joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140043cb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x140129b78]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov r8, rcx
mov ebx, edx
movzx ecx, byte [rcx]
test cl, cl
je 0x140043cf6
lea rax, [r8 + 1]
cmp cl, 0x25
jne 0x140043ce6
cmp byte [rax], cl
jne 0x140043cf6
cmp cl, cl
cmovne rax, r8
movzx ecx, byte [rax + 1]
lea r8, [rax + 1]
test cl, cl
jne 0x140043cd7
movzx edx, byte [r8]
cmp dl, 0x25
jne 0x140043e5a
cmp byte [r8 + 1], dl
je 0x140043e5a
lea r11, [rsp + 0x20]
mov r9, r8
lea eax, [rdx - 0x41]
movsx r10d, dl
cmp al, 0x19
ja 0x140043d32
lea ecx, [r10 - 0x41]
mov eax, 1
shl eax, cl
test eax, 0x900
je 0x140043d5a
sub dl, 0x61
cmp dl, 0x19
ja 0x140043d4c
lea ecx, [r10 - 0x61]
mov eax, 1
shl eax, cl
test eax, 0x2480a80
je 0x140043d5a
movzx edx, byte [r9 + 1]
inc r9
test dl, dl
jne 0x140043d15
jmp 0x140043d5d
inc r9
cmp r8, r9
jae 0x140043d8f
movabs rdx, 0x800000000000009
nop dword [rax]
movzx ecx, byte [r8]
inc r8
lea eax, [rcx - 0x24]
cmp al, 0x3b
ja 0x140043d84
bt rdx, rax
jb 0x140043d8a
mov byte [r11], cl
inc r11
cmp r8, r9
jb 0x140043d70
xorps xmm3, xmm3
mov byte [r11], 0
cvtss2sd xmm3, xmm2
lea r8, [rsp + 0x20]
mov edx, 0x40
lea rcx, [rsp + 0x40]
movq r9, xmm3
call fcn.14001cd80
cmp byte [rsp + 0x40], 0x20
lea rcx, [rsp + 0x40]
jne 0x140043dc8
nop
inc rcx
cmp byte [rcx], 0x20
je 0x140043dc0
lea eax, [rbx - 8]
cmp eax, 1
jbe 0x140043e48
movzx r9d, byte [rcx]
movzx r8d, r9b
cmp r9b, 0x2d
jne 0x140043de3
movzx r8d, byte [rcx + 1]
lea rdx, [rcx + 1]
movzx eax, r8b
cmovne rdx, rcx
cmp r8b, 0x2b
jne 0x140043df9
movzx eax, byte [rdx + 1]
lea rcx, [rdx + 1]
xorps xmm1, xmm1
cmovne rcx, rdx
cmp al, 0x30
jl 0x140043e36
movss xmm2, dword [0x1400cff5c]
cmp al, 0x39
ja 0x140043e36
movzx eax, al
inc rcx
sub eax, 0x30
mulss xmm1, xmm2
movd xmm0, eax
movzx eax, byte [rcx]
cvtdq2ps xmm0, xmm0
addss xmm0, xmm1
movaps xmm1, xmm0
cmp al, 0x30
jge 0x140043e10
cmp r9b, 0x2d
jne 0x140043e55
xorps xmm1, xmmword [0x1400cffd0]
movaps xmm0, xmm1
jmp 0x140043e5d
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
movaps xmm0, xmm1
jmp 0x140043e5d
movaps xmm0, xmm2
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400c90c0
add rsp, 0x90
pop rbx
ret
Function at 0x140043e80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x140129b78]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov r8, rcx
mov ebx, edx
movzx ecx, byte [rcx]
test cl, cl
je 0x140043ec6
lea rax, [r8 + 1]
cmp cl, 0x25
jne 0x140043eb6
cmp byte [rax], cl
jne 0x140043ec6
cmp cl, cl
cmovne rax, r8
movzx ecx, byte [rax + 1]
lea r8, [rax + 1]
test cl, cl
jne 0x140043ea7
movzx edx, byte [r8]
cmp dl, 0x25
jne 0x140044024
cmp byte [r8 + 1], dl
je 0x140044024
lea r11, [rsp + 0x20]
mov r9, r8
lea eax, [rdx - 0x41]
movsx r10d, dl
cmp al, 0x19
ja 0x140043f02
lea ecx, [r10 - 0x41]
mov eax, 1
shl eax, cl
test eax, 0x900
je 0x140043f2a
sub dl, 0x61
cmp dl, 0x19
ja 0x140043f1c
lea ecx, [r10 - 0x61]
mov eax, 1
shl eax, cl
test eax, 0x2480a80
je 0x140043f2a
movzx edx, byte [r9 + 1]
inc r9
test dl, dl
jne 0x140043ee5
jmp 0x140043f2d
inc r9
cmp r8, r9
jae 0x140043f5f
movabs rdx, 0x800000000000009
nop dword [rax]
movzx ecx, byte [r8]
inc r8
lea eax, [rcx - 0x24]
cmp al, 0x3b
ja 0x140043f54
bt rdx, rax
jb 0x140043f5a
mov byte [r11], cl
inc r11
cmp r8, r9
jb 0x140043f40
movaps xmm3, xmm2
mov byte [r11], 0
movq r9, xmm2
lea r8, [rsp + 0x20]
mov edx, 0x40
lea rcx, [rsp + 0x40]
call fcn.14001cd80
cmp byte [rsp + 0x40], 0x20
lea rcx, [rsp + 0x40]
jne 0x140043f98
nop dword [rax + rax]
inc rcx
cmp byte [rcx], 0x20
je 0x140043f90
lea eax, [rbx - 8]
cmp eax, 1
jbe 0x140044016
movzx r9d, byte [rcx]
movzx r8d, r9b
cmp r9b, 0x2d
jne 0x140043fb3
movzx r8d, byte [rcx + 1]
lea rdx, [rcx + 1]
movzx eax, r8b
cmovne rdx, rcx
cmp r8b, 0x2b
jne 0x140043fc9
movzx eax, byte [rdx + 1]
lea rcx, [rdx + 1]
xorps xmm1, xmm1
cmovne rcx, rdx
cmp al, 0x30
jl 0x140044004
movsd xmm2, qword [0x1400cef80]
cmp al, 0x39
ja 0x140044004
movzx eax, al
inc rcx
sub eax, 0x30
mulsd xmm1, xmm2
movd xmm0, eax
movzx eax, byte [rcx]
cvtdq2pd xmm0, xmm0
addsd xmm1, xmm0
cmp al, 0x30
jge 0x140043fe0
cmp r9b, 0x2d
jne 0x14004401f
xorps xmm1, xmmword [0x1400cefc0]
movaps xmm0, xmm1
jmp 0x140044027
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
movaps xmm1, xmm0
movaps xmm0, xmm1
jmp 0x140044027
movaps xmm0, xmm2
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400c90c0
add rsp, 0x90
pop rbx
ret
Function at 0x140056cb0
Capabilities:
Log keystrokes

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x140129b78]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov eax, edx
movzx ebx, cl
mov ecx, eax
xor edx, edx
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
xor ecx, ecx
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov word [rsp + 0x2a], ax
test bl, bl
mov eax, 8
mov qword [rsp + 0x40], rcx
mov edx, 0xa
mov dword [rsp + 0x20], 1
cmovne eax, edx
lea r8d, [rcx + 0x28]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x2c], eax
lea ecx, [r8 - 0x27]
movups xmmword [rsp + 0x30], xmm0
call qword [sym.imp.USER32.dll_SendInput]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400c90c0
add rsp, 0x50
pop rbx
ret
Function at 0x140063400
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x140129b78]
xor rax, rsp
mov qword [rsp + 0x48], rax
movss dword [rsp + 0x38], xmm1
mov ebx, ecx
call fcn.1400667f0
call fcn.1400667f0
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r9d, 4
mov qword [rsp + 0x20], 0
mov rcx, rax
lea r8, [rsp + 0x30]
mov edx, 0xe0c3868
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov ecx, dword [rsp + 0x30]
lea rax, [rsp + 0x40]
add ecx, ebx
mov qword [rsp + 0x20], rax
mov r9d, 0x40
mov ebx, ecx
mov edx, ecx
mov rcx, qword [0x14015fdd0]
lea r8d, [r9 - 0x3c]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rcx, qword [0x14015fdd0]
lea r8, [rsp + 0x38]
mov r9d, 4
mov qword [rsp + 0x20], 0
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x14015fdd0]
lea rax, [rsp + 0x40]
mov r9d, 2
mov qword [rsp + 0x20], rax
mov edx, ebx
lea r8d, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400c90c0
add rsp, 0x50
pop rbx
ret

Function at 0x140063580
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140129b78]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140063653
cmp byte [rcx + 0x71], 0
je 0x140063653
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + Ordinal_26]
cmp eax, 0xffffffff
je 0x14006364f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140063614
sub eax, 1
je 0x140063618
cmp eax, 2
jne 0x14006364f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400c90c0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140063646
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14006364f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1400635fc
xor al, al
jmp 0x1400635fc
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400c90c0
add rsp, 0x60
pop rbx
ret
Function at 0x140063910
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140129b78]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
mov rcx, qword [rcx + 0x10]
movabs rax, 0x7fffffffffffffff
sub rax, rcx
cmp rax, 3
jb 0x140063a77
mov rax, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x14006395e
mov rax, qword [rbx]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 3
lea r9, [0x1400f9600]
mov r8, rbx
movzx edx, byte [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.140058650
lea r9, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae r9, qword [rsp + 0x50]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
lea r8, str.cmd.exe
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x1400639fa
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400639f5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400639f5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c911c
movdqa xmm0, xmmword [0x1400fcb70]
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], 0
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x140063a43
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x140063a3e
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140063a70
mov rcx, r8
call fcn.1400c911c
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400c90c0
mov rbx, qword [rsp + 0x98]
add rsp, 0x80
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.140063730
nop
int3
Function at 0x140064c80
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x140129b78]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov esi, edx
mov rdi, rcx
cmp edx, 0xffffffff
jne 0x140064cad
xor eax, eax
jmp 0x140064e16
mov qword [rsp + 0xa0], rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
test rax, rax
je 0x140064ced
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::epptr_void_const___ptr64]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
cmp rax, rbx
jae 0x140064ced
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], sil
mov eax, esi
jmp 0x140064e0e
cmp qword [rdi + 0x80], 0
je 0x140064e09
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::eback_void_const___ptr64]
lea rcx, [rdi + 0x70]
cmp rax, rcx
jne 0x140064d27
mov rdx, qword [rdi + 0x88]
mov rcx, rdi
mov r9, qword [rdi + 0x90]
mov r8, rdx
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::setg_char____ptr64__char____ptr64__char____ptr64____ptr64]
mov rcx, qword [rdi + 0x68]
test rcx, rcx
jne 0x140064d52
mov rdx, qword [rdi + 0x80]
movsx ecx, sil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, esi
mov eax, ecx
jmp 0x140064e0e
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], sil
mov qword [rsp + 0x38], rax
lea rdx, [rdi + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140064dc1
sub eax, 1
je 0x140064dc1
cmp eax, 2
jne 0x140064e09
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rdi + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, esi
mov eax, ecx
jmp 0x140064e0e
mov rbx, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rbx, rax
je 0x140064def
mov r9, qword [rdi + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rbx
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbx, rax
jne 0x140064e09
lea rax, [rsp + 0x50]
mov byte [rdi + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, esi
mov eax, ecx
jmp 0x140064e0e
mov eax, 0xffffffff
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400c90c0
mov rsi, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x1400653a0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xb0
mov rax, qword [0x140129b78]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rdi, rcx
mov qword [rsp + 0x90], rcx
lea r8, [0x1400f95ac]
xor edx, edx
call fcn.140064a20
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
mov dword [rsp + 0x20], reloc.WS2_32.dll_WSASetLastError
mov dword [rsp + 0x24], 0x40
xor ecx, ecx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rcx
lea rax, str.cmd.exe
mov qword [rsp + 0x38], rax
mov rax, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x140065436
mov rax, qword [rdi]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rcx
mov dword [rsp + 0x50], ecx
mov qword [rsp + 0x58], rcx
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x140065467
mov rcx, rdi
call fcn.140058df0
mov eax, 0xffffffff
jmp 0x1400654af
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rsp + 0x98]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [rsp + 0x98]
mov rcx, rdi
call fcn.140058df0
mov eax, ebx
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1400c90c0
mov rbx, qword [rsp + 0xc8]
add rsp, 0xb0
pop rdi
ret
Function at 0x140065950
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rsi, r8
mov rbp, rdx
mov r14, rcx
test r8, r8
jg 0x140065972
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x140065988
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov qword [rsp + 0x28], rbx
mov rbx, rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const___ptr64]
test rax, rax
je 0x1400659d2
cmp rax, rsi
mov rdi, rsi
mov rcx, r14
cmovb rdi, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
mov r8, rdi
mov rcx, rbp
mov rdx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edx, edi
mov rcx, r14
add rbp, rdi
sub rbx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
cmp qword [r14 + 0x80], 0
mov rdi, rbx
je 0x140065a41
mov rcx, r14
call fcn.140063690
cmp rbx, 0xfff
jbe 0x140065a21
mov r9, qword [r14 + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
add rbp, rax
mov rdi, rbx
cmp rax, 0xfff
jne 0x140065a5a
cmp rbx, rax
ja 0x1400659f0
test rdi, rdi
je 0x140065a41
mov r9, qword [r14 + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rdi, rax
sub rsi, rdi
mov rbx, qword [rsp + 0x28]
mov rax, rsi
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
sub rsi, rbx
jmp 0x140065a44
Function at 0x140065a60
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x140065a88
add rsp, 0x20
pop r14
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov rbp, rax
test rbx, rbx
jle 0x140065afc
test rax, rax
jle 0x140065adc
cmp rbx, rax
mov rcx, rdi
cmovl rbp, rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, rbp
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edx, ebp
mov rcx, rdi
add r14, rbp
sub rbx, rbp
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
test rbx, rbx
jle 0x140065afc
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140065afc
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x40]
sub rsi, rbx
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rbx
ret
Function at 0x140066730
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x160
mov rax, qword [0x140129b78]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor edi, edi
xor edx, edx
mov ebx, edi
lea ecx, [rdi + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov rsi, rax
call sub.KERNEL32.dll_Process32First
lea rdx, [rsp + 0x20]
mov rcx, rsi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x1400667c4
nop dword [rax + rax]
lea rdx, str.AndroidEmulatorEx.exe
lea rcx, [rsp + 0x4c]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
jne 0x1400667b3
mov eax, dword [rsp + 0x3c]
cmp eax, ebx
jle 0x1400667b3
mov edi, dword [rsp + 0x28]
mov ebx, eax
lea rdx, [rsp + 0x20]
mov rcx, rsi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x140066790
mov eax, edi
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1400c90c0
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x1400667f0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x1b0
mov rax, qword [0x140129b78]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
xor ebp, ebp
mov dword [rsp + 0x20], 0x130
xor edx, edx
mov esi, ebp
lea ecx, [rbp + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea rdx, [rsp + 0x20]
mov rcx, rax
mov rdi, rax
call sub.KERNEL32.dll_Process32First
cmp eax, 1
jne 0x1400668d6
lea rdx, [rsp + 0x20]
mov rcx, rdi
call sub.KERNEL32.dll_Process32Next
cmp eax, 1
jne 0x1400668d6
nop word [rax + rax]
lea rdx, [0x1400fcc50]
lea rcx, [rsp + 0x4c]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
jne 0x1400668c4
mov r8d, dword [rsp + 0x28]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x1400668c4
mov r8d, 0x48
lea rdx, [rsp + 0x150]
mov rcx, rax
call sub.KERNEL32.dll_K32GetProcessMemoryInfo
test eax, eax
je 0x1400668bb
cmp qword [rsp + 0x160], 0x11e1a300
ja 0x1400669a9
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call sub.KERNEL32.dll_Process32Next
cmp eax, 1
je 0x140066860
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov dword [rsp + 0x20], 0x130
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea rdx, [rsp + 0x20]
mov rcx, rax
mov rdi, rax
call sub.KERNEL32.dll_Process32First
cmp eax, 1
jne 0x140066992
lea rdx, [rsp + 0x20]
mov rcx, rdi
call sub.KERNEL32.dll_Process32Next
cmp eax, 1
jne 0x140066992
nop dword [rax]
lea rdx, str.AndroidProcess.exe
lea rcx, [rsp + 0x4c]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
jne 0x140066980
mov r8d, dword [rsp + 0x28]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140066980
mov r8d, 0x48
lea rdx, [rsp + 0x150]
mov rcx, rax
call sub.KERNEL32.dll_K32GetProcessMemoryInfo
test eax, eax
je 0x140066977
cmp qword [rsp + 0x160], 0x11e1a300
ja 0x1400669b2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call sub.KERNEL32.dll_Process32Next
cmp eax, 1
je 0x140066920
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x1400669bd
cmp esi, 1
cmovne ebp, esi
mov eax, ebp
jmp 0x1400669bf
mov esi, dword [rsp + 0x28]
jmp 0x1400668df
mov eax, dword [rsp + 0x28]
cmp eax, 1
jbe 0x14006699b
jmp 0x1400669bf
xor eax, eax
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.1400c90c0
lea r11, [rsp + 0x1b0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140067000
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 7], dil
je 0x140067034
mov ecx, edi
nop dword [rax]
lea eax, [rcx + 0x7d]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 6
jb 0x140067020
mov byte [r8 + 7], dil
lea rax, [r8 + 6]
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x140067061
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x140067080
mov qword [rsp + 0x30], 6
mov eax, dword [r8]
mov dword [rsp + 0x20], eax
movzx eax, word [r8 + 4]
mov word [rsp + 0x24], ax
mov byte [rsp + 0x26], dil
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x14006708e
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.140074160
mov qword [rbx], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140067105
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140067100
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140067100
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c911c
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret