joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1402d02f0
Capabilities:
Encode data using xor

Disassembly:
sub r8d, 2
pxor mm7, mm7
pxor mm6, mm6
movq mm0, qword [rcx]
movq mm1, qword [rcx + 1]
movq mm2, mm0
movq mm3, mm1
punpcklbw mm0, mm7
punpcklbw mm1, mm7
punpckhbw mm2, mm7
punpckhbw mm3, mm7
psubw mm0, mm1
psubw mm2, mm3
add rcx, rdx
movq mm4, qword [rcx]
movq mm1, qword [rcx + 1]
movq mm5, mm4
movq mm3, mm1
punpcklbw mm4, mm7
punpcklbw mm1, mm7
punpckhbw mm5, mm7
punpckhbw mm3, mm7
psubw mm4, mm1
psubw mm5, mm3
psubw mm0, mm4
psubw mm2, mm5
pxor mm3, mm3
pxor mm1, mm1
pcmpgtw mm3, mm0
pcmpgtw mm1, mm2
pxor mm0, mm3
pxor mm2, mm1
psubw mm0, mm3
psubw mm2, mm1
paddw mm2, mm0
paddw mm6, mm2
add rcx, rdx
movq mm0, qword [rcx]
movq mm1, qword [rcx + 1]
movq mm2, mm0
movq mm3, mm1
punpcklbw mm0, mm7
punpcklbw mm1, mm7
punpckhbw mm2, mm7
punpckhbw mm3, mm7
psubw mm0, mm1
psubw mm2, mm3
psubw mm4, mm0
psubw mm5, mm2
pxor mm3, mm3
pxor mm1, mm1
pcmpgtw mm3, mm4
pcmpgtw mm1, mm5
pxor mm4, mm3
pxor mm5, mm1
psubw mm4, mm3
psubw mm5, mm1
paddw mm5, mm4
paddw mm6, mm5
add rcx, rdx
movq mm4, qword [rcx]
movq mm1, qword [rcx + 1]
movq mm5, mm4
movq mm3, mm1
punpcklbw mm4, mm7
punpcklbw mm1, mm7
punpckhbw mm5, mm7
punpckhbw mm3, mm7
psubw mm4, mm1
psubw mm5, mm3
psubw mm0, mm4
psubw mm2, mm5
pxor mm3, mm3
pxor mm1, mm1
pcmpgtw mm3, mm0
pcmpgtw mm1, mm2
pxor mm0, mm3
pxor mm2, mm1
psubw mm0, mm3
psubw mm2, mm1
paddw mm2, mm0
paddw mm6, mm2
add rcx, rdx
sub r8d, 2
jne 0x1402d0362
movq mm0, mm6
punpcklwd mm0, mm7
punpckhwd mm6, mm7
paddd mm6, mm0
movq mm0, mm6
psrlq mm6, 0x20
paddd mm0, mm6
movd eax, mm0
repz ret
Function at 0x1402e78c0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x88
movaps xmmword [rsp + 0x30], xmm6
movaps xmmword [rsp + 0x40], xmm7
movaps xmmword [rsp + 0x50], xmm8
movaps xmmword [rsp + 0x60], xmm9
movaps xmmword [rsp + 0x70], xmm10
pxor xmm6, xmm6
movapd xmm2, xmm0
movapd xmm7, xmm0
movsd xmm9, qword [0x14042dcb0]
mulsd xmm2, xmm1
addsd xmm2, xmm9
cvttsd2si esi, xmm2
or esi, 1
ucomisd xmm6, xmm0
ja 0x1402e7a70
ucomisd xmm6, xmm1
ja 0x1402e7a70
lea ebx, [rsi - 1]
cmp ebx, 0xffffffe
ja 0x1402e7a70
mov ecx, 0x10
call fcn.14036d890
test rax, rax
mov rdi, rax
mov qword [rsp + 0x28], rax
je 0x1402e7a70
movsxd rcx, esi
mov dword [rax + 8], esi
shl rcx, 3
call fcn.14036d890
mov rbp, qword [rsp + 0x28]
mov qword [rdi], rax
cmp qword [rbp], 0
je 0x1402e7a52
pxor xmm0, xmm0
movapd xmm8, xmm7
mov rdi, qword [rbp]
movsd xmm10, qword [0x14042dca0]
addsd xmm8, xmm7
cvtsi2sd xmm0, ebx
xor ebx, ebx
mulsd xmm7, xmm8
mulsd xmm8, qword [0x14042dc90]
sqrtsd xmm8, xmm8
mulsd xmm9, xmm0
pxor xmm1, xmm1
cvtsi2sd xmm1, ebx
subsd xmm1, xmm9
movapd xmm0, xmm1
xorpd xmm0, xmm10
mulsd xmm0, xmm1
divsd xmm0, xmm7
call fcn.140386450
divsd xmm0, xmm8
movsd qword [rdi + rbx*8], xmm0
add rbx, 1
cmp esi, ebx
jg 0x1402e79a5
mov edx, dword [rbp + 8]
mov rax, qword [rbp]
test edx, edx
jle 0x1402e7a27
sub edx, 1
lea rcx, [rax + rdx*8 + 8]
mov rdx, rax
addsd xmm6, qword [rdx]
add rdx, 8
cmp rdx, rcx
jne 0x1402e79f0
movsd xmm1, qword [0x14042dc50]
divsd xmm1, xmm6
nop dword [rax]
add rax, 8
movsd xmm0, qword [rax - 8]
mulsd xmm0, xmm1
movsd qword [rax - 8], xmm0
cmp rcx, rax
jne 0x1402e7a10
movaps xmm6, xmmword [rsp + 0x30]
mov rax, rbp
movaps xmm7, xmmword [rsp + 0x40]
movaps xmm8, xmmword [rsp + 0x50]
movaps xmm9, xmmword [rsp + 0x60]
movaps xmm10, xmmword [rsp + 0x70]
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rcx, [rsp + 0x28]
call fcn.14036dc30
mov rbp, qword [rsp + 0x28]
test rbp, rbp
jne 0x1402e796c
nop word [rax + rax]
xor ebp, ebp
jmp 0x1402e7a27
Function at 0x14034f4e0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x88
movsxd r9, r9d
mov rdi, rcx
mov rsi, rdx
lea rbp, [r8 + r9]
mov rbx, r8
cmp r8, rbp
jae 0x14034f5df
lea rax, [rcx + 0x17]
lea r15, [rcx + 0x18]
lea r12, [rcx + 0x10]
mov r14d, 0x10
mov r13d, 1
mov qword [rsp + 0x38], rax
lea rax, [rcx + 0x16]
mov qword [rsp + 0x40], rax
lea rax, [rcx + 0x15]
mov qword [rsp + 0x48], rax
lea rax, [rcx + 0x14]
mov qword [rsp + 0x50], rax
lea rax, [rcx + 0x13]
mov qword [rsp + 0x58], rax
lea rax, [rcx + 0x12]
mov qword [rsp + 0x60], rax
lea rax, [rcx + 0x11]
mov qword [rsp + 0x68], rax
lea rax, [rcx + 0xf]
mov qword [rsp + 0x70], rax
lea rax, [rcx + 8]
mov qword [rsp + 0x78], rax
mov rax, r15
mov r15, rbp
mov rbp, r12
mov r12, rax
nop dword [rax]
mov eax, dword [rdi + 0x28]
test eax, eax
je 0x14034f5f3
movsxd rdx, eax
mov r9, r14
sub r9, rdx
lea r8, [r12 + rdx]
add r9, rbx
cmp r15, r9
cmovbe r9, r15
mov rcx, r9
sub rcx, rbx
add eax, ecx
and eax, 0xf
cmp r9, rbx
mov dword [rdi + 0x28], eax
jbe 0x14034f5da
xor eax, eax
movzx edx, byte [rbx + rax]
xor dl, byte [r8 + rax]
mov byte [rsi + rax], dl
add rax, 1
cmp rcx, rax
jne 0x14034f5b3
lea rax, [rbx + 1]
mov rcx, r13
sub rcx, rax
add r9, rcx
add rsi, r9
add rbx, r9
cmp r15, rbx
ja 0x14034f580
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov r8, qword [rsp + 0x78]
mov rcx, qword [rdi]
mov r9d, 1
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rdx, r12
call fcn.14034e9b0
cmp rbp, qword [rsp + 0x38]
ja 0x14034f686
add byte [rdi + 0x17], 1
jne 0x14034f686
cmp rbp, qword [rsp + 0x40]
ja 0x14034f686
add byte [rdi + 0x16], 1
jne 0x14034f686
cmp rbp, qword [rsp + 0x48]
ja 0x14034f686
add byte [rdi + 0x15], 1
jne 0x14034f686
cmp rbp, qword [rsp + 0x50]
ja 0x14034f686
add byte [rdi + 0x14], 1
jne 0x14034f686
cmp rbp, qword [rsp + 0x58]
ja 0x14034f686
add byte [rdi + 0x13], 1
jne 0x14034f686
cmp rbp, qword [rsp + 0x60]
ja 0x14034f686
add byte [rdi + 0x12], 1
jne 0x14034f686
cmp rbp, qword [rsp + 0x68]
ja 0x14034f686
add byte [rdi + 0x11], 1
jne 0x14034f686
add byte [rdi + 0x10], 1
jne 0x14034f686
cmp rbp, qword [rsp + 0x70]
ja 0x14034f686
add byte [rdi + 0xf], 1
mov eax, dword [rdi + 0x28]
jmp 0x14034f587
Function at 0x140353450
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
lea eax, [rdx - 8]
mov r10, rcx
cmp eax, 0x18
ja 0x140353570
mov eax, 1
mov ecx, edx
mov r9d, r8d
shl rax, cl
cmp r9, rax
jge 0x140353570
mov eax, 0x20
mov rbx, r10
mov rsi, r10
sub eax, edx
xor r11d, r11d
mov ecx, eax
xor eax, eax
shl r8d, cl
jmp 0x140353503
mov ecx, r11d
mov eax, r11d
shl ecx, 0x18
shl eax, 0x19
sar ecx, 0x1f
and ecx, r8d
xor ecx, eax
mov edx, ecx
add ecx, ecx
sar edx, 0x1f
and edx, r8d
xor edx, ecx
mov eax, edx
add edx, edx
sar eax, 0x1f
and eax, r8d
xor eax, edx
mov r9d, eax
add eax, eax
sar r9d, 0x1f
and r9d, r8d
xor r9d, eax
mov ecx, r9d
add r9d, r9d
sar ecx, 0x1f
and ecx, r8d
xor ecx, r9d
mov edx, ecx
add ecx, ecx
sar edx, 0x1f
and edx, r8d
xor edx, ecx
mov eax, edx
add edx, edx
sar eax, 0x1f
and eax, r8d
xor eax, edx
mov ecx, eax
lea edx, [rax + rax]
sar ecx, 0x1f
and ecx, r8d
mov eax, ecx
xor eax, edx
bswap eax
add r11d, 1
mov dword [rsi], eax
add rsi, 4
cmp r11d, 0x100
jne 0x140353490
lea rcx, [r10 + 0x400]
mov dword [r10 + 0x400], 1
nop dword [rax]
mov eax, dword [rbx]
add rbx, 4
movzx edx, al
shr eax, 8
xor eax, dword [r10 + rdx*4]
movzx edx, al
mov dword [rbx + 0x3fc], eax
shr eax, 8
xor eax, dword [r10 + rdx*4]
movzx edx, al
mov dword [rbx + 0x7fc], eax
shr eax, 8
xor eax, dword [r10 + rdx*4]
mov dword [rbx + 0xbfc], eax
cmp rbx, rcx
jne 0x140353530
xor eax, eax
pop rbx
pop rsi
ret
mov eax, 0xffffffea
pop rbx
pop rsi
ret

Function at 0x140353d00
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
mov eax, dword [rcx + 0x400]
add r9, r8
test eax, eax
jne 0x140353d9d
test r8b, 3
je 0x140353d3e
cmp r8, r9
jb 0x140353d25
jmp 0x140353d3e
cmp r9, r8
jbe 0x140353d3e
add r8, 1
mov eax, edx
shr edx, 8
xor al, byte [r8 - 1]
movzx eax, al
xor edx, dword [rcx + rax*4]
test r8b, 3
jne 0x140353d20
lea rsi, [r9 - 3]
cmp r8, rsi
jae 0x140353d9d
mov r11, r8
nop word [rax + rax]
xor edx, dword [r11]
add r11, 4
mov eax, edx
movzx r10d, dl
mov ebx, edx
shr eax, 0x18
mov r10d, dword [rcx + r10*4 + 0xc00]
shr ebx, 0x10
xor r10d, dword [rcx + rax*4]
movzx eax, dh
movzx ebx, bl
mov edx, dword [rcx + rax*4 + 0x800]
xor edx, r10d
xor edx, dword [rcx + rbx*4 + 0x400]
cmp r11, rsi
jb 0x140353d50
lea rax, [r9 - 4]
sub rax, r8
shr rax, 2
lea r8, [r8 + rax*4 + 4]
cmp r9, r8
jbe 0x140353dba
add r8, 1
mov eax, edx
shr edx, 8
xor al, byte [r8 - 1]
movzx eax, al
xor edx, dword [rcx + rax*4]
cmp r9, r8
jne 0x140353da2
mov eax, edx
pop rbx
pop rsi
ret
Function at 0x14036c4a0
Capabilities:
Query environment variable

Disassembly:
push rsi
push rbx
sub rsp, 0x48
cmp byte [rdx], 0
movsxd rsi, ecx
mov rbx, rdx
je 0x14036c4dd
mov edx, dword [0x1403b87a0]
test edx, edx
js 0x14036c533
cmp esi, 4
je 0x14036c4ca
mov eax, dword [0x1403b87a0]
test eax, eax
jne 0x14036c4e4
call qword [sym.imp.msvcrt.dll___iob_func]
lea rdx, [rax + 0x60]
mov rcx, rbx
call sub.msvcrt.dll_fputs
nop
add rsp, 0x48
pop rbx
pop rsi
ret
lea rax, [0x140433f40]
mov rcx, qword [0x1405ecdc8]
movzx edx, byte [rax + rsi]
mov rsi, qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
or dx, word [0x1405ecdd2]
movzx edx, dx
call rsi
call qword [sym.imp.msvcrt.dll___iob_func]
lea rdx, [rax + 0x60]
mov rcx, rbx
call sub.msvcrt.dll_fputs
movzx edx, word [0x1405ecdd0]
mov rcx, qword [0x1405ecdc8]
call rsi
nop
add rsp, 0x48
pop rbx
pop rsi
ret
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp rax, 0xffffffffffffffff
mov qword [0x1405ecdc8], rax
je 0x14036c55c
lea rcx, str.NO_COLOR
call sub.msvcrt.dll_getenv
test rax, rax
je 0x14036c56b
mov dword [0x1403b87a0], 0
jmp 0x14036c4bb
lea rcx, str.AV_LOG_FORCE_NOCOLOR
call sub.msvcrt.dll_getenv
test rax, rax
jne 0x14036c55c
mov dword [0x1403b87a0], 1
lea rdx, [rsp + 0x20]
mov rcx, qword [0x1405ecdc8]
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx eax, word [rsp + 0x28]
mov word [0x1405ecdd0], ax
and ax, 0xf0
mov word [0x1405ecdd2], ax
jmp 0x14036c4bb
Function at 0x14037e040
Capabilities:
Create thread

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rsi, r8
mov r8d, dword [rsp + 0xb0]
mov qword [rsp + 0x90], rcx
mov rbx, rdx
mov qword [rsp + 0xa8], r9
test r8d, r8d
js 0x14037e2d6
je 0x14037e271
cmp qword [rsp + 0xa8], 0
je 0x14037e29a
mov ecx, 0x50
call fcn.14036dc50
mov r13, rax
mov rax, qword [rsp + 0x90]
test r13, r13
mov qword [rax], r13
je 0x14037e26a
mov eax, dword [rsp + 0xb0]
mov dword [rsp + 0x38], eax
movsxd rcx, dword [rsp + 0x38]
mov edx, 0x40
call fcn.14036dcd0
test rax, rax
mov qword [r13], rax
je 0x14037e25d
mov rax, qword [rsp + 0xa8]
mov qword [r13 + 0x38], rbx
lea rcx, [r13 + 0x20]
mov qword [r13 + 0x40], rsi
mov dword [r13 + 0xc], 0
mov dword [r13 + 0x10], 0
mov dword [r13 + 0x34], 0
mov qword [r13 + 0x48], rax
mov eax, dword [rsp + 0xb0]
mov dword [r13 + 8], eax
mov dword [r13 + 0x14], 0
mfence
mov dword [r13 + 0x18], 0
mfence
mov r14, qword [sym.imp.KERNEL32.dll_InitializeSRWLock]
call r14
lea rcx, [r13 + 0x28]
mov r15, qword [sym.imp.KERNEL32.dll_InitializeConditionVariable]
call r15
mov edx, dword [rsp + 0x38]
mov dword [r13 + 0x30], 0
test edx, edx
je 0x14037e20f
mov rbp, qword [sym.imp.KERNEL32.dll_SleepConditionVariableSRW]
xor r12d, r12d
nop dword [rax + rax]
mov rbx, r12
mov dword [rsp + 0x3c], r12d
shl rbx, 6
add rbx, qword [r13]
lea rsi, [rbx + 8]
lea rdi, [rbx + 0x10]
mov qword [rbx], r13
mov rcx, rsi
call r14
mov rcx, rdi
call r15
mov rcx, rsi
call sub.KERNEL32.dll_AcquireSRWLockExclusive
lea rax, [0x14037dc80]
mov dword [rbx + 0x38], 0
mov qword [rbx + 0x28], rbx
xor edx, edx
xor ecx, ecx
lea r9, [rbx + 0x18]
mov qword [rbx + 0x20], rax
lea r8, [0x14037dc60]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.msvcrt.dll__beginthreadex]
test rax, rax
mov qword [rbx + 0x18], rax
jne 0x14037e1f1
jmp 0x14037e227
xor r9d, r9d
mov r8d, 0xffffffff
mov rdx, rsi
mov rcx, rdi
call rbp
mov eax, dword [rbx + 0x38]
test eax, eax
je 0x14037e1e0
mov rcx, rsi
add r12, 1
call fcn.14038ffc8
cmp dword [rsp + 0x38], r12d
jg 0x14037e160
mov eax, dword [rsp + 0xb0]
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov r14d, dword [rsp + 0x3c]
mov rcx, rsi
add r14d, 1
cmp qword [rsp + 0xa8], 0
cmove r12d, r14d
mov dword [r13 + 8], r12d
call fcn.14038ffc8
mov rcx, qword [rsp + 0x90]
call fcn.14037df40
mov eax, 0xffffffff
jmp 0x14037e216
mov rcx, qword [rsp + 0x90]
call fcn.14036dc30
mov eax, 0xfffffff4
jmp 0x14037e216
call fcn.140353350
lea edx, [rax + 1]
cmp eax, 2
mov eax, 1
cmovge eax, edx
cmp qword [rsp + 0xa8], 0
mov dword [rsp + 0xb0], eax
jne 0x14037e08c
mov eax, dword [rsp + 0xb0]
mov ecx, 0x50
sub eax, 1
mov dword [rsp + 0x38], eax
call fcn.14036dc50
mov r13, rax
mov rax, qword [rsp + 0x90]
test r13, r13
mov qword [rax], r13
je 0x14037e26a
mov ecx, dword [rsp + 0x38]
test ecx, ecx
je 0x14037e0d4
jmp 0x14037e0b8
lea rax, str.libavutil_slicethread.c
lea r9, str.nb_threads___0
lea r8, [0x14043ec7c]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], 0x66
mov qword [rsp + 0x20], rax
call fcn.14036cf30
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x140380eb0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
movsxd rbp, dword [0x1405edc04]
mov rbx, rcx
mov rsi, rdx
mov rdi, r8
test ebp, ebp
jle 0x140380fc7
mov rax, qword [0x1405edc08]
xor edx, edx
add rax, 8
mov rcx, qword [rax]
cmp rbx, rcx
jb 0x140380efd
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rcx, r8
cmp rbx, rcx
jb 0x140380fad
add edx, 1
add rax, 0x18
cmp edx, ebp
jne 0x140380ee1
mov rcx, rbx
call fcn.140381b00
test rax, rax
mov r12, rax
je 0x140380fff
lea rbp, [rbp + rbp*2]
shl rbp, 3
mov r13, rbp
add r13, qword [0x1405edc08]
mov qword [r13 + 0x10], rax
mov dword [r13], 0
call fcn.140381c70
mov edx, dword [r12 + 0xc]
mov r8d, 0x30
add rax, rdx
lea rdx, [rsp + 0x20]
mov qword [r13 + 8], rax
mov rax, qword [0x1405edc08]
mov rcx, qword [rax + rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140380fe2
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140380fa6
sub eax, 4
and eax, 0xfffffffb
je 0x140380fa6
mov r9, rbp
add r9, qword [0x1405edc08]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x140380fce
add dword [0x1405edc04], 1
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sub.msvcrt.dll_memcpy
xor ebp, ebp
jmp 0x140380f08
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140380e40
mov rax, qword [0x1405edc08]
mov edx, dword [r12 + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbp + 8]
call fcn.140380e40
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call fcn.140380e40
nop
nop

Function at 0x140381760
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x1405edee0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1405edec0]
test rbx, rbx
je 0x1403817b4
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x1403817ab
test rsi, rsi
je 0x1403817ab
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140381790
lea rcx, [0x1405edee0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x140381b00
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x140440220]
xor r9d, r9d
mov rdx, rcx
cmp word [r8], 0x5a4d
je 0x140381b21
mov rax, r9
add rsp, 0x28
ret
mov rcx, r8
call fcn.1403819d0
test eax, eax
je 0x140381b19
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x140381b19
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x140381b74
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140381b90
add rax, 0x28
cmp rax, r9
jne 0x140381b60
xor r9d, r9d
mov rax, r9
add rsp, 0x28
ret
mov r9, rax
mov rax, r9
add rsp, 0x28
ret
Function at 0x1403a1f80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
mov eax, 0xffffffc0
lea rbp, [rcx + 0x30]
test eax, eax
je 0x1403a203c
mov edi, eax
mov rsi, rdx
xor r9d, r9d
sar edi, 0x1f
lea r10, [rcx + 0x20]
mov r8, rsi
mov byte [r8], 0x64
mov r11, qword [r10]
mov r12d, dword [rcx]
movzx r14d, byte [r11 + r9]
mov r11d, r12d
cmp r14d, r12d
jge 0x1403a1fe2
mov r11, qword [r10 + 0x10]
mov ebx, edi
xor ebx, eax
sub ebx, edi
movsx r13d, byte [r11 + r9]
lea r14d, [rbx + r14 - 1]
mov r11d, r12d
cmp ebx, r13d
cmovle r11d, r14d
mov rbx, qword [rcx + 8]
movsxd r13, r11d
movzx ebx, word [rbx + r13*4 + 2]
inc ebx
cmp r12d, r11d
je 0x1403a1ffe
cmp ebx, 0x63
jg 0x1403a1ffe
mov byte [r8], bl
movsxd rbx, dword [rcx]
mov r11, qword [rcx + 8]
movzx r11d, word [r11 + rbx*4 + 2]
movzx ebx, byte [r8]
add r11d, 0xf
cmp r11d, ebx
jge 0x1403a201b
mov byte [r8], r11b
add r10, 8
add r8, 0x2000
cmp rbp, r10
jne 0x1403a1fad
inc r9
sub rsi, 0xffffffffffffff80
cmp r9, 0x40
jne 0x1403a1fa6
inc eax
inc rdx
cmp eax, 0x40
jne 0x1403a1f93
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x1403a5e88
Capabilities:
Encode data using xor

Disassembly:
push rdi
push rsi
sub rsp, 0x138
xor edx, edx
movss xmm0, dword [rcx + 0x138]
lea r8, [rsp + 0x40]
mov rax, rcx
movss dword [rcx + 0x284], xmm0
movss dword [rcx + 0x280], xmm0
movss xmm0, dword [rcx + 0x13c]
movss dword [rcx + 0x28c], xmm0
movss dword [rcx + 0x288], xmm0
movss xmm0, dword [rcx + 0x140]
movss dword [rcx + 0x294], xmm0
movss dword [rcx + 0x290], xmm0
movss xmm0, dword [rcx + 0x144]
movss dword [rcx + 0x29c], xmm0
movss dword [rcx + 0x298], xmm0
mov rcx, r8
mov r9, qword [rax + rdx + 0xa0]
add rcx, 0x30
mov qword [rcx - 0x30], r9
mov r9, qword [rax + rdx + 0xc8]
mov qword [rcx - 0x20], r9
mov r9, qword [rax + rdx + 0xf0]
mov qword [rcx - 0x10], r9
mov r9, qword [rax + rdx*2 + 0xa0]
mov qword [rcx - 0x28], r9
mov r9, qword [rax + rdx*2 + 0xf0]
mov qword [rcx - 0x18], r9
mov r9, qword [rax + rdx*2 + 0xc8]
add rdx, 8
mov qword [rcx - 8], r9
cmp rdx, 0x28
jne 0x1403a5cd6
movss xmm0, dword [0x140421c60]
lea r10, [rax + 0xa0]
lea r9, [rax + 0x220]
mov rdx, r8
mov r11, rsp
movaps xmm2, xmm0
movss xmm1, dword [rdx + 0x30]
mov rdi, r10
add r10, 0x40
movss dword [rsp], xmm1
add rdx, 8
mov ecx, 0x10
movss dword [rsp + 4], xmm1
mov rsi, r11
movss xmm1, dword [rdx + 0x58]
movss dword [rsp + 8], xmm1
movss dword [rsp + 0xc], xmm1
movss xmm1, dword [rdx + 0x88]
movss dword [rsp + 0x10], xmm1
movss dword [rsp + 0x14], xmm1
movss xmm1, dword [rdx + 0xb8]
movss dword [rsp + 0x18], xmm1
movss dword [rsp + 0x1c], xmm1
movss xmm1, dword [rdx + 0x2c]
movss dword [rsp + 0x20], xmm1
xorps xmm1, xmm0
movss dword [rsp + 0x24], xmm1
movss xmm1, dword [rdx + 0x5c]
movss dword [rsp + 0x28], xmm1
xorps xmm1, xmm0
movss dword [rsp + 0x2c], xmm1
movss xmm1, dword [rdx + 0x8c]
movss dword [rsp + 0x30], xmm1
xorps xmm1, xmm0
movss dword [rsp + 0x34], xmm1
movss xmm1, dword [rdx + 0xbc]
cmp r9, r10
movss dword [rsp + 0x38], xmm1
xorps xmm1, xmm0
movss dword [rsp + 0x3c], xmm1
movaps xmm1, xmm2
rep movsd dword [rdi], dword [rsi]
jne 0x1403a5d4b
add rax, 0x280
movss xmm2, dword [r8 + 4]
mov rdi, r9
add r9, 0x20
movaps xmm3, xmm2
movss dword [rsp + 8], xmm2
movss xmm2, dword [r8 + 0xc]
add r8, 0x10
xorps xmm3, xmm1
movss dword [rsp + 0x18], xmm2
movss xmm0, dword [r8 - 0x10]
mov ecx, 8
movss dword [rsp], xmm0
mov rsi, r11
movss dword [rsp + 4], xmm3
movaps xmm3, xmm2
movss dword [rsp + 0xc], xmm0
xorps xmm3, xmm1
movss xmm0, dword [r8 - 8]
cmp rax, r9
movss dword [rsp + 0x10], xmm0
movss dword [rsp + 0x1c], xmm0
movss dword [rsp + 0x14], xmm3
rep movsd dword [rdi], dword [rsi]
jne 0x1403a5e11
add rsp, 0x138
pop rsi
pop rdi
ret
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.140353280
test al, 0x40
je 0x1403a5ea7
mov rdx, qword [0x140442cf0]
mov qword [rbx + 0x2a8], rdx
xor edx, edx
test ah, 0x40
je 0x1403a5ec1
mov rdx, qword [0x140441620]
mov qword [rbx + 0x2a0], rdx
mov edx, 1
and eax, 0x8008000
cmp eax, 0x8000
jne 0x1403a5edb
mov rax, qword [0x140442ce0]
mov qword [rbx + 0x2a8], rax
test edx, edx
je 0x1403a5eec
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x1403a5c60
add rsp, 0x20
pop rbx
ret
Function at 0x140001820
Capabilities:
Create pipe

Disassembly:
push rsi
sub rsp, 0x60
mov rsi, rcx
test rcx, rcx
jne 0x140001836
xor eax, eax
add rsp, 0x60
pop rsi
ret
mov edx, 1
xor r9d, r9d
xor ecx, ecx
mov r8d, edx
mov qword [rsp + 0x78], rbp
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x140001878
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Failed_to_create_event:__d_n
mov edx, eax
call fcn.140021e30
mov rbp, qword [rsp + 0x78]
xor eax, eax
add rsp, 0x60
pop rsi
ret
mov ecx, 0x28
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x80], rdi
call fcn.140021fb4
xor edi, edi
mov rbx, rax
test rax, rax
je 0x1400018b0
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], rax
mov qword [rbx + 0x20], rax
jmp 0x1400018b3
mov rbx, rdi
xor eax, eax
lea r8, [rsp + 0x48]
lea rcx, str.D:_A_OICI_GA___BG__D_OICI_GA___AN__A_OICI_GRGWGX___AU__A_OICI_GA___BA_S:_ML__NW___ME_
mov qword [rbx], rax
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x20], rax
mov qword [rbx + 0x18], rbp
lea edx, [rax + 1]
xor r9d, r9d
mov dword [rsp + 0x40], 0x18
mov dword [rsp + 0x50], edi
call qword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
xor ecx, ecx
call fcn.14001e060
lea rcx, [rsp + 0x40]
mov r9d, 0xff
cmp eax, 8
mov edx, 0x40000003
cmovle rcx, rdi
xor r8d, r8d
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], 0x1388
mov rcx, rsi
mov dword [rsp + 0x28], 0x2000
mov dword [rsp + 0x20], 0x2000
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x140001954
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.CreateNamedPipe_failed_with__d._n
mov edx, eax
call fcn.140021e30
xor eax, eax
jmp 0x14000197c
mov ecx, 0x4048
call fcn.140021fb4
test rax, rax
je 0x140001979
mov r8, rsi
mov rdx, rbp
mov rcx, rax
mov qword [rsp + 0x20], rbx
call fcn.140001af0
mov rdi, rax
mov rax, rdi
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
add rsp, 0x60
pop rsi
ret

Function at 0x140001be0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, r8
mov rbx, rcx
xor edx, edx
mov r8d, 0x2000
add rcx, 0x2c
call fcn.140024640
cmp dword [rbx + 8], 1
jne 0x140001c2e
test rdi, rdi
je 0x140001c2e
mov r9, qword [rbx + 0x20]
mov rcx, qword [rbx + 0x18]
lea rdx, [rbx + 0x2c]
mov r8d, 0x2000
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadFileEx]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
xor eax, eax
add rsp, 0x30
pop rdi
ret