joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400066c0
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x14000f960], rbx
je 0x140006727
cmp rax, rbx
jne 0x14000671a
mov ebx, 1
mov esi, ebx
jmp 0x14000672c
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x1400066ff
mov ebx, 1
mov eax, dword [0x14000f968]
cmp eax, ebx
jne 0x140006744
mov edi, 0x1f
mov ecx, edi
call fcn.140157000
jmp 0x1400067b0
mov eax, dword [0x14000f968]
test eax, eax
jne 0x1400067a5
mov dword [0x14000f968], ebx
lea r15, [0x1400089b8]
lea rdi, [0x1400089a0]
mov qword [rsp + 0x30], rdi
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rdi, r15
jae 0x140006797
test eax, eax
jne 0x14000679b
cmp qword [rdi], r14
je 0x14000678c
mov rax, qword [rdi]
mov rcx, qword [0x140008920]
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x14000676e
test eax, eax
je 0x1400067ab
mov eax, 0xff
jmp 0x140006906
mov dword [0x14000d3e4], ebx
mov edi, 0x1f
mov eax, dword [0x14000f968]
cmp eax, ebx
jne 0x1400067d7
lea rdx, [0x140008998]
lea rcx, [0x140008928]
call sub.msvcrt.dll__initterm
mov dword [0x14000f968], 2
test esi, esi
jne 0x1400067e5
mov rax, r14
xchg qword [0x14000f960], rax
cmp qword [0x14000f970], r14
je 0x140006818
lea rcx, [0x14000f970]
call fcn.140006b30
test eax, eax
je 0x140006818
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x14000f970]
mov r9, qword [0x140008920]
call r9
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x140006831
mov eax, 0xff
jmp 0x140006906
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
movzx eax, word [rcx]
cmp ax, 0x20
ja 0x1400068b7
test ax, ax
je 0x14000684c
test edx, edx
jne 0x1400068b7
sub ax, bx
cmp ax, di
ja 0x140006862
add rcx, 2
mov qword [rsp + 0x28], rcx
movzx eax, word [rcx]
jmp 0x14000684c
test byte [rsp + 0x7c], bl
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.1400013dc
mov dword [0x14000d3e0], eax
cmp dword [0x14000d400], r14d
jne 0x1400068a0
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x14000d3e4], r14d
jne 0x1400068b5
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x14000d3e0]
jmp 0x140006906
cmp ax, 0x22
jne 0x1400068cb
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x14000683a
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call fcn.140006bc4
add rsp, 0x28
jmp 0x1400066c0
Function at 0x140001960
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140095050]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rcx
mov qword [rbp - 0x38], rcx
xor r14d, r14d
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], 7
mov word [rbp - 0x30], r14w
mov word [rsp + 0x20], r14w
mov r9d, 0x100
movzx r8d, byte [rbp - 0x40]
mov edx, r9d
lea rcx, [rbp - 0x30]
call fcn.140003960
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rdx, qword [rbp - 0x30]
mov ecx, dword [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
test eax, eax
jne 0x140001a68
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], r14
xor r8d, r8d
lea rdx, [0x1400640b0]
mov rcx, rbx
call fcn.140003890
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x140001a44
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001a3f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001b95
call fcn.14003a23c
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14003a1e0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
mov rcx, rsi
mov r8, qword [rbp - 0x20]
cmp rsi, r8
ja 0x140001a8d
lea rax, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rax, qword [rbp - 0x30]
mov qword [rbp - 0x20], rcx
mov word [rax + rsi*2], r14w
jmp 0x140001ae8
mov rdx, rcx
sub rdx, r8
mov rdi, qword [rbp - 0x18]
mov rax, rdi
sub rax, r8
cmp rdx, rax
ja 0x140001ad1
mov qword [rbp - 0x20], rcx
lea r9, [rbp - 0x30]
cmp rdi, 8
cmovae r9, qword [rbp - 0x30]
lea rdi, [r9 + r8*2]
test rdx, rdx
je 0x140001ac6
movzx eax, r14w
mov rcx, rdx
rep stosw word [rdi], ax
lea rax, [r8 + rdx]
mov word [r9 + rax*2], r14w
jmp 0x140001ae8
mov word [rsp + 0x20], r14w
mov r9, rdx
movzx r8d, byte [rbp - 0x40]
lea rcx, [rbp - 0x30]
call fcn.140003960
cmp esi, 0x100
jb 0x140001b1d
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rdx, qword [rbp - 0x30]
mov ecx, dword [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x140001b31
cmp eax, esi
jae 0x140001b31
xor r8d, r8d
mov edx, eax
lea rcx, [rbp - 0x30]
call fcn.140002da0
movups xmm0, xmmword [rbp - 0x30]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rbp - 0x20]
movups xmmword [rbx + 0x10], xmm1
jmp 0x140001a44
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], r14
xor r8d, r8d
lea rdx, [0x1400640b0]
mov rcx, rbx
call fcn.140003890
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x140001a44
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001a3f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001a3f
call fcn.140040b2c
int3
Function at 0x140005bb0
Capabilities:
Get token membership

Disassembly:
push rbx
sub rsp, 0x80
mov rax, qword [0x140095050]
xor rax, rsp
mov qword [rsp + 0x78], rax
xor ebx, ebx
mov dword [rsp + 0x70], 0
lea rax, [rsp + 0x68]
mov word [rsp + 0x74], 0x500
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x48], ebx
mov r9d, 0x220
mov dword [rsp + 0x40], ebx
lea r8d, [rbx + 0x20]
mov dword [rsp + 0x38], ebx
mov dl, 2
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x140005c4c
mov rdx, qword [rsp + 0x68]
lea r8, [rsp + 0x60]
xor ecx, ecx
mov dword [rsp + 0x60], ebx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov ecx, dword [rsp + 0x60]
test eax, eax
cmove ecx, ebx
mov dword [rsp + 0x60], ecx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [rsp + 0x60], 1
sete al
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14003a1e0
add rsp, 0x80
pop rbx
ret
Function at 0x140010d80
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rsi
push rdi
push r14
sub rsp, 0x88
mov rax, qword [0x140095050]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, r9
mov rax, r8
mov rdi, rdx
mov r14, rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqa xmmword [rsp + 0x40], xmm1
mov r8, qword [r8 + 8]
mov rdx, qword [rax]
lea rcx, [rsp + 0x30]
call fcn.140003890
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqa xmmword [rsp + 0x60], xmm1
mov r8, qword [rbx + 8]
mov rdx, qword [rbx]
lea rcx, [rsp + 0x50]
call fcn.140003890
nop
movaps xmm1, xmmword [rdi]
movabs rcx, 0xcbf29ce484222325
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rax, xmm0
movq r8, xmm1
lea r9, [r8 + rax*2]
cmp r8, r9
je 0x140010e48
lea r10, [0x14006be00]
movabs r11, 0x100000001b3
nop dword [rax + rax]
movsx rax, byte [r8]
movsx rdx, byte [rax + r10]
xor rcx, rdx
imul rcx, r11
inc r8
cmp r8, r9
jne 0x140010e30
movabs rax, 0xde5fb9d2630458e9
mul rcx
lea r9, [rax + rdx]
mov r8, rdi
lea rdx, [rsp + 0x20]
lea rcx, [r14 + 8]
call fcn.140021710
mov rdx, qword [r14 + 0x10]
mov rax, qword [rsp + 0x20]
cmp byte [rsp + 0x28], 0
je 0x140010e94
lea rcx, [rax + rax*2]
shl rcx, 5
add rcx, rdx
lea r8, [rsp + 0x30]
mov rdx, rdi
call fcn.140023d40
jmp 0x140010ebc
lea rbx, [rax + rax*2]
shl rbx, 5
add rbx, rdx
lea rdx, [rsp + 0x30]
lea rcx, [rbx + 0x20]
call fcn.140002f90
lea rcx, [rbx + 0x40]
lea rdx, [rsp + 0x50]
call fcn.140002f90
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x140010efa
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010ef5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010f58
call fcn.14003a23c
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x140010f38
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010f33
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010f58
call fcn.14003a23c
mov byte [r14], 1
mov al, 1
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14003a1e0
add rsp, 0x88
pop r14
pop rdi
pop rsi
pop rbx
ret
call fcn.140040b2c
int3
Function at 0x140023700
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
cmp qword [r8 + 0x18], 8
mov rbx, rdx
mov rdi, qword [rcx]
mov rax, r8
jb 0x14002371d
mov rax, qword [r8]
mov rcx, qword [r8 + 0x10]
movabs r9, 0xcbf29ce484222325
lea r10, [rax + rcx*2]
cmp rax, r10
je 0x14002376d
mov qword [rsp + 0x40], rsi
lea r11, [0x14006be00]
movabs rsi, 0x100000001b3
nop word [rax + rax]
movsx rcx, byte [rax]
inc rax
movsx rdx, byte [rcx + r11]
xor r9, rdx
imul r9, rsi
cmp rax, r10
jne 0x140023750
mov rsi, qword [rsp + 0x40]
movabs rax, 0xde5fb9d2630458e9
mov rcx, rdi
mul r9
lea r9, [rax + rdx]
lea rdx, [rsp + 0x20]
call fcn.140023b80
movzx r10d, byte [rsp + 0x28]
mov r9, qword [rsp + 0x20]
test r10b, r10b
je 0x14002384d
mov rax, qword [rsp + 0x68]
lea r8, [r9 + r9*2]
xorps xmm0, xmm0
shl r8, 5
add r8, qword [rdi + 8]
mov rdx, qword [rax]
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax]
xor eax, eax
movups xmmword [r8], xmm0
mov qword [r8 + 0x10], rax
mov qword [r8 + 0x18], rax
movups xmm0, xmmword [rcx]
movups xmmword [r8], xmm0
movups xmm1, xmmword [rcx + 0x10]
xorps xmm0, xmm0
movups xmmword [r8 + 0x10], xmm1
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], 7
mov word [rcx], ax
movups xmmword [r8 + 0x20], xmm0
mov qword [r8 + 0x30], rax
mov qword [r8 + 0x38], rax
movups xmm0, xmmword [rdx]
movups xmmword [r8 + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x10]
xorps xmm0, xmm0
movups xmmword [r8 + 0x30], xmm1
mov qword [rdx + 0x10], rax
mov qword [rdx + 0x18], 7
mov word [rdx], ax
movups xmmword [r8 + 0x40], xmm0
mov qword [r8 + 0x50], rax
mov qword [r8 + 0x58], rax
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [r8 + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [r8 + 0x50], xmm1
mov qword [rdx + 0x30], rax
mov qword [rdx + 0x38], 7
mov word [rdx + 0x20], ax
mov rcx, qword [rdi]
lea rdx, [r9 + r9*2]
shl rdx, 5
mov rax, rbx
add rdx, qword [rdi + 8]
add rcx, r9
mov qword [rbx], rcx
mov qword [rbx + 8], rdx
mov byte [rbx + 0x10], r10b
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140026a10
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
mov rbx, rcx
xor ebp, ebp
mov dword [rsp + 0x30], ebp
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], rbp
mov qword [rcx + 0x18], 7
mov word [rcx], bp
mov dword [rsp + 0x30], 1
movaps xmm0, xmmword [rdx]
movdqa xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x20], bp
mov r9d, 0x100
movzx r8d, byte [rsp + 0x60]
mov edx, r9d
call fcn.140003960
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x140026a79
mov rdx, qword [rbx]
mov r8d, 0x100
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
test eax, eax
jne 0x140026abd
mov rax, rbx
cmp qword [rbx + 0x18], 8
jb 0x140026a9d
mov rax, qword [rbx]
mov qword [rbx + 0x10], rbp
mov word [rax], bp
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rax, rbx
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
mov rdx, rdi
xor r8d, r8d
mov rcx, rbx
call fcn.140002da0
cmp edi, 0x100
jb 0x140026aff
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x140026ae0
mov rdx, qword [rbx]
mov r8d, edi
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp eax, edi
jae 0x140026aff
xor r8d, r8d
mov edx, eax
mov rcx, rbx
call fcn.140002da0
mov rax, rbx
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret

Function at 0x140028010
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
mov rbx, rcx
xor ebp, ebp
mov dword [rsp + 0x30], ebp
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], rbp
mov qword [rcx + 0x18], 7
mov word [rcx], bp
mov dword [rsp + 0x30], 1
movaps xmm0, xmmword [rdx]
movdqa xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x20], bp
mov r9d, 0x1000
movzx r8d, byte [rsp + 0x60]
mov edx, r9d
call fcn.140003960
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x140028079
mov rdx, qword [rbx]
mov r8d, 0x1000
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
test eax, eax
jne 0x1400280bd
mov rax, rbx
cmp qword [rbx + 0x18], 8
jb 0x14002809d
mov rax, qword [rbx]
mov qword [rbx + 0x10], rbp
mov word [rax], bp
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rax, rbx
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
mov rdx, rdi
xor r8d, r8d
mov rcx, rbx
call fcn.140002da0
cmp edi, 0x1000
jb 0x1400280ff
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x1400280e0
mov rdx, qword [rbx]
mov r8d, edi
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp eax, edi
jae 0x1400280ff
xor r8d, r8d
mov edx, eax
mov rcx, rbx
call fcn.140002da0
mov rax, rbx
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x1400284e0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x140095050]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rbx, qword [rdx + 8]
mov rbp, r8
mov rdi, qword [rdx]
mov rsi, rcx
test rbx, rbx
je 0x140028556
xor r14d, r14d
mov r15d, 0xffffffff
nop dword [rax]
mov r8d, r15d
mov dword [rsp + 0x30], r14d
cmp rbx, r15
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x30]
mov rdx, rdi
cmovb r8d, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
jne 0x14002857c
mov eax, dword [rsp + 0x30]
add rdi, rax
sub rbx, rax
jne 0x140028520
mov al, 1
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14003a1e0
mov rbx, qword [rsp + 0xc8]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov qword [rsp + 0x48], 0xb
lea rax, str.WriteFile:
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x40]
movaps xmm0, xmmword [rsp + 0x40]
lea rcx, [rsp + 0x50]
movdqa xmmword [rsp + 0x40], xmm0
call fcn.140001350
mov rdx, rax
mov rcx, rbp
mov rbx, rax
call fcn.140002f90
mov rdx, qword [rsp + 0x68]
mov eax, dword [rbx + 0x20]
mov dword [rbp + 0x20], eax
cmp rdx, 8
jb 0x1400285fd
mov rcx, qword [rsp + 0x50]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400285f8
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140028604
call fcn.14003a23c
xor al, al
jmp 0x140028558
call fcn.140040b2c
int3
Function at 0x140028610
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x140095050]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rsi, r8
mov rbp, rcx
mov rbx, qword [rdx]
mov r9, qword [rdx + 8]
test r9, r9
je 0x1400286a7
mov eax, r9d
mov rdi, r9
xor r14d, r14d
mov r15d, 0xffffffff
nop dword [rax]
nop word [rax + rax]
mov dword [rsp + 0x30], r14d
mov r8d, r15d
cmp r9, r15
cmovb r8d, eax
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x30]
mov rdx, rbx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, 1
jne 0x140028768
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x1400286cd
add rbx, rax
mov r9, rdi
sub r9, rax
mov eax, r9d
mov rdi, r9
jne 0x140028660
mov al, 1
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14003a1e0
mov rbx, qword [rsp + 0xc8]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [0x14008c410]
movdqu xmmword [rsp + 0x60], xmm1
mov word [rsp + 0x50], r14w
mov dword [rsp + 0x70], r14d
mov r8d, 0x1b
lea rdx, str.Reached_the_end_of_the_file
lea rcx, [rsp + 0x50]
call fcn.14000aa50
mov dword [rsp + 0x70], 0x26
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.140002f90
mov eax, dword [rsp + 0x70]
mov dword [rsi + 0x20], eax
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x1400287e9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400287e4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400287f6
jmp 0x1400287e4
lea rax, str.ReadFile:
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 0xa
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.140001350
mov rbx, rax
mov rdx, rax
mov rcx, rsi
call fcn.140002f90
mov eax, dword [rbx + 0x20]
mov dword [rsi + 0x20], eax
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x1400287e9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400287e4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400287f0
call fcn.14003a23c
xor al, al
jmp 0x1400286a9
call fcn.140040b2c
int3
call fcn.140040b2c
int3
Function at 0x14002e8c0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x80
mov rax, qword [0x140095050]
xor rax, rsp
mov qword [rsp + 0x70], rax
movaps xmm0, xmmword [rdx]
mov rbx, rcx
lea rdx, [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x50]
call fcn.140015230
mov r8d, dword [rsp + 0x60]
lea rdx, [rsp + 0x50]
xor eax, eax
lea r9, [rsp + 0x30]
cmp qword [rsp + 0x68], 0x10
mov rcx, rbx
mov dword [rsp + 0x30], eax
cmovae rdx, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, 0xffffffffffffffff
cmp eax, 1
jne 0x14002e932
mov ebx, dword [rsp + 0x30]
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x14002e96b
mov rcx, qword [rsp + 0x50]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002e966
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002e984
call fcn.14003a23c
mov rax, rbx
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14003a1e0
add rsp, 0x80
pop rbx
ret
call fcn.140040b2c
int3
Function at 0x14002fef0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov eax, dword [rsp + 0x60]
mov rbx, rcx
test eax, eax
movq rcx, xmm3
mov r10, rcx
mov r14d, 0xd
mov r11d, r14d
movabs r15, 0xfffffffffffff
cmovns r11d, eax
mov rbp, r8
and r10, r15
shr rcx, 0x34
mov r9, rdx
test ecx, ecx
jne 0x14002ff51
mov rax, r10
neg rax
sbb esi, esi
and esi, 0xfffffc02
jmp 0x14002ff57
lea esi, [rcx - 0x3ff]
movabs rdx, 0x10000000000000
mov rax, r10
or rax, rdx
test ecx, ecx
cmovne r10, rax
mov eax, esi
cdq
mov r8d, eax
xor r8d, edx
sub r8d, edx
cmp r8d, 0xa
jae 0x14002ff86
mov edx, 4
jmp 0x14002ffa1
cmp r8d, 0x64
jae 0x14002ff93
mov edx, 5
jmp 0x14002ffa1
cmp r8d, 0x3e8
sbb rdx, rdx
add rdx, 7
mov rcx, rbp
movsxd rdi, r11d
sub rcx, r9
sar rcx, 1
cmp rcx, rdi
jge 0x14002ffc1
mov qword [rbx], rbp
mov dword [rbx + 8], 0x84
jmp 0x1400300d6
xor eax, eax
test r11d, r11d
setg al
sub rcx, rdi
add rax, rdx
cmp rcx, rax
jl 0x14002ffb2
cmp r11d, r14d
jge 0x140030000
lea rdi, [r10 + r10]
sub r14d, r11d
shl r14d, 2
lea rax, [rdi - 1]
or rax, r10
movzx ecx, r14b
mov edx, 1
shl rdx, cl
and rdx, rax
and rdx, rdi
add r10, rdx
mov rax, r10
and r10, r15
shr rax, 0x34
add al, 0x30
movsx eax, al
mov word [r9], ax
add r9, 2
test r11d, r11d
jle 0x1400300a6
mov eax, 0x2e
lea r14, str.0123456789abcdefghijklmnopqrstuvwxyz
mov word [r9], ax
lea edi, [r11 - 1]
mov rax, r10
mov r15d, 0x30
shr rax, 0x30
mov ecx, r15d
movzx eax, word [r14 + rax*2]
mov word [r9 + 2], ax
add r9, 4
test edi, edi
je 0x1400300a6
movabs rdx, 0x1000000000000
test ecx, ecx
je 0x14003008e
lea rax, [rdx - 1]
sub ecx, 4
and r10, rax
ror rdx, 4
mov rax, r10
shr rax, cl
mov eax, eax
movzx eax, word [r14 + rax*2]
mov word [r9], ax
add r9, 2
sub edi, 1
jne 0x140030060
jmp 0x1400300a6
movsxd rdx, edi
test edi, edi
je 0x1400300a2
movzx eax, r15w
mov rdi, r9
mov rcx, rdx
rep stosw word [rdi], ax
lea r9, [r9 + rdx*2]
mov eax, 0x70
lea rdx, [r9 + 4]
mov word [r9], ax
test esi, esi
mov eax, 0x2d
mov ecx, 0x2b
cmovns ax, cx
mov rcx, rbx
mov word [r9 + 2], ax
mov r9d, r8d
mov r8, rbp
call fcn.140003cd0
mov rbp, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x140037890
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x50]
sub rsp, 0x150
mov rax, qword [0x140095050]
xor rax, rsp
mov qword [rbp + 0x48], rax
mov r14, rdx
mov rdi, rcx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x6c], xmm0
movups xmmword [rbp - 0x5c], xmm0
movups xmmword [rbp - 0x4c], xmm0
movups xmmword [rbp - 0x3c], xmm0
movups xmmword [rbp - 0x2c], xmm0
movups xmmword [rbp - 0x1c], xmm0
mov dword [rbp - 0xc], eax
mov dword [rbp - 0x70], 0x68
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], rax
movups xmmword [rbp], xmm0
movdqa xmm1, xmmword [0x14008c410]
movdqu xmmword [rbp + 0x10], xmm1
xor r15d, r15d
mov word [rbp], r15w
mov rsi, qword [rcx + 0x68]
mov rbx, qword [rcx + 0x60]
cmp rbx, rsi
je 0x140037953
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x14003791f
mov rcx, qword [rbx]
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rax
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x60], xmm0
lea r8, [rbp]
lea rdx, [rsp + 0x60]
lea rcx, [rbp]
call fcn.140003100
add rbx, 0x20
cmp rbx, rsi
jne 0x140037912
mov edx, 0x400
movzx eax, byte [rdi + 0x7d]
cmp al, 1
jne 0x140037967
mov edx, 0x410
jmp 0x140037979
cmp al, 2
jne 0x140037979
mov edx, 0x8000400
or dword [rbp - 0x34], 1
mov word [rbp - 0x30], r15w
lea rax, [rdi + 0x20]
cmp qword [rax + 0x10], 0
jne 0x140037989
mov rax, r15
jmp 0x140037993
cmp qword [rax + 0x18], 8
jb 0x140037993
mov rax, qword [rax]
lea rcx, [rdi + 0x40]
cmp qword [rcx + 0x10], 0
jne 0x1400379a3
mov rcx, r15
jmp 0x1400379ad
cmp qword [rcx + 0x18], 8
jb 0x1400379ad
mov rcx, qword [rcx]
lea r11, [rbp]
cmp qword [rbp + 0x18], 8
cmovae r11, qword [rbp]
cmp qword [rdi + 0x10], 0
jne 0x1400379c7
mov r10, r15
jmp 0x1400379d4
mov r10, rdi
cmp qword [rdi + 0x18], 8
jb 0x1400379d4
mov r10, qword [rdi]
lea r8, [rsp + 0x70]
mov qword [rsp + 0x48], r8
lea r8, [rbp - 0x70]
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
mov rdx, r11
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, 1
je 0x140037a61
lea rax, [0x140059ac8]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0xe
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x60], xmm0
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x20]
call fcn.140001350
mov rbx, rax
mov rdx, rax
mov rcx, r14
call fcn.140002f90
mov eax, dword [rbx + 0x20]
mov dword [r14 + 0x20], eax
lea rcx, [rbp + 0x20]
call fcn.1400012e0
xor bl, bl
jmp 0x140037a7f
mov eax, dword [rbp - 0x80]
mov dword [rdi + 0x78], eax
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
lea rcx, [rbp]
call fcn.1400012e0
movzx eax, bl
mov rcx, qword [rbp + 0x48]
xor rcx, rsp
call fcn.14003a1e0
mov rbx, qword [rsp + 0x190]
add rsp, 0x150
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret