joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1416026a1
Capabilities:
Authenticate hmac

Disassembly:
or dx, bx
inc dx
rol sil, 1
lea rax, [rdx + rdx*2 - 0x4a4e324e]
inc r9d
neg sil
rol r9, 0x3c
xor dx, 0xc597
xor sil, 0x82
mov ecx, edx
xor r9, rbp
jne 0x141591c76
mov qword [rsp + rdi - 0x5521], 0xfffffffffe8e709b
mov r8w, word [rbp + rdi*8 - 0x2a908]
lea rbp, [rbp + rdi - 0x551f]
shr al, 0xc2
je 0x141577d67
jns 0x14161aed2

Function at 0x14160d6c0
Capabilities:
Authenticate hmac

Disassembly:
lea rsp, [rsp + 0x30]
jne 0x141628c2f
mov r10d, 0x2d0c9b29
pop rbx
jmp 0x1415eca7f
mov ebx, 0xc82721b0
call fcn.1415b8704

Function at 0x14160f38f
Capabilities:
Authenticate hmac

Disassembly:
sub r10, 4
movzx eax, cx
mov edx, eax
mov ebp, dword [r10 + rax - 0xdc0c]
mov ebx, edx
shl ebx, cl
xor ebp, r11d
bswap rcx
sal dx, 0x24
jp 0x14158e1ae
lea rsp, [rsp + 8]
add rsp, rcx
test ebx, ebx
push 0x373d1f15
push 0x4d27791d
call fcn.141557014
mov ecx, 0xfd06dc0c
jmp 0x1415ebc53

Function at 0x141614908
Capabilities:
Authenticate hmac

Disassembly:
or qword [rsp + rsi - 0x242f], rax
not edx
rol byte [rsp + rsi - 0x2433], 0xa6
sub ecx, eax
or byte [rsp + rsi - 0x2440], r9b
ror edx, 2
mov qword [rsp + rsi*4 - 0x9100], rbx
xor dword [rsp + rsi*2 - 0x4870], edx
sal cl, 0x41
add r8b, r9b
mov rbx, qword [rsp + rsi - 0x2428]
push r8
push r8
setge byte [rsp + rsi*8 - 0x1221a]
movsxd rdx, edx
inc r8
adc cx, ax
add r10, rdx
push r9
pop r9
pop rdx
pop rdx
pop rcx
pop rsi
pop rsi
pop rax
pop rdi
jmp fcn.1416256a7

Function at 0x141617750
Capabilities:
Authenticate hmac

Disassembly:
mov qword [rsp + rcx*2 - 0x64], rdx
mov qword [rsp + rcx - 0x32], r8
ret
lea r10, [r10 + rbp - 0x4590f591]
mov esi, dword [r10 + rbp - 0x4590f58d]
xor esi, r11d
call fcn.1415ac3da
sub r11, 4
call fcn.141555c2e
lea rax, [r8*8 - 0x1ae9b153]
lea rdx, [r8*4 - 0x5167f2e7]
inc r10d
dec eax
rol r10d, 3
neg r10d
rol r9b, 0x85
sal eax, 0x7d
xor r10d, 0xdc06959c
xor r8w, dx
movzx ecx, r9w
rol ecx, 0x5d
push rsi
lea rsi, [rax*8 - 0x66cfe2ec]
movsx edi, r9w
jae 0x141550a07
mov word [r11 + rcx*2 - 0x64], bx
xor bpl, 0xb1
jae 0x1415caa07
mov ebp, 0x4590f58d
jmp 0x1415db319

Function at 0x14161a388
Capabilities:
Authenticate hmac

Disassembly:
call fcn.141614908
mov rax, qword [rcx + r11 - 0x1c494cdc]
mov rdi, qword [rax + rdx*2 - 0x40d0]
movzx esi, cx
dec rsi
jne 0x14158700e
mov qword [rcx + r11 - 0x1c494cdc], rdi
sal rcx, 0x14
sub r9w, 0xaaab
jmp r10
adc r10, rdx
inc ax
mov edx, eax
pop rdx
js fcn.1416256a7
mov qword [rsp + 8], 0xffffffffbaaa48b2
mov edx, dword [rbp + riz]
lea rcx, [r8*8 + 0x24ae510b]
add rbp, 4
push rcx
xor qword [rsp + 0x18], 0xffffffffee1ad19a
xor edx, ebx
ror dword [rsp + 0x11], cl
and r8, qword [rsp + 0x15]
movsx esi, word [rsp + 0x19]
ror edx, 3
lea r9, [rsi + rcx*2 + 0x2415481b]
sal rax, cl
bswap edx
jp 0x14154aa04
Function at 0x14161ab4b
Capabilities:
Authenticate hmac

Disassembly:
push 0xfffffffff124728f
cmp ebx, 4
lea rsp, [rsp + 8]
jne 0x14161fe0d
push 0xffffffffa60dfd38
mov r9, rax
lea rsp, [rsp + 8]
jmp 0x14161fe1e
jmp 0x141545229
cmp ebx, 3
lea rsp, [rsp + 8]
jne 0x141566fd3
mov r8d, 0x1b99b429
mov r8, rax
jmp 0x14161fe1e
jmp 0x1415858e5
mov eax, 0x5bace94
xor al, al
push rax
mov rax, qword [rbp + rbx*8 + 0x20]
mov qword [rsp], rax

Function at 0x14161b582
Capabilities:
Authenticate hmac

Disassembly:
mov qword [rsp], rax
mov qword [rsp], rbp
lea rax, [rax + rax - 0x4bc9fe76]
mov ebp, eax
push r8
mov r8d, eax
push rdi
lea rbp, [rax + r8*2 - 0x484c9fef]
xchg r8b, bpl
push rsi
push r15
pushfq
lea rsi, [r8 + 0x4eb34687]
shl eax, 0xe5
push rdx
lea r14, [rsi*2 + 0x33c2b0d]
adc rbp, rbp
lea esi, [r8 + 0x188b4f1b]
movzx r9d, al
inc r14b
shl rsi, 2
add r9, 0x670b7c89
movzx edi, ax
push rcx
sal r9b, 0xa5
movsx ecx, dil
sbb r14d, ecx
push r13
movabs r9, 0
push rbx
push r10
lea rdx, [r8 - 0xa7f8bd0]
push r12
add di, r14w
lea rdi, [rax + rdx*8 + 0x2412f329]
lea rdi, [rsp + rdx - 0x1cf52525]
call fcn.14155dffc

Function at 0x14161be63
Capabilities:
Authenticate hmac

Disassembly:
xor al, r11b
sal sil, 3
rol al, 1

Function at 0x14161faa1
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp], rax
xor edi, ebx
xadd byte [rsp + 1], ah
mov esi, 0x29853f0c
xor edi, 0x4695f63e
movzx r9d, ax
xor rax, 0x282fc00e
dec edi
neg dword [rsp + r9*2 - 0x393a]
lea rdx, [r9 + 0x54b01416]
setbe sil
xor edi, 0x4c235f92
rol qword [rsp + rsi - 0x29853f01], 0xf3
lea rax, [r9 + rdx + 0x43977527]
neg sil
bswap edi
lea rcx, [rsi - 0x24713ce2]
dec edi
neg edi
not qword [rsp + rsi - 0x29853fff]
ror edi, 1
lea rcx, [rcx + rsi + 0x7b2a6c3c]
sar ax, 0x2f
mov qword [rsp + rsi*2 - 0x530a7ffe], rbx
movsx r8d, sil
sete r8b
xor dword [rsp + rsi*2 - 0x530a7ffe], edi
sub r8w, ax
call fcn.141564977

Function at 0x14161fb34
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp], rsi
and r9d, 0x51ad90a0
xor dword [rsp + r9 - 0x51ad90a0], eax
pop rsi
xadd dx, bx
neg di
call fcn.14153f959
ror ecx, 3
inc ecx
movsx ebp, di
rol ecx, 2
lea rdx, [rbx + rbx*8 + 0x69167a4]
sub qword [rsp + rbx - 0x360eb49f], 0xffffffffb41e13ae
mov qword [rsp + rbx - 0x360eb49f], rsi
adc dl, bpl
xor dword [rsp + rbx*2 - 0x6c1d693e], ecx
call fcn.14159e7f9
mov eax, dword [r10 + rbp*8 - 0x62538]
lea r10, [rbp + r10 - 0xc4a3]
mov qword [rsp + rbp*2 - 0x1894e], rbp
xor eax, esi
add rbp, qword [rsp + rbp - 0xc4a7]
rol bp, 0x4c
rol eax, 1
rol word [rsp + rbp*2 - 0x3d122], 0xa1
movsx edi, word [rsp + rbp*4 - 0x7a250]
sbb eax, 0xf31d1436
or qword [rsp + rbp*2 - 0x3d128], rbx
setge bl
sbb di, di
rol eax, 2
not eax
sal rbp, 0x20
add dil, dl
ror eax, 2
xadd dword [rsp], edx
lea eax, [rax + rdx - 0x31410cef]
movsx r9d, dl
not eax
jl 0x141574042
Function at 0x141623d68
Capabilities:
Authenticate hmac

Disassembly:
neg r10d
mov r9d, dword [rsp + rcx - 0x5d4240c0]
sub r9d, r9d
not dx
bswap r10d
xadd r8b, cl
jge 0x14157e6f3
rol r10d, 1
shl di, 0xe9
ror cx, 0xa5
mov qword [rsp + r8], rsi
movzx esi, dil
xor r8w, dx
not di
xor dword [rsp + r8*2 - 0xca], r10d
sub cx, si
inc sil
inc edx
pop rsi
shl edi, 0x4b
ror dl, cl
sbb r9d, r9d
movsxd r10, r10d
neg r9
adc rbx, r10
inc edi
jle 0x141614b31
and word [rsp + rcx - 0x5d4240bf], r8w
ror r10d, 1
rol edi, 0x48
inc r10d
mov eax, dword [rsp + r8 - 0x3b]
jmp 0x14154a396
lea rax, [rax + r8*2 - 0x4e5a1257]
mov r8, qword [rbp + r8*8 - 0x328]
mov rax, qword [rbp + r9 + 8]
not r8
call fcn.1415a1845
or bx, word [rdi + rbp - 0x91]
movsx edi, r9w
or eax, r9d
xor qword [rsp + rbp - 0x83], 0xdba9725
lea r11, [r11 + rbp*8 - 0x48a]
pop rbp
seta cl
xor eax, 0x660e2ea4
mov word [r11 + rcx - 1], bx
movsx ebx, r9w
call fcn.1415ec55e
mov r10d, dword [r11 - 4]
mov ecx, 0xa2bdbf3e
movzx r8d, cl
and rcx, rcx
lea r11, [r11 + r8 - 0x42]
mov edx, 0xb6b5ff9a
xor r10d, esi
push rdx
neg ecx
xor r10d, 0xdfa03137
movsx edi, byte [rsp + r8*2 - 0x7c]
jmp 0x141586732
Function at 0x140028490
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov rbx, qword [rcx + 0x10]
cmp rbx, qword [rcx + 0x18]
je 0x1400284ca
mov rax, qword [rdi]
mov qword [rbx], rax
add qword [rsi + 0x10], 8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r15, qword [rsi]
mov r14, qword [rsi + 8]
mov rax, r14
sub rax, r15
jbe 0x140028526
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
add rax, rcx
inc rax
sar rax, 1
mov r12, rax
neg r12
shl rax, 3
mov r15, r14
sub r15, rax
sub rbx, r14
je 0x140028515
mov rcx, r15
mov rdx, r14
mov r8, rbx
call fcn.140108e80
mov r14, qword [rsi + 8]
add rbx, r15
mov qword [rsi + 0x10], rbx
lea rax, [r14 + r12*8]
mov qword [rsi + 8], rax
jmp 0x1400284af
mov rax, rbx
sub rax, r15
mov rcx, rax
sar rcx, 2
test rax, rax
mov r13d, 1
cmovne r13, rcx
mov rax, r13
shr rax, 0x3d
jne 0x1400285bc
mov r12, r13
shr r12, 2
lea rcx, [r13*8]
call fcn.140105b78
lea r9, [rax + r12*8]
lea r8, [rax + r13*8]
mov r10, r9
sub rbx, r14
je 0x140028590
lea r10, [r9 + rbx]
sar rbx, 3
shl rbx, 3
lea r11, [rax + r12*8]
xor edx, edx
mov rcx, qword [r14 + rdx]
mov qword [r11 + rdx], rcx
add rdx, 8
cmp rbx, rdx
jne 0x14002857f
mov qword [rsi], rax
mov qword [rsi + 8], r9
mov qword [rsi + 0x10], r10
mov qword [rsi + 0x18], r8
mov rbx, r10
test r15, r15
je 0x1400284af
mov rcx, r15
call fcn.140105bb4
mov rbx, qword [rsi + 0x10]
jmp 0x1400284af
call fcn.140119940
int3

Function at 0x1400285d0
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r14, rdx
mov rsi, rcx
mov rbx, qword [rcx + 8]
cmp rbx, qword [rcx]
je 0x14002860d
mov rdi, rbx
mov rax, qword [r14]
mov qword [rdi - 8], rax
add qword [rsi + 8], 0xfffffffffffffff8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r15, qword [rsi + 0x10]
mov rax, qword [rsi + 0x18]
cmp r15, rax
jae 0x14002865f
sub rax, r15
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
lea r12, [rax + rcx]
inc r12
sar r12, 1
lea rdi, [r15 + r12*8]
mov r8, r15
sub r8, rbx
je 0x140028651
sub rdi, r8
mov rcx, rdi
mov rdx, rbx
call fcn.140108e80
mov r15, qword [rsi + 0x10]
mov qword [rsi + 8], rdi
lea rax, [r15 + r12*8]
mov qword [rsi + 0x10], rax
jmp 0x1400285f1
sub rax, rbx
mov rcx, rax
sar rcx, 2
test rax, rax
mov r13d, 1
cmovne r13, rcx
mov rax, r13
shr rax, 0x3d
jne 0x1400286f0
lea r12, [r13 + 3]
shr r12, 2
lea rcx, [r13*8]
call fcn.140105b78
lea rdi, [rax + r12*8]
lea r8, [rax + r13*8]
mov r9, rdi
sub r15, rbx
je 0x1400286c7
lea r9, [rdi + r15]
sar r15, 3
shl r15, 3
lea r10, [rax + r12*8]
xor edx, edx
mov rcx, qword [rbx + rdx]
mov qword [r10 + rdx], rcx
add rdx, 8
cmp r15, rdx
jne 0x1400286b6
mov qword [rsi], rax
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], r9
mov qword [rsi + 0x18], r8
test rbx, rbx
je 0x1400285f1
mov rcx, rbx
call fcn.140105bb4
mov rdi, qword [rsi + 8]
jmp 0x1400285f1
call fcn.140119940
int3
Function at 0x140029550
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rdx
mov edi, ecx
mov rax, qword [0x14024f018]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r8d, 0x20
call fcn.140118cdc
mov ebx, 6
cmp eax, 0x20
jne 0x140029626
mov ecx, dword [rsi + 8]
mov rbx, qword [sym.imp.WS2_32.dll_ntohl]
call rbx
mov dword [rsi + 8], eax
mov ecx, dword [rsi + 0xc]
call rbx
mov dword [rsi + 0xc], eax
mov ecx, dword [rsi + 0x10]
call rbx
mov dword [rsi + 0x10], eax
mov ecx, dword [rsi + 0x14]
call rbx
mov dword [rsi + 0x14], eax
mov ecx, dword [rsi + 0x18]
call rbx
mov dword [rsi + 0x18], eax
mov ecx, dword [rsi + 0x1c]
call rbx
mov dword [rsi + 0x1c], eax
movaps xmm0, xmmword [0x1402183e0]
lea rdx, [rsp + 0x20]
movaps xmmword [rdx + 0x20], xmm0
movaps xmmword [rdx + 0x10], xmm0
movaps xmmword [rdx], xmm0
mov ecx, edi
call fcn.140117058
mov ebx, 6
test eax, eax
jne 0x140029626
movabs rax, 0x303146464944424d
mov ebx, 8
cmp qword [rsi], rax
jne 0x140029626
movsxd rax, dword [rsp + 0x34]
cmp rax, 0x20
jb 0x140029626
add rax, 0xffffffffffffffe0
mov ecx, dword [rsi + 0x14]
sub rax, rcx
jb 0x140029626
mov ecx, dword [rsi + 0x18]
sub rax, rcx
jb 0x140029626
mov ecx, dword [rsi + 0x1c]
cmp rax, rcx
jb 0x140029626
setne al
movzx ebx, al
shl ebx, 3
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140106490
mov eax, ebx
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
Function at 0x140029640
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov r15d, r9d
mov r12, r8
mov ebx, edx
mov rdi, rcx
mov r13d, dword [rcx + 8]
mov ebp, dword [rcx + 0x18]
add ebp, dword [rcx + 0x14]
add ebp, dword [rcx + 0x1c]
mov rcx, rbp
call fcn.1400f1140
test rax, rax
je 0x1400296a4
mov r14, rax
add r13, r12
mov rsi, rax
test ebp, ebp
je 0x1400296ab
mov ecx, ebx
mov rdx, rsi
mov r8d, ebp
call fcn.140118cdc
test eax, eax
js 0x1400296c6
sub ebp, eax
mov ecx, eax
add rsi, rcx
test eax, eax
jne 0x14002967e
test ebp, ebp
je 0x14002967e
jmp 0x1400296bf
mov ebx, 1
jmp 0x1400296d3
mov eax, dword [rdi + 0x14]
imul ecx, eax, 0xaaaaaaab
ror ecx, 2
cmp ecx, 0x15555555
jbe 0x1400296e6
mov ebx, 8
jmp 0x1400296cb
mov ebx, 6
mov rcx, r14
call fcn.1400f1190
mov eax, ebx
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
test rax, rax
je 0x140029825
mov dword [rsp + 0x24], r15d
mov rbp, r14
add rbp, rax
mov eax, dword [rdi + 0x18]
mov ecx, dword [rdi + 0x1c]
add rax, rbp
add rcx, rax
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rax
mov rdi, rax
mov qword [rsp + 0x28], rbp
mov r15, r12
mov r12, r14
mov qword [rsp + 0x30], r15
mov ecx, dword [r12]
mov rsi, qword [sym.imp.WS2_32.dll_ntohl]
call rsi
mov dword [r12], eax
mov ecx, dword [r12 + 4]
call rsi
mov dword [r12 + 4], eax
mov ecx, dword [r12 + 8]
call rsi
mov dword [r12 + 8], eax
mov eax, dword [r12]
mov rcx, r13
sub rcx, r15
cmp rcx, rax
jb 0x1400296bf
mov rcx, qword [rsp + 0x40]
sub rcx, rbp
cmp rcx, rax
jb 0x1400296bf
test rax, rax
je 0x14002978d
xor eax, eax
mov cl, byte [r15 + rax]
add byte [rbp + rax], cl
inc rax
mov r8d, dword [r12]
cmp rax, r8
jb 0x140029777
jmp 0x140029790
xor r8d, r8d
mov ecx, dword [rsp + 0x24]
mov rdx, rbp
call fcn.14011cb00
mov ebx, 7
cmp eax, dword [r12]
jne 0x1400296cb
mov esi, eax
mov r8d, dword [r12 + 4]
mov rax, qword [rsp + 0x38]
sub rax, rdi
cmp rax, r8
jb 0x1400296bf
mov ecx, dword [rsp + 0x24]
mov rdx, rdi
call fcn.14011cb00
cmp eax, dword [r12 + 4]
jne 0x1400296cb
mov edx, esi
add r15, rdx
movsxd rcx, dword [r12 + 8]
mov rbx, qword [rsp + 0x30]
sub rbx, r15
cmp rbx, rcx
jg 0x1400296bf
mov rbx, r13
sub rbx, r15
cmp rbx, rcx
jl 0x1400296bf
add rbp, rdx
mov eax, eax
add rdi, rax
add r15, rcx
add r12, 0xc
xor ebx, ebx
cmp r12, qword [rsp + 0x28]
jb 0x140029723
jmp 0x1400296cb
xor ebx, ebx
jmp 0x1400296cb
Function at 0x140029830
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb8
movaps xmmword [rsp + 0xa0], xmm6
mov r15, r8
mov rbp, rcx
mov rax, qword [0x14024f018]
xor rax, rsp
mov qword [rsp + 0x98], rax
lea rbx, [rsp + 0x30]
mov dword [rbx], 0xaaaaaaaa
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x28], 0
xor esi, esi
mov rcx, rdx
mov edx, 0x8000
mov r8d, 0x40
xor r9d, r9d
call fcn.140119b2c
cmp eax, 1
sbb esi, esi
not esi
or esi, dword [rbx]
js 0x1400298d1
movaps xmm6, xmmword [0x1402183e0]
lea rdx, [rsp + 0x70]
movaps xmmword [rdx + 0x10], xmm6
movaps xmmword [rdx], xmm6
mov ecx, esi
call fcn.140029550
mov r12d, 0xffffffff
xor r14d, r14d
test eax, eax
je 0x1400298db
mov edi, eax
mov ebx, 0xffffffff
jmp 0x140029a15
mov edi, 6
jmp 0x140029a3c
mov dword [rsp + 0x30], 0xaaaaaaaa
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x28], 0
mov rcx, rbp
mov edx, 0x8000
mov r8d, 0x40
xor r9d, r9d
call fcn.140119b2c
mov ebx, dword [rsp + 0x30]
cmp eax, 1
mov ebp, 0
sbb ebp, ebp
not ebp
or ebp, ebx
js 0x1400299fd
lea rdx, [rsp + 0x30]
movaps xmmword [rdx + 0x20], xmm6
movaps xmmword [rdx + 0x10], xmm6
movaps xmmword [rdx], xmm6
mov ecx, ebp
call fcn.140117058
mov r12d, 0xffffffff
mov edi, 6
test eax, eax
jne 0x140029a12
mov r13d, dword [rsp + 0x44]
cmp r13d, dword [rsp + 0x78]
jne 0x140029a06
mov rcx, r13
call fcn.1400f1140
test rax, rax
je 0x140029a0d
mov r14, rax
mov ecx, ebp
mov rdx, rax
mov r8d, r13d
call fcn.140118cdc
cmp eax, dword [rsp + 0x78]
jne 0x140029a15
mov ebp, eax
call fcn.14016b7b0
movsxd rdx, ebp
mov rcx, r14
call fcn.14016b780
not eax
cmp dword [rsp + 0x7c], eax
jne 0x140029a6a
lea r12, [rsp + 0x6c]
mov dword [r12], 0xaaaaaaaa
mov qword [rsp + 0x20], r12
mov dword [rsp + 0x28], 0
xor ebp, ebp
mov rcx, r15
mov edx, 0x8301
mov r8d, 0x40
xor r9d, r9d
call fcn.140119b2c
mov r12d, dword [r12]
cmp eax, 1
sbb ebp, ebp
not ebp
or ebp, r12d
js 0x140029a71
lea rcx, [rsp + 0x70]
mov edx, esi
mov r8, r14
mov r9d, ebp
call fcn.140029640
mov edi, eax
jmp 0x140029a15
mov edi, 6
mov ebx, ebp
jmp 0x140029a15
mov edi, 8
jmp 0x140029a12
mov edi, 1
xor r14d, r14d
mov rcx, r14
call fcn.1400f1190
mov ecx, esi
call fcn.140114254
test ebx, ebx
js 0x140029a2f
mov ecx, ebx
call fcn.140114254
test r12d, r12d
js 0x140029a3c
mov ecx, r12d
call fcn.140114254
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.140106490
mov eax, edi
movaps xmm6, xmmword [rsp + 0xa0]
add rsp, 0xb8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov edi, 4
jmp 0x140029a15
mov r12d, ebp
jmp 0x140029a15
Function at 0x14003f400
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x30
mov r12, r8
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x14024f018]
xor rax, rsp
mov qword [rsp + 0x28], rax
xor eax, eax
mov qword [rcx], rax
mov rbp, qword [rdx]
mov qword [rdx], rax
lea r15, [rbp + 1]
cmp r15, 2
jb 0x14003f440
call fcn.1400ed9a0
cmp qword [rsi], rbp
je 0x14003f475
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14003f533
cmp r15, 2
jb 0x14003f46c
mov qword [rsi], rbp
call fcn.1400ed9a0
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov qword [rsi + 8], 0xffffffffffffffff
lea r14, [rsi + 0x10]
xor eax, eax
mov qword [rsp + 0x20], rax
mov rdi, qword [r12]
mov qword [r12], rax
cmp rdi, 0xffffffffffffffff
je 0x14003f4a0
test rdi, rdi
je 0x14003f4c4
call fcn.1400ed9a0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
lea rax, [rdi + 1]
cmp rax, 2
jb 0x14003f4bc
mov qword [rsp + 0x20], rdi
call fcn.1400ed9a0
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rdx, [rsp + 0x20]
mov rcx, r14
call fcn.140173220
mov rax, qword [rbx]
inc rax
cmp rax, 2
jb 0x14003f4f1
call fcn.1400ed9a0
mov rcx, qword [rbx]
call fcn.1400f1110
mov qword [rbx], 0
mov rax, qword [r12]
inc rax
cmp rax, 2
jb 0x14003f514
call fcn.1400ed9a0
mov rcx, qword [r12]
call fcn.1400f1110
mov qword [r12], 0
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140106490
mov rax, rsi
add rsp, 0x30
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
call fcn.1400ed9a0
mov rcx, qword [rsi]
call fcn.1400f1110
mov qword [rsi], 0
jmp 0x14003f45e
Function at 0x1400421f0
Capabilities:
Get session information

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rsi, rcx
mov rax, qword [0x14024f018]
xor rax, rsp
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
cmp eax, 0xffffffff
je 0x1400422b5
lea r9, [rsp + 0x48]
mov qword [r9], 0
lea rcx, [rsp + 0x44]
mov dword [rcx], 0
mov qword [rsp + 0x20], rcx
xor ecx, ecx
mov edx, eax
mov r8d, 0x18
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x1400422b5
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0x38]
mov qword [r14], rax
mov rdi, qword [rsp + 0x48]
mov ecx, 0x30
call fcn.140105b78
mov rbx, rax
lea rdx, [0x140043090]
lea r8, [0x140026680]
mov rcx, rax
call fcn.1400ebf70
lea rax, [0x1402049a0]
mov qword [rbx + 0x20], rax
mov qword [rbx + 0x28], rdi
lea rdx, [rsp + 0x30]
mov qword [rdx], rbx
mov rcx, r14
call fcn.1400784a0
cmp dword [rsp + 0x44], 0xd7
ja 0x1400422be
mov qword [rsi], 0
jmp 0x1400422d2
mov qword [rsi], 0
jmp 0x1400422dc
mov rax, qword [rsp + 0x48]
mov rdx, qword [rax + 0xc8]
mov rcx, rsi
call fcn.1400785e0
lea rcx, [rsp + 0x38]
call fcn.140078580
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140106490
mov rax, rsi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140046210
Capabilities:
Accept command line arguments

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
mov rax, qword [0x14024f018]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, qword [0x140259ca0]
test rdi, rdi
jne 0x1400462b3
mov ecx, 0x48
call fcn.140105b78
mov rsi, rax
xorps xmm6, xmm6
movups xmmword [rax], xmm6
mov ecx, 0x18
call fcn.140105b78
mov qword [rsi + 0x10], rax
lea rcx, [rax + 0x18]
mov qword [rsi + 0x20], rcx
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
mov qword [rsi + 0x18], rcx
lea rax, [rsi + 0x30]
movups xmmword [rsi + 0x30], xmm6
mov qword [rsi + 0x28], rax
mov qword [rsi + 0x40], 1
mov qword [0x140259ca0], rsi
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x28], rax
test rax, rax
je 0x1400462d5
mov rcx, rax
call fcn.140121344
lea rdx, [rsp + 0x28]
mov qword [rdx + 8], rax
mov rcx, rsi
call fcn.1400462e0
test rdi, rdi
sete bl
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140106490
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
int3

Function at 0x1400462e0
Capabilities:
Accept command line arguments

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rbx, rdx
mov r14, rcx
mov rax, qword [0x14024f018]
xor rax, rsp
mov qword [rsp + 0x50], rax
movups xmm0, xmmword [rdx]
lea rdx, [rsp + 0x40]
movaps xmmword [rdx], xmm0
lea rsi, [rsp + 0x20]
mov rcx, rsi
mov r8d, 3
call fcn.140053ed0
movups xmm0, xmmword [rsi]
movups xmmword [rbx], xmm0
cmp qword [rbx + 8], 0
je 0x14004641e
movups xmm0, xmmword [rbx]
movups xmmword [r14], xmm0
mov dword [rsp + 0x3c], 0
lea rcx, str.api_ms_win_downlevel_shell32_l1_1_0.dll
xor edx, edx
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
test rax, rax
je 0x14004643b
lea rdx, [0x14021f8ce]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14004644e
mov rsi, rax
mov rcx, qword [rbx]
lea rdx, [rsp + 0x3c]
call rax
mov rbx, rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x20]
mov qword [rsi + 0x10], rax
movaps xmm0, xmmword [0x1402183e0]
movaps xmmword [rsi], xmm0
movsxd rax, dword [rsp + 0x3c]
lea r8, [rbx + rax*8]
mov rcx, rsi
mov rdx, rbx
call fcn.140047960
mov rcx, r14
mov rdx, rsi
call fcn.140045ed0
xorps xmm0, xmm0
movups xmmword [r14], xmm0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rdi, rdi
je 0x1400463e0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rsi, qword [rsp + 0x20]
test rsi, rsi
je 0x14004641e
mov rax, qword [rsp + 0x28]
cmp rax, rsi
je 0x140046436
lea rdi, [rax - 0x18]
cmp byte [rax - 1], 0
jns 0x140046407
mov rcx, qword [rax - 0x18]
call fcn.140105bb4
mov rax, rdi
cmp rdi, rsi
jne 0x1400463f4
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x28], rsi
call fcn.140105bb4
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140106490
nop
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rcx, rsi
jmp 0x140046414
mov rcx, qword [rbx]
lea rdx, [rsp + 0x3c]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
jmp 0x140046383
xor ebx, ebx
jmp 0x140046386