joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400628a8
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r9, [0x14008fe90]
mov rax, r15
mov rbp, r15
and eax, 0x3f
sar rbp, 6
mov ecx, 4
xor esi, esi
mov r14, rdx
lea rdi, [rax + rax*8]
mov rax, qword [r9 + rbp*8]
lea r13d, [rcx + 6]
mov r10, qword [rax + rdi*8 + 0x28]
test r8, r8
je 0x1400628ff
cmp word [rdx], r13w
jne 0x1400628ff
or byte [rax + rdi*8 + 0x38], cl
jmp 0x140062904
and byte [rax + rdi*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rbx, r14
cmp r14, r8
jae 0x140062a29
mov r11d, 0xd
lea r12d, [r11 - 0xb]
movzx ecx, word [rdx]
cmp cx, 0x1a
je 0x140062a4a
lea r9, [rdx + 2]
cmp cx, r11w
je 0x14006293d
mov rdx, r9
mov word [rbx], cx
jmp 0x140062964
cmp r9, r8
jae 0x140062974
cmp word [r9], r13w
mov rax, r12
mov ecx, 4
cmove rax, rcx
add rdx, rax
mov eax, r13d
cmp word [r9], r13w
cmovne ax, r11w
mov word [rbx], ax
mov rax, r12
add rbx, rax
cmp rdx, r8
jb 0x14006291e
jmp 0x140062a29
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rsi
mov r8d, r12d
lea rdx, [rsp + 0x70]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140062a1e
cmp dword [rsp + 0x80], esi
je 0x140062a1e
lea r8, [0x14008fe90]
mov rax, qword [r8 + rbp*8]
test byte [rax + rdi*8 + 0x38], 0x48
je 0x1400629f6
movzx eax, word [rsp + 0x70]
cmp ax, r13w
jne 0x1400629c6
mov word [rbx], r13w
jmp 0x140062a26
mov ecx, 0xd
mov word [rsp + 0x78], ax
mov word [rbx], cx
mov rax, qword [r8 + rbp*8]
lea rcx, [rax + rdi*8]
mov al, byte [rsp + rsi + 0x78]
mov byte [rcx + rsi + 0x3a], al
inc rsi
cmp rsi, r12
jl 0x1400629d3
mov rax, qword [r8 + rbp*8]
mov byte [rax + rdi*8 + 0x3c], r13b
jmp 0x140062a26
cmp word [rsp + 0x70], r13w
jne 0x140062a03
cmp rbx, r14
je 0x1400629c0
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.14005a594
cmp word [rsp + 0x70], r13w
je 0x140062a29
mov ecx, 0xd
mov word [rbx], cx
add rbx, r12
sub rbx, r14
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x14008fe90]
mov rdx, qword [r8 + rbp*8]
mov al, byte [rdx + rdi*8 + 0x38]
test al, 0x40
jne 0x140062a23
or al, r12b
mov byte [rdx + rdi*8 + 0x38], al
jmp 0x140062a29
Function at 0x1400643fc
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.14004a918
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x140064486
cmp byte [rbp - 0x21], r15b
je 0x140064481
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x1400644bc
call fcn.140054cd0
test eax, eax
jne 0x1400644a8
cmp byte [rbp - 0x21], r15b
je 0x1400644a0
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x1400644bc
cmp byte [rbp - 0x21], r15b
je 0x1400644b9
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.140051130
test eax, eax
jne 0x14006455c
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.14004a918
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x1400644fb
cmp byte [rbp - 0x21], r15b
je 0x140064530
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x140064530
call fcn.140054cd0
test eax, eax
jne 0x14006451c
cmp byte [rbp - 0x21], r15b
je 0x140064515
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x140064530
cmp byte [rbp - 0x21], r15b
je 0x14006452d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.140051130
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x14006455c
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x14006455f
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x14006456d
mov rcx, rdi
call fcn.1400549cc
cmp byte [rbp + 0x3f], r15b
je 0x14006457c
mov rcx, qword [rbp + 0x27]
call fcn.1400549cc
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x140065e70
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140065e98
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140065e98
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x1400aaa30
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rcx
push r13
mov qword [rsp + 0x20], 0x24ab8820
movabs r13, 0x58b607ff0f082bf0
push r13
pop rsi
bswap r13
mov rcx, r13
lea rcx, [rcx + rsi + 0x31527176]
pushfq
or ecx, 0x52f03b38
xor si, cx
mov rsi, qword [rsp + 0x18]
neg ecx
jae 0x1400aaa49
or r13w, 0x776c
call fcn.1401532f1
Function at 0x1400e0699
Capabilities:
Link many functions at runtime

Disassembly:
mov r9, qword [rsp + 0x40]
xchg qword [rsp + 0x88], rax
movzx r8, word [rsp + 0x40]
mov r9, r8
sub ebp, 0x1d9d6a8a
lea rcx, [rbp + r12*2 + 0x71b27740]
jns 0x1401108cc
call fcn.1401199eb
call fcn.1400fad94
Function at 0x1400e9d8a
Capabilities:
Link many functions at runtime

Disassembly:
add qword [rsp + 0x50], 0xffffffffbff00895
xor qword [rsp + 0x38], 0x251c7829
mov rdx, qword [rsp + 0x60]
cmp dword [rsp + 0x38], 0x60b97c48
cmova r10w, word [rsp + 0x3a]
jae 0x140026007
mov word [rsp + 0x38], r10w
call fcn.14022345c

Function at 0x1400eba29
Capabilities:
Get geographical location

Disassembly:
movabs r14, 0x66583f5642e912bd
pushfq
cmp r14d, 0x269d1e35
bswap r14
mov qword [rsp + 0x18], rbp
push r9
jl 0x1400989f5
push 0x48759f1
pop r9
bswap r14d

Function at 0x140102564
Capabilities:
Link many functions at runtime

Disassembly:
neg dx
setno dl
mov qword [rsp + 0x58], rsi
neg r13d
bswap rdx
push rbx
and r15b, r13b
mov rbx, r15
add qword [rsp + 0x40], 0xfffffffffffd44e0
call fcn.1402248ef

Function at 0x14010258a
Capabilities:
Link many functions at runtime

Disassembly:
call fcn.14018d78f
call fcn.1400a4961

Function at 0x14010bb44
Capabilities:
Link many functions at runtime

Disassembly:
push r15
jbe fcn.1401a8b8e
lea rcx, [r11 + r11*4 + 0x330031c0]
or r15, r15
ja 0x140184c4b
push rax
call fcn.140207116
add qword [rsp + 0x30], 0xfffffffffff8e3de
call fcn.1400ade74

Function at 0x14011088e
Capabilities:
Link many functions at runtime

Disassembly:
mov dword [rsp + 0x10], 0x3fe7438a
add qword [rsp], 0xffffffffffed9329
xor qword [rsp + 0x10], 0x53b93305
xor byte [rsp + 8], 0xd6
nop
push rdx
sub byte [rsp + 0x18], 0xa4
neg word [rsp + 0x10]
call fcn.140186ff6
pop rax
push r11
pushfq
movabs r11, 0x2abb338b53864543
test r11b, r11b
sete r11b
movabs r11, 0x338a559a421f5c62
sub r11, r11
xchg qword [rsp + r11 + 0x10], rax
call fcn.14020276c

Function at 0x1401108ed
Capabilities:
Link many functions at runtime

Disassembly:
mov r13b, 0xf9
xor r13w, r13w
setae r13b
call fcn.1401f3673

Function at 0x14011090a
Capabilities:
Link many functions at runtime

Disassembly:
xchg qword [rsp + 0x38], rsi
sub word [rsp + 0x30], 0x39cc
jo 0x1401fdc5c
mov rdi, qword [rsp + 0x68]
and word [rsp + 0x98], 0x61ff

Function at 0x1401174b8
Capabilities:
Encode data using xor

Disassembly:
pushfq
add qword [rsp + 8], 0x6724c
push rdi
push 0x641a39c1
call fcn.1401b6e30

Function at 0x140137ec4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp r11b, 0xd8
call fcn.1401898ec

Function at 0x140137edf
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push qword [rsp + 0x50]
popfq
lea rsp, [rsp + 0x58]
call fcn.140266f61

Function at 0x140137eee
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xchg qword [rsp + 0x18], rdx
movsxd rdi, edi
setge dil
or di, 0x376b
or edi, edi
mov rdi, qword [rsp + 0x10]
mov qword [rsp + 0x10], rdx
push r11
movabs r11, 0x35a86fbc3bc41ad1
test r11d, r11d
jno 0x140179187
jle 0x14021f85a
push r11
add qword [rsp + 0x10], 0xffffffffffff2996
push r9
mov r9, r11
lea r11, [r11*2 + 0x22d36e8d]
mov rdx, r9
push r13
or r11b, r11b
neg byte [rsp + 0x10]
sub dl, r11b
mov rdx, qword [rsp + 0x20]
mov rdx, qword [rdx]
mov r13, r11
sub r13d, 0x7c3158cf
call fcn.14011f2c8
call fcn.1400e3869
pop rdx
invalid
Function at 0x140137f20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
push r9
neg word [rsp + 0x20]
call fcn.14020fe6d
int3
call fcn.14015017c
xchg ecx, eax
cmc
neg qword [rbx + 0x886ca93]
adc byte [rdx], cl
jae 0x140137eb7
or byte [rax], ch
xor edi, dword [rax + 0x74]
test dword [rdx], 0xf776fcd3
outsd dx, dword [rsi]
push rbx
ja 0x140137edb
or byte [rax - 0x19], ch
cmp dword [rdi - 0x1c5910f8], ebx
ja 0x140137f43
out 0x39, eax
lahf
or bh, ch
cmpsb byte [rsi], byte [rdi]
jrcxz 0x140137fc2
idiv dword [rbx - 0x893f8c8]
mov ebx, 0xf76c0738
cdq
adc dil, byte [r15 - 9]
invalid
add esp, esp
or eax, 0xf2521487
invalid

Function at 0x14013f631
Capabilities:
Encode data using xor

Disassembly:
mov bh, 0x69
or byte [rax], al
add qword [rsp + 0x50], 0xffffffffbfe01c61
mov rcx, rdi
and ecx, 0x42025577
mov rcx, qword [rsp + 0x20]
sub si, 0x3638
bswap edi
add qword [rsp + 0xb0], rdx
or byte [rsp + 0xb0], 0x70
mov r9, qword [rsp + 0xd0]
add qword [rsp + 0xd8], 0xffffffffbfde5123
add byte [rsp + 0xb0], 0xec
or edi, 0x28f1112c
test qword [rsp + 0xb0], 0x5cf375eb
mov rsi, qword [rsp + 0xc8]
call fcn.14014f9f5
xchg byte [rcx + rsi - 0x7ade986c], cl
mov ecx, dword [rdi - 0xd]
jb 0x14013f62d
mov al, 0xb3
in al, 2
stosb byte [rdi], al
xchg edx, eax
xchg edx, eax
test byte [rax], ch
movsb byte [rdi], byte [rsi]
xchg bh, ah
int1
invalid

Function at 0x140142b2f
Capabilities:
Encode data using xor

Disassembly:
pushfq
movabs r10, 0x50b66baf2e992449
not r10w

Function at 0x1401532f1
Capabilities:
Encode data using xor

Disassembly:
test rcx, 0xfb22a1a
rcr dword [rdx], 0x2a
mov dl, 0xf
mov r13b, 0xc0
mov r13, qword [rsp + 0x10]
call fcn.1400eebec
push rcx
push rdi
movabs rdi, 0x55bd03025bf74e7c
bswap rdi
pushfq
xor di, 0x78b6
push rcx
movabs rcx, 0x78ca023d4f106501
mov ecx, 0x5d7398e
add di, di
mov rcx, qword [rsp + 0x20]
not rdi
not di
and dil, dil
mov edi, 0x718d23b2
call fcn.1400dc5a5
mov ebx, 0x3d16bae4
jbe 0x1401532f3
sub dh, byte [rax + rcx - 0x7d]
retf 0x8ba7

Function at 0x140176c6a
Capabilities:
Encode data using xor

Disassembly:
xor byte [rcx - 0xa], al
ror dword [rdi], cl
xchg byte [rdx + 0x66000aa5], dl
test dword [rsp], 0x54f61d5c
and al, 0
call fcn.1400ad730
mov r15w, 0x4df8
mov r12, qword [rsp + 0x58]
clc
mov r12, qword [rsp + 0x58]
jae 0x140212ee7
jnp 0x140176c6d
outsd dx, dword [rsi]
mov edi, 0x390b9ff1
pop qword [rcx + 0x53]
cmp dl, byte [rax - 0xeac72c4]
jbe 0x140176c50
mov bh, 0xb4
sti
invalid
seto byte [rsp + 0x38]
neg r15d
add dword [rsp + 0x40], 0x30613bd0
not word [rsp + 0x50]
mov r9, qword [rsp + 0x28]
cmovne r15, qword [rsp + 0x50]
call fcn.1401bd5e2

Function at 0x140178893
Capabilities:
Encode data using xor

Disassembly:
mov rbx, qword [rsp + 0x18]
mov qword [rsp + 0x18], rcx
not ebx
call fcn.1400e5825
xchg edx, eax
movabs eax, dword [0x345c81ed30aa5cb0]
and al, 0x52
sbb dword [rcx + rbx*8 - 0x40], 0x45
movabs dword [0x5b51da370a95dcc], eax
movabs dword [0x6dc7a3590d10855c], eax
cwde
outsd dx, dword [rsi]
movabs dword [0x2187ea5ca934028a], eax
invalid
Function at 0x1401a80ae
Capabilities:
Link many functions at runtime

Disassembly:
mov r15, qword [rsp + 0x48]
mov qword [rsp + 0x68], 0x747d3789
sub dx, word [rsp + 0x6e]
movzx rdx, r12b
sets dl
cmp r9w, r12w
not r12
not edx
mov rdx, qword [rsp + 0x58]
jle 0x1401a8d8f

Function at 0x1401a8db0
Capabilities:
Link many functions at runtime

Disassembly:
call fcn.1400df6af
call fcn.1401c2150
push rsi
call fcn.1400662a7
mov r11, qword [rsp + 0x50]
sub dword [rsp + 0x90], 0x44285c08
call fcn.1401f4a78

Function at 0x1401bb8b4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jge fcn.140137f20
push qword [rsp + 0x30]
popfq
lea rsp, [rsp + 0x40]
call fcn.140266f61
ja 0x140150264
push qword [rsp]
popfq
lea rsp, [rsp + 8]
ret

Function at 0x1401bc23a
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rsp + 0x18]
mov rax, qword [rax]
jbe 0x1400dd1e2

Function at 0x1401d462d
Capabilities:
Link many functions at runtime

Disassembly:
cmp dword [rsp + 0x18], r15d
jo 0x1400f6800
call fcn.1401d45f6

Function at 0x1401d463d
Capabilities:
Link many functions at runtime

Disassembly:
or r13w, 0x5d68
mov rdx, qword [rsp + 0x60]
mov rdx, qword [rdx]
mov qword [rsp + 0x60], rsi
push r9
neg word [rsp + 0x68]
push r14
mov r9, qword [rsp + 0x70]
lea rdx, [rdx + rsi - 0x3e9e0570]
or rbx, 0x32196258
neg r13w
neg bl
xchg qword [rsp + 0x98], rdx
not qword [rsp + 0x28]
not r9d
mov rcx, qword [rsp + 0x28]
or dword [rsp + 0x70], 0x353448f9
add qword [rsp + 0x60], 0xffffffffbfe7d505
mov r12, qword [rsp + 0x88]
mov r14, qword [rsp + 0x70]
pop r14
sub ecx, 0x6098393e
jge fcn.140172622
and byte [rsp + 0x68], r9b
lea r13, [r9 + r9*2 + 0x5a2674a0]
setns byte [rsp + 0x20]
neg byte [rsp + 0x68]
or r9d, 0x1dd5f32
mov rcx, qword [rsp + 0x18]
and ebx, 0x5b1f1ce6
lea rbx, [r13 + r9*4 + 0x13475d22]
call fcn.1400e5842

Function at 0x1401d46e9
Capabilities:
Link many functions at runtime

Disassembly:
jo fcn.14014722a
test r12, rdi
movabs rbx, 0x668c0f4348267019
push r8
push rbp
mov rbx, qword [rsp + 0x20]
mov rbx, qword [rbx]
mov qword [rsp + 0x20], rdi
mov r8, qword [rsp + 0x20]
push r8
call fcn.140229e4d
call fcn.14016600c

Function at 0x1401e1d8e
Capabilities:
Link many functions at runtime

Disassembly:
call 0x1401950e9
push r13
movabs rdi, 0x19d05ef81c7a68f6
mov rbx, rdi
add qword [rsp + 0x10], 0xffffffffbfefa829
test cx, 0x30be
lea rbx, [rcx + r11*4 + 0x5c1d61]
mov rbx, qword [rsp + 0x70]
mov rbx, qword [rbx]
movsx edi, bpl
jns 0x1401635a9

Function at 0x140212883
Capabilities:
Link many functions at runtime

Disassembly:
js 0x1401a8dba
or byte [rsp + 0x58], 0xe4
call fcn.140109b0d

Function at 0x14021a8e5
Capabilities:
Link many functions at runtime

Disassembly:
not r10w
push r15
lea r10, [r10 + r10*8 + 0x5b2f2689]
mov r10, qword [rsp + 0x28]
mov qword [rsp + 0x28], rsi

Function at 0x140223cc8
Capabilities:
Encode data using xor

Disassembly:
cmp rbx, 0x7c1573c5
lea rbx, [rbx + rbx + 0xb704135]
xchg qword [rsp + rbx*4 - 0x2dc104b4], rdx
push rcx
js 0x1401c4531
Function at 0x140006e75
Capabilities:
Encrypt data using aes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rdx
mov r15, rcx
mov byte [rdx + 0xf0], 0xe
call fcn.140007020
mov ebp, eax
mov dword [rsi], eax
lea rcx, [r15 + 4]
call fcn.140007020
mov edi, eax
mov dword [rsi + 4], eax
lea rcx, [r15 + 8]
call fcn.140007020
mov ebx, eax
mov dword [rsi + 8], eax
lea rcx, [r15 + 0xc]
call fcn.140007020
mov r14d, eax
mov dword [rsi + 0xc], eax
lea rcx, [r15 + 0x10]
call fcn.140007020
mov dword [rsi + 0x10], eax
lea rcx, [r15 + 0x14]
call fcn.140007020
mov dword [rsi + 0x14], eax
lea rcx, [r15 + 0x18]
call fcn.140007020
mov dword [rsi + 0x18], eax
add r15, 0x1c
mov rcx, r15
call fcn.140007020
mov dword [rsi + 0x1c], eax
xor ecx, ecx
mov edx, 0xff
lea r8, [0x140024948]
lea r9, [0x140024d48]
lea r10, [0x140025148]
lea r11, [0x140025548]
mov r12d, eax
shr r12d, 0x10
and r12d, edx
movzx r12d, byte [r8 + r12*4 + 3]
shl r12d, 0x18
xor r12d, ebp
mov r13d, eax
shr r13d, 8
and r13d, edx
movzx ebp, byte [r9 + r13*4 + 2]
shl ebp, 0x10
mov r13d, eax
and r13d, edx
movzx r13d, byte [r10 + r13*4 + 1]
shl r13d, 8
xor r13d, ebp
xor r13d, r12d
mov r12d, eax
shr r12d, 0x18
movzx ebp, byte [r11 + r12*4]
xor ebp, r13d
lea r15, [0x140025948]
xor ebp, dword [rcx + r15]
mov dword [rsi + rcx*8 + 0x20], ebp
xor edi, ebp
mov dword [rsi + rcx*8 + 0x24], edi
xor ebx, edi
mov dword [rsi + rcx*8 + 0x28], ebx
xor r14d, ebx
mov dword [rsi + rcx*8 + 0x2c], r14d
cmp rcx, 0x18
je 0x14000700f
mov r12d, r14d
shr r12d, 0x18
movzx r12d, byte [r8 + r12*4 + 3]
shl r12d, 0x18
xor r12d, dword [rsi + rcx*8 + 0x10]
mov r13d, r14d
shr r13d, 0x10
and r13d, edx
movzx r13d, byte [r9 + r13*4 + 2]
shl r13d, 0x10
mov r15d, r14d
shr r15d, 8
and r15d, edx
movzx r15d, byte [r10 + r15*4 + 1]
shl r15d, 8
xor r15d, r13d
mov r13d, r14d
and r13d, edx
movzx r13d, byte [r11 + r13*4]
xor r13d, r15d
xor r13d, r12d
mov dword [rsi + rcx*8 + 0x30], r13d
xor r13d, dword [rsi + rcx*8 + 0x14]
mov dword [rsi + rcx*8 + 0x34], r13d
xor r13d, dword [rsi + rcx*8 + 0x18]
mov dword [rsi + rcx*8 + 0x38], r13d
xor eax, r13d
mov dword [rsi + rcx*8 + 0x3c], eax
add rcx, 4
jmp 0x140006f1c
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14000a9ec
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xa8
mov rsi, rcx
test r9, r9
je 0x14000aa2f
mov r15, r9
mov r14, r8
mov rbx, qword [rsp + 0x100]
mov ecx, edx
call qword [sym.imp.kernel32.dll_GetStdHandle]
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
jmp 0x14000aa4c
Function at 0x14000c433
Capabilities:
Query environment variable

Disassembly:
mov r8d, 0x11
jmp fcn.14000c0dc

Function at 0x14000c4ab
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
sub rsp, 0x38
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
movaps xmmword [rcx], xmm0
mov edx, 0x10
call qword [sym.imp.advapi32.dll_SystemFunction036]
test al, al
je 0x14000c4d8
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
add rsp, 0x38
ret
call fcn.14000a503
ud2

Function at 0x14000c711
Capabilities:
Generate random numbers via winapi

Disassembly:
sub rsp, 0x38
test rcx, rcx
je 0x14000c730
mov rax, qword [rcx]
and qword [rcx], 0
test rax, rax
je 0x14000c730
mov rax, qword [rcx + 8]
mov rdx, qword [rcx + 0x10]
jmp 0x14000c764
xorps xmm0, xmm0
lea rdx, [rsp + 0x20]
movaps xmmword [rdx], xmm0
xor ecx, ecx
mov r8d, 0x10
mov r9d, 2
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
js 0x14000c75f
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
jmp 0x14000c764
call fcn.14000c4ab
mov ecx, dword [0x140032b84]
mov r8, qword gs:[0x58]
mov rcx, qword [r8 + rcx*8]
mov qword [rcx + 0xa0], 1
mov qword [rcx + 0xa8], rax
mov qword [rcx + 0xb0], rdx
add rsp, 0x38
ret

Function at 0x14000d409
Capabilities:
Accept command line arguments

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rax, rdx
mov rsi, rcx
lea rdx, [rsp + 0x2c]
mov rcx, rax
call sub.shell32.dll_CommandLineToArgvW
test rax, rax
je 0x14000d4a2
mov rdi, rax
movsxd r12, dword [rsp + 0x2c]
lea rbx, [rsp + 0x30]
mov qword [rbx], 8
xorps xmm0, xmm0
movups xmmword [rbx + 8], xmm0
shl r12, 3
xor r13d, r13d
lea r14, [rsp + 0x48]
cmp r12, r13
je 0x14000d487
mov r15, qword [rdi + r13]
mov rcx, r15
call fcn.1400174b4
mov rcx, r14
mov rdx, r15
mov r8, rax
call fcn.14000ceaf
mov rcx, rbx
mov rdx, r14
call fcn.14000d691
add r13, 8
jmp 0x14000d457
mov rcx, rdi
call sub.kernel32.dll_LocalFree
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm0
mov rax, qword [rsp + 0x40]
mov qword [rsi + 0x10], rax
jmp 0x14000d4b0
mov qword [rsi], 8
xorps xmm0, xmm0
movups xmmword [rsi + 8], xmm0
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140012d56
Capabilities:
Reference wmi statements

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
and qword [rsp + 0x38], 0
mov rsi, rdx
mov rdi, rcx
cmp qword [rdx + 0x10], 0
je 0x140012e1a
lea rcx, [0x140027172]
call sub.oleaut32.dll_SysAllocString
mov rbx, rax
lea rcx, str.SELECT__FROM_MSAcpi_ThermalZoneTemperature
call sub.oleaut32.dll_SysAllocString
mov r14, rax
mov rcx, qword [rsi + 0x18]
mov rax, qword [rcx]
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x28], rdx
and qword [rsp + 0x20], 0
mov rdx, rbx
mov r8, r14
mov r9d, 0x30
call qword [rax + 0xa0]
mov ebp, eax
mov rcx, rbx
call sub.oleaut32.dll_SysFreeString
mov rcx, r14
call sub.oleaut32.dll_SysFreeString
test ebp, ebp
js 0x140012e1a
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rsi + 0x20]
mov rdx, qword [rsi + 0x28]
call section..text
mov qword [rsi + 0x20], 1
mov qword [rsi + 0x28], rbx
mov rax, qword [rsi + 0x30]
mov qword [rdi + 0x30], rax
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movups xmmword [rdi + 0x10], xmm1
movups xmmword [rdi], xmm0
mov rax, qword [rsi + 0x20]
mov qword [rdi + 0x20], rax
mov rax, qword [rsi + 0x28]
mov qword [rdi + 0x28], rax
jmp 0x140012e29
mov qword [rdi], 2
mov rcx, rsi
call fcn.1400118a0
nop
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x140013eec
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
test rax, rax
je 0x140013f36
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140013f36
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140013f36
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140013f36
cmp dword [rcx + 0x84], 0xe
jbe 0x140013f36
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140013f38
xor al, al
add rsp, 0x28
ret

Function at 0x1400182fc
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400180f8
Function at 0x14001b40c
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.kernel32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14001b43c
xor eax, eax
jmp 0x14001b4ff
mov rbp, rbx
cmp word [rax], si
je 0x14001b461
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x14001b448
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14001b444
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.14001b32c
movsxd r14, eax
test eax, eax
jne 0x14001b49f
mov rcx, rbx
call qword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
jmp 0x14001b435
mov rcx, r14
call fcn.140018cfc
mov rdi, rax
test rax, rax
jne 0x14001b4b8
xor ecx, ecx
call fcn.140018d5c
jmp 0x14001b494
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.14001b32c
test eax, eax
jne 0x14001b4e9
mov rcx, rdi
call fcn.140018d5c
jmp 0x14001b4f3
xor ecx, ecx
call fcn.140018d5c
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret