joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140103d70
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov r8, qword [rcx + 0x648]
xor esi, esi
mov rbx, rcx
test r8, r8
je 0x140103da0
mov rdi, qword [rcx + 0x640]
jmp 0x140103da7
mov rdi, rsi
nop dword [rax]
test r8, r8
je 0x140103dc0
mov rax, qword [rbx + 0x640]
lea rcx, [rax + r8*8]
jmp 0x140103dc3
mov rcx, rsi
cmp rdi, rcx
je 0x140103ffa
mov rax, qword [rdi]
cmp qword [rax + 0x28], rdx
je 0x140103de2
add rdi, 8
jmp 0x140103da7
test r8, r8
je 0x140103ea6
cmp rdi, qword [rbx + 0x640]
jb 0x140103ea6
mov rax, qword [rbx + 0x640]
lea rcx, [rax + r8*8]
cmp rdi, rcx
jae 0x140103ea6
mov rdx, rdi
nop word [rax + rax]
mov rcx, qword [rbx + 0x648]
test rcx, rcx
je 0x140103e39
mov rax, qword [rbx + 0x640]
lea rax, [rax + rcx*8]
jmp 0x140103e3c
mov rax, rsi
add rax, 0xfffffffffffffff8
cmp rdx, rax
jae 0x140103e5f
mov rax, qword [rdx + 8]
mov qword [rdx], rax
neg rdx
add rdx, 0xfffffffffffffff8
neg rdx
jmp 0x140103e19
test rcx, rcx
je 0x140103ea6
lea rax, [rcx - 1]
mov qword [rbx + 0x648], rax
test rax, rax
jne 0x140103ea6
mov rcx, qword [rbx + 0x640]
test rcx, rcx
je 0x140103e98
call fcn.140097d00
mov qword [rbx + 0x640], rsi
mov qword [rbx + 0x650], rsi
mov qword [rbx + 0x648], rsi
mov rcx, qword [rdi]
test rcx, rcx
je 0x140103ece
mov rax, qword [rcx]
mov edx, 0x1866919c
xor edx, 0x7ee8913d
sub edx, 0x355eb3b5
sub edx, 0x312f4ceb
call qword [rax]
cmp qword [rbx + 0x648], rsi
je 0x140103ffa
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.1400ee600
mov rcx, qword [rsp + 0x30]
mov r10d, 0x77e8c09a
sub r10d, 0x1bab7a8b
xor r10d, 0x28a7f43c
sub r10d, 0x749ab193
mov r8d, dword [rsp + 0x34]
mov eax, ecx
mov r9, qword [rbx + 0x648]
sub eax, r8d
cdq
idiv dword [rbx + 0x648]
cmp eax, r10d
cmovl r10d, eax
test r9, r9
je 0x140103fb2
mov rdx, qword [rbx + 0x640]
lea r11, [rdx + r9*8]
cmp rdx, r11
je 0x140103fb2
mov r9d, r10d
xor r9d, 0x1ac5644a
xor r8d, 0x1ac5644a
nop dword [rax]
mov rcx, qword [rdx]
mov eax, esi
xor eax, 0x1ac5644a
add esi, r10d
nop
add rdx, 0x74c50e6c
sub rdx, 0x74c50e64
mov dword [rcx + 0x30], eax
mov dword [rcx + 0x34], 0xb9eb7da
xor dword [rcx + 0x34], 0x167b5f5
add dword [rcx + 0x34], 0x5d59bf25
sub dword [rcx + 0x34], 0x4d8d5d0a
mov dword [rcx + 0x38], r9d
mov dword [rcx + 0x3c], r8d
cmp rdx, r11
jne 0x140103f5c
mov rcx, qword [rsp + 0x30]
mov r8d, dword [rsp + 0x34]
mov rax, qword [rbx + 0x660]
test rax, rax
je 0x140103ff2
sub ecx, r8d
mov dword [rax + 0x14], 0x2558123d
xor dword [rax + 0x14], 0x72b800d6
xor dword [rax + 0x14], 0x4d2576a1
xor ecx, 0x1ac5644a
xor r8d, 0x1ac5644a
mov dword [rax + 0x10], ecx
mov dword [rax + 0x18], r8d
mov dword [rax + 0x1c], r8d
mov rcx, rbx
call fcn.1400edd10
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1401040c9
Capabilities:
Encode data using xor

Disassembly:
push rbx
neg rsp
sub rsp, 0xffffffffffffffe0
neg rsp
mov rax, qword [rcx]
mov rbx, rcx
call qword [rax + 0x78]
mov rdx, qword [rbx + 0x648]
mov rcx, rax
mov qword [rsp + 0x30], rax
call fcn.140100380
lea rcx, [rbx + 0x640]
lea rdx, [rsp + 0x30]
call fcn.140103c30
mov rcx, rbx
neg rsp
add rsp, 0xffffffffffffffe0
neg rsp
pop rbx
jmp 0x140104010
push rbx
neg rsp
sub rsp, 0xffffffffffffffe0
neg rsp
cmp qword [rcx + 0x648], 0
mov rbx, rcx
je 0x140104141
lea rdx, [rsp + 0x30]
call fcn.1400ee600
mov r8, qword [rsp + 0x30]
mov r11d, 0x571583b2
xor r11d, 0x6a003418
sub r11d, 0x3d15b70a
mov r9d, dword [rsp + 0x34]
mov eax, r8d
sub eax, r9d
cdq
idiv dword [rbx + 0x648]
mov rdx, qword [rbx + 0x648]
cmp eax, r11d
cmovl r11d, eax
xor r10d, r10d
test rdx, rdx
je 0x1401040f7
mov rax, qword [rbx + 0x640]
mov qword [rsp + 0x38], rdi
lea rdi, [rax + rdx*8]
cmp rax, rdi
je 0x1401040f2
mov r8d, r11d
xor r8d, 0x1ac5644a
xor r9d, 0x1ac5644a
nop word [rax + rax]
mov rdx, qword [rax]
mov ecx, r10d
xor ecx, 0x1ac5644a
add r10d, r11d
sub rax, 0xfffffffffffffff8
mov dword [rdx + 0x30], ecx
mov dword [rdx + 0x34], 0x2f7496d9
xor dword [rdx + 0x34], 0x328a94e3
sub dword [rdx + 0x34], 0x3389df0
mov dword [rdx + 0x38], r8d
mov dword [rdx + 0x3c], r9d
cmp rax, rdi
jne 0x1401040ac
mov r8, qword [rsp + 0x30]
mov r9d, dword [rsp + 0x34]
mov rdi, qword [rsp + 0x38]
mov rax, qword [rbx + 0x660]
test rax, rax
je 0x140104139
sub r8d, r9d
mov dword [rax + 0x14], 0x644ace74
sub dword [rax + 0x14], 0x25918394
xor dword [rax + 0x14], 0x247c2eaa
xor r8d, 0x1ac5644a
xor r9d, 0x1ac5644a
mov dword [rax + 0x10], r8d
mov dword [rax + 0x18], r9d
mov dword [rax + 0x1c], r9d
mov rcx, rbx
call fcn.1400edd10
nop
add rsp, 0x6fb94e3
sub rsp, 0x6fb94c3
pop rbx
ret
Function at 0x140117b94
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp - 0x30], ebx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
mov dword [rsp - 0x18], 0x3cfdd35d
sub rsp, 0x80
xor esi, esi
mov dword [rbp - 0x50], 0x7bcab6c9
sub dword [rbp - 0x50], 0x499a6375
xor dword [rbp - 0x50], 0xf9f1896
sub dword [rbp - 0x50], 0x3d4c4ada
mov dword [rbp - 0x4c], 0x784e7c84
sub dword [rbp - 0x4c], 0x75e8092c
add dword [rbp - 0x4c], 0x1010de97
sub dword [rbp - 0x4c], 0x12595123
mov dword [rbp - 0x48], 0x1a78f6c4
xor dword [rbp - 0x48], 0x3ad46827
xor dword [rbp - 0x48], 0x43a42377
sub dword [rbp - 0x48], 0x47f66578
sub dword [rbp - 0x48], 0x1aa9571f
mov dword [rbp - 0x44], 0xf13fbe5
xor dword [rbp - 0x44], 0x33aedb8c
add dword [rbp - 0x44], 0x3263175d
sub dword [rbp - 0x44], 0x6f0f36f3
xchg rbx, rsi
mov qword [rbp + 0x10], rbx
xchg rsi, rbx
lea ebx, [rsi + 1]
mov dword [rsp - 0x38], 0x633d30b2
xchg rdi, rax
mov rdi, qword [rbp + 0x10]
xchg rdi, rax
xchg rcx, r12
mov r12, qword [rbp + 0x10]
xchg rcx, r12
mov rax, qword [rbp + 0x10]
mov dword [rsp - 0x38], 0x5786639b
and cl, 3
shl cl, 1
shl cl, 1
shl cl, 1
movzx edx, word [rbp + rax*2 - 0x50]
mov eax, 0x43eadb8
add eax, 0x28bf33c1
sub eax, 0xb92f918
add eax, 0x3c184957
shr eax, cl
movzx ecx, al
mov rbx, rbx
mov rax, qword [rbp + 0x10]
xor cx, dx
mov word [rbp + rax*2 - 0x20], cx
mov rdx, rdx
xchg r10, rax
mov r10, qword [rbp + 0x10]
xchg r10, rax
add rax, rbx
mov dword [rsp - 0x44], ebp
xchg rcx, rax
mov qword [rbp + 0x10], rcx
xchg rcx, rax
mov rax, qword [rbp + 0x10]
mov r11, r11
cmp rax, 8
jb 0x140117c50
lea rax, [rbp - 0x20]
mov word [rbp - 0x10], si
mov dword [rsp - 0x24], 0x777a39d3
xorps xmm0, xmm0
xchg rcx, rax
mov qword [rbp - 0x38], rcx
xchg rcx, rax
lea r9, [rbp - 0x30]
mov dword [rbp - 0x40], 0x5817aca
xor dword [rbp - 0x40], 0x5cdc4af6
sub dword [rbp - 0x40], 0x47a26271
add dword [rbp - 0x40], 0x48412d17
xor dword [rbp - 0x40], 0x59e9faf2
lea r8, [rbp - 0x40]
mov dword [rsp + 0x20], esi
mov dword [rsp - 0x3c], ecx
xor edx, edx
xor ecx, ecx
xchg rcx, rbp
movups xmmword [rcx - 0x30], xmm0
xchg rcx, rbp
call fcn.1401330a0
mov dword [rsp - 0x18], esi
xchg r12, rax
mov rdi, r12
xchg r12, rax
test rax, rax
mov rdx, rdx
je 0x140117d7c
mov rcx, rax
call fcn.14010e2a0
mov dword [rsp - 0x3c], 0x2b34c9ac
test al, al
je 0x140117d7c
lea rdx, [rbp - 0x40]
mov dword [rsp - 0x1c], 0x63acfb1b
xchg r8, rdi
mov rcx, r8
xchg rdi, r8
call fcn.14010d1d8
xchg r9, r9
test al, al
jne 0x140117d87
mov bl, sil
mov dword [rsp - 0x38], 0x939191d
xor eax, eax
lea r11, [rsp + 0x80]
mov rsi, qword [r11 + 0x20]
mov dword [rsp - 0x44], esi
lea rdi, [rbp - 0x20]
lea ecx, [rax + 8]
rep stosb byte [rdi], al
mov dword [rsp - 0x14], 0x28bce801
xchg rdi, rdx
mov rdx, qword [r11 + 0x28]
xchg rdi, rdx
mov al, bl
mov dword [rsp - 0x18], edx
mov rbx, qword [r11 + 0x18]
xchg rsp, r11
mov r11, rsp
xchg rsp, r11
nop
add rsp, 8
mov rbp, qword [rsp - 8]
ret
Function at 0x14011bfe0
Capabilities:
Encode data using xor

Disassembly:
push rbx
neg rsp
sub rsp, 0xfffffffffffffdd0
neg rsp
mov r10, qword [0x1401412b0]
xchg rsi, rsi
lea rdx, [rsp + 0x20]
ror r10, 0x12
xchg rcx, rbx
mov rcx, rbx
xchg rbx, rcx
movabs rcx, 0xbaae3cc974e6e538
sub rcx, 0x55af36a3
add rcx, 0x5975e45a
sub rcx, 0x68768c96
xor r9d, r9d
add r10, rcx
movabs rax, 0x1a7724de033fc0ea
add rax, 0x20acc49c
xor rax, 0x5b74282f
xor rax, 0x10f11b94
add rax, 0x7fffffff
add rax, 0xcb22c05
xor r10, rax
xor ecx, ecx
ror r10, 2
xchg rdi, rdi
lea r8d, [r9 + 8]
call r10
lea rcx, [rbx + 8]
xorps xmm0, xmm0
mov dword [rsp - 0x38], ebp
xchg r13, rcx
mov qword [rbx], r13
xchg r13, rcx
movups xmmword [rcx], xmm0
mov dword [rsp - 0x34], ebx
xchg rcx, rsi
movups xmmword [rsi + 0x10], xmm0
xchg rsi, rcx
xchg rcx, r10
movups xmmword [r10 + 0x20], xmm0
xchg rcx, r10
test eax, eax
mov r9, r9
je 0x14011c1c7
lea rax, [rsp + 0x20]
nop
movabs rdx, 0xffffffff0f0f32e2
xor rdx, 0x41149feb
add rdx, 0x1fd4f8fe
add rdx, 0x7fffffff
xor rdx, 0x120f59f9
nop dword [rax + rax]
mov dword [rsp - 0x28], ecx
inc rdx
cmp word [rax + rdx*2], 0
jne 0x14011c0db
xchg rbx, rcx
mov rbx, rcx
xchg rbx, rcx
mov qword [rbx + 0x38], rdx
call fcn.140017bec
xor r8d, r8d
mov dword [rsp - 0x20], 0x389eb444
xchg rdx, rsi
mov rsi, rax
xchg rsi, rdx
mov ecx, 0x5723768a
xor ecx, 0xc32ac01
sub ecx, 0x573da762
add ecx, 0x59aefe8f
cmp qword [rbx + 0x38], r8
jbe 0x14011c1dc
xchg r12, r12
lea r9, [rsp + 0x20]
mov r10d, 0x460e0330
sub r10d, 0x1c14e267
add r10d, 0x23663ccd
xor r10d, 0x720b16d2
sub r10d, 0x3f544a45
sub r9, rax
mov dword [rsp - 0xc], edi
nop word [rax + rax]
movzx eax, cx
lea rdx, [rdx + 2]
and ax, r10w
xchg r11, r11
ror ecx, 3
ror ecx, 2
ror ecx, 1
ror ecx, 1
ror ecx, 1
xor ax, word [r9 + rdx - 2]
mov dword [rsp - 0x34], 0x5c99f318
inc r8
mov word [rdx - 2], ax
cmp r8, qword [rbx + 0x38]
jb 0x14011c16c
mov rbx, rbx
xchg rbx, rax
mov rbx, rax
xchg rbx, rax
neg rsp
add rsp, 0xfffffffffffffdd0
neg rsp
nop
add rsp, 8
mov rbx, qword [rsp - 8]
ret
xor r8d, r8d
mov dword [rsp - 0x20], 0x3305f50c
xchg r14, r8
mov qword [rbx + 0x38], r14
xchg r8, r14
mov rax, rbx
mov dword [rsp - 0x14], ebp
sub rsp, 0xfffffffffffffdd0
nop
mov rbx, qword [rsp]
add rsp, 8
ret
Function at 0x14011c200
Capabilities:
Encode data using xor

Disassembly:
push rbx
neg rsp
sub rsp, 0xfffffffffffffdd0
neg rsp
mov rax, qword [0x140141450]
xchg rdx, rdx
mov rbx, rcx
ror rax, 0x1e
ror rax, 1
ror rax, 2
ror rax, 1
ror rax, 1
ror rax, 1
movabs rcx, 0x10ee42c602530cc9
add rcx, 0x6087fc10
xor rcx, 0x6ffe0c2c
sub rcx, 0x61e5847
not rax
xchg r8, r8
mov edx, 0x65c9855
xor edx, 0x4566c5fb
xor edx, 0x4bbefe61
xor edx, 0x52fadcd5
xor edx, 0x5a7e7e1e
add rax, rcx
mov dword [rsp - 0x44], 0x7e9b4d54
movabs rcx, 0x39cf101a4c6230ba
sub rcx, 0x2be130d8
add rcx, 0x2308e7dd
add rcx, 0x7dbe380
xor rcx, 0x2858010a
not rax
mov r9, r9
sub rax, rcx
lea rcx, [rsp + 0x20]
call rax
mov r10, r10
lea rax, [rbx + 8]
xorps xmm0, xmm0
mov qword [rbx], rax
nop
movabs rdx, 0xffffffff4391fb14
xor rdx, 0x3c1cdea9
sub rdx, 0x70ff1d62
add rdx, 0x6ae329ae
add rdx, 0x7fffffff
add rdx, 0x68ecdf7
xchg r11, rax
movups xmmword [r11], xmm0
xchg r11, rax
xchg rcx, rax
movups xmmword [rcx + 0x10], xmm0
xchg rcx, rax
xchg r13, rax
movups xmmword [r13 + 0x20], xmm0
xchg r13, rax
lea rax, [rsp + 0x20]
xchg r11, r11
inc rdx
cmp word [rax + rdx*2], 0
jne 0x14011c30f
mov r11, r11
xchg rcx, r8
mov r8, rbx
xchg r8, rcx
mov qword [rbx + 0x38], rdx
xchg rdi, rdi
call fcn.140017bec
xor r8d, r8d
mov edx, 0x971c74a
xor edx, 0x2a0aff41
add edx, 0x4fbfdf5b
xor edx, 0x2eb826de
cmp qword [rbx + 0x38], r8
jbe 0x14011c3cf
mov dword [rsp - 0x1c], 0x5b2d4b84
lea r9, [rsp + 0x20]
mov r10d, 0x6d57a4bb
sub r10d, 0x23d2eb1b
xor r10d, 0x72265e23
xor r10d, 0x3ba2e77c
sub r9, rax
xchg r15, r15
nop word [rax + rax]
movzx ecx, dx
lea rax, [rax + 2]
and cx, r10w
mov dword [rsp - 0x38], 0x6ac7345f
ror edx, 2
ror edx, 5
ror edx, 1
xor cx, word [r9 + rax - 2]
mov dword [rsp - 0x34], 0x2003117f
inc r8
mov word [rax - 2], cx
cmp r8, qword [rbx + 0x38]
jb 0x14011c391
mov dword [rsp - 0x2c], ebp
xchg r13, rax
mov r13, rbx
xchg r13, rax
sub rsp, 0xfffffffffffffdd0
mov rbx, rbx
nop
mov rbx, qword [rsp]
add rsp, 8
ret
Function at 0x1401330a0
Capabilities:
Execute syscall

Disassembly:
xchg r8, rcx
mov r10, r8
xchg rcx, r8
mov eax, dword [0x140142004]
cmp qword [0x140142018], 0
jne 0x14008c5b0
mov rsi, rsi
syscall
ret
jmp 0x14008d137
Function at 0x1401358c0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r12
mov qword [rsp + 8], r12
xchg rbx, r12
xchg rsi, rbp
mov qword [rsp + 0x10], rbp
xchg rbp, rsi
mov qword [rsp + 0x18], rdi
xchg rcx, rcx
nop
push r12
mov qword [rsp], rbp
push r12
mov rbx, rbx
nop
sub rsp, 8
mov qword [rsp], r14
mov rbp, rsp
mov dword [rsp - 0x30], ebp
neg rsp
sub rsp, 0xffffffffffffff90
neg rsp
xchg r13, r8
mov rdi, r13
xchg r8, r13
xchg rdx, rbx
mov r14, rbx
xchg rdx, rbx
mov rsi, rcx
mov dword [rsp - 0x20], ecx
movabs r12, 0x2d264c3e387a1cfd
add r12, 0x34fe0321
sub r12, 0x98d4a6e
add r12, 0x7d7f434
add r12, 0xdba3a64
cmp r9d, 0x60001
mov dword [rsp - 0x34], esi
jne 0x140135af3
mov dword [rbp - 0x40], 0x31246546
xor dword [rbp - 0x40], 0x199406f
sub dword [rbp - 0x40], 0x1dfd0093
xor dword [rbp - 0x40], 0x4bde8411
add dword [rbp - 0x40], 0x4ff5718d
xor edx, edx
xchg rdx, rdx
mov dword [rbp - 0x3c], 0x1edbf0d2
xor dword [rbp - 0x3c], 0x47452d91
sub dword [rbp - 0x3c], 0x2666244d
sub dword [rbp - 0x3c], 0x183814a4
mov dword [rbp - 0x38], 0x55a61e63
sub dword [rbp - 0x38], 0x89e43
sub dword [rbp - 0x38], 0x13750df6
add dword [rbp - 0x38], 0x1045c6b
xor dword [rbp - 0x38], 0x8826c660
mov ecx, edx
mov dword [rsp - 0x30], 0x6c52d810
mov eax, 0x390aafc7
sub eax, 0x770771a
xor eax, 0x1a63b5da
sub eax, 0xb902622
rol eax, cl
xor al, byte [rbp + rdx - 0x40]
mov byte [rbp + rdx - 0x34], al
mov dword [rsp - 0x40], 0x68a520b5
inc rdx
cmp rdx, 0xc
jb 0x1401359bb
mov r9d, 0x335604fe
sub r9d, 0x1c84de6f
add r9d, 0x4744e552
sub r9d, 0x4bee7671
xor r9d, 0x12279a8f
mov qword [rsp + 0x20], 0x160321ec
add qword [rsp + 0x20], 0x5de219fc
xor qword [rsp + 0x20], 0x125beef5
sub qword [rsp + 0x20], 0x5e7019ef
sub qword [rsp + 0x20], 0x34ebb22
lea r8, [rbp - 0x34]
xchg rdx, rdi
mov rdi, rdx
xchg rdi, rdx
mov rcx, r14
call fcn.140132cec
xchg rsi, rax
mov rbx, rsi
xchg rsi, rax
lea rdi, [rbp - 0x34]
xor eax, eax
mov dword [rsp - 0x28], 0x3cba6601
lea ecx, [rax + 0xc]
rep stosb byte [rdi], al
test rbx, rbx
je 0x140135b36
mov dword [rsp - 0x20], 0x5b6360c5
lea rdx, [rbp - 0x28]
lea rcx, [rbx + 0xc]
call fcn.14008ea6c
mov dword [rsp - 0x14], esp
test dword [rbp - 7], 0x1000
jne 0x140135b36
cmp byte [rbp - 0x1d], 0xe8
jne 0x140135b36
mov dword [rsp - 0x18], 0x583d244a
lea rdx, [rbx + 0xc]
xchg r14, r8
mov rcx, r8
xchg r14, r8
call fcn.140084260
movzx edx, byte [rbp - 0x28]
mov dword [rsp - 0x44], 0x25f49d8f
add edx, dword [rbp - 0x13]
add edx, eax
xchg r15, rax
mov r15, qword [rsi + 8]
xchg r15, rax
xor rax, r12
add rdx, rax
mov dword [rsp - 0xc], ebp
xor rdx, r12
mov qword [rsi + 0x20], rdx
cmp qword [rsi + 0x20], r12
setne al
xchg rsp, rsp
lea r11, [rsp + 0x70]
xchg r15, rbx
mov r15, qword [r11 + 0x20]
xchg r15, rbx
mov rsi, qword [r11 + 0x28]
xchg r15, r15
xchg rdi, r9
mov r9, qword [r11 + 0x30]
xchg rdi, r9
xchg r11, rcx
mov rsp, rcx
xchg r11, rcx
nop
mov r14, qword [rsp]
add rsp, 8
pop r12
pop rbp
mov rsi, rsi
ret
xor al, al
mov r12, r12
jmp 0x140135afd
Function at 0x140003350
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x14000d008]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rcx
cmp qword [rcx + 0x68], 0
je 0x1400034fe
cmp byte [rcx + 0x72], 0
je 0x1400034fe
mov rax, qword [rcx]
mov ebx, 0xffff
mov edx, ebx
call qword [rax + 0x18]
cmp bx, ax
jne 0x1400033ae
xor al, al
jmp 0x140003500
mov edx, 0xf
mov qword [rbp - 0x18], rdx
mov byte [rbp - 0x30], 0
xor ecx, ecx
mov qword [rbp - 0x30], rcx
mov qword [rbp - 0x20], 8
lea rax, [rbp - 0x30]
cmp rdx, 0x10
cmovae rax, rcx
mov byte [rax + 8], cl
mov rcx, qword [rbp - 0x30]
mov r9, qword [rbp - 0x18]
lea rdx, [rbp - 0x30]
cmp r9, 0x10
cmovae rdx, rcx
lea r8, [rbp - 0x30]
cmovae r8, rcx
mov r9, qword [rbp - 0x20]
add r9, rdx
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
lea rdx, [rdi + 0x74]
mov rcx, qword [rdi + 0x68]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_wchar_t__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14000341d
sub eax, 1
jne 0x140003492
jmp 0x140003421
mov byte [rdi + 0x72], 0
lea rax, [rbp - 0x30]
mov rcx, qword [rbp - 0x30]
mov r9, qword [rbp - 0x18]
cmp r9, 0x10
cmovae rax, rcx
mov rbx, qword [rbp - 0x38]
sub rbx, rax
je 0x14000346f
lea rax, [rbp - 0x30]
cmp r9, 0x10
cmovae rax, rcx
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r9, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x30]
cmp rbx, rax
jne 0x14000349f
cmp byte [rdi + 0x72], 0
je 0x1400034a3
test rbx, rbx
jne 0x1400033e0
xor r8d, r8d
lea edx, [rbx + 8]
lea rcx, [rbp - 0x30]
call fcn.140003240
jmp 0x1400033d8
sub eax, 2
mov r9, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x30]
je 0x1400034a3
xor bl, bl
jmp 0x1400034a5
mov bl, 1
cmp r9, 0x10
jb 0x1400034f9
lea rax, [r9 + 1]
cmp rax, 0x1000
jb 0x1400034f4
test byte [rbp - 0x30], 0x1f
je 0x1400034c4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1400034d4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
sub rcx, rax
cmp rcx, 8
jae 0x1400034e4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp rcx, 0x27
jbe 0x1400034f1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rax
call fcn.140005ff4
movzx eax, bl
jmp 0x140003500
mov al, 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140006010
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140004710
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x140004743
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rax
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x14000478a
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x140004785
nop
cmp rbx, rcx
jae 0x14000478a
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x140004770
cmp rbx, rcx
jb 0x14000478e
xor eax, eax
jmp 0x14000479a
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140005690
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
xor ebp, ebp
mov qword [rcx + 4], 1
lea rdi, [rcx + 0x18]
mov dword [rcx], ebp
lea rsi, [rcx + 0x10]
mov qword [rcx + 0x20], rbp
mov rbx, rcx
mov qword [rdi], rbp
xor ecx, ecx
mov qword [rsi], rbp
xor edx, edx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov dword [rbx], eax
mov dword [rbx + 8], 1
cmp eax, 0x80010106
jne 0x1400056e2
mov dword [rbx + 4], ebp
xor edx, edx
mov qword [rsp + 0x20], rdi
lea r9, [0x140008788]
lea rcx, [0x140008768]
lea r8d, [rdx + 1]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [rbx], eax
test eax, eax
js 0x14000577f
mov rcx, qword [rdi]
lea rdx, str.ROOTWMI
mov qword [rsp + 0x40], rsi
xor r9d, r9d
mov qword [rsp + 0x38], rbp
xor r8d, r8d
mov qword [rsp + 0x30], rbp
mov rax, qword [rcx]
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rbp
call qword [rax + 0x18]
mov dword [rbx], eax
test eax, eax
js 0x140005776
mov rcx, qword [rsi]
xor r9d, r9d
mov dword [rsp + 0x38], ebp
xor r8d, r8d
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 3
lea edx, [r9 + 0xa]
mov dword [rsp + 0x20], 3
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov dword [rbx], eax
test eax, eax
jns 0x14000578e
mov rcx, qword [rsi]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rdi]
mov rax, qword [rcx]
call qword [rax + 0x10]
cmp dword [rbx + 4], ebp
je 0x14000578a
call qword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
jmp 0x140005793
mov eax, 1
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x4181e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x418370
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00437d00
xorps xmm15, xmm15
mov r14, qword [0x005cbc50]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x418245
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x418260
add rsp, 0x48
pop rbp
ret
call fcn.004518e0
mov rbx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x38]
sub rbx, rcx
nop dword [rax]
test rbx, rbx
jbe 0x41827f
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x41828f
cmp rbx, 0x1000
jae 0x41824b
jmp 0x4182fa
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x4182a2
xor edx, edx
nop
jmp 0x4182f1
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00437d00
xorps xmm15, xmm15
mov r14, qword [0x005cbc50]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x418285
jmp 0x418274
call fcn.00467b60
xorps xmm15, xmm15
mov r14, qword [0x005cbc50]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.0043bc80
lea rax, [0x004db933]
mov ebx, 0x18
call fcn.0043c4c0
mov rax, qword [rsp + 0x38]
call fcn.0043c220
lea rax, [0x004dbf96]
mov ebx, 0x19
call fcn.0043c4c0
mov rax, qword [rsp + 0x30]
call fcn.0043c220
call fcn.0043bea0
call fcn.0043bce0
lea rax, [0x004dea88]
mov ebx, 0x21
call fcn.0043a440
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00464600
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004181e0