joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140299950
Capabilities:
Create process on windows
Create thread
Terminate thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
mov eax, 0x10f0
call fcn.1402cec90
sub rsp, rax
mov rax, qword [0x14041da10]
xor rax, rsp
mov qword [rsp + 0x10e0], rax
cmp qword [rcx + 0xa8], 0
mov rdi, rdx
mov rbx, rcx
je 0x1402999a2
lea rdx, str.Already_running.
add rcx, 0x40
mov r8d, 0x10
call fcn.1400ce190
xor al, al
jmp 0x140299ade
call fcn.1402998c0
cmp qword [rax + 0x10], 0
jne 0x1402999cb
lea rcx, [rbx + 0x40]
lea rdx, str.No_path_to_HitmanPro_found.
mov r8d, 0x1b
call fcn.1400ce190
xor al, al
jmp 0x140299ade
mov rcx, rbx
call fcn.1402998c0
cmp qword [rax + 0x18], 8
jb 0x1402999dd
mov rax, qword [rax]
lea rdx, str.__ls___ls
lea rcx, [rsp + 0xe0]
mov r9, rdi
mov r8, rax
call fcn.140299f30
xor eax, eax
xor edi, edi
lea rcx, [rsp + 0x78]
lea r8d, [rdi + 0x60]
xor edx, edx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
call fcn.1402c5760
lea rax, [rsp + 0x50]
lea rdx, [rsp + 0xe0]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 1
mov dword [rsp + 0x70], 0x68
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x140299a7e
lea rcx, [rbx + 0x40]
lea r8d, [rdi + 0x15]
lea rdx, str.CreateProcess_failed.
call fcn.1400ce190
xor al, al
jmp 0x140299ade
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x60]
mov rcx, qword [rbx + 0xe0]
mov dword [rbx + 0xa0], eax
mov rax, qword [rsp + 0x50]
mov qword [rbx + 0xa8], rax
test rcx, rcx
je 0x140299ab3
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rax, [rsp + 0x68]
lea r8, [0x140299b00]
mov r9, rbx
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0xe0], rax
mov al, 1
mov rcx, qword [rsp + 0x10e0]
xor rcx, rsp
call fcn.1402bcad0
mov rbx, qword [rsp + 0x1110]
add rsp, 0x10f0
pop rdi
ret
Function at 0x140299c00
Capabilities:
Read file on windows

Disassembly:
push rbp
push rdi
push r14
lea rbp, [rsp - 0xf90]
mov eax, 0x1090
call fcn.1402cec90
sub rsp, rax
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x10b8], rbx
mov qword [rsp + 0x10c0], rsi
mov rax, qword [0x14041da10]
xor rax, rsp
mov qword [rbp + 0xf80], rax
mov rbx, rcx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rsi, rax
lea r14, vtable.HitmanProPipeData.0
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
call fcn.140299e20
mov rdi, rax
test rax, rax
jne 0x140299ca4
nop dword [rax + rax]
mov edx, 0x14d
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x140299de1
call fcn.140299e20
mov rdi, rax
test rax, rax
je 0x140299c80
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEvent]
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x58], rsi
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
mov r8d, 0x1000
lea rdx, [rbp - 0x80]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140299dd3
mov eax, dword [rsp + 0x38]
test eax, eax
je 0x140299c61
xor ecx, ecx
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x60], r14
lea rcx, [rbp - 0x80]
mov qword [rsp + 0x70], rcx
mov dword [rsp + 0x78], eax
cmp dword [rbp - 0x80], 0x50504d48
jne 0x140299d99
movzx eax, word [rbp - 0x78]
cmp ax, 1
jne 0x140299d7a
movups xmm0, xmmword [rbp - 0x6c]
movups xmmword [rbx + 0xe9], xmm0
movsd xmm1, qword [rbp - 0x5c]
movsd qword [rbx + 0xf9], xmm1
mov eax, dword [rbp - 0x54]
mov dword [rbx + 0x101], eax
mov byte [rbx + 0xe8], 1
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140299d99
mov r8, rbx
mov edx, dword [rbp - 0x74]
mov ecx, dword [rbp - 0x70]
call rax
movzx eax, word [rbp - 0x78]
cmp ax, 2
jne 0x140299d99
mov rax, qword [rbx + 0x20]
test rax, rax
je 0x140299d99
mov r9, rbx
xor r8d, r8d
lea rdx, [rbp - 0x68]
mov ecx, dword [rbp - 0x74]
call rax
nop
cmp byte [rsp + 0x68], 0
je 0x140299da9
lea rcx, [rbp - 0x80]
call fcn.1402bd0e0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
mov r8d, 0x1000
lea rdx, [rbp - 0x80]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140299cf3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
jmp 0x140299c61
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0xf80]
xor rcx, rsp
call fcn.1402bcad0
lea r11, [rsp + 0x1090]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140299e20
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x14041da10]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor edi, edi
lea rcx, str..pipehitmanpro
xor r9d, r9d
mov qword [rsp + 0x30], rdi
xor r8d, r8d
mov edx, 0xc0000000
mov dword [rsp + 0x28], 0x110000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x140299ece
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe7
jne 0x140299f05
lea rcx, str..pipehitmanpro
mov edx, 0x3e8
call qword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
je 0x140299f05
mov qword [rsp + 0x30], rdi
lea rcx, str..pipehitmanpro
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov dword [rsp + 0x28], 0x110000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140299e71
lea rdx, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
mov dword [rsp + 0x40], 2
call qword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
mov rax, rbx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1402bcad0
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
cmp rbx, 0xffffffffffffffff
jne 0x140299ece
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x140299f1e
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x140299eed

Function at 0x14029a1b0
Capabilities:
Create thread

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x70], rsi
mov rax, qword [0x14041da10]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rsi, rdx
mov rbp, rcx
mov ecx, 0x80
call fcn.1402bcb4c
mov rbx, rax
mov qword [rsp + 0x38], rax
xor edi, edi
test rax, rax
je 0x14029a219
xor edx, edx
mov r8d, 0x80
mov rcx, rax
call fcn.1402c5760
mov rcx, rbx
call fcn.140299fe0
mov rbx, rax
jmp 0x14029a21c
mov rbx, rdi
mov qword [rbx + 8], rbp
mov qword [rbx + 0x10], rsi
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edi
mov r9, rbx
lea r8, [0x14029a290]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rsi, rax
test rax, rax
jne 0x14029a25a
mov r8, qword [rbx]
lea edx, [rax + 1]
mov rcx, rbx
call qword [r8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rsi, rsi
setne al
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1402bcad0
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x14029a4a0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x14041da10]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov r14, rdx
mov rbp, rcx
mov r15d, 1
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov edx, r15d
xor dil, dil
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov r8d, dword [r14 + 0x18]
mov rdx, qword [r14 + 0x10]
mov rcx, qword [rbp + 0x10]
mov rsi, rax
xor eax, eax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x48], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
jne 0x14029a55a
cmp eax, 0x3e5
jne 0x14029a585
mov rax, qword [rbp + 0x18]
lea rdx, [rsp + 0x58]
lea ecx, [rbx + 2]
or r9d, 0xffffffff
xor r8d, r8d
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test eax, eax
je 0x14029a585
mov rcx, qword [rbp + 0x10]
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x30]
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x14029a585
mov ecx, dword [r14 + 0x18]
movzx edi, dil
cmp dword [rsp + 0x50], ecx
cmove edi, r15d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, dil
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1402bcad0
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x1402ac3e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xor r11d, r11d
mov rbx, rcx
bts edx, 8
nop
mov ecx, edx
mov eax, edx
add edx, edx
shr ecx, 7
shr rax, 8
movzx r10d, word [rbx + rax*2]
and ecx, 1
neg ecx
shr r10, 4
sar rcx, 4
and ecx, 0x7f
xor r10, rcx
add r11d, dword [r8 + r10*4]
cmp edx, 0x10000
jb 0x1402ac3f0
mov rbx, qword [rsp + 8]
mov eax, r11d
ret

Function at 0x1402ac430
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov r10d, 0x100
xor ebx, ebx
mov r11d, r8d
or edx, r10d
mov rdi, rcx
nop dword [rax + rax]
add r11d, r11d
mov r8d, edx
mov ecx, edx
shr ecx, 7
shr r8d, 8
mov eax, r10d
and ecx, 1
and eax, r11d
add edx, edx
neg ecx
add eax, r10d
sar rcx, 4
add r8d, eax
movzx r8d, word [rdi + r8*2]
and ecx, 0x7f
shr r8, 4
xor r8, rcx
mov ecx, edx
add ebx, dword [r9 + r8*4]
xor ecx, r11d
not ecx
and r10d, ecx
cmp edx, 0x10000
jb 0x1402ac450
mov rdi, qword [rsp + 0x10]
mov eax, ebx
mov rbx, qword [rsp + 8]
ret
Function at 0x1402ac7b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
push r15
mov r11, qword [rsp + 0x48]
movzx r10d, word [rcx]
mov ebp, r8d
movzx r8d, word [rcx + 2]
mov eax, r10d
xor r10, 0x7f0
shr rax, 4
shr r10, 4
mov r13, r9
mov r14d, dword [r11 + rax*4]
mov eax, r8d
xor r8, 0x7f0
shr rax, 4
shr r8, 4
mov r15d, edx
mov r12d, dword [r11 + rax*4]
mov eax, dword [r11 + r8*4]
mov rbx, rcx
add eax, dword [r11 + r10*4]
add r12d, dword [r11 + r10*4]
xor r9d, r9d
mov dword [rsp + 0x48], eax
mov rsi, r13
nop dword [rax + rax]
cmp r9d, ebp
jae 0x1402ac991
mov r8d, r9d
xor r10d, r10d
or r8d, 8
cmp r8d, 1
je 0x1402ac882
lea edi, [r15*8]
mov ecx, r8d
mov eax, r8d
shr r8d, 1
and ecx, 1
shr rax, 1
neg ecx
add rax, rdi
movzx edx, word [rbx + rax*2 + 4]
sar rcx, 4
shr rdx, 4
and ecx, 0x7f
xor rdx, rcx
add r10d, dword [r11 + rdx*4]
cmp r8d, 1
jne 0x1402ac851
lea eax, [r10 + r14]
inc r9d
add rsi, 4
mov dword [rsi - 4], eax
cmp r9d, 8
jb 0x1402ac830
cmp r9d, 0x10
jae 0x1402ac91c
lea r14, [r9*4]
lea esi, [r9 - 8]
add r14, r13
nop
cmp r9d, ebp
jae 0x1402ac991
mov r8d, esi
xor r10d, r10d
or r8d, 8
cmp r8d, 1
je 0x1402ac905
lea edi, [r15*8]
mov ecx, r8d
mov eax, r8d
shr r8d, 1
and ecx, 1
shr rax, 1
neg ecx
add rax, rdi
movzx edx, word [rbx + rax*2 + 0x104]
sar rcx, 4
shr rdx, 4
and ecx, 0x7f
xor rdx, rcx
add r10d, dword [r11 + rdx*4]
cmp r8d, 1
jne 0x1402ac8d1
lea eax, [r10 + r12]
inc r9d
add r14, 4
mov dword [r14 - 4], eax
inc esi
cmp r9d, 0x10
jb 0x1402ac8b0
cmp r9d, ebp
jae 0x1402ac991
lea rdi, [r9*4]
lea r10d, [r9 - 0x10]
add rdi, r13
sub ebp, r9d
mov esi, ebp
mov ebp, dword [rsp + 0x48]
nop dword [rax]
mov eax, r10d
xor r9d, r9d
bts eax, 8
cmp eax, 1
je 0x1402ac97e
nop
mov edx, eax
mov ecx, eax
shr eax, 1
and edx, 1
shr rcx, 1
movzx r8d, word [rbx + rcx*2 + 0x204]
neg edx
sar rdx, 4
shr r8, 4
and edx, 0x7f
xor r8, rdx
add r9d, dword [r11 + r8*4]
cmp eax, 1
jne 0x1402ac950
lea eax, [r9 + rbp]
add rdi, 4
inc r10d
mov dword [rdi - 4], eax
dec rsi
jne 0x1402ac940
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
pop r15
pop r14
pop r13
pop r12
ret
Function at 0x1402ae930
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov rsi, rcx
xor r11d, r11d
lea rdi, [rcx + 0x33b84]
nop dword [rax]
xor r9d, r9d
mov r10d, r11d
lea eax, [r9 + 1]
lea ebx, [rax + 3]
nop dword [rax]
mov ecx, eax
mov r8d, r10d
add eax, eax
movzx edx, word [rsi + rcx*2 + 0x3422c]
and r8d, 1
shr r10d, 1
mov ecx, r8d
shr rdx, 4
or eax, r8d
neg ecx
sar rcx, 4
and ecx, 0x7f
xor rdx, rcx
add r9d, dword [rsi + rdx*4 + 0x324d4]
dec ebx
jne 0x1402ae960
inc r11d
mov dword [rdi], r9d
add rdi, 4
cmp r11d, 0x10
jb 0x1402ae950
mov rdi, qword [rsp + 0x18]
mov dword [rsi + 0x33bc4], ebx
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
ret
Function at 0x1402ae9c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x210
mov rax, qword [0x14041da10]
xor rax, rsp
mov qword [rsp + 0x200], rax
mov r12d, 4
mov r10, rcx
lea rbp, [rcx + 0x304d8]
mov edi, r12d
lea rsi, [rsp + 0x10]
nop dword [rax]
movzx edx, byte [rbp]
xor ebx, ebx
mov r11d, edi
mov r9d, edx
mov eax, edx
lea r8d, [rbx + 1]
and eax, 1
shr r9d, 1
dec r9d
or eax, 2
mov ecx, r9d
shl eax, cl
sub r11d, eax
test r9d, r9d
je 0x1402aea81
mov r14d, edx
mov r15d, eax
mov eax, r8d
mov edx, r11d
add r8d, r8d
sub rax, r14
and edx, 1
shr r11d, 1
add rax, r15
or r8d, edx
movzx ecx, word [r10 + rax*2 + 0x34146]
mov eax, edx
neg eax
shr rcx, 4
sar rax, 4
and eax, 0x7f
xor rcx, rax
add ebx, dword [r10 + rcx*4 + 0x324d4]
dec r9d
jne 0x1402aea41
inc edi
mov dword [rsi], ebx
inc rbp
add rsi, r12
cmp edi, 0x80
jb 0x1402aea10
lea rsi, [rsp]
lea rbx, [r10 + 0x32f84]
lea rdi, [r10 + 0x33f48]
sub rsi, r10
lea r14, [r10 + 0x3338c]
sub rsi, 0x33384
nop word [rax + rax]
xor r11d, r11d
cmp dword [r10 + 0x33bc8], r11d
jbe 0x1402aeb1e
nop dword [rax]
mov eax, r11d
xor r9d, r9d
or eax, 0x40
cmp eax, 1
je 0x1402aeb0e
nop
mov edx, eax
mov ecx, eax
shr eax, 1
and edx, 1
shr rcx, 1
movzx r8d, word [rdi + rcx*2]
neg edx
sar rdx, 4
shr r8, 4
and edx, 0x7f
xor r8, rdx
add r9d, dword [r10 + r8*4 + 0x324d4]
cmp eax, 1
jne 0x1402aeae0
mov dword [rbx + r11*4], r9d
inc r11d
cmp r11d, dword [r10 + 0x33bc8]
jb 0x1402aead0
mov edx, 0xe
cmp dword [r10 + 0x33bc8], edx
jbe 0x1402aeb4d
nop dword [rax]
mov eax, edx
lea rcx, [rbx + rax*4]
mov eax, edx
inc edx
shr eax, 1
sub eax, 5
shl eax, 4
add dword [rcx], eax
cmp edx, dword [r10 + 0x33bc8]
jb 0x1402aeb30
mov eax, dword [rbx]
lea r8, [r10 + 0x304d8]
lea rdx, [r14 + 8]
mov dword [r14 - 8], eax
mov eax, dword [rbx + 4]
mov r9d, 0x7c
mov dword [r14 - 4], eax
mov eax, dword [rbx + 8]
mov dword [r14], eax
mov eax, dword [rbx + 0xc]
mov dword [r14 + 4], eax
nop dword [rax + rax]
movzx eax, byte [r8]
lea rdx, [rdx + 4]
lea r8, [r8 + 1]
mov ecx, dword [rbx + rax*4]
add ecx, dword [rdx + rsi - 4]
mov dword [rdx - 4], ecx
dec r9
jne 0x1402aeb80
sub rdi, 0xffffffffffffff80
add rbx, 0x100
add r14, 0x200
sub rsi, 0x200
dec r12
jne 0x1402aeac0
mov dword [r10 + 0x3d340], r12d
mov rcx, qword [rsp + 0x200]
xor rcx, rsp
call fcn.1402bcad0
lea r11, [rsp + 0x210]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1402afce0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor eax, eax
mov dword [rcx + 0x3c], 0x20
mov qword [rcx + 0x68], 1
mov qword [rcx + 0x60], 4
lea r8, [rcx + 0x84]
mov qword [rcx + 0x40], rax
mov qword [rcx + 0x28], rax
nop dword [rax + rax]
mov edx, eax
mov ecx, eax
inc eax
shr ecx, 1
and edx, 1
lea r8, [r8 + 4]
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov dword [r8 - 4], ecx
cmp eax, 0x100
jb 0x1402afd10
ret
Function at 0x1402c0e34
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.1402c0c9c

Function at 0x1402c2ec8
Capabilities:
Access peb ldr_data

Disassembly:
push r12
push r14
push r15
sub r12, r12
add r12, 0x60
mov r14, qword gs:[r12]
push r11
Function at 0x14000acd0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xa0
mov rax, qword [0x140020008]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
lea rcx, str.APPDATA
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], dil
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], dil
jne 0x14000ad25
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.14000ef20
nop
movabs rdi, 0x7fffffffffffffff
mov rax, rdi
mov rcx, qword [rsp + 0x60]
sub rax, rcx
cmp rax, 0xe
jb 0x14000ae8b
lea r9, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae r9, qword [rsp + 0x50]
mov qword [rsp + 0x30], 0xe
lea rax, str.MicrosoftCLR
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x70]
call fcn.140010d60
nop
mov rax, qword [rsp + 0x80]
sub rdi, rax
cmp rdi, 1
jb 0x14000ae85
lea r9, [rsp + 0x70]
cmp qword [rsp + 0x88], 0x10
cmovae r9, qword [rsp + 0x70]
mov qword [rsp + 0x30], 1
lea rcx, [0x140017bb0]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
mov rcx, rbx
call fcn.140010d60
nop
mov rdx, qword [rsp + 0x88]
cmp rdx, 0x10
jb 0x14000ae21
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ae1b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000ae1b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140011b8c
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x14000ae61
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ae5c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000ae5c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140011b8c
mov rax, rbx
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140011810
mov rbx, qword [rsp + 0xb8]
add rsp, 0xa0
pop rdi
ret
call fcn.1400095b0
nop
call fcn.1400095b0
int3
Function at 0x14000aea0
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x140020008]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rsi, rcx
mov qword [rsp + 0x48], rcx
cmp qword [rcx + 0x18], 0x10
jb 0x14000aee1
mov rbx, qword [rcx]
mov rcx, rbx
mov rdx, rbx
jmp 0x14000aee7
mov rbx, rsi
mov rdx, rsi
mov r14, qword [rsi + 0x10]
add r14, rcx
xor r15d, r15d
cmp rdx, r14
je 0x14000afdd
cmp byte [rbx], 0x5c
jne 0x14000af91
mov byte [rbx], r15b
mov rdx, rsi
lea rcx, [rsp + 0x28]
call fcn.14000e650
mov rdi, rax
mov rcx, rax
cmp qword [rax + 0x18], 0x10
jb 0x14000af23
mov rcx, qword [rax]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x14000af41
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x14000af41
xor bpl, bpl
jmp 0x14000af44
mov bpl, 1
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x14000af7a
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x14000af75
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000af9c
mov rcx, r8
call fcn.140011b8c
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], 0xf
mov byte [rdi], r15b
test bpl, bpl
je 0x14000afa3
mov byte [rbx], 0x5c
inc rbx
cmp rbx, r14
jmp 0x14000aef4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rdx, qword [rsi + 0x18]
cmp rdx, 0x10
jb 0x14000afd9
inc rdx
mov rcx, qword [rsi]
cmp rdx, 0x1000
jb 0x14000afd4
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000b04b
mov rcx, r8
call fcn.140011b8c
xor al, al
jmp 0x14000b015
mov rdx, qword [rsi + 0x18]
cmp rdx, 0x10
jb 0x14000b013
inc rdx
mov rcx, qword [rsi]
cmp rdx, 0x1000
jb 0x14000b00e
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000b04b
mov rcx, r8
call fcn.140011b8c
mov al, 1
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], 0xf
mov byte [rsi], 0
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140011810
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14000b2a0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x140020008]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, rcx
cmp byte [rcx + 0x10], 0
jne 0x14000b323
mov byte [rcx + 0x10], 1
mov eax, dword [rcx + 0x14]
mov dword [rcx + 0x18], eax
mov ecx, 0x10
call fcn.140011830
mov qword [rax], rbx
lea rcx, [0x14000b250]
mov qword [rax + 8], rcx
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x1400114a0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14000b33d
cmp dword [rbx + 8], 0
jne 0x14000b336
movaps xmm1, xmmword [rsp + 0x30]
movups xmmword [rbx], xmm1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140011810
add rsp, 0x50
pop rbx
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
nop
mov dword [rsp + 0x38], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3