joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c1640
Capabilities:
Encode data using xor

Disassembly:
xor r10, r10
xor r11, r11
xor r12, r12
cmp r9, 0xd
jne 0x4c16e7
mov r10, qword [rcx]
mov r11, qword [rcx + 5]
shr r11, 0x18
mov r12, 1
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
ret
cmp r9, 0x10
jb 0x4c178a
add r10, qword [rcx]
adc r11, qword [rcx + 8]
adc r12, 1
lea rcx, [rcx + 0x10]
sub r9, 0x10
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
jmp 0x4c16e7
cmp r9, 0
je 0x4c1843
xor r13, r13
xor r14, r14
xor r15, r15
add rcx, r9
shld r14, r13, 8
shl r13, 8
mov r15b, byte [rcx - 1]
xor r13, r15
dec rcx
dec r9
jne 0x4c17a0
add r10, r13
adc r11, r14
adc r12, 1
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
ret
Function at 0x1400a693e
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0xbea9bea8
stosb byte [rdi], al
adc ebp, ebp
test eax, 0xed13aabe
xor dword [rcx], edi
push rbx
jp 0x1400a6941
cmp al, 0x6b
xor dword [rcx + rax], edx
test al, 0x21
sbb byte [rsi], dl
test dword [rdi], esi
jge 0x1400a69ba
mov esp, 0xd7d832c4
cmp dword [rdx], edi
add edi, dword [rdx + 0x15d22562]
pop rdx
xchg esp, eax
sub edx, dword [rbx]
sbb byte [rdx - 2], 0x1f
lahf
adc dword [rax - 0x8ac05af], esp
test byte [rdi - 0x3bef3adf], cl
invalid
invalid
Function at 0x140001380
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x2030
call fcn.140003260
sub rsp, rax
mov rax, qword [0x140006040]
xor rax, rsp
mov qword [rsp + 0x2020], rax
mov eax, dword [rdx + 0x10]
mov rsi, qword [0x1400060b8]
cmp eax, 0xffffffff
je 0x1400014ab
mov rdi, qword [rdx + 8]
mov rbx, qword [rdx]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
lea rax, [rdi + 0xc]
cmp rax, 0x2000
ja 0x14000140e
test rdi, rdi
je 0x1400013ee
mov r8, rdi
lea rcx, [rsp + 0x2c]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
lea r8d, [rdi + 0xc]
xor r9d, r9d
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
setne al
jmp 0x1400014ad
mov r8d, 0x1ff4
lea rcx, [rsp + 0x2c]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
xor r9d, r9d
lea rdx, [rsp + 0x20]
mov r8d, 0x2000
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x1400014ab
add rbx, 0x1ff4
add rdi, 0xffffffffffffe00c
cmp rdi, 0x7fffffff
jbe 0x140001491
nop dword [rax]
nop dword [rax + rax]
xor r9d, r9d
mov r8d, 0x7fffffff
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x1400014ab
sub rdi, 0x7fffffff
add rbx, 0x7fffffff
cmp rdi, 0x7fffffff
ja 0x140001460
xor r9d, r9d
mov r8d, edi
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
setne al
jmp 0x1400014ad
xor al, al
mov rcx, qword [rsp + 0x2020]
xor rcx, rsp
call fcn.140002420
lea r11, [rsp + 0x2030]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400014e0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x2030
call fcn.140003260
sub rsp, rax
mov rax, qword [0x140006040]
xor rax, rsp
mov qword [rsp + 0x2020], rax
mov rbp, qword [0x1400060b8]
mov rsi, rdx
mov rcx, rbp
lea rdx, [rsp + 0x20]
xor r9d, r9d
mov r8d, 0x2000
call qword [sym.imp.WS2_32.dll_recv]
mov ebx, eax
test eax, eax
js 0x1400015fc
mov ecx, dword [rsp + 0x28]
mov rdx, qword [rsp + 0x20]
mov qword [rsi + 8], rdx
mov dword [rsi + 0x10], ecx
cmp ecx, 0xffffffff
je 0x1400015fc
test rdx, rdx
jne 0x140001562
mov qword [rsi], rdx
mov al, 1
jmp 0x1400015fe
mov rcx, rdx
sub ebx, 0xc
call fcn.1400026cc
movsxd rbx, ebx
lea rdx, [rsp + 0x2c]
mov r8, rbx
mov rcx, rax
mov rdi, rax
call sub.VCRUNTIME140.dll_memcpy
cmp rbx, 0x1ff4
ja 0x140001593
mov qword [rsi], rdi
mov al, 1
jmp 0x1400015fe
mov rbx, qword [rsi + 8]
add rdi, 0x1ff4
sub rbx, 0x1ff4
cmp rbx, 0x7fffffff
jbe 0x1400015e0
nop
xor r9d, r9d
mov r8d, 0x7fffffff
mov rdx, rdi
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
js 0x1400015fc
sub rbx, 0x7fffffff
add rdi, 0x7fffffff
cmp rbx, 0x7fffffff
ja 0x1400015b0
xor r9d, r9d
mov r8d, ebx
mov rdx, rdi
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_recv]
shr eax, 0x1f
xor al, 1
mov qword [rsi], rdi
jmp 0x1400015fe
xor al, al
mov rcx, qword [rsp + 0x2020]
xor rcx, rsp
call fcn.140002420
lea r11, [rsp + 0x2030]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140001630
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rbx, rcx
mov qword [rbp - 0x20], rcx
xor eax, eax
mov dword [rbp - 0x28], eax
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], send
mov byte [rcx], al
mov dword [rbp - 0x28], 1
mov word [rbp - 0x40], 0xc7
mov r8d, eax
nop dword [rax]
nop word [rax + rax]
movsxd rcx, r8d
lea rdx, [rbp - 0x40]
add rdx, rcx
lea ecx, [r8 - 0x4b]
xor byte [rdx], cl
inc r8d
cmp r8d, 1
jb 0x140001680
mov byte [rbp - 0x3f], 0
mov dword [rbp - 0x38], 0xcad2dec2
mov dword [rbp - 0x34], 0xd1d89adc
mov dword [rbp - 0x30], 0xb8da90d9
mov word [rbp - 0x2c], 0xa4
movdqa xmm2, xmmword [0x140004440]
movdqa xmm0, xmmword [str.KKKKKKKKKKKKKKKK_]
movdqa xmmword [rbp - 0x10], xmm0
mov edx, dword [rbp - 0x10]
movsxd rcx, eax
movd xmm1, eax
pshufd xmm1, xmm1, 0
paddd xmm1, xmm2
andps xmm1, xmmword [0x140004450]
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd xmm0, edx
psubb xmm1, xmm0
movd xmm0, dword [rbp + rcx - 0x38]
xorps xmm1, xmm0
movd dword [rbp + rcx - 0x38], xmm1
add eax, 4
cmp eax, 0xc
jb 0x1400016d0
cmp eax, 0xd
jae 0x140001736
nop dword [rax]
nop word [rax + rax]
movsxd rcx, eax
lea rdx, [rbp - 0x38]
add rdx, rcx
lea ecx, [rax - 0x4b]
xor byte [rdx], cl
inc eax
cmp eax, 0xd
jb 0x140001720
mov byte [rbp - 0x2b], 0
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x38]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__popen]
mov rdi, rax
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fgetc]
mov ecx, eax
cmp al, 0xff
je 0x1400017ac
nop word [rax + rax]
cmp cl, 0xa
je 0x14000179c
mov rdx, qword [rbx + 0x10]
mov r8, qword [rbx + 0x18]
cmp rdx, r8
jae 0x140001790
lea rax, [rdx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp r8, 0xf
jbe 0x140001786
mov rax, qword [rbx]
mov byte [rax + rdx], cl
mov byte [rax + rdx + 1], 0
jmp 0x14000179c
movzx r9d, cl
mov rcx, rbx
call fcn.140002150
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fgetc]
movzx ecx, al
cmp al, 0xff
jne 0x140001760
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__pclose]
mov rax, rbx
mov rbx, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
add rsp, 0x60
pop rbp
ret
Function at 0x140002e4c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002e96
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002e96
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002e96
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002e96
cmp dword [rcx + 0x84], 0xe
jbe 0x140002e96
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002e98
xor al, al
add rsp, 0x28
ret

Function at 0x140001d40
Capabilities:
Write file on windows

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x58], r9
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov ecx, 2
call fcn.140002290
lea rcx, str.Mingw_w64_runtime_failure:_n
mov edx, 0x1b
mov r8d, 1
mov r9, rax
call sub.msvcrt.dll_fwrite
mov ecx, 2
call fcn.140002290
mov r8, qword [rsp + 0x28]
mov rcx, rax
mov rdx, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
int3

Function at 0x1400023b0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rax, qword [0x140012008]
movzx edx, word [rax]
cmp edx, 0x5a4d
jne 0x14000241c
movsxd rdx, dword [rax + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x14000241c
add rax, rdx
movzx edx, word [rax + 0x18]
cmp edx, 0x20b
jne 0x14000241c
movzx edx, word [rax + 6]
test edx, edx
je 0x14000241c
sub rcx, qword [0x140012008]
movzx r8d, word [rax + 0x14]
add rax, r8
add rax, 0x18
jmp 0x140002408
add rax, 0x28
dec edx
je 0x14000241c
mov r8d, dword [rax + 0xc]
cmp rcx, r8
jb 0x140002400
add r8d, dword [rax + 8]
cmp rcx, r8
jae 0x140002400
jmp 0x14000241e
xor eax, eax
ret

Function at 0x140002420
Capabilities:
Parse pe header

Disassembly:
mov rcx, qword [0x140012008]
movzx edx, word [rcx]
xor eax, eax
cmp edx, 0x5a4d
jne 0x140002455
movsxd rdx, dword [rcx + 0x3c]
cmp dword [rcx + rdx], 0x4550
jne 0x140002455
movzx r8d, word [rcx + rdx + 0x18]
cmp r8d, 0x20b
jne 0x140002455
movzx eax, word [rcx + rdx + 6]
ret

Function at 0x1400024d0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140012008]
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x1400024fc
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x1400024fc
movzx ecx, word [rax + rcx + 0x18]
cmp ecx, 0x20b
je 0x1400024fe
xor eax, eax
ret
Function at 0x140003a30
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
mov qword [rsp + 0x58], rdx
mov rbx, r8
xor edx, edx
test rcx, rcx
je 0x140003a64
cmp word [rcx], 0x5a4d
jne 0x140003a64
movsxd rax, dword [rcx + 0x3c]
cmp eax, 0x400
jg 0x140003a64
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140003a64
mov edx, dword [rcx + 0x28]
add rdx, qword [rsp + 0x58]
mov rcx, rbx
call fcn.140003970
test eax, eax
jne 0x140003a80
xor eax, eax
add rsp, 0x40
pop rbx
ret
mov rcx, rbx
call fcn.1400039e0
test rax, rax
je 0x140003a75
lea rdx, [rax + 0x10]
lea rax, [rsp + 0x38]
mov rcx, qword [rbx]
mov r9d, 8
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x58]
mov qword [rsp + 0x38], 0
call fcn.14000422c
not eax
shr eax, 0x1f
add rsp, 0x40
pop rbx
ret

Function at 0x140004130
Capabilities:
Execute syscall

Disassembly:
pop rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov rcx, r10
call fcn.1400040d0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x140004594
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rax, qword [0x140535fb8]
xor ebx, ebx
add rax, 0x18
mov r12, rcx
mov ecx, dword [0x140535fb4]
mov rsi, rdx
mov rdi, r8
cmp ebx, ecx
jge 0x1400045e2
mov rdx, qword [rax]
cmp r12, rdx
jb 0x1400045da
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x1400046c9
inc ebx
add rax, 0x28
jmp 0x1400045ba
mov rcx, r12
call fcn.140004dc1
mov rbp, rax
test rax, rax
jne 0x140004601
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.140004530
movsxd rbx, ebx
mov rax, qword [0x140535fb8]
xor edx, edx
imul rbx, rbx, 0x28
add rax, rbx
mov dword [rax], edx
mov qword [rax + 0x20], rbp
call fcn.140004e6f
mov edx, dword [rbp + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x140535fb8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x140004663
mov rax, qword [0x140535fb8]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.140004530
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x1400046c3
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x1400046c3
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x140535fb8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1400046c3
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140004530
inc dword [0x140535fb4]
mov ecx, edi
mov rdi, r12
rep movsb byte [rdi], byte [rsi]
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x140004af0
Capabilities:
Get thread local storage value

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rdi, [0x140536020]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140536000]
test rbx, rbx
je 0x140004b3c
mov ecx, dword [rbx]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rsi, rsi
je 0x140004b36
test eax, eax
jne 0x140004b36
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
jmp 0x140004b0e
mov rcx, rdi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x140004cf0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x140004d13
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x140004d13
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x140004d14
Capabilities:
Enumerate pe sections

Disassembly:
xor r8d, r8d
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
movzx r9d, word [rcx + 6]
lea rax, [rcx + rax + 0x18]
cmp r8d, r9d
jae 0x140004d4e
mov r10d, dword [rax + 0xc]
mov rcx, r10
cmp rdx, r10
jb 0x140004d45
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x140004d50
inc r8d
add rax, 0x28
jmp 0x140004d2c
xor eax, eax
ret

Function at 0x140004dc1
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x140532130]
mov r8, rcx
mov rcx, r9
call fcn.140004cf0
test eax, eax
je 0x140004ded
mov rdx, r8
mov rcx, r9
sub rdx, r9
add rsp, 0x28
jmp fcn.140004d14
xor eax, eax
add rsp, 0x28
ret
Function at 0x140002020
Capabilities:
Copy file
Move file

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x57]
sub rsp, 0xa0
mov qword [rbp - 0x19], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x14008d598]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov esi, r9d
mov rdi, r8
mov rbx, rdx
mov r14, rcx
cmp qword [rdx + 0x18], 0x10
jb 0x140002066
mov rdx, qword [rdx]
lea rcx, [rbp + 0xf]
call fcn.140010790
nop
cmp qword [rdi + 0x18], 0x10
jb 0x14000207a
mov rdi, qword [rdi]
mov rdx, rdi
lea rcx, [rbp - 0x11]
call fcn.140010790
nop
lea rcx, [rbp + 0xf]
call fcn.140008a30
lea rdx, [rbp - 0x31]
lea rcx, [rbp + 0xf]
call fcn.14000c980
xor edi, edi
test al, al
jne 0x1400020c3
cmp qword [rbx + 0x18], 0x10
jb 0x1400020ad
mov rbx, qword [rbx]
lea rcx, str.Source_file_doesnt_exist:__s
mov rdx, rbx
call fcn.14000e970
xor bl, bl
jmp 0x14000219d
cmp byte [rbp - 0x31], dil
je 0x1400020e9
cmp qword [rbx + 0x18], 0x10
jb 0x1400020d3
mov rbx, qword [rbx]
lea rcx, str.Source_file_is_actually_a_directory:__s
mov rdx, rbx
call fcn.14000e970
xor bl, bl
jmp 0x14000219d
mov dl, 1
xor ecx, ecx
call fcn.14000e9c0
lea rcx, [rbp - 0x11]
call fcn.14000caf0
mov dl, 1
xor ecx, ecx
call fcn.14000e9c0
mov rax, qword [r14]
mov qword [rbp - 0x29], rax
mov rax, qword [rbp + 0x7f]
mov qword [rbp - 0x21], rax
mov dl, 1
xor ecx, ecx
call fcn.14000e9c0
mov dword [rbp - 0x2d], edi
lea rdx, [rbp - 0x11]
lea rcx, [rbp + 0xf]
lea r9, [rbp - 0x29]
lea r8, [0x140003230]
test esi, esi
jne 0x14000216b
cmp qword [rbp + 7], 8
cmovae rdx, qword [rbp - 0x11]
cmp qword [rbp + 0x27], 8
cmovae rcx, qword [rbp + 0xf]
mov dword [rsp + 0x20], 0xa
call qword [sym.imp.KERNEL32.dll_MoveFileWithProgressW]
mov ebx, eax
mov r8b, 1
xor edx, edx
mov ecx, 0xcb
call fcn.14000e9f0
jmp 0x140002198
cmp qword [rbp + 7], 8
cmovae rdx, qword [rbp - 0x11]
cmp qword [rbp + 0x27], 8
cmovae rcx, qword [rbp + 0xf]
mov dword [rsp + 0x28], 0x1000
lea rax, [rbp - 0x2d]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CopyFileExW]
mov ebx, eax
test ebx, ebx
setne bl
mov rdx, qword [rbp + 7]
cmp rdx, 8
jb 0x1400021d9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x11]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400021d4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002253
call fcn.140028ef4
movdqa xmm0, xmmword [0x140055c40]
movdqu xmmword [rbp - 1], xmm0
mov word [rbp - 0x11], di
mov rdx, qword [rbp + 0x27]
cmp rdx, 8
jb 0x140002226
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xf]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002221
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000224d
call fcn.140028ef4
movzx eax, bl
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.140028f90
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.140033494
nop
call fcn.140033494
nop
int3
Function at 0x140002c20
Capabilities:
Write file on windows

Disassembly:
push rdi
sub rsp, 0xd0
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0xe0], rbx
mov rax, qword [0x14008d598]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rdi, rdx
mov rbx, rcx
add rdx, 0x20
cmp qword [rdx + 0x18], 0x10
jb 0x140002c60
mov rdx, qword [rdx]
lea rcx, [rsp + 0x58]
call fcn.140010790
nop
lea rcx, [rsp + 0x58]
call fcn.14000caf0
lea rcx, [rsp + 0x58]
call fcn.14000c9f0
lea rcx, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rcx, qword [rsp + 0x58]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x40000080
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 3]

Function at 0x140004cc0
Capabilities:
Get token membership

Disassembly:
push rbx
sub rsp, 0x80
mov rax, qword [0x14008d598]
xor rax, rsp
mov qword [rsp + 0x78], rax
xor ebx, ebx
mov word [rsp + 0x74], 0x500
lea rax, [rsp + 0x68]
mov dword [rsp + 0x60], ebx
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x48], ebx
mov r9d, 0x220
mov dword [rsp + 0x40], ebx
lea r8d, [rbx + 0x20]
mov dword [rsp + 0x38], ebx
mov dl, 2
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
mov dword [rsp + 0x70], ebx
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x140004d50
mov rdx, qword [rsp + 0x68]
lea r8, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov ecx, dword [rsp + 0x60]
test eax, eax
cmove ecx, ebx
mov dword [rsp + 0x60], ecx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [rsp + 0x60], 1
sete al
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140028f90
add rsp, 0x80
pop rbx
ret
Function at 0x140004d80
Capabilities:
Create process on windows

Disassembly:
push rbx
mov eax, 0x10d0
call fcn.140028ff0
sub rsp, rax
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rax, qword [0x14008d598]
xor rax, rsp
mov qword [rsp + 0x10c0], rax
mov rbx, rcx
test rcx, rcx
je 0x140004f4b
cmp byte [rcx], 0
je 0x140004f4b
xor edx, edx
mov r8d, 0x1000
lea rcx, [rsp + 0xc0]
call fcn.140030fb0
mov r8d, 0x1000
lea rdx, [rsp + 0xc0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x140004e01
mov dl, 1
lea rcx, str.Unable_to_get_path_to_current_exe.
call fcn.14000e9c0
jmp 0x140004f57
mov rdx, rbx
lea rcx, [rsp + 0xa0]
call fcn.140010790
nop
xor edx, edx
lea r8d, [rdx + 0x70]
lea rcx, [rsp + 0x30]
call fcn.140030fb0
mov dword [rsp + 0x30], 0x70
mov dword [rsp + 0x34], 0x40
lea rax, str.runas
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xa0]
cmp qword [rsp + 0xb8], 8
cmovae rax, qword [rsp + 0xa0]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x60], 0
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x140004e93
mov dl, 1
lea rcx, str.Unable_to_run_as_admin.
call fcn.14000e9c0
xor bl, bl
jmp 0x140004f02
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x140004ebc
mov dl, 1
lea rcx, str.Waiting_for_process_failed.
call fcn.14000e9c0
xor bl, bl
jmp 0x140004f02
lea rdx, [rsp + 0x20]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x140004ee5
mov dl, 1
lea rcx, str.Failed_to_get_exit_code_from_process.
call fcn.14000e9c0
xor bl, bl
jmp 0x140004f02
mov edx, dword [rsp + 0x20]
test edx, edx
je 0x140004f00
mov r8d, edx
lea rcx, str.Invoking_self_as_admin_returned_exit_code_0x_x___d_.
call fcn.14000e970
xor bl, bl
jmp 0x140004f02
mov bl, 1
mov rdx, qword [rsp + 0xb8]
cmp rdx, 8
jb 0x140004f46
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004f41
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004f72
call fcn.140028ef4
movzx eax, bl
jmp 0x140004f59
lea rcx, str.No_parameter_passed_to_invoke_with.
call fcn.14000e970
xor al, al
mov rcx, qword [rsp + 0x10c0]
xor rcx, rsp
call fcn.140028f90
add rsp, 0x10d0
pop rbx
ret
call fcn.140033494
int3
Function at 0x14000ba90
Capabilities:
Set registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x90
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x14008d598]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rdi, r9
mov rbx, r8
xor esi, esi
mov qword [rsp + 0x30], rsi
lea r9, [rsp + 0x30]
mov r8, qword [rsp + 0xd0]
call fcn.14000c230
test al, al
jne 0x14000bae0
xor bl, bl
jmp 0x14000bbf8
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.1400109c0
nop
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.1400109c0
nop
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
mov eax, dword [rsp + 0x50]
add eax, eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rdx, [0x1400900c0]
mov ecx, eax
call fcn.14000c380
movzx ebx, al
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14000bb94
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000bb8f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000bc2c
call fcn.140028ef4
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], si
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x14000bbe5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000bbe0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000bc26
call fcn.140028ef4
movdqa xmm0, xmmword [0x140055c40]
movdqu xmmword [rsp + 0x70], xmm0
mov word [rsp + 0x60], si
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14000bc08
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, bl
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140028f90
add rsp, 0x90
pop rdi
pop rsi
pop rbx
ret
call fcn.140033494
nop
call fcn.140033494
int3