joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14019cee0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x2c], eax
cmp dword [rsp + 0x2c], 0x80
je 0x14019cf1f
cmp dword [rsp + 0x2c], 0xc0
je 0x14019cf26
cmp dword [rsp + 0x2c], 0x100
je 0x14019cf2d
jmp 0x14019cf34
mov byte [rsp + 0x20], 4
jmp 0x14019cf3e
mov byte [rsp + 0x20], 6
jmp 0x14019cf3e
mov byte [rsp + 0x20], 8
jmp 0x14019cf3e
mov eax, 0xfffffffe
jmp 0x14019d0a2
mov eax, dword [rsp + 0x60]
cmp dword [rsp + 0x58], eax
jl 0x14019cf52
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x34], eax
jmp 0x14019cf5a
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0x80
je 0x14019cf82
cmp dword [rsp + 0x30], 0xc0
je 0x14019cf8c
cmp dword [rsp + 0x30], 0x100
je 0x14019cf96
jmp 0x14019cfa0
mov dword [rsp + 0x28], 0xa
jmp 0x14019cfaa
mov dword [rsp + 0x28], ntohl
jmp 0x14019cfaa
mov dword [rsp + 0x28], reloc.WS2_32.dll_ntohl
jmp 0x14019cfaa
mov eax, 0xfffffffd
jmp 0x14019d0a2
mov eax, 0x20
imul rax, rax, 0
mov rcx, qword [rsp + 0x68]
add rcx, rax
mov rax, rcx
movzx r8d, byte [rsp + 0x20]
mov rdx, rax
mov rcx, qword [rsp + 0x50]
call fcn.14019d6d0
mov dword [rsp + 0x24], 1
jmp 0x14019cfe5
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x28]
cmp dword [rsp + 0x24], eax
jge 0x14019d050
movzx r8d, byte [rsp + 0x20]
lea rdx, str.cw
mov rcx, qword [rsp + 0x50]
call fcn.14019d8a0
movzx r8d, byte [rsp + 0x20]
xor edx, edx
mov rcx, qword [rsp + 0x50]
call fcn.14019d770
movzx edx, byte [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
call fcn.14019d930
movsxd rax, dword [rsp + 0x24]
imul rax, rax, 0x20
mov rcx, qword [rsp + 0x68]
add rcx, rax
mov rax, rcx
movzx r8d, byte [rsp + 0x20]
mov rdx, rax
mov rcx, qword [rsp + 0x50]
call fcn.14019d6d0
jmp 0x14019cfdb
movzx r8d, byte [rsp + 0x20]
lea rdx, str.cw
mov rcx, qword [rsp + 0x50]
call fcn.14019d8a0
movzx r8d, byte [rsp + 0x20]
xor edx, edx
mov rcx, qword [rsp + 0x50]
call fcn.14019d770
movsxd rax, dword [rsp + 0x28]
imul rax, rax, 0x20
mov rcx, qword [rsp + 0x68]
add rcx, rax
mov rax, rcx
movzx r8d, byte [rsp + 0x20]
mov rdx, rax
mov rcx, qword [rsp + 0x50]
call fcn.14019d6d0
xor eax, eax
add rsp, 0x48
ret
Function at 0x14019d2b0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x2c], eax
cmp dword [rsp + 0x2c], 0x80
je 0x14019d2ef
cmp dword [rsp + 0x2c], 0xc0
je 0x14019d2f6
cmp dword [rsp + 0x2c], 0x100
je 0x14019d2fd
jmp 0x14019d304
mov byte [rsp + 0x20], 4
jmp 0x14019d30e
mov byte [rsp + 0x20], 6
jmp 0x14019d30e
mov byte [rsp + 0x20], 8
jmp 0x14019d30e
mov eax, 0xfffffffe
jmp 0x14019d471
mov eax, dword [rsp + 0x60]
cmp dword [rsp + 0x58], eax
jl 0x14019d322
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x34], eax
jmp 0x14019d32a
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0x80
je 0x14019d352
cmp dword [rsp + 0x30], 0xc0
je 0x14019d35c
cmp dword [rsp + 0x30], 0x100
je 0x14019d366
jmp 0x14019d370
mov dword [rsp + 0x24], 0xa
jmp 0x14019d37a
mov dword [rsp + 0x24], ntohl
jmp 0x14019d37a
mov dword [rsp + 0x24], reloc.WS2_32.dll_ntohl
jmp 0x14019d37a
mov eax, 0xfffffffd
jmp 0x14019d471
movsxd rax, dword [rsp + 0x24]
imul rax, rax, 0x20
mov rcx, qword [rsp + 0x68]
add rcx, rax
mov rax, rcx
movzx r8d, byte [rsp + 0x20]
mov rdx, rax
mov rcx, qword [rsp + 0x50]
call fcn.14019d6d0
movzx r8d, byte [rsp + 0x20]
lea rdx, [0x1403343d0]
mov rcx, qword [rsp + 0x50]
call fcn.14019d8a0
movzx r8d, byte [rsp + 0x20]
mov dl, 1
mov rcx, qword [rsp + 0x50]
call fcn.14019d770
mov eax, dword [rsp + 0x24]
dec eax
mov dword [rsp + 0x28], eax
jmp 0x14019d3e0
mov eax, dword [rsp + 0x28]
dec eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
jle 0x14019d448
movsxd rax, dword [rsp + 0x28]
imul rax, rax, 0x20
mov rcx, qword [rsp + 0x68]
add rcx, rax
mov rax, rcx
movzx r8d, byte [rsp + 0x20]
mov rdx, rax
mov rcx, qword [rsp + 0x50]
call fcn.14019d6d0
movzx edx, byte [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
call fcn.14019daf0
movzx r8d, byte [rsp + 0x20]
lea rdx, [0x1403343d0]
mov rcx, qword [rsp + 0x50]
call fcn.14019d8a0
movzx r8d, byte [rsp + 0x20]
mov dl, 1
mov rcx, qword [rsp + 0x50]
call fcn.14019d770
jmp 0x14019d3d6
mov eax, 0x20
imul rax, rax, 0
mov rcx, qword [rsp + 0x68]
add rcx, rax
mov rax, rcx
movzx r8d, byte [rsp + 0x20]
mov rdx, rax
mov rcx, qword [rsp + 0x50]
call fcn.14019d6d0
xor eax, eax
add rsp, 0x48
ret
Function at 0x14019e1c0
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x98
mov rax, qword [0x1404e6228]
xor rax, rsp
mov qword [rsp + 0x88], rax
lea rcx, [0x140430ef8]
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
mov qword [rsp + 0x30], rax
xor edx, edx
xor ecx, ecx
call sub.api_ms_win_crt_stdio_l1_1_0.dll__getcwd
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x14019e206
xor al, al
jmp 0x14019e280
mov rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x48]
call fcn.1400a4430
nop
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x68]
call fcn.1400a4430
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x48]
call fcn.1400f3590
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x68]
call fcn.140088270
cmp qword [rsp + 0x40], 0xffffffffffffffff
je 0x14019e269
mov byte [rsp + 0x20], 1
lea rcx, [rsp + 0x48]
call fcn.140088270
movzx eax, byte [rsp + 0x20]
jmp 0x14019e280
mov rcx, qword [rsp + 0x28]
call fcn.1402f8b10
nop
lea rcx, [rsp + 0x48]
call fcn.140088270
xor al, al
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.1401a6870
add rsp, 0x98
ret

Function at 0x14019e2a0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xb8
mov rax, qword [0x1404e6228]
xor rax, rsp
mov qword [rsp + 0xa8], rax
mov dword [rsp + 0x20], 0
lea rdx, [0x140334560]
lea rcx, [rsp + 0x48]
call fcn.1400a4430
nop
lea rcx, [0x140334568]
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
mov qword [rsp + 0x28], rax
mov rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x88]
call fcn.1400a4430
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
lea r8, [0x140334578]
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x68]
call fcn.1400db3e0
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x48]
call fcn.140088650
lea rcx, [rsp + 0x68]
call fcn.140088270
nop
lea rcx, [rsp + 0x88]
call fcn.140088270
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0xc0]
call fcn.1400a42f0
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x48]
call fcn.140088270
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.1401a6870
add rsp, 0xb8
ret
Function at 0x14019e450
Capabilities:
Terminate process

Disassembly:
mov byte [rsp + 0x10], dl
mov qword [rsp + 8], rcx
sub rsp, 0xd8
mov rax, qword [0x1404e6228]
xor rax, rsp
mov qword [rsp + 0xc8], rax
lea rcx, [rsp + 0x68]
call fcn.140087860
nop
lea rcx, [rsp + 0xa8]
call fcn.14019e3a0
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
lea r8, [0x140430ed8]
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x88]
call fcn.1400db3e0
nop
lea rcx, [rsp + 0xa8]
call fcn.140088270
lea rcx, [rsp + 0x88]
call fcn.1400bcdf0
lea rdx, [rsp + 0x68]
mov rcx, rax
call fcn.14019ddf0
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x14019e527
movzx eax, byte [rsp + 0xe8]
test eax, eax
je 0x14019e500
mov ecx, 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
nop
jmp 0x14019e527
mov byte [rsp + 0x21], 0
lea rcx, [rsp + 0x88]
call fcn.140088270
nop
lea rcx, [rsp + 0x68]
call fcn.140088270
movzx eax, byte [rsp + 0x21]
jmp 0x14019e5c3
lea rax, [rsp + 0x48]
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x68]
mov rcx, qword [rsp + 0x38]
call fcn.140087760
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0x40]
call fcn.14019ec60
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x14019e5a1
movzx eax, byte [rsp + 0xe8]
test eax, eax
je 0x14019e57d
mov ecx, 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
nop
jmp 0x14019e5a1
mov byte [rsp + 0x22], 0
lea rcx, [rsp + 0x88]
call fcn.140088270
nop
lea rcx, [rsp + 0x68]
call fcn.140088270
movzx eax, byte [rsp + 0x22]
jmp 0x14019e5c3
mov byte [rsp + 0x23], 1
lea rcx, [rsp + 0x88]
call fcn.140088270
nop
lea rcx, [rsp + 0x68]
call fcn.140088270
movzx eax, byte [rsp + 0x23]
mov rcx, qword [rsp + 0xc8]
xor rcx, rsp
call fcn.1401a6870
add rsp, 0xd8
ret

Function at 0x1401a30f0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rcx, qword [rsp + 0x78]
call fcn.140084510
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1401a3c30
mov qword [rsp + 0x38], rax
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x30]
call fcn.1401a2a80
nop
lea rcx, [rsp + 0x40]
call fcn.1401a2490
lea rax, [0x1401a2f90]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x70]
add rax, 8
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x30]
call fcn.1401a2520
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rsp + 0x50]
xor edx, edx
xor ecx, ecx
call sub.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex
mov rcx, qword [rsp + 0x70]
mov qword [rcx], rax
mov rax, qword [rsp + 0x70]
cmp qword [rax], 0
je 0x1401a319a
lea rcx, [rsp + 0x30]
call fcn.1401a2540
jmp 0x1401a31b1
mov rax, qword [rsp + 0x70]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.1402d4c38
nop
lea rcx, [rsp + 0x30]
call fcn.1401a2490
add rsp, 0x68
ret

Function at 0x1401c3770
Capabilities:
Set thread local storage value

Disassembly:
mov eax, 0x28
call fcn.1401a6810
sub rsp, rax
mov ecx, dword [rcx]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x28
ret
Function at 0x1401c6d30
Capabilities:
Query environment variable

Disassembly:
push rbx
mov eax, 0x20
call fcn.1401a6810
sub rsp, rax
mov rbx, rcx
call fcn.1400c9480
test eax, eax
je 0x1401c6d53
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
Function at 0x1401d29a0
Capabilities:
Encode data using base64

Disassembly:
mov eax, 0x28
call fcn.1401a6810
sub rsp, rax
mov r9d, r8d
mov r8, rdx
mov rdx, rcx
xor ecx, ecx
add rsp, 0x28
jmp fcn.1401d2d60

Function at 0x1401e37c0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x38
call fcn.1401a6810
sub rsp, rax
mov r10, r8
mov r11, rcx
test r9, r9
jne 0x1401e37ff
mov edx, 0xe2
mov dword [rsp + 0x20], 0x9a
lea r9, str.crypto_asn1_a_int.c
lea ecx, [rax - 0x2b]
lea r8d, [rdx - 4]
call fcn.1401b3690
xor eax, eax
add rsp, 0x38
ret
movzx r8d, byte [r8]
and r8d, 0x80
test rdx, rdx
je 0x1401e3812
mov dword [rdx], r8d
cmp r9, 1
jne 0x1401e3834
test r11, r11
je 0x1401e382a
movzx eax, byte [r10]
test r8d, r8d
je 0x1401e3828
neg al
mov byte [rcx], al
mov eax, 1
add rsp, 0x38
ret
movzx ecx, byte [r10]
mov qword [rsp + 0x40], rbx
xor ebx, ebx
mov eax, ebx
test cl, cl
jne 0x1401e3851
mov eax, 1
mov ebx, eax
jmp 0x1401e38ff
cmp cl, 0xff
jne 0x1401e393d
mov eax, 1
lea rcx, [r9 - 1]
mov edx, ebx
cmp r9, rax
jbe 0x1401e38ef
cmp rcx, 8
jb 0x1401e38e0
and ecx, 7
mov rdx, r9
sub rdx, rcx
xorps xmm2, xmm2
xorps xmm3, xmm3
movd xmm1, dword [rax + r10]
xorps xmm0, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
por xmm2, xmm1
movd xmm1, dword [rax + r10 + 4]
punpcklbw xmm1, xmm0
add rax, 8
punpcklwd xmm1, xmm0
por xmm1, xmm3
movdqa xmm3, xmm1
cmp rax, rdx
jb 0x1401e3883
por xmm2, xmm1
movdqa xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movd edx, xmm2
cmp rax, r9
jae 0x1401e38ef
nop
movzx ecx, byte [rax + r10]
inc rax
or edx, ecx
cmp rax, r9
jb 0x1401e38e0
test edx, edx
mov eax, ebx
setne al
test edx, edx
setne bl
test edx, edx
je 0x1401e393d
movzx ecx, byte [r10 + 1]
and ecx, 0x80
cmp r8d, ecx
jne 0x1401e393d
mov edx, 0xe2
mov dword [rsp + 0x20], 0xbb
lea r9, str.crypto_asn1_a_int.c
mov ecx, reloc.WS2_32.dll_listen
lea r8d, [rdx - 5]
call fcn.1401b3690
mov rbx, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x38
ret
mov ecx, eax
sub r9, rcx
test r11, r11
je 0x1401e3991
neg r8d
mov qword [rsp + 0x30], rdi
lea r8, [rbx + r10]
sbb edi, edi
add r8, r9
movzx edi, dil
mov ecx, edi
and ecx, 1
test r9, r9
je 0x1401e398c
mov rdx, r8
sub rdx, rbx
sub rdx, r10
nop
movzx eax, byte [r8 - 1]
lea r8, [r8 - 1]
dec rdx
xor eax, edi
add ecx, eax
mov byte [rdx + r11], cl
shr ecx, 8
test rdx, rdx
jne 0x1401e3970
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
mov rax, r9
add rsp, 0x38
ret

Function at 0x1401f4fd0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, 0x28
call fcn.1401a6810
sub rsp, rax
lea rcx, [0x1404fdb04]
add rsp, 0x28
jmp fcn.1401c35d0
Function at 0x140270ad0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x38
call fcn.1401a6810
sub rsp, rax
cmp dword [rsp + 0x68], 0
je 0x140270af9
lea rax, [0x14026f130]
mov qword [rsp + 0x68], rax
add rsp, 0x38
jmp fcn.140268520
lea rax, [0x14026e2e0]
mov qword [rsp + 0x68], rax
add rsp, 0x38
jmp fcn.140268260
Function at 0x1402d2480
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
push r14
push r15
sub rsp, 0x20
mov r15, rdx
mov r14, rcx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov edi, eax
mov eax, 1
test edi, edi
cmove edi, eax
mov r8d, edi
mov eax, 2
mul r8
mov rbx, 0xffffffffffffffff
cmovo rax, rbx
mov rcx, rax
call fcn.1401a6a04
mov rsi, rax
mov qword [rsp + 0x40], rax
mov rdx, rax
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor edi, edi
test eax, eax
jne 0x1402d2508
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1402d2508
lea r8, str.boost::filesystem::current_path
mov rdx, r15
mov ecx, eax
call fcn.1402d3cb0
jmp 0x1402d251f
test r15, r15
je 0x1402d251f
mov dword [r15], edi
mov byte [r15 + 4], dil
lea rax, [0x14031ad80]
mov qword [r15 + 8], rax
mov qword [r14], rdi
mov qword [r14 + 0x10], rdi
mov qword [r14 + 0x18], 7
mov word [r14], di
inc rbx
cmp word [rsi + rbx*2], di
jne 0x1402d2532
mov r8, rbx
mov rdx, rsi
mov rcx, r14
call fcn.1402ce6c0
nop
mov rcx, rsi
call fcn.1401a66fc
mov rax, r14
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x1402d2cc0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0xb0
mov rax, qword [0x1404e6228]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov r15, r8
mov rsi, rdx
mov rdi, rcx
xor r14d, r14d
test r8, r8
je 0x1402d2d07
mov dword [r8], r14d
mov byte [r8 + 4], r14b
lea rax, [0x14031ad80]
mov qword [r8 + 8], rax
mov rcx, rsi
cmp qword [rdx + 0x18], 8
jb 0x1402d2d14
mov rcx, qword [rdx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebp, eax
cmp eax, 0xffffffff
jne 0x1402d2d34
mov r8, r15
mov rdx, rsi
mov rcx, rdi
call fcn.1402d2800
jmp 0x1402d2eb5
mov edx, ebp
mov rcx, rsi
call fcn.1402d26d0
mov r12d, eax
bt ebp, 0xa
jae 0x1402d2e8b
mov rcx, rsi
call fcn.1402d25f0
test al, al
jne 0x1402d2d62
mov dword [rdi], 9
jmp 0x1402d2eb1
mov rdx, rsi
cmp qword [rsi + 0x18], 8
jb 0x1402d2d6f
mov rdx, qword [rsi]
mov qword [rsp + 0x48], r14
movdqa xmm0, xmmword [0x1404a7490]
movdqu xmmword [rsp + 0x58], xmm0
mov word [rsp + 0x48], r14w
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rdx + r8*2], r14w
jne 0x1402d2d90
lea rcx, [rsp + 0x48]
call fcn.1402ce6c0
nop
lea rcx, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rcx, qword [rsp + 0x48]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x1402d2e25
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1402d2e1f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1402d2eda
call fcn.1401a66fc
nop
movdqa xmm0, xmmword [0x1404a7490]
movdqu xmmword [rsp + 0x58], xmm0
mov word [rsp + 0x48], r14w
cmp rbx, 0xffffffffffffffff
jne 0x1402d2e50
mov r8, r15
mov rdx, rsi
mov rcx, rdi
call fcn.1402d2800
nop
jmp 0x1402d2eb5
lea rdx, [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
jne 0x1402d2e7d
mov r8, r15
mov rdx, rsi
mov rcx, rdi
call fcn.1402d2800
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x1402d2eb5
mov ebp, dword [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
and ebp, 0x10
je 0x1402d2e96
mov eax, dword [rsp + 0x40]
jmp 0x1402d2e9e
mov eax, r12d
mov r12d, dword [rsp + 0x40]
test ebp, ebp
setne r14b
add r14d, 2
mov dword [rdi], r14d
test ebp, ebp
cmove r12d, eax
mov dword [rdi + 4], r12d
mov rax, rdi
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1401a6870
add rsp, 0xb0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
call sub.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn
nop
Function at 0x1402fd3f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
add r8d, 0xdeadbeef
mov rdi, rdx
add r8d, edx
mov r11, rcx
mov r10d, r8d
mov ebx, r8d
cmp rdx, 0xc
jbe 0x1402fd523
mov qword [rsp + 0x10], rsi
lea r9, [rdx - 0xd]
movabs rax, 0xaaaaaaaaaaaaaaab
mul r9
mov rsi, rdx
shr rsi, 3
inc rsi
imul rax, rsi, 0xfffffffffffffff4
add rdi, rax
nop dword [rax]
movzx eax, byte [r11 + 6]
movzx ecx, byte [r11 + 7]
movzx r9d, byte [r11 + 4]
movzx edx, byte [r11 + 8]
add r9d, r10d
shl ecx, 8
add edx, r8d
add ecx, eax
movzx eax, byte [r11 + 5]
shl ecx, 8
add ecx, eax
movzx eax, byte [r11 + 0xa]
shl ecx, 8
add r9d, ecx
movzx ecx, byte [r11 + 0xb]
shl ecx, 8
add ecx, eax
movzx eax, byte [r11 + 9]
shl ecx, 8
add ecx, eax
movzx eax, byte [r11 + 2]
shl ecx, 8
add edx, ecx
movzx ecx, byte [r11 + 3]
shl ecx, 8
mov r8d, edx
add ecx, eax
rol r8d, 4
movzx eax, byte [r11 + 1]
shl ecx, 8
add ecx, eax
movzx eax, byte [r11]
shl ecx, 8
add r11, 0xc
add ecx, eax
sub ecx, edx
add edx, r9d
add ecx, ebx
xor r8d, ecx
sub r9d, r8d
mov eax, r8d
add r8d, edx
rol eax, 6
xor eax, r9d
sub edx, eax
mov ecx, eax
add eax, r8d
rol ecx, 8
xor ecx, edx
sub r8d, ecx
mov ebx, ecx
add ecx, eax
rol ebx, 0x10
xor ebx, r8d
sub eax, ebx
mov r10d, ebx
ror r10d, 0xd
add ebx, ecx
xor r10d, eax
sub ecx, r10d
mov r8d, r10d
rol r8d, 4
add r10d, ebx
xor r8d, ecx
sub rsi, 1
jne 0x1402fd440
mov rsi, qword [rsp + 0x10]
cmp rdi, 0xc
ja 0x1402fd5ac
lea rcx, [0x140000000]
mov eax, dword [rcx + rdi*4 + 0x2fd60c]
add rax, rcx
jmp rax
movzx eax, byte [r11 + 0xb]
shl eax, 0x18
add r8d, eax
movzx eax, byte [r11 + 0xa]
shl eax, 0x10
add r8d, eax
movzx eax, byte [r11 + 9]
shl eax, 8
add r8d, eax
movzx eax, byte [r11 + 8]
add r8d, eax
movzx eax, byte [r11 + 7]
shl eax, 0x18
add r10d, eax
movzx eax, byte [r11 + 6]
shl eax, 0x10
add r10d, eax
movzx eax, byte [r11 + 5]
shl eax, 8
add r10d, eax
movzx eax, byte [r11 + 4]
add r10d, eax
movzx eax, byte [r11 + 3]
shl eax, 0x18
add ebx, eax
movzx eax, byte [r11 + 2]
shl eax, 0x10
add ebx, eax
movzx eax, byte [r11 + 1]
shl eax, 8
add ebx, eax
movzx eax, byte [r11]
add ebx, eax
xor r8d, r10d
mov eax, r10d
rol eax, 0xe
sub r8d, eax
mov eax, r8d
mov edx, r8d
rol eax, 0xb
xor edx, ebx
sub edx, eax
xor r10d, edx
mov eax, edx
ror eax, 7
sub r10d, eax
xor r8d, r10d
mov eax, r10d
rol eax, 0x10
sub r8d, eax
mov eax, r8d
mov ecx, r8d
rol eax, 4
xor ecx, edx
sub ecx, eax
xor r10d, ecx
mov eax, ecx
rol eax, 0xe
sub r10d, eax
mov eax, r10d
xor r8d, r10d
ror eax, 8
sub r8d, eax
mov rbx, qword [rsp + 0x18]
mov eax, r8d
pop rdi
ret
Function at 0x140001d31
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x148
mov qword [rcx], 0
mov r13, rcx
lea r12, [rsp + 0x120]
mov qword [rcx + 8], 0
mov qword [rcx + 0x10], 0
lea rcx, str.APPDATA
call sub.msvcrt.dll_getenv
lea rcx, str.LOCALAPPDATA
mov r14, rax
call sub.msvcrt.dll_getenv
mov rdx, r14
mov rcx, r12
mov r15, rax
call fcn.140001850
lea rax, [rsp + 0x40]
lea r8, str.Discord
mov rdx, r12
mov rcx, rax
mov qword [rsp + 0x28], rax
call fcn.1400d8a00
mov rcx, r12
call fcn.1400b3ac0
mov rdx, r14
mov rcx, r12
call fcn.140001850
lea rax, [rsp + 0x60]
lea r8, str.discordcanary
mov rdx, r12
mov rcx, rax
mov qword [rsp + 0x30], rax
call fcn.1400d8a00
mov rcx, r12
call fcn.1400b3ac0
mov rdx, r14
mov rcx, r12
call fcn.140001850
lea rax, [rsp + 0x80]
lea r8, str.discordptb
mov rdx, r12
mov rcx, rax
mov qword [rsp + 0x38], rax
call fcn.1400d8a00
mov rcx, r12
call fcn.1400b3ac0
mov rdx, r14
mov rcx, r12
call fcn.140001850
lea rbx, [rsp + 0xa0]
lea r8, str.Opera_SoftwareOpera_Stable
mov rdx, r12
mov rcx, rbx
call fcn.1400d8a00
mov rcx, r12
call fcn.1400b3ac0
mov rdx, r15
mov rcx, r12
call fcn.140001850
lea rsi, [rsp + 0xc0]
lea r8, str.GoogleChromeUser_DataDefault
mov rdx, r12
mov rcx, rsi
call fcn.1400d8a00
mov rcx, r12
call fcn.1400b3ac0
mov rdx, r15
mov rcx, r12
call fcn.140001850
lea rdi, [rsp + 0xe0]
lea r8, str.BraveSoftwareBrave_BrowserUser_DataDefault
mov rdx, r12
mov rcx, rdi
call fcn.1400d8a00
mov rcx, r12
call fcn.1400b3ac0
mov rdx, r15
mov rcx, r12
call fcn.140001850
lea rbp, [rsp + 0x100]
lea r8, str.YandexYandexBrowserUser_DataDefault
mov rdx, r12
mov rcx, rbp
call fcn.1400d8a00
mov rcx, r12
call fcn.1400b3ac0
mov rdx, qword [rsp + 0x28]
mov rcx, r13
call fcn.1400b1bc0
mov rdx, qword [rsp + 0x30]
mov rcx, r13
call fcn.1400b1bc0
mov rdx, qword [rsp + 0x38]
mov rcx, r13
call fcn.1400b1bc0
mov rdx, rbx
mov rcx, r13
call fcn.1400b1bc0
mov rdx, rsi
mov rcx, r13
call fcn.1400b1bc0
mov rdx, rdi
mov rcx, r13
call fcn.1400b1bc0
mov rdx, rbp
mov rcx, r13
call fcn.1400b1bc0
mov rcx, r15
call fcn.1400190f8
mov rcx, r14
call fcn.1400190f8
mov rcx, rbp
call fcn.1400b3ac0
mov rcx, rdi
call fcn.1400b3ac0
mov rcx, rsi
call fcn.1400b3ac0
mov rcx, rbx
call fcn.1400b3ac0
mov rcx, qword [rsp + 0x38]
call fcn.1400b3ac0
mov rcx, qword [rsp + 0x30]
call fcn.1400b3ac0
mov rcx, qword [rsp + 0x28]
call fcn.1400b3ac0
mov rax, r13
add rsp, 0x148
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14000cb30
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.1400197a0
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call fcn.1400197a0
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]