joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140004800
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rbx, rdx
mov rdi, rcx
test rdx, rdx
je 0x1400049c5
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1400af828], eax
jle 0x1400048f7
lea rcx, [0x1400af828]
call fcn.140083760
cmp dword [0x1400af828], 0xffffffff
jne 0x1400048f7
xorps xmm0, xmm0
movups xmmword [rbp + 0x37], xmm0
mov qword [rbp + 0x47], 0xa
mov qword [rbp + 0x4f], reloc.WS2_32.dll_ntohs
movsd xmm0, qword [str.ExFreePool]
movsd qword [rbp + 0x37], xmm0
movzx eax, word [0x140097530]
mov word [rbp + 0x3f], ax
mov byte [rbp + 0x41], 0
lea r8, [rbp + 0x37]
mov rdx, qword [0x1400af3d8]
mov rcx, rdi
call fcn.1400049f0
mov qword [0x1400af7f0], rax
mov rdx, qword [rbp + 0x4f]
cmp rdx, 0xf
jbe 0x1400048eb
inc rdx
mov rcx, qword [rbp + 0x37]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400048e5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400048e5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400836b0
nop
lea rcx, [0x1400af828]
call fcn.1400836f4
mov r8, qword [0x1400af7f0]
test r8, r8
jne 0x1400049c9
mov dword [rbp - 0x19], 0xa4d0a30
mov dword [rbp - 0x15], 0xa4e0a30
mov dword [rbp - 0x11], 0xa110a29
mov dword [rbp - 0xd], 0xa1e0a18
mov dword [rbp - 9], 0xa100a16
mov dword [rbp - 5], 0xa020a55
mov dword [rbp - 1], 0xa580a18
mov dword [rbp + 3], 0xa130a1f
mov dword [rbp + 7], 0xa180a15
mov dword [rbp + 0xb], 0xa3b0a5d
mov dword [rbp + 0xf], 0xac10a07
mov dword [rbp + 0x13], 0xaee0aed
mov dword [rbp + 0x17], 0xae70aec
mov dword [rbp + 0x1b], 0xaf20ae4
mov dword [rbp + 0x1f], 0xad80ae2
mov dword [rbp + 0x23], 0xae50ae6
mov dword [rbp + 0x27], 0xae7
xor eax, eax
mov byte [rbp + 0x2b], 1
mov edx, 0xa6b
nop dword [rax]
lea ecx, [rdx + rax]
xor word [rbp + rax*2 - 0x19], cx
inc rax
cmp rax, 0x21
jb 0x140004990
mov byte [rbp + 0x2b], 0
lea rdx, [rbp - 0x19]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.14000b2d0
lea rdx, [0x14000b4b0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor al, al
jmp 0x1400049d6
mov r9, rbx
xor edx, edx
mov rcx, rdi
call fcn.14000d5b0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140005750
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov rdi, rdx
mov rsi, rcx
test rdx, rdx
je 0x140005945
mov ecx, 4
mov rax, qword gs:[0x58]
mov rax, qword [rax]
xor ebx, ebx
mov eax, dword [rcx + rax]
cmp dword [0x1400af840], eax
jle 0x140005862
lea rcx, [0x1400af840]
call fcn.140083760
cmp dword [0x1400af840], 0xffffffff
jne 0x140005862
xorps xmm0, xmm0
movups xmmword [rbp + 0x27], xmm0
mov qword [rbp + 0x37], rbx
mov qword [rbp + 0x3f], reloc.WS2_32.dll_ntohs
lea ecx, [rbx + 0x20]
call fcn.1400837d8
mov qword [rbp + 0x27], rax
mov qword [rbp + 0x37], reloc.WS2_32.dll_setsockopt
mov qword [rbp + 0x3f], Ordinal_35
movups xmm0, xmmword [str.ExReleaseResourceLite]
movups xmmword [rax], xmm0
mov ecx, dword [0x140097568]
mov dword [rax + 0x10], ecx
movzx ecx, byte [0x14009756c]
mov byte [rax + 0x14], cl
mov byte [rax + 0x15], bl
lea r8, [rbp + 0x27]
mov rdx, qword [0x1400af3d8]
mov rcx, rsi
call fcn.1400049f0
mov qword [0x1400af7c8], rax
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0xf
jbe 0x140005856
inc rdx
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005850
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005850
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400836b0
nop
lea rcx, [0x1400af840]
call fcn.1400836f4
mov r8, qword [0x1400af7c8]
test r8, r8
jne 0x140005949
mov dword [rbp - 0x39], 0xa4d0a30
mov dword [rbp - 0x35], 0xa4e0a30
mov dword [rbp - 0x31], 0xa110a29
mov dword [rbp - 0x2d], 0xa1e0a18
mov dword [rbp - 0x29], 0xa100a16
mov dword [rbp - 0x25], 0xa020a55
mov dword [rbp - 0x21], 0xa580a18
mov dword [rbp - 0x1d], 0xa130a1f
mov dword [rbp - 0x19], 0xa180a15
mov dword [rbp - 0x15], 0xa3b0a5d
mov dword [rbp - 0x11], 0xad20a07
mov dword [rbp - 0xd], 0xaee0ae4
mov dword [rbp - 9], 0xae50ae6
mov dword [rbp - 5], 0xae30af6
mov dword [rbp - 1], 0xaed0ad5
mov dword [rbp + 3], 0xae50afa
mov dword [rbp + 7], 0xafe0afe
mov dword [rbp + 0xb], 0xaeb0aee
mov dword [rbp + 0xf], 0xaf90ac3
mov dword [rbp + 0x13], 0xaf70ae5
mov word [rbp + 0x17], bx
mov byte [rbp + 0x19], 1
mov ecx, 0xa6b
nop dword [rax + rax]
lea eax, [rcx + rbx]
xor word [rbp + rbx*2 - 0x39], ax
inc rbx
cmp rbx, 0x28
jb 0x140005910
mov byte [rbp + 0x19], 0
lea rdx, [rbp - 0x39]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.14000b2d0
lea rdx, [0x14000b4b0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor al, al
jmp 0x140005956
mov r9, rdi
xor edx, edx
mov rcx, rsi
call fcn.14000e2a0
mov rbx, qword [rsp + 0xd0]
add rsp, 0xa0
pop rdi
pop rsi
pop rbp
ret
Function at 0x140007030
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0xf70]
mov eax, 0x1070
call fcn.140084130
sub rsp, rax
mov rax, qword [0x1400ae0c0]
xor rax, rsp
mov qword [rbp + 0xf60], rax
mov rdi, r9
mov rbx, r8
test r8, r8
je 0x140007248
mov r9d, 0x1000
lea rdx, [rsp + 0x60]
call fcn.140003730
xor edx, edx
test al, al
jne 0x140007131
mov dword [rsp + 0x20], 0xa410a30
mov r8d, 0xa6b
mov dword [rsp + 0x24], 0xa4e0a30
mov dword [rsp + 0x28], 0xa110a2c
mov dword [rsp + 0x2c], 0xa550a1f
mov dword [rsp + 0x30], 0xa540a07
mov dword [rsp + 0x34], 0xa130a07
mov dword [rsp + 0x38], 0xa1c0a16
mov dword [rsp + 0x3c], 0xa170a59
mov dword [rsp + 0x40], 0xa180a14
mov dword [rsp + 0x44], 0xa120a08
mov dword [rsp + 0x48], 0xaa00a1a
mov dword [rsp + 0x4c], 0xae70ae9
mov dword [rsp + 0x50], 0xae00ae2
mov dword [rsp + 0x54], 0xaf40ae0
mov dword [rsp + 0x58], 0xaf4
mov byte [rsp + 0x5c], 1
nop word [rax + rax]
lea eax, [r8 + rdx]
xor word [rsp + rdx*2 + 0x20], ax
inc rdx
cmp rdx, 0x1d
jb 0x140007110
mov byte [rsp + 0x5c], 0
lea rdx, [rsp + 0x20]
jmp 0x14000722c
movsxd rax, dword [rbp - 0x64]
lea rcx, [rsp + 0x60]
add rcx, rax
mov r9d, edx
movzx eax, word [rcx + 0x14]
lea r11, [rcx + 0x18]
movzx r10d, word [rcx + 6]
add r11, rax
test r10d, r10d
je 0x14000719b
nop word [rax + rax]
mov eax, r9d
lea rcx, [rax + rax*4]
cmp dword [r11 + rcx*8], 0x45474150
lea r8, [r11 + rcx*8]
jne 0x140007193
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [r8 + rax], dl
jne 0x140007180
cmp rax, 4
je 0x140007264
inc r9d
cmp r9d, r10d
jb 0x140007160
mov dword [rsp + 0x20], 0xa410a30
mov r8d, 0xa6b
mov dword [rsp + 0x24], 0xa4e0a30
mov dword [rsp + 0x28], 0xa110a2c
mov dword [rsp + 0x2c], 0xa550a1f
mov dword [rsp + 0x30], 0xa540a07
mov dword [rsp + 0x34], 0xa1f0a13
mov dword [rsp + 0x38], 0xa1c0a19
mov dword [rsp + 0x3c], 0xa090a59
mov dword [rsp + 0x40], 0xa1f0a1e
mov dword [rsp + 0x44], 0xa170a09
mov dword [rsp + 0x48], 0xaee0a10
mov word [rsp + 0x4c], dx
mov byte [rsp + 0x4e], 1
nop dword [rax]
nop word [rax + rax]
lea eax, [r8 + rdx]
xor word [rsp + rdx*2 + 0x20], ax
inc rdx
cmp rdx, 0x16
jb 0x140007210
mov byte [rsp + 0x4e], 0
lea rdx, [rsp + 0x20]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.14000b2d0
lea rdx, [0x14000b4b0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor eax, eax
mov rcx, qword [rbp + 0xf60]
xor rcx, rsp
call fcn.140083690
add rsp, 0x1070
pop rdi
pop rbx
pop rbp
ret
mov eax, dword [r8 + 0xc]
test eax, eax
je 0x14000719b
mov ecx, dword [r8 + 8]
lea rax, [rsp + rax + 0x60]
test rax, rax
je 0x14000719b
test ecx, ecx
je 0x14000719b
test rdi, rdi
je 0x140007291
mov dword [rdi], ecx
lea rcx, [rsp + 0x60]
sub rax, rcx
add rax, rbx
jmp 0x14000724a
Function at 0x140009950
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x76], 0
je 0x140009975
xor eax, eax
mov r8d, 0xa6b
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x3a
jb 0x140009960
mov byte [rcx + 0x76], 0
ret

Function at 0x140009980
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x6c], 0
je 0x1400099a5
xor eax, eax
mov r8d, 0xa6b
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x35
jb 0x140009990
mov byte [rcx + 0x6c], 0
ret

Function at 0x1400099b0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x74], 0
je 0x1400099d5
xor eax, eax
mov r8d, 0xa6b
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x39
jb 0x1400099c0
mov byte [rcx + 0x74], 0
ret

Function at 0x1400099e0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x6e], 0
je 0x140009a05
xor eax, eax
mov r8d, 0xa6b
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x36
jb 0x1400099f0
mov byte [rcx + 0x6e], 0
ret

Function at 0x140009a10
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x48], 0
je 0x140009a35
xor eax, eax
mov r8d, 0xa6b
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x23
jb 0x140009a20
mov byte [rcx + 0x48], 0
ret

Function at 0x140009a40
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x66], 0
je 0x140009a65
xor eax, eax
mov r8d, 0xa6b
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x32
jb 0x140009a50
mov byte [rcx + 0x66], 0
ret

Function at 0x140009e00
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x140009e28
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x140009e4e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140009e50
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140009ea9
test ecx, ecx
jle 0x140009e89
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140009ea9
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140009ea9
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
Function at 0x140009ed0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140009ef2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x140009f08
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140009f24
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140009f26
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140009f62
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x140009ffe
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x140009f9d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x140009fde
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x140009ffe
cmp rbx, rax
ja 0x140009fb0
test rbx, rbx
je 0x140009ffe
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x14000a470
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1400ae0c0]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14000a49d
xor eax, eax
jmp 0x14000a609
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x14000a4d7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x14000a4d7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x14000a609
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14000a5fc
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14000a51a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14000a545
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14000a601
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14000a5b4
sub eax, 1
je 0x14000a5b4
cmp eax, 2
jne 0x14000a5fc
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14000a601
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x14000a5e2
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14000a5fc
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x14000a601
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140083690
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret

Function at 0x14000a7e0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x4a], 0
je 0x14000a805
xor eax, eax
mov r8d, 0xa6b
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x24
jb 0x14000a7f0
mov byte [rcx + 0x4a], 0
ret

Function at 0x14000a810
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x50], 0
je 0x14000a835
xor eax, eax
mov r8d, 0xa6b
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x27
jb 0x14000a820
mov byte [rcx + 0x50], 0
ret
Function at 0x14000a840
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x3e], 0
je 0x14000a865
xor eax, eax
mov r8d, 0xa6b
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x1e
jb 0x14000a850
mov byte [rcx + 0x3e], 0
ret

Function at 0x14000a870
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x36], 0
je 0x14000a895
xor eax, eax
mov r8d, 0xa6b
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x1a
jb 0x14000a880
mov byte [rcx + 0x36], 0
ret

Function at 0x14000a8a0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x4c], 0
je 0x14000a8c5
xor eax, eax
mov r8d, 0xa6b
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x25
jb 0x14000a8b0
mov byte [rcx + 0x4c], 0
ret

Function at 0x14000a8d0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x46], 0
je 0x14000a8f5
xor eax, eax
mov r8d, 0xa6b
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x22
jb 0x14000a8e0
mov byte [rcx + 0x46], 0
ret

Function at 0x14000a900
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x58], 0
je 0x14000a925
xor eax, eax
mov r8d, 0xa6b
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x2b
jb 0x14000a910
mov byte [rcx + 0x58], 0
ret

Function at 0x14000aeb0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1400ae0c0]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14000af83
cmp byte [rcx + 0x71], 0
je 0x14000af83
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + Ordinal_26]
cmp eax, 0xffffffff
je 0x14000af7f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14000af44
sub eax, 1
je 0x14000af48
cmp eax, 2
jne 0x14000af7f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140083690
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x14000af76
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14000af7f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14000af2c
xor al, al
jmp 0x14000af2c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140083690
add rsp, 0x60
pop rbx
ret
Function at 0x140012730
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x1400ae0c0]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x40], rcx
xor r8d, r8d
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x140012847
movsxd rax, dword [rdx + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x140012847
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x48], xmm1
mov qword [rsp + 0x58], r8
mov ecx, dword [rax + rdx + 0xb0]
test ecx, ecx
jne 0x1400127a9
mov qword [rdi], r8
mov qword [rdi + 8], r8
mov qword [rdi + 0x10], r8
jmp 0x140012852
lea rbx, [rdx + rcx]
mov ebp, dword [rax + rdx + 0xb4]
add rbp, rbx
mov rcx, qword [rsp + 0x50]
cmp rbx, rbp
jae 0x140012835
mov edx, dword [rbx + 4]
test edx, edx
je 0x140012835
mov eax, dword [rbx]
add rax, rsi
mov qword [rsp + 0x28], rax
lea rax, [rbx + 8]
mov qword [rsp + 0x30], rax
lea rax, [rdx - 8]
shr rax, 1
mov dword [rsp + 0x38], eax
cmp rcx, r8
je 0x14001280e
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rcx], xmm0
movsd xmm1, qword [rsp + 0x38]
movsd qword [rcx + 0x10], xmm1
mov rcx, qword [rsp + 0x50]
add rcx, 0x18
mov qword [rsp + 0x50], rcx
jmp 0x140012825
lea r8, [rsp + 0x28]
mov rdx, rcx
lea rcx, [rsp + 0x48]
call fcn.1400132f0
mov rcx, qword [rsp + 0x50]
mov eax, dword [rbx + 4]
add rbx, rax
mov r8, qword [rsp + 0x58]
cmp rbx, rbp
jb 0x1400127c1
mov rax, qword [rsp + 0x48]
mov qword [rdi], rax
mov qword [rdi + 8], rcx
mov qword [rdi + 0x10], r8
jmp 0x140012852
mov qword [rcx], r8
mov qword [rcx + 8], r8
mov qword [rcx + 0x10], r8
mov rax, rdi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140083690
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140014a70
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1400ae0c0]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor edi, edi
lea r9, [rsp + 0x20]
mov rsi, rcx
mov dword [rsp + 0x20], edi
xor r8d, r8d
xor edx, edx
mov ebx, edi
lea ecx, [rdi + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x140014b01
test rbx, rbx
je 0x140014ac9
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rax
mov ecx, ntohs
mov rbx, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x140014ab3
test eax, eax
jns 0x140014b22
test rbx, rbx
je 0x140014b27
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
jmp 0x140014bed
test rbx, rbx
jne 0x140014b2e
xor eax, eax
jmp 0x140014bed
mov qword [rsp + 0x68], rbp
cmp dword [rbx], edi
jbe 0x140014bd5
nop dword [rax + rax]
mov eax, edi
imul rcx, rax, 0x128
movzx edx, word [rcx + rbx + 0x2e]
lea rbp, [rcx + rbx]
add rcx, 0x30
add rdx, rcx
lea rcx, [rsp + 0x28]
add rdx, rbx
call fcn.14000ac70
cmp qword [rsi + 0x18], 0xf
mov rdx, rsi
jbe 0x140014b73
mov rdx, qword [rsi]
cmp qword [rsp + 0x40], 0xf
lea rcx, [rsp + 0x28]
cmova rcx, qword [rsp + 0x28]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x140014c0a
mov rdx, qword [rsp + 0x40]
cmp rdx, 0xf
jbe 0x140014bcb
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140014bc6
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140014c53
call fcn.1400836b0
inc edi
cmp edi, dword [rbx]
jb 0x140014b40
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rbp, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140083690
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
mov rdi, qword [rbp + 0x18]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, qword [rsp + 0x40]
cmp rdx, 0xf
jbe 0x140014c5f
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140014c5a
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140014c5a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400836b0
mov rax, rdi
jmp 0x140014be8