joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006e900
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rsi, rdx
mov rdi, rcx
xor r14d, r14d
mov word [rax + 0x10], r14w
lea r8, [rax + 0x10]
mov ebx, 0x400
mov edx, ebx
lea rcx, [rax - 0x30]
call fcn.14005e1b4
mov rcx, rsi
cmp qword [rsi + 0x18], 7
jbe 0x14006e943
nop
mov rcx, qword [rsi]
mov r8d, ebx
mov rbx, qword [rsp + 0x28]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ebp, eax
test eax, eax
je 0x14006ea1c
cmp ebp, 0x3ff
jbe 0x14006e99b
mov word [rsp + 0x68], r14w
mov edx, ebp
lea r8, [rsp + 0x68]
lea rcx, [rsp + 0x28]
call fcn.14005e11c
cmp qword [rsi + 0x18], 7
jbe 0x14006e987
mov rsi, qword [rsi]
mov r8d, ebp
mov rbx, qword [rsp + 0x28]
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rdx, [0x14011a1d0]
test rbx, rbx
cmovne rdx, rbx
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], r14
or r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], r14w
jne 0x14006e9bb
mov rcx, rdi
call fcn.140005d34
nop
test rbx, rbx
je 0x14006ea06
mov rax, qword [rsp + 0x38]
sub rax, rbx
sar rax, 1
add rax, rax
cmp rax, 0x1000
mov rcx, rbx
jb 0x14006e9fd
mov rbx, qword [rbx - 8]
sub rcx, rbx
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14006ea34
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, rdi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], 7
mov word [rdi], r14w
jmp 0x14006e9ce
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14006ea3c
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rsi, rdx
mov rdi, rcx
xor ebp, ebp
mov rcx, rdx
cmp qword [rdx + 0x18], 7
jbe 0x14006ea65
mov rcx, qword [rdx]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea ebx, [rax + 1]
mov word [rsp + 0x58], bp
mov edx, ebx
lea r8, [rsp + 0x58]
lea rcx, [rsp + 0x28]
call fcn.14005e1b4
cmp qword [rsi + 0x18], 7
jbe 0x14006ea93
mov rsi, qword [rsi]
mov r8d, ebx
mov rbx, qword [rsp + 0x28]
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rbp
test eax, eax
je 0x14006eb2e
lea rdx, [0x14011a1d0]
test rbx, rbx
cmovne rdx, rbx
mov qword [rdi + 0x18], rbp
or r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], bp
jne 0x14006eacb
mov rcx, rdi
call fcn.140005d34
nop
test rbx, rbx
je 0x14006eb16
mov rax, qword [rsp + 0x38]
sub rax, rbx
sar rax, 1
add rax, rax
cmp rax, 0x1000
mov rcx, rbx
jb 0x14006eb0d
mov rbx, qword [rbx - 8]
sub rcx, rbx
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14006eb3b
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
mov qword [rdi + 0x18], 7
mov word [rdi], bp
jmp 0x14006eade
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3

Function at 0x140070a70
Capabilities:
Get hostname

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov dword [rax + 8], ecx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rsi, rdx
xorps xmm0, xmm0
movdqu xmmword [rax - 0x38], xmm0
xor ebp, ebp
mov qword [rax - 0x28], rbp
mov dword [rax + 0x18], ebp
lea r8, [rax + 0x18]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
je 0x140070aac
lea edi, [rbp + 0xd]
jmp 0x140070abb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 0xea
je 0x140070ac0
mov rbx, rbp
jmp 0x140070b08
mov word [rsp + 0x60], bp
mov edx, dword [rsp + 0x70]
lea r8, [rsp + 0x60]
lea rcx, [rsp + 0x20]
call fcn.14005e11c
lea r8, [rsp + 0x70]
mov rbx, qword [rsp + 0x20]
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
jne 0x140070afb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x140070b08
mov rdx, rbx
mov rcx, rsi
call fcn.140007084
mov edi, ebp
test rbx, rbx
je 0x140070b40
mov rax, qword [rsp + 0x30]
sub rax, rbx
sar rax, 1
add rax, rax
cmp rax, 0x1000
jb 0x140070b37
mov rcx, qword [rbx - 8]
sub rbx, rcx
lea rax, [rbx - 8]
cmp rax, 0x1f
ja 0x140070b4f
mov rbx, rcx
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, edi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x1400724a0
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax]
mov eax, dword [rcx + rax]
cmp dword [0x1401720f0], eax
jg 0x1400724e3
mov al, byte [0x1401720e0]
add rsp, 0x58
ret
cmp eax, 2
lea rcx, [0x1401720f0]
sete byte [0x1401720e0]
call fcn.1400e50d8
jmp 0x1400724c0
lea rcx, [0x1401720f0]
call fcn.1400e5144
cmp dword [0x1401720f0], 0xffffffff
jne 0x1400724c0
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx ecx, word [rsp + 0x20]
xor edx, edx
test ecx, ecx
je 0x14007252b
cmp ecx, 9
lea eax, [rdx + 2]
cmovne eax, edx
jmp 0x1400724cb
mov eax, 1
jmp 0x1400724cb

Function at 0x1400ac710
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140165040]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
mov rcx, qword [rdx + 0x10]
movabs rax, 0x7ffffffffffffffe
sub rax, rcx
cmp rax, 0x7b
jb 0x1400ac81d
cmp qword [rdx + 0x18], 7
jbe 0x1400ac75b
mov rdx, qword [rdx]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], 0x7b
lea r9, str.SELECT_Component.ComponentId_FROM_Shortcut__Component_WHERE_Shortcut.Component___Component.Component_and_Shortcut.Target
lea rcx, [rsp + 0x50]
call fcn.14000a5a4
lea rdx, [0x140131eb0]
lea rcx, [rsp + 0x50]
call fcn.14000a260
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
mov rax, qword [rsp + 0x68]
cmp rax, 7
jbe 0x1400ac7fc
lea rax, [rax*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rdx, rcx
cmp rax, 0x1000
jb 0x1400ac7f6
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
jbe 0x1400ac7f6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, rbx
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400e4b70
mov rbx, qword [rsp + 0xa0]
add rsp, 0x80
pop rdi
ret
call fcn.1400059f8
int3
Function at 0x1400b2f10
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x140165040]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdx, qword [rcx + 8]
mov r8d, 2
cmp qword [rdx + 0x10], r8
jb 0x1400b2fe1
cmp qword [rdx + 0x18], 7
mov rax, rdx
jbe 0x1400b2f46
mov rax, qword [rdx]
cmp word [rax + 2], 0x3a
jne 0x1400b2fe1
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rsp + 0x28], xmm0
movdqu xmmword [rsp + 0x38], xmm1
cmp qword [rdx + 0x10], r8
cmovb r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 7
jbe 0x1400b2f75
mov rdx, qword [rdx]
lea rcx, [rsp + 0x28]
call fcn.140005d34
cmp qword [rsp + 0x40], 7
lea rcx, [rsp + 0x28]
cmova rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 4
mov rax, qword [rsp + 0x40]
sete bl
cmp rax, 7
jbe 0x1400b2fdd
mov rcx, qword [rsp + 0x28]
lea rax, [rax*2 + 2]
mov rdx, rcx
cmp rax, 0x1000
jb 0x1400b2fd7
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
jbe 0x1400b2fd7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov al, bl
jmp 0x1400b2fe3
xor al, al
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400e4b70
add rsp, 0x50
pop rbx
ret
Function at 0x1400c6058
Capabilities:
Copy file

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140165040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rdi, rcx
lea rcx, [rsp + 0x40]
call fcn.1400d4588
mov rbx, rax
cmp qword [rax + 0x18], 7
jbe 0x1400c608e
mov rbx, qword [rax]
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.1400d4588
cmp qword [rax + 0x18], 7
jbe 0x1400c60a5
mov rax, qword [rax]
xor r8d, r8d
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov ebx, eax
mov rcx, qword [rsp + 0x38]
cmp rcx, 7
jbe 0x1400c60fb
lea rcx, [rcx*2 + 2]
mov rdx, qword [rsp + 0x20]
mov rax, rdx
cmp rcx, 0x1000
jb 0x1400c60f2
mov rdx, qword [rdx - 8]
sub rax, rdx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400c60f2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
movdqa xmm0, xmmword [0x140137c10]
movdqu xmmword [rsp + 0x30], xmm0
xor edi, edi
mov word [rsp + 0x20], di
mov rax, qword [rsp + 0x58]
cmp rax, 7
jbe 0x1400c6151
lea rax, [rax*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rdx, rcx
cmp rax, 0x1000
jb 0x1400c614b
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
jbe 0x1400c614b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test ebx, ebx
je 0x1400c6173
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400e4b70
mov rbx, qword [rsp + 0xa0]
add rsp, 0x80
pop rdi
ret
call fcn.1400c5cdc
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
or rdx, rbx
movabs rax, 0x52a00000000
or rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140008d38
lea rdx, [0x140146bc8]
lea rcx, [rsp + 0x40]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x1400d36c8
Capabilities:
Move file

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140165040]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor eax, eax
test rcx, rcx
jne 0x1400d36fa
lea ecx, [rax + 0x57]
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1400d37d0
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x40], xmm1
or r8, 0xffffffffffffffff
inc r8
cmp word [rcx + r8*2], ax
jne 0x1400d370d
mov rdx, rcx
lea rcx, [rbp - 0x50]
call fcn.140005d34
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.1400d4750
mov rax, qword [rbp - 0x38]
cmp rax, 7
jbe 0x1400d376f
lea rax, [rax*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rdx, rcx
cmp rax, 0x1000
jb 0x1400d3769
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
jbe 0x1400d3769
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 7
cmova rcx, qword [rbp - 0x30]
xor edx, edx
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ebx, eax
mov rcx, qword [rbp - 0x18]
cmp rcx, 7
jbe 0x1400d37ce
lea rcx, [rcx*2 + 2]
mov rdx, qword [rbp - 0x30]
mov rax, rdx
cmp rcx, 0x1000
jb 0x1400d37c5
mov rdx, qword [rdx - 8]
sub rax, rdx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400d37c5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400e4b70
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rbp
ret
Function at 0x1400d42a8
Capabilities:
Copy file

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x140165040]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rdx
mov r8, rcx
mov rdx, qword [rcx + 0x10]
xor esi, esi
test rdx, rdx
je 0x1400d431b
cmp qword [rbx + 0x10], rsi
je 0x1400d431b
mov rcx, rbx
cmp qword [rbx + 0x18], 7
jbe 0x1400d42ec
mov rcx, qword [rbx]
mov r9, r8
cmp qword [r8 + 0x18], 7
jbe 0x1400d42f9
mov r9, qword [r8]
cmp rdx, qword [rbx + 0x10]
jne 0x1400d433e
test rdx, rdx
je 0x1400d431b
sub r9, rcx
movzx eax, word [rcx + r9]
cmp ax, word [rcx]
jne 0x1400d433e
add rcx, 2
sub rdx, 1
jne 0x1400d4307
mov edx, 0x5c
lea rcx, str.src_appvisv_shared_system_file.cpp
call qword [sym.imp.VCRUNTIME140.dll_strrchr]
test rax, rax
je 0x1400d4479
inc rax
jmp 0x1400d4480
mov rdx, r8
lea rcx, [rbp - 0x30]
call fcn.1400d4750
mov rdx, rbx
lea rcx, [rbp - 0x50]
call fcn.1400d4750
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 7
cmova rdx, qword [rbp - 0x50]
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 7
cmova rcx, qword [rbp - 0x30]
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileExW]
test eax, eax
jne 0x1400d43dc
lea edx, [rax + 0x5c]
lea rcx, str.src_appvisv_shared_system_file.cpp
call qword [sym.imp.VCRUNTIME140.dll_strrchr]
test rax, rax
je 0x1400d43a5
inc rax
jmp 0x1400d43ac
lea rax, str.src_appvisv_shared_system_file.cpp
mov rdx, rax
lea rcx, [0x1401712f0]
call fcn.140005a68
mov rbx, rax
shl rbx, 0x34
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
or rdi, rbx
movabs rax, 0x832500000000
or rdi, rax
jmp 0x1400d43e6
movabs rdi, 0x8000000000
mov ebx, 0x1000
mov rax, qword [rbp - 0x38]
cmp rax, 7
jbe 0x1400d4427
lea rax, [rax*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rdx, rcx
cmp rax, rbx
jb 0x1400d4421
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
jbe 0x1400d4421
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
movdqa xmm0, xmmword [0x140137c10]
movdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x50], si
mov rax, qword [rbp - 0x18]
cmp rax, 7
jbe 0x1400d4474
lea rax, [rax*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rdx, rcx
cmp rax, rbx
jb 0x1400d446e
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
jbe 0x1400d446e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, rdi
jmp 0x1400d44a0
lea rax, str.src_appvisv_shared_system_file.cpp
mov rdx, rax
lea rcx, [0x1401712f0]
call fcn.140005a68
shl rax, 0x34
movabs rcx, 0x822500000057
or rax, rcx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400e4b70
mov rbx, qword [rsp + 0xb0]
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400dbc38
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
lea rax, [r8 - 1]
mov r13, r9
mov r15, rax
mov qword [rsp + 0x50], rax
sar r15, 1
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
mov r12, rdx
mov r14, rdx
cmp rdx, r15
jge 0x1400dbcd1
lea rbx, [r14 + r14]
lea rdx, [rbx + 2]
shl rdx, 6
add rdx, rsi
lea r8, [rdx - 0x40]
call fcn.1400da960
lea r14, [rbx + 1]
movzx eax, al
xor rax, 1
shl rdi, 6
add r14, rax
add rdi, rsi
mov rbx, r14
mov rcx, rdi
shl rbx, 6
add rbx, rsi
mov rdx, rbx
call fcn.14000a100
lea rdx, [rbx + 0x20]
lea rcx, [rdi + 0x20]
call fcn.14000a100
mov rdi, r14
cmp r14, r15
jl 0x1400dbc7a
cmp r14, r15
jne 0x1400dbd09
test bpl, 1
jne 0x1400dbd09
shl rbp, 6
shl rdi, 6
add rdi, rsi
mov rcx, rdi
lea rbx, [rsi + rbp]
lea rdx, [rbx - 0x40]
call fcn.14000a100
lea rdx, [rbx - 0x20]
lea rcx, [rdi + 0x20]
call fcn.14000a100
mov rdi, qword [rsp + 0x50]
cmp r12, rdi
jge 0x1400dbd55
lea rbx, [rdi - 1]
mov r8, r13
sar rbx, 1
mov rbp, rbx
shl rbp, 6
add rbp, rsi
mov rdx, rbp
call fcn.1400da960
test al, al
je 0x1400dbd55
shl rdi, 6
mov rdx, rbp
add rdi, rsi
mov rcx, rdi
call fcn.14000a100
lea rdx, [rbp + 0x20]
lea rcx, [rdi + 0x20]
call fcn.14000a100
mov rdi, rbx
cmp r12, rbx
jl 0x1400dbd0e
shl rdi, 6
mov rdx, r13
add rdi, rsi
mov rcx, rdi
call fcn.14000a100
lea rdx, [r13 + 0x20]
lea rcx, [rdi + 0x20]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
jmp fcn.14000a100
Function at 0x1400e56f0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400e573a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400e573a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400e573a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400e573a
cmp dword [rcx + 0x84], 0xe
jbe 0x1400e573a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400e573c
xor al, al
add rsp, 0x28
ret

Function at 0x1400e5e9c
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd r8, dword [0x14000003c]
lea rsi, [0x140000000]
add r8, rsi
mov rbx, rdx
mov rdi, rcx
cmp dword [r8 + 0x84], 0xd
jbe 0x1400e5f14
mov r10d, dword [r8 + 0xf0]
xor r9d, r9d
test r10d, r10d
je 0x1400e5f14
movzx ecx, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rcx, 0x18
mov r10d, dword [r10 + rsi + 0xc]
add rcx, r8
test r11d, r11d
je 0x1400e5f14
mov eax, dword [rcx + 0xc]
cmp r10d, eax
jb 0x1400e5f08
mov edx, dword [rcx + 8]
add eax, edx
cmp r10d, eax
jb 0x1400e5f26
inc r9d
add rcx, 0x28
cmp r9d, r11d
jb 0x1400e5ef6
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov dword [rdi], edx
mov eax, dword [rcx + 0x24]
mov dword [rbx], eax
mov eax, dword [rcx + 0xc]
add rax, rsi
jmp 0x1400e5f16
Function at 0x140012c00
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
test rdx, rdx
je 0x140012c72
mov rsi, rdx
mov rdi, rcx
mov r14d, 0xffffffff
mov r15, qword [sym.imp.bcrypt.dll_BCryptGenRandom]
mov r12, qword [sym.imp.ADVAPI32.dll_SystemFunction036]
jmp 0x140012c38
add rdi, rbx
sub rsi, rbx
je 0x140012c72
cmp rsi, r14
mov ebx, 0xffffffff
cmovb rbx, rsi
xor ecx, ecx
mov rdx, rdi
mov r8d, ebx
mov r9d, 2
call r15
cmp eax, 0xbfffffff
jbe 0x140012c30
mov ebp, eax
mov rcx, rdi
mov edx, ebx
call r12
test al, al
jne 0x140012c30
and ebp, 0x7fffffff
jmp 0x140012c74
xor ebp, ebp
mov eax, ebp
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x140012f40
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], rdx
mov rdx, qword [rsp + 0xb0]
mov rax, qword [rcx]
bswap rax
mov qword [rsp + 0x30], rcx
mov r15, qword [rcx + 8]
bswap r15
and rdx, 0xfffffffffffffff0
je 0x140013085
mov rdi, r9
mov rcx, qword [rsp + 0x28]
xor rcx, qword [rsp + 0x20]
mov qword [rsp + 0x38], rcx
xor r12d, r12d
mov qword [rsp + 0x40], rdx
nop dword [rax + rax]
mov rbx, qword [rdi + r12]
mov r14, qword [rdi + r12 + 8]
bswap r14
xor r14, r15
bswap rbx
xor rbx, rax
mov rcx, r14
mov rdx, qword [rsp + 0x28]
call fcn.140012c90
mov r13, rax
mov r15, rdx
mov rcx, rbx
mov rdx, qword [rsp + 0x20]
call fcn.140012c90
mov rbp, rax
mov rsi, rdx
xor rbx, r14
mov rcx, rbx
mov rdx, qword [rsp + 0x38]
call fcn.140012c90
mov rcx, r13
shl rcx, 0x3f
mov r8, r13
shl r8, 0x3e
xor r8, rcx
mov r9, r13
shl r9, 0x39
xor r9, rax
xor r9, r8
xor r15, r13
mov rcx, r15
xor rcx, rbp
xor rcx, r9
mov r8, r13
shr r8, 1
mov rax, rcx
shr rax, 1
mov r9, rcx
mov r11, rcx
shr r11, 2
xor r11, rax
mov r10, rcx
mov rax, rcx
shr rax, 7
xor rax, rsi
xor rax, r11
xor rax, rcx
shl rcx, 0x3f
mov r11, r13
shr r11, 2
xor r11, r8
shl r9, 0x3e
shr r13, 7
shl r10, 0x39
xor r10, r9
xor r13, rdx
mov rdx, qword [rsp + 0x40]
xor r13, r11
xor r13, rcx
xor r13, r10
xor r15, rsi
xor r15, rbp
xor r15, r13
add r12, 0x10
cmp rdx, r12
jne 0x140012fa0
bswap rax
bswap r15
mov rcx, qword [rsp + 0x30]
mov qword [rcx], rax
mov qword [rcx + 8], r15
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x1400130b0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
test rdx, rdx
je 0x140013100
mov rsi, rdx
mov rdi, rcx
xor ebx, ebx
mov r14d, 0xffffffff
nop
mov r15, rbx
mov rbx, rsi
sub rbx, r15
lea rcx, [rdi + r15]
cmp rbx, r14
cmovae rbx, r14
mov edx, ebx
call sub.ADVAPI32.dll_SystemFunction036
mov ecx, eax
test al, al
sete al
add rbx, r15
cmp rbx, rsi
jae 0x140013102
test cl, cl
jne 0x1400130d0
jmp 0x140013102
xor eax, eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14001b010
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne fcn.14001b010
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
repz ret

Function at 0x14001b11a
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm8, xmm1
aesenc xmm9, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
aesenc xmm8, xmm0
aesenc xmm9, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14001b0f0
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm8, xmm1
aesenc xmm9, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
aesenclast xmm8, xmm0
aesenclast xmm9, xmm0
repz ret
Function at 0x14001c9fd
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov rax, rsp
mov rdi, rcx
mov rsi, rdx
mov rdx, r8
mov rcx, r9
mov r8, qword [rsp + 0x28]
xchg rcx, rdx
test rcx, rcx
je 0x14001cb71
lea rsp, [rsp - 0xb8]
movaps xmmword [rsp + 0x10], xmm6
movaps xmmword [rsp + 0x20], xmm7
movaps xmmword [rsp + 0x30], xmm8
movaps xmmword [rsp + 0x40], xmm9
movaps xmmword [rsp + 0x50], xmm10
movaps xmmword [rsp + 0x60], xmm11
movaps xmmword [rsp + 0x70], xmm12
movaps xmmword [rsp + 0x80], xmm13
movaps xmmword [rsp + 0x90], xmm14
movaps xmmword [rsp + 0xa0], xmm15
movdqu xmm0, xmmword [r8]
movdqa xmm8, xmmword [0x14001cda0]
sub rsi, rdi
call fcn.14001cb80
movdqa xmm6, xmm0
pshufb xmm6, xmmword [0x14001cd90]
test rcx, 1
je 0x14001caba
movdqu xmm7, xmmword [rdi]
call fcn.14001c200
pxor xmm0, xmm7
paddd xmm6, xmm8
movdqu xmmword [rsi + rdi], xmm0
sub rcx, 1
lea rdi, [rdi + 0x10]
je 0x14001cb26
movdqa xmm14, xmm6
movdqa xmm15, xmm6
paddd xmm15, xmm8
movdqa xmm1, xmmword [0x14001cd90]
movdqa xmm0, xmm14
movdqa xmm6, xmm15
pshufb xmm0, xmm1
pshufb xmm6, xmm1
call fcn.14001c360
movdqu xmm1, xmmword [rdi]
movdqu xmm2, xmmword [rdi + 0x10]
movdqa xmm3, xmmword [0x14001cdb0]
pxor xmm0, xmm1
pxor xmm6, xmm2
paddd xmm14, xmm3
paddd xmm15, xmm3
movdqu xmmword [rsi + rdi], xmm0
movdqu xmmword [rsi + rdi + 0x10], xmm6
sub rcx, 2
lea rdi, [rdi + 0x20]
jne 0x14001cac9
movaps xmm6, xmmword [rsp + 0x10]
movaps xmm7, xmmword [rsp + 0x20]
movaps xmm8, xmmword [rsp + 0x30]
movaps xmm9, xmmword [rsp + 0x40]
movaps xmm10, xmmword [rsp + 0x50]
movaps xmm11, xmmword [rsp + 0x60]
movaps xmm12, xmmword [rsp + 0x70]
movaps xmm13, xmmword [rsp + 0x80]
movaps xmm14, xmmword [rsp + 0x90]
movaps xmm15, xmmword [rsp + 0xa0]
lea rsp, [rsp + 0xb8]
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
repz ret