joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d01e2
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140001303
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r12d, r12d
je 0x1400014bc
cmp r15d, 0x2000
jb 0x1400014bc
movsxd rax, dword [rdi + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x1400014bc
mov ecx, 0x10b
cmp word [rax + rdi + 0x18], cx
je 0x1400014bc
mov ecx, 0x20b
cmp word [rax + rdi + 0x18], cx
jne 0x1400014bc
mov edx, dword [rax + rdi + 0x88]
mov rcx, rdi
call fcn.140002010
mov r13d, eax
mov rcx, rdi
add r13, rdi
mov edx, dword [r13 + 0x20]
call fcn.140002010
mov edx, dword [r13 + 0x24]
mov rcx, rdi
mov r14d, eax
add r14, rdi
call fcn.140002010
mov r15d, eax
mov r12d, ebx
add r15, rdi
cmp dword [r13 + 0x18], ebx
jbe 0x1400014bc
mov edx, dword [r14]
mov rcx, rdi
call fcn.140002010
mov ecx, eax
lea rdx, str.ReflectiveDllMain
add rcx, rdi
call qword [sym.imp.SHLWAPI.dll_StrStrA]
test rax, rax
jne 0x1400013d3
add r14, 4
add r15, 2
inc r12d
cmp r12d, dword [r13 + 0x18]
jb 0x14000139b
jmp 0x1400014bc
mov edx, dword [r13 + 0x1c]
mov rcx, rdi
call fcn.140002010
movzx ecx, word [r15]
mov eax, eax
add rax, rdi
mov edx, dword [rax + rcx*4]
mov rcx, rdi
call fcn.140002010
mov r12d, eax
test eax, eax
je 0x1400014bc
mov r15d, dword [rsp + 0x60]
mov r9d, 0x3000
mov r8d, r15d
mov dword [rsp + 0x20], 0x40
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r14, rax
test rax, rax
je 0x1400014bc
mov r9d, r15d
mov qword [rsp + 0x20], rbx
mov r8, rdi
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x1400014bc
lea rax, [r14 + r12]
mov qword [rsp + 0x28], r14
mov r9, rsi
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x60], rbx
call fcn.1400018f8
test eax, eax
js 0x1400014bc
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400014bc
cmp dword [rbp + 0x408], ebx
je 0x140001483
mov ebx, 1
jmp 0x1400014b6
mov edx, 0x64
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x1400014b1
mov rcx, qword [rsp + 0x60]
lea rdx, [rbp + 0x400]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x1400014b1
cmp dword [rbp + 0x400], ebx
setne bl
mov rcx, qword [rsp + 0x60]
call fcn.1400b7b8e
call fcn.140077a49
jge 0x1400761a4
wait
iretd
cmp dword [rdx + riz*8 - 0x4d2b46a1], esp
invalid
jge 0x14006300a
movabs rax, 0x159e08ad7b8c9bb5
je 0x140076159
mov rax, qword [rsp + 0x60]
mov rax, qword [rax]
mov rcx, r15
add byte [rsp + 0x10], 0x9b
mov r10, qword [rsp + 0x10]
xor r10d, 0x1f31bf0d
lea r10, [r10*4 + 0x76a64c1c]
jbe 0x1400012f4
lea rax, [rax - 0x5a44a17a]
cmp dil, byte [rsp + 0x15]
je 0x14005adf7
not r15b
xchg qword [rsp + 0x78], rax
mov r15, qword [rsp + 0x68]
mov r9, qword [rsp + 0x10]
movzx r10, byte [rsp + 0x10]
jge 0x1400564e0
cmp edi, dword [rsp + 0x12]
mov r10, qword [rsp + 0x10]
movzx cx, r9b
call fcn.140049f86
pop rdi
mov ch, 0x49
add eax, 0x28541883
fmul dword [rax - 0x3ae2f6c6]
imul ebp, dword [0xd5018310], 0x317a2cd0
invalid
Function at 0x1400d3ed1
Capabilities:
Connect pipe
Read file on windows

Disassembly:
xchg qword [rsp + 0x20], rbx
push 0x541a64aa
call fcn.14007abcf

Function at 0x1400d3f02
Capabilities:
Connect pipe
Read file on windows

Disassembly:
mov qword [rsp + 0x40], rax
and r10, 0x320f041f
not edi
lea r10, [rdi*2 + 0x6a1784bb]
push r11
movabs r11, 0x232e3f87f12cde9d
shr r10d, 0xba
lea r10, [r10*8 - 0x764b3364]
add qword [rsp + 0x30], 0x2dc4
test rdi, 0x4a824d1c
lea r11, [r11 + rdi*8 - 0x4ccf7ae2]
push r15
movzx edi, r10w
mov r15, r11
movabs rax, 0x9a9da63bf22cef34
movabs rcx, 0xe837532916111798
mov rax, qword [rsp + rdi - 0xccc4]
mov rax, qword [rax]
setns r10b
mov qword [rsp + 0x38], rcx
setno r10b
js 0x1400a3884
sub r10d, 0x27b56319
test r10, 0xfffffffff904f91d
lea r10, [rcx*2 + 0x33be2105]
mov rcx, qword [rsp + rdi - 0xccc4]
bswap ecx

Function at 0x1400d7ad2
Capabilities:
Enumerate process modules

Disassembly:
movabs r13, 0x653c5c24e3ab5398
or rcx, 0x5eb32baa
add qword [rsp + 8], 0xffffffffbff22251
mov r13, qword [rsp + 0x28]
call fcn.14000f39a
mov r11, qword [rsp + 0x18]
jae 0x14006624c

Function at 0x1400d900d
Capabilities:
Encode data using xor

Disassembly:
and dword [rsp + 0x48], 0x482986a1
and qword [rsp + 0x50], 0x1594da2c
xor word [rsp + 0x50], 0xed11
add qword [rsp + r15 - 0x61c6c970], 0xffffffffbffb2834
test qword [rsp + r15 - 0x61c6c960], r15
jl 0x1400966aa
mov r15, qword [rsp + r15 - 0x61c6c908]
jl 0x14007be79
jae 0x140066e56
or qword [rsp + r13 - 0x61c6c930], 0xffffffffcba94fb4
not byte [rsp + r13 - 0x61c6c930]
and r13w, r13w
test dword [rsp + r13 - 0x61c6c95d], r13d
mov r13, qword [rsp + r15 - 0x61c6c968]
jno 0x1400c18a4

Function at 0x1400da5df
Capabilities:
Encode data using xor

Disassembly:
jge fcn.140011bb0
mov qword [rsp + 0x18], rax
test edi, 0x41fd498
jbe 0x1400d4646
push rdx
sub di, 0xb615
push r10
call fcn.140059e04

Function at 0x1400dbd67
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Execute shellcode via indirect call
Resolve function by parsing pe exports
Resume thread
Terminate process

Disassembly:
pop r13
add qword [rsp + r13 - 0x4e980c12], 0x6acc5
push r14
cmp r10w, 0xeb85
lea rsi, [rsi + rdi - 0xb4224fa]
call fcn.140016354
movabs rdx, 0xf8afc0aa5f9cb13f
mov rdx, qword [rsp + 0x20]
lea r13, [r13 + r13*4 - 0x73e36ce4]
call fcn.1400d1230
jo 0x14009da06
mov rcx, rdx
movabs rdx, 0x3331d72ee737949d
add rdx, rcx
shl dl, cl
js 0x1400c056b
or cl, cl
mov qword [rsp + 0x50], rsi
add qword [rsp], 0xa0810

Function at 0x1400dc8c9
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
add qword [rsp], 0x2d4b
lea r12, [rdi + r12*8 + 0x4b84df08]
movsx r8, r12w
call fcn.14004dc09
mov eax, dword [rcx]
bt r11d, r14d
jmp 0x1400c35ca
Function at 0x140237de4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
bts r10w, si
xor edi, edi
movzx ebx, r8b
mov r8b, 0xb5
mov r11, rcx
mov r8, rdi
movsx r9d, r12w
xchg r10b, r10b
movzx r10, r13w
nop
movzx r9d, byte [r11]
movzx r10d, byte [rdx]
jmp 0x140237e1b
inc r11
jmp 0x140237e23
inc rdx
clc
test bl, bl
jmp 0x140237e2e
je 0x140237e69
mov ecx, r8d
rcr ah, 0x9c
mov eax, 0x3f9d0512
clc
jmp 0x140237e45
rol eax, cl
test r11b, 0x85
cmp r8b, 0x2e
add al, r8b
cmp dh, 0x28
xor r9b, al
jmp 0x140237e5d
inc r8
test r13w, 0x903b
cmp r11b, al
test r9b, r9b
je 0x140237e80
cmp r9b, r10b
jmp 0x140237e7a
je 0x140237e0e
cmp r9b, r10b
jmp 0x140237e88
jae 0x140237eae
or eax, 0xffffffff
movsxd rbx, esp
mov rbx, qword [rsp + 8]
movsx edi, di
movsx rdi, sp
movzx edi, di
mov rdi, qword [rsp + 0x10]
jmp 0x140237ead
ret
mov rbx, qword [rsp + 8]
cmovl ax, r15w
movsxd rax, r12d
lahf
seta dil
bswap ax
movzx rax, bx
movsx eax, r11w
mov eax, edi
bswap edi
mov rdi, qword [rsp + 0x10]
ret
Function at 0x140005cf0
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
mov qword [rsp + 0x58], rdx
mov rbx, r8
xor edx, edx
test rcx, rcx
je 0x140005d24
cmp word [rcx], 0x5a4d
jne 0x140005d24
movsxd rax, dword [rcx + 0x3c]
cmp eax, 0x400
jg 0x140005d24
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140005d24
mov edx, dword [rcx + 0x28]
add rdx, qword [rsp + 0x58]
mov rcx, rbx
call fcn.140005c30
test eax, eax
jne 0x140005d40
xor eax, eax
add rsp, 0x40
pop rbx
ret
mov rcx, rbx
call fcn.140005ca0
test rax, rax
je 0x140005d35
lea rdx, [rax + 0x10]
lea rax, [rsp + 0x38]
mov rcx, qword [rbx]
mov r9d, 8
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x58]
mov qword [rsp + 0x38], 0
call fcn.1400064ec
not eax
shr eax, 0x1f
add rsp, 0x40
pop rbx
ret

Function at 0x1400063f0
Capabilities:
Execute syscall

Disassembly:
pop rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov rcx, r10
call fcn.140006390
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x140006844
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rax, qword [0x1409afc18]
xor ebx, ebx
add rax, 0x18
mov r12, rcx
mov ecx, dword [0x1409afc14]
mov rsi, rdx
mov rdi, r8
cmp ebx, ecx
jge 0x140006892
mov rdx, qword [rax]
cmp r12, rdx
jb 0x14000688a
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x140006979
inc ebx
add rax, 0x28
jmp 0x14000686a
mov rcx, r12
call fcn.140007071
mov rbp, rax
test rax, rax
jne 0x1400068b1
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.1400067e0
movsxd rbx, ebx
mov rax, qword [0x1409afc18]
xor edx, edx
imul rbx, rbx, 0x28
add rax, rbx
mov dword [rax], edx
mov qword [rax + 0x20], rbp
call fcn.14000711f
mov edx, dword [rbp + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x1409afc18]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x140006913
mov rax, qword [0x1409afc18]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.1400067e0
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x140006973
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140006973
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x1409afc18]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140006973
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.1400067e0
inc dword [0x1409afc14]
mov ecx, edi
mov rdi, r12
rep movsb byte [rdi], byte [rsi]
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x140006da0
Capabilities:
Get thread local storage value

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rdi, [0x1409afc80]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1409afc60]
test rbx, rbx
je 0x140006dec
mov ecx, dword [rbx]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rsi, rsi
je 0x140006de6
test eax, eax
jne 0x140006de6
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
jmp 0x140006dbe
mov rcx, rdi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x140006fa0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x140006fc3
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x140006fc3
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x140006fc4
Capabilities:
Enumerate pe sections

Disassembly:
xor r8d, r8d
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
movzx r9d, word [rcx + 6]
lea rax, [rcx + rax + 0x18]
cmp r8d, r9d
jae 0x140006ffe
mov r10d, dword [rax + 0xc]
mov rcx, r10
cmp rdx, r10
jb 0x140006ff5
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x140007000
inc r8d
add rax, 0x28
jmp 0x140006fdc
xor eax, eax
ret

Function at 0x140007071
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x1409a7390]
mov r8, rcx
mov rcx, r9
call fcn.140006fa0
test eax, eax
je 0x14000709d
mov rdx, r8
mov rcx, r9
sub rdx, r9
add rsp, 0x28
jmp fcn.140006fc4
xor eax, eax
add rsp, 0x28
ret
Function at 0x1400016a0
Capabilities:
Terminate process
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rsi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rsi
lea rcx, str.mksdcard:_create_a_blank_FAT32_image_to_be_used_with_the_Android_emulator_n
mov rdi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov edx, 0x4a
mov r8d, 1
mov r9, rax
call rdi
mov ecx, 2
call rsi
lea rcx, str.usage:_mksdcard___l_label___size___file__n_n
mov edx, 0x2a
mov r8d, 1
mov r9, rax
call rdi
mov ecx, 2
call rsi
lea rcx, str.__if__size__is_a_simple_integer__it_specifies_a_size_in_bytes_n
mov edx, 0x3e
mov r8d, 1
mov r9, rax
call rdi
mov ecx, 2
call rsi
lea rcx, str.__if__size__is_an_integer_followed_by_K__it_specifies_a_size_in_KiB_n
mov edx, 0x46
mov r8d, 1
mov r9, rax
call rdi
mov ecx, 2
call rsi
lea rcx, str.__if__size__is_an_integer_followed_by_M__it_specifies_a_size_in_MiB_n
mov edx, 0x46
mov r8d, 1
mov r9, rax
call rdi
mov ecx, 2
call rsi
lea rcx, str.__if__size__is_an_integer_followed_by_G__it_specifies_a_size_in_GiB_n
mov edx, 0x46
mov r8d, 1
mov r9, rax
call rdi
mov ecx, 2
call rsi
lea rcx, str._nMinimum_size_is_9M._The_Android_emulator_cannot_use_smaller_images._n
mov edx, 0x45
mov r8d, 1
mov r9, rax
call rdi
mov ecx, 2
call rsi
mov qword [rsp + 0x28], 0x3ff
mov qword [rsp + 0x20], 0xfffff
lea rdx, str.Maximum_size_is__lld_bytes___lldK___lldM_or__lldG_n
movabs r8, 0xfffffffe00
mov r9d, 0x3fffffff
mov rcx, rax
call fcn.1400017d0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x140001820
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rax, rdx
mov r9, rcx
mov edx, 1
mov r8d, 0x200
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rsi, rax
cmp rax, 0x200
je 0x14000187f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, dword [rax]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_strerror]
mov rdi, rax
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, str.Failed_to_write_sector_of__d_bytes:__s_n
mov rcx, rax
mov r8d, 0x200
mov r9, rdi
call fcn.1400017d0
xor eax, eax
cmp rsi, 0x200
setne al
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x1400018a0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rbx, rcx
lea rcx, [0x140005650]
xor r14d, r14d
mov r8d, 0x40000
xor edx, edx
call sub.VCRUNTIME140.dll_memset
test rdi, rdi
jle 0x140001946
shl rdi, 9
lea r15, [0x140005650]
mov rbp, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, 0x40000
mov esi, 0x40000
cmovb rsi, rdi
mov edx, 1
mov rcx, r15
mov r8, rsi
mov r9, rbx
call rbp
cmp rax, rsi
jne 0x14000190f
sub rdi, rsi
test rdi, rdi
jg 0x1400018e0
jmp 0x140001946
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, dword [rax]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_strerror]
mov rdi, rax
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, str.Failed_to_write__d_bytes:__s_n
mov rcx, rax
mov r8d, esi
mov r9, rdi
call fcn.1400017d0
mov r14d, 1
mov eax, r14d
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140018a20
Capabilities:
Read file via mapping

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rbx, r8
mov r15d, edx
mov rsi, rcx
mov rax, qword [0x140055018]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea rdi, [rcx + 0x28]
mov rcx, rdi
call fcn.140018900
xor ebp, ebp
cmp rbx, 0x7fffffff
ja 0x140018a68
test al, al
je 0x140018a68
cmp qword [rsi + 0x58], 0
je 0x140018a84
xor ebp, ebp
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400477a0
mov eax, ebp
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
cmp byte [rsi], 0
je 0x140018b0d
mov rcx, rdi
call fcn.140018910
mov r14, rax
mov rbp, qword [0x140055c10]
test rbp, rbp
jne 0x140018acb
lea rcx, [0x14004d42a]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.NtQuerySection
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbp, rax
mov qword [0x140055c10], rax
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x30]
mov rcx, r14
xor edx, edx
mov r9d, 0x18
call rbp
test eax, eax
jne 0x140018a66
test dword [rsp + 0x38], 0x1000000
jne 0x140018a66
mov r14d, r15d
sar r14d, 0x1f
xor eax, eax
cmp byte [rsi + 0x60], 0
sete al
lea ebp, [rax + rax]
add ebp, 4
mov rcx, rdi
call fcn.140018910
mov qword [rsp + 0x20], rbx
mov rcx, rax
mov edx, ebp
mov r8d, r14d
mov r9d, r15d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsi + 0x58], rax
test rax, rax
jne 0x140018b84
xor eax, eax
cmp byte [rsi + 0x60], 0
sete al
lea ebp, [rax + rax]
add ebp, 4
mov rcx, rdi
call fcn.140018910
mov qword [rsp + 0x20], rbx
mov rcx, rax
mov edx, ebp
mov r8d, r14d
mov r9d, r15d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsi + 0x58], rax
test rax, rax
je 0x140018a66
mov rbp, rax
lea rdx, [rsp + 0x30]
mov r8d, 0x30
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x140018ba4
xor eax, eax
jmp 0x140018bb1
mov rax, qword [rsp + 0x48]
sub rax, rbp
add rax, qword [rsp + 0x38]
mov qword [rsi + 0x50], rax
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.1400188a0
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rsi + 0x70], xmm0
call fcn.140018be0
mov bpl, 1
jmp 0x140018a68

Function at 0x140018c40
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
cmp qword [rcx], rdx
je 0x140018cb4
mov rdi, rdx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
mov rcx, rsi
call fcn.140018cd0
lea rax, [rdi + 1]
cmp rax, 2
jb case.default.0x140018cad
mov qword [rsi], rdi
call fcn.140018870
mov rbx, rax
mov r15, qword [rsp + 0x58]
call sym.firefox.exe_GetHandleVerifier
mov rbp, qword [rax]
mov qword [rsp + 0x20], rbx
mov rcx, rax
mov rdx, rdi
mov r8, rsi
mov r9, r15
call qword [rbp + 8]
mov ecx, r14d
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
jmp qword [sym.imp.KERNEL32.dll_SetLastError]
nop
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
lea ebp, [rsi - 0x31bfb2f8]
sbb eax, 0xae8af98b
mov edi, ecx
mov ch, byte [rsi + 0x67def54d]
stosd dword [rdi], eax
Function at 0x14000182c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001876
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001876
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001876
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001876
cmp dword [rcx + 0x84], 0xe
jbe 0x140001876
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001878
xor al, al
add rsp, 0x28
ret
Function at 0x1400010f0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x58
movaps xmmword [rsp + 0x40], xmm10
movaps xmmword [rsp + 0x30], xmm9
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x10], xmm7
movaps xmmword [rsp], xmm6
movdqa xmm0, xmmword [rcx]
movdqa xmm1, xmmword [rcx + 0x10]
movdqa xmm9, xmmword [rcx + 0x20]
movdqa xmm8, xmmword [rcx + 0x30]
movdqa xmm10, xmmword [rdx]
pxor xmm10, xmm0
movdqa xmm3, xmmword [rdx + 0x10]
pxor xmm3, xmm0
movdqa xmm4, xmmword [rdx + 0x20]
pxor xmm4, xmm0
movdqa xmm5, xmmword [rdx + 0x30]
pxor xmm5, xmm0
movdqa xmm2, xmmword [rdx + 0x40]
pxor xmm2, xmm0
movdqa xmm6, xmmword [rdx + 0x50]
pxor xmm6, xmm0
movdqa xmm7, xmmword [rdx + 0x60]
pxor xmm7, xmm0
pxor xmm0, xmmword [rdx + 0x70]
aesenc xmm10, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm2, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm0, xmm1
aesenc xmm10, xmm9
aesenc xmm3, xmm9
aesenc xmm4, xmm9
aesenc xmm5, xmm9
aesenc xmm2, xmm9
aesenc xmm6, xmm9
aesenc xmm7, xmm9
aesenc xmm0, xmm9
aesenc xmm10, xmm8
aesenc xmm3, xmm8
aesenc xmm4, xmm8
aesenc xmm5, xmm8
aesenc xmm2, xmm8
aesenc xmm6, xmm8
aesenc xmm7, xmm8
aesenc xmm0, xmm8
movdqa xmm1, xmmword [rcx + 0x40]
aesenc xmm10, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm2, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm0, xmm1
movdqa xmm1, xmmword [rcx + 0x50]
aesenc xmm10, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm2, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm0, xmm1
movdqa xmm1, xmmword [rcx + 0x60]
aesenc xmm10, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm2, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm0, xmm1
movdqa xmm1, xmmword [rcx + 0x70]
aesenc xmm10, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm2, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm0, xmm1
movdqa xmm1, xmmword [rcx + 0x80]
aesenc xmm10, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm2, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm0, xmm1
movdqa xmm1, xmmword [rcx + 0x90]
aesenc xmm10, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm2, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm0, xmm1
movdqa xmm1, xmmword [rcx + 0xa0]
aesenclast xmm10, xmm1
aesenclast xmm3, xmm1
movdqa xmmword [rdx], xmm10
movdqa xmmword [rdx + 0x10], xmm3
aesenclast xmm4, xmm1
movdqa xmmword [rdx + 0x20], xmm4
aesenclast xmm5, xmm1
movdqa xmmword [rdx + 0x30], xmm5
aesenclast xmm2, xmm1
aesenclast xmm6, xmm1
movdqa xmmword [rdx + 0x40], xmm2
movdqa xmmword [rdx + 0x50], xmm6
aesenclast xmm7, xmm1
movdqa xmmword [rdx + 0x60], xmm7
aesenclast xmm0, xmm1
movdqa xmmword [rdx + 0x70], xmm0
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
add rsp, 0x58
ret
Function at 0x1400024a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aeskeygenassist xmm0, xmmword [rdx], 2
movdqa xmmword [rcx], xmm0
ret

Function at 0x1400434b0
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x468
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3e0], 0xfffffffffffffffe
mov qword [rbp + 0x3d8], rcx
xor ebx, ebx
lea rcx, [rbp - 0x58]
mov r8d, 0x400
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov qword [rbp + 0x3c0], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3c8], xmm0
mov esi, 0x200
mov r13d, 2
cmp rsi, 0x201
jae 0x140043532
jmp 0x140043580
mov rsi, r8
jae 0x1400435dd
cmp rsi, 0x201
jb 0x140043580
mov r8, rsi
sub r8, rbx
mov rax, qword [rbp + 0x3c8]
sub rax, rbx
cmp rax, r8
jae 0x14004355d
lea rcx, [rbp + 0x3c0]
mov rdx, rbx
call fcn.14005c2b0
mov r13, qword [rbp + 0x3c0]
mov qword [rbp + 0x3d0], rsi
mov rbx, rsi
mov r15, r13
mov r14, rsi
mov r12, r13
jmp 0x14004358d
lea r12, [rbp - 0x58]
mov r15, r12
mov r14d, 0x200
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, esi
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov edi, eax
test eax, eax
jne 0x1400435b0
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140043625
mov r8d, edi
cmp rsi, r8
jne 0x140043520
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140043681
add rsi, rsi
cmp rsi, 0x201
jae 0x140043532
jmp 0x140043580
cmp r14, r8
jb 0x14004369b
lea rcx, [rbp + 0x3a8]
mov rdx, r15
call fcn.140046790
mov rax, qword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3d8]
mov qword [rsi + 0x18], rax
movups xmm0, xmmword [rbp + 0x3a8]
movups xmmword [rsi + 8], xmm0
xor eax, eax
mov qword [rsi], rax
mov rdx, qword [rbp + 0x3c8]
test rdx, rdx
jne 0x140043652
jmp 0x14004366a
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3d8]
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
mov rdx, qword [rbp + 0x3c8]
test rdx, rdx
je 0x14004366a
test r13, r13
je 0x14004366a
add rdx, rdx
je 0x14004366a
mov r8d, 2
mov rcx, r13
call fcn.14003e880
mov rax, rsi
add rsp, 0x468
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea rcx, str.internal_error:_entered_unreachable_code_rustc_eb82facb1626166188d49599a3313fc95201f556library_alloc_src_vecmod.rs
lea r8, str.library_std_src_syswindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.14005cd70
jmp 0x1400436b0
lea rax, str.library_std_src_syswindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, r14
mov r8, rax
call fcn.14005cfd0
ud2