joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400707b0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je case.default.0x1400707d1
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x1400707fe
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140070800
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140070859
test ecx, ecx
jle 0x140070839
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140070859
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140070859
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
std
Function at 0x140070880
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x1400708a2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je case.default.0x1400708b1
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x1400708d4
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1400708d6
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140070912
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x1400709ae
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x14007094d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x14007098e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x1400709ae
cmp rbx, rax
ja 0x140070960
test rbx, rbx
je 0x1400709ae
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x140070e20
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140162080]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x140070e4d
xor eax, eax
jmp 0x140070fb9
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140070e87
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x140070e87
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140070fb9
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x140070fac
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140070eca
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140070ef5
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140070fb1
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140070f64
sub eax, 1
je 0x140070f64
cmp eax, 2
jne 0x140070fac
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140070fb1
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140070f92
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x140070fac
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x140070fb1
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140104d30
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140071480
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140162080]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140071553
cmp byte [rcx + 0x71], 0
je 0x140071553
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + Ordinal_26]
cmp eax, 0xffffffff
je 0x14007154f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140071514
sub eax, 1
je 0x140071518
cmp eax, 2
jne 0x14007154f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140104d30
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140071546
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14007154f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1400714fc
xor al, al
jmp 0x1400714fc
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140104d30
add rsp, 0x60
pop rbx
ret
Function at 0x1400746a0
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x50
mov rax, qword [0x140162080]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor edx, edx
lea r9, [rsp + 0x20]
mov rsi, rcx
xor r14d, r14d
xor r8d, r8d
mov dword [rsp + 0x20], r14d
mov ebx, r14d
lea ecx, [rdx + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x14007472e
test rbx, rbx
je 0x1400746f6
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rax
mov ecx, ntohl
mov rbx, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x1400746e0
test eax, eax
jns 0x14007474f
test rbx, rbx
je 0x140074754
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
jmp 0x140074852
test rbx, rbx
jne 0x14007475b
xor eax, eax
jmp 0x140074852
mov qword [rsp + 0x78], rbp
mov qword [rsp + 0x80], rdi
mov edi, r14d
cmp dword [rbx], r14d
jbe 0x140074832
mov eax, edi
xorps xmm0, xmm0
imul rcx, rax, 0x128
movups xmmword [rsp + 0x28], xmm0
movzx edx, word [rcx + rbx + 0x2e]
lea rbp, [rcx + rbx]
add rdx, 0x30
mov qword [rsp + 0x38], r14
add rdx, rcx
mov qword [rsp + 0x40], r14
add rdx, rbx
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rdx + r8], r14b
jne 0x1400747b0
lea rcx, [rsp + 0x28]
call fcn.140069f60
cmp qword [rsi + 0x18], 0xf
mov rdx, rsi
jbe 0x1400747d0
mov rdx, qword [rsi]
cmp qword [rsp + 0x40], 0xf
lea rcx, [rsp + 0x28]
cmova rcx, qword [rsp + 0x28]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x140074868
mov rdx, qword [rsp + 0x40]
cmp rdx, 0xf
jbe 0x140074828
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140074823
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400748b1
call fcn.140105460
inc edi
cmp edi, dword [rbx]
jb 0x140074774
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rbp, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140104d30
add rsp, 0x50
pop r14
pop rsi
pop rbx
ret
mov rdi, qword [rbp + 0x18]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, qword [rsp + 0x40]
cmp rdx, 0xf
jbe 0x1400748bd
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400748b8
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400748b8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140105460
mov rax, rdi
jmp 0x140074845
Function at 0x1400754f0
Capabilities:
Interact with driver via ioctl

Disassembly:
mov r11, rsp
sub rsp, 0x78
mov rax, qword [0x140162080]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov eax, dword [0x140470e80]
xor r9d, r9d
cmp byte [0x140470e90], r9b
mov qword [r11 - 0x40], r9
mov qword [r11 - 0x48], r9
mov dword [r11 - 0x50], r9d
mov dword [r11 - 0x34], r9d
mov qword [r11 - 0x30], rcx
mov rcx, qword [0x140470e88]
mov qword [r11 - 0x28], rdx
mov edx, 0x222404
mov qword [r11 - 0x20], r8
lea r8, [r11 - 0x38]
mov qword [r11 - 0x58], r9
mov r9d, reloc.WLDAP32.dll_Ordinal_32
mov dword [rsp + 0x40], eax
jne 0x140075557
mov edx, 0x220c58
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
setne al
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140104d30
add rsp, 0x78
ret

Function at 0x140075580
Capabilities:
Interact with driver via ioctl

Disassembly:
mov r11, rsp
sub rsp, 0x78
mov rax, qword [0x140162080]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor r9d, r9d
mov eax, r8d
cmp byte [0x140470e90], r9b
lea r8, [r11 - 0x38]
mov qword [r11 - 0x40], r9
mov qword [r11 - 0x48], r9
mov dword [r11 - 0x50], r9d
mov qword [r11 - 0x20], rax
mov eax, dword [0x140470e80]
mov dword [r11 - 0x34], r9d
mov qword [r11 - 0x30], rcx
mov rcx, qword [0x140470e88]
mov qword [r11 - 0x28], rdx
mov edx, 0x222404
mov qword [r11 - 0x58], r9
mov r9d, reloc.WLDAP32.dll_Ordinal_32
mov dword [rsp + 0x40], eax
jne 0x1400755ea
mov edx, 0x220c58
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
setne al
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140104d30
add rsp, 0x78
ret
Function at 0x140086d90
Capabilities:
Create directory
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x140162080]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rsi, rcx
mov qword [rbp - 0x28], rcx
xor edi, edi
mov dword [rbp - 0x30], edi
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x18], rdi
mov byte [rbp - 0x38], Ordinal_211
mov byte [rbp - 0x37], 0xce
mov byte [rbp - 0x36], Ordinal_200
mov byte [rbp - 0x35], Ordinal_217
mov byte [rbp - 0x34], 0xd5
mov byte [rbp - 0x33], Ordinal_200
mov byte [rbp - 0x32], 0xd4
mov byte [rbp - 0x31], 0xb1
movzx eax, byte [rbp - 0x38]
mov r9d, edi
movabs r11, 0x77549627af8c43b4
mov r10, r11
lea rax, [rbp - 0x38]
sub r10, rax
lea r14d, [rdi + 0xf]
nop word [rax + rax]
lea rdx, [rbp - 0x38]
add rdx, r9
movsx r8, byte [rdx]
mov rcx, r9
and ecx, r14d
cmp rcx, r14
cmovae rcx, r14
shl cl, 2
mov rax, r11
shr rax, cl
and al, r14b
add dl, r10b
xor al, dl
xor al, r8b
mov byte [rbp + r9 - 0x38], al
inc r9
cmp r9, 8
jb 0x140086e10
lea r8, [rbp - 0x38]
lea rdx, [rbp - 0x18]
lea rcx, [rbp - 0x20]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__dupenv_s]
test eax, eax
jne 0x140086f7a
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x140086f7a
mov edx, 0x104
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strnlen]
test rax, rax
je 0x140086f7a
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], rdi
mov qword [rsi + 0x18], r14
mov byte [rsi], dil
mov dword [rbp - 0x30], 1
mov rdx, qword [rbp - 0x20]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x140086eb0
mov rcx, rsi
call fcn.140066340
mov byte [rbp - 0x40], 0xbc
mov byte [rbp - 0x3f], 0xaf
mov byte [rbp - 0x3e], 0x92
mov byte [rbp - 0x3d], Ordinal_143
mov byte [rbp - 0x3c], 0x9c
mov byte [rbp - 0x3b], 0xad
mov byte [rbp - 0x3a], 0xf9
movzx eax, byte [rbp - 0x40]
movabs r10, 0xe89972e75d2f57ee
mov r9, r10
lea rax, [rbp - 0x40]
sub r9, rax
nop word [rax + rax]
lea rdx, [rbp - 0x40]
add rdx, rdi
movzx r8d, byte [rdx]
mov rcx, rdi
and ecx, 0xf
cmp rcx, 0xf
cmovae rcx, r14
shl cl, 2
mov rax, r10
shr rax, cl
and al, 0xf
add dl, r9b
xor al, dl
xor al, r8b
mov byte [rbp + rdi - 0x40], al
inc rdi
cmp rdi, 7
jb 0x140086f00
lea rax, [rbp - 0x40]
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140086f40
mov r8, rbx
lea rdx, [rbp - 0x40]
mov rcx, rsi
call fcn.140066340
mov rcx, rsi
cmp qword [rsi + 0x18], 0xf
jbe 0x140086f65
mov rcx, qword [rsi]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, rsi
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140104d30
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140086fa0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x60
mov rbx, rcx
mov qword [rsp + 0x20], rcx
xor edi, edi
mov byte [rax - 0x48], 0x3c
mov byte [rax - 0x47], 8
mov byte [rax - 0x46], 1
mov byte [rax - 0x45], 0x14
mov byte [rax - 0x44], 0x42
mov byte [rax - 0x43], 1
mov byte [rax - 0x42], 0x1d
mov byte [rax - 0x41], 4
mov byte [rax - 0x40], 7
mov byte [rax - 0x3f], 0x6d
movzx eax, byte [rax - 0x48]
mov r9d, edi
movabs r11, 0xd41da050424a264
mov r10, r11
lea rax, [rsp + 0x20]
sub r10, rax
lea esi, [rdi + 0xf]
lea rdx, [rsp + 0x20]
add rdx, r9
movsx r8, byte [rdx]
mov rcx, r9
and ecx, esi
cmp rcx, rsi
cmovae rcx, rsi
shl cl, 2
mov rax, r11
shr rax, cl
and al, sil
add dl, r10b
xor al, dl
xor al, r8b
mov byte [rsp + r9 + 0x20], al
inc r9
cmp r9, 0xa
jb 0x140087001
lea rcx, [rsp + 0x38]
call fcn.140086d90
nop
lea rcx, [rsp + 0x20]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rcx + r8], 0
jne 0x140087052
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.140066340
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], rsi
mov byte [rax], 0
mov rdx, qword [rsp + 0x50]
cmp rdx, 0xf
jbe 0x1400870d0
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400870cb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400870cb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140105460
mov rax, rbx
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
Function at 0x140088df0
Capabilities:
Get session user name

Disassembly:
push rbx
sub rsp, 0x250
mov rax, qword [0x140162080]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov qword [rsp + 0x28], rcx
lea rdx, [rsp + 0x28]
mov rbx, rcx
mov dword [rsp + 0x28], 0x101
lea rcx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140071210
mov rax, rbx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140104d30
add rsp, 0x250
pop rbx
ret
Function at 0x140088e60
Capabilities:
Delete file
Query environment variable

Disassembly:
sub rsp, 0x248
mov rax, qword [0x140162080]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov r8d, 0x104
lea rdx, [rsp + 0x20]
lea rcx, str.USERPROFILE
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0x103
ja 0x140088f49
lea r8, str.AppDataLocalEpicGamesLauncherSavedConfigWindowsGameUserSettings.ini
mov edx, 0x104
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140088f0c
mov qword [rsp + 0x240], rbx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Error_deleting_file:
mov ebx, eax
call fcn.1400738c0
mov edx, ebx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140073a90]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rbx, qword [rsp + 0x240]
jmp 0x140088f6c
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.File_deleted_successfully.
call fcn.1400738c0
lea rdx, [0x140073a90]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor eax, eax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140104d30
add rsp, 0x248
ret
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Error_getting_USERPROFILE_environment_variable.
call fcn.1400738c0
lea rdx, [0x140073a90]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov eax, 1
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140104d30
add rsp, 0x248
ret
Function at 0x140088f90
Capabilities:
Execute command

Disassembly:
sub rsp, 0x28
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.___Disabling_adapters...
call fcn.1400738c0
lea rdx, [0x140073a90]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.WMIC_PATH_WIN32_NETWORKADAPTER_WHERE_PHYSICALADAPTERTRUE_CALL_DISABLE__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.___Enabling_adapters...
call fcn.1400738c0
lea rdx, [0x140073a90]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.WMIC_PATH_WIN32_NETWORKADAPTER_WHERE_PHYSICALADAPTERTRUE_CALL_ENABLE__nul_2_1
add rsp, 0x28
jmp qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
Function at 0x14008af40
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x30], 0
je 0x14008af63
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x2b]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x2f
jb 0x14008af50
mov byte [rcx + 0x30], 0
mov rax, rcx
ret

Function at 0x14008af70
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x3c], 0
je 0x14008af93
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x2b]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x3b
jb 0x14008af80
mov byte [rcx + 0x3c], 0
mov rax, rcx
ret

Function at 0x14008afa0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x27], 0
je 0x14008afc3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x2b]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x26
jb 0x14008afb0
mov byte [rcx + 0x27], 0
mov rax, rcx
ret

Function at 0x14008afd0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x29], 0
je 0x14008aff3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x2b]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x28
jb 0x14008afe0
mov byte [rcx + 0x29], 0
mov rax, rcx
ret

Function at 0x14008b000
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x25], 0
je 0x14008b023
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x2b]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x24
jb 0x14008b010
mov byte [rcx + 0x25], 0
mov rax, rcx
ret

Function at 0x14008b030
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x3b], 0
je 0x14008b053
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x2b]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x3a
jb 0x14008b040
mov byte [rcx + 0x3b], 0
mov rax, rcx
ret