joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004e320
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov rdi, rdx
mov rsi, rcx
test rdx, rdx
je 0x14004e4d5
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
xor ebx, ebx
mov eax, dword [rdx + rcx]
cmp dword [0x1400968a0], eax
jle 0x14004e40b
lea rcx, [0x1400968a0]
call fcn.14006cb20
cmp dword [0x1400968a0], 0xffffffff
jne 0x14004e40b
mov qword [rbp + 0x27], rbx
mov qword [rbp + 0x37], rbx
mov qword [rbp + 0x3f], recv
mov byte [rbp + 0x27], bl
lea r8d, [rbx + 0xa]
lea rdx, str.ExFreePool
lea rcx, [rbp + 0x27]
call fcn.140054920
nop
lea r8, [rbp + 0x27]
mov rdx, qword [0x140093078]
mov rcx, rsi
call fcn.14004e500
mov qword [0x140096870], rax
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0x10
jb 0x14004e3ff
inc rdx
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004e3f9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004e3f9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006c920
nop
lea rcx, [0x1400968a0]
call fcn.14006cac0
mov r8, qword [0x140096870]
test r8, r8
jne 0x14004e4d9
mov dword [rbp - 0x29], 0x17de17a5
mov dword [rbp - 0x25], 0x1821185d
mov dword [rbp - 0x21], 0x18621844
mov dword [rbp - 0x1d], 0x1869186d
mov dword [rbp - 0x19], 0x18631863
mov dword [rbp - 0x15], 0x187d1828
mov dword [rbp - 0x11], 0x182b1865
mov dword [rbp - 0xd], 0x1864186a
mov dword [rbp - 9], 0x186b1860
mov dword [rbp - 5], 0x18541830
mov dword [rbp - 1], 0x1852186a
mov dword [rbp + 3], 0x18791878
mov dword [rbp + 7], 0x18741879
mov dword [rbp + 0xb], 0x186d1879
mov dword [rbp + 0xf], 0x184b187f
mov dword [rbp + 0x13], 0x18721873
mov dword [rbp + 0x17], 0x1872
mov byte [rbp + 0x1b], 1
mov ecx, 0x17fe
nop dword [rax + rax]
lea eax, [rcx + rbx]
xor word [rbp + rbx*2 - 0x29], ax
inc rbx
cmp rbx, 0x21
jb 0x14004e4a0
mov byte [rbp + 0x1b], 0
lea rdx, [rbp - 0x29]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140054ad0
lea rdx, [0x140054cb0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor al, al
jmp 0x14004e4e6
mov r9, rdi
xor edx, edx
mov rcx, rsi
call fcn.140056ef0
mov rbx, qword [rsp + 0xc0]
add rsp, 0x90
pop rdi
pop rsi
pop rbp
ret
Function at 0x14004f1b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov rdi, rdx
mov rsi, rcx
test rdx, rdx
je 0x14004f385
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
xor ebx, ebx
mov eax, dword [rdx + rcx]
cmp dword [0x1400968b8], eax
jle 0x14004f29b
lea rcx, [0x1400968b8]
call fcn.14006cb20
cmp dword [0x1400968b8], 0xffffffff
jne 0x14004f29b
mov qword [rbp + 0x27], rbx
mov qword [rbp + 0x37], rbx
mov qword [rbp + 0x3f], recv
mov byte [rbp + 0x27], bl
lea r8d, [rbx + 0x15]
lea rdx, str.ExReleaseResourceLite
lea rcx, [rbp + 0x27]
call fcn.140054920
nop
lea r8, [rbp + 0x27]
mov rdx, qword [0x140093078]
mov rcx, rsi
call fcn.14004e500
mov qword [0x140096848], rax
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0x10
jb 0x14004f28f
inc rdx
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004f289
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004f289
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006c920
nop
lea rcx, [0x1400968b8]
call fcn.14006cac0
mov r8, qword [0x140096848]
test r8, r8
jne 0x14004f389
mov dword [rbp - 0x39], 0x17de17a5
mov dword [rbp - 0x35], 0x1821185d
mov dword [rbp - 0x31], 0x18621844
mov dword [rbp - 0x2d], 0x1869186d
mov dword [rbp - 0x29], 0x18631863
mov dword [rbp - 0x25], 0x187d1828
mov dword [rbp - 0x21], 0x182b1865
mov dword [rbp - 0x1d], 0x1864186a
mov dword [rbp - 0x19], 0x186b1860
mov dword [rbp - 0x15], 0x18541830
mov dword [rbp - 0x11], 0x1841186a
mov dword [rbp - 0xd], 0x18791871
mov dword [rbp - 9], 0x18761873
mov dword [rbp - 5], 0x187c186b
mov dword [rbp - 1], 0x187e1848
mov dword [rbp + 3], 0x1872186f
mov dword [rbp + 7], 0x186d186b
mov dword [rbp + 0xb], 0x18441843
mov dword [rbp + 0xf], 0x184a186e
mov dword [rbp + 0x13], 0x18401850
mov word [rbp + 0x17], bx
mov byte [rbp + 0x19], 1
mov ecx, 0x17fe
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx + rbx]
xor word [rbp + rbx*2 - 0x39], ax
inc rbx
cmp rbx, 0x28
jb 0x14004f350
mov byte [rbp + 0x19], 0
lea rdx, [rbp - 0x39]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140054ad0
lea rdx, [0x140054cb0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor al, al
jmp 0x14004f396
mov r9, rdi
xor edx, edx
mov rcx, rsi
call fcn.140057c60
mov rbx, qword [rsp + 0xd0]
add rsp, 0xa0
pop rdi
pop rsi
pop rbp
ret
Function at 0x140050940
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0xf70]
mov eax, 0x1070
call fcn.14006dc60
sub rsp, rax
mov rax, qword [0x140092010]
xor rax, rsp
mov qword [rbp + 0xf60], rax
mov rdi, r9
mov rbx, r8
test r8, r8
je 0x140050b58
mov r9d, 0x1000
lea rdx, [rsp + 0x60]
call fcn.14004d360
xor edx, edx
test al, al
jne 0x140050a41
mov dword [rsp + 0x20], 0x17d217a5
mov r8d, 0x17fe
mov dword [rsp + 0x24], 0x1821185d
mov dword [rsp + 0x28], 0x18621841
mov dword [rsp + 0x2c], 0x1822186a
mov dword [rsp + 0x30], 0x18271872
mov dword [rsp + 0x34], 0x186c187a
mov dword [rsp + 0x38], 0x186f186b
mov dword [rsp + 0x3c], 0x1860182c
mov dword [rsp + 0x40], 0x186b1861
mov dword [rsp + 0x44], 0x187d1865
mov dword [rsp + 0x48], 0x18331877
mov dword [rsp + 0x4c], 0x1870187c
mov dword [rsp + 0x50], 0x18731877
mov dword [rsp + 0x54], 0x186b187d
mov dword [rsp + 0x58], 0x1869
mov byte [rsp + 0x5c], 1
nop word [rax + rax]
lea eax, [r8 + rdx]
xor word [rsp + rdx*2 + 0x20], ax
inc rdx
cmp rdx, 0x1d
jb 0x140050a20
mov byte [rsp + 0x5c], 0
lea rdx, [rsp + 0x20]
jmp 0x140050b3c
movsxd rax, dword [rbp - 0x64]
lea rcx, [rsp + 0x60]
add rcx, rax
mov r9d, edx
movzx eax, word [rcx + 0x14]
lea r11, [rcx + 0x18]
movzx r10d, word [rcx + 6]
add r11, rax
test r10d, r10d
je 0x140050aab
nop word [rax + rax]
mov eax, r9d
lea rcx, [rax + rax*4]
cmp dword [r11 + rcx*8], 0x45474150
lea r8, [r11 + rcx*8]
jne 0x140050aa3
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [r8 + rax], dl
jne 0x140050a90
cmp rax, 4
je 0x140050b74
inc r9d
cmp r9d, r10d
jb 0x140050a70
mov dword [rsp + 0x20], 0x17d217a5
mov r8d, 0x17fe
mov dword [rsp + 0x24], 0x1821185d
mov dword [rsp + 0x28], 0x18621841
mov dword [rsp + 0x2c], 0x1822186a
mov dword [rsp + 0x30], 0x18271872
mov dword [rsp + 0x34], 0x1860186e
mov dword [rsp + 0x38], 0x186f1864
mov dword [rsp + 0x3c], 0x187e182c
mov dword [rsp + 0x40], 0x186c186b
mov dword [rsp + 0x44], 0x18781864
mov dword [rsp + 0x48], 0x187d187d
mov word [rsp + 0x4c], dx
mov byte [rsp + 0x4e], 1
nop dword [rax]
nop word [rax + rax]
lea eax, [r8 + rdx]
xor word [rsp + rdx*2 + 0x20], ax
inc rdx
cmp rdx, 0x16
jb 0x140050b20
mov byte [rsp + 0x4e], 0
lea rdx, [rsp + 0x20]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140054ad0
lea rdx, [0x140054cb0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor eax, eax
mov rcx, qword [rbp + 0xf60]
xor rcx, rsp
call fcn.14006c830
add rsp, 0x1070
pop rdi
pop rbx
pop rbp
ret
mov eax, dword [r8 + 0xc]
test eax, eax
je 0x140050aab
mov ecx, dword [r8 + 8]
lea r8, [rsp + 0x60]
add r8, rax
je 0x140050aab
test ecx, ecx
je 0x140050aab
test rdi, rdi
je 0x140050ba1
mov dword [rdi], ecx
lea rax, [rsp + 0x60]
sub rbx, rax
lea rax, [r8 + rbx]
jmp 0x140050b5a
Function at 0x140053200
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x76], 0
je 0x140053225
xor eax, eax
mov r8d, 0x17fe
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x3a
jb 0x140053210
mov byte [rcx + 0x76], 0
ret

Function at 0x140053230
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x6c], 0
je 0x140053255
xor eax, eax
mov r8d, 0x17fe
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x35
jb 0x140053240
mov byte [rcx + 0x6c], 0
ret

Function at 0x140053260
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x74], 0
je 0x140053285
xor eax, eax
mov r8d, 0x17fe
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x39
jb 0x140053270
mov byte [rcx + 0x74], 0
ret

Function at 0x140053290
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x6e], 0
je 0x1400532b5
xor eax, eax
mov r8d, 0x17fe
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x36
jb 0x1400532a0
mov byte [rcx + 0x6e], 0
ret

Function at 0x1400532c0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x48], 0
je 0x1400532e5
xor eax, eax
mov r8d, 0x17fe
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x23
jb 0x1400532d0
mov byte [rcx + 0x48], 0
ret

Function at 0x1400532f0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x66], 0
je 0x140053315
xor eax, eax
mov r8d, 0x17fe
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x32
jb 0x140053300
mov byte [rcx + 0x66], 0
ret

Function at 0x140053610
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x140053647
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x140053668
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14005366a
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x1400536c3
test ecx, ecx
jle 0x1400536a3
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
sub rbx, rbp
add r14, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x1400536c3
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x1400536c3
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x30]
sub rsi, rbx
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1400536f0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140053712
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x140053728
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140053744
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140053746
xor ecx, ecx
mov qword [rsp + 0x20], rdi
movsxd rax, ecx
test ecx, ecx
je 0x140053780
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
sub rbx, rdi
add r14, rdi
mov r8, rbx
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x140053827
mov r9, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r9], rax
jne 0x1400537bb
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r9], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov rdi, r8
cmp r8, 0xfff
jbe 0x140053801
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
add r14, rax
mov rdi, rbx
cmp rax, 0xfff
jne 0x140053840
cmp rbx, rax
ja 0x1400537d0
mov r8, rdi
test rdi, rdi
je 0x140053827
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov r8, rdi
sub r8, rax
sub rbp, r8
mov rdi, qword [rsp + 0x20]
mov rax, rbp
mov rbx, qword [rsp + 0x28]
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
sub rbp, rbx
jmp 0x14005382a
Function at 0x140053c40
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140092010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x140053c6d
xor eax, eax
jmp 0x140053dc2
mov rdx, qword [rcx + 0x40]
mov rax, qword [rdx]
test rax, rax
je 0x140053c98
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, rax
cmp rax, r8
jae 0x140053c98
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x140053dc2
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x140053db5
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x140053cdb
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140053d06
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140053dba
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140053d75
sub eax, 1
je 0x140053d75
cmp eax, 2
jne 0x140053db5
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140053dba
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140053da3
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x140053db5
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, edi
jne 0x140053dba
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14006c830
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret

Function at 0x140053f90
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x4a], 0
je 0x140053fb5
xor eax, eax
mov r8d, 0x17fe
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x24
jb 0x140053fa0
mov byte [rcx + 0x4a], 0
ret

Function at 0x140053fc0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x50], 0
je 0x140053fe5
xor eax, eax
mov r8d, 0x17fe
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x27
jb 0x140053fd0
mov byte [rcx + 0x50], 0
ret
Function at 0x140053ff0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x3e], 0
je 0x140054015
xor eax, eax
mov r8d, 0x17fe
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x1e
jb 0x140054000
mov byte [rcx + 0x3e], 0
ret

Function at 0x140054020
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x36], 0
je 0x140054045
xor eax, eax
mov r8d, 0x17fe
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x1a
jb 0x140054030
mov byte [rcx + 0x36], 0
ret

Function at 0x140054050
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x4c], 0
je 0x140054075
xor eax, eax
mov r8d, 0x17fe
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x25
jb 0x140054060
mov byte [rcx + 0x4c], 0
ret

Function at 0x140054080
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x46], 0
je 0x1400540a5
xor eax, eax
mov r8d, 0x17fe
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x22
jb 0x140054090
mov byte [rcx + 0x46], 0
ret

Function at 0x1400540b0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x58], 0
je 0x1400540d5
xor eax, eax
mov r8d, 0x17fe
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x2b
jb 0x1400540c0
mov byte [rcx + 0x58], 0
ret

Function at 0x140054470
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140092010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140054543
cmp byte [rcx + 0x71], 0
je 0x140054543
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14005453f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140054504
sub eax, 1
je 0x140054508
cmp eax, 2
jne 0x14005453f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14006c830
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140054536
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14005453f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1400544ec
xor al, al
jmp 0x1400544ec
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14006c830
add rsp, 0x60
pop rbx
ret
Function at 0x14005c370
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x140092010]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x20], rcx
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x14005c488
movsxd rax, dword [rdx + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x14005c488
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
xor edx, edx
mov qword [rsp + 0x50], rdx
mov ecx, dword [rax + rsi + 0xb0]
test ecx, ecx
jne 0x14005c3e8
mov qword [rdi], rdx
mov qword [rdi + 8], rdx
mov qword [rdi + 0x10], rdx
jmp 0x14005c495
lea rbx, [rsi + rcx]
mov ebp, dword [rax + rsi + 0xb4]
add rbp, rbx
mov rcx, qword [rsp + 0x48]
cmp rbx, rbp
jae 0x14005c476
mov r8d, dword [rbx + 4]
test r8d, r8d
je 0x14005c476
mov eax, dword [rbx]
add rax, rsi
mov qword [rsp + 0x28], rax
lea rax, [rbx + 8]
mov qword [rsp + 0x30], rax
lea rax, [r8 - 8]
shr rax, 1
mov dword [rsp + 0x38], eax
cmp rcx, rdx
je 0x14005c44f
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rcx], xmm0
movsd xmm1, qword [rsp + 0x38]
movsd qword [rcx + 0x10], xmm1
mov rcx, qword [rsp + 0x48]
add rcx, 0x18
mov qword [rsp + 0x48], rcx
jmp 0x14005c466
lea r8, [rsp + 0x28]
mov rdx, rcx
lea rcx, [rsp + 0x40]
call fcn.14005c9c0
mov rcx, qword [rsp + 0x48]
mov eax, dword [rbx + 4]
add rbx, rax
mov rdx, qword [rsp + 0x50]
cmp rbx, rbp
jb 0x14005c400
mov rax, qword [rsp + 0x40]
mov qword [rdi], rax
mov qword [rdi + 8], rcx
mov qword [rdi + 0x10], rdx
jmp 0x14005c495
xor edx, edx
mov qword [rcx], rdx
mov qword [rcx + 8], rdx
mov qword [rcx + 0x10], rdx
mov rax, rdi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14006c830
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14005e070
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x140092010]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r14, rcx
xor ebp, ebp
mov ebx, ebp
mov dword [rsp + 0x20], ebp
lea r9, [rsp + 0x20]
xor r8d, r8d
xor edx, edx
lea ecx, [rbp + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x14005e104
test rbx, rbx
je 0x14005e0cc
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rsp + 0x20]
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
lea r9, [rsp + 0x20]
mov r8d, dword [rsp + 0x20]
mov rdx, rax
mov ecx, 0xb
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x14005e0b6
test eax, eax
jns 0x14005e143
test rbx, rbx
je 0x14005e11e
mov r8d, 0x8000
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14006c830
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
test rbx, rbx
je 0x14005e11e
mov edi, ebp
cmp dword [rbx], ebp
jbe 0x14005e10d
nop
mov esi, edi
imul rax, rsi, 0x128
movzx ecx, word [rax + rbx + 0x2e]
add rcx, rax
lea rdx, [rbx + 0x30]
add rdx, rcx
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], socket
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x14005e182
lea rcx, [rsp + 0x28]
call fcn.140054920
mov rdx, r14
cmp qword [r14 + 0x18], 0x10
jb 0x14005e1a3
mov rdx, qword [r14]
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 0x10
cmovae rcx, qword [rsp + 0x28]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x14005e206
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x14005e1f7
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005e1f2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005e257
call fcn.14006c920
inc edi
cmp edi, dword [rbx]
jb 0x14005e150
jmp 0x14005e10d
imul rax, rsi, 0x128
mov rdi, qword [rax + rbx + 0x18]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x14005e263
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005e25e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005e25e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006c920
mov rax, rdi
jmp 0x14005e120