joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000c6a0
Capabilities:
Get disk information

Disassembly:
sub rsp, 0x118
mov rax, qword [0x18002a090]
xor rax, rsp
mov qword [rsp + 0x100], rax
mov eax, dword [0x180023488]
lea rcx, [rsp + 0x20]
mov r8d, 0x64
mov dword [rcx], eax
movzx eax, word [0x18002348c]
mov word [rcx + 4], ax
mov word [rsp + 0x20], dx
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
jne 0x18000c70d
call fcn.1800048e0
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.180013990
add rsp, 0x118
ret
lea rcx, str.DeviceKZipVirtualDisk
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rdx, [rsp + 0x30]
lea rcx, str.DeviceKZipVirtualDisk
movsxd r8, eax
call fcn.180014420
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.180013990
add rsp, 0x118
ret
Function at 0x18000d180
Capabilities:
Create thread
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x70
mov rbx, rcx
xor esi, esi
lea rcx, str..KZDriver
mov qword [rsp + 0x30], rsi
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbx + 0x18], rax
cmp rax, 0xffffffffffffffff
jne 0x18000d1d9
call fcn.1800048e0
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rsi
ret
mov rdx, qword [rbx + 0x10]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
test rax, rax
je 0x18000d1c6
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x80], rdi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x60]
mov edi, esi
add eax, eax
je 0x18000d242
nop
lea r8, [0x18000d340]
mov r9, rbx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x60]
inc edi
add eax, eax
cmp edi, eax
jb 0x18000d210
lea rcx, str.KZModule.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdi, qword [rsp + 0x80]
mov qword [rbx + 0x20], rax
mov rbx, qword [rsp + 0x88]
xor eax, eax
add rsp, 0x70
pop rsi
ret

Function at 0x18000d830
Capabilities:
Get memory capacity

Disassembly:
push rdi
sub rsp, 0x60
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x78], rbx
mov dword [rsp + 0x28], 0x38
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov r11, qword [rsp + 0x38]
shr r11, 1
mov edi, 0x2000000
cmp r11, rdi
jb 0x18000d878
mov rdi, r11
mov eax, 0x40000000
cmp r11, rax
cmova rdi, rax
mov qword [rsp + 0x70], 0
mov rbx, qword [0x18002c8b8]
test rbx, rbx
je 0x18000d896
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
mov qword [rsp + 0x70], rbx
test rbx, rbx
je 0x18000d8ad
mov rax, qword [rbx]
mov rdx, rdi
mov rcx, rbx
call qword [rax + 0x18]
nop
test rbx, rbx
je 0x18000d8bb
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret

Function at 0x18000e0d0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x30
mov r12, rcx
mov ecx, 0x38
mov rdi, r8
mov rbp, rdx
call fcn.1800140a8
xor esi, esi
mov rbx, rax
test rax, rax
je 0x18000e119
mov qword [rax + 0x28], 7
mov qword [rax + 0x20], rsi
mov word [rax + 0x10], si
jmp 0x18000e11c
mov rbx, rsi
or rcx, 0xffffffffffffffff
mov qword [rbx + 0x30], rdi
xor eax, eax
mov qword [rbx], r12
mov rdi, rbp
mov rdx, rbp
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rbx + 8]
call fcn.1800037d0
lea r8, [0x18000e2d0]
mov r9, rbx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
xor eax, eax
add rsp, 0x30
pop r12
ret
Function at 0x180012d50
Capabilities:
Check if file exists
Create directory
Get common file path
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x260
mov rax, qword [0x18002a090]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rbx, rcx
mov edi, edx
lea rcx, [rsp + 0x42]
xor esi, esi
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x40], si
call fcn.180014980
lea rdx, [rsp + 0x40]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x180012dc1
cmp eax, 0x104
ja 0x180012dc1
lea rdx, str.KZCache_
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
jmp 0x180012dd7
call fcn.1800048e0
test eax, eax
js 0x180012e62
cmp eax, 1
je 0x180012e62
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x180012dff
lea rcx, [rsp + 0x40]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x180012dff
call fcn.1800048e0
jmp 0x180012e62
lea rdx, [0x1800238b8]
lea rcx, [rsp + 0x40]
mov r9, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x180012df8
mov dword [rbx + 0x210], edi
mov qword [rsp + 0x30], rsi
neg edi
sbb eax, eax
mov edx, 0xc0000000
mov rcx, rbx
and eax, 0x20000000
xor r9d, r9d
xor r8d, r8d
bts eax, 0x1a
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbx + 0x208], rax
cmp rax, 0xffffffffffffffff
je 0x180012df8
xor eax, eax
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.180013990
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x180012f20
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rsi, r9
mov edi, r8d
mov r10, rdx
mov rbx, rcx
test r8d, r8d
je 0x180013090
mov rcx, qword [rcx + 0x208]
cmp rcx, 0xffffffffffffffff
je 0x1800130a2
test r9, r9
je 0x1800130a2
cmp dword [rbx + 0x210], 0
je 0x180012fb1
mov rax, qword [rdx]
cqo
and edx, 0x1ff
add rax, rdx
and eax, 0x1ff
cmp rax, rdx
jne 0x180012f87
test edi, 0x1ff
je 0x180012fb1
mov r9d, edi
mov r8, rsi
mov rdx, r10
mov rcx, rbx
mov qword [rsp + 0x20], 0
call fcn.180013260
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rdx, qword [r10]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x180012fd9
call fcn.1800048e0
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rbx + 0x208]
lea r9, [rsp + 0x50]
mov r8d, edi
mov rdx, rsi
mov dword [rsp + 0x50], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x180013090
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6f8
je 0x18001303e
cmp eax, 0x3e6
je 0x18001303e
test eax, eax
jle 0x1800130a7
movzx eax, ax
or eax, 0x80070000
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov edx, edi
mov rcx, rbx
call fcn.180012e90
test eax, eax
js 0x1800130a7
cmp eax, 1
je 0x1800130a7
mov rdx, qword [rbx + 0x218]
mov rcx, qword [rbx + 0x208]
lea r9, [rsp + 0x50]
mov r8d, edi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180012fc4
mov rdx, qword [rbx + 0x218]
mov r8, rdi
mov rcx, rsi
call fcn.180015520
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov eax, 0x80070057
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1800130c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rdi
sub rsp, 0x30
mov rbp, r9
mov edi, r8d
mov r10, rdx
mov rbx, rcx
test r8d, r8d
jne 0x1800130f2
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
test r9, r9
je 0x180013242
mov rcx, qword [rcx + 0x208]
cmp rcx, 0xffffffffffffffff
je 0x180013242
cmp dword [rbx + 0x210], 0
je 0x18001315f
mov rax, qword [rdx]
cqo
and edx, 0x1ff
add rax, rdx
and eax, 0x1ff
cmp rax, rdx
jne 0x180013135
test edi, 0x1ff
je 0x18001315f
mov r9d, edi
mov r8, rbp
mov rdx, r10
mov rcx, rbx
mov qword [rsp + 0x20], 0
call fcn.1800133b0
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rdx, qword [r10]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x18001322d
mov rcx, qword [rbx + 0x208]
lea r9, [rsp + 0x50]
mov r8d, edi
mov rdx, rbp
mov dword [rsp + 0x50], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1800130e0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6f8
je 0x1800131db
cmp eax, 0x3e6
je 0x1800131db
test eax, eax
jle 0x180013247
movzx eax, ax
or eax, 0x80070000
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov edx, edi
mov rcx, rbx
call fcn.180012e90
test eax, eax
js 0x180013247
cmp eax, 1
je 0x180013247
mov rcx, qword [rbx + 0x218]
mov r8, rdi
mov rdx, rbp
call fcn.180015520
mov rdx, qword [rbx + 0x218]
mov rcx, qword [rbx + 0x208]
lea r9, [rsp + 0x50]
mov r8d, edi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1800130e0
call fcn.1800048e0
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov eax, 0x80070057
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x180013260
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x30
mov edi, r9d
mov r12, r8
mov rbp, rdx
mov rsi, rcx
test r9d, r9d
jne 0x18001328e
xor eax, eax
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
test r8, r8
je 0x18001339a
cmp qword [rcx + 0x208], 0xffffffffffffffff
je 0x18001339a
test rdx, rdx
je 0x18001339a
mov rcx, qword [rdx]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], r13
mov rax, rcx
cqo
and edx, 0x1ff
lea rbx, [rdx + rax]
mov rax, rdi
sar rbx, 9
shl rbx, 9
sub rax, rbx
lea rax, [rax + rcx + 0x1ff]
mov rcx, rsi
cqo
and edx, 0x1ff
lea r13, [rdx + rax]
sar r13, 9
shl r13d, 9
mov edx, r13d
call fcn.180012e90
test eax, eax
js 0x180013352
cmp eax, 1
je 0x180013352
mov rcx, qword [rsi + 0x208]
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x18001334d
mov rdx, qword [rsi + 0x218]
mov rcx, qword [rsi + 0x208]
xor eax, eax
lea r9, [rsp + 0x68]
mov r8d, r13d
mov dword [rsp + 0x68], eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x18001336a
call fcn.1800048e0
mov rbx, qword [rsp + 0x50]
mov r13, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
mov eax, dword [rbp]
mov ecx, dword [rsp + 0x68]
sub eax, ebx
cmp ecx, eax
jbe 0x180013396
sub ecx, eax
cmp ecx, edi
cmovb edi, ecx
test edi, edi
je 0x180013396
mov edx, eax
mov r8d, edi
mov rcx, r12
add rdx, qword [rsi + 0x218]
call fcn.180015520
xor eax, eax
jmp 0x180013352
mov eax, 0x80070057
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
Function at 0x1800133b0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rbp, r8
mov rsi, rdx
mov rdi, rcx
test r9d, r9d
jne 0x1800133d0
xor eax, eax
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
test r8, r8
je 0x180013535
cmp qword [rcx + 0x208], 0xffffffffffffffff
je 0x180013535
test rdx, rdx
je 0x180013535
mov rcx, qword [rdx]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], r12
mov rax, rcx
mov qword [rsp + 0x38], r13
mov r13d, r9d
cqo
and edx, 0x1ff
lea rbx, [rdx + rax]
mov eax, r9d
sar rbx, 9
shl rbx, 9
sub rax, rbx
lea rax, [rax + rcx + 0x1ff]
mov rcx, rdi
cqo
and edx, 0x1ff
lea r12, [rdx + rax]
sar r12, 9
shl r12d, 9
mov edx, r12d
call fcn.180012e90
test eax, eax
js 0x18001351a
cmp eax, 1
je 0x18001351a
mov rcx, qword [rdi + 0x208]
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x18001347e
call fcn.1800048e0
jmp 0x18001351a
mov rdx, qword [rdi + 0x218]
mov rcx, qword [rdi + 0x208]
mov qword [rsp + 0x30], r14
xor r14d, r14d
lea r9, [rsp + 0x78]
mov r8d, r12d
mov dword [rsp + 0x78], r14d
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180013510
mov ecx, dword [rsi]
mov r8, r13
mov rdx, rbp
sub ecx, ebx
add rcx, qword [rdi + 0x218]
call fcn.180015520
mov rcx, qword [rdi + 0x208]
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x180013510
mov rdx, qword [rdi + 0x218]
mov rcx, qword [rdi + 0x208]
lea r9, [rsp + 0x80]
mov r8d, r12d
mov dword [rsp + 0x80], r14d
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x180013531
call fcn.1800048e0
mov r14, qword [rsp + 0x30]
mov r12, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov r13, qword [rsp + 0x38]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
xor eax, eax
jmp 0x180013515
mov eax, 0x80070057
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x140004fc0
Capabilities:
Encode data using xor

Disassembly:
xor eax, dword [r15]
xor ebx, dword [r15 + 4]
xor ecx, dword [r15 + 8]
xor edx, dword [r15 + 0xc]
mov r13d, dword [r15 + 0xf0]
sub r13d, 1
jmp 0x140004fe0
movzx esi, al
movzx edi, bl
movzx ebp, cl
mov r10d, dword [r14 + rsi*8]
mov r11d, dword [r14 + rdi*8]
mov r12d, dword [r14 + rbp*8]
movzx esi, bh
movzx edi, ch
movzx ebp, dl
xor r10d, dword [r14 + rsi*8 + 3]
xor r11d, dword [r14 + rdi*8 + 3]
mov r8d, dword [r14 + rbp*8]
movzx esi, dh
shr ecx, 0x10
movzx ebp, ah
xor r12d, dword [r14 + rsi*8 + 3]
shr edx, 0x10
xor r8d, dword [r14 + rbp*8 + 3]
shr ebx, 0x10
lea r15, [r15 + 0x10]
shr eax, 0x10
movzx esi, cl
movzx edi, dl
movzx ebp, al
xor r10d, dword [r14 + rsi*8 + 2]
xor r11d, dword [r14 + rdi*8 + 2]
xor r12d, dword [r14 + rbp*8 + 2]
movzx esi, dh
movzx edi, ah
movzx ebp, bl
xor r10d, dword [r14 + rsi*8 + 1]
xor r11d, dword [r14 + rdi*8 + 1]
xor r8d, dword [r14 + rbp*8 + 2]
mov edx, dword [r15 + 0xc]
movzx edi, bh
movzx ebp, ch
mov eax, dword [r15]
xor r12d, dword [r14 + rdi*8 + 1]
xor r8d, dword [r14 + rbp*8 + 1]
mov ebx, dword [r15 + 4]
mov ecx, dword [r15 + 8]
xor eax, r10d
xor ebx, r11d
xor ecx, r12d
xor edx, r8d
sub r13d, 1
jne 0x140004fe0
movzx esi, al
movzx edi, bl
movzx ebp, cl
movzx r10d, byte [r14 + rsi*8 + 2]
movzx r11d, byte [r14 + rdi*8 + 2]
movzx r12d, byte [r14 + rbp*8 + 2]
movzx esi, dl
movzx edi, bh
movzx ebp, ch
movzx r8d, byte [r14 + rsi*8 + 2]
mov edi, dword [r14 + rdi*8]
mov ebp, dword [r14 + rbp*8]
and edi, 0xff00
and ebp, 0xff00
xor r10d, edi
xor r11d, ebp
shr ecx, 0x10
movzx esi, dh
movzx edi, ah
shr edx, 0x10
mov esi, dword [r14 + rsi*8]
mov edi, dword [r14 + rdi*8]
and esi, 0xff00
and edi, 0xff00
shr ebx, 0x10
xor r12d, esi
xor r8d, edi
shr eax, 0x10
movzx esi, cl
movzx edi, dl
movzx ebp, al
mov esi, dword [r14 + rsi*8]
mov edi, dword [r14 + rdi*8]
mov ebp, dword [r14 + rbp*8]
and esi, 0xff0000
and edi, 0xff0000
and ebp, 0xff0000
xor r10d, esi
xor r11d, edi
xor r12d, ebp
movzx esi, bl
movzx edi, dh
movzx ebp, ah
mov esi, dword [r14 + rsi*8]
mov edi, dword [r14 + rdi*8 + 2]
mov ebp, dword [r14 + rbp*8 + 2]
and esi, 0xff0000
and edi, 0xff000000
and ebp, 0xff000000
xor r8d, esi
xor r10d, edi
xor r11d, ebp
movzx esi, bh
movzx edi, ch
mov edx, dword [r15 + 0x1c]
mov esi, dword [r14 + rsi*8 + 2]
mov edi, dword [r14 + rdi*8 + 2]
mov eax, dword [r15 + 0x10]
and esi, 0xff000000
and edi, 0xff000000
xor r12d, esi
xor r8d, edi
mov ebx, dword [r15 + 0x14]
mov ecx, dword [r15 + 0x18]
xor eax, r10d
xor ebx, r11d
xor ecx, r12d
xor edx, r8d
repz ret
Function at 0x140005500
Capabilities:
Encode data using xor

Disassembly:
xor eax, dword [r15]
xor ebx, dword [r15 + 4]
xor ecx, dword [r15 + 8]
xor edx, dword [r15 + 0xc]
mov r13d, dword [r15 + 0xf0]
sub r13d, 1
jmp 0x140005520
movzx esi, al
movzx edi, bl
movzx ebp, cl
mov r10d, dword [r14 + rsi*8]
mov r11d, dword [r14 + rdi*8]
mov r12d, dword [r14 + rbp*8]
movzx esi, dh
movzx edi, ah
movzx ebp, dl
xor r10d, dword [r14 + rsi*8 + 3]
xor r11d, dword [r14 + rdi*8 + 3]
mov r8d, dword [r14 + rbp*8]
movzx esi, bh
shr eax, 0x10
movzx ebp, ch
xor r12d, dword [r14 + rsi*8 + 3]
shr edx, 0x10
xor r8d, dword [r14 + rbp*8 + 3]
shr ebx, 0x10
lea r15, [r15 + 0x10]
shr ecx, 0x10
movzx esi, cl
movzx edi, dl
movzx ebp, al
xor r10d, dword [r14 + rsi*8 + 2]
xor r11d, dword [r14 + rdi*8 + 2]
xor r12d, dword [r14 + rbp*8 + 2]
movzx esi, bh
movzx edi, ch
movzx ebp, bl
xor r10d, dword [r14 + rsi*8 + 1]
xor r11d, dword [r14 + rdi*8 + 1]
xor r8d, dword [r14 + rbp*8 + 2]
movzx esi, dh
mov edx, dword [r15 + 0xc]
movzx ebp, ah
xor r12d, dword [r14 + rsi*8 + 1]
mov eax, dword [r15]
xor r8d, dword [r14 + rbp*8 + 1]
xor eax, r10d
mov ebx, dword [r15 + 4]
mov ecx, dword [r15 + 8]
xor ecx, r12d
xor ebx, r11d
xor edx, r8d
sub r13d, 1
jne 0x140005520
lea r14, [r14 + 0x800]
movzx esi, al
movzx edi, bl
movzx ebp, cl
movzx r10d, byte [r14 + rsi]
movzx r11d, byte [r14 + rdi]
movzx r12d, byte [r14 + rbp]
movzx esi, dl
movzx edi, dh
movzx ebp, ah
movzx r8d, byte [r14 + rsi]
movzx edi, byte [r14 + rdi]
movzx ebp, byte [r14 + rbp]
shl edi, 8
shl ebp, 8
xor r10d, edi
xor r11d, ebp
shr edx, 0x10
movzx esi, bh
movzx edi, ch
shr eax, 0x10
movzx esi, byte [r14 + rsi]
movzx edi, byte [r14 + rdi]
shl esi, 8
shl edi, 8
shr ebx, 0x10
xor r12d, esi
xor r8d, edi
shr ecx, 0x10
movzx esi, cl
movzx edi, dl
movzx ebp, al
movzx esi, byte [r14 + rsi]
movzx edi, byte [r14 + rdi]
movzx ebp, byte [r14 + rbp]
shl esi, 0x10
shl edi, 0x10
shl ebp, 0x10
xor r10d, esi
xor r11d, edi
xor r12d, ebp
movzx esi, bl
movzx edi, bh
movzx ebp, ch
movzx esi, byte [r14 + rsi]
movzx edi, byte [r14 + rdi]
movzx ebp, byte [r14 + rbp]
shl esi, 0x10
shl edi, 0x18
shl ebp, 0x18
xor r8d, esi
xor r10d, edi
xor r11d, ebp
movzx esi, dh
movzx edi, ah
mov edx, dword [r15 + 0x1c]
movzx esi, byte [r14 + rsi]
movzx edi, byte [r14 + rdi]
mov eax, dword [r15 + 0x10]
shl esi, 0x18
shl edi, 0x18
xor r12d, esi
xor r8d, edi
mov ebx, dword [r15 + 0x14]
mov ecx, dword [r15 + 0x18]
lea r14, [r14 - 0x800]
xor eax, r10d
xor ebx, r11d
xor ecx, r12d
xor edx, r8d
repz ret
Function at 0x14000a240
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
vmovdqu xmm4, xmmword [rcx - 0x80]
vmovdqu xmm2, xmmword [r11 + 0x20]
lea r13, [rbp - 1]
vmovups xmm15, xmmword [rcx - 0x70]
lea r12, [rcx - 0x60]
vpxor xmm9, xmm1, xmm4
add ebx, 0x6000000
jb 0x14000a360
vpaddb xmm10, xmm1, xmm2
vpaddb xmm11, xmm10, xmm2
vpxor xmm10, xmm10, xmm4
vpaddb xmm12, xmm11, xmm2
vpxor xmm11, xmm11, xmm4
vpaddb xmm13, xmm12, xmm2
vpxor xmm12, xmm12, xmm4
vpaddb xmm14, xmm13, xmm2
vpxor xmm13, xmm13, xmm4
vpaddb xmm1, xmm14, xmm2
vpxor xmm14, xmm14, xmm4
jmp 0x14000a2a0
vaesenc xmm9, xmm9, xmm15
vaesenc xmm10, xmm10, xmm15
vaesenc xmm11, xmm11, xmm15
vaesenc xmm12, xmm12, xmm15
vaesenc xmm13, xmm13, xmm15
vaesenc xmm14, xmm14, xmm15
vmovups xmm15, xmmword [r12]
lea r12, [r12 + 0x10]
dec r13d
jne 0x14000a2a0
vmovdqu xmm3, xmmword [r12]
vaesenc xmm9, xmm9, xmm15
vpxor xmm4, xmm3, xmmword [rdi]
vaesenc xmm10, xmm10, xmm15
vpxor xmm5, xmm3, xmmword [rdi + 0x10]
vaesenc xmm11, xmm11, xmm15
vpxor xmm6, xmm3, xmmword [rdi + 0x20]
vaesenc xmm12, xmm12, xmm15
vpxor xmm8, xmm3, xmmword [rdi + 0x30]
vaesenc xmm13, xmm13, xmm15
vpxor xmm2, xmm3, xmmword [rdi + 0x40]
vaesenc xmm14, xmm14, xmm15
vpxor xmm3, xmm3, xmmword [rdi + 0x50]
lea rdi, [rdi + 0x60]
vaesenclast xmm9, xmm9, xmm4
vaesenclast xmm10, xmm10, xmm5
vaesenclast xmm11, xmm11, xmm6
vaesenclast xmm12, xmm12, xmm8
vaesenclast xmm13, xmm13, xmm2
vaesenclast xmm14, xmm14, xmm3
vmovups xmmword [rsi], xmm9
vmovups xmmword [rsi + 0x10], xmm10
vmovups xmmword [rsi + 0x20], xmm11
vmovups xmmword [rsi + 0x30], xmm12
vmovups xmmword [rsi + 0x40], xmm13
vmovups xmmword [rsi + 0x50], xmm14
lea rsi, [rsi + 0x60]
repz ret
vpshufb xmm6, xmm1, xmm0
vmovdqu xmm5, xmmword [r11 + 0x30]
vpaddd xmm10, xmm6, xmmword [r11 + 0x40]
vpaddd xmm11, xmm6, xmm5
vpaddd xmm12, xmm10, xmm5
vpshufb xmm10, xmm10, xmm0
vpaddd xmm13, xmm11, xmm5
vpshufb xmm11, xmm11, xmm0
vpxor xmm10, xmm10, xmm4
vpaddd xmm14, xmm12, xmm5
vpshufb xmm12, xmm12, xmm0
vpxor xmm11, xmm11, xmm4
vpaddd xmm1, xmm13, xmm5
vpshufb xmm13, xmm13, xmm0
vpxor xmm12, xmm12, xmm4
vpshufb xmm14, xmm14, xmm0
vpxor xmm13, xmm13, xmm4
vpshufb xmm1, xmm1, xmm0
vpxor xmm14, xmm14, xmm4
jmp 0x14000a2a0
Function at 0x140026f74
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0xb0
mov rax, qword [0x14008a3a8]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rdi, rcx
mov ebx, 1
test dl, dl
jne 0x140026fb5
cmp qword [rcx + 0x10], 0
jne 0x140027005
xor eax, eax
jmp 0x14002712a
and dword [rsp + 0x28], 0
lea rax, str.TargetNtMapViewOfSection64
mov r9d, ebx
mov qword [rsp + 0x20], rax
lea r8, str.NtMapViewOfSection
lea rdx, [0x1400750b8]
call fcn.140026708
lea rax, str.TargetNtUnmapViewOfSection64
mov dword [rsp + 0x28], ebx
mov r9d, ebx
mov qword [rsp + 0x20], rax
lea r8, str.NtUnmapViewOfSection
mov rcx, rdi
lea rdx, [0x1400750b8]
call fcn.140026708
mov rax, qword [rdi]
xor edx, edx
mov r9d, 0x2000
mov dword [rsp + 0x20], ebx
mov r8d, 0x10000
mov rbp, qword [rax]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rsi, qword [rdi + 0x10]
mov rbx, rax
shl rsi, 6
add rsi, 0x60
mov rcx, rsi
call fcn.140026a84
mov r14, rax
mov dword [rsp + 0x20], 0x40
mov rdx, rax
lea r8, [rsi + 0xfff]
mov rax, 0xfffffffffffff000
mov r9d, 0x1000
and rdx, rax
and r8, rax
add rdx, rbx
mov rcx, rbp
and r14d, 0xfff
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
test rax, rax
jne 0x14002707e
int3
and dword [rsp + 0x58], 0
lea rbx, [r14 + rax]
mov r14d, 0x20
mov qword [rsp + 0x40], rsi
xor edx, edx
mov qword [rsp + 0x48], r14
mov r8d, 0x150
lea rcx, [sym.QtWebEngineProcess.exe_g_originals]
call sub.VCRUNTIME140.dll_memset
lea r9, [rsp + 0x40]
mov r8, rsi
mov rdx, rbx
mov rcx, rdi
call fcn.140026c74
test eax, eax
jne 0x14002712a
lea rax, [rsp + 0x38]
mov r9d, r14d
lea r8, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov rdx, rbx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140027125
cmp qword [rsp + 0x38], r14
jne 0x140027125
lea rax, [rsp + 0x30]
mov r9d, r14d
mov r8, rsi
mov qword [rsp + 0x20], rax
mov rdx, rbx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rcx, qword [rdi]
lea r8, [sym.QtWebEngineProcess.exe_g_originals]
mov r9d, 0x150
lea rdx, str.g_originals
call fcn.14003cfe8
jmp 0x14002712a
mov eax, 0x2a
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1400722b0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140028444
Capabilities:
Create pipe

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rbx, qword [rsp + 0x98]
or rbp, 0xffffffffffffffff
mov r11d, r9d
mov r10, r8
mov qword [rbx], rbp
cmp ecx, 3
jne 0x140028516
cmp qword [r8 + 0x18], 8
jb 0x140028480
mov r10, qword [r8]
and qword [rsp + 0x38], 0
mov rcx, r10
mov eax, dword [rsp + 0x90]
mov rsi, qword [rdx]
mov edx, r11d
mov r9d, dword [rsp + 0x78]
mov r8d, dword [rsp + 0x70]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x88]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x80]
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov rdi, rax
cmp rax, rbp
jne 0x1400284cd
mov rcx, rbp
jmp 0x14002850a
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x30], 3
lea r9, [rsp + 0x98]
and dword [rsp + 0x28], 0
mov rcx, rax
and dword [rsp + 0x20], 0
mov r8, rsi
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rcx, qword [rsp + 0x98]
test eax, eax
cmove rcx, rbp
mov qword [rbx], rcx
cmp rcx, rbp
je 0x140028516
xor eax, eax
jmp 0x14002851b
mov eax, 5
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret