joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14019bb3e
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x80
mov rsi, rcx
mov rax, qword [0x140346038]
xor rax, rsp
mov qword [rsp + 0x78], rax
xorps xmm0, xmm0
lea rdi, [rsp + 0x40]
movaps xmmword [rdi + 0x20], xmm0
movaps xmmword [rdi + 0x10], xmm0
movaps xmmword [rdi], xmm0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx edx, word [rdi]
lea rcx, [rsp + 0x28]
call fcn.1400c8a47
lea rdi, [rsi + 0x10]
cmp byte [rsi + 0x27], 0
js 0x14019bbcc
mov rax, qword [rsp + 0x38]
mov qword [rdi + 0x10], rax
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rdi], xmm0
movzx eax, byte [rsi + 0x27]
test al, al
js 0x14019bbc6
test rax, rax
setne bl
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140156fe0
mov eax, ebx
add rsp, 0x80
pop rbx
pop rdi
pop rsi
ret
mov rax, qword [rsi + 0x18]
jmp 0x14019bba6
mov rcx, qword [rdi]
call fcn.140153bcc
jmp 0x14019bb8d

Function at 0x14019d34c
Capabilities:
Get geographical location

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, rcx
mov rax, qword [0x140346038]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov ecx, 0x10
call qword [sym.imp.KERNEL32.dll_GetUserGeoID]
lea rcx, [rsp + 0x28]
mov edx, eax
call fcn.14007da8d
lea rdi, [rsi + 0xb8]
cmp byte [rsi + 0xcf], 0
js 0x14019d3b1
mov rax, qword [rsp + 0x38]
mov qword [rdi + 0x10], rax
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rdi], xmm0
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140156fe0
nop
add rsp, 0x48
pop rdi
pop rsi
ret
mov rcx, qword [rdi]
call fcn.140153bcc
jmp 0x14019d38b

Function at 0x14019d3bc
Capabilities:
Identify system language via api

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, rcx
mov rax, qword [0x140346038]
xor rax, rsp
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx edx, ax
lea rcx, [rsp + 0x20]
call fcn.1400c8a47
lea rdi, [rsi + 0x88]
cmp byte [rsi + 0x9f], 0
js 0x14019d43a
mov rax, qword [rsp + 0x30]
mov qword [rdi + 0x10], rax
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rdi], xmm0
movzx eax, byte [rsi + 0x9f]
test al, al
js 0x14019d431
test rax, rax
setne bl
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140156fe0
mov eax, ebx
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
mov rax, qword [rsi + 0x90]
jmp 0x14019d414
mov rcx, qword [rdi]
call fcn.140153bcc
jmp 0x14019d3f8
Function at 0x14019d444
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x80
mov rsi, rcx
mov rax, qword [0x140346038]
xor rax, rsp
mov qword [rsp + 0x78], rax
xorps xmm0, xmm0
lea rdi, [rsp + 0x40]
movaps xmmword [rdi + 0x20], xmm0
movaps xmmword [rdi + 0x10], xmm0
movaps xmmword [rdi], xmm0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx edx, word [rdi]
lea rcx, [rsp + 0x28]
call fcn.1400c8a47
lea rdi, [rsi + 0x70]
cmp byte [rsi + 0x87], 0
js 0x14019d4d8
mov rax, qword [rsp + 0x38]
mov qword [rdi + 0x10], rax
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rdi], xmm0
movzx eax, byte [rsi + 0x87]
test al, al
js 0x14019d4d2
test rax, rax
setne bl
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140156fe0
mov eax, ebx
add rsp, 0x80
pop rbx
pop rdi
pop rsi
ret
mov rax, qword [rsi + 0x78]
jmp 0x14019d4b2
mov rcx, qword [rdi]
call fcn.140153bcc
jmp 0x14019d496
Function at 0x1401a0bd2
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x180
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x140346038]
xor rax, rsp
mov qword [rsp + 0x178], rax
mov qword [rcx + 8], rdx
mov eax, dword [0x140362dc0]
mov ecx, dword [0x1403576e0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jle 0x1401a0c57
lea rcx, [0x140362dc0]
call fcn.1401547b8
cmp dword [0x140362dc0], 0xffffffff
jne 0x1401a0c57
lea rcx, [0x140303a40]
lea rdx, str.::IsWow64Process
xor r8d, r8d
call fcn.1400950ce
mov qword [0x140362db8], rax
lea rcx, [0x140362dc0]
call fcn.140153cf4
mov rax, qword [0x140362db8]
test rax, rax
je 0x1401a0e34
lea rdx, [rsp + 0x174]
mov dword [rdx], 0xaaaaaaaa
mov rcx, rdi
call qword [0x14037e008]
test eax, eax
je 0x1401a0de3
cmp dword [rsp + 0x174], 0
setne byte [rsi + 0x81]
jne 0x1401a0d4c
movaps xmm0, xmmword [0x1402fccc0]
lea rbx, [rsp + 0x30]
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [rbx], 9
sete byte [rsi + 0x80]
cmp byte [rsi + 0x81], 0
setne dl
lea rax, [rsi + 0x30]
lea r9, [rsi + 0x28]
mov qword [rsp + 0x20], rax
mov rcx, rdi
mov r8, rsi
call fcn.1401a0e84
test al, al
je 0x1401a0d5a
cmp byte [rsi + 0x80], 0
mov rdx, qword [rsi + 0x28]
mov rcx, rdi
mov r8, rsi
je 0x1401a0d45
call fcn.14008088e
test al, al
je 0x1401a0da6
mov dl, byte [rsi + 0x80]
mov rcx, rdi
mov r8, rsi
call fcn.140080387
mov sil, 1
test al, al
je 0x1401a0e40
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.140156fe0
mov eax, esi
add rsp, 0x180
pop rbx
pop rdi
pop rsi
ret
call fcn.14025ccb6
jmp 0x1401a0d04
mov byte [rsi + 0x80], 0
mov dl, 1
jmp 0x1401a0cd0
cmp dword [0x1403629c0], 2
jg 0x1401a0da2
lea rdx, str....._third_partycrashpadcrashpadutilwinprocess_info.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x21e
mov r9d, 2
call fcn.140117f40
lea rcx, [rsp + 0x40]
lea rdx, str.GetProcessBasicInformation_failed
mov r8d, 0x21
call fcn.140097cc9
mov rcx, rsi
call fcn.14009caf0
xor esi, esi
jmp 0x1401a0d28
cmp dword [0x1403629c0], 2
jg 0x1401a0da2
lea rdx, str....._third_partycrashpadcrashpadutilwinprocess_info.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x227
mov r9d, 2
call fcn.140117f40
lea rcx, [rsp + 0x40]
lea rdx, str.ReadProcessData_failed
mov r8d, 0x16
jmp 0x1401a0d95
cmp dword [0x1403629c0], 2
jg 0x1401a0e34
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutilwinprocess_info.cc
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov r8d, 0x4b
mov r9d, 2
call fcn.14009c6a0
lea rcx, [rsp + 0x40]
lea rdx, [0x14031708b]
mov r8d, 0xe
call fcn.140097cc9
mov rcx, rbx
call fcn.14009c720
mov byte [rsi + 0x81], 0
jmp 0x1401a0c9b
cmp dword [0x1403629c0], 2
jg 0x1401a0da2
lea rdx, str....._third_partycrashpadcrashpadutilwinprocess_info.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x22c
mov r9d, 2
call fcn.140117f40
lea rcx, [rsp + 0x40]
lea rdx, str.ReadMemoryInfo_failed
mov r8d, 0x15
jmp 0x1401a0d95
Function at 0x1401d08b4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rax, qword [0x140346038]
xor rax, rsp
mov qword [rsp + 0x30], rax
movups xmm0, xmmword [rdx]
movaps xmmword [rsp + 0x20], xmm0
mov rdi, qword [rcx + 0x50]
mov r12, qword [rcx + 0x58]
mov ebx, 1
cmp rdi, r12
je 0x1401d0948
mov rsi, r8
mov r14, rcx
lea r15, [rsp + 0x20]
mov rcx, rdi
mov rdx, r15
call fcn.14008c988
test al, al
jne 0x1401d0910
add rdi, 0x70
cmp rdi, r12
jne 0x1401d08f5
mov rdi, r12
cmp rdi, qword [r14 + 0x58]
je 0x1401d0948
cmp byte [rdi + 0x27], 0
js 0x1401d0922
lea rcx, [rdi + 0x10]
jmp 0x1401d0926
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
shr ecx, 3
and ecx, 2
cmp eax, 0xffffffff
mov ebx, 1
cmovne ebx, ecx
test ebx, ebx
jne 0x1401d0948
mov qword [rsi], rdi
xor ebx, ebx
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140156fe0
mov eax, ebx
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x1401d0966
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov rax, qword [0x140346038]
xor rax, rsp
mov qword [rsp + 0x38], rax
movups xmm0, xmmword [rdx]
movaps xmmword [rsp + 0x20], xmm0
mov r14, qword [rcx + 0x50]
mov r12, qword [rcx + 0x58]
mov esi, 1
cmp r14, r12
je 0x1401d09e1
mov rdi, r9
mov ebp, r8d
mov rbx, rcx
lea r15, [rsp + 0x20]
mov rcx, r14
mov rdx, r15
call fcn.14008c988
test al, al
jne 0x1401d09c6
add r14, 0x70
cmp r14, r12
jne 0x1401d09ab
mov r14, r12
cmp r14, qword [rbx + 0x58]
je 0x1401d09e1
mov eax, dword [r14 + 0x68]
cmp eax, ebp
je 0x1401d09ff
xor ecx, ecx
cmp eax, 1
sete cl
lea esi, [rcx + rcx*2]
inc esi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140156fe0
mov eax, esi
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
cmp byte [r14 + 0x27], 0
js 0x1401d0a0c
lea rcx, [r14 + 0x10]
jmp 0x1401d0a10
mov rcx, qword [r14 + 0x10]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1401d09e1
shr eax, 3
and eax, 2
mov esi, eax
jne 0x1401d09e1
mov byte [rbx + 0x48], 1
mov qword [rdi], r14
xor esi, esi
jmp 0x1401d09e1
Function at 0x1401d5880
Capabilities:
Hash data using sha256

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa0
mov rsi, r8
mov r8, rdx
mov rdx, rcx
mov rax, qword [0x140346038]
xor rax, rsp
mov qword [rsp + 0x98], rax
xorps xmm0, xmm0
lea rdi, [rsp + 0x20]
movups xmmword [rdi + 0x5c], xmm0
movups xmmword [rdi + 0x50], xmm0
movups xmmword [rdi + 0x40], xmm0
movups xmmword [rdi + 0x30], xmm0
movups xmmword [rdi + 0x20], xmm0
movaps xmm0, xmmword [0x14031a780]
movups xmmword [rdi], xmm0
movaps xmm0, xmmword [0x14031a790]
movups xmmword [rdi + 0x10], xmm0
mov dword [rdi + 0x6c], 0x20
mov rcx, rdi
call fcn.1400eaf50
mov ebx, dword [rdi + 0x6c]
mov ebp, dword [rdi + 0x20]
mov r14d, dword [rdi + 0x24]
lea rdi, [rsp + 0x48]
mov eax, dword [rdi + 0x40]
lea rcx, [rax + 1]
mov byte [rsp + rax + 0x48], 0x80
cmp rax, 0x38
jae 0x1401d59c3
cmp rcx, 0x38
je 0x1401d5926
mov r8d, 0x38
sub r8, rcx
add rcx, rdi
xor edx, edx
call fcn.140159120
bswap r14d
lea rcx, [rsp + 0x20]
mov dword [rcx + 0x60], r14d
bswap ebp
mov dword [rcx + 0x64], ebp
mov r8d, 1
mov rdx, rdi
call fcn.140011fc0
xorps xmm0, xmm0
movups xmmword [rdi + 0x30], xmm0
movups xmmword [rdi + 0x20], xmm0
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi], xmm0
mov dword [rdi + 0x40], 0
lea eax, [rbx - 0x21]
cmp eax, 0xffffffe3
jb 0x1401d597c
shr ebx, 2
xor eax, eax
mov ecx, dword [rsp + rax*4 + 0x20]
bswap ecx
mov dword [rsi + rax*4], ecx
inc rax
cmp rbx, rax
jne 0x1401d596b
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.140156fe0
mov rax, rsi
add rsp, 0xa0
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
cmp eax, 0x3f
je 0x1401d59db
mov r8d, 0x3f
sub r8, rax
add rcx, rdi
xor edx, edx
call fcn.140159120
lea rcx, [rsp + 0x20]
mov r8d, 1
mov rdx, rdi
call fcn.140011fc0
xor ecx, ecx
jmp 0x1401d5913
Function at 0x1401e1bbe
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
sub rsp, 0x68
mov rsi, rcx
mov rax, qword [0x140346038]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x50]
movdqa xmm0, xmmword [0x1402fccc0]
movdqa xmmword [rax], xmm0
movdqa xmmword [rax - 0x10], xmm0
mov r8, qword [rdx]
mov ecx, 0x38
lea r9, str.000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f404142434445464748494a4b4c4d4e4f505152535455565758595a5b5c5d5e5f606162636465666768696a6b6c6d6e6f707172737475767778797a7b7c7d7e7f808182838485868788898a8b8c8d8e8f909192939495969798999a9b9c9d9e9fa0a1a2a3a4a5a6a7a8a9aaabacadaeafb0b1b2b3b4b5b6b7b8b9babbbcbdbebfc0c1c2c3c4c5c6c7c8c9cacbcccdcecfd0d1d2d3d4d5d6d7d8d9dadbdcdddedfe0e1e2e3e4e5e6e7e8e9eaebecedeeeff0f1f2f3f4f5f6f7f8f9fafbfcfdfeff
mov r10, r8
shr r10, cl
movzx r10d, r10b
movzx r10d, word [r9 + r10*2]
mov word [rax], r10w
add rcx, 0xfffffffffffffff8
add rax, 2
cmp rcx, 0xfffffffffffffff8
jne 0x1401e1bfb
lea rax, [rsp + 0x60]
or r8, 1
bsr rcx, r8
xor ecx, 0x3c
shr ecx, 2
mov r8d, 0x10
sub r8d, ecx
movzx r9d, byte [rdx + 8]
cmp r8d, r9d
jb 0x1401e1c52
sub rax, r8
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov rdx, rax
jmp 0x1401e1c89
movzx ecx, byte [rdx + 9]
movd xmm0, ecx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm0, xmm0, 0
movdqa xmmword [rsp + 0x40], xmm0
neg r8
movdqu xmmword [rax + r8 - 0x10], xmm0
sub rax, r9
lea rdi, [rsp + 0x20]
mov rcx, rdi
mov rdx, rax
mov r8, r9
call fcn.1400e86ea
mov rcx, rsi
mov rdx, rdi
call fcn.1401e1924
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140156fe0
nop
add rsp, 0x68
pop rdi
pop rsi
ret
Function at 0x1401e2fa1
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r9
mov rdi, r8
mov rbx, rdx
mov r14, rcx
mov ecx, 2
call sym.msedge.exe_OQS_CPU_has_extension
mov rcx, r14
mov rdx, rbx
mov r8, rdi
mov r9, rsi
test eax, eax
je 0x1401e2fde
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp 0x1401eadcb
nop
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp 0x1401e34fb
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xd0
mov rbx, r9
mov rsi, r8
mov r14, rdx
mov rdi, rcx
mov rax, qword [0x140346038]
xor rax, rsp
vpbroadcastb ymm0, byte [0x140305aa2]
mov qword [rsp + 0xc8], rax
vmovdqu ymmword [rsp + 0xa0], ymm0
vmovdqu ymmword [rsp + 0x20], ymm0
vmovdqu ymmword [rsp + 0x80], ymm0
cmp r8, 4
jb 0x1401e3472
lea r15, [rsp + 0x80]
vmovdqu ymm0, ymmword [r14]
vmovups ymm1, ymmword [r14 + 0x20]
vmovups ymmword [rsp + 0xa0], ymm1
vmovdqu ymmword [rsp + 0x80], ymm0
mov rcx, rdi
mov rdx, r15
mov r8, rbx
vzeroupper
call fcn.1401e3aab
add rsi, 0xfffffffffffffffc
add r14, 0x40
add rdi, 0x40
cmp rsi, 3
ja 0x1401e3432
test rsi, rsi
jne 0x1401e349a
mov rcx, qword [rsp + 0xc8]
xor rcx, rsp
vzeroupper
call fcn.140156fe0
nop
add rsp, 0xd0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
vmovdqu ymm0, ymmword [rsp + 0x20]
vmovdqu ymmword [rsp + 0x60], ymm0
vmovdqu ymmword [rsp + 0x40], ymm0
lea rax, [rsi*4]
xor ecx, ecx
mov edx, dword [r14 + rcx*4]
mov dword [rsp + rcx*4 + 0x80], edx
inc rcx
cmp rax, rcx
jne 0x1401e34b6
lea r14, [rsp + 0x40]
lea rdx, [rsp + 0x80]
mov rcx, r14
mov r8, rbx
vzeroupper
call fcn.1401e3aab
shl rsi, 4
mov rcx, rdi
mov rdx, r14
mov r8, rsi
call fcn.140158a70
jmp 0x1401e3477
mov rax, r8
mov r8, rdx
mov rdx, rcx
shr r8, 4
mov rcx, r9
mov r9, rax
jmp 0x1401e33d7
cmp rdx, 0x10
jb 0x1401eae61
shr rdx, 4
xor eax, eax
vmovdqa xmm0, xmmword [r8]
vpxor xmm0, xmm0, xmmword [rcx + rax]
vaesenc xmm0, xmm0, xmmword [r8 + 0x10]
vaesenc xmm0, xmm0, xmmword [r8 + 0x20]
vaesenc xmm0, xmm0, xmmword [r8 + 0x30]
vaesenc xmm0, xmm0, xmmword [r8 + 0x40]
vaesenc xmm0, xmm0, xmmword [r8 + 0x50]
vaesenc xmm0, xmm0, xmmword [r8 + 0x60]
vaesenc xmm0, xmm0, xmmword [r8 + 0x70]
vaesenc xmm0, xmm0, xmmword [r8 + 0x80]
vaesenc xmm0, xmm0, xmmword [r8 + 0x90]
vaesenc xmm0, xmm0, xmmword [r8 + 0xa0]
vaesenc xmm0, xmm0, xmmword [r8 + 0xb0]
vaesenc xmm0, xmm0, xmmword [r8 + 0xc0]
vaesenc xmm0, xmm0, xmmword [r8 + 0xd0]
vaesenclast xmm0, xmm0, xmmword [r8 + 0xe0]
vmovdqu xmmword [r9 + rax], xmm0
add rax, 0x10
dec rdx
jne 0x1401eaddb
ret
Function at 0x1401e40f0
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x1401e411a
xor eax, eax
xor r9d, r9d
mov r10b, byte [rdx + rax]
xor r10b, byte [rcx + rax]
or r9b, r10b
inc rax
cmp r8, rax
jne 0x1401e40fa
movzx eax, r9b
neg eax
shr eax, 8
and eax, 1
ret
xor eax, eax
jmp 0x1401e4111

Function at 0x1401e4310
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov rax, qword [0x140346038]
xor rax, rsp
mov qword [rsp + 0x50], rax
vmovups ymm0, ymmword [rcx]
vmovups ymm1, ymmword [rcx + 0x10]
vmovups ymmword [rsp + 0x30], ymm1
vmovups ymmword [rsp + 0x20], ymm0
test rdx, rdx
je 0x1401e434f
xor eax, eax
mov cl, byte [rdx + rax]
xor byte [rsp + rax + 0x20], cl
inc rax
cmp rax, 0x30
jne 0x1401e433f
vxorps xmm0, xmm0, xmm0
vmovups ymmword [0x14035af78], ymm0
vmovups ymmword [0x14035af68], ymm0
lea rcx, [rsp + 0x20]
vzeroupper
call fcn.1401e438d
mov dword [0x14035af98], 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140156fe0
nop
add rsp, 0x58
ret

Function at 0x1401e438d
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x68
mov rsi, rcx
mov rax, qword [0x140346038]
xor rax, rsp
mov qword [rsp + 0x60], rax
vpbroadcastb ymm0, byte [0x140305bfc]
vmovdqu ymmword [rsp + 0x40], ymm0
vmovdqu ymmword [rsp + 0x30], ymm0
xor r12d, r12d
lea rdi, [0x14035af68]
lea rbx, [rsp + 0x28]
lea r14, [0x14035af88]
jmp 0x1401e442b
inc cl
mov byte [rax + rdi + 0x20], cl
mov rax, r12
shl rax, 4
lea r15, [rsp + rax]
add r15, 0x30
mov qword [rsp + 0x28], 0
mov rcx, rdi
mov rdx, rbx
vzeroupper
call fcn.1401e2ed3
mov edx, 0x10
mov rcx, r14
mov r8, rdi
mov r9, r15
call fcn.1401e2f38
mov rcx, qword [rsp + 0x28]
call fcn.1401e2f0a
inc r12
cmp r12, 3
je 0x1401e4447
mov eax, 0xf
mov eax, eax
mov cl, byte [rax + rdi + 0x20]
cmp cl, 0xff
jne 0x1401e43d9
mov byte [rax + rdi + 0x20], 0
add eax, 0xffffffff
jb 0x1401e4430
jmp 0x1401e43df
test rsi, rsi
je 0x1401e445e
xor eax, eax
mov cl, byte [rsi + rax]
xor byte [rsp + rax + 0x30], cl
inc rax
cmp rax, 0x30
jne 0x1401e444e
vmovups ymm0, ymmword [rsp + 0x30]
vmovups ymmword [0x14035af68], ymm0
vmovaps xmm0, xmmword [rsp + 0x50]
vmovups xmmword [0x14035af88], xmm0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
vzeroupper
call fcn.140156fe0
nop
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x1401ec55f
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x1401ec585
xor r9d, r9d
xor eax, eax
mov r10b, byte [rdx + rax]
xor r10b, byte [rcx + rax]
or r9b, r10b
inc rax
cmp r8, rax
jne 0x1401ec569
xor eax, eax
test r9b, r9b
setne al
ret
xor eax, eax
ret

Function at 0x1401ec588
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x1401ec5af
neg r9b
xor eax, eax
mov r10b, byte [rcx + rax]
mov r11b, byte [rdx + rax]
xor r11b, r10b
and r11b, r9b
xor r11b, r10b
mov byte [rcx + rax], r11b
inc rax
cmp r8, rax
jne 0x1401ec592
ret
Function at 0x1401ffb8c
Capabilities:
Packed with generic packer

Disassembly:
ja 0x1401ffbed
jg 0x1401ffc03
jge 0x1401ffc04
jb 0x1401ffc12
invalid
imul ebp, dword [rdx + 0x69], 0x7478788d
lea edi, [rax + 0x78]
je 0x1401ffc65
jo 0x1401ffc5f
imul esi, dword [rcx + 0x67], 0x6e6a7e74
jno 0x1401ffc5f
je 0x1401ffc78
push 0x6e
js 0x1401ffc72
imul esi, dword [rax - 0x75], 0x4c
and al, 0x30
xor byte [rax + 0x31], cl
xor rcx, rsp
call fcn.140156fe0
mov rcx, rsi
mov rdx, rdi
loope 0x1401ffbf0
invalid
add rsp, 0x38
pop rdi
pop rsi
jmp fcn.140079fa0
dec dword [rcx + 8]
je 0x1401ffc6a
add rsp, 0x20
add esp, 0x20
pop rsi
ret
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
mov r8, qword [0x14037e008]
mov eax, dword [0x14037e008]
mov edx, 1
add rsp, 0x20
pop rsi
jmp r8
Function at 0x14021c51d
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2c8
movaps xmmword [rsp + 0x2b0], xmm6
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], rdx
mov rax, qword [0x140346038]
xor rax, rsp
mov qword [rsp + 0x2a8], rax
mov rbx, qword [rcx]
mov r12, qword [rcx + 8]
cmp rbx, r12
je 0x14021c588
movabs rbp, 0xaaaaaaaaaaaaaaaa
movaps xmm6, xmmword [0x1402fccc0]
lea rdi, [rsp + 0x50]
lea r14, [rsp + 0x30]
lea r13, [rsp + 0x88]
jmp 0x14021c632
mov rcx, qword [rsp + 0x2a8]
xor rcx, rsp
call fcn.140156fe0
movaps xmm6, xmmword [rsp + 0x2b0]
add rsp, 0x2c8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [rsp + 0xa0]
mov qword [rsp + 0x68], rcx
call fcn.14015468c
mov qword [rsp + 0x70], rax
mov rcx, r13
lea rdx, [rsp + 0x68]
call fcn.1400caf10
mov rcx, r14
mov rdx, r13
call fcn.1400d8440
mov rcx, r13
call fcn.1400d8480
mov rcx, qword [rsp + 0x20]
mov rax, qword [rcx + 8]
cmp rax, qword [rcx + 0x10]
mov rbp, r15
mov rdx, r14
je 0x14021c607
call fcn.140216116
jmp 0x14021c60c
call fcn.140103506
mov rcx, r14
call fcn.1400d8480
cmp byte [rsp + 0x67], 0
jns 0x14021c625
mov rcx, qword [rsp + 0x50]
call fcn.140153bcc
add rbx, 0x18
cmp rbx, r12
je 0x14021c588
mov qword [rsp + 0x60], rbp
movaps xmmword [rsp + 0x50], xmm6
cmp byte [rbx + 0x17], 0
js 0x14021c658
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x60], rax
movups xmm0, xmmword [rbx]
movaps xmmword [rsp + 0x50], xmm0
mov rsi, rdi
jmp 0x14021c66a
mov rdx, qword [rbx]
mov r8, qword [rbx + 8]
mov rsi, rdi
mov rcx, rdi
call fcn.1400bd4a4
mov r15, rbp
mov qword [rsp + 0x40], rbp
movaps xmmword [rsp + 0x30], xmm6
mov rcx, r14
call fcn.1400d8550
mov r8d, 0x208
lea rcx, [rsp + 0xa0]
mov dl, 0xaa
call fcn.140159120
movzx eax, byte [rsp + 0x67]
mov r8d, eax
and r8d, 0x7f
test al, al
cmovs r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x50]
mov rdi, rsi
cmovns rdx, rsi
lea rsi, [rsp + 0x78]
mov rcx, rsi
call fcn.1400e86ea
mov rcx, r13
mov rdx, rsi
call fcn.140130ba0
cmp byte [rsp + 0x9f], 0
mov rcx, r13
jns 0x14021c6e1
mov rcx, qword [rsp + 0x88]
lea rdx, [rsp + 0xa0]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ebp, eax
cmp byte [rsp + 0x9f], 0
jns 0x14021c70e
mov rcx, qword [rsp + 0x88]
call fcn.140153bcc
dec ebp
cmp ebp, 0x102
jbe 0x14021c5b4
mov rcx, qword [rsp + 0x28]
jmp 0x14021c5f0
Function at 0x14023cce0
Capabilities:
Suspend thread

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
lea rax, [0x1402feb08]
mov qword [rcx], rax
mov qword [rcx + 8], rdx
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
setne byte [rsi + 0x10]
mov rax, rsi
add rsp, 0x20
pop rsi
ret

Function at 0x14023cd10
Capabilities:
Resume thread

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rax, qword [0x140346038]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rax, [0x1402feb08]
mov qword [rcx], rax
cmp byte [rcx + 0x10], 0
je 0x14023cd92
mov rsi, rcx
lea rdi, [rsp + 0x2c]
mov rcx, qword [rcx + 8]
mov qword [rdi - 0xc], rcx
mov qword [rdi - 4], 0
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetThreadPriorityBoost]
mov dword [rdi - 4], eax
test eax, eax
je 0x14023cd6d
mov rcx, qword [rsp + 0x20]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_SetThreadPriorityBoost]
mov rcx, qword [rsi + 8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x14023cda7
cmp dword [rsp + 0x28], 0
je 0x14023cd92
mov edx, dword [rsp + 0x2c]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetThreadPriorityBoost]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140156fe0
nop
add rsp, 0x38
pop rdi
pop rsi
ret
int3

Function at 0x14023ceb0
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov ebx, r8d
mov edi, edx
mov rsi, rcx
mov rax, qword [0x140346038]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp byte [rcx + 8], 0
je 0x14023cf21
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, edi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x14023cf2b
mov dil, 1
test bl, bl
je 0x14023cf0a
cmp byte [rsi + 8], 0
je 0x14023cf26
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140156fe0
mov eax, edi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
mov rcx, qword [rsi]
jmp 0x14023cedd
mov rcx, qword [rsi]
jmp 0x14023ceff
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [rsi + 8], 0
je 0x14023cf53
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14023cf58
xor edi, edi
jmp 0x14023cf0a
mov rcx, qword [rsi]
jmp 0x14023cf40
mov dword [rsp + 0x24], 0xaaaaaaaa
cmp byte [rsi + 8], 0
je 0x14023cf7f
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov dil, 1
jmp 0x14023cf0a
mov rcx, qword [rsi]
jmp 0x14023cf6f