joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140021ae0
Capabilities:
Print debug messages

Disassembly:
push r12
mov r12, rcx
sub rsp, 0x40
mov rax, qword [0x14002d650]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov rax, qword [rax]
cmp dword [rax + 0xde], 0
je 0x140021b51
mov rcx, qword [rax + 0x7f8]
test rcx, rcx
je 0x140021b51
mov r8w, word [rax + 0x812]
test r8w, r8w
je 0x140021b51
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x58], rdx
mov word [rsp + 0x38], r8w
call sym.SysSetConfig
mov rdx, qword [rsp + 0x58]
mov rcx, r12
call sym.SysInvoke
jmp 0x140021b5a
mov rcx, r12
call qword [rax + 0x228]
mov dword [rsp + 0x20], eax
mov r8d, 0x6f
lea r9, [0x14002a997]
lea rdx, str.SysNtSuspendThread
lea rcx, str._DEBUG::_s::_d___s__..._____08x_n
mov r12d, eax
call sym.DbgPrint
add rsp, 0x40
mov eax, r12d
pop r12
ret

Function at 0x140021b90
Capabilities:
Print debug messages

Disassembly:
push r12
mov r12, rcx
sub rsp, 0x40
mov rax, qword [0x14002d650]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov rax, qword [rax]
cmp dword [rax + 0xde], 0
je 0x140021bff
mov rcx, qword [rax + 0x7f8]
test rcx, rcx
je 0x140021bff
mov r8w, word [rax + 0x808]
test r8w, r8w
je 0x140021bff
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x58], edx
mov word [rsp + 0x38], r8w
call sym.SysSetConfig
mov edx, dword [rsp + 0x58]
mov rcx, r12
call sym.SysInvoke
jmp 0x140021c08
mov rcx, r12
call qword [rax + 0x200]
mov dword [rsp + 0x20], eax
mov r8d, 0x29
lea r9, [0x14002a93d]
lea rdx, str.SysNtTerminateProcess
lea rcx, str._DEBUG::_s::_d___s__..._____08x_n
mov r12d, eax
call sym.DbgPrint
add rsp, 0x40
mov eax, r12d
pop r12
ret

Function at 0x140021c40
Capabilities:
Print debug messages

Disassembly:
push r12
mov r12, rcx
sub rsp, 0x40
mov rax, qword [0x14002d650]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov rax, qword [rax]
cmp dword [rax + 0xde], 0
je 0x140021caf
mov rcx, qword [rax + 0x7f8]
test rcx, rcx
je 0x140021caf
mov r8w, word [rax + 0x832]
test r8w, r8w
je 0x140021caf
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x58], edx
mov word [rsp + 0x38], r8w
call sym.SysSetConfig
mov edx, dword [rsp + 0x58]
mov rcx, r12
call sym.SysInvoke
jmp 0x140021cb8
mov rcx, r12
call qword [rax + 0x2b0]
mov dword [rsp + 0x20], eax
mov r8d, 0x161
lea r9, [0x14002aad7]
lea rdx, str.SysNtTerminateThread
lea rcx, str._DEBUG::_s::_d___s__..._____08x_n
mov r12d, eax
call sym.DbgPrint
add rsp, 0x40
mov eax, r12d
pop r12
ret
Function at 0x140021cf0
Capabilities:
Print debug messages

Disassembly:
push r12
mov r12, rcx
sub rsp, 0x40
mov rax, qword [0x14002d650]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov rax, qword [rax]
cmp dword [rax + 0xde], 0
je 0x140021d61
mov rcx, qword [rax + 0x7f8]
test rcx, rcx
je 0x140021d61
mov r8w, word [rax + 0x82e]
test r8w, r8w
je 0x140021d61
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x58], rdx
mov word [rsp + 0x38], r8w
call sym.SysSetConfig
mov rdx, qword [rsp + 0x58]
mov rcx, r12
call sym.SysInvoke
jmp 0x140021d6a
mov rcx, r12
call qword [rax + 0x2a0]
mov dword [rsp + 0x20], eax
mov r8d, 0x137
lea r9, [0x14002aa97]
lea rdx, str.SysNtUnmapViewOfSection
lea rcx, str._DEBUG::_s::_d___s__..._____08x_n
mov r12d, eax
call sym.DbgPrint
add rsp, 0x40
mov eax, r12d
pop r12
ret

Function at 0x140021da0
Capabilities:
Print debug messages

Disassembly:
push r12
movzx edx, dl
mov r12, rcx
sub rsp, 0x50
mov rax, qword [0x14002d650]
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov rax, qword [rax]
cmp dword [rax + 0xde], 0
je 0x140021e1c
mov rcx, qword [rax + 0x7f8]
test rcx, rcx
je 0x140021e1c
mov r9w, word [rax + 0x824]
test r9w, r9w
je 0x140021e1c
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x70], r8
mov dword [rsp + 0x3c], edx
mov word [rsp + 0x48], r9w
call sym.SysSetConfig
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x3c]
mov rcx, r12
call sym.SysInvoke
jmp 0x140021e25
mov rcx, r12
call qword [rax + 0x270]
mov dword [rsp + 0x20], eax
mov r8d, 0xfe
lea r9, [0x14002aa40]
lea rdx, str.SysNtWaitForSingleObject
lea rcx, str._DEBUG::_s::_d___s__..._____08x_n
mov r12d, eax
call sym.DbgPrint
add rsp, 0x50
mov eax, r12d
pop r12
ret

Function at 0x140021e60
Capabilities:
Print debug messages

Disassembly:
push r12
mov r12, rcx
push rbx
sub rsp, 0x48
mov rax, qword [0x14002d650]
mov qword [rsp + 0x30], 0
mov rbx, qword [rsp + 0x80]
mov qword [rsp + 0x38], 0
mov rax, qword [rax]
cmp dword [rax + 0xde], 0
je 0x140021ef3
mov rcx, qword [rax + 0x7f8]
test rcx, rcx
je 0x140021ef3
mov r10w, word [rax + 0x828]
test r10w, r10w
je 0x140021ef3
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x78], r9
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x68], rdx
mov word [rsp + 0x38], r10w
call sym.SysSetConfig
mov qword [rsp + 0x20], rbx
mov r9, qword [rsp + 0x78]
mov rcx, r12
mov r8, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
call sym.SysInvoke
jmp 0x140021f01
mov qword [rsp + 0x20], rbx
mov rcx, r12
call qword [rax + 0x288]
mov dword [rsp + 0x20], eax
mov r8d, 0x11d
lea r9, [0x14002aa6e]
lea rdx, str.SysNtWriteVirtualMemory
lea rcx, str._DEBUG::_s::_d___s__..._____08x_n
mov r12d, eax
call sym.DbgPrint
add rsp, 0x48
mov eax, r12d
pop rbx
pop r12
ret
Function at 0x140021f40
Capabilities:
Print debug messages

Disassembly:
push r12
mov r10, rdx
push rbx
sub rsp, 0xa8
mov rax, qword [rsp + 0xe0]
mov rbx, qword [rsp + 0xe8]
mov qword [rsp + 0x60], 0
cmp cl, 2
je 0x140021fea
ja 0x140021f8a
test cl, cl
jne 0x140021fb5
mov qword [rsp + 0x28], rbx
mov ecx, 2
mov qword [rsp + 0x20], rax
call sym.ThreadCreate
jmp 0x1400220d5
cmp cl, 3
je 0x1400220d0
movzx r9d, cl
mov r8d, 0x114
lea rdx, str.ThreadCreate
lea rcx, str._DEBUG::_s::_d__Technique_not_found____d
call sym.DbgPrint
jmp 0x1400220d0
mov rdx, qword [0x14002d650]
xor r8d, r8d
mov rcx, r10
mov r11, qword [rdx]
mov qword [rsp + 0x30], rbx
xor edx, edx
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
call qword [r11 + 0x300]
mov qword [rsp + 0x60], rax
jmp 0x1400220d0
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x20], r9
xor r8d, r8d
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x90], rdx
lea rdx, [rsp + 0x78]
mov r9, r10
mov qword [rsp + 0x50], rdx
mov edx, 0x1fffff
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x98], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x80], 0x10003
mov qword [rsp + 0x88], 0x10
mov qword [rsp + 0x78], 0x28
call sym.SysNtCreateThreadEx
mov r12d, eax
test eax, eax
js 0x140022097
test rbx, rbx
je 0x1400220d0
mov rax, qword [rsp + 0x70]
mov dword [rbx], eax
jmp 0x1400220d0
mov r9d, eax
mov r8d, 0x107
lea rdx, str.ThreadCreate
lea rcx, str._DEBUG::_s::_d__Failed_to_create_new_thread___NtStatus:__x__n
call sym.DbgPrint
mov rax, qword [0x14002d650]
mov ecx, r12d
mov rax, qword [rax]
mov rbx, qword [rax + 0x8c2]
call qword [rax + 0x160]
mov dword [rbx + 0x68], eax
mov rax, qword [rsp + 0x60]
add rsp, 0xa8
pop rbx
pop r12
ret
Function at 0x1400231d0
Capabilities:
Print debug messages

Disassembly:
push r12
mov r8d, 1
mov edx, 8
mov rcx, 0xfffffffffffffffe
push rbx
sub rsp, 0x48
mov qword [rsp + 0x38], 0
lea rbx, [rsp + 0x38]
mov r9, rbx
call sym.SysNtOpenThreadToken
test eax, eax
jns 0x1400232a6
mov r12d, eax
cmp eax, 0xc000007c
je 0x140023241
mov rbx, qword [0x14002d650]
mov ecx, r12d
mov rax, qword [rbx]
call qword [rax + 0x160]
mov r9d, r12d
mov r8d, 0x27a
lea rdx, str.TokenCurrentHandle
mov dword [rsp + 0x20], eax
lea rcx, str._DEBUG::_s::_d__NtOpenThreadToken:_Failed:__08x_:__ld__n
jmp 0x140023287
mov r8, rbx
mov edx, 8
or rcx, 0xffffffffffffffff
call sym.SysNtOpenProcessToken
mov r12d, eax
test eax, eax
jns 0x1400232a6
mov rbx, qword [0x14002d650]
mov ecx, r12d
mov rax, qword [rbx]
call qword [rax + 0x160]
mov r9d, r12d
mov r8d, 0x281
lea rdx, str.TokenCurrentHandle
mov dword [rsp + 0x20], eax
lea rcx, str._DEBUG::_s::_d__NtOpenProcessToken:_Failed:__08x_:__ld__n
call sym.DbgPrint
mov rax, qword [rbx]
mov ecx, r12d
mov rbx, qword [rax + 0x8c2]
call qword [rax + 0x160]
mov dword [rbx + 0x68], eax
xor eax, eax
jmp 0x1400232ab
mov rax, qword [rsp + 0x38]
add rsp, 0x48
pop rbx
pop r12
ret

Function at 0x1400232c0
Capabilities:
Print debug messages

Disassembly:
push rdi
mov r10, rcx
xor eax, eax
mov ecx, 0xa
push rsi
push rbx
sub rsp, 0x70
lea rdi, [rsp + 0x40]
mov dword [rsp + 0x38], r8d
lea r8, [rsp + 0x40]
rep stosd dword [rdi], eax
lea rax, [rsp + 0x34]
mov dword [rsp + 0x20], r9d
mov rcx, r10
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0xb0]
xor r9d, r9d
mov dword [rsp + 0x3c], 0
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x34], 0xc
mov dword [rsp + 0x40], 0x30
call sym.SysNtDuplicateToken
mov ebx, eax
mov eax, 1
test ebx, ebx
jns 0x140023375
mov rdi, qword [0x14002d650]
mov ecx, ebx
mov rax, qword [rdi]
mov rsi, qword [rax + 0x8c2]
call qword [rax + 0x160]
mov ecx, ebx
mov dword [rsi + 0x68], eax
mov rax, qword [rdi]
call qword [rax + 0x160]
mov r9d, ebx
mov r8d, 0x3d
lea rdx, str.TokenDuplicate
mov dword [rsp + 0x20], eax
lea rcx, str._DEBUG::_s::_d__NtDuplicateToken:_Failed:__08x_:__ld__n
call sym.DbgPrint
xor eax, eax
add rsp, 0x70
pop rbx
pop rsi
pop rdi
ret
Function at 0x140023c60
Capabilities:
Print debug messages

Disassembly:
push r12
push rsi
mov esi, edx
mov rdx, rcx
xor ecx, ecx
push rbx
sub rsp, 0x50
mov rbx, qword [0x14002d650]
mov qword [rsp + 0x40], 0
lea r8, [rsp + 0x38]
mov qword [rsp + 0x48], 0
mov rax, qword [rbx]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
call qword [rax + 0x648]
test eax, eax
jne 0x140023cd6
mov r12d, eax
mov rax, qword [rbx]
mov r8d, 0xd5
lea rdx, str.TokenSetPrivilege
lea rcx, str._DEBUG::_s::_d______LookupPrivilegeValue_error:__u_n
mov rax, qword [rax + 0x8c2]
mov r9d, dword [rax + 0x68]
jmp 0x140023d62
mov rax, qword [rsp + 0x38]
lea r8, [rsp + 0x30]
mov edx, 0xf01ff
mov dword [rsp + 0x40], 1
mov qword [rsp + 0x44], rax
xor eax, eax
test esi, esi
setne al
or rcx, 0xffffffffffffffff
add eax, eax
mov dword [rsp + 0x4c], eax
call sym.SysNtOpenProcessToken
test eax, eax
mov r12d, eax
mov rax, qword [rbx]
js 0x140023d69
mov rcx, qword [rsp + 0x30]
xor r9d, r9d
lea r8, [rsp + 0x40]
xor edx, edx
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [rax + 0x630]
mov r12d, eax
test eax, eax
jne 0x140023dab
mov rax, qword [rbx]
mov r8d, 0xe4
lea rdx, str.TokenSetPrivilege
lea rcx, str._DEBUG::_s::_d______AdjustTokenPrivileges_error:__u_n
mov rax, qword [rax + 0x8c2]
mov r9d, dword [rax + 0x68]
call sym.DbgPrint
jmp 0x140023db1
mov ecx, r12d
call qword [rax + 0x160]
mov r8d, 0xe8
lea rdx, str.TokenSetPrivilege
lea rcx, str._DEBUG::_s::_d__NtOpenProcessToken:_Failed___d_
mov r9d, eax
call sym.DbgPrint
mov rax, qword [rbx]
mov ecx, r12d
xor r12d, r12d
call qword [rax + 0x160]
mov ecx, 1
mov edx, eax
call sym.PackageTransmitError
jmp 0x140023db1
mov r12d, 1
add rsp, 0x50
mov eax, r12d
pop rbx
pop rsi
pop r12
ret

Function at 0x1400243a0
Capabilities:
Print debug messages

Disassembly:
push r12
lea rdx, str.VehDebugger
mov r8d, 0x25
push rbx
mov rbx, rcx
sub rsp, 0x38
mov rax, qword [rcx]
lea rcx, str._DEBUG::_s::_d__Exception:__p_n
mov dword [rsp + 0x2c], 0
mov r9d, dword [rax]
call sym.DbgPrint
mov rcx, qword [0x1400266e0]
mov rax, qword [rbx + 8]
lea rdx, [rsp + 0x2c]
mov qword [rax + 0xf8], rcx
call sym.GetRequestIDForCallingObjectFile
test eax, eax
je 0x140024401
mov edx, dword [rsp + 0x2c]
mov ecx, 0x14
call sym.PackageCreateWithRequestID
jmp 0x14002440b
mov ecx, 0x14
call sym.PackageCreate
mov rcx, rax
mov edx, 1
mov r12, rax
call sym.PackageAddInt32
mov rax, qword [rbx]
mov rcx, r12
mov edx, dword [rax]
call sym.PackageAddInt32
mov rax, qword [rbx]
mov rcx, r12
mov rdx, qword [rax + 0x10]
call sym.PackageAddInt64
mov rcx, r12
call sym.PackageTransmit
add rsp, 0x38
or eax, 0xffffffff
pop rbx
pop r12
ret

Function at 0x1400258a0
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
call dbg.__main
mov rax, qword [0x14002d7a0]
xor edx, edx
mov r9d, dword [rax]
mov rax, qword [0x14002d790]
mov r8, qword [rax]
mov rax, qword [0x14002d780]
mov rcx, qword [rax]
add rsp, 0x28
jmp entry0
Function at 0x140001378
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x140005440]
mov dword [rax], 1
mov rax, qword [0x140005450]
mov dword [rax], 1
mov rax, qword [0x140005460]
mov dword [rax], 1
mov rax, qword [0x140005400]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400013c9
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400013f5
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000141b
cmp eax, 0x20b
je 0x140001442
jmp 0x140001471
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000142e
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x14000145d
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x140001b20
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x1400027f2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x140009168]
test eax, eax
je 0x14000288a
lea rax, [0x140009140]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x140009170]
mov qword [rbp - 8], rax
jmp 0x14000286e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x140002862
cmp qword [rbp - 0x10], 0
je 0x140002862
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140002828
lea rax, [0x140009140]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x14000288b
nop
add rsp, 0x30
pop rbp
ret
Function at 0x14012ac0f
Capabilities:
Execute syscall
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov r8d, r15d
add r13, rdi
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
xchg rcx, rdi
mov rdi, qword [rax]
je 0x14012a9bd
jne 0x14012a9bd
mul rdx
cmp rdi, rdi
rcr r9d, 0x6e
jmp 0x14012a513
jmp 0x14012ad38
mov r9d, 0x8000
mov qword [rsp + 0x398], r13
lea r8, [rbp + 0xc0]
mov qword [rbp + 0xc0], r15
jmp 0x14012ac32
mov rcx, qword [rsp + 0x40]
call rdi
test eax, eax
jne 0x14012d646
jmp 0x14012aaf9
lea rdx, [rsp + 0x30]
mov rcx, 0xffffffffffffffff
call r12
mov rax, qword gs:[0x60]
lea rdi, [0x140000000]
movsxd r13, dword [0x14000003c]
jmp 0x14012a977
mov r10d, r8d
mov edx, 0xf020dd12
lea rax, [r11 + r10*4]
je 0x14012acfd
jne 0x14012acfd
lea edi, [rcx + 0x990f]
lea r14d, [rbp - 0xaeec]
lea ecx, [rbx + 0xdd5a]
js 0x14012b9f5
call rax
div rcx
jl 0x14012a8ad
pushfq
xor r15d, 0x843f8af0
xor edi, 0x843f8af0
call rax
jmp rax
jmp 0x14012ad24
mov ecx, dword [rax + r9]
add rcx, r9
movzx eax, byte [rcx]
inc rcx
test al, al
jmp 0x14012a932
xchg rcx, rdi
mov r9, qword [rcx + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
mov r11d, dword [rbx + r9 + 0x20]
nop word [rax + rax]
je 0x14012ad6d
jne 0x14012ad6d
jle 0x14012b8de
jb 0x14012bd35
jmp rax
jmp 0x14012acb0
xor dil, dil
cmp byte [rbx], 0x2e
jne 0x14012b6ab
mov eax, dword [rbx + 1]
jmp fcn.14012b3c7
add byte [rbx + rcx*4 + 0x44], ah
lea ebp, [rcx + 0x5576]
jg 0x14012b54b
test edi, 0xd16e0a55
jmp 0x14012b4f4
invalid
Function at 0x14012d650
Capabilities:
Execute syscall

Disassembly:
ror byte [rax - 0x7d], 0xf8
push rbx
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x28
lea rax, [0x14012d8c0]
je 0x14012d68c
jne 0x14012d68c
call rax
rcr r15d, 0x72
div r12
lea ebp, [rbx - 0x4b01]
test r9, rdx
cmp ebp, 0x241c2d92
movabs r11, 0xce4c93165111aeb
ror ebp, 0x9f
jg 0x14012cf92
jmp fcn.14012d6a8
syscall
jae 0x14012de57
ret 0x10
Function at 0x14000fe40
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x70
mov qword [rax - 0x48], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x14009b038]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rbx, rcx
cmp qword [rcx + 0x68], 0
je 0x14000ff85
cmp byte [rcx + 0x71], 0
je 0x14000ff85
mov rax, qword [rcx]
or edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
jne 0x14000fe94
xor al, al
jmp 0x14000ff87
mov edx, 8
lea rcx, [rsp + 0x40]
call fcn.14000ecf0
nop
mov r9, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x58]
nop
lea rcx, [rsp + 0x40]
cmp rdx, 0x10
cmovae rcx, r9
lea r8, [rsp + 0x40]
cmovae r8, r9
mov r9, qword [rsp + 0x50]
add r9, rcx
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea rdx, [rbx + 0x74]
mov rcx, qword [rbx + 0x68]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14000fef1
sub eax, 1
jne 0x14000ff6b
jmp 0x14000fef5
mov byte [rbx + 0x71], 0
lea rax, [rsp + 0x40]
mov r9, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
cmovae rax, r9
mov rdi, qword [rsp + 0x38]
sub rdi, rax
je 0x14000ff47
lea rcx, [rsp + 0x40]
cmp rdx, 0x10
cmovae rcx, r9
mov r9, qword [rbx + 0x80]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14000ff70
mov rdx, qword [rsp + 0x58]
mov r9, qword [rsp + 0x40]
cmp byte [rbx + 0x71], 0
je 0x14000ff74
test rdi, rdi
jne 0x14000feb0
xor r8d, r8d
lea edx, [rdi + 8]
lea rcx, [rsp + 0x40]
call fcn.14000fd20
jmp 0x14000fea4
sub eax, 2
je 0x14000ff74
xor bl, bl
jmp 0x14000ff76
mov bl, 1
lea rcx, [rsp + 0x40]
call fcn.14000fc00
movzx eax, bl
jmp 0x14000ff87
mov al, 1
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140062800
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400152a0
Capabilities:
Get common file path

Disassembly:
push rdi
sub rsp, 0x70
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x80], rbx
mov rax, qword [0x14009b038]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rbx, rdx
mov qword [rsp + 0x30], rdx
movdqa xmm0, xmmword [0x1400812a0]
movdqu xmmword [rsp + 0x50], xmm0
xor edi, edi
mov word [rsp + 0x40], di
xor r8d, r8d
mov edx, 0x105
lea rcx, [rsp + 0x40]
call fcn.1400111f0
lea rax, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rax, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [rdi + 0x23]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rcx, [rsp + 0x40]
call fcn.140017500
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rdx, qword [rsp + 0x40]
or r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x140015340
lea rcx, [rsp + 0x40]
call fcn.14000fab0
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rsp + 0x50]
movups xmmword [rbx + 0x10], xmm1
mov rax, rbx
jmp 0x140015370
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140062800
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
Function at 0x1400157f0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push r14
mov eax, 0x13f0
call fcn.1400633e0
sub rsp, rax
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x1408], rbx
mov qword [rsp + 0x1410], rsi
mov qword [rsp + 0x1418], rdi
mov rax, qword [0x14009b038]
xor rax, rsp
mov qword [rsp + 0x13e0], rax
mov r14, rcx
mov qword [rsp + 0x28], rcx
xor eax, eax
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], 7
mov word [rcx], ax
mov qword [rcx + 0x30], rax
mov qword [rcx + 0x38], 7
mov word [rcx + 0x20], ax
mov qword [rcx + 0x50], rax
mov qword [rcx + 0x58], 7
mov word [rcx + 0x40], ax
mov qword [rcx + 0x70], rax
mov qword [rcx + 0x78], 7
mov word [rcx + 0x60], ax
mov qword [rcx + 0x90], rax
mov qword [rcx + 0x98], 7
mov word [rcx + 0x80], ax
xor r8d, r8d
lea rdx, [0x140077e2c]
call fcn.14000fab0
xor r8d, r8d
lea rdx, [0x140077e2c]
lea rcx, [r14 + 0x20]
call fcn.14000fab0
xor r8d, r8d
lea rdx, [0x140077e2c]
lea rcx, [r14 + 0x40]
call fcn.14000fab0
xor r8d, r8d
lea rdx, [0x140077e2c]
lea rcx, [r14 + 0x60]
call fcn.14000fab0
lea rcx, [r14 + 0xa0]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [r14 + 0xc4]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [r14 + 0xd4]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [r14 + 0xe4]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [r14 + 0xf4]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov edx, 0x1571
mov ebx, 1
mov r8d, ebx
mov ecx, ebx
nop dword [rax]
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, r8d
inc r8d
inc rcx
cmp rcx, 0x270
jl 0x140015930
movdqa xmm0, xmmword [0x1400812b0]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
xor r8d, r8d
lea rdx, [0x140077e29]
lea rcx, [rsp + 0x30]
call fcn.140018160
nop
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov edx, eax
mov rcx, rbx
nop dword [rax + rax]
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ebx
inc ebx
inc rcx
cmp rcx, 0x270
jl 0x140015990
lea rcx, [rsp + 0x30]
call fcn.14000fc00
lea rcx, [r14 + 0xb4]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
nop
mov rax, r14
mov rcx, qword [rsp + 0x13e0]
xor rcx, rsp
call fcn.140062800
lea r11, [rsp + 0x13f0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x140015a50
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
lea rbx, [0x14009d6a8]
mov rax, qword [0x14009d6b8]
mov edx, 0x105
cmp rax, rdx
jb 0x140015a9c
mov qword [0x14009d6b8], rdx
mov rax, rbx
cmp qword [0x14009d6c0], 8
cmovae rax, qword [0x14009d6a8]
xor ecx, ecx
mov word [rax + 0x20a], cx
jmp 0x140015aaa
xor r8d, r8d
sub rdx, rax
mov rcx, rbx
call fcn.1400111f0
mov rax, rbx
cmp qword [0x14009d6c0], 8
cmovae rax, qword [0x14009d6a8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x23]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov rcx, rbx
call fcn.140017500
mov rdx, rbx
cmp qword [0x14009d6c0], 8
cmovae rdx, qword [0x14009d6a8]
or r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], 0
jne 0x140015af3
mov rcx, rbx
call fcn.14000fab0
nop
jmp 0x140015b10
add rsp, 0x40
pop rbx
ret