joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140114340
Capabilities:
Delete file

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rsi, rcx
mov rax, qword [0x1404fe040]
xor rax, rsp
mov qword [rsp + 0x50], rax
call fcn.140114510
mov eax, dword [rsi]
mov dword [0x1405009bc], eax
mov bl, 1
test al, 1
jne 0x140114391
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
cmp rcx, qword [0x1404fe040]
je 0x140114385
call fcn.140297b50
int3
mov eax, ebx
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rcx, qword [0x140512ca8]
test rcx, rcx
je 0x1401143bf
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140512ca8], 0
cmp qword [0x140512cb0], 0
jne 0x1401143bf
and byte [0x1405009bc], 0xfe
mov rax, qword [rsi + 0x28]
test rax, rax
je 0x1401143e8
movsx rcx, byte [rsi + 0x1f]
test rcx, rcx
jns 0x1401143d6
mov rcx, qword [rsi + 0x10]
test rcx, rcx
jne 0x140114461
mov qword [0x140512ca8], rax
jmp 0x14011436e
movsx rax, byte [rsi + 0x1f]
test rax, rax
jns 0x1401143f6
mov rax, qword [rsi + 0x10]
test rax, rax
je 0x1401144b0
lea rdi, [rsi + 8]
mov rcx, qword [0x140512cb0]
test rcx, rcx
jne 0x140114431
mov ecx, 0x18
call fcn.1402965cc
mov rcx, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov qword [0x140512cb0], rax
mov rdx, rdi
call fcn.1401f09a0
cmp dword [rsi + 0x24], 0
jne 0x140114455
mov rcx, qword [0x140512cb0]
cmp byte [rcx + 0x17], 0
jns 0x14011444f
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.14030da60
mov ebx, eax
jmp 0x14011436e
lea rdx, str.BaseInitLoggingImpl_built_with_NDEBUG
lea r8, str....._baselogging.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r9d, 0x21b
call fcn.14020f920
lea rdx, str.settings.log_file_path.empty__
lea r14, [rsp + 0x48]
mov rcx, r14
mov r8d, 0x7f
mov r9, rdi
call fcn.140310c50
mov rcx, r14
call fcn.140310e60
mov rax, qword [rsi + 0x28]
jmp 0x1401143df
lea rdx, str.BaseInitLoggingImpl_built_with_NDEBUG
lea r8, str....._baselogging.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r9d, 0x221
call fcn.14020f920
lea rdx, str._settings.log_file_path.empty__
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov r8d, 0x7f
mov r9, rdi
call fcn.140310c50
lea rdx, str.LOG_TO_FILE_set_but_no_log_file_path_
mov rcx, rbx
call fcn.140307000
mov rcx, rbx
call fcn.140310e60
jmp 0x1401143ff
Function at 0x1401198a0
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov ebx, r8d
mov rdi, rdx
mov rsi, rcx
xor eax, eax
mov qword [rcx], rax
mov r14, qword [rdx]
mov qword [rdx], rax
lea r15, [r14 + 1]
cmp r15, 2
jb 0x1401198cf
call fcn.14020f940
cmp qword [rsi], r14
je 0x1401198fe
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14011993a
cmp r15, 2
jb 0x1401198f6
mov qword [rsi], r14
call fcn.14020f940
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [rsi + 8]
call fcn.140210900
lea rcx, [rsi + 0x20]
call fcn.14022da60
mov dword [rsi + 0x24], 0
mov byte [rsi + 0x28], 0
mov byte [rsi + 0x29], bl
mov rax, qword [rdi]
inc rax
cmp rax, 2
jae 0x140119950
mov rax, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.14020f940
mov rcx, qword [rsi]
call fcn.1401fa240
mov qword [rsi], 0
jmp 0x1401198e8
call fcn.14020f940
mov rcx, qword [rdi]
call fcn.1401fa240
mov qword [rdi], 0
jmp 0x14011992a

Function at 0x14011a1a0
Capabilities:
Accept command line arguments

Disassembly:
push rsi
push rdi
sub rsp, 0x58
movaps xmmword [rsp + 0x40], xmm6
mov rax, qword [0x1404fe040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, qword [0x140512dc0]
test rdi, rdi
jne 0x14011a252
mov ecx, 0x50
call fcn.1402965cc
mov rsi, rax
xorps xmm6, xmm6
movups xmmword [rax], xmm6
mov byte [rax + 0x10], 0
mov ecx, 0x18
call fcn.1402965cc
mov qword [rsi + 0x18], rax
lea rcx, [rax + 0x18]
mov qword [rsi + 0x28], rcx
test rax, rax
je 0x14011a27b
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
mov qword [rsi + 0x20], rcx
mov rax, rsi
add rax, 0x38
movups xmmword [rsi + 0x38], xmm6
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x48], 1
mov qword [0x140512dc0], rsi
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x28], rax
test rax, rax
je 0x14011a27b
mov rcx, rax
call fcn.1402b8034
lea rdx, [rsp + 0x28]
mov qword [rdx + 8], rax
mov rcx, rsi
call fcn.14011a280
test rdi, rdi
sete al
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
cmp rcx, qword [0x1404fe040]
je 0x14011a26f
call fcn.140297b50
int3
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x58
pop rdi
pop rsi
ret
ud2
Function at 0x14012e190
Capabilities:
Hash data using sha256

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rsi, r9
mov rdi, r8
mov rbx, rdx
mov r15, rcx
mov r13, qword [rsp + 0xb0]
mov rax, qword [0x1404fe040]
xor rax, rsp
mov qword [rsp + 0x48], rax
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
xor r14d, r14d
test r13, r13
je 0x14012e200
mov ecx, dword [r13 + 0x2c]
call fcn.1402305a0
test rax, rax
je 0x14012e2db
mov r12, rax
xor ecx, ecx
call fcn.140230600
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r13
mov r14, r12
mov rax, qword [r13 + 0x10]
lea rcx, [0x14032c2c0]
cmp rax, rcx
jne 0x14012e2df
xorps xmm0, xmm0
movups xmmword [r14 + 0x5c], xmm0
movups xmmword [r14 + 0x50], xmm0
movups xmmword [r14 + 0x40], xmm0
movups xmmword [r14 + 0x30], xmm0
movups xmmword [r14 + 0x20], xmm0
movaps xmm0, xmmword [0x14048e0a0]
movups xmmword [r14], xmm0
movaps xmm0, xmmword [0x14048e0b0]
movups xmmword [r14 + 0x10], xmm0
mov dword [r14 + 0x6c], 0x20
lea r14, [rsp + 0x20]
mov rax, qword [r14]
mov rax, qword [rax + 0x18]
mov rcx, r14
mov rdx, r15
mov r8, rbx
call qword [case.0x1403053b8.0]
mov rax, qword [r14]
mov rax, qword [rax + 0x20]
mov rcx, r14
mov rdx, rdi
call qword [case.0x1403053b8.0]
mov rax, qword [r14]
test rsi, rsi
je 0x14012e28a
mov ecx, dword [rax + 4]
mov dword [rsi], ecx
mov edx, dword [rax + 0x2c]
mov rcx, qword [rsp + 0x28]
call fcn.140230640
mov r14d, 1
mov rcx, qword [rsp + 0x28]
call fcn.140230600
mov rax, qword [rsp + 0x38]
test rax, rax
jne 0x14012e2ef
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
cmp rcx, qword [0x1404fe040]
je 0x14012e2c8
call fcn.140297b50
int3
mov eax, r14d
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor ecx, ecx
jmp 0x14012e2a2
lea rcx, [rsp + 0x20]
call qword [case.0x1403053b8.0]
jmp 0x14012e24f
mov rax, qword [rax]
mov rcx, qword [rsp + 0x30]
call qword [case.0x1403053b8.0]
jmp 0x14012e2b1

Function at 0x14012e4a0
Capabilities:
Hash data using sha256

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rax, qword [rcx]
cmp rax, rdx
je 0x14012e4d8
mov rdi, rdx
mov ecx, dword [rdx + 0x2c]
call fcn.1402305a0
test rax, rax
je 0x14012e52c
mov rbx, rax
mov rcx, qword [rsi + 8]
call fcn.140230600
mov qword [rsi + 8], rbx
mov qword [rsi], rdi
mov rax, rdi
mov rax, qword [rax + 0x10]
lea rcx, [0x14032c2c0]
cmp rax, rcx
jne 0x14012e530
mov rax, qword [rsi + 8]
xorps xmm0, xmm0
movups xmmword [rax + 0x5c], xmm0
movups xmmword [rax + 0x50], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x20], xmm0
movaps xmm0, xmmword [0x14048e0a0]
movups xmmword [rax], xmm0
movaps xmm0, xmmword [0x14048e0b0]
movups xmmword [rax + 0x10], xmm0
mov dword [rax + 0x6c], 0x20
mov eax, 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
xor eax, eax
jmp 0x14012e524
mov rcx, rsi
call qword [case.0x1403053b8.0]
jmp 0x14012e51f
Function at 0x14012e5d0
Capabilities:
Hash data using sha256

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x30
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
cmp qword [rcx + 0x10], 0
jne 0x14012e607
mov rcx, qword [rsp + 0x80]
mov rdx, r9
call fcn.140161120
mov qword [rdi + 0x10], rax
test rax, rax
je 0x14012e710
mov ebp, dword [rsp + 0x88]
lea rcx, [0x140513008]
lea rdx, [0x140131c40]
call fcn.14023ddb0
lea rax, [0x140513010]
mov qword [rdi + 0x18], rax
mov rcx, qword [rdi + 0x10]
test ebp, ebp
je 0x14012e714
call fcn.140161420
test eax, eax
je 0x14012e710
test rbx, rbx
je 0x14012e65e
mov rcx, qword [rdi + 0x10]
mov rdx, rbx
call fcn.140124090
test eax, eax
je 0x14012e710
xor eax, eax
test ebp, ebp
setne al
mov rcx, qword [rdi + 0x10]
mov rcx, qword [rcx]
shl eax, 4
cmp qword [rcx + rax + 0x28], 0
je 0x14012e6f2
test rbx, rbx
je 0x14012e729
mov rax, qword [rdi]
cmp rax, rbx
je 0x14012e6ab
mov ecx, dword [rbx + 0x2c]
call fcn.1402305a0
test rax, rax
je 0x14012e710
mov r14, rax
mov rcx, qword [rdi + 8]
call fcn.140230600
mov qword [rdi + 8], r14
mov qword [rdi], rbx
mov rax, rbx
mov rax, qword [rax + 0x10]
lea rcx, [0x14032c2c0]
cmp rax, rcx
jne 0x14012e71e
mov rax, qword [rdi + 8]
xorps xmm0, xmm0
movups xmmword [rax + 0x5c], xmm0
movups xmmword [rax + 0x50], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x20], xmm0
movaps xmm0, xmmword [0x14048e0a0]
movups xmmword [rax], xmm0
movaps xmm0, xmmword [0x14048e0b0]
movups xmmword [rax + 0x10], xmm0
mov dword [rax + 0x6c], 0x20
mov ebx, 1
test rsi, rsi
je 0x14012e703
mov rax, qword [rdi + 0x10]
mov qword [rsi], rax
mov eax, ebx
add rsp, 0x30
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
xor ebx, ebx
jmp 0x14012e703
call fcn.1403a1790
jmp 0x14012e63d
mov rcx, rdi
call qword [case.0x1403053b8.0]
jmp 0x14012e6f2
mov dword [rsp + 0x20], 0x6d
lea r9, str....._third_party_boringssl_srccrypto_fipsmoduledigestsigndigestsign.c.inc
xor ebx, ebx
mov ecx, 6
xor edx, edx
mov r8d, 0x77
call fcn.1403a01f0
jmp 0x14012e703
Function at 0x14012fa60
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rax, r8
mov rsi, rdx
mov rdi, rcx
movsxd r8, dword [rcx + 0x148]
test r8, r8
jle 0x14012fc7b
mov r10, qword [rdi + 0x140]
xor ecx, ecx
mov edx, r8d
mov r11d, edx
cmp qword [r10 + r11*8 - 8], 0
je 0x14012fc10
movsxd rcx, edx
shl edx, 6
mov r10, qword [r10 + rcx*8 - 8]
xor ecx, ecx
test r10, r10
setne cl
or ecx, edx
xor edx, edx
mov r11, r10
shr r11, 0x20
setne dl
cmove r11, r10
shl edx, 5
mov rbx, r11
shr rbx, 0x10
xor r10d, r10d
cmp r11, 0x10000
setae r10b
cmovb rbx, r11
shl r10d, 4
mov r14, rbx
shr r14, 8
xor r11d, r11d
cmp rbx, 0x100
setae r11b
cmovb r14, rbx
mov rbx, r14
shr rbx, 4
xor r15d, r15d
cmp r14, 0x10
setae r15b
cmovb rbx, r14
mov r14, rbx
shr r14, 2
xor r12d, r12d
cmp rbx, 4
setae r12b
cmovb r14, rbx
or edx, ecx
or edx, r10d
cmp r14, 2
lea ecx, [rdx + r11*8]
lea ecx, [rcx + r15*4]
lea ecx, [rcx + r12*2]
sbb ecx, 0xffffffff
add ecx, 0xffffffc7
shr ecx, 3
cmp r9, rcx
jne 0x14012fc50
lea rcx, [r8*8]
cmp r9, rcx
ja 0x14012fc76
mov rcx, rsi
cmp r9, 8
jb 0x14012fb88
mov rdx, qword [rax + r9 - 8]
add r9, 0xfffffffffffffff8
bswap rdx
mov qword [rcx], rdx
add rcx, 8
dec r8
cmp r9, 7
ja 0x14012fb6c
test r9, r9
jne 0x14012fc25
shl r8, 3
test r8, r8
jne 0x14012fc8f
movsxd rcx, dword [rdi + 0x148]
mov eax, 0x14b
test rcx, rcx
je 0x14012fc55
mov r8, qword [rdi + 0x140]
xor edx, edx
xor r9d, r9d
mov r10, qword [r8 + r9*8]
mov r11, qword [rsi + r9*8]
xor edi, edi
mov rbx, r11
sub rbx, r10
sete dil
neg rdi
xor r10, r11
xor rbx, r11
or rbx, r10
xor rbx, r11
sar rbx, 0x3f
xor rdx, rbx
and rdx, rdi
xor rdx, rbx
inc r9
cmp rcx, r9
jne 0x14012fbbf
mov esi, 1
test edx, edx
jns 0x14012fc55
mov eax, esi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea r11d, [rdx - 1]
cmp edx, 1
mov edx, r11d
jg 0x14012fa92
jmp 0x14012fb49
xor edx, edx
xor r10d, r10d
mov r11, r10
shl r11, 8
movzx r10d, byte [rax + rdx]
or r10, r11
inc rdx
cmp r9, rdx
jne 0x14012fc2a
mov qword [rcx], r10
add rcx, 8
dec r8
jmp 0x14012fb91
mov eax, 0x144
mov dword [rsp + 0x20], eax
lea r9, str....._third_party_boringssl_srccrypto_fipsmoduleec_simple.c.inc
xor esi, esi
mov ecx, 0xf
xor edx, edx
mov r8d, 0x80
call fcn.1403a01f0
jmp 0x14012fc00
call fcn.1402adcd0
test r8d, r8d
je 0x14012fc9b
mov r10, qword [rdi + 0x140]
mov edx, r8d
jmp 0x14012faa1
xor edx, edx
call fcn.1402d26c0
jmp 0x14012fb9e
xor ecx, ecx
jmp 0x14012fb49
Function at 0x1401302d0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rax, qword [0x1404fe040]
xor rax, rsp
mov qword [rsp + 0x50], rax
cmp r8, 0x30
ja 0x14013042a
mov r14, r8
mov r15, rdx
mov rsi, rcx
movaps xmm0, xmmword [0x140470090]
lea rdi, [rsp + 0x40]
movaps xmmword [rdi], xmm0
movaps xmmword [rdi - 0x10], xmm0
movaps xmmword [rdi - 0x20], xmm0
lea r12, [rsp + 0x30]
lea rbx, [rcx + 0x108]
mov eax, dword [rcx + 0x114]
bswap eax
inc eax
bswap eax
mov dword [rcx + 0x114], eax
mov rax, qword [rcx + 0xf8]
lea rdx, [rsp + 0x20]
mov rcx, rbx
mov r8, rsi
call qword [case.0x1403053b8.0]
mov eax, dword [rsi + 0x114]
bswap eax
inc eax
bswap eax
mov dword [rsi + 0x114], eax
mov rax, qword [rsi + 0xf8]
mov rcx, rbx
mov rdx, r12
mov r8, rsi
call qword [case.0x1403053b8.0]
mov eax, dword [rsi + 0x114]
bswap eax
inc eax
bswap eax
mov dword [rsi + 0x114], eax
mov rax, qword [rsi + 0xf8]
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call qword [case.0x1403053b8.0]
test r14, r14
je 0x1401303b3
xor eax, eax
mov cl, byte [r15 + rax]
xor byte [rsp + rax + 0x20], cl
inc rax
cmp r14, rax
jne 0x1401303a3
mov ecx, 1
call fcn.14023df10
bt eax, 0x19
jae 0x140130435
not eax
lea rcx, [rsp + 0x20]
mov edx, 0x100
mov r8, rsi
test eax, 0x12000000
jne 0x14013042e
call fcn.140030140
lea rax, [0x14002ebe0]
lea rcx, [0x14002de80]
mov qword [rsi + 0xf8], rcx
mov qword [rsi + 0x100], rax
movups xmm0, xmmword [rdi]
movups xmmword [rbx], xmm0
mov eax, 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
cmp rcx, qword [0x1404fe040]
je 0x14013041c
call fcn.140297b50
int3
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
xor eax, eax
jmp 0x140130405
call fcn.14002fe50
jmp 0x1401303de
lea rcx, [rsp + 0x20]
mov edx, 0x100
mov r8, rsi
bt eax, 9
jae 0x14013045d
call fcn.140030f50
lea rax, [0x140031420]
lea rcx, [0x140031120]
jmp 0x1401303ec
call fcn.140316c20
lea rax, [0x140317880]
lea rcx, [0x140316af0]
jmp 0x1401303ec
Function at 0x140130490
Capabilities:
Hash data using sha256

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xe8
movaps xmmword [rsp + 0xd0], xmm8
movaps xmmword [rsp + 0xc0], xmm7
movaps xmmword [rsp + 0xb0], xmm6
mov qword [rsp + 0x28], r9
mov rax, qword [0x1404fe040]
xor rax, rsp
mov qword [rsp + 0xa8], rax
xorps xmm6, xmm6
movaps xmmword [rsp + 0x40], xmm6
movaps xmmword [rsp + 0x30], xmm6
mov esi, 1
test rdx, rdx
je 0x14013065d
mov r15, r8
mov rdi, rdx
mov rbx, rcx
mov rsi, qword [rsp + 0x150]
mov r13d, dword [rsi + 4]
xor r14d, r14d
movaps xmm7, xmmword [0x14048e0a0]
movaps xmm8, xmmword [0x14048e0b0]
lea r12, [rsp + 0x30]
mov eax, r14d
bswap eax
mov dword [rsp + 0x5c], eax
mov rax, qword [rsp + 0x30]
cmp rax, rsi
je 0x140130558
mov ecx, dword [rsi + 0x2c]
call fcn.1402305a0
test rax, rax
je 0x1401306ba
mov rbp, rax
mov rcx, qword [rsp + 0x38]
call fcn.140230600
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rsi
mov rax, rsi
mov rax, qword [rax + 0x10]
lea rcx, [0x14032c2c0]
cmp rax, rcx
jne 0x1401306be
mov rax, qword [rsp + 0x38]
movups xmmword [rax + 0x5c], xmm6
movups xmmword [rax + 0x50], xmm6
movups xmmword [rax + 0x40], xmm6
movups xmmword [rax + 0x30], xmm6
movups xmmword [rax + 0x20], xmm6
movups xmmword [rax], xmm7
movups xmmword [rax + 0x10], xmm8
mov dword [rax + 0x6c], 0x20
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x18]
mov rcx, r12
mov rdx, r15
mov r8, qword [rsp + 0x28]
call qword [case.0x1403053b8.0]
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x18]
mov r8d, 4
mov rcx, r12
lea rdx, [rsp + 0x5c]
call qword [case.0x1403053b8.0]
cmp rdi, r13
jb 0x140130608
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x20]
mov rcx, r12
mov rdx, rbx
call qword [case.0x1403053b8.0]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
mov edx, dword [rax + 0x2c]
call fcn.140230640
add rbx, r13
inc r14d
sub rdi, r13
jne 0x14013051a
jmp 0x140130658
movaps xmm0, xmmword [0x140470090]
lea rsi, [rsp + 0x60]
movaps xmmword [rsi + 0x30], xmm0
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
lea r14, [rsp + 0x30]
mov rax, qword [r14]
mov rax, qword [rax + 0x20]
mov rcx, r14
mov rdx, rsi
call qword [case.0x1403053b8.0]
mov rax, qword [r14]
mov rcx, qword [r14 + 8]
mov edx, dword [rax + 0x2c]
call fcn.140230640
mov rcx, rbx
mov rdx, rsi
mov r8, rdi
call fcn.1402d2020
mov esi, 1
mov rcx, qword [rsp + 0x38]
call fcn.140230600
mov rax, qword [rsp + 0x48]
test rax, rax
jne 0x1401306ce
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
cmp rcx, qword [0x1404fe040]
je 0x14013068b
call fcn.140297b50
int3
mov eax, esi
movaps xmm6, xmmword [rsp + 0xb0]
movaps xmm7, xmmword [rsp + 0xc0]
movaps xmm8, xmmword [rsp + 0xd0]
add rsp, 0xe8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor esi, esi
jmp 0x14013065d
lea rcx, [rsp + 0x30]
call qword [case.0x1403053b8.0]
jmp 0x140130594
mov rax, qword [rax]
mov rcx, qword [rsp + 0x40]
call qword [case.0x1403053b8.0]
jmp 0x140130671
Function at 0x140131a30
Capabilities:
Encode data using xor
Hash data using sha1 via x86 extensions

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov ecx, 2
call fcn.14023df10
mov ebp, eax
bt eax, 0x1d
jb 0x140131a73
not ebp
test ebp, 0x128
jne 0x140131a99
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
jmp fcn.14003d270
mov ecx, 1
call fcn.14023df10
bt eax, 9
jae 0x140131a53
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
jmp fcn.14003b300
mov ecx, 1
call fcn.14023df10
mov ebp, eax
bt eax, 0x1c
jae 0x140131ab8
xor ecx, ecx
call fcn.14023df10
bt eax, 0x1e
jb 0x140131ae2
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
bt ebp, 9
jb 0x140131ad4
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
jmp fcn.14003a2c0
nop
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
jmp fcn.14003b5d0
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
jmp fcn.14003c470
Function at 0x140134540
Capabilities:
Get session user name

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x250
mov rsi, rcx
mov rax, qword [0x1404fe040]
xor rax, rsp
mov qword [rsp + 0x248], rax
lea rdi, [rsp + 0x40]
mov r8d, 0x200
mov rcx, rdi
mov dl, 0xaa
call fcn.1402d26c0
lea rbx, [rsp + 0x3c]
mov dword [rbx], 0x100
mov rcx, rdi
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
setne cl
mov eax, dword [rbx]
test eax, eax
setne bl
and bl, cl
je 0x1401346a4
mov edx, eax
movsx rcx, byte [rsi + 0x17]
test rcx, rcx
js 0x14013467f
mov r8, rsi
cmp edx, 0xa
jbe 0x140134628
mov eax, ecx
mov r8, rcx
cmp rdx, r8
cmova r8, rdx
mov r9, r8
or r9, 3
cmp r9, 0xb
mov edx, ntohl
cmovne rdx, r9
cmp r8, 0xb
mov r8d, 0xa
cmovb rdx, r8
test cl, cl
js 0x1401346b1
cmp rdx, r8
je 0x1401345fd
mov rcx, rsi
call fcn.1400e1f50
mov al, byte [rsi + 0x17]
mov r8, rsi
test al, al
jns 0x140134628
mov rax, qword [rsi + 0x10]
mov rcx, rax
btr rcx, 0x3f
cmp rcx, 1
je 0x1401346c9
shr rax, 0x38
mov r8, rsi
test al, al
jns 0x140134628
mov r8, qword [rsi]
mov word [r8], 0x2e
cmp byte [rsi + 0x17], 0
jns 0x1401346ab
mov qword [rsi + 8], 1
mov word [r8 + 2], 0
mov r8d, dword [rsp + 0x3c]
dec r8d
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.1401f95c0
mov rcx, qword [rsp + 0x248]
xor rcx, rsp
cmp rcx, qword [0x1404fe040]
je 0x140134672
call fcn.140297b50
int3
mov eax, ebx
add rsp, 0x250
pop rbx
pop rdi
pop rsi
ret
mov rax, qword [rsi + 0x10]
mov r8, rax
btr r8, 0x3f
dec r8
shr rax, 0x38
cmp r8, rdx
jae 0x1401345fd
mov r8, qword [rsi + 8]
jmp 0x1401345bc
call fcn.140310f60
jmp 0x140134658
mov byte [rsi + 0x17], 1
jmp 0x14013463c
mov rax, qword [rsi + 0x10]
mov r8, rax
btr r8, 0x3f
dec r8
shr rax, 0x38
jmp 0x1401345ed
mov r9, qword [rsi + 8]
mov r8d, 2
sub r8, rcx
xor edi, edi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], r9
mov qword [rsp + 0x20], rdi
mov rcx, rsi
xor edx, edx
call fcn.1401e8150
mov qword [rsi + 8], rdi
mov al, byte [rsi + 0x17]
jmp 0x14013461e
Function at 0x14013dfe0
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x1404fe040]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov byte [rcx], 0
mov qword [rcx + 8], 0
movabs r14, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0x40]
mov qword [rbx], r14
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x28
mov r8, rbx
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14013e0e1
mov r15, qword [rsp + 0x40]
cmp qword [rsi + 8], r15
je 0x14013e07b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi + 8]
inc rax
cmp rax, 2
jae 0x14013e12c
lea rax, [r15 + 1]
cmp rax, 2
jb 0x14013e073
mov qword [rsi + 8], r15
call fcn.14020f940
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea r8, [rsp + 0x38]
mov qword [r8], r14
xor ecx, ecx
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x14013e107
lea r8, [rsp + 0x48]
mov dword [r8], 1
mov rax, qword [rsp + 0x38]
mov qword [r8 + 4], rax
mov dword [r8 + 0xc], 2
lea rax, [rsp + 0x34]
mov dword [rax], 0xaaaaaaaa
lea rdx, [rsi + 0x10]
mov rcx, qword [rsi + 8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
xor edx, edx
mov r9d, 0x10
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x14013e107
mov byte [rsi], 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
cmp rcx, qword [0x1404fe040]
je 0x14013e0f8
call fcn.140297b50
int3
mov rax, rsi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov rax, qword [rsi + 8]
inc rax
cmp rax, 2
jb 0x14013e0e1
call fcn.14020f940
mov rcx, qword [rsi + 8]
call fcn.1401fa240
mov qword [rsi + 8], 0
jmp 0x14013e0e1
call fcn.14020f940
mov rcx, qword [rsi + 8]
call fcn.1401fa240
mov qword [rsi + 8], 0
jmp 0x14013e060
Function at 0x140143090
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x78
mov rsi, rcx
mov rax, qword [0x1404fe040]
xor rax, rsp
mov qword [rsp + 0x70], rax
lea r9, [rsp + 0x68]
mov qword [r9], 0
lea rcx, [0x14044a668]
xor edx, edx
xor r8d, r8d
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
js 0x14014322d
mov rdi, qword [rsp + 0x68]
test rdi, rdi
je 0x14014321c
movabs r15, 0x7ffffffffffffff7
mov rcx, rdi
call fcn.1402b8034
cmp rax, r15
ja 0x140143223
mov rbx, rax
lea r14, [rsp + 0x28]
cmp rax, 0xa
jbe 0x140143200
mov rax, rbx
or rax, 3
lea rcx, [rax + 1]
cmp rax, 0xb
mov r12d, ntohl
cmovne r12, rcx
test r12, r12
js 0x14014321e
lea rcx, [r12 + r12]
call fcn.1402965cc
mov rcx, rax
mov qword [rsp + 0x28], rax
lea rax, [r15 + r12]
add rax, 9
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
lea r15, [rcx + rbx*2]
cmp rdi, rcx
setb al
cmp rdi, r15
setae dl
or dl, al
je 0x14014321c
test rbx, rbx
je 0x14014317f
add rbx, rbx
mov rdx, rdi
mov r8, rbx
call fcn.1402d2020
mov word [r15], 0
movsx rax, byte [rsp + 0x3f]
test rax, rax
cmovs rax, qword [rsp + 0x30]
cmovs r14, qword [rsp + 0x28]
lea rdx, [rsp + 0x40]
mov qword [rdx], r14
mov qword [rdx + 8], rax
lea rdi, [rsp + 0x50]
mov rcx, rdi
call fcn.140210960
mov rcx, rsi
mov rdx, rdi
call fcn.140117e00
mov rcx, rdi
call fcn.140210aa0
cmp byte [rsp + 0x3f], 0
jns 0x1401431d7
mov rcx, qword [rsp + 0x28]
call fcn.140296608
mov bl, 1
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1401431e9
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
cmp rcx, qword [0x1404fe040]
je 0x14014320c
call fcn.140297b50
int3
mov byte [rsp + 0x3f], bl
mov rcx, r14
jmp 0x140143154
mov eax, ebx
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
ud2
call fcn.1402d3510
lea rcx, [rsp + 0x28]
call fcn.1402d34d0
mov rcx, rsi
call fcn.14038ed70
mov ebx, eax
jmp 0x1401431d9