joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b3138
Capabilities:
Connect to http server

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x50
mov qword [r11 - 0x28], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
movzx ebp, r9w
mov rbx, r8
mov r14, rdx
mov rdi, rcx
mov rax, qword [rsp + 0xa0]
mov qword [r11 - 0x48], rax
call fcn.1400b3304
nop
lea rax, vtable.CHttpConnection.0
mov qword [rdi], rax
call fcn.14008c6e8
mov rcx, rax
test rax, rax
je 0x1400b326e
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x1400dedaa.0]
add rax, 0x18
mov qword [rdi + 0x30], rax
test rbx, rbx
jne 0x1400b31af
xor eax, eax
jmp 0x1400b31b7
mov rcx, rbx
call fcn.14023d6a8
mov r8d, eax
mov rdx, rbx
lea rcx, [rdi + 0x30]
call fcn.140002a7c
mov rax, qword [rdi + 0x10]
mov qword [rsp + 0x38], rax
and dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x90]
movzx r8d, bp
mov rdx, rbx
mov rcx, qword [r14 + 0x10]
call qword [sym.imp.WININET.dll_InternetConnectW]
mov rsi, rax
mov qword [rdi + 8], rax
test rax, rax
je 0x1400b3262
mov rbx, qword [rdi + 0x18]
lea rcx, [0x140368828]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rdx, rsi
lea rcx, [0x1403687e0]
call fcn.14014c618
mov qword [rax], rbx
mov rax, qword [0x140368818]
lea rcx, [0x140368818]
mov rax, qword [rax + 0x28]
call qword [case.0x1400dedaa.0]
nop
mov rax, rdi
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
xor edx, edx
mov rcx, qword [rdi + 0x10]
call fcn.1400b3cb8
nop
mov ecx, 0x80004005
call fcn.140002d3c
int3

Function at 0x1400b34f8
Capabilities:
Create http request

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
and dword [rcx + 0x20], 0
lea rax, vtable.CInternetSession.0
and qword [rcx + 0x18], 0
mov edi, r9d
mov qword [rcx], rax
mov r10, rdx
mov qword [rcx + 8], r8
mov rbx, rcx
test rdx, rdx
jne 0x1400b3530
call fcn.1400b08b8
mov r10, qword [rax + 0x20]
mov eax, dword [rsp + 0x70]
mov edx, edi
mov r9, qword [rsp + 0x68]
mov rcx, r10
mov r8, qword [rsp + 0x60]
mov dword [rsp + 0x20], eax
call qword [sym.imp.WININET.dll_InternetOpenW]
mov qword [rbx + 0x10], rax
mov rdi, rax
test rax, rax
je 0x1400b359e
lea rcx, [0x140368828]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rdx, rdi
lea rcx, [0x1403687e0]
call fcn.14014c618
lea rcx, [0x140368818]
mov qword [rax], rbx
mov rax, qword [0x140368818]
mov rax, qword [rax + 0x28]
call qword [case.0x1400dedaa.0]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rbx + 8]
xor edx, edx
call fcn.1400b3cb8
int3

Function at 0x1400badb8
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rbx, rdx
mov rcx, qword [rdx]
cmp dword [rcx - 0x10], 0
je 0x1400badea
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400badea
lea rcx, [rdi + 0x120]
mov rdx, rbx
call fcn.14015bb00
mov rbx, qword [rsp + 0x30]
mov eax, 1
add rsp, 0x20
pop rdi
ret
Function at 0x1400badfc
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov rdi, rdx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x1400bae22
mov r8, rdx
mov rdx, qword [rbx]
call fcn.1400a33d4
jmp 0x1400bae8d
cmp byte [0x140368a08], 0
jne 0x1400bae66
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400bae56
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140368a00], rax
jmp 0x1400bae5d
mov rax, qword [0x140368a00]
mov byte [0x140368a08], 1
jmp 0x1400bae6d
mov rax, qword [0x140368a00]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x1400bae87
mov r8d, dword [rbx + 8]
xor r9d, r9d
call qword [case.0x1400dedaa.0]
jmp 0x1400bae8d
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1400d0f5c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
xor ebx, ebx
mov rdi, r8
mov rsi, rdx
mov r15, rcx
test r8, r8
jne 0x1400d0f8d
call fcn.1400b08b8
mov rdi, qword [rax + 0x18]
lea r8, [0x14028bf40]
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbp, rax
test rax, rax
je 0x1400d0ff6
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
test rax, rax
je 0x1400d0ff6
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
test rax, rax
je 0x1400d0fe9
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, r14
mov rcx, r15
mov r8d, eax
call fcn.1400d1014
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
jmp 0x1400d0ff8
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x14014f770
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
test byte [rdx + 4], 1
mov esi, r8d
mov rbx, qword [rdx + 0x10]
mov rdi, rdx
mov rbp, rcx
jne 0x14014f7e7
mov rcx, qword [rdi + 8]
mov r8d, 5
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x14014f7b7
call fcn.1400af2c4
mov rcx, qword [rdi + 8]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
test rax, rax
jne 0x14014f7d1
call fcn.1400af2c4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
jne 0x14014f7e7
call fcn.1400af2c4
call fcn.1400b08b8
cmp qword [rax + 0x68], 0
je 0x14014f801
mov rdx, rbx
mov rcx, rbp
call fcn.14014ec34
mov rbx, rax
mov edx, esi
mov rcx, rbx
call fcn.14014fa5c
mov rcx, qword [rbp + 0xf8]
mov rsi, rax
test rcx, rcx
je 0x14014f828
call qword [sym.imp.KERNEL32.dll_GlobalFree]
and qword [rbp + 0xf8], 0
test rsi, rsi
je 0x14014f837
mov rbx, rsi
mov qword [rbp + 0xf8], rsi
or dword [rdi + 4], 1
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov qword [rdi + 0x10], rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140193294
Capabilities:
Delete registry value

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 8]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
add rsp, 0x28
ret

Function at 0x1401933d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x38
mov rcx, qword [rcx + 8]
lea rax, [r11 + 8]
mov qword [r11 - 0x10], rax
lea r9, [r11 + 0x20]
mov qword [r11 - 0x18], r8
xor r8d, r8d
mov dword [rsp + 0x40], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor edx, edx
test eax, eax
jne 0x140193412
mov ecx, dword [rsp + 0x58]
sub ecx, 4
neg ecx
sbb eax, eax
and eax, 0xd
test eax, eax
sete dl
mov eax, edx
add rsp, 0x38
ret
Function at 0x14019384c
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x30
mov rdi, r9
mov rbx, r8
mov rsi, rdx
mov rbp, rcx
test rdx, rdx
je 0x14019391e
test rbx, rbx
je 0x14019391e
test r9, r9
je 0x14019391e
and qword [r8], 0
xor r8d, r8d
and dword [r9], 0
mov rcx, qword [rcx + 8]
mov qword [rax - 0x10], r9
lea r9, [rax + 0x10]
and qword [rax - 0x18], 0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14019391a
cmp dword [rsp + 0x48], 3
jne 0x14019391a
test eax, eax
jne 0x14019391a
cmp dword [rdi], eax
je 0x14019391a
mov ecx, dword [rdi]
call fcn.14008c218
mov qword [rbx], rax
lea r9, [rsp + 0x48]
mov rcx, qword [rbp + 8]
xor r8d, r8d
mov qword [rsp + 0x28], rdi
mov rdx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14019390e
cmp dword [rsp + 0x48], 3
jne 0x14019390e
test eax, eax
jne 0x14019390e
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rbx]
call fcn.14008c210
and qword [rbx], 0
xor eax, eax
jmp 0x1401938f9
call fcn.14008d304
int3

Function at 0x140193bf4
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
cmp dword [rcx + 0x28], ebx
je 0x140193c05
xor eax, eax
jmp 0x140193c33
mov rcx, qword [rcx + 8]
lea rax, [rsp + 0x40]
mov r9d, 4
mov dword [rsp + 0x40], r8d
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete bl
mov eax, ebx
add rsp, 0x30
pop rbx
ret

Function at 0x140193c3c
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
cmp dword [rcx + 0x28], ebx
je 0x140193c4d
xor eax, eax
jmp 0x140193c71
mov rcx, qword [rcx + 8]
mov dword [rsp + 0x28], r9d
mov r9d, 3
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete bl
mov eax, ebx
add rsp, 0x30
pop rbx
ret

Function at 0x1401f8010
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x40
and dword [rax - 0x18], 0
mov rbp, r9
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
lea rcx, [rsp + 0x30]
call fcn.1402457a8
test eax, eax
jne 0x1401f8074
mov eax, dword [rsp + 0x30]
lea r8, str._s_s_X.tmp
mov dword [rsp + 0x28], eax
mov r9, rsi
mov rdx, rbp
mov qword [rsp + 0x20], rdi
mov rcx, rbx
call fcn.1400a3150
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1401f8086
jmp 0x1401f8034
mov r9, rbx
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x140246d5c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140246ac0
Function at 0x1402518c4
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov rdx, rcx
test rcx, rcx
jne 0x1402518a1
call fcn.1402326e4
mov dword [rax], 0x16
call fcn.140232594
or eax, 0xffffffff
jmp 0x1402518be
sub dword [rcx + 0x10], 1
jns 0x1402518b0
add rsp, 0x28
jmp fcn.140252998
mov rax, qword [rcx]
movzx ecx, byte [rax]
inc rax
mov qword [rdx], rax
mov eax, ecx
add rsp, 0x28
ret
jmp 0x140251880

Function at 0x140252998
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x140252654
call fcn.1402326e4
mov dword [rax], 0x16
call fcn.140232594
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x14025263c
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x14025263c
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x140252686
lock or dword [rax + 0x14], 0x10
jmp 0x14025263c
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x1402526a3
mov rcx, qword [rbp + 0x10]
call fcn.140259304
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.140244410
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.14025208c
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x1402526fa
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x14025263c
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x140252766
mov rcx, qword [rbp + 0x10]
call fcn.140244410
cmp eax, 0xffffffff
je 0x14025274d
mov rcx, qword [rbp + 0x10]
call fcn.140244410
cmp eax, 0xfffffffe
je 0x14025274d
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.140244410
movsxd rdi, eax
lea rsi, [0x14036c530]
mov rcx, rbx
sar rdi, 6
call fcn.140244410
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x140252754
lea rax, [0x14035dd30]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x140252766
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x14025279c
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x140252798
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x140252798
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x14025263f
jmp 0x14025260c
Function at 0x1402529a0
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x140252806
call fcn.1402326e4
mov dword [rax], 0x16
call fcn.140232594
mov eax, 0xffff
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x1402527e8
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x1402527e8
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x20]
shr ecx, 1
test cl, 1
je 0x140252838
lock or dword [rax + 0x14], 0x10
jmp 0x1402527e8
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x140252855
mov rcx, qword [rbp + 0x20]
call fcn.140259304
mov rax, qword [rbp + 0x20]
cmp dword [rax + 0x10], 1
jne 0x14025286a
mov rcx, qword [rax]
mov sil, 1
mov r14b, byte [rcx]
jmp 0x140252870
xor sil, sil
xor r14b, r14b
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x20]
mov rcx, rbx
call fcn.140244410
mov rdx, qword [rbp + 0x20]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.14025208c
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x20]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 2
ja 0x1402528c3
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x20]
and dword [rax + 0x10], 0
jmp 0x1402527e8
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x14025292f
mov rcx, qword [rbp + 0x20]
call fcn.140244410
cmp eax, 0xffffffff
je 0x140252916
mov rcx, qword [rbp + 0x20]
call fcn.140244410
cmp eax, 0xfffffffe
je 0x140252916
mov rbx, qword [rbp + 0x20]
mov rcx, rbx
call fcn.140244410
movsxd rdi, eax
lea r15, [0x14036c530]
mov rcx, rbx
sar rdi, 6
call fcn.140244410
and eax, 0x3f
shl rax, 6
add rax, qword [r15 + rdi*8]
jmp 0x14025291d
lea rax, [0x14035dd30]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x14025292f
mov rax, qword [rbp + 0x20]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x20]
cmp dword [rax + 0x20], 0x200
jne 0x140252965
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x140252961
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x140252961
mov rax, qword [rbp + 0x20]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax]
test sil, sil
je 0x140252983
movzx edx, byte [rcx]
dec dword [rax + 0x10]
shl dx, 8
movzx ecx, r14b
or dx, cx
inc qword [rax]
jmp 0x14025298e
movzx edx, word [rcx]
add dword [rax + 0x10], 0xfffffffe
add qword [rax], 2
movzx eax, dx
jmp 0x1402527ed
jmp 0x1402527b4
Function at 0x14083341f
Capabilities:
Encode data using xor

Disassembly:
sub ebx, 0x63335b5c
mov rbx, qword [rsp + 0x18]
mov qword [rsp + 0x18], 0x36e04882
push rdx
movabs rdx, 0x5932476e4cf340e2
push rbx
mov rdx, qword [rsp + 8]
movabs rbx, 0x43327bf93e9e4938
or rbx, rbx
or bx, bx
xor rbx, 0x369b43d9
sub bl, 0x65
test rbx, 0x31f46571
mov rbx, qword [rsp]
jo 0x140833433
add qword [rsp + 0x10], 0xffffffffbf0d1650
push qword [rsp + 0x20]
popfq
lea rsp, [rsp + 0x28]
call fcn.141041b28
imul edx, dword [rsi], 0xffffff80
movsb byte [rdi], byte [rsi]
invalid

Function at 0x140895d34
Capabilities:
Encode data using xor

Disassembly:
mov rsi, qword [rsp + 8]
or byte [rsp + 8], sil
test rsi, 0xeba3b9f
jne 0x140fa04ba
add qword [rsp + 0x48], 0xffffffffbf1100b0
not dword [rsp + 8]
mov rsi, qword [rsp + 0x18]
call fcn.140f1ac65
invalid

Function at 0x14103964f
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap edx
add edx, 0x3dc32b57
clc
rol edx, 2
push r9
shr r9b, 0xdb
xor dword [rsp], edx
cmp al, 0x9e
xor r9b, 0x10
add r9w, 0x2cbe
pop r9
cmp r11, rbp
movsxd rdx, edx
test r8b, 0xe6
add rbp, rdx
jmp 0x1410da2c2
rol edx, 3
jmp 0x140fd3d72
push rbx
bswap ebx
push rdi
mov bx, r12w
xchg bh, bl
push rdx
movsx bx, r10b
mov bx, 0x29d9
push r12
push r13
movsxd rbx, r9d
not bh
pushfq
sub dx, ax
push rax
add rbx, 0x779d5a01
clc
push r11
cmc
adc r11w, 0x6278
push rsi
rdtsc
sub ax, 0x5002
add al, 0x33
push r9
seta al
push r14
push rcx
btr bx, sp
movzx r9d, r13w
cbw
push rbp
cwd
push r8
rcl al, cl
clc
push r10
jmp 0x1410d0374
push r15
rdtsc
shld r9w, r9w, 0xce
cbw
movabs r10, 0
push r10
mov rbx, qword [rsp + 0x90]
bts rbp, r15
bswap ebx
and r11b, dl
cdqe
xor ebx, 0x68e708fa
bts rdx, r9
bswap r9w
rol ebx, 1
neg ebx
ror ebx, 1
cdq
lea rbx, [rbx + r10]
sal ebp, 0x71
movabs rax, 0x100000000
sub r11b, 0x6e
lea rbx, [rbx + rax]
movsx ebp, bx
mov bpl, 0xf6
test r13b, 0xa1
mov r11, rsp
sub rsp, 0x180
and rsp, 0xfffffffffffffff0
movsx edx, r12w
movsx rbp, r14w
mov r9, rbx
test r10, 0x7862237b
movabs rax, 0
rol edx, cl
sub r9, rax
adc bpl, r15b
cwd
lea rbp, [0x1410d040e]
movzx edx, r11w
neg dh
mov edx, dword [rbx]
cmp eax, 0x5d0771ef
clc
add rbx, 4
cmp r14, rdi
test r12b, 0x5c
xor edx, r9d
jmp 0x141023a23
jmp rbp
Function at 0x140132794
Capabilities:
Write file on windows

Disassembly:
jmp 0x140169cc0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x1405bd426]
call fcn.140136f88
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x68], 0
je 0x140169d17
mov r8, qword [rbp + 0x130]
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x140169e23
mov rax, qword [rbp + 0x130]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x130], 0
jle 0x140169dbc
cmp qword [rbp + 0x28], 0
jle 0x140169dbc
mov rax, qword [rbp + 0x28]
cmp qword [rbp + 0x130], rax
jge 0x140169d5c
mov rax, qword [rbp + 0x130]
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x128]
mov rcx, rax
call fcn.140136a88
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x128]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov edx, dword [rbp + 0x28]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
cmp qword [rbp + 0x130], 0
jle 0x140169e12
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x80], 0
je 0x140169e12
mov rax, qword [rbp + 0x120]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x130]
mov edx, 1
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.ucrtbased.dll_fwrite]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x130]
mov rcx, qword [rbp + 8]
sub rcx, rax
mov rax, rcx
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret

Function at 0x140132da2
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x14019ef80
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x1405be5c4]
call fcn.140136f88
mov qword [rbp + 8], 0
jmp 0x14019efbe
mov rax, qword [rbp + 8]
inc rax
mov qword [rbp + 8], rax
mov rax, qword [rbp + 0x110]
cmp qword [rbp + 8], rax
jae 0x14019f014
mov rax, qword [rbp + 8]
mov rcx, qword [rbp + 0x108]
add rcx, rax
mov rax, rcx
movzx eax, byte [rax]
mov rcx, qword [rbp + 0x100]
xor rcx, rax
mov rax, rcx
mov qword [rbp + 0x100], rax
movabs rax, 0x100000001b3
mov rcx, qword [rbp + 0x100]
imul rcx, rax
mov rax, rcx
mov qword [rbp + 0x100], rax
jmp 0x14019efb3
mov rax, qword [rbp + 0x100]
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x140132fa0
Capabilities:
Create thread

Disassembly:
jmp 0x140190d10
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x16
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x168]
mov rax, qword [0x14058be80]
xor rax, rbp
mov qword [rbp + 0x100], rax
lea rcx, [0x1405be00a]
call fcn.140136f88
mov edx, 8
lea rcx, [rbp + 8]
call fcn.140133702
mov rdx, qword [rbp + 0x138]
lea rcx, [rbp + 8]
call fcn.1401346bb
nop
lea rax, [0x1401353b3]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x130]
add rax, 8
mov qword [rbp + 0xf8], rax
lea rcx, [rbp + 8]
call fcn.140135593
mov rcx, qword [rbp + 0xf8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rbp + 0x28]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll__beginthreadex]
mov rcx, qword [rbp + 0x130]
mov qword [rcx], rax
mov rax, qword [rbp + 0x130]
cmp qword [rax], 0
je 0x140190dea
lea rcx, [rbp + 8]
call fcn.1401341b1
jmp 0x140190e03
mov rax, qword [rbp + 0x130]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.14013317b
nop
lea rcx, [rbp + 8]
call fcn.140134035
lea rcx, [rbp - 0x30]
lea rdx, [0x1403b8180]
call fcn.1401361eb
mov rcx, qword [rbp + 0x100]
xor rcx, rbp
call fcn.1401345d0
lea rsp, [rbp + 0x118]
pop rdi
pop rbp
ret