joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140004cdc
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov r15, rcx
call fcn.14000272c
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov ebp, eax
xor edi, edi
test eax, eax
je 0x140004de0
mov eax, 2
mul rbp
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.14003d3e8
mov rbx, rax
mov qword [rsp + 0x68], rax
mov rdx, rax
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov esi, eax
test eax, eax
je 0x140004dd5
cmp eax, ebp
ja 0x140004dd5
lea rcx, [rsp + 0x20]
call fcn.140002ca8
nop
mov r12d, edi
mov ebp, edi
test esi, esi
je 0x140004dc3
mov r14, rbx
cmp word [r14], di
jne 0x140004db9
mov eax, r12d
lea rdx, [rbx + rax*2]
lea rcx, [rsp + 0x20]
call fcn.140002de4
lea r12d, [rbp + 1]
mov rcx, r15
call fcn.140002488
mov ecx, 0x10
call fcn.14003d380
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.140002da8
nop
mov edx, dword [r15 + 8]
lea ecx, [rdx + 1]
mov dword [r15 + 8], ecx
mov rcx, qword [r15]
mov qword [rcx + rdx*8], rax
inc ebp
add r14, 2
cmp ebp, esi
jb 0x140004d67
cmp r12d, esi
sete dil
mov rcx, qword [rsp + 0x20]
call fcn.14003d378
nop
mov rcx, rbx
call fcn.14003d378
mov al, dil
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret

Function at 0x140004ea8
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rcx, qword [rcx]
mov rdi, rdx
and dword [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x140004edd
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x140004edd
xor al, al
jmp 0x140004eed
mov ecx, dword [rsp + 0x30]
mov al, 1
shl rcx, 0x20
add rcx, rbx
mov qword [rdi], rcx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140005058
Capabilities:
Clear file content

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea r9, [rsp + 0x40]
xor r8d, r8d
mov rbx, rdx
mov rdi, rcx
call fcn.140004f54
test al, al
je 0x140005090
cmp qword [rsp + 0x40], rbx
jne 0x140005090
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
setne al
jmp 0x140005092
xor al, al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400061f8
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rdx]
xor ebp, ebp
mov dword [rdx + 8], ebp
mov rsi, rcx
mov rbx, rdx
mov word [rax], bp
mov rcx, qword [rcx]
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov edi, eax
test eax, eax
jne 0x140006239
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
sete al
jmp 0x140006277
mov edx, edi
mov rcx, rbx
call fcn.140003534
mov rcx, qword [rsi]
lea r8d, [rdi + 1]
mov rdx, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rdx, qword [rbx]
mov ecx, ebp
cmp edi, eax
cmova edi, eax
mov word [rdx + rdi*2], bp
cmp word [rdx], bp
je 0x14000626e
inc ecx
cmp word [rdx + rcx*2], bp
jne 0x140006266
mov dword [rbx + 8], ecx
test edi, edi
je 0x14000622c
mov al, 1
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14000c264
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov rdi, r8
mov r12, rdx
mov rsi, rcx
xor r13d, r13d
movzx r9d, r13b
lea r8d, [r13 + 1]
cmp dword [rdx + 8], r13d
je 0x14000c2d0
mov rax, qword [rdx]
mov rcx, qword [rax]
cmp dword [rcx + 8], r13d
jne 0x14000c2ae
mov r9b, r8b
jmp 0x14000c2d0
mov rdx, qword [rcx]
movzx ecx, word [rdx]
lea eax, [rcx - 0x61]
cmp ax, 0x19
jbe 0x14000c2c7
sub cx, 0x41
cmp cx, 0x19
ja 0x14000c2d0
cmp word [rdx + 2], 0x3a
cmove r9d, r8d
cmp dword [rsi + 0xa0], 3
jne 0x14000c2eb
test r9b, r9b
je 0x14000c2eb
mov dword [rdi + 8], r13d
mov rax, qword [rdi]
mov word [rax], r13w
jmp 0x14000c2fa
lea rdx, [rsi + 0x80]
mov rcx, rdi
call fcn.140002e78
mov r14d, r13d
cmp dword [r12 + 8], r13d
jbe 0x14000c452
test r14d, r14d
je 0x14000c33a
mov ecx, dword [rdi + 8]
cmp dword [rdi + 0xc], ecx
jne 0x14000c320
mov rcx, rdi
call fcn.140002b48
mov ecx, dword [rdi + 8]
mov rdx, qword [rdi]
mov eax, ecx
mov r8d, 0x5c
mov word [rdx + rax*2], r8w
inc ecx
mov word [rdx + rcx*2], r13w
mov dword [rdi + 8], ecx
mov ecx, r14d
mov rax, qword [r12]
mov r15, qword [rax + rcx*8]
mov rdx, r15
mov rcx, rdi
call fcn.140003194
mov eax, dword [r12 + 8]
mov r8d, 1
sub eax, r8d
cmp r14d, eax
jne 0x14000c36f
cmp byte [rsi + 0xd0], r13b
mov bl, r8b
jne 0x14000c372
mov bl, r13b
cmp dword [rdi + 8], r13d
jne 0x14000c38c
test bl, bl
je 0x14000c444
mov byte [rsi + 0x127], r8b
jmp 0x14000c444
cmp dword [rsi + 0xa0], 3
jne 0x14000c3c1
test r14d, r14d
jne 0x14000c3c1
cmp dword [r15 + 8], 2
jne 0x14000c3c1
mov rdx, qword [r15]
movzx ecx, word [rdx]
lea eax, [rcx - 0x61]
cmp ax, 0x19
jbe 0x14000c3ba
sub cx, 0x41
cmp cx, 0x19
ja 0x14000c3c1
cmp word [rdx + 2], 0x3a
je 0x14000c378
xor edx, edx
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test bl, bl
je 0x14000c43e
mov rbx, qword [rdi]
mov qword [rbp - 0x40], r13
mov qword [rbp - 0x38], r13
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x28], r13
mov dword [rbp - 0x20], r13d
mov word [rbp - 0x1c], r13w
lea rcx, [rbp - 0x18]
call fcn.140002ca8
nop
xor r8d, r8d
mov rdx, rbx
lea rcx, [rbp - 0x40]
call fcn.14000449c
test al, al
je 0x14000c415
mov eax, dword [rbp - 0x20]
shr eax, 4
test al, 1
mov bl, 1
jne 0x14000c418
mov bl, r13b
mov rcx, qword [rbp - 0x18]
call fcn.14003d378
test bl, bl
jne 0x14000c43e
mov byte [rsi + 0x127], 1
mov r8, rdi
lea rdx, str.Cannot_create_folder
mov rcx, rsi
call fcn.14000c5d4
mov r8d, 1
add r14d, r8d
cmp r14d, dword [r12 + 8]
jb 0x14000c308
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x14000d9b4
Capabilities:
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp byte [rcx + 0x127], 0
mov rbx, rcx
jne 0x14000da2c
cmp dword [rcx + 0xe0], 0
je 0x14000da2c
cmp byte [rcx + 0x190], 0
jne 0x14000da2c
cmp byte [rcx + 0xf1], 0
je 0x14000da2c
cmp byte [rcx + 0x120], 0
je 0x14000da2c
mov ecx, dword [rcx + 0x11c]
lea rdi, [rbx + 0xd8]
mov edx, ecx
mov eax, ecx
and edx, 0x3fff
and eax, 0xf0000000
cmove edx, ecx
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x14000da2c
mov r8, rdi
lea rdx, str.Cannot_set_file_attribute
mov rcx, rbx
call fcn.14000c638
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400171e4
Capabilities:
Get file system object information

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x298]
sub rsp, 0x370
mov r14, r9
mov r12d, r8d
mov r13d, edx
mov r15, rcx
lea rcx, [rsp + 0x60]
call fcn.140002ca8
nop
xor eax, eax
cmp byte [r14], al
je 0x14001727e
lea rdx, [rsp + 0x70]
mov rcx, qword [r14 + 8]
call fcn.140002918
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.140002ce0
nop
lea r8, [rsp + 0x50]
mov edx, 0xdb0
lea rcx, [rsp + 0x40]
call fcn.1400170fc
nop
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.140002e78
nop
mov rcx, qword [rsp + 0x40]
call fcn.14003d378
nop
mov rcx, qword [rsp + 0x50]
call fcn.14003d378
lea rcx, [r14 + 0x18]
call fcn.14000329c
lea esi, [rax + 1]
mov eax, dword [r14 + 0x20]
cmp esi, eax
cmovbe eax, esi
mov ebx, eax
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.140002b00
lea rdi, [rbx + rbx]
mov r8, rdi
mov rdx, qword [r14 + 0x18]
mov rbx, qword [rsp + 0x40]
mov rcx, rbx
call fcn.14003ef60
xor eax, eax
mov word [rdi + rbx], ax
mov rax, qword [r14 + 0x18]
lea rdx, [rax + rsi*2]
lea rcx, [rsp + 0x50]
call fcn.140002ce0
nop
lea rdx, [rsp + 0x40]
mov rcx, r15
call fcn.140017140
lea rdx, [rsp + 0x50]
mov rcx, r15
call fcn.140017140
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.140002da8
nop
lea rcx, [rsp + 0x30]
call fcn.1400030f4
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.140003194
lea rcx, [rsp + 0x30]
call fcn.1400030f4
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x30]
call fcn.140003194
lea rcx, [rsp + 0x30]
call fcn.1400030f4
xor ebx, ebx
cmp byte [r14 + 1], bl
je 0x140017399
mov edx, 0x3f4
lea rcx, [rsp + 0x70]
call fcn.140005f28
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.140003194
nop
mov rcx, qword [rsp + 0x70]
call fcn.14003d378
lea rdx, [0x14005a078]
lea rcx, [rsp + 0x30]
call fcn.1400031e0
lea rcx, [r14 + 0x10]
xor r9d, r9d
lea r8, [rsp + 0x70]
call fcn.140005c50
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x30]
call fcn.1400031e0
mov edx, r13d
mov rcx, qword [r15 + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rdx, qword [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov dword [rsp + 0x20], pe_nt_image_headers64
mov r9d, 0x2b8
lea r8, [rbp - 0x50]
mov edx, 0x80
mov rcx, qword [r14 + 0x18]
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test rax, rax
je 0x1400173fd
mov edx, r12d
mov rcx, qword [r15 + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
mov r8, qword [rbp - 0x50]
mov edx, 0x170
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
nop
mov rcx, qword [rsp + 0x30]
call fcn.14003d378
nop
mov rcx, qword [rsp + 0x50]
call fcn.14003d378
nop
mov rcx, qword [rsp + 0x40]
call fcn.14003d378
nop
mov rcx, qword [rsp + 0x60]
call fcn.14003d378
lea r11, [rsp + 0x370]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x140019288
Capabilities:
Hide graphical window

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x70
mov rsi, rcx
mov rcx, qword [rcx + 0x110]
test rcx, rcx
je 0x1400192c1
mov rdx, qword [rsi + 0x118]
test rdx, rdx
je 0x1400192c1
mov rax, qword [rcx]
xor r8d, r8d
call qword [rax + 0x50]
mov dl, 1
mov rcx, rsi
call fcn.1400188e0
mov edx, 0x198
lea rcx, [rbp - 0x50]
call fcn.140005f28
mov r8, qword [rbp - 0x50]
mov ebx, 2
mov edx, ebx
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
mov rcx, qword [rbp - 0x50]
call fcn.14003d378
mov edx, ebx
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
mov edx, 0xf4
lea r9d, [rbx - 1]
mov r8d, r9d
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, 0x1bc
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
mov edx, 0x1be
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x70]
lea rax, [rbp - 0x40]
mov qword [rbp + 0x20], rax
lea rcx, [rbp - 0x40]
call fcn.140002ca8
nop
lea rcx, [rbp - 0x30]
call fcn.140002ca8
nop
lea rax, [rbp - 0x20]
mov qword [rbp + 0x20], rax
lea rcx, [rbp - 0x20]
call fcn.140002ca8
nop
lea rcx, [rbp - 0x10]
call fcn.140002ca8
nop
lea rbx, [rsi + 0x288]
mov qword [rbp + 0x20], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov r14d, dword [rsi + 0x240]
lea rdi, [rsi + 0x248]
mov rdx, rdi
lea rcx, [rbp - 0x40]
call fcn.140002e78
lea rdx, [rdi + 0x10]
lea rcx, [rbp - 0x30]
call fcn.140002e78
lea rdx, [rdi + 0x20]
lea rcx, [rbp - 0x20]
call fcn.140002e78
lea rdx, [rdi + 0x30]
lea rcx, [rbp - 0x10]
call fcn.140002e78
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [rbp - 0x28], 0
je 0x140019447
mov byte [rsi + 0x2b3], 1
cmp dword [rbp - 0x38], 0
jne 0x140019410
lea rdx, str.7_Zip
lea rcx, [rbp - 0x40]
call fcn.140003004
mov r9d, 0x10
mov r8, qword [rbp - 0x40]
mov rdx, qword [rbp - 0x30]
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_MessageBoxW]
test r14d, r14d
je 0x140019484
cmp byte [rsi + 0x1ae], 0
jne 0x140019484
mov byte [rsi + 0x1ad], 1
mov rcx, rsi
call fcn.14001984c
jmp 0x140019491
test r14d, r14d
jne 0x14001942d
mov byte [rsi + 0x2b3], 1
cmp dword [rbp - 8], r14d
je 0x140019484
cmp dword [rbp - 0x18], r14d
jne 0x14001946f
lea rdx, str.7_Zip
lea rcx, [rbp - 0x20]
call fcn.140003004
xor r9d, r9d
mov r8, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x10]
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_MessageBoxW]
xor edx, edx
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_EndDialog]
nop
mov rcx, qword [rbp - 0x10]
call fcn.14003d378
mov rcx, qword [rbp - 0x20]
call fcn.14003d378
mov rcx, qword [rbp - 0x30]
call fcn.14003d378
mov rcx, qword [rbp - 0x40]
call fcn.14003d378
mov al, 1
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140019d94
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov r14, rcx
xor ebp, ebp
mov qword [rax - 0x38], rbp
and dword [rax - 0x2c], ebp
xor esi, esi
mov dword [rax - 0x30], esi
lea edi, [rbp + 2]
mov r9d, edi
or r8, 0xffffffffffffffff
mov r15d, 0x100c
mov edx, r15d
mov rcx, qword [rcx + 0xf0]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rbx, rax
test eax, eax
js 0x140019e15
mov edx, ebx
lea rcx, [rsp + 0x20]
call fcn.14000b61c
mov r8d, ebx
mov r9, rdi
mov edx, r15d
mov rcx, qword [r14 + 0xf0]
call qword [sym.imp.USER32.dll_SendMessageW]
mov ebx, eax
test eax, eax
jns 0x140019de4
mov esi, dword [rsp + 0x28]
mov rbp, qword [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.140002ca8
nop
mov ebx, esi
test esi, esi
jne 0x140019e41
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1004
mov rcx, qword [r14 + 0xf0]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rbx, rax
xor edi, edi
test ebx, ebx
je 0x140019e87
mov r15, rbp
cmp edi, esi
jae 0x140019e53
mov eax, dword [r15]
jmp 0x140019e55
mov eax, edi
mov edx, eax
mov rax, qword [r14 + 0x100]
mov rdx, qword [rax + rdx*8]
lea rcx, [rsp + 0x30]
call fcn.140003194
lea rdx, [0x14005a1f8]
lea rcx, [rsp + 0x30]
call fcn.1400031e0
inc edi
add r15, 4
cmp edi, ebx
jb 0x140019e4a
mov rcx, qword [r14 + 8]
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
setne bl
test eax, eax
je 0x140019f06
call qword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x140019f06
mov esi, dword [rsp + 0x38]
inc esi
add rsi, rsi
mov rdx, rsi
mov ecx, 0x2002
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
test rax, rax
je 0x140019f06
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x140019efd
mov r8, rsi
mov rdx, qword [rsp + 0x30]
mov rcx, rax
call fcn.14003ef60
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, rdi
mov ecx, 0xd
call qword [sym.imp.USER32.dll_SetClipboardData]
test rax, rax
jne 0x140019f06
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
test bl, bl
je 0x140019f11
call qword [sym.imp.USER32.dll_CloseClipboard]
nop
mov rcx, qword [rsp + 0x30]
call fcn.14003d378
nop
mov rcx, rbp
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
jmp fcn.14003d378

Function at 0x14001a19c
Capabilities:
Get file system object information

Disassembly:
push rbx
sub rsp, 0x2f0
mov rbx, r8
mov dword [rsp + 0x20], 0x4010
lea r8, [rsp + 0x30]
bts edx, 7
mov r9d, 0x2b8
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov ecx, dword [rsp + 0x38]
mov dword [rbx], ecx
add rsp, 0x2f0
pop rbx
ret
Function at 0x140026410
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r12
push r14
push r15
mov r10d, dword [r9]
xor ebp, ebp
mov r14d, dword [rsp + 0x40]
and r10d, 7
mov r12, r9
mov r15d, r8d
mov rsi, rcx
mov r11d, ebp
cmp rdx, 5
jae 0x140026453
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
pop r15
pop r14
pop r12
ret
lea r9, [rdx - 4]
mov qword [rsp + 0x20], rbx
add r15d, 5
mov qword [rsp + 0x28], rdi
add r9, rsi
nop dword [rax + rax]
lea rax, [r11 + rsi]
cmp rax, r9
jae 0x140026493
nop dword [rax]
movzx ecx, byte [rax]
and cl, 0xfe
cmp cl, 0xe8
je 0x140026493
inc rax
cmp rax, r9
jb 0x140026480
mov rcx, rax
sub rcx, r11
mov r11, rax
sub r11, rsi
sub rcx, rsi
cmp rax, r9
jae 0x1400265ac
cmp rcx, 2
jbe 0x140026527
mov r10d, ebp
movzx edx, byte [rax + 4]
lea ecx, [rdx + 1]
test cl, 0xfe
jne 0x140026598
movzx ecx, byte [rax + 3]
lea edi, [r11 + r15]
shl edx, 8
or edx, ecx
movzx ecx, byte [rax + 2]
shl edx, 8
or edx, ecx
movzx ecx, byte [rax + 1]
shl edx, 8
or edx, ecx
mov ecx, edx
sub ecx, edi
test r14d, r14d
lea ebx, [rdx + rdi]
cmove ebx, ecx
mov r8d, ebx
test r10d, r10d
je 0x140026566
and r10d, 6
mov edx, ebx
shl r10d, 2
mov ecx, r10d
shr edx, cl
inc edx
test dl, 0xfe
jne 0x140026563
mov r8d, 0x100
shl r8d, cl
dec r8d
xor r8d, ebx
test r14d, r14d
je 0x140026560
add r8d, edi
jmp 0x140026563
shr r10d, cl
test r10d, r10d
je 0x1400264b4
cmp r10d, 4
ja 0x140026551
cmp r10d, 3
je 0x140026551
mov ecx, r10d
shr rcx, 1
movzx edx, byte [rcx + rax + 1]
inc edx
test dl, 0xfe
jne 0x1400264b4
or r10d, 8
shr r10d, 1
inc r11
jmp 0x140026470
sub r8d, edi
mov r10d, ebp
mov ecx, r8d
mov byte [rax + 1], r8b
shr ecx, 8
mov byte [rax + 2], cl
mov ecx, r8d
shr r8d, 0x18
and r8b, 1
shr ecx, 0x10
neg r8b
mov byte [rax + 3], cl
mov byte [rax + 4], r8b
mov eax, 5
add r11, rax
jmp 0x140026470
or r10d, 8
mov eax, 1
shr r10d, 1
add r11, rax
jmp 0x140026470
mov rdi, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
cmp rcx, 2
ja 0x1400265c2
shr r10d, cl
mov ebp, r10d
mov rsi, qword [rsp + 0x38]
mov rax, r11
mov dword [r12], ebp
mov rbp, qword [rsp + 0x30]
pop r15
pop r14
pop r12
ret
Function at 0x14002cb30
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov r11d, r8d
lea r9, [rcx + 0x10]
shr r11d, 2
mov edi, 1
mov eax, r11d
shr eax, 1
add eax, 3
mov dword [rcx], eax
test r11d, r11d
je 0x14002cb81
mov rcx, r9
mov r8d, r11d
nop dword [rax + rax]
mov eax, dword [rdx]
lea rdx, [rdx + 4]
mov dword [rcx], eax
lea rcx, [rcx + 4]
sub r8, rdi
jne 0x14002cb70
xor r10d, r10d
lea rsi, [r11 + 0xe]
lea rbx, [r11*4]
mov eax, dword [rbx + r9 - 4]
lea rsi, [r11 + rsi*2]
lea rsi, [r9 + rsi*4]
lea r14d, [r10 + 0x1b]
lea rbp, [0x14005afb0]
test r10d, r10d
jne 0x14002cbfc
mov r8d, eax
mov r10d, r11d
movzx eax, al
mov ecx, r8d
shr rcx, 0x18
movzx eax, byte [rax + rbp]
movzx ecx, byte [rcx + rbp]
shl eax, 8
or eax, ecx
mov ecx, r8d
shr rcx, 0x10
shl eax, 8
movzx edx, cl
shr r8, 8
movzx ecx, byte [rdx + rbp]
or eax, ecx
movzx ecx, r8b
shl eax, 8
movzx edx, byte [rcx + rbp]
xor edx, edi
add edi, edi
or eax, edx
bt edi, 8
cmovb edi, r14d
jmp 0x14002cc46
cmp r10d, 4
jne 0x14002cc46
cmp r11d, 6
jbe 0x14002cc46
mov r8d, eax
shr rax, 0x10
movzx ecx, al
movzx eax, byte [rcx + rbp]
mov ecx, r8d
shr rcx, 0x18
movzx ecx, byte [rcx + rbp]
shl ecx, 8
or eax, ecx
mov ecx, r8d
shr rcx, 8
movzx edx, cl
shl eax, 8
movzx ecx, byte [rdx + rbp]
or eax, ecx
movzx ecx, r8b
shl eax, 8
movzx edx, byte [rcx + rbp]
or eax, edx
xor eax, dword [r9]
dec r10d
mov dword [rbx + r9], eax
add r9, 4
cmp r9, rsi
jne 0x14002cba8
mov rbx, qword [rsp + 0x10]
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
pop r14
ret
Function at 0x1400340d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov r11, qword [rcx]
mov rbx, rcx
movabs rbp, 0x27d4eb2f165667c5
movabs rsi, 0xc2b2ae3d27d4eb4f
movabs rdi, 0x9e3779b185ebca87
movabs r14, 0x7a1435883d4d519d
cmp r11, 0x20
jb 0x1400341b6
mov rdx, qword [rcx + 8]
mov r10, qword [rcx + 0x20]
mov rax, rdx
mov r8, qword [rcx + 0x10]
mov r9, qword [rcx + 0x18]
rol rax, 1
mov rcx, r9
rol rcx, 0xc
add rcx, rax
mov rax, r8
rol rax, 7
add rcx, rax
mov rax, r10
imul rdx, rsi
imul r8, rsi
imul r9, rsi
imul r10, rsi
rol rax, 0x12
add rcx, rax
rol rdx, 0x1f
imul rdx, rdi
rol r8, 0x1f
movabs rax, 0x85ebca77c2b2ae63
xor rcx, rdx
rol r9, 0x1f
imul rcx, rdi
imul r8, rdi
imul r9, rdi
sub rcx, r14
rol r10, 0x1f
xor rcx, r8
imul rcx, rdi
imul r10, rdi
sub rcx, r14
xor rcx, r9
imul rcx, rdi
sub rcx, r14
xor rcx, r10
imul rcx, rdi
add rax, rcx
jmp 0x1400341bd
mov rax, qword [rcx + 0x18]
add rax, rbp
add rax, r11
lea r8, [rbx + 0x28]
and r11d, 0x1f
cmp r11, 8
jb 0x140034207
mov edx, r11d
shr rdx, 3
imul rcx, rdx, 0xfffffffffffffff8
add r11, rcx
nop dword [rax]
mov rcx, qword [r8]
add r8, 8
imul rcx, rsi
rol rcx, 0x1f
imul rcx, rdi
xor rax, rcx
rol rax, 0x1b
imul rax, rdi
sub rax, r14
sub rdx, 1
jne 0x1400341e0
movabs r9, 0x165667b19e3779f9
cmp r11, 4
jb 0x140034234
mov edx, dword [r8]
add r8, 4
imul rdx, rdi
xor rax, rdx
rol rax, 0x17
imul rax, rsi
add rax, r9
sub r11, 4
test r11, r11
je 0x14003425d
nop dword [rax]
movzx ecx, byte [r8]
lea r8, [r8 + 1]
imul rcx, rbp
xor rax, rcx
rol rax, 0xb
imul rax, rdi
sub r11, 1
jne 0x140034240
mov rbx, qword [rsp + 0x10]
mov rcx, rax
mov rbp, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x28]
shr rcx, 0x21
xor rcx, rax
imul rcx, rsi
mov rsi, qword [rsp + 0x20]
mov rdx, rcx
shr rdx, 0x1d
xor rdx, rcx
imul rdx, r9
mov rax, rdx
shr rax, 0x20
xor rax, rdx
pop r14
ret

Function at 0x14004389c
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov esi, edx
mov rbp, rcx
test r8, r8
jne 0x1400438d3
call fcn.140045f18
mov dword [rax], 0x16
call fcn.140045ddc
xor eax, eax
jmp 0x140043961
mov rdx, r9
mov rcx, r8
call fcn.140043838
mov rbx, rax
test rax, rax
je 0x14004395e
lea rax, [rsp + 0x50]
mov rdx, rsi
mov qword [rsp + 0x28], rax
lea r8, [0x140043764]
mov eax, dword [rsp + 0x60]
mov r9, rbx
mov rcx, rbp
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x14004394b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140045e8c
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x140043932
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x140043941
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
call fcn.140045940
jmp 0x14004395e
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14004395b
mov eax, dword [rsp + 0x50]
mov dword [rcx], eax
mov rdi, rdx
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x140043ec4
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140043cc0