joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140010910
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov ebx, r8d
mov esi, edx
mov rdi, rcx
mov rax, qword [0x14017e028]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp byte [rcx + 8], 0
je 0x14001093f
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x140010942
mov rcx, qword [rdi]
mov edx, esi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x140010990
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [rdi + 8], 0
je 0x140010965
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x140010968
mov rcx, qword [rdi]
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14001099f
xor esi, esi
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14008fec0
mov eax, esi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
test bl, bl
je 0x1400109e4
cmp byte [rdi + 8], 0
jne 0x1400109d0
mov rcx, qword [rdi]
jmp 0x1400109d9
mov dword [rsp + 0x24], 0xaaaaaaaa
cmp byte [rdi + 8], 0
jne 0x1400109b2
mov rcx, qword [rdi]
jmp 0x1400109bb
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x1400109e4
mov esi, dword [rsp + 0x24]
jmp 0x1400109e4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
mov edx, esi
int3
Function at 0x140032d70
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x250
mov rax, qword [0x14017e028]
xor rax, rsp
mov qword [rsp + 0x248], rax
mov sil, 1
cmp qword [0x140184508], 0
jne 0x140032fa4
mov rcx, qword [0x140184500]
test rcx, rcx
je 0x140032e6f
test byte [0x14017fe98], 1
je 0x140032fa4
cmp byte [rcx + 0x17], 0
jns 0x140032dc7
mov rcx, qword [rcx]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov edx, 4
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x140184508], rax
inc rax
cmp rax, 1
ja 0x140032fa4
lea rdi, [rsp + 0x40]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.1400924f0
mov word [rdi], 0
mov ecx, 0x104
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x140032fa2
cmp eax, 0x104
ja 0x140032fa2
mov rcx, qword [0x140184500]
lea rdx, [rsp + 0x40]
int3
movabs r14, 0x7fffffffffffffef
mov ecx, 0x18
int3
xor esi, esi
mov rcx, qword [rsp + 0x248]
xor rcx, rsp
call fcn.14008fec0
mov eax, esi
add rsp, 0x250
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140036f40
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x138
movapd xmmword [rsp + 0x120], xmm10
movapd xmmword [rsp + 0x110], xmm9
movaps xmmword [rsp + 0x100], xmm8
movaps xmmword [rsp + 0xf0], xmm7
movaps xmmword [rsp + 0xe0], xmm6
mov rsi, rcx
mov rax, qword [0x14017e028]
xor rax, rsp
mov qword [rsp + 0xd8], rax
movabs r13, 0xaaaaaaaaaaaaaaaa
test byte [0x14017ff80], 0x19
jne 0x14003772c
mov rcx, qword [rsi + 0x60]
test rcx, rcx
jne 0x140037bb6
mov rcx, qword [rsi + 0x48]
mov rdx, rsi
int3
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edi, eax
mov qword [rsp + 0x90], r13
mov rax, qword [0x140181438]
lea r14, [0x140033180]
cmp rax, r14
jne 0x140037ac1
lea rbx, [rsp + 0xb0]
mov qword [rbx], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbx]
movabs rcx, 0x8637bd05af7
cmp rax, rcx
jge 0x140037871
imul rax, rax, 0xf4240
cqo
idiv qword [0x140184658]
jmp 0x140037893
mov rcx, qword [0x140184658]
cqo
idiv rcx
imul rbp, rax, 0xf4240
imul rax, rdx, 0xf4240
cqo
idiv rcx
add rax, rbp
mov qword [rsp + 0x90], rax
lea rbp, [rsp + 0x90]
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x30], edi
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x48], 8
mov qword [rsp + 0x40], 0
lea rdx, [0x14017ff80]
lea r8, str.WorkerThread_born
mov cl, 0x49
xor r9d, r9d
call fcn.14003a4d0
test byte [0x14017ff80], 0x19
je 0x140036fac
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edi, eax
mov qword [rsp + 0x90], r13
mov rax, qword [0x140181438]
cmp rax, r14
jne 0x140037ad0
lea rbx, [rsp + 0xb0]
mov qword [rbx], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbx]
movabs rcx, 0x8637bd05af7
cmp rax, rcx
jge 0x140037946
imul rax, rax, 0xf4240
cqo
idiv qword [0x140184658]
jmp 0x140037968
mov rcx, qword [0x140184658]
cqo
idiv rcx
imul rbx, rax, 0xf4240
imul rax, rdx, 0xf4240
cqo
idiv rcx
add rax, rbx
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x30], edi
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
lea rdx, [0x14017ff80]
lea r8, str.WorkerThread_active
mov cl, 0x42
xor r9d, r9d
call fcn.14003a4d0
jmp 0x140036fac
lea rcx, [rsp + 0x90]
call rax
jmp 0x14003789b
lea rcx, [rsp + 0x90]
call rax
jmp 0x140037970
mov rax, qword [rcx]
call qword [rax + 8]
jmp 0x140036fb9
Function at 0x140041f90
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rdi, qword [0x1401882e8]
cmp rdi, 1
jbe 0x140041fed
mov ecx, dword [0x1401814d8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140041fd6
movsxd rcx, dword [rdi]
shl rcx, 4
mov qword [rax + rcx], 0
mov ecx, dword [rdi + 4]
movsxd rdx, dword [rdi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov rcx, qword [rsi]
test rcx, rcx
je 0x140041fe5
lock sub dword [rcx + 8], 1
je 0x140042042
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x1401882e8]
int3
add rcx, 8
add rcx, 0xfffffffffffffff8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.140042060

Function at 0x140042430
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov qword [rcx], rdx
test rdx, rdx
je 0x140042446
lock inc dword [rdx + 8]
mov qword [rsi + 8], rdx
mov rdi, qword [0x1401882e8]
cmp rdi, 1
jbe 0x1400424d5
lea rbx, [rsi + 8]
mov ecx, dword [0x1401814d8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14004256b
movsxd rcx, dword [rdi]
shl rcx, 4
mov qword [rax + rcx], rbx
mov ecx, dword [rdi + 4]
movsxd rdx, dword [rdi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov rdi, qword [0x140188278]
cmp rdi, 1
jbe 0x140042522
mov ecx, dword [0x1401814d8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14004257e
movsxd rcx, dword [rdi]
shl rcx, 4
mov qword [rax + rcx], rsi
mov ecx, dword [rdi + 4]
movsxd rdx, dword [rdi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x1401882e8]
int3
lea rcx, [0x140188278]
int3
test rbx, rbx
je 0x14004248a
call fcn.1400074b0
jmp 0x140042471
test rsi, rsi
je 0x1400424ca
call fcn.1400074b0
jmp 0x1400424b1

Function at 0x140043210
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov eax, dword [0x140189db8]
mov ecx, dword [0x140181920]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140043272
mov ecx, dword [0x1401814d8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400432ae
movsxd rcx, dword [0x140189db0]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [0x140189db4]
jne 0x1400432ae
mov rax, qword [rax + rcx]
mov qword [rsi], rax
mov rax, rsi
add rsp, 0x20
pop rsi
ret
lea rcx, [0x140189db8]
int3
xor eax, eax
jmp 0x140043266
Function at 0x14004a450
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
sub rsp, 0x130
mov rax, qword [0x14017e028]
xor rax, rsp
mov qword [rsp + 0x128], rax
mov r9, qword [rcx + 8]
mov rsi, 0xffffffffffffffff
cmp r9, r8
jbe 0x14004a58e
mov r11, qword [rdx + 8]
cmp r11, 1
je 0x14004a5bb
test r11, r11
je 0x14004a58b
xorps xmm0, xmm0
movaps xmmword [rsp + 0x110], xmm0
movaps xmmword [rsp + 0x100], xmm0
movaps xmmword [rsp + 0xf0], xmm0
movaps xmmword [rsp + 0xe0], xmm0
movaps xmmword [rsp + 0xd0], xmm0
movaps xmmword [rsp + 0xc0], xmm0
movaps xmmword [rsp + 0xb0], xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
mov rdx, qword [rdx]
lea rsi, [r11 - 1]
mov r10d, r11d
and r10d, 3
cmp rsi, 3
jae 0x14004a51e
xor esi, esi
jmp 0x14004a560
and r11, 0xfffffffffffffffc
xor esi, esi
nop word cs:[rax + rax]
nop
movzx eax, byte [rdx + rsi]
mov byte [rsp + rax + 0x20], 1
movzx eax, byte [rdx + rsi + 1]
mov byte [rsp + rax + 0x20], 1
movzx eax, byte [rdx + rsi + 2]
mov byte [rsp + rax + 0x20], 1
movzx eax, byte [rdx + rsi + 3]
mov byte [rsp + rax + 0x20], 1
add rsi, 4
cmp r11, rsi
jne 0x14004a530
test r10, r10
je 0x14004a57c
add rdx, rsi
xor eax, eax
movzx esi, byte [rdx + rax]
mov byte [rsp + rsi + 0x20], 1
add rax, 1
cmp r10, rax
jne 0x14004a56a
mov rax, qword [rcx]
movzx ecx, byte [rax + r8]
cmp byte [rsp + rcx + 0x20], 0
jne 0x14004a5aa
mov rsi, r8
mov rcx, qword [rsp + 0x128]
xor rcx, rsp
call fcn.14008fec0
mov rax, rsi
add rsp, 0x130
pop rsi
ret
inc r8
cmp r9, r8
jne 0x14004a57f
mov r8, 0xffffffffffffffff
jmp 0x14004a58b
mov rax, qword [rdx]
mov al, byte [rax]
mov rcx, qword [rcx]
cmp byte [rcx + r8], al
jne 0x14004a58b
inc r8
cmp r9, r8
jne 0x14004a5c3
jmp 0x14004a58e
Function at 0x14004a5e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x128
mov rax, qword [0x14017e028]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov r14, qword [rcx + 8]
test r14, r14
je 0x14004a741
add r14, 0xffffffffffffffff
cmp r14, r8
jae 0x14004a7a3
mov rsi, qword [rdx + 8]
cmp rsi, 1
je 0x14004a74a
test rsi, rsi
je 0x14004a721
xorps xmm0, xmm0
movaps xmmword [rsp + 0x110], xmm0
movaps xmmword [rsp + 0x100], xmm0
movaps xmmword [rsp + 0xf0], xmm0
movaps xmmword [rsp + 0xe0], xmm0
movaps xmmword [rsp + 0xd0], xmm0
movaps xmmword [rsp + 0xc0], xmm0
movaps xmmword [rsp + 0xb0], xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
mov rax, qword [rdx]
lea rdi, [rsi - 1]
mov edx, esi
and edx, 3
cmp rdi, 3
jae 0x14004a6b6
xor edi, edi
jmp 0x14004a6f0
and rsi, 0xfffffffffffffffc
xor edi, edi
nop dword [rax]
movzx ebx, byte [rax + rdi]
mov byte [rsp + rbx + 0x20], 1
movzx ebx, byte [rax + rdi + 1]
mov byte [rsp + rbx + 0x20], 1
movzx ebx, byte [rax + rdi + 2]
mov byte [rsp + rbx + 0x20], 1
movzx ebx, byte [rax + rdi + 3]
mov byte [rsp + rbx + 0x20], 1
add rdi, 4
cmp rsi, rdi
jne 0x14004a6c0
test rdx, rdx
je 0x14004a70c
add rax, rdi
xor edi, edi
movzx esi, byte [rax + rdi]
mov byte [rsp + rsi + 0x20], 1
add rdi, 1
cmp rdx, rdi
jne 0x14004a6fa
mov rcx, qword [rcx]
movzx eax, byte [rcx + r14]
cmp byte [rsp + rax + 0x20], 0
jne 0x14004a77c
mov rax, r14
mov r14, rax
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.14008fec0
mov rax, r14
add rsp, 0x128
pop rbx
pop rdi
pop rsi
pop r14
ret
mov r14, 0xffffffffffffffff
jmp 0x14004a721
mov rax, qword [rdx]
mov al, byte [rax]
mov rdi, qword [rcx]
inc r14
mov rdx, r14
mov cl, byte [rdi + rdx - 1]
lea r14, [rdx - 1]
cmp cl, al
jne 0x14004a76d
cmp rdx, 1
mov rdx, r14
jne 0x14004a758
cmp cl, al
mov rax, 0xffffffffffffffff
cmove r14, rax
jmp 0x14004a721
mov rax, r14
sub rax, 1
jb 0x14004a797
movzx edx, byte [rcx + r14 - 1]
cmp byte [rsp + rdx + 0x20], 0
mov r14, rax
je 0x14004a71e
jmp 0x14004a77f
mov rax, 0xffffffffffffffff
jmp 0x14004a71e
mov r14, r8
jmp 0x14004a618
Function at 0x14004b3e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov r15, rdx
mov rax, qword [0x14017e028]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rsi, qword [rcx]
mov rdi, qword [rcx + 8]
lea r13, [rsi + rdi]
mov r14b, 1
mov rcx, rsi
test rdi, rdi
jne 0x14004b4a1
xor edx, edx
cmp rcx, r13
jne 0x14004b451
xor eax, eax
and r14b, dl
mov dword [r15], eax
test r14b, r14b
setne bl
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14008fec0
mov eax, ebx
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
sub rdi, rcx
add rsi, rdi
xor edx, edx
xor eax, eax
movzx ebx, byte [rcx + rdx]
add bl, 0xd0
cmp bl, 9
ja 0x14004b4cf
test rdx, rdx
je 0x14004b48d
cmp eax, 0xccccccc
jg 0x14004b4d6
cmp bl, 7
seta bpl
cmp eax, 0xccccccc
je 0x14004b483
xor ebp, ebp
test bpl, bpl
jne 0x14004b4d6
add eax, eax
lea eax, [rax + rax*4]
mov ebp, eax
movzx eax, bl
add eax, ebp
add rdx, 1
cmp rsi, rdx
jne 0x14004b45b
mov dl, 1
jmp 0x14004b425
mov bpl, byte [rsi]
movzx ecx, bpl
call fcn.14008d710
mov r14b, 1
mov r12, rsi
test eax, eax
jne 0x14004b4e2
cmp bpl, 0x2d
je 0x14004b51c
lea rcx, [r12 + 1]
cmp bpl, 0x2b
cmovne rcx, r12
jmp 0x14004b41c
xor edx, edx
jmp 0x14004b425
xor edx, edx
mov eax, 0x7fffffff
jmp 0x14004b425
lea rbx, [rdi - 1]
mov r12, rsi
xor r14d, r14d
mov edx, 0
mov eax, 0
test rbx, rbx
je 0x14004b425
mov bpl, byte [r12 + 1]
inc r12
movzx ecx, bpl
call fcn.14008d710
dec rbx
xor r14d, r14d
test eax, eax
je 0x14004b4b7
jmp 0x14004b4e9
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x28]
mov qword [rsi], rax
inc r12
mov rcx, rsi
mov rdx, r12
mov r8, r13
call fcn.140111a10
and byte [rsi + 4], r14b
mov rax, qword [rsi]
mov r14, rax
shr r14, 0x20
jmp 0x14004b428
Function at 0x140050b60
Capabilities:
Get thread local storage value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rsi, rcx
mov rax, qword [0x14017e028]
xor rax, rsp
mov qword [rsp + 0x30], rax
cmp byte [rcx + 0x18], 0
je 0x140050c21
mov eax, dword [0x14018a348]
mov ecx, dword [0x140181920]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140050c85
mov ecx, dword [0x1401814d8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, dword [0x14018a348]
mov ecx, dword [0x140181920]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140050cc8
mov ecx, dword [0x1401814d8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140050c15
movsxd rcx, dword [0x14018a340]
shl rcx, 4
mov qword [rax + rcx], 0
mov ecx, dword [0x14018a344]
movsxd rdx, dword [0x14018a340]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov rbx, qword [rsi]
mov rdi, qword [rsi + 8]
cmp rbx, rdi
jne 0x140050c3f
cmp qword [rsi], 0
jne 0x140050c73
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14008fec0
nop
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
lea r14, [rsp + 0x28]
mov r9, qword [rbx + 0x30]
mov rcx, qword [rbx]
mov rax, qword [rbx + 0x28]
mov qword [rsp + 0x28], rax
mov qword [rbx + 0x28], 0
mov rax, qword [rcx]
lea rdx, [rbx + 8]
mov r8, r14
call qword [rax]
add rbx, 0x38
cmp rbx, rdi
je 0x140050c21
jmp 0x140050c44
mov rcx, rsi
int3
lea rcx, [0x14018a348]
int3
lea rcx, [0x14018a348]
int3

Function at 0x140053200
Capabilities:
Accept command line arguments

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
movaps xmmword [rsp + 0x70], xmm6
mov rsi, rdx
mov rbx, rcx
mov rax, qword [0x14017e028]
xor rax, rsp
mov qword [rsp + 0x68], rax
movups xmm0, xmmword [rdx]
lea rdx, [rsp + 0x50]
movaps xmmword [rdx], xmm0
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r8d, 3
call fcn.140054060
movups xmm0, xmmword [rdi]
movups xmmword [rsi], xmm0
cmp qword [rsi + 8], 0
je 0x140053425
movups xmm0, xmmword [rsi]
mov qword [rsp + 0x28], rbx
movups xmmword [rbx], xmm0
mov dword [rsp + 0x4c], 0
lea rcx, str.api_ms_win_downlevel_shell32_l1_1_0.dll
xor edx, edx
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test rax, rax
mov qword [rsp + 0x20], rax
je 0x14005345b
lea rdx, [0x14015f8ba]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14005346e
mov rbx, rax
mov rcx, qword [rsi]
lea rdx, [rsp + 0x4c]
call rax
mov r12, rax
movsxd rbp, dword [rsp + 0x4c]
xorps xmm6, xmm6
movaps xmmword [rsp + 0x30], xmm6
mov qword [rsp + 0x40], 0
test rbp, rbp
je 0x140053476
test ebp, ebp
js 0x14005347d
shl rbp, 3
lea rsi, [rbp*2]
add rsi, rbp
mov rcx, rsi
int3
lea rdx, [rsp + 0x30]
mov rsi, qword [rsp + 0x28]
mov rcx, rsi
int3
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14008fec0
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsi]
lea rdx, [rsp + 0x4c]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
jmp 0x1400532b8
xor r12d, r12d
jmp 0x1400532bb
xor ebx, ebx
jmp 0x1400533bc
lea rcx, [rsp + 0x30]
int3
Function at 0x140063e60
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x140063ed8
cmp r8, 4
jae 0x140063e88
xor r9d, r9d
xor eax, eax
mov r10b, byte [rdx + r9]
xor r10b, byte [rcx + r9]
movzx r10d, r10b
or eax, r10d
inc r9
cmp r8, r9
jne 0x140063e70
ret
mov r9, r8
and r9, 0xfffffffffffffffc
pxor xmm0, xmm0
xor r10d, r10d
pxor xmm1, xmm1
mov eax, dword [rdx + r10]
xor eax, dword [rcx + r10]
movd xmm2, eax
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
por xmm1, xmm2
add r10, 4
cmp r9, r10
jne 0x140063e9a
pshufd xmm0, xmm1, 0xee
por xmm0, xmm1
pshufd xmm1, xmm0, 0x55
por xmm1, xmm0
movd eax, xmm1
cmp r9, r8
jne 0x140063e70
jmp 0x140063e87
xor eax, eax
ret

Function at 0x140064ae0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x1401814d8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140064b14
movsxd rcx, dword [rsi]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [rsi + 4]
jne 0x140064b14
mov rax, qword [rax + rcx]
add rsp, 0x20
pop rsi
ret
xor eax, eax
jmp 0x140064b0e

Function at 0x140069e80
Capabilities:
Hash data using sha256

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov r15, rdx
mov rsi, rcx
cmp qword [rcx], rdx
je 0x140069eee
mov r12d, dword [r15 + 0x2c]
lea r14, [r12 + 8]
mov rdi, qword [0x140181548]
mov rcx, rdi
mov rdx, r14
xor r8d, r8d
call qword [rdi]
mov rbx, rax
test rax, rax
jne 0x140069ec8
cmp byte [0x140184548], 0
jne 0x140069f7c
test rbx, rbx
je 0x140069f8c
mov qword [rbx], r12
add rbx, 8
je 0x140069f8c
mov rdi, qword [rsi + 8]
test rdi, rdi
jne 0x140069f4a
mov qword [rsi + 8], rbx
mov qword [rsi], r15
mov rax, qword [r15 + 0x10]
lea rcx, [0x14014b310]
cmp rax, rcx
jne 0x140069f75
mov rax, qword [rsi + 8]
xorps xmm0, xmm0
movups xmmword [rax + 0x5c], xmm0
movups xmmword [rax + 0x50], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x20], xmm0
movaps xmm0, xmmword [0x140167aa0]
movups xmmword [rax], xmm0
movaps xmm0, xmmword [0x140167ab0]
movups xmmword [rax + 0x10], xmm0
mov dword [rax + 0x6c], 0x20
mov esi, 1
mov eax, esi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov r8, qword [rdi - 8]
add rdi, 0xfffffffffffffff8
add r8, 8
mov rcx, rdi
xor edx, edx
call fcn.1400924f0
mov rcx, qword [0x140181548]
mov rdx, rdi
xor r8d, r8d
call qword [rcx + 0x28]
jmp 0x140069ee7
mov rcx, rsi
call rax
jmp 0x140069f35
mov rcx, r14
int3
mov dword [rsp + 0x20], 0xc4
lea r9, str..._.._third_party_boringssl_src_crypto_fipsmodule_digest_digest.c
xor esi, esi
mov ecx, 0x1d
xor edx, edx
mov r8d, 0x41
int3
Function at 0x14006bfd0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
cmp rdx, r9
mov r10, r9
cmovb r10, rdx
xor eax, eax
test r10, r10
je 0x14006c03e
xor r11d, r11d
mov r14, qword [r8 + r11*8]
mov r15, qword [rcx + r11*8]
mov rbx, r15
xor rbx, r14
mov edi, eax
lea rax, [rbx - 1]
mov rsi, r15
sub rsi, r14
xor rsi, r15
or rsi, rbx
not rbx
and rax, rbx
sar rax, 0x3f
xor rsi, r15
sar rsi, 0x3f
mov rbx, rsi
not rsi
and esi, 1
or rsi, rbx
mov rbx, rax
and edi, ebx
not rax
and rax, rsi
or rax, rdi
inc r11
cmp r10, r11
jne 0x14006bfeb
cmp rdx, r9
jb 0x14006c077
cmp r9, rdx
jae 0x14006c0a1
xor esi, esi
or rsi, qword [rcx + r9*8]
inc r9
cmp rdx, r9
jne 0x14006c04a
mov rcx, rsi
not rcx
dec rsi
and rsi, rcx
sar rsi, 0x3f
mov rcx, rsi
and ecx, eax
not rsi
and esi, 1
or esi, ecx
mov eax, esi
jmp 0x14006c0a1
xor ecx, ecx
or rcx, qword [r8 + rdx*8]
inc rdx
cmp r9, rdx
jne 0x14006c079
mov rdx, rcx
not rdx
dec rcx
and rcx, rdx
sar rcx, 0x3f
mov rdx, rcx
and edx, eax
not rcx
or ecx, edx
mov eax, ecx
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140086fc0
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
cmp qword [rcx], rdx
je 0x14008700d
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rdi]
add rax, 1
cmp rax, 2
jae 0x140087018
lea rax, [rsi + 1]
cmp rax, 2
jb 0x140086ffb
mov qword [rdi], rsi
call fcn.140041560
mov ecx, ebx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp qword [sym.imp.KERNEL32.dll_SetLastError]
nop
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.140041560
mov r14, qword [rdi]
mov rcx, qword [0x140184a28]
test rcx, rcx
je 0x14008703d
mov rax, qword [rcx]
mov rdx, r14
call qword [rax]
mov qword [rdi], 0
jmp 0x140086fe9
int3

Function at 0x140088090
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
sub rsp, 0x128
mov rax, qword [0x14017e028]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov r10, qword [rcx + 8]
mov rdi, 0xffffffffffffffff
test r10, r10
je 0x1400880ec
mov rsi, qword [rdx + 8]
cmp rsi, 1
jne 0x140088109
sub r10, r8
jbe 0x1400880ec
mov rdx, qword [rdx]
movsx edx, byte [rdx]
mov rsi, qword [rcx]
add r8, rsi
mov rcx, r8
mov r8, r10
call fcn.140091cc0
test rax, rax
je 0x1400880ec
sub rax, rsi
mov rdi, rax
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.14008fec0
mov rax, rdi
add rsp, 0x128
pop rdi
pop rsi
ret
test rsi, rsi
je 0x1400880ec
xorps xmm0, xmm0
movaps xmmword [rsp + 0x110], xmm0
movaps xmmword [rsp + 0x100], xmm0
movaps xmmword [rsp + 0xf0], xmm0
movaps xmmword [rsp + 0xe0], xmm0
movaps xmmword [rsp + 0xd0], xmm0
movaps xmmword [rsp + 0xc0], xmm0
movaps xmmword [rsp + 0xb0], xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
mov rdx, qword [rdx]
lea rdi, [rsi - 1]
mov r9d, esi
and r9d, 3
cmp rdi, 3
jae 0x140088197
xor edi, edi
jmp 0x1400881d0
and rsi, 0xfffffffffffffffc
xor edi, edi
nop dword [rax]
movzx eax, byte [rdx + rdi]
mov byte [rsp + rax + 0x20], 1
movzx eax, byte [rdx + rdi + 1]
mov byte [rsp + rax + 0x20], 1
movzx eax, byte [rdx + rdi + 2]
mov byte [rsp + rax + 0x20], 1
movzx eax, byte [rdx + rdi + 3]
mov byte [rsp + rax + 0x20], 1
add rdi, 4
cmp rsi, rdi
jne 0x1400881a0
test r9, r9
je 0x1400881ec
add rdx, rdi
xor edi, edi
movzx esi, byte [rdx + rdi]
mov byte [rsp + rsi + 0x20], 1
add rdi, 1
cmp r9, rdi
jne 0x1400881da
mov rdi, 0xffffffffffffffff
cmp r10, r8
jbe 0x1400880ec
mov rcx, qword [rcx]
nop
movzx eax, byte [rcx + r8]
cmp byte [rsp + rax + 0x20], 0
jne 0x14008821a
add r8, 1
cmp r10, r8
jne 0x140088200
jmp 0x1400880ec
mov rdi, r8
jmp 0x1400880ec