joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000e280
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x88
movdqa xmmword [rsp + 0x70], xmm13
movdqa xmmword [rsp + 0x60], xmm12
movdqa xmmword [rsp + 0x50], xmm11
movdqa xmmword [rsp + 0x40], xmm10
movdqa xmmword [rsp + 0x30], xmm9
movdqa xmmword [rsp + 0x20], xmm8
movdqa xmmword [rsp + 0x10], xmm7
movdqa xmmword [rsp], xmm6
movdqu xmm4, xmmword [rcx]
movdqu xmm3, xmmword [rcx + 0x10]
movdqu xmm2, xmmword [rcx + 0x20]
movdqu xmm1, xmmword [rcx + 0x30]
movd xmm0, r8d
pxor xmm0, xmm4
lea r8, [rdx - 0x40]
mov r9d, 0x40
lea r11, [rcx + r9]
cmp r8, r9
jb 0x14000e3ce
add rdx, 0xffffffffffffff80
mov r9, rdx
and r9, 0xffffffffffffffc0
lea r10, [r9 + 0x80]
movabs rax, 0x154442bd4
movq xmm9, rax
movdqa xmm8, xmmword [0x1401ffbc0]
movdqa xmm6, xmm0
pclmulqdq xmm6, xmm9, 0
movdqa xmm12, xmm3
pclmulqdq xmm12, xmm9, 0
movdqa xmm11, xmm2
pclmulqdq xmm11, xmm9, 0
movdqa xmm10, xmm1
pclmulqdq xmm10, xmm9, 0
movdqa xmm4, xmm0
pclmulqdq xmm4, xmm8, 0x11
movdqa xmm5, xmm3
pclmulqdq xmm5, xmm8, 0x11
movdqa xmm7, xmm2
pclmulqdq xmm7, xmm8, 0x11
movdqa xmm13, xmm1
pclmulqdq xmm13, xmm8, 0x11
movdqu xmm0, xmmword [r11]
pxor xmm0, xmm6
pxor xmm0, xmm4
movdqu xmm3, xmmword [r11 + 0x10]
pxor xmm3, xmm12
pxor xmm3, xmm5
movdqu xmm2, xmmword [r11 + 0x20]
pxor xmm2, xmm11
pxor xmm2, xmm7
movdqu xmm1, xmmword [r11 + 0x30]
pxor xmm1, xmm10
pxor xmm1, xmm13
add r8, 0xffffffffffffffc0
add r11, 0x40
cmp r8, 0x3f
ja 0x14000e319
sub rdx, r9
add rcx, r10
mov r8, rdx
mov r11, rcx
movabs rax, 0x1751997d0
movq xmm4, rax
movdqa xmm5, xmm0
pclmulqdq xmm5, xmm4, 0
pxor xmm5, xmm3
movdqa xmm3, xmmword [0x1401ffbd0]
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm5
movdqa xmm5, xmm0
pclmulqdq xmm5, xmm4, 0
pxor xmm5, xmm2
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm5
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm2
cmp r8, 0x10
jb 0x14000e45e
movdqu xmm1, xmmword [r11]
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm1
pxor xmm0, xmm2
add r11, 0x10
add r8, 0xfffffffffffffff0
cmp r8, 0xf
ja 0x14000e433
movdqa xmm1, xmmword [0x1401ffbd0]
pclmulqdq xmm1, xmm0, 1
psrldq xmm0, 8
pxor xmm0, xmm1
pmovzxdq xmm1, xmm0
psrldq xmm0, 4
movabs rax, 0x163cd6124
movq xmm2, rax
pclmulqdq xmm2, xmm1, 0
pxor xmm2, xmm0
pmovzxdq xmm0, xmm2
pclmulqdq xmm0, xmmword [0x1401ffbe0], 0x10
pmovzxdq xmm0, xmm0
movabs rax, 0x1db710641
movq xmm1, rax
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
pextrd eax, xmm1, 1
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
movaps xmm11, xmmword [rsp + 0x50]
movaps xmm12, xmmword [rsp + 0x60]
movaps xmm13, xmmword [rsp + 0x70]
add rsp, 0x88
ret

Function at 0x140013b4e
Capabilities:
Move file

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
lea rdi, [rcx + 0x28]
mov rcx, rdi
mov dl, 1
call fcn.140079f50
test al, al
jne 0x140013b71
mov rcx, rdi
call fcn.14007a380
add rsi, 0x40
mov rcx, rsi
xor edx, edx
call fcn.140079f50
test al, al
je 0x140013b8a
add rsp, 0x28
pop rdi
pop rsi
ret
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.14007a380
Function at 0x14001ecc8
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rdx
mov ebx, ecx
mov rax, qword [0x140267e38]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r8d, 0x20
call fcn.1401de124
mov edi, 6
cmp eax, 0x20
jne 0x14001ed8c
mov ecx, dword [rsi + 8]
mov rdi, qword [sym.imp.WS2_32.dll_ntohl]
call rdi
mov dword [rsi + 8], eax
mov ecx, dword [rsi + 0xc]
call rdi
mov dword [rsi + 0xc], eax
mov ecx, dword [rsi + 0x10]
call rdi
mov dword [rsi + 0x10], eax
mov ecx, dword [rsi + 0x14]
call rdi
mov dword [rsi + 0x14], eax
mov ecx, dword [rsi + 0x18]
call rdi
mov dword [rsi + 0x18], eax
mov ecx, dword [rsi + 0x1c]
call rdi
mov dword [rsi + 0x1c], eax
lea rdx, [rsp + 0x28]
mov ecx, ebx
call fcn.1401dad7c
mov edi, 6
test eax, eax
jne 0x14001ed8c
movabs rax, 0x303146464944424d
mov edi, 8
cmp qword [rsi], rax
jne 0x14001ed8c
movsxd rax, dword [rsp + 0x3c]
cmp rax, 0x20
jb 0x14001ed8c
add rax, 0xffffffffffffffe0
mov ecx, dword [rsi + 0x14]
sub rax, rcx
jb 0x14001ed8c
mov ecx, dword [rsi + 0x18]
sub rax, rcx
jb 0x14001ed8c
mov ecx, dword [rsi + 0x1c]
cmp rax, rcx
jb 0x14001ed8c
setne al
movzx edi, al
shl edi, 3
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1401ca2e0
mov eax, edi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
Function at 0x14001eda3
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov r15d, r9d
mov r12, r8
mov ebx, edx
mov rdi, rcx
mov r13d, dword [rcx + 8]
mov ebp, dword [rcx + 0x18]
add ebp, dword [rcx + 0x14]
add ebp, dword [rcx + 0x1c]
mov rcx, rbp
call case.0x1400f5a1c.1
test rax, rax
je 0x14001ee07
mov r14, rax
add r13, r12
mov rsi, rax
test ebp, ebp
je 0x14001ee0e
mov ecx, ebx
mov rdx, rsi
mov r8d, ebp
call fcn.1401de124
test eax, eax
js 0x14001ee29
sub ebp, eax
mov ecx, eax
add rsi, rcx
test eax, eax
jne 0x14001ede1
test ebp, ebp
je 0x14001ede1
jmp 0x14001ee22
mov ebx, 1
jmp 0x14001ee36
mov eax, dword [rdi + 0x14]
imul ecx, eax, 0xaaaaaaab
ror ecx, 2
cmp ecx, 0x15555555
jbe 0x14001ee49
mov ebx, 8
jmp 0x14001ee2e
mov ebx, 6
mov rcx, r14
call case.0x1400f5a1c.0
mov eax, ebx
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
test eax, eax
je 0x14001ef89
mov dword [rsp + 0x24], r15d
mov rbp, r14
add rbp, rax
mov eax, dword [rdi + 0x18]
add rax, rbp
mov ecx, dword [rdi + 0x1c]
add rcx, rax
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], r12
mov r15, r12
mov qword [rsp + 0x40], rax
mov rdi, rax
mov qword [rsp + 0x28], rbp
mov r12, r14
mov ecx, dword [r12]
mov rax, qword [sym.imp.WS2_32.dll_ntohl]
mov rsi, rax
call rax
mov dword [r12], eax
mov ecx, dword [r12 + 4]
call rsi
mov dword [r12 + 4], eax
mov ecx, dword [r12 + 8]
call rsi
mov dword [r12 + 8], eax
mov eax, dword [r12]
mov rcx, r13
sub rcx, r15
cmp rcx, rax
jb 0x14001ee22
mov rcx, qword [rsp + 0x40]
sub rcx, rbp
cmp rcx, rax
jb 0x14001ee22
test eax, eax
je 0x14001eef1
xor eax, eax
mov cl, byte [r15 + rax]
add byte [rbp + rax], cl
inc rax
mov r8d, dword [r12]
cmp rax, r8
jb 0x14001eedb
jmp 0x14001eef4
xor r8d, r8d
mov ecx, dword [rsp + 0x24]
mov rdx, rbp
call fcn.1401e2050
mov ebx, 7
cmp eax, dword [r12]
jne 0x14001ee2e
mov esi, eax
mov r8d, dword [r12 + 4]
mov rax, qword [rsp + 0x38]
sub rax, rdi
cmp rax, r8
jb 0x14001ee22
mov ecx, dword [rsp + 0x24]
mov rdx, rdi
call fcn.1401e2050
cmp eax, dword [r12 + 4]
jne 0x14001ee2e
mov edx, esi
add r15, rdx
movsxd rcx, dword [r12 + 8]
mov rbx, qword [rsp + 0x30]
sub rbx, r15
cmp rbx, rcx
jg 0x14001ee22
mov rbx, r13
sub rbx, r15
cmp rbx, rcx
jl 0x14001ee22
add rbp, rdx
mov eax, eax
add rdi, rax
add r15, rcx
add r12, 0xc
xor ebx, ebx
cmp r12, qword [rsp + 0x28]
jb 0x14001ee85
jmp 0x14001ee2e
xor ebx, ebx
jmp 0x14001ee2e
Function at 0x14001ef90
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov r15, r8
mov rbp, rcx
mov rax, qword [0x140267e38]
xor rax, rsp
mov qword [rsp + 0x90], rax
lea rbx, [rsp + 0x38]
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x28], 0
xor esi, esi
mov rcx, rdx
mov edx, 0x8000
mov r8d, 0x40
xor r9d, r9d
call fcn.1401e2cac
cmp eax, 1
sbb esi, esi
not esi
or esi, dword [rbx]
js 0x14001f015
lea rdx, [rsp + 0x70]
mov ecx, esi
call fcn.14001ecc8
mov r12d, 0xffffffff
xor r14d, r14d
test eax, eax
je 0x14001f01f
mov edi, eax
mov ebx, 0xffffffff
jmp 0x14001f13e
mov edi, 6
jmp 0x14001f165
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x28], 0
mov rcx, rbp
mov edx, 0x8000
mov r8d, 0x40
xor r9d, r9d
call fcn.1401e2cac
mov ebx, dword [rsp + 0x38]
cmp eax, 1
mov ebp, 0
sbb ebp, ebp
not ebp
or ebp, ebx
js 0x14001f126
lea rdx, [rsp + 0x38]
mov ecx, ebp
call fcn.1401dad7c
mov r12d, 0xffffffff
mov edi, 6
test eax, eax
jne 0x14001f13b
mov r13d, dword [rsp + 0x4c]
cmp r13d, dword [rsp + 0x78]
jne 0x14001f12f
mov rcx, r13
call case.0x1400f5a1c.1
test rax, rax
je 0x14001f136
mov r14, rax
mov ecx, ebp
mov rdx, rax
mov r8d, r13d
call fcn.1401de124
cmp eax, dword [rsp + 0x78]
jne 0x14001f13e
mov ebp, eax
call fcn.1400aee5f
movsxd rdx, ebp
mov rcx, r14
call fcn.1400aee3c
not eax
cmp dword [rsp + 0x7c], eax
jne 0x14001f18b
lea r12, [rsp + 0x6c]
mov qword [rsp + 0x20], r12
mov dword [rsp + 0x28], 0
xor ebp, ebp
mov rcx, r15
mov edx, 0x8301
mov r8d, 0x40
xor r9d, r9d
call fcn.1401e2cac
mov r12d, dword [r12]
cmp eax, 1
sbb ebp, ebp
not ebp
or ebp, r12d
js 0x14001f192
lea rcx, [rsp + 0x70]
mov edx, esi
mov r8, r14
mov r9d, ebp
call fcn.14001eda3
mov edi, eax
jmp 0x14001f13e
mov edi, 6
mov ebx, ebp
jmp 0x14001f13e
mov edi, 8
jmp 0x14001f13b
mov edi, 1
xor r14d, r14d
mov rcx, r14
call case.0x1400f5a1c.0
mov ecx, esi
call fcn.1401d7e44
test ebx, ebx
js 0x14001f158
mov ecx, ebx
call fcn.1401d7e44
test r12d, r12d
js 0x14001f165
mov ecx, r12d
call fcn.1401d7e44
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1401ca2e0
mov eax, edi
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov edi, 4
jmp 0x14001f13e
mov r12d, ebp
jmp 0x14001f13e
Function at 0x140024210
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor edx, edx
jmp 0x140024328
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov ebx, edx
mov rsi, rcx
mov rax, qword [0x140267e38]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp byte [rcx + 0x5e], 0
je 0x14002436d
movzx edi, word [rsi + 0x5c]
test bl, bl
je 0x140024472
mov word [rsi + 0x5c], 0xffff
mov byte [rsi + 0x5e], 0
jmp 0x140024472
mov eax, dword [rsi + 0x58]
test eax, eax
mov edi, 1
cmovg edi, eax
xor ebp, ebp
mov rcx, qword [rsi + 0x40]
call fcn.1401e6058
cmp eax, 0xffffffff
je 0x14002446e
mov byte [rsp + rbp + 0x58], al
inc rbp
cmp rbp, rdi
jb 0x14002437c
cmp byte [rsi + 0x5f], 0
je 0x1400243c0
movsx eax, byte [rsp + 0x58]
mov word [rsp + 0x56], ax
test bl, bl
je 0x140024432
movzx edi, word [rsp + 0x56]
mov word [rsi + 0x5c], di
jmp 0x140024472
lea r13, [rsp + 0x56]
lea r12, [rsp + 0x48]
lea r14, [rsp + 0x58]
mov rcx, qword [rsi + 0x48]
mov rdx, qword [rsi + 0x50]
mov r15, qword [rdx]
lea r9, [rsp + rdi]
add r9, 0x58
mov rax, qword [rcx]
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r12
mov r8, r14
call qword [rax + 0x18]
cmp eax, 1
jne 0x14002445b
mov rax, qword [rsi + 0x50]
mov qword [rax], r15
cmp rdi, 8
je 0x14002446e
mov rcx, qword [rsi + 0x40]
call fcn.1401e6058
cmp eax, 0xffffffff
je 0x14002446e
mov byte [rsp + rdi + 0x58], al
inc rdi
jmp 0x1400243cf
mov edi, edi
test rdi, rdi
jle 0x140024454
mov rdx, qword [rsi + 0x40]
movsx eax, byte [rsp + rdi + 0x57]
dec rdi
movzx ecx, ax
call fcn.1401eb9c4
cmp eax, 0xffffffff
jne 0x140024434
jmp 0x14002446e
movzx edi, word [rsp + 0x56]
jmp 0x140024472
cmp eax, 2
je 0x14002446e
cmp eax, 3
je 0x1400243a0
jmp 0x1400243aa
mov di, 0xffff
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1401ca2e0
mov eax, edi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x1400244e0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov rsi, rcx
mov rax, qword [0x140267e38]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea r14, [rsp + 0x38]
lea r12, [rsp + 0x28]
lea r15, [rsp + 0x30]
mov ebp, 0xffffffff
mov rcx, qword [rsi + 0x48]
mov rdx, qword [rsi + 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x20], r12
mov r8, r15
mov r9, r14
call qword [rax + 0x20]
mov edi, eax
mov rbx, qword [rsp + 0x28]
sub rbx, r15
mov r9, qword [rsi + 0x40]
mov edx, 1
mov rcx, r15
mov r8, rbx
call fcn.1401e5c7c
cmp rax, rbx
jne 0x140024567
cmp edi, 1
je 0x140024514
cmp edi, 2
je 0x140024567
mov rcx, qword [rsi + 0x40]
call fcn.1401e52f8
neg eax
sbb ebp, ebp
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1401ca2e0
mov eax, ebp
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x140024590
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r8
mov r14, rdx
mov rdi, rcx
cmp byte [rcx + 0x58], 0
je 0x1400245c5
mov r9, qword [rdi + 0x40]
mov edx, 1
mov rcx, r14
mov r8, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.1401e5c7c
xor ebx, ebx
test rsi, rsi
jle 0x1400245ea
movzx edx, byte [r14 + rbx]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x60]
cmp eax, 0xffffffff
je 0x1400245ea
inc rbx
cmp rsi, rbx
jne 0x1400245cc
mov rbx, rsi
mov rax, rbx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x140024600
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov r15d, edx
mov rax, qword [0x140267e38]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp edx, 0xffffffff
je 0x14002465d
mov rdi, rcx
mov byte [rsp + 0x57], r15b
cmp byte [rcx + 0x58], 0
je 0x14002466c
mov r9, qword [rdi + 0x40]
lea rcx, [rsp + 0x57]
mov edx, 1
mov r8d, 1
call fcn.1401e5c7c
mov esi, 0xffffffff
cmp rax, 1
jne 0x14002471c
xor esi, esi
cmp r15d, 0xffffffff
cmovne esi, r15d
jmp 0x14002471c
lea rbx, [rsp + 0x58]
lea r12, [rsp + 0x48]
mov qword [r12], rbx
lea rsi, [rsp + 0x57]
lea r13, [rsp + 0x60]
lea r14, [rsp + 0x40]
mov rcx, qword [rdi + 0x48]
mov rdx, qword [rdi + 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r14
mov r8, rsi
lea r9, [rsp + 0x58]
call qword [rax + 0x10]
cmp qword [rsp + 0x40], rsi
je 0x140024717
mov ebp, eax
cmp eax, 3
je 0x1400246f6
cmp ebp, 1
ja 0x140024717
mov rsi, qword [rsp + 0x48]
sub rsi, rbx
mov r9, qword [rdi + 0x40]
mov edx, 1
mov rcx, rbx
mov r8, rsi
call fcn.1401e5c7c
cmp rax, rsi
jne 0x140024717
mov rsi, qword [rsp + 0x40]
cmp ebp, 1
je 0x140024689
jmp 0x14002465d
mov r9, qword [rdi + 0x40]
mov edx, 1
mov r8d, 1
mov rcx, rsi
call fcn.1401e5c7c
cmp rax, 1
je 0x14002465d
mov esi, 0xffffffff
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1401ca2e0
mov eax, esi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140024780
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r8
mov r14, rdx
mov rdi, rcx
cmp byte [rcx + 0x58], 0
je 0x1400247b5
mov r9, qword [rdi + 0x40]
mov edx, 2
mov rcx, r14
mov r8, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.1401e5c7c
xor ebx, ebx
test rsi, rsi
jle 0x1400247db
movzx edx, word [r14 + rbx*2]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x60]
cmp ax, 0xffff
je 0x1400247db
inc rbx
cmp rsi, rbx
jne 0x1400247bc
mov rbx, rsi
mov rax, rbx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1400247f0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov esi, edx
mov rax, qword [0x140267e38]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp dx, 0xffff
je 0x14002484c
mov rdi, rcx
mov word [rsp + 0x56], si
cmp byte [rcx + 0x58], 0
je 0x14002485c
mov r9, qword [rdi + 0x40]
lea rcx, [rsp + 0x56]
mov edx, 2
mov r8d, 1
call fcn.1401e5c7c
mov di, 0xffff
cmp rax, 1
jne 0x14002490b
xor eax, eax
cmp si, 0xffff
cmove esi, eax
mov edi, esi
jmp 0x14002490b
lea r15, [rsp + 0x58]
lea r12, [rsp + 0x48]
mov qword [r12], r15
lea rbx, [rsp + 0x56]
lea r13, [rsp + 0x60]
lea r14, [rsp + 0x40]
mov rcx, qword [rdi + 0x48]
mov rdx, qword [rdi + 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r14
mov r8, rbx
lea r9, [rsp + 0x58]
call qword [rax + 0x10]
cmp qword [rsp + 0x40], rbx
je 0x140024907
mov ebp, eax
cmp eax, 3
je 0x1400248e6
cmp ebp, 1
ja 0x140024907
mov rbx, qword [rsp + 0x48]
sub rbx, r15
mov r9, qword [rdi + 0x40]
mov edx, 1
mov rcx, r15
mov r8, rbx
call fcn.1401e5c7c
cmp rax, rbx
jne 0x140024907
mov rbx, qword [rsp + 0x40]
cmp ebp, 1
je 0x140024879
jmp 0x14002484c
mov r9, qword [rdi + 0x40]
mov edx, 1
mov r8d, 1
mov rcx, rbx
call fcn.1401e5c7c
cmp rax, 1
je 0x14002484c
mov di, 0xffff
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1401ca2e0
mov eax, edi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140028ec0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp rdx, r8
je 0x140028ef7
movabs r9, 0xf000000000000000
shl rax, 4
movsx r10, byte [rdx]
add r10, rax
mov rcx, r10
and rcx, r9
mov rax, rcx
shr rax, 0x38
or rax, rcx
xor rax, r10
inc rdx
cmp r8, rdx
jne 0x140028ed1
ret

Function at 0x140029010
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp rdx, r8
je 0x140029048
movabs r9, 0xf000000000000000
shl rax, 4
movzx r10d, word [rdx]
add r10, rax
mov rcx, r10
and rcx, r9
mov rax, rcx
shr rax, 0x38
or rax, rcx
xor rax, r10
add rdx, 2
cmp r8, rdx
jne 0x140029021
ret
Function at 0x14005213f
Capabilities:
Get session information

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rcx
mov rax, qword [0x140267e38]
xor rax, rsp
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
cmp eax, 0xffffffff
je 0x14005220d
lea r9, [rsp + 0x50]
mov qword [r9], 0
lea rcx, [rsp + 0x4c]
mov dword [rcx], 0
mov qword [rsp + 0x20], rcx
xor ecx, ecx
mov edx, eax
mov r8d, 0x18
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x14005220d
mov rbx, qword [rsp + 0x50]
mov ecx, 0x30
call fcn.1401c9f10
mov rdi, rax
lea rdx, [0x140052c70]
lea r8, [0x14000c300]
mov rcx, rax
call fcn.140057270
lea rax, [0x1401fc800]
mov qword [rdi + 0x20], rax
mov qword [rdi + 0x28], rbx
lea rbx, [rsp + 0x30]
mov qword [rbx], rdi
lea rdi, [rsp + 0x38]
mov rcx, rdi
mov rdx, rbx
call fcn.1400572c0
mov rcx, rbx
call fcn.140057300
lea rcx, [rsp + 0x40]
mov rdx, rdi
call fcn.1400b8780
cmp dword [rsp + 0x4c], 0xd7
ja 0x140052216
mov qword [rsi], 0
jmp 0x140052253
mov qword [rsi], 0
jmp 0x14005225d
mov rdx, qword [rsp + 0x50]
mov ecx, dword [rdx + 0xc8]
mov eax, dword [rdx + 0xcc]
cmp qword [rdx + 0xc8], 0
jne 0x140052242
cmp dword [rdx], 1
jne 0x140052242
mov ecx, dword [rdx + 0xb0]
mov eax, dword [rdx + 0xb4]
shl rax, 0x20
mov edx, ecx
or rdx, rax
mov rcx, rsi
call fcn.140085a60
lea rcx, [rsp + 0x40]
call fcn.1400b87b0
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1401ca2e0
mov rax, rsi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
Function at 0x14005466b
Capabilities:
Create process on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x2d8
mov rdi, rdx
mov rax, qword [0x140267e38]
xor rax, rsp
mov qword [rsp + 0x2d0], rax
add rcx, 8
lea rdx, str.msedge.exe
mov qword [rsp + 0x2a8], rdx
cmp word [str.msedge.exe], 0
je 0x1400546b9
xor eax, eax
cmp word [rdx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x1400546ab
jmp 0x1400546bb
xor eax, eax
lea r8, [rsp + 0x2a8]
mov qword [r8 + 8], rax
lea rsi, [rsp + 0x2b8]
mov rdx, rsi
call fcn.14005cc00
lea rbx, [rsp + 0x270]
mov rcx, rbx
mov rdx, rsi
call fcn.140057400
mov edx, dword [rdi + 0x28]
lea rdi, [rsp + 0x88]
mov rcx, rdi
call fcn.140068270
lea rdx, str.try_chrome_again
lea r14, [rsp + 0x200]
mov rcx, r14
call fcn.140002c8a
mov rcx, rbx
mov rdx, r14
mov r8, rdi
call fcn.140058570
cmp byte [r14 + 0x17], 0
jns 0x140054736
mov rcx, qword [rsp + 0x200]
call fcn.1401c9f6c
cmp byte [rsp + 0x9f], 0
jns 0x14005474d
mov rcx, qword [rsp + 0x88]
call fcn.1401c9f6c
xorps xmm0, xmm0
movaps xmmword [rsp + 0x200], xmm0
xor edi, edi
mov qword [rsp + 0x260], rdi
movaps xmmword [rsp + 0x250], xmm0
movaps xmmword [rsp + 0x240], xmm0
movaps xmmword [rsp + 0x230], xmm0
movaps xmmword [rsp + 0x220], xmm0
movaps xmmword [rsp + 0x210], xmm0
mov dword [rsp + 0x200], 0x68
mov qword [rsp + 0x1f0], rdi
movaps xmmword [rsp + 0x1e0], xmm0
lea rcx, [rsp + 0x270]
lea rbx, [rsp + 0x1c8]
mov rdx, rbx
xor r8d, r8d
call fcn.1400592a0
cmp byte [rbx + 0x17], dil
jns 0x1400547ce
mov rbx, qword [rsp + 0x1c8]
cmp byte [rsp + 0x2cf], dil
jns 0x1400547e0
mov rsi, qword [rsp + 0x2b8]
lea rax, [rsp + 0x1e0]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r14
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 0
mov rcx, rsi
mov rdx, rbx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140054845
lea rsi, [rsp + 0x88]
lea rdx, [rsp + 0x1e0]
mov rcx, rsi
call fcn.1400b9a60
mov rcx, rsi
call fcn.1400b9ab0
jmp 0x1400548f9
mov ecx, 2
call fcn.140060b40
test al, al
je 0x1400548f9
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._chrome_installer_setup_user_experiment.cc
lea rcx, [rsp + 0x88]
mov r8d, 0x225
mov r9d, 2
call fcn.1400618b0
lea rcx, [rsp + 0x98]
lea rdx, str.Failed_to_launch:
mov r8d, 0x12
call fcn.140007184
mov rsi, rax
lea rbx, [rsp + 0x58]
lea rdx, [rsp + 0x1c8]
mov rcx, rbx
call fcn.14003b7ee
lea rdi, [rsp + 0x70]
mov rcx, rdi
mov rdx, rbx
call fcn.14008d710
xor ebx, ebx
cmp byte [rdi + 0x17], bl
jns 0x1400548ce
mov rdi, qword [rsp + 0x70]
mov rcx, rsi
mov rdx, rdi
call fcn.140061a30
cmp byte [rsp + 0x87], bl
jns 0x1400548ec
mov rcx, qword [rsp + 0x70]
call fcn.1401c9f6c
lea rcx, [rsp + 0x88]
call fcn.140061980
cmp byte [rsp + 0x1df], 0
jns 0x140054910
mov rcx, qword [rsp + 0x1c8]
call fcn.1401c9f6c
lea rcx, [rsp + 0x270]
call fcn.1400578f0
lea rcx, [rsp + 0x2b8]
call fcn.14005baa0
mov rcx, qword [rsp + 0x2d0]
xor rcx, rsp
call fcn.1401ca2e0
nop
add rsp, 0x2d8
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140057960
Capabilities:
Accept command line arguments

Disassembly:
push rsi
sub rsp, 0x40
mov rax, qword [0x140267e38]
xor rax, rsp
mov qword [rsp + 0x38], rax
cmp qword [0x14026af88], 0
je 0x140057985
xor esi, esi
jmp 0x140057a15
mov ecx, 0x38
call fcn.1401c9f10
mov rsi, rax
mov ecx, 0x18
call fcn.1401c9f10
mov qword [rsi], rax
lea rcx, [rax + 0x18]
mov qword [rsi + 0x10], rcx
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov qword [rsi + 8], rcx
lea rax, [rsi + 0x20]
movups xmmword [rsi + 0x20], xmm0
mov qword [rsi + 0x18], rax
mov qword [rsi + 0x30], 1
mov qword [0x14026af88], rsi
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x28], rax
test rax, rax
je 0x1400579fe
cmp word [rax], 0
je 0x1400579fe
xor ecx, ecx
nop dword [rax]
cmp word [rax + rcx*2 + 2], 0
lea rcx, [rcx + 1]
jne 0x1400579f0
jmp 0x140057a00
xor ecx, ecx
mov qword [rsp + 0x30], rcx
lea rdx, [rsp + 0x28]
mov rcx, rsi
call fcn.140057a30
mov sil, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1401ca2e0
mov eax, esi
add rsp, 0x40
pop rsi
ret