joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6b1c10
Capabilities:
Get disk information

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x60
mov rbp, rsp
mov qword [rbp + 0x38], rcx
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x88], rdx
mov rcx, qword [rbp + 0x88]
call fcn.0040e850
nop
lea rcx, [0x006b1ef4]
mov rdx, qword [rbp + 0x88]
mov r8d, 1
call fcn.00410360
cmp eax, 2
jne 0x6b1c7e
mov rcx, qword [rbp + 0x38]
mov rdx, qword [rbp + 0x88]
call fcn.0040ecf0
jmp 0x6b1e51
lea rcx, [0x006b1f04]
mov rdx, qword [rbp + 0x88]
mov r8d, 2
call fcn.00410360
mov ebx, eax
lea rcx, [0x006b1f04]
mov rdx, qword [rbp + 0x88]
mov r8d, ebx
add r8d, 1
call fcn.00410360
mov ebx, eax
xor rax, rax
cmp qword [rbp + 0x88], 0
je 0x6b1ccd
mov rax, qword [rbp + 0x88]
mov eax, dword [rax - 4]
mov rcx, qword [rbp + 0x38]
mov rdx, qword [rbp + 0x88]
movsxd r8, ebx
mov r9d, eax
sub r9d, ebx
add r9d, 1
movsxd r9, r9d
call fcn.004100d0
xor rax, rax
cmp qword [rbp + 0x88], 0
je 0x6b1d04
mov rax, qword [rbp + 0x88]
mov eax, dword [rax - 4]
lea rcx, [rbp + 0x88]
mov edx, ebx
mov r8d, eax
call fcn.00410130
lea rcx, [rbp + 0x58]
mov edx, 0x104
call fcn.0040fcf0
mov rcx, qword [rbp + 0x58]
call fcn.0040fa60
lea rcx, [0x006b1f08]
mov rdx, rax
mov r8d, 0x104
call sub.kernel32.dll_QueryDosDeviceW
test eax, eax
je 0x6b1d8c
mov rcx, qword [rbp + 0x58]
call fcn.0040fa60
lea rcx, [rbp + 0x58]
mov rdx, rax
call fcn.0040fb00
mov rcx, qword [rbp + 0x88]
mov rdx, qword [rbp + 0x58]
call fcn.0042ff20
test eax, eax
jne 0x6b1d8c
mov rcx, qword [rbp + 0x38]
lea rdx, [0x006b1f1c]
mov rax, qword [rbp + 0x38]
mov r8, qword [rax]
call fcn.0040fec0
jmp 0x6b1e51
mov bx, 0x61
lea rcx, [rbp + 0x58]
mov edx, 0x104
call fcn.0040fcf0
lea rcx, [rbp + 0x48]
mov edx, ebx
call fcn.0040fab0
lea rcx, [rbp + 0x48]
lea rdx, [0x006b1ef4]
call fcn.0040fdd0
mov rcx, qword [rbp + 0x48]
call fcn.0040fa60
mov rsi, rax
mov rcx, qword [rbp + 0x58]
call fcn.0040fa60
mov rcx, rsi
mov rdx, rax
mov r8d, 0x104
call sub.kernel32.dll_QueryDosDeviceW
test eax, eax
je 0x6b1e41
mov rcx, qword [rbp + 0x58]
call fcn.0040fa60
lea rcx, [rbp + 0x58]
mov rdx, rax
call fcn.0040fb00
mov rcx, qword [rbp + 0x88]
mov rdx, qword [rbp + 0x58]
call fcn.0042ff20
test eax, eax
jne 0x6b1e41
lea rcx, [rbp + 0x40]
mov edx, ebx
call fcn.0040fab0
mov rcx, qword [rbp + 0x38]
mov edx, 3
mov r8, qword [rbp + 0x40]
lea r9, [0x006b1ef4]
mov rax, qword [rbp + 0x38]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
call fcn.0040ffe0
jmp 0x6b1e51
add bx, 1
cmp bx, 0x7b
jne 0x6b1d90
nop
nop
lea rcx, [rbp + 0x40]
mov edx, 2
call fcn.0040e7a0
lea rcx, [rbp + 0x58]
call fcn.0040e6c0
lea rcx, [rbp + 0x88]
call fcn.0040e6c0
mov rax, qword [rbp + 0x38]
lea rsp, [rbp + 0x60]
pop rbx
pop rsi
pop rbp
ret
Function at 0x6b40c0
Capabilities:
Create process on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x138
mov rbp, rsp
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x78], rbp
mov qword [rbp + 0x150], rcx
mov dword [rbp + 0x158], edx
mov dword [rbp + 0x160], r8d
mov rcx, qword [rbp + 0x150]
call fcn.0040e850
nop
mov dword [rbp + 0x9c], 0
mov ecx, 0x2000000
xor rdx, rdx
mov r8d, dword [rbp + 0x158]
call sub.kernel32.dll_OpenProcess
mov qword [rbp + 0x90], rax
mov rcx, qword [rbp + 0x90]
mov edx, 0x200eb
lea r8, [rbp + 0x128]
call sub.advapi32.dll_OpenProcessToken
mov eax, dword [rbp + 0x160]
or eax, 0x400
mov dword [rbp + 0x124], eax
lea rcx, [rbp + 0xb8]
mov edx, 0x68
xor r8, r8
call fcn.0040a1d0
mov dword [rbp + 0xb8], 0x68
lea rax, [0x006b4394]
mov qword [rbp + 0xc8], rax
lea rcx, [rbp + 0xa0]
mov edx, 0x18
xor r8, r8
call fcn.0040a1d0
nop
lea rcx, [rbp + 0x88]
mov rdx, qword [rbp + 0x128]
xor r8, r8
call qword [0x0070b328]
test eax, eax
je 0x6b42e4
mov rcx, qword [rbp + 0x150]
call fcn.0040fa60
mov rbx, rax
lea rcx, [rbp + 0x70]
mov rdx, qword [rbp + 0x150]
call fcn.004319c0
mov rcx, qword [rbp + 0x70]
call fcn.0040fa60
mov rcx, qword [rbp + 0x128]
xor rdx, rdx
mov r8, rbx
xor r9, r9
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
mov r10d, dword [rbp + 0x124]
mov dword [rsp + 0x30], r10d
mov r10, qword [rbp + 0x88]
mov qword [rsp + 0x38], r10
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0xb8]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0xa0]
mov qword [rsp + 0x50], rax
call sub.advapi32.dll_CreateProcessAsUserW
test eax, eax
je 0x6b42e4
mov dword [rbp + 0x9c], 0xffffffff
jmp 0x6b42e4
mov rcx, qword [rbp + 0x90]
call sub.kernel32.dll_CloseHandle_1
mov rcx, qword [rbp + 0x128]
call sub.kernel32.dll_CloseHandle_1
mov rcx, qword [rbp + 0x128]
call sub.kernel32.dll_CloseHandle_1
nop
lea rcx, [rbp + 0x68]
mov edx, 2
call fcn.0040e7a0
lea rcx, [rbp + 0x150]
call fcn.0040e6c0
mov eax, dword [rbp + 0x9c]
lea rsp, [rbp + 0x138]
pop rbx
pop rbp
ret
Function at 0x6b43c0
Capabilities:
Terminate process

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rbp, rsp
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], 0
nop
xor rsi, rsi
mov rax, qword [rbp + 0x20]
mov rax, qword [rax + 0x1c8]
mov byte [rax + 0x138f4], 0
mov rax, qword [rbp + 0x20]
mov rax, qword [rax + 0x1c8]
mov byte [rax + 0x138f5], 0
jmp 0x6b440c
mov ecx, 1
call sub.kernel32.dll_Sleep_2
mov rax, qword [rbp + 0x20]
mov rax, qword [rax + 0x1c8]
cmp byte [rax + 0x138f4], 0
je 0x6b4401
mov rax, qword [rbp + 0x20]
mov rax, qword [rax + 0x1c8]
mov byte [rax + 0x138f5], 1
mov rax, qword [rbp + 0x20]
mov rax, qword [rax + 0x1c8]
lea rcx, [rax + 0x13910]
call sub.kernel32.dll_EnterCriticalSection_1
mov rax, qword [rbp + 0x20]
mov rax, qword [rax + 0x1c8]
cmp dword [rax + 0x138f0], 0
jle 0x6b4552
xor rbx, rbx
mov rax, qword [rbp + 0x20]
mov rax, qword [rax + 0x1c8]
mov edi, dword [rax + 0x138f0]
sub edi, 1
cmp ebx, edi
ja 0x6b4551
add edi, 1
mov rax, qword [rbp + 0x20]
mov rax, qword [rax + 0x1c8]
mov ecx, ebx
mov rax, qword [rax + rcx*8 + 0x70]
mov rcx, qword [rax + 0x10]
mov rax, qword [rbp + 0x20]
mov rdx, qword [rax + 0x1b8]
call fcn.004100c0
test eax, eax
jne 0x6b44dc
mov ecx, 1
xor rdx, rdx
mov rax, qword [rbp + 0x20]
mov rax, qword [rax + 0x1c8]
mov r8d, ebx
mov rax, qword [rax + r8*8 + 0x70]
mov r8d, dword [rax]
call sub.kernel32.dll_OpenProcess
mov rcx, rax
xor rdx, rdx
call sub.kernel32.dll_TerminateProcess
mov rax, qword [rbp + 0x20]
mov rax, qword [rax + 0x1c8]
mov ecx, ebx
mov rax, qword [rax + rcx*8 + 0x70]
movsxd rax, dword [rax + 0x28]
mov rcx, qword [rbp + 0x20]
mov ecx, dword [rcx + 0x1c0]
cmp rax, rcx
jne 0x6b4546
mov rax, qword [rbp + 0x20]
mov rax, qword [rax + 0x1c8]
mov ecx, ebx
mov rax, qword [rax + rcx*8 + 0x70]
mov rcx, qword [rax + 0x10]
mov rax, qword [rbp + 0x20]
mov rax, qword [rax + 0x1c8]
mov rdx, qword [rax + 0x13940]
call fcn.004100c0
test eax, eax
jne 0x6b4546
mov rax, qword [rbp + 0x20]
mov rax, qword [rax + 0x1c8]
mov ecx, ebx
mov rax, qword [rax + rcx*8 + 0x70]
mov esi, dword [rax]
add ebx, 1
cmp ebx, edi
jne 0x6b4483
nop
mov rax, qword [rbp + 0x20]
mov rax, qword [rax + 0x1c8]
lea rcx, [rax + 0x13910]
call sub.kernel32.dll_LeaveCriticalSection_1
test esi, esi
je 0x6b459a
lea rcx, [rbp + 0x28]
mov rax, qword [rbp + 0x20]
mov rdx, qword [rax + 0x1b8]
lea r8, [0x006b45e0]
call fcn.0040fec0
mov rcx, qword [rbp + 0x28]
mov edx, esi
mov r8d, 0x20
call fcn.006b40c0
nop
lea rcx, [rbp + 0x28]
call fcn.0040e6c0
lea rsp, [rbp + 0x38]
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x140001062
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push rbx
sub rsp, 0x440
mov rax, qword gs:[0x60]
lea rdx, [rsp + 0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rbx, qword [rax + 0x30]
mov rcx, rbx
call fcn.14000102e
mov edx, dword [rsp + 0x98]
lea rax, [rsp + 0x60]
add rdx, rbx
mov qword [rsp + 0x20], rax
and byte [rax - 0x73], cl
and al, 0x20

Function at 0x140001100
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140001120
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
repz ret

Function at 0x140001160
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140001183
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
repz ret

Function at 0x1400011e0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140001203
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
repz ret

Function at 0x140001260
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
xorps xmm5, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
nop dword [rax]
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140001289
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
repz ret
Function at 0x14001c1f0
Capabilities:
Reference processor manufacturer constants

Disassembly:
push rsi
push rdi
push rbx
mov r8, rcx
xor ebx, ebx
xor eax, eax
xor ecx, ecx
xchg rbx, rsi
cpuid
xchg rbx, rsi
test eax, eax
jle 0x14001c302
mov esi, eax
mov eax, 1
xor ecx, ecx
xchg rbx, rdi
cpuid
xchg rbx, rdi
mov r9d, ecx
mov r10d, edx
mov r11d, eax
cmp esi, 7
jb 0x14001c23d
mov eax, 7
xor ecx, ecx
xchg rbx, rbx
cpuid
xchg rbx, rbx
and ebx, 0x20
mov dword [r8], r11d
mov eax, r11d
and eax, 0xf
mov dword [r8 + 8], eax
shr r11d, 0xc
and r11d, 3
mov dword [r8 + 4], r11d
mov eax, r10d
shr eax, 0x17
and al, 1
mov byte [r8 + 0xc], al
mov eax, r10d
shr eax, 0x19
and al, 1
mov byte [r8 + 0xd], al
shr r10d, 0x1a
and r10b, 1
mov byte [r8 + 0xe], r10b
mov eax, r9d
and al, 1
mov byte [r8 + 0xf], al
mov eax, r9d
shr eax, 9
and al, 1
mov byte [r8 + 0x10], al
mov eax, r9d
shr eax, 0x13
and al, 1
mov byte [r8 + 0x11], al
mov eax, r9d
shr eax, 0x14
and al, 1
mov byte [r8 + 0x12], al
mov eax, r9d
shr eax, 0x17
and al, 1
mov byte [r8 + 0x13], al
mov eax, r9d
shr eax, 0x1f
mov byte [r8 + 0x19], al
mov eax, r9d
not eax
test eax, 0x1c000000
jne 0x14001c339
xor ecx, ecx
xgetbv
not eax
test al, 6
sete al
mov byte [r8 + 0x14], al
mov ecx, r9d
shr ecx, 0x19
and cl, 1
mov byte [r8 + 0x17], cl
shr r9d, 0xc
and r9b, 1
mov byte [r8 + 0x15], r9b
test al, al
setne al
test ebx, ebx
setne cl
and cl, al
mov byte [r8 + 0x16], cl
mov eax, 0x80000000
xor ecx, ecx
xchg rbx, rbx
cpuid
xchg rbx, rbx
cmp eax, 0x80000006
jle 0x14001c33d
mov eax, 0x80000007
xor ecx, ecx
xchg rbx, rbx
cpuid
xchg rbx, rbx
shr edx, 8
and dl, 1
mov byte [r8 + 0x18], dl
test dl, dl
je 0x14001c343
pop rbx
pop rdi
pop rsi
ret
xor eax, eax
jmp 0x14001c2d5
mov dl, byte [r8 + 0x18]
jmp 0x14001c331
cmp byte [r8 + 0x19], 0
je 0x14001c335
mov eax, 0x40000000
xor ecx, ecx
xchg rbx, rbx
cpuid
xchg rbx, rbx
cmp ebx, 0x7263694d
jne 0x14001c335
cmp ecx, 0x666f736f
jne 0x14001c335
cmp edx, 0x76482074
jne 0x14001c335
mov byte [r8 + 0x18], 1
jmp 0x14001c335
Function at 0x140024830
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test rdx, rdx
je 0x14002486c
mov rsi, rdx
mov rdi, rcx
mov r14d, 0xffffffff
cmp rsi, r14
mov ebx, 0xffffffff
cmovb rbx, rsi
mov rcx, rdi
mov edx, ebx
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x140024876
add rdi, rbx
sub rsi, rbx
jne 0x14002484a
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
int3

Function at 0x140024880
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rdi
sub rsp, 0x28
cmp qword [0x1400f0088], 0
jne 0x1400248bd
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x1400248b0
mov dword [rdi], eax
mov dword [0x1400f0090], eax
mov qword [0x1400f0088], rsi
cmp eax, 0xffffffff
setne al
add rsp, 0x28
pop rdi
pop rsi
ret
int3
Function at 0x140026f00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov rdi, r8
mov rsi, rdx
mov bl, byte [rbp + 0x68]
test byte [r9 + 8], 1
jne 0x140026f5a
mov dl, byte [rbp + 0x60]
movzx ebx, bl
mov rax, qword [rcx]
mov rax, qword [rax + 0x30]
mov dword [rsp + 0x28], ebx
mov byte [rsp + 0x20], dl
mov rdx, rsi
mov r8, rdi
call qword [0x1400fd008]
mov rax, rsi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
lea r14, [rbp - 0x20]
mov rcx, r9
mov rdx, r14
call fcn.140050850
lea rdx, [0x1400f0a68]
mov rcx, r14
call fcn.140051060
mov r14, rax
mov rcx, qword [rbp - 0x20]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
test eax, eax
jne 0x140026f9a
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x1400fd008]
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r15, [rbp - 0x20]
mov qword [r15 + 0x10], rax
movaps xmm0, xmmword [0x1400d09d0]
movaps xmmword [r15], xmm0
mov rax, qword [r14]
xor bl, 1
movzx ecx, bl
mov rax, qword [rax + rcx*8 + 0x28]
mov rcx, r14
mov rdx, r15
call qword [0x1400fd008]
movzx r9d, byte [r15 + 0x17]
test r9b, r9b
mov rcx, qword [r15]
mov r8, qword [r15 + 8]
mov rax, r9
cmovs rax, r8
test rax, rax
je 0x140027061
test r9b, r9b
mov rbx, r15
cmovs rbx, rcx
test rdi, rdi
je 0x140027046
mov al, byte [rbx]
movzx eax, al
mov rcx, qword [rdi + 0x30]
cmp rcx, qword [rdi + 0x38]
je 0x14002704a
lea rdx, [rcx + 1]
mov qword [rdi + 0x30], rdx
mov byte [rcx], al
cmp eax, 0xffffffff
jne 0x14002701b
xor edi, edi
mov r9b, byte [rbp - 9]
mov rcx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x18]
inc rbx
test r9b, r9b
mov rax, r15
cmovs rax, rcx
movzx edx, r9b
cmovs rdx, r8
add rdx, rax
cmp rbx, rdx
jne 0x140026ff6
jmp 0x140027061
xor edi, edi
jmp 0x140027027
mov rcx, qword [rdi]
mov r8, qword [rcx + 0x60]
mov rcx, rdi
mov edx, eax
mov rax, r8
call qword [0x1400fd008]
jmp 0x140027014
shr r9b, 7
mov qword [rsi], rdi
test r9b, r9b
je 0x140026f4a
call fcn.1400698a8
jmp 0x140026f4a

Function at 0x14002efe0
Capabilities:
Create thread

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov ecx, 0x10
call fcn.14006986c
mov qword [rax], rdi
mov qword [rax + 8], rsi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x14002f050]
xor ecx, ecx
xor edx, edx
mov r9, rax
call fcn.140078a24
mov qword [rbx], rax
test rax, rax
je 0x14002f037
xor eax, eax
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
Function at 0x14002f440
Capabilities:
Accept command line arguments

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
mov rax, qword [0x1400e4028]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, qword [0x1400f17a8]
test rdi, rdi
jne 0x14002f4e3
mov ecx, 0x48
call fcn.14006986c
mov rsi, rax
xorps xmm6, xmm6
movups xmmword [rax], xmm6
mov ecx, 0x18
call fcn.14006986c
mov qword [rsi + 0x10], rax
lea rcx, [rax + 0x18]
mov qword [rsi + 0x20], rcx
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
mov qword [rsi + 0x18], rcx
lea rax, [rsi + 0x30]
movups xmmword [rsi + 0x30], xmm6
mov qword [rsi + 0x28], rax
mov qword [rsi + 0x40], 1
mov qword [0x1400f17a8], rsi
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x28], rax
test rax, rax
je 0x14002f505
mov rcx, rax
call fcn.140083a98
lea rdx, [rsp + 0x28]
mov qword [rdx + 8], rax
mov rcx, rsi
call fcn.14002f510
test rdi, rdi
sete bl
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14006ac50
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
int3
Function at 0x14002f510
Capabilities:
Accept command line arguments

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
movaps xmmword [rsp + 0x70], xmm6
mov rsi, rdx
mov rbx, rcx
mov rax, qword [0x1400e4028]
xor rax, rsp
mov qword [rsp + 0x68], rax
movups xmm0, xmmword [rdx]
lea rdx, [rsp + 0x50]
movaps xmmword [rdx], xmm0
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r8d, 3
call fcn.1400364c0
movups xmm0, xmmword [rdi]
movups xmmword [rsi], xmm0
cmp qword [rsi + 8], 0
je 0x14002f70e
movups xmm0, xmmword [rsi]
movups xmmword [rbx], xmm0
mov dword [rsp + 0x4c], 0
lea rcx, str.api_ms_win_downlevel_shell32_l1_1_0.dll
xor edx, edx
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test rax, rax
mov qword [rsp + 0x20], rax
je 0x14002f766
lea rdx, [0x1400d39de]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14002f779
mov rcx, qword [rsi]
lea rdx, [rsp + 0x4c]
call qword [0x1400fd008]
mov r12, rax
movsxd rbp, dword [rsp + 0x4c]
xorps xmm6, xmm6
movaps xmmword [rsp + 0x30], xmm6
mov qword [rsp + 0x40], 0
test rbp, rbp
mov qword [rsp + 0x28], rbx
je 0x14002f781
shl rbp, 3
movabs rax, 0x5555555555555551
cmp rbp, rax
jae 0x14002f788
lea rsi, [rbp*2]
add rsi, rbp
mov rcx, rsi
call fcn.14006986c
mov rbx, rax
mov qword [rsp + 0x30], rax
add rax, rsi
mov qword [rsp + 0x40], rax
xor r15d, r15d
mov rsi, qword [r12 + r15]
mov rcx, rsi
call fcn.140083a98
mov rdi, rax
movabs rax, 0x7fffffffffffffef
cmp rdi, rax
ja 0x14002f75e
cmp rdi, 0xb
jae 0x14002f670
mov byte [rbx + 0x17], dil
test rdi, rdi
je 0x14002f66b
cmp rdi, 3
jne 0x14002f6cc
movzx eax, word [rsi + 4]
mov word [rbx + 4], ax
mov eax, dword [rsi]
mov dword [rbx], eax
mov r13, rbx
jmp 0x14002f6b1
lea r14, [rdi + 8]
and r14, 0xfffffffffffffff8
lea rcx, [r14 + r14]
call fcn.14006986c
mov r13, rax
mov qword [rbx], rax
movabs rax, 0x7fffffffffffffef
add rax, 0x11
or rax, r14
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], rdi
mov r8, rdi
add r8, rdi
mov rcx, r13
mov rdx, rsi
call fcn.14006c6c0
mov word [r13 + rdi*2], 0
add rbx, 0x18
add r15, 8
cmp rbp, r15
jne 0x14002f628
jmp 0x14002f6d1
mov r13, rbx
jmp 0x14002f6a0
mov qword [rsp + 0x38], rbx
lea rdx, [rsp + 0x30]
mov rsi, qword [rsp + 0x28]
mov rcx, rsi
call fcn.14002f290
movups xmmword [rsi], xmm6
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x14002f704
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rsi, qword [rsp + 0x30]
test rsi, rsi
jne 0x14002f734
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14006ac50
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
cmp rbx, rsi
je 0x14002f754
lea rdi, [rbx - 0x18]
cmp byte [rbx - 1], 0
jns 0x14002f74c
mov rcx, qword [rbx - 0x18]
call fcn.1400698a8
mov rbx, rdi
cmp rdi, rsi
jne 0x14002f739
mov rcx, rsi
call fcn.1400698a8
jmp 0x14002f70e
mov rcx, rbx
call fcn.1400b1d60
mov rcx, qword [rsi]
lea rdx, [rsp + 0x4c]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
jmp 0x14002f5c4
xor r12d, r12d
jmp 0x14002f5c7
xor ebx, ebx
jmp 0x14002f6d6
lea rcx, [rsp + 0x30]
call fcn.140097480
int3
Function at 0x140030890
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
movaps xmmword [rsp + 0x80], xmm6
mov rax, qword [0x1400e4028]
xor rax, rsp
mov qword [rsp + 0x78], rax
movzx eax, byte [0x1400f17b8]
and eax, 1
neg rax
cmp rax, 0xfffffffffffffffd
je 0x140030a37
mov qword [rsp + 0x40], rdx
mov rbx, qword [rcx]
mov qword [rsp + 0x38], rcx
mov rdi, qword [rcx + 8]
xor r13d, r13d
lea r12, str._:_r_
movabs rcx, 0xaaaaaaaaaaaaaaaa
movaps xmm6, xmmword [0x1400d09d0]
lea rsi, [rsp + 0x60]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x48], rbx
mov rbx, qword [rsp + 0x48]
mov rax, r13
shl rax, 4
mov qword [rsp + 0x70], rcx
movaps xmmword [rsp + 0x60], xmm6
mov rdx, qword [rax + r12]
mov rbp, qword [rax + r12 + 8]
mov byte [rsp + 0x77], bpl
mov r8, rbp
add r8, rbp
mov r15, rsi
mov rcx, rsi
call fcn.14006c6c0
mov word [rsp + rbp*2 + 0x60], 0
movzx eax, byte [rsp + 0x77]
mov rcx, rax
test al, al
jns 0x140030959
mov rcx, qword [rsp + 0x68]
cmp rcx, rdi
ja 0x140030a91
mov r14b, 1
test rcx, rcx
mov rsi, r15
je 0x140030a9c
mov rdx, rsi
test al, al
jns 0x14003097d
mov rdx, qword [rsp + 0x60]
xor ebp, ebp
movzx edi, word [rbx + rbp*2]
cmp di, word [rdx + rbp*2]
jne 0x1400309ce
inc rbp
cmp rcx, rbp
jne 0x14003097f
mov rbp, rcx
test al, al
js 0x140030aa3
test r14b, r14b
jne 0x1400309d8
mov qword [rsp + 0x28], rbp
inc r13
movzx eax, byte [0x1400f17b8]
xor rax, 3
cmp r13, rax
mov rdi, qword [rsp + 0x30]
movabs rcx, 0xaaaaaaaaaaaaaaaa
jb 0x140030911
jmp 0x140030a37
xor r14d, r14d
mov rbp, qword [rsp + 0x28]
jmp 0x140030994
test rbp, rbp
je 0x140030a37
mov rsi, qword [rsp + 0x38]
cmp rbp, qword [rsi + 8]
mov rdi, qword [rsp + 0x40]
je 0x140030a37
lea rax, [0x1400d3980]
lea rdx, [rsp + 0x60]
mov qword [rdx], rax
mov qword [rdx + 8], 1
movups xmm0, xmmword [rsi]
lea rcx, [rsp + 0x50]
movaps xmmword [rcx], xmm0
xor r8d, r8d
call fcn.1400596e0
mov rdx, qword [rsi + 8]
sub rdx, rbp
jb 0x140030ab5
mov rcx, qword [rdi + 8]
sub rax, rbp
cmp rdx, rax
cmovb rax, rdx
cmp rax, rcx
je 0x140030a64
xor ebx, ebx
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14006ac50
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x80]
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov bl, 1
test rcx, rcx
je 0x140030a39
mov rax, qword [rdi]
add rbp, rbp
add rbp, qword [rsi]
xor edx, edx
mov rdi, rbp
movzx ebp, word [rbp + rdx*2]
cmp bp, word [rax + rdx*2]
jne 0x140030a37
inc rdx
cmp rcx, rdx
mov rbp, rdi
jne 0x140030a76
jmp 0x140030a39
xor r14d, r14d
mov rsi, r15
jmp 0x1400309d1
xor ebp, ebp
jmp 0x140030994
mov rcx, qword [rsp + 0x60]
call fcn.1400698a8
mov rsi, r15
jmp 0x14003099c
int3