joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46c4c0
Capabilities:
Encode data using xor

Disassembly:
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
test rdx, 0xf
jne 0x46c52b
mov rax, 0
movdqu xmm0, xmmword [rsi + rax]
movdqu xmm1, xmmword [rcx + rax]
pxor xmm0, xmm1
movdqu xmmword [rbx + rax], xmm0
add rax, 0x10
cmp rdx, rax
jne 0x46c4e4
ret
sub rdx, 1
mov dil, byte [rsi + rdx]
mov al, byte [rcx + rdx]
xor dil, al
mov byte [rbx + rdx], dil
test rdx, 7
jne 0x46c501
cmp rdx, 0
je 0x46c54d
test rdx, 0xf
je 0x46c4dd
test rdx, 7
jne 0x46c501
sub rdx, 8
mov rdi, qword [rsi + rdx]
mov rax, qword [rcx + rdx]
xor rdi, rax
mov qword [rbx + rdx], rdi
cmp rdx, 0x10
jge 0x46c4dd
ret
Function at 0x47a940
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rbx]
add rax, 0x10
pxor xmm0, xmm1
sub rcx, 0xc
je 0x47a97f
jb 0x47a994
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x20]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x30]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x40]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x50]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x60]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x70]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x80]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x90]
aesenclast xmm0, xmm1
movups xmmword [rdx], xmm0
ret
Function at 0x47aa00
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
add rbx, 0x10
pxor xmm4, xmm4
cmp ecx, 0xc
je 0x47aad0
jb 0x47ab2f
movups xmm2, xmmword [rax + 0x10]
movups xmmword [rbx], xmm2
add rbx, 0x10
aeskeygenassist xmm1, xmm2, 1
call fcn.0047a8e0
aeskeygenassist xmm1, xmm0, 1
call fcn.0047a900
aeskeygenassist xmm1, xmm2, 2
call fcn.0047a8e0
aeskeygenassist xmm1, xmm0, 2
call fcn.0047a900
aeskeygenassist xmm1, xmm2, 4
call fcn.0047a8e0
aeskeygenassist xmm1, xmm0, 4
call fcn.0047a900
aeskeygenassist xmm1, xmm2, 8
call fcn.0047a8e0
aeskeygenassist xmm1, xmm0, 8
call fcn.0047a900
aeskeygenassist xmm1, xmm2, 0x10
call fcn.0047a8e0
aeskeygenassist xmm1, xmm0, 0x10
call fcn.0047a900
aeskeygenassist xmm1, xmm2, 0x20
call fcn.0047a8e0
aeskeygenassist xmm1, xmm0, 0x20
call fcn.0047a900
aeskeygenassist xmm1, xmm2, 0x40
call fcn.0047a8e0
jmp 0x47ab9d
movq xmm2, qword [rax + 0x10]
aeskeygenassist xmm1, xmm2, 1
call fcn.0047a840
aeskeygenassist xmm1, xmm2, 2
call fcn.0047a8a0
aeskeygenassist xmm1, xmm2, 4
call fcn.0047a840
aeskeygenassist xmm1, xmm2, 8
call fcn.0047a8a0
aeskeygenassist xmm1, xmm2, 0x10
call fcn.0047a840
aeskeygenassist xmm1, xmm2, 0x20
call fcn.0047a8a0
aeskeygenassist xmm1, xmm2, 0x40
call fcn.0047a840
aeskeygenassist xmm1, xmm2, 0x80
call fcn.0047a8a0
jmp 0x47ab9d
aeskeygenassist xmm1, xmm0, 1
call fcn.0047a800
aeskeygenassist xmm1, xmm0, 2
call fcn.0047a800
aeskeygenassist xmm1, xmm0, 4
call fcn.0047a800
aeskeygenassist xmm1, xmm0, 8
call fcn.0047a800
aeskeygenassist xmm1, xmm0, 0x10
call fcn.0047a800
aeskeygenassist xmm1, xmm0, 0x20
call fcn.0047a800
aeskeygenassist xmm1, xmm0, 0x40
call fcn.0047a800
aeskeygenassist xmm1, xmm0, 0x80
call fcn.0047a800
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.0047a800
aeskeygenassist xmm1, xmm0, 0x36
call fcn.0047a800
sub rbx, 0x10
movups xmm1, xmmword [rbx]
movups xmmword [rdx], xmm1
dec rcx
movups xmm1, xmmword [rbx - 0x10]
aesimc xmm0, xmm1
movups xmmword [rdx + 0x10], xmm0
sub rbx, 0x10
add rdx, 0x10
dec rcx
jne 0x47abaa
movups xmm0, xmmword [rbx - 0x10]
movups xmmword [rdx + 0x10], xmm0
ret
Function at 0x14009d220
Capabilities:
Query environment variable

Disassembly:
push rsi
push rdi
sub rsp, 0x38
movaps xmmword [rsp + 0x20], xmm6
mov rdi, rdx
mov rsi, rcx
cmp byte [0x1400cf0cb], 1
jne 0x14009d247
movzx eax, byte [0x1400cf0ca]
test al, al
jne 0x14009d26b
jmp 0x14009d28b
lea rcx, str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
test rax, rax
setne al
setne byte [0x1400cf0ca]
mov byte [0x1400cf0cb], 1
test al, al
je 0x14009d28b
mov ecx, 2
call qword [fcn.14009ce10]
lea rdx, str.libunwind:___unw_init_local_cursor_p__context_p__n
mov rcx, rax
mov r8, rsi
mov r9, rdi
call fcn.14009ae10
lea rax, [0x1400c3398]
mov qword [rsi], rax
lea rax, [0x1400cf0b8]
mov qword [rsi + 8], rax
xorps xmm0, xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x30], xmm0
movaps xmmword [rsi + 0x40], xmm0
mov qword [rsi + 0x50], 0
lea rax, [rsi + 0x580]
lea rcx, [rsi + 0xb0]
movaps xmmword [rsi + 0x580], xmm0
movaps xmmword [rsi + 0x590], xmm0
movaps xmmword [rsi + 0x5a0], xmm0
movaps xmmword [rsi + 0x5b0], xmm0
movaps xmmword [rsi + 0x5c0], xmm0
movaps xmmword [rsi + 0x5d0], xmm0
movaps xmmword [rsi + 0x5e0], xmm0
movaps xmmword [rsi + 0x5f0], xmm0
movaps xmmword [rsi + 0x600], xmm0
movaps xmmword [rsi + 0x610], xmm0
movaps xmmword [rsi + 0x620], xmm0
movaps xmmword [rsi + 0x630], xmm0
movaps xmmword [rsi + 0x640], xmm0
movups xmmword [rsi + 0x649], xmm0
mov qword [rsi + 0x80], rcx
mov qword [rsi + 0x98], rax
mov rax, qword [rdi]
mov rcx, qword [rdi + 8]
mov rdx, qword [rdi + 0x80]
movups xmm0, xmmword [rdi + 0x10]
movdqu xmm1, xmmword [rdi + 0x30]
pshufd xmm1, xmm1, 0x4e
movdqu xmm2, xmmword [rdi + 0x20]
pshufd xmm2, xmm2, 0x4e
movups xmm3, xmmword [rdi + 0x40]
movups xmm4, xmmword [rdi + 0x50]
movups xmm5, xmmword [rdi + 0x60]
movups xmm6, xmmword [rdi + 0x70]
mov dword [rsi + 0xe0], 0x10000b
mov qword [rsi + 0x128], rax
movaps xmmword [rsi + 0x130], xmm0
mov qword [rsi + 0x140], rcx
movdqu xmmword [rsi + 0x148], xmm1
movdqu xmmword [rsi + 0x158], xmm2
movups xmmword [rsi + 0x168], xmm3
movups xmmword [rsi + 0x178], xmm4
movups xmmword [rsi + 0x188], xmm5
movups xmmword [rsi + 0x198], xmm6
mov qword [rsi + 0x1a8], rdx
test rdx, rdx
je 0x14009d3d2
mov rcx, rsi
call fcn.14009b9d0
test al, al
jne 0x14009d3d9
mov byte [rsi + 0x658], 1
xor eax, eax
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
pop rdi
pop rsi
ret

Function at 0x14009d3f0
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
cmp byte [0x1400cf0cb], 1
jne 0x14009d409
movzx eax, byte [0x1400cf0ca]
add rsp, 0x28
ret
lea rcx, str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
test rax, rax
setne al
setne byte [0x1400cf0ca]
mov byte [0x1400cf0cb], 1
add rsp, 0x28
ret
Function at 0x180050630
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x180050658
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x180050658
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1800554e8
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x180055518
xor eax, eax
jmp 0x1800555db
mov rbp, rbx
cmp word [rax], si
je 0x18005553d
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x180055524
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x180055520
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.180055408
movsxd r14, eax
test eax, eax
jne 0x18005557b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x180055511
mov rcx, r14
call fcn.180053b38
mov rdi, rax
test rax, rax
jne 0x180055594
xor ecx, ecx
call fcn.180052c6c
jmp 0x180055570
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.180055408
test eax, eax
jne 0x1800555c5
mov rcx, rdi
call fcn.180052c6c
jmp 0x1800555cf
xor ecx, ecx
call fcn.180052c6c
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x140006240
Capabilities:
Write clipboard data

Disassembly:
push rdi
sub rsp, 0x20
cmp dword [rcx + 0x2c], 0
mov rdi, rcx
jne 0x14000626c
call fcn.1400065e0
test eax, eax
jne 0x14000626c
lea rdx, str.Cant_open_clipboard_for_writing.
mov rcx, rdi
add rsp, 0x20
pop rdi
jmp 0x140006390
mov qword [rsp + 0x38], rsi
call qword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
jne 0x1400062ba
cmp dword [rdi + 0x2c], eax
je 0x1400062a1
xor esi, esi
cmp qword [rdi + 0x10], rsi
je 0x140006295
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov qword [rdi + 0x10], rsi
call qword [sym.imp.USER32.dll_CloseClipboard]
mov dword [rdi + 0x2c], esi
mov qword [rdi], rsi
lea rdx, str.EmptyClipboard
mov rcx, rdi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x140006390
mov rcx, qword [rdi + 8]
xor esi, esi
test rcx, rcx
je 0x1400062fd
mov rax, qword [rdi + 0x18]
test rax, rax
je 0x140006331
cmp word [rax], si
mov qword [rsp + 0x30], rbx
sete bl
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
test bl, bl
mov rbx, qword [rsp + 0x30]
mov qword [rdi + 0x18], rsi
mov dword [rdi + 0x28], esi
je 0x140006331
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov qword [rdi + 8], rax
cmp dword [rdi + 0x2c], esi
je 0x140006321
cmp qword [rdi + 0x10], rsi
je 0x140006315
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov qword [rdi + 0x10], rsi
call qword [sym.imp.USER32.dll_CloseClipboard]
mov dword [rdi + 0x2c], esi
mov qword [rdi], rsi
mov eax, 1
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rdx, qword [rdi + 8]
mov ecx, SafeArrayGetElemsize
call qword [sym.imp.USER32.dll_SetClipboardData]
test rax, rax
je 0x14000634b
mov qword [rdi + 8], rsi
jmp 0x1400062fd
cmp dword [rdi + 0x2c], esi
je 0x14000636f
cmp qword [rdi + 0x10], rsi
je 0x140006363
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov qword [rdi + 0x10], rsi
call qword [sym.imp.USER32.dll_CloseClipboard]
mov dword [rdi + 0x2c], esi
mov qword [rdi], rsi
lea rdx, str.SetClipboardData
mov rcx, rdi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x140006390
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor esi, esi
mov rdi, rdx
mov rbx, rcx
cmp dword [rcx + 0x2c], esi
je 0x1400063cb
cmp qword [rcx + 0x10], rsi
je 0x1400063bf
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov qword [rbx + 0x10], rsi
call qword [sym.imp.USER32.dll_CloseClipboard]
mov dword [rbx + 0x2c], esi
mov qword [rbx], rsi
cmp qword [rbx + 0x18], rsi
je 0x1400063e2
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov qword [rbx + 0x18], rsi
mov dword [rbx + 0x28], esi
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400063f5
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov qword [rbx + 8], rax
cmp word [rdi], si
je 0x14000641f
lea r8, [0x1400e346c]
lea rcx, [0x14011b1d0]
mov rdx, rdi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.140040740
mov rbx, qword [rsp + 0x30]
mov eax, esi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14001b980
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [0x14011a460], 0
lea rbx, [0x140118630]
jne 0x14001b9df
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, 1
lea r8, [0x140118634]
mov dword [0x140118630], eax
nop
mov eax, dword [r8 - 4]
add r8, 4
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul ecx, ecx, 0x6c078965
add ecx, edx
inc edx
mov dword [r8 - 4], ecx
cmp edx, 0x270
jl 0x14001b9b0
mov dword [0x14011a460], 1
mov dword [0x140113a04], 0x270
mov qword [0x140118620], rbx
mov r8d, 0xe3
nop word [rax + rax]
mov eax, dword [rbx + 4]
mov ecx, eax
and al, 1
xor ecx, dword [rbx]
and ecx, 0x7ffffffe
xor ecx, dword [rbx]
shr ecx, 1
neg al
sbb eax, eax
add rbx, 4
and eax, 0x9908b0df
xor ecx, eax
xor ecx, dword [rbx + 0x630]
dec r8d
mov dword [rbx - 4], ecx
jne 0x14001ba00
mov r8d, 0x18c
nop word [rax + rax]
mov eax, dword [rbx + 4]
lea rdx, [rbx + 4]
mov ecx, eax
and al, 1
xor ecx, dword [rbx]
and ecx, 0x7ffffffe
xor ecx, dword [rbx]
shr ecx, 1
neg al
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
xor ecx, dword [rbx - 0x38c]
dec r8d
mov dword [rbx], ecx
mov rbx, rdx
jne 0x14001ba40
mov eax, dword [0x140118630]
mov ecx, dword [rdx]
xor ecx, eax
and al, 1
and ecx, 0x7ffffffe
xor ecx, dword [rdx]
shr ecx, 1
neg al
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
xor ecx, dword [rdx - 0x38c]
mov dword [rdx], ecx
add rsp, 0x20
pop rbx
ret

Function at 0x14001bab0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 0x28
dec dword [0x140113a04]
jne 0x14001bac1
call fcn.14001b980
mov rax, qword [0x140118620]
add rax, 4
mov ecx, dword [rax - 4]
mov qword [0x140118620], rax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
add rsp, 0x28
ret

Function at 0x14001bb10
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 0x28
dec dword [0x140113a04]
jne 0x14001bb21
call fcn.14001b980
mov rax, qword [0x140118620]
pxor xmm0, xmm0
add rax, 4
mov ecx, dword [rax - 4]
mov qword [0x140118620], rax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
cvtsi2sd xmm0, rax
mulsd xmm0, qword [0x140101f88]
add rsp, 0x28
ret

Function at 0x14001c090
Capabilities:
Write clipboard data

Disassembly:
sub rsp, 0x38
movzx eax, byte [rcx + 0x23]
test al, al
jne 0x14001c0b8
mov rcx, qword [rcx + 0x10]
xor r9d, r9d
or r8, 0xffffffffffffffff
xor edx, edx
mov byte [rsp + 0x20], 1
call fcn.1400b14e0
add rsp, 0x38
ret
cmp al, 2
jne 0x14001c0ce
lea rcx, [0x1400e346c]
xor edx, edx
add rsp, 0x38
jmp fcn.1400060c0
cmp qword [0x140114480], 2
jae 0x14001c0fd
cmp qword [rcx + 0x18], 2
jae 0x14001c0fd
lea r8, [0x1400e346c]
lea rdx, str.Memory_limit_reached__see_MaxMem_in_the_help_file_.
lea rcx, [0x14011b1d0]
add rsp, 0x38
jmp fcn.140040740
xor r8d, r8d
lea edx, [r8 + 3]
call fcn.1400b1b90
mov eax, 1
add rsp, 0x38
ret
Function at 0x14001c690
Capabilities:
Write clipboard data

Disassembly:
cmp byte [rcx + 0x23], 0
jne 0x14001c69a
mov rcx, qword [rcx + 0x10]
cmp byte [rcx + 0x23], 2
jne 0x14001c6b6
cmp qword [0x14011be40], 0
je 0x14001c6b6
lea rcx, [0x14011be28]
jmp fcn.140006240
and byte [rcx + 0x21], 0x86
movzx eax, byte [rcx + 0x21]
test dl, dl
je 0x14001c6c7
or al, 1
mov byte [rcx + 0x21], al
mov eax, 1
ret

Function at 0x14001fcf0
Capabilities:
Set current directory

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
sub rsp, 0x160
cmp byte [0x14011c00b], 0
mov ebp, r8d
mov esi, edx
mov rdi, rcx
mov dword [rcx + 0xb44], edx
jne 0x14001fed4
cmp byte [rcx + 0xbb4], 0
je 0x14001fed4
mov rcx, qword [0x14011a308]
mov qword [rax + 8], rbx
mov dword [0x14011d10c], r8d
xor r8d, r8d
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], r13
lea edx, [r8 + 1]
call fcn.140001820
lea rcx, [rsp + 0x60]
mov r8d, 0x7f
mov rdx, rax
call fcn.1400cd7f4
mov rbx, qword [0x1401144a8]
inc dword [0x140119934]
add rbx, 0x150
lea rdx, [0x140118220]
xor r13d, r13d
mov rcx, rbx
mov r8d, 0x150
mov word [rsp + 0x15e], r13w
mov qword [0x1401144a8], rbx
call fcn.1400cb2e0
lea rcx, [0x14011b1d0]
xor edx, edx
mov dword [rbx + 0x3c], r13d
call fcn.14001f650
cmp dword [0x140119980], r13d
mov qword [0x14011bd90], r13
je 0x14001fddf
mov rax, qword [0x140115e50]
lea rcx, [0x1400e346c]
test rax, rax
je 0x14001fdd9
mov rax, qword [rax]
test rax, rax
cmovne rcx, rax
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov rcx, qword [rdi + 0xb30]
mov r12d, dword [0x140114474]
mov byte [0x14011c00b], 1
mov dword [0x140114474], r13d
mov bl, 1
mov byte [0x14011639c], r13b
test rcx, rcx
je 0x14001fe20
call fcn.1400a7a30
test eax, eax
je 0x14001fe20
cmp byte [0x14011639c], r13b
movzx ebx, bl
cmove ebx, r13d
mov byte [0x14011639c], 1
test bl, bl
je 0x14001fe7d
mov dword [rsp + 0x30], r13d
call fcn.140068fb0
mov r9d, r13d
cmp qword [rdi + 0xb30], r9
mov qword [rsp + 0x20], rax
movsxd rax, dword [0x14011d10c]
lea rcx, [rdi + 0xae0]
lea rdx, [rsp + 0x20]
sete r9b
mov r8d, 2
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x50], 1
call fcn.1400a7c00
movzx ebx, bl
cmp eax, 3
cmove ebx, r13d
mov byte [0x14011c00b], r13b
mov r13, qword [rsp + 0x190]
test bl, bl
mov rbx, qword [rsp + 0x180]
jne 0x14001fec6
cmp esi, 0xffffffff
jle 0x14001fec6
lea rcx, [rsp + 0x60]
call fcn.140004b20
mov dword [0x140114474], r12d
mov r12, qword [rsp + 0x188]
mov eax, 8
add rsp, 0x160
pop rdi
pop rsi
pop rbp
ret
mov r8d, ebp
mov edx, esi
mov rcx, rdi
call fcn.14001ff20
int3
cmp byte [0x14011639c], 0
jne 0x14001ff12
cmp edx, 6
jne 0x14001ff12
mov rax, qword [0x1401196d0]
mov ecx, dword [0x14011d10c]
mov byte [0x14011639c], 1
cmp word [rax], 0
lea eax, [rdx + 2]
cmovne ecx, r8d
mov dword [0x14011d10c], ecx
add rsp, 0x160
pop rdi
pop rsi
pop rbp
ret
call fcn.14001ff20
int3
Function at 0x140020920
Capabilities:
Get keyboard layout

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1c088]
mov eax, 0x1c188
call fcn.1400d23b0
sub rsp, rax
xor r13d, r13d
lea r15, [rbp + 0x1c0]
xor al, al
or ebx, 0xffffffff
lea r12, [rbp + 0x14060]
movaps xmmword [rsp + 0x1c170], xmm6
mov qword [rbp - 0x40], r15
mov qword [rbp - 0x30], r15
mov dword [rbp - 0x38], edx
mov qword [rsp + 0x60], r12
lea r14, [0x14011b1d0]
mov word [rbp + 0x81d0], r13w
mov byte [rbp + 0x1c0d8], al
mov word [rsp + 0x4a], r13w
mov word [rsp + 0x70], r13w
mov dword [0x14011b498], edx
mov dword [rsp + 0x68], ebx
test rcx, rcx
je 0x1400209cc
lea r9d, [r13 + 1]
lea rdx, [rbp + 0x1c0]
mov r8d, 0x4000
call fcn.1400aacf0
mov edx, eax
test eax, eax
jne 0x140020a92
mov word [rbp + 0x1c0], r13w
or rsi, 0xffffffffffffffff
mov qword [rsp + 0x58], rsi
lea rdx, [0x1400e8958]
lea rcx, [rbp + 0x1c0]
mov r8d, 2
call fcn.1400cc780
test eax, eax
sete dil
mov byte [rsp + 0x40], dil
test dil, dil
je 0x140020a0e
mov word [rbp + 0x1c0], r13w
mov rsi, r13
mov qword [rsp + 0x58], r13
mov eax, dword [rbp + 0x1c0d8]
mov ecx, dword [rbp + 0x1c0d8]
xorpd xmm6, xmm6
mov dword [rbp - 0x48], eax
movzx eax, byte [rbp + 0x1c0d8]
mov dword [rbp - 0x44], ecx
mov byte [rbp + 0x1c0e0], al
movzx eax, byte [rbp + 0x1c0d8]
mov byte [rbp + 0x1c0e8], al
cmp word [rbp + rdx*2 + 0x1be], 0xa
jne 0x140020aa0
dec rdx
mov word [rbp + rdx*2 + 0x1c0], r13w
lea rcx, [rbp + 0x1c0]
or rdx, 0xffffffffffffffff
call fcn.14001bea0
lea rcx, [rbp + 0x1c0]
mov rdx, rax
call fcn.14001bfa0
mov r8, qword [0x140113a28]
lea rdx, [0x140113a08]
lea rcx, [rbp + 0x1c0]
mov rsi, rax
mov qword [rsp + 0x58], rax
call fcn.1400cc780
test eax, eax
jne 0x140020b03
mov word [rbp + 0x1c0], r13w
mov rsi, r13
mov qword [rsp + 0x58], r13
jmp 0x1400209d5
lea rdx, [0x140113a08]
lea rcx, [rbp + 0x1c0]
call fcn.1400cb634
mov rbx, rax
test rax, rax
je 0x140020c24
lea r9, [rbx - 2]
lea rax, [rbp + 0x1c0]
cmp r9, rax
jb 0x140020c14
movzx eax, word [r9]
cmp ax, 0x20
je 0x140020be3
cmp ax, 9
je 0x140020be3
movzx edx, word [0x14011449c]
lea rcx, [rbp + 0x1c0]
mov rax, r9
cmp r9, rcx
jbe 0x140020b7f
cmp word [rax], dx
jne 0x140020b7f
cmp word [rax - 2], dx
jne 0x140020b7f
lea rcx, [rbp + 0x1c0]
sub rax, 4
cmp rax, rcx
ja 0x140020b64
lea rcx, [rbp + 0x1c0]
cmp rax, rcx
jb 0x140020bb7
cmp word [rax], dx
jne 0x140020bb7
or rcx, 0xffffffffffffffff
lea rdx, [r9 + 2]
xor eax, eax
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx + rcx]
mov rcx, r9
call fcn.1400cb2e0
dec rsi
mov qword [rsp + 0x58], rsi
mov rax, qword [0x140113a28]
lea rdx, [0x140113a08]
lea rcx, [rbx + rax*2]
call fcn.1400cb634
mov rbx, rax
test rax, rax
jne 0x140020b22
mov ebx, dword [rsp + 0x68]
jmp 0x1400209d5
mov word [r9], r13w
lea rax, [rbp + 0x1c0]
lea rcx, [rbp + 0x1c0]
sub r9, rax
sar r9, 1
mov rdx, r9
call fcn.14001bfa0
mov ebx, dword [rsp + 0x68]
mov rsi, rax
mov qword [rsp + 0x58], rax
jmp 0x1400209d5
mov word [rbp + 0x1c0], r13w
mov rsi, r13
mov qword [rsp + 0x58], r13
mov ebx, dword [rsp + 0x68]
jmp 0x1400209d5
Function at 0x140066b60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x30
xor esi, esi
mov rdi, rdx
or r10d, 0xffffffff
mov edx, esi
mov ebp, r9d
mov r12, r8
mov r13, rcx
mov dword [rsp + 0x68], r10d
mov dword [rsp + 0x6c], edx
cmp word [rdi], dx
je 0x140066c67
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x70], r14
lea r14, [0x140000000]
movzx ebx, word [rdi]
test ebx, 0xffffff80
jne 0x140066bca
mov edx, 2
mov ecx, ebx
call fcn.1400cbb48
mov edx, dword [rsp + 0x6c]
mov r10d, dword [rsp + 0x68]
test eax, eax
je 0x140066bca
and ebx, 0xffffffdf
movzx eax, bx
add eax, 0xffffffd5
cmp eax, 0x33
ja case.0x140066beb.51
cdqe
movzx eax, byte [r14 + rax + 0x66cc4]
mov ecx, dword [r14 + rax*4 + 0x66ca0]
add rcx, r14
jmp rcx
movzx esi, word [rdi]
jmp case.0x140066beb.51
mov ecx, 1
jmp 0x140066c21
mov ecx, SafeArrayAllocDescriptor
jmp 0x140066c21
mov ecx, 4
jmp 0x140066c21
mov ecx, 2
jmp 0x140066c21
mov ecx, pe_nt_image_headers64
jmp 0x140066c21
mov ecx, 0x1000
jmp 0x140066c21
mov ecx, 0x100
cmp esi, 0x2b
je 0x140066c3d
cmp esi, 0x2d
je 0x140066c34
cmp esi, 0x5e
jne case.0x140066beb.51
xor edx, ecx
jmp 0x140066c4b
not ecx
and r10d, ecx
and edx, ecx
jmp 0x140066c46
mov eax, ecx
not eax
and r10d, eax
or edx, ecx
mov dword [rsp + 0x68], r10d
mov dword [rsp + 0x6c], edx
add rdi, 2
cmp word [rdi], 0
jne 0x140066ba3
mov r14, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x60]
movzx r9d, byte [rsp + 0x80]
lea rax, [rsp + 0x68]
mov r8d, ebp
mov qword [rsp + 0x28], rax
lea rax, [0x140066d00]
mov rdx, r12
mov rcx, r13
mov qword [rsp + 0x20], rax
call fcn.140066d40
add rsp, 0x30
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret