joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1406c19e0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rcx
push rbp
lea rbp, [rsp - 0x60]
sub rsp, 0x160
cmp byte [0x14079e091], 0
je 0x1406c1b66
lea rcx, [rsp + 0x50]
call fcn.1406d09e0
nop
mov dword [rsp + 0x20], 0x232e132b
mov dword [rsp + 0x24], 0xc1ddc2c6
mov dword [rsp + 0x28], 0x311ad8d5
mov dword [rsp + 0x2c], 0xc8dbd5d1
mov dword [rsp + 0x30], 0xf1eb2620
mov dword [rsp + 0x34], 0xf40a3737
mov dword [rsp + 0x38], 0xf3fe37ef
mov dword [rsp + 0x3c], 0x49fc
xor eax, eax
mov byte [rsp + 0x40], al
mov qword [rbp + 0x78], rax
mov rax, qword [rbp + 0x78]
movabs r9, 0xd8155246f3d3e94e
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [rbp + 0x78]
mov rax, qword [rbp + 0x78]
movzx edx, byte [rsp + rax + 0x20]
add rcx, r9
mov rax, rcx
and rax, rdx
imul r8, rax, 0xfffffffffffffffe
add r8, rcx
add r8, rdx
sub r8b, 0x22
mov rax, qword [rbp + 0x78]
mov byte [rsp + rax + 0x20], r8b
mov rax, qword [rbp + 0x78]
inc rax
mov qword [rbp + 0x78], rax
mov rax, qword [rbp + 0x78]
cmp rax, 0x21
jb 0x1406c1a70
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x50]
call fcn.1406d0880
mov dword [rsp + 0x20], 0x97808497
mov dword [rsp + 0x24], 0x77818a83
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x28], xmm0
mov dword [rsp + 0x38], eax
mov qword [rbp + 0x78], rax
mov rax, qword [rbp + 0x78]
movabs r9, 0xcf382d256279c42e
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [rbp + 0x78]
mov rax, qword [rbp + 0x78]
movzx edx, byte [rsp + rax + 0x20]
add rcx, r9
mov rax, rcx
and rax, rdx
imul r8, rax, 0xfffffffffffffffe
add r8, rcx
add r8, rdx
sub r8b, 0x42
mov rax, qword [rbp + 0x78]
mov byte [rsp + rax + 0x20], r8b
mov rax, qword [rbp + 0x78]
inc rax
mov qword [rbp + 0x78], rax
mov rax, qword [rbp + 0x78]
cmp rax, 0x1c
jb 0x1406c1b00
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x50]
call fcn.1406bcf30
lea rcx, [rsp + 0x50]
call fcn.1406d0840
nop
lea rcx, [rsp + 0x50]
call fcn.1406c1b80
call fcn.1406bea00
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x1406c1bf0
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x2230
call fcn.140742390
sub rsp, rax
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r9, [rsp + 0x2248]
mov r8d, 0x2000
mov rcx, rax
lea rdx, [rsp + 0x230]
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x1406c1ca2
mov eax, dword [rsp + 0x2248]
xor edi, edi
test rax, 0xfffffffffffffff8
jbe 0x1406c1ca2
lea rsi, [rsp + 0x230]
mov rbx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 0x104
lea r8, [rsp + 0x20]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExW]
test eax, eax
je 0x1406c1c89
mov rdx, rbp
lea rcx, [rsp + 0x20]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
jne 0x1406c1cbd
mov ecx, dword [rsp + 0x2248]
inc edi
shr rcx, 3
add rsi, 8
movsxd rax, edi
cmp rax, rcx
jb 0x1406c1c52
xor al, al
lea r11, [rsp + 0x2230]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov al, 1
jmp 0x1406c1ca4
Function at 0x1406c3150
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
xor ecx, ecx
mov dword [rbp + 0x17], 0x72785b63
mov dword [rbp + 0x1b], 0x1e0c1b05
mov dword [rbp + 0x1f], 0x66701817
mov dword [rbp + 0x23], 0x1c04040d
mov dword [rbp + 0x27], 0x67424005
mov dword [rbp + 0x2b], 0x5170f1e
mov dword [rbp + 0x2f], 0x5f090b15
mov dword [rbp + 0x33], 0x2f362e25
mov dword [rbp + 0x37], 0x3431773c
mov word [rbp + 0x3b], 0x893f
xor eax, eax
mov qword [rbp + 0x3d], rax
mov dword [rbp + 0x45], eax
mov word [rbp + 0x49], ax
mov qword [rbp + 0x67], rcx
mov rax, qword [rbp + 0x67]
movabs r9, 0x376465e6285a6045
nop dword [rax + rax]
mov rcx, qword [rbp + 0x67]
mov rax, qword [rbp + 0x67]
movzx edx, byte [rbp + rax + 0x17]
add rcx, r9
mov rax, rcx
and rax, rdx
imul r8, rax, 0xfffffffffffffffe
add r8, rcx
add r8, rdx
add r8b, 0x1d
mov rax, qword [rbp + 0x67]
mov byte [rbp + rax + 0x17], r8b
mov rax, qword [rbp + 0x67]
inc rax
mov qword [rbp + 0x67], rax
mov rax, qword [rbp + 0x67]
cmp rax, 0x34
jb 0x1406c31d0
lea rax, [rbp + 0x17]
mov qword [rbp - 0x19], rax
lea rcx, [rbp + 0x17]
call fcn.1406bcef0
mov qword [rbp - 0x11], rax
call fcn.1407413b0
movaps xmm0, xmmword [rbp - 0x19]
movdqa xmmword [rbp - 0x19], xmm0
lea r8, [rbp - 0x19]
mov edx, eax
lea rcx, [rbp - 9]
call fcn.1406be030
nop
lea rcx, [rbp - 9]
call fcn.1406be910
movzx ebx, al
mov rdx, qword [rbp + 0xf]
cmp rdx, 7
jbe 0x1406c3294
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1406c328f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1406c328f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140741b18
test bl, bl
setne al
mov rbx, qword [rsp + 0xa8]
add rsp, 0x90
pop rbp
ret
Function at 0x1406ca850
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x260
mov rdi, rcx
xor edx, edx
mov ecx, 2
xor esi, esi
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1406ca8ca
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1406ca8ca
nop word [rax + rax]
mov rdx, rdi
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x1406ca8c6
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1406ca8a0
jmp 0x1406ca8ca
mov esi, dword [rsp + 0x28]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0x260]
mov eax, esi
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x1406d0350
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov esi, 0xffff
movzx edi, dx
mov rbx, rcx
cmp si, dx
jne 0x1406d0372
xor eax, eax
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x1406d03b1
mov r8, qword [rcx + 0x58]
movsxd r9, dword [r8]
lea rcx, [rdx + r9*2]
cmp rdx, rcx
jae 0x1406d03b1
lea eax, [r9 - 1]
mov dword [r8], eax
mov rcx, qword [rbx + 0x40]
mov rdx, qword [rcx]
lea rax, [rdx + 2]
mov qword [rcx], rax
movzx eax, di
mov word [rdx], di
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0x90], rbp
je 0x1406d04cd
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1406d03f8
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub rdx, rcx
mov rax, qword [rbx + 0x38]
sar rdx, 1
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x1406d0406
movzx ecx, di
jmp 0x1406d0460
lea rax, [rsp + 0xa0]
mov word [rsp + 0x40], di
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x42]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_wchar_t__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__wchar_t_const____ptr64__wchar_t_const____ptr64__wchar_t_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1406d0487
sub eax, 1
je 0x1406d0487
cmp eax, 2
jne 0x1406d04cd
movzx ecx, word [rsp + 0x40]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputwc]
mov rbp, qword [rsp + 0x90]
cmp ax, si
cmove di, si
movzx eax, di
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
mov rbp, qword [rsp + 0xa0]
lea rax, [rsp + 0x48]
sub rbp, rax
je 0x1406d04b8
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x48]
mov r8, rbp
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbp, rax
jne 0x1406d04cd
lea rax, [rsp + 0x40]
mov byte [rbx + 0x72], 1
cmp qword [rsp + 0xa8], rax
cmovne si, di
mov rbp, qword [rsp + 0x90]
movzx eax, si
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x1406d0e00
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x1406d0e28
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x1406d0e4e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x1406d0e50
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x1406d0ea9
test ecx, ecx
jle 0x1406d0e89
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x1406d0ea9
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x1406d0ea9
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
Function at 0x1406d0ed0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x1406d0f01
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
je 0x1406d0f1f
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x30], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x1406d0f3b
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1406d0f3d
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1406d0f79
mov qword [rsp + 0x38], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x38]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x1406d100e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x1406d0fb4
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x1406d0fee
nop dword [rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x1406d100e
cmp rbx, rax
ja 0x1406d0fc0
test rbx, rbx
je 0x1406d100e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
mov rsi, qword [rsp + 0x48]
sub rbp, rbx
mov rbx, qword [rsp + 0x30]
mov rax, rbp
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x1406d1480
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x70
mov ebx, edx
mov rdi, rcx
call fcn.1406bceb0
mov ecx, eax
mov edx, ebx
call fcn.1406bcec0
test al, al
je 0x1406d14c6
call fcn.1406bceb0
cmp ebx, eax
jne 0x1406d14b6
call fcn.1406bceb0
xor ebx, ebx
test eax, eax
sete bl
mov eax, ebx
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
mov rax, qword [rdi + 0x40]
mov rcx, qword [rax]
test rcx, rcx
je 0x1406d1508
mov rdx, qword [rdi + 0x58]
movsxd r8, dword [rdx]
lea rax, [rcx + r8]
cmp rcx, rax
jae 0x1406d1508
lea eax, [r8 - 1]
mov dword [rdx], eax
mov rcx, qword [rdi + 0x40]
mov rdx, qword [rcx]
lea rax, [rdx + 1]
mov qword [rcx], rax
mov eax, ebx
mov byte [rdx], bl
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
cmp qword [rdi + 0x80], 0
jne 0x1406d1525
call fcn.1406bceb0
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
mov r8, qword [rdi + 0x18]
lea rax, [rdi + 0x70]
cmp qword [r8], rax
jne 0x1406d1552
mov rcx, qword [rdi + 0x88]
mov rdx, qword [rdi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rdi + 0x38]
mov qword [rax], rcx
mov rax, qword [rdi + 0x50]
mov dword [rax], edx
mov rcx, qword [rdi + 0x68]
test rcx, rcx
jne 0x1406d1587
movsx ecx, bl
mov rdx, qword [rdi + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
cmp eax, 0xffffffff
jne 0x1406d1577
call fcn.1406bceb0
mov ebx, eax
mov eax, ebx
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
lea rax, [rsp + 0x90]
mov byte [rsp + 0x40], bl
mov qword [rsp + 0x38], rax
lea rdx, [rdi + 0x74]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x41]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1406d15e9
sub eax, 1
je 0x1406d15e9
cmp eax, 2
jne 0x1406d1512
movsx ecx, byte [rsp + 0x40]
jmp 0x1406d155e
mov qword [rsp + 0x80], rsi
lea rax, [rsp + 0x48]
mov rsi, qword [rsp + 0x90]
sub rsi, rax
je 0x1406d1622
mov r9, qword [rdi + 0x80]
lea rcx, [rsp + 0x48]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x1406d1639
lea rax, [rsp + 0x40]
mov byte [rdi + 0x71], 1
cmp qword [rsp + 0x98], rax
je 0x1406d1639
mov eax, ebx
jmp 0x1406d163e
call fcn.1406bceb0
mov rsi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
Function at 0x1406d2940
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x50
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1406d2a0b
cmp byte [rcx + 0x72], 0
je 0x1406d2a0b
mov rax, qword [rcx]
mov qword [rsp + 0x68], rdi
mov edi, 0xffff
mov edx, edi
call qword [rax + Ordinal_26]
cmp di, ax
je 0x1406d29fe
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x60]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_wchar_t__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1406d29ba
sub eax, 1
je 0x1406d29be
cmp eax, 2
jne 0x1406d29fe
mov rdi, qword [rsp + 0x68]
mov al, 1
mov byte [rbx + 0x72], 0
add rsp, 0x50
pop rbx
ret
mov byte [rbx + 0x72], 0
mov rdi, qword [rsp + 0x60]
lea rax, [rsp + 0x30]
sub rdi, rax
je 0x1406d29ec
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x30]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x1406d29fe
cmp byte [rbx + 0x72], 0
mov rdi, qword [rsp + 0x68]
sete al
add rsp, 0x50
pop rbx
ret
mov rdi, qword [rsp + 0x68]
xor al, al
add rsp, 0x50
pop rbx
ret
mov al, 1
add rsp, 0x50
pop rbx
ret

Function at 0x1406d2ae0
Capabilities:
Write file on windows

Disassembly:
push rdi
sub rsp, 0x50
cmp qword [rcx + 0x68], 0
mov rdi, rcx
je 0x1406d2bc0
cmp byte [rcx + 0x71], 0
je 0x1406d2bc0
mov rax, qword [rcx]
mov qword [rsp + 0x68], rbx
mov rbx, qword [rax + 0x18]
call fcn.1406bceb0
mov edx, eax
mov rcx, rdi
call rbx
mov ebx, eax
call fcn.1406bceb0
mov edx, ebx
mov ecx, eax
call fcn.1406bcec0
test al, al
jne 0x1406d2bb3
mov rcx, qword [rdi + 0x68]
lea rax, [rsp + 0x60]
lea rdx, [rdi + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1406d2b6f
sub eax, 1
je 0x1406d2b73
cmp eax, 2
jne 0x1406d2bb3
mov rbx, qword [rsp + 0x68]
mov al, 1
mov byte [rdi + 0x71], 0
add rsp, 0x50
pop rdi
ret
mov byte [rdi + 0x71], 0
mov rbx, qword [rsp + 0x60]
lea rax, [rsp + 0x30]
sub rbx, rax
je 0x1406d2ba1
mov r9, qword [rdi + 0x80]
lea rcx, [rsp + 0x30]
mov r8, rbx
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbx, rax
jne 0x1406d2bb3
cmp byte [rdi + 0x71], 0
mov rbx, qword [rsp + 0x68]
sete al
add rsp, 0x50
pop rdi
ret
mov rbx, qword [rsp + 0x68]
xor al, al
add rsp, 0x50
pop rdi
ret
mov al, 1
add rsp, 0x50
pop rdi
ret

Function at 0x1406e19f0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x136], 0
je 0x1406e1a18
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x4e]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0x135
jb 0x1406e1a00
mov byte [rcx + 0x136], 0
mov rax, rcx
ret
Function at 0x1406e8a50
Capabilities:
Execute command

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xa0
mov rax, qword [0x14076f0c0]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov rdi, rcx
mov qword [rsp + 0x90], rcx
mov rcx, qword [rcx + 0x10]
movabs rax, 0x7fffffffffffffff
sub rax, rcx
cmp rax, 0x2d
jb 0x1406e8c9c
mov rax, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x1406e8aa2
mov rax, qword [rdi]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], reloc.WLDAP32.dll_Ordinal_45
lea r9, str.start_cmd__C__color_b__title_Error__echo
mov r8, rdi
movzx edx, byte [rsp + 0x40]
lea rcx, [rsp + 0x68]
call fcn.1406d5500
nop
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x80]
mov rax, rdx
sub rax, rcx
cmp rax, 0x11
jb 0x1406e8b23
lea rax, [rcx + 0x11]
mov qword [rsp + 0x78], rax
lea rbx, [rsp + 0x68]
cmp rdx, 0xf
cmova rbx, qword [rsp + 0x68]
add rbx, rcx
mov r8d, reloc.WS2_32.dll_recvfrom
lea rdx, str.__timeout__t_5_
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x11], 0
lea rax, [rsp + 0x68]
jmp 0x1406e8b45
mov qword [rsp + 0x20], reloc.WS2_32.dll_recvfrom
lea r9, str.__timeout__t_5_
xor r8d, r8d
mov edx, reloc.WS2_32.dll_recvfrom
lea rcx, [rsp + 0x68]
call fcn.1406d5040
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x58], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rcx, [rsp + 0x48]
cmp qword [rsp + 0x60], 0xf
cmova rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x60]
cmp rdx, 0xf
jbe 0x1406e8bd1
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1406e8bcc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1406e8bcc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140741b18
movdqa xmm0, xmmword [0x14075fc60]
movdqu xmmword [rsp + 0x58], xmm0
mov byte [rsp + 0x48], 0
mov rdx, qword [rsp + 0x80]
cmp rdx, 0xf
jbe 0x1406e8c27
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1406e8c22
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1406e8c22
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140741b18
xor ecx, ecx
int 0x29
mov rdx, qword [rdi + 0x18]
cmp rdx, 0xf
jbe 0x1406e8c61
inc rdx
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x1406e8c5c
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1406e8c95
mov rcx, r8
call fcn.140741b18
mov qword [rdi + 0x10], 0
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], 0
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.1407422d0
mov rbx, qword [rsp + 0xb8]
add rsp, 0xa0
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.1406bd7f0
nop
int3
Function at 0x1406e96e0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rbx, rcx
mov qword [rsp + 0x38], rcx
xor edi, edi
mov dword [rsp + 0x30], edi
lea rcx, str.ALLUSERSPROFILE
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x1406e9740
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], dil
jne 0x1406e9727
mov rdx, rax
mov rcx, rbx
call fcn.1406d48f0
jmp 0x1406e97f4
lea rcx, [rsp + 0x40]
call fcn.1406e3b00
nop
mov rsi, rax
cmp qword [rax + 0x18], 7
jbe 0x1406e9758
mov rsi, qword [rax]
mov rbp, qword [rax + 0x10]
call fcn.1407413b0
mov r14d, eax
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov dword [rsp + 0x30], reloc.WS2_32.dll_recv
test rbp, rbp
je 0x1406e97ea
cmp rbp, 0x7fffffff
ja 0x1406e9816
mov dword [rsp + 0x20], edi
xor r9d, r9d
mov r8d, ebp
mov rdx, rsi
mov ecx, eax
call fcn.140741420
mov rdi, rax
shr rax, 0x20
test eax, eax
jne 0x1406e9821
movsxd rdx, edi
xor r8d, r8d
mov rcx, rbx
call fcn.1406d30e0
mov r9, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x1406e97cd
mov r9, qword [rbx]
mov dword [rsp + 0x20], edi
mov r8d, ebp
mov rdx, rsi
mov ecx, r14d
call fcn.140741420
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x1406e980c
lea rcx, [rsp + 0x40]
call fcn.1406be1b0
mov rax, rbx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
shr rcx, 0x20
call fcn.1406bdf10
int3
mov ecx, reloc.WLDAP32.dll_Ordinal_22
call fcn.1406bdc40
int3
shr rdi, 0x20
mov ecx, edi
call fcn.1406bdf10
int3
Function at 0x1406f65f0
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
cdqe
add rsp, 0x28
ret