joyce8/EMBER2024-capa huggingface dataset:
Function at 0x61ca0080
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbx
sub rsp, 0x30
mov ebx, dword [rsp + 0x80]
mov r13, rdx
mov r12, rcx
mov rdx, r8
mov r15, r8
mov rcx, r13
mov r14, r9
call fcn.61ca6f10
test al, al
jne 0x61ca00d5
mov r8d, 0xb1
lea rdx, str.src_Cairo.cpp
lea rcx, str.pos1___pos2__pos1___pos3
add rsp, 0x30
pop rbx
pop r12
pop r13
pop r14
pop r15
jmp fcn.61c87360
mov rdx, r14
mov rcx, r13
call fcn.61ca6f10
test al, al
je 0x61ca00af
mov rcx, r13
call fcn.61ca6ec0
mov rcx, r13
cvtsi2sd xmm2, dword [rax]
movsd qword [rsp + 0x28], xmm2
call fcn.61ca6eb0
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
cvtsi2sd xmm1, dword [rax]
call fcn.61d13aa0
mov rcx, r15
call fcn.61ca6ec0
mov rcx, r15
cvtsi2sd xmm2, dword [rax]
movsd qword [rsp + 0x28], xmm2
call fcn.61ca6eb0
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
cvtsi2sd xmm1, dword [rax]
call fcn.61d12430
mov rcx, r14
call fcn.61ca6ec0
mov rcx, r14
cvtsi2sd xmm2, dword [rax]
movsd qword [rsp + 0x28], xmm2
call fcn.61ca6eb0
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
cvtsi2sd xmm1, dword [rax]
call fcn.61d12430
mov rcx, r13
call fcn.61ca6ec0
mov rcx, r13
cvtsi2sd xmm2, dword [rax]
movsd qword [rsp + 0x28], xmm2
call fcn.61ca6eb0
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
cvtsi2sd xmm1, dword [rax]
call fcn.61d12430
mov rcx, r12
test bl, bl
je 0x61ca01ad
add rsp, 0x30
pop rbx
pop r12
pop r13
pop r14
pop r15
jmp fcn.61d17460
add rsp, 0x30
pop rbx
pop r12
pop r13
pop r14
pop r15
jmp fcn.61d10e70

Function at 0x61ca01c0
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbx
sub rsp, 0x30
mov ebx, dword [rsp + 0x80]
mov r13, rdx
mov r12, rcx
mov rdx, r8
mov r15, r8
mov rcx, r13
mov r14, r9
call fcn.61ca6f90
test al, al
jne 0x61ca0215
mov r8d, 0xb1
lea rdx, str.src_Cairo.cpp
lea rcx, str.pos1___pos2__pos1___pos3
add rsp, 0x30
pop rbx
pop r12
pop r13
pop r14
pop r15
jmp fcn.61c87360
mov rdx, r14
mov rcx, r13
call fcn.61ca6f90
test al, al
je 0x61ca01ef
mov rcx, r13
call fcn.61ca6f40
mov rcx, r13
mov eax, dword [rax]
cvtsi2sd xmm2, rax
movsd qword [rsp + 0x28], xmm2
call fcn.61ca6f30
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
mov eax, dword [rax]
cvtsi2sd xmm1, rax
call fcn.61d13aa0
mov rcx, r15
call fcn.61ca6f40
mov rcx, r15
mov eax, dword [rax]
cvtsi2sd xmm2, rax
movsd qword [rsp + 0x28], xmm2
call fcn.61ca6f30
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
mov eax, dword [rax]
cvtsi2sd xmm1, rax
call fcn.61d12430
mov rcx, r14
call fcn.61ca6f40
mov rcx, r14
mov eax, dword [rax]
cvtsi2sd xmm2, rax
movsd qword [rsp + 0x28], xmm2
call fcn.61ca6f30
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
mov eax, dword [rax]
cvtsi2sd xmm1, rax
call fcn.61d12430
mov rcx, r13
call fcn.61ca6f40
mov rcx, r13
mov eax, dword [rax]
cvtsi2sd xmm2, rax
movsd qword [rsp + 0x28], xmm2
call fcn.61ca6f30
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
mov eax, dword [rax]
cvtsi2sd xmm1, rax
call fcn.61d12430
mov rcx, r12
test bl, bl
je 0x61ca0305
add rsp, 0x30
pop rbx
pop r12
pop r13
pop r14
pop r15
jmp fcn.61d17460
add rsp, 0x30
pop rbx
pop r12
pop r13
pop r14
pop r15
jmp fcn.61d10e70
Function at 0x61ca0320
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbx
sub rsp, 0x30
mov ebx, dword [rsp + 0x80]
mov r13, rdx
mov r12, rcx
mov rdx, r8
mov r15, r8
mov rcx, r13
mov r14, r9
call fcn.61ca7030
test al, al
jne 0x61ca0375
mov r8d, 0xb1
lea rdx, str.src_Cairo.cpp
lea rcx, str.pos1___pos2__pos1___pos3
add rsp, 0x30
pop rbx
pop r12
pop r13
pop r14
pop r15
jmp fcn.61c87360
mov rdx, r14
mov rcx, r13
call fcn.61ca7030
test al, al
je 0x61ca034f
mov rcx, r13
call fcn.61ca6fc0
mov rcx, r13
movsx eax, word [rax]
cvtsi2sd xmm2, eax
movsd qword [rsp + 0x28], xmm2
call fcn.61ca6fb0
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
movsx eax, word [rax]
cvtsi2sd xmm1, eax
call fcn.61d13aa0
mov rcx, r15
call fcn.61ca6fc0
mov rcx, r15
movsx eax, word [rax]
cvtsi2sd xmm2, eax
movsd qword [rsp + 0x28], xmm2
call fcn.61ca6fb0
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
movsx eax, word [rax]
cvtsi2sd xmm1, eax
call fcn.61d12430
mov rcx, r14
call fcn.61ca6fc0
mov rcx, r14
movsx eax, word [rax]
cvtsi2sd xmm2, eax
movsd qword [rsp + 0x28], xmm2
call fcn.61ca6fb0
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
movsx eax, word [rax]
cvtsi2sd xmm1, eax
call fcn.61d12430
mov rcx, r13
call fcn.61ca6fc0
mov rcx, r13
movsx eax, word [rax]
cvtsi2sd xmm2, eax
movsd qword [rsp + 0x28], xmm2
call fcn.61ca6fb0
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
movsx eax, word [rax]
cvtsi2sd xmm1, eax
call fcn.61d12430
mov rcx, r12
test bl, bl
je 0x61ca0465
add rsp, 0x30
pop rbx
pop r12
pop r13
pop r14
pop r15
jmp fcn.61d17460
add rsp, 0x30
pop rbx
pop r12
pop r13
pop r14
pop r15
jmp fcn.61d10e70
Function at 0x61ca0480
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbx
sub rsp, 0x30
mov ebx, dword [rsp + 0x80]
mov r13, rdx
mov r12, rcx
mov rdx, r8
mov r15, r8
mov rcx, r13
mov r14, r9
call fcn.61ca70d0
test al, al
jne 0x61ca04d5
mov r8d, 0xb1
lea rdx, str.src_Cairo.cpp
lea rcx, str.pos1___pos2__pos1___pos3
add rsp, 0x30
pop rbx
pop r12
pop r13
pop r14
pop r15
jmp fcn.61c87360
mov rdx, r14
mov rcx, r13
call fcn.61ca70d0
test al, al
je 0x61ca04af
mov rcx, r13
call fcn.61ca7060
mov rcx, r13
movzx eax, word [rax]
cvtsi2sd xmm2, eax
movsd qword [rsp + 0x28], xmm2
call fcn.61ca7050
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
movzx eax, word [rax]
cvtsi2sd xmm1, eax
call fcn.61d13aa0
mov rcx, r15
call fcn.61ca7060
mov rcx, r15
movzx eax, word [rax]
cvtsi2sd xmm2, eax
movsd qword [rsp + 0x28], xmm2
call fcn.61ca7050
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
movzx eax, word [rax]
cvtsi2sd xmm1, eax
call fcn.61d12430
mov rcx, r14
call fcn.61ca7060
mov rcx, r14
movzx eax, word [rax]
cvtsi2sd xmm2, eax
movsd qword [rsp + 0x28], xmm2
call fcn.61ca7050
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
movzx eax, word [rax]
cvtsi2sd xmm1, eax
call fcn.61d12430
mov rcx, r13
call fcn.61ca7060
mov rcx, r13
movzx eax, word [rax]
cvtsi2sd xmm2, eax
movsd qword [rsp + 0x28], xmm2
call fcn.61ca7050
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
movzx eax, word [rax]
cvtsi2sd xmm1, eax
call fcn.61d12430
mov rcx, r12
test bl, bl
je 0x61ca05c5
add rsp, 0x30
pop rbx
pop r12
pop r13
pop r14
pop r15
jmp fcn.61d17460
add rsp, 0x30
pop rbx
pop r12
pop r13
pop r14
pop r15
jmp fcn.61d10e70

Function at 0x61ca05e0
Capabilities:
Log keystrokes via polling

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rsi, qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x10
call rsi
mov ecx, 0x11
movsx ebx, ax
call rsi
shr ebx, 0x1f
mov ecx, 0x12
shr eax, 0xe
and eax, 2
or ebx, eax
call rsi
mov ecx, 0x5b
shr eax, 0xd
and eax, 4
or ebx, eax
call rsi
mov ecx, 0x5c
shr eax, 0xc
and eax, 8
or ebx, eax
call rsi
mov ecx, 0x90
shr eax, 0xc
and eax, 8
or ebx, eax
call rsi
mov ecx, 0x91
shl eax, 4
and eax, 0x10
or ebx, eax
call rsi
mov ecx, 0x14
shl eax, 5
and eax, 0x20
or ebx, eax
call rsi
shl eax, 6
and eax, 0x40
or eax, ebx
add rsp, 0x28
pop rbx
pop rsi
ret
Function at 0x61ca0d70
Capabilities:
Query environment variable

Disassembly:
xorps xmm1, xmm1
mov rax, qword [rcx + 0x10]
movsd xmm0, qword [rax + 0xd8]
comisd xmm0, xmm1
ja 0x61c9171a
jmp fcn.61ca1670
ret
push r12
sub rsp, 0x20
mov r12, rcx
lea rcx, str.DPF_SCALE_FACTOR
call sub.msvcrt.dll_getenv
mov rcx, rax
test rax, rax
je 0x61ca0d9c
call sub.msvcrt.dll_atof
maxsd xmm0, qword [0x61e07998]
jmp 0x61ca0db7
test r12, r12
je 0x61ca0daf
mov rcx, r12
add rsp, 0x20
pop r12
jmp 0x61c91700
movsd xmm0, qword [0x61e07998]
add rsp, 0x20
pop r12
ret

Function at 0x61ca0fb0
Capabilities:
Query environment variable

Disassembly:
lea rcx, str.Window::PrivateData::renderToPicture
jmp 0x61ca0fb0
mov rdx, rcx
lea rcx, str.cairo_function_not_implemented:__s
jmp fcn.61c881f0
Function at 0x61ca2e80
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x98
movups xmmword [rsp + 0x60], xmm6
movups xmmword [rsp + 0x70], xmm7
movups xmmword [rsp + 0x80], xmm8
mov r13, qword [0x61df95e0]
movsd xmm7, qword [0x61e07080]
movq xmm8, qword [0x61e07070]
movsd xmm6, qword [r13 + 0x38]
movupd xmm0, xmm6
andps xmm0, xmm8
comisd xmm0, xmm7
mov rdi, rcx
mov ebx, edx
mov esi, r8d
jae 0x61ca2fc2
lea rcx, [0x61e06f40]
mov r15, qword [r13 + 0x40]
call sub.msvcrt.dll_getenv
mov rcx, rax
test rax, rax
je 0x61ca2f0c
call sub.msvcrt.dll_atof
movsd xmm6, qword [0x61e07090]
maxsd xmm6, xmm0
jmp 0x61ca2fc2
lea rcx, [0x61e06f51]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
movsd xmm6, qword [0x61e07090]
mov r12, rax
test rax, rax
je 0x61ca2fc2
mov rbp, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x61e06f5c]
mov rcx, rax
call rbp
lea rdx, [0x61e06f73]
mov rcx, r12
mov r14, rax
call rbp
mov dword [rsp + 0x58], 0
mov dword [rsp + 0x5c], 0x64
mov rbp, rax
test r14, r14
je 0x61ca2fa8
test rax, rax
je 0x61ca2fa8
xor ecx, ecx
lea rdx, [rsp + 0x58]
call r14
test eax, eax
jne 0x61ca2fa8
cmp dword [rsp + 0x58], 0
je 0x61ca2fa8
mov edx, 1
test r15, r15
je 0x61ca2f96
mov rcx, r15
call qword [sym.imp.USER32.dll_MonitorFromWindow]
jmp 0x61ca2f9e
xor ecx, ecx
call qword [sym.imp.USER32.dll_MonitorFromPoint]
mov rcx, rax
lea rdx, [rsp + 0x5c]
call rbp
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [rsp + 0x5c]
cvtsi2sd xmm6, rax
mulsd xmm6, qword [0x61e07098]
movupd xmm0, xmm6
andps xmm0, xmm8
comisd xmm0, xmm7
jb 0x61ca3002
movupd xmm0, xmm6
subsd xmm0, qword [0x61e07090]
andps xmm0, xmm8
comisd xmm0, xmm7
jb 0x61ca3002
cvtsi2sd xmm0, rbx
mulsd xmm0, xmm6
cvttsd2si rbx, xmm0
cvtsi2sd xmm0, rsi
mulsd xmm0, xmm6
cvttsd2si rsi, xmm0
movq r9, xmm6
mov r8d, esi
movupd xmm3, xmm6
mov edx, ebx
lea rcx, str.createNextWindow__u__u__f
call fcn.61c87ab0
mov ecx, 0x20
call fcn.61cb1010
mov r8, qword [r13 + 0x40]
mov dword [rsp + 0x20], esi
mov r9d, ebx
mov dword [rsp + 0x48], 0
mov rdx, r13
mov rcx, rax
mov r12, rax
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 1
movsd qword [rsp + 0x28], xmm6
call fcn.61c9a810
mov rcx, qword [r12 + 8]
lea rax, fcn.61ca2b90
mov qword [r12 + 0x10], rdi
mov qword [r12], rax
cmp qword [rcx + 0x20], 0
mov word [r12 + 0x18], 1
je 0x61ca30a0
call fcn.61c99360
test al, al
je 0x61ca30a0
mov rax, qword [r12 + 8]
mov rcx, qword [rax + 0x20]
call fcn.61c906a0
mov rcx, qword [r13 + 0x10]
cmp r12, rcx
jne 0x61ca30b8
jmp 0x61ca30c7
mov qword [r13 + 0x10], r12
test rcx, rcx
je 0x61ca30c7
mov rax, qword [rcx]
call qword [rax + 8]
cmp qword [r13 + 0x58], 0
mov rax, qword [r13 + 0x10]
jne 0x61ca30f0
mov rdx, qword [rax + 8]
mov byte [rdx + 0x71], 1
jmp 0x61ca30f0
movups xmm6, xmmword [rsp + 0x60]
movups xmm7, xmmword [rsp + 0x70]
movups xmm8, xmmword [rsp + 0x80]
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x61ca37a0
Capabilities:
Query environment variable

Disassembly:
mov r8, qword [rcx]
test r8, r8
jne 0x61ca37c8
mov r9d, 0xf2
lea r8, str.src_.._.._distrho_extra_String.hpp
lea rdx, str.fBuffer___nullptr
lea rcx, [0x61e07f51]
jmp fcn.61c88330
cmp byte [rcx + 0x10], 0
je 0x61ca37d6
mov rcx, r8
jmp sub.msvcrt.dll_free
ret
Function at 0x61ccb5a0
Capabilities:
Hash data using djb2

Disassembly:
mov eax, 0x1505
test rcx, rcx
je 0x61ccb5c2
movsx edx, byte [rcx]
test dl, dl
je 0x61ccb5c2
mov r8d, eax
inc rcx
shl r8d, 5
add edx, r8d
add eax, edx
jmp 0x61ccb5a5
ret

Function at 0x61cdabe0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push rbx
sub rsp, 0x28
xor eax, eax
mov rdx, rcx
mov ecx, 0x811c9dc5
imul ecx, ecx, 0x1000193
movzx r8d, byte [rdx + rax + 0x38]
inc rax
xor ecx, r8d
cmp rax, 0x30
jne 0x61cdabf0
xor eax, eax
imul ecx, ecx, 0x1000193
movzx r8d, byte [rdx + rax + 0x68]
inc rax
xor ecx, r8d
cmp rax, 0x30
jne 0x61cdac0a
call fcn.61cf0d70
lea rcx, [rdx + 0x98]
mov rsi, qword [rdx + 0x28]
mov ebx, eax
call fcn.61d11290
xor ebx, eax
mov ecx, ebx
xor ecx, esi
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.61cf0d70

Function at 0x61ceb8e0
Capabilities:
Check os version

Disassembly:
push r13
push r12
sub rsp, 0xc8
mov rax, qword [0x61e14b10]
cmp dword [rax], 0
jne 0x61ceb8fc
call fcn.61ccff10
mov r12, qword [0x61df9790]
mov rcx, r12
test r12, r12
jne 0x61ceb9b0
mov ecx, 0x70
call sub.msvcrt.dll_malloc
lea rdx, [0x61e1c260]
mov rcx, rax
mov r13, rax
call fcn.61cc4060
call fcn.61ced240
mov qword [r13 + 0x58], 0
lea rcx, [rsp + 0x2c]
mov qword [r13 + 0x60], rax
mov dword [rsp + 0x2c], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x3c], 1
jne 0x61ceb964
cmp dword [rsp + 0x30], 4
jne 0x61ceb964
cmp dword [rsp + 0x34], 0xa
je 0x61ceb990
lea rcx, str.msimg32
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [r13 + 0x58], rax
mov r12, rax
test rax, rax
je 0x61ceb990
lea rdx, str.AlphaBlend
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
xor eax, eax
mov qword [r13 + 0x68], r12
lock cmpxchg qword [0x61df9790], r13
mov rcx, r13
je 0x61ceb9b0
call sub.msvcrt.dll_free
mov rcx, qword [0x61df9790]
call fcn.61d10d20
add rsp, 0xc8
pop r12
pop r13
ret

Function at 0x61cf0d90
Capabilities:
Check os version

Disassembly:
push r12
sub rsp, 0xc0
mov dword [rsp + 0x2c], 0x94
lea rcx, [rsp + 0x2c]
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
mov r12d, eax
test eax, eax
jne 0x61cf0dc1
lea rcx, str._have_cleartype_quality
call fcn.61ced620
jmp 0x61cf0de2
cmp dword [rsp + 0x30], 5
mov r12d, 1
ja 0x61cf0de2
mov r12d, 0
jne 0x61cf0de2
xor r12d, r12d
cmp dword [rsp + 0x34], 0
setne r12b
mov eax, r12d
add rsp, 0xc0
pop r12
ret
Function at 0x61cf2ed0
Capabilities:
Query environment variable

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r12, rcx
lea rcx, str.PIXMAN_DISABLE
call sub.msvcrt.dll_getenv
mov r14, rax
xor eax, eax
test r14, r14
je 0x61cf2f7b
or rcx, 0xffffffffffffffff
mov rdi, r12
or rbp, 0xffffffffffffffff
xor r13d, r13d
repne scasb al, byte [rdi]
not rcx
lea rsi, [rcx - 1]
mov edx, 0x20
mov rcx, r14
call sub.msvcrt.dll_strchr
mov rbx, rax
test rax, rax
je 0x61cf2f2c
sub ebx, r14d
jmp 0x61cf2f3d
mov rcx, rbp
mov rdi, r14
mov eax, r13d
repne scasb al, byte [rdi]
not rcx
lea ebx, [rcx - 1]
movsxd rbx, ebx
cmp rsi, rbx
jne 0x61cf2f6d
mov r8, rsi
mov rdx, r14
mov rcx, r12
call sub.msvcrt.dll_strncmp
test eax, eax
jne 0x61cf2f6d
mov rdx, r12
lea rcx, str.pixman:_Disabled__s_implementation_n
call fcn.61dbe200
mov eax, 1
jmp 0x61cf2f7b
add rbx, r14
cmp byte [rbx], 0
lea r14, [rbx + 1]
jne 0x61cf2f12
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x140001000
Capabilities:
Create process on windows

Disassembly:
mov r11, rsp
sub rsp, 0xa8
mov rax, qword [0x140003008]
xor rax, rsp
mov qword [rsp + 0x90], rax
xor eax, eax
mov dword [rsp + 0x20], 0x70
xorps xmm0, xmm0
lea rdx, str.disable__USBVID_2B00PID_F202_
movups xmmword [rsp + 0x44], xmm0
test cl, cl
lea rcx, [rsp + 0x20]
movups xmmword [rsp + 0x24], xmm0
movups xmmword [rsp + 0x34], xmm0
movups xmmword [rsp + 0x54], xmm0
movups xmmword [rsp + 0x64], xmm0
movups xmmword [rsp + 0x74], xmm0
mov qword [r11 - 0x24], rax
mov dword [r11 - 0x1c], eax
lea rax, str.runas
mov qword [r11 - 0x78], rax
lea rax, str.devcon.exe
mov qword [r11 - 0x70], rax
lea rax, str.enable__USBVID_2B00PID_F202_
cmove rax, rdx
mov qword [r11 - 0x68], rax
mov dword [rsp + 0x50], 1
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x1400010b7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, 1
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140001120
add rsp, 0xa8
ret
xor eax, eax
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140001120
add rsp, 0xa8
ret
Function at 0x140002060
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov eax, dword [rcx + 0x48]
lea rbx, [rcx + 0x28]
mov rsi, qword [rcx]
lea r11, [rcx + 0x28]
add rbx, rax
mov rdi, rcx
movabs rbp, 0x9e3779b185ebca87
movabs r15, 0x27d4eb2f165667c5
movabs r14, 0xc2b2ae3d27d4eb4f
movabs r12, 0x7a1435883d4d519d
cmp rsi, 0x20
jb 0x14000215b
mov rcx, qword [rcx + 8]
mov r8, qword [rdi + 0x18]
mov r9, qword [rdi + 0x20]
mov rax, r8
mov rdx, qword [rdi + 0x10]
mov r10, r9
rol r10, 0x12
rol rax, 0xc
add r10, rax
mov rax, rdx
rol rax, 7
add r10, rax
mov rax, rcx
rol rax, 1
add r10, rax
movabs rax, 0x85ebca77c2b2ae63
imul rcx, r14
imul rdx, r14
imul r8, r14
imul r9, r14
rol rcx, 0x1f
imul rcx, rbp
rol rdx, 0x1f
xor r10, rcx
rol r8, 0x1f
imul r10, rbp
imul rdx, rbp
imul r8, rbp
sub r10, r12
rol r9, 0x1f
xor r10, rdx
imul r10, rbp
imul r9, rbp
sub r10, r12
xor r10, r8
imul r10, rbp
sub r10, r12
xor r10, r9
imul r10, rbp
add rax, r10
add rax, rsi
jmp 0x140002163
lea rax, [rsi + r15]
add rax, qword [rcx + 0x18]
lea rdx, [rdi + 0x30]
cmp rdx, rbx
ja 0x14000219a
nop dword [rax]
mov rcx, qword [r11]
add rdx, 8
imul rcx, r14
add r11, 8
rol rcx, 0x1f
imul rcx, rbp
xor rax, rcx
rol rax, 0x1b
imul rax, rbp
sub rax, r12
cmp rdx, rbx
jbe 0x140002170
lea rdx, [r11 + 4]
movabs r8, 0x165667b19e3779f9
cmp rdx, rbx
ja 0x1400021c5
mov ecx, dword [r11]
mov r11, rdx
imul rcx, rbp
xor rax, rcx
rol rax, 0x17
imul rax, r14
add rax, r8
cmp r11, rbx
jae 0x1400021eb
nop word [rax + rax]
movzx ecx, byte [r11]
inc r11
imul rcx, r15
xor rax, rcx
rol rax, 0xb
imul rax, rbp
cmp r11, rbx
jb 0x1400021d0
mov rbx, qword [rsp + 0x20]
mov rcx, rax
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
shr rcx, 0x21
xor rcx, rax
imul rcx, r14
mov rdx, rcx
shr rdx, 0x1d
xor rdx, rcx
imul rdx, r8
mov rax, rdx
shr rax, 0x20
xor rax, rdx
pop r15
pop r14
pop r12
ret

Function at 0x14000a310
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x90
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx eax, byte [rcx]
lea rbx, [rsp + 0x30]
xor r14d, r14d
mov rbp, rdx
mov word [rsp + 0x30], r14w
mov rsi, rcx
lea edi, [r14 + 0x28]
test al, al
je 0x14000a3c1
nop word [rax + rax]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], r14b
lea rcx, [rsp + 0x24]
call fcn.1400101a0
cmp rax, 1
jne 0x14000a3f7
mov rcx, rdi
mov rax, rbx
cmp word [rbx], r14w
je 0x14000a39d
add rax, 2
dec rcx
cmp word [rax], r14w
jne 0x14000a390
cmp rcx, 1
jb 0x14000a3f7
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], r14w
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x14000a360
mov rdx, rbp
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14000b7f0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.14000fe64
int3
Function at 0x14000a480
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x250
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rdi, r8
lea rax, [rsp + 0x30]
mov rbx, rcx
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor ecx, ecx
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x14000a4c5
xor al, al
jmp 0x14000a512
cmp word [rbx], 0
je 0x14000a4dd
nop dword [rax + rax]
add rbx, 2
dec rdi
cmp word [rbx], 0
jne 0x14000a4d0
cmp word [rsp + 0x30], 0
je 0x14000a50b
lea rcx, [rsp + 0x30]
sub rcx, rbx
nop dword [rax]
cmp rdi, 1
jb 0x14000a533
movzx eax, word [rcx + rbx]
dec rdi
mov word [rbx], ax
add rbx, 2
cmp word [rcx + rbx], 0
jne 0x14000a4f0
xor eax, eax
mov word [rbx], ax
mov al, 1
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14000b7f0
mov rbx, qword [rsp + 0x270]
add rsp, 0x250
pop rdi
ret
call fcn.14000fe64
int3
Function at 0x14000ad40
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x2030
call fcn.14001f7e0
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x2020], rax
mov r11d, dword [0x14002fdd4]
lea rsi, [0x140032e10]
mov rdi, rcx
test r11d, r11d
jne 0x14000adb9
mov r8d, 0x1000
lea rdx, str.HOME
lea rcx, [rsp + 0x20]
call fcn.14000a540
test al, al
je 0x14000ae99
lea rcx, [rsp + 0x20]
call fcn.14001446c
movsxd r11, dword [0x14002fdd4]
mov qword [rsi + r11*8], rax
inc r11d
mov dword [0x14002fdd4], r11d
xor r9d, r9d
test r11d, r11d
jle 0x14000adf4
mov r10, rsi
mov r8, qword [r10]
mov rax, rdi
sub r8, rdi
nop dword [rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x14000ade4
add rax, 2
test ecx, ecx
jne 0x14000add0
test edx, edx
je 0x14000ae17
inc r9d
add r10, 8
cmp r9d, r11d
jl 0x14000adc4
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rdi + rax*2], 0
jne 0x14000ae00
cmp rax, 2
jne 0x14000ae1b
cmp word [rdi + 2], 0x3a
jne 0x14000ae1b
mov al, 1
jmp 0x14000ae78
xor edx, edx
mov qword [rsp + 0x2048], rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne bl
test eax, eax
jne 0x14000ae46
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14000ae6d
mov bl, 1
cmp dword [0x14002fdd4], 0x400
jge 0x14000ae6d
mov rcx, rdi
call fcn.14001446c
movsxd rdx, dword [0x14002fdd4]
mov qword [rsi + rdx*8], rax
inc edx
mov dword [0x14002fdd4], edx
movzx eax, bl
mov rbx, qword [rsp + 0x2048]
mov rcx, qword [rsp + 0x2020]
xor rcx, rsp
call fcn.14000b7f0
mov rsi, qword [rsp + 0x2050]
add rsp, 0x2030
pop rdi
ret
lea rcx, str.HOME
call fcn.14000abe0
int3
Function at 0x14000afc0
Capabilities:
Check if file exists
Delete file
Get file attributes
Terminate process

Disassembly:
sub rsp, 0x68
mov rcx, qword [0x14002fdd8]
test rcx, rcx
je 0x14000affb
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14000afee
mov rcx, qword [0x14002fdd8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [0x14002fdd8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x14002fde8], 0
je 0x14000b0ee
mov qword [rsp + 0x70], rbx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x78], rbp
lea rbp, [0x1400298b0]
mov qword [rsp + 0x80], rsi
lea rsi, [0x140030610]
mov qword [rsp + 0x88], rdi
xor edi, edi
mov qword [rsp + 0x60], r14
mov r14d, 0x414
mov word [rsp + 0x40], r14w
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rbp
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ebx, edi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000b0cf
test al, 0x10
je 0x14000b0cf
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbp
mov word [rsp + 0x40], r14w
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rbp
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
inc ebx
cmp ebx, 0x14
jl 0x14000b075
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov r14, qword [rsp + 0x60]
add rsp, 0x68
ret