joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140047160
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x11], 0
je 0x140047183
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x4e]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x10
jb 0x140047170
mov byte [rcx + 0x11], 0
mov rax, rcx
ret

Function at 0x140047190
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x12], 0
je 0x1400471b3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x4e]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x11
jb 0x1400471a0
mov byte [rcx + 0x12], 0
mov rax, rcx
ret

Function at 0x1400471c0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1f], 0
je 0x1400471e3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x4e]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1e
jb 0x1400471d0
mov byte [rcx + 0x1f], 0
mov rax, rcx
ret

Function at 0x1400471f0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x21], 0
je 0x140047213
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x4e]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x20
jb 0x140047200
mov byte [rcx + 0x21], 0
mov rax, rcx
ret

Function at 0x140047220
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x17], 0
je 0x140047243
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x4e]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x16
jb 0x140047230
mov byte [rcx + 0x17], 0
mov rax, rcx
ret

Function at 0x140047250
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x20], 0
je 0x140047273
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x4e]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1f
jb 0x140047260
mov byte [rcx + 0x20], 0
mov rax, rcx
ret

Function at 0x140047280
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1b], 0
je 0x1400472a3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x4e]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1a
jb 0x140047290
mov byte [rcx + 0x1b], 0
mov rax, rcx
ret

Function at 0x1400472b0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1c], 0
je 0x1400472d3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x4e]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1b
jb 0x1400472c0
mov byte [rcx + 0x1c], 0
mov rax, rcx
ret

Function at 0x1400472e0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x16], 0
je 0x140047303
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x4e]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x15
jb 0x1400472f0
mov byte [rcx + 0x16], 0
mov rax, rcx
ret

Function at 0x140047310
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x19], 0
je 0x140047333
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x4e]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x18
jb 0x140047320
mov byte [rcx + 0x19], 0
mov rax, rcx
ret

Function at 0x140047340
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1d], 0
je 0x140047363
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x4e]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1c
jb 0x140047350
mov byte [rcx + 0x1d], 0
mov rax, rcx
ret
Function at 0x140047370
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x18], 0
je 0x140047393
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x4e]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x17
jb 0x140047380
mov byte [rcx + 0x18], 0
mov rax, rcx
ret

Function at 0x1400473a0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x22], 0
je 0x1400473c3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x4e]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x21
jb 0x1400473b0
mov byte [rcx + 0x22], 0
mov rax, rcx
ret

Function at 0x1400473d0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x28], 0
je 0x1400473f3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x4e]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x27
jb 0x1400473e0
mov byte [rcx + 0x28], 0
mov rax, rcx
ret

Function at 0x140047400
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1a], 0
je 0x140047423
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x4e]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x19
jb 0x140047410
mov byte [rcx + 0x1a], 0
mov rax, rcx
ret
Function at 0x140049b90
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x140067010]
xor rax, rsp
mov qword [rbp + 0x4f], rax
movdqa xmm0, xmmword [0x14005c240]
xor ebx, ebx
movdqu xmmword [rbp + 0x17], xmm0
mov ecx, ebx
mov dword [rbp + 0x27], 0x100a6a5
nop dword [rax]
lea eax, [rcx - 0x4e]
xor byte [rbp + rcx + 0x17], al
inc rcx
cmp rcx, 0x12
jb 0x140049bd0
mov byte [rbp + 0x2a], bl
mov rcx, rbx
mov dword [rbp - 9], 0xf7feedf6
mov dword [rbp - 5], 0xf3fab3f0
mov word [rbp - 1], 0xcc
mov byte [rbp + 1], 1
nop
lea eax, [rcx - 0x68]
xor byte [rbp + rcx - 9], al
inc rcx
cmp rcx, 9
jb 0x140049c00
lea rcx, [rbp - 9]
mov byte [rbp + 1], bl
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [rbp + 0x17]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
movdqa xmm0, xmmword [0x14005c560]
mov rdx, rbx
movdqu xmmword [rbp + 0x2f], xmm0
mov rdi, rax
mov word [rbp + 0x3f], 0x100
nop dword [rax]
nop word [rax + rax]
lea ecx, [rdx - 0x4e]
xor byte [rbp + rdx + 0x2f], cl
inc rdx
cmp rdx, 0x10
jb 0x140049c50
mov byte [rbp + 0x40], bl
mov dword [rbp + 7], 0xf7feedf6
mov dword [rbp + 0xb], 0xf3fab3f0
mov word [rbp + 0xf], 0xcc
mov byte [rbp + 0x11], 1
nop dword [rax + rax]
lea eax, [rbx - 0x68]
xor byte [rbp + rbx + 7], al
inc rbx
cmp rbx, 9
jb 0x140049c80
lea rcx, [rbp + 7]
mov byte [rbp + 0x11], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp + 0x2f]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor r8d, r8d
lea r9, [rbp + 0x47]
mov dl, 1
mov rbx, rax
lea ecx, [r8 + 0x13]
call rdi
lea rax, [rbp + 0x4b]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 6
mov ecx, 0xc00002b4
call rbx
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.140052570
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret

Function at 0x140049d00
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x32], 0
je 0x140049d23
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x4e]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x31
jb 0x140049d10
mov byte [rcx + 0x32], 0
mov rax, rcx
ret
Function at 0x140049d90
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
movdqa xmm0, xmmword [0x14005c170]
movdqu xmmword [rbp + 0x27], xmm0
movdqa xmm1, xmmword [0x14005c520]
movdqu xmmword [rbp + 0x37], xmm1
mov dword [rbp + 0x47], 0xbbb1babe
mov dword [rbp + 0x4b], 0xb8baf8a2
mov dword [rbp + 0x4f], 0xa5a8f5b4
mov word [rbp + 0x53], 0xaa
mov byte [rbp + 0x55], 1
xor esi, esi
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 0x4e]
xor byte [rbp + rcx + 0x27], al
inc rcx
cmp rcx, 0x2d
jb 0x140049df0
mov byte [rbp + 0x55], sil
mov qword [rbp - 0x19], rsi
mov qword [rbp - 9], rsi
mov qword [rbp - 1], 0xf
mov byte [rbp - 0x19], sil
lea rax, [rbp + 0x27]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], sil
jne 0x140049e23
lea rdx, [rbp + 0x27]
lea rcx, [rbp - 0x19]
call fcn.1400506b0
nop
lea rdx, [rbp - 0x19]
lea rcx, [rbp + 7]
call fcn.140046400
mov rbx, rax
lea rdi, [0x140068930]
cmp rdi, rax
je 0x140049ed0
mov rdx, qword [0x140068948]
cmp rdx, 0x10
jb 0x140049e93
mov rcx, qword [0x140068930]
inc rdx
cmp rdx, 0x1000
jb 0x140049e8e
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140049f02
mov rcx, r8
call fcn.140052b18
mov qword [0x140068940], rsi
mov qword [0x140068948], 0xf
mov byte [0x140068930], 0
movups xmm0, xmmword [rbx]
movups xmmword [0x140068930], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [0x140068940], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0x10
jb 0x140049f0e
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049f09
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140049f09
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140052b18
mov qword [rbp + 0x17], rsi
mov qword [rbp + 0x1f], 0xf
mov byte [rbp + 7], 0
mov rdx, qword [rbp - 1]
cmp rdx, 0x10
jb 0x140049f5c
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049f57
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140049f57
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140052b18
mov rax, qword [0x140068980]
lea r9, [0x140068970]
cmp qword [0x140068988], 0x10
cmovae r9, qword [0x140068970]
cmp qword [0x140068948], 0x10
cmovae rdi, qword [0x140068930]
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, qword [0x140068940]
mov rcx, rdi
call fcn.140050ea0
cmp rax, 0xffffffffffffffff
je 0x140049fac
call fcn.140049b90
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x14004ac10
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x3d], 0
je 0x14004ac33
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x4e]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x3c
jb 0x14004ac20
mov byte [rcx + 0x3d], 0
mov rax, rcx
ret
Function at 0x14004ed40
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x23], 0
je 0x14004ed63
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x4e]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x22
jb 0x14004ed50
mov byte [rcx + 0x23], 0
ret

Function at 0x14004ed70
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x3c], 0
je 0x14004ed93
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x4e]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x3b
jb 0x14004ed80
mov byte [rcx + 0x3c], 0
ret

Function at 0x14004eda0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xa4], 0
je 0x14004edc8
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x4e]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xa3
jb 0x14004edb0
mov byte [rcx + 0xa4], 0
ret

Function at 0x14004edd0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 3], 0
je 0x14004edf3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x4e]
xor byte [rax + rcx], dl
inc rax
cmp rax, 2
jb 0x14004ede0
mov byte [rcx + 3], 0
ret

Function at 0x14004ee00
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x35], 0
je 0x14004ee23
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x4e]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x34
jb 0x14004ee10
mov byte [rcx + 0x35], 0
ret

Function at 0x14004ee30
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x28], 0
je 0x14004ee53
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x4e]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x27
jb 0x14004ee40
mov byte [rcx + 0x28], 0
ret

Function at 0x14004ee60
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x16], 0
je 0x14004ee83
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x4e]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x15
jb 0x14004ee70
mov byte [rcx + 0x16], 0
ret

Function at 0x14004ee90
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1b], 0
je 0x14004eeb3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x4e]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1a
jb 0x14004eea0
mov byte [rcx + 0x1b], 0
ret

Function at 0x14004eec0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x20], 0
je 0x14004eee3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x4e]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1f
jb 0x14004eed0
mov byte [rcx + 0x20], 0
ret

Function at 0x14004eef0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x17], 0
je 0x14004ef13
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x4e]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x16
jb 0x14004ef00
mov byte [rcx + 0x17], 0
ret

Function at 0x14004ef20
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 4], 0
je 0x14004ef43
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x4e]
xor byte [rax + rcx], dl
inc rax
cmp rax, 3
jb 0x14004ef30
mov byte [rcx + 4], 0
ret

Function at 0x14004ef50
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x11], 0
je 0x14004ef73
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x4e]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x10
jb 0x14004ef60
mov byte [rcx + 0x11], 0
ret
Function at 0x14004f270
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x14004f2a7
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x14004f2c8
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14004f2ca
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x14004f323
test ecx, ecx
jle 0x14004f303
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
sub rbx, rbp
add r14, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x14004f323
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x14004f323
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x30]
sub rsi, rbx
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14004f350
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x14004f372
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x14004f388
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14004f3a4
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14004f3a6
xor ecx, ecx
mov qword [rsp + 0x20], rdi
movsxd rax, ecx
test ecx, ecx
je 0x14004f3e0
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
sub rbx, rdi
add r14, rdi
mov r8, rbx
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14004f487
mov r9, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r9], rax
jne 0x14004f41b
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r9], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov rdi, r8
cmp r8, 0xfff
jbe 0x14004f461
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
add r14, rax
mov rdi, rbx
cmp rax, 0xfff
jne 0x14004f4a0
cmp rbx, rax
ja 0x14004f430
mov r8, rdi
test rdi, rdi
je 0x14004f487
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov r8, rdi
sub r8, rax
sub rbp, r8
mov rdi, qword [rsp + 0x20]
mov rax, rbp
mov rbx, qword [rsp + 0x28]
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
sub rbp, rbx
jmp 0x14004f48a
Function at 0x14004f8b0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140067010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14004f8dd
xor eax, eax
jmp 0x14004fa32
mov rdx, qword [rcx + 0x40]
mov rax, qword [rdx]
test rax, rax
je 0x14004f908
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, rax
cmp rax, r8
jae 0x14004f908
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x14004fa32
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14004fa25
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x14004f94b
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14004f976
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14004fa2a
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14004f9e5
sub eax, 1
je 0x14004f9e5
cmp eax, 2
jne 0x14004fa25
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14004fa2a
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x14004fa13
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14004fa25
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, edi
jne 0x14004fa2a
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140052570
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret

Function at 0x14004fc10
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x13], 0
je 0x14004fc33
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x4e]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x12
jb 0x14004fc20
mov byte [rcx + 0x13], 0
ret

Function at 0x14004fc40
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x14004fc63
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x4e]
xor byte [rax + rcx], dl
inc rax
cmp rax, 4
jb 0x14004fc50
mov byte [rcx + 5], 0
ret
Function at 0x140050060
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140067010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140050133
cmp byte [rcx + 0x71], 0
je 0x140050133
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14005012f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400500f4
sub eax, 1
je 0x1400500f8
cmp eax, 2
jne 0x14005012f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140052570
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140050126
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14005012f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1400500dc
xor al, al
jmp 0x1400500dc
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140052570
add rsp, 0x60
pop rbx
ret
Function at 0x14001eea1
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
push rbp
push r15
mov rax, 0x8c
sub rsp, 8
mov qword [rsp], 0
dec rax
jne 0x14001eeb5
sub rsp, 0x28
call fcn.140042180
mov rdx, qword [rsp + 0x4a8]
lea rcx, [rsp + 0x28]
sub rsp, 0x10
call fcn.1400421f0
add rsp, 0x10
mov dword [0x1400f9001], 0x4000096
mov dword [0x1400f9001], 0x400009a
push qword [rsp + 0x4a0]
push 0x18
pop rcx
pop rdx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x468], rax
mov dword [0x1400f9001], 0x400009b
cmp qword [rsp + 0x468], 0
je 0x14001f0a7
mov dword [0x1400f9001], 0x400009c
lea rbp, [rsp + 0x30]
mov dword [rbp], 0x438
mov dword [0x1400f9001], 0x400009d
lea rax, [rsp + 0x30]
mov rax, rax
push rax
push qword [rsp + 0x470]
pop rcx
pop rdx
call sub.KERNEL32.dll_Module32FirstW
mov qword [rsp + 0x470], rax
mov dword [0x1400f9001], 0x400009e
cmp qword [rsp + 0x470], 0
je 0x14001f090
mov dword [0x1400f9001], 0x400009f
push rcx
sub rsp, 0x28
call fcn.140041d60
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push 1
push 1
push qword [rsp + 0x48]
push rcx
sub rsp, 0x20
call fcn.140041d60
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.140041d60
add rsp, 0x28
pop rcx
push rax
lea rbp, [rsp + 0x68]
lea rax, [rbp + 0x30]
mov rax, rax
push rax
pop rcx
pop rdx
sub rsp, 0x20
call fcn.1400408b0
add rsp, 0x20
push rax
call fcn.140041f90
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14003f660
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.1400246b8
add rsp, 0x28
pop rax
and rax, rax
je 0x14001f04e
mov dword [0x1400f9001], 0x40000a0
lea rbp, [rsp + 0x30]
push qword [rbp + 0x18]
pop rax
mov qword [rsp + 0x478], rax
mov dword [0x1400f9001], 0x40000a1
jmp 0x14001f090
mov dword [0x1400f9001], 0x40000a2
mov dword [0x1400f9001], 0x40000a3
lea rax, [rsp + 0x30]
mov rax, rax
push rax
push qword [rsp + 0x470]
pop rcx
pop rdx
call sub.KERNEL32.dll_Module32NextW
mov qword [rsp + 0x470], rax
mov dword [0x1400f9001], 0x40000a4
jmp 0x14001ef70
mov dword [0x1400f9001], 0x40000a5
push qword [rsp + 0x468]
pop rcx
call sub.KERNEL32.dll_CloseHandle
mov dword [0x1400f9001], 0x40000a6
mov dword [0x1400f9001], 0x40000a8
mov rax, qword [rsp + 0x478]
jmp 0x14001f0d2
push rax
mov rcx, qword [rsp + 0x30]
sub rsp, 0x28
call fcn.140042260
add rsp, 0x28
pop rax
add rsp, 0x488
pop r15
pop rbp
ret