joyce8/EMBER2024-capa huggingface dataset:
Function at 0x456d20
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x456dea
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0x70], rbx
mov qword [rsp + 8], 0
mov qword [rsp + 0x10], 0
lea rdx, [rsp + 0x18]
movups xmmword [rdx], xmm15
lea rdx, [rsp + 0x28]
movups xmmword [rdx], xmm15
lea rdx, [rsp + 0x38]
movups xmmword [rdx], xmm15
lea rdx, [rsp + 0x48]
movups xmmword [rdx], xmm15
lea rdx, [0x00456e20]
mov qword [rsp + 0x10], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x18], rdx
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rdi
lea rax, [rsp + 8]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.0045ee80
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
nop
call fcn.0045efc0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00456d20

Function at 0x45d980
Capabilities:
Access peb ldr_data

Disassembly:
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov r13, 0
mov qword [rsp + 0x20], r13
mov byte [rsp + 0x17], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
mov rcx, qword [rcx + 0x30]
nop
inc dword [rcx + 0x244]
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
mov rdx, qword [rcx + 0x30]
nop
mov rsi, rcx
mov qword [rdx + 0x138], rcx
mov rcx, qword [rsi + 0x30]
mov qword [rsi + 0xe8], rcx
lea rcx, fcn.004403a0
mov qword [rsp + 0x20], rcx
mov byte [rsp + 0x17], 1
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
mov rcx, qword [rcx + 0x30]
mov qword [rsp + 0x18], rcx
mov rdx, qword [rsp + 0x38]
mov qword [rcx + 0x2e0], rdx
mov rdx, qword [rsp + 0x40]
mov qword [rcx + 0x2e8], rdx
lea rdx, [rsp + 0x48]
mov qword [rcx + 0x2f0], rdx
lea rbx, [rcx + 0x2e0]
mov rax, qword [0x005dda80]
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
call fcn.004032a0
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rcx + 0x2f8]
mov rsi, qword [rcx + 0x300]
mov rcx, qword [rcx + 0x308]
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], rcx
mov byte [rsp + 0x17], 0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
call fcn.004403a0
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
Function at 0x461100
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4024af
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
nop
call fcn.00408be0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045efc0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x402480
cmp byte [0x00632a97], 0
je 0x461115
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x45e0e0
jmp 0x402480

Function at 0x461120
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x00632e00]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x00632a97], 0
je 0x461155
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x00633080]
aesenc xmm0, xmmword [0x00633090]
aesenc xmm0, xmmword [0x006330a0]
movq rax, xmm0
ret
jmp 0x408de0

Function at 0x461160
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x00632e00]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x00632a97], 0
je 0x461196
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x00633080]
aesenc xmm0, xmmword [0x00633090]
aesenc xmm0, xmmword [0x006330a0]
movq rax, xmm0
ret
jmp 0x408e40

Function at 0x462ae0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x30
mov rcx, 0xfffffffffffffff4
mov qword [rsp], rcx
mov rax, qword [sym.imp.kernel32.dll_GetStdHandle]
call rax
mov rcx, rax
mov qword [rsp], rcx
lea rdx, [0x00633000]
mov qword [rsp + 8], rdx
lea r8d, [0x00632ab4]
mov qword [rsp + 0x10], r8
lea r9, [rsp + 0x28]
mov qword [r9], 0
mov qword [rsp + 0x18], r9
mov qword [rsp + 0x20], 0
mov rax, qword [sym.imp.kernel32.dll_WriteFile]
call rax
call fcn.00461060
add rsp, 0x30
ret

Function at 0x4639c0
Capabilities:
Access peb ldr_data

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x38], r10
mov qword [rsp + 0x40], r11
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x50], rax
call fcn.0045dc60
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
Function at 0x4a7720
Capabilities:
Encode data using xor
Encrypt data using salsa20 or chacha

Disassembly:
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov ecx, 0x14
lea rax, str.expand_32_byte_k
movdqa xmm0, xmmword [rax]
movdqa xmm5, xmmword [rax + 0x10]
movdqa xmm6, xmmword [rax + 0x20]
movdqu xmm1, xmmword [rdi]
movdqu xmm2, xmmword [rdi + 0x10]
movdqu xmm3, xmmword [rsi]
paddd xmm0, xmm1
pxor xmm3, xmm0
pshufb xmm3, xmm5
paddd xmm2, xmm3
pxor xmm1, xmm2
movdqa xmm4, xmm1
pslld xmm1, 0xc
psrld xmm4, 0x14
pxor xmm1, xmm4
paddd xmm0, xmm1
pxor xmm3, xmm0
pshufb xmm3, xmm6
pshufd xmm0, xmm0, 0x93
paddd xmm2, xmm3
pshufd xmm3, xmm3, 0x4e
pxor xmm1, xmm2
pshufd xmm2, xmm2, 0x39
movdqa xmm4, xmm1
pslld xmm1, 7
psrld xmm4, 0x19
pxor xmm1, xmm4
sub rcx, 2
paddd xmm0, xmm1
pxor xmm3, xmm0
pshufb xmm3, xmm5
paddd xmm2, xmm3
pxor xmm1, xmm2
movdqa xmm4, xmm1
pslld xmm1, 0xc
psrld xmm4, 0x14
pxor xmm1, xmm4
paddd xmm0, xmm1
pxor xmm3, xmm0
pshufb xmm3, xmm6
pshufd xmm0, xmm0, 0x39
paddd xmm2, xmm3
pshufd xmm3, xmm3, 0x4e
pxor xmm1, xmm2
pshufd xmm2, xmm2, 0x93
movdqa xmm4, xmm1
pslld xmm1, 7
psrld xmm4, 0x19
pxor xmm1, xmm4
ja 0x4a7756
movdqu xmmword [rdx], xmm0
movdqu xmmword [rdx + 0x10], xmm3
ret
Function at 0x4c1a20
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x4c1c83
sub rsp, 0xb0
mov qword [rsp + 0xa8], rbp
lea rbp, [rsp + 0xa8]
test rax, rax
je 0x4c1c67
mov qword [rsp + 0xb8], rax
mov rbx, qword [rax + 8]
mov rdx, qword [rax]
mov rcx, qword [rax + 0x10]
test rbx, rbx
jne 0x4c1a6d
xor ebx, ebx
xor ecx, ecx
jmp 0x4c1a80
mov rax, rdx
call fcn.004b5c20
mov rcx, rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x48], rbx
cmp qword [rax + 0x28], 0
je 0x4c1b9b
mov rcx, qword [rax + 0x18]
mov rax, rcx
nop
call fcn.00474dc0
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x58], rbx
mov rcx, qword [rsp + 0xb8]
mov r8, qword [rcx + 0x20]
mov r9, qword [rcx + 0x28]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x00504981]
mov esi, 1
lea rax, [rsp + 0x68]
mov rbx, qword [rsp + 0x88]
call fcn.0044bc00
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call fcn.004022e0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
nop
jl 0x4c1b5e
xor eax, eax
lea rbx, [0x00504997]
mov ecx, 1
mov rdi, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x60]
lea r8, [0x00504a05]
mov r9d, 2
mov r10, qword [rsp + 0x90]
mov r11, qword [rsp + 0x58]
call fcn.0044bce0
jmp 0x4c1b8b
xor eax, eax
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x60]
lea rdi, [0x0052debb]
mov esi, 1
mov r8, qword [rsp + 0x90]
mov r9, qword [rsp + 0x58]
call fcn.0044bc00
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov rax, qword [rax + 0x18]
nop
call fcn.00474dc0
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x50], rbx
mov rcx, qword [rsp + 0x88]
mov qword [rsp], rcx
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 8], rdx
mov byte [rsp + 0x10], 0x3a
call fcn.004022e0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x4c1c2a
xor eax, eax
lea rbx, [0x00504997]
mov ecx, 1
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x48]
lea r8, [0x00504a05]
mov r9d, 2
mov r10, qword [rsp + 0x98]
mov r11, qword [rsp + 0x50]
call fcn.0044bce0
jmp 0x4c1c57
xor eax, eax
mov rbx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x0052debb]
mov esi, 1
mov r8, qword [rsp + 0x98]
mov r9, qword [rsp + 0x50]
call fcn.0044bc00
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
lea rax, [0x00504d61]
mov ebx, 5
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov qword [rsp + 8], rax
call fcn.0045efc0
mov rax, qword [rsp + 8]
jmp fcn.004c1a20
Function at 0x1400030c0
Capabilities:
Get file size
Read file on windows

Disassembly:
push rsi
push rdi
push r15
sub rsp, 0x70
mov rax, qword [0x1400a20c0]
xor rax, rsp
mov qword [rsp + 0x68], rax
cmp qword [0x1400a2c38], 0xf
mov rdi, rdx
mov r8, qword [0x1400a2c30]
lea rdx, [0x1400a2c20]
jbe 0x1400030fa
mov rdx, qword [0x1400a2c20]
add r8, rdx
lea rcx, [rsp + 0x48]
call fcn.140025120
cmp qword [rax + 0x18], 7
jbe 0x140003111
mov rax, qword [rax]
xor r15d, r15d
xor r9d, r9d
mov qword [rsp + 0x30], r15
mov edx, 0xc0000000
mov dword [rsp + 0x28], 0x80
mov rcx, rax
mov dword [rsp + 0x20], 3
lea r8d, [r15 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdx, qword [rsp + 0x60]
mov rsi, rax
cmp rdx, 7
jbe 0x140003183
mov rcx, qword [rsp + 0x48]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000317e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400032b7
call fcn.140054120
movdqa xmm0, xmmword [0x140094720]
mov word [rsp + 0x48], r15w
movdqu xmmword [rsp + 0x58], xmm0
cmp rsi, 0xffffffffffffffff
jne 0x1400031a4
xor al, al
jmp 0x1400032a1
xor edx, edx
mov qword [rsp + 0xa8], r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r14d, eax
cmp eax, 0xffffffff
je 0x14000328e
mov rdx, qword [rdi + 0x10]
mov ecx, r14d
cmp r14, rdx
ja 0x1400031e6
mov qword [rdi + 0x10], rcx
mov rdx, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x1400031e0
mov rdx, qword [rdi]
mov byte [rdx + r14], r15b
jmp 0x140003255
mov r8, qword [rdi + 0x18]
mov qword [rsp + 0xa0], rbp
mov rax, r8
mov rbp, rcx
sub rax, rdx
sub rbp, rdx
cmp rbp, rax
ja 0x14000323a
mov qword [rsp + 0x90], rbx
mov rax, rdi
mov qword [rdi + 0x10], rcx
cmp r8, 0xf
jbe 0x14000321b
mov rax, qword [rdi]
lea rbx, [rax + rdx]
mov r8, rbp
mov rcx, rbx
xor edx, edx
call fcn.140080d20
mov byte [rbx + rbp], r15b
mov rbx, qword [rsp + 0x90]
jmp 0x14000324d
mov r9, rbp
mov byte [rsp + 0x20], r15b
mov rdx, rbp
mov rcx, rdi
call fcn.140026ff0
mov rbp, qword [rsp + 0xa0]
cmp qword [rdi + 0x18], 0xf
mov dword [rsp + 0x40], r15d
jbe 0x140003264
mov rdi, qword [rdi]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], r15
mov r8d, r14d
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14000328e
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x140003299
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov r14, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140054100
add rsp, 0x70
pop r15
pop rdi
pop rsi
ret
call fcn.14006a6c0
int3
Function at 0x140004950
Capabilities:
Move file

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x18], 7
mov rbx, rdx
mov rdi, rcx
jbe 0x14000496a
mov rcx, qword [rcx]
cmp qword [rdx + 0x18], 7
jbe 0x140004974
mov rdx, qword [rdx]
mov qword [rsp + 0x40], rsi
call qword [sym.imp.KERNEL32.dll_MoveFileW]
mov rcx, qword [rdi + 0x18]
test eax, eax
je 0x140004a1d
cmp rcx, 7
jbe 0x1400049c6
lea rdx, [rcx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x1400049c1
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140004ac1
mov rcx, r8
call fcn.140054120
xor esi, esi
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], rsi
mov word [rdi], si
mov rdx, qword [rbx + 0x18]
cmp rdx, 7
jbe 0x140004a16
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140004a11
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140004ac1
mov rcx, r8
call fcn.140054120
mov al, 1
jmp 0x140004aa2
cmp rcx, 7
jbe 0x140004a54
lea rdx, [rcx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x140004a4f
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140004ac1
mov rcx, r8
call fcn.140054120
xor esi, esi
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], rsi
mov word [rdi], si
mov rdx, qword [rbx + 0x18]
cmp rdx, 7
jbe 0x140004aa0
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140004a9b
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140004ac1
mov rcx, r8
call fcn.140054120
xor al, al
mov word [rbx], si
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], rsi
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
call fcn.14006a6c0
int3
Function at 0x1400071e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1400
call fcn.140054ba0
sub rsp, rax
mov rax, qword [0x1400a20c0]
xor rax, rsp
mov qword [rsp + 0x13f0], rax
mov r13, rcx
mov qword [rsp + 0x28], rcx
xor ebx, ebx
mov dword [rsp + 0x20], ebx
call fcn.140033f64
mov rcx, rax
movabs rax, 0x346dc5d63886594b
imul rcx
sar rdx, 0xb
mov rax, rdx
shr rax, 0x3f
add rdx, rax
movabs rax, 0x5555555555555555
mov qword [rsp + 0x13e8], rax
mov qword [rsp + 0x68], rdx
lea ecx, [rbx + 1]
movabs r8, 0x5851f42d4c957f2d
nop dword [rax]
mov rax, rdx
shr rax, 0x3e
xor rdx, rax
imul rdx, r8
add rdx, rcx
mov qword [rsp + rcx*8 + 0x68], rdx
inc rcx
cmp rcx, 0x138
jb 0x140007270
mov dword [rsp + 0x60], 0x138
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbx
mov r8d, CreateDecompressor
lea rdx, str.abcdefghijklmnopqrstuvwxyz0123456789
lea rcx, [rsp + 0x40]
call fcn.140026400
nop
mov rbp, qword [rsp + 0x50]
dec rbp
xorps xmm0, xmm0
movups xmmword [r13], xmm0
mov qword [r13 + 0x10], rbx
mov qword [r13 + 0x18], rbx
xor r8d, r8d
lea rdx, [0x140092c54]
mov rcx, r13
call fcn.140026400
mov dword [rsp + 0x20], 1
mov r14d, 8
lea r12d, [r14 + 0x38]
mov r15, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x40]
nop word [rax + rax]
lea rcx, [rsp + 0x60]
cmp rbp, 0xffffffffffffffff
jne 0x140007322
call fcn.140029300
jmp 0x140007379
lea rbx, [rbp + 1]
call fcn.140029300
mov rcx, rax
mov rax, rbx
mul rcx
mov r8, rdx
mov rcx, rax
cmp rax, rbx
jae 0x14000736d
mov rax, rbx
neg rax
xor edx, edx
div rbx
mov rdi, rdx
cmp rcx, rdx
jae 0x14000736d
lea rcx, [rsp + 0x60]
call fcn.140029300
mov rcx, rax
mov rax, rbx
mul rcx
mov r8, rdx
cmp rax, rdi
jb 0x140007352
mov ecx, r12d
and ecx, 0x3f
mov rax, r8
shr rax, cl
lea rdx, [rsp + 0x40]
cmp r15, 7
cmova rdx, rsi
movzx edx, word [rdx + rax*2]
mov rcx, r13
call fcn.140022030
sub r14, 1
jne 0x140007310
cmp r15, 7
jbe 0x1400073d3
lea rdx, [r15*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x1400073cb
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007407
mov rcx, rsi
call fcn.140054120
mov rax, r13
mov rcx, qword [rsp + 0x13f0]
xor rcx, rsp
call fcn.140054100
lea r11, [rsp + 0x1400]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.14006a6c0
int3
Function at 0x140008ea0
Capabilities:
Create pipe
Create process on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x100
mov rbx, rcx
mov dword [rbp - 0x59], CreateCompressor
xor edi, edi
mov dword [rbp - 0x49], 1
lea rcx, [rbp + 0x6f]
mov qword [rbp - 0x51], rdi
xor r9d, r9d
lea r8, [rbp - 0x59]
lea rdx, [rbp + 0x67]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
mov rcx, qword [rbp + 0x6f]
lea edx, [rdi + 1]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov rax, qword [rbp + 0x67]
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
mov qword [rbp + 0x27], rax
movaps xmmword [rbp - 9], xmm0
movups xmmword [rbp + 7], xmm0
mov dword [rbp - 0x39], 0x68
movups xmmword [rbp + 0x17], xmm0
mov qword [rbp + 0x1f], rax
movups xmmword [rbp - 0x29], xmm0
mov word [rbp + 7], di
movups xmmword [rbp - 0x19], xmm0
psrldq xmm0, 0xc
movd eax, xmm0
bts eax, 8
cmp qword [rbx + 0x18], 7
mov dword [rbp + 3], eax
jbe 0x140008f3f
mov rbx, qword [rbx]
lea rax, [rbp + 0x37]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rcx, str.C:windows_system32cmd.exe
lea rax, [rbp - 0x39]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov rdx, rbx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rcx, qword [rbp + 0x67]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x6f]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0x100]
mov al, 1
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14000a110
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1400a20c0]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
call fcn.140066edc
mov rsi, rax
mov rdi, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x14000a150
mov rdi, qword [rbx]
xor ebp, ebp
mov dword [rax], ebp
lea r8d, [rbp + 0xa]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.14005ab28
cmp rdi, qword [rsp + 0x20]
je 0x14000a259
cmp dword [rsi], 0x22
je 0x14000a246
mov r8d, eax
xor edx, edx
lea ecx, [rbp + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
jne 0x14000a1f9
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x14000a1c6
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x14000a1c1
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000a253
mov rcx, r8
call fcn.140054120
xor al, al
mov byte [rbx], 0
mov qword [rbx + 0x18], recv
mov qword [rbx + 0x10], rbp
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140054100
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
mov edx, 1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
mov rdx, qword [rbx + 0x18]
test eax, eax
je 0x14000a190
cmp rdx, 0xf
jbe 0x14000a242
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x14000a23d
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000a253
mov rcx, r8
call fcn.140054120
mov al, 1
jmp 0x14000a1c8
lea rcx, str.stoul_argument_out_of_range
call fcn.14002d5e8
nop
call fcn.14006a6c0
nop
lea rcx, str.invalid_stoul_argument
call fcn.14002d5a0
int3
Function at 0x14000ed60
Capabilities:
Enumerate threads

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xa0
mov rax, qword [0x1400a20c0]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov rdi, rcx
mov qword [rbp - 9], rcx
xor r12d, r12d
mov dword [rbp - 0x49], r12d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r14d, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r15d, eax
mov qword [rdi], r12
mov qword [rdi + 8], r12
lea ecx, [r12 + 0x20]
call fcn.140054128
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rdi], rax
mov dword [rbp - 0x49], 1
xor edx, edx
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 1], rax
mov qword [rbp + 7], rsi
mov rbx, rsi
cmp rsi, 0xffffffffffffffff
je 0x14000ef10
mov dword [rbp + 0xf], CreateCompressor
lea rdx, [rbp + 0xf]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x14000ef10
movabs r13, 0x7ffffffffffffff
nop
cmp dword [rbp + 0xf], 0x10
jb 0x14000eef1
cmp dword [rbp + 0x1b], r14d
jne 0x14000eef1
mov edx, dword [rbp + 0x17]
cmp edx, r15d
je 0x14000eef1
mov rbx, qword [rdi]
mov rax, qword [rbx + 8]
mov qword [rbp - 0x39], rax
mov dword [rbp - 0x31], r12d
mov rcx, rbx
cmp byte [rax + 0x19], 0
jne 0x14000ee96
nop dword [rax + rax]
mov qword [rbp - 0x39], rax
cmp dword [rax + 0x1c], edx
jae 0x14000ee83
mov dword [rbp - 0x31], r12d
mov rax, qword [rax + 0x10]
jmp 0x14000ee90
mov dword [rbp - 0x31], 1
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x14000ee70
cmp byte [rcx + 0x19], 0
jne 0x14000eea1
cmp edx, dword [rcx + 0x1c]
jae 0x14000eef1
cmp qword [rdi + 8], r13
je 0x14000ef4f
mov qword [rbp - 0x19], rdi
mov qword [rbp - 0x11], r12
mov ecx, CloseCompressor
call fcn.140054128
mov r8, rax
mov eax, dword [rbp + 0x17]
mov dword [r8 + 0x1c], eax
mov qword [r8], rbx
mov qword [r8 + 8], rbx
mov qword [r8 + 0x10], rbx
mov word [r8 + 0x18], 0
mov qword [rbp - 0x11], r12
movups xmm0, xmmword [rbp - 0x39]
movaps xmmword [rbp - 0x39], xmm0
lea rdx, [rbp - 0x39]
mov rcx, rdi
call fcn.140028c50
mov dword [rbp + 0xf], CreateCompressor
mov rbx, rsi
lea rdx, [rbp + 0xf]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x14000ee30
test rbx, rbx
je 0x14000ef1f
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rax, rdi
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.140054100
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400030a0
int3