joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140019a70
Capabilities:
Copy file
Move file

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x14006b088]
xor rax, rsp
mov qword [rbp + 0x70], rax
mov rdi, r8
mov rsi, rdx
mov byte [rsp + 0x38], 0
mov qword [rsp + 0x20], 0x3e
lea r9, str.CFiles::ReplaceWithRebootDelay
mov r8d, 0x22
lea rdx, str.PIE_Common_Files
lea rcx, [rbp - 0x50]
call fcn.140011450
lea rax, vtable.CTracePieCommonFiles.0
mov qword [rbp - 0x50], rax
mov ebx, 1
mov qword [rsp + 0x58], 7
xor r14d, r14d
mov qword [rsp + 0x50], r14
mov word [rsp + 0x40], r14w
cmp word [rdi], r14w
jne 0x140019b05
mov r8d, r14d
jmp 0x140019b1a
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rdi + r8*2], r14w
jne 0x140019b10
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.140007f20
nop
lea r8, str..replace
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x70]
call fcn.14000b000
nop
mov r8, qword [rsp + 0x58]
cmp r8, 8
jb 0x140019b5b
inc r8
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x40]
call fcn.140008b70
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], r14
mov word [rsp + 0x40], r14w
lea rdx, [rbp - 0x70]
cmp qword [rbp - 0x58], 8
cmovae rdx, qword [rbp - 0x70]
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x140019bd3
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 8
cmovae rcx, qword [rbp - 0x70]
mov r8d, 5
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x140019bf8
call qword [sym.imp.KERNEL32.dll_GetLastError]
movups xmm0, xmmword [rbp - 0x70]
movaps xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rbp - 0x60]
movaps xmmword [rbp - 0x80], xmm1
lea r9, [rsp + 0x70]
lea r8, str.Failed_to_move___ws___error_code:__d
jmp 0x140019be3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9, rsi
lea r8, str.Failed_to_copy___ws___error_code:__d
mov dword [rsp + 0x20], eax
mov edx, 2
lea rcx, [rbp - 0x50]
call fcn.140011590
mov ebx, r14d
lea rcx, str.TRUE
lea rax, str.FALSE
test ebx, ebx
cmovne rax, rcx
mov qword [rsp + 0x20], rax
lea r9, str.result
lea r8, str.____returned__s___s
mov edx, 4
lea rcx, [rbp - 0x50]
call fcn.140011590
mov al, 1
mov byte [rbp + 0x60], al
mov r8, qword [rbp - 0x58]
cmp r8, 8
jb 0x140019c50
inc r8
mov rdx, qword [rbp - 0x70]
lea rcx, [rbp - 0x70]
call fcn.140008b70
movzx eax, byte [rbp + 0x60]
mov qword [rbp - 0x58], 7
mov qword [rbp - 0x60], r14
mov word [rbp - 0x70], r14w
lea rcx, vtable.CTracePie.0
mov qword [rbp - 0x50], rcx
cmp byte [rbp + 0x61], 1
jne 0x140019c8c
test al, al
jne 0x140019c8c
lea r8, [0x140056e3c]
mov edx, 5
lea rcx, [rbp - 0x50]
call fcn.140011590
nop
mov eax, ebx
mov rcx, qword [rbp + 0x70]
xor rcx, rsp
call fcn.14001e5b0
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140019cc0
Capabilities:
Get common file path

Disassembly:
push rdi
sub rsp, 0x130
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x140], rbx
mov rax, qword [0x14006b088]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov rdi, rdx
mov qword [rsp + 0x50], rdx
xor ebx, ebx
mov dword [rsp + 0x40], ebx
mov byte [rsp + 0x38], bl
mov qword [rsp + 0x20], 0x38
lea r9, str.CFiles::GetProgramFilesPath
lea r8d, [rbx + 0x22]
lea rdx, str.PIE_Common_Files
lea rcx, [rsp + 0x60]
call fcn.140011450
lea rax, vtable.CTracePieCommonFiles.0
mov qword [rsp + 0x60], rax
lea r9, [rsp + 0x58]
xor r8d, r8d
xor edx, edx
lea rcx, [0x140040b30]
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
mov rdx, qword [rsp + 0x58]
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], rbx
cmp qword [rdi + 0x18], 8
jb 0x140019d63
mov rax, qword [rdi]
jmp 0x140019d66
mov rax, rdi
mov word [rax], bx
cmp word [rdx], 0
je 0x140019d7d
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rdx + rbx*2], 0
jne 0x140019d73
mov r8, rbx
mov rcx, rdi
call fcn.140007f20
mov dword [rsp + 0x40], 1
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
cmp qword [rdi + 0x18], 8
jb 0x140019da7
mov r9, qword [rdi]
jmp 0x140019daa
mov r9, rdi
lea r8, str.Program_files_path:__ws
mov edx, 4
lea rcx, [rsp + 0x60]
call fcn.140011590
nop
lea rax, vtable.CTracePie.0
mov qword [rsp + 0x60], rax
cmp byte [rsp + 0x111], 1
jne 0x140019df8
cmp byte [rsp + 0x110], 0
jne 0x140019df8
lea r8, [0x140056e3c]
mov edx, 5
lea rcx, [rsp + 0x60]
call fcn.140011590
nop
mov rax, rdi
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.14001e5b0
mov rbx, qword [rsp + 0x140]
add rsp, 0x130
pop rdi
ret
Function at 0x1400067d0
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov qword [rsp + 0x28], 0
lea rsi, [rsp + 0x28]
mov rcx, rsi
call sub.USER32.dll_GetCursorPos
mov edi, dword [rsp + 0x28]
mov ebx, dword [rsp + 0x2c]
nop word cs:[rax + rax]
xor ecx, ecx
mov edx, 0x1dcd6500
call fcn.1401a8c40
mov qword [rsp + 0x28], 0
mov rcx, rsi
call sub.USER32.dll_GetCursorPos
cmp edi, dword [rsp + 0x28]
jne 0x14000683c
cmp ebx, dword [rsp + 0x2c]
je 0x140006800
jmp 0x14000683c
xor ecx, ecx
mov edx, 0x1dcd6500
call fcn.1401a8c40
call fcn.140003290
test al, al
je 0x140006830
call fcn.140002f50
test al, al
je 0x140006830
call fcn.140003860
test al, al
je 0x140006830
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400159b0
Capabilities:
Encode data using base64

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov qword [rbp], 0xfffffffffffffffe
mov r14, rdx
mov r15, qword [rcx + 0x10]
mov qword [rbp - 8], rcx
mov r13, qword [rcx + 0x18]
test r13, r13
je 0x140015a1f
xor edi, edi
mov rax, r13
shr rax, 0x3d
sete al
jne 0x140015b66
lea r12, [r13*4]
mov dil, al
shl rdi, 2
test r12, r12
je 0x140015a29
mov rcx, r12
mov rdx, rdi
call fcn.140001150
mov rbx, rax
test rbx, rbx
jne 0x140015a35
jmp 0x140015b6d
mov ebx, 4
xor r12d, r12d
jmp 0x140015a35
mov rbx, rdi
test rbx, rbx
je 0x140015b6d
mov qword [rbp - 0x20], r13
mov qword [rbp - 0x18], rbx
mov rcx, rbx
mov rdx, r15
mov r8, r12
call fcn.1401d84a0
mov qword [rbp - 0x10], r13
mov r9, qword [r14 + 0x138]
movzx ecx, byte [r14 + 0x108]
shr r9, cl
test r9, r9
mov r8, qword [rbp - 8]
je 0x140015ad4
xor edi, edi
jmp 0x140015a7f
mov rax, qword [r8 + 0x10]
mov dword [rax + rdi*4], esi
inc rdi
cmp rdi, r9
je 0x140015ad4
mov rcx, qword [r8]
and ecx, 0x3f
mov rax, rdi
shl rax, cl
cmp rdi, r13
je 0x140015b52
mov edx, dword [rbx + rdi*4]
cmp edx, eax
je 0x140015a77
nop dword [rax + rax]
mov esi, edx
mov edx, edx
shr rdx, cl
cmp rdx, r13
jae 0x140015b3e
mov edx, dword [rbx + rdx*4]
cmp edx, eax
jne 0x140015aa0
mov rdx, qword [r8 + 0x18]
cmp rdi, rdx
jb 0x140015a70
lea r8, [0x1401f74c0]
mov rcx, rdi
call fcn.1401f2a90
jmp 0x140015b78
lea rdi, [r8 + 8]
mov rcx, r14
mov rdx, rdi
call fcn.14005a580
test r13, r13
je 0x140015afd
shl r13, 2
mov r8d, 4
mov rcx, rbx
mov rdx, r13
call fcn.140001160
mov rdx, qword [rdi]
test rdx, rdx
mov rax, qword [rbp - 8]
je 0x140015b2c
mov rcx, qword [rax + 0x10]
shl rdx, 2
mov r8d, 4
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
jmp fcn.140001160
nop
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea r8, [0x1401f74a8]
mov rcx, rdx
mov rdx, r13
call fcn.1401f2a90
jmp 0x140015b78
lea r8, [0x1401f7490]
mov rcx, r13
mov rdx, r13
call fcn.1401f2a90
jmp 0x140015b78
call fcn.1401bf0a0
jmp 0x140015b78
mov rcx, r12
mov rdx, rdi
call fcn.1401f27a0
ud2
Function at 0x14003bbd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
cmp edx, 0x1ff
jg 0x14003bc74
dec edx
cmp edx, 0x3f
ja case.0x14003bc02.64
mov esi, 0x3600
xor eax, eax
lea rbx, [0x14003bd84]
movsxd rdx, dword [rbx + rdx*4]
add rdx, rbx
jmp rdx
movzx edx, byte [rcx]
test rdx, rdx
je 0x14003bc3f
lea ecx, [rdx - 1]
mov eax, 1
xor edi, edi
shld rdi, rax, cl
mov ebx, ecx
shr bl, 7
movzx ebx, bl
xor esi, esi
shl rax, cl
test cl, 0x40
cmovne rdi, rax
cmovne rax, rsi
shl rbx, 4
or qword [r8 + rbx], rax
or qword [r8 + rbx + 8], rdi
mov esi, 1
xor eax, eax
mov ecx, edx
shld rax, rsi, cl
xor ebx, ebx
shl rsi, cl
test dl, 0x40
cmovne rax, rsi
cmovne rsi, rbx
shr rdx, 3
and edx, 0xfffffff0
add r8, rdx
or qword [r8], rsi
or qword [r8 + 8], rax
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
cmp edx, 0x1fff
jle 0x14003bc94
cmp edx, 0x7fff
jle case.0x14003bc02.64
cmp edx, 0x8000
je case.0x14003bc02.64
cmp edx, 0x20000
jmp case.0x14003bc02.64
cmp edx, 0x7ff
xor r9d, r9d
mov r10d, 1
lea r14, [0x1401fb848]
xor r11d, r11d
jmp 0x14003bcef
xor eax, eax
mov ecx, esi
shld rax, r10, cl
shr cl, 7
movzx edx, cl
mov edi, 1
mov ecx, esi
shl rdi, cl
test sil, 0x40
cmovne rax, rdi
cmovne rdi, r9
shl rdx, 4
or qword [r8 + rdx], rdi
or qword [r8 + rdx + 8], rax
movzx eax, bp
cmp eax, 0xff
jae case.0x14003bc02.1
mov ecx, r11d
movzx eax, r11w
cmp eax, 0x100
mov ebp, 0xff
cmovae ebp, eax
movzx edi, al
mov r11d, ebp
inc r11d
mov ebx, ecx
nop
cmp bp, bx
je 0x14003bd40
mov esi, ebx
lea ebx, [rsi + 1]
movzx edx, bl
cmp byte [rdi + r14], 0
sete al
cmp byte [rdx + r14], 0
setne dl
xor dl, al
jne 0x14003bd10
mov ebp, esi
mov r11d, ebx
test cl, cl
jne 0x14003bd4c
jmp 0x14003bcb0
mov si, 0xff
test cl, cl
je 0x14003bcb0
dec cl
xor eax, eax
shld rax, r10, cl
mov edx, ecx
shr dl, 7
movzx edx, dl
mov edi, 1
shl rdi, cl
test cl, 0x40
cmovne rax, rdi
cmovne rdi, r9
shl rdx, 4
or qword [r8 + rdx], rdi
or qword [r8 + rdx + 8], rax
jmp 0x14003bcb0
ud2
Function at 0x1400766f0
Capabilities:
Encode data using base64

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov qword [rbp], 0xfffffffffffffffe
mov r14, rdx
mov r15, qword [rcx + 0x10]
mov qword [rbp - 8], rcx
mov r13, qword [rcx + 0x18]
test r13, r13
je 0x14007675f
xor edi, edi
mov rax, r13
shr rax, 0x3d
sete al
jne 0x1400768a6
lea r12, [r13*4]
mov dil, al
shl rdi, 2
test r12, r12
je 0x140076769
mov rcx, r12
mov rdx, rdi
call fcn.140001150
mov rbx, rax
test rbx, rbx
jne 0x140076775
jmp 0x1400768ad
mov ebx, 4
xor r12d, r12d
jmp 0x140076775
mov rbx, rdi
test rbx, rbx
je 0x1400768ad
mov qword [rbp - 0x20], r13
mov qword [rbp - 0x18], rbx
mov rcx, rbx
mov rdx, r15
mov r8, r12
call fcn.1401d84a0
mov qword [rbp - 0x10], r13
mov r9, qword [r14 + 0x148]
test r9, r9
mov r8, qword [rbp - 8]
je 0x140076814
xor edi, edi
jmp 0x1400767bf
mov rax, qword [r8 + 0x10]
mov dword [rax + rdi*4], esi
inc rdi
cmp rdi, r9
je 0x140076814
mov rcx, qword [r8]
and ecx, 0x3f
mov rax, rdi
shl rax, cl
cmp rdi, r13
je 0x140076892
mov edx, dword [rbx + rdi*4]
cmp edx, eax
je 0x1400767b7
nop dword [rax + rax]
mov esi, edx
mov edx, edx
shr rdx, cl
cmp rdx, r13
jae 0x14007687e
mov edx, dword [rbx + rdx*4]
cmp edx, eax
jne 0x1400767e0
mov rdx, qword [r8 + 0x18]
cmp rdi, rdx
jb 0x1400767b0
lea r8, [0x140202420]
mov rcx, rdi
call fcn.1401f2a90
jmp 0x1400768b8
lea rdi, [r8 + 8]
mov rcx, r14
mov rdx, rdi
call fcn.140079e40
test r13, r13
je 0x14007683d
shl r13, 2
mov r8d, 4
mov rcx, rbx
mov rdx, r13
call fcn.140001160
mov rdx, qword [rdi]
test rdx, rdx
mov rax, qword [rbp - 8]
je 0x14007686c
mov rcx, qword [rax + 0x10]
shl rdx, 2
mov r8d, 4
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
jmp fcn.140001160
nop
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea r8, [0x140202408]
mov rcx, rdx
mov rdx, r13
call fcn.1401f2a90
jmp 0x1400768b8
lea r8, [0x1402023f0]
mov rcx, r13
mov rdx, r13
call fcn.1401f2a90
jmp 0x1400768b8
call fcn.1401bf0a0
jmp 0x1400768b8
mov rcx, r12
mov rdx, rdi
call fcn.1401f27a0
ud2
Function at 0x1400a4450
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
sub rsp, 0x98
lea rbp, [rsp + 0x80]
movdqa xmmword [rbp], xmm7
movdqa xmmword [rbp - 0x10], xmm6
mov qword [rbp - 0x18], 0xfffffffffffffffe
mov rsi, rcx
mov ecx, 0x200
mov edx, 4
call fcn.140001150
test rax, rax
je 0x1400a45cf
mov ecx, 2
lea rdx, [0x14021c098]
movdqa xmm0, xmmword [0x1401fca70]
nop word cs:[rax + rax]
movdqu xmm1, xmmword [rdx + rcx*8 - 0x10]
movdqu xmm2, xmmword [rdx + rcx*8]
pshufd xmm3, xmm1, 0xe8
pshufd xmm1, xmm1, 0xed
movdqa xmm4, xmm3
pxor xmm4, xmm0
movdqa xmm5, xmm1
pxor xmm5, xmm0
movdqa xmm6, xmm5
pcmpgtd xmm6, xmm4
movdqa xmm7, xmm3
pand xmm7, xmm6
pandn xmm6, xmm1
por xmm6, xmm7
pcmpgtd xmm4, xmm5
pand xmm3, xmm4
pandn xmm4, xmm1
por xmm4, xmm3
punpckldq xmm6, xmm4
movdqu xmmword [rax + rcx*8 - 0x10], xmm6
pshufd xmm1, xmm2, 0xe8
pshufd xmm2, xmm2, 0xed
movdqa xmm3, xmm1
pxor xmm3, xmm0
movdqa xmm4, xmm2
pxor xmm4, xmm0
movdqa xmm5, xmm4
pcmpgtd xmm5, xmm3
movdqa xmm6, xmm1
pand xmm6, xmm5
pandn xmm5, xmm2
por xmm5, xmm6
pcmpgtd xmm3, xmm4
pand xmm1, xmm3
pandn xmm3, xmm2
por xmm3, xmm1
punpckldq xmm5, xmm3
movdqu xmmword [rax + rcx*8], xmm5
add rcx, 4
cmp rcx, 0x42
jne 0x1400a44b0
mov rcx, rax
add rcx, 0x200
mov qword [rbp - 0x40], 0x40
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rcx
mov qword [rbp - 0x28], rax
lea rcx, [rbp - 0x58]
lea rdx, [rbp - 0x40]
call fcn.1400d6e10
mov rax, qword [rbp - 0x48]
test rax, rax
movups xmm0, xmmword [rbp - 0x58]
movaps xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], rax
sete byte [rbp - 0x28]
lea rcx, [rbp - 0x40]
call fcn.1400dd600
movaps xmm0, xmmword [rbp - 0x40]
movaps xmm1, xmmword [rbp - 0x30]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rax, rsi
movaps xmm6, xmmword [rbp - 0x10]
movaps xmm7, xmmword [rbp]
add rsp, 0x98
pop rsi
pop rbp
ret
mov ecx, 0x200
mov edx, 4
call fcn.1401f27a0
ud2
Function at 0x1400d91c0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
movdqa xmmword [rsp + 0x20], xmm6
mov r14, rcx
mov rbx, rdx
sub rbx, r8
shr rbx, 3
mov r15, rdx
sub r15, r8
je 0x1400d9239
movabs rax, 0x7ffffffffffffff9
xor esi, esi
cmp r15, rax
setb al
jae 0x1400d93ea
mov rdi, r8
mov r12, rdx
mov sil, al
shl rsi, 2
mov rcx, r15
mov rdx, rsi
call fcn.140001150
test rax, rax
je 0x1400d93f1
mov qword [r14], rbx
mov qword [r14 + 8], rax
add r15, 0xfffffffffffffff8
cmp r15, 8
jae 0x1400d924b
xor ecx, ecx
jmp 0x1400d93a0
mov qword [r14], rbx
mov qword [r14 + 8], 4
xor ecx, ecx
jmp 0x1400d93c2
shr r15, 3
inc r15
mov rcx, r15
and rcx, 0xfffffffffffffffe
lea rdx, [rcx - 2]
mov r8, rdx
shr r8, 1
inc r8
test rdx, rdx
je 0x1400d93dc
mov rsi, r8
and rsi, 0xfffffffffffffffe
xor edx, edx
movdqa xmm0, xmmword [0x1401fca70]
movdqu xmm1, xmmword [rdi + rdx*8]
pshufd xmm2, xmm1, 0xe8
pshufd xmm1, xmm1, 0xed
movdqa xmm3, xmm2
pxor xmm3, xmm0
movdqa xmm4, xmm1
pxor xmm4, xmm0
movdqa xmm5, xmm4
pcmpgtd xmm5, xmm3
movdqa xmm6, xmm2
pand xmm6, xmm5
pandn xmm5, xmm1
por xmm5, xmm6
pcmpgtd xmm3, xmm4
pand xmm2, xmm3
pandn xmm3, xmm1
por xmm3, xmm2
punpckldq xmm5, xmm3
movdqu xmmword [rax + rdx*8], xmm5
movdqu xmm1, xmmword [rdi + rdx*8 + 0x10]
pshufd xmm2, xmm1, 0xe8
pshufd xmm1, xmm1, 0xed
movdqa xmm3, xmm2
pxor xmm3, xmm0
movdqa xmm4, xmm1
pxor xmm4, xmm0
movdqa xmm5, xmm4
pcmpgtd xmm5, xmm3
movdqa xmm6, xmm2
pand xmm6, xmm5
pandn xmm5, xmm1
por xmm5, xmm6
pcmpgtd xmm3, xmm4
pand xmm2, xmm3
pandn xmm3, xmm1
por xmm3, xmm2
punpckldq xmm5, xmm3
movdqu xmmword [rax + rdx*8 + 0x10], xmm5
add rdx, 4
add rsi, 0xfffffffffffffffe
jne 0x1400d9280
test r8b, 1
je 0x1400d938a
movdqu xmm0, xmmword [rdi + rdx*8]
pshufd xmm1, xmm0, 0xe8
pshufd xmm0, xmm0, 0xed
movdqa xmm2, xmmword [0x1401fca70]
movdqa xmm3, xmm1
pxor xmm3, xmm2
pxor xmm2, xmm0
movdqa xmm4, xmm2
pcmpgtd xmm4, xmm3
movdqa xmm5, xmm1
pand xmm5, xmm4
pandn xmm4, xmm0
por xmm4, xmm5
pcmpgtd xmm3, xmm2
pand xmm1, xmm3
pandn xmm3, xmm0
por xmm3, xmm1
punpckldq xmm4, xmm3
movdqu xmmword [rax + rdx*8], xmm4
cmp r15, rcx
je 0x1400d93c2
lea rdi, [rdi + rcx*8]
nop word cs:[rax + rax]
mov edx, dword [rdi]
mov ebx, dword [rdi + 4]
cmp edx, ebx
mov esi, ebx
cmovb esi, edx
cmova ebx, edx
mov dword [rax + rcx*8], esi
mov dword [rax + rcx*8 + 4], ebx
inc rcx
add rdi, 8
cmp rdi, r12
jne 0x1400d93a0
mov qword [r14 + 0x10], rcx
mov rax, r14
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
xor edx, edx
test r8b, 1
jne 0x1400d9336
jmp 0x1400d938a
call fcn.1401bf0a0
ud2
mov rcx, r15
mov rdx, rsi
call fcn.1401f27a0
ud2
Function at 0x1400dfdf0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
cmp byte [rdx + 0x31], 0
je 0x1400dfe0e
mov qword [rcx], 3
jmp 0x1400e001e
mov r14, qword [rdx + 0x18]
mov r15, qword [rdx + 0x20]
cmp r15, r14
je 0x1400dff8c
mov r10, qword [rdx]
mov r11, qword [rdx + 8]
mov rdi, qword [rdx + 0x28]
jmp 0x1400dfe49
mov qword [rdx + 0x10], 1
nop word cs:[rax + rax]
cmp r15, r14
je 0x1400dff8c
mov rsi, r15
mov r9, rdi
inc r15
mov qword [rdx + 0x20], r15
movzx ebx, byte [rsi]
movzx eax, bl
test al, al
jns 0x1400dfed0
mov edi, eax
and edi, 0x1f
lea r15, [rsi + 2]
mov qword [rdx + 0x20], r15
movzx ebp, byte [rsi + 1]
and ebp, 0x3f
cmp al, 0xdf
jbe 0x1400dfebe
lea r15, [rsi + 3]
mov qword [rdx + 0x20], r15
movzx r8d, byte [rsi + 2]
shl ebp, 6
and r8d, 0x3f
or r8d, ebp
cmp bl, 0xf0
jb 0x1400dfec7
lea r15, [rsi + 4]
mov qword [rdx + 0x20], r15
movzx eax, byte [rsi + 3]
and edi, 7
shl edi, 0x12
shl r8d, 6
and eax, 0x3f
or eax, r8d
or eax, edi
cmp eax, 0x110000
jne 0x1400dfed0
jmp 0x1400dff8c
shl edi, 6
or edi, ebp
mov eax, edi
jmp 0x1400dfed0
shl edi, 0xc
or r8d, edi
mov eax, r8d
mov rdi, r15
sub rdi, rsi
add rdi, r9
mov qword [rdx + 0x28], rdi
cmp eax, 0x25
je 0x1400dff10
cmp eax, 0x110000
je 0x1400dff8c
cmp byte [rdx + 0x30], 0
je 0x1400dfe40
cmp eax, 0x3d
je 0x1400dffd8
cmp eax, 0x20
jne 0x1400dfe40
jmp 0x1400dffd8
movzx ebx, byte [rdx + 0x30]
mov eax, ebx
xor al, 1
mov byte [rdx + 0x30], al
test r9, r9
je 0x1400dfe2c
mov r8, qword [rdx + 0x10]
cmp r9, r8
jb 0x1400e002e
test r8, r8
je 0x1400dff4d
cmp r8, r11
jae 0x1400dff47
cmp byte [r10 + r8], 0xc0
jge 0x1400dff4d
jmp 0x1400e002e
jne 0x1400e002e
cmp r9, r11
jae 0x1400dff5e
cmp byte [r10 + r9], 0xbf
jg 0x1400dff64
jmp 0x1400e002e
jne 0x1400e002e
lea rax, [r9 + 1]
mov qword [rdx + 0x10], rax
sub r9, r8
je 0x1400dfe40
add r10, r8
test bl, bl
je 0x1400e000f
mov qword [rcx], 1
jmp 0x1400e0016
mov byte [rdx + 0x31], 1
cmp byte [rdx + 0x30], 0
je 0x1400dffa3
mov qword [rcx], 2
mov byte [rcx + 8], 0
jmp 0x1400e001e
mov rax, qword [rdx]
mov r9, qword [rdx + 8]
mov r8, qword [rdx + 0x10]
test r8, r8
je 0x1400dffeb
cmp r9, r8
jbe 0x1400dffe9
cmp byte [rax + r8], 0xbf
jg 0x1400dffeb
lea rcx, str.C:Users_test.cargo_registry_srcgithub.com_1ecc6299db9ec823expand_str_0.1.1_srclib.rs
mov qword [rsp + 0x20], rcx
mov rcx, rax
mov rdx, r9
call fcn.1401f2f30
ud2
mov byte [rdx + 0x31], 1
mov qword [rcx], 2
mov byte [rcx + 8], 1
jmp 0x1400e001e
jne 0x1400dffbf
mov rbp, r9
sub rbp, r8
je 0x1400dfe02
add rax, r8
mov qword [rdx + 0x10], r9
mov qword [rcx], 0
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rbp
jmp 0x1400e001e
mov qword [rcx], 0
mov qword [rcx + 8], r10
mov qword [rcx + 0x10], r9
mov rax, rcx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
lea rax, str.C:Users_test.cargo_registry_srcgithub.com_1ecc6299db9ec823expand_str_0.1.1_srclib.rs
mov qword [rsp + 0x20], rax
mov rcx, r10
mov rdx, r11
call fcn.1401f2f30
ud2
Function at 0x1400e29d0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rax
add qword [rdx + 0x30], 8
mov rcx, qword [rcx]
mov qword [rsp], rcx
mov r9, qword [rdx + 0x40]
test r9, r9
je 0x1400e2a77
mov eax, 8
mov r11d, 8
sub r11, r9
cmp r11, 8
cmovb rax, r11
xor r10d, r10d
xor r8d, r8d
cmp rax, 4
mov ecx, ecx
cmovae r10, rcx
setae r8b
lea rcx, [r8*4 + 1]
shl r8, 2
cmp rcx, rax
jae 0x1400e2a3e
movzx esi, word [rsp + r8]
lea ecx, [r8*8]
shl rsi, cl
or r10, rsi
or r8, 2
cmp r8, rax
jae 0x1400e2a55
movzx eax, byte [rsp + r8]
shl r8d, 3
mov ecx, r8d
shl rax, cl
or r10, rax
lea ecx, [r9*8]
shl r10, cl
or r10, qword [rdx + 0x38]
mov qword [rdx + 0x38], r10
cmp r9, 8
jbe 0x1400e2a7c
add r9, 8
jmp 0x1400e2bba
xor r11d, r11d
jmp 0x1400e2ad0
mov rsi, qword [rdx + 0x18]
mov rcx, qword [rdx + 0x10]
mov r8, qword [rdx]
add r8, rcx
rol rcx, 0xd
xor rsi, r10
xor rcx, r8
rol r8, 0x20
mov rax, qword [rdx + 8]
add rax, rsi
rol rsi, 0x10
xor rsi, rax
add r8, rsi
rol rsi, 0x15
xor rsi, r8
add rax, rcx
rol rcx, 0x11
mov qword [rdx + 0x18], rsi
xor rcx, rax
rol rax, 0x20
mov qword [rdx + 0x10], rcx
mov qword [rdx + 8], rax
xor r8, r10
mov qword [rdx], r8
mov r8d, 8
sub r8, r11
mov r9d, r8d
and r9d, 7
and r8, 0xfffffffffffffff8
cmp r11, r8
jae 0x1400e2b52
mov rcx, qword [rdx + 0x18]
mov rax, qword [rdx]
mov r10, qword [rdx + 8]
mov rsi, qword [rdx + 0x10]
nop dword [rax + rax]
add rax, rsi
rol rsi, 0xd
mov rdi, qword [rsp + r11]
xor rsi, rax
rol rax, 0x20
xor rcx, rdi
add r10, rcx
rol rcx, 0x10
xor rcx, r10
add rax, rcx
rol rcx, 0x15
add r10, rsi
rol rsi, 0x11
xor rsi, r10
rol r10, 0x20
xor rcx, rax
xor rax, rdi
add r11, 8
cmp r11, r8
jb 0x1400e2b00
mov qword [rdx + 0x18], rcx
mov qword [rdx], rax
mov qword [rdx + 0x10], rsi
mov qword [rdx + 8], r10
cmp r9d, 3
jbe 0x1400e2b70
mov r10d, dword [rsp + r11]
mov r8d, 4
mov rax, r8
or rax, 1
cmp rax, r9
jb 0x1400e2b82
jmp 0x1400e2b9c
xor r8d, r8d
xor r10d, r10d
mov rax, r8
or rax, 1
cmp rax, r9
jae 0x1400e2b9c
lea rax, [r8 + r11]
movzx eax, word [rsp + rax]
lea ecx, [r8*8]
shl rax, cl
or r10, rax
or r8, 2
cmp r8, r9
jae 0x1400e2bb6
add r11, r8
movzx eax, byte [rsp + r11]
shl r8d, 3
mov ecx, r8d
shl rax, cl
or r10, rax
mov qword [rdx + 0x38], r10
mov qword [rdx + 0x40], r9
add rsp, 8
pop rdi
pop rsi
ret
Function at 0x1400e6540
Capabilities:
Accept command line arguments

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0x80]
mov qword [rbp], 0xfffffffffffffffe
mov rax, rdx
mov rsi, rcx
lea rdx, [rbp - 0x1c]
mov rcx, rax
call sub.SHELL32.dll_CommandLineToArgvW
test rax, rax
je 0x1400e6680
mov rdi, rax
mov qword [rbp - 0x40], rsi
movsxd r14, dword [rbp - 0x1c]
mov qword [rbp - 0x18], 0
mov qword [rbp - 0x10], 8
mov qword [rbp - 8], 0
test r14, r14
je 0x1400e6663
shl r14, 3
xor r15d, r15d
lea r12, [rbp - 0x58]
lea r13, [rbp - 0x38]
jmp 0x1400e65e6
mov rax, qword [rbp - 0x10]
lea rcx, [rdx + rdx*2]
movups xmm0, xmmword [rbp - 0x38]
mov rdx, qword [rbp - 0x28]
mov qword [rax + rcx*8 + 0x10], rdx
movups xmmword [rax + rcx*8], xmm0
inc qword [rbp - 8]
add r15, 8
cmp r14, r15
je 0x1400e6663
mov rbx, qword [rdi + r15]
mov rcx, rbx
call fcn.1401dcf2c
mov rsi, rax
mov qword [rbp - 0x38], 0
mov qword [rbp - 0x30], 1
mov qword [rbp - 0x28], 0
shr rax, 1
mov r8d, esi
and r8d, 1
add r8, rax
je 0x1400e6626
mov rcx, r13
xor edx, edx
call fcn.1401e78a0
lea rax, [rbx + rsi*2]
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rbx
mov word [rbp - 0x48], 0
mov rcx, r12
mov rdx, r13
call fcn.1400ec570
mov rdx, qword [rbp - 8]
cmp rdx, qword [rbp - 0x18]
jne 0x1400e65c0
lea rcx, [rbp - 0x18]
call fcn.140040710
mov rdx, qword [rbp - 8]
jmp 0x1400e65c0
mov rcx, rdi
call sub.KERNEL32.dll_LocalFree
mov rax, qword [rbp - 8]
mov rcx, qword [rbp - 0x40]
mov qword [rcx + 0x10], rax
movups xmm0, xmmword [rbp - 0x18]
movups xmmword [rcx], xmm0
jmp 0x1400e6697
mov qword [rsi], 0
mov qword [rsi + 8], 8
mov qword [rsi + 0x10], 0
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret