joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400dafc0
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x250
mov rax, qword [0x14018e028]
xor rax, rsp
mov qword [rsp + 0x248], rax
mov sil, 1
cmp qword [0x1401a8a98], 0
je 0x1400db006
mov rcx, qword [rsp + 0x248]
xor rcx, rsp
call fcn.1400a29f0
mov eax, esi
add rsp, 0x250
pop rbx
pop rdi
pop rsi
ret
mov rcx, qword [0x1401a8a70]
test rcx, rcx
je 0x1400db0a4
test byte [0x14019c0b8], 1
je 0x1400dafe9
cmp byte [rcx + 0x17], 0
jns 0x1400db028
mov rcx, qword [rcx]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov edx, 4
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x1401a8a98], rax
inc rax
cmp rax, 1
ja 0x1400dafe9
lea rdi, [rsp + 0x40]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.1400a4b40
mov word [rdi], 0
mov ecx, 0x104
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add eax, 0xfffffefb
cmp eax, 0xfffffefc
jae 0x1400db171
xor esi, esi
jmp 0x1400dafe9
mov ecx, 0x18
call fcn.1400a1490
mov rsi, rax
lea rdi, [rsp + 0x40]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.1400a4b40
xor ecx, ecx
mov rdx, rdi
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
movaps xmm0, xmmword [0x140161e70]
movups xmmword [rsi], xmm0
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsi + 0x10], rax
mov rcx, rsi
mov rdx, rdi
call fcn.1400566f0
movzx eax, byte [rsi + 0x17]
test al, al
js 0x1400db10a
and eax, 0x7f
mov rcx, rsi
jmp 0x1400db111
mov rax, qword [rsi + 8]
mov rcx, qword [rsi]
test rax, rax
je 0x1400db14c
lea r8, [rax + rax]
test r8, r8
je 0x1400db14c
lea rdx, [r8 - 2]
cmp word [rcx + r8 - 2], 0x5c
mov r8, rdx
jne 0x1400db11a
cmp rdx, 0xfffffffffffffffe
je 0x1400db14c
sar rdx, 1
cmp rax, rdx
jbe 0x1400db257
inc rdx
mov rcx, rsi
call fcn.14010fb40
lea rdx, str.debug.log
mov r8d, 9
mov rcx, rsi
call fcn.140034f36
mov qword [0x1401a8a70], 0
jmp 0x1400db09d
mov rdi, qword [0x1401a8a70]
lea rbx, [rsp + 0x40]
mov rcx, rbx
call fcn.1400c5734
mov rcx, rdi
mov rdx, rbx
mov r8, rax
call fcn.140061bfc
mov rcx, qword [0x1401a8a70]
movzx eax, byte [rcx + 0x17]
test al, al
jns 0x1400db24a
mov rax, qword [rcx + 8]
test rax, rax
je 0x1400db25f
mov rdx, qword [rcx]
cmp word [rdx + rax*2 - 2], 0x5c
je 0x1400db1d7
lea rdx, [0x1401691d0]
mov r8d, 1
call fcn.140034f36
mov rcx, qword [0x1401a8a70]
lea rdx, str.debug.log
mov r8d, 9
call fcn.140034f36
mov rcx, qword [0x1401a8a70]
cmp byte [rcx + 0x17], 0
jns 0x1400db1f9
mov rcx, qword [rcx]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov edx, 4
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x1401a8a98], rax
inc rax
cmp rax, 1
ja 0x1400dafe9
mov qword [0x1401a8a98], 0
jmp 0x1400db09d
test rax, rax
je 0x1400db25f
mov rdx, rcx
jmp 0x1400db1b6
mov rcx, rsi
call fcn.1400e0296
lea rax, str.string::back__:_string_is_empty
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude_string
lea r9, str._empty__
mov r8d, 0x50d
call fcn.1400e34ad
int3
Function at 0x1400e357e
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r9
mov rdi, r8
mov rbx, rdx
mov r14, rcx
mov ecx, 2
call sym.elevation_service.exe_OQS_CPU_has_extension
mov rcx, r14
mov rdx, rbx
mov r8, rdi
mov r9, rsi
test eax, eax
je 0x1400e35bb
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp 0x1400eb10b
nop
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp 0x1400e3b6e
sub rsp, 0x28
mov rax, r8
mov r8, rdx
mov rdx, rcx
shr r8, 4
mov dword [rsp + 0x20], 0xe
mov rcx, r9
mov r9, rax
call fcn.1400e3a3b
nop
add rsp, 0x28
ret
cmp rdx, 0x10
jb 0x1400eb1a1
shr rdx, 4
xor eax, eax
vmovdqa xmm0, xmmword [r8]
vpxor xmm0, xmm0, xmmword [rcx + rax]
vaesenc xmm0, xmm0, xmmword [r8 + 0x10]
vaesenc xmm0, xmm0, xmmword [r8 + 0x20]
vaesenc xmm0, xmm0, xmmword [r8 + 0x30]
vaesenc xmm0, xmm0, xmmword [r8 + 0x40]
vaesenc xmm0, xmm0, xmmword [r8 + 0x50]
vaesenc xmm0, xmm0, xmmword [r8 + 0x60]
vaesenc xmm0, xmm0, xmmword [r8 + 0x70]
vaesenc xmm0, xmm0, xmmword [r8 + 0x80]
vaesenc xmm0, xmm0, xmmword [r8 + 0x90]
vaesenc xmm0, xmm0, xmmword [r8 + 0xa0]
vaesenc xmm0, xmm0, xmmword [r8 + 0xb0]
vaesenc xmm0, xmm0, xmmword [r8 + 0xc0]
vaesenc xmm0, xmm0, xmmword [r8 + 0xd0]
vaesenclast xmm0, xmm0, xmmword [r8 + 0xe0]
vmovdqu xmmword [r9 + rax], xmm0
add rax, 0x10
dec rdx
jne 0x1400eb11b
ret
Function at 0x1400e4710
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x1400e473a
xor eax, eax
xor r9d, r9d
mov r10b, byte [rdx + rax]
xor r10b, byte [rcx + rax]
or r9b, r10b
inc rax
cmp r8, rax
jne 0x1400e471a
movzx eax, r9b
neg eax
shr eax, 8
and eax, 1
ret
xor eax, eax
jmp 0x1400e4731

Function at 0x1400e4930
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov rax, qword [0x14018e028]
xor rax, rsp
mov qword [rsp + 0x50], rax
vmovups ymm0, ymmword [rcx]
vmovups ymm1, ymmword [rcx + 0x10]
vmovups ymmword [rsp + 0x30], ymm1
vmovups ymmword [rsp + 0x20], ymm0
test rdx, rdx
je 0x1400e496f
xor eax, eax
mov cl, byte [rdx + rax]
xor byte [rsp + rax + 0x20], cl
inc rax
cmp rax, 0x30
jne 0x1400e495f
vxorps xmm0, xmm0, xmm0
vmovups ymmword [0x1401a16c8], ymm0
vmovups ymmword [0x1401a16b8], ymm0
lea rcx, [rsp + 0x20]
vzeroupper
call fcn.1400e49ad
mov dword [0x1401a16e8], 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400a29f0
nop
add rsp, 0x58
ret

Function at 0x1400e49ad
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x68
mov rsi, rcx
mov rax, qword [0x14018e028]
xor rax, rsp
mov qword [rsp + 0x60], rax
vpbroadcastb ymm0, byte [0x140166723]
vmovdqu ymmword [rsp + 0x40], ymm0
vmovdqu ymmword [rsp + 0x30], ymm0
xor r12d, r12d
lea rdi, [0x1401a16b8]
lea rbx, [rsp + 0x28]
lea r14, [0x1401a16d8]
jmp 0x1400e4a4b
inc cl
mov byte [rax + rdi + 0x20], cl
mov rax, r12
shl rax, 4
lea r15, [rsp + rax]
add r15, 0x30
mov qword [rsp + 0x28], 0
mov rcx, rdi
mov rdx, rbx
vzeroupper
call fcn.1400e34b0
mov edx, 0x10
mov rcx, r14
mov r8, rdi
mov r9, r15
call fcn.1400e3515
mov rcx, qword [rsp + 0x28]
call fcn.1400e34e7
inc r12
cmp r12, 3
je 0x1400e4a67
mov eax, 0xf
mov eax, eax
mov cl, byte [rax + rdi + 0x20]
cmp cl, 0xff
jne 0x1400e49f9
mov byte [rax + rdi + 0x20], 0
add eax, 0xffffffff
jb 0x1400e4a50
jmp 0x1400e49ff
test rsi, rsi
je 0x1400e4a7e
xor eax, eax
mov cl, byte [rsi + rax]
xor byte [rsp + rax + 0x30], cl
inc rax
cmp rax, 0x30
jne 0x1400e4a6e
vmovups ymm0, ymmword [rsp + 0x30]
vmovups ymmword [0x1401a16b8], ymm0
vmovaps xmm0, xmmword [rsp + 0x50]
vmovups xmmword [0x1401a16d8], xmm0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
vzeroupper
call fcn.1400a29f0
nop
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x1400ec734
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x1400ec75a
xor r9d, r9d
xor eax, eax
mov r10b, byte [rdx + rax]
xor r10b, byte [rcx + rax]
or r9b, r10b
inc rax
cmp r8, rax
jne 0x1400ec73e
xor eax, eax
test r9b, r9b
setne al
ret
xor eax, eax
ret

Function at 0x1400ec75d
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x1400ec784
neg r9b
xor eax, eax
mov r10b, byte [rcx + rax]
mov r11b, byte [rdx + rax]
xor r11b, r10b
and r11b, r9b
xor r11b, r10b
mov byte [rcx + rax], r11b
inc rax
cmp r8, rax
jne 0x1400ec767
ret
Function at 0x1400ec930
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x28
test rdx, rdx
je 0x1400ec943
cmp dword [0x1401a1738], ecx
jle 0x1400ec94a
add rsp, 0x28
pop rdi
pop rsi
ret
mov rsi, rdx
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsxd rdi, eax
mov rcx, rsi
mov rdx, rdi
call fcn.1400ec990
test edi, edi
je 0x1400ec943
cmp byte [rdi + rsi - 1], 0xa
je 0x1400ec943
lea rcx, [0x14016551f]
mov edx, 1
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.1400ec990

Function at 0x1400ec990
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x14018e028]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
add rsi, rdi
xor r15d, r15d
lea r14, [rsp + 0x2c]
mov r12, qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x1400ec9de
mov rdx, rcx
add rdi, rdx
cmp al, 1
je 0x1400eca1c
cmp rdi, rsi
jae 0x1400eca1c
mov dword [rsp + 0x2c], 0
mov r8d, esi
sub r8d, edi
mov qword [rsp + 0x20], r15
mov rcx, rbx
mov rdx, rdi
mov r9, r14
call r12
test eax, eax
sete dl
mov ecx, dword [rsp + 0x2c]
test rcx, rcx
sete al
or al, dl
mov edx, 0
jne 0x1400ec9d7
jmp 0x1400ec9d4
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400a29f0
nop
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x14010ec10
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov ebx, r8d
mov edi, edx
mov rsi, rcx
mov rax, qword [0x14018e028]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp byte [rcx + 8], 0
je 0x14010ec81
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, edi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x14010ec8b
mov dil, 1
test bl, bl
je 0x14010ec6a
cmp byte [rsi + 8], 0
je 0x14010ec86
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400a29f0
mov eax, edi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
mov rcx, qword [rsi]
jmp 0x14010ec3d
mov rcx, qword [rsi]
jmp 0x14010ec5f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [rsi + 8], 0
je 0x14010ecb3
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14010ecb8
xor edi, edi
jmp 0x14010ec6a
mov rcx, qword [rsi]
jmp 0x14010eca0
mov dword [rsp + 0x24], 0xaaaaaaaa
cmp byte [rsi + 8], 0
je 0x14010ecdf
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov dil, 1
jmp 0x14010ec6a
mov rcx, qword [rsi]
jmp 0x14010eccf
Function at 0x14010f030
Capabilities:
Move file

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x98
mov rsi, rcx
mov rax, qword [0x14018e028]
xor rax, rsp
mov qword [rsp + 0x90], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0x40]
mov qword [rbx + 0x40], rax
movaps xmm0, xmmword [0x140161e70]
movaps xmmword [rbx + 0x30], xmm0
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
lea rdx, str.DeleteFileAfterReboot
lea r8, str....._base_files_file_util_win.cc
lea r14, [rsp + 0x20]
mov rcx, r14
mov r9d, 0x217
call fcn.140039d50
xor edi, edi
mov rcx, rbx
mov rdx, r14
xor r8d, r8d
call fcn.140040670
mov al, byte [rsi + 0x17]
test al, al
jns 0x14010f0bc
cmp qword [rsi + 8], 0x103
ja 0x14010f0da
test al, al
jns 0x14010f0c3
mov rsi, qword [rsi]
mov rcx, rsi
xor edx, edx
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
setne dil
lea rcx, [rsp + 0x40]
call fcn.1400408d0
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1400a29f0
mov eax, edi
add rsp, 0x98
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140113880
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x60
movdqa xmmword [rsp + 0x50], xmm9
movdqa xmmword [rsp + 0x40], xmm8
movdqa xmmword [rsp + 0x30], xmm7
movdqa xmmword [rsp + 0x20], xmm6
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
xor eax, eax
movdqa xmm0, xmmword [rsi + rax]
pxor xmm0, xmmword [rdi + rax]
movdqa xmmword [rsi + rax], xmm0
add rax, 0x10
cmp rax, 0x80
jne 0x1401138b0
cmp rbx, 2
jb 0x140113998
lea r14, [rdi + 0x80]
mov r15d, 1
movdqa xmm6, xmmword [0x14016e630]
movdqa xmm7, xmmword [0x14016e640]
movdqa xmm8, xmmword [0x14016e650]
movdqa xmm9, xmmword [0x14016e660]
mov rcx, rsi
call fcn.1401249f0
xor eax, eax
movdqa xmm0, xmmword [rsi + rax]
movdqa xmm1, xmm0
pand xmm1, xmm6
pshufd xmm2, xmm0, 0x39
pand xmm2, xmm7
por xmm2, xmm1
pshufd xmm1, xmm0, 0x4e
pand xmm0, xmm8
movdqa xmm3, xmm0
pslldq xmm3, 4
psrldq xmm0, 0xc
por xmm0, xmm3
pand xmm1, xmm9
por xmm1, xmm0
por xmm1, xmm2
movdqa xmmword [rsi + rax], xmm1
add rax, 0x10
cmp rax, 0x80
jne 0x14011390e
mov rcx, rsi
call fcn.140124ee0
xor eax, eax
movdqa xmm0, xmmword [rsi + rax]
pxor xmm0, xmmword [r14 + rax]
movdqa xmmword [rsi + rax], xmm0
add rax, 0x10
cmp rax, 0x80
jne 0x14011396c
inc r15
sub r14, 0xffffffffffffff80
cmp r15, rbx
jne 0x140113904
mov rcx, rsi
call fcn.1401249f0
xor eax, eax
movdqa xmm0, xmmword [0x14016e630]
movdqa xmm1, xmmword [0x14016e640]
movdqa xmm2, xmmword [0x14016e650]
movdqa xmm3, xmmword [0x14016e660]
movdqa xmm4, xmmword [rsi + rax]
movdqa xmm5, xmm4
pand xmm5, xmm0
pshufd xmm6, xmm4, 0x39
pand xmm6, xmm1
por xmm6, xmm5
pshufd xmm5, xmm4, 0x4e
pand xmm4, xmm2
movdqa xmm7, xmm4
pslldq xmm7, 4
psrldq xmm4, 0xc
por xmm4, xmm7
pand xmm5, xmm3
por xmm5, xmm4
por xmm5, xmm6
movdqa xmmword [rsi + rax], xmm5
add rax, 0x10
cmp rax, 0x80
jne 0x1401139c2
shl rbx, 7
add rdi, rbx
xor eax, eax
movdqa xmm0, xmmword [rsi + rax]
pxor xmm0, xmmword [rdi + rax]
movdqa xmmword [rsi + rax], xmm0
add rax, 0x10
cmp rax, 0x80
jne 0x140113a1d
movaps xmm6, xmmword [rsp + 0x20]
movaps xmm7, xmmword [rsp + 0x30]
movaps xmm8, xmmword [rsp + 0x40]
movaps xmm9, xmmword [rsp + 0x50]
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140120a10
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x88
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
mov edx, dword [rsp + 0xe0]
mov rax, qword [0x14018e028]
xor rax, rsp
mov qword [rsp + 0x80], rax
movsxd r8, dword [rcx + 0x108]
lea ecx, [rdx + 4]
mov r11, rcx
shr r11, 6
xor eax, eax
mov r10d, 0
cmp r11, r8
jae 0x140120a6f
mov r10, qword [r9 + r11*8]
shr r10, cl
shl r10d, 5
and r10d, 0x20
lea ecx, [rdx + 3]
mov r11, rcx
shr r11, 6
cmp r11, r8
jae 0x140120a8b
mov rax, qword [r9 + r11*8]
shr rax, cl
shl eax, 4
and eax, 0x10
or eax, r10d
lea ecx, [rdx + 2]
mov r14, rcx
shr r14, 6
xor r10d, r10d
mov r11d, 0
cmp r14, r8
jae 0x140120ab5
mov r11, qword [r9 + r14*8]
shr r11, cl
shl r11d, 3
and r11d, 8
or eax, r11d
lea ecx, [rdx + 1]
mov r11, rcx
shr r11, 6
cmp r11, r8
jae 0x140120ad6
mov r10, qword [r9 + r11*8]
shr r10, cl
shl r10d, 2
and r10d, 4
or eax, r10d
mov ecx, edx
mov r11, rcx
shr r11, 6
xor r10d, r10d
cmp r11, r8
jae 0x140120af8
mov r10, qword [r9 + r11*8]
shr r10, cl
add r10d, r10d
and r10d, 2
or eax, r10d
test edx, edx
je 0x140120b1e
dec edx
mov r10, rdx
shr r10, 6
xor ecx, ecx
cmp r10, r8
jae 0x140120b1c
mov r8, qword [r9 + r10*8]
xor ecx, ecx
bt r8, rdx
setb cl
or eax, ecx
mov r14d, eax
shr r14, 5
lea ecx, [r14 - 1]
neg r14
and ecx, eax
xor eax, 0x3f
mov r15d, r14d
and r15d, eax
or r15d, ecx
mov rax, r15
shr rax, 1
and r15d, 1
add r15, rax
xor r12d, r12d
mov r8d, 0xd8
mov rcx, rsi
xor edx, edx
call fcn.1400a4b40
mov r8, r12
xor r8, r15
dec r8
sar r8, 0x3f
mov qword [rsp + 0x20], rsi
mov rcx, rdi
mov rdx, rsi
mov r9, rbx
call fcn.14011d3b0
inc r12
add rbx, 0xd8
cmp r12, 0x11
jne 0x140120b5a
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x70], rax
movaps xmm0, xmmword [0x140161e70]
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
add rsi, 0x48
mov eax, dword [rdi + 0x148]
test eax, eax
jle 0x140120c2b
xor ecx, ecx
xor edx, edx
or rdx, qword [rsi + rcx*8]
inc rcx
cmp rax, rcx
jne 0x140120bc6
test rdx, rdx
sete dl
test rax, rax
je 0x140120c7c
movsxd rcx, eax
mov rax, qword [rdi + 0x140]
xor r8d, r8d
lea r9, [rsp + 0x30]
sub r10, r10
jmp 0x140120c00
mov r10, qword [rax + r8*8]
sbb r10, qword [rsi + r8*8]
mov qword [r9 + r8*8], r10
lea r8, [r8 + 1]
dec rcx
jne 0x140120c00
sbb r10, r10
movsxd rax, dword [rdi + 0x148]
mov ecx, eax
test rax, rax
jle 0x140120c4a
xor r8d, r8d
jmp 0x140120c3f
mov dl, 1
jmp 0x140120bd8
xor r9d, r9d
mov qword [rsp + r8*8 + 0x30], r9
inc r8
cmp rcx, r8
je 0x140120c4a
test dl, dl
jne 0x140120c2f
mov r9, qword [rsp + r8*8 + 0x30]
jmp 0x140120c32
test rcx, rcx
je 0x140120c7c
and r14d, 1
neg r14
mov rcx, r14
not rcx
xor edx, edx
mov r8, qword [rsp + rdx*8 + 0x30]
and r8, r14
mov r9, qword [rsi + rdx*8]
and r9, rcx
or r9, r8
mov qword [rsi + rdx*8], r9
inc rdx
cmp rax, rdx
jne 0x140120c5e
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400a29f0
nop
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x140121c00
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov rsi, rcx
mov rax, qword [0x14018e028]
xor rax, rsp
mov qword [rsp + 0x50], rax
movaps xmm0, xmmword [0x140161e70]
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
test r9, r9
je 0x140121c68
xor edi, edi
cmp r9, 0x30
ja 0x140121c8a
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
movups xmm2, xmmword [rdx + 0x20]
lea rdx, [rsp + 0x20]
movaps xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movaps xmmword [rdx], xmm0
xor eax, eax
mov cl, byte [r8 + rax]
xor byte [rsp + rax + 0x20], cl
inc rax
cmp r9, rax
jne 0x140121c58
mov r8d, 0x30
mov rcx, rsi
call fcn.140074770
test eax, eax
je 0x140121ca0
mov qword [rsi + 0x118], 1
mov edi, 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400a29f0
mov eax, edi
add rsp, 0x58
pop rdi
pop rsi
ret
xor edi, edi
jmp 0x140121c8a
Function at 0x14015214f
Capabilities:
Read file via mapping

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
cmp dword [r8], 0
jle 0x14015218e
xor eax, eax
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
cmp ecx, 0x8007000e
jne 0x14015215e
mov dword [rsi], 7
jmp 0x14015215e
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
call fcn.14009bc65
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10000080
mov dword [rsp + 0x20], 3
mov rcx, rbx
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
je 0x14015216a
mov r14, rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rax
xor edx, edx
mov r8d, 2
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rbx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x14015216a
mov qword [rsp + 0x20], 0
mov rcx, rbx
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rdi + 8], rax
test rax, rax
je 0x140152240
mov qword [rdi + 0x28], rbx
mov al, 1
jmp 0x140152160
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14015215e
Function at 0x14000efb0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
xor r8d, r8d
xor edx, edx
jmp 0x14000eddc

Function at 0x14001e514
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov rdx, rcx
test rcx, rcx
jne 0x14001e4f1
call fcn.140015bc4
mov dword [rax], 0x16
call fcn.14001a72c
or eax, 0xffffffff
jmp 0x14001e50e
sub dword [rcx + 0x10], 1
jns 0x14001e500
add rsp, 0x28
jmp 0x140024250
mov rax, qword [rcx]
movzx ecx, byte [rax]
inc rax
mov qword [rdx], rax
mov eax, ecx
add rsp, 0x28
ret
jmp 0x14001e4d0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rdi, rcx
test rcx, rcx
jne 0x140024282
call fcn.140015bc4
mov dword [rax], 0x16
call fcn.14001a72c
jmp 0x14002439f
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x14002439f
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x14002439f
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x1400242b1
lock or dword [rcx + 0x14], 0x10
jmp 0x14002439f
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x1400242c5
call fcn.1400243bc
mov rbx, qword [rdi + 8]
mov rcx, rdi
mov qword [rdi], rbx
call fcn.14001cc2c
mov r8d, dword [rdi + 0x20]
mov ecx, eax
mov rdx, rbx
call fcn.140019750
mov dword [rdi + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 1
jbe 0x14002438d
mov eax, dword [rdi + 0x14]
or esi, 0xffffffff
test al, 6
jne 0x140024358
mov rcx, rdi
call fcn.14001cc2c
cmp eax, esi
je 0x140024343
mov rcx, rdi
call fcn.14001cc2c
cmp eax, 0xfffffffe
je 0x140024343
mov rcx, rdi
call fcn.14001cc2c
movsxd rbx, eax
lea r14, [0x1400398b0]
mov rcx, rdi
sar rbx, 6
call fcn.14001cc2c
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rbx*8]
lea rdx, [rax + rcx*8]
jmp 0x14002434a
lea rdx, [0x1400382d0]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x140024358
lock or dword [rdi + 0x14], 0x20
cmp dword [rdi + 0x20], 0x200
jne 0x14002437c
mov eax, dword [rdi + 0x14]
shr eax, 6
test al, 1
je 0x14002437c
mov eax, dword [rdi + 0x14]
shr eax, 8
test al, 1
jne 0x14002437c
mov dword [rdi + 0x20], 0x1000
add dword [rdi + 0x10], esi
mov rax, qword [rdi]
movzx esi, byte [rax]
inc rax
mov qword [rdi], rax
jmp 0x1400243a2
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rdi + 0x14], eax
and dword [rdi + 0x10], 0
or esi, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov eax, esi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x140034270
Capabilities:
Access peb ldr_data

Disassembly:
push r12
push r14
push r15
sub r12, r12
add r12, 0x60
mov r14, qword gs:[r12]
push r11
mov r11, qword [r14 + 0x10]
add r14, 0x18
mov r15, qword [r14]
mov r12, r15
add r12, 0x10
mov r14, qword [r12]
push rax
mov r12, qword [r14 + 0x30]
cmp r12, 0
cmp esp, 0
je 0x1400342ca
mov r15, qword [r14 + 0x60]
mov rax, qword [r15]
and eax, 0xdf00df
mov r15, qword [r15 + 0xb]
add r15d, eax
shr r15d, 2
sub r15d, 0xc914cd2
cmp r15, 0
je 0x1400342d2
mov r14, qword [r14]
jmp 0x14003429b
mov r14d, dword [r12 + 0x3c]
add r14, r12
add r14, 0x10
mov r15d, dword [r14 + 0x78]
add r15, r12
push r10
mov eax, dword [r15 + 0x20]
add rax, r12
mov r10d, dword [rax]
add r10, r12
mov r14d, dword [r10 + 0xb]
sub r14d, 0x746365
cmp r14d, 0
jne 0x140034307
jmp 0x140034315
inc rax
inc rax
inc rax
inc rax
jmp 0x1400342ee
mov r14d, dword [r15 + 0x20]
sub rax, r14
sub rax, r12
shr eax, 1
mov r14d, dword [r15 + 0x24]
add r14, rax
add r14, r12
mov eax, dword [r14]
mov r14d, dword [r15 + 0x1c]
shl eax, 0x10
shr eax, 0xe
add r14, r12
add r14, rax
mov eax, dword [r14]
add rax, r12
mov r14d, 0xb5000
add r14, r11
push r12
push r11
push r14
push r10
push r10
push rax
mov rcx, r14
mov r9, rsp
mov r8d, 0x40
mov edx, 0xb8000
call rax
pop r15
pop r10
pop r10
pop r14
pop r11
mov r12d, 0x7f80
push rax
movabs r15, 0x3ae00
mov eax, 0xa
imul r12, rax
movabs rax, 0x2111
add rax, r11
add r12, rax
call fcn.1400343cc
mov r12d, 0x8da11
movabs r14, 0xf5000
add r12, r11
mov r15d, 0x3b30
add r14, r11
call fcn.1400343cc
pop rax
jmp 0x1400343f2
nop
ret
mov r12d, 0x8000000
mov r15d, 0x4d4
movabs r14, 0xb5000
mov eax, 3
imul r15d, eax
add r15d, 0x184
add r14, r11
sub r14, r15
mov r15, r14
sub r15, r12
mov r12d, 0x92611
add r12, r11
mov eax, dword [r12]
xor eax, 0xcacc5a43
dec eax
cmp eax, 0
je 0x14003444f
add rax, r14
mov r10, qword [rax]
add r10, r15
mov qword [rax], r10
add r12, 4
jmp 0x14003442d
sub rsp, 0x28
movabs r14, 0x2dc3
mov r12d, 0x48d5
add r12, 0xd16f4
add r12, r14
add r12, r11
push r12
dec r10
lea r15d, [eax]
jmp 0x1400343f0
invalid