eae0]
test r8, r8
jne 0x14007a0f4
mov r8, rdx
mov dword [rsp + 0x20], r10d
lea rdx, str._s__s__d_n
call fcn.140056660
add rsp, 0x38
ret
cmp r10d, 0xff
jne 0x14007a0cb
lea r8, str.EXOPL
mov qword [rsp + 0x20], r8
mov r8, rdx
lea rdx, str._s__s__s_n
call fcn.140056660
add rsp, 0x38
ret
mov r9d, r8d
mov dword [rsp + 0x20], r10d
mov r8, rdx
lea rdx, str._s__d__d_n
call fcn.140056660
add rsp, 0x38
ret

Function at 0x14007a470
Capabilities:
Send data
Send data on socket

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x20
mov rbp, qword [rcx]
mov edi, r8d
mov esi, edx
mov byte [rax + 0x10], 0xff
xor r9d, r9d
mov byte [rax + 0x11], sil
mov rbx, rcx
mov byte [rax + 0x12], dil
mov rcx, qword [rcx + 0x4c0]
lea rdx, [rax + 0x10]
lea r8d, [r9 + 3]
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x14007a4cf
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbp
mov r8d, eax
call fcn.1400564e0
mov rcx, qword [rbx]
lea rdx, str.SENT
mov r9d, edi
mov r8d, esi
call fcn.14007a000
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x14007a680
Capabilities:
Send data
Send data on socket

Disassembly:
cmp edx, 0x1f
jne 0x14007a828
push rbp
push rdi
push r14
sub rsp, 0x20
mov rbp, qword [rcx]
mov r14, rcx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], r15
mov rdi, qword [rbp + 0x1e0]
lea rsi, [rdi + 0x1cb8]
lea rbx, [rdi + 0x1eb8]
mov qword [rbx], rsi
cmp rsi, rbx
jae 0x14007a6e5
lea rax, [rsi + 1]
mov byte [rsi], 0xff
mov qword [rbx], rax
cmp rax, rbx
jae 0x14007a6e5
mov byte [rax], 0xfa
inc qword [rbx]
mov rax, qword [rbx]
cmp rax, rbx
jae 0x14007a6e5
mov byte [rax], dl
inc qword [rbx]
movzx ecx, word [rdi + 0x1ca8]
call qword [sym.imp.WS2_32.dll_htons]
movzx ecx, word [rdi + 0x1caa]
movzx r15d, ax
mov word [rsp + 0x48], ax
call qword [sym.imp.WS2_32.dll_htons]
mov r9, qword [rbx]
movzx ecx, ax
cmp r9, rbx
jae 0x14007a71c
mov byte [r9], r15b
inc qword [rbx]
mov r9, qword [rbx]
mov r15, qword [rsp + 0x58]
cmp r9, rbx
jae 0x14007a772
movzx eax, byte [rsp + 0x49]
mov byte [r9], al
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x14007a772
mov byte [r9], cl
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x14007a772
shr cx, 8
mov byte [r9], cl
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x14007a772
mov byte [r9], 0xff
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x14007a772
mov byte [r9], 0xf0
mov r9, qword [rbx]
inc r9
mov qword [rdi + 0x1ec0], r9
lea r8, [rdi + 0x1cba]
sub r9, rsi
mov qword [rbx], rsi
sub r9, 2
mov edx, 0x3e
mov rcx, rbp
call fcn.14007a130
mov rcx, qword [r14 + 0x4c0]
xor r9d, r9d
mov rdx, rsi
lea r8d, [r9 + 3]
call qword [sym.imp.WS2_32.dll_send]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
test eax, eax
jns 0x14007a7d4
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbp
mov r8d, eax
call fcn.1400564e0
lea rdx, [rdi + 0x1cbb]
mov r8d, 4
mov rcx, r14
call fcn.14007a500
mov rcx, qword [r14 + 0x4c0]
lea rdx, [rdi + 0x1cbf]
xor r9d, r9d
lea r8d, [r9 + 2]
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x14007a820
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbp
mov r8d, eax
call fcn.1400564e0
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
Function at 0x14007bf90
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0xd0
mov rax, qword [0x1400bb080]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbx, qword [rcx + 0xa00]
lea rax, [rsp + 0x30]
mov rdi, qword [rcx]
mov r14, rcx
mov dword [rsp + 0x30], 0x80
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov r8d, dword [rbx + 0x15c]
mov rdx, qword [rbx + 0x168]
add r8d, 4
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [rbx + 0x150], 0
mov dword [rbx + 0x154], eax
jne 0x14007c025
movsxd r8, dword [rsp + 0x30]
lea rcx, [rbx + 0xd0]
lea rdx, [rsp + 0x40]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rsp + 0x30]
mov dword [rbx + 0x150], eax
mov r8d, dword [rbx + 0x154]
mov qword [rsp + 0xf8], rbp
mov qword [rsp + 0x100], rsi
cmp r8d, 4
jge 0x14007c086
lea rdx, str.Received_too_short_packet
mov rcx, rdi
call fcn.1400564e0
mov dword [rbx + 0xc], 7
xor eax, eax
mov rsi, qword [rsp + 0x100]
mov rbp, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14008f210
add rsp, 0xd0
pop r14
pop rdi
pop rbx
ret
mov rdx, qword [rbx + 0x168]
movzx eax, byte [rdx]
movzx ecx, byte [rdx + 1]
shl eax, 8
or ecx, eax
mov dword [rbx + 0xc], ecx
sub ecx, 3
je 0x14007c141
sub ecx, 1
je 0x14007c1b4
sub ecx, 1
je 0x14007c0f0
cmp ecx, 1
je 0x14007c0d3
lea r8, str.Internal_error:_Unexpected_packet
mov rcx, rdi
lea rdx, [0x14009c950]
call fcn.1400564e0
jmp 0x14007c1b4
add r8d, 0xfffffffe
add rdx, 2
mov rcx, rbx
call fcn.14007bcc0
test eax, eax
je 0x14007c1b4
jmp 0x14007c05a
movzx ecx, byte [rdx + 2]
lea eax, [r8 - 4]
movsxd rbp, eax
lea rsi, [rdx + 4]
movzx eax, byte [rdx + 3]
mov r8, rbp
shl ecx, 8
xor edx, edx
or ecx, eax
mov dword [rbx + 8], ecx
mov rcx, rsi
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x14007c1b4
sub rax, rsi
cmp rax, rbp
jae 0x14007c1b4
mov r8, rsi
lea rdx, str.TFTP_error:__s_n
mov rcx, rdi
call fcn.140056660
jmp 0x14007c1b4
cmp r8d, 4
jle 0x14007c1b4
movzx eax, byte [rdx + 3]
movzx ecx, byte [rdx + 2]
shl ecx, 8
or ecx, eax
movzx eax, word [rbx + 0x48]
inc eax
movzx eax, ax
cmp eax, ecx
jne 0x14007c1b4
lea eax, [r8 - 4]
mov rcx, r14
lea r8, [rdx + 4]
movsxd r9, eax
mov edx, 1
call fcn.140056400
mov esi, eax
test eax, eax
je 0x14007c193
mov edx, 5
mov rcx, rbx
call fcn.14007cc80
mov eax, esi
jmp 0x14007c05a
mov eax, dword [rbx + 0x154]
mov rcx, rdi
sub eax, 4
cdqe
add qword [rdi + 0xf8], rax
mov rdx, qword [rdi + 0xf8]
call fcn.140064ee0
mov rcx, r14
call fcn.1400651c0
test eax, eax
je 0x14007c058
mov edx, 5
mov rcx, rbx
call fcn.14007cc80
mov eax, Ordinal_45
jmp 0x14007c05a
Function at 0x14008ef50
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [sub.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x14008ef92
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x14008efd9
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x14008f032
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
sub rbp, 1
jne 0x14008eff0
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x14008f073
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x1400a20ca]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x1400a20cb]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x14008f040
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret

Function at 0x140090140
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14009018a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14009018a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14009018a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14009018a
cmp dword [rcx + 0x84], 0xe
jbe 0x14009018a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14009018c
xor al, al
add rsp, 0x28
ret
Function at 0x140004000
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
cld
and rsp, 0xfffffffffffffff0
call fcn.1400040d6
push r9
push r8
push rdx
push rcx
push rsi
xor rdx, rdx
mov rdx, qword gs:[rdx + 0x60]
mov rdx, qword [rdx + 0x18]
mov rdx, qword [rdx + 0x20]
mov rsi, qword [rdx + 0x50]
xor r9, r9
movzx rcx, word [rdx + 0x4a]
xor rax, rax
lodsb al, byte [rsi]
cmp al, 0x61
jl 0x140004037
sub al, 0x20
ror r9d, 0xd
add r9d, eax
loop 0x14000402d
push rdx
push r9
mov rdx, qword [rdx + 0x20]
mov eax, dword [rdx + 0x3c]
add rax, rdx
cmp word [rax + 0x18], 0x20b
jne 0x1400040cb
mov eax, dword [rax + 0x88]
test rax, rax
je 0x1400040cb
add rax, rdx
mov ecx, dword [rax + 0x18]
push rax
mov r8d, dword [rax + 0x20]
add r8, rdx
jrcxz 0x1400040ca
xor r9, r9
dec rcx
mov esi, dword [r8 + rcx*4]
add rsi, rdx
xor rax, rax
ror r9d, 0xd
lodsb al, byte [rsi]
add r9d, eax
cmp al, ah
jne 0x140004081
add r9, qword [rsp + 8]
cmp r9d, r10d
jne 0x140004072
pop rax
mov r8d, dword [rax + 0x24]
add r8, rdx
mov cx, word [r8 + rcx*2]
mov r8d, dword [rax + 0x1c]
add r8, rdx
mov eax, dword [r8 + rcx*4]
add rax, rdx
pop r8
pop r8
pop rsi
pop rcx
pop rdx
pop r8
pop r9
pop r10
sub rsp, 0x20
push r10
jmp rax
pop rax
pop r9
pop rdx
mov rdx, qword [rdx]
jmp 0x140004021
Function at 0x14075b0e0
Capabilities:
Terminate process

Disassembly:
cwde
mov cs, word [rbx - 0x138d9c7c]
fdiv dword [rcx + 0x27704f7a]
invalid
cld
pop r11
jmp 0x14075b0ed
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14075b0fd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14075b0e5
lea eax, [rcx + 1]
jmp 0x14075b10b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x14075b11e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14075b104
sub eax, 3
jb 0x14075b13e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14075b18d
sar eax, 1
movsxd rbp, eax
jb 0x14075b174
jmp 0x14075b14c
add ebx, ebx
jne 0x14075b14a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14075b174
inc ecx
add ebx, ebx
jne 0x14075b15a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14075b174
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14075b16d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14075b15c
add ecx, 2
jmp 0x14075b179
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.14075b0a2
jmp 0x14075b0ed
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
sub rsp, 0x28
lea rdi, [rsi + 0x758000]
mov eax, dword [rdi]
or eax, eax
je 0x14075b1f9
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x75b1e4]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14075b19d
jns 0x14075b1d2
movzx rdx, word [rdi]
add rdi, 2
jmp 0x14075b1dc
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14075b1f3
mov qword [rbx], rax
add rbx, 8
jmp 0x14075b1bd
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x14075b23d
cmp al, 0xef
ja 0x14075b225
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x14075b205
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x14075b214
mov eax, dword [rdi]
add rdi, 4
jmp 0x14075b214
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x24f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14075b291
sub rsp, 0xffffffffffffff80
jmp 0x1406f0dfc
Function at 0x140f7b5c0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140f7b5ca
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x140f7b5f3
pop rbp
sub rbp, 0x33
sub rbp, 0xf7b5c0
sub rsp, 0x20
jmp 0x140f7b612
mov rax, 0xf7b5c0
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0xfffffffffefdef48
xor byte [rax], dl
inc rax
dec rcx
jne 0x140f7b631
jmp 0x140f7b648
add cl, al
movabs eax, dword [0xc90048484874c1c3]
mov dword [rax + 0x49], eax
add byte [rcx - 0x5f], cl
add byte [rdi + 0x48484088], cl
add byte [rdi + 0x4848608a], cl
add byte [rdi - 0x76b6ff56], dil
ret
Function at 0x140002140
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 4], 0
je 0x140002163
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x35]
xor byte [rax + rcx], dl
inc rax
cmp rax, 3
jb 0x140002150
mov byte [rcx + 4], 0
mov rax, rcx
ret

Function at 0x140003c00
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x26], 0
je 0x140003c23
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x35]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x25
jb 0x140003c10
mov byte [rcx + 0x26], 0
mov rax, rcx
ret

Function at 0x140003c30
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
mov rax, qword [0x14004b010]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rbx, rcx
mov qword [rbp - 0x39], rcx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
lea rcx, [rbp - 0x39]
mov qword [rbp - 0x39], rax
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__localtime64]
mov dword [rbp - 0x49], 0x1d1a5210
mov dword [rbp - 0x45], 0x651e1754
mov dword [rbp - 0x41], 0x671b1d
movups xmm0, xmmword [rax]
mov byte [rbp - 0x3d], 1
movups xmmword [rbp - 0x31], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x21], xmm1
mov eax, dword [rax + 0x20]
mov dword [rbp - 0x11], eax
xor eax, eax
nop dword [rax]
lea ecx, [rax + 0x35]
xor byte [rbp + rax - 0x49], cl
inc rax
cmp rax, 0xb
jb 0x140003ca0
lea r9, [rbp - 0x31]
mov byte [rbp - 0x3d], 0
lea r8, [rbp - 0x49]
mov edx, 0x50
lea rcx, [rbp - 9]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_strftime]
mov qword [rbx + 0x10], 0
lea rax, [rbp - 9]
mov qword [rbx + 0x18], 0xf
mov r8, 0xffffffffffffffff
mov byte [rbx], 0
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140003cf0
lea rdx, [rbp - 9]
mov rcx, rbx
call fcn.140023ea0
mov rax, rbx
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140031850
mov rbx, qword [rsp + 0xd8]
add rsp, 0xc0
pop rbp
ret
Function at 0x140003d30
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x14004b010]
xor rax, rsp
mov qword [rbp - 8], rax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
lea rdx, [rbp - 0x28]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx edx, word [rbp - 0x20]
mov esi, 0xfffb
and dx, si
or dx, 0xb
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov dword [rbp - 0x30], 0x6c163f
mov byte [rbp - 0x2c], 1
xor ebx, ebx
mov ecx, ebx
nop dword [rax + rax]
lea eax, [rcx + 0x35]
xor byte [rbp + rcx - 0x30], al
inc rcx
cmp rcx, 3
jb 0x140003da0
mov byte [rbp - 0x2c], bl
lea rdx, [rbp - 0x30]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140024c10
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rdi, rax
lea rdx, [rbp - 0x28]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx edx, word [rbp - 0x20]
mov eax, 0xfff5
and dx, ax
or dx, 5
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov rdi, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rcx, [rbp - 0x28]
call fcn.140003c30
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0x10
jb 0x140003e16
mov rax, qword [rax]
mov rdx, rax
mov rcx, rdi
call fcn.14002a3b0
nop
mov rdx, qword [rbp - 0x10]
cmp rdx, 0x10
jb 0x140003e60
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003e5b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003e5b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140031b00
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rdi, rax
lea rdx, [rbp - 0x28]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx edx, word [rbp - 0x20]
and dx, si
or dx, 0xb
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov dword [rbp - 0x30], 0x171668
mov byte [rbp - 0x2c], 1
nop word [rax + rax]
lea eax, [rbx + 0x35]
xor byte [rbp + rbx - 0x30], al
inc rbx
cmp rbx, 3
jb 0x140003ea0
mov byte [rbp - 0x2c], 0
lea rdx, [rbp - 0x30]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140024c10
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
lea rdx, [rbp - 0x28]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx edx, word [rbp - 0x20]
or dx, 0xf
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140031850
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
add rsp, 0x50
pop rbp
ret
Function at 0x140003f20
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1d], 0
je 0x140003f43
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x35]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1c
jb 0x140003f30
mov byte [rcx + 0x1d], 0
mov rax, rcx
ret

Function at 0x140004450
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Execute command

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x14004b010]
xor rax, rsp
mov qword [rbp - 8], rax
xor ebx, ebx
mov dword [rbp - 0x30], 0x445a56
mov ecx, ebx
mov byte [rbp - 0x2c], 1
nop
lea eax, [rcx + 0x35]
xor byte [rbp + rcx - 0x30], al
inc rcx
cmp rcx, 3
jb 0x140004480
lea rcx, [rbp - 0x30]
mov byte [rbp - 0x2c], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rbp - 0x30]
mov word [rbp - 0x30], 0xa
mov byte [rbp - 0x2e], bl
call fcn.140024c10
call fcn.140003d30
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
lea rdx, [rbp - 0x28]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx edx, word [rbp - 0x20]
mov rcx, rdi
or dx, 0xf
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
movdqa xmm0, xmmword [0x140042eb0]
mov rdx, rbx
movdqu xmmword [rbp - 0x28], xmm0
mov dword [rbp - 0x18], 0x68342329
mov dword [rbp - 0x14], 0x23262f1b
mov dword [rbp - 0x10], 0x712b2b3b
mov word [rbp - 0xc], pe_nt_image_headers64
nop dword [rax]
nop word [rax + rax]
lea eax, [rdx + 0x35]
xor byte [rbp + rdx - 0x28], al
inc rdx
cmp rdx, 0x1c
jb 0x140004520
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rbp - 0x28]
mov byte [rbp - 0xb], bl
call fcn.140024c10
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
lea rdx, [rbp - 0x28]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx edx, word [rbp - 0x20]
mov eax, 0xfff9
and dx, ax
mov rcx, rdi
or dx, 9
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x14003683c]
call fcn.140024c10
movdqa xmm0, xmmword [0x140043770]
movdqu xmmword [rbp - 0x28], xmm0
mov dword [rbp - 0x18], 0x787f767d
mov word [rbp - 0x14], pe_nt_image_headers64
nop dword [rax]
nop dword [rax + rax]
lea eax, [rbx + 0x35]
xor byte [rbp + rbx - 0x28], al
inc rbx
cmp rbx, 0x14
jb 0x1400045b0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rbp - 0x28]
mov byte [rbp - 0x13], 0
call fcn.140024c10
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x14003683c]
call fcn.140024c10
mov ecx, 0x384
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140031850
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x140004610
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x14004b010]
xor rax, rsp
mov qword [rbp - 8], rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rbp - 0x30]
mov word [rbp - 0x30], 0xa
mov byte [rbp - 0x2e], 0
call fcn.140024c10
call fcn.140003d30
call fcn.140003f50
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
lea rdx, [rbp - 0x28]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx edx, word [rbp - 0x20]
mov eax, 0xfffb
and dx, ax
mov rcx, rbx
or dx, 0xb
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
movdqa xmm0, xmmword [0x140042680]
xor ebx, ebx
movdqu xmmword [rbp - 0x28], xmm0
mov edx, ebx
mov dword [rbp - 0x18], 0x23242737
mov dword [rbp - 0x14], 0x6c2c2420
mov dword [rbp - 0x10], 0x3523270b
mov dword [rbp - 0xc], 0x1007222
lea eax, [rdx + 0x35]
xor byte [rbp + rdx - 0x28], al
inc rdx
cmp rdx, 0x1e
jb 0x1400046b0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rbp - 0x28]
mov byte [rbp - 9], bl
call fcn.140024c10
call fcn.140003fd0
mov dword [rbp - 0x30], 0x171615
mov byte [rbp - 0x2c], 1
nop dword [rax]
nop word [rax + rax]
lea eax, [rbx + 0x35]
xor byte [rbp + rbx - 0x30], al
inc rbx
cmp rbx, 3
jb 0x1400046f0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rbp - 0x30]
mov byte [rbp - 0x2c], 0
call fcn.140024c10
call fcn.140004050
lea rcx, [rbp - 0x28]
call fcn.140003c30
mov rdx, qword [rbp - 0x10]
cmp rdx, 0x10
jb 0x140004760
mov rcx, qword [rbp - 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000475b
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000475b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140031b00
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140031850
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret