joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1403aab20
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x38
cmp r8d, 8
jge 0x1403aabbd
xor eax, eax
cmp r8d, 4
jl 0x1403aab71
add r8d, 0xfffffffc
movsx r10, word [rcx + rax*2]
movsx r9, dx
cmp r10d, r9d
je 0x1403aabb8
nop dword [rax]
movsx r10, word [rcx + rax*2 + 2]
cmp r10d, r9d
je 0x1403aabb1
movsx r10, word [rcx + rax*2 + 4]
cmp r10d, r9d
je 0x1403aaba9
movsx r10, word [rcx + rax*2 + 6]
cmp r10d, r9d
je 0x1403aaba1
add rax, 4
test r8d, r8d
jle 0x1403aad9a
movsx r9, dx
nop
dec r8d
movsx rdx, word [rcx + rax*2]
cmp edx, r9d
je 0x1403aabb8
inc rax
test r8d, r8d
jg 0x1403aab80
jmp 0x1403aad9a
add eax, 3
jmp 0x1403aad95
add eax, 2
jmp 0x1403aad95
inc eax
jmp 0x1403aad95
jmp 0x1403aad95
movsx r9, dx
movd xmm0, r9d
punpcklwd xmm0, xmm0
pshufd xmm0, xmm0, 0
mov rax, rcx
lea edx, [r8 - 8]
movsxd rdx, edx
add rdx, rdx
lea r10, [rax + rdx]
movups xmm1, xmmword [rax]
pcmpeqw xmm1, xmm0
movaps xmmword [rsp + 0x20], xmm1
xorps xmm2, xmm2
pcmpeqw xmm1, xmm2
pmovmskb r9d, xmm1
cmp r9d, 0xffff
jne 0x1403aacd6
add rax, 0x10
cmp rax, r10
jbe 0x1403aabe0
mov eax, r8d
test al, 7
je 0x1403aad9a
movups xmm1, xmmword [r10]
pcmpeqw xmm0, xmm1
movaps xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
pcmpeqw xmm0, xmm1
pmovmskb ecx, xmm0
cmp ecx, 0xffff
je 0x1403aad9a
mov rax, qword [rsp + 0x20]
mov qword [rsp + 8], rax
movzx eax, word [rsp + 8]
shr eax, 0xf
movzx ecx, word [rsp + 0xa]
shr ecx, 0xf
add ecx, ecx
or eax, ecx
movzx ecx, word [rsp + 0xc]
shr ecx, 0xf
shl ecx, 2
or ecx, eax
mov eax, ecx
movzx ecx, word [rsp + 0xe]
shr ecx, 0xf
shl ecx, 3
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x28]
mov qword [rsp], rcx
movzx ecx, word [rsp]
shr ecx, 0xf
movzx r8d, word [rsp + 2]
shr r8d, 0xf
add r8d, r8d
or ecx, r8d
movzx r8d, word [rsp + 4]
shr r8d, 0xf
shl r8d, 2
or r8d, ecx
mov ecx, r8d
movzx r8d, word [rsp + 6]
shr r8d, 0xf
shl r8d, 3
or r8d, ecx
mov ecx, r8d
shl ecx, 4
or eax, ecx
jne 0x1403aad8c
mov ecx, 0x20
jmp 0x1403aad8f
mov rdx, qword [rsp + 0x20]
mov qword [rsp + 0x18], rdx
movzx edx, word [rsp + 0x18]
shr edx, 0xf
movzx r8d, word [rsp + 0x1a]
shr r8d, 0xf
add r8d, r8d
or edx, r8d
movzx r8d, word [rsp + 0x1c]
shr r8d, 0xf
shl r8d, 2
or r8d, edx
mov edx, r8d
movzx r8d, word [rsp + 0x1e]
shr r8d, 0xf
shl r8d, 3
or r8d, edx
mov edx, r8d
mov r8, qword [rsp + 0x28]
mov qword [rsp + 0x10], r8
movzx r8d, word [rsp + 0x10]
shr r8d, 0xf
movzx r10d, word [rsp + 0x12]
shr r10d, 0xf
add r10d, r10d
or r8d, r10d
movzx r10d, word [rsp + 0x14]
shr r10d, 0xf
shl r10d, 2
or r10d, r8d
mov r8d, r10d
movzx r10d, word [rsp + 0x16]
shr r10d, 0xf
shl r10d, 3
or r10d, r8d
mov r8d, r10d
shl r8d, 4
or edx, r8d
jne 0x1403aad7d
mov r8d, 0x20
jmp 0x1403aad81
bsf r8d, edx
sub rax, rcx
shr rax, 1
add eax, r8d
jmp 0x1403aad95
bsf ecx, eax
shr rdx, 1
lea eax, [rdx + rcx]
add rsp, 0x38
ret
mov eax, 0xffffffff
add rsp, 0x38
ret
Function at 0x1403b5040
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x48
movaps xmmword [rsp + 0x30], xmm6
cmp r9d, 8
jge 0x1403b5091
movzx r10d, dx
sub r8d, r10d
movzx eax, r8w
xor edx, edx
test r9d, r9d
jle 0x1403b52bb
movsxd r8, edx
movzx r8d, word [rcx + r8*2]
sub r8d, r10d
movzx r8d, r8w
cmp r8d, eax
jle 0x1403b5085
inc edx
cmp edx, r9d
jl 0x1403b5065
jmp 0x1403b52bb
mov eax, edx
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret
movzx r10d, dx
movd xmm0, r10d
punpcklwd xmm0, xmm0
pshufd xmm0, xmm0, 0
mov eax, r8d
sub eax, r10d
movzx eax, ax
movd xmm1, eax
punpcklwd xmm1, xmm1
pshufd xmm1, xmm1, 0
mov rax, rcx
add r9d, 0xfffffff8
mov edx, r9d
add rdx, rdx
lea r8, [rax + rdx]
movups xmm2, xmmword [0x140926b60]
movaps xmm3, xmm1
psubw xmm3, xmm2
movups xmm4, xmmword [rax]
psubw xmm4, xmm0
movaps xmm5, xmm4
psubw xmm5, xmm2
movaps xmm6, xmm3
pcmpgtw xmm6, xmm5
pcmpeqw xmm4, xmm1
por xmm4, xmm6
movaps xmmword [rsp + 0x20], xmm4
xorps xmm5, xmm5
pcmpeqw xmm4, xmm5
pmovmskb r10d, xmm4
cmp r10d, 0xffff
jne 0x1403b51fb
add rax, 0x10
cmp rax, r8
jb 0x1403b50d8
movups xmm4, xmmword [r8]
psubw xmm4, xmm0
movaps xmm0, xmm4
psubw xmm0, xmm2
pcmpgtw xmm3, xmm0
pcmpeqw xmm1, xmm4
por xmm1, xmm3
movaps xmmword [rsp + 0x20], xmm1
xorps xmm0, xmm0
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
cmp eax, 0xffff
je 0x1403b52bb
mov rax, qword [rsp + 0x20]
mov qword [rsp + 8], rax
movzx eax, word [rsp + 8]
shr eax, 0xf
movzx ecx, word [rsp + 0xa]
shr ecx, 0xf
add ecx, ecx
or eax, ecx
movzx ecx, word [rsp + 0xc]
shr ecx, 0xf
shl ecx, 2
or ecx, eax
mov eax, ecx
movzx ecx, word [rsp + 0xe]
shr ecx, 0xf
shl ecx, 3
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x28]
mov qword [rsp], rcx
movzx ecx, word [rsp]
shr ecx, 0xf
movzx r8d, word [rsp + 2]
shr r8d, 0xf
add r8d, r8d
or ecx, r8d
movzx r8d, word [rsp + 4]
shr r8d, 0xf
shl r8d, 2
or r8d, ecx
mov ecx, r8d
movzx r8d, word [rsp + 6]
shr r8d, 0xf
shl r8d, 3
or r8d, ecx
mov ecx, r8d
shl ecx, 4
or eax, ecx
bsf ecx, eax
mov r8d, 0x20
test eax, eax
cmove ecx, r8d
mov eax, ecx
shr rdx, 1
add eax, edx
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret
mov rdx, qword [rsp + 0x20]
mov qword [rsp + 0x18], rdx
movzx edx, word [rsp + 0x18]
shr edx, 0xf
movzx r8d, word [rsp + 0x1a]
shr r8d, 0xf
add r8d, r8d
or edx, r8d
movzx r8d, word [rsp + 0x1c]
shr r8d, 0xf
shl r8d, 2
or r8d, edx
mov edx, r8d
movzx r8d, word [rsp + 0x1e]
shr r8d, 0xf
shl r8d, 3
or r8d, edx
mov edx, r8d
mov r8, qword [rsp + 0x28]
mov qword [rsp + 0x10], r8
movzx r8d, word [rsp + 0x10]
shr r8d, 0xf
movzx r10d, word [rsp + 0x12]
shr r10d, 0xf
add r10d, r10d
or r8d, r10d
movzx r10d, word [rsp + 0x14]
shr r10d, 0xf
shl r10d, 2
or r10d, r8d
mov r8d, r10d
movzx r10d, word [rsp + 0x16]
shr r10d, 0xf
shl r10d, 3
or r10d, r8d
mov r8d, r10d
shl r8d, 4
or edx, r8d
bsf r8d, edx
mov r10d, 0x20
test edx, edx
cmove r8d, r10d
sub rax, rcx
shr rax, 1
add eax, r8d
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret
mov eax, 0xffffffff
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret
Function at 0x14058f058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.14058f1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14058f089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14058f06f
add dl, dl
jne 0x14058f096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14058f0f6
xor eax, eax
add dl, dl
jne 0x14058f0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14058f1ad
add dl, dl
jne 0x14058f0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14058f0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14058f0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14058f0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14058f0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14058f07e
mov eax, 1
add dl, dl
jne 0x14058f106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14058f113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14058f0fb
sub eax, ebx
mov ebx, 1
jne 0x14058f14c
mov ecx, 1
add dl, dl
jne 0x14058f12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14058f13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14058f123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14058f07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14058f168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14058f175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14058f15d
cmp eax, 0x7d00
jae 0x14058f19b
cmp eax, 0x500
jb 0x14058f196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14058f07e
cmp eax, 0x7f
ja 0x14058f19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14058f07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14058f1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14058f07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14000421c
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
call fcn.14000144c
xor esi, esi
mov rcx, rax
test rax, rax
je 0x1400042d9
mov rax, qword [rax]
call qword [rax + 0x18]
lea ecx, [rsi + 1]
mov edx, 0x104
lea r9, [rax + 0x18]
mov qword [rbx], r9
mov eax, dword [r9 - 0xc]
sub ecx, dword [r9 - 8]
sub eax, edx
or ecx, eax
jge 0x140004272
mov rcx, rbx
call fcn.140001a54
mov r9, qword [rbx]
xor r8d, r8d
lea rdx, [0x140050a48]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov rcx, qword [rbx]
mov edi, eax
test rcx, rcx
jne 0x140004293
mov eax, esi
jmp 0x1400042a0
movsxd rdx, dword [rcx - 0xc]
call fcn.140031f70
test eax, eax
js 0x1400042e4
mov rcx, qword [rbx]
cmp eax, dword [rcx - 0xc]
jg 0x1400042e4
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [rbx]
mov word [rax + rcx*2], si
test edi, edi
je 0x1400042be
cmp edi, 0x6f
jne 0x1400042c6
mov rcx, rbx
call fcn.1400018d8
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov ecx, 0x80004005
call fcn.1400017a4
int3
mov ecx, 0x80070057
call fcn.1400017a4
int3

Function at 0x140004c7c
Capabilities:
Compare security identifiers

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x50]
sub rsp, 0x150
mov rax, qword [0x140057010]
xor rax, rsp
mov qword [rbp + 0x40], rax
and qword [rsp + 0x38], 0
lea rax, [0x14004e308]
xorps xmm0, xmm0
mov qword [rsp + 0x20], rax
movdqu xmmword [rsp + 0x28], xmm0
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 8
lea rcx, [rsp + 0x20]
mov r8, rax
call fcn.14000403c
test al, al
jne 0x140004ce7
call fcn.14000c81c
mov edi, eax
jmp 0x140004d7f
lea rcx, [rsp + 0x40]
call fcn.140001ecc
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.140003ee0
test al, al
jne 0x140004d0d
call fcn.14000c81c
mov edi, eax
jmp 0x140004d75
mov r9d, 0x12
lea rdx, [0x14004e140]
lea rcx, [rbp - 0x40]
lea r8d, [r9 - 0x11]
call fcn.140001fa0
cmp byte [rbp - 0x74], 0
je 0x140004d66
lea rcx, [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x140004d66
cmp byte [rbp + 0xc], 0
je 0x140004d66
lea rcx, [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x140004d66
lea rdx, [rbp - 0x38]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
setne al
jmp 0x140004d68
xor al, al
lea rcx, [rbp - 0x40]
mov byte [rbx], al
call fcn.140002160
xor edi, edi
lea rcx, [rsp + 0x40]
call fcn.140002160
mov rdx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x28]
test rdx, rdx
je 0x140004d9c
test rbx, rbx
je 0x140004daa
mov rcx, rbx
call qword [sym.imp.USERENV.dll_UnloadUserProfile]
test rbx, rbx
je 0x140004daa
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x38]
mov edx, 8
call fcn.14002192c
mov eax, edi
mov rcx, qword [rbp + 0x40]
xor rcx, rsp
call fcn.140021680
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140005bd8
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov rbx, rcx
call fcn.14000144c
xor ebp, ebp
mov rcx, rax
test rax, rax
je 0x140005c9e
mov rax, qword [rax]
call qword [rax + 0x18]
xor r8d, r8d
xor edx, edx
add rax, 0x18
mov rcx, rsi
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
test eax, eax
je 0x140005c86
test eax, eax
js 0x140005ca9
mov rax, qword [rbx]
lea edx, [rbp + 1]
mov ecx, dword [rax - 0xc]
sub edx, dword [rax - 8]
sub ecx, edi
or edx, ecx
jge 0x140005c49
mov edx, edi
mov rcx, rbx
call fcn.140001a54
mov rax, qword [rbx]
mov r8d, edi
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rcx, qword [rbx]
test rcx, rcx
jne 0x140005c64
mov eax, ebp
jmp 0x140005c71
movsxd rdx, dword [rcx - 0xc]
call fcn.140031f70
test eax, eax
js 0x140005ca9
mov rcx, qword [rbx]
cmp eax, dword [rcx - 0xc]
jg 0x140005ca9
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [rbx]
mov word [rax + rcx*2], bp
mov rbp, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov ecx, 0x80004005
call fcn.1400017a4
int3
mov ecx, 0x80070057
call fcn.1400017a4
int3

Function at 0x140005cb4
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x260
mov rax, qword [0x140057010]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov esi, ecx
mov rbx, rdx
mov rcx, rdx
call fcn.1400018d8
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x208
call fcn.140022290
lea rax, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, esi
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edi, eax
test eax, eax
jns 0x140005d96
movzx ecx, sil
cmp ecx, 0x26
jne 0x140005d43
lea rdx, str.ProgramFiles
lea rcx, [rsp + 0x30]
call fcn.140005bd8
mov rdx, rax
mov rcx, rbx
call fcn.1400017c8
mov rdx, qword [rsp + 0x30]
jmp 0x140005d69
cmp ecx, 0x1c
jne 0x140005d83
lea rdx, str.LocalAppData
lea rcx, [rsp + 0x38]
call fcn.140005bd8
mov rdx, rax
mov rcx, rbx
call fcn.1400017c8
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140005d83
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, qword [rbx]
mov ecx, 1
cmp dword [rax - 0x10], 0
cmovne edi, ecx
mov eax, edi
jmp 0x140005db2
lea rcx, [rsp + 0x40]
call fcn.140031e44
mov r8d, eax
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.140001948
xor eax, eax
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140021680
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140005fa4
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call fcn.14000144c
xor ebp, ebp
mov rcx, rax
test rax, rax
je 0x140006070
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov esi, 0x103
mov qword [rbx], rax
lea edi, [rsi + 1]
test edi, edi
js 0x14000607b
mov r8, qword [rbx]
mov ecx, 1
mov eax, dword [r8 - 0xc]
sub ecx, dword [r8 - 8]
sub eax, edi
or ecx, eax
jge 0x14000600e
mov edx, edi
mov rcx, rbx
call fcn.140001a54
mov r8, qword [rbx]
mov edx, edi
mov rcx, r8
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, edi
mov esi, eax
sbb eax, eax
and eax, esi
cmp eax, 0xffffffff
jne 0x14000603b
mov rcx, qword [rbx]
test rcx, rcx
jne 0x140006032
mov eax, ebp
jmp 0x14000603f
movsxd rdx, dword [rcx - 0xc]
call fcn.140031f70
test eax, eax
js 0x14000607b
mov rcx, qword [rbx]
cmp eax, dword [rcx - 0xc]
jg 0x14000607b
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [rbx]
mov word [rax + rcx*2], bp
cmp esi, edi
jae 0x140005fe0
mov rbp, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov ecx, 0x80004005
call fcn.1400017a4
int3
mov ecx, 0x80070057
call fcn.1400017a4
int3

Function at 0x140006088
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call fcn.14000144c
xor ebp, ebp
mov rcx, rax
test rax, rax
je 0x14000614f
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov esi, 0x103
mov qword [rbx], rax
lea edi, [rsi + 1]
test edi, edi
js 0x14000615a
mov rdx, qword [rbx]
mov ecx, 1
mov eax, dword [rdx - 0xc]
sub ecx, dword [rdx - 8]
sub eax, edi
or ecx, eax
jge 0x1400060f0
mov edx, edi
mov rcx, rbx
call fcn.140001a54
mov rdx, qword [rbx]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, edi
mov esi, eax
sbb eax, eax
and eax, esi
cmp eax, 0xffffffff
jne 0x14000611a
mov rcx, qword [rbx]
test rcx, rcx
jne 0x140006111
mov eax, ebp
jmp 0x14000611e
movsxd rdx, dword [rcx - 0xc]
call fcn.140031f70
test eax, eax
js 0x14000615a
mov rcx, qword [rbx]
cmp eax, dword [rcx - 0xc]
jg 0x14000615a
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [rbx]
mov word [rax + rcx*2], bp
cmp esi, edi
jae 0x1400060c4
mov rbp, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov ecx, 0x80004005
call fcn.1400017a4
int3
mov ecx, 0x80070057
call fcn.1400017a4
int3
Function at 0x140006808
Capabilities:
Move file

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x140057010]
xor rax, rsp
mov qword [rsp + 0x48], rax
xorps xmm0, xmm0
lea r8, [rsp + 0x20]
mov rdi, rdx
xor eax, eax
xor edx, edx
mov dword [rsp + 0x40], eax
movups xmmword [rsp + 0x20], xmm0
mov rbx, rcx
movups xmmword [rsp + 0x30], xmm0
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
jne 0x140006852
mov eax, 0x80070002
jmp 0x1400068ac
xorps xmm0, xmm0
lea r8, [rsp + 0x20]
xor eax, eax
xor edx, edx
mov rcx, rbx
mov dword [rsp + 0x40], eax
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
jne 0x14000687e
xor r8d, r8d
jmp 0x14000688b
mov r8d, dword [rsp + 0x20]
shr r8d, 4
and r8d, 1
xor r8d, 1
mov rdx, rdi
add r8d, 4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x1400068aa
call fcn.14000c81c
jmp 0x1400068ac
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140021680
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret

Function at 0x140006b4c
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov r11, rcx
test edx, edx
jle 0x140006c73
mov r10, r8
lea rbx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
jmp 0x140006bcf
sub r9d, 4
js 0x140006c73
movzx eax, byte [r11]
shr rax, 2
mov al, byte [rax + rbx]
mov byte [r10], al
movzx eax, byte [r11 + 1]
movzx ecx, byte [r11]
shr eax, 4
and ecx, 3
shl ecx, 4
add ecx, eax
mov al, byte [rcx + rbx]
mov byte [r10 + 1], al
movzx eax, byte [r11 + 2]
movzx ecx, byte [r11 + 1]
shr eax, 6
and ecx, 0xf
lea eax, [rax + rcx*4]
mov al, byte [rax + rbx]
mov byte [r10 + 2], al
movzx eax, byte [r11 + 2]
add r11, 3
and eax, 0x3f
mov al, byte [rax + rbx]
mov byte [r10 + 3], al
add r10, 4
sub edx, 3
cmp edx, 2
jg 0x140006b68
sub edx, 1
je 0x140006c33
cmp edx, 1
jne 0x140006c6b
sub r9d, 3
js 0x140006c73
movzx eax, byte [r11]
shr rax, 2
mov al, byte [rax + rbx]
mov byte [r10], al
movzx ecx, byte [r11]
movzx eax, byte [r11 + 1]
and ecx, 3
shr eax, 4
shl ecx, 4
add ecx, eax
mov al, byte [rcx + rbx]
mov byte [r10 + 1], al
movzx eax, byte [r11 + 1]
and eax, 0xf
mov al, byte [rbx + rax*4]
mov byte [r10 + 2], al
lea eax, [r9 - 1]
test eax, eax
js 0x140006c73
mov byte [r10 + 3], 0x3d
jmp 0x140006c67
sub r9d, 2
js 0x140006c73
movzx eax, byte [r11]
shr rax, 2
mov al, byte [rax + rbx]
mov byte [r10], al
movzx eax, byte [r11]
and eax, 3
add rax, rax
mov cl, byte [rbx + rax*8]
mov byte [r10 + 1], cl
lea ecx, [r9 - 2]
test ecx, ecx
js 0x140006c73
mov word [r10 + 2], 0x3d3d
add r10, 4
sub r10d, r8d
mov eax, r10d
jmp 0x140006c75
xor eax, eax
mov rbx, qword [rsp + 8]
ret
Function at 0x140007468
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x57]
sub rsp, 0x100
lea rax, [0x14004e308]
xorps xmm0, xmm0
xor ebx, ebx
mov qword [rbp - 0x59], rax
lea rcx, [rbp - 0x59]
mov qword [rbp - 0x41], rbx
movdqu xmmword [rbp - 0x51], xmm0
mov r14d, r9d
mov rsi, r8
mov r15, rdx
call fcn.1400040c8
test al, al
jne 0x1400074c8
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3f0
je 0x1400074eb
lea ecx, [rbx + 3]
jmp 0x1400074db
cmp qword [rbp - 0x51], rbx
je 0x1400074eb
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
test eax, eax
jne 0x1400074eb
lea ecx, [rax + 2]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_RaiseException]
xor edx, edx
mov dword [rbp - 0x31], 0x68
lea rcx, [rbp - 0x29]
lea r8d, [rdx + 0x60]
call fcn.140022290
mov rdi, qword [rbp + 0x7f]
lea rax, [rbp - 0x31]
mov qword [rsp + 0x48], rdi
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor ecx, ecx
mov qword [rsp + 0x38], rbx
mov dword [rbp + 0xb], 0x80
mov rdx, r15
test rsi, rsi
jne 0x14000753a
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
jmp 0x140007547
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x400
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x14000755f
call fcn.14000c81c
mov ebx, eax
jmp 0x1400075aa
mov al, byte [0x140059d39]
lea rdx, [0x140059d40]
neg al
sbb rcx, rcx
and rcx, rdx
je 0x1400075aa
mov r8d, 1
mov qword [rbp - 0x71], rcx
mov dword [rbp - 0x69], 7
mov dword [rbp - 0x65], 1
call fcn.140008294
mov r8d, dword [rdi + 0x10]
lea rdx, str._Started_process___u_
lea rcx, [rbp - 0x71]
mov dword [rbp - 0x61], eax
call fcn.1400041a4
lea rcx, [rbp - 0x59]
call fcn.1400042f0
lea r11, [rsp + 0x100]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret