joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14011b520
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x80
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
mov edx, dword [rsp + 0xe0]
mov rax, qword [0x140181040]
xor rax, rsp
mov qword [rsp + 0x78], rax
movsxd r8, dword [rcx + 0x108]
lea ecx, [rdx + 4]
mov r11d, ecx
shr r11d, 6
xor eax, eax
mov r10d, 0
cmp r11, r8
jae 0x14011b57e
mov r10, qword [r9 + r11*8]
shr r10, cl
shl r10d, 5
and r10d, 0x20
lea ecx, [rdx + 3]
mov r11d, ecx
shr r11d, 6
cmp r11, r8
jae 0x14011b59a
mov rax, qword [r9 + r11*8]
shr rax, cl
shl eax, 4
and eax, 0x10
or eax, r10d
lea ecx, [rdx + 2]
mov r14d, ecx
shr r14d, 6
xor r10d, r10d
mov r11d, 0
cmp r14, r8
jae 0x14011b5c4
mov r11, qword [r9 + r14*8]
shr r11, cl
shl r11d, 3
and r11d, 8
or eax, r11d
lea ecx, [rdx + 1]
mov r11d, ecx
shr r11d, 6
cmp r11, r8
jae 0x14011b5e5
mov r10, qword [r9 + r11*8]
shr r10, cl
shl r10d, 2
and r10d, 4
or eax, r10d
mov r11d, edx
shr r11d, 6
xor r10d, r10d
cmp r11, r8
jae 0x14011b607
mov ecx, edx
mov r10, qword [r9 + r11*8]
shr r10, cl
add r10d, r10d
and r10d, 2
or eax, r10d
test edx, edx
je 0x14011b62d
dec edx
mov r10d, edx
shr r10d, 6
xor ecx, ecx
cmp r10, r8
jae 0x14011b62b
mov r8, qword [r9 + r10*8]
xor ecx, ecx
bt r8, rdx
setb cl
or eax, ecx
mov r14d, eax
shr r14d, 5
mov ecx, r14d
dec ecx
neg r14
and ecx, eax
xor eax, 0x3f
mov r15d, r14d
and r15d, eax
or r15d, ecx
mov eax, r15d
shr eax, 1
sub r15, rax
xor r12d, r12d
mov r8d, 0xd8
mov rcx, rsi
xor edx, edx
call fcn.1400c5230
mov r13, r15
not r13
mov r8, r12
xor r8, r15
dec r8
and r8, r13
sar r8, 0x3f
mov qword [rsp + 0x20], rsi
mov rcx, rdi
mov rdx, rsi
mov r9, rbx
call fcn.140118690
inc r12
add rbx, 0xd8
cmp r12, 0x11
jne 0x14011b66b
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x70], rax
movaps xmm0, xmmword [0x140152e90]
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
add rsi, 0x48
movsxd rcx, dword [rdi + 0x148]
test rcx, rcx
jle 0x14011b738
xor eax, eax
xor edx, edx
or rdx, qword [rsi + rax*8]
inc rax
cmp rcx, rax
jne 0x14011b6dc
test rdx, rdx
sete dl
test ecx, ecx
je 0x14011b788
mov rax, qword [rdi + 0x140]
xor r8d, r8d
lea r9, [rsp + 0x30]
sub r10, r10
jmp 0x14011b710
mov r10, qword [rax + r8*8]
sbb r10, qword [rsi + r8*8]
mov qword [r9 + r8*8], r10
lea r8, [r8 + 1]
dec rcx
jne 0x14011b710
sbb r10, r10
movsxd rax, dword [rdi + 0x148]
test rax, rax
jle 0x14011b757
xor ecx, ecx
jmp 0x14011b74c
mov dl, 1
jmp 0x14011b6ee
xor r8d, r8d
mov qword [rsp + rcx*8 + 0x30], r8
inc rcx
cmp rax, rcx
je 0x14011b757
test dl, dl
jne 0x14011b73c
mov r8, qword [rsp + rcx*8 + 0x30]
jmp 0x14011b73f
test eax, eax
je 0x14011b788
and r14d, 1
neg r14
mov rcx, r14
not rcx
xor edx, edx
mov r8, qword [rsp + rdx*8 + 0x30]
and r8, r14
mov r9, qword [rsi + rdx*8]
and r9, rcx
or r9, r8
mov qword [rsi + rdx*8], r9
inc rdx
cmp rax, rdx
jne 0x14011b76a
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140092da0
nop
add rsp, 0x80
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14011c760
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov rsi, rcx
mov rax, qword [0x140181040]
xor rax, rsp
mov qword [rsp + 0x50], rax
movaps xmm0, xmmword [0x140152e90]
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
test r9, r9
je 0x14011c7c8
xor edi, edi
cmp r9, 0x30
ja 0x14011c7ea
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
movups xmm2, xmmword [rdx + 0x20]
lea rdx, [rsp + 0x20]
movaps xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movaps xmmword [rdx], xmm0
xor eax, eax
mov cl, byte [r8 + rax]
xor byte [rsp + rax + 0x20], cl
inc rax
cmp r9, rax
jne 0x14011c7b8
mov r8d, 0x30
mov rcx, rsi
call fcn.140073760
test eax, eax
je 0x14011c800
mov qword [rsi + 0x118], 1
mov edi, 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140092da0
mov eax, edi
add rsp, 0x58
pop rdi
pop rsi
ret
xor edi, edi
jmp 0x14011c7ea

Function at 0x140121e20
Capabilities:
Inspect section memory permissions

Disassembly:
mov r9d, r8d
xor r8d, r8d
jmp 0x140121e30
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x40
mov ebx, r8d
mov rsi, rdx
mov r14, rcx
cmp byte [rdx + 0x17], 0
jns 0x140121e51
mov rsi, qword [rsi]
mov edi, r9d
and edi, 0xfffffff
test r9b, 4
je 0x140121e75
cmp byte [r14 + 0x50], 1
jne 0x140121e6f
or edi, 0x80000000
jmp 0x140121e75
or edi, 0x20000000
test dil, 8
je 0x140121e90
cmp byte [r14 + 0x68], 1
je 0x140121e8a
or edi, 0x10000000
jmp 0x140121e90
or edi, 0x40000000
xor r15d, r15d
cmp byte [r14 + 0x60], 0
mov r12d, 0
je 0x140121ea4
mov r12, qword [r14 + 0x58]
cmp byte [r14 + 0x48], 0
mov r13d, 0
je 0x140121eb5
mov r13, qword [r14 + 0x40]
cmp byte [r14 + 0x38], 1
jne 0x140121ec8
lea rcx, [r14 + 0x20]
call fcn.140060660
mov r15, rax
cmp byte [r14 + 0x18], 1
je 0x140121eed
xor r9d, r9d
jmp 0x140121ef8
xor edx, edx
jmp 0x140121f14
mov edx, 4
jmp 0x140121f14
mov edx, 1
jmp 0x140121f14
mov edx, 6
jmp 0x140121f14
mov rcx, r14
call fcn.140060660
mov r9, rax
cmp ebx, 4
ja case.default.0x140121f0d
mov eax, ebx
lea rcx, [0x14016b8ec]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
mov edx, 7
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r15
mov rcx, rsi
mov r8d, edi
call qword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
mov esi, eax
test eax, eax
je 0x140121f3d
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
sete al
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14012ff4f
Capabilities:
Read file via mapping

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
cmp dword [r8], 0
jle 0x14012ff8e
xor eax, eax
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
cmp ecx, 0x8007000e
jne 0x14012ff5e
mov dword [rsi], 7
jmp 0x14012ff5e
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
call fcn.14007d605
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10000080
mov dword [rsp + 0x20], 3
mov rcx, rbx
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
je 0x14012ff6a
mov r14, rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rax
xor edx, edx
mov r8d, 2
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rbx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x14012ff6a
mov qword [rsp + 0x20], 0
mov rcx, rbx
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rdi + 8], rax
test rax, rax
je 0x140130040
mov qword [rdi + 0x28], rbx
mov al, 1
jmp 0x14012ff60
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14012ff5e
Function at 0x1400022d0
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
cmp qword [rcx], rdx
je 0x140002327
mov rdi, rdx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rsi
call fcn.14000236c
lea rax, [rdi + 1]
cmp rax, 2
jb 0x140002317
mov qword [rsi], rdi
call fcn.140038540
mov r8, qword [rsp + 0x38]
mov rcx, rdi
mov rdx, rsi
mov r9, rax
call fcn.140052570
mov ecx, ebx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_SetLastError]
nop
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x14000483c
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x88
movdqa xmmword [rsp + 0x70], xmm13
movdqa xmmword [rsp + 0x60], xmm12
movdqa xmmword [rsp + 0x50], xmm11
movdqa xmmword [rsp + 0x40], xmm10
movdqa xmmword [rsp + 0x30], xmm9
movdqa xmmword [rsp + 0x20], xmm8
movdqa xmmword [rsp + 0x10], xmm7
movdqa xmmword [rsp], xmm6
movdqu xmm4, xmmword [rcx]
movdqu xmm3, xmmword [rcx + 0x10]
movdqu xmm2, xmmword [rcx + 0x20]
movdqu xmm1, xmmword [rcx + 0x30]
movd xmm0, r8d
pxor xmm0, xmm4
lea r8, [rdx - 0x40]
mov r9d, 0x40
lea r11, [rcx + r9]
cmp r8, r9
jb 0x14000498a
add rdx, 0xffffffffffffff80
mov r9, rdx
and r9, 0xffffffffffffffc0
lea r10, [r9 + 0x80]
movabs rax, 0x154442bd4
movq xmm9, rax
movdqa xmm8, xmmword [0x1401975d0]
movdqa xmm6, xmm0
pclmulqdq xmm6, xmm9, 0
movdqa xmm12, xmm3
pclmulqdq xmm12, xmm9, 0
movdqa xmm11, xmm2
pclmulqdq xmm11, xmm9, 0
movdqa xmm10, xmm1
pclmulqdq xmm10, xmm9, 0
movdqa xmm4, xmm0
pclmulqdq xmm4, xmm8, 0x11
movdqa xmm5, xmm3
pclmulqdq xmm5, xmm8, 0x11
movdqa xmm7, xmm2
pclmulqdq xmm7, xmm8, 0x11
movdqa xmm13, xmm1
pclmulqdq xmm13, xmm8, 0x11
movdqu xmm0, xmmword [r11]
pxor xmm0, xmm6
pxor xmm0, xmm4
movdqu xmm3, xmmword [r11 + 0x10]
pxor xmm3, xmm12
pxor xmm3, xmm5
movdqu xmm2, xmmword [r11 + 0x20]
pxor xmm2, xmm11
pxor xmm2, xmm7
movdqu xmm1, xmmword [r11 + 0x30]
pxor xmm1, xmm10
pxor xmm1, xmm13
add r8, 0xffffffffffffffc0
add r11, 0x40
cmp r8, 0x3f
ja 0x1400048d5
sub rdx, r9
add rcx, r10
mov r8, rdx
mov r11, rcx
movabs rax, 0x1751997d0
movq xmm4, rax
movdqa xmm5, xmm0
pclmulqdq xmm5, xmm4, 0
pxor xmm5, xmm3
movdqa xmm3, xmmword [0x1401975e0]
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm5
movdqa xmm5, xmm0
pclmulqdq xmm5, xmm4, 0
pxor xmm5, xmm2
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm5
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm2
cmp r8, 0x10
jb 0x140004a1a
movdqu xmm1, xmmword [r11]
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm1
pxor xmm0, xmm2
add r11, 0x10
add r8, 0xfffffffffffffff0
cmp r8, 0xf
ja 0x1400049ef
movdqa xmm1, xmmword [0x1401975e0]
pclmulqdq xmm1, xmm0, 1
psrldq xmm0, 8
pxor xmm0, xmm1
pmovzxdq xmm1, xmm0
psrldq xmm0, 4
movabs rax, 0x163cd6124
movq xmm2, rax
pclmulqdq xmm2, xmm1, 0
pxor xmm2, xmm0
pmovzxdq xmm0, xmm2
pclmulqdq xmm0, xmmword [0x1401975f0], 0x10
pmovzxdq xmm0, xmm0
movabs rax, 0x1db710641
movq xmm1, rax
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
pextrd eax, xmm1, 1
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
movaps xmm11, xmmword [rsp + 0x50]
movaps xmm12, xmmword [rsp + 0x60]
movaps xmm13, xmmword [rsp + 0x70]
add rsp, 0x88
ret
Function at 0x14000a0ce
Capabilities:
Move file

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
lea rdi, [rcx + 0x28]
mov rcx, rdi
mov dl, 1
call fcn.14004e960
test al, al
jne 0x14000a0f1
mov rcx, rdi
call 0x14004ed80
add rsi, 0x40
mov rcx, rsi
xor edx, edx
call fcn.14004e960
test al, al
je 0x14000a10a
add rsp, 0x28
pop rdi
pop rsi
ret
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp 0x14004ed80
push rsi
push rdi
sub rsp, 0x68
mov rsi, rcx
mov rax, qword [0x1401ee6a8]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea rdx, str.DeleteFileAfterReboot
lea r8, str..._.._base_files_file_util_win.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r9d, 0x187
call fcn.140038520
lea rcx, [rsp + 0x48]
mov rdx, rdi
xor r8d, r8d
call fcn.140045190
cmp byte [rsi + 0x17], 0
jns 0x14004ede0
cmp qword [rsi + 8], 0x103
jbe 0x14004eddd
xor esi, esi
jmp 0x14004edf7
mov rsi, qword [rsi]
mov rcx, rsi
xor edx, edx
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
setne sil
lea rcx, [rsp + 0x48]
call fcn.1400452c0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140163e00
mov eax, esi
add rsp, 0x68
pop rdi
pop rsi
ret
Function at 0x140016ed0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor edx, edx
jmp 0x140016fe8
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov ebx, edx
mov rsi, rcx
mov rax, qword [0x1401ee6a8]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp byte [rcx + 0x5e], 0
je 0x14001702d
movzx edi, word [rsi + 0x5c]
test bl, bl
je 0x140017132
mov word [rsi + 0x5c], 0xffff
mov byte [rsi + 0x5e], 0
jmp 0x140017132
mov eax, dword [rsi + 0x58]
test eax, eax
mov edi, 1
cmovg edi, eax
xor ebp, ebp
mov rcx, qword [rsi + 0x40]
call fcn.14017f8d8
cmp eax, 0xffffffff
je 0x14001712e
mov byte [rsp + rbp + 0x58], al
inc rbp
cmp rbp, rdi
jb 0x14001703c
cmp byte [rsi + 0x5f], 0
je 0x140017080
movsx eax, byte [rsp + 0x58]
mov word [rsp + 0x56], ax
test bl, bl
je 0x1400170f2
movzx edi, word [rsp + 0x56]
mov word [rsi + 0x5c], di
jmp 0x140017132
lea r13, [rsp + 0x56]
lea r12, [rsp + 0x48]
lea r14, [rsp + 0x58]
mov rcx, qword [rsi + 0x48]
mov rdx, qword [rsi + 0x50]
mov r15, qword [rdx]
lea r9, [rsp + rdi]
add r9, 0x58
mov rax, qword [rcx]
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r12
mov r8, r14
call qword [rax + 0x18]
cmp eax, 1
jne 0x14001711b
mov rax, qword [rsi + 0x50]
mov qword [rax], r15
cmp rdi, 8
je 0x14001712e
mov rcx, qword [rsi + 0x40]
call fcn.14017f8d8
cmp eax, 0xffffffff
je 0x14001712e
mov byte [rsp + rdi + 0x58], al
inc rdi
jmp 0x14001708f
mov edi, edi
test rdi, rdi
jle 0x140017114
mov rdx, qword [rsi + 0x40]
movsx eax, byte [rsp + rdi + 0x57]
dec rdi
movzx ecx, ax
call fcn.1401850d4
cmp eax, 0xffffffff
jne 0x1400170f4
jmp 0x14001712e
movzx edi, word [rsp + 0x56]
jmp 0x140017132
cmp eax, 2
je 0x14001712e
cmp eax, 3
je 0x140017060
jmp 0x14001706a
mov di, 0xffff
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140163e00
mov eax, edi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x1400171a0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov rsi, rcx
mov rax, qword [0x1401ee6a8]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea r14, [rsp + 0x38]
lea r12, [rsp + 0x28]
lea r15, [rsp + 0x30]
mov ebp, 0xffffffff
mov rcx, qword [rsi + 0x48]
mov rdx, qword [rsi + 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x20], r12
mov r8, r15
mov r9, r14
call qword [rax + 0x20]
mov edi, eax
mov rbx, qword [rsp + 0x28]
sub rbx, r15
mov r9, qword [rsi + 0x40]
mov edx, 1
mov rcx, r15
mov r8, rbx
call fcn.14017f4fc
cmp rax, rbx
jne 0x140017227
cmp edi, 1
je 0x1400171d4
cmp edi, 2
je 0x140017227
mov rcx, qword [rsi + 0x40]
call fcn.14017eacc
neg eax
sbb ebp, ebp
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140163e00
mov eax, ebp
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x140017250
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r8
mov r14, rdx
mov rdi, rcx
cmp byte [rcx + 0x58], 0
je 0x140017285
mov r9, qword [rdi + 0x40]
mov edx, 1
mov rcx, r14
mov r8, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.14017f4fc
xor ebx, ebx
test rsi, rsi
jle 0x1400172aa
movzx edx, byte [r14 + rbx]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x60]
cmp eax, 0xffffffff
je 0x1400172aa
inc rbx
cmp rsi, rbx
jne 0x14001728c
mov rbx, rsi
mov rax, rbx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x1400172c0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov r15d, edx
mov rax, qword [0x1401ee6a8]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp edx, 0xffffffff
je 0x14001731d
mov rdi, rcx
mov byte [rsp + 0x57], r15b
cmp byte [rcx + 0x58], 0
je 0x14001732c
mov r9, qword [rdi + 0x40]
lea rcx, [rsp + 0x57]
mov edx, 1
mov r8d, 1
call fcn.14017f4fc
mov esi, 0xffffffff
cmp rax, 1
jne 0x1400173dc
xor esi, esi
cmp r15d, 0xffffffff
cmovne esi, r15d
jmp 0x1400173dc
lea rbx, [rsp + 0x58]
lea r12, [rsp + 0x48]
mov qword [r12], rbx
lea rsi, [rsp + 0x57]
lea r13, [rsp + 0x60]
lea r14, [rsp + 0x40]
mov rcx, qword [rdi + 0x48]
mov rdx, qword [rdi + 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r14
mov r8, rsi
lea r9, [rsp + 0x58]
call qword [rax + 0x10]
cmp qword [rsp + 0x40], rsi
je 0x1400173d7
mov ebp, eax
cmp eax, 3
je 0x1400173b6
cmp ebp, 1
ja 0x1400173d7
mov rsi, qword [rsp + 0x48]
sub rsi, rbx
mov r9, qword [rdi + 0x40]
mov edx, 1
mov rcx, rbx
mov r8, rsi
call fcn.14017f4fc
cmp rax, rsi
jne 0x1400173d7
mov rsi, qword [rsp + 0x40]
cmp ebp, 1
je 0x140017349
jmp 0x14001731d
mov r9, qword [rdi + 0x40]
mov edx, 1
mov r8d, 1
mov rcx, rsi
call fcn.14017f4fc
cmp rax, 1
je 0x14001731d
mov esi, 0xffffffff
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140163e00
mov eax, esi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140017440
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r8
mov r14, rdx
mov rdi, rcx
cmp byte [rcx + 0x58], 0
je 0x140017475
mov r9, qword [rdi + 0x40]
mov edx, 2
mov rcx, r14
mov r8, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.14017f4fc
xor ebx, ebx
test rsi, rsi
jle 0x14001749b
movzx edx, word [r14 + rbx*2]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x60]
cmp ax, 0xffff
je 0x14001749b
inc rbx
cmp rsi, rbx
jne 0x14001747c
mov rbx, rsi
mov rax, rbx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1400174b0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov esi, edx
mov rax, qword [0x1401ee6a8]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp dx, 0xffff
je 0x14001750c
mov rdi, rcx
mov word [rsp + 0x56], si
cmp byte [rcx + 0x58], 0
je 0x14001751c
mov r9, qword [rdi + 0x40]
lea rcx, [rsp + 0x56]
mov edx, 2
mov r8d, 1
call fcn.14017f4fc
mov di, 0xffff
cmp rax, 1
jne 0x1400175cb
xor eax, eax
cmp si, 0xffff
cmove esi, eax
mov edi, esi
jmp 0x1400175cb
lea r15, [rsp + 0x58]
lea r12, [rsp + 0x48]
mov qword [r12], r15
lea rbx, [rsp + 0x56]
lea r13, [rsp + 0x60]
lea r14, [rsp + 0x40]
mov rcx, qword [rdi + 0x48]
mov rdx, qword [rdi + 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r14
mov r8, rbx
lea r9, [rsp + 0x58]
call qword [rax + 0x10]
cmp qword [rsp + 0x40], rbx
je 0x1400175c7
mov ebp, eax
cmp eax, 3
je 0x1400175a6
cmp ebp, 1
ja 0x1400175c7
mov rbx, qword [rsp + 0x48]
sub rbx, r15
mov r9, qword [rdi + 0x40]
mov edx, 1
mov rcx, r15
mov r8, rbx
call fcn.14017f4fc
cmp rax, rbx
jne 0x1400175c7
mov rbx, qword [rsp + 0x40]
cmp ebp, 1
je 0x140017539
jmp 0x14001750c
mov r9, qword [rdi + 0x40]
mov edx, 1
mov r8d, 1
mov rcx, rbx
call fcn.14017f4fc
cmp rax, 1
je 0x14001750c
mov di, 0xffff
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140163e00
mov eax, edi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x14001bb60
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp rdx, r8
je 0x14001bb97
movabs r9, 0xf000000000000000
shl rax, 4
movsx r10, byte [rdx]
add r10, rax
mov rcx, r10
and rcx, r9
mov rax, rcx
shr rax, 0x38
or rax, rcx
xor rax, r10
inc rdx
cmp r8, rdx
jne 0x14001bb71
ret

Function at 0x14001bcb0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp rdx, r8
je 0x14001bce8
movabs r9, 0xf000000000000000
shl rax, 4
movzx r10d, word [rdx]
add r10, rax
mov rcx, r10
and rcx, r9
mov rax, rcx
shr rax, 0x38
or rax, rcx
xor rax, r10
add rdx, 2
cmp r8, rdx
jne 0x14001bcc1
ret
Function at 0x140031230
Capabilities:
Accept command line arguments

Disassembly:
push rsi
sub rsp, 0x40
mov rax, qword [0x1401ee6a8]
xor rax, rsp
mov qword [rsp + 0x38], rax
cmp qword [0x1401f13a8], 0
je 0x140031255
xor esi, esi
jmp 0x1400312e5
mov ecx, 0x38
call fcn.140163a50
mov rsi, rax
mov ecx, 0x18
call fcn.140163a50
mov qword [rsi], rax
lea rcx, [rax + 0x18]
mov qword [rsi + 0x10], rcx
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov qword [rsi + 8], rcx
lea rax, [rsi + 0x20]
movups xmmword [rsi + 0x20], xmm0
mov qword [rsi + 0x18], rax
mov qword [rsi + 0x30], 1
mov qword [0x1401f13a8], rsi
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x28], rax
test rax, rax
je 0x1400312ce
cmp word [rax], 0
je 0x1400312ce
xor ecx, ecx
nop dword [rax]
cmp word [rax + rcx*2 + 2], 0
lea rcx, [rcx + 1]
jne 0x1400312c0
jmp 0x1400312d0
xor ecx, ecx
mov qword [rsp + 0x30], rcx
lea rdx, [rsp + 0x28]
mov rcx, rsi
call fcn.140031300
mov sil, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140163e00
mov eax, esi
add rsp, 0x40
pop rsi
ret
Function at 0x140031300
Capabilities:
Accept command line arguments

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
movaps xmmword [rsp + 0x70], xmm6
mov rsi, rdx
mov rbp, rcx
mov rax, qword [0x1401ee6a8]
xor rax, rsp
mov qword [rsp + 0x68], rax
movups xmm0, xmmword [rdx]
movaps xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x50]
mov r8d, 3
call fcn.140042b70
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm0
cmp qword [rsi + 8], 0
je 0x14003153c
mov dword [rsp + 0x4c], 0
lea rcx, str.api_ms_win_downlevel_shell32_l1_1_0.dll
xor edx, edx
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test rax, rax
je 0x1400313a9
mov rdi, rax
lea rdx, [0x14019c28a]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400313bc
mov rbx, rax
mov rcx, qword [rsi]
lea rdx, [rsp + 0x4c]
call rax
mov r15, rax
jmp 0x1400313bf
mov rcx, qword [rsi]
lea rdx, [rsp + 0x4c]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov r15, rax
jmp 0x1400313c8
xor r15d, r15d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
movsxd r13, dword [rsp + 0x4c]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
test r13, r13
je 0x1400314df
mov qword [rsp + 0x28], rbp
test r13d, r13d
js 0x14003156f
shl r13, 3
lea rsi, [r13*2]
add rsi, r13
mov rcx, rsi
call fcn.140163a50
mov rbx, rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
add rsi, rax
mov qword [rsp + 0x40], rsi
xor r14d, r14d
xorps xmm6, xmm6
jmp 0x140031460
mov byte [rbx + 0x17], dil
mov rsi, rbx
test rdi, rdi
je 0x14003144d
mov r8, rdi
add r8, rdi
mov rcx, rsi
mov rdx, r12
call fcn.1401667e0
mov word [rsi + rdi*2], 0
add rbx, 0x18
add r14, 8
cmp r13, r14
je 0x1400314d5
mov r12, qword [r15 + r14]
movups xmmword [rbx], xmm6
mov qword [rbx + 0x10], 0
mov rcx, r12
call fcn.140184604
mov rdi, rax
movabs rax, 0x7fffffffffffffef
cmp rdi, rax
ja 0x140031562
cmp rdi, 0xb
jb 0x140031430
lea rbp, [rdi + 8]
and rbp, 0xfffffffffffffff8
js 0x14003156a
mov rcx, rbp
add rcx, rbp
lea rcx, [rbp + rbp]
call fcn.140163a50
mov rsi, rax
mov qword [rbx], rax
movabs rax, 0x7fffffffffffffef
add rax, 0x11
or rax, rbp
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], rdi
jmp 0x14003143c
mov qword [rsp + 0x38], rbx
mov rbp, qword [rsp + 0x28]
lea rdx, [rsp + 0x30]
mov rcx, rbp
call fcn.140030ef0
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rsi, qword [rsp + 0x30]
test rsi, rsi
je 0x14003153c
mov rax, qword [rsp + 0x38]
cmp rax, rsi
jne 0x140031518
mov rcx, rsi
jmp 0x140031532
mov rax, rdi
cmp rsi, rdi
je 0x14003152d
lea rdi, [rax - 0x18]
cmp byte [rax - 1], 0
jns 0x140031510
mov rcx, qword [rax - 0x18]
call fcn.140163a8c
jmp 0x140031510
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x38], rsi
call fcn.140163a8c
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140163e00
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, rbx
call fcn.14002d5be
call fcn.140177b74
lea rcx, [rsp + 0x30]
call fcn.14002fbb0
int3