joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400011c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
xor ebp, ebp
mov qword [rsp + 0x28], rcx
xorps xmm0, xmm0
mov r14, rdx
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], rbp
mov rbx, rcx
mov qword [rcx + 0x18], rbp
cmp qword [rdx + 0x18], 0xf
mov rsi, qword [rdx + 0x10]
jbe 0x1400011fb
mov r14, qword [rdx]
movabs rdi, 0x7fffffffffffffff
cmp rsi, rdi
ja 0x140001375
cmp rsi, 0xf
ja 0x14000122c
mov qword [rcx + 0x10], rsi
mov qword [rcx + 0x18], 0xf
movups xmm0, xmmword [r14]
movups xmmword [rcx], xmm0
jmp 0x1400012bf
mov rax, rsi
or rax, 0xf
cmp rax, rdi
jbe 0x140001264
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140002c20
mov rcx, rax
test rax, rax
je 0x140001299
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1400012a5
mov ecx, 0x16
mov rdi, rax
cmp rax, rcx
cmovb rdi, rcx
lea rcx, [rdi + 1]
test rcx, rcx
jne 0x140001281
mov rax, rbp
jmp 0x1400012a5
cmp rcx, 0x1000
jb 0x1400012a0
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000137b
jmp 0x140001246
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002c20
lea r8, [rsi + 1]
mov qword [rbx], rax
mov rdx, r14
mov qword [rbx + 0x10], rsi
mov rcx, rax
mov qword [rbx + 0x18], rdi
call sub.VCRUNTIME140.dll_memcpy
cmp qword [rbx + 0x18], 0xf
mov r8, rbx
jbe 0x1400012d4
mov r8, qword [rbx]
mov rdx, r8
mov rax, r8
jmp 0x1400012da
mov rax, rbx
mov rdx, rbx
add rdx, qword [rbx + 0x10]
mov rcx, rdx
sub rcx, r8
cmp r8, rdx
cmova rcx, rbp
test rcx, rcx
je 0x14000134f
cmp rcx, 0x40
jb 0x14000134f
movdqa xmm1, xmmword [str.UUUUUUUUUUUUUUUU_]
and rcx, 0xffffffffffffffc0
nop dword [rax]
nop word [rax + rax]
movdqu xmm0, xmmword [rax]
add rbp, 0x40
xorps xmm0, xmm1
movdqu xmmword [rax], xmm0
movdqu xmm0, xmmword [rax + 0x10]
xorps xmm0, xmm1
movdqu xmmword [rax + 0x10], xmm0
movdqu xmm0, xmmword [rax + 0x20]
xorps xmm0, xmm1
movdqu xmmword [rax + 0x20], xmm0
movdqu xmm0, xmmword [rax + 0x30]
xorps xmm0, xmm1
movdqu xmmword [rax + 0x30], xmm0
add rax, 0x40
cmp rbp, rcx
jne 0x140001310
cmp rax, rdx
je 0x14000135f
xor byte [rax], 0x55
inc rax
cmp rax, rdx
jne 0x140001354
mov rbp, qword [rsp + 0x68]
mov rax, rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
call fcn.1400011a0
int3
call fcn.140001100
int3
Function at 0x1400014a0
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, r8
mov dword [rsp + 0x38], 1
lea rcx, [rsp + 0x60]
call fcn.1400011c0
nop
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.1400011c0
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0xf
cmova rdx, qword [rsp + 0x60]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x140001517
xor bl, bl
jmp 0x140001560
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0xf
cmova rdx, qword [rsp + 0x40]
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebx, eax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
sete bl
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x1400015a0
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000159b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000159b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002c5c
movdqa xmm0, xmmword [0x140004560]
movdqu xmmword [rsp + 0x50], xmm0
mov byte [rsp + 0x40], 0
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x1400015f3
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400015ee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400015ee
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002c5c
movzx eax, bl
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140002c00
add rsp, 0x90
pop rbx
ret
Function at 0x140001610
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister
Stop service

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov eax, 0x1410
call fcn.140003b70
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1400], rax
mov rdi, rcx
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rsp + 0x13f4], 0xffffffff
mov edx, 1
mov dword [rsp + 0x74], eax
nop dword [rax]
nop word [rax + rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rsp + rdx*4 + 0x74], eax
inc rdx
cmp rdx, 0x270
jb 0x140001660
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x70], 0x270
call fcn.1400027a0
mov ecx, eax
imul rax, rcx, 0x7d1
cmp eax, 0x375
ja 0x1400016bb
lea rcx, [rsp + 0x70]
call fcn.1400027a0
mov ecx, eax
imul rax, rcx, 0x7d1
cmp eax, 0x376
jb 0x1400016a1
shr rax, 0x20
lea rcx, [rsp + 0x20]
sub rax, 0x7ffffc18
xor rax, 0xffffffff80000000
mov qword [rsp + 0x20], rax
call fcn.140002060
mov ecx, 3
call fcn.140001390
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
je 0x14000178d
mov rdx, rdi
lea rcx, [rsp + 0x28]
call fcn.1400011c0
cmp qword [rax + 0x18], 0xf
jbe 0x140001717
mov rax, qword [rax]
mov r8d, 0x24
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rdx, qword [rsp + 0x40]
mov rdi, rax
cmp rdx, 0xf
jbe 0x14000176c
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001767
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001767
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002c5c
movdqa xmm0, xmmword [0x140004560]
mov byte [rsp + 0x28], 0
movdqu xmmword [rsp + 0x38], xmm0
test rdi, rdi
jne 0x140001791
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
jmp 0x1400017b8
lea r8, [rsp + 0x48]
mov edx, 1
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, 1
mov rcx, qword [rsp + 0x1400]
xor rcx, rsp
call fcn.140002c00
mov rbx, qword [rsp + 0x1428]
add rsp, 0x1410
pop rdi
ret
Function at 0x1400027a0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x140002801
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x1400027c0
mov ecx, dword [r9]
jmp 0x1400028eb
cmp ecx, 0x4e0
jb 0x1400028eb
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
add r10, 4
mov edx, r11d
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x140002820
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x140002870
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret

Function at 0x140003580
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400035ca
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400035ca
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400035ca
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400035ca
cmp dword [rcx + 0x84], 0xe
jbe 0x1400035ca
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400035cc
xor al, al
add rsp, 0x28
ret
Function at 0x14001dfb0
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3d0], rcx
mov qword [rbp + 0x3d8], 0
mov qword [rbp + 0x3e0], 2
mov qword [rbp + 0x3e8], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3c8], rax
xor esi, esi
xor edi, edi
xor ebx, ebx
cmp r8, 0x201
jae 0x14001e050
jmp 0x14001e03f
jae 0x14001e10f
cmp r8, 0x201
jae 0x14001e050
mov r14d, 0x200
lea r15, [rbp - 0x58]
mov r12, r8
jmp 0x14001e0a7
sub r8, rbx
sub rdi, rbx
cmp rdi, r8
jae 0x14001e07f
lea rcx, [rbp + 0x3d8]
mov rdx, rbx
call fcn.14003ef20
mov rsi, qword [rbp + 0x3d8]
mov rax, qword [rbp + 0x3e0]
mov qword [rbp + 0x3c8], rax
mov eax, 0xffffffff
cmp rsi, rax
mov ebx, 0xffffffff
cmovb rbx, rsi
mov qword [rbp + 0x3e8], rbx
mov rdi, rsi
mov r14, rbx
mov r15, qword [rbp + 0x3c8]
mov r12, rbx
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov ecx, r12d
mov rdx, r15
call qword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
mov r13d, eax
test eax, eax
jne 0x14001e0d0
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x14001e17b
mov r8d, r13d
cmp r12, r8
jne 0x14001e030
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14001e1af
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x14001e03f
jmp 0x14001e050
cmp r14, r8
jb 0x14001e1c9
lea rcx, [rbp + 0x3a8]
mov rdx, r15
call fcn.14001fa00
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3d0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rdx, qword [rbp + 0x3d8]
test rdx, rdx
je 0x14001e164
mov rcx, qword [rbp + 0x3e0]
add rdx, rdx
mov r8d, 2
call fcn.14000bd50
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3d0]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov rdx, qword [rbp + 0x3d8]
test rdx, rdx
jne 0x14001e14f
jmp 0x14001e164
lea rcx, str.internal_error:_entered_unreachable_code_bV
lea r8, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.14003fd80
jmp 0x14001e1de
lea rax, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, r14
mov r8, rax
call fcn.140040130
ud2
Function at 0x140023000
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
mov eax, 0x10b8
call fcn.14003e2d0
sub rsp, rax
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x1020], xmm6
mov qword [rbp + 0x1018], 0xfffffffffffffffe
mov qword [rbp + 0x1008], rdx
mov r15, rcx
lea r12, [rbp - 0x50]
mov r8d, 0x1000
mov rcx, r12
xor edx, edx
call sub.VCRUNTIME140.dll_memset
xorps xmm6, xmm6
lea r13, [rbp + 0xffc]
lea rbx, [0x1400288e0]
lea r14, [rbp + 0xfb0]
mov rsi, qword [sym.imp.kernel32.dll_WriteFileEx]
mov rdi, qword [sym.imp.kernel32.dll_SleepEx]
mov qword [rbp + 0x1010], r15
mov r8d, 0x1000
mov rcx, r15
mov rdx, r12
call fcn.1400286b0
mov r15, rdx
mov qword [rbp + 0xfd8], rax
mov qword [rbp + 0xfe0], rdx
test rax, rax
jne 0x1400231f0
test r15, r15
je 0x1400231bc
cmp r15, 0x1000
ja 0x140023212
xor r12d, r12d
nop word cs:[rax + rax]
mov r8d, r15d
sub r8d, r12d
lea rdx, [r12 + rbp]
add rdx, 0xffffffffffffffb0
mov dword [rbp + 0xffc], 0
movaps xmmword [rbp + 0xfb0], xmm6
mov qword [rbp + 0xfc0], 0
mov qword [rbp + 0xfc8], r13
mov qword [rsp + 0x20], rbx
mov rcx, qword [rbp + 0x1008]
mov r9, r14
call rsi
test eax, eax
je 0x140023190
nop word cs:[rax + rax]
mov ecx, 0xffffffff
mov edx, 1
call rdi
cmp dword [rbp + 0xffc], 0
je 0x140023120
mov ecx, dword [rbp + 0x1000]
mov eax, dword [rbp + 0x1004]
mov rdx, rcx
shl rdx, 0x20
or rdx, 2
xor r8d, r8d
test ecx, ecx
setne r8b
cmove rdx, rax
mov qword [rbp + 0xfe8], r8
mov qword [rbp + 0xff0], rdx
jne 0x1400231b0
add r12, rax
cmp r12, r15
je 0x140023180
jbe 0x1400230d0
jmp 0x1400231fe
mov r15, qword [rbp + 0x1010]
lea r12, [rbp - 0x50]
jmp 0x14002307e
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp + 0xfe8], 1
mov qword [rbp + 0xff0], rax
lea rcx, [rbp + 0xff0]
call fcn.140018600
mov rsi, qword [sym.imp.kernel32.dll_CloseHandle]
mov rcx, qword [rbp + 0x1010]
call rsi
mov rcx, qword [rbp + 0x1008]
call rsi
movaps xmm6, xmmword [rbp + 0x1020]
add rsp, 0x10b8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea rcx, [rbp + 0xfe0]
call fcn.140018600
jmp 0x1400231bc
lea r8, str.library_std_src_syspalwindowspipe.rs
mov rcx, r12
mov rdx, r15
call fcn.1400401a0
jmp 0x140023226
lea r8, str.library_std_src_syspalwindowspipe.rs
mov edx, 0x1000
mov rcx, r15
call fcn.140040130
ud2
Function at 0x140026e90
Capabilities:
Copy file

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x90
lea rbp, [rsp + 0x80]
mov qword [rbp + 8], 0xfffffffffffffffe
mov rsi, r9
mov rdi, r8
mov r8, rdx
mov rdx, rcx
lea rcx, [rbp - 0x38]
call fcn.14002ed00
mov rax, qword [rbp - 0x38]
mov rdx, qword [rbp - 0x30]
movabs rbx, 0x8000000000000000
cmp rax, rbx
je 0x140026f06
mov rcx, qword [rbp - 0x28]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov qword [rbp - 0x10], rcx
lea rcx, [rbp - 0x50]
lea rdx, [rbp - 0x20]
mov r8b, 1
call fcn.140030720
mov rax, qword [rbp - 0x50]
mov rdx, qword [rbp - 0x48]
cmp rax, rbx
jne 0x140026f19
mov eax, 1
add rsp, 0x90
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov qword [rbp], rax
mov qword [rbp - 8], rdx
lea rcx, [rbp - 0x38]
mov rdx, rdi
mov r8, rsi
call fcn.14002ed00
mov rax, qword [rbp - 0x38]
mov rdx, qword [rbp - 0x30]
cmp rax, rbx
je 0x140026f6a
mov rcx, qword [rbp - 0x28]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov qword [rbp - 0x10], rcx
lea rcx, [rbp - 0x50]
lea rdx, [rbp - 0x20]
mov r8b, 1
call fcn.140030720
mov rsi, qword [rbp - 0x50]
mov rdx, qword [rbp - 0x48]
cmp rsi, rbx
jne 0x140026f9d
mov rcx, qword [rbp - 8]
mov r14, qword [rbp]
mov eax, 1
test r14, r14
je 0x140026f0b
add r14, r14
mov r8d, 2
mov rsi, rdx
mov rdx, r14
call fcn.14000bd50
mov eax, 1
mov rdx, rsi
jmp 0x140026f0b
mov qword [rbp - 0x20], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r8, [0x1400270b0]
lea r9, [rbp - 0x20]
mov rcx, qword [rbp - 8]
mov rbx, rcx
mov rdi, rdx
call qword [sym.imp.kernel32.dll_CopyFileExW]
test eax, eax
mov r14, qword [rbp]
je 0x140027022
mov rdx, qword [rbp - 0x20]
test rsi, rsi
je 0x140026ffc
add rsi, rsi
mov r8d, 2
mov rcx, rdi
mov rdi, rdx
mov rdx, rsi
call fcn.14000bd50
mov rdx, rdi
test r14, r14
je 0x14002701b
add r14, r14
mov r8d, 2
mov rcx, rbx
mov rsi, rdx
mov rdx, r14
call fcn.14000bd50
mov rdx, rsi
xor eax, eax
jmp 0x140026f0b
call qword [sym.imp.kernel32.dll_GetLastError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
test rsi, rsi
je 0x140027051
add rsi, rsi
mov r8d, 2
mov rcx, rdi
mov rdi, rdx
mov rdx, rsi
call fcn.14000bd50
mov rdx, rdi
mov rcx, rbx
mov eax, 1
test r14, r14
jne 0x140026f7c
jmp 0x140026f0b
Function at 0x1400270d0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov rsi, rcx
movups xmm0, xmmword [0x140047680]
movaps xmmword [rbp], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
test r9, r9
je 0x140027108
mov rcx, qword [rbp + 0x60]
mov qword [rbp - 0x30], rcx
test r9, r9
mov qword [rbp - 0x38], r9
lea rcx, [rbp - 0x30]
cmove rcx, r9
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
mov rax, rbp
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x140027166
mov rcx, rsi
mov edx, 0xffffffff
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [rbp]
cmp eax, 0x103
je 0x140027193
test eax, eax
js 0x140027172
mov rdx, qword [rbp + 8]
xor eax, eax
jmp 0x140027189
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xa8
pop rsi
pop rbp
ret
mov dword [rbp + 0x18], 0
mov byte [rbp + 0x1c], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
lea rax, [rbp + 0x20]
mov qword [rbp - 0x28], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rcx, [rbp + 0x18]
lea rdx, [rbp - 0x38]
call fcn.14001f780
mov qword [rbp - 8], rax
lea rcx, [rbp - 8]
call fcn.140018c10
mov ecx, 7
int 0x29
ud2
Function at 0x14002e540
Capabilities:
Create thread

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
Function at 0x14003cd90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
test r8, r8
je 0x14003ce1a
mov rax, rdx
mov rdx, qword [rbp + 0x50]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x14003ce10
cmp r11, r10
ja 0x14003ce96
cmp r10, rdx
ja 0x14003cea8
add r11, r9
xor ebx, ebx
nop word cs:[rax + rax]
cmp rdi, rbx
je 0x14003ce12
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x14003cdf0
jmp 0x14003ce77
ja 0x14003ce1a
mov r11, r10
cmp rax, r8
jne 0x14003cdb7
mov rdx, qword [rbp + 0x60]
test rdx, rdx
je 0x14003ce7b
mov r8, qword [rbp + 0x58]
add rdx, r8
movzx ecx, cx
mov al, 1
nop
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x14003ce50
mov r8, r10
sub ecx, r9d
jns 0x14003ce6e
jmp 0x14003ce7d
cmp r10, rdx
je 0x14003ce8a
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x14003ce7d
xor al, 1
cmp r8, rdx
jne 0x14003ce30
jmp 0x14003ce7d
xor eax, eax
jmp 0x14003ce7d
mov al, 1
and al, 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
lea rcx, str.librarycore_srcunicodeprintable.rs
call fcn.14003fc40
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.1400401a0
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.140040130
int3

Function at 0x14003e7ec
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
test rax, rax
je 0x14003e836
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14003e836
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14003e836
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14003e836
cmp dword [rcx + 0x84], 0xe
jbe 0x14003e836
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14003e838
xor al, al
add rsp, 0x28
ret
Function at 0x14001114f
Capabilities:
Write file on windows

Disassembly:
jmp 0x140026880
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x14004d0f5]
call fcn.140011ed3
nop
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x68], 0
je 0x1400268d8
mov r8, qword [rbp + 0x130]
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x1400269ea
mov rax, qword [rbp + 0x130]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x130], 0
jle 0x140026983
cmp qword [rbp + 0x28], 0
jle 0x140026983
mov rax, qword [rbp + 0x28]
cmp qword [rbp + 0x130], rax
jge 0x140026921
mov rax, qword [rbp + 0x130]
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x128]
mov rcx, rax
call fcn.140011dfc
nop
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x128]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov edx, dword [rbp + 0x28]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
nop
cmp qword [rbp + 0x130], 0
jle 0x1400269d9
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x80], 0
je 0x1400269d9
mov rax, qword [rbp + 0x120]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x130]
mov edx, 1
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.ucrtbased.dll_fwrite]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x130]
mov rcx, qword [rbp + 8]
sub rcx, rax
mov rax, rcx
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret

Function at 0x140011181
Capabilities:
Block operations on executable memory pages using arbitrary code guard

Disassembly:
jmp 0x14001cff0
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xa
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140042040]
xor rax, rbp
mov qword [rbp + 0xd8], rax
lea rcx, [0x14004d122]
call fcn.140011ed3
nop
lea rax, [rbp + 4]
mov rdi, rax
xor eax, eax
mov ecx, 4
rep stosb byte [rdi], al
mov eax, dword [rbp + 4]
or eax, 1
mov dword [rbp + 4], eax
mov r8d, 4
lea rdx, [rbp + 4]
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
nop
lea rcx, [rbp - 0x20]
lea rdx, [0x140037870]
call fcn.140011c58
mov rcx, qword [rbp + 0xd8]
xor rcx, rbp
call fcn.14001170d
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret