joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412630
Capabilities:
Link many functions at runtime

Disassembly:
mov rax, rsp
sub rsp, 0x68
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax - 8], r12
mov qword [rax - 0x10], r13
mov r13, rcx
mov edi, r8d
mov r12, rdx
call fcn.0040d680
xor ebx, ebx
cmp qword [0x0041dfc8], rbx
mov rsi, rax
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x34], ebx
jne 0x412761
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rbp, rax
jne 0x412693
xor eax, eax
jmp 0x412841
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x41268c
mov rcx, rax
call fcn.0040d610
lea rdx, str.GetActiveWindow
mov rcx, rbp
mov qword [0x0041dfc8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.0040d610
lea rdx, str.GetLastActivePopup
mov rcx, rbp
mov qword [0x0041dfd0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.0040d610
lea rcx, [rsp + 0x30]
mov qword [0x0041dfd8], rax
call fcn.0040f530
test eax, eax
je 0x412717
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.0040bdc0
cmp dword [rsp + 0x30], 2
jne 0x412761
lea rdx, str.GetUserObjectInformationA
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.0040d610
test rax, rax
mov qword [0x0041dfe8], rax
je 0x412761
lea rdx, str.GetProcessWindowStation
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.0040d610
mov qword [0x0041dfe0], rax
mov rcx, qword [0x0041dfe0]
cmp rcx, rsi
je 0x4127f3
cmp qword [0x0041dfe8], rsi
je 0x4127f3
call fcn.0040d6e0
call rax
test rax, rax
mov rbp, rax
je 0x4127be
mov rcx, qword [0x0041dfe8]
call fcn.0040d6e0
lea rcx, [rsp + 0x38]
mov r9d, 0xc
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
lea r8, [rsp + 0x40]
mov rcx, rbp
call rax
test eax, eax
je 0x4127be
test byte [rsp + 0x48], 1
jne 0x4127f3
lea rcx, [rsp + 0x34]
call fcn.0040f580
test eax, eax
je 0x4127e0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.0040bdc0
cmp dword [rsp + 0x34], 4
jb 0x4127ed
bts edi, 0x15
jmp 0x412827
bts edi, 0x12
jmp 0x412827
mov rcx, qword [0x0041dfd0]
cmp rcx, rsi
je 0x412827
call fcn.0040d6e0
call rax
test rax, rax
mov rbx, rax
je 0x412827
mov rcx, qword [0x0041dfd8]
cmp rcx, rsi
je 0x412827
call fcn.0040d6e0
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x0041dfc8]
call fcn.0040d6e0
mov r9d, edi
mov r8, r12
mov rdx, r13
mov rcx, rbx
call rax
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
add rsp, 0x68
ret

Function at 0x140b5e000
Capabilities:
Decompress data using aplib

Disassembly:
jmp 0x140b5e00a
jmp 0x140b6000f
jmp fcn.1407fe058
Function at 0x1400011c0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x160
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rdi, rcx
mov qword [rsp + 0x38], rcx
lea rax, [rsp + 0x40]
xor ecx, ecx
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x1a
xor esi, esi
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
test eax, eax
js 0x14000134a
mov qword [rsp + 0x178], rbx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x180], rbp
mov rbx, 0xffffffffffffffff
mov qword [rdi + 0x18], rsi
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], sil
jne 0x140001240
movabs rbp, 0x7fffffffffffffff
cmp rbx, rbp
ja 0x14000135a
cmp rbx, 0xf
ja 0x140001287
mov r8, rbx
mov qword [rdi + 0x10], rbx
lea rdx, [rsp + 0x40]
mov qword [rdi + 0x18], 0xf
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rdi], sil
jmp 0x140001316
mov rax, rbx
or rax, 0xf
cmp rax, rbp
jbe 0x1400012bc
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140001c10
test rax, rax
je 0x1400012e8
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x1400012f7
mov ecx, 0x16
mov rbp, rax
cmp rax, rcx
cmovb rbp, rcx
lea rcx, [rbp + 1]
test rcx, rcx
je 0x1400012f7
cmp rcx, 0x1000
jb 0x1400012ef
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001360
jmp 0x1400012a1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140001c10
mov rsi, rax
mov r8, rbx
mov qword [rdi], rsi
lea rdx, [rsp + 0x40]
mov qword [rdi + 0x10], rbx
mov rcx, rsi
mov qword [rdi + 0x18], rbp
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + rbx], 0
mov rbx, qword [rsp + 0x178]
mov rax, rdi
mov rbp, qword [rsp + 0x180]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140001bf0
mov rsi, qword [rsp + 0x188]
add rsp, 0x160
pop rdi
ret
mov qword [rdi + 0x18], 0xf
mov rax, rdi
mov byte [rdi], sil
jmp 0x140001329
call fcn.1400011a0
int3
call fcn.140001100
int3
Function at 0x140002570
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400025ba
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400025ba
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400025ba
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400025ba
cmp dword [rcx + 0x84], 0xe
jbe 0x1400025ba
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400025bc
xor al, al
add rsp, 0x28
ret
Function at 0x14000abc4
Capabilities:
Check mutex on windows

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov byte [rcx], 0
mov qword [rcx + 8], 0
lea r8, str.A946A6A9_917E_4949_B9BC_6BADA8C7FD63
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsi + 8], rax
test rax, rax
je 0x14000ac04
mov rcx, rax
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
sete byte [rsi]
mov rax, rsi
add rsp, 0x20
pop rsi
ret

Function at 0x14000ad56
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
cmp qword [rcx], rdx
je 0x14000adad
mov rdi, rdx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rsi
call fcn.14000adb6
lea rax, [rdi + 1]
cmp rax, 2
jb 0x14000ad9d
mov qword [rsi], rdi
call fcn.140047d00
mov r8, qword [rsp + 0x38]
mov rcx, rdi
mov rdx, rsi
mov r9, rax
call fcn.14005c6b0
mov ecx, ebx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_SetLastError]
nop
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x14000c7d0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x88
movdqa xmmword [rsp + 0x70], xmm13
movdqa xmmword [rsp + 0x60], xmm12
movdqa xmmword [rsp + 0x50], xmm11
movdqa xmmword [rsp + 0x40], xmm10
movdqa xmmword [rsp + 0x30], xmm9
movdqa xmmword [rsp + 0x20], xmm8
movdqa xmmword [rsp + 0x10], xmm7
movdqa xmmword [rsp], xmm6
movdqu xmm4, xmmword [rcx]
movdqu xmm3, xmmword [rcx + 0x10]
movdqu xmm2, xmmword [rcx + 0x20]
movdqu xmm1, xmmword [rcx + 0x30]
movd xmm0, r8d
pxor xmm0, xmm4
lea r8, [rdx - 0x40]
mov r9d, 0x40
lea r11, [rcx + r9]
cmp r8, r9
jb 0x14000c91e
add rdx, 0xffffffffffffff80
mov r9, rdx
and r9, 0xffffffffffffffc0
lea r10, [r9 + 0x80]
movabs rax, 0x154442bd4
movq xmm9, rax
movdqa xmm8, xmmword [0x140175620]
movdqa xmm6, xmm0
pclmulqdq xmm6, xmm9, 0
movdqa xmm12, xmm3
pclmulqdq xmm12, xmm9, 0
movdqa xmm11, xmm2
pclmulqdq xmm11, xmm9, 0
movdqa xmm10, xmm1
pclmulqdq xmm10, xmm9, 0
movdqa xmm4, xmm0
pclmulqdq xmm4, xmm8, 0x11
movdqa xmm5, xmm3
pclmulqdq xmm5, xmm8, 0x11
movdqa xmm7, xmm2
pclmulqdq xmm7, xmm8, 0x11
movdqa xmm13, xmm1
pclmulqdq xmm13, xmm8, 0x11
movdqu xmm0, xmmword [r11]
pxor xmm0, xmm6
pxor xmm0, xmm4
movdqu xmm3, xmmword [r11 + 0x10]
pxor xmm3, xmm12
pxor xmm3, xmm5
movdqu xmm2, xmmword [r11 + 0x20]
pxor xmm2, xmm11
pxor xmm2, xmm7
movdqu xmm1, xmmword [r11 + 0x30]
pxor xmm1, xmm10
pxor xmm1, xmm13
add r8, 0xffffffffffffffc0
add r11, 0x40
cmp r8, 0x3f
ja 0x14000c869
sub rdx, r9
add rcx, r10
mov r8, rdx
mov r11, rcx
movabs rax, 0x1751997d0
movq xmm4, rax
movdqa xmm5, xmm0
pclmulqdq xmm5, xmm4, 0
pxor xmm5, xmm3
movdqa xmm3, xmmword [0x140175630]
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm5
movdqa xmm5, xmm0
pclmulqdq xmm5, xmm4, 0
pxor xmm5, xmm2
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm5
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm2
cmp r8, 0x10
jb 0x14000c9ae
movdqu xmm1, xmmword [r11]
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm1
pxor xmm0, xmm2
add r11, 0x10
add r8, 0xfffffffffffffff0
cmp r8, 0xf
ja 0x14000c983
movdqa xmm1, xmmword [0x140175630]
pclmulqdq xmm1, xmm0, 1
psrldq xmm0, 8
pxor xmm0, xmm1
pmovzxdq xmm1, xmm0
psrldq xmm0, 4
movabs rax, 0x163cd6124
movq xmm2, rax
pclmulqdq xmm2, xmm1, 0
pxor xmm2, xmm0
pmovzxdq xmm0, xmm2
pclmulqdq xmm0, xmmword [0x140175640], 0x10
pmovzxdq xmm0, xmm0
movabs rax, 0x1db710641
movq xmm1, rax
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
pextrd eax, xmm1, 1
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
movaps xmm11, xmmword [rsp + 0x50]
movaps xmm12, xmmword [rsp + 0x60]
movaps xmm13, xmmword [rsp + 0x70]
add rsp, 0x88
ret
Function at 0x14000ebe4
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rdx
mov ebx, ecx
mov rax, qword [0x1401b6b28]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r8d, 0x20
call fcn.140159fec
mov edi, 6
cmp eax, 0x20
jne 0x14000eca8
mov ecx, dword [rsi + 8]
mov rdi, qword [sym.imp.WS2_32.dll_ntohl]
call rdi
mov dword [rsi + 8], eax
mov ecx, dword [rsi + 0xc]
call rdi
mov dword [rsi + 0xc], eax
mov ecx, dword [rsi + 0x10]
call rdi
mov dword [rsi + 0x10], eax
mov ecx, dword [rsi + 0x14]
call rdi
mov dword [rsi + 0x14], eax
mov ecx, dword [rsi + 0x18]
call rdi
mov dword [rsi + 0x18], eax
mov ecx, dword [rsi + 0x1c]
call rdi
mov dword [rsi + 0x1c], eax
lea rdx, [rsp + 0x28]
mov ecx, ebx
call fcn.140158344
mov edi, 6
test eax, eax
jne 0x14000eca8
movabs rax, 0x303146464944424d
mov edi, 8
cmp qword [rsi], rax
jne 0x14000eca8
movsxd rax, dword [rsp + 0x3c]
cmp rax, 0x20
jb 0x14000eca8
add rax, 0xffffffffffffffe0
mov ecx, dword [rsi + 0x14]
sub rax, rcx
jb 0x14000eca8
mov ecx, dword [rsi + 0x18]
sub rax, rcx
jb 0x14000eca8
mov ecx, dword [rsi + 0x1c]
cmp rax, rcx
jb 0x14000eca8
setne al
movzx edi, al
shl edi, 3
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140147fd0
mov eax, edi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
Function at 0x14000ecbf
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov r15d, r9d
mov r12, r8
mov ebx, edx
mov rdi, rcx
mov r13d, dword [rcx + 8]
mov ebp, dword [rcx + 0x18]
add ebp, dword [rcx + 0x14]
add ebp, dword [rcx + 0x1c]
mov rcx, rbp
call fcn.14005da90
test rax, rax
je 0x14000ed23
mov r14, rax
add r13, r12
mov rsi, rax
test ebp, ebp
je 0x14000ed2a
mov ecx, ebx
mov rdx, rsi
mov r8d, ebp
call fcn.140159fec
test eax, eax
js 0x14000ed45
sub ebp, eax
mov ecx, eax
add rsi, rcx
test eax, eax
jne 0x14000ecfd
test ebp, ebp
je 0x14000ecfd
jmp 0x14000ed3e
mov ebx, 1
jmp 0x14000ed52
mov eax, dword [rdi + 0x14]
imul ecx, eax, 0xaaaaaaab
ror ecx, 2
cmp ecx, 0x15555555
jbe 0x14000ed65
mov ebx, 8
jmp 0x14000ed4a
mov ebx, 6
mov rcx, r14
call fcn.14005daf0
mov eax, ebx
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
test eax, eax
je 0x14000eea5
mov dword [rsp + 0x24], r15d
mov rbp, r14
add rbp, rax
mov eax, dword [rdi + 0x18]
add rax, rbp
mov ecx, dword [rdi + 0x1c]
add rcx, rax
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], r12
mov r15, r12
mov qword [rsp + 0x40], rax
mov rdi, rax
mov qword [rsp + 0x28], rbp
mov r12, r14
mov ecx, dword [r12]
mov rax, qword [sym.imp.WS2_32.dll_ntohl]
mov rsi, rax
call rax
mov dword [r12], eax
mov ecx, dword [r12 + 4]
call rsi
mov dword [r12 + 4], eax
mov ecx, dword [r12 + 8]
call rsi
mov dword [r12 + 8], eax
mov eax, dword [r12]
mov rcx, r13
sub rcx, r15
cmp rcx, rax
jb 0x14000ed3e
mov rcx, qword [rsp + 0x40]
sub rcx, rbp
cmp rcx, rax
jb 0x14000ed3e
test eax, eax
je 0x14000ee0d
xor eax, eax
mov cl, byte [r15 + rax]
add byte [rbp + rax], cl
inc rax
mov r8d, dword [r12]
cmp rax, r8
jb 0x14000edf7
jmp 0x14000ee10
xor r8d, r8d
mov ecx, dword [rsp + 0x24]
mov rdx, rbp
call fcn.14015d628
mov ebx, 7
cmp eax, dword [r12]
jne 0x14000ed4a
mov esi, eax
mov r8d, dword [r12 + 4]
mov rax, qword [rsp + 0x38]
sub rax, rdi
cmp rax, r8
jb 0x14000ed3e
mov ecx, dword [rsp + 0x24]
mov rdx, rdi
call fcn.14015d628
cmp eax, dword [r12 + 4]
jne 0x14000ed4a
mov edx, esi
add r15, rdx
movsxd rcx, dword [r12 + 8]
mov rbx, qword [rsp + 0x30]
sub rbx, r15
cmp rbx, rcx
jg 0x14000ed3e
mov rbx, r13
sub rbx, r15
cmp rbx, rcx
jl 0x14000ed3e
add rbp, rdx
mov eax, eax
add rdi, rax
add r15, rcx
add r12, 0xc
xor ebx, ebx
cmp r12, qword [rsp + 0x28]
jb 0x14000eda1
jmp 0x14000ed4a
xor ebx, ebx
jmp 0x14000ed4a
Function at 0x14000eeac
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov r15, r8
mov rbp, rcx
mov rax, qword [0x1401b6b28]
xor rax, rsp
mov qword [rsp + 0x90], rax
lea rbx, [rsp + 0x38]
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x28], 0
xor esi, esi
mov rcx, rdx
mov edx, 0x8000
mov r8d, 0x40
xor r9d, r9d
call fcn.14015e284
cmp eax, 1
sbb esi, esi
not esi
or esi, dword [rbx]
js 0x14000ef31
lea rdx, [rsp + 0x70]
mov ecx, esi
call fcn.14000ebe4
mov r12d, 0xffffffff
xor r14d, r14d
test eax, eax
je 0x14000ef3b
mov edi, eax
mov ebx, 0xffffffff
jmp 0x14000f05a
mov edi, 6
jmp 0x14000f081
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x28], 0
mov rcx, rbp
mov edx, 0x8000
mov r8d, 0x40
xor r9d, r9d
call fcn.14015e284
mov ebx, dword [rsp + 0x38]
cmp eax, 1
mov ebp, 0
sbb ebp, ebp
not ebp
or ebp, ebx
js 0x14000f042
lea rdx, [rsp + 0x38]
mov ecx, ebp
call fcn.140158344
mov r12d, 0xffffffff
mov edi, 6
test eax, eax
jne 0x14000f057
mov r13d, dword [rsp + 0x4c]
cmp r13d, dword [rsp + 0x78]
jne 0x14000f04b
mov rcx, r13
call fcn.14005da90
test rax, rax
je 0x14000f052
mov r14, rax
mov ecx, ebp
mov rdx, rax
mov r8d, r13d
call fcn.140159fec
cmp eax, dword [rsp + 0x78]
jne 0x14000f05a
mov ebp, eax
call fcn.14007bbfb
movsxd rdx, ebp
mov rcx, r14
call fcn.14007bbd8
not eax
cmp dword [rsp + 0x7c], eax
jne 0x14000f0a7
lea r12, [rsp + 0x6c]
mov qword [rsp + 0x20], r12
mov dword [rsp + 0x28], 0
xor ebp, ebp
mov rcx, r15
mov edx, 0x8301
mov r8d, 0x40
xor r9d, r9d
call fcn.14015e284
mov r12d, dword [r12]
cmp eax, 1
sbb ebp, ebp
not ebp
or ebp, r12d
js 0x14000f0ae
lea rcx, [rsp + 0x70]
mov edx, esi
mov r8, r14
mov r9d, ebp
call fcn.14000ecbf
mov edi, eax
jmp 0x14000f05a
mov edi, 6
mov ebx, ebp
jmp 0x14000f05a
mov edi, 8
jmp 0x14000f057
mov edi, 1
xor r14d, r14d
mov rcx, r14
call fcn.14005daf0
mov ecx, esi
call fcn.1401558e8
test ebx, ebx
js 0x14000f074
mov ecx, ebx
call fcn.1401558e8
test r12d, r12d
js 0x14000f081
mov ecx, r12d
call fcn.1401558e8
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140147fd0
mov eax, edi
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov edi, 4
jmp 0x14000f05a
mov r12d, ebp
jmp 0x14000f05a
Function at 0x140013810
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor edx, edx
jmp 0x140013928
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov ebx, edx
mov rsi, rcx
mov rax, qword [0x1401b6b28]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp byte [rcx + 0x5e], 0
je 0x14001396d
movzx edi, word [rsi + 0x5c]
test bl, bl
je 0x140013a72
mov word [rsi + 0x5c], 0xffff
mov byte [rsi + 0x5e], 0
jmp 0x140013a72
mov eax, dword [rsi + 0x58]
test eax, eax
mov edi, 1
cmovg edi, eax
xor ebp, ebp
mov rcx, qword [rsi + 0x40]
call fcn.140160acc
cmp eax, 0xffffffff
je 0x140013a6e
mov byte [rsp + rbp + 0x58], al
inc rbp
cmp rbp, rdi
jb 0x14001397c
cmp byte [rsi + 0x5f], 0
je 0x1400139c0
movsx eax, byte [rsp + 0x58]
mov word [rsp + 0x56], ax
test bl, bl
je 0x140013a32
movzx edi, word [rsp + 0x56]
mov word [rsi + 0x5c], di
jmp 0x140013a72
lea r13, [rsp + 0x56]
lea r12, [rsp + 0x48]
lea r14, [rsp + 0x58]
mov rcx, qword [rsi + 0x48]
mov rdx, qword [rsi + 0x50]
mov r15, qword [rdx]
lea r9, [rsp + rdi]
add r9, 0x58
mov rax, qword [rcx]
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r12
mov r8, r14
call qword [rax + 0x18]
cmp eax, 1
jne 0x140013a5b
mov rax, qword [rsi + 0x50]
mov qword [rax], r15
cmp rdi, 8
je 0x140013a6e
mov rcx, qword [rsi + 0x40]
call fcn.140160acc
cmp eax, 0xffffffff
je 0x140013a6e
mov byte [rsp + rdi + 0x58], al
inc rdi
jmp 0x1400139cf
mov edi, edi
test rdi, rdi
jle 0x140013a54
mov rdx, qword [rsi + 0x40]
movsx eax, byte [rsp + rdi + 0x57]
dec rdi
movzx ecx, ax
call fcn.1401629d8
cmp eax, 0xffffffff
jne 0x140013a34
jmp 0x140013a6e
movzx edi, word [rsp + 0x56]
jmp 0x140013a72
cmp eax, 2
je 0x140013a6e
cmp eax, 3
je 0x1400139a0
jmp 0x1400139aa
mov di, 0xffff
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140147fd0
mov eax, edi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140013ae0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov rsi, rcx
mov rax, qword [0x1401b6b28]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea r14, [rsp + 0x38]
lea r12, [rsp + 0x28]
lea r15, [rsp + 0x30]
mov ebp, 0xffffffff
mov rcx, qword [rsi + 0x48]
mov rdx, qword [rsi + 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x20], r12
mov r8, r15
mov r9, r14
call qword [rax + 0x20]
mov edi, eax
mov rbx, qword [rsp + 0x28]
sub rbx, r15
mov r9, qword [rsi + 0x40]
mov edx, 1
mov rcx, r15
mov r8, rbx
call fcn.1401606f0
cmp rax, rbx
jne 0x140013b67
cmp edi, 1
je 0x140013b14
cmp edi, 2
je 0x140013b67
mov rcx, qword [rsi + 0x40]
call fcn.14015f938
neg eax
sbb ebp, ebp
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140147fd0
mov eax, ebp
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x140013b90
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r8
mov r14, rdx
mov rdi, rcx
cmp byte [rcx + 0x58], 0
je 0x140013bc5
mov r9, qword [rdi + 0x40]
mov edx, 1
mov rcx, r14
mov r8, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.1401606f0
xor ebx, ebx
test rsi, rsi
jle 0x140013bea
movzx edx, byte [r14 + rbx]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x60]
cmp eax, 0xffffffff
je 0x140013bea
inc rbx
cmp rsi, rbx
jne 0x140013bcc
mov rbx, rsi
mov rax, rbx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x140013c00
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov r15d, edx
mov rax, qword [0x1401b6b28]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp edx, 0xffffffff
je 0x140013c5d
mov rdi, rcx
mov byte [rsp + 0x57], r15b
cmp byte [rcx + 0x58], 0
je 0x140013c6c
mov r9, qword [rdi + 0x40]
lea rcx, [rsp + 0x57]
mov edx, 1
mov r8d, 1
call fcn.1401606f0
mov esi, 0xffffffff
cmp rax, 1
jne 0x140013d1c
xor esi, esi
cmp r15d, 0xffffffff
cmovne esi, r15d
jmp 0x140013d1c
lea rbx, [rsp + 0x58]
lea r12, [rsp + 0x48]
mov qword [r12], rbx
lea rsi, [rsp + 0x57]
lea r13, [rsp + 0x60]
lea r14, [rsp + 0x40]
mov rcx, qword [rdi + 0x48]
mov rdx, qword [rdi + 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r14
mov r8, rsi
lea r9, [rsp + 0x58]
call qword [rax + 0x10]
cmp qword [rsp + 0x40], rsi
je 0x140013d17
mov ebp, eax
cmp eax, 3
je 0x140013cf6
cmp ebp, 1
ja 0x140013d17
mov rsi, qword [rsp + 0x48]
sub rsi, rbx
mov r9, qword [rdi + 0x40]
mov edx, 1
mov rcx, rbx
mov r8, rsi
call fcn.1401606f0
cmp rax, rsi
jne 0x140013d17
mov rsi, qword [rsp + 0x40]
cmp ebp, 1
je 0x140013c89
jmp 0x140013c5d
mov r9, qword [rdi + 0x40]
mov edx, 1
mov r8d, 1
mov rcx, rsi
call fcn.1401606f0
cmp rax, 1
je 0x140013c5d
mov esi, 0xffffffff
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140147fd0
mov eax, esi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140013d80
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r8
mov r14, rdx
mov rdi, rcx
cmp byte [rcx + 0x58], 0
je 0x140013db5
mov r9, qword [rdi + 0x40]
mov edx, 2
mov rcx, r14
mov r8, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.1401606f0
xor ebx, ebx
test rsi, rsi
jle 0x140013ddb
movzx edx, word [r14 + rbx*2]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x60]
cmp ax, 0xffff
je 0x140013ddb
inc rbx
cmp rsi, rbx
jne 0x140013dbc
mov rbx, rsi
mov rax, rbx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140013df0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov esi, edx
mov rax, qword [0x1401b6b28]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp dx, 0xffff
je 0x140013e4c
mov rdi, rcx
mov word [rsp + 0x56], si
cmp byte [rcx + 0x58], 0
je 0x140013e5c
mov r9, qword [rdi + 0x40]
lea rcx, [rsp + 0x56]
mov edx, 2
mov r8d, 1
call fcn.1401606f0
mov di, 0xffff
cmp rax, 1
jne 0x140013f0b
xor eax, eax
cmp si, 0xffff
cmove esi, eax
mov edi, esi
jmp 0x140013f0b
lea r15, [rsp + 0x58]
lea r12, [rsp + 0x48]
mov qword [r12], r15
lea rbx, [rsp + 0x56]
lea r13, [rsp + 0x60]
lea r14, [rsp + 0x40]
mov rcx, qword [rdi + 0x48]
mov rdx, qword [rdi + 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r14
mov r8, rbx
lea r9, [rsp + 0x58]
call qword [rax + 0x10]
cmp qword [rsp + 0x40], rbx
je 0x140013f07
mov ebp, eax
cmp eax, 3
je 0x140013ee6
cmp ebp, 1
ja 0x140013f07
mov rbx, qword [rsp + 0x48]
sub rbx, r15
mov r9, qword [rdi + 0x40]
mov edx, 1
mov rcx, r15
mov r8, rbx
call fcn.1401606f0
cmp rax, rbx
jne 0x140013f07
mov rbx, qword [rsp + 0x40]
cmp ebp, 1
je 0x140013e79
jmp 0x140013e4c
mov r9, qword [rdi + 0x40]
mov edx, 1
mov r8d, 1
mov rcx, rbx
call fcn.1401606f0
cmp rax, 1
je 0x140013e4c
mov di, 0xffff
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140147fd0
mov eax, edi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140014020
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp rdx, r8
je 0x140014057
movabs r9, 0xf000000000000000
shl rax, 4
movsx r10, byte [rdx]
add r10, rax
mov rcx, r10
and rcx, r9
mov rax, rcx
shr rax, 0x38
or rax, rcx
xor rax, r10
inc rdx
cmp r8, rdx
jne 0x140014031
ret

Function at 0x140014170
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp rdx, r8
je 0x1400141a8
movabs r9, 0xf000000000000000
shl rax, 4
movzx r10d, word [rdx]
add r10, rax
mov rcx, r10
and rcx, r9
mov rax, rcx
shr rax, 0x38
or rax, rcx
xor rax, r10
add rdx, 2
cmp r8, rdx
jne 0x140014181
ret
Function at 0x14003c240
Capabilities:
Get session information

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rcx
mov rax, qword [0x1401b6b28]
xor rax, rsp
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
cmp eax, 0xffffffff
je 0x14003c30e
lea r9, [rsp + 0x50]
mov qword [r9], 0
lea rcx, [rsp + 0x4c]
mov dword [rcx], 0
mov qword [rsp + 0x20], rcx
xor ecx, ecx
mov edx, eax
mov r8d, 0x18
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x14003c30e
mov rbx, qword [rsp + 0x50]
mov ecx, 0x30
call fcn.140147c20
mov rdi, rax
lea rdx, [0x14003d330]
lea r8, [0x14000a850]
mov rcx, rax
call fcn.14003ff50
lea rax, [0x140173c80]
mov qword [rdi + 0x20], rax
mov qword [rdi + 0x28], rbx
lea rbx, [rsp + 0x30]
mov qword [rbx], rdi
lea rdi, [rsp + 0x38]
mov rcx, rdi
mov rdx, rbx
call fcn.14003ffa0
mov rcx, rbx
call fcn.14003ffe0
lea rcx, [rsp + 0x40]
mov rdx, rdi
call fcn.140088ec0
cmp dword [rsp + 0x4c], 0xd7
ja 0x14003c317
mov qword [rsi], 0
jmp 0x14003c32b
mov qword [rsi], 0
jmp 0x14003c335
mov rax, qword [rsp + 0x50]
mov rdx, qword [rax + 0xc8]
mov rcx, rsi
call fcn.140089190
lea rcx, [rsp + 0x40]
call fcn.140088ef0
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140147fd0
mov rax, rsi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret