joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401148e0
Capabilities:
Link many functions at runtime

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x70
mov qword [rax - 0x58], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov rsi, rcx
xorps xmm0, xmm0
movdqu xmmword [rax - 0x40], xmm0
movdqa xmm1, xmmword [0x140249480]
movdqu xmmword [rax - 0x40], xmm1
xor ebp, ebp
mov word [rax - 0x50], bp
lea r8d, [rbp + 0xc]
lea rdx, str.wintrust.dll
lea rcx, [rax - 0x50]
call fcn.140006b90
nop
call fcn.1400d7f30
mov rcx, rax
lea rdx, [rsp + 0x28]
call fcn.1400d7fe0
mov rbx, rax
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x140114986
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140114981
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140114b2d
call fcn.140183104
movdqa xmm0, xmmword [0x140249480]
movdqu xmmword [rsp + 0x38], xmm0
mov word [rsp + 0x28], bp
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x58], xmm0
movdqa xmm1, xmmword [0x140249480]
movdqu xmmword [rsp + 0x58], xmm1
mov word [rsp + 0x48], bp
mov r8d, 0xb
lea rdx, str.crypt32.dll
lea rcx, [rsp + 0x48]
call fcn.140006b90
nop
call fcn.1400d7f30
mov rcx, rax
lea rdx, [rsp + 0x48]
call fcn.1400d7fe0
mov rdi, rax
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x140114a24
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140114a1f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140114b27
call fcn.140183104
movdqa xmm0, xmmword [0x140249480]
movdqu xmmword [rsp + 0x58], xmm0
mov word [rsp + 0x48], bp
test rbx, rbx
je 0x140114b11
test rdi, rdi
je 0x140114b11
lea rdx, str.CryptCATAdminCalcHashFromFileHandle
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 8], rax
lea rdx, str.CryptCATAdminAcquireContext
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x10], rax
lea rdx, str.CryptCATAdminEnumCatalogFromHash
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x18], rax
lea rdx, str.CryptCATCatalogInfoFromContext
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x20], rax
lea rdx, str.CryptCATAdminReleaseCatalogContext
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x28], rax
lea rdx, str.CryptCATAdminReleaseContext
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x30], rax
lea rdx, str.WTHelperProvDataFromStateData
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x38], rax
lea rdx, str.WTHelperGetProvSignerFromChain
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x40], rax
lea rdx, str.WinVerifyTrust
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x48], rax
lea rdx, str.CertNameToStrW
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x50], rax
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call fcn.140195eec
int3
call fcn.140195eec
int3
Function at 0x1401157d0
Capabilities:
Check os version

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0xb8]
sub rsp, 0x1b0
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], r14
mov rax, qword [0x1402be168]
xor rax, rsp
mov qword [rbp + 0xa0], rax
mov rsi, rcx
xor r14d, r14d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x38], r14d
mov qword [rsp + 0x70], r14
lea ecx, [r14 + 1]
call fcn.1401830c8
mov rbx, rax
mov qword [rsp + 0x70], rax
mov byte [rax], r14b
xor edx, edx
mov r8d, 0x118
lea rcx, [rbp - 0x7c]
call fcn.140189b30
mov dword [rbp - 0x80], 0x11c
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x140115860
cmp dword [rbp - 0x7c], 6
setae al
mov byte [rbx], al
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x30]
call fcn.1400f1be0
test al, al
je 0x1401159b5
cmp qword [rsp + 0x30], 0
je 0x1401159b5
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], r14w
mov r8d, 0xc
lea rdx, str.Advapi32.dll
lea rcx, [rsp + 0x40]
call fcn.140006b90
nop
call fcn.1400d7f30
mov rcx, rax
lea rdx, [rsp + 0x40]
call fcn.1400d7fe0
mov rbx, rax
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x140115910
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14011590b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401159ec
call fcn.140183104
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], r14w
test rbx, rbx
je 0x1401159b5
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.DuplicateTokenEx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1401159b5
xor bl, bl
mov qword [rsp + 0x68], r14
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 1
mov r9d, 2
xor r8d, r8d
mov edx, 0x18b
mov rcx, qword [rsp + 0x30]
call rax
test eax, eax
je 0x140115998
mov rax, qword [rsp + 0x68]
mov qword [rsi], rax
mov bl, 1
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1401159b7
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1401159a8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1401159b7
xor bl, bl
lea rcx, [rsp + 0x70]
call fcn.1400f04f0
movzx eax, bl
mov rcx, qword [rbp + 0xa0]
xor rcx, rsp
call fcn.1401836b0
lea r11, [rsp + 0x1b0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.140195eec
nop
int3
Function at 0x140118710
Capabilities:
Check mutex on windows

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov rax, qword [0x1402be168]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rsi, rdx
mov rdi, rcx
mov rcx, qword [rcx]
xor ebp, ebp
test rcx, rcx
je 0x14011874e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi], rbp
mov word [rdi + 8], bp
mov qword [rsp + 0x28], rbp
lea rcx, [rsp + 0x28]
call fcn.1400f8490
nop
mov rbx, qword [rsp + 0x28]
cmp qword [rbx], 0
lea rcx, [rbx + 0x10]
jne 0x140118774
mov rcx, rbp
cmp qword [rsi + 0x10], 0
je 0x140118787
cmp qword [rsi + 0x18], 8
jb 0x14011878a
mov rsi, qword [rsi]
jmp 0x14011878a
mov rsi, rbp
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rdi], rax
test rax, rax
je 0x1401187ae
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1401187ae
mov byte [rdi + 9], 1
cmp qword [rdi], 0
setne sil
mov rdi, qword [rbx]
test rdi, rdi
je 0x1401187d5
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rbx], rbp
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1401187e8
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rbx + 8], rbp
mov edx, 0x58
mov rcx, rbx
call fcn.140183104
mov qword [rsp + 0x28], rbp
movzx eax, sil
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1401836b0
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x14011b020
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x90
mov qword [r11 - 0x50], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
mov rax, qword [0x1402be168]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rdi, rdx
mov rbx, rcx
mov rdx, qword [rcx]
test rdx, rdx
je 0x14011b137
cmp byte [rdx + 0x78], 0
je 0x14011b137
add rdx, 0x28
lea rcx, [r11 - 0x48]
call fcn.14010e3d0
nop
xor r8d, r8d
mov rdx, rdi
lea rcx, [rsp + 0x60]
call fcn.1400be0f0
nop
mov rsi, qword [rsp + 0x70]
lea rdi, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae rdi, qword [rsp + 0x60]
mov rcx, qword [rbx]
cmp qword [rcx + 0x18], 8
jb 0x14011b0ab
mov rcx, qword [rcx]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14011b122
mov dword [rsp + 0x40], 0
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov r8d, esi
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x60]
call fcn.1400093b0
nop
lea rcx, [rsp + 0x50]
call fcn.14010e430
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1401836b0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14014ddd0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, qword [rcx + 0x10]
mov rsi, rdx
mov rbx, rcx
test rdi, rdi
je 0x14014de85
cmp qword [rdi], 0
mov rbx, qword [rcx]
je 0x14014de51
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14014de70
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14014de70
mov rdx, qword [rdi]
xor r9d, r9d
mov qword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rsp + 0x20], rdx
mov rcx, rbx
mov rdx, rsi
call rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rdi + 8], 0
je 0x14014de70
mov rcx, rbx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp byte [0x1402c0c38], 0
jne 0x14014ded0
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14014dec0
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1402c0c30], rax
mov byte [0x1402c0c38], 1
jmp 0x14014ded7
mov rax, qword [0x1402c0c30]
mov byte [0x1402c0c38], 1
jmp 0x14014ded7
mov rax, qword [0x1402c0c30]
mov rcx, qword [rbx]
mov rdx, rsi
test rax, rax
je 0x14014de5a
mov r8d, dword [rbx + 8]
xor r9d, r9d
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp rax
Function at 0x14014ec80
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x1402be168]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov r9d, dword [rcx + 8]
xor ebp, ebp
mov rsi, rdx
mov qword [rsp + 0x48], rbp
mov r8, rdx
mov dword [rsp + 0x50], ebp
mov rdx, qword [rcx]
mov rdi, rcx
or r9d, 0x2001f
mov qword [rsp + 0x58], rbp
lea rcx, [rsp + 0x48]
call fcn.14014e4e0
mov ebx, eax
test eax, eax
jne 0x14014ed97
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x40]
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x70]
mov qword [rsp + 0x28], rbp
xor edx, edx
mov qword [rsp + 0x20], rbp
mov dword [rsp + 0x40], 0x100
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14014ed71
nop dword [rax + rax]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.14014ec80
mov ebx, eax
test eax, eax
jne 0x14014ed97
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x40]
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x70]
mov qword [rsp + 0x28], rbp
xor edx, edx
mov qword [rsp + 0x20], rbp
mov dword [rsp + 0x40], 0x100
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x14014ed20
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14014ed86
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], rbp
mov rdx, rsi
mov dword [rsp + 0x50], ebp
mov rcx, rdi
call fcn.14014ddd0
mov ebx, eax
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14014eda7
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1401836b0
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret
Function at 0x14014f2b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x490
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov rax, qword [0x1402be168]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov r15, r9
mov rsi, r8
mov rbx, rdx
xor r14d, r14d
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x70], r14
xor edx, edx
lea r8d, [r14 + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x14014f33e
xor edx, edx
lea r8d, [r14 + 2]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x14014f33e
call fcn.14014db10
mov ebx, eax
jmp 0x14014f463
mov r8, r15
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x14014f35f
call fcn.14014db10
jmp 0x14014f452
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x14014f382
call fcn.14014db10
jmp 0x14014f452
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, ebx
jae 0x14014f3a4
mov ebx, 0x8007000e
jmp 0x14014f454
mov ecx, eax
test eax, eax
je 0x14014f3d9
xor edx, edx
mov rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x14014f49b
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x14014f3d9
lea rcx, [rsp + 0x70]
call fcn.14014d9f0
jmp 0x14014f3e3
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rax
jmp 0x14014f3f6
cmp qword [rsp + 0x70], 0
jne 0x14014f405
mov ebx, 0x8007000e
jmp 0x14014f454
mov dword [rsp + 0x28], ebx
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, rsi
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x14014f42f
call fcn.14014db10
jmp 0x14014f452
mov ecx, eax
mov rax, qword [rsp + 0x70]
mov word [rax + rcx*2], r14w
mov r8d, dword [rsp + 0x4e0]
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.14014edd0
mov ebx, eax
test rdi, rdi
je 0x14014f463
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x14014f47a
lea rcx, [rsp + 0x70]
call fcn.14014df60
nop
mov eax, ebx
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.1401836b0
add rsp, 0x490
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
mov ecx, 0x80070216
call fcn.14014db40
int3
Function at 0x140187100
Capabilities:
Read pipe
Write file on windows
Write pipe

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x60]
sub rsp, 0x160
lea r14, [rcx + 0x370]
mov r15, rdx
cmp qword [r14 + 0x18], 8
mov rsi, rcx
jb 0x140187137
mov r14, qword [r14]
mov edi, dword [rcx + 0x390]
mov ebx, dword [rcx + 0x38]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
movups xmm0, xmmword [rsi + 0x28]
mov dword [rbp - 0x5c], eax
lea r9, [rsp + 0x40]
lea rax, [rsi + 0x5c]
mov dword [rbp - 0x58], ebx
xor ebx, ebx
mov qword [rbp - 0x50], rax
lea rax, [rsi + 0x60]
mov qword [rsp + 0x30], rbx
mov qword [rbp - 0x48], rax
lea rdx, [rbp - 0x60]
lea rax, [rsi + 0x68]
mov dword [rbp - 0x60], 1
mov qword [rbp - 0x40], rax
lea r8d, [rbx + 0x60]
xor eax, eax
mov qword [rbp - 0x28], rbx
mov qword [rsp + 0x68], rax
mov rcx, r15
mov qword [rsp + 0x70], rax
lea rax, [rbp + 0x80]
movups xmmword [rbp - 0x38], xmm0
mov qword [rsp + 0x28], rax
xorps xmm0, xmm0
mov dword [rsp + 0x20], 0x60
movdqa xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], r14
mov dword [rbp - 8], edi
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x48], ebx
movdqa xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x78], rbx
movdqa xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], rbx
mov dword [rbp - 0x68], ebx
mov dword [rbp + 0x80], ebx
call qword [sym.imp.KERNEL32.dll_TransactNamedPipe]
test eax, eax
je 0x140187298
cmp dword [rsp + 0x40], 2
jne 0x140187298
cmp dword [rsp + 0x44], ebx
je 0x140187298
cmp qword [rsp + 0x78], rbx
je 0x140187298
cmp qword [rbp - 0x80], rbx
je 0x140187298
cmp qword [rbp - 0x78], rbx
je 0x140187298
xor eax, eax
mov qword [rbp + 4], rbx
xorps xmm0, xmm0
mov qword [rbp + 0x20], rax
lea r9, [rbp + 0x80]
movdqa xmmword [rbp + 0x10], xmm0
lea r8d, [rbx + 0x60]
mov qword [rbp + 0x28], rax
lea rdx, [rbp]
mov qword [rbp + 0x30], rax
mov rcx, r15
movdqa xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x38], rbx
mov qword [rbp + 0x50], rbx
mov dword [rbp + 0x58], ebx
mov dword [rbp], 3
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140187298
mov rax, qword [rsp + 0x78]
mov qword [rsi + 0x40], rax
mov rax, qword [rbp - 0x80]
mov qword [rsi + 0x48], rax
mov rax, qword [rbp - 0x78]
mov qword [rsi + 0x50], rax
mov eax, dword [rsp + 0x44]
mov dword [rsi + 0x58], eax
mov al, 1
jmp 0x14018729a
xor al, al
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x1401d2024
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1401d1cec
Function at 0x1401dc9b8
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x1401dc5e0
call fcn.140196080
mov dword [rax], 0x16
call fcn.140195ecc
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x1401dc5c8
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x1401dc5c8
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x1401dc612
lock or dword [rax + 0x14], 0x10
jmp 0x1401dc5c8
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x1401dc62f
mov rcx, qword [rbp + 0x10]
call fcn.1401dea1c
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.1401d9014
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.1401da004
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x1401dc686
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x1401dc5c8
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x1401dc6f2
mov rcx, qword [rbp + 0x10]
call fcn.1401d9014
cmp eax, 0xffffffff
je 0x1401dc6d9
mov rcx, qword [rbp + 0x10]
call fcn.1401d9014
cmp eax, 0xfffffffe
je 0x1401dc6d9
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.1401d9014
movsxd rdi, eax
lea rsi, [0x1402c2840]
mov rcx, rbx
sar rdi, 6
call fcn.1401d9014
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x1401dc6e0
lea rax, [0x1402be510]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x1401dc6f2
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x1401dc728
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x1401dc724
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x1401dc724
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x1401dc5cb
jmp 0x1401dc598
Function at 0x14000720c
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.14000719c
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rcx, [0x140021170]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400205b8]
jmp 0x140007248
cmp qword [rbx + 0x18], rdi
je 0x14000724f
mov rbx, qword [rbx]
test rbx, rbx
jne 0x14000723f
jmp 0x140007269
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbx + 0x10]
lea rcx, [0x1400205b8]
call fcn.140011c68
lea rcx, [0x140021170]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
invalid
add eax, 0x1490bacc
clc
xchg ebp, eax
test byte [rdx], bl
mov dh, 0x6d
pop rdx
pop rbp
invalid
sbb byte [rax], cl
adc cl, dl
fmul st(0)
xor dword [rdi + 0x5bd10ee1], ecx
push rsi
mov word [rdx + rbx*8 - 0x4a86721a], cs
movabs byte [0x2c7d6abdff6a8ba9], al
test eax, 0xbdff6a8b
push 0x7d
sub al, 0x89
or eax, dword [rbp - 0x3bf6afce]
test eax, 0xbdff6a8b
push 0x7d
sub al, 0x89
or eax, dword [rbp - 0x3bf6afce]
loope 0x14003f69e
int 0xf0
lahf
call 0x19953a329
xchg edx, eax
je 0x14003f702
invalid
invalid
xchg eax, edi
sub ah, dl
insb byte [rdi], dx
lea eax, [rcx - 0x5e]
ret 0xf366
xchg byte [rbp + 0x3e], ah
jno str._df95
xchg byte [rdx - 0x2e], al
sub byte [rdi + rsi*8 - 0x329a5be0], al
int3
mov edi, dword [rbp + rbx*4 + 0x11]
dec al
mul dword [rsi]
ror byte [rax - 0x75cef385], cl
xchg esp, eax
out dx, eax
in eax, 0x41
mov edx, 0x2f53bbe3
test dword [rax - 0x4d], esp
call [rcx + 0x3e9c7f01]
in al, 0x6a
adc edx, esp
stc
rcl byte [rbx], cl
add dword [rbp - 0xe6df2cc], edx
mov dh, 0x68
push rsi
invalid
pop rdi
cmp word fs:[0x1ad766e8f], si
ja 0x14003f778
insd dword [rdi], dx
xor eax, 0x6d727788
ja 0x14003f778
insd dword [rdi], dx
sbb eax, edi
lodsb al, byte [rsi]
adc al, 0x15
invalid
Function at 0x140001f68
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0xa8
mov word [rsp + 0x20], 0x3f
mov word [rsp + 0x22], 0x35
mov word [rsp + 0x24], 0x48
mov word [rsp + 0x26], 0x4a
mov word [rsp + 0x28], 0x4c
mov word [rsp + 0x2a], 0x56
mov word [rsp + 0x2c], 0x57
mov word [rsp + 0x2e], 0x55
mov word [rsp + 0x30], 0x5c
mov word [rsp + 0x32], 0x3f
mov word [rsp + 0x34], 0x30
mov word [rsp + 0x36], 0x44
mov word [rsp + 0x38], 0x46
mov word [rsp + 0x3a], 0x4b
mov word [rsp + 0x3c], 0x4c
mov word [rsp + 0x3e], 0x51
mov word [rsp + 0x40], 0x48
mov word [rsp + 0x42], 0x3f
mov word [rsp + 0x44], 0x36
mov word [rsp + 0x46], 0x3c
mov word [rsp + 0x48], 0x36
mov word [rsp + 0x4a], 0x37
mov word [rsp + 0x4c], 0x28
mov word [rsp + 0x4e], 0x30
mov word [rsp + 0x50], 0x3f
mov word [rsp + 0x52], 0x26
mov word [rsp + 0x54], 0x58
mov word [rsp + 0x56], 0x55
mov word [rsp + 0x58], 0x55
mov word [rsp + 0x5a], 0x48
mov word [rsp + 0x5c], 0x51
mov word [rsp + 0x5e], 0x57
mov word [rsp + 0x60], 0x26
mov word [rsp + 0x62], 0x52
mov word [rsp + 0x64], 0x51
mov word [rsp + 0x66], 0x57
mov word [rsp + 0x68], 0x55
mov word [rsp + 0x6a], 0x52
mov word [rsp + 0x6c], 0x4f
mov word [rsp + 0x6e], 0x36
mov word [rsp + 0x70], 0x48
mov word [rsp + 0x72], 0x57
mov word [rsp + 0x74], 0x3f
mov word [rsp + 0x76], 0x36
mov word [rsp + 0x78], 0x48
mov word [rsp + 0x7a], 0x55
mov word [rsp + 0x7c], 0x59
mov word [rsp + 0x7e], 0x4c
mov word [rsp + 0x80], 0x46
mov word [rsp + 0x82], 0x48
mov word [rsp + 0x84], 0x56
mov word [rsp + 0x86], 0x3f
mov word [rsp + 0x88], 0x38
mov word [rsp + 0x8a], 0x56
mov word [rsp + 0x8c], 0x52
mov word [rsp + 0x8e], 0x36
mov word [rsp + 0x90], 0x59
mov word [rsp + 0x92], 0x46
mov word [rsp + 0x94], 0xe3
cmp byte [0x14059aa08], 0
jne 0x14000216f
mov byte [0x14059aa96], 1
mov eax, 0
lea rcx, [0x14059aa20]
movzx edx, word [rsp + rax*2 + 0x20]
mov word [rcx + rax*2], dx
add rax, 1
cmp rax, 0x3b
jne 0x140002149
mov byte [0x14059aa08], 1
lea rcx, [0x14000161f]
call fcn.1400014f0
lea rax, [0x14059aa20]
add rsp, 0xa8
ret