joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001c708
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov r8d, dword [rcx + 0x20]
mov edi, 0x38
mov rsi, qword [rcx + 0x20]
and r8d, 0x3f
shl rsi, 3
mov r14, rdx
mov rbx, rcx
mov byte [r8 + rcx + 0x28], 0x80
inc r8d
cmp r8d, edi
je 0x14001c789
jbe 0x14001c772
lea edx, [rdi + 8]
cmp r8d, edx
jae 0x14001c767
mov ecx, r8d
sub edx, r8d
add rcx, 0x28
mov r8d, edx
add rcx, rbx
xor edx, edx
call fcn.140033c80
mov rcx, rbx
call fcn.14001c9c8
xor r8d, r8d
mov ecx, r8d
sub edi, r8d
add rcx, 0x28
mov r8d, edi
add rcx, rbx
xor edx, edx
call fcn.140033c80
mov rcx, rsi
shr rcx, 0x20
call fcn.14003a12c
mov ecx, esi
mov dword [rbx + 0x60], eax
call fcn.14003a12c
mov rcx, rbx
mov dword [rbx + 0x64], eax
call fcn.14001c9c8
mov ecx, dword [rbx]
call fcn.14003a12c
mov dword [r14], eax
mov ecx, dword [rbx + 4]
call fcn.14003a12c
mov dword [r14 + 4], eax
mov ecx, dword [rbx + 8]
call fcn.14003a12c
mov dword [r14 + 8], eax
mov ecx, dword [rbx + 0xc]
call fcn.14003a12c
mov dword [r14 + 0xc], eax
mov ecx, dword [rbx + 0x10]
call fcn.14003a12c
mov dword [r14 + 0x10], eax
mov ecx, dword [rbx + 0x14]
call fcn.14003a12c
mov dword [r14 + 0x14], eax
mov ecx, dword [rbx + 0x18]
call fcn.14003a12c
mov dword [r14 + 0x18], eax
mov ecx, dword [rbx + 0x1c]
call fcn.14003a12c
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov dword [r14 + 0x1c], eax
and qword [rbx + 0x20], 0
mov dword [rbx], 0x6a09e667
mov dword [rbx + 4], 0xbb67ae85
mov dword [rbx + 8], 0x3c6ef372
mov dword [rbx + 0xc], 0xa54ff53a
mov dword [rbx + 0x10], 0x510e527f
mov dword [rbx + 0x14], 0x9b05688c
mov dword [rbx + 0x18], 0x1f83d9ab
mov dword [rbx + 0x1c], 0x5be0cd19
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop r14
ret

Function at 0x14001c85c
Capabilities:
Hash data using sha256

Disassembly:
push rbx
sub rsp, 0xa0
mov rax, qword [0x14005be78]
xor rax, rsp
mov qword [rsp + 0x90], rax
and qword [rsp + 0x40], 0
mov rbx, r8
mov r8, rdx
mov dword [rsp + 0x20], 0x6a09e667
mov rdx, rcx
mov dword [rsp + 0x24], 0xbb67ae85
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x28], 0x3c6ef372
mov dword [rsp + 0x2c], 0xa54ff53a
mov dword [rsp + 0x30], 0x510e527f
mov dword [rsp + 0x34], 0x9b05688c
mov dword [rsp + 0x38], 0x1f83d9ab
mov dword [rsp + 0x3c], 0x5be0cd19
call fcn.14001c938
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.14001c708
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1400322b0
add rsp, 0xa0
pop rbx
ret

Function at 0x14001c8f8
Capabilities:
Hash data using sha256

Disassembly:
and qword [rcx + 0x20], 0
mov dword [rcx], 0x6a09e667
mov dword [rcx + 4], 0xbb67ae85
mov dword [rcx + 8], 0x3c6ef372
mov dword [rcx + 0xc], 0xa54ff53a
mov dword [rcx + 0x10], 0x510e527f
mov dword [rcx + 0x14], 0x9b05688c
mov dword [rcx + 0x18], 0x1f83d9ab
mov dword [rcx + 0x1c], 0x5be0cd19
ret
Function at 0x14001d000
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rcx
cmp qword [rcx + 0x18], 8
jb 0x14001d017
mov rcx, qword [rcx]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x14001d0e9
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x20], xmm0
and qword [rsp + 0x30], 0
mov edx, eax
lea rcx, [rsp + 0x20]
call fcn.1400013a4
nop
mov rax, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x20]
sub rax, rdx
sar rax, 1
mov rcx, rdi
cmp qword [rdi + 0x18], 8
jb 0x14001d063
mov rcx, qword [rdi]
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov rbx, qword [rsp + 0x20]
test eax, eax
je 0x14001d0a7
mov rcx, qword [rsp + 0x28]
sub rcx, rbx
sar rcx, 1
mov eax, eax
cmp rax, rcx
ja 0x14001d0a7
mov rcx, rbx
call fcn.14003790c
mov r8, rax
mov rdx, rbx
mov rcx, rdi
call fcn.1400020b0
mov dil, 1
mov rbx, qword [rsp + 0x20]
jmp 0x14001d0aa
xor dil, dil
test rbx, rbx
je 0x14001d0e6
mov rdx, qword [rsp + 0x30]
sub rdx, rbx
sar rdx, 1
add rdx, rdx
mov rax, rbx
cmp rdx, 0x1000
jb 0x14001d0de
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d0f4
mov rcx, rbx
call fcn.14003219c
mov al, dil
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
call fcn.140037894
int3

Function at 0x14001dcfc
Capabilities:
Get token membership

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x14005be78]
xor rax, rsp
mov qword [rbp - 8], rax
and dword [rbp - 0x10], 0
lea rax, [rbp - 0x18]
mov qword [rsp + 0x50], rax
lea rcx, [rbp - 0x10]
and dword [rsp + 0x48], 0
mov r9d, 0x220
and dword [rsp + 0x40], 0
mov r8d, 0x20
and dword [rsp + 0x38], 0
mov dl, 2
and dword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
mov word [rbp - 0xc], 0x500
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [rbp - 0x20], eax
test eax, eax
je 0x14001dd8c
mov rdx, qword [rbp - 0x18]
lea r8, [rbp - 0x20]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
neg eax
sbb ecx, ecx
and dword [rbp - 0x20], ecx
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [rbp - 0x20]
test eax, eax
setne al
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400322b0
add rsp, 0x80
pop rbp
ret
Function at 0x14001dda4
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
mov rax, qword [0x14005be78]
xor rax, rsp
mov qword [rbp + 0x4f], rax
mov rbx, rcx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x29], xmm0
xor edi, edi
mov qword [rbp - 0x19], rdi
mov edx, 0x104
lea rcx, [rbp - 0x29]
call fcn.1400013a4
nop
mov rdx, qword [rbp - 0x21]
mov rcx, qword [rbp - 0x29]
sub rdx, rcx
sar rdx, 1
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov esi, 0x1000
test eax, eax
jne 0x14001de11
mov ebx, edi
jmp 0x14001df71
mov qword [rbp - 0x11], rdi
movdqa xmm0, xmmword [0x1400489c0]
movdqu xmmword [rbp - 1], xmm0
mov word [rbp - 0x11], di
mov qword [rbp + 0x2f], rdi
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x3f], xmm0
mov rcx, rbx
call fcn.14003790c
mov r8, rax
mov rdx, rbx
lea rcx, [rbp + 0x2f]
call fcn.14000129c
nop
mov rbx, qword [rbp - 0x29]
mov qword [rbp + 0xf], rdi
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x1f], xmm0
mov rcx, rbx
call fcn.14003790c
mov r8, rax
mov rdx, rbx
lea rcx, [rbp + 0xf]
call fcn.14000129c
nop
lea r8, [rbp - 0x11]
lea rdx, [rbp + 0x2f]
lea rcx, [rbp + 0xf]
call fcn.1400173c8
nop
mov rdx, qword [rbp + 0x27]
cmp rdx, 8
jb 0x14001dec0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xf]
mov rax, rcx
cmp rdx, rsi
jb 0x14001debb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001dfd7
call fcn.14003219c
movdqa xmm0, xmmword [0x1400489c0]
movdqu xmmword [rbp + 0x1f], xmm0
mov word [rbp + 0xf], di
mov rdx, qword [rbp + 0x47]
cmp rdx, 8
jb 0x14001df0d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x2f]
mov rax, rcx
cmp rdx, rsi
jb 0x14001df08
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001dfdd
call fcn.14003219c
lea rcx, [rbp - 0x11]
cmp qword [rbp + 7], 8
cmovae rcx, qword [rbp - 0x11]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
mov rdx, qword [rbp + 7]
cmp rdx, 8
jb 0x14001df60
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x11]
mov rax, rcx
cmp rdx, rsi
jb 0x14001df5b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001dfe3
call fcn.14003219c
movdqa xmm0, xmmword [0x1400489c0]
movdqu xmmword [rbp - 1], xmm0
mov word [rbp - 0x11], di
mov rcx, qword [rbp - 0x29]
test rcx, rcx
je 0x14001dfa9
mov rdx, qword [rbp - 0x19]
sub rdx, rcx
sar rdx, 1
add rdx, rdx
mov rax, rcx
cmp rdx, rsi
jb 0x14001dfa4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001dfd1
call fcn.14003219c
mov rax, rbx
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.1400322b0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.140037894
nop
call fcn.140037894
nop
call fcn.140037894
nop
call fcn.140037894
int3
Function at 0x14001eac0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov rbx, rcx
cmp dword [rcx], edi
jbe 0x14001eb62
lea rax, [rsp + 0x40]
mov r9, rbx
mov qword [rsp + 0x28], rax
lea r8, [0x14001ec70]
and dword [rsp + 0x20], 0
mov edx, 0x10000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rsi, rax
test rax, rax
jne 0x14001eb38
lea rdx, str.CreateThread_failed
lea rcx, [0x1400609e0]
call fcn.14000b67c
lea rcx, [0x1400609e0]
call fcn.14000ba60
lea edx, [rsi + 2]
lea rcx, [0x1400609e0]
call fcn.14000b674
mov qword [rbx + rdi*8 + 8], rsi
inc dword [rbx + 0x208]
mov edx, dword [0x140067b48]
test edx, edx
je 0x14001eb58
mov rcx, qword [rbx + rdi*8 + 8]
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
inc edi
cmp edi, dword [rbx]
jb 0x14001eadc
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x140026ca4
Capabilities:
Hide graphical window

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x14005be78]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rsi, r8
mov r8, rdx
mov rdi, rcx
and qword [rbp - 0x38], 0
and qword [rbp - 0x40], 0
mov rax, qword [rdx]
lea rdx, [rbp - 0x38]
mov rcx, r8
mov rax, qword [rax + 0x90]
call qword [0x140048518]
mov ebx, eax
test eax, eax
js 0x140026d69
mov rcx, qword [rbp - 0x38]
test rcx, rcx
je 0x140026d76
mov rax, qword [rcx]
lea r8, [rbp - 0x40]
lea rdx, [0x14004afa0]
mov rax, qword [rax]
call qword [0x140048518]
mov ebx, eax
test eax, eax
js 0x140026d58
mov rcx, qword [rbp - 0x40]
mov rax, qword [rcx]
mov rax, qword [rax + 0x40]
call qword [0x140048518]
mov ebx, eax
test eax, eax
js 0x140026d47
mov rcx, qword [rbp - 0x40]
mov rax, qword [rcx]
mov rdx, rsi
mov rax, qword [rax + 0x28]
call qword [0x140048518]
mov ebx, eax
mov rcx, qword [rbp - 0x40]
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140048518]
mov rcx, qword [rbp - 0x38]
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140048518]
test ebx, ebx
js 0x140026d76
mov rcx, qword [rbp - 0x38]
test rcx, rcx
jne 0x140026de6
cmp qword [rdi + 0x10], 0
je 0x140026de6
cmp qword [rdi + 0x48], 0
jne 0x140026de6
mov r8, qword [rdi + 0x40]
test r8, r8
je 0x140026de6
lea rdx, [rbp - 0x30]
mov rcx, rdi
call fcn.140027830
nop
mov dword [rsp + 0x30], 0x204
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_SetWindowPos]
mov edx, 5
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.USER32.dll_ShowWindow]
lea rdx, [rbp - 0x30]
mov rcx, qword [rdi + 0x10]
call fcn.140002520
nop
lea rcx, [rbp - 0x30]
call fcn.140001fa0
shr ebx, 0x1f
xor bl, 1
mov al, bl
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400322b0
mov rbx, qword [rsp + 0xb8]
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret
Function at 0x140029edc
Capabilities:
Delete file

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov rax, qword [0x14005be78]
xor rax, rsp
mov qword [rbp + 0x47], rax
xor r14d, r14d
mov ebx, r14d
mov dword [rbp - 0x19], ebx
lea rsi, [0x140067cc8]
cmp qword [0x140067cd8], r14
je 0x140029f95
mov rbx, qword [str.RarSFX]
mov qword [rbp - 0x11], r14
xorps xmm0, xmm0
movdqu xmmword [rbp - 1], xmm0
mov rcx, rbx
call fcn.14003790c
mov r8, rax
mov rdx, rbx
lea rcx, [rbp - 0x11]
call fcn.14000129c
nop
mov dword [rbp - 0x19], 1
mov rdx, rsi
lea rcx, [rbp + 0xf]
call fcn.140017e54
nop
lea ebx, [r14 + 3]
mov dword [rbp - 0x19], ebx
lea rdx, [rbp - 0x11]
cmp qword [rbp + 7], 8
cmovae rdx, qword [rbp - 0x11]
cmp qword [rax + 0x18], 8
jb 0x140029f80
mov rax, qword [rax]
mov r8d, 6
mov rcx, rax
call fcn.140021378
test eax, eax
mov dil, 1
je 0x140029f98
mov dil, r14b
test bl, 2
je 0x140029faa
and ebx, 0xfffffffd
lea rcx, [rbp + 0xf]
call fcn.140001fa0
nop
test bl, 1
je 0x140029fef
mov rdx, qword [rbp + 7]
cmp rdx, 8
jb 0x140029fef
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x11]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140029fea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a11a
call fcn.14003219c
test dil, dil
je 0x14002a0eb
lea rcx, [0x140067ca0]
call fcn.140018024
mov qword [rbp - 0x11], r14
mov qword [rbp - 1], r14
mov qword [rbp + 7], r14
cmp qword [0x140067ce0], 8
cmovae rsi, qword [0x140067cc8]
mov r8, qword [0x140067cd8]
mov rdx, rsi
lea rcx, [rbp - 0x11]
call fcn.140008d04
nop
mov rcx, qword [rbp - 1]
cmp rcx, qword [rbp + 7]
jae 0x14002a05a
lea rax, [rcx + 1]
mov qword [rbp - 1], rax
lea rax, [rbp - 0x11]
cmp qword [rbp + 7], 8
cmovae rax, qword [rbp - 0x11]
mov dword [rax + rcx*2], r14d
jmp 0x14002a06d
xor r9d, r9d
mov r8b, r14b
lea edx, [r9 + 1]
lea rcx, [rbp - 0x11]
call fcn.140001744
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0xf], xmm0
movups xmmword [rbp + 0x1f], xmm0
movups xmmword [rbp + 0x2f], xmm0
mov qword [rbp + 0x3f], rax
mov dword [rbp + 0x17], 3
mov eax, 0x14
mov word [rbp + 0x2f], ax
lea rax, [rbp - 0x11]
cmp qword [rbp + 7], 8
cmovae rax, qword [rbp - 0x11]
mov qword [rbp + 0x1f], rax
lea rcx, [rbp + 0xf]
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
nop
mov rdx, qword [rbp + 7]
cmp rdx, 8
jb 0x14002a0eb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x11]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002a0e6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a114
call fcn.14003219c
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1400322b0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.140037894
int3
call fcn.140037894
int3
Function at 0x14002a25c
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x180
mov rax, qword [0x14005be78]
xor rax, rsp
mov qword [rsp + 0x170], rax
xor ebp, ebp
mov rdi, r8
cmp qword [0x14005bdc8], rbp
mov rbx, rdx
mov rsi, rcx
jne 0x14002a2cf
lea r9d, [rbp + 0x64]
mov ecx, 0x400
lea r8, [rsp + 0xa0]
lea edx, [rbp + 0xf]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
movzx eax, word [rsp + 0xa0]
mov word [0x140067da8], ax
lea rax, [0x140067da8]
mov qword [0x14005bdc8], rax
mov word [0x140067daa], bp
mov r8d, 0x32
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.14001d720
lea r9, [0x14005bdb0]
mov dword [rsp + 0x28], edi
lea r8, [rsp + 0x30]
mov word [rbx], bp
xor edx, edx
mov qword [rsp + 0x20], rbx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetNumberFormatW]
mov word [rbx + rdi*2 - 2], bp
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400322b0
mov rbx, qword [rsp + 0x1b8]
add rsp, 0x180
pop rdi
pop rsi
pop rbp
ret
Function at 0x14002fc9c
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x14005be78]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, rcx
mov rdx, rcx
cmp qword [rcx + 0x18], 8
jb 0x14002fccc
mov rdx, qword [rcx]
lea rcx, str.sfxcmd
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
xor edi, edi
mov qword [rbp - 0x28], rdi
movdqa xmm0, xmmword [0x1400489c0]
movdqu xmmword [rbp - 0x18], xmm0
mov word [rbp - 0x28], di
mov qword [rbp - 0x30], rdi
lea r8, [rbp - 0x28]
lea rdx, [rbp - 0x30]
mov rcx, rbx
call fcn.14001d0fc
test al, al
je 0x14002fd53
mov rax, qword [rbp - 0x30]
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x14002fd19
mov rcx, qword [rbx]
movzx ecx, word [rcx + rax*2]
call fcn.14001d4dc
test al, al
je 0x14002fd33
mov rax, qword [rbp - 0x30]
inc rax
mov qword [rbp - 0x30], rax
jmp 0x14002fd0c
cmp qword [rbx + 0x18], 8
jb 0x14002fd3d
mov rbx, qword [rbx]
mov rax, qword [rbp - 0x30]
lea rdx, [rbx + rax*2]
lea rcx, str.sfxpar
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
nop
mov rdx, qword [rbp - 0x10]
cmp rdx, 8
jb 0x14002fd8f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002fd8a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002fdab
call fcn.14003219c
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400322b0
mov rbx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
add rsp, 0x50
pop rbp
ret
call fcn.140037894
int3
Function at 0x14000ad00
Capabilities:
Hash data with md5

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov rax, qword [0x1403687c8]
xor rax, rsp
mov qword [rbp + 0x37], rax
xor edi, edi
mov dword [rbp + 0x13], 0x67452301
mov rbx, r8
mov qword [rbp + 0x27], rdi
mov r8d, edx
mov dword [rbp + 0x17], 0xefcdab89
mov rdx, rcx
mov dword [rbp + 0x1b], 0x98badcfe
lea rcx, [rbp - 0x39]
mov dword [rbp + 0x1f], 0x10325476
mov qword [rbp - 0x39], rdi
mov dword [rbp - 0x31], edi
call fcn.140036ba0
test eax, eax
jne 0x14000ae0c
test rbx, rbx
je 0x14000ae07
mov eax, dword [rbp - 0x39]
mov byte [rbp + rax - 0x2d], 0x80
mov ecx, dword [rbp - 0x39]
inc ecx
mov dword [rbp - 0x39], ecx
cmp ecx, 0x38
jbe 0x14000adb1
mov eax, ecx
mov r8d, 0x40
sub r8d, ecx
xor edx, edx
lea rcx, [rbp - 0x2d]
add rcx, rax
call fcn.140097f00
lea rdx, [rbp - 0x2d]
mov dword [rbp - 0x39], 0x40
lea rcx, [rbp - 0x39]
call fcn.1400363b0
mov ecx, edi
mov dword [rbp - 0x39], edi
mov eax, ecx
mov r8d, 0x38
sub r8d, ecx
xor edx, edx
lea rcx, [rbp - 0x2d]
add rcx, rax
call fcn.140097f00
mov r9d, dword [rbp - 0x35]
mov edx, r9d
mov ecx, dword [rbp - 0x31]
shr edx, 0x1d
shl r9d, 3
mov dword [rbp - 0x35], r9d
mov dword [rbp + 0xb], r9d
lea r8d, [rdx + rcx*8]
lea rdx, [rbp - 0x2d]
mov dword [rbp - 0x31], r8d
lea rcx, [rbp - 0x39]
mov dword [rbp + 0xf], r8d
call fcn.1400363b0
movups xmm0, xmmword [rbp + 0x13]
mov eax, edi
movups xmmword [rbx], xmm0
jmp 0x14000ae0c
mov eax, 0xffffff53
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140095720
add rsp, 0xa0
pop rdi
pop rbx
pop rbp
ret

Function at 0x14000ae30
Capabilities:
Hash data using sha1

Disassembly:
push rbx
sub rsp, 0xa0
mov rax, qword [0x1403687c8]
xor rax, rsp
mov qword [rsp + 0x90], rax
xor eax, eax
mov dword [rsp + 0x6c], 0x67452301
mov rbx, r8
mov qword [rsp + 0x80], rax
mov r8d, edx
mov dword [rsp + 0x70], 0xefcdab89
mov rdx, rcx
mov dword [rsp + 0x74], 0x98badcfe
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x78], 0x10325476
mov dword [rsp + 0x7c], 0xc3d2e1f0
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], eax
call fcn.140025380
test eax, eax
jne 0x14000aeaa
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.140025880
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140095720
add rsp, 0xa0
pop rbx
ret

Function at 0x14000aed0
Capabilities:
Hash data using sha256

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0xb0
mov rax, qword [0x1403687c8]
xor rax, rsp
mov qword [rsp + 0xa0], rax
xor eax, eax
mov rbx, r8
mov qword [r11 - 0x28], rax
mov dword [rsp + 0x20], 0x6a09e667
mov dword [rsp + 0x24], 0xbb67ae85
mov dword [rsp + 0x28], 0x3c6ef372
mov dword [rsp + 0x2c], 0xa54ff53a
mov dword [rsp + 0x30], 0x510e527f
mov dword [rsp + 0x34], 0x9b05688c
mov dword [rsp + 0x38], 0x1f83d9ab
mov dword [rsp + 0x3c], 0x5be0cd19
mov qword [r11 - 0x38], rax
mov dword [r11 - 0x30], eax
test rcx, rcx
jne 0x14000af4e
test edx, edx
je 0x14000af62
mov eax, 0xffffff53
jmp 0x14000af6f
mov r8d, edx
mov rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.140022230
test eax, eax
jne 0x14000af6f
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.140022ca0
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140095720
add rsp, 0xb0
pop rbx
ret
Function at 0x140017540
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
xor eax, eax
mov r10, rcx
mov r9d, eax
test r8d, r8d
jle 0x140017619
cmp r8d, 8
jb 0x140017619
mov qword [rsp + 0x10], rbx
lea r11, [rdx + 4]
mov qword [rsp], rdi
sub rcx, rdx
movsxd rbx, r8d
mov rdi, 0xfffffffffffffffc
and rbx, 0xfffffffffffffff8
xorps xmm4, xmm4
sub rdi, rdx
xorps xmm3, xmm3
nop word [rax + rax]
movd xmm2, dword [rcx + r11 - 4]
xorps xmm0, xmm0
movd xmm1, dword [r11 - 4]
lea r11, [r11 + 8]
punpcklbw xmm2, xmm0
lea rax, [rdi + r11]
punpcklwd xmm2, xmm0
add r9d, 8
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
movd xmm1, dword [r11 - 8]
punpcklbw xmm1, xmm0
por xmm4, xmm2
movd xmm2, dword [rcx + r11 - 8]
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
por xmm3, xmm2
cmp rax, rbx
jl 0x140017590
mov rdi, qword [rsp]
por xmm3, xmm4
mov rbx, qword [rsp + 0x10]
movdqa xmm0, xmm3
psrldq xmm0, 8
por xmm3, xmm0
movdqa xmm0, xmm3
psrldq xmm0, 4
por xmm3, xmm0
movd eax, xmm3
movsxd r11, r9d
movsxd r9, r8d
cmp r11, r9
jge 0x140017648
sub r10, rdx
lea rcx, [r11 + rdx]
sub r9, r11
nop
movzx r8d, byte [rcx + r10]
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
xor r8d, edx
or eax, r8d
sub r9, 1
jne 0x140017630
add rsp, 8
ret
Function at 0x1400188f0
Capabilities:
Hash data using sha256
Hash data using sha384
Hash data using sha512

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
xor edi, edi
mov rcx, qword [rcx + 0x78]
test rcx, rcx
je 0x140018921
mov rax, qword [0x14036e090]
test rax, rax
je 0x140018918
call rax
jmp 0x14001891d
call fcn.14009bf04
mov qword [rbx + 0x78], rdi
mov rax, qword [0x14036e0a0]
mov ecx, 0x3e8
test rax, rax
je 0x140018936
call rax
jmp 0x14001893b
call fcn.14009bf18
mov qword [rbx + 0x78], rax
test rax, rax
jne 0x140018954
mov eax, 0xffffff83
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
xor edx, edx
mov r8d, 0x3e8
mov rcx, rax
call fcn.140097f00
mov rcx, qword [rbx + 0x78]
add rcx, 0x1b0
je 0x140018b19
mov rax, qword [rbx + 0xa8]
xorps xmm0, xmm0
mov qword [rcx + 0x70], rax
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm0
mov dword [rcx], 0x6a09e667
mov dword [rcx + 4], 0xbb67ae85
mov dword [rcx + 8], 0x3c6ef372
mov dword [rcx + 0xc], 0xa54ff53a
mov dword [rcx + 0x10], 0x510e527f
mov dword [rcx + 0x14], 0x9b05688c
mov dword [rcx + 0x18], 0x1f83d9ab
mov dword [rcx + 0x1c], 0x5be0cd19
mov qword [rcx + 0x60], rdi
mov dword [rcx + 0x68], edi
mov rcx, qword [rbx + 0x78]
add rcx, 0x228
je 0x140018b19
mov rax, qword [rbx + 0xa8]
mov qword [rcx + 0xd8], rax
movabs rax, 0xcbbb9d5dc1059ed8
mov qword [rcx], rax
movabs rax, 0x629a292a367cd507
mov qword [rcx + 8], rax
movabs rax, 0x9159015a3070dd17
mov qword [rcx + 0x10], rax
movabs rax, 0x152fecd8f70e5939
mov qword [rcx + 0x18], rax
movabs rax, 0x67332667ffc00b31
mov qword [rcx + 0x20], rax
movabs rax, 0x8eb44a8768581511
mov qword [rcx + 0x28], rax
movabs rax, 0xdb0c2e0d64f98fa7
mov qword [rcx + 0x30], rax
movabs rax, 0x47b5481dbefa4fa4
mov qword [rcx + 0x38], rax
mov dword [rcx + 0xc0], edi
mov qword [rcx + 0xc8], rdi
mov qword [rcx + 0xd0], rdi
mov rcx, qword [rbx + 0x78]
add rcx, 0x308
je 0x140018b19
mov rax, qword [rbx + 0xa8]
mov qword [rcx + 0xd8], rax
movabs rax, 0x6a09e667f3bcc908
mov qword [rcx], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rcx + 8], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rcx + 0x10], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rcx + 0x18], rax
movabs rax, 0x510e527fade682d1
mov qword [rcx + 0x20], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rcx + 0x28], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rcx + 0x30], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rcx + 0x38], rax
xor eax, eax
mov dword [rcx + 0xc0], edi
mov qword [rcx + 0xc8], rdi
mov qword [rcx + 0xd0], rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
mov eax, 0xffffff53
add rsp, 0x20
pop rdi
ret