joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000c600
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
mov r10, rcx
mov r11d, dword [rsp + 0x58]
mov eax, dword [r9]
mov ebx, eax
and ebx, 7
cmp rdx, 5
jb 0x14000c77d
sub rdx, 4
add r8d, 5
xor esi, esi
lea rdi, [rsi + r10]
lea rax, [rdx + r10]
cmp rdi, rax
jae 0x14000c653
nop
nop
mov cl, byte [rdi]
and cl, 0xfe
cmp cl, 0xe8
je 0x14000c653
add rdi, 1
cmp rdi, rax
jb 0x14000c640
mov rcx, rdi
sub rcx, r10
mov r12, rcx
sub r12, rsi
mov rsi, rcx
cmp rdi, rax
jae 0x14000c727
cmp r12, 2
jbe 0x14000c740
xor ebx, ebx
mov al, byte [rdi + 4]
add al, 1
test al, 0xfe
jne 0x14000c76b
movzx eax, byte [rdi + 4]
shl eax, 0x18
movzx ecx, byte [rdi + 3]
shl ecx, 0x10
or eax, ecx
movzx ecx, byte [rdi + 2]
shl ecx, 8
or eax, ecx
movzx ecx, byte [rdi + 1]
mov r13d, eax
or r13d, ecx
mov eax, esi
lea r14d, [r8d + eax]
add rsi, 5
test r11d, r11d
je 0x14000c6bc
add r13d, r14d
jmp 0x14000c6bf
sub r13d, r14d
test ebx, ebx
je 0x14000c6fa
mov ecx, ebx
and ecx, 6
add ecx, ecx
add ecx, ecx
mov eax, r13d
shr eax, cl
movzx eax, al
add eax, 1
test eax, 0xfe
jne 0x14000c6f8
mov eax, 0x100
shl eax, cl
sub eax, 1
xor r13d, eax
test r11d, r11d
je 0x14000c6f5
add r13d, r14d
jmp 0x14000c6f8
sub r13d, r14d
xor ebx, ebx
mov al, r13b
mov byte [rdi + 1], al
mov eax, r13d
shr eax, 8
mov byte [rdi + 2], al
mov eax, r13d
shr eax, 0x10
mov byte [rdi + 3], al
xor eax, eax
shr r13d, 0x18
and r13d, 1
sub eax, r13d
mov byte [rdi + 4], al
jmp 0x14000c62d
cmp r12, 2
jbe 0x14000c731
xor eax, eax
jmp 0x14000c738
mov ecx, r12d
mov eax, ebx
shr eax, cl
mov dword [r9], eax
mov rax, rsi
jmp 0x14000c77f
mov ecx, r12d
shr ebx, cl
test ebx, ebx
je 0x14000c677
cmp ebx, 4
ja 0x14000c76b
cmp ebx, 3
je 0x14000c76b
mov eax, ebx
shr eax, 1
mov eax, eax
mov al, byte [rdi + rax + 1]
add al, 1
test al, 0xfe
jne 0x14000c677
mov eax, ebx
shr eax, 1
mov ebx, eax
or ebx, 4
add rsi, 1
jmp 0x14000c62d
xor eax, eax
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret

Function at 0x14000f3c0
Capabilities:
Accept command line arguments

Disassembly:
push rbx
push rsi
sub rsp, 0x148
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rbx, rax
cmp byte [rbx], 0
jne 0x14000f3ef
mov r8d, 0x104
lea rdx, [rsp + 0x2c]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rbx, [rsp + 0x2c]
lea rax, [rsp + 0x130]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x138]
xor r8, r8
xor edx, edx
mov rcx, rbx
call fcn.14000f200
mov rax, qword [rsp + 0x138]
mov rdx, qword [rsp + 0x130]
lea rcx, [rdx + rax*8]
call fcn.14000d7e0
mov rsi, rax
test rsi, rsi
je 0x14000f479
lea rax, [rsp + 0x130]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x138]
lea r8, [rsi + rax*8]
lea r9, [rsp + 0x138]
mov rdx, rsi
mov rcx, rbx
call fcn.14000f200
mov rax, qword [rsp + 0x138]
sub rax, 1
mov dword [0x14001b0b0], eax
mov qword [0x14001b0b8], rsi
jmp 0x14000f483
mov ecx, 0xfffffffc
call fcn.14000f640
add rsp, 0x148
pop rsi
pop rbx
ret
Function at 0x14000f490
Capabilities:
Query environment variable

Disassembly:
push rbx
push rsi
push rdi
push r12
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov rbx, rax
test rax, rax
jne 0x14000f4ae
mov rbx, qword [0x14001b250]
mov rsi, rbx
xor edx, edx
jmp 0x14000f4d6
mov rdi, rsi
or rcx, 0xffffffffffffffff
xor eax, eax
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
lea r12, [rcx + 1]
cmp byte [rsi], 0x3d
je 0x14000f4d3
add rdx, r12
add rsi, r12
cmp byte [rsi], 0
jne 0x14000f4b5
lea rcx, [rdx + 1]
call fcn.14000d7e0
mov r8, rax
mov qword [0x14001b0c8], rax
cmp qword [0x14001b0c8], 0
je 0x14000f557
mov rsi, rbx
jmp 0x14000f53a
mov rdi, rsi
or rcx, 0xffffffffffffffff
xor eax, eax
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
lea r12, [rcx + 1]
cmp byte [rsi], 0x3d
je 0x14000f537
mov rcx, r8
mov rdx, rsi
mov r10, rcx
sub rcx, rdx
mov al, byte [rdx]
mov byte [rcx + rdx], al
add rdx, 1
test al, al
jne 0x14000f524
mov rax, r10
add r8, r12
add rsi, r12
cmp byte [rsi], 0
jne 0x14000f4fd
mov byte [r8], 0
cmp rbx, qword [0x14001b250]
je 0x14000f561
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
jmp 0x14000f561
mov ecx, 0xfffffffc
call fcn.14000f640
add rsp, 0x28
pop r12
pop rdi
pop rsi
pop rbx
ret

Function at 0x14000f570
Capabilities:
Accept command line arguments

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
cmp byte [rax], 0x22
jne 0x14000f598
add rax, 1
cmp byte [rax], 0x22
je 0x14000f592
cmp byte [rax], 0
jne 0x14000f57f
cmp byte [rax], 0x22
jne 0x14000f5a3
add rax, 1
jmp 0x14000f5a3
cmp byte [rax], 0x20
jbe 0x14000f5a3
add rax, 1
jmp 0x14000f598
cmp byte [rax], 0
je 0x14000f5ad
cmp byte [rax], 0x20
jbe 0x14000f592
add rsp, 0x28
ret

Function at 0x14000f640
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x20
lea eax, [ecx + 0x10]
cmp eax, 0xe
ja 0x14000f6eb
sub ecx, 0xfffffff0
mov eax, ecx
lea rdx, [0x1400199c0]
jmp qword [rdx + rax*8]
lea rbx, str.unexpected_error
lea rdx, [0x14001b610]
lea rcx, str.CRT:
call fcn.140010150
lea rdx, [0x14001b610]
mov rcx, rbx
call fcn.140010150
lea rdx, [0x14001b610]
lea rcx, [0x140019a4a]
call fcn.140010150
lea rcx, str.CRT:
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str.____terminating_r_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, 0xff
call sub.KERNEL32.dll_ExitProcess
add rsp, 0x20
pop rbx
ret
Function at 0x140011cb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov rbx, rcx
mov esi, edx
mov rdi, rbx
mov ax, word [rdi + 6]
and ax, 0x7ff0
shr ax, 4
movzx eax, ax
mov r12w, ax
cmp r12w, 0x7ff
je 0x140011df1
test r12w, r12w
je 0x140011e17
movsx eax, r12w
add esi, eax
cmp esi, 0x7ff
jge 0x140011e30
test esi, esi
jg 0x140011e64
mov ax, word [rdi + 6]
mov r13w, ax
and r13w, 0x8000
mov ax, word [rdi + 6]
and ax, 0xf
or ax, 0x10
mov word [rdi + 6], ax
sub esi, 1
cmp esi, 0xffffffcc
jl 0x140011e7e
mov ax, si
jmp 0x140011d56
mov dx, word [rdi + 2]
mov word [rdi], dx
mov dx, word [rdi + 4]
mov word [rdi + 2], dx
mov dx, word [rdi + 6]
mov word [rdi + 4], dx
mov word [rdi + 6], 0
add ax, 0x10
cmp ax, 0xfff0
jle 0x140011d35
mov dx, ax
neg dx
mov ax, dx
test dx, dx
je 0x140011de4
movsx eax, ax
mov edx, eax
neg edx
movzx r8d, word [rdi + 2]
lea ecx, [edx + 0x10]
shl r8d, cl
movzx r9d, word [rdi]
mov ecx, eax
sar r9d, cl
or r8d, r9d
mov cx, r8w
mov word [rdi], cx
movzx r8d, word [rdi + 4]
lea ecx, [edx + 0x10]
shl r8d, cl
movzx r9d, word [rdi + 2]
mov ecx, eax
sar r9d, cl
or r8d, r9d
mov cx, r8w
mov word [rdi + 2], cx
movzx r8d, word [rdi + 6]
lea ecx, [edx + 0x10]
shl r8d, cl
movzx edx, word [rdi + 4]
mov ecx, eax
sar edx, cl
or r8d, edx
mov dx, r8w
mov word [rdi + 4], dx
lea rdx, [rdi + 6]
movzx r8d, word [rdx]
mov ecx, eax
sar r8d, cl
mov ax, r8w
mov word [rdx], ax
or word [rdi + 6], r13w
or eax, 0xffffffff
jmp 0x140011e96
test word [rdi + 6], 0xf
jne 0x140011e0d
cmp word [rdi + 4], 0
jne 0x140011e0d
cmp word [rdi + 2], 0
jne 0x140011e0d
cmp word [rdi], 0
je 0x140011e5d
mov eax, 2
jmp 0x140011e96
mov rcx, rdi
call fcn.140012b60
mov r12w, ax
test ax, ax
jle 0x140011cec
xor eax, eax
jmp 0x140011e96
test word [rdi + 6], 0x8000
je 0x140011e4a
movsd xmm0, qword [0x140019950]
xorpd xmm0, xmmword [0x140019990]
jmp 0x140011e52
movsd xmm0, qword [0x140019950]
movsd qword [rbx], xmm0
mov eax, 1
jmp 0x140011e96
mov eax, 1
jmp 0x140011e96
movzx eax, word [rdi + 6]
and eax, 0xffff800f
movsx edx, si
shl edx, 4
or eax, edx
mov word [rdi + 6], ax
or eax, 0xffffffff
jmp 0x140011e96
mov word [rdi + 6], r13w
mov word [rdi + 4], 0
mov word [rdi + 2], 0
mov word [rdi], 0
xor eax, eax
add rsp, 0x20
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x140012e30
Capabilities:
Delete file

Disassembly:
jmp 0x140013600
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x140013620
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140013380
or eax, 0xffffffff
jmp 0x140013622
xor eax, eax
add rsp, 0x28
ret

Function at 0x140013600
Capabilities:
Delete file

Disassembly:
jmp 0x140013600
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x140013620
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140013380
or eax, 0xffffffff
jmp 0x140013622
xor eax, eax
add rsp, 0x28
ret

Function at 0x140013aa0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rbx, rcx
mov esi, edx
mov edi, r8d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor edx, edx
mov qword [rsp + 0x30], rdx
mov edx, eax
xor ecx, ecx
cmp eax, 0xffffffff
cmove edx, ecx
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], edi
xor r9, r9
mov r8d, 1
mov edx, esi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x140013b80
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
sub rsp, 0x30
mov rbx, rcx
mov rsi, rdx
lea rdx, [0x14001921c]
lea rcx, [0x14001df20]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
test rsi, rsi
je 0x140013bef
mov r8d, 1
xor edx, edx
mov rcx, rsi
call fcn.140013aa0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, 0x400
lea rdx, [0x14001df20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetShortPathNameW]
mov esi, eax
test esi, esi
je 0x140013db3
cmp esi, 0x400
jg 0x140013db3
mov r8d, 0x400
lea rdx, [0x14001d720]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetShortPathNameW]
mov esi, eax
test esi, esi
je 0x140013db3
cmp esi, 0x400
jg 0x140013db3
lea r9, [0x14001d720]
lea r8, [0x14001df20]
lea rdx, str._s_s_r_n
lea rcx, [0x14001d320]
call qword [sym.imp.USER32.dll_wsprintfA]
mov ebx, eax
mov r8d, 0x800
lea rdx, [0x14001d720]
lea rcx, str._WIN_
call qword [sym.imp.pbcore64.dll_EvalVarBuf]
mov r8d, 4
mov edx, 0xc0000000
lea rcx, [0x14001d720]
call fcn.140013aa0
mov rsi, rax
or rax, 0xffffffffffffffff
cmp rsi, rax
je 0x140013db3
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [ebx + edi + 0xa]
mov edx, eax
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov r12, rax
test r12, r12
je 0x140013daa
xor eax, eax
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2c]
mov r8d, edi
mov rdx, r12
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140013daa
cmp edi, dword [rsp + 0x2c]
jne 0x140013daa
lea rdx, str._Rename__r_n
mov rcx, r12
call fcn.140013af0
test rax, rax
je 0x140013d3f
lea rcx, [rax + 0xa]
lea rdx, [0x140019204]
call fcn.140013af0
test rax, rax
je 0x140013d5a
mov edx, edi
lea rcx, [rdx + r12]
add rdx, r12
movsxd r8, ebx
add rdx, r8
cmp rcx, rax
jbe 0x140013d33
nop
nop
nop
mov r8b, byte [rcx]
mov byte [rdx], r8b
sub rcx, 1
sub rdx, 1
cmp rcx, rax
ja 0x140013d20
sub rax, r12
add rax, 1
mov r13d, eax
jmp 0x140013d5d
mov eax, edi
lea rcx, [rax + r12]
lea rdx, str._Rename__r_n
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
add edi, 0xa
mov r13d, edi
jmp 0x140013d5d
mov r13d, edi
mov eax, r13d
lea rcx, [rax + r12]
mov r8d, ebx
lea rdx, [0x14001d320]
call fcn.140013b60
add edi, ebx
xor r9d, r9d
xor r8, r8
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
xor eax, eax
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2c]
mov r8d, edi
mov rdx, r12
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x30
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400140f0
Capabilities:
Query environment variable

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov rbx, rcx
mov rsi, rdx
mov ecx, 0x2000
call fcn.14000d7e0
mov rdi, rax
test rdi, rdi
je 0x1400141cb
mov r8d, 0x1000
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov r12d, eax
test r12d, r12d
je 0x140014178
cmp r12d, 0x1000
ja 0x140014191
mov r13d, 1
jmp 0x140014145
xor r13d, r13d
test r13d, r13d
je 0x140014158
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.pbcore64.dll_SetVar]
jmp 0x140014168
lea rdx, [0x1400191e4]
mov rcx, rsi
call qword [sym.imp.pbcore64.dll_SetVar]
mov rcx, rdi
call fcn.14000dc10
test r13d, r13d
setne al
jmp 0x1400141cd
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xcb
jne 0x140014142
mov rcx, rdi
call fcn.14000dc10
xor al, al
jmp 0x1400141cd
mov eax, r12d
lea rdx, [rax + rax]
mov rcx, rdi
call fcn.14000e0b0
mov rdi, rax
test rdi, rdi
je 0x1400141cb
mov r8d, r12d
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x14001413a
mov rcx, rdi
call fcn.14000dc10
xor al, al
jmp 0x1400141cd
xor al, al
add rsp, 0x20
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret

Function at 0x1400152b0
Capabilities:
Create directory

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x430
mov r8, rcx
lea rdi, [rsp + 0x228]
xor eax, eax
mov ecx, 0x104
rep stosw word [rdi], ax
lea rdi, [rsp + 0x20]
xor eax, eax
mov ecx, 0x104
rep stosw word [rdi], ax
mov edx, 0x104
lea rcx, [rsp + 0x20]
call fcn.14000c9f0
lea rcx, [rsp + 0x20]
call fcn.140015190
mov dx, 0x5c
lea rcx, [rsp + 0x20]
call fcn.14000e3f0
mov rbx, rax
xor esi, esi
test rbx, rbx
je 0x1400153a7
lea rax, [rsp + 0x20]
neg rax
add rax, rbx
sar rax, 1
lea r9, [rax + 1]
lea r8, [rsp + 0x20]
mov edx, 0x104
lea rcx, [rsp + 0x228]
call fcn.14000e410
xor edx, edx
lea rcx, [rsp + 0x228]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140015372
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0xb7
je 0x14001538e
lea rcx, [rbx + 2]
mov dx, 0x5c
call fcn.14000e3f0
mov rbx, rax
jmp 0x14001539e
cmp byte [0x140020e70], 0
je 0x14001538e
lea rdx, [rsp + 0x228]
mov ecx, 1
call qword [sym.imp.pbcore64.dll_AddUninstLog]
lea rcx, [rbx + 2]
mov dx, 0x5c
call fcn.14000e3f0
mov rbx, rax
test rbx, rbx
jne 0x140015313
mov eax, esi
add rsp, 0x430
pop rdi
pop rsi
pop rbx
ret

Function at 0x1400153c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400153dd
test eax, 0x10
je 0x1400153dd
mov eax, 1
jmp 0x1400153df
xor eax, eax
add rsp, 0x28
ret
Function at 0x140007f20
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x140007f5a
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x140007f5f
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140007fa8
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x14000a4a0]
cmp byte [rcx + rax], 0
je 0x140007fa8
dec r8
sub rdx, 1
jne 0x140007f8e
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x140008b88
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140008bd2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140008bd2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140008bd2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140008bd2
cmp dword [rcx + 0x84], 0xe
jbe 0x140008bd2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140008bd4
xor al, al
add rsp, 0x28
ret
Function at 0x14000afc0
Capabilities:
Check if file exists
Delete file
Get file attributes
Terminate process

Disassembly:
sub rsp, 0x68
mov rcx, qword [0x14002fdd8]
test rcx, rcx
je 0x14000affb
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14000afee
mov rcx, qword [0x14002fdd8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [0x14002fdd8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x14002fde8], 0
je 0x14000b0ee
mov qword [rsp + 0x70], rbx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x78], rbp
lea rbp, [0x1400298d8]
mov qword [rsp + 0x80], rsi
lea rsi, [0x140032610]
mov qword [rsp + 0x88], rdi
xor edi, edi
mov qword [rsp + 0x60], r14
mov r14d, 0x414
mov word [rsp + 0x40], r14w
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rbp
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ebx, edi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000b0cf
test al, 0x10
je 0x14000b0cf
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbp
mov word [rsp + 0x40], r14w
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rbp
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
inc ebx
cmp ebx, 0x14
jl 0x14000b075
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov r14, qword [rsp + 0x60]
add rsp, 0x68
ret
Function at 0x140028db0
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
add rsp, 0xffffffffffffffe0
mov rax, qword [rcx]
mov rbx, r9
mov edi, r8d
mov r14, rdx
mov rsi, rcx
call qword [rax + 0x68]
mov r10d, dword [rbx]
mov rbp, rax
mov rdx, qword [rsp + 0x60]
xor r10d, 0x5d9f74cd
mov dword [rax + 0x10], r10d
mov r9d, dword [rbx + 4]
xor r9d, 0x5d9f74cd
mov dword [rax + 0x14], r9d
mov ecx, dword [rdx]
xor ecx, 0x5d9f74cd
mov dword [rax + 0x18], ecx
mov ecx, dword [rdx + 4]
xor ecx, 0x5d9f74cd
mov dword [rax + 0x1c], ecx
mov dword [rax + 0x20], edi
mov rcx, qword [0x1404ecbd8]
call fcn.14002c620
mov rbx, rax
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 0x48]
lock inc dword [rbx + 0x10]
je 0x140028e50
cmp rdi, qword [rbx]
je 0x140028ec8
mov rcx, qword [rbx + 8]
xor r8d, r8d
xor edx, edx
call fcn.140095540
mov qword [rbx], rdi
mov dword [rbx + 0x14], 0x156b78ef
xor dword [rbx + 0x14], 0x122bbcd9
add dword [rbx + 0x14], 0x6933aabe
xor dword [rbx + 0x14], 0x70746ef5
lea rcx, [rbp + 0x28]
mov rdx, r14
call fcn.14006d170
mov rcx, qword [rbp + 8]
call fcn.14002f530
xor r14d, r14d
sub dword [rbx + 0x14], 1
jne 0x140028ed0
mov qword [rbx], r14
mov eax, 0x3b660e26
sub eax, 0xec8d92d
xor eax, 0x7a771ac0
add eax, 0xa915d1c6
lock xadd dword [rbx + 0x10], eax
dec eax
cmp eax, 0xffffffff
je 0x140028ed4
mov rcx, qword [rbx + 8]
xor edx, edx
call fcn.1400954e0
jmp 0x140028ed4
inc dword [rbx + 0x14]
jmp 0x140028e6f
lock dec dword [rbx + 0x10]
cmp qword [rsi + 0x838], r14
jne 0x140028f73
mov qword [rsi + 0x838], rbp
lea rax, [rsi + 0x5a8]
mov byte [rbp + 0x68], 0x2d
sub byte [rbp + 0x68], 0x10
xor byte [rbp + 0x68], 0x1c
mov rbx, rax
mov rdi, qword [rax + 0x280]
test rdi, rdi
cmove rbx, r14
je 0x140028f1e
shl rdi, 7
add rdi, rax
jmp 0x140028f21
mov rdi, r14
cmp rbx, rdi
je 0x140028f6b
nop dword [rax]
mov rax, qword [rbx + 0x78]
cmp rax, 0x78
jbe 0x140028f47
mov rcx, qword [rbx]
jmp 0x140028f51
test rax, rax
mov rcx, r14
cmovne rcx, rbx
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + 8]
nop
add rbx, 0x80
cmp rbx, rdi
jne 0x140028f31
mov rcx, rsi
call fcn.14002f530
lea rcx, [rsi + 0x840]
mov qword [rsp + 0x60], rbp
lea rdx, [rsp + 0x60]
call fcn.140028760
mov rbx, qword [rsp + 0x40]
mov rax, rbp
mov rbp, qword [rsp + 0x48]
neg rsp
add rsp, 0xffffffffffffffe0
neg rsp
pop r14
pop rdi
pop rsi
ret
Function at 0x1400392d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
nop
sub rsp, 0xd766d84
add rsp, 0xd766d24
mov rbp, qword [rcx + 0xaf8]
lea rax, [rsp + 0x28]
mov rbx, qword [rcx + 0xac0]
xorps xmm0, xmm0
mov r14, rdx
mov qword [rsp + 0x20], rax
mov rsi, rcx
lea rcx, [rsp + 0x20]
lea rdx, [rbp + 1]
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
call fcn.140011430
mov edi, 0x2cfab8aa
sub edi, 0x2bfc2a86
xor edi, 0x70b62d76
xor edi, 0x472ab059
mov r9, rax
mov ecx, edi
mov r15d, 0x3caf1e14
add r15d, 0x2e760e6b
sub r15d, 0x6b252b80
test rbp, rbp
je 0x1400393a0
mov rdx, rax
sub rbx, rax
mov r8, rbp
nop dword [rax]
nop dword [rax + rax]
movzx eax, cx
lea rdx, [rdx + 2]
and ax, r15w
ror ecx, 8
xor ax, word [rdx + rbx - 2]
mov word [rdx - 2], ax
sub r8, 1
jne 0x14003937f
xor ebx, ebx
mov word [r9 + rbp*2], bx
cmp word [rsi + 0xb48], bx
je 0x1400393f0
mov r8d, ebx
cmp qword [rsi + 0xaf8], rbx
jbe 0x1400393f0
mov edx, ebx
nop dword [rax + rax]
mov rax, qword [rsp + 0x20]
lea rdx, [rdx + 2]
movzx ecx, word [rsi + 0xb48]
inc r8
mov word [rdx + rax - 2], cx
cmp r8, qword [rsi + 0xaf8]
jb 0x1400393cb
mov rsi, qword [rsp + 0x20]
lea rax, [r14 + 8]
xorps xmm0, xmm0
mov qword [r14], rax
movups xmmword [rax], xmm0
nop
movabs rdx, 0xffffffff01fe1d7f
add rdx, 0x19c598e8
add rdx, 0x7fffffff
add rdx, 0x643c4999
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
inc rdx
cmp word [rsi + rdx*2], bx
jne 0x14003942a
mov rcx, r14
mov qword [r14 + 0x38], rdx
call fcn.140011430
cmp qword [r14 + 0x38], rbx
jbe 0x140039474
sub rsi, rax
movzx ecx, di
lea rax, [rax + 2]
and cx, r15w
ror edi, 8
xor cx, word [rax + rsi - 2]
inc rbx
mov word [rax - 2], cx
cmp rbx, qword [r14 + 0x38]
jb 0x140039450
mov rcx, qword [rsp + 0x20]
lea rax, [rsp + 0x28]
cmp rcx, rax
jne 0x1400394a6
lea rdi, [rsp + 0x28]
xor eax, eax
mov ecx, 0x5c6ef661
xor ecx, 0x6481ddee
sub ecx, 0x38ef2b5f
rep stosb byte [rdi], al
jmp 0x1400394ab
call fcn.1400c1b60
lea r11, [rsp + 0x60]
mov rax, r14
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret