joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140005fe0
Capabilities:
Get token membership

Disassembly:
push rbx
sub rsp, 0x80
mov rax, qword [0x140098080]
xor rax, rsp
mov qword [rsp + 0x78], rax
xor ebx, ebx
mov dword [rsp + 0x70], 0
lea rax, [rsp + 0x68]
mov word [rsp + 0x74], 0x500
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x48], ebx
mov r9d, 0x220
mov dword [rsp + 0x40], ebx
mov r8d, 0x20
mov dword [rsp + 0x38], ebx
mov dl, 2
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x140006079
mov rdx, qword [rsp + 0x68]
lea r8, [rsp + 0x60]
xor ecx, ecx
mov dword [rsp + 0x60], ebx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x140006066
mov dword [rsp + 0x60], ebx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [rsp + 0x60], 1
sete al
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14003bb30
add rsp, 0x80
pop rbx
ret
Function at 0x14000b200
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r12, r9
mov r15, r8
mov rbp, rdx
mov rsi, rcx
movabs r11, 0xcbf29ce484222325
mov rax, qword [r8 + 8]
lea r8, [rax + rax]
mov rax, qword [r15]
add r8, rax
cmp rax, r8
je 0x14000b278
lea r9, [0x14006e360]
movabs r10, 0x100000001b3
nop word [rax + rax]
movsx rcx, byte [rax]
movsx rdx, byte [rcx + r9]
xor r11, rdx
imul r11, r10
inc rax
cmp rax, r8
jne 0x14000b260
movabs rax, 0xde5fb9d2630458e9
mul r11
lea r9, [rdx + rax]
mov r8, r15
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.14000d1c0
mov rdi, qword [rsp + 0x20]
movzx r14d, byte [rsp + 0x28]
test r14b, r14b
je 0x14000b2fb
mov rbx, rdi
shl rbx, 6
add rbx, qword [rsi + 8]
mov qword [rsp + 0x60], rbx
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
xor r13d, r13d
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], r13
mov r8, qword [r15 + 8]
mov rdx, qword [r15]
mov rcx, rbx
call fcn.140003be0
nop
lea rcx, [rbx + 0x20]
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], r13
mov qword [rcx + 0x18], r13
mov r8, qword [r12 + 8]
mov rdx, qword [r12]
call fcn.140003be0
nop
mov rcx, qword [rsi]
add rcx, rdi
mov qword [rsp + 0x20], rcx
shl rdi, 6
add rdi, qword [rsi + 8]
mov qword [rsp + 0x28], rdi
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rbp], xmm0
mov byte [rbp + 0x10], r14b
mov rax, rbp
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14001c3b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov rax, qword [r8]
mov r14, r9
mov r10, qword [r8 + 8]
mov r12, r8
mov rbp, rdx
mov rsi, rcx
movabs r11, 0xcbf29ce484222325
lea r10, [rax + r10*2]
cmp rax, r10
je 0x14001c418
lea r8, [0x14006e360]
movabs r9, 0x100000001b3
nop dword [rax + rax]
movsx rcx, byte [rax]
inc rax
movsx rdx, byte [rcx + r8]
xor r11, rdx
imul r11, r9
cmp rax, r10
jne 0x14001c400
movabs rax, 0xde5fb9d2630458e9
mov qword [rsp + 0x60], rbx
mul r11
mov r8, r12
mov rcx, rsi
lea r9, [rdx + rax]
lea rdx, [rsp + 0x20]
call fcn.140022090
mov rdi, qword [rsp + 0x20]
mov rcx, qword [rsi + 8]
movzx r15d, byte [rsp + 0x28]
lea rbx, [rdi + rdi*2]
shl rbx, 5
add rbx, rcx
test r15b, r15b
je 0x14001c4f1
xorps xmm0, xmm0
mov qword [rsp + 0x68], r13
movups xmmword [rbx], xmm0
xor r13d, r13d
mov rcx, rbx
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], r13
mov r8, qword [r12 + 8]
mov rdx, qword [r12]
call fcn.140003be0
xorps xmm0, xmm0
movups xmmword [rbx + 0x20], xmm0
mov qword [rbx + 0x30], r13
mov qword [rbx + 0x38], r13
movups xmm0, xmmword [r14]
movups xmmword [rbx + 0x20], xmm0
movups xmm1, xmmword [r14 + 0x10]
xorps xmm0, xmm0
movups xmmword [rbx + 0x30], xmm1
mov qword [r14 + 0x18], 7
mov qword [r14 + 0x10], r13
mov word [r14], r13w
movups xmmword [rbx + 0x40], xmm0
mov qword [rbx + 0x50], r13
mov qword [rbx + 0x58], r13
movups xmm0, xmmword [r14 + 0x20]
movups xmmword [rbx + 0x40], xmm0
movups xmm1, xmmword [r14 + 0x30]
movups xmmword [rbx + 0x50], xmm1
mov qword [r14 + 0x30], r13
mov qword [r14 + 0x38], 7
mov word [r14 + 0x20], r13w
mov r13, qword [rsp + 0x68]
jmp 0x14001c50a
mov rdx, r14
lea rcx, [rbx + 0x20]
call fcn.140002cc0
lea rdx, [r14 + 0x20]
lea rcx, [rbx + 0x40]
call fcn.140002cc0
mov rcx, qword [rsi]
lea rax, [rdi + rdi*2]
mov rbx, qword [rsp + 0x60]
add rcx, rdi
shl rax, 5
add rax, qword [rsi + 8]
mov qword [rsp + 0x28], rax
mov rax, rbp
mov qword [rsp + 0x20], rcx
movups xmm0, xmmword [rsp + 0x20]
mov byte [rbp + 0x10], r15b
movups xmmword [rbp], xmm0
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140022f50
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x30
mov rsi, qword [rcx]
lea r14, [rdx + 0x18]
mov rbx, qword [rcx + 8]
mov r15, rcx
mov rbp, qword [rcx + 0x18]
and r14, 0xfffffffffffffff8
lea rcx, [rdx + rdx*2]
xor r13d, r13d
shl rcx, 5
mov rdi, rdx
add rcx, r14
jne 0x140022f94
mov eax, r13d
jmp 0x140022fd1
cmp rcx, 0x1000
jb 0x140022fcc
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400231b6
mov rcx, rax
call fcn.14003bb50
mov rcx, rax
test rax, rax
je 0x1400231bc
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140022fd1
call fcn.14003bb50
lea rcx, [r14 + rax]
mov qword [r15], rax
mov qword [r15 + 8], rcx
lea r8, [rdi + 0x10]
mov rcx, rax
mov edx, 0xffffff80
call fcn.140056ff0
mov rax, qword [r15]
mov rcx, rdi
mov byte [rdi + rax], 0xff
mov rax, rdi
shr rax, 3
sub rcx, rax
mov qword [r15 + 0x18], rdi
sub rcx, qword [r15 + 0x10]
mov rdi, r13
mov qword [r15 + 0x28], rcx
test rbp, rbp
je 0x14002319f
mov qword [rsp + 0x68], r12
lea r14, [0x14006e360]
movaps xmmword [rsp + 0x20], xmm6
movabs rcx, 0xcbf29ce484222325
movdqa xmm6, xmmword [0x14008eb00]
movabs r12, 0x100000001b3
movabs r10, 0xde5fb9d2630458e9
cmp byte [rsi + rdi], r13b
jl 0x140023142
cmp qword [rbx + 0x18], 7
mov rax, rbx
jbe 0x140023067
mov rax, qword [rbx]
mov r8, rcx
mov rcx, qword [rbx + 0x10]
lea r9, [rax + rcx*2]
cmp rax, r9
je 0x140023098
nop word [rax + rax]
movsx rcx, byte [rax]
inc rax
movsx rdx, byte [rcx + r14]
xor r8, rdx
imul r8, r12
cmp rax, r9
jne 0x140023080
mov r9, qword [r15 + 0x18]
mov rax, r10
mov r10, qword [r15]
movdqa xmm1, xmm6
mul r8
mov rcx, r13
lea r11, [rdx + rax]
mov r8, r11
shr r8, 7
and r8, r9
movdqu xmm0, xmmword [r10 + r8]
pcmpgtb xmm1, xmm0
pmovmskb eax, xmm1
test eax, eax
jne 0x1400230f0
nop dword [rax]
add rcx, 0x10
movdqa xmm1, xmm6
add r8, rcx
and r8, r9
movdqu xmm0, xmmword [r10 + r8]
pcmpgtb xmm1, xmm0
pmovmskb eax, xmm1
test eax, eax
je 0x1400230d0
bsf edx, eax
and r11b, 0x7f
add rdx, r8
mov r8, rbx
and rdx, r9
mov byte [r10 + rdx], r11b
lea rcx, [rdx - 0x10]
mov rax, qword [r15 + 0x18]
lea rdx, [rdx + rdx*2]
and rcx, rax
shl rdx, 5
and eax, 0xf
add rcx, rax
mov rax, qword [r15]
mov byte [rcx + rax + 1], r11b
add rdx, qword [r15 + 8]
call fcn.140024b90
movabs rcx, 0xcbf29ce484222325
movabs r10, 0xde5fb9d2630458e9
inc rdi
add rbx, 0x60
cmp rdi, rbp
jne 0x140023050
movaps xmm6, xmmword [rsp + 0x20]
lea rax, [rbp*2]
mov r12, qword [rsp + 0x68]
lea rdx, [rbp + 0x18]
add rax, rbp
and rdx, 0xfffffffffffffff8
shl rax, 5
add rdx, rax
cmp rdx, 0x1000
jb 0x140023197
mov rcx, qword [rsi - 8]
add rdx, 0x27
sub rsi, rcx
lea rax, [rsi - 8]
cmp rax, 0x1f
ja 0x1400231bc
mov rsi, rcx
mov rcx, rsi
call fcn.14003bb8c
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret
call fcn.140001110
int3
call fcn.140041a3c
int3
Function at 0x140024620
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
cmp qword [r8 + 0x18], 7
mov rdi, rdx
mov rbx, qword [rcx]
mov rax, r8
jbe 0x14002463d
mov rax, qword [r8]
mov rcx, qword [r8 + 0x10]
movabs r9, 0xcbf29ce484222325
lea r10, [rax + rcx*2]
cmp rax, r10
je 0x14002468d
mov qword [rsp + 0x40], rsi
lea r11, [0x14006e360]
movabs rsi, 0x100000001b3
nop word [rax + rax]
movsx rcx, byte [rax]
inc rax
movsx rdx, byte [rcx + r11]
xor r9, rdx
imul r9, rsi
cmp rax, r10
jne 0x140024670
mov rsi, qword [rsp + 0x40]
movabs rax, 0xde5fb9d2630458e9
mov rcx, rbx
mul r9
lea r9, [rdx + rax]
lea rdx, [rsp + 0x20]
call fcn.140024d30
movzx r10d, byte [rsp + 0x28]
mov r9, qword [rsp + 0x20]
test r10b, r10b
je 0x14002476d
mov rax, qword [rsp + 0x68]
lea r8, [r9 + r9*2]
xorps xmm0, xmm0
shl r8, 5
add r8, qword [rbx + 8]
mov rdx, qword [rax]
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax]
xor eax, eax
movups xmmword [r8], xmm0
mov qword [r8 + 0x10], rax
mov qword [r8 + 0x18], rax
movups xmm0, xmmword [rcx]
movups xmmword [r8], xmm0
movups xmm1, xmmword [rcx + 0x10]
xorps xmm0, xmm0
movups xmmword [r8 + 0x10], xmm1
mov qword [rcx + 0x18], 7
mov qword [rcx + 0x10], rax
mov word [rcx], ax
movups xmmword [r8 + 0x20], xmm0
mov qword [r8 + 0x30], rax
mov qword [r8 + 0x38], rax
movups xmm0, xmmword [rdx]
movups xmmword [r8 + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x10]
xorps xmm0, xmm0
movups xmmword [r8 + 0x30], xmm1
mov qword [rdx + 0x18], 7
mov qword [rdx + 0x10], rax
mov word [rdx], ax
movups xmmword [r8 + 0x40], xmm0
mov qword [r8 + 0x50], rax
mov qword [r8 + 0x58], rax
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [r8 + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [r8 + 0x50], xmm1
mov qword [rdx + 0x30], rax
mov qword [rdx + 0x38], 7
mov word [rdx + 0x20], ax
mov rcx, qword [rbx]
lea rax, [r9 + r9*2]
add rcx, r9
shl rax, 5
add rax, qword [rbx + 8]
mov rbx, qword [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov rax, rdi
mov qword [rsp + 0x20], rcx
movups xmm0, xmmword [rsp + 0x20]
mov byte [rdi + 0x10], r10b
movups xmmword [rdi], xmm0
add rsp, 0x30
pop rdi
ret
Function at 0x140027ae0
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x50
movaps xmmword [rax - 0x18], xmm6
mov rbx, rcx
xor ebp, ebp
mov dword [rax - 0x28], ebp
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], rbp
mov qword [rcx + 0x18], 7
mov word [rcx], bp
mov dword [rax - 0x28], 1
movaps xmm6, xmmword [rdx]
mov word [rax - 0x38], bp
mov r9d, 0x100
movzx r8d, byte [rsp + 0x60]
mov edx, r9d
call fcn.140003d10
mov rdx, rbx
cmp qword [rbx + 0x18], 7
jbe 0x140027b48
mov rdx, qword [rbx]
mov r8d, 0x100
movq rcx, xmm6
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
test eax, eax
jne 0x140027b7b
mov qword [rbx + 0x10], rbp
mov rax, rbx
cmp qword [rbx + 0x18], 7
jbe 0x140027b70
mov rax, qword [rbx]
mov word [rax], bp
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140027bbd
mov rdx, rdi
xor r8d, r8d
mov rcx, rbx
call fcn.140002c30
cmp edi, 0x100
jb 0x140027bbd
mov rdx, rbx
cmp qword [rbx + 0x18], 7
jbe 0x140027b9e
mov rdx, qword [rbx]
mov r8d, edi
movq rcx, xmm6
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp eax, edi
jae 0x140027bbd
xor r8d, r8d
mov edx, eax
mov rcx, rbx
call fcn.140002c30
mov rax, rbx
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rdi
ret

Function at 0x140029090
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x50
movaps xmmword [rax - 0x18], xmm6
mov rbx, rcx
xor ebp, ebp
mov dword [rax - 0x28], ebp
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], rbp
mov qword [rcx + 0x18], 7
mov word [rcx], bp
mov dword [rax - 0x28], 1
movaps xmm6, xmmword [rdx]
mov word [rax - 0x38], bp
mov r9d, 0x1000
movzx r8d, byte [rsp + 0x60]
mov edx, r9d
call fcn.140003d10
mov rdx, rbx
cmp qword [rbx + 0x18], 7
jbe 0x1400290f8
mov rdx, qword [rbx]
mov r8d, 0x1000
movq rcx, xmm6
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
test eax, eax
jne 0x14002912b
mov qword [rbx + 0x10], rbp
mov rax, rbx
cmp qword [rbx + 0x18], 7
jbe 0x140029120
mov rax, qword [rbx]
mov word [rax], bp
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14002916d
mov rdx, rdi
xor r8d, r8d
mov rcx, rbx
call fcn.140002c30
cmp edi, 0x1000
jb 0x14002916d
mov rdx, rbx
cmp qword [rbx + 0x18], 7
jbe 0x14002914e
mov rdx, qword [rbx]
mov r8d, edi
movq rcx, xmm6
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp eax, edi
jae 0x14002916d
xor r8d, r8d
mov edx, eax
mov rcx, rbx
call fcn.140002c30
mov rax, rbx
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rdi
ret
Function at 0x1400295a0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x140098080]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rbx, qword [rdx + 8]
mov rbp, r8
mov rdi, qword [rdx]
mov rsi, rcx
test rbx, rbx
je 0x140029616
xor r14d, r14d
mov r15d, 0xffffffff
nop dword [rax]
mov r8d, r15d
mov dword [rsp + 0x30], r14d
cmp rbx, r15
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x30]
mov rdx, rdi
cmovb r8d, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
jne 0x14002963c
mov eax, dword [rsp + 0x30]
add rdi, rax
sub rbx, rax
jne 0x1400295e0
mov al, 1
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14003bb30
mov rbx, qword [rsp + 0xc8]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov qword [rsp + 0x48], 0xb
lea rax, str.WriteFile:
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x40]
movaps xmm0, xmmword [rsp + 0x40]
lea rcx, [rsp + 0x50]
movdqa xmmword [rsp + 0x40], xmm0
call fcn.140001310
mov rdx, rax
mov rcx, rbp
mov rbx, rax
call fcn.140002cc0
mov rdx, qword [rsp + 0x68]
mov eax, dword [rbx + 0x20]
mov dword [rbp + 0x20], eax
cmp rdx, 7
jbe 0x1400296bd
mov rcx, qword [rsp + 0x50]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400296b8
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400296c4
call fcn.14003bb8c
xor al, al
jmp 0x140029618
call fcn.140041a3c
int3
Function at 0x1400296d0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x140098080]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rsi, r8
mov rbp, rcx
mov rdi, qword [rdx]
mov rbx, qword [rdx + 8]
test rbx, rbx
je 0x14002974e
xor r14d, r14d
mov r15d, 0xffffffff
nop dword [rax]
mov dword [rsp + 0x30], r14d
mov r8d, r15d
cmp rbx, r15
cmovb r8d, ebx
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x30]
mov rdx, rdi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, 1
jne 0x14002980f
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x140029774
add rdi, rax
sub rbx, rax
jne 0x140029710
mov al, 1
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14003bb30
mov rbx, qword [rsp + 0xc8]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [0x14008ea00]
movdqu xmmword [rsp + 0x60], xmm1
mov word [rsp + 0x50], r14w
mov dword [rsp + 0x70], r14d
mov r8d, 0x1b
lea rdx, str.Reached_the_end_of_the_file
lea rcx, [rsp + 0x50]
call fcn.14000ad20
mov dword [rsp + 0x70], 0x26
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.140002cc0
mov eax, dword [rsp + 0x70]
mov dword [rsi + 0x20], eax
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x140029890
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002988b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002989d
jmp 0x14002988b
lea rax, str.ReadFile:
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 0xa
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.140001310
mov rbx, rax
mov rdx, rax
mov rcx, rsi
call fcn.140002cc0
mov eax, dword [rbx + 0x20]
mov dword [rsi + 0x20], eax
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x140029890
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002988b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140029897
call fcn.14003bb8c
xor al, al
jmp 0x140029750
call fcn.140041a3c
int3
call fcn.140041a3c
int3
Function at 0x14002fd60
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x80
mov rax, qword [0x140098080]
xor rax, rsp
mov qword [rsp + 0x70], rax
movaps xmm0, xmmword [rdx]
mov rbx, rcx
lea rdx, [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x50]
call fcn.1400160f0
mov r8d, dword [rsp + 0x60]
lea rdx, [rsp + 0x50]
xor eax, eax
lea r9, [rsp + 0x30]
cmp qword [rsp + 0x68], 0xf
mov rcx, rbx
mov dword [rsp + 0x30], eax
cmova rdx, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, 0xffffffffffffffff
cmp eax, 1
jne 0x14002fdd2
mov ebx, dword [rsp + 0x30]
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x14002fe0b
mov rcx, qword [rsp + 0x50]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002fe06
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002fe24
call fcn.14003bb8c
mov rax, rbx
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14003bb30
add rsp, 0x80
pop rbx
ret
call fcn.140041a3c
int3
Function at 0x140038d20
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x50]
sub rsp, 0x150
mov rax, qword [0x140098080]
xor rax, rsp
mov qword [rbp + 0x48], rax
mov r14, rdx
mov rdi, rcx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x6c], xmm0
movups xmmword [rbp - 0x5c], xmm0
movups xmmword [rbp - 0x4c], xmm0
movups xmmword [rbp - 0x3c], xmm0
movups xmmword [rbp - 0x2c], xmm0
movups xmmword [rbp - 0x1c], xmm0
mov dword [rbp - 0xc], eax
mov dword [rbp - 0x70], 0x68
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], rax
movups xmmword [rbp], xmm0
movdqa xmm1, xmmword [0x14008ea00]
movdqu xmmword [rbp + 0x10], xmm1
xor r15d, r15d
mov word [rbp], r15w
mov rsi, qword [rcx + 0x68]
mov rbx, qword [rcx + 0x60]
cmp rbx, rsi
je 0x140038de3
mov rcx, rbx
cmp qword [rbx + 0x18], 7
jbe 0x140038daf
mov rcx, qword [rbx]
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rax
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x60], xmm0
lea r8, [rbp]
lea rdx, [rsp + 0x60]
lea rcx, [rbp]
call fcn.140002e90
add rbx, 0x20
cmp rbx, rsi
jne 0x140038da2
mov edx, 0x400
movzx eax, byte [rdi + 0x7d]
cmp al, 1
jne 0x140038df7
mov edx, 0x410
jmp 0x140038e09
cmp al, 2
jne 0x140038e09
mov edx, 0x8000400
or dword [rbp - 0x34], 1
mov word [rbp - 0x30], r15w
lea rax, [rdi + 0x20]
cmp qword [rax + 0x10], 0
jne 0x140038e19
mov rax, r15
jmp 0x140038e23
cmp qword [rax + 0x18], 7
jbe 0x140038e23
mov rax, qword [rax]
lea rcx, [rdi + 0x40]
cmp qword [rcx + 0x10], 0
jne 0x140038e33
mov rcx, r15
jmp 0x140038e3d
cmp qword [rcx + 0x18], 7
jbe 0x140038e3d
mov rcx, qword [rcx]
lea r11, [rbp]
cmp qword [rbp + 0x18], 7
cmova r11, qword [rbp]
cmp qword [rdi + 0x10], 0
jne 0x140038e57
mov r10, r15
jmp 0x140038e64
mov r10, rdi
cmp qword [rdi + 0x18], 7
jbe 0x140038e64
mov r10, qword [rdi]
lea r8, [rsp + 0x70]
mov qword [rsp + 0x48], r8
lea r8, [rbp - 0x70]
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
mov rdx, r11
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, 1
je 0x140038ef1
lea rax, [0x14005ba88]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0xe
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x60], xmm0
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x20]
call fcn.140001310
mov rbx, rax
mov rdx, rax
mov rcx, r14
call fcn.140002cc0
mov eax, dword [rbx + 0x20]
mov dword [r14 + 0x20], eax
lea rcx, [rbp + 0x20]
call fcn.1400012a0
xor bl, bl
jmp 0x140038f0f
mov eax, dword [rbp - 0x80]
mov dword [rdi + 0x78], eax
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
lea rcx, [rbp]
call fcn.1400012a0
movzx eax, bl
mov rcx, qword [rbp + 0x48]
xor rcx, rsp
call fcn.14003bb30
mov rbx, qword [rsp + 0x190]
add rsp, 0x150
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140038f40
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x100
mov rax, qword [0x140098080]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov r15, rdx
mov rbx, rcx
call fcn.140005fe0
test al, al
je 0x140038f85
mov rdx, r15
mov rcx, rbx
call fcn.140038d20
jmp 0x14003914e
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x55], xmm0
movups xmmword [rbp - 0x45], xmm0
movups xmmword [rbp - 0x35], xmm0
mov qword [rbp - 0x25], rax
mov dword [rbp - 0x1d], eax
movups xmmword [rbp - 0x19], xmm0
xor esi, esi
mov edx, esi
mov qword [rbp - 9], rdx
mov r8d, 7
mov qword [rbp - 1], r8
mov word [rbp - 0x19], si
mov r14d, 1
mov rcx, qword [rbx + 0x60]
mov rax, qword [rbx + 0x68]
sub rax, rcx
sar rax, 5
cmp rax, r14
jbe 0x14003903f
mov edi, 0x20
nop word [rax + rax]
lea rax, [rdi + rcx]
mov rcx, rax
cmp qword [rax + 0x18], 7
jbe 0x140038ff1
mov rcx, qword [rax]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rax
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x30], xmm0
lea r8, [rbp - 0x19]
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x19]
call fcn.140002e90
inc r14
add rdi, 0x20
mov rcx, qword [rbx + 0x60]
mov rax, qword [rbx + 0x68]
sub rax, rcx
sar rax, 5
cmp r14, rax
jb 0x140038fe0
mov r8, qword [rbp - 1]
mov rdx, qword [rbp - 9]
cmp qword [rbx + 0x10], 0
jne 0x140039056
cmp qword [rcx + 0x18], 7
jbe 0x140039050
mov rcx, qword [rcx]
mov qword [rbp - 0x71], rcx
jmp 0x140039067
mov rax, rbx
cmp qword [rbx + 0x18], 7
jbe 0x140039063
mov rax, qword [rbx]
mov qword [rbp - 0x71], rax
test rdx, rdx
jne 0x140039072
mov qword [rbp - 0x69], rsi
jmp 0x140039083
lea rax, [rbp - 0x19]
cmp r8, 7
cmova rax, qword [rbp - 0x19]
mov qword [rbp - 0x69], rax
lea rax, str.runas
mov qword [rbp - 0x79], rax
mov dword [rsp + 0x40], 0x70
mov qword [rsp + 0x48], rsi
mov eax, esi
cmp byte [rbx + 0x7d], 2
setne al
mov dword [rbp - 0x59], eax
mov dword [rsp + 0x44], 0x40
cmp qword [rbx + 0x30], 0
je 0x1400390c5
lea rsi, [rbx + 0x20]
cmp qword [rbx + 0x38], 7
jbe 0x1400390c5
mov rsi, qword [rbx + 0x20]
mov qword [rbp - 0x61], rsi
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp eax, 1
je 0x140039129
lea rax, str.ShellExecuteExW:
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0x11
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 7]
call fcn.140001310
mov rbx, rax
mov rdx, rax
mov rcx, r15
call fcn.140002cc0
mov eax, dword [rbx + 0x20]
mov dword [r15 + 0x20], eax
lea rcx, [rbp + 7]
call fcn.1400012a0
xor bl, bl
jmp 0x140039142
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov dword [rbx + 0x78], eax
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
lea rcx, [rbp - 0x19]
call fcn.1400012a0
movzx eax, bl
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.14003bb30
mov rbx, qword [rsp + 0x140]
add rsp, 0x100
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret