joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005f950
Capabilities:
Terminate process

Disassembly:
push rbp
sub rsp, 0x150
lea rbp, [rsp + 0x40]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x14014e080]
xor rax, rsp
mov qword [rbp + 0x100], rax
lea rcx, [rbp + 0xa0]
call fcn.14005d4f0
nop
lea rcx, [0x140152160]
call fcn.14008d990
test al, al
je 0x14005fb7f
movabs rax, 0x92dc9a2b18edc52e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs rax, 0x2f76569c2a6c285a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0xfbbb45a7f0380c7e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
movabs rax, 0x16656b042ab3d16c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
movabs rax, 0x556e893960cc981a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
movabs rax, 0x6ba17d1042c2e8ab
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
movabs rax, 0x6df54436f11288fc
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
movabs rax, 0x6ccc6e1a66492a7d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
movabs rax, 0xeba8f3596d8ea07d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
movabs rax, 0x5b0576ec47095c7a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc8], rax
movabs rax, 0x88d82cd38351781f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xd0], rax
movabs rax, 0x7504076600998a4c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xd8], rax
movabs rax, 0x750aec4d13a5f471
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xe0], rax
movabs rax, 0xcce113030a79bde
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xe8], rax
movabs rax, 0x47df6d07d932e693
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xf0], rax
movabs rax, 0x6ccc6e1a66432020
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xf8], rax
vmovdqu ymm0, ymmword [rbp + 0xc0]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqa ymmword [rbp + 0x20], ymm1
vmovdqu ymm0, ymmword [rbp + 0x40]
vpxor ymm1, ymm0, ymmword [rbp + 0xe0]
vmovdqa ymmword [rbp + 0x40], ymm1
lea r8, [rbp + 0xa0]
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x60]
vzeroupper
call fcn.140081940
mov rcx, rax
call fcn.14005b7f0
call fcn.14005cbf0
lea rdx, [0x140137a1e]
lea rcx, [rbp + 0x80]
call fcn.140006990
mov rdx, rax
lea rcx, [0x140152160]
call fcn.14008bf10
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0x10
jb 0x14005fbc3
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005fbbe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005fbbe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e8180
mov rcx, qword [rbp + 0x100]
xor rcx, rsp
call fcn.1400e8160
add rsp, 0x150
pop rbp
ret
Function at 0x140060100
Capabilities:
Terminate process

Disassembly:
push rbp
sub rsp, 0x150
lea rbp, [rsp + 0x60]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x14014e080]
xor rax, rsp
mov qword [rbp + 0xe0], rax
lea rcx, [rbp + 0x80]
call fcn.14005d4f0
nop
cmp qword [0x1401522b0], 0
je 0x140060365
cmp qword [0x1401522d0], 0
je 0x140060365
cmp qword [0x1401522f0], 0
je 0x140060365
movabs rax, 0x92dc9a2b18edc52e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs rax, 0x2f76569c2a6c285a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0xfbbb45a7f0380c7e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
movabs rax, 0x1c63680a2ab3d16c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
movabs rax, 0x5f20c57d3b85871f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
movabs rax, 0xcce113030ad9183
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
movabs rax, 0xeba8f3596d8ea07d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
movabs rax, 0x5b0576ec47095c7a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
movabs rax, 0x88d82cd38351781f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb0], rax
movabs rax, 0x7504076600998a4c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb8], rax
movabs rax, 0x750aec4d13a5f471
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
movabs rax, 0xcce113030a79bde
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc8], rax
vmovdqu ymm0, ymmword [rbp + 0x20]
vpxor ymm1, ymm0, ymmword [rbp + 0xa0]
vmovdqa ymmword [rbp + 0x20], ymm1
vmovdqa xmm0, xmmword [rbp + 0x40]
vpxor xmm0, xmm0, xmmword [rbp + 0xc0]
vmovdqa xmmword [rbp + 0x40], xmm0
lea rcx, [rbp + 0x20]
mov rax, 0xffffffffffffffff
vzeroupper
inc rax
cmp byte [rcx + rax], 0
jne 0x1400602a6
movabs rcx, 0x7fffffffffffffff
mov rdx, qword [rbp + 0x90]
sub rcx, rdx
cmp rcx, rax
jb 0x140060374
lea rcx, [rbp + 0x80]
cmp qword [rbp + 0x98], 0x10
cmovae rcx, qword [rbp + 0x80]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x20]
lea rcx, [rbp + 0x60]
call fcn.140083150
lea rcx, [rbp + 0x60]
call fcn.14005ada0
nop
mov rdx, qword [rbp + 0x98]
cmp rdx, 0x10
jb 0x14006034d
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140060348
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140060348
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e8180
mov rcx, qword [rbp + 0xe0]
xor rcx, rsp
call fcn.1400e8160
add rsp, 0x150
pop rbp
ret
call fcn.14005fbe0
nop
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.140002500
int3
Function at 0x140060d60
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x14014e080]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov r15, r8
mov r12, rdx
mov rsi, rcx
mov qword [rsp + 0x20], rcx
xor edi, edi
movabs rax, 0xdb99bb6a59fcc833
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x30], rax
movabs rcx, 0x5b0576ec47095c7a
mov qword [rsp + 0x20], rcx
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x38], rax
movabs rax, 0xeba8f3596d8ea07d
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x20], rcx
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x78], rax
movdqa xmm0, xmmword [rsp + 0x30]
pxor xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x30], xmm0
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rdi
lea rax, [rsp + 0x30]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], dil
jne 0x140060e20
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x48]
call fcn.1400081f0
nop
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi], rdi
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], rdi
mov r14, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x48]
test r15, r15
je 0x140060ebc
mov rdx, r15
mov rcx, rsi
call fcn.1400840f0
mov rbx, qword [rsi]
mov r8, r15
mov rdx, r12
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
lea rax, [r15 + rbx]
mov qword [rsi + 8], rax
mov r8, qword [rsp + 0x58]
nop dword [rax]
nop word [rax + rax]
lea rcx, [rsp + 0x48]
cmp r14, 0x10
cmovae rcx, rbp
xor edx, edx
mov rax, rdi
div r8
add rdx, rcx
mov rcx, qword [rsi]
movzx eax, byte [rcx + rdi]
xor al, byte [rdx]
mov byte [rcx + rdi], al
inc rdi
cmp rdi, r15
jne 0x140060e90
cmp r14, 0x10
jb 0x140060ef6
lea rdx, [r14 + 1]
mov rax, rbp
cmp rdx, 0x1000
jb 0x140060eee
add rdx, 0x27
mov rbp, qword [rbp - 8]
sub rax, rbp
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140060eee
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbp
call fcn.1400e8180
mov rax, rsi
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400e8160
add rsp, 0x90
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140061230
Capabilities:
Create thread

Disassembly:
sub rsp, 0x68
mov rax, qword [0x14014e080]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov ecx, 1
call fcn.1400e8420
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x140084690]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1400612ca
cmp dword [rsp + 0x38], 0
jne 0x140061295
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
je 0x1400612b8
mov ecx, eax
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
nop
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400e8160
add rsp, 0x68
ret
mov dword [rsp + 0x38], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3

Function at 0x1400615f0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x68
mov rax, qword [0x14014e080]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov ecx, 1
call fcn.1400e8420
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x1400846c0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14006168a
cmp dword [rsp + 0x38], 0
jne 0x140061655
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
je 0x140061678
mov ecx, eax
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
nop
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400e8160
add rsp, 0x68
ret
mov dword [rsp + 0x38], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x1400619b0
Capabilities:
Execute command

Disassembly:
push rbp
sub rsp, 0xb0
lea rbp, [rsp + 0x40]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x14014e080]
xor rax, rsp
mov qword [rbp + 0x60], rax
movabs rcx, 0x7504076600998a4c
movabs rax, 0x87c49a3206fdc109
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs rax, 0xb6c1bbb674f735a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0xeda049fdc6020e6d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
movabs rax, 0xeba8f3596d8ea07d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
movabs rax, 0x5b0576ec47095c7a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
movabs rax, 0x88d82cd38351781f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
mov qword [rbp], rcx
lea rcx, [rbp + 0x20]
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
vmovdqu ymm0, ymmword [rbp + 0x40]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqa ymmword [rbp + 0x20], ymm1
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [rbp + 0x60]
xor rcx, rsp
call fcn.1400e8160
add rsp, 0xb0
pop rbp
ret

Function at 0x140061ab0
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
cmp qword [0x140152060], 0x10
lea rcx, [0x140152048]
cmovae rcx, qword [0x140152048]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
cmp qword [0x140152040], 0x10
lea rcx, [0x140152028]
cmovae rcx, qword [0x140152028]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
cmp qword [0x1401520c0], 0x10
lea rcx, [0x1401520a8]
cmovae rcx, qword [0x1401520a8]
add rsp, 0x28
jmp qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
Function at 0x140066980
Capabilities:
Delete file

Disassembly:
push rbp
sub rsp, 0xf0
lea rbp, [rsp + 0x40]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x14014e080]
xor rax, rsp
mov qword [rbp + 0xa0], rax
movabs rax, 0x99cf9c2b3dd29a3e
movabs rcx, 0x6ccc6e1a66432020
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs rax, 0x16591798264d311b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0xfcbe43a0ec231b76
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
movabs rax, 0x67368026ef0dd10
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
movabs rax, 0x2979892570c4b72d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
movabs rax, 0x3eff7a5e7dccd4a6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
movabs rax, 0x47df6d07ad5384bd
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
movabs rax, 0xeba8f3596d8ea07d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x60], rax
movabs rax, 0x5b0576ec47095c7a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x68], rax
movabs rax, 0x88d82cd38351781f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x70], rax
movabs rax, 0x7504076600998a4c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x78], rax
movabs rax, 0x750aec4d13a5f471
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x80], rax
movabs rax, 0xcce113030a79bde
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
movabs rax, 0x47df6d07d932e693
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x90], rax
mov qword [rbp], rcx
lea rcx, [rbp + 0x20]
mov rax, qword [rbp]
vmovdqu ymm0, ymmword [rbp + 0x60]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqu ymm0, ymmword [rbp + 0x40]
vmovdqa ymmword [rbp + 0x20], ymm1
mov qword [rbp + 0x98], rax
vpxor ymm1, ymm0, ymmword [rbp + 0x80]
vmovdqa ymmword [rbp + 0x40], ymm1
vzeroupper
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov rcx, qword [rbp + 0xa0]
xor rcx, rsp
call fcn.1400e8160
add rsp, 0xf0
pop rbp
ret
Function at 0x14006c1e0
Capabilities:
Execute command

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0xb0
lea rbp, [rsp + 0x40]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x14014e080]
xor rax, rsp
mov qword [rbp + 0x60], rax
movabs r15, 0x84c794790ae0c90d
lea rcx, [rbp + 0x20]
mov qword [rbp], r15
movabs r12, 0x7b68198f696c301d
mov rax, qword [rbp]
movabs r13, 0xb6ea0cbff63f5821
mov qword [rbp + 0x20], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
movabs rax, 0x750407660099bb6a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
movabs rax, 0xeba8f3596d8ea07d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
movabs rax, 0x5b0576ec47095c7a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
movabs rax, 0x88d82cd38351781f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
movabs rax, 0x7504076600998a4c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
vmovdqu ymm0, ymmword [rbp + 0x40]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqa ymmword [rbp + 0x20], ymm1
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
test eax, eax
je 0x14006c416
movabs rsi, 0x7ffffffed5fa0dff
movabs rdi, 0x7fffffffffffffff
movabs r14, 0x12a05f200
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x14006c326
imul rax, rax, 0x64
jmp 0x14006c344
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
imul rcx, rcx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
cmp rax, rsi
jge 0x14006c353
lea rcx, [rax + r14]
mov qword [rbp], rcx
jmp 0x14006c357
mov qword [rbp], rdi
lea rcx, [rbp]
call fcn.14000cef0
mov qword [rbp], r15
lea rcx, [rbp + 0x20]
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
movabs rax, 0x750407660099bb6a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
movabs rax, 0xeba8f3596d8ea07d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
movabs rax, 0x5b0576ec47095c7a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
movabs rax, 0x88d82cd38351781f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
movabs rax, 0x7504076600998a4c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
vmovdqu ymm0, ymmword [rbp + 0x40]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqa ymmword [rbp + 0x20], ymm1
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
test eax, eax
jne 0x14006c308
mov rcx, qword [rbp + 0x60]
xor rcx, rsp
call fcn.1400e8160
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x14006c850
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
call fcn.140062cb0
call fcn.140063580
cmp byte [0x140151fcb], 1
lea rsi, [0x140152048]
lea rbp, [0x140152028]
lea r14, [0x1401520a8]
lea rdi, [0x140152418]
jne 0x14006c89e
call fcn.140063e50
jmp 0x14006c950
cmp qword [0x140152060], 0x10
mov rcx, rsi
cmovae rcx, qword [0x140152048]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
cmp qword [0x140152040], 0x10
mov rcx, rbp
cmovae rcx, qword [0x140152028]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
cmp qword [0x1401520c0], 0x10
mov rcx, r14
cmovae rcx, qword [0x1401520a8]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov rax, qword [0x140152430]
mov byte [0x140151f26], 1
cmp rax, 0x61
jb 0x14006c93c
mov qword [rsp + 0x30], rbx
lea rdx, str.Spoofing_process_has_been_interupted_and_forced_to_exit__please_contact_support__error_code_f2_.
cmp rax, 0x10
mov qword [0x140152428], 0x61
mov rbx, rdi
mov r8d, 0x61
cmovae rbx, qword [0x140152418]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x61], 0
mov rbx, qword [rsp + 0x30]
jmp 0x14006c950
lea r9, str.Spoofing_process_has_been_interupted_and_forced_to_exit__please_contact_support__error_code_f2_.
mov edx, 0x61
mov rcx, rdi
call fcn.14000a530
call fcn.140061b10
call fcn.1400623e0
cmp byte [0x140151fcb], 1
jne 0x14006c96d
call fcn.140063e50
jmp 0x14006ca12
cmp qword [0x140152060], 0x10
cmovae rsi, qword [0x140152048]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
cmp qword [0x140152040], 0x10
cmovae rbp, qword [0x140152028]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
cmp qword [0x1401520c0], 0x10
cmovae r14, qword [0x1401520a8]
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov rax, qword [0x140152430]
mov byte [0x140151f26], 1
cmp rax, 0x61
jb 0x14006c9fe
cmp rax, 0x10
mov qword [0x140152428], 0x61
mov r8d, 0x61
lea rdx, str.Spoofing_process_has_been_interupted_and_forced_to_exit__please_contact_support__error_code_f2_.
cmovae rdi, qword [0x140152418]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov byte [rdi + 0x61], 0
jmp 0x14006ca12
lea r9, str.Spoofing_process_has_been_interupted_and_forced_to_exit__please_contact_support__error_code_f2_.
mov edx, 0x61
mov rcx, rdi
call fcn.14000a530
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14006e200
Capabilities:
Create process on windows
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x3d0]
sub rsp, 0x4d0
mov rax, qword [0x14014e080]
xor rax, rsp
mov qword [rbp + 0x3c0], rax
mov r8d, 0x104
lea rdx, [rbp - 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x14006e418
mov r8d, 0x104
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test eax, eax
je 0x14006e418
movabs rax, 0xebccf3796deda052
mov qword [rsp + 0x4e0], rdi
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x40]
mov rax, qword [rsp + 0x30]
lea rcx, [rbp + 0x1b0]
mov qword [rsp + 0x40], rax
movabs rdi, 0xeba8f3596d8ea07d
movabs rax, 0x5b0576cc47655c1f
movabs rbx, 0x5b0576ec47095c7a
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rdi
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x30]
movdqa xmm0, xmmword [rsp + 0x40]
mov qword [rsp + 0x78], rax
pxor xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
movabs rax, 0xeb88f3676db0a05d
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x30], rax
lea rcx, [rbp + 0x1b0]
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x50], rax
movabs rax, 0x5b0576a0475c5c34
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x30], rdi
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x30]
movdqa xmm0, xmmword [rsp + 0x50]
mov qword [rbp - 0x78], rax
pxor xmm0, xmmword [rbp - 0x80]
movdqa xmmword [rsp + 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_lstrcatW]
movabs rax, 0xebfbf3346de1a03e
lea rdx, [rbp - 0x60]
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x60]
mov rax, qword [rsp + 0x30]
mov r8d, 0x104
mov qword [rsp + 0x60], rax
movabs rax, 0x5b05768f476c5c0a
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x30], rdi
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x70], rax
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x30]
movdqa xmm0, xmmword [rsp + 0x60]
mov qword [rbp - 0x68], rax
pxor xmm0, xmmword [rbp - 0x70]
movdqa xmmword [rsp + 0x60], xmm0
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rdi, qword [rsp + 0x4e0]
test eax, eax
je 0x14006e418
xor ebx, ebx
lea r9, [rbp + 0x1b0]
mov dword [rsp + 0x28], ebx
lea r8, [rbp - 0x60]
xor edx, edx
mov qword [rsp + 0x20], rbx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
setg bl
mov eax, ebx
jmp 0x14006e41a
xor eax, eax
mov rcx, qword [rbp + 0x3c0]
xor rcx, rsp
call fcn.1400e8160
mov rbx, qword [rsp + 0x4e8]
add rsp, 0x4d0
pop rbp
ret