joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001b50
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rdi, r8
mov r14, rdx
mov rbx, rcx
mov rax, qword [0x140049030]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov ecx, 2
mov edx, 0x4000000
call fcn.14000f4e0
test rax, rax
je 0x140001c86
mov rsi, rax
mov rax, qword [rbx + 8]
lea r15, [rsp + 0x30]
mov qword [r15], rax
xorps xmm0, xmm0
movups xmmword [r15 + 8], xmm0
mov rax, qword [rbx + 0x10]
mov qword [r15 + 0x18], rax
mov qword [r15 + 0x20], 0
mov rax, qword [rbx + 0x20]
mov qword [r15 + 0x28], rax
xor r12d, r12d
mov eax, dword [r14 + 0xc]
test eax, eax
je 0x140001c8d
cmp r12d, eax
jge 0x140001c13
mov rax, qword [rsp + 0x38]
cmp rax, qword [rsp + 0x40]
jne 0x140001c13
mov eax, dword [rbx + 0x18]
mov rcx, qword [rbx]
mov r9, qword [rbx + 8]
mov dword [rsp + 0x20], eax
mov rdx, r14
mov r8d, r12d
call fcn.14000d4f0
test eax, eax
jle 0x140001c9b
add r12d, eax
mov eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov rcx, rsi
mov rdx, r15
call fcn.14000e510
mov r13d, eax
mov r8, qword [rsp + 0x50]
cmp r8, qword [rbx + 0x20]
jne 0x140001c50
mov rcx, qword [rbx + 0x10]
mov edx, 1
mov r9, rdi
call fcn.140021128
cmp rax, qword [rsp + 0x50]
jne 0x140001c94
mov qword [rsp + 0x50], 0
xor r8d, r8d
test r13d, r13d
je 0x140001bc2
mov ebp, 0x27
cmp r13d, 1
jne 0x140001ca0
mov rcx, qword [rbx + 0x10]
mov edx, 1
mov r9, rdi
call fcn.140021128
xor ecx, ecx
cmp rax, qword [rsp + 0x50]
mov ebp, 0x46
cmove ebp, ecx
jmp 0x140001ca0
mov ebp, 0x27
jmp 0x140001ca8
mov ebp, 0x28
jmp 0x140001ca0
mov ebp, 0x46
jmp 0x140001ca0
mov ebp, 6
mov rcx, rsi
call fcn.14000f5e0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140026460
mov eax, ebp
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140004010
Capabilities:
Create directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rcx
mov dx, 0x2f
call fcn.14001590c
test rax, rax
je 0x140004045
mov rsi, rax
mov word [rax], 0
mov rcx, rdi
call fcn.140004010
mov ebx, eax
test eax, eax
je 0x140004051
mov word [rsi], 0x2f
jmp 0x140004047
xor ebx, ebx
mov eax, ebx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
xor ebx, ebx
cmp word [rdi], 0
je 0x14000403e
mov rcx, rdi
call fcn.14001f454
test eax, eax
jns 0x14000403e
call fcn.14001adb0
cmp dword [rax], 0x11
je 0x14000403e
mov eax, dword [0x14004c1c8]
mov ecx, dword [0x140049f80]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400040b5
call fcn.14001adb0
mov r9d, dword [rax]
lea rcx, [0x14004bfb8]
lea rdx, str.ensure_parent_dir:_failed_to_create_directory:__S__err:__d
mov r8, rdi
call fcn.1400117c0
mov ebx, 7
jmp 0x14000403e
lea rcx, [0x14004c1c8]
call fcn.140013b60
cmp dword [0x14004c1c8], 0xffffffff
jne 0x140004090
mov qword [0x14004bfb8], 0
lea rcx, [0x14000ada0]
call fcn.140013cf8
lea rcx, [0x14004c1c8]
call fcn.140013bc8
jmp 0x140004090
Function at 0x140005ba0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov ebx, r9d
mov rsi, r8
mov edi, edx
mov r14, rcx
mov rax, qword [0x140049030]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rcx, str.MOZ_LAUNCHED_CHILD1
call fcn.14001e280
mov rcx, r14
call fcn.14001ea94
test eax, eax
je 0x140005c1a
mov eax, dword [0x14004c1c8]
mov ecx, dword [0x140049f80]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140005cd2
lea rcx, [0x14004bfb8]
lea rdx, str.Warning:_chdir_failed
call fcn.1400117c0
test bl, bl
je 0x140005c3d
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140026460
nop
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsi]
lea r9, [rsp + 0x28]
mov edx, edi
mov r8, rsi
call fcn.140035440
test eax, eax
je 0x140005c1e
mov rsi, qword [rsp + 0x28]
mov r14, qword [sym.imp.KERNEL32.dll_GetTickCount]
call r14
mov edi, eax
call r14
sub eax, edi
cmp eax, 0x270f
ja 0x140005cc2
mov r15, qword [sym.imp.KERNEL32.dll_SetLastError]
mov r12, qword [sym.imp.USER32.dll_WaitForInputIdle]
mov r13, qword [sym.imp.KERNEL32.dll_GetLastError]
mov rbp, qword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, 0x2710
sub ebx, eax
xor ecx, ecx
call r15
mov rcx, rsi
mov edx, ebx
call r12
cmp eax, 0xffffffff
jne 0x140005cc2
call r13
cmp eax, 0x5bf
jne 0x140005cc2
mov ecx, 0xa
call rbp
call r14
sub eax, edi
cmp eax, 0x2710
jb 0x140005c8c
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140005c1e
lea rcx, [0x14004c1c8]
call fcn.140013b60
cmp dword [0x14004c1c8], 0xffffffff
jne 0x140005c07
mov qword [0x14004bfb8], 0
lea rcx, [0x14000ada0]
call fcn.140013cf8
lea rcx, [0x14004c1c8]
call fcn.140013bc8
jmp 0x140005c07
Function at 0x140008550
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x248
mov rsi, rcx
mov rax, qword [0x140049030]
xor rax, rsp
mov qword [rsp + 0x240], rax
lea rcx, [rsp + 0x30]
mov r8d, 0x20a
xor edx, edx
call fcn.1400155d0
cmp byte [0x14004bda8], 0
je 0x1400085aa
lea rcx, [0x14004b360]
lea rdx, [0x140040aee]
lea r8, [rsp + 0x30]
call fcn.140012230
test eax, eax
jne 0x1400085d3
jmp 0x14000862c
lea rax, [0x140040ae2]
mov qword [rsp + 0x20], rax
lea r8, str._s_s
lea r9, [0x14004b360]
lea rcx, [rsp + 0x30]
mov edx, 0x105
call fcn.140004870
lea rdx, [0x140041420]
lea rcx, [rsp + 0x30]
call fcn.14001f324
test rax, rax
je 0x14000862c
mov rdi, rax
mov rcx, rsi
call fcn.140021cf0
mov r8d, 1
mov rcx, rsi
mov rdx, rax
mov r9, rdi
call fcn.140021128
cmp rax, 1
jne 0x140008630
cmp byte [0x14004bda8], 0
je 0x140008627
lea rcx, [0x14004b360]
call fcn.1400122c0
test eax, eax
je 0x140008630
mov sil, 1
jmp 0x140008632
xor esi, esi
jmp 0x14000863a
xor esi, esi
mov rcx, rdi
call fcn.1400207a4
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140026460
mov eax, esi
add rsp, 0x248
pop rdi
pop rsi
ret

Function at 0x140008660
Capabilities:
Copy file

Disassembly:
push rsi
sub rsp, 0x660
mov rax, qword [0x140049030]
xor rax, rsp
mov qword [rsp + 0x658], rax
mov eax, dword [0x14004c1c8]
mov ecx, dword [0x140049f80]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400087d1
mov rcx, qword [0x14004bfb8]
test rcx, rcx
je 0x1400086bb
call fcn.1400207a4
mov qword [0x14004bfb8], 0
cmp byte [0x14004bb99], 1
jne 0x1400087b7
lea rsi, [rsp + 0x440]
mov r8d, 0x20a
mov rcx, rsi
xor edx, edx
call fcn.1400155d0
lea rcx, [0x14004b360]
lea rdx, [0x140040aee]
mov r8, rsi
call fcn.140012230
test eax, eax
je 0x140008741
lea rsi, [rsp + 0x230]
mov r8d, 0x20a
mov rcx, rsi
xor edx, edx
call fcn.1400155d0
lea r8, str._supdate.status
lea r9, [0x14004b360]
mov edx, 0x105
mov rcx, rsi
call fcn.140004870
lea rcx, [rsp + 0x440]
mov rdx, rsi
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea rsi, [rsp + 0x230]
mov r8d, 0x20a
mov rcx, rsi
xor edx, edx
call fcn.1400155d0
lea rcx, [0x14004b360]
lea rdx, [0x140041066]
mov r8, rsi
call fcn.140012230
test eax, eax
je 0x1400087b7
lea rsi, [rsp + 0x20]
mov r8d, 0x20a
mov rcx, rsi
xor edx, edx
call fcn.1400155d0
lea r8, str._supdate.log
lea r9, [0x14004b360]
mov edx, 0x105
mov rcx, rsi
call fcn.140004870
lea rcx, [rsp + 0x230]
mov rdx, rsi
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov rcx, qword [rsp + 0x658]
xor rcx, rsp
call fcn.140026460
nop
add rsp, 0x660
pop rsi
ret
lea rcx, [0x14004c1c8]
call fcn.140013b60
cmp dword [0x14004c1c8], 0xffffffff
jne 0x14000869f
mov qword [0x14004bfb8], 0
lea rcx, [0x14000ada0]
call fcn.140013cf8
lea rcx, [0x14004c1c8]
call fcn.140013bc8
jmp 0x14000869f
Function at 0x14000b1c0
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x268
mov rdi, r8
mov rsi, rdx
mov r15, rcx
mov rax, qword [0x140049030]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor ebx, ebx
lea r14, [rsp + 0x50]
mov r8d, 0x20a
mov rcx, r14
xor edx, edx
call fcn.1400155d0
lea rcx, [0x14004b360]
lea rdx, [0x140040aee]
mov r8, r14
call fcn.140012230
test eax, eax
je 0x14000b354
lea rdx, [0x1400412ec]
lea rcx, [rsp + 0x50]
call fcn.14001f324
test rax, rax
je 0x14000b2fb
mov r14, rax
xorps xmm0, xmm0
lea rcx, [rsp + 0x30]
movaps xmmword [rcx + 0x10], xmm0
movaps xmmword [rcx], xmm0
mov edx, 1
mov r8d, 0x1f
mov r9, rax
call fcn.140020e94
mov r12, rax
mov rcx, r14
call fcn.14002088c
test eax, eax
sete bl
jne 0x14000b34c
mov byte [rsp + r12 + 0x30], 0
test rdi, rdi
je 0x14000b28d
cmp byte [rdi + 4], 0
je 0x14000b28d
mov byte [rdi + 4], 0
lea r13, [rsp + 0x30]
mov rcx, r13
mov edx, 0x3a
call fcn.140015760
mov r12, rax
test rax, rax
jne 0x14000b2d0
lea rcx, [rsp + 0x30]
mov edx, 0xa
call fcn.140015760
mov r12, rax
test rax, rax
jne 0x14000b2d0
lea rcx, [rsp + 0x30]
call fcn.140021cf0
lea r12, [rsp + rax]
add r12, 0x30
mov rbp, r12
sub rbp, r13
mov rcx, r15
call fcn.140021cf0
cmp rbp, rax
jne 0x14000b2ff
lea rcx, [rsp + 0x30]
mov rdx, r15
mov r8, rbp
call fcn.140021db0
test eax, eax
sete bpl
jmp 0x14000b301
xor ebx, ebx
jmp 0x14000b354
xor ebp, ebp
test rdi, rdi
je 0x14000b349
cmp byte [r12], 0x3a
jne 0x14000b349
inc r12
lea r15, [rsp + 0x28]
mov qword [r15], 0
mov rcx, r12
mov rdx, r15
mov r8d, 0xa
call fcn.140022474
cmp qword [r15], r12
je 0x14000b349
lea ecx, [rax - 0x7fffffff]
cmp ecx, 2
jb 0x14000b349
cmp byte [rdi + 4], 0
jne 0x14000b37a
mov dword [rdi], eax
mov byte [rdi + 4], 1
mov byte [rsi], bpl
mov rcx, r14
call fcn.1400207a4
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140026460
mov eax, ebx
add rsp, 0x268
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
int3
Function at 0x14000bcd0
Capabilities:
Hash data via wincrypt
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
test rdx, rdx
je 0x14000bd4d
mov rbx, r8
test r8, r8
je 0x14000bd4d
mov r14, qword [rsp + 0x80]
test r14, r14
je 0x14000bd4d
mov rsi, qword [rsp + 0x90]
test rsi, rsi
je 0x14000bd4d
mov edi, r9d
mov r8, rdx
mov r9d, r9d
mov rdx, rbx
call fcn.14000cdd0
test eax, eax
jne 0x14000bd86
mov r15d, dword [rsp + 0x88]
xor r12d, r12d
mov r13, qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov rcx, qword [r14 + r12*8]
mov rdx, rbx
mov r8d, edi
xor r9d, r9d
call r13
test eax, eax
je 0x14000bd99
inc r12
cmp r15, r12
jne 0x14000bd2d
xor eax, eax
jmp 0x14000bd76
mov ecx, 2
call fcn.140015d78
lea rcx, str.ERROR:_Invalid_parameter_specified._n
mov edx, 0x24
mov r8d, 1
mov r9, rax
call fcn.140021128
mov eax, 0xffffffff
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, 2
call fcn.140015d78
lea rdx, str.ERROR:_Could_not_read__s_n
jmp 0x14000bdaa
mov ecx, 2
call fcn.140015d78
lea rdx, str.ERROR:_Could_not_update_verify_context_for__s_n
mov rcx, rax
mov r8, rsi
call fcn.1400356a0
jmp 0x14000bd71
Function at 0x14000c810
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x140049030]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov edx, 1
mov r8d, 0x20
mov rcx, rsi
mov r9, rdi
call fcn.140020e94
mov ebx, 6
cmp rax, 0x20
jne 0x14000c8e8
mov ecx, dword [rsi + 8]
mov rbx, qword [sym.imp.WS2_32.dll_ntohl]
call rbx
mov dword [rsi + 8], eax
mov ecx, dword [rsi + 0xc]
call rbx
mov dword [rsi + 0xc], eax
mov ecx, dword [rsi + 0x10]
call rbx
mov dword [rsi + 0x10], eax
mov ecx, dword [rsi + 0x14]
call rbx
mov dword [rsi + 0x14], eax
mov ecx, dword [rsi + 0x18]
call rbx
mov dword [rsi + 0x18], eax
mov ecx, dword [rsi + 0x1c]
call rbx
mov dword [rsi + 0x1c], eax
mov rcx, rdi
call fcn.14001b18c
lea rdx, [rsp + 0x28]
mov ecx, eax
call fcn.14001b3cc
mov ebx, 6
test eax, eax
jne 0x14000c8e8
movabs rax, 0x303146464944424d
mov ebx, 0x29
cmp qword [rsi], rax
jne 0x14000c8e8
movsxd rax, dword [rsp + 0x3c]
cmp rax, 0x20
jb 0x14000c8e8
add rax, 0xffffffffffffffe0
mov ecx, dword [rsi + 0x14]
sub rax, rcx
jb 0x14000c8e8
mov ecx, dword [rsi + 0x18]
sub rax, rcx
jb 0x14000c8e8
mov ecx, dword [rsi + 0x1c]
cmp rax, rcx
jb 0x14000c8e8
xor edx, edx
cmp rax, rcx
cmove ebx, edx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140026460
mov eax, ebx
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
Function at 0x14000c900
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov qword [rsp + 0x28], r9
mov qword [rsp + 0x20], r8
mov r15, rdx
mov r14, rcx
mov ebx, dword [rcx + 8]
mov esi, dword [rcx + 0x14]
mov r12d, dword [rcx + 0x18]
add r12d, esi
add r12d, dword [rcx + 0x1c]
mov rcx, r12
call fcn.140021688
test rax, rax
je 0x14000c998
mov rdi, rax
test r12, r12
je 0x14000c97e
mov esi, 0x7fffffff
mov r13, rdi
cmp r12, rsi
mov ebp, 0x7fffffff
cmovb rbp, r12
mov edx, 1
mov rcx, r13
mov r8, rbp
mov r9, r15
call fcn.140020e94
cmp rax, rbp
jne 0x14000c9a2
add r13, rbp
sub r12, rbp
jne 0x14000c94e
mov esi, dword [r14 + 0x14]
imul eax, esi, 0xaaaaaaab
ror eax, 2
cmp eax, 0x15555555
jbe 0x14000c9ac
mov ebp, 0x29
jmp 0x14000cade
mov ebp, ntohl
jmp 0x14000cae6
mov ebp, 6
jmp 0x14000cade
test esi, esi
je 0x14000cadc
mov r13, qword [rsp + 0x20]
add rbx, r13
mov eax, esi
mov r15, rdi
add r15, rax
mov eax, dword [r14 + 0x18]
mov ecx, dword [r14 + 0x1c]
add rax, r15
add rcx, rax
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rax
mov r14, rax
mov qword [rsp + 0x30], r15
mov rsi, rdi
mov ecx, dword [rsi]
mov r12, qword [sym.imp.WS2_32.dll_ntohl]
call r12
mov dword [rsi], eax
mov ecx, dword [rsi + 4]
call r12
mov dword [rsi + 4], eax
mov ecx, dword [rsi + 8]
call r12
mov dword [rsi + 8], eax
mov eax, dword [rsi]
mov rcx, rbx
sub rcx, r13
cmp rcx, rax
jb 0x14000c98e
mov rcx, qword [rsp + 0x40]
sub rcx, r15
cmp rcx, rax
jb 0x14000c98e
test eax, eax
je 0x14000ca44
xor ecx, ecx
mov al, byte [r13 + rcx]
add byte [r15 + rcx], al
inc rcx
mov eax, dword [rsi]
cmp rcx, rax
jb 0x14000ca2f
jmp 0x14000ca46
xor eax, eax
mov r8d, eax
mov edx, 1
mov rcx, r15
mov r9, qword [rsp + 0x28]
call fcn.140021128
mov r12, rax
mov ebp, 0x40
cmp dword [rsi], r12d
jne 0x14000cade
mov r8d, dword [rsi + 4]
mov rax, qword [rsp + 0x38]
sub rax, r14
cmp rax, r8
jb 0x14000c98e
mov edx, 1
mov rcx, r14
mov r9, qword [rsp + 0x28]
call fcn.140021128
cmp dword [rsi + 4], eax
jne 0x14000cade
mov edx, r12d
add r13, rdx
movsxd rcx, dword [rsi + 8]
mov r8, qword [rsp + 0x20]
sub r8, r13
cmp r8, rcx
jg 0x14000c98e
mov r8, rbx
sub r8, r13
cmp r8, rcx
jl 0x14000c98e
add r15, rdx
mov eax, eax
add r14, rax
add r13, rcx
add rsi, 0xc
xor ebp, ebp
cmp rsi, qword [rsp + 0x30]
jb 0x14000c9e7
jmp 0x14000cade
xor ebp, ebp
mov rcx, rdi
call fcn.140021114
mov eax, ebp
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14000cb70
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x140049030]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov qword [rdx], 0
lea r8, [0x1400412ec]
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov rdx, rsi
call fcn.14001f330
mov rbx, qword [rbx]
test rbx, rbx
je 0x14000cc1b
mov qword [rdi], 0
mov ecx, 0x820
call fcn.140021688
test rax, rax
je 0x14000cc51
mov rsi, rax
mov rcx, rbx
xor edx, edx
mov r8d, 2
call fcn.14001b1bc
mov rcx, rbx
test eax, eax
je 0x14000cc5b
call fcn.140021798
mov ecx, 2
call fcn.140015d78
lea rcx, str.Warning:_MAR_size_could_not_be_determined_n
mov edx, 0x2a
mov r8d, 1
mov r9, rax
call fcn.140021128
mov r14d, 0x1f400000
jmp 0x14000cc84
mov ecx, 2
call fcn.140015d78
lea rcx, str.ERROR:_could_not_open_file_in_mar_wopen___n
mov edx, 0x2a
mov r8d, 1
mov r9, rax
call fcn.140021128
mov rcx, rsi
call fcn.14001f480
mov ebx, 1
jmp 0x14000cd5c
mov ebx, 2
jmp 0x14000cd52
call fcn.14001bdac
mov r15, rax
mov rcx, rbx
call fcn.140021798
test r15d, r15d
js 0x14000cbef
mov r14d, r15d
cmp r15d, 0x1f400001
jae 0x14000cd9b
mov rcx, r14
call fcn.140021688
mov qword [rsi], rax
test rax, rax
je 0x14000cd06
mov r15, rax
mov edx, 1
mov rcx, rax
mov r8, r14
mov r9, rbx
call fcn.140020e94
mov qword [rsi + 8], rax
mov rcx, rbx
call fcn.140020b64
cmp eax, 0xffffffff
jne 0x14000cd77
mov rcx, rbx
call fcn.14002088c
test eax, eax
je 0x14000cd39
mov ecx, 2
call fcn.140015d78
lea rcx, str.ERROR:_Failed_to_read_MAR_n
mov edx, 0x1a
mov r8d, 1
mov r9, rax
call fcn.140021128
mov rcx, qword [rsi]
call fcn.140021114
mov rcx, rsi
call fcn.140021114
mov ebx, 1
jmp 0x14000cd52
mov ebx, 2
mov ecx, 2
call fcn.140015d78
lea rcx, str.ERROR:_MAR_buffer_could_not_be_allocated_n
mov edx, 0x29
mov r8d, 1
mov r9, rax
call fcn.140021128
mov rcx, rsi
call fcn.140021114
jmp 0x14000cd52
mov rcx, rsi
add rcx, 0x10
xor ebx, ebx
mov r8d, 0x80c
xor edx, edx
call fcn.1400155d0
mov qword [rdi], rsi
mov rcx, qword [rsp + 0x20]
call fcn.1400207a4
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140026460
mov eax, ebx
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov ecx, 2
call fcn.140015d78
lea rdx, str.ERROR:_File_is_larger_than_buffer___lli__n
mov rcx, rax
mov r8, r14
call fcn.1400356a0
mov rcx, r15
jmp 0x14000ccf2
mov ecx, 2
call fcn.140015d78
lea rdx, str.ERROR:_MAR_exceeds_maximum_size___lli__n
mov rcx, rax
mov r8, r14
call fcn.1400356a0
mov rcx, rsi
call fcn.140021114
mov ebx, 3
jmp 0x14000cd52
Function at 0x14000d580
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x88
movdqa xmmword [rsp + 0x70], xmm13
movdqa xmmword [rsp + 0x60], xmm12
movdqa xmmword [rsp + 0x50], xmm11
movdqa xmmword [rsp + 0x40], xmm10
movdqa xmmword [rsp + 0x30], xmm9
movdqa xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x10], xmm7
movaps xmmword [rsp], xmm6
movdqa xmm0, xmmword [0x14003e140]
xor eax, eax
movdqa xmm1, xmmword [0x14003e150]
movdqa xmm2, xmmword [0x14003e160]
movdqa xmm3, xmmword [0x14003e170]
movdqa xmm4, xmmword [0x14003e180]
movdqa xmm5, xmmword [0x14003e190]
movdqa xmm6, xmmword [0x14003e1a0]
lea rcx, [0x14004c1e0]
movdqa xmm7, xmmword [0x14003e1b0]
movdqa xmm9, xmm0
psrld xmm9, 1
movdqa xmm8, xmm0
pslld xmm8, 0x1f
psrad xmm8, 0x1f
pand xmm8, xmm1
pxor xmm8, xmm9
movdqa xmm10, xmm8
psrld xmm10, 1
movdqa xmm9, xmm0
pslld xmm9, 0x1e
psrad xmm9, 0x1f
pand xmm9, xmm1
pxor xmm9, xmm10
movdqa xmm10, xmm9
psrld xmm10, 6
movdqa xmm11, xmm0
pslld xmm11, 0x1d
psrad xmm11, 0x1f
pand xmm11, xmm2
movdqa xmm12, xmm0
pslld xmm12, 0x1c
psrad xmm12, 0x1f
pand xmm12, xmm3
pxor xmm12, xmm11
movdqa xmm11, xmm0
pslld xmm11, 0x1b
psrad xmm11, 0x1f
pand xmm11, xmm4
movdqa xmm13, xmm0
pslld xmm13, 0x1a
psrad xmm13, 0x1f
pand xmm13, xmm5
pxor xmm13, xmm11
pxor xmm13, xmm12
pxor xmm13, xmm10
pslld xmm8, 0x1a
psrad xmm8, 0x1f
pand xmm8, xmm6
pslld xmm9, 0x1a
psrad xmm9, 0x1f
pand xmm9, xmm1
pxor xmm9, xmm13
pxor xmm9, xmm8
movdqa xmmword [rax + rcx], xmm9
paddd xmm0, xmm7
add rax, 0x10
cmp rax, 0x400
jne 0x14000d603
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
movaps xmm11, xmmword [rsp + 0x50]
movaps xmm12, xmmword [rsp + 0x60]
movaps xmm13, xmmword [rsp + 0x70]
add rsp, 0x88
ret
Function at 0x14000d750
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x18
movdqa xmmword [rsp], xmm6
movdqa xmm0, xmmword [0x14003e1c0]
xor eax, eax
movdqa xmm1, xmmword [0x14003e1d0]
movdqa xmm2, xmmword [0x14003e1e0]
lea rcx, [0x14004c5e0]
movdqa xmm3, xmmword [0x14003e1f0]
movdqa xmm4, xmm0
psrlq xmm4, 1
movdqa xmm5, xmm0
psllq xmm5, 0x3f
psrad xmm5, 0x1f
pshufd xmm5, xmm5, 0xf5
pand xmm5, xmm1
pxor xmm5, xmm4
movdqa xmm4, xmm5
psrlq xmm4, 1
movdqa xmm6, xmm0
psllq xmm6, 0x3e
psrad xmm6, 0x1f
pshufd xmm6, xmm6, 0xf5
pand xmm6, xmm1
pxor xmm6, xmm4
movdqa xmm4, xmm6
psrlq xmm4, 1
psllq xmm5, 0x3e
psrad xmm5, 0x1f
pshufd xmm5, xmm5, 0xf5
pand xmm5, xmm1
pxor xmm5, xmm4
movdqa xmm4, xmm5
psrlq xmm4, 1
psllq xmm6, 0x3e
psrad xmm6, 0x1f
pshufd xmm6, xmm6, 0xf5
pand xmm6, xmm1
pxor xmm6, xmm4
movdqa xmm4, xmm6
psrlq xmm4, 1
psllq xmm5, 0x3e
psrad xmm5, 0x1f
pshufd xmm5, xmm5, 0xf5
pand xmm5, xmm1
pxor xmm5, xmm4
movdqa xmm4, xmm5
psrlq xmm4, 1
psllq xmm6, 0x3e
psrad xmm6, 0x1f
pshufd xmm6, xmm6, 0xf5
pand xmm6, xmm1
pxor xmm6, xmm4
movdqa xmm4, xmm6
psrlq xmm4, 2
psllq xmm5, 0x3e
psrad xmm5, 0x1f
pshufd xmm5, xmm5, 0xf5
pand xmm5, xmm2
psllq xmm6, 0x3e
psrad xmm6, 0x1f
pshufd xmm6, xmm6, 0xf5
pand xmm6, xmm1
pxor xmm6, xmm4
pxor xmm6, xmm5
movdqa xmmword [rax + rcx], xmm6
paddq xmm0, xmm3
add rax, 0x10
cmp rax, 0x800
jne 0x14000d782
movaps xmm6, xmmword [rsp]
add rsp, 0x18
ret
Function at 0x14000e350
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov r14, rcx
cmp dword [rcx], 4
jne 0x14000e370
mov rax, qword [r8]
sub r9, rax
cmp r9, 5
jae 0x14000e377
xor esi, esi
jmp 0x14000e4fb
add rdx, rax
mov r13d, dword [r14 + 0x10]
add r9, 0xfffffffffffffffc
mov rax, 0xffffffffffffffff
xor esi, esi
lea rdi, [0x14003e260]
mov ebp, 0xe8
mov cl, byte [rdx + rsi]
and cl, 0xfe
cmp cl, 0xe8
jne 0x14000e3b3
mov rcx, rsi
sub rcx, rax
cmp rcx, 3
jbe 0x14000e3bb
xor r13d, r13d
jmp 0x14000e3f3
mov rcx, rsi
jmp 0x14000e4d2
dec cl
shl r13d, cl
mov eax, r13d
mov r13d, 0
and eax, 7
je 0x14000e3f3
bt ebp, eax
jb 0x14000e4c5
movzx ecx, byte [rax + rdi]
mov rbx, rsi
sub rbx, rcx
mov cl, byte [rbx + rdx + 4]
dec cl
cmp cl, 0xfe
jae 0x14000e4c5
mov r13d, eax
movzx eax, byte [rdx + rsi + 4]
lea ecx, [rax - 1]
cmp cl, 0xfe
jae 0x14000e40b
add r13d, r13d
inc r13d
jmp 0x14000e4cc
movzx ecx, byte [rdx + rsi + 1]
movzx r10d, byte [rdx + rsi + 2]
shl r10d, 8
movzx r11d, byte [rdx + rsi + 3]
shl r11d, 0x10
shl eax, 0x18
or eax, ecx
or eax, r10d
or eax, r11d
mov ecx, dword [r14 + 0xc]
add ecx, esi
mov r15d, 0xfffffffb
sub r15d, ecx
add eax, r15d
test r13d, r13d
je 0x14000e496
mov ecx, r13d
movzx r11d, byte [rcx + rdi]
shl r11d, 3
mov r10d, 0x18
sub r10d, r11d
mov r12d, eax
mov ecx, r10d
shr r12d, cl
dec r12b
cmp r12b, 0xfe
jb 0x14000e496
neg r11b
mov r12d, 0xffffffff
mov ecx, r11d
shl r12d, cl
xor eax, r12d
not eax
add eax, r15d
mov r11d, eax
mov ecx, r10d
shr r11d, cl
dec r11b
cmp r11b, 0xfd
ja 0x14000e47c
lea rcx, [rsi + 4]
mov ebx, eax
and ebx, 0x1000000
mov r10d, ebx
neg r10d
or r10d, ebx
mov byte [rdx + rsi + 1], al
mov byte [rdx + rsi + 2], ah
shr eax, 0x10
mov byte [rdx + rsi + 3], al
shr r10d, 0x18
mov byte [rdx + rsi + 4], r10b
jmp 0x14000e4cf
lea r13d, [rax + rax]
inc r13d
mov rcx, rsi
mov rax, rsi
mov rsi, rcx
inc rsi
cmp rsi, r9
jb 0x14000e397
mov rdx, rsi
sub rdx, rax
lea ecx, [rdx - 1]
shl r13d, cl
xor eax, eax
cmp rdx, 4
cmovb eax, r13d
mov dword [r14 + 0x10], eax
add qword [r8], rsi
add dword [r14 + 0xc], esi
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400116d0
Capabilities:
Get token privileges

Disassembly:
push rsi
sub rsp, 0x40
mov rax, qword [0x140049030]
xor rax, rsp
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov rcx, rax
mov edx, 8
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140011745
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x28]
mov qword [rsp + 0x20], rax
lea rsi, [rsp + 0x2c]
mov edx, 0x12
mov r8, rsi
mov r9d, 4
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
setne al
cmp dword [rsi], 3
sete sil
and sil, al
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140011747
xor esi, esi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140026460
mov eax, esi
add rsp, 0x40
pop rsi
ret

Function at 0x1400118e0
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov qword [rsp + 0x78], r9
mov qword [rsp + 0x70], r8
mov rax, qword [0x140049030]
xor rax, rsp
mov qword [rsp + 0x30], rax
cmp qword [rcx], 0
je 0x14001196f
mov rdi, rdx
mov rsi, rcx
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov r9, qword [rcx]
lea rcx, str._Warning:
mov edx, ntohl
mov r8d, 1
call fcn.140021128
mov r14, qword [rsp + 0x28]
mov rbx, qword [rsi]
call fcn.140001080
mov rcx, qword [rax]
mov qword [rsp + 0x20], r14
mov rdx, rbx
mov r8, rdi
xor r9d, r9d
call fcn.140016134
mov r9, qword [rsi]
lea rcx, str._n
mov edx, 4
mov r8d, 1
call fcn.140021128
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140026460
nop
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret