joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7feeff4e17d
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov r14, rdx
mov rbx, rcx
call fcn.7feeff31066
mov rdi, rax
cmp qword [0x7fef003ef10], 0
je 0x7feeff4e20b
lea r8, [rsp + 0x28]
mov qword [r8], 0
mov rax, qword [0x7fef003ef20]
lea rcx, [rsp + 0x40]
mov qword [rcx + 0x10], rax
movups xmm0, xmmword [0x7fef003ef10]
movaps xmmword [rcx], xmm0
movups xmm0, xmmword [rbx]
lea rdx, [rsp + 0x30]
movaps xmmword [rdx], xmm0
call fcn.7feeff4e336
cmp byte [rdi], 0
jne 0x7feeff4e21a
mov rsi, rax
test rax, rax
js 0x7feeff4e246
mov rax, qword [0x7fef003ef18]
shl rsi, 5
lea rcx, [rax + rsi]
add rcx, 0x20
mov rdx, r14
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.7feeff4deda
mov ecx, 0x20
call fcn.7feeff4c98a
cmp byte [rdi], 0
je 0x7feeff4e227
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov qword [0x7fef003ef20], 0
lea rcx, [0x7fef003ef10]
mov rdx, rax
call fcn.7feeff4dc01
jmp 0x7feeff4e1a1
mov rcx, qword [0x7fef003ef10]
test rcx, rcx
je 0x7feeff4e2f6
xor ebp, ebp
mov rdx, qword [0x7fef003ef20]
call fcn.7feeff4e431
test bpl, bpl
jne 0x7feeff4e2b7
test al, al
je 0x7feeff4e2b7
call fcn.7feeff4e015
cmp byte [rdi], 0
jne 0x7feeff4e21a
mov r15, qword [rsp + 0x28]
mov rax, qword [0x7fef003ef20]
lea rcx, [rsp + 0x40]
mov qword [rcx + 0x10], rax
movups xmm0, xmmword [0x7fef003ef10]
movaps xmmword [rcx], xmm0
movups xmm0, xmmword [rbx]
lea rdx, [rsp + 0x30]
movaps xmmword [rdx], xmm0
mov r8, r15
call fcn.7feeff4e4b9
cmp byte [rdi], 0
jne 0x7feeff4e21a
mov rsi, rax
jmp 0x7feeff4e2c5
test bpl, bpl
jne 0x7feeff4e21a
mov r15, qword [rsp + 0x28]
not rsi
movups xmm0, xmmword [rbx]
lea rcx, [rsp + 0x40]
movaps xmmword [rcx], xmm0
mov rdx, r14
mov r8, r15
mov r9, rsi
call fcn.7feeff4ddec
cmp byte [rdi], 0
jne 0x7feeff4e21a
inc qword [0x7fef003ef20]
jmp 0x7feeff4e21a
mov ecx, 0x20
call fcn.7feeff4c98a
cmp byte [rdi], 0
jne 0x7feeff4e21a
mov qword [0x7fef003ef20], 0
lea rcx, [0x7fef003ef10]
mov rdx, rax
call fcn.7feeff4dc01
cmp byte [rdi], 0
setne bpl
mov rcx, qword [0x7fef003ef10]
jmp 0x7feeff4e258

Function at 0x7feeff4e6e0
Capabilities:
Terminate process

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov rcx, qword [rcx + 0x10]
call fcn.7feeff331b4
test al, al
je 0x7feeff4e711
mov rcx, qword [rsi + 0x10]
call fcn.7feeff3b6a6
mov rcx, qword [rsi + 0x10]
mov edx, 8
add rsp, 0x20
pop rsi
jmp fcn.7feeff31c2a
nop
add rsp, 0x20
pop rsi
ret
Function at 0x7feeff4e7d2
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
cmp qword [rcx], 0
jle 0x7feeff4e825
mov edi, 0x18
xor ebx, ebx
mov rax, qword [rsi + 8]
mov rcx, qword [rax + rdi]
call fcn.7feeff331b4
test al, al
je 0x7feeff4e819
mov rax, qword [rsi + 8]
mov rcx, qword [rax + rdi]
call fcn.7feeff3b6a6
mov rax, qword [rsi + 8]
mov rcx, qword [rax + rdi]
mov edx, 8
call fcn.7feeff31c2a
inc rbx
add rdi, 0x18
cmp rbx, qword [rsi]
jl 0x7feeff4e7e9
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x7feeff4e845
test byte [rcx + 7], 0x40
jne 0x7feeff4e845
mov edx, 8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.7feeff311a3
nop
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret

Function at 0x7feeff4f312
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
call fcn.7feeff31066
mov rdi, rax
mov rcx, qword [rsi + 0x10]
lea rdx, [0x7feeffe10a8]
call fcn.7feeff3ed00
test al, al
je 0x7feeff4f345
mov rcx, qword [rsi + 0x10]
call fcn.7feeff3b4bd
cmp byte [rdi], 0
je 0x7feeff4f34c
add rsp, 0x28
pop rdi
pop rsi
ret
mov rcx, qword [rsi + 0x10]
mov edx, 8
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.7feeff31c2a

Function at 0x7feeff4f360
Capabilities:
Terminate process

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rbx, rdx
mov rdi, rcx
call fcn.7feeff31066
mov r14, rax
movups xmm0, xmmword [rbx]
movups xmmword [rdi], xmm0
mov rsi, qword [rdi + 0x10]
mov rax, qword [rbx + 0x10]
mov qword [rdi + 0x10], rax
lea rdx, [0x7feeffe10a8]
mov rcx, rsi
call fcn.7feeff3ed00
test al, al
je 0x7feeff4f3aa
mov rcx, rsi
call fcn.7feeff3b4bd
cmp byte [r14], 0
je 0x7feeff4f3b4
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
mov edx, 8
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.7feeff31c2a

Function at 0x7feeff4f425
Capabilities:
Terminate process

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rbx, rdx
mov rdi, rcx
call fcn.7feeff31066
mov r14, rax
mov rsi, qword [rdi]
mov qword [rdi], rbx
mov rcx, rsi
call fcn.7feeff3b6d3
test al, al
je 0x7feeff4f45c
mov rcx, rsi
call fcn.7feeff3b4bd
cmp byte [r14], 0
je 0x7feeff4f466
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
mov edx, 8
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.7feeff31c2a

Function at 0x7feeff4f47c
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
call fcn.7feeff31066
cmp qword [rsi], 0
jle 0x7feeff4f4eb
mov r14, rax
mov edi, 0x18
xor ebx, ebx
lea r15, [0x7feeffe10a8]
mov rax, qword [rsi + 8]
mov rcx, qword [rax + rdi]
mov rdx, r15
call fcn.7feeff3ed00
test al, al
je 0x7feeff4f4df
mov rax, qword [rsi + 8]
mov rcx, qword [rax + rdi]
call fcn.7feeff3b4bd
cmp byte [r14], 0
jne 0x7feeff4f50f
mov rax, qword [rsi + 8]
mov rcx, qword [rax + rdi]
mov edx, 8
call fcn.7feeff31c2a
inc rbx
add rdi, 0x18
cmp rbx, qword [rsi]
jl 0x7feeff4f4a6
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x7feeff4f50f
test byte [rcx + 7], 0x40
jne 0x7feeff4f50f
mov edx, 8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.7feeff311a3
nop
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x7feeff5068a
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
call fcn.7feeff31066
mov rdi, rax
mov rcx, qword [rsi + 0x10]
lea rdx, [0x7feeffe3d48]
call fcn.7feeff3ed00
test al, al
je 0x7feeff506bd
mov rcx, qword [rsi + 0x10]
call fcn.7feeff3e9e4
cmp byte [rdi], 0
je 0x7feeff506c4
add rsp, 0x28
pop rdi
pop rsi
ret
mov rcx, qword [rsi + 0x10]
mov edx, 8
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.7feeff31c2a

Function at 0x7feeff506d8
Capabilities:
Terminate process

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rbx, rdx
mov rdi, rcx
call fcn.7feeff31066
mov r14, rax
movups xmm0, xmmword [rbx]
movups xmmword [rdi], xmm0
mov rsi, qword [rdi + 0x10]
mov rax, qword [rbx + 0x10]
mov qword [rdi + 0x10], rax
lea rdx, [0x7feeffe3d48]
mov rcx, rsi
call fcn.7feeff3ed00
test al, al
je 0x7feeff50722
mov rcx, rsi
call fcn.7feeff3e9e4
cmp byte [r14], 0
je 0x7feeff5072c
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
mov edx, 8
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.7feeff31c2a

Function at 0x7feeff507a5
Capabilities:
Terminate process

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rbx, rdx
mov rdi, rcx
call fcn.7feeff31066
mov r14, rax
mov rsi, qword [rdi]
mov qword [rdi], rbx
mov rcx, rsi
call fcn.7feeff3f141
test al, al
je 0x7feeff507dc
mov rcx, rsi
call fcn.7feeff3e9e4
cmp byte [r14], 0
je 0x7feeff507e6
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
mov edx, 8
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.7feeff31c2a
Function at 0x7feeff51f91
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x28
call fcn.7feeff31208
mov rdi, rax
call fcn.7feeff31066
mov rsi, rax
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x7feeff51fb5
call fcn.7feeff51fd9
cmp byte [rsi], 0
je 0x7feeff51fce
mov byte [rsi], 0
call fcn.7feeff45730
cmp byte [rsi], 0
je 0x7feeff51fce
add rsp, 0x28
pop rdi
pop rsi
ret
mov ecx, 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
int3

Function at 0x7feeff52179
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
call fcn.7feeff31066
mov rcx, rdi
mov rdx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp 0x7feeff5219b
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rdx, rdi
mov r8, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp 0x7feeff521c5
push rsi
sub rsp, 0x20
mov rax, rdx
mov rsi, rcx
mov edx, 1
mov rcx, rax
mov r9, rsi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rcx, rsi
add rsp, 0x20
pop rsi
jmp fcn.7feeffcd570

Function at 0x7feeff5219b
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
call fcn.7feeff31066
mov rcx, rdi
mov rdx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp 0x7feeff5219b
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rdx, rdi
mov r8, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp 0x7feeff521c5
push rsi
sub rsp, 0x20
mov rax, rdx
mov rsi, rcx
mov edx, 1
mov rcx, rax
mov r9, rsi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rcx, rsi
add rsp, 0x20
pop rsi
jmp fcn.7feeffcd570

Function at 0x7feeff521c5
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
call fcn.7feeff31066
mov rcx, rdi
mov rdx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp 0x7feeff5219b
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rdx, rdi
mov r8, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp 0x7feeff521c5
push rsi
sub rsp, 0x20
mov rax, rdx
mov rsi, rcx
mov edx, 1
mov rcx, rax
mov r9, rsi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rcx, rsi
add rsp, 0x20
pop rsi
jmp fcn.7feeffcd570

Function at 0x7feeff522ad
Capabilities:
Terminate process

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call fcn.7feeff34303
test al, al
je 0x7feeff522cb
mov rcx, rsi
add rsp, 0x20
pop rsi
jmp fcn.7feeff31be7
nop
add rsp, 0x20
pop rsi
ret

Function at 0x7feeff52986
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
call fcn.7feeff31066
mov rdi, rax
mov rcx, rsi
call fcn.7feeff34303
test al, al
je 0x7feeff529b0
mov rcx, rsi
call fcn.7feeff34340
cmp byte [rdi], 0
je 0x7feeff529b7
add rsp, 0x28
pop rdi
pop rsi
ret
mov edx, 8
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.7feeff31c2a
Function at 0x7feeff56611
Capabilities:
Terminate process

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
lea rdx, str.could_not_load:
mov rcx, rax
call fcn.7feeff31ada
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.7feeff4447a
mov rsi, rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rdx, rsi
call fcn.7feeff31ada
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xc1
jne 0x7feeff5667c
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
lea rdx, str._n_bad_format__library_may_be_wrong_architecture_
mov rcx, rax
call fcn.7feeff31ada
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
lea rdx, [0x7feeffd8c60]
mov rcx, rax
call fcn.7feeff31ada
mov ecx, 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
int3
Function at 0x7feeff569db
Capabilities:
Terminate process

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
lea rdx, str.could_not_import:
mov rcx, rax
call fcn.7feeff31ada
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rdx, rsi
call fcn.7feeff31ada
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
lea rdx, [0x7feeffd8c60]
mov rcx, rax
call fcn.7feeff31ada
mov ecx, 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
int3
Function at 0x7feeff592f3
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
movabs rdi, 0x4000000000000000
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x7feeff59319
test qword [rcx], rdi
jne 0x7feeff59319
call fcn.7feeff311e0
mov rcx, qword [rsi + 0x18]
test rcx, rcx
je 0x7feeff59332
test qword [rcx], rdi
jne 0x7feeff59332
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.7feeff311e0
nop
add rsp, 0x28
pop rdi
pop rsi
ret

Function at 0x7feeff5a5d4
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x90
mov rsi, r8
mov rbx, rdx
mov r14, rcx
call fcn.7feeff31066
mov r15, rax
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
lea rdi, [rsp + 0x58]
mov rcx, rdi
call fcn.7feeff5a125
movups xmm0, xmmword [rsi]
lea rcx, [rsp + 0x40]
movaps xmmword [rcx], xmm0
mov rdx, rdi
call fcn.7feeff59f39
cmp byte [r15], 0
je 0x7feeff5a654
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x7feeff5a644
test byte [rcx + 7], 0x40
jne 0x7feeff5a644
add rsp, 0x90
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.7feeff311e0
nop
add rsp, 0x90
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
movups xmm0, xmmword [rbx]
lea rdx, [rsp + 0x40]
movaps xmmword [rdx], xmm0
lea rcx, [rsp + 0x30]
call fcn.7feeff4498f
mov al, byte [rsp + 0x70]
test al, al
je 0x7feeff5a679
cmp al, 0x73
jne 0x7feeff5a74b
mov rbx, qword [rsp + 0x68]
cmp rbx, 0xffffffffffffffff
je 0x7feeff5a6cd
movaps xmm0, xmmword [rsp + 0x30]
lea rcx, [rsp + 0x40]
movaps xmmword [rcx], xmm0
call fcn.7feeff5a3ce
cmp byte [r15], 0
jne 0x7feeff5a621
cmp rbx, rax
jge 0x7feeff5a6cd
movaps xmm0, xmmword [rsp + 0x30]
lea rcx, [rsp + 0x40]
movaps xmmword [rcx], xmm0
mov rdx, rbx
call fcn.7feeff5a78f
cmp byte [r15], 0
jne 0x7feeff5a621
lea rcx, [rsp + 0x30]
mov rdx, rax
call fcn.7feeff43826
mov al, byte [rsp + 0x58]
mov r9b, byte [rsp + 0x59]
mov r8, qword [rsp + 0x60]
movaps xmm0, xmmword [rsp + 0x30]
lea rdx, [rsp + 0x80]
movaps xmmword [rdx], xmm0
mov byte [rsp + 0x20], al
lea rsi, [rsp + 0x40]
mov rcx, rsi
call fcn.7feeff5a13f
mov rbx, qword [rsi + 8]
cmp byte [r15], 0
jne 0x7feeff5a72b
lea rsi, [rsp + 0x40]
mov rdi, qword [rsi]
mov rcx, r14
mov rdx, rdi
call fcn.7feeff4164e
mov qword [rsi], rdi
mov qword [rsi + 8], rbx
mov rcx, r14
mov rdx, rsi
call fcn.7feeff416ee
test rbx, rbx
je 0x7feeff5a621
test byte [rbx + 7], 0x40
jne 0x7feeff5a621
mov rcx, rbx
call fcn.7feeff311e0
jmp 0x7feeff5a621
mov ecx, 0x40
mov edx, 8
call fcn.7feeff3fbf8
lea rcx, [0x7feeffd9d80]
mov qword [rax], rcx
lea rdx, str.ValueError
mov qword [rax + 0x10], rdx
movups xmm0, xmmword [0x7feeffcf150]
movups xmmword [rax + 0x18], xmm0
mov qword [rax + 8], 0
mov rcx, rax
call fcn.7feeff3fc31
jmp 0x7feeff5a621
Function at 0x7feeff5a881
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
mov r15, r8
mov rsi, rdx
mov r14, rcx
call fcn.7feeff31066
mov rdi, rax
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov rdx, rsi
call fcn.7feeff5a923
mov rsi, qword [rbx + 8]
cmp byte [rdi], 0
jne 0x7feeff5a8da
lea rdx, [rsp + 0x20]
mov rax, qword [rdx]
mov qword [rdx], rax
mov qword [rdx + 8], rsi
movups xmm0, xmmword [r15]
lea r8, [rsp + 0x30]
movaps xmmword [r8], xmm0
mov rcx, r14
call fcn.7feeff5a5d4
test rsi, rsi
je 0x7feeff5a904
mov rax, qword [rsi]
mov ecx, eax
not ecx
lea ecx, [rcx + rcx*2]
lea edx, [rax + rax]
add ecx, eax
inc ecx
xor ecx, edx
movabs rdx, 0x40000000fffffffe
xor rdx, rcx
test rax, rdx
je 0x7feeff5a910
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov rcx, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.7feeff311e0

Function at 0x7feeff5b391
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rdi, rdx
mov rsi, rcx
call fcn.7feeff31066
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
cmp qword [rdi], 0
je 0x7feeff5b44f
cmp byte [rax], 0
jne 0x7feeff5b459
mov rax, qword [rdi + 8]
mov cl, byte [rax + 8]
call fcn.7feeff59786
mov r14d, eax
movups xmm0, xmmword [rdi]
lea r15, [rsp + 0x20]
movaps xmmword [r15], xmm0
lea rdi, [rsp + 0x38]
mov r8d, 1
mov rcx, rdi
mov rdx, r15
call fcn.7feeff5b466
mov rbx, qword [rdi]
mov rdi, qword [rdi + 8]
lea rdx, [rbx + 1]
lea rbp, [rsp + 0x38]
mov rcx, rbp
call fcn.7feeff41973
mov rcx, rbp
mov edx, r14d
call fcn.7feeff5b486
mov qword [r15], rbx
mov qword [r15 + 8], rdi
lea rdx, [rsp + 0x20]
mov rcx, rbp
call fcn.7feeff416ee
movups xmm0, xmmword [rbp]
movups xmmword [rsi], xmm0
test rdi, rdi
je 0x7feeff5b459
test byte [rdi + 7], 0x40
jne 0x7feeff5b459
mov rcx, rdi
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.7feeff311e0
movups xmm0, xmmword [0x7feeffcf170]
movups xmmword [rsi], xmm0
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x7feeff5b72b
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rsi, rdx
mov r12, rcx
call fcn.7feeff31066
mov qword [r12], 0
mov edx, 0x10
mov r8d, 8
xor ecx, ecx
call fcn.7feeff3fef8
mov qword [r12 + 8], rax
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
mov rax, qword [rsi]
test rax, rax
js 0x7feeff5b878
mov r14d, 2
xor r8d, r8d
lea r13, [rsp + 0x20]
lea r15, [0x7feeffd24d0]
cmp rax, r8
mov rcx, r8
cmovg rcx, rax
lea rbp, [r8 - 1]
mov rdx, rcx
neg rdx
lea rbx, [rdx + rbp]
cmp rbx, 0xffffffffffffffff
je 0x7feeff5b7d3
mov rbx, qword [rsi + 8]
movzx edi, byte [rbx + rbp + 9]
mov rbx, rdi
shr rbx, 3
movzx ebx, byte [rbx + r15]
and dil, 7
movzx edi, dil
inc rbp
bt ebx, edi
jae 0x7feeff5b7a2
jmp 0x7feeff5b7d6
mov rbp, rcx
mov rbx, r14
sub rbx, 1
cmovb rbp, rax
lea r9, [rbp - 1]
movups xmm0, xmmword [rsi]
movaps xmmword [rsp + 0x40], xmm0
mov rcx, r13
lea rdx, [rsp + 0x40]
call fcn.7feeff5936d
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rsp + 0x20], xmm0
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov rdx, r13
call fcn.7feeff4172d
movaps xmm0, xmmword [rsp + 0x30]
movaps xmmword [rsp + 0x50], xmm0
mov rcx, rdi
call fcn.7feeff3fc2a
movaps xmm0, xmmword [rsp + 0x50]
movaps xmmword [rsp + 0x20], xmm0
mov rcx, r12
mov rdx, r13
call fcn.7feeff56419
test r14, r14
je 0x7feeff5b853
lea r8, [rbp + 1]
mov rax, qword [rsi]
mov r14, rbx
cmp rbp, rax
jl 0x7feeff5b78e
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x7feeff5b878
test byte [rcx + 7], 0x40
jne 0x7feeff5b878
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.7feeff311e0
nop
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x7feeff5bc04
Capabilities:
Encode data using xor

Disassembly:
test rcx, rcx
jle 0x7feeff5bc39
xor r8d, r8d
xor eax, eax
movzx r9d, byte [rdx + r8 + 8]
add r9, rax
mov r10, r9
shl r10, 0xa
add r10, r9
mov rax, r10
shr rax, 6
xor rax, r10
inc r8
cmp rcx, r8
jne 0x7feeff5bc0e
lea rax, [rax + rax*8]
jmp 0x7feeff5bc3b
xor eax, eax
mov rcx, rax
shr rcx, 0xb
xor rcx, rax
mov rax, rcx
shl rax, 0xf
add rax, rcx
ret

Function at 0x7feeff6086d
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
call fcn.7feeff31066
mov rdi, rax
mov rcx, rsi
call fcn.7feeff3d96b
test al, al
je 0x7feeff60897
mov rcx, rsi
call fcn.7feeff3d9bc
cmp byte [rdi], 0
je 0x7feeff6089e
add rsp, 0x28
pop rdi
pop rsi
ret
mov edx, 8
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.7feeff31c2a
Function at 0x7feeff60ee3
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
movabs rdi, 0x4000000000000000
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x7feeff60f09
test qword [rcx], rdi
jne 0x7feeff60f09
call fcn.7feeff311e0
mov rcx, qword [rsi + 0x18]
test rcx, rcx
je 0x7feeff60f1c
test qword [rcx], rdi
jne 0x7feeff60f1c
call fcn.7feeff311e0
mov rcx, qword [rsi + 0x28]
test rcx, rcx
je 0x7feeff60f2f
test qword [rcx], rdi
jne 0x7feeff60f2f
call fcn.7feeff311e0
mov rcx, qword [rsi + 0x38]
test rcx, rcx
je 0x7feeff60f42
test qword [rcx], rdi
jne 0x7feeff60f42
call fcn.7feeff311e0
mov rcx, qword [rsi + 0x48]
test rcx, rcx
je 0x7feeff60f55
test qword [rcx], rdi
jne 0x7feeff60f55
call fcn.7feeff311e0
mov rcx, qword [rsi + 0x58]
test rcx, rcx
je 0x7feeff60f68
test qword [rcx], rdi
jne 0x7feeff60f68
call fcn.7feeff311e0
mov rcx, qword [rsi + 0x68]
test rcx, rcx
je 0x7feeff60f7b
test qword [rcx], rdi
jne 0x7feeff60f7b
call fcn.7feeff311e0
mov rcx, qword [rsi + 0x78]
test rcx, rcx
je 0x7feeff60f94
test qword [rcx], rdi
jne 0x7feeff60f94
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.7feeff311e0
nop
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x7feeff619cb
Capabilities:
Terminate process

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rsi, rcx
call fcn.7feeff31066
mov rbx, qword [rsi]
test rbx, rbx
je 0x7feeff61a02
mov r14, rax
mov rax, qword [rsi + 8]
lea rcx, [rax + 8]
test rax, rax
cmove rcx, rax
mov rdx, rbx
call fcn.7feeff610a5
test al, al
je 0x7feeff61a4a
mov ecx, 0x48
mov edx, 8
call fcn.7feeff3fbf8
lea rcx, [0x7feeffd9dd0]
mov qword [rax], rcx
lea rdx, str.OSError
mov qword [rax + 0x10], rdx
movups xmm0, xmmword [0x7feeffcf710]
movups xmmword [rax + 0x18], xmm0
mov qword [rax + 8], 0
mov rcx, rax
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.7feeff3fc31
inc rbx
lea rdi, [rsp + 0x38]
mov rcx, rdi
mov rdx, rbx
call fcn.7feeff41973
movups xmm0, xmmword [rsi]
lea rbx, [rsp + 0x20]
movaps xmmword [rbx], xmm0
mov rcx, rdi
mov rdx, rbx
call fcn.7feeff416ee
movups xmm0, xmmword [0x7feeffcf720]
movaps xmmword [rbx], xmm0
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.7feeff416ee
mov rcx, qword [rdi]
mov rbx, qword [rdi + 8]
mov rdx, rbx
call fcn.7feeff4447a
mov rcx, rax
call sub.api_ms_win_crt_environment_l1_1_0.dll__putenv
test eax, eax
je 0x7feeff61ac2
call fcn.7feeff41400
cmp byte [r14], 0
jne 0x7feeff61ac2
movups xmm0, xmmword [rsi]
lea rdx, [rsp + 0x20]
movaps xmmword [rdx], xmm0
mov ecx, eax
call fcn.7feeff41407
test rbx, rbx
je 0x7feeff61ade
test byte [rbx + 7], 0x40
jne 0x7feeff61ade
mov rcx, rbx
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.7feeff311e0
nop
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x7feeff61bb1
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rdi, rdx
mov rsi, rcx
lea rbx, [rsp + 0x20]
mov edx, 0x18
mov rcx, rbx
call fcn.7feeff318bc
mov rax, qword [rsi + 0x10]
mov qword [rbx + 0x10], rax
movups xmm0, xmmword [rsi]
movaps xmmword [rbx], xmm0
mov edx, 0x18
mov rcx, rsi
call fcn.7feeff318bc
mov al, byte [rdi]
mov byte [rsi], al
cmp al, 1
je 0x7feeff61c0f
test al, al
jne 0x7feeff61c3b
mov rbx, qword [rsi + 0x10]
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x7feeff61c19
call fcn.7feeff42188
mov rax, qword [rdi + 0x10]
jmp 0x7feeff61c1b
mov rax, qword [rdi + 8]
mov qword [rsi + 8], rax
jmp 0x7feeff61c3b
xor eax, eax
mov qword [rsi + 0x10], rax
mov rax, qword [rdi + 8]
mov qword [rsi + 8], rax
mov rcx, rbx
call fcn.7feeff32cdd
test al, al
je 0x7feeff61c3b
mov rcx, rbx
call fcn.7feeff31be7
cmp byte [rsp + 0x20], 0
jne 0x7feeff61c62
mov rsi, qword [rsp + 0x30]
mov rcx, rsi
call fcn.7feeff32cdd
test al, al
je 0x7feeff61c62
mov rcx, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
jmp fcn.7feeff31be7
nop
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret

Function at 0x7feeff61c6b
Capabilities:
Terminate process

Disassembly:
push rsi
sub rsp, 0x20
cmp byte [rcx], 0
jne 0x7feeff61c93
mov rsi, rcx
mov rcx, qword [rcx + 0x10]
call fcn.7feeff32cdd
test al, al
je 0x7feeff61c93
mov rcx, qword [rsi + 0x10]
add rsp, 0x20
pop rsi
jmp fcn.7feeff31be7
nop
add rsp, 0x20
pop rsi
ret