joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006d230
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov ebx, r8d
mov rdi, rdx
mov rsi, rcx
xor eax, eax
mov qword [rcx], rax
mov r14, qword [rdx]
mov qword [rdx], rax
lea r15, [r14 + 1]
cmp r15, 2
jb 0x14006d25f
call fcn.1400e1920
cmp qword [rsi], r14
je 0x14006d28e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14006d2e0
cmp r15, 2
jb 0x14006d286
mov qword [rsi], r14
call fcn.1400e1920
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [rsi + 8]
call fcn.14005f440
lea rcx, [rsi + 0x20]
call fcn.140086c30
mov dword [rsi + 0x24], 0
mov byte [rsi + 0x28], 0
mov byte [rsi + 0x29], bl
mov rax, qword [rdi]
inc rax
cmp rax, 2
jae 0x14006d2ca
mov rax, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.1400e1920
mov rcx, qword [rdi]
call fcn.1400d9a60
mov qword [rdi], 0
jmp 0x14006d2ba
call fcn.1400e1920
mov rcx, qword [rsi]
call fcn.1400d9a60
mov qword [rsi], 0
jmp 0x14006d278

Function at 0x14006d300
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rcx, rdx
call fcn.14005cdf0
mov qword [rsi], 0
test rax, rax
je 0x14006d353
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14006d387
lea rax, [rbx + 1]
cmp rax, 2
jb 0x14006d34b
mov qword [rsi], rbx
call fcn.1400e1920
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [rsi + 8]
lea rdx, [rdi + 8]
call fcn.14006c440
lea rcx, [rsi + 0x20]
call fcn.140086c30
mov eax, dword [rdi + 0x24]
mov dword [rsi + 0x24], eax
mov al, byte [rdi + 0x28]
mov byte [rsi + 0x28], al
mov al, byte [rdi + 0x29]
mov byte [rsi + 0x29], al
mov rax, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
call fcn.1400e1920
mov rcx, qword [rsi]
call fcn.1400d9a60
mov qword [rsi], 0
jmp 0x14006d339

Function at 0x14006da80
Capabilities:
Accept command line arguments

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
mov rax, qword [0x14034e040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, qword [0x140362048]
test rdi, rdi
jne 0x14006db33
mov ecx, 0x50
call fcn.14010f3f0
mov rsi, rax
xorps xmm6, xmm6
movups xmmword [rax], xmm6
mov byte [rax + 0x10], 0
mov ecx, 0x18
call fcn.14010f3f0
mov qword [rsi + 0x18], rax
lea rcx, [rax + 0x18]
mov qword [rsi + 0x28], rcx
test rax, rax
je 0x14006db55
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
mov qword [rsi + 0x20], rcx
mov rax, rsi
add rax, 0x38
movups xmmword [rsi + 0x38], xmm6
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x48], 1
mov qword [0x140362048], rsi
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x28], rax
test rax, rax
je 0x14006db55
mov rcx, rax
call fcn.140131e24
lea rdx, [rsp + 0x28]
mov qword [rdx + 8], rax
mov rcx, rsi
call fcn.14006db60
test rdi, rdi
sete bl
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140110970
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
ud2
Function at 0x14006db60
Capabilities:
Accept command line arguments

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x78
movaps xmmword [rsp + 0x60], xmm6
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x14034e040]
xor rax, rsp
mov qword [rsp + 0x58], rax
movups xmm0, xmmword [rdx]
lea rdx, [rsp + 0x40]
movaps xmmword [rdx], xmm0
lea rdi, [rsp + 0x20]
mov rcx, rdi
mov r8d, 3
call fcn.14005b270
movups xmm0, xmmword [rdi]
movups xmmword [rbx], xmm0
cmp qword [rbx + 8], 0
je 0x14006dce8
movups xmm0, xmmword [rbx]
movups xmmword [rsi], xmm0
mov dword [rsp + 0x3c], 0
lea rcx, [0x1402e8ed8]
xor edx, edx
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
test rax, rax
je 0x14006dd1b
lea rdx, [0x1402e8f28]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14006dd0a
mov rcx, qword [rbx]
lea rdx, [rsp + 0x3c]
call qword [0x14033dc40]
mov rbx, rax
movsxd r12, dword [rsp + 0x3c]
xorps xmm6, xmm6
movaps xmmword [rsp + 0x20], xmm6
mov qword [rsp + 0x30], 0
test r12, r12
je 0x14006dc82
test r12d, r12d
js 0x14006dd11
shl r12, 3
lea r15, [r12 + r12*2]
mov rcx, r15
call fcn.14010f3f0
mov r14, rax
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
add rax, r15
mov qword [rsp + 0x30], rax
xor r15d, r15d
test r14, r14
je 0x14006dd08
mov rdx, qword [rbx + r15]
mov rcx, r14
call fcn.140028a90
add r14, 0x18
add r15, 8
cmp r12, r15
jne 0x14006dc5b
mov qword [rsp + 0x28], r14
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.14006d6d0
movups xmmword [rsi], xmm6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rdi, rdi
je 0x14006dca9
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rsi, qword [rsp + 0x20]
test rsi, rsi
je 0x14006dce8
mov rdi, qword [rsp + 0x28]
cmp rdi, rsi
je 0x14006dce0
add rdi, 0xffffffffffffffe8
test rdi, rdi
je 0x14006dd08
cmp byte [rdi + 0x17], 0
jns 0x14006dcd4
mov rcx, qword [rdi]
call fcn.14010f42c
lea rax, [rdi - 0x18]
cmp rdi, rsi
mov rdi, rax
jne 0x14006dcc1
mov rcx, rsi
call fcn.14010f42c
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140110970
movaps xmm6, xmmword [rsp + 0x60]
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
ud2
xor ebx, ebx
jmp 0x14006dc0f
lea rcx, [rsp + 0x20]
call fcn.14014aee0
mov rcx, qword [rbx]
lea rdx, [rsp + 0x3c]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
jmp 0x14006dc0c
Function at 0x140075700
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 0x28
test rdx, rdx
je 0x140075715
mov r8d, r8d
add rsp, 0x28
jmp fcn.140074e80
test r8d, r8d
jne 0x14007571f
call fcn.140096440
xor eax, eax
add rsp, 0x28
ret

Function at 0x140078420
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x14034e040]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov byte [rcx], 0
mov qword [rcx + 8], 0
movabs r14, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0x40]
mov qword [rbx], r14
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x28
mov r8, rbx
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140078530
mov r15, qword [rsp + 0x40]
cmp qword [rsi + 8], r15
je 0x1400784bb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi + 8]
inc rax
cmp rax, 2
jae 0x14007854c
lea rax, [r15 + 1]
cmp rax, 2
jb 0x1400784b3
mov qword [rsi + 8], r15
call fcn.1400e1920
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea r8, [rsp + 0x38]
mov qword [r8], r14
xor ecx, ecx
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x140078523
lea r8, [rsp + 0x48]
mov dword [r8], 1
mov rax, qword [rsp + 0x38]
mov qword [r8 + 4], rax
mov dword [r8 + 0xc], 2
lea rax, [rsp + 0x34]
mov dword [rax], 0xaaaaaaaa
lea rdx, [rsi + 0x10]
mov rcx, qword [rsi + 8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
xor edx, edx
mov r9d, 0x10
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x140078523
mov byte [rsi], 1
jmp 0x140078530
mov rax, qword [rsi + 8]
inc rax
cmp rax, 2
jae 0x140078567
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140110970
mov rax, rsi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.1400e1920
mov rcx, qword [rsi + 8]
call fcn.1400d9a60
mov qword [rsi + 8], 0
jmp 0x1400784a0
call fcn.1400e1920
mov rcx, qword [rsi + 8]
call fcn.1400d9a60
mov qword [rsi + 8], 0
jmp 0x140078530
Function at 0x14007d710
Capabilities:
Check if file exists
Create directory

Disassembly:
push rsi
push rdi
sub rsp, 0x198
mov rsi, rcx
mov rax, qword [0x14034e040]
xor rax, rsp
mov qword [rsp + 0x190], rax
cmp byte [rcx + 0x17], 0
jns 0x14007d737
mov rcx, qword [rsi]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14007d771
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14007d790
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.140110970
mov rcx, rsi
add rsp, 0x198
pop rdi
pop rsi
jmp fcn.14007d870
mov sil, 1
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.140110970
mov eax, esi
add rsp, 0x198
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.14006a140
test al, al
je 0x14007d85b
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea rcx, [rsp + 0x58]
mov r8d, 0x265
mov r9d, 2
call fcn.14018e580
lea rcx, [rsp + 0x68]
lea rdx, str.CreateDirectory
mov r8d, 0x10
call fcn.1400cdd30
mov rdi, rax
movsx rax, byte [rsi + 0x17]
test rax, rax
jns 0x14007d7f3
mov rax, qword [rsi + 8]
mov rsi, qword [rsi]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rax
test rax, rax
js 0x14007d862
sete al
test rsi, rsi
setne cl
or cl, al
je 0x14007d862
lea rsi, [rsp + 0x40]
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.1400dcf50
movsx r8, byte [rsi + 0x17]
test r8, r8
jns 0x14007d835
mov r8, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rcx, rdi
mov rdx, rsi
call fcn.1400cdd30
cmp byte [rsp + 0x57], 0
jns 0x14007d851
mov rcx, qword [rsp + 0x40]
call fcn.14010f42c
lea rcx, [rsp + 0x58]
call fcn.14018e5f0
xor esi, esi
jmp 0x14007d774
ud2

Function at 0x14007d870
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x168
mov rsi, rcx
mov rax, qword [0x14034e040]
xor rax, rsp
mov qword [rsp + 0x160], rax
cmp byte [rcx + 0x17], 0
jns 0x14007d897
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14007d93d
mov dil, 1
test al, 0x10
je 0x14007d8c9
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140110970
mov eax, edi
add rsp, 0x168
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.14006a140
test al, al
je 0x14007d936
lea rdx, str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x255
mov r9d, 2
call fcn.14018d7b0
lea rcx, [rsp + 0x38]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.1400cdd30
mov rcx, rax
mov rdx, rsi
call fcn.140190050
lea rdx, str.:_not_a_directory
mov r8d, 0x11
mov rcx, rax
call fcn.1400cdd30
mov rcx, rdi
call fcn.14018dbe0
xor edi, edi
jmp 0x14007d8ad
mov ecx, 2
call fcn.14006a140
test al, al
je 0x14007d936
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x251
mov r9d, 2
call fcn.14018e580
lea rcx, [rsp + 0x38]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.1400cdd30
mov rcx, rax
mov rdx, rsi
call fcn.140190050
mov rcx, rdi
call fcn.14018e5f0
jmp 0x14007d936
Function at 0x14007ec90
Capabilities:
Get file attributes

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rdi, rdx
mov rax, qword [0x14034e040]
xor rax, rsp
mov qword [rsp + 0x30], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x28]
mov qword [rsi], rax
mov rdx, rsi
call fcn.14007da30
mov rax, qword [rsi]
test rax, rax
je 0x14007ed07
mov rbx, qword [rax + 0x50]
mov r15, qword [rax + 0x58]
xor esi, esi
cmp rbx, r15
jne 0x14007ed0e
lea rcx, [rsp + 0x28]
call fcn.14007e480
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140110970
mov eax, esi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov esi, 3
jmp 0x14007ece0
mov r12, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [rbx + 0x68], 0
jne 0x14007ed32
cmp byte [rbx + 0x27], 0
js 0x14007ed27
lea rcx, [rbx + 0x10]
jmp 0x14007ed2b
mov rcx, qword [rbx + 0x10]
call r12
test al, 0x10
je 0x14007ed3d
add rbx, 0x70
cmp rbx, r15
je 0x14007ece0
jmp 0x14007ed15
mov r14, qword [rdi + 8]
cmp r14, qword [rdi + 0x10]
jae 0x14007ed5c
mov rcx, r14
mov rdx, rbx
call fcn.1401f4540
add r14, 0x68
mov qword [rdi + 8], r14
jmp 0x14007ed32
mov rcx, rdi
mov rdx, rbx
call fcn.1401f43e0
mov r14, rax
jmp 0x14007ed56

Function at 0x14007ed70
Capabilities:
Get file attributes

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rdi, rdx
mov rax, qword [0x14034e040]
xor rax, rsp
mov qword [rsp + 0x30], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x28]
mov qword [rsi], rax
mov rdx, rsi
call fcn.14007da30
mov rax, qword [rsi]
test rax, rax
je 0x14007ede7
mov rbx, qword [rax + 0x50]
mov r15, qword [rax + 0x58]
xor esi, esi
cmp rbx, r15
jne 0x14007edee
lea rcx, [rsp + 0x28]
call fcn.14007e480
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140110970
mov eax, esi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov esi, 3
jmp 0x14007edc0
mov r12, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [rbx + 0x68], 2
jne 0x14007ee12
cmp byte [rbx + 0x27], 0
js 0x14007ee07
lea rcx, [rbx + 0x10]
jmp 0x14007ee0b
mov rcx, qword [rbx + 0x10]
call r12
test al, 0x10
je 0x14007ee1d
add rbx, 0x70
cmp rbx, r15
je 0x14007edc0
jmp 0x14007edf5
mov r14, qword [rdi + 8]
cmp r14, qword [rdi + 0x10]
jae 0x14007ee3c
mov rcx, r14
mov rdx, rbx
call fcn.1401f4540
add r14, 0x68
mov qword [rdi + 8], r14
jmp 0x14007ee12
mov rcx, rdi
mov rdx, rbx
call fcn.1401f43e0
mov r14, rax
jmp 0x14007ee36
Function at 0x14007f560
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x158
mov rax, qword [0x14034e040]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov eax, dword [0x140364310]
mov ecx, dword [0x14035efd0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14007f5c0
lea rsi, [0x140364308]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140110970
mov rax, rsi
add rsp, 0x158
pop rdi
pop rsi
ret
lea rcx, [0x140364310]
call fcn.14010f47c
cmp dword [0x140364310], 0xffffffff
jne 0x14007f59c
lea rsi, [rsp + 0x38]
mov r8d, 0x118
mov rcx, rsi
xor edx, edx
call fcn.1401496f0
mov dword [rsi - 4], 0x11c
lea rsi, [rsp + 0x34]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
lea rdi, [rsp + 0x30]
mov dword [rdi], 0
mov ecx, dword [rsi + 4]
mov edx, dword [rsi + 8]
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetProductInfo]
mov ecx, 0x88
call fcn.14010f3f0
mov rsi, rax
mov edi, dword [rdi]
mov eax, dword [0x140364358]
mov ecx, dword [0x14035efd0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jle 0x14007f697
lea rcx, [0x140364358]
call fcn.14010f47c
cmp dword [0x140364358], 0xffffffff
jne 0x14007f697
xorps xmm0, xmm0
movups xmmword [0x140364348], xmm0
movups xmmword [0x140364338], xmm0
movups xmmword [0x140364328], xmm0
lea rcx, [0x140364328]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rcx, [0x140364358]
call fcn.14010f530
lea r8, [0x140364328]
lea rdx, [rsp + 0x34]
mov rcx, rsi
mov r9d, edi
call fcn.14007f7a0
mov qword [0x140364308], rsi
lea rcx, [0x140364310]
call fcn.14010f530
jmp 0x14007f59c

Function at 0x14007f6f0
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x28
mov eax, dword [0x140364358]
mov ecx, dword [0x14035efd0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jle 0x14007f75b
lea rcx, [0x140364358]
call fcn.14010f47c
cmp dword [0x140364358], 0xffffffff
jne 0x14007f75b
xorps xmm0, xmm0
movups xmmword [0x140364348], xmm0
movups xmmword [0x140364338], xmm0
movups xmmword [0x140364328], xmm0
lea rcx, [0x140364328]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rcx, [0x140364358]
call fcn.14010f530
movzx eax, word [0x140364328]
cmp eax, 9
jne 0x14007f771
mov eax, 1
add rsp, 0x28
ret
test eax, eax
je 0x14007f76c
cmp eax, 6
jne 0x14007f781
mov eax, 2
jmp 0x14007f76c
cmp eax, 0xc
jne 0x14007f78d
mov eax, 3
jmp 0x14007f76c
mov eax, 4
jmp 0x14007f76c
Function at 0x1400802c0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov rdi, r9
mov r14, r8
mov ebx, edx
mov rsi, rcx
mov rax, qword [0x14034e040]
xor rax, rsp
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x68]
mov qword [rax], 0
mov qword [rsp + 0x20], rax
lea rcx, [0x1402c20c0]
lea r9, [0x1402f1960]
xor edx, edx
mov r8d, 1
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x140080476
mov qword [rsp + 0x60], 0
movsx rax, byte [r14 + 0x17]
test rax, rax
jns 0x140080335
mov rax, qword [r14 + 8]
mov r14, qword [r14]
mov r15, qword [rsp + 0x68]
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x50], rax
test rax, rax
js 0x140080462
sete al
test r14, r14
setne cl
or cl, al
je 0x140080462
lea r14, [rsp + 0x58]
lea rdx, [rsp + 0x48]
mov rcx, r14
call fcn.140098f00
mov rdx, qword [r14]
mov rax, qword [r15]
mov rax, qword [rax + 0x18]
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x40], rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rcx, r15
xor r8d, r8d
xor r9d, r9d
call qword [0x14033dc40]
mov ebp, eax
mov rcx, r14
call fcn.140098f50
test ebp, ebp
js 0x140080464
test bl, bl
je 0x1400803fa
mov rcx, qword [rsp + 0x60]
mov eax, 3
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov edx, 0xa
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x14008046c
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x60], 0
mov rcx, qword [rdi]
mov qword [rdi], rax
test rcx, rcx
jne 0x140080482
mov byte [rsi], 0
xor eax, eax
mov byte [rsi + 4], al
mov rcx, qword [rsp + 0x60]
test rcx, rcx
jne 0x140080491
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140080445
mov qword [rsp + 0x68], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x14033dc40]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140110970
mov rax, rsi
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
ud2
mov dword [rsi], 1
jmp 0x140080472
mov dword [rsi], 2
mov al, 1
jmp 0x140080418
mov dword [rsi], 0
mov byte [rsi + 4], 1
jmp 0x140080425
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x14033dc40]
jmp 0x140080413
mov qword [rsp + 0x60], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x14033dc40]
jmp 0x140080425
Function at 0x140083910
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rax, qword [0x14034e040]
xor rax, rsp
mov qword [rsp + 0x50], rax
cmp r8, 0x30
ja 0x140083a59
mov r14, r8
mov r15, rdx
mov rsi, rcx
movaps xmm0, xmmword [0x1402cdfe0]
lea rdi, [rsp + 0x40]
movaps xmmword [rdi], xmm0
movaps xmmword [rdi - 0x10], xmm0
movaps xmmword [rdi - 0x20], xmm0
lea r12, [rsp + 0x30]
lea rbx, [rcx + 0x108]
mov eax, dword [rcx + 0x114]
bswap eax
inc eax
bswap eax
mov dword [rcx + 0x114], eax
mov rax, qword [rcx + 0xf8]
lea rdx, [rsp + 0x20]
mov rcx, rbx
mov r8, rsi
call qword [0x14033dc40]
mov eax, dword [rsi + 0x114]
bswap eax
inc eax
bswap eax
mov dword [rsi + 0x114], eax
mov rax, qword [rsi + 0xf8]
mov rcx, rbx
mov rdx, r12
mov r8, rsi
call qword [0x14033dc40]
mov eax, dword [rsi + 0x114]
bswap eax
inc eax
bswap eax
mov dword [rsi + 0x114], eax
mov rax, qword [rsi + 0xf8]
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call qword [0x14033dc40]
test r14, r14
je 0x1400839f3
xor eax, eax
mov cl, byte [r15 + rax]
xor byte [rsp + rax + 0x20], cl
inc rax
cmp r14, rax
jne 0x1400839e3
mov ecx, 1
call fcn.1400e72c0
lea rcx, [rsp + 0x20]
mov edx, 0x100
mov r8, rsi
bt eax, 0x19
jae 0x140083a5d
call fcn.140002fe0
lea rax, [0x140001d60]
lea rcx, section..text
mov qword [rsi + 0xf8], rcx
mov qword [rsi + 0x100], rax
movups xmm0, xmmword [rdi]
movups xmmword [rbx], xmm0
mov esi, 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140110970
mov eax, esi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
xor esi, esi
jmp 0x140083a3c
bt eax, 9
jae 0x140083a78
call fcn.1400040d0
lea rax, [0x1400045a0]
lea rcx, [0x1400042a0]
jmp 0x140083a23
call fcn.1401f8140
lea rax, [0x1401f8940]
lea rcx, [0x1401f8020]
jmp 0x140083a23

Function at 0x140083aa0
Capabilities:
Encode data using xor
Hash data using sha1 via x86 extensions

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov ecx, 2
call fcn.1400e72c0
mov ebp, eax
bt eax, 0x1d
jb 0x140083ae3
not ebp
test ebp, 0x128
jne 0x140083b09
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
jmp fcn.140010eb0
mov ecx, 1
call fcn.1400e72c0
bt eax, 9
jae 0x140083ac3
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
jmp fcn.14000ef40
mov ecx, 1
call fcn.1400e72c0
mov ebp, eax
bt eax, 0x1c
jae 0x140083b28
xor ecx, ecx
call fcn.1400e72c0
bt eax, 0x1e
jb 0x140083b52
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
bt ebp, 9
jb 0x140083b44
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
jmp fcn.14000df00
nop
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
jmp fcn.14000f210
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
jmp fcn.1400100b0
Function at 0x14008fa80
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x248
mov rax, qword [0x14034e040]
xor rax, rsp
mov qword [rsp + 0x240], rax
movaps xmm0, xmmword [0x1402cdfe0]
lea rcx, [rsp + 0x20]
movaps xmmword [rcx], xmm0
call sub.ntdll.dll_RtlFormatCurrentUserKeyPath
mov esi, eax
test eax, eax
js 0x14008fbfc
lea rdi, [rsp + 0x20]
mov rdx, qword [rdi + 8]
lea rbx, [0x1403655b0]
mov r14d, 0xff
mov r8d, 0xff
mov rcx, rbx
call fcn.140132b1c
mov rcx, rbx
call fcn.140131e24
sub r14, rax
lea rdx, [0x1402d8114]
mov rcx, rbx
mov r8, r14
call fcn.140132b1c
mov rcx, rdi
call sub.ntdll.dll_RtlFreeUnicodeString
lea rbx, [rsp + 0x30]
mov r8d, 0x208
mov rcx, rbx
xor edx, edx
call fcn.1401496f0
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rdi, rax
lea rcx, str.PROGRAMFILES
mov rdx, rbx
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x14008fb5c
mov r8d, eax
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.140132b64
test eax, eax
je 0x14008fc20
lea rcx, str.PROGRAMFILES_X86_
lea rdx, [rsp + 0x30]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x14008fb97
mov r8d, eax
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.140132b64
test eax, eax
je 0x14008fc20
xor eax, eax
mov byte [0x1403651a9], al
mov dword [rsp + 0x30], 0
lea rcx, [0x1402dc504]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x1402f6b30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14008fc27
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x30]
mov rcx, rax
mov rax, rdi
call qword [0x14033dc40]
test eax, eax
je 0x14008fc27
cmp dword [rsp + 0x30], 0
setne al
mov byte [0x1403657b0], al
mov byte [0x1403651a8], 1
test esi, esi
setns bl
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140110970
mov eax, ebx
add rsp, 0x248
pop rbx
pop rdi
pop rsi
pop r14
ret
mov al, 1
jmp 0x14008fb99
xor eax, eax
jmp 0x14008fbef