joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400020f0
Capabilities:
Encode data using xor
Get hostname

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov edx, dword [rsp + 0x80]
lea r8d, [rcx + 0x2af]
mov eax, dword [rsp + 0x88]
mov ebp, ecx
mov ebx, edx
mov dword [rsp + 0x80], r8d
mov r12d, 0x6a4
xor ebx, 0xed2
xor ebp, r12d
lea r15d, [rdx - 0xed2]
lea esi, [rax + 0x67]
mov dword [rsp + 0x60], r15d
lea edi, [rax - 0x82b]
mov r14, r9
lea eax, [r8 - 0x51b]
lea r13d, [rdx - 0x82]
cmp esi, eax
jl 0x14000220a
mov eax, dword [r9 + 0xf0]
lea ecx, [r8 - 0xc]
mov dword [0x14003506c], eax
lea edx, [rdi + 0x9e0]
lea eax, [rbp - 0x3cb]
mov r9d, esi
mov dword [rsp + 0x28], eax
xor r9d, 0xe25
mov r8, r14
mov dword [rsp + 0x20], eax
call fcn.1400151b4
mov ebx, eax
lea edx, [r15 + 0xebc]
lea eax, [rsi - 0x9e3]
mov r9d, ebp
mov dword [rsp + 0x28], eax
lea r8d, [rbp - 0x111]
mov ecx, r15d
mov dword [rsp + 0x20], edx
mov rdx, r14
xor r9d, r12d
xor ecx, 0xbcd
call fcn.140017680
mov r9d, dword [rsp + 0x80]
lea r8d, [r13 - 0x20]
mov ecx, r13d
mov qword [rsp + 0x20], r14
xor r9d, 0x379
xor ecx, 0x743
mov edx, ebx
mov edi, eax
call fcn.1400015b8
mov r8d, dword [rsp + 0x80]
mov ebx, eax
lea ecx, [rbp + 0x4b]
cmp edi, ecx
je 0x14000230d
lea ecx, [rdi - 0x2c9]
cmp ebx, ecx
je 0x14000224a
xor esi, 0x649
mov dword [rsp + 0x20], edi
mov r9d, esi
lea r8d, [r15 + 0xa7a]
lea ecx, [r13 - 0x22]
mov rdx, r14
call fcn.140002d60
xor edi, 0x313
jmp 0x14000230d
mov eax, r15d
mov r12d, ebx
or eax, dword [r14 + 0x80]
add eax, 0xd43
cmp ebx, eax
jne 0x14000230d
mov rdx, qword [section..data]
mov ecx, dword [rdx + 0xbc]
or ecx, ebp
and ecx, esi
cmp ebx, ecx
jbe 0x1400022e9
mov r13d, r8d
mov r15d, ebx
or r13d, esi
mov eax, dword [rdx + 0x90]
mov ecx, r13d
sub ecx, dword [0x1400350e4]
sub eax, ebx
and eax, 0xd1d
sub dword [0x140035068], eax
call qword [sym.imp.KERNEL32.dll_SwitchToFiber]
mov rax, qword [section..data]
mov edx, dword [0x140035024]
add edx, edi
mov ecx, dword [rax + 0x58]
sub ecx, dword [r14 + 0x124]
xor rcx, 0xa7a
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov rdx, qword [section..data]
add r15d, 3
mov ecx, dword [rdx + 0xbc]
or ecx, ebp
and ecx, esi
cmp r15d, ecx
ja 0x140002282
mov r15d, dword [rsp + 0x60]
mov r8d, dword [rsp + 0x80]
mov eax, r15d
or eax, dword [r14 + 0x80]
add r12d, 4
add eax, 0xd43
cmp r12d, eax
je 0x140002275
mov rbx, qword [rsp + 0x68]
lea eax, [rdi - 0x95e]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400027fc
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov edi, dword [rsp + 0x70]
lea ebx, [r9 - 0xcc]
mov esi, dword [rsp + 0x68]
lea r11d, [r9 + 0x6c]
mov r10, r8
xor edx, 0xfcf
mov r8d, r9d
xor edi, 0xe88
xor r8d, 0xaa2
add esi, 0xfffffe6b
add edx, 0x1a1
cmp ebx, edx
jl 0x140002867
mov eax, dword [r10 + 0xec]
xor r8d, 0x976
sub eax, dword [r10 + 0x100]
xor eax, 0xe9bd37a7
mov dword [0x14003505c], eax
mov eax, edi
xor eax, 0xf73
cmp ebx, eax
je 0x1400029d2
mov rdx, qword [section..data]
cmp dword [rdx + 0x80], 0x12cae
jae 0x1400028a5
mov eax, dword [0x1400350e8]
mov ecx, dword [r10 + 0xb8]
add eax, 0x2babc
add ecx, eax
add dword [rdx + 0xd8], ecx
jmp 0x1400028b0
lea rax, [0x140035c20]
mov qword [r10 + 0x78], rax
xor r11d, r11d
mov rcx, qword [section..data]
mov eax, dword [r10 + 0x44]
xor eax, 0x1de5a7
sub dword [rcx + 0xec], eax
mov rdx, qword [section..data]
mov ecx, dword [0x140035084]
mov rax, qword [rdx + 0x78]
mov r9d, dword [rax + r11]
add r11, 4
mov eax, dword [rdx + 0x38]
sub eax, dword [0x1400350e4]
imul r9d, dword [rdx + 0x4c]
add eax, 0x1cc0fb
imul ecx, eax
mov eax, dword [0x140035090]
add eax, 0xffedb127
mov r8d, r9d
mov dword [0x140035084], ecx
add ecx, eax
add dword [rdx + 0x118], ecx
mov rax, qword [section..data]
movsxd rdx, dword [r10 + 0x54]
shr r8d, 0x10
mov rcx, qword [rax + 0xb0]
mov byte [rdx + rcx], r8b
mov edx, r9d
inc dword [r10 + 0x54]
mov rax, qword [section..data]
shr edx, 8
movsxd rcx, dword [rax + 0x54]
mov rax, qword [rax + 0xb0]
mov byte [rcx + rax], dl
mov rax, qword [section..data]
inc dword [rax + 0x54]
movsxd rcx, dword [0x140035064]
mov rax, qword [r10 + 0xb0]
mov byte [rcx + rax], r9b
inc dword [0x140035064]
mov edx, dword [r10 + 0x100]
mov eax, dword [r10 + 0x58]
mov ecx, dword [r10 + 0x3c]
add eax, 0xffeec358
add ecx, eax
mov eax, dword [r10 + 0x98]
add dword [r10 + 0x18], ecx
sub eax, 0x6bc78
xor dword [r10 + 0x118], eax
mov eax, dword [r10 + 0x90]
mov ecx, dword [r10 + 0x118]
add ecx, edx
imul eax, ecx
mov dword [r10 + 0x90], eax
mov eax, dword [r10 + 0xa0]
add eax, edx
or dword [r10 + 4], eax
cmp r11, 0xf10
jl 0x1400028b3
jmp 0x140002a38
mov ecx, dword [r10 + 0x130]
sub r9d, edi
and ecx, dword [0x140035028]
mov edx, r8d
mov rax, qword [section..data]
add r9d, 0xd84
mov dword [rsp + 0x28], r9d
and r11d, 0x90
or r11d, 0xe2c
mov r9d, 0x6c
mov dword [rsp + 0x20], r11d
mov dword [rax + 0xa8], ecx
mov ecx, dword [r10 + 0x118]
sub edx, dword [r10 + 0x90]
or ecx, r8d
xor ecx, esi
lea r8, [0x140035010]
add edx, ebx
call fcn.140002a50
mov rsi, qword [rsp + 0x48]
xor ebx, 0x156
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x140002d60
Capabilities:
Create pipe

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov eax, dword [rsp + 0x90]
lea r14d, [rcx - 0xe2e]
mov r10, qword [section..data]
mov r12d, r8d
xor r12d, 0xe88
mov rdi, rdx
lea ebx, [rax - 0xd43]
lea esi, [rax - 0x71]
lea eax, [rsi + 0x1ea]
cmp ebx, eax
jl 0x140002e42
mov ecx, dword [r10 + 0x14]
mov r13d, ebx
add ecx, r14d
cmp ebx, ecx
jb 0x140002e42
mov ebp, esi
movsxd r11, r14d
xor ebp, r14d
mov r15d, ebx
or r15d, 0xe2e
mov r8d, dword [rdi + 0xa0]
mov edx, dword [r10 + 0x108]
imul r8d, dword [0x140035048]
and edx, 0xe30
mov r9d, dword [rdi + 0x98]
add edx, esi
mov ecx, dword [r10 + 0x118]
add r9d, ebx
mov qword [rsp + 0x38], r11
add ecx, r12d
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x28], r15d
and r8d, 0xa7a
mov dword [rsp + 0x20], edx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov r10, qword [section..data]
add r13d, 4
movsxd r11, r14d
mov ecx, dword [r10 + 0x14]
add ecx, r14d
cmp r13d, ecx
jae 0x140002dd5
lea eax, [rbx + 0x80e]
cmp esi, eax
jle 0x140002e70
mov eax, dword [rdi + 0x100]
cmp dword [rdi + 0x50], eax
jbe 0x140002e68
mov eax, dword [r10 + 0x70]
xor eax, 0xfffda44f
mov dword [0x14003505c], eax
jmp 0x140002e70
add dword [r10 + 0x58], 0xfffd8f2c
lea r11, [rsp + 0x40]
mov rbp, qword [r11 + 0x38]
lea eax, [rbx + 0xcd2]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140002e94
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov r10, rdx
lea r11d, [r8 + 0x620]
lea edx, [r9 - 0x151]
lea eax, [rdx + 0x97c]
lea ebx, [r9 + 0x588]
lea edi, [r8 + 0x642]
cmp r11d, eax
jl 0x1400030ea
lea ecx, [r9 + 0x82b]
xor ecx, 0x32d
lea eax, [r9 + 0x892]
cmp eax, ecx
je 0x14000308a
mov rcx, qword [section..data]
cmp dword [rcx + 0x100], 0xb563
ja 0x140002f14
mov eax, 0xbf295aef
sub eax, dword [rcx + 0xd4]
sub eax, dword [rcx + 0x74]
add dword [r10 + 0x4c], eax
mov rcx, qword [section..data]
mov eax, 0x95
sub eax, dword [0x140035014]
add dword [rcx + 0x4c], eax
mov edx, dword [r10 + 0xa0]
cmp edx, dword [0x140035118]
jb 0x140002f45
mov rcx, qword [section..data]
mov eax, dword [rcx + 0xa8]
sub eax, edx
mov dword [rcx + 0x34], eax
jmp 0x140002f53
lea rax, [0x1400234a0]
mov qword [0x140035088], rax
xor ebx, ebx
mov rax, qword [r10 + 0x78]
mov rcx, qword [section..data]
mov r9d, dword [rax + rbx]
add rbx, 4
imul r9d, dword [r10 + 0x4c]
mov eax, dword [r10 + 0x108]
sub eax, 0x160e1c
xor dword [rcx + 0x18], eax
mov r8, qword [section..data]
mov eax, dword [0x140035080]
mov edx, r9d
dec eax
shr edx, 0x10
mov ecx, dword [r8 + 0x58]
add ecx, eax
mov dword [0x140035080], ecx
mov rax, qword [r8 + 0xb0]
mov r8d, r9d
movsxd rcx, dword [r10 + 0x54]
shr r8d, 8
mov byte [rcx + rax], dl
inc dword [r10 + 0x54]
mov rax, qword [section..data]
movsxd rdx, dword [r10 + 0x54]
mov rcx, qword [rax + 0xb0]
mov byte [rdx + rcx], r8b
inc dword [r10 + 0x54]
mov ecx, dword [0x1400350d0]
mov eax, dword [r10 + 0x98]
xor eax, 0x6bc79
imul ecx, eax
mov rax, qword [0x1400350c0]
mov dword [0x1400350d0], ecx
movsxd rcx, dword [0x140035064]
mov byte [rcx + rax], r9b
inc dword [0x140035064]
mov rax, qword [section..data]
mov ecx, dword [rax + 0x50]
mov eax, dword [rax + 0x3c]
add eax, 0xffeec356
add ecx, eax
mov eax, dword [r10 + 0xc0]
add dword [r10 + 0xd4], ecx
sub eax, 0x1ae27c
mov rcx, qword [section..data]
or dword [rcx + 0x34], eax
mov eax, dword [0x140035054]
sub eax, dword [r10 + 0x34]
xor eax, 0x1de5a7
sub dword [r10 + 0x100], eax
mov eax, 0x143a38
mov ecx, dword [r10 + 0x30]
xor ecx, dword [r10 + 0x50]
mov rdx, qword [section..data]
sub eax, ecx
add dword [rdx + 0x58], eax
mov rax, qword [section..data]
mov ecx, dword [rax + 0x50]
sub ecx, dword [r10 + 0x74]
xor ecx, 0xffef3c4b
sub dword [r10 + 0x44], ecx
cmp rbx, 0x70d0
jl 0x140002f55
jmp 0x1400030ea
mov ecx, 0xe50
or edx, ecx
cmp r11d, edx
jle 0x1400030ea
mov eax, dword [r10 + 0xb8]
sub eax, ecx
cmp r11d, eax
jne 0x1400030ea
mov r8, qword [section..data]
mov r9d, dword [r10 + 0xa4]
mov edx, dword [r10 + 0x134]
add r9d, ebx
or ebx, 0xe2e
or edx, 0xb3d
mov eax, dword [r8 + 0xbc]
or r9d, dword [r8 + 0x130]
or eax, edi
imul ecx, eax, 0xb3d
mov dword [rsp + 0x20], ebx
call fcn.140003ca4
mov r11d, eax
mov rbx, qword [rsp + 0x40]
xor r11d, 0xd8f
mov eax, r11d
add rsp, 0x30
pop rdi
ret
Function at 0x140003ab8
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov eax, dword [rsp + 0x88]
lea ebp, [rcx - 0x622]
mov r13d, dword [rsp + 0x80]
lea esi, [r8 - 0xd29]
add r13d, 0xfffffb0e
mov rbx, rdx
lea edi, [rax - 0x80e]
lea r9d, [rax + 0x576]
mov dword [rsp + 0x88], edi
mov eax, ebp
xor eax, 0x54d
cmp edi, eax
je 0x140003b46
mov eax, dword [rdx + 0x18]
cmp dword [rdx + 0x12c], eax
je 0x140003b3a
mov eax, dword [0x140035028]
mov ecx, dword [rdx + 0x100]
add eax, 0x7567
add ecx, eax
mov dword [rdx + 0x2c], ecx
mov rdx, qword [section..data]
jmp 0x140003bf0
mov rdx, qword [section..data]
mov r15d, ebp
or r15d, esi
mov dword [rsp + 0x80], r15d
mov r14d, dword [rdx + 0xa8]
cmp r14d, r15d
jne 0x140003bf0
and ebp, edi
imul ebp, r9d
mov r12d, edi
cmp edi, ebp
jl 0x140003be7
imul eax, r13d, 0x3a1
lea r15d, [rsi + rsi]
movsxd rdi, eax
mov ecx, dword [rdx + 0x6c]
mov r8d, dword [rdx + 0x10]
or rcx, 0xd43
mov eax, dword [0x1400350fc]
sub r8d, r15d
mov r9d, dword [rbx + 0xe4]
sub r9d, dword [rdx + 0xa0]
mov edx, dword [rdx + 0x58]
or rdx, rax
mov qword [rsp + 0x20], rcx
mov eax, dword [rbx + 0xec]
mov rcx, rdi
and rdx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rdx, qword [section..data]
add r12d, 4
cmp r12d, ebp
jge 0x140003b86
mov edi, dword [rsp + 0x88]
mov r15d, dword [rsp + 0x80]
add r14d, 3
cmp r14d, r15d
je 0x140003b71
lea eax, [r13 + 0x80e]
cmp esi, eax
jg 0x140003c7f
lea eax, [rdi + 0xd43]
cmp esi, eax
mov eax, dword [rbx + 0xb8]
jge 0x140003c59
sub eax, dword [rbx + 0x3c]
lea r8d, [rdi + 0xebc]
add eax, 0x1bd45b
lea ecx, [r13 + 0xe50]
xor dword [0x1400350c8], eax
lea rdx, [0x140035010]
mov eax, r13d
mov r9d, edi
xor eax, 0xed2
xor esi, 0xd29
mov dword [rsp + 0x28], eax
xor r9d, 0xe50
mov dword [rsp + 0x20], esi
call fcn.14001af40
jmp 0x140003c7f
sub eax, dword [rbx + 0x8c]
cmp dword [rdx + 0xc0], eax
ja 0x140003c7f
mov ecx, dword [0x1400350ac]
mov eax, esi
and rcx, rax
xor rcx, 0xd84
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
mov rbx, qword [rsp + 0x60]
lea eax, [rdi + 0xe30]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140003ca4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rbx, r8
lea r14d, [r9 + 0x1ea]
mov eax, r14d
lea edi, [r9 - 0x258]
mov ebp, edx
mov r8d, r9d
mov esi, edx
xor eax, 0x6b2
xor r8d, 0x2e2
xor esi, 0x713
xor ebp, 0xbcd
add ecx, 0xfffffbdf
cmp ecx, eax
jg 0x140003d25
lea eax, [r14 - 0xb1b]
cmp edi, eax
jle 0x140003d25
lea eax, [rcx + 0x31c]
cmp edi, eax
jl 0x140003d72
mov rax, qword [section..data]
sub edi, 0x6d9
mov dword [rax + 0x104], 0x1d74
mov r10, qword [section..data]
xor esi, 0xf7f
cmp edi, esi
jg 0x140003d52
mov eax, dword [rbx + 0x12c]
cmp dword [r10 + 0x18], eax
je 0x140003d52
imul eax, dword [rbx + 0x98], 0x6bc78
mov dword [rbx + 0x98], eax
mov rbx, qword [rsp + 0x50]
lea eax, [r8 - 0x51d]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
mov r10, qword [section..data]
mov r15d, dword [rbx + 0x100]
mov eax, dword [r10 + 0x34]
or eax, 0x913
xor eax, dword [rbx + 0x118]
cmp r15d, eax
jbe 0x140003d2c
mov r9d, dword [rbx + 0xc0]
lea rcx, [0x140035010]
mov eax, ebp
and eax, dword [rbx + 0xa4]
imul r8d, eax, 0xd43
mov eax, dword [r10 + 0x50]
lea edx, [r9 - 0x2d7]
or r9d, dword [0x140035014]
xor eax, r14d
or r9d, esi
mov dword [rsp + 0x20], eax
and edx, 0x80e
call fcn.140003a00
mov r10, qword [section..data]
add r15d, 3
mov r8d, eax
mov ecx, dword [r10 + 0x34]
or ecx, 0x913
xor ecx, dword [rbx + 0x118]
cmp r15d, ecx
ja 0x140003d94
jmp 0x140003d2c
Function at 0x140004020
Capabilities:
Connect pipe

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov ebp, dword [rsp + 0x88]
mov esi, r8d
mov r14d, dword [rsp + 0x80]
mov r10d, ebp
mov edi, edx
add r8d, 0xfffff586
xor r14d, 0x11d
xor r10d, 0x513
lea r15d, [rsi + 0x3d6]
xor ebp, 0x67e
xor esi, 0x454
xor edi, 0x333
mov eax, esi
mov rbx, r9
xor eax, 0x620
cmp r14d, eax
je 0x14000420a
mov eax, esi
xor eax, 0x7e
cmp ebp, eax
je 0x140004154
mov rcx, qword [section..data]
mov eax, dword [0x1400350a8]
cmp dword [rcx + 0x58], eax
ja 0x1400040c1
mov eax, dword [r9 + 0x100]
add eax, 0x141792
or dword [r9 + 0x70], eax
jmp 0x1400040d4
mov eax, dword [rcx + 0xa8]
sub eax, dword [r9 + 0x80]
add dword [0x140035080], eax
mov eax, dword [0x140035090]
add eax, 0x6e48c
xor dword [r9 + 0x104], eax
mov rax, qword [section..data]
mov edx, dword [r9 + 0x104]
mov ecx, dword [rax + 0x44]
lea eax, [r15 - 0x172]
xor ecx, dword [0x14003504c]
sub edx, ecx
mov dword [rsp + 0x28], eax
add edx, 0x50a1f
mov dword [rsp + 0x20], r10d
mov dword [r9 + 0x104], edx
lea ecx, [r10 - 0x261]
lea r9d, [r8 + 0xd1d]
xor ecx, 0x86c
lea edx, [r8 + 0xcde]
lea r8, [0x140035010]
call fcn.140002a50
mov edi, eax
mov dword [0x14003502c], 0x37bc8d60
jmp 0x14000420a
mov eax, dword [0x140035130]
or eax, esi
or eax, 0xb3d
cmp r8d, eax
je 0x14000420a
mov ecx, dword [r9 + 0x50]
add ecx, r15d
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
mov rcx, qword [section..data]
mov eax, dword [rbx + 0xbc]
mov edx, dword [rcx + 0xa4]
mov ecx, dword [rcx + 0x108]
sub edx, 0xd29
or rcx, rax
mov eax, esi
or rcx, rax
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov eax, dword [0x14003513c]
mov ecx, ebp
mov r8d, dword [0x14003510c]
add eax, 0xfffff2d7
mov edx, dword [0x1400350a8]
add r8d, 0xa7a
add edx, dword [0x1400350b0]
xor r8d, 0x913
imul r11d, eax, 0xe2e
mov rax, qword [section..data]
imul r15d, r14d
mov qword [rsp + 0x30], rbx
mov r10d, dword [rax + 0x34]
sub r10d, 0xd29
mov dword [rsp + 0x28], r11d
mov dword [rsp + 0x20], r10d
lea r9d, [r15 - 0xcde]
call fcn.14001794c
mov rbx, qword [rsp + 0x60]
xor edi, 0x513
mov rbp, qword [rsp + 0x68]
mov eax, edi
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x14000ca08
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov rdx, rcx
test rcx, rcx
jne 0x14000c9e5
call fcn.14000b024
mov dword [rax], 0x16
call fcn.14000af04
or eax, 0xffffffff
jmp 0x14000ca02
sub dword [rcx + 0x10], 1
jns 0x14000c9f4
add rsp, 0x28
jmp 0x14000fbd4
mov rax, qword [rcx]
movzx ecx, byte [rax]
inc rax
mov qword [rdx], rax
mov eax, ecx
add rsp, 0x28
ret
jmp 0x14000c9c4
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x14000fa74
call fcn.14000b024
mov dword [rax], 0x16
call fcn.14000af04
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x14000fa5c
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x14000fa5c
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x14000faa6
lock or dword [rax + 0x14], 0x10
jmp 0x14000fa5c
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x14000fac3
mov rcx, qword [rbp + 0x10]
call fcn.14000fbdc
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.14000be50
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.140011234
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x14000fb1a
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x14000fa5c
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x14000fb86
mov rcx, qword [rbp + 0x10]
call fcn.14000be50
cmp eax, 0xffffffff
je 0x14000fb6d
mov rcx, qword [rbp + 0x10]
call fcn.14000be50
cmp eax, 0xfffffffe
je 0x14000fb6d
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.14000be50
movsxd rdi, eax
lea rsi, [0x14003d720]
mov rcx, rbx
sar rdi, 6
call fcn.14000be50
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x14000fb74
lea rax, [0x14003ce60]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x14000fb86
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x14000fbbc
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x14000fbb8
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x14000fbb8
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x14000fa5f
jmp 0x14000fa2c
Function at 0x14001584c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov esi, edx
lea ebx, [r9 + 0x4b]
xor esi, 0x1fb
lea r14d, [r8 - 0x4f2]
mov edi, r8d
mov dword [rsp + 0x30], r14d
xor edi, 0x82c
lea r15d, [r9 - 0xcde]
mov ebp, edx
mov dword [rsp + 0x90], r15d
lea eax, [rsi + 0x105]
cmp ebx, eax
jg 0x14001599e
mov r8, qword [section..data]
lea eax, [rbx + 0x5b]
mov r9d, edi
mov dword [rsp + 0x20], eax
xor r9d, 0xc
lea edx, [r15 + 0xbcd]
lea ecx, [r14 + 0x913]
call fcn.140003ca4
mov rcx, qword [section..data]
xor r14d, 0x4f2
mov r10, qword [rsp + 0xa0]
cmp dword [rcx + 0x44], 0xc043
je 0x14001590b
mov ecx, dword [r10 + 0xc0]
sub ecx, dword [r10 + 0x58]
mov eax, dword [r10 + 0xa0]
add ecx, 0xcb7ca
imul eax, ecx
mov dword [r10 + 0xa0], eax
jmp 0x14001591a
mov eax, dword [rcx + 0x50]
add eax, dword [0x140035048]
add dword [rcx + 0xa0], eax
mov ecx, dword [r10 + 0x50]
cmp ecx, 0x987b
jb 0x14001594d
mov rcx, qword [section..data]
mov eax, dword [rcx + 0x130]
add eax, dword [r10 + 0x80]
xor eax, dword [rcx + 0xbc]
xor eax, 0xf657
mov dword [rcx + 0xbc], eax
jmp 0x140015967
mov rax, qword [section..data]
sub ecx, dword [rax + 0xb8]
xor ecx, 0x3f21c
sub dword [r10 + 0xbc], ecx
lea eax, [rdi - 0xc]
xor ebp, 0x5c1
xor edi, 0x28e
mov dword [rsp + 0x20], eax
add r14d, 0x93e
lea r8d, [r15 + 0xe50]
mov edx, edi
mov rcx, r10
lea r9d, [rbp + 0x2ba]
call fcn.1400179bc
jmp 0x140015a8f
xor esi, ebx
mov dword [rsp + 0x88], ebx
mov dword [rsp + 0x98], esi
mov r15d, ebx
cmp ebx, esi
jle 0x140015a8f
mov rax, qword [section..data]
mov r14d, dword [rsp + 0x90]
mov ecx, dword [rax + 0xe4]
imul ecx, ebx
sub ecx, edi
cmp ebx, ecx
jb 0x140015a75
mov r15, qword [rsp + 0xa0]
mov r12d, esi
and r12d, 0xb3d
mov r13d, edi
xor r13d, ebx
mov esi, ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rax, qword [section..data]
sub ebp, r13d
mov r8d, dword [0x140035084]
mov ecx, dword [r15 + 0x108]
xor r8d, 0xd43
mov dword [rsp + 0x28], r12d
sub ecx, r14d
imul r8d, dword [rax + 0xe4]
lea r9d, [rdi + rbp]
mov edx, dword [rax + 8]
and r9d, ebx
xor edx, dword [r15 + 0x44]
add edx, 0xd29
mov dword [rsp + 0x20], r8d
mov r8, r15
call fcn.1400151b4
mov rcx, qword [section..data]
add esi, 2
mov ebp, eax
mov ecx, dword [rcx + 0xe4]
imul ecx, ebx
sub ecx, edi
cmp esi, ecx
jae 0x1400159f5
mov esi, dword [rsp + 0x98]
mov r15d, dword [rsp + 0x88]
add r15d, 4
mov dword [rsp + 0x88], r15d
cmp r15d, esi
jg 0x1400159d3
mov r14d, dword [rsp + 0x30]
lea eax, [r14 - 0x93e]
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140016404
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov ecx, dword [rsp + 0x68]
lea eax, [rdx + 0x1a9]
xor eax, 0x391
lea ebx, [r9 + 0x442]
lea r10d, [r9 + 0xc3]
lea r11d, [rcx + 0x152]
cmp r11d, eax
je 0x140016531
mov eax, dword [rsp + 0x60]
add ecx, 0x172
add eax, 0xcc
cmp ecx, eax
jg 0x1400164d8
lea r8, [0x140035010]
xor r9d, r9d
mov qword [0x140035120], r8
mov r8, qword [rsp + 0x70]
mov eax, dword [r8 + 0x34]
add dword [r8 + 0x38], eax
mov rax, qword [r8 + 0xc8]
mov edx, dword [rax + r9]
mov rax, qword [section..data]
xor edx, dword [0x14003506c]
mov rcx, qword [rax + 0xc8]
mov dword [r9 + rcx], edx
add r9, 4
mov rax, qword [section..data]
mov ecx, dword [rax + 0x58]
dec ecx
xor dword [0x140035060], ecx
mov eax, dword [r8 + 0x18]
sub eax, dword [0x140035054]
add eax, 0x1de5a7
or dword [r8 + 0x34], eax
mov eax, dword [0x1400350e0]
add dword [r8 + 0x5c], eax
cmp r9, 0x51e0
jl 0x140016464
mov rax, qword [0x1400350d8]
mov qword [r8 + 0x60], rax
jmp 0x140016531
mov rdx, qword [rsp + 0x70]
imul eax, r10d, 0xb3d
sub eax, 0x28c85d
cmp dword [rdx + 0x128], eax
je 0x140016531
mov rcx, qword [section..data]
mov r8d, r10d
sub r8d, r11d
or r8d, 0xe50
mov dword [rsp + 0x20], r8d
lea r8, [0x140035010]
mov r9d, dword [rcx + 0x48]
xor r9d, dword [rdx + 0x84]
mov edx, dword [rdx + 0x74]
or r9d, r11d
sub edx, dword [rcx + 0x120]
lea ecx, [r11 + r10]
call fcn.140002330
mov eax, ebx
add rsp, 0x30
pop rbx
ret