joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400eaf28
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1400eaf58
xor eax, eax
jmp 0x1400eb01b
mov rbp, rbx
cmp word [rax], si
je 0x1400eaf7d
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1400eaf64
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1400eaf60
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1400e9690
movsxd r14, eax
test eax, eax
jne 0x1400eafbb
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1400eaf51
mov rcx, r14
call fcn.1400e3d54
mov rdi, rax
test rax, rax
jne 0x1400eafd4
xor ecx, ecx
call fcn.1400e2100
jmp 0x1400eafb0
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1400e9690
test eax, eax
jne 0x1400eb005
mov rcx, rdi
call fcn.1400e2100
jmp 0x1400eb00f
xor ecx, ecx
call fcn.1400e2100
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x1400eb038
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1400eb0bf
mov rsi, rbx
cmp word [rax], bp
je 0x1400eb07e
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x1400eb068
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1400eb064
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.1400e3d54
mov rdi, rax
test rax, rax
je 0x1400eb0ac
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.1400f3c40
mov rbp, rdi
xor ecx, ecx
call fcn.1400e2100
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400ee218
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.1400e1c50
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x1400ee2b9
cmp ebx, dword [rsp + 0x30]
je 0x1400ee2b2
test esi, esi
je 0x1400ee2b2
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x1400ee28d
sub r8w, 0x61
cmp r8w, 0x19
ja 0x1400ee29a
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x1400ee277
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x1400ee29e
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x1400ee2bb
mov eax, 1
jmp 0x1400ee2bb
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400f2568
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.1400e6790
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.1400e6790
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x1400f26b8
cmp rax, 0xffffffffffffffff
je 0x1400f26b8
xor edi, edi
test rbp, rbp
jle 0x1400f2663
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.1400e2088
mov rbx, rax
test rax, rax
jne 0x1400f25f0
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x1400f2659
mov edx, 0x8000
mov ecx, r14d
call fcn.1400dfd0c
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.1400e4d70
cmp eax, 0xffffffff
je 0x1400f2639
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1400f2600
mov edx, r15d
mov ecx, r14d
call fcn.1400dfd0c
jmp 0x1400f2659
cmp byte [rsi + 0x38], dil
je 0x1400f2650
cmp dword [rsi + 0x34], 5
jne 0x1400f2650
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], send
cmp byte [rsi + 0x30], dil
je 0x1400f2659
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.1400e2100
jmp 0x1400f26cc
jns 0x1400f26cc
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.1400e6790
cmp rax, 0xffffffffffffffff
jne 0x1400f2684
cmp byte [rsi + 0x30], dil
je 0x1400f26cc
mov edi, dword [rsi + 0x2c]
jmp 0x1400f26cc
mov ecx, r14d
call fcn.1400ebcc4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1400f26cc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], send
jmp 0x1400f26cc
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1400f26c5
mov eax, dword [rsi + 0x2c]
jmp 0x1400f26ca
mov eax, socket
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.1400e6790
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x1400f37f0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400f3818
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400f3818
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1411b63c0
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x1250
call fcn.141316c10
sub rsp, rax
mov rax, qword [0x14136fbc0]
xor rax, rsp
mov qword [rsp + 0x1240], rax
mov rsi, rcx
lea r8, [rsp + 0x28]
lea rcx, [rsp + 0x30]
mov edx, 0x1000
call qword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
je 0x1411b6514
mov ebp, dword [rsp + 0x28]
xor ebx, ebx
shr ebp, 2
test ebp, ebp
je 0x1411b6514
mov r8d, dword [rsp + rbx*4 + 0x30]
test r8d, r8d
je 0x1411b650a
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x1411b650a
lea r9, [rsp + 0x2c]
mov r8d, 8
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x1411b6501
mov rdx, qword [rsp + 0x20]
lea r8, [rsp + 0x1030]
mov r9d, 0x104
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameW]
test eax, eax
je 0x1411b6501
lea rcx, [rsp + 0x1030]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1411b64a0
cmp qword [rsi + 0x18], 7
mov r8, rsi
mov rdx, qword [rsi + 0x10]
jbe 0x1411b64bb
mov r8, qword [rsi]
cmp rdx, rax
jne 0x1411b6501
lea rax, [rsp + 0x1030]
test rdx, rdx
je 0x1411b64f4
lea rcx, [rsp + 0x1030]
sub r8, rcx
nop dword [rax + rax]
movzx ecx, word [r8 + rax]
cmp cx, word [rax]
jne 0x1411b6501
add rax, 2
sub rdx, 1
jne 0x1411b64e0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x1411b6516
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, ebp
jb 0x1411b6420
xor al, al
mov rcx, qword [rsp + 0x1240]
xor rcx, rsp
call fcn.1413164a0
lea r11, [rsp + 0x1250]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1411cbdc0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, ecx
call fcn.1411cbdf0
mov ecx, ebx
call fcn.1411ca420
test al, al
je 0x1411cbde2
add rsp, 0x20
pop rbx
jmp fcn.141206b30
add rsp, 0x20
pop rbx
ret

Function at 0x1411cd6b0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov rbp, rcx
lea r15, [0x1413721c8]
mov qword [rsp + 0x20], r15
xor eax, eax
mov r12d, 1
lock cmpxchg qword [0x1413721c8], r12
je 0x1411cd6f0
mov rcx, r15
call fcn.141207060
mov byte [rsp + 0x28], r12b
xor r14d, r14d
cmp qword [rbp + 0x10], 0x7ffe
jg 0x1411cd718
mov rcx, rbp
call fcn.1411c8780
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x1411cd7f0
mov ecx, 0xfffe
call fcn.141316da0
mov rsi, rax
mov rdi, r14
mov rax, qword [rbp + 0x10]
test rax, rax
jle 0x1411cd7e7
nop word [rax + rax]
mov rbx, rax
sub rbx, rdi
mov ecx, 0x7ffe
cmp rbx, rcx
cmovl rcx, rbx
mov r8, qword [rbp + 8]
test r8, r8
cmove r8, r14
mov rdx, rdi
cmp rdi, rax
jg 0x1411cd79f
test rdi, rdi
jns 0x1411cd792
test rcx, rcx
js 0x1411cd786
lea rbx, [rcx + rdi]
cmp rbx, rax
jge 0x1411cd786
test rbx, rbx
jle 0x1411cd79f
mov rdx, r14
lea rdx, [r8 + rdx*2]
jmp 0x1411cd7b4
mov rdx, r14
mov rbx, rax
lea rdx, [r8 + rdx*2]
jmp 0x1411cd7b4
cmp rcx, rbx
cmovbe rbx, rcx
lea rdx, [r8 + rdx*2]
jmp 0x1411cd7b4
xorps xmm1, xmm1
xorps xmm0, xmm0
psrldq xmm0, 8
movq rdx, xmm0
movq rbx, xmm1
test rdx, rdx
je 0x1411cd7c5
lea r8, [rbx + rbx]
mov rcx, rsi
call fcn.141340f00
mov word [rsi + rbx*2], r14w
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rdi, 0x7ffe
mov rax, qword [rbp + 0x10]
cmp rdi, rax
jl 0x1411cd740
mov rcx, rsi
call fcn.1413164c0
nop
mov rax, r12
lock cmpxchg qword [0x1413721c8], r14
je 0x1411cd806
mov rcx, r15
call fcn.141207560
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1411d2070
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x68], rsi
mov r12, r9
lea rsi, [r8 - 1]
mov r14, r8
sar rsi, 1
mov rdi, rdx
mov rbp, rcx
mov r13, rdx
mov r10, rdx
cmp rdx, rsi
jge 0x1411d2169
mov qword [rsp + 0x60], rbx
nop
lea rbx, [r10 + r10]
lea rax, [rbx + 2]
imul rdx, rax, 0x38
lea rcx, [rsp + 0x80]
add rdx, rbp
lea r8, [rdx - 0x38]
call fcn.1411d3750
movzx r10d, al
xor r10, 1
imul rdx, rdi, 0x38
inc r10
add rdx, rbp
add r10, rbx
imul r8, r10, 0x38
mov rcx, qword [rdx]
mov rdi, r10
add r8, rbp
mov rax, qword [r8]
mov qword [rdx], rax
mov qword [r8], rcx
mov rax, qword [r8 + 8]
mov rcx, qword [rdx + 8]
mov qword [rdx + 8], rax
mov qword [r8 + 8], rcx
mov rax, qword [r8 + 0x10]
mov rcx, qword [rdx + 0x10]
mov qword [rdx + 0x10], rax
mov qword [r8 + 0x10], rcx
mov rax, qword [r8 + 0x18]
mov rcx, qword [rdx + 0x18]
mov qword [rdx + 0x18], rax
mov qword [r8 + 0x18], rcx
mov rax, qword [r8 + 0x20]
mov rcx, qword [rdx + 0x20]
mov qword [rdx + 0x20], rax
mov qword [r8 + 0x20], rcx
mov rax, qword [r8 + 0x28]
mov rcx, qword [rdx + 0x28]
mov qword [rdx + 0x28], rax
mov qword [r8 + 0x28], rcx
mov rax, qword [r8 + 0x30]
mov rcx, qword [rdx + 0x30]
mov qword [rdx + 0x30], rax
mov qword [r8 + 0x30], rcx
cmp r10, rsi
jl 0x1411d20b0
mov rbx, qword [rsp + 0x60]
cmp r10, rsi
mov rsi, qword [rsp + 0x68]
jne 0x1411d2201
test r14b, 1
jne 0x1411d2201
imul r9, r14, 0x38
imul rdx, rdi, 0x38
add r9, rbp
lea rdi, [r14 - 1]
mov rax, qword [r9 - 0x38]
add rdx, rbp
mov rcx, qword [rdx]
mov qword [rdx], rax
mov qword [r9 - 0x38], rcx
mov rax, qword [r9 - 0x30]
mov rcx, qword [rdx + 8]
mov qword [rdx + 8], rax
mov qword [r9 - 0x30], rcx
mov rax, qword [r9 - 0x28]
mov rcx, qword [rdx + 0x10]
mov qword [rdx + 0x10], rax
mov qword [r9 - 0x28], rcx
mov rax, qword [r9 - 0x20]
mov rcx, qword [rdx + 0x18]
mov qword [rdx + 0x18], rax
mov qword [r9 - 0x20], rcx
mov rax, qword [r9 - 0x18]
mov rcx, qword [rdx + 0x20]
mov qword [rdx + 0x20], rax
mov qword [r9 - 0x18], rcx
mov rax, qword [r9 - 0x10]
mov rcx, qword [rdx + 0x28]
mov qword [rdx + 0x28], rax
mov qword [r9 - 0x10], rcx
mov rax, qword [r9 - 8]
mov rcx, qword [rdx + 0x30]
mov qword [rdx + 0x30], rax
mov qword [r9 - 8], rcx
mov r9, r12
mov r8, r13
mov rdx, rdi
mov rcx, rbp
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
jmp fcn.1411d2230
Function at 0x1411e2370
Capabilities:
Encode data using base64

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xe0
mov rax, qword [0x14136fbc0]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov ebx, r8d
mov r14, rdx
mov r12, rcx
mov qword [rsp + 0x28], rdx
xor ebp, ebp
mov dword [rsp + 0x20], ebp
movaps xmm0, xmmword [0x1400479a0]
movaps xmmword [rsp + 0x80], xmm0
movaps xmm1, xmmword [0x1400479b0]
movaps xmmword [rsp + 0x90], xmm1
movaps xmm0, xmmword [0x1400479c0]
movaps xmmword [r11 - 0x78], xmm0
movaps xmm1, xmmword [0x1400479d0]
movaps xmmword [r11 - 0x68], xmm1
movzx eax, byte [0x1400479e0]
mov byte [r11 - 0x58], al
movaps xmm0, xmmword [0x1400479f0]
movaps xmmword [rsp + 0x30], xmm0
movaps xmm1, xmmword [0x140047a00]
movaps xmmword [rsp + 0x40], xmm1
movaps xmm0, xmmword [0x140047a10]
movaps xmmword [rsp + 0x50], xmm0
movaps xmm1, xmmword [0x140047a20]
movaps xmmword [rsp + 0x60], xmm1
movzx eax, byte [0x140047a30]
mov byte [rsp + 0x70], al
bt r8d, 0
lea r15, [rsp + 0x30]
lea rax, [r11 - 0x98]
cmovae r15, rax
mov r13, qword [rcx + 0x10]
lea rcx, [r13 + 2]
movabs rax, 0x5555555555555556
imul rcx
mov rax, rdx
shr rax, 0x3f
add rdx, rax
shl rdx, 2
xor r8d, r8d
mov rcx, r14
call fcn.1411df5b0
mov dword [rsp + 0x20], 1
mov esi, ebp
mov rax, qword [r14]
test rax, rax
je 0x1411e2487
mov eax, dword [rax]
cmp eax, 1
jle 0x1411e2499
mov r8d, 1
mov rdx, qword [r14 + 0x10]
mov rcx, r14
call fcn.1411e0fd0
mov rdi, qword [r14 + 8]
and ebx, 2
test r13, r13
jle 0x1411e2580
lea r9, [0x14004798c]
mov rdx, qword [r12 + 8]
mov rax, r9
test rdx, rdx
cmovne rax, rdx
movzx ecx, byte [rax + rsi]
inc rsi
shl ecx, 0x10
cmp rsi, r13
jne 0x1411e24d5
mov ebp, 2
jmp 0x1411e250a
mov rax, r9
test rdx, rdx
cmovne rax, rdx
movzx eax, byte [rax + rsi]
inc rsi
shl eax, 8
or ecx, eax
cmp rsi, r13
jne 0x1411e24f7
mov ebp, 1
jmp 0x1411e250a
mov rax, r9
test rdx, rdx
cmovne rax, rdx
movzx eax, byte [rax + rsi]
inc rsi
or ecx, eax
mov edx, ecx
shr edx, 6
and edx, 0x3f
mov r8d, ecx
and r8d, 0x3f
mov rax, rcx
shr rax, 0x12
movzx eax, byte [rax + r15]
mov byte [rdi], al
shr rcx, 0xc
and ecx, 0x3f
movzx eax, byte [rcx + r15]
mov byte [rdi + 1], al
add rdi, 2
cmp rbp, 1
jle 0x1411e2552
test ebx, ebx
jne 0x1411e2577
mov byte [rdi], 0x3d
inc rdi
mov byte [rdi], 0x3d
inc rdi
jmp 0x1411e2577
movzx ecx, byte [rdx + r15]
mov byte [rdi], cl
inc rdi
test rbp, rbp
jle 0x1411e256d
test ebx, ebx
jne 0x1411e2577
mov byte [rdi], 0x3d
inc rdi
jmp 0x1411e2577
movzx ecx, byte [r8 + r15]
mov byte [rdi], cl
inc rdi
cmp rsi, r13
jl 0x1411e24b0
test ebx, ebx
je 0x1411e25ba
mov rax, qword [r14]
test rax, rax
je 0x1411e2593
mov eax, dword [rax]
cmp eax, 1
jle 0x1411e25a5
mov r8d, 1
mov rdx, qword [r14 + 0x10]
mov rcx, r14
call fcn.1411e0fd0
sub rdi, qword [r14 + 8]
cmp rdi, qword [r14 + 0x10]
jge 0x1411e25ba
mov rdx, rdi
mov rcx, r14
call fcn.1411e1e60
mov rax, r14
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.1413164a0
mov rbx, qword [rsp + 0x130]
add rsp, 0xe0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1411f3b00
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov rbx, rcx
xor r15d, r15d
mov dword [rsp + 0x20], r15d
mov qword [rcx], r15
mov qword [rcx + 8], r15
mov qword [rcx + 0x10], r15
mov dword [rsp + 0x20], 1
mov rcx, rdx
call fcn.1411c8780
mov rcx, rax
lea rdx, [rsp + 0xa0]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov r14, rax
test rax, rax
je 0x1411f3cb4
movsxd rdx, dword [rsp + 0xa0]
mov rcx, rbx
call fcn.1411dd2d0
movsxd rcx, dword [rsp + 0xa0]
lea rbp, [r14 + rcx*8]
mov rsi, r14
cmp r14, rbp
jae 0x1411f3cab
mov rdi, qword [rsp + 0x90]
nop dword [rax + rax]
mov r8, 0xffffffffffffffff
mov rdx, qword [rsi]
lea rcx, [rsp + 0x40]
call fcn.1411c24e0
nop
mov rcx, qword [rax]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rax + 8]
mov qword [rsp + 0x30], rcx
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x38], rcx
mov qword [rax], r15
mov qword [rax + 8], r15
mov qword [rax + 0x10], r15
mov eax, dword [rsp + 0x20]
or eax, 0xa
mov dword [rsp + 0x20], eax
test al, 4
je 0x1411f3c05
and dword [rsp + 0x20], 0xfffffffb
test rdi, rdi
je 0x1411f3c05
mov eax, 0xffffffff
lock xadd dword [rdi], eax
cmp eax, 1
jne 0x1411f3c05
mov edx, 2
mov r8d, 8
mov rcx, rdi
call fcn.1411dba10
nop
mov eax, dword [rsp + 0x20]
test al, 2
je 0x1411f3c40
and dword [rsp + 0x20], 0xfffffffd
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1411f3c40
mov eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x1411f3c40
mov edx, 2
mov r8d, 8
mov rcx, qword [rsp + 0x40]
call fcn.1411dba10
nop
lea r8, [rsp + 0x28]
mov rdx, qword [rbx + 0x10]
mov rcx, rbx
call fcn.1411b52a0
mov rax, qword [rbx]
test rax, rax
je 0x1411f3c60
mov eax, dword [rax]
cmp eax, 1
jle 0x1411f3c71
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.1411b4d30
nop
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x1411f3c9e
mov eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x1411f3c9e
mov edx, 2
mov r8d, 8
mov rcx, qword [rsp + 0x28]
call fcn.1411dba10
add rsi, 8
cmp rsi, rbp
jb 0x1411f3b90
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rax, rbx
mov rbx, qword [rsp + 0x98]
add rsp, 0x60
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1411fb9d0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
xor r9d, r9d
mov r10, rcx
sub r10, r8
mov r11d, r9d
cmp rdx, 0x20
jb 0x1411fba53
mov qword [rsp + 0x10], rbx
lea rbx, [r8 + 0x10]
mov qword [rsp], rdi
mov edi, 0x10
sub rdi, r8
nop dword [rax + rax]
movdqu xmm0, xmmword [rbx + r10 - 0x10]
add r11, 0x20
movdqu xmm2, xmmword [rbx + r10]
lea rbx, [rbx + 0x20]
movdqa xmm1, xmm0
lea rax, [rdi + rbx]
psrlw xmm0, 8
psllw xmm1, 8
xorps xmm1, xmm0
movdqa xmm0, xmm2
psllw xmm0, 8
psrlw xmm2, 8
xorps xmm0, xmm2
movdqu xmmword [rbx - 0x20], xmm0
movdqu xmmword [rbx - 0x30], xmm1
cmp rax, rdx
jbe 0x1411fba00
mov rdi, qword [rsp]
mov rbx, qword [rsp + 0x10]
lea rax, [r11 + 0x10]
cmp rax, rdx
ja 0x1411fba7c
movdqu xmm0, xmmword [r11 + rcx]
movdqa xmm1, xmm0
psrlw xmm0, 8
psllw xmm1, 8
xorps xmm1, xmm0
movdqu xmmword [r11 + r8], xmm1
mov r11, rax
cmp r11, rdx
jae 0x1411fbaaa
lea rax, [r11 + r8]
cmp r9, 0x10
jae 0x1411fbaaa
movzx ecx, word [r10 + rax]
add r9, 2
ror cx, 8
mov word [rax], cx
add rax, 2
mov rcx, rax
sub rcx, r8
cmp rcx, rdx
jb 0x1411fba85
mov rax, rdx
add rsp, 8
ret

Function at 0x1412239f0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rsi, r8
mov r15, rdx
mov rbp, rcx
mov r12, qword [rcx + 0x28]
test r8, r8
js 0x141223b44
xor ebx, ebx
cmp qword [rcx + 0xa8], rbx
je 0x141223ab6
nop dword [rax + rax]
mov r8, rsi
sub r8, rbx
lea rcx, [rbx + r15]
mov r9, qword [rbp + 0xa8]
mov edx, 1
call fcn.14131dc90
mov rdi, rax
mov rcx, qword [rbp + 0xa8]
call fcn.14132863c
test eax, eax
setne r14b
test eax, eax
je 0x141223a69
test rdi, rdi
je 0x141223a96
add rbx, rdi
test eax, eax
jne 0x141223af8
test rdi, rdi
jne 0x141223a88
call fcn.141328508
xor ecx, ecx
cmp dword [rax], 4
sete cl
jmp 0x141223a90
xor ecx, ecx
cmp rbx, rsi
setl cl
test ecx, ecx
jne 0x141223a30
jmp 0x141223af8
mov rcx, qword [rbp + 0xa8]
call fcn.141324c54
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rbp + 0xa8]
call fcn.14131dfc8
jmp 0x141223af8
cmp dword [rcx + 0xd0], 0xffffffff
je 0x141223b0a
nop
mov rax, rsi
sub rax, rbx
mov r8d, 0x7fffffff
cmp rax, r8
cmovb r8d, eax
lea rdx, [rbx + r15]
mov ecx, dword [rbp + 0xd0]
call fcn.141328f0c
movsxd rcx, eax
test eax, eax
jle 0x141223af1
add rbx, rcx
cmp rbx, rsi
jl 0x141223ac0
cmp ecx, 0xffffffff
setne r14b
test r14b, r14b
jne 0x141223b96
test rbx, rbx
jne 0x141223b96
mov rbx, 0xffffffffffffffff
mov edx, ebx
lea rcx, [rsp + 0x20]
call fcn.141206500
nop
mov r8, rax
mov edx, 1
mov rcx, r12
call fcn.141221670
nop
mov rax, qword [rsp + 0x20]
test rax, rax
je 0x141223b96
mov ecx, ebx
lock xadd dword [rax], ecx
cmp ecx, 1
jmp 0x141223b7f
mov edx, 0x16
lea rcx, [rsp + 0x20]
call fcn.141206500
nop
mov r8, rax
mov edx, 1
mov rcx, r12
call fcn.141221670
nop
mov rbx, 0xffffffffffffffff
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x141223b96
mov eax, ebx
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x141223b96
mov r8d, 8
mov edx, 2
mov rcx, qword [rsp + 0x20]
call fcn.1411dba10
mov rax, rbx
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x141226a80
Capabilities:
Copy file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x50
mov r14, r8
mov rax, rdx
mov rdi, rcx
lea rdx, [rsp + 0x38]
mov rcx, rax
call fcn.141221fc0
nop
mov rcx, rax
call fcn.1411c8780
mov rbx, rax
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.141221fc0
nop
mov rcx, rax
call fcn.1411c8780
mov r8d, 1
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov esi, eax
test eax, eax
setne dil
mov ebx, 0xffffffff
mov rdx, qword [rsp + 0x20]
test rdx, rdx
je 0x141226b17
mov ecx, ebx
lock xadd dword [rdx], ecx
cmp ecx, 1
jne 0x141226b17
mov edx, 2
mov r8d, 8
mov rcx, qword [rsp + 0x20]
call fcn.1411dba10
nop
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x141226b3f
lock xadd dword [rax], ebx
cmp ebx, 1
jne 0x141226b3f
mov edx, 2
mov r8d, 8
mov rcx, qword [rsp + 0x38]
call fcn.1411dba10
test esi, esi
jne 0x141226b5d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x78], eax
mov dword [rsp + 0x7c], 2
mov rcx, qword [rsp + 0x78]
mov qword [r14], rcx
movzx eax, dil
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
add rsp, 0x50
pop r14
ret
Function at 0x141226e40
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
movzx esi, r8b
mov rbp, rdx
mov rbx, rcx
mov qword [rsp + 0x20], 2
lea rax, [0x14007a230]
mov qword [rsp + 0x28], rax
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
mov r8d, 1
lea rdx, [rsp + 0x20]
call fcn.1411c7540
mov r14d, 0x5c
test al, al
je 0x141226eb2
mov r8d, 1
movzx edx, r14w
mov rcx, rbx
call fcn.1411c0ae0
cmp rax, 3
jle 0x141227028
cmp qword [rbx + 0x10], 2
jne 0x141226ec8
mov rax, qword [rbx + 8]
cmp word [rax + 2], 0x3a
je 0x141227028
mov rdi, 0xffffffffffffffff
test sil, sil
je 0x141226f2f
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.141230530
nop
lea rcx, [rsp + 0x20]
call fcn.1411c8780
mov rcx, rax
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, eax
mov rdx, qword [rsp + 0x20]
test rdx, rdx
je 0x141226f24
mov ecx, edi
lock xadd dword [rdx], ecx
cmp ecx, 1
jne 0x141226f24
mov edx, 2
mov r8d, 8
mov rcx, qword [rsp + 0x20]
call fcn.1411dba10
test esi, esi
je 0x141226f2f
mov al, 1
jmp 0x14122702a
mov r9d, 1
mov r8, rdi
movzx edx, r14w
mov rcx, rbx
call fcn.1411c3540
nop
cmp eax, 1
jl 0x141227028
movsxd r8, eax
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.1411c35d0
nop
mov r8b, 1
mov rdx, rbp
lea rcx, [rsp + 0x40]
call fcn.141226e40
test al, al
je 0x141226ff9
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.141230530
nop
lea rcx, [rsp + 0x20]
call fcn.1411c8780
mov rcx, rax
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, eax
mov rdx, qword [rsp + 0x20]
test rdx, rdx
je 0x141226fc7
mov ecx, edi
lock xadd dword [rdx], ecx
cmp ecx, 1
jne 0x141226fc7
mov edx, 2
mov r8d, 8
mov rcx, qword [rsp + 0x20]
call fcn.1411dba10
test esi, esi
je 0x141226fcf
mov bl, 1
jmp 0x141226ffb
mov byte [rsp + 0x98], 0
lea rdx, [rsp + 0x98]
mov rcx, rbx
call fcn.1412296f0
test al, al
je 0x141226ff9
cmp byte [rsp + 0x98], 0
je 0x141226ff9
mov bl, 1
jmp 0x141226ffb
xor bl, bl
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x141227023
lock xadd dword [rax], edi
cmp edi, 1
jne 0x141227023
mov edx, 2
mov r8d, 8
mov rcx, qword [rsp + 0x40]
call fcn.1411dba10
movzx eax, bl
jmp 0x14122702a
xor al, al
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret