joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140037f70
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x70
mov rax, qword [0x140061040]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rsi, qword [0x1400d4380]
mov rbp, rcx
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x14003818e
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x14003818e
mov qword [rsp + 0x80], rbx
mov ecx, 0x50
mov qword [rsp + 0x88], rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r8, qword [0x1400d4380]
xor ebx, ebx
mov rdi, rax
test r8, r8
je 0x140038044
movsx rdx, word [r8 + 0x6120]
lea rax, [r8 + 0x6124]
mov r9d, dword [r8 + 0x3f88]
lea rax, [rax + rdx*8]
cmp dword [rax], r9d
je 0x140038039
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x6120], cx
movsx rax, cx
lea rax, [rax*8 + 0x6124]
add rax, r8
mov dword [rax], r9d
mov dword [rax + 4], ebx
inc word [rax + 4]
inc dword [r8 + 0x6118]
test rdi, rdi
je 0x140038061
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi + 0x20], xmm0
movups xmmword [rdi + 0x30], xmm0
movups xmmword [rdi + 0x40], xmm0
jmp 0x140038064
mov rdi, rbx
or dword [rsi + 0xc], 6
lea rax, [0x140058c28]
mov qword [rsi + 0x80], rax
mov qword [rsi + 0x90], rdi
mov qword [rdi], rbp
mov rax, qword [rsp + 0x58]
mov qword [rdi + 0x20], rax
mov rax, qword [rsp + 0x60]
mov qword [rdi + 0x18], rax
mov dword [rdi + 0x28], 9
test r8, r8
je 0x1400380a7
mov rsi, qword [r8 + 0x90]
jmp 0x1400380aa
mov rsi, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
shr rax, 0x10
mov r9d, 4
movzx ecx, ax
lea r8, [rsi + 0x2c]
mov edx, 0x20001004
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x1400380d5
mov dword [rsi + 0x2c], ebx
mov rax, qword [0x1400d4380]
mov rcx, qword [rax + 0x4b60]
mov rax, qword [rcx]
mov qword [rax + 0x28], rbp
lea rax, str.xinput1_4.dll
mov qword [rsp + 0x30], rax
lea rax, str.xinput1_3.dll
mov qword [rsp + 0x38], rax
lea rax, str.xinput9_1_0.dll
mov qword [rsp + 0x40], rax
lea rax, str.xinput1_2.dll
mov qword [rsp + 0x48], rax
lea rax, str.xinput1_1.dll
mov qword [rsp + 0x50], rax
mov byte [rdi + 0x31], 1
nop word [rax + rax]
mov rcx, qword [rsp + rbx*8 + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
jne 0x14003814e
inc rbx
cmp rbx, 5
jl 0x140038130
jmp 0x14003817a
lea rdx, str.XInputGetCapabilities
mov qword [rdi + 0x38], rsi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.XInputGetState
mov rcx, rsi
mov qword [rdi + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rdi + 0x48], rax
mov rdi, qword [rsp + 0x88]
mov al, 1
mov rbx, qword [rsp + 0x80]
jmp 0x140038190
xor al, al
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14004fe20
mov rbp, qword [rsp + 0x90]
add rsp, 0x70
pop rsi
ret
Function at 0x1400480c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x140061040]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, rdx
mov r14, rcx
call fcn.140017990
movss xmm0, dword [rdi + 4]
lea r9, [rsp + 0x30]
movss xmm1, dword [rdi]
lea rdx, [rsp + 0x20]
movss dword [rsp + 0x24], xmm0
lea rcx, str.ColorButton
movss xmm0, dword [rdi + 8]
xor r8d, r8d
movss dword [rsp + 0x28], xmm0
movss dword [rsp + 0x20], xmm1
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x2c], 0x3f800000
call fcn.14004a9e0
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.140018650
test al, al
je 0x1400481e2
xor ecx, ecx
call fcn.14000db80
test al, al
je 0x1400481e2
mov qword [rsp + 0x80], rbp
lea rcx, str.ColorPickerPopup
mov rbp, qword [0x1400d4380]
xor edx, edx
mov byte [0x1400d43f8], 1
mov rbx, qword [rbp + 0x4040]
movsxd rax, dword [rbx + 0x108]
mov r8, qword [rbx + 0x110]
mov r8d, dword [r8 + rax*4 - 4]
call fcn.1400094e0
mov rcx, qword [rbx]
mov esi, eax
cmp dword [rcx + 0x4094], eax
jne 0x1400481b2
lea r8, str.ColorPickerPopup
mov edx, 0xb
mov ecx, eax
call fcn.140023040
test byte [rbp + 0x607c], 4
mov rbp, qword [rsp + 0x80]
je 0x1400481d9
mov r8d, esi
lea rdx, str.ColorPickerPopup
lea rcx, str._popup__OpenPopup___s_____0x_08X__n
call fcn.140022c40
xor edx, edx
mov ecx, esi
call fcn.14001bd90
mov rbx, qword [0x1400d4380]
mov eax, dword [rbx + 0x4b38]
cmp dword [rbx + 0x4b28], eax
jg 0x140048206
mov dword [rbx + 0x4a50], 0
jmp 0x140048314
mov rbx, qword [rbx + 0x4040]
lea rcx, str.ColorPickerPopup
xor edx, edx
movsxd rax, dword [rbx + 0x108]
mov r8, qword [rbx + 0x110]
mov r8d, dword [r8 + rax*4 - 4]
call fcn.1400094e0
mov rcx, qword [rbx]
mov esi, eax
cmp dword [rcx + 0x4094], eax
jne 0x14004824e
lea r8, str.ColorPickerPopup
mov edx, 0xb
mov ecx, eax
call fcn.140023040
mov ecx, esi
call fcn.14001c330
test al, al
je 0x140048314
movss xmm0, dword [rdi]
lea rdx, [rsp + 0x30]
movss xmm1, dword [rdi + 4]
xor r9d, r9d
movss dword [rsp + 0x30], xmm0
mov rcx, r14
movss xmm0, dword [rdi + 8]
movss dword [rsp + 0x34], xmm1
lea r8d, [r9 + 2]
movss dword [rsp + 0x38], xmm0
mov dword [rsp + 0x3c], 0x3f800000
call fcn.1400485c0
test al, al
je 0x1400482bd
movss xmm0, dword [rsp + 0x30]
movss xmm1, dword [rsp + 0x34]
movss dword [rdi], xmm0
movss xmm0, dword [rsp + 0x38]
movss dword [rdi + 8], xmm0
movss dword [rdi + 4], xmm1
mov rbx, qword [0x1400d4380]
mov rcx, qword [rbx + 0x4040]
cmp qword [rbx + 0x4b68], rcx
jne 0x1400482f8
cmp byte [rbx + 0x4c09], 0
je 0x1400482f8
cmp dword [rbx + 0x4bb8], 0
jne 0x1400482f8
mov eax, dword [rbx + 0x4c0c]
and eax, 0xfffffff2
or eax, 2
mov dword [rbx + 0x4c0c], eax
test dword [rcx + 0x14], 0x1000000
je 0x140048308
mov byte [rbx + 0x3f96], 1
call fcn.140016980
mov byte [rbx + 0x3f96], 0
mov rax, qword [0x1400d4380]
mov rcx, qword [rax + 0x4040]
movzx eax, byte [0x1400d43f8]
dec dword [rcx + 0x108]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14004fe20
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
Function at 0x14004f5b0
Capabilities:
Log keystrokes via polling

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x70
mov rax, qword [0x140061040]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp byte [0x1400d3be0], 0
mov rbx, qword [0x1400d43d0]
je 0x14004f7bd
mov qword [r11 + 8], rsi
xor esi, esi
mov qword [r11 + 0x10], rdi
nop word [rax + rax]
xor edx, edx
lea rcx, [0x1400592a0]
call qword [sym.imp.USER32.dll_FindWindowA]
mov rdi, rax
test rax, rax
je 0x14004f7a6
mov rcx, qword [rbx + 0x50]
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], esi
call qword [sym.imp.USER32.dll_GetWindowDisplayAffinity]
cmp byte [0x1400d3c5d], sil
je 0x14004f634
cmp dword [rsp + 0x40], esi
jne 0x14004f647
mov edx, 0x11
jmp 0x14004f63d
cmp dword [rsp + 0x40], 0x11
jne 0x14004f647
xor edx, edx
mov rcx, qword [rbx + 0x50]
call qword [sym.imp.USER32.dll_SetWindowDisplayAffinity]
mov rcx, qword [rbx + 0x50]
mov edx, 0xffffffec
call qword [sym.imp.USER32.dll_GetWindowLongA]
cmp byte [0x1400d3be1], sil
je 0x14004f66e
cmp eax, 0x80088
je 0x14004f68a
mov r8d, 0x80088
jmp 0x14004f67b
cmp eax, 0x800a8
je 0x14004f68a
mov r8d, 0x800a8
mov rcx, qword [rbx + 0x50]
mov edx, 0xffffffec
call qword [sym.imp.USER32.dll_SetWindowLongA]
mov ecx, dword [0x1400d3c60]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
je 0x14004f6bd
cmp byte [0x1400d4410], sil
jne 0x14004f6bd
cmp byte [0x1400d3be1], sil
mov byte [0x1400d4410], 1
sete byte [0x1400d3be1]
jmp 0x14004f6e0
mov ecx, dword [0x1400d3c60]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
jne 0x14004f6e0
cmp byte [0x1400d4410], sil
je 0x14004f6e0
mov byte [0x1400d4410], sil
xorps xmm0, xmm0
mov qword [rsp + 0x48], rsi
lea rdx, [rsp + 0x50]
mov rcx, rdi
movups xmmword [rsp + 0x50], xmm0
call qword [sym.imp.USER32.dll_GetClientRect]
lea rdx, [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.USER32.dll_ClientToScreen]
mov eax, dword [0x1400d3bf0]
mov rcx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x48]
mov r9d, dword [rsp + 0x4c]
cmp dword [rsp + 0x50], eax
jne 0x14004f756
mov eax, dword [0x1400d3bfc]
cmp dword [rsp + 0x5c], eax
jne 0x14004f756
mov eax, dword [0x1400d3bf4]
cmp dword [rsp + 0x54], eax
jne 0x14004f756
cmp ecx, dword [0x1400d3bf8]
jne 0x14004f756
cmp r8d, dword [0x1400d3c00]
jne 0x14004f756
cmp r9d, dword [0x1400d3c04]
je 0x14004f78c
movups xmm0, xmmword [rsp + 0x50]
mov rax, rcx
mov dword [rsp + 0x30], 8
shr rax, 0x20
xor edx, edx
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
movaps xmmword [0x1400d3bf0], xmm0
mov qword [0x1400d3c00], r8
mov rcx, qword [rbx + 0x50]
call qword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x1400d3be0], sil
jne 0x14004f5f0
jmp 0x14004f7ad
mov byte [0x1400d3be0], sil
mov rsi, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14004fe20
add rsp, 0x70
pop rbx
ret
Function at 0x140050950
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14005099a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14005099a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14005099a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14005099a
cmp dword [rcx + 0x84], 0xe
jbe 0x14005099a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14005099c
xor al, al
add rsp, 0x28
ret
Function at 0x140004e28
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp dword [0x140057dc8], 2
mov edi, r8d
mov esi, edx
mov rbx, rcx
jl 0x140004e84
movaps xmm0, xmmword [0x140030ae0]
movaps xmm1, xmmword [0x140030af0]
movdqa xmmword [0x140039b70], xmm0
movaps xmm0, xmmword [0x140030b00]
movdqa xmmword [0x140039b60], xmm1
movaps xmm1, xmmword [0x140030b10]
movdqa xmmword [0x140039b50], xmm0
movdqa xmmword [0x140039b40], xmm1
xor edx, edx
mov r8d, 0xf0
call fcn.140020cd0
xor r11d, r11d
mov qword [rbx + 0x110], r11
mov byte [rbx + 0x118], r11b
mov rcx, qword [rbx + 0xf8]
lea rax, [0x140030a20]
mov eax, dword [r11 + rax]
mov dword [r11 + rcx], eax
add r11, 4
cmp r11, 0x20
jl 0x140004ea2
mov rax, qword [rbx + 0xf8]
bts edi, 0xd
xor dword [rax], 0x2080020
mov rax, qword [rbx + 0xf8]
shl edi, 0x10
xor dword [rax + 8], esi
mov rax, qword [rbx + 0xf8]
mov rbx, qword [rsp + 0x30]
xor dword [rax + 0xc], edi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140005f04
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [rcx + 4], 0
mov r8, rcx
jne 0x140005f4b
xor r9d, r9d
mov r10d, r9d
mov r11d, 8
mov edx, r10d
mov ecx, r10d
shr edx, 1
mov eax, edx
mov r10d, edx
xor eax, 0xedb88320
and cl, 1
cmovne r10d, eax
sub r11, 1
jne 0x140005f19
inc r9d
mov dword [r8], r10d
add r8, 4
cmp r9d, 0x100
jb 0x140005f10
repz ret

Function at 0x140005fc4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov r10, r8
mov rbx, rdx
mov r11d, ecx
lea rsi, [0x140039b80]
test r8, r8
je 0x14000600d
test bl, 7
je 0x14000600d
movzx ecx, byte [rbx]
movzx eax, r11b
inc rbx
xor rcx, rax
mov eax, r11d
mov r11d, dword [rsi + rcx*4]
shr eax, 8
xor r11d, eax
sub r10, 1
jne 0x140005fe8
cmp r10, 8
jb 0x1400060ba
mov rdi, r10
shr rdi, 3
mov rax, rdi
imul rax, rax, 0xfffffffffffffff8
add r10, rax
xor r11d, dword [rbx]
mov r9d, dword [rbx + 4]
add rbx, 8
mov eax, r9d
shr eax, 0x10
movzx edx, al
mov eax, r9d
mov r8d, dword [rsi + rdx*4 + 0x400]
shr eax, 0x18
movzx ecx, al
mov eax, r9d
xor r8d, dword [rsi + rcx*4]
shr eax, 8
movzx ecx, al
mov eax, r11d
xor r8d, dword [rsi + rcx*4 + 0x800]
shr eax, 0x18
movzx ecx, al
mov eax, r11d
xor r8d, dword [rsi + rcx*4 + 0x1000]
shr eax, 0x10
movzx ecx, al
mov eax, r11d
xor r8d, dword [rsi + rcx*4 + 0x1400]
shr eax, 8
movzx ecx, al
movzx eax, r9b
xor r8d, dword [rsi + rcx*4 + 0x1800]
xor r8d, dword [rsi + rax*4 + 0xc00]
movzx eax, r11b
mov r11d, r8d
xor r11d, dword [rsi + rax*4 + 0x1c00]
sub rdi, 1
jne 0x140006028
test r10, r10
je 0x1400060df
movzx ecx, byte [rbx]
movzx eax, r11b
inc rbx
xor rcx, rax
mov eax, r11d
mov r11d, dword [rsi + rcx*4]
shr eax, 8
xor r11d, eax
sub r10, 1
jne 0x1400060bf
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
mov eax, r11d
ret
Function at 0x140006444
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x1f0
mov r13d, 0x40
mov rbp, r9
mov r12, r8
mov rbx, rdx
mov rsi, rcx
cmp rdx, r13
jbe 0x1400064b6
lea rcx, [rax - 0x88]
call fcn.140013dc8
lea rcx, [rsp + 0x180]
mov r8, rbx
mov rdx, rsi
call fcn.1400140a4
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x180]
call fcn.140014168
lea rsi, [rsp + 0x80]
lea ebx, [r13 - 0x20]
xor edi, edi
mov dl, 0x36
mov r8, rdi
cmp rbx, rdi
jbe 0x1400064e2
lea rax, [rsp + 0x20]
mov r9, rsi
sub r9, rax
lea rcx, [rsp + r8 + 0x20]
inc r8
mov al, byte [r9 + rcx]
xor al, dl
mov byte [rcx], al
cmp r8, rbx
jb 0x1400064cd
cmp rbx, r13
jae 0x1400064f7
mov r8, r13
lea rcx, [rsp + rbx + 0x20]
sub r8, rbx
call fcn.140020cd0
lea rcx, [rsp + 0xa0]
call fcn.140013dc8
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0xa0]
mov r8, r13
call fcn.1400140a4
lea rcx, [rsp + 0xa0]
mov r8, rbp
mov rdx, r12
call fcn.1400140a4
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0xa0]
call fcn.140014168
lea rcx, [rsp + 0x110]
call fcn.140013dc8
mov dl, 0x5c
cmp rbx, rdi
jbe 0x14000656e
lea rax, [rsp + 0x20]
sub rsi, rax
lea rcx, [rsp + rdi + 0x20]
inc rdi
mov al, byte [rsi + rcx]
xor al, dl
mov byte [rcx], al
cmp rdi, rbx
jb 0x14000655a
cmp rbx, r13
jae 0x140006583
mov r8, r13
lea rcx, [rsp + rbx + 0x20]
sub r8, rbx
call fcn.140020cd0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x110]
mov r8, r13
call fcn.1400140a4
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x110]
mov r8d, 0x20
call fcn.1400140a4
mov rdx, qword [rsp + 0x230]
lea rcx, [rsp + 0x110]
call fcn.140014168
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x1400065e4
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x110
mov rax, r8
mov r8d, 0x40
mov r13, rcx
cmp r9, r8
mov r12, rdx
lea rcx, [r11 - 0x88]
cmovb r8, r9
mov rdx, rax
mov rbx, r9
call fcn.1400210c0
lea rax, [rsp + 0x40]
lea r9, [rbx + 4]
lea r8, [rsp + 0xa0]
mov rdx, r12
mov rcx, r13
mov qword [rsp + 0x20], rax
mov byte [rsp + rbx + 0xa0], 0
mov byte [rsp + rbx + 0xa1], 0
mov byte [rsp + rbx + 0xa2], 0
mov byte [rsp + rbx + 0xa3], 1
call fcn.140006444
mov r14d, 0x20
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x78]
mov r8, r14
call fcn.1400210c0
mov r11d, dword [rsp + 0x168]
lea eax, [r14 - 0x10]
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0x150]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x158]
dec r11d
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x160]
mov dword [rsp + 0x30], r11d
lea rsi, [rsp + 0x60]
lea rdi, [rsp + 0x30]
lea ebp, [r14 - 0x1d]
mov qword [rsp + 0x70], rax
cmp dword [rdi], 0
jbe 0x140006731
mov ebx, dword [rdi]
lea rax, [rsp + 0xf0]
lea r8, [rsp + 0x40]
mov r9, r14
mov rdx, r12
mov rcx, r13
mov qword [rsp + 0x20], rax
call fcn.140006444
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x40]
mov r8, r14
call fcn.1400210c0
xor r11d, r11d
mov rcx, r14
mov al, byte [rsp + r11 + 0x40]
inc r11
xor byte [rsp + r11 + 0x77], al
sub rcx, 1
jne 0x140006718
sub rbx, 1
jne 0x1400066dd
mov rcx, qword [rsi]
lea rdx, [rsp + 0x78]
mov r8, r14
call fcn.1400210c0
add rdi, 4
add rsi, 8
sub rbp, 1
jne 0x1400066d6
lea edx, [rbp + 0x44]
lea rcx, [rsp + 0xa0]
call fcn.14000f7ec
lea rcx, [rsp + 0x78]
mov rdx, r14
call fcn.14000f7ec
lea rcx, [rsp + 0x40]
mov rdx, r14
call fcn.14000f7ec
lea rcx, [rsp + 0xf0]
mov rdx, r14
call fcn.14000f7ec
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
ret
Function at 0x1400067ac
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], r9
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x2a0
mov esi, dword [rsp + 0x300]
mov r13, r8
mov r15b, dl
mov r12, rcx
cmp esi, 0x18
ja 0x140006a09
xor ebx, ebx
lea rdi, [rcx + 0x4b4]
cmp dword [rdi + 0x134], esi
jne 0x140006825
mov rdx, r13
mov rcx, rdi
call fcn.14000f91c
test al, al
je 0x140006825
mov rdx, qword [rsp + 0x2f0]
lea rcx, [rdi + 0x102]
mov r8d, 0x10
call fcn.140021410
test eax, eax
je 0x140006a25
inc ebx
add rdi, 0x178
cmp ebx, 4
jb 0x1400067ec
mov rcx, qword [rsp + 0x2e8]
mov edi, 0x200
lea rdx, [rsp + 0xa0]
mov r8, rdi
call fcn.1400156c8
mov ecx, esi
mov ebx, 1
shl ebx, cl
lea rcx, [rsp + 0xa0]
call fcn.140021000
mov r8, qword [rsp + 0x2f0]
mov dword [rsp + 0x38], ebx
mov rdx, rax
lea rax, [rsp + 0x60]
mov ebx, 0x10
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x80]
lea rcx, [rsp + 0xa0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov r9, rbx
mov qword [rsp + 0x20], rax
call fcn.1400065e4
lea rcx, [rsp + 0xa0]
mov rdx, rdi
call fcn.14000f7ec
mov ecx, dword [r12 + 0xa94]
mov rdx, r13
mov rax, rcx
mov r8d, 0x102
and eax, 3
imul rax, rax, 0x178
lea rdi, [rax + r12 + 0x4b4]
lea eax, [rcx + 1]
mov dword [r12 + 0xa94], eax
mov rcx, rdi
mov dword [rdi + 0x134], esi
call fcn.1400210c0
mov rdx, qword [rsp + 0x2f0]
lea rcx, [rdi + 0x102]
mov r8, rbx
call fcn.1400210c0
lea esi, [rbx + 0x10]
lea rdx, [rsp + 0x40]
lea rcx, [rdi + 0x112]
mov r8, rsi
call fcn.1400210c0
lea rcx, [rdi + 0x138]
lea rdx, [rsp + 0x60]
mov r8, rsi
call fcn.1400210c0
lea rcx, [rdi + 0x158]
lea rdx, [rsp + 0x80]
mov r8, rsi
call fcn.1400210c0
lea rcx, [rdi + 0x112]
xor r9d, r9d
mov r8b, 1
mov rdx, rsi
call fcn.14000f698
mov rcx, qword [rsp + 0x308]
test rcx, rcx
je 0x140006985
lea rdx, [rsp + 0x80]
mov r8, rsi
call fcn.1400210c0
mov rbx, qword [rsp + 0x310]
test rbx, rbx
je 0x1400069cf
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 8]
call fcn.140020cd0
xor r11d, r11d
lea rdx, [rsp + 0x60]
mov r8, rsi
mov al, byte [rdx]
mov rcx, r11
inc r11
and ecx, 7
inc rdx
xor byte [rcx + rbx], al
sub r8, 1
jne 0x1400069ab
lea rcx, [rsp + 0x60]
mov rdx, rsi
call fcn.14000f7ec
mov rax, qword [rsp + 0x2f8]
test rax, rax
je 0x1400069fc
lea rcx, [r12 + 0xa9c]
lea r8, [rsp + 0x40]
mov r9d, 0x100
mov dl, r15b
mov qword [rsp + 0x20], rax
call fcn.14000efd8
lea rcx, [rsp + 0x40]
mov rdx, rsi
call fcn.14000f7ec
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret
xor r9d, r9d
lea rcx, [rdi + 0x112]
xor r8d, r8d
lea esi, [r9 + 0x20]
mov rdx, rsi
call fcn.14000f698
lea rdx, [rdi + 0x112]
lea rcx, [rsp + 0x40]
mov r8, rsi
call fcn.1400210c0
lea rcx, [rdi + 0x112]
xor r9d, r9d
mov r8b, 1
mov rdx, rsi
call fcn.14000f698
lea rdx, [rdi + 0x138]
lea rcx, [rsp + 0x60]
mov r8, rsi
call fcn.1400210c0
lea rdx, [rdi + 0x158]
lea rcx, [rsp + 0x80]
mov r8, rsi
call fcn.1400210c0
jmp 0x140006968
Function at 0x140006b5c
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x50
cmp dword [rcx], 2
mov rdi, rdx
mov rbx, rcx
mov esi, 0x20
jne 0x140006bcc
mov eax, dword [rcx + 4]
lea r9d, [rsi - 0x1c]
lea r8, [r11 + 8]
mov dword [rsp + 0x60], eax
lea rax, [r11 - 0x28]
mov rdx, rsi
mov rcx, rdi
mov qword [r11 - 0x38], rax
call fcn.140006444
xor r11d, r11d
lea r8, [rsp + 0x30]
mov dword [rbx + 4], r11d
mov edx, r11d
movzx eax, byte [r8]
mov ecx, r11d
inc r11d
and ecx, 3
inc r8
shl ecx, 3
shl eax, cl
xor edx, eax
cmp r11d, esi
jb 0x140006bad
mov dword [rbx + 4], edx
cmp dword [rbx], 3
jne 0x140006bfe
lea rax, [rsp + 0x30]
lea r8, [rbx + 4]
mov r9, rsi
mov rdx, rsi
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.140006444
lea rdx, [rsp + 0x30]
lea rcx, [rbx + 4]
mov r8, rsi
call fcn.1400210c0
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x140009acc
Capabilities:
Move file

Disassembly:
push r12
mov eax, 0x5060
call fcn.14002ea50
sub rsp, rax
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x5070], rbx
mov qword [rsp + 0x5078], rbp
mov qword [rsp + 0x5080], rsi
mov qword [rsp + 0x5088], rdi
mov rbx, rcx
mov r12d, 0x800
mov r8d, r12d
lea rdx, [rsp + 0x4060]
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
xor ebp, ebp
cmp eax, ebp
je 0x140009ce6
cmp eax, r12d
jae 0x140009ce6
mov r8d, r12d
lea rdx, [rsp + 0x3060]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetShortPathNameW]
cmp eax, ebp
je 0x140009ce2
cmp eax, r12d
jae 0x140009ce2
lea rcx, [rsp + 0x4060]
call fcn.14000c008
mov rsi, rax
lea rcx, [rsp + 0x3060]
call fcn.14000c008
mov rdi, rax
cmp word [rax], bp
je 0x140009cde
mov rdx, rax
mov rcx, rsi
call fcn.140015960
cmp eax, ebp
je 0x140009cde
mov rcx, rbx
call fcn.14000c008
mov rcx, rax
mov rdx, rdi
call fcn.140015960
cmp eax, ebp
jne 0x140009cde
mov ax, bp
mov word [rsp + 0x30], ax
mov edi, ebp
cmp ax, bp
jne 0x140009c1f
mov r8, r12
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.140014338
lea rcx, [rsp + 0x30]
call fcn.14000c008
mov rcx, rax
mov r9d, edi
lea r8, str.rtmp_d
mov rdx, r12
call fcn.140009aa8
lea rcx, [rsp + 0x30]
call fcn.14000abe4
cmp al, bpl
je 0x140009c03
mov eax, ebp
mov word [rsp + 0x30], ax
jmp 0x140009c08
mov ax, word [rsp + 0x30]
add edi, 0x7b
cmp edi, 0x2710
jl 0x140009bb7
cmp ax, bp
jne 0x140009c1f
xor al, al
jmp 0x140009ce8
mov r8, r12
mov rdx, rbx
lea rcx, [rsp + 0x2060]
call fcn.140014338
mov r8, r12
mov rdx, rsi
lea rcx, [rsp + 0x2060]
call fcn.14000c1bc
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x2060]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
cmp eax, ebp
jne 0x140009c63
xor al, al
jmp 0x140009ce8
lea rcx, [rsp + 0x1030]
call fcn.140009e38
nop
mov dil, bpl
mov rcx, rbx
call fcn.14000abe4
cmp al, bpl
jne 0x140009c9a
mov r8d, 0x12
mov rdx, rbx
lea rcx, [rsp + 0x1030]
call fcn.14000a030
mov dil, al
lea rdx, [rsp + 0x2060]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
cmp dil, bpl
je 0x140009ccd
lea rcx, [rsp + 0x1030]
call fcn.14000a18c
lea rcx, [rsp + 0x1030]
call fcn.14000a1f4
nop
lea rcx, [rsp + 0x1030]
call fcn.14000a47c
mov al, 1
jmp 0x140009ce8
xor al, al
jmp 0x140009ce8
xor al, al
jmp 0x140009ce8
xor al, al
lea r11, [rsp + 0x5060]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret