joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140005a30
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x48
mov edx, 0xfffe
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x140005b3a
mov edx, 0xfffe
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x140005b2f
mov edx, 0xfffe
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x140005b24
mov r8d, 0x7fff
mov rdx, qword [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x140005b19
mov edx, 0x7fff
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x140005b19
mov r9, qword [rsp + 0x28]
lea r8, str._scmd.exe
mov edx, 0x7fff
mov rcx, qword [rsp + 0x30]
call fcn.140023d1c
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140005b19
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, 1
jmp 0x140005b3c
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
add rsp, 0x48
ret
Function at 0x14000ab30
Capabilities:
Persist via run registry key

Disassembly:
sub rsp, 0x68
lea rdx, [rsp + 0x30]
lea rcx, [0x14005d480]
call fcn.14000ae40
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x14000ac8f
mov edx, 0xfffe
mov ecx, 0x40
call qword [0x140063768]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
je 0x14000ac84
lea rax, str.7DF0398B_7AD0_4EA0_BD5A_6CCFE999BD2C
mov qword [rsp + 0x28], rax
lea rax, str.Install.exe
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x38]
lea r8, str._s_s__s
mov edx, 0x7fff
mov rcx, qword [rsp + 0x40]
call qword [0x140063e90]
mov dword [rsp + 0x50], eax
cmp dword [0x14005f130], 1
jne 0x14000ac14
lea r8, [rsp + 0x48]
lea rdx, [0x1400345d0]
mov rcx, 0xffffffff80000001
call qword [0x140063cf8]
test eax, eax
jne 0x14000ac14
mov eax, dword [rsp + 0x50]
inc eax
cdqe
shl rax, 1
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, [0x14005f2b4]
mov rcx, qword [rsp + 0x48]
call qword [0x140063cf0]
mov rcx, qword [rsp + 0x48]
call qword [0x140063d00]
cmp dword [0x14005f12c], 1
jne 0x14000ac79
lea r8, [rsp + 0x48]
lea rdx, [0x140034630]
mov rcx, 0xffffffff80000002
call qword [0x140063cf8]
test eax, eax
jne 0x14000ac79
mov eax, dword [rsp + 0x50]
inc eax
cdqe
shl rax, 1
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.AB1F3E47_AEF1_400E_A108_233A046C3A34
mov rcx, qword [rsp + 0x48]
call qword [0x140063cf0]
mov rcx, qword [rsp + 0x48]
call qword [0x140063d00]
mov rcx, qword [rsp + 0x40]
call qword [0x140063780]
mov rcx, qword [rsp + 0x38]
call qword [0x140063780]
mov eax, 1
add rsp, 0x68
ret

Function at 0x14000aca0
Capabilities:
Persist via run registry key

Disassembly:
sub rsp, 0x38
cmp dword [0x14005f130], 1
jne 0x14000ace7
lea r8, [rsp + 0x20]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
call qword [0x140063cf8]
test eax, eax
jne 0x14000ace7
lea rdx, [0x14005f2b4]
mov rcx, qword [rsp + 0x20]
call qword [0x140063d48]
mov rcx, qword [rsp + 0x20]
call qword [0x140063d00]
cmp dword [0x14005f12c], 1
jne 0x14000ad2a
lea r8, [rsp + 0x20]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000002
call qword [0x140063cf8]
test eax, eax
jne 0x14000ad2a
lea rdx, str.AB1F3E47_AEF1_400E_A108_233A046C3A34
mov rcx, qword [rsp + 0x20]
call qword [0x140063d48]
mov rcx, qword [rsp + 0x20]
call qword [0x140063d00]
mov eax, 1
add rsp, 0x38
ret
Function at 0x14000e6f0
Capabilities:
Compress data via winapi

Disassembly:
sub rsp, 0x38
lea rcx, [0x140034c80]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
lea rdx, str.RtlDecompressBuffer
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400635d8], rax
lea rdx, str.RtlGetCompressionWorkSpaceSize
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400635e0], rax
cmp qword [rsp + 0x20], 0
je 0x14000e75b
cmp qword [0x1400635d8], 0
je 0x14000e75b
cmp qword [0x1400635e0], 0
je 0x14000e75b
mov eax, 1
jmp 0x14000e75d
xor eax, eax
add rsp, 0x38
ret
Function at 0x140014b60
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
lea rax, [0x140064208]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140014c20]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x1400641f8], rax
cmp qword [0x1400641f8], 0
je 0x140014ba4
mov eax, 1
jmp 0x140014ba6
xor eax, eax
add rsp, 0x38
ret
Function at 0x14001dc00
Capabilities:
Create thread

Disassembly:
push rdi
sub rsp, 0x3f0
lea rcx, str.UNLOAD.TXT
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x14001dc90
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call qword [0x140063788]
mov qword [0x1400634e0], rax
cmp qword [0x1400634e0], 0
je 0x14001dc90
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140005660]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x1400634e8], rax
cmp qword [0x1400634e8], 0
je 0x14001dc78
jmp 0x14001dc90
mov rcx, qword [0x1400634e0]
call qword [0x140063780]
mov qword [0x1400634e0], 0
cmp dword [0x14005f140], 1
jne 0x14001dd7c
call fcn.1400197b0
cmp eax, 1
jne 0x14001dd7c
mov qword [rsp + 0x1d8], 0
mov dword [rsp + 0x1d0], 0
lea rdx, [rsp + 0x1d0]
lea rcx, [0x14005d480]
call fcn.14000ae40
mov qword [rsp + 0x1d8], rax
cmp qword [rsp + 0x1d8], 0
je 0x14001dd7c
xor eax, eax
mov word [rsp + 0x1e0], ax
lea rax, [rsp + 0x1e2]
mov rdi, rax
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
lea rax, str.Install.exe
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x1d8]
lea r8, str.__s_s_
mov edx, 0x104
lea rcx, [rsp + 0x1e0]
call fcn.140023d1c
mov eax, dword [0x14005f1e4]
mov dword [rsp + 0x28], eax
mov eax, dword [0x14005f1e0]
mov dword [rsp + 0x20], eax
lea r9, [0x14005f192]
lea r8, [0x14005f144]
lea rdx, str.7DF0398B_7AD0_4EA0_BD5A_6CCFE999BD2C
lea rcx, [rsp + 0x1e0]
call fcn.140002e90
mov rcx, qword [rsp + 0x1d8]
call qword [0x140063780]
cmp dword [0x14005f134], 0
jne 0x14001dd8a
call fcn.14000ab30
cmp dword [0x14005f138], 1
jne 0x14001dd98
call fcn.14000a7b0
cmp dword [0x14005f134], 1
jne 0x14001dda6
call fcn.140014b60
mov ecx, 0x15
call fcn.140010fc0
cmp dword [0x14005da70], 1
jne 0x14001de22
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x1400634f8], rax
cmp qword [0x1400634f8], 0
je 0x14001de22
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x1400095d0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x140063500], rax
cmp qword [0x140063500], 0
je 0x14001de15
jmp 0x14001de22
mov rcx, qword [0x1400634f8]
call qword [0x140063758]
lea rdx, [rsp + 0x30]
mov cx, 2
call qword [0x140064020]
test eax, eax
jne 0x14001dead
cmp dword [0x14005d33c], 1
jne 0x14001de6a
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140018cb0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x1400643f0], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140021700]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x1400648e0], rax
cmp qword [0x1400648e0], 0
je 0x14001dea7
mov eax, 1
jmp 0x14001deb2
call qword [0x140064028]
mov eax, 1
add rsp, 0x3f0
pop rdi
ret
Function at 0x14001eb40
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x70]
add rax, 0x18
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x3c], 0
jmp 0x14001eb79
mov eax, dword [rsp + 0x3c]
inc eax
mov dword [rsp + 0x3c], eax
cmp dword [rsp + 0x3c], 0x64
jge 0x14001ed00
movsxd rax, dword [rsp + 0x3c]
imul rax, rax, 0x20
xor edx, edx
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx + rax + 0x10]
call qword [0x1400637a8]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
je 0x14001ebb8
cmp dword [rsp + 0x38], 0x102
je 0x14001ecfb
movsxd rax, dword [rsp + 0x3c]
imul rax, rax, 0x20
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
cmp qword [rax + 8], 0
je 0x14001ebf9
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 8]
call qword [0x140063758]
mov rax, qword [rsp + 0x40]
mov qword [rax + 8], 0
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x10], 0
je 0x14001ec21
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0x10]
call qword [0x140063758]
mov rax, qword [rsp + 0x40]
mov qword [rax + 0x10], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call qword [0x140063788]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x14001ecd4
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 4
mov r9, qword [rsp + 0x40]
mov r8, qword [rsp + 0x80]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x14001ecc9
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
mov qword [rax + 8], rcx
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
mov qword [rax + 0x10], rcx
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x88]
mov qword [rax + 0x18], rcx
mov rcx, qword [rsp + 0x50]
call qword [0x140063930]
cmp eax, 0xffffffff
je 0x14001ecbe
mov eax, 1
jmp 0x14001ed02
mov rcx, qword [rsp + 0x50]
call qword [0x140063758]
mov rcx, qword [rsp + 0x48]
call qword [0x140063758]
mov rax, qword [rsp + 0x40]
mov qword [rax + 0x18], 0
mov rax, qword [rsp + 0x40]
mov qword [rax + 8], 0
mov rax, qword [rsp + 0x40]
mov qword [rax + 0x10], 0
jmp 0x14001eb6f
xor eax, eax
add rsp, 0x68
ret
Function at 0x14002a170
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.140029fe0

Function at 0x14002c7bb
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140061f90]
jne 0x140027e3a
rol rcx, 0x10
test cx, 0xffff
jne 0x140027e36
repz ret
ror rcx, 0x10
jmp 0x14002c714
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x1400653f0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x1400654e8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x14002c799
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x1400653f0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x14002c7bb
mov rax, qword [rsp + 0x88]
mov qword [0x1400654e8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x140065488], rax
mov rax, qword [0x1400654e8]
mov qword [0x140065360], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140065470], rax
mov dword [0x140065350], 0xc0000409
mov dword [0x140065354], 1
mov rax, qword [0x140061f90]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140061f98]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x1400653e8], eax
mov ecx, 1
call fcn.14002c2c0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140039900]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x1400653e8], 0
jne 0x14002c842
mov ecx, 1
call fcn.14002c2c0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x14002da5c
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x140061f90]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.140026464
xor ebx, ebx
cmp qword [0x140065978], rbx
mov rdi, rax
jne 0x14002db6f
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x14002dc46
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14002dc46
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x140065978], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x140065980], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x140065988], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x140065998], rax
test rax, rax
je 0x14002db66
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x140065990], rax
jmp 0x14002db76
mov rax, qword [0x140065990]
jmp 0x14002db7d
mov rax, qword [0x140065990]
mov r11, qword [0x140065998]
cmp rax, rdi
je 0x14002dbe4
cmp r11, rdi
je 0x14002dbe4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x140065998]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x14002dbe4
test rax, rax
je 0x14002dbe4
call rsi
test rax, rax
je 0x14002dbde
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x14002dbde
test byte [rsp + 0x40], 1
jne 0x14002dbe4
bts ebp, 0x15
jmp 0x14002dc24
mov rcx, qword [0x140065980]
cmp rcx, rdi
je 0x14002dc24
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14002dc24
call rax
mov rbx, rax
test rax, rax
je 0x14002dc24
mov rcx, qword [0x140065988]
cmp rcx, rdi
je 0x14002dc24
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14002dc24
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x140065978]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14002dc46
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x14002dc48
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140027e20
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140002147
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x98
movaps xmmword [rsp + 0x80], xmm14
movaps xmmword [rsp + 0x70], xmm13
movaps xmmword [rsp + 0x60], xmm12
movaps xmmword [rsp + 0x50], xmm11
movaps xmmword [rsp + 0x40], xmm10
movaps xmmword [rsp + 0x30], xmm9
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x10], xmm7
movaps xmmword [rsp], xmm6
aesimc xmm0, xmmword [rdx + 0x10]
aesimc xmm1, xmmword [rdx + 0x20]
aesimc xmm2, xmmword [rdx + 0x30]
aesimc xmm3, xmmword [rdx + 0x40]
aesimc xmm4, xmmword [rdx + 0x50]
aesimc xmm5, xmmword [rdx + 0x60]
aesimc xmm6, xmmword [rdx + 0x70]
aesimc xmm7, xmmword [rdx + 0x80]
aesimc xmm8, xmmword [rdx + 0x90]
aesimc xmm9, xmmword [rdx + 0xa0]
aesimc xmm10, xmmword [rdx + 0xb0]
aesimc xmm11, xmmword [rdx + 0xc0]
aesimc xmm12, xmmword [rdx + 0xd0]
movaps xmm13, xmmword [rdx]
movaps xmm14, xmmword [rdx + 0xe0]
movaps xmmword [rcx], xmm13
movdqa xmmword [rcx + 0x10], xmm0
movdqa xmmword [rcx + 0x20], xmm1
movdqa xmmword [rcx + 0x30], xmm2
movdqa xmmword [rcx + 0x40], xmm3
movdqa xmmword [rcx + 0x50], xmm4
movdqa xmmword [rcx + 0x60], xmm5
movdqa xmmword [rcx + 0x70], xmm6
movdqa xmmword [rcx + 0x80], xmm7
movdqa xmmword [rcx + 0x90], xmm8
movdqa xmmword [rcx + 0xa0], xmm9
movdqa xmmword [rcx + 0xb0], xmm10
movdqa xmmword [rcx + 0xc0], xmm11
movdqa xmmword [rcx + 0xd0], xmm12
movaps xmmword [rcx + 0xe0], xmm14
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
movaps xmm11, xmmword [rsp + 0x50]
movaps xmm12, xmmword [rsp + 0x60]
movaps xmm13, xmmword [rsp + 0x70]
movaps xmm14, xmmword [rsp + 0x80]
add rsp, 0x98
ret
Function at 0x14000b741
Capabilities:
Allocate or change rwx memory

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov rcx, rdx
mov rdx, r8
mov r8, r9
mov r9d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rcx, rsi
mov edx, eax
add rsp, 0x30
pop rsi
jmp 0x14000b5f1

Function at 0x14000b7ae
Capabilities:
Create process on windows

Disassembly:
push rsi
sub rsp, 0x50
mov rsi, rcx
mov qword [rsp + 0x48], r9
mov qword [rsp + 0x40], r8
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0xc
and dword [rsp + 0x20], 0
mov rcx, rdx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rcx, rsi
mov edx, eax
add rsp, 0x50
pop rsi
jmp 0x14000b5f1
Function at 0x140012015
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
movsxd rax, dword [rcx + 0x3c]
mov eax, dword [rax + rcx + 0x88]
mov r12d, dword [rax + rcx + 0x1c]
mov r13d, dword [rax + rcx + 0x20]
add r13, rcx
mov ebp, dword [rax + rcx + 0x24]
add rbp, rcx
lea r14, [rsp + 0x20]
lea r15, [0x140115be8]
mov ecx, dword [r13]
add rcx, rsi
call fcn.14000577d
mov r8, rdx
mov rcx, r14
mov rdx, rax
call fcn.140036800
mov rcx, r14
mov rdx, r15
call fcn.140007219
mov rcx, rax
mov r8, rbx
mov r9, rdi
call fcn.1400c5bb4
test al, al
jne 0x14001209a
add r13, 4
add rbp, 2
jmp 0x140012059
add r12, rsi
movzx eax, word [rbp]
mov eax, dword [r12 + rax*4]
add rax, rsi
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140012512
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
lea rax, [rcx + 1]
cmp rax, 2
jb 0x140012598
mov rsi, rdx
lea rax, [rdx + 1]
cmp rax, 2
jb 0x140012598
mov rdi, rcx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x14001257a
lea rcx, [rsp + 0x28]
and qword [rcx], 0
call fcn.140005947
lea rbx, [rsp + 0x28]
mov rcx, rbx
mov rdx, rdi
call fcn.1400acf77
mov rcx, rbx
call fcn.140005947
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov rdx, rsi
call fcn.1400acf77
mov rcx, rdi
jmp 0x140012593
call fcn.1400d3f2c
lea rcx, [rsp + 0x28]
and qword [rcx + 8], 0
mov dword [rcx + 0x10], eax
mov qword [rcx], 1
call fcn.140005947
nop
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
Function at 0x14001a383
Capabilities:
Get token membership

Disassembly:
sub rsp, 0x78
lea rcx, [rsp + 0x70]
and dword [rcx], 0
mov word [rcx + 4], 0x500
lea rax, [rsp + 0x68]
and qword [rax], 0
and dword [rsp + 0x48], 0
and dword [rsp + 0x40], 0
and dword [rsp + 0x38], 0
and dword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
mov qword [rsp + 0x50], rax
and dword [rsp + 0x20], 0
mov dl, 2
mov r8d, 0x20
mov r9d, 0x220
call sub.advapi32.dll_AllocateAndInitializeSid
test eax, eax
je 0x14001a40a
lea r8, [rsp + 0x64]
and dword [r8], 0
mov rdx, qword [rsp + 0x68]
xor ecx, ecx
call sub.advapi32.dll_CheckTokenMembership
test eax, eax
jne 0x14001a3f6
and dword [rsp + 0x64], 0
mov rcx, qword [rsp + 0x68]
call sub.KERNEL32.dll_LocalFree
cmp dword [rsp + 0x64], 0
setne al
jmp 0x14001a40c
xor eax, eax
add rsp, 0x78
ret
Function at 0x14003278c
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aeskeygenassist xmm0, xmmword [rdx], 2
movdqa xmmword [rcx], xmm0
ret

Function at 0x14003b030
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rax, rdx
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x14003b0c0
cmp r11, r10
ja 0x14003b136
cmp r10, rdx
ja 0x14003b14a
add r11, r9
xor r15d, r15d
nop word cs:[rax + rax]
cmp r14, r15
je 0x14003b0c2
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x14003b0a0
jmp 0x14003b124
ja 0x14003b0ca
mov r11, r10
cmp rax, r8
jne 0x14003b064
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x14003b100
mov rdi, r8
sub ecx, edx
jns 0x14003b11b
jmp 0x14003b126
cmp r8, rsi
je 0x14003b15b
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x14003b126
xor al, 1
cmp rdi, rsi
jne 0x14003b0e0
jmp 0x14003b126
xor eax, eax
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.14010df10
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.14010dc40
ud2
lea rcx, [0x14016d772]
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.14010dcc0
ud2
Function at 0x140040650
Capabilities:
Hash data with crc32

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov r9, r8
mov rax, rdx
not ecx
lea rdi, [0x14011f2a0]
mov ebx, 0xff
lea rsi, str.Z:WorkspaceDevelopTools.cargo_registry_srcindex.crates.io_6f17d22bba15001fcrc32fast_1.3.2_src_baseline.rs
cmp r9, 0x40
jb 0x140040780
mov r14d, 4
sub r14, 1
jb 0x140040675
cmp r9, 0xf
jbe 0x1400407ad
movzx edx, byte [rax + 0xf]
movzx r8d, byte [rax + 0xe]
mov ebp, dword [rdi + r8*4 + 0x400]
xor ebp, dword [rdi + rdx*4]
movzx edx, byte [rax + 0xd]
xor ebp, dword [rdi + rdx*4 + 0x800]
movzx edx, byte [rax + 0xc]
xor ebp, dword [rdi + rdx*4 + 0xc00]
movzx edx, byte [rax + 0xb]
xor ebp, dword [rdi + rdx*4 + 0x1000]
movzx edx, byte [rax + 0xa]
xor ebp, dword [rdi + rdx*4 + 0x1400]
movzx edx, byte [rax + 9]
xor ebp, dword [rdi + rdx*4 + 0x1800]
movzx edx, byte [rax + 8]
xor ebp, dword [rdi + rdx*4 + 0x1c00]
movzx edx, byte [rax + 7]
xor ebp, dword [rdi + rdx*4 + 0x2000]
movzx edx, byte [rax + 6]
xor ebp, dword [rdi + rdx*4 + 0x2400]
movzx edx, byte [rax + 5]
xor ebp, dword [rdi + rdx*4 + 0x2800]
movzx edx, byte [rax + 4]
xor ebp, dword [rdi + rdx*4 + 0x2c00]
mov edx, ecx
shr edx, 0x18
movzx r8d, byte [rax + 3]
xor r8d, edx
xor ebp, dword [rdi + r8*4 + 0x3000]
mov edx, ecx
shr edx, 0x10
and edx, ebx
movzx r8d, byte [rax + 2]
xor r8d, edx
xor ebp, dword [rdi + r8*4 + 0x3400]
mov edx, ecx
shr edx, 8
and edx, ebx
movzx r8d, byte [rax + 1]
xor r8d, edx
xor ebp, dword [rdi + r8*4 + 0x3800]
and ecx, ebx
movzx edx, byte [rax]
xor edx, ecx
xor ebp, dword [rdi + rdx*4 + 0x3c00]
mov rcx, rax
mov rdx, r9
mov r8, rsi
call fcn.140040c94
mov r9, rdx
mov ecx, ebp
jmp 0x140040685
xor edx, edx
cmp r9, rdx
je 0x14004079e
mov r8b, byte [rax + rdx]
xor r8b, cl
movzx r8d, r8b
shr ecx, 8
xor ecx, dword [rdi + r8*4]
inc rdx
jmp 0x140040782
not ecx
mov eax, ecx
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
lea r8, str.Z:WorkspaceDevelopTools.cargo_registry_srcindex.crates.io_6f17d22bba15001fcrc32fast_1.3.2_src_baseline.rs
mov ecx, 0xf
mov rdx, r9
call fcn.14010dbc0
ud2