joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140004000
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
cld
and rsp, 0xfffffffffffffff0
call fcn.1400040d6
push r9
push r8
push rdx
xor rdx, rdx
push rcx
mov rdx, qword gs:[rdx + 0x60]
push rsi
mov rdx, qword [rdx + 0x18]
mov rdx, qword [rdx + 0x20]
mov rsi, qword [rdx + 0x50]
xor r9, r9
movzx rcx, word [rdx + 0x4a]
xor rax, rax
lodsb al, byte [rsi]
cmp al, 0x61
jl 0x140004037
sub al, 0x20
ror r9d, 0xd
add r9d, eax
loop 0x14000402d
push rdx
push r9
mov rdx, qword [rdx + 0x20]
mov eax, dword [rdx + 0x3c]
add rax, rdx
cmp word [rax + 0x18], 0x20b
jne 0x1400040cb
mov eax, dword [rax + 0x88]
test rax, rax
je 0x1400040cb
add rax, rdx
push rax
mov ecx, dword [rax + 0x18]
mov r8d, dword [rax + 0x20]
add r8, rdx
jrcxz 0x1400040ca
xor r9, r9
dec rcx
mov esi, dword [r8 + rcx*4]
add rsi, rdx
xor rax, rax
ror r9d, 0xd
lodsb al, byte [rsi]
add r9d, eax
cmp al, ah
jne 0x140004081
add r9, qword [rsp + 8]
cmp r9d, r10d
jne 0x140004072
pop rax
mov r8d, dword [rax + 0x24]
add r8, rdx
mov cx, word [r8 + rcx*2]
mov r8d, dword [rax + 0x1c]
add r8, rdx
mov eax, dword [r8 + rcx*4]
add rax, rdx
pop r8
pop r8
pop rsi
pop rcx
pop rdx
pop r8
pop r9
pop r10
sub rsp, 0x20
push r10
jmp rax
pop rax
pop r9
pop rdx
mov rdx, qword [rdx]
jmp 0x140004021
Function at 0x140027080
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x160
mov rax, qword [0x1401297c0]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor edx, edx
mov rdi, rcx
lea ecx, [rdx + 2]
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400270f3
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
call sub.kernel32.dll_Process32First
test eax, eax
je 0x1400270f3
nop
mov rdx, rdi
lea rcx, [rsp + 0x4c]
call qword [sym.imp.ucrtbase.dll__mbsicmp]
mov rcx, rbx
test eax, eax
je 0x14002711f
lea rdx, [rsp + 0x20]
call sub.kernel32.dll_Process32Next
test eax, eax
jne 0x1400270d0
mov rcx, rbx
call qword [sym.imp.kernel32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1400b6140
mov rbx, qword [rsp + 0x178]
add rsp, 0x160
pop rdi
ret
call qword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [rsp + 0x28]
jmp 0x1400270fe

Function at 0x140027130
Capabilities:
Access peb ldr_data
Encode data using xor
Enumerate processes
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x270
mov rax, qword [0x1401297c0]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbx, rcx
xor ebp, ebp
xor edx, edx
lea ecx, [rbp + 2]
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140027272
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x288], rdi
mov rcx, rax
mov dword [rsp + 0x20], 0x238
call sub.kernel32.dll_Process32FirstW
test eax, eax
je 0x1400271ba
mov rdx, rbx
lea rcx, [rsp + 0x4c]
call sub.vcruntime140.dll_wcsstr
test rax, rax
jne 0x1400271b6
lea rdx, [rsp + 0x20]
mov rcx, rsi
call sub.kernel32.dll_Process32NextW
test eax, eax
jne 0x140027191
jmp 0x1400271ba
mov ebp, dword [rsp + 0x28]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140027247
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140027247
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x448adcf
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140027242
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x140027220
cmp r8d, 0xc3273443
je 0x14002724c
test r9d, r9d
jne 0x140027200
mov rax, qword [rax]
jmp 0x1400271d0
mov edx, dword [rbx + 0x24]
mov rcx, rsi
add rdx, r10
movzx r8d, word [rdx + r9*2]
mov edx, dword [rbx + 0x1c]
add rdx, r10
mov r9d, dword [rdx + r8*4]
add r9, r10
call r9
mov rdi, qword [rsp + 0x288]
mov eax, ebp
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1400b6140
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop rsi
ret
Function at 0x1400272a0
Capabilities:
Enumerate processes

Disassembly:
sub rsp, 0x1b8
mov rax, qword [0x1401297c0]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
lea rax, [0x1400c04b0]
mov qword [rsp + 0x180], rax
lea rax, [0x1400c04c0]
mov qword [rsp + 0x188], rax
lea rax, [0x1400c04d0]
mov qword [rsp + 0x190], rax
lea rax, [0x1400c04e0]
mov qword [rsp + 0x198], rax
xor edx, edx
mov ecx, 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0xffffffffffffffff
jne 0x140027315
xor al, al
jmp 0x1400273d9
mov dword [rsp + 0x50], 0x130
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x20]
call sub.kernel32.dll_Process32First
test eax, eax
jne 0x140027342
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.kernel32.dll_CloseHandle]
xor al, al
jmp 0x1400273d9
lea rax, [rsp + 0x180]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x30]
add rax, 0x20
mov qword [rsp + 0x38], rax
jmp 0x140027377
mov rax, qword [rsp + 0x28]
add rax, 8
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x28], rax
je 0x1400273b5
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov rdx, qword [rax]
lea rcx, [rsp + 0x7c]
call fcn.140044480
test rax, rax
je 0x1400273b3
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.kernel32.dll_CloseHandle]
mov al, 1
jmp 0x1400273d9
jmp 0x140027369
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x20]
call sub.kernel32.dll_Process32Next
test eax, eax
jne 0x140027342
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.kernel32.dll_CloseHandle]
xor al, al
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.1400b6140
add rsp, 0x1b8
ret
Function at 0x140033820
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xb8
mov rax, qword [0x1401297c0]
xor rax, rsp
mov qword [rsp + 0xa8], rax
mov rax, qword [rsp + 0xc0]
cmp qword [rax + 0x68], 0
je 0x14003385d
mov rax, qword [rsp + 0xc0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x140033864
mov al, 1
jmp 0x1400339ed
mov rax, qword [rsp + 0xc0]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x60], rax
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x38], 0xffffffff
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0xc0]
call qword [rsp + 0x60]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x5c]
mov dword [rsp + 0x3c], eax
mov dword [rsp + 0x3c], 0xffffffff
mov eax, dword [rsp + 0x48]
cmp dword [rsp + 0x3c], eax
jne 0x1400338c0
mov dword [rsp + 0x40], 1
jmp 0x1400338c8
mov dword [rsp + 0x40], 0
movzx eax, byte [rsp + 0x40]
mov byte [rsp + 0x30], al
movzx eax, byte [rsp + 0x30]
test eax, eax
je 0x1400338e1
xor al, al
jmp 0x1400339ed
mov qword [rsp + 0x70], 0x20
mov rax, qword [rsp + 0xc0]
mov rax, qword [rax + 0x68]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0xa0]
mov rcx, qword [rsp + 0xc0]
add rcx, 0x74
lea rdx, [rsp + 0x78]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rsp + 0x80]
mov rdx, rcx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.msvcp140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
je 0x140033954
cmp dword [rsp + 0x34], 1
je 0x140033960
cmp dword [rsp + 0x34], 3
je 0x1400339db
jmp 0x1400339eb
mov rax, qword [rsp + 0xc0]
mov byte [rax + 0x71], 0
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x78]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
jbe 0x1400339b2
mov rax, qword [rsp + 0xc0]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x50]
mov edx, 1
lea rcx, [rsp + 0x80]
call qword [sym.imp.ucrtbase.dll_fwrite]
cmp qword [rsp + 0x50], rax
je 0x1400339b2
xor al, al
jmp 0x1400339ed
mov rax, qword [rsp + 0xc0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x1400339cc
mov dword [rsp + 0x44], 1
jmp 0x1400339d4
mov dword [rsp + 0x44], 0
movzx eax, byte [rsp + 0x44]
jmp 0x1400339ed
mov rax, qword [rsp + 0xc0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x1400339ed
xor al, al
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.1400b6140
add rsp, 0xb8
ret
Function at 0x14003ae20
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x1401297c0]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov byte [rsp + 0x40], 0
mov dword [rsp + 0x50], 0
mov rcx, qword [rsp + 0x70]
call fcn.140039130
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10000000
mov rcx, rax
call qword [sym.imp.kernel32.dll_CreateFileW]
mov qword [rsp + 0x48], rax
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x50
jne 0x14003aea5
mov byte [rsp + 0x41], 1
mov rcx, qword [rsp + 0x70]
call fcn.140036810
movzx eax, byte [rsp + 0x41]
jmp 0x14003af2b
cmp qword [rsp + 0x48], 0xffffffffffffffff
jne 0x14003aec3
mov byte [rsp + 0x42], 0
mov rcx, qword [rsp + 0x70]
call fcn.140036810
movzx eax, byte [rsp + 0x42]
jmp 0x14003af2b
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x50]
mov r8d, 0x33c8
lea rdx, section._________1
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.kernel32.dll_WriteFile]
mov byte [rsp + 0x40], al
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.kernel32.dll_CloseHandle]
movzx eax, byte [rsp + 0x40]
test eax, eax
jne 0x14003af17
mov byte [rsp + 0x43], 0
mov rcx, qword [rsp + 0x70]
call fcn.140036810
movzx eax, byte [rsp + 0x43]
jmp 0x14003af2b
mov byte [rsp + 0x44], 1
mov rcx, qword [rsp + 0x70]
call fcn.140036810
movzx eax, byte [rsp + 0x44]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400b6140
add rsp, 0x68
ret

Function at 0x14003af40
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x1401297c0]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov byte [rsp + 0x40], 0
mov dword [rsp + 0x50], 0
mov rcx, qword [rsp + 0x70]
call fcn.140039130
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10000000
mov rcx, rax
call qword [sym.imp.kernel32.dll_CreateFileW]
mov qword [rsp + 0x48], rax
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x50
jne 0x14003afc5
mov byte [rsp + 0x41], 1
mov rcx, qword [rsp + 0x70]
call fcn.140036810
movzx eax, byte [rsp + 0x41]
jmp 0x14003b04b
cmp qword [rsp + 0x48], 0xffffffffffffffff
jne 0x14003afe3
mov byte [rsp + 0x42], 0
mov rcx, qword [rsp + 0x70]
call fcn.140036810
movzx eax, byte [rsp + 0x42]
jmp 0x14003b04b
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x50]
mov r8d, 0x3400
lea rdx, [0x1400ff3d0]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.kernel32.dll_WriteFile]
mov byte [rsp + 0x40], al
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.kernel32.dll_CloseHandle]
movzx eax, byte [rsp + 0x40]
test eax, eax
jne 0x14003b037
mov byte [rsp + 0x43], 0
mov rcx, qword [rsp + 0x70]
call fcn.140036810
movzx eax, byte [rsp + 0x43]
jmp 0x14003b04b
mov byte [rsp + 0x44], 1
mov rcx, qword [rsp + 0x70]
call fcn.140036810
movzx eax, byte [rsp + 0x44]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400b6140
add rsp, 0x68
ret
Function at 0x14003b060
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x1401297c0]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov byte [rsp + 0x40], 0
mov dword [rsp + 0x50], 0
mov rcx, qword [rsp + 0x70]
call fcn.140039130
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10000000
mov rcx, rax
call qword [sym.imp.kernel32.dll_CreateFileW]
mov qword [rsp + 0x48], rax
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x50
jne 0x14003b0e5
mov byte [rsp + 0x41], 1
mov rcx, qword [rsp + 0x70]
call fcn.140036810
movzx eax, byte [rsp + 0x41]
jmp 0x14003b16b
cmp qword [rsp + 0x48], 0xffffffffffffffff
jne 0x14003b103
mov byte [rsp + 0x42], 0
mov rcx, qword [rsp + 0x70]
call fcn.140036810
movzx eax, byte [rsp + 0x42]
jmp 0x14003b16b
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x50]
mov r8d, 0x1df8
lea rdx, [0x1401027d0]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.kernel32.dll_WriteFile]
mov byte [rsp + 0x40], al
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.kernel32.dll_CloseHandle]
movzx eax, byte [rsp + 0x40]
test eax, eax
jne 0x14003b157
mov byte [rsp + 0x43], 0
mov rcx, qword [rsp + 0x70]
call fcn.140036810
movzx eax, byte [rsp + 0x43]
jmp 0x14003b16b
mov byte [rsp + 0x44], 1
mov rcx, qword [rsp + 0x70]
call fcn.140036810
movzx eax, byte [rsp + 0x44]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400b6140
add rsp, 0x68
ret

Function at 0x14003b180
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x1401297c0]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov byte [rsp + 0x40], 0
mov dword [rsp + 0x50], 0
mov rcx, qword [rsp + 0x70]
call fcn.140039130
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10000000
mov rcx, rax
call qword [sym.imp.kernel32.dll_CreateFileW]
mov qword [rsp + 0x48], rax
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x50
jne 0x14003b205
mov byte [rsp + 0x41], 1
mov rcx, qword [rsp + 0x70]
call fcn.140036810
movzx eax, byte [rsp + 0x41]
jmp 0x14003b28b
cmp qword [rsp + 0x48], 0xffffffffffffffff
jne 0x14003b223
mov byte [rsp + 0x42], 0
mov rcx, qword [rsp + 0x70]
call fcn.140036810
movzx eax, byte [rsp + 0x42]
jmp 0x14003b28b
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x50]
mov r8d, 0x23c00
lea rdx, [0x1401045d0]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.kernel32.dll_WriteFile]
mov byte [rsp + 0x40], al
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.kernel32.dll_CloseHandle]
movzx eax, byte [rsp + 0x40]
test eax, eax
jne 0x14003b277
mov byte [rsp + 0x43], 0
mov rcx, qword [rsp + 0x70]
call fcn.140036810
movzx eax, byte [rsp + 0x43]
jmp 0x14003b28b
mov byte [rsp + 0x44], 1
mov rcx, qword [rsp + 0x70]
call fcn.140036810
movzx eax, byte [rsp + 0x44]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400b6140
add rsp, 0x68
ret
Function at 0x140043680
Capabilities:
Create process on windows
Encrypt data using rc4 prga

Disassembly:
mov byte [rsp + 0x18], r8b
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x70
mov rcx, qword [rsp + 0x88]
call fcn.140039130
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x80]
call fcn.140039130
mov qword [rsp + 0x40], rax
mov eax, 2
imul rax, rax, 0
lea rcx, [0x1400c0190]
xor edx, edx
movzx ecx, word [rcx + rax]
call fcn.140027060
mov word [rsp + 0x50], ax
mov eax, 2
imul rax, rax, 1
lea rcx, [0x1400c0190]
mov edx, 1
movzx ecx, word [rcx + rax]
call fcn.140027060
mov word [rsp + 0x52], ax
mov eax, 2
imul rax, rax, 2
lea rcx, [0x1400c0190]
mov edx, 2
movzx ecx, word [rcx + rax]
call fcn.140027060
mov word [rsp + 0x54], ax
mov eax, 2
imul rax, rax, 3
lea rcx, [0x1400c0190]
mov edx, 3
movzx ecx, word [rcx + rax]
call fcn.140027060
mov word [rsp + 0x56], ax
mov eax, 2
imul rax, rax, 4
lea rcx, [0x1400c0190]
mov edx, 4
movzx ecx, word [rcx + rax]
call fcn.140027060
mov word [rsp + 0x58], ax
mov eax, 2
imul rax, rax, 5
lea rcx, [0x1400c0190]
mov edx, 5
movzx ecx, word [rcx + rax]
call fcn.140027060
mov word [rsp + 0x5a], ax
mov eax, 2
imul rax, rax, 6
lea rcx, [0x1400c0190]
mov edx, 6
movzx ecx, word [rcx + rax]
call fcn.140027060
mov word [rsp + 0x5c], ax
mov eax, 2
imul rax, rax, 7
lea rcx, [0x1400c0190]
mov edx, 7
movzx ecx, word [rcx + rax]
call fcn.140027060
mov word [rsp + 0x5e], ax
mov eax, 2
imul rax, rax, 8
lea rcx, [0x1400c0190]
mov edx, 8
movzx ecx, word [rcx + rax]
call fcn.140027060
mov word [rsp + 0x60], ax
mov eax, 2
imul rax, rax, 9
lea rcx, [0x1400c0190]
mov edx, 9
movzx ecx, word [rcx + rax]
call fcn.140027060
mov word [rsp + 0x62], ax
mov eax, 2
imul rax, rax, 0xa
lea rcx, [0x1400c0190]
mov edx, 0xa
movzx ecx, word [rcx + rax]
call fcn.140027060
mov word [rsp + 0x64], ax
lea rax, [rsp + 0x66]
lea rax, [rsp + 0x66]
mov rdi, rax
xor eax, eax
mov ecx, 2
rep stosb byte [rdi], al
mov dword [rsp + 0x30], 0
jmp 0x140043860
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
movsxd rax, dword [rsp + 0x30]
cmp rax, 0xb
jae 0x14004388d
movsxd rax, dword [rsp + 0x30]
movzx eax, word [rsp + rax*2 + 0x50]
mov ecx, dword [rsp + 0x30]
add ecx, 0x133
xor eax, ecx
movsxd rcx, dword [rsp + 0x30]
mov word [rsp + rcx*2 + 0x50], ax
jmp 0x140043856
mov eax, 2
imul rax, rax, 0xb
xor ecx, ecx
mov word [rsp + rax + 0x50], cx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
movzx eax, byte [rsp + 0x90]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], 0
mov r9, qword [rsp + 0x38]
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.shell32.dll_ShellExecuteW]
nop
mov rcx, qword [rsp + 0x80]
call fcn.140036810
nop
mov rcx, qword [rsp + 0x88]
call fcn.140036810
add rsp, 0x70
pop rdi
ret
Function at 0x14004a8c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rdi
push r12
sub rsp, 0x20
mov r12, rdx
mov rbx, rcx
call fcn.14004ab20
movzx edi, word [rbx]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov r8, qword [rax + 0x18]
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], r15
mov r10, qword [r8 + 0x20]
mov r11, qword [r8 + 0x28]
nop word [rax + rax]
mov r8, qword [r10 + 0x50]
xor ecx, ecx
cmp word [r8], cx
je 0x14004a91c
mov rax, r8
nop
inc ecx
lea rax, [rax + 2]
cmp word [rax], 0
jne 0x14004a910
xor edx, edx
test di, di
je 0x14004a93c
mov rax, rbx
nop word [rax + rax]
inc edx
lea rax, [rax + 2]
cmp word [rax], 0
jne 0x14004a930
cmp ecx, edx
jne 0x14004aa48
xor edx, edx
movsxd r9, ecx
test ecx, ecx
jle 0x14004a97b
mov rax, rbx
sub r8, rbx
nop dword [rax]
nop word [rax + rax]
movzx ecx, word [rax]
cmp word [r8 + rax], cx
jne 0x14004aa48
add rdx, 2
add rax, 4
cmp rdx, r9
jl 0x14004a960
mov r11, qword [r10 + 0x20]
test r11, r11
je 0x14004aa54
movsxd rax, dword [r11 + 0x3c]
xor ebx, ebx
movsxd rcx, dword [rax + r11 + 0x88]
add rcx, r11
movsxd r14, dword [rcx + 0x1c]
movsxd rsi, dword [rcx + 0x20]
add r14, r11
movsxd r15, dword [rcx + 0x24]
add rsi, r11
movsxd rdi, dword [rcx + 0x18]
add r15, r11
test rdi, rdi
jle 0x14004aa54
movzx ebp, byte [r12]
xor r10d, r10d
nop dword [rax]
nop word [rax + rax]
movsxd r8, dword [rsi + r10*4]
xor edx, edx
add r8, r11
cmp byte [r8], dl
je 0x14004a9ec
mov rax, r8
inc edx
lea rax, [rax + 1]
cmp byte [rax], 0
jne 0x14004a9e1
xor ecx, ecx
test bpl, bpl
je 0x14004aa0b
mov rax, r12
nop word [rax + rax]
inc ecx
lea rax, [rax + 1]
cmp byte [rax], 0
jne 0x14004aa00
cmp edx, ecx
jne 0x14004aa73
movsxd r9, edx
test edx, edx
jle 0x14004aa37
mov rcx, r12
sub r8, r12
nop dword [rax]
movzx eax, byte [rcx]
cmp byte [r8 + rcx], al
jne 0x14004aa73
inc rcx
mov rax, rcx
sub rax, r12
cmp rax, r9
jl 0x14004aa20
movsxd rax, ebx
movsx rcx, word [r15 + rax*2]
movsxd rax, dword [r14 + rcx*4]
add rax, r11
jmp 0x14004aa56
mov r10, qword [r10]
cmp r10, r11
jne 0x14004a900
xor eax, eax
mov r15, qword [rsp + 0x58]
mov r14, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop r12
pop rdi
pop rbx
ret
inc ebx
inc r10
cmp r10, rdi
jl 0x14004a9d0
jmp 0x14004aa54
Function at 0x14004b570
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x14004b5a4
mov eax, esi
lea ecx, [rax + 0x2a]
xor byte [r8 + rax], cl
inc rax
cmp rax, 6
jb 0x14004b590
mov byte [r8 + 7], sil
add r8, 6
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.14004ae00
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x14004b5c9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14003ec20
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14004b643
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004b63e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004b63e
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b5d00
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x14004b650
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r10, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x28], rcx
xor ebx, ebx
cmp byte [r8 + 9], bl
je 0x14004b684
mov ecx, ebx
lea eax, [rcx + 0x2a]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 8
jb 0x14004b670
mov byte [r8 + 9], bl
add r8, 8
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x50]
call fcn.14004ae00
nop
cmp byte [rdi + 9], 0
je 0x14004b6b4
lea eax, [rbx + 0x2a]
xor byte [rdi + rbx], al
inc rbx
cmp rbx, 8
jb 0x14004b6a1
mov byte [rdi + 9], 0
lea r8, [rdi + 8]
lea r9, [rsp + 0x20]
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.14004ae00
nop
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
movzx edx, byte [rsp + 0x20]
mov rcx, rsi
call fcn.140051f30
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14004b724
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004b71e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004b71e
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b5d00
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x14004b764
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004b75f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004b75f
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b5d00
mov rax, rsi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret