joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180016080
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
sub rsp, 0x28
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax - 8], rdi
mov qword [rax - 0x10], r12
mov r12, r9
mov qword [rax - 0x18], r13
xor r9d, r9d
mov qword [rax - 0x20], r14
mov r13, rdx
mov rax, rcx
mov qword [rsp], r15
movzx ecx, r8b
mov edx, r9d
shr r8d, 8
test r8d, r8d
jne 0x1800160c9
mov r8d, 0xffffffff
cmp ecx, 0x24
mov r10b, 1
cmovb edx, ecx
movzx ecx, byte [rax]
cmp cl, 0x2b
jne 0x1800160df
mov r10b, 1
jmp 0x1800160e8
cmp cl, 0x2d
jne 0x1800160f1
xor r10b, 1
inc rax
add r8d, 0xffffffff
jne 0x1800160d2
lea rbx, [0x180000000]
test edx, edx
jne 0x180016146
cmp byte [rax], 0x30
lea edi, [rdx + 0xa]
jne 0x18001617e
cmp r8d, 1
jbe 0x180016131
movzx ecx, byte [rax + 1]
sub cl, 0x58
test cl, 0xdf
jne 0x180016131
movzx ecx, byte [rax + 2]
cmp byte [rcx + rbx + 0x2bea0], 0x10
jae 0x180016131
add rax, 2
lea edi, [rdx + 0x10]
add r8d, 0xfffffffe
jmp 0x18001617e
movzx ecx, byte [rax + 1]
cmp byte [rcx + rbx + 0x2bea0], 8
jae 0x18001617e
mov edi, 8
jmp 0x18001617e
mov edi, edx
cmp edx, 0x10
jne 0x18001617e
cmp byte [rax], 0x30
jne 0x18001617e
cmp r8d, 1
jbe 0x18001617e
movzx ecx, byte [rax + 1]
cmp cl, 0x78
je 0x180016166
cmp cl, 0x58
jne 0x18001617e
movzx ecx, byte [rax + 2]
mov edi, edx
cmp byte [rcx + rbx + 0x2bea0], 0x10
jae 0x18001617e
add r8d, 0xfffffffe
add rax, 2
mov r14d, edi
mov r15, rax
movsx ebp, byte [r14 + rbx + 0x2bfa0]
mov rbx, r9
test r8d, r8d
je 0x1800161e7
lea r13, [0x180000000]
mov qword [rsp + 0x48], rsi
movzx ecx, byte [rax]
test cl, cl
je 0x1800161dd
movzx esi, byte [rcx + r13 + 0x2bea0]
cmp esi, edi
jae 0x1800161dd
mov r11, rbx
imul rbx, r14
add rbx, rsi
cmp r11, rbx
ja 0x1800161ce
mov ecx, ebp
shr r11, cl
test r11, r11
je 0x1800161d4
mov r9d, 0x37
inc rax
add r8d, 0xffffffff
jne 0x1800161a1
mov r13, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
mov r14, qword [rsp + 8]
mov rdi, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x40]
test r10b, r10b
jne 0x18001620a
test r9d, r9d
mov ecx, 0x39
cmove r9d, ecx
neg rbx
test r12, r12
je 0x180016213
mov qword [r12], rbx
mov r12, qword [rsp + 0x18]
cmp rax, r15
mov r15, qword [rsp]
mov ecx, 0xffffffc8
mov rbx, qword [rsp + 0x30]
cmove r9d, ecx
test r13, r13
je 0x180016236
mov qword [r13], rax
mov r13, qword [rsp + 0x10]
test r9d, r9d
jne 0x180016283
cmp byte [rax], r9b
je 0x180016283
test r8d, r8d
je 0x180016283
nop word [rax + rax]
movzx ecx, byte [rax]
cmp cl, 0x20
je 0x18001625d
cmp cl, 9
jne 0x180016270
inc rax
add r8d, 0xffffffff
jne 0x180016250
mov eax, 0x4d
add rsp, 0x28
ret
test r8d, r8d
je 0x180016266
test cl, cl
je 0x180016266
mov eax, 0x4c
add rsp, 0x28
ret
mov eax, r9d
add rsp, 0x28
ret
Function at 0x180016ed0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
xor ebp, ebp
lea rax, str.C:DevelAntidetect4PersonalVirtualBox_srcVBoxRuntime_r3winpathint_win.cpp
mov rbx, rdx
mov qword [rsp + 0x28], rax
mov rdi, rcx
mov qword [rcx], rbp
lea rax, [rsp + 0x60]
mov qword [rsp + 0x60], rbp
mov r8, rcx
mov qword [rsp + 0x20], rax
lea rdx, [rbp - 1]
xor r9d, r9d
mov rcx, rbx
call fcn.18000f9a0
mov esi, eax
test eax, eax
js 0x180017073
mov rcx, qword [rsp + 0x60]
cmp rcx, 0xf3
ja 0x180016fde
movsx edx, byte [rbx]
lea eax, [rdx - 0x61]
cmp eax, 0x1a
jb 0x180016f43
lea eax, [rdx - 0x41]
cmp eax, 0x1a
jae 0x180016f78
cmp byte [rbx + 1], 0x3a
jne 0x180016f78
movzx eax, byte [rbx + 2]
cmp al, 0x5c
je 0x180017055
cmp al, 0x2f
je 0x180017055
mov rcx, rdi
call fcn.180016e40
test al, al
je 0x180016fde
xor eax, eax
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
cmp dl, 0x5c
je 0x180016f9c
cmp dl, 0x2f
je 0x180016f9c
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ecx, eax
add rcx, qword [rsp + 0x60]
cmp rcx, 0xf2
jmp 0x180016fdc
movzx eax, byte [rbx + 1]
cmp al, 0x5c
je 0x180016fa8
cmp al, 0x2f
jne 0x180016fd5
movzx eax, byte [rbx + 2]
cmp al, 0x5c
je 0x180016fd5
cmp al, 0x2f
je 0x180016fd5
test al, al
je 0x180016fd5
cmp al, 0x3f
jne 0x180016fcc
movzx eax, byte [rbx + 3]
cmp al, 0x5c
je 0x180016fcc
cmp al, 0x2f
jne 0x180017055
cmp rcx, 0xf0
jmp 0x180016fdc
cmp rcx, 0xf1
jbe 0x180017055
mov rcx, qword [rdi]
call fcn.180003bd0
mov r8, rbx
mov qword [rdi], rbp
lea rdx, [rsp + 0x78]
mov dword [rsp + 0x30], ebp
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x78], rbp
call fcn.18001e9e0
mov esi, eax
test eax, eax
js 0x180017073
cmp qword [rsp + 0x78], rbp
jne 0x180017064
mov rax, qword [rsp + 0x38]
cmp word [rax], 0x5c
jne 0x180017064
cmp word [rax + 2], 0x3f
jne 0x180017064
cmp word [rax + 4], 0x3f
jne 0x180017064
cmp word [rax + 6], 0x5c
jne 0x180017064
mov ecx, 0x5c
mov word [rax + 2], cx
movzx eax, word [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
shr rax, 1
cmp word [rcx + rax*2], bp
jne 0x180017064
mov qword [rdi], rcx
xor eax, eax
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x30]
call fcn.18001e9c0
mov rbx, qword [rsp + 0x68]
mov eax, esi
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x18001d290
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0xe0
mov rax, qword [0x180051010]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov rbx, rcx
mov esi, r8d
mov ecx, 0xfffffff4
mov rdi, rdx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor ebp, ebp
lea r9, [rsp + 0x40]
mov rcx, rax
mov qword [rsp + 0x20], rbp
mov r8d, edi
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea r9d, [rbp + 0xa]
mov dword [rsp + 0x30], 0x2010
mov dword [rsp + 0x28], ebp
lea rcx, [rsp + 0x50]
mov r8d, esi
mov dword [rsp + 0x20], ebp
lea edx, [r9 + 0x76]
call fcn.18001ff40
mov ecx, 0xfffffff4
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rbp
mov rcx, rax
lea rdx, [rsp + 0x50]
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rbp
mov rcx, rax
lea r8d, [rbp + 2]
lea rdx, [0x180027bb4]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.180001160
mov rbx, qword [rsp + 0x118]
add rsp, 0xe0
pop rdi
pop rsi
pop rbp
ret

Function at 0x18001d380
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rbx, rdx
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], 0
mov rcx, rax
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x18001d3d0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0xe0
mov rax, qword [0x180051010]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov r9d, 0x10
mov dword [rsp + 0x30], 0x4080
mov r8, rcx
mov dword [rsp + 0x28], 0x10
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x20], 0x10
lea edx, [r9 + 0x70]
call fcn.180020010
mov ecx, 0xfffffff4
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov rcx, rax
lea rdx, [rsp + 0x50]
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.180001160
add rsp, 0xe0
pop rbx
ret
Function at 0x18001d460
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xe0
mov rax, qword [0x180051010]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov rdi, rcx
cmp rcx, 0x1000
jb 0x18001d4bf
movabs rax, 0xffff800000000000
test rax, rcx
jne 0x18001d4bf
xor ebx, ebx
cmp byte [rcx], bl
je 0x18001d4a9
inc rbx
cmp byte [rcx + rbx], 0
jne 0x18001d4a0
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov r8d, ebx
mov rdx, rdi
jmp 0x18001d562
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov rcx, rax
lea rdx, str._pszString
mov r8d, 0xb
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r9d, 0x10
mov dword [rsp + 0x30], 0x4080
mov dword [rsp + 0x28], 0x10
lea rcx, [rsp + 0x50]
mov r8, rdi
mov dword [rsp + 0x20], 0x10
lea edx, [r9 + 0x70]
call fcn.180020010
mov ecx, 0xfffffff4
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov rcx, rax
lea rdx, [rsp + 0x50]
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov r8d, 1
lea rdx, [0x180027720]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.180001160
mov rbx, qword [rsp + 0xf8]
add rsp, 0xe0
pop rdi
ret

Function at 0x18001d5a0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x110
mov rax, qword [0x180051010]
xor rax, rsp
mov qword [rsp + 0x100], rax
xor ebp, ebp
mov dword [rsp + 0x30], 0x2000
mov esi, ecx
mov dword [rsp + 0x28], ebp
mov r8d, ecx
mov dword [rsp + 0x20], ebp
mov edi, 0xa8
lea rcx, [rsp + 0x50]
lea r9d, [rbp + 0xa]
mov edx, edi
call fcn.18001ff40
mov dword [rsp + 0x30], 0x2008
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x28], ebp
lea r9d, [rbp + 0x10]
mov r8d, esi
mov dword [rsp + 0x20], ebp
lea rbx, [rax + 2]
mov word [rsp + rax + 0x50], 0x2820
sub rdi, rbx
add rcx, rbx
mov rdx, rdi
call fcn.18001ff40
add rax, rbx
mov ecx, 0xfffffff4
mov byte [rsp + rax + 0x50], 0x29
lea ebx, [rax + 1]
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rbp
mov rcx, rax
lea rdx, [rsp + 0x50]
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.180001160
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x18001d690
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0xe0
mov rax, qword [0x180051010]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov r9d, 0x10
mov dword [rsp + 0x30], 0x2008
mov r8d, ecx
mov dword [rsp + 0x28], 0
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x20], 0
lea edx, [r9 + 0x70]
call fcn.18001ff40
mov ecx, 0xfffffff4
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov rcx, rax
lea rdx, [rsp + 0x50]
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.180001160
add rsp, 0xe0
pop rbx
ret
Function at 0x14008c268
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r12
push r13
sub rsp, 0xb0
xor ebx, ebx
mov dword [rsp + 0x20], ebx
lea rcx, [rax - 0x78]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
mov r12d, ebx
xor eax, eax
lock cmpxchg qword [0x1400a43c0], rdi
je 0x14008c2c8
cmp rax, rdi
jne 0x14008c2bb
mov r12d, 1
jmp 0x14008c2c8
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14008c2a1
mov eax, dword [0x1400a43b8]
cmp eax, 1
jne 0x14008c2dd
lea ecx, [rax + 0x1e]
call sub.msvcrt.dll__amsg_exit
jmp 0x14008c344
mov eax, dword [0x1400a43b8]
cmp eax, ebx
jne 0x14008c33a
mov dword [0x1400a43b8], 1
lea r13, [0x140001bd0]
lea rdi, [0x140001bb8]
mov qword [rsp + 0x30], rdi
mov eax, ebx
mov dword [rsp + 0x24], ebx
cmp rdi, r13
jae 0x14008c32c
cmp eax, ebx
jne 0x14008c32c
mov rcx, qword [rdi]
cmp rcx, rbx
je 0x14008c321
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x14008c30a
cmp eax, ebx
je 0x14008c344
mov eax, 0xff
jmp 0x14008c48c
mov dword [0x1400a36b4], 1
mov eax, dword [0x1400a43b8]
cmp eax, 1
jne 0x14008c36c
lea rdx, [0x140001bb0]
lea rcx, [0x140001b98]
call sub.msvcrt.dll__initterm
mov dword [0x1400a43b8], 2
cmp r12d, ebx
jne 0x14008c37b
mov rax, rbx
xchg qword [0x1400a43c0], rax
cmp qword [0x1400a43d8], rbx
je 0x14008c3a3
lea rcx, [0x1400a43d8]
call fcn.14008caac
cmp eax, ebx
je 0x14008c3a3
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x1400a43d8]
mov rcx, qword [sym.imp.msvcrt.dll__wcmdln]
cmp qword [rcx], rbx
jne 0x14008c3b9
mov eax, 0xff
jmp 0x14008c48c
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
cmp word [rcx], 0x20
ja 0x14008c43e
cmp word [rcx], bx
je 0x14008c3d4
cmp edx, ebx
jne 0x14008c43e
cmp word [rcx], bx
je 0x14008c3ea
cmp word [rcx], 0x20
ja 0x14008c3ea
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x14008c3d4
test byte [rsp + 0x7c], 1
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140030f14
mov dword [0x1400a36b0], eax
cmp dword [0x1400a3694], ebx
jne 0x14008c428
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x1400a36b4], ebx
jne 0x14008c43c
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x1400a36b0]
jmp 0x14008c48c
cmp word [rcx], 0x22
jne 0x14008c451
mov eax, ebx
cmp edx, ebx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x14008c3c5
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov r12, qword [r11 + 0x20]
mov rsp, r11
pop r13
ret
sub rsp, 0x28
call 0x140138000
add rsp, 0x28
jmp 0x14008c268
Function at 0x140008838
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp dword [0x14007a060], 2
mov edi, r8d
mov esi, edx
mov rbx, rcx
jl 0x140008898
movdqa xmm0, xmmword [0x140058a50]
movdqa xmm1, xmmword [0x140058a40]
movdqa xmmword [0x14006ede0], xmm0
movdqa xmm0, xmmword [0x140058a20]
movdqa xmmword [0x14006edf0], xmm1
movdqa xmm1, xmmword [0x140058a30]
movdqa xmmword [0x14006ee00], xmm0
movdqa xmmword [0x14006ee10], xmm1
xor edx, edx
mov r8d, 0xf0
call fcn.140043280
xor edx, edx
mov qword [rbx + 0x110], rdx
mov byte [rbx + 0x118], dl
mov rcx, qword [rbx + 0xf8]
lea rax, [0x140058a00]
mov eax, dword [rdx + rax]
mov dword [rdx + rcx], eax
add rdx, 4
cmp rdx, 0x20
jl 0x1400088b4
mov rax, qword [rbx + 0xf8]
bts edi, 0xd
shl edi, 0x10
xor dword [rax], 0x2080020
mov rax, qword [rbx + 0xf8]
xor dword [rax + 8], esi
mov rax, qword [rbx + 0xf8]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
xor dword [rax + 0xc], edi
add rsp, 0x20
pop rdi
ret

Function at 0x14000a6e4
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x14006e368]
xor rax, rsp
mov qword [rbp - 8], rax
mov dil, dl
mov rbx, rcx
lea rax, [rcx + 0x400]
xor esi, esi
mov qword [rax + 0x10], rsi
cmp qword [rax + 0x18], 8
jb 0x14000a726
mov rax, qword [rax]
mov word [rax], si
mov byte [rcx + 0x3f1], sil
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rbp - 0x28], rsi
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x18], xmm0
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], si
jne 0x14000a746
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.1400033a4
nop
mov qword [rbp - 0x48], rsi
mov qword [rbp - 0x38], rsi
mov qword [rbp - 0x30], 7
mov word [rbp - 0x48], si
mov qword [rbp - 0x50], rsi
lea r8, [rbp - 0x48]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x28]
call fcn.1400315a0
test al, al
je 0x14000a7cd
lea r8, [rbp - 0x48]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x28]
call fcn.1400315a0
test al, al
je 0x14000a7cd
lea rdx, [rbp - 0x48]
mov rcx, rbx
test dil, dil
je 0x14000a7bc
cmp qword [rbp - 0x30], 8
cmovae rdx, qword [rbp - 0x48]
call fcn.14000a9e0
jmp 0x14000a78a
cmp qword [rbp - 0x30], 8
cmovae rdx, qword [rbp - 0x48]
call fcn.14000a0e8
jmp 0x14000a78a
test dil, dil
jne 0x14000a7db
mov rcx, rbx
call fcn.14000a810
nop
lea rcx, [rbp - 0x48]
call fcn.140003250
nop
lea rcx, [rbp - 0x28]
call fcn.140003250
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140041050
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14000ded8
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x14006e368]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, rcx
lea rcx, [rbp - 0x28]
call fcn.140031d68
nop
lea rcx, [rbp - 0x28]
call fcn.140031b08
mov ecx, 1
call fcn.140049a30
cmp rbx, rax
jne 0x14000df24
cmp byte [0x14006ee35], 0
jne 0x14000df44
mov ecx, 2
call fcn.140049a30
cmp rbx, rax
jne 0x14000e051
cmp byte [0x14006ee36], 0
je 0x14000e051
mov ecx, 1
call fcn.140049a30
sub rbx, rax
neg rbx
sbb ecx, ecx
add ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
mov ecx, dword [0x14006ee30]
cmp ecx, 3
jne 0x14000df9a
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rdx, qword [rbp - 0x28]
mov r8d, dword [rbp - 0x18]
add r8d, r8d
and qword [rsp + 0x20], 0
lea r9, [rbp - 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x14000e092
and qword [rbp - 0x48], 0
movdqa xmm0, xmmword [0x140058950]
movdqu xmmword [rbp - 0x38], xmm0
mov byte [rbp - 0x48], 0
lea rdx, [rbp - 0x48]
cmp ecx, 4
lea rcx, [rbp - 0x28]
jne 0x14000dfc4
call fcn.140034ff0
jmp 0x14000dfc9
call fcn.140034e9c
test dword [0x14006ee30], 0xfffffffd
jne 0x14000dff2
lea rdx, [rbp - 0x48]
cmp qword [rbp - 0x30], 0x10
cmovae rdx, qword [rbp - 0x48]
lea rcx, [rbp - 0x48]
cmovae rcx, qword [rbp - 0x48]
call qword [sym.imp.USER32.dll_CharToOemA]
lea rdx, [rbp - 0x48]
cmp qword [rbp - 0x30], 0x10
cmovae rdx, qword [rbp - 0x48]
and qword [rsp + 0x20], 0
lea r9, [rbp - 0x50]
mov r8d, dword [rbp - 0x38]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x14000e092
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e04a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000e0b8
call fcn.140040ed4
jmp 0x14000e092
mov ecx, 2
call fcn.140049a30
xor ecx, ecx
cmp rbx, rax
setne cl
add ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rdx, qword [rbp - 0x28]
and qword [rsp + 0x20], 0
lea r9, [rbp - 0x4c]
mov r8d, dword [rbp - 0x18]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
nop
lea rcx, [rbp - 0x28]
call fcn.140003250
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140041050
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rbp
ret
call fcn.140046404
nop
int3
Function at 0x14000e504
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
lea r14, [0x14006ee40]
mov rdi, r8
mov rsi, rdx
mov ebx, ecx
test r8, r8
je 0x14000e54c
test sil, 0xf
je 0x14000e54c
movzx ecx, byte [rsi]
inc rsi
movzx eax, bl
xor rcx, rax
shr ebx, 8
xor ebx, dword [r14 + rcx*4]
sub rdi, 1
jne 0x14000e52d
cmp rdi, 0x10
jb 0x14000e66f
mov rbp, rdi
shr rbp, 4
imul rax, rbp, 0xfffffffffffffff0
add rdi, rax
xor ebx, dword [rsi]
mov r11d, dword [rsi + 0xc]
mov r9d, dword [rsi + 8]
mov eax, r11d
mov r8d, dword [rsi + 4]
mov edx, r11d
shr eax, 0x10
add rsi, 0x10
movzx ecx, al
mov eax, r11d
shr eax, 8
shr rdx, 0x18
mov r10d, dword [r14 + rdx*4]
xor r10d, dword [r14 + rcx*4 + 0x400]
movzx ecx, al
mov eax, r9d
shr rax, 0x18
xor r10d, dword [r14 + rcx*4 + 0x800]
xor r10d, dword [r14 + rax*4 + 0x1000]
mov eax, r9d
shr eax, 0x10
movzx ecx, al
mov eax, r9d
shr eax, 8
xor r10d, dword [r14 + rcx*4 + 0x1400]
movzx ecx, al
mov eax, r8d
shr rax, 0x18
xor r10d, dword [r14 + rcx*4 + 0x1800]
xor r10d, dword [r14 + rax*4 + 0x2000]
mov eax, r8d
shr eax, 0x10
movzx ecx, al
mov eax, r8d
shr eax, 8
xor r10d, dword [r14 + rcx*4 + 0x2400]
movzx ecx, al
mov eax, ebx
shr rax, 0x18
xor r10d, dword [r14 + rcx*4 + 0x2800]
xor r10d, dword [r14 + rax*4 + 0x3000]
mov eax, ebx
shr eax, 0x10
movzx ecx, al
mov eax, ebx
shr eax, 8
xor r10d, dword [r14 + rcx*4 + 0x3400]
movzx ecx, al
movzx eax, r8b
xor r10d, dword [r14 + rcx*4 + 0x3800]
xor r10d, dword [r14 + rax*4 + 0x2c00]
movzx eax, r9b
xor r10d, dword [r14 + rax*4 + 0x1c00]
movzx eax, r11b
xor r10d, dword [r14 + rax*4 + 0xc00]
movzx eax, bl
mov ebx, r10d
xor ebx, dword [r14 + rax*4 + 0x3c00]
sub rbp, 1
jne 0x14000e564
test rdi, rdi
je 0x14000e68d
movzx ecx, byte [rsi]
inc rsi
movzx eax, bl
xor rcx, rax
shr ebx, 8
xor ebx, dword [r14 + rcx*4]
sub rdi, 1
jne 0x14000e674
mov rbp, qword [rsp + 0x18]
mov eax, ebx
mov rbx, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
pop r14
ret

Function at 0x14000e6c8
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [rcx + 4], 0
mov r8, rcx
jne 0x14000e70f
xor r9d, r9d
mov r10d, r9d
mov r11d, 8
mov edx, r10d
mov ecx, r10d
shr edx, 1
mov eax, edx
mov r10d, edx
xor eax, 0xedb88320
test cl, 1
cmovne r10d, eax
sub r11, 1
jne 0x14000e6dd
mov dword [r8], r10d
inc r9d
add r8, 4
cmp r9d, 0x100
jb 0x14000e6d4
ret
Function at 0x14000e948
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x80
mov rax, qword [0x14006e368]
xor rax, rsp
mov qword [rsp + 0x78], rax
cmp dword [rcx], 2
lea rbx, [rcx + 4]
mov rsi, rdx
mov rdi, rcx
mov r14d, 0x20
jne 0x14000e9db
and qword [r11 - 0x58], 0
lea r9d, [r14 - 0x1c]
and qword [r11 - 0x60], 0
lea r8, [r11 - 0x48]
mov eax, dword [rbx]
mov edx, r14d
and qword [r11 - 0x68], 0
mov rcx, rsi
and qword [r11 - 0x70], 0
mov dword [rsp + 0x50], eax
lea rax, [r11 - 0x40]
mov qword [r11 - 0x78], rax
call fcn.14000fb08
xor r8d, r8d
lea r9, [rsp + 0x58]
xor edx, edx
movzx eax, byte [r9]
mov ecx, edx
and ecx, 3
inc edx
shl ecx, 3
inc r9
shl eax, cl
xor r8d, eax
cmp edx, r14d
jb 0x14000e9bd
mov dword [rbx], r8d
cmp dword [rdi], 3
jne 0x14000ea24
and qword [rsp + 0x40], 0
lea rax, [rsp + 0x58]
and qword [rsp + 0x38], 0
mov r9, r14
and qword [rsp + 0x30], 0
mov r8, rbx
and qword [rsp + 0x28], 0
mov rdx, r14
mov rcx, rsi
mov qword [rsp + 0x20], rax
call fcn.14000fb08
movups xmm0, xmmword [rsp + 0x58]
movups xmm1, xmmword [rsp + 0x68]
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm1
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140041050
mov rbx, qword [rsp + 0xb0]
add rsp, 0x80
pop r14
pop rdi
pop rsi
ret

Function at 0x14000ea48
Capabilities:
Encode data using xor

Disassembly:
mov r10, r8
mov r11, rdx
mov r9, rcx
test r8, r8
je 0x14000eae9
movzx edx, word [r9 + 0x9d2]
mov ecx, 0x1234
add cx, word [r9 + 0x9cc]
mov word [r9 + 0x9cc], cx
movzx r8d, cx
mov eax, r8d
shr rax, 1
movzx ecx, al
movzx eax, word [r9 + rcx*4 + 0x4b8]
xor word [r9 + 0x9ce], ax
movzx eax, word [r9 + rcx*4 + 0x4ba]
mov ecx, 1
sub word [r9 + 0x9d0], ax
ror dx, cl
xor dx, word [r9 + 0x9ce]
ror dx, cl
mov word [r9 + 0x9d2], dx
xor dx, word [r9 + 0x9d0]
xor dx, r8w
mov word [r9 + 0x9cc], dx
shr dx, 8
xor byte [r11], dl
inc r11
sub r10, 1
jne 0x14000ea5a
ret