joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140005d80
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov qword [rcx], 0
test rdx, rdx
je 0x140005dc9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140005de7
lea rax, [rdi + 1]
cmp rax, 2
jb 0x140005dc1
mov qword [rsi], rdi
call fcn.140036360
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov word [rsi + 8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp rax, rdi
je 0x140005e1a
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.140036360
mov r14, qword [rsi]
mov rcx, qword [0x1401096a8]
test rcx, rcx
je 0x140005e0c
mov rax, qword [rcx]
mov rdx, r14
call qword [rax]
mov qword [rsi], 0
jmp 0x140005daf
call fcn.14009d7f0
mov rcx, qword [0x1401096a8]
jmp 0x140005dfb
int3

Function at 0x140006a80
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
mov eax, 0x1040
call fcn.140069820
sub rsp, rax
mov rax, qword [0x140100028]
xor rax, rsp
mov qword [rsp + 0x1038], rax
mov dword [rsp + 0x2c], 0xaaaaaaaa
mov ecx, dword [0x140103438]
mov dword [rsp + 0x2c], ecx
cmp ecx, 0xffffffff
jne 0x140006b1f
lea rcx, [rsp + 0x2c]
call fcn.140092a60
test al, al
je 0x140006b9c
mov ecx, dword [rsp + 0x2c]
cmp ecx, 0xffffffff
jne 0x140006b00
lea rcx, [rsp + 0x2c]
call fcn.140092a60
test al, al
je 0x140006b9f
cmp dword [rsp + 0x2c], 0xffffffff
je 0x140006b9f
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_TlsFree]
mov ecx, dword [rsp + 0x2c]
mov eax, 0xffffffff
lock cmpxchg dword [0x140103438], ecx
je 0x140006b1f
call qword [sym.imp.KERNEL32.dll_TlsFree]
mov ecx, dword [0x140103438]
mov dword [rsp + 0x2c], ecx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x140006b99
lea rsi, [rsp + 0x30]
mov r8d, 0x1000
mov rcx, rsi
xor edx, edx
call fcn.14006bec0
mov ecx, dword [rsp + 0x2c]
lea rdx, [rsp + 0x33]
mov rbx, qword [sym.imp.KERNEL32.dll_TlsSetValue]
call rbx
mov ecx, 0x1000
call fcn.140067688
mov rdi, rax
mov r8d, 0x1000
mov rcx, rax
mov rdx, rsi
call fcn.14006b810
mov ecx, dword [rsp + 0x2c]
mov rdx, rdi
or rdx, 3
call rbx
mov rcx, qword [rsp + 0x1038]
xor rcx, rsp
call fcn.140069890
mov rax, rdi
add rsp, 0x1040
pop rbx
pop rdi
pop rsi
ret
int3
int3
int3

Function at 0x140006f20
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, qword [0x140109628]
cmp rsi, 1
jbe 0x140006f65
mov ecx, dword [0x140103438]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140006fb7
movsxd rcx, dword [rsi]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [rsi + 4]
jne 0x140006fb7
mov rax, qword [rax + rcx]
test rax, rax
je 0x140006fb7
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x140109628]
call fcn.1400473a0
test al, al
je 0x140006fab
mov qword [0x140109630], 0
lea rdi, [0x140109628]
lea rsi, [0x140109630]
mov rcx, rsi
xor edx, edx
call fcn.140036fb0
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
mov r9, rdi
call fcn.140047310
jmp 0x140006f33
mov rsi, qword [0x140109628]
jmp 0x140006f33
int3
Function at 0x1400355a0
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
movapd xmmword [rsp + 0x40], xmm6
mov rsi, rcx
mov rax, qword [0x140100028]
xor rax, rsp
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x28], 0
lea rdx, [rsp + 0x28]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_QueryThreadCycleTime]
movsd xmm0, qword [0x140106338]
xorpd xmm6, xmm6
ucomisd xmm0, xmm6
jne 0x1400355f7
jnp 0x14003565c
ucomisd xmm0, xmm6
jne 0x140035603
jnp 0x140035796
movsd xmm1, qword [rsp + 0x28]
unpcklps xmm1, xmmword [0x1400e7ab0]
subpd xmm1, xmmword [0x1400e7ac0]
movapd xmm2, xmm1
unpckhpd xmm2, xmm1
addsd xmm2, xmm1
divsd xmm2, xmm0
mulsd xmm2, qword [0x1400eddd8]
cvttsd2si rax, xmm2
mov qword [rsi], rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140069890
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rbx, qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov r12d, eax
call rbx
mov rcx, rax
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [0x140106348]
mov ecx, dword [0x1401036f8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14003579d
mov eax, dword [0x140106358]
mov ecx, dword [0x1401036f8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400357d7
rdtsc
mov r14, rax
mov r15, rdx
xor edi, edi
lea rbx, [rsp + 0x30]
mov qword [rbx], rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rbp, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, r12d
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov qword [rbx], rdi
lea rdi, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
sub rbp, qword [0x140106350]
movq xmm0, rbp
punpckldq xmm0, xmmword [0x1400e7ab0]
subpd xmm0, xmmword [0x1400e7ac0]
movapd xmm1, xmm0
unpckhpd xmm1, xmm0
addsd xmm1, xmm0
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rdi]
divsd xmm1, xmm0
xorpd xmm0, xmm0
movsd xmm2, qword [0x1400eddd0]
ucomisd xmm2, xmm1
ja 0x1400355f7
shl r15, 0x20
or r14, r15
sub r14, qword [0x140106340]
movq xmm2, r14
punpckldq xmm2, xmmword [0x1400e7ab0]
subpd xmm2, xmmword [0x1400e7ac0]
movapd xmm0, xmm2
unpckhpd xmm0, xmm2
addsd xmm0, xmm2
divsd xmm0, xmm1
movsd qword [0x140106338], xmm0
jmp 0x1400355f7
xor eax, eax
jmp 0x140035635
lea rcx, [0x140106348]
call fcn.1400673a4
cmp dword [0x140106348], 0xffffffff
jne 0x1400356a6
rdtsc
shl rdx, 0x20
or rdx, rax
mov qword [0x140106340], rdx
lea rcx, [0x140106348]
call fcn.140067344
jmp 0x1400356a6
lea rcx, [0x140106358]
call fcn.1400673a4
cmp dword [0x140106358], 0xffffffff
jne 0x1400356cb
lea rbx, [rsp + 0x30]
mov qword [rbx], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbx]
mov qword [0x140106350], rax
lea rcx, [0x140106358]
call fcn.140067344
jmp 0x1400356cb
Function at 0x140063ca0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rsi
push rdi
mov r9, qword [rcx]
mov r10, qword [rcx + 8]
mov r8, r10
sub r8, r9
je 0x140063d2f
mov rax, r8
shr rax, 2
mov rdx, r9
not rdx
add rdx, r10
jne 0x140063cc7
xor edx, edx
jmp 0x140063d0c
mov r10, r8
and r10, 0xfffffffffffffffe
xor edx, edx
lea r11, [0x1400f4350]
nop word [rax + rax]
movzx esi, al
movzx edi, byte [r9 + rdx]
xor edi, esi
shr eax, 8
xor eax, dword [r11 + rdi*4]
movzx esi, al
movzx edi, byte [r9 + rdx + 1]
xor edi, esi
shr eax, 8
xor eax, dword [r11 + rdi*4]
add rdx, 2
cmp r10, rdx
jne 0x140063ce0
test r8b, 1
je 0x140063d29
movzx edi, al
movzx edx, byte [r9 + rdx]
xor edx, edi
lea rdi, [0x1400f4350]
shr eax, 8
xor eax, dword [rdi + rdx*4]
mov dword [rcx + 0x18], eax
pop rdi
pop rsi
ret
xor eax, eax
jmp 0x140063d29

Function at 0x140063f50
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov qword [rcx], rdx
mov rdi, qword [0x140109698]
cmp rdi, 1
jbe 0x140063fa0
mov ecx, dword [0x140103438]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140063fe6
movsxd rcx, dword [rdi]
shl rcx, 4
mov qword [rax + rcx], rsi
mov ecx, dword [rdi + 4]
movsxd rdx, dword [rdi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x140109698]
call fcn.1400473a0
test al, al
je 0x140063ff2
mov qword [0x1401096a0], 0
lea rbx, [0x140109698]
lea rdi, [0x1401096a0]
mov rcx, rdi
xor edx, edx
call fcn.140036fb0
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9, rbx
call fcn.140047310
jmp 0x140063f6a
test rsi, rsi
je 0x140063f95
call fcn.140006a80
jmp 0x140063f7c
mov rdi, qword [0x140109698]
jmp 0x140063f6a

Function at 0x140064050
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov edi, dword [0x1401096c0]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test esi, esi
jne 0x14006407d
mov rax, rdi
add rsp, 0x28
pop rdi
pop rsi
ret
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140064073

Function at 0x140064090
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov byte [rcx], dl
mov rdi, qword [0x14010acd0]
cmp rdi, 1
jbe 0x1400640df
mov ecx, dword [0x140103438]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140064125
movsxd rcx, dword [rdi]
shl rcx, 4
mov qword [rax + rcx], rsi
mov ecx, dword [rdi + 4]
movsxd rdx, dword [rdi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x14010acd0]
call fcn.1400473a0
test al, al
je 0x140064131
mov qword [0x14010acd8], 0
lea rbx, [0x14010acd0]
lea rdi, [0x14010acd8]
mov rcx, rdi
xor edx, edx
call fcn.140036fb0
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9, rbx
call fcn.140047310
jmp 0x1400640a9
test rsi, rsi
je 0x1400640d4
call fcn.140006a80
jmp 0x1400640bb
mov rdi, qword [0x14010acd0]
jmp 0x1400640a9
Function at 0x1400c3170
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x140103438]
cmp ecx, 0xffffffff
je 0x1400c3195
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 3
dec eax
cmp eax, 2
setb al
add rsp, 0x28
ret
xor eax, eax
jmp 0x1400c3190

Function at 0x1400c7fe0
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x68
mov r14, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x140100028]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov eax, 4
lea r15, [rsp + 0x3c]
mov dword [r15], eax
lea r12, [rsp + 0x38]
mov dword [r12], eax
lea rsi, [rsp + 0x34]
mov dword [rsi], 0
lea rdx, str.ReadValue
lea r8, str..._.._base_win_registry.cc
lea rcx, [rsp + 0x40]
mov r9d, 0x19e
call fcn.14003f330
mov rcx, qword [rbx]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rsi
mov rdx, rdi
xor r8d, r8d
mov r9, r15
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400c80a2
mov eax, dword [rsp + 0x3c]
add eax, 0xfffffffd
mov edi, 0x3f4
cmp eax, 1
ja 0x1400c8085
cmp dword [rsp + 0x38], 4
jne 0x1400c8085
mov eax, dword [rsp + 0x34]
mov dword [r14], eax
xor edi, edi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140069890
mov eax, edi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov edi, eax
jmp 0x1400c8085
Function at 0x1400d7330
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
add rcx, 0x38
call 0x1400d7330
add rsi, 8
mov rcx, rsi
add rsp, 0x20
pop rsi
jmp 0x1400d7330
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x1400d7352
mov rdi, qword [rcx]
call fcn.14000d670
mov rcx, rdi
test rdi, rdi
jne 0x1400d7342
mov rdx, qword [rsi]
mov qword [rsi], 0
test rdx, rdx
je 0x1400d7377
mov r8, qword [rsi + 8]
add rsi, 0x10
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.14000cb90
nop
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x14001d850
Capabilities:
Reference processor manufacturer constants

Disassembly:
push rsi
push rdi
push rbx
mov r8, rcx
xor ebx, ebx
xor eax, eax
xor ecx, ecx
xchg rbx, rsi
cpuid
xchg rbx, rsi
test eax, eax
jle 0x14001d962
mov esi, eax
mov eax, 1
xor ecx, ecx
xchg rbx, rdi
cpuid
xchg rbx, rdi
mov r9d, ecx
mov r10d, edx
mov r11d, eax
cmp esi, 7
jb 0x14001d89d
mov eax, 7
xor ecx, ecx
xchg rbx, rbx
cpuid
xchg rbx, rbx
and ebx, 0x20
mov dword [r8], r11d
mov eax, r11d
and eax, 0xf
mov dword [r8 + 8], eax
shr r11d, 0xc
and r11d, 3
mov dword [r8 + 4], r11d
mov eax, r10d
shr eax, 0x17
and al, 1
mov byte [r8 + 0xc], al
mov eax, r10d
shr eax, 0x19
and al, 1
mov byte [r8 + 0xd], al
shr r10d, 0x1a
and r10b, 1
mov byte [r8 + 0xe], r10b
mov eax, r9d
and al, 1
mov byte [r8 + 0xf], al
mov eax, r9d
shr eax, 9
and al, 1
mov byte [r8 + 0x10], al
mov eax, r9d
shr eax, 0x13
and al, 1
mov byte [r8 + 0x11], al
mov eax, r9d
shr eax, 0x14
and al, 1
mov byte [r8 + 0x12], al
mov eax, r9d
shr eax, 0x17
and al, 1
mov byte [r8 + 0x13], al
mov eax, r9d
shr eax, 0x1f
mov byte [r8 + 0x19], al
mov eax, r9d
not eax
test eax, 0x1c000000
jne 0x14001d999
xor ecx, ecx
xgetbv
not eax
test al, 6
sete al
mov byte [r8 + 0x14], al
mov ecx, r9d
shr ecx, 0x19
and cl, 1
mov byte [r8 + 0x17], cl
shr r9d, 0xc
and r9b, 1
mov byte [r8 + 0x15], r9b
test al, al
setne al
test ebx, ebx
setne cl
and cl, al
mov byte [r8 + 0x16], cl
mov eax, 0x80000000
xor ecx, ecx
xchg rbx, rbx
cpuid
xchg rbx, rbx
cmp eax, 0x80000006
jle 0x14001d99d
mov eax, 0x80000007
xor ecx, ecx
xchg rbx, rbx
cpuid
xchg rbx, rbx
shr edx, 8
and dl, 1
mov byte [r8 + 0x18], dl
test dl, dl
je 0x14001d9a3
pop rbx
pop rdi
pop rsi
ret
xor eax, eax
jmp 0x14001d935
mov dl, byte [r8 + 0x18]
jmp 0x14001d991
cmp byte [r8 + 0x19], 0
je 0x14001d995
mov eax, 0x40000000
xor ecx, ecx
xchg rbx, rbx
cpuid
xchg rbx, rbx
cmp ebx, 0x7263694d
jne 0x14001d995
cmp ecx, 0x666f736f
jne 0x14001d995
cmp edx, 0x76482074
jne 0x14001d995
mov byte [r8 + 0x18], 1
jmp 0x14001d995
Function at 0x1400260a0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test rdx, rdx
je 0x1400260dc
mov rsi, rdx
mov rdi, rcx
mov r14d, 0xffffffff
cmp rsi, r14
mov ebx, 0xffffffff
cmovb rbx, rsi
mov rcx, rdi
mov edx, ebx
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x1400260e6
add rdi, rbx
sub rsi, rbx
jne 0x1400260ba
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
int3

Function at 0x140026290
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rdi
sub rsp, 0x28
cmp qword [0x140125418], 0
jne 0x1400262cd
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x1400262c0
mov dword [rdi], eax
mov dword [0x140125420], eax
mov qword [0x140125418], rsi
cmp eax, 0xffffffff
setne al
add rsp, 0x28
pop rdi
pop rsi
ret
int3
Function at 0x140028bf0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov rdi, r8
mov rsi, rdx
mov bl, byte [rbp + 0x68]
test byte [r9 + 8], 1
jne 0x140028c4a
mov dl, byte [rbp + 0x60]
movzx ebx, bl
mov rax, qword [rcx]
mov rax, qword [rax + 0x30]
mov dword [rsp + 0x28], ebx
mov byte [rsp + 0x20], dl
mov rdx, rsi
mov r8, rdi
call qword [0x140135008]
mov rax, rsi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
lea r14, [rbp - 0x20]
mov rcx, r9
mov rdx, r14
call fcn.1400674f0
lea rdx, [0x140125e08]
mov rcx, r14
call fcn.140067d00
mov r14, rax
mov rcx, qword [rbp - 0x20]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
test eax, eax
jne 0x140028c8a
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x140135008]
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r15, [rbp - 0x20]
mov qword [r15 + 0x10], rax
movaps xmm0, xmmword [0x1400ffac0]
movaps xmmword [r15], xmm0
mov rax, qword [r14]
xor bl, 1
movzx ecx, bl
mov rax, qword [rax + rcx*8 + 0x28]
mov rcx, r14
mov rdx, r15
call qword [0x140135008]
movzx r9d, byte [r15 + 0x17]
test r9b, r9b
mov rcx, qword [r15]
mov r8, qword [r15 + 8]
mov rax, r9
cmovs rax, r8
test rax, rax
je 0x140028d51
test r9b, r9b
mov rbx, r15
cmovs rbx, rcx
test rdi, rdi
je 0x140028d36
mov al, byte [rbx]
movzx eax, al
mov rcx, qword [rdi + 0x30]
cmp rcx, qword [rdi + 0x38]
je 0x140028d3a
lea rdx, [rcx + 1]
mov qword [rdi + 0x30], rdx
mov byte [rcx], al
cmp eax, 0xffffffff
jne 0x140028d0b
xor edi, edi
mov r9b, byte [rbp - 9]
mov rcx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x18]
inc rbx
test r9b, r9b
mov rax, r15
cmovs rax, rcx
movzx edx, r9b
cmovs rdx, r8
add rdx, rax
cmp rbx, rdx
jne 0x140028ce6
jmp 0x140028d51
xor edi, edi
jmp 0x140028d17
mov rcx, qword [rdi]
mov r8, qword [rcx + 0x60]
mov rcx, rdi
mov edx, eax
mov rax, r8
call qword [0x140135008]
jmp 0x140028d04
shr r9b, 7
mov qword [rsi], rdi
test r9b, r9b
je 0x140028c3a
call fcn.1400897f8
jmp 0x140028c3a

Function at 0x140031440
Capabilities:
Create thread

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov ecx, 0x10
call fcn.1400897bc
mov qword [rax], rdi
mov qword [rax + 8], rsi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x1400314b0]
xor ecx, ecx
xor edx, edx
mov r9, rax
call fcn.14009cc64
mov qword [rbx], rax
test rax, rax
je 0x140031497
xor eax, eax
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
Function at 0x140031f30
Capabilities:
Accept command line arguments

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
mov rax, qword [0x140119028]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, qword [0x140126b58]
test rdi, rdi
jne 0x140031fd3
mov ecx, 0x48
call fcn.1400897bc
mov rsi, rax
xorps xmm6, xmm6
movups xmmword [rax], xmm6
mov ecx, 0x18
call fcn.1400897bc
mov qword [rsi + 0x10], rax
lea rcx, [rax + 0x18]
mov qword [rsi + 0x20], rcx
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
mov qword [rsi + 0x18], rcx
lea rax, [rsi + 0x30]
movups xmmword [rsi + 0x30], xmm6
mov qword [rsi + 0x28], rax
mov qword [rsi + 0x40], 1
mov qword [0x140126b58], rsi
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x28], rax
test rax, rax
je 0x140031ff5
mov rcx, rax
call fcn.1400a8f50
lea rdx, [rsp + 0x28]
mov qword [rdx + 8], rax
mov rcx, rsi
call fcn.140032000
test rdi, rdi
sete bl
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14008ab00
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
int3
Function at 0x140032000
Capabilities:
Accept command line arguments

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
movaps xmmword [rsp + 0x70], xmm6
mov rsi, rdx
mov rbx, rcx
mov rax, qword [0x140119028]
xor rax, rsp
mov qword [rsp + 0x68], rax
movups xmm0, xmmword [rdx]
lea rdx, [rsp + 0x50]
movaps xmmword [rdx], xmm0
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r8d, 3
call fcn.14003f660
movups xmm0, xmmword [rdi]
movups xmmword [rsi], xmm0
cmp qword [rsi + 8], 0
je 0x1400321fe
movups xmm0, xmmword [rsi]
movups xmmword [rbx], xmm0
mov dword [rsp + 0x4c], 0
lea rcx, str.api_ms_win_downlevel_shell32_l1_1_0.dll
xor edx, edx
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test rax, rax
mov qword [rsp + 0x20], rax
je 0x140032253
lea rdx, [0x140102d1e]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140032266
mov rcx, qword [rsi]
lea rdx, [rsp + 0x4c]
call qword [0x140135008]
mov r12, rax
movsxd rbp, dword [rsp + 0x4c]
xorps xmm6, xmm6
movaps xmmword [rsp + 0x30], xmm6
mov qword [rsp + 0x40], 0
test rbp, rbp
mov qword [rsp + 0x28], rbx
je 0x14003226e
shl rbp, 3
movabs rax, 0x5555555555555551
cmp rbp, rax
jae 0x14003224e
lea rdi, [rbp*2]
add rdi, rbp
mov rcx, rdi
call fcn.1400897bc
mov rsi, rax
mov qword [rsp + 0x30], rax
add rax, rdi
mov qword [rsp + 0x40], rax
xor r15d, r15d
mov rbx, qword [r12 + r15]
mov rcx, rbx
call fcn.1400a8f50
mov rdi, rax
movabs rax, 0x7fffffffffffffef
cmp rdi, rax
ja 0x14003224e
cmp rdi, 0xb
jae 0x140032160
mov byte [rsi + 0x17], dil
test rdi, rdi
je 0x14003215b
cmp rdi, 3
jne 0x1400321bc
movzx eax, word [rbx + 4]
mov word [rsi + 4], ax
mov eax, dword [rbx]
mov dword [rsi], eax
mov r13, rsi
jmp 0x1400321a1
lea r14, [rdi + 8]
and r14, 0xfffffffffffffff8
lea rcx, [r14 + r14]
call fcn.1400897bc
mov r13, rax
mov qword [rsi], rax
movabs rax, 0x7fffffffffffffef
add rax, 0x11
or rax, r14
mov qword [rsi + 0x10], rax
mov qword [rsi + 8], rdi
mov r8, rdi
add r8, rdi
mov rcx, r13
mov rdx, rbx
call fcn.14008c580
mov word [r13 + rdi*2], 0
add rsi, 0x18
add r15, 8
cmp rbp, r15
jne 0x140032118
jmp 0x1400321c1
mov r13, rsi
jmp 0x140032190
mov qword [rsp + 0x38], rsi
lea rdx, [rsp + 0x30]
mov rdi, qword [rsp + 0x28]
mov rcx, rdi
call fcn.140031d80
movups xmmword [rdi], xmm6
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x1400321f4
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rdi, qword [rsp + 0x30]
test rdi, rdi
jne 0x140032224
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14008ab00
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
cmp rsi, rdi
je 0x140032244
lea rbx, [rsi - 0x18]
cmp byte [rsi - 1], 0
jns 0x14003223c
mov rcx, qword [rsi - 0x18]
call fcn.1400897f8
mov rsi, rbx
cmp rbx, rdi
jne 0x140032229
mov rcx, rdi
call fcn.1400897f8
jmp 0x1400321fe
call fcn.1400a1f00
mov rcx, qword [rsi]
lea rdx, [rsp + 0x4c]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
jmp 0x1400320b4
xor r12d, r12d
jmp 0x1400320b7
xor esi, esi
jmp 0x1400321c6
Function at 0x140033320
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
movaps xmmword [rsp + 0x80], xmm6
mov rax, qword [0x140119028]
xor rax, rsp
mov qword [rsp + 0x78], rax
movzx eax, byte [0x140126b68]
and eax, 1
neg rax
cmp rax, 0xfffffffffffffffd
je 0x1400334c7
mov qword [rsp + 0x40], rdx
mov rbx, qword [rcx]
mov qword [rsp + 0x38], rcx
mov rdi, qword [rcx + 8]
xor r13d, r13d
lea r12, [0x140102c90]
movabs rcx, 0xaaaaaaaaaaaaaaaa
movaps xmm6, xmmword [0x1400ffac0]
lea rsi, [rsp + 0x60]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x48], rbx
mov rbx, qword [rsp + 0x48]
mov rax, r13
shl rax, 4
mov qword [rsp + 0x70], rcx
movaps xmmword [rsp + 0x60], xmm6
mov rdx, qword [rax + r12]
mov rbp, qword [rax + r12 + 8]
mov byte [rsp + 0x77], bpl
mov r8, rbp
add r8, rbp
mov r15, rsi
mov rcx, rsi
call fcn.14008c580
mov word [rsp + rbp*2 + 0x60], 0
movzx eax, byte [rsp + 0x77]
mov rcx, rax
test al, al
jns 0x1400333e9
mov rcx, qword [rsp + 0x68]
cmp rcx, rdi
ja 0x140033521
mov r14b, 1
test rcx, rcx
mov rsi, r15
je 0x14003352c
mov rdx, rsi
test al, al
jns 0x14003340d
mov rdx, qword [rsp + 0x60]
xor ebp, ebp
movzx edi, word [rbx + rbp*2]
cmp di, word [rdx + rbp*2]
jne 0x14003345e
inc rbp
cmp rcx, rbp
jne 0x14003340f
mov rbp, rcx
test al, al
js 0x140033533
test r14b, r14b
jne 0x140033468
mov qword [rsp + 0x28], rbp
inc r13
movzx eax, byte [0x140126b68]
xor rax, 3
cmp r13, rax
mov rdi, qword [rsp + 0x30]
movabs rcx, 0xaaaaaaaaaaaaaaaa
jb 0x1400333a1
jmp 0x1400334c7
xor r14d, r14d
mov rbp, qword [rsp + 0x28]
jmp 0x140033424
test rbp, rbp
je 0x1400334c7
mov rsi, qword [rsp + 0x38]
cmp rbp, qword [rsi + 8]
mov rdi, qword [rsp + 0x40]
je 0x1400334c7
lea rax, [0x140102cc0]
lea rdx, [rsp + 0x60]
mov qword [rdx], rax
mov qword [rdx + 8], 1
movups xmm0, xmmword [rsi]
lea rcx, [rsp + 0x50]
movaps xmmword [rcx], xmm0
xor r8d, r8d
call fcn.140070250
mov rdx, qword [rsi + 8]
sub rdx, rbp
jb 0x140033545
mov rcx, qword [rdi + 8]
sub rax, rbp
cmp rdx, rax
cmovb rax, rdx
cmp rax, rcx
je 0x1400334f4
xor ebx, ebx
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14008ab00
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x80]
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov bl, 1
test rcx, rcx
je 0x1400334c9
mov rax, qword [rdi]
add rbp, rbp
add rbp, qword [rsi]
xor edx, edx
mov rdi, rbp
movzx ebp, word [rbp + rdx*2]
cmp bp, word [rax + rdx*2]
jne 0x1400334c7
inc rdx
cmp rcx, rdx
mov rbp, rdi
jne 0x140033506
jmp 0x1400334c9
xor r14d, r14d
mov rsi, r15
jmp 0x140033461
xor ebp, ebp
jmp 0x140033424
mov rcx, qword [rsp + 0x60]
call fcn.1400897f8
mov rsi, r15
jmp 0x14003342c
int3