joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140088033
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rcx
nop
mov qword [rsp - 8], rbp
sub rsp, 8
nop
push 0x7204a530
mov qword [rsp], rsi
push r12
push r13
mov r13, r13
nop
sub rsp, 8
mov qword [rsp], r14
nop
sub rsp, 8
mov qword [rsp], r15
add rsp, 0xffffffffffffffd8
mov r10, r10
xchg rdi, r14
mov rdi, rdx
xchg r14, rdi
mov r13d, r8d
mov edx, 0x3f37b953
add edx, 0x357a3a0b
sub edx, 0x2ba2e81d
add edx, 0x1be43d1
xor edx, 0x4ac94f12
cmp r8d, edx
mov dword [rsp - 0x1c], ecx
jae 0x140088042
mov edx, r13d
nop
movabs rcx, 0xffffffff3820290c
sub rcx, 0x3624ac68
add rcx, 0x6c15c2f
xor rcx, 0x194cc6c8
add rcx, 0x7fffffff
xor rcx, 0x6e0fe1e5
mov eax, 0x1694d9d0
xor eax, 0x21f8de3a
sub eax, 0x1a7ee094
sub eax, 0x1ced2752
mul rdx
cmovb rax, rcx
mov dword [rsp - 0x3c], 0x45e58191
mov rcx, rax
call fcn.140099540
xchg rdi, rax
mov r15, rdi
xchg rdi, rax
mov byte [rsp + 0x70], 0x5b
sub byte [rsp + 0x70], 0x5b
add byte [rsp + 0x70], 0x18
xor byte [rsp + 0x70], 0x19
xchg r10, rax
mov r10, qword [rsp + 0x60]
xchg r10, rax
lea r12d, [r13 + 0xfffff]
mov dword [rsp - 0x28], 0x1fb17ea9
xor esi, esi
shr r12d, 0x13
shr r12d, 1
mov ebp, dword [rax + 0x18]
test r12d, r12d
je 0x1400881ec
xchg rsi, rsi
xchg r8, rbx
mov qword [rsp + 0x68], r8
xchg r8, rbx
mov ecx, 0x790fd1ee
sub ecx, 0x645be74d
sub ecx, 0x5ba0385
sub ecx, 0xee9e71c
xchg rsi, rdi
mov qword [rsp + 0x20], rsi
xchg rsi, rdi
mov edi, esi
xchg r15, r15
mov ebx, r13d
shl edi, 0xa
shl edi, 3
shl edi, 6
shl edi, 1
mov rdx, r15
mov dword [rsp - 0x20], ebx
sub ebx, edi
cmp ebx, ecx
cmova ebx, ecx
xchg r11, rax
mov rcx, r11
xchg r11, rax
mov r8d, ebx
call fcn.140084cc0
mov r13, r13
test al, al
je 0x1400881c8
shr ebx, 1
shr ebx, 1
xor eax, eax
shr edi, 2
test ebx, ebx
xchg rsi, rsi
je 0x140088196
xchg r9, r15
mov r15, r9
xchg r9, r15
lea ecx, [rdi + rax]
mov r10, r10
mov r8d, ebp
xor r8d, dword [r9]
lea r9, [r9 + 4]
mov rcx, rcx
xor r8d, 0x797b4946
inc eax
mov dword [r14 + rcx*4], r8d
cmp eax, ebx
mov r12, r12
jb 0x14008816b
mov rax, qword [rsp + 0x60]
inc esi
xchg r12, r12
mov ecx, 0x6eaf9e3c
sub ecx, 0x21933be2
sub ecx, 0x3df2ea3f
xor ecx, 0xf39781b
cmp esi, r12d
jb 0x140088113
xchg rbp, rbp
jmp 0x1400881dc
mov byte [rsp + 0x70], 0x72
xor byte [rsp + 0x70], 0xb
sub byte [rsp + 0x70], 0x56
xor byte [rsp + 0x70], 0x23
mov rbx, qword [rsp + 0x68]
xchg rbx, rdi
mov rbx, qword [rsp + 0x20]
xchg rbx, rdi
xchg rcx, rsi
mov rsi, r15
xchg rcx, rsi
call fcn.140099550
movzx eax, byte [rsp + 0x70]
mov rsp, rsp
nop
add rsp, 0x6af38f84
sub rsp, 0x6af38f5c
nop
mov r15, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov r14, qword [rsp - 8]
pop r13
mov dword [rsp - 0x10], 0x7f1e2c35
nop
mov r12, qword [rsp]
add rsp, 8
pop rsi
mov dword [rsp - 0x28], ecx
nop
add rsp, 8
mov rbp, qword [rsp - 8]
ret
Function at 0x140088260
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp - 0x44], 0x7c3d77e7
xchg rbp, r11
mov qword [rsp + 0x10], r11
xchg r11, rbp
xchg r8, rsi
mov qword [rsp + 0x20], r8
xchg rsi, r8
nop
mov qword [rsp - 8], rdi
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r12
push r13
push r8
mov qword [rsp], r14
nop
sub rsp, 8
mov qword [rsp], r15
add rsp, 0xffffffffffffffe0
mov r14d, r8d
mov dword [rsp - 0x14], 0x3a8e25c7
xchg r9, rdx
mov rdi, r9
xchg rdx, r9
mov r9d, r14d
mov dword [rsp - 0x34], 0x35b5696a
xchg r13, r9
mov r9, rcx
xchg r9, r13
cmp r8d, 0x40000
xchg rsi, rsi
jb 0x140088305
mov r9d, 0x5ea346cf
xor r9d, 0x6ce23447
xor r9d, 0x64c4ffa6
sub r9d, 0x51787e86
xor r9d, 0x5090ea8
nop
movabs rcx, 0xffffffff2e5a235b
xor rcx, 0x4ece74fa
xor rcx, 0x46754a70
add rcx, 0x7fffffff
add rcx, 0x591ee22f
mov eax, 0x4296c1d1
sub eax, 0x29d67cf8
add eax, 0x86ed0dc
sub eax, 0x6740b32
sub eax, 0x1abb0a7f
mul r9
mov dword [rsp - 0x30], 0x4a9ecbef
cmovb rax, rcx
mov rcx, rax
call fcn.140099540
mov dword [rsp - 0x20], 0x46d394e6
mov esi, dword [r13 + 0x18]
lea r15d, [r14 + 0xfffff]
shr r15d, 8
shr r15d, 9
shr r15d, 2
shr r15d, 1
xor ebx, ebx
mov dword [rsp - 0x38], esp
xchg rbp, rax
mov rax, rbp
xchg rbp, rax
mov r12b, 0x13
add r12b, 0x45
xor r12b, 0x18
xor r12b, 0xe
sub r12b, 0x4d
test r15d, r15d
mov r9, r9
je 0x1400884b3
nop
mov r8d, ebx
mov r10d, r14d
mov dword [rsp - 0x1c], edx
shl r8d, 1
shl r8d, 0x12
shl r8d, 1
xor eax, eax
sub r10d, r8d
mov rdi, rdi
shr r8d, 2
cmp r10d, 0x100000
jbe 0x140088423
mov dword [rsp - 0x3c], 0x2211d552
mov r10d, 0x204add17
sub r10d, 0xd8a69e2
add r10d, 0x2368d394
xor r10d, 0x363946c9
mov r11d, 0x79872b76
xor r11d, 0xdeb962
xor r11d, 0x5938306
xor r11d, 0xb6973c7
xor r11d, 0x77a762d5
jmp 0x140088436
mov r11d, r10d
shr r11d, 2
test r11d, r11d
mov rsi, rsi
je 0x140088473
xchg rbp, r9
mov rbp, r9
xchg r9, rbp
nop dword [rax]
lea edx, [r8 + rax]
mov ecx, esi
mov dword [rsp - 0x44], esi
xor ecx, dword [rdi + rdx*4]
lea r9, [r9 + 4]
xor ecx, 0x797b4946
inc eax
mov r15, r15
mov dword [r9 - 4], ecx
cmp eax, r11d
jb 0x140088446
mov dword [rsp - 0x3c], ebp
mov r8d, r10d
xchg rdx, rsp
mov rsp, rbp
xchg rdx, rsp
xchg rcx, r13
mov r13, rcx
xchg r13, rcx
call fcn.140085110
test al, al
mov dword [rsp - 0x34], 0x2b9db8b9
je 0x1400884b0
inc ebx
cmp ebx, r15d
jb 0x1400883ac
xchg r11, r11
jmp 0x1400884b3
xor r12b, r12b
xchg rdi, rbp
mov rcx, rdi
xchg rbp, rdi
call fcn.140099550
mov r15, r15
mov rbx, qword [rsp + 0x50]
movzx eax, r12b
xchg rbp, r9
mov r9, qword [rsp + 0x58]
xchg rbp, r9
xchg rsi, r9
mov r9, qword [rsp + 0x68]
xchg r9, rsi
neg rsp
add rsp, 0xffffffffffffffe0
neg rsp
nop
add rsp, 8
mov r15, qword [rsp - 8]
pop r14
nop
add rsp, 8
mov r13, qword [rsp - 8]
nop
mov r12, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x140088520
Capabilities:
Encode data using xor

Disassembly:
xchg rbp, rbx
mov qword [rsp + 0x10], rbp
xchg rbx, rbp
xchg r9, rbp
mov qword [rsp + 0x18], r9
xchg rbp, r9
nop
mov qword [rsp - 8], rsi
sub rsp, 8
nop
push 0x717bc96c
mov qword [rsp], rdi
nop
mov qword [rsp - 8], r12
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r14
push r15
mov dword [rsp - 0xc], 0x19efb0c0
mov eax, 0x2fae00fb
xor eax, 0x771711e3
xor eax, 0x4b04e65e
sub eax, 0x13bde726
call fcn.14009b2d0
mov dword [rsp - 0x20], 0x3adf760c
sub rsp, rax
xchg rbp, rcx
mov r15, rbp
xchg rbp, rcx
call fcn.14009b1a0
mov rbp, rbp
mov ebp, eax
and ebp, 0x3fc
jbe 0x1400885f3
lea rdi, [rsp + 0x20]
mov rsi, rsi
mov esi, ebp
call fcn.14009b1a0
movzx ebx, ax
mov dword [rsp - 0x2c], 0x28877359
shl ebx, 8
shl ebx, 4
shl ebx, 2
shl ebx, 1
shl ebx, 1
call fcn.14009b1a0
movzx ecx, ax
lea rdi, [rdi + 4]
mov dword [rsp - 0x24], ebp
or ecx, ebx
mov dword [rdi - 4], ecx
sub rsi, 1
mov r15, r15
jne 0x1400885b4
lea r14d, [rbp*4]
mov eax, 0x27678066
sub eax, 0xd37379e
xor eax, 0x1705db07
sub eax, 0xd3593cb
mov ecx, r14d
mul rcx
mov rcx, rcx
pushf
movabs rcx, 0xffffffff5f69174b
sub rcx, 0x2eb57e0a
sub rcx, 0x19a9107f
add rcx, 0x3dded24d
add rcx, 0x7fffffff
add rcx, 0x2b16a4f1
popf
cmovb rax, rcx
xchg r9, rcx
mov r9, rax
xchg r9, rcx
call fcn.140099540
mov r10, r10
mov edi, dword [r15 + 0x18]
lea ebp, [r14 + 0xfffff]
shr ebp, 9
shr ebp, 9
shr ebp, 1
shr ebp, 1
xor ebx, ebx
mov dword [rsp - 0x44], ebp
xchg rsi, r10
mov r10, rax
xchg rsi, r10
mov r12b, 0x45
xor r12b, 0x14
add r12b, 5
sub r12b, 0x20
xor r12b, 0x37
test ebp, ebp
je 0x1400887a9
mov dword [rsp - 0x30], 0x666dd83
nop
mov r8d, ebx
mov r10d, r14d
shl r8d, 0x10
shl r8d, 1
shl r8d, 2
shl r8d, 1
xor eax, eax
mov rcx, rcx
sub r10d, r8d
shr r8d, 2
cmp r10d, 0x100000
mov dword [rsp - 0x1c], 0x5dec7441
jbe 0x14008871e
mov r10d, 0x51b78ac5
sub r10d, 0x37c0ea44
sub r10d, 0x4c852c6
add r10d, 0xf58701
sub r10d, 0x1613d4bc
mov r11d, 0x6dc830b1
sub r11d, 0x670ed8da
xor r11d, 0x7665ccdc
sub r11d, 0x70d89b0b
jmp 0x140088732
mov r11d, r10d
shr r11d, 2
mov dword [rsp - 0x20], ebx
test r11d, r11d
je 0x140088770
xchg rbx, rsi
mov r9, rbx
xchg rsi, rbx
nop dword [rax]
mov r15, r15
lea edx, [r8 + rax]
mov ecx, edi
xor ecx, dword [rsp + rdx*4 + 0x20]
mov dword [rsp - 0x38], esp
lea r9, [r9 + 4]
xor ecx, 0x797b4946
inc eax
mov dword [rsp - 0x34], edx
mov dword [r9 - 4], ecx
cmp eax, r11d
jb 0x140088745
mov r8d, r10d
mov dword [rsp - 0x2c], ecx
mov rdx, rsi
xchg rcx, rsi
mov rsi, r15
xchg rcx, rsi
call fcn.140085110
test al, al
je 0x1400887a2
xchg rcx, rcx
inc ebx
cmp ebx, ebp
jb 0x1400886a7
jmp 0x1400887a9
xor r12b, r12b
mov dword [rsp - 0x1c], ebx
xchg rsi, r12
mov rcx, r12
xchg rsi, r12
call fcn.140099550
mov rsi, rsi
lea r11, [rsp + 0x1020]
movzx eax, r12b
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov dword [rsp - 0x30], 0x2a061c06
xchg r11, rsp
mov r11, rsp
xchg rsp, r11
nop
add rsp, 8
mov r15, qword [rsp - 8]
nop
add rsp, 8
mov r14, qword [rsp - 8]
nop
add rsp, 8
mov r12, qword [rsp - 8]
pop rdi
mov rsp, rsp
nop
add rsp, 8
mov rsi, qword [rsp - 8]
ret
Function at 0x14008d080
Capabilities:
Encode data using xor

Disassembly:
xchg r12, rbx
mov qword [rsp + 8], r12
xchg r12, rbx
mov ebx, edx
mov r12, r12
mov r8d, ecx
test ecx, ecx
jne 0x14008d0ab
mov dword [rsp - 0x34], 0x2e6977b5
xor eax, eax
mov rbx, qword [rsp + 8]
ret
xor r10d, r10d
mov r11d, r8d
xchg rbp, rbp
mov edx, r10d
mov r9d, r8d
nop dword [rax]
mov r12, r12
nop word [rax + rax]
lea eax, [r9 + r9]
mov ecx, edx
mov rsp, rsp
xor ecx, r9d
mov r9d, eax
test r11b, 1
cmove ecx, edx
xchg r10, r10
xor r9d, ebx
cmp eax, 0x100
mov edx, ecx
mov dword [rsp - 0x38], 0x63cecbb0
cmovb r9d, eax
shr r11d, 1
jne 0x14008d0cb
mov r11d, r8d
mov dword [rsp - 0x44], ebp
mov r9d, r10d
test ecx, ecx
je 0x14008d14c
lea eax, [r11 + r11]
mov rbx, rbx
mov ecx, r9d
xor ecx, r11d
mov r11d, eax
test dl, 1
xchg r11, r11
cmove ecx, r9d
xor r11d, ebx
cmp eax, 0x100
mov r9d, ecx
mov rbx, rbx
cmovb r11d, eax
shr edx, 1
jne 0x14008d115
mov r11, r11
mov r11d, r9d
mov edx, r10d
test r9d, r9d
je 0x14008d1a6
mov dword [rsp - 0x2c], ecx
nop dword [rax]
nop word [rax + rax]
lea eax, [r11 + r11]
mov ecx, edx
mov r14, r14
xor ecx, r11d
mov r11d, eax
test r9b, 1
mov dword [rsp - 0x30], 0x63009162
cmove ecx, edx
xor r11d, ebx
cmp eax, 0x100
mov edx, ecx
mov dword [rsp - 0xc], ebx
cmovb r11d, eax
shr r9d, 1
jne 0x14008d16d
test edx, edx
mov rbx, rbx
je 0x14008d1f1
nop word [rax + rax]
mov ecx, r10d
mov dword [rsp - 0x10], edx
xor ecx, r8d
test dl, 1
cmove ecx, r10d
mov r10d, ecx
xchg r9, r9
lea ecx, [r8 + r8]
mov r8d, ecx
xor r8d, ebx
mov rbp, rbp
cmp ecx, 0x100
cmovb r8d, ecx
shr edx, 1
mov dword [rsp - 0xc], ebp
jne 0x14008d1b7
mov rbx, qword [rsp + 8]
mov eax, r10d
xchg rdi, rdi
ret
Function at 0x14009b2d0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
add rsp, 0xfffffffffffffff0
mov rbp, rbp
mov qword [rsp], r10
mov qword [rsp + 8], r11
xor r11, r11
mov dword [rsp - 0x34], 0x36dda454
lea r10, [rsp + 0x18]
sub r10, rax
cmovb r10, r11
mov r11, qword gs:[0x10]
mov dword [rsp - 0x38], esp
cmp r10, r11
bnd jae 0x14009b330
and r10w, 0xf000
lea r11, [r11 - 0x1000]
xchg r15, r15
mov byte [r11], 0x3a
xor byte [r11], 0x32
add byte [r11], 0x19
sub byte [r11], 0x21
cmp r10, r11
bnd jne 0x14009b310
xchg r10, rcx
mov rcx, qword [rsp]
xchg r10, rcx
mov r11, qword [rsp + 8]
nop
add rsp, 0x1ccc4e20
sub rsp, 0x1ccc4e10
bnd ret
Function at 0x14047b050
Capabilities:
Encode data using xor

Disassembly:
xchg rcx, rsp
mov rax, rcx
xchg rcx, rsp
xchg rbx, r13
mov qword [rax + 0x10], r13
xchg rbx, r13
mov qword [rax + 0x18], rsi
nop
sub rsp, 8
mov qword [rsp], rdi
neg rsp
sub rsp, 0xffffffffffffffb0
neg rsp
mov dword [rax - 0x38], 0x4527c1b2
add dword [rax - 0x38], 0x3c4b5ac
xor dword [rax - 0x38], 0x4e9e2bcb
sub dword [rax - 0x38], 0x6465c32
xor esi, esi
mov r15, r15
mov dword [rax - 0x34], 0x21f2bd04
xor dword [rax - 0x34], 0xa1ac6a5
add dword [rax - 0x34], 0x39762013
xor dword [rax - 0x34], 0x656a9b0b
xchg r12, rcx
mov rbx, r12
xchg r12, rcx
mov dword [rax - 0x30], 0xce92773
add dword [rax - 0x30], 0x401c16dd
sub dword [rax - 0x30], 0x4482fbb6
xor dword [rax - 0x30], 0x8ef429d
mov dword [rax - 0x2c], 0x2ebf56f7
sub dword [rax - 0x2c], 0x3348b7e
sub dword [rax - 0x2c], 0xdf16f5f
xor dword [rax - 0x2c], 0xeff3542
sub dword [rax - 0x2c], 0x135768b5
mov dword [rax - 0x28], 0x21831ef4
add dword [rax - 0x28], 0x5e14f28a
sub dword [rax - 0x28], 0x4e649b8e
xor dword [rax - 0x28], 0xf1b604f
xor dword [rax - 0x28], 0x3e1b15e7
xchg rsi, r12
mov qword [rsp + 0x60], r12
xchg rsi, r12
xchg rsi, rax
mov rsi, qword [rsp + 0x60]
xchg rsi, rax
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [rsp + 0x60]
mov dword [rsp - 0x2c], 0x6f085398
mov rax, qword [rsp + 0x60]
and cl, 3
shl cl, 3
xchg r11, r11
movzx edx, word [rsp + rax*2 + 0x20]
mov eax, 0xe8b311
add eax, 0x5d5607de
sub eax, 0x4fef9b68
xor eax, 0x5fb72ddb
add eax, 0x19952cd8
shr eax, cl
mov dword [rsp - 0x14], ebp
movzx ecx, al
mov rax, qword [rsp + 0x60]
xor cx, dx
mov word [rsp + rax*2 + 0x34], cx
mov dword [rsp - 0x14], 0x3af58e15
xchg r10, rax
mov r10, qword [rsp + 0x60]
xchg r10, rax
inc rax
xchg rdx, rax
mov qword [rsp + 0x60], rdx
xchg rdx, rax
mov rax, qword [rsp + 0x60]
mov rdx, rdx
cmp rax, 0xa
jb 0x14047b144
xor edx, edx
xchg r8, r8
mov word [rsp + 0x48], si
lea rcx, [rsp + 0x34]
call fcn.14007c2b0
mov dword [rsp - 0x10], 0x7db4ae05
xchg r8, rax
mov rax, r8
xchg r8, rax
mov qword [rbx + 0x210], rax
mov dword [rsp - 0x1c], 0x22154275
xor eax, eax
lea rdi, [rsp + 0x34]
mov ecx, 0x1dc29ad0
add ecx, 0x2bb1917a
xor ecx, 0x169d7685
sub ecx, 0x16d6c66a
xor ecx, 0x4912946f
rep stosb byte [rdi], al
mov dword [rsp - 0x1c], edi
test r8, r8
je 0x14047b2a4
lea rdx, [rbx + 0x218]
mov rdi, rdi
xchg r8, r13
mov rcx, r13
xchg r13, r8
call fcn.14047b770
mov dword [rsp - 0x18], 0x6439cb68
test al, al
jne 0x14047b29a
xchg rdx, rcx
mov rdx, qword [rbx + 0x210]
xchg rdx, rcx
call fcn.14007e840
xor al, al
xchg rcx, rsi
mov qword [rbx + 0x210], rcx
xchg rsi, rcx
xchg rbx, r8
mov r8, qword [rsp + 0x68]
xchg rbx, r8
xchg rcx, rsi
mov rcx, qword [rsp + 0x70]
xchg rsi, rcx
neg rsp
add rsp, 0xffffffffffffffb0
neg rsp
pop rdi
mov dword [rsp - 0x28], 0x56b8128b
ret
mov al, 0x65
sub al, 0x3b
sub al, 1
add al, 0xd
sub al, 0x35
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
nop
sub rsp, 0x61d46ef9
add rsp, 0x61d46f49
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x14049b4d0
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov rdx, rdx
mov eax, dword [0x1404a90cc]
cmp qword [0x1404a90e0], 0
jne 0x140089dc0
syscall
xchg rdi, rdi
ret
jmp 0x14008a91b
Function at 0x140008ca0
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x90
movaps xmmword [rsp + 0x80], xmm6
lea rbx, [0x14001f30a]
lea rax, [0x140034140]
mov rcx, qword [0x140036148]
movq xmm6, rax
movq xmm0, rbx
punpcklqdq xmm6, xmm0
test rcx, rcx
je 0x140008d0f
call qword [sym.imp.KERNEL32.DLL_GetProcessId]
xor ecx, ecx
mov edx, eax
call qword [sym.imp.KERNEL32.DLL_GenerateConsoleCtrlEvent]
test eax, eax
je 0x140008d78
mov rcx, qword [0x140036148]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov rcx, qword [0x140036148]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp byte [0x140036140], 0
jne 0x140008d30
movaps xmm6, xmmword [rsp + 0x80]
add rsp, 0x90
pop rbx
ret
mov eax, 0x414
mov dword [rsp + 0x48], 3
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], 0
mov word [rsp + 0x60], ax
mov dword [rsp + 0x64], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], rbx
movaps xmmword [rsp + 0x50], xmm6
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
jmp 0x140008d18
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov r9d, 0x400
xor edx, edx
mov qword [rsp + 0x30], 0
mov r8d, eax
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], 0
mov ecx, 0x1300
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.DLL_FormatMessageA]
lea rcx, str.Failed_to_send_CTRL_C_to_child_process.
call sub.msvcrt.dll_puts
mov rcx, qword [rsp + 0x40]
call sub.msvcrt.dll_puts
jmp 0x140008cf0
Function at 0x140015b50
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call fcn.14001ca50
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call fcn.14001ca50
mov r8, rbx
mov rdx, qword [rbp + 0x20]
mov rcx, rax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop

Function at 0x140016802
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x140036228]
test eax, eax
je 0x14001689a
lea rax, [0x140036200]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
call rax
mov rax, qword [0x140036230]
mov qword [rbp - 8], rax
jmp 0x14001687e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.DLL_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.DLL_GetLastError]
call rax
test eax, eax
jne 0x140016872
cmp qword [rbp - 0x10], 0
je 0x140016872
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140016838
lea rax, [0x140036200]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
call rax
jmp 0x14001689b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x1400169a0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400169c8
mov eax, 0
jmp 0x140016a16
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400169f1
mov eax, 0
jmp 0x140016a16
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x140016a11
mov eax, 0
jmp 0x140016a16
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x140016a1c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x140016a9a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x140016a91
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x140016a91
mov rax, qword [rbp - 8]
jmp 0x140016aaf
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x140016a64
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140017580
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x1400175a2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x14001761c
mov rdi, r14
mov rcx, rbx
call fcn.14001b250
test rax, rax
jle 0x1400175f4
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov rax, qword [rbx + 0x38]
mov r8, rbp
mov rdx, qword [rax]
call fcn.14007daf0
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x14001760c
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x140017614
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x1400175b6
sub r14, rdi
jmp 0x1400176ff
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x140017633
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140017635
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140017667
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.14007daf0
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x1400176fc
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1400176a2
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x1400176dd
nop dword [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.14008a8b4
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x1400176fc
cmp rbp, rax
ja 0x1400176b0
test rbp, rbp
je 0x1400176fc
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.14008a8b4
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
Function at 0x140029f30
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
mov rax, qword [0x140154060]
xor rax, rsp
mov qword [rbp + 0x4f], rax
mov rbx, rcx
mov qword [rbp + 0x27], rcx
xor esi, esi
mov dword [rbp - 0x49], esi
movdqa xmm0, xmmword [0x140142a80]
movdqa xmmword [rbp - 0x39], xmm0
movdqa xmm1, xmmword [0x140142a90]
movdqa xmmword [rbp - 0x29], xmm1
movdqa xmm0, xmmword [str.8___]
movdqa xmmword [rbp - 0x19], xmm0
mov dword [rbp - 9], 0xf2eeee12
mov dword [rbp - 5], 0xf2f6f6f2
mov dword [rbp - 1], 0xf2fefef2
mov dword [rbp + 3], 0x100f6f2
mov eax, esi
nop dword [rax + rax]
lea ecx, [rax + 0x4f]
xor byte [rbp + rax - 0x39], cl
inc rax
cmp rax, 0x3e
jb 0x140029fb0
mov byte [rbp + 6], sil
lea r8, [rbp + 5]
lea rdx, [rbp - 0x39]
lea rcx, [rbp + 0x2f]
call fcn.1400103c0
nop
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov edi, 0xd
mov dword [rbp - 0x49], edi
call fcn.14008ad00
cdqe
mov r9, qword [rbp + 0x3f]
lea rcx, [r9 - 1]
xor edx, edx
div rcx
movsxd rcx, edx
xorps xmm0, xmm0
movups xmmword [rbp + 7], xmm0
mov qword [rbp + 0x17], rsi
mov qword [rbp + 0x1f], rsi
cmp r9, rcx
jb 0x14002a114
sub r9, rcx
mov r8d, 1
cmp r9, r8
cmovb r8, r9
lea rdx, [rbp + 0x2f]
cmp qword [rbp + 0x47], 0x10
cmovae rdx, qword [rbp + 0x2f]
add rdx, rcx
lea rcx, [rbp + 7]
call fcn.1400104f0
or edi, 2
mov dword [rbp - 0x49], edi
lea rdx, [rbp + 7]
cmp qword [rbp + 0x1f], 0x10
cmovae rdx, qword [rbp + 7]
mov r8, qword [rbp + 0x17]
mov rcx, rbx
call fcn.14001b270
nop
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0x10
jb 0x14002a0a4
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002a09f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a10e
call fcn.14007bc24
cmp qword [rbx + 0x10], 0xc
jne 0x140029ff3
mov rdx, qword [rbp + 0x47]
cmp rdx, 0x10
jb 0x14002a0e6
inc rdx
mov rcx, qword [rbp + 0x2f]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002a0e1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a11a
call fcn.14007bc24
mov rax, rbx
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.14007b610
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.1400824c4
int3
call fcn.14001c030
nop
call fcn.1400824c4
int3