joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140011010
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
mov rax, rdx
sub rdx, rcx
cmp rdx, 0x20
jae 0x140011035
cmp rax, rcx
je 0x14001103b
cmp rdx, 4
jae 0x14001103f
xor eax, eax
xor r8d, r8d
jmp 0x1400110d0
pop rbp
jmp fcn.140007000
xor eax, eax
pop rbp
ret
mov r8d, edx
and r8d, 0x1c
pxor xmm0, xmm0
xor eax, eax
movdqa xmm2, xmmword [0x140040540]
movdqa xmm3, xmmword [0x140040550]
pxor xmm1, xmm1
movzx r9d, word [rcx + rax]
movd xmm4, r9d
movzx r9d, word [rcx + rax + 2]
movd xmm5, r9d
pcmpgtb xmm4, xmm2
punpcklbw xmm4, xmm4
pshuflw xmm4, xmm4, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm0, xmm4
pcmpgtb xmm5, xmm2
punpcklbw xmm5, xmm5
pshuflw xmm4, xmm5, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm1, xmm4
add rax, 4
cmp r8, rax
jne 0x140011060
paddq xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddq xmm0, xmm1
movq rax, xmm0
cmp r8, rdx
je 0x1400110e7
nop dword [rax]
xor r9d, r9d
cmp byte [rcx + r8], 0xc0
setge r9b
add rax, r9
inc r8
cmp rdx, r8
jne 0x1400110d0
pop rbp
ret

Function at 0x140015350
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov rsi, rcx
movups xmm0, xmmword [0x140045350]
movaps xmmword [rbp], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
mov rax, rbp
mov qword [rsp + 0x20], rax
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x1400153c1
mov rcx, rsi
mov edx, 0xffffffff
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [rbp]
cmp eax, 0x103
je 0x1400153ee
test eax, eax
js 0x1400153cd
mov rdx, qword [rbp + 8]
xor eax, eax
jmp 0x1400153e4
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xa8
pop rsi
pop rbp
ret
mov dword [rbp + 0x18], 0
mov byte [rbp + 0x1c], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
lea rax, [rbp + 0x20]
mov qword [rbp - 0x28], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rcx, [rbp + 0x18]
lea rdx, [rbp - 0x38]
call fcn.140014b90
mov qword [rbp - 8], rax
lea rcx, [rbp - 8]
call fcn.140014c30
mov ecx, 7
int 0x29
ud2
Function at 0x140018520
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3d0], rcx
mov qword [rbp + 0x3d8], 0
mov qword [rbp + 0x3e0], 2
mov qword [rbp + 0x3e8], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3c8], rax
xor esi, esi
xor edi, edi
xor ebx, ebx
cmp r8, 0x201
jae 0x1400185c0
jmp 0x1400185af
jae 0x14001867f
cmp r8, 0x201
jae 0x1400185c0
mov r14d, 0x200
lea r15, [rbp - 0x58]
mov r12, r8
jmp 0x140018617
sub r8, rbx
sub rdi, rbx
cmp rdi, r8
jae 0x1400185ef
lea rcx, [rbp + 0x3d8]
mov rdx, rbx
call fcn.14003efa0
mov rsi, qword [rbp + 0x3d8]
mov rax, qword [rbp + 0x3e0]
mov qword [rbp + 0x3c8], rax
mov eax, 0xffffffff
cmp rsi, rax
mov ebx, 0xffffffff
cmovb rbx, rsi
mov qword [rbp + 0x3e8], rbx
mov rdi, rsi
mov r14, rbx
mov r15, qword [rbp + 0x3c8]
mov r12, rbx
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov ecx, r12d
mov rdx, r15
call qword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
mov r13d, eax
test eax, eax
jne 0x140018640
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x1400186e8
mov r8d, r13d
cmp r12, r8
jne 0x1400185a0
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14001871a
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x1400185af
jmp 0x1400185c0
cmp r14, r8
jb 0x140018734
lea rcx, [rbp + 0x3a8]
mov rdx, r15
call fcn.140018f60
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rax, qword [rbp + 0x3d0]
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
cmp qword [rbp + 0x3d8], 0
je 0x1400186d3
mov r8, qword [rbp + 0x3e0]
mov rcx, qword [0x140056ba0]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
nop
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rcx, qword [rbp + 0x3d0]
mov qword [rcx + 8], rax
movabs rax, 0x8000000000000000
mov qword [rcx], rax
cmp qword [rbp + 0x3d8], 0
jne 0x1400186bd
jmp 0x1400186d3
lea rcx, str.internal_error:_entered_unreachable_code
lea r8, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.14003e3f0
jmp 0x140018749
lea rax, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, r14
mov r8, rax
call fcn.14003e3e0
ud2
Function at 0x140025b10
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov rsi, rcx
lea rcx, [rbp - 0x28]
call fcn.14001acb0
mov rcx, qword [rbp - 0x28]
mov rax, qword [rbp - 0x20]
movabs rbx, 0x8000000000000000
cmp rcx, rbx
jne 0x140025b4e
mov qword [rbp - 8], rax
mov qword [rbp - 0x10], rbx
jmp 0x140025b74
mov rdx, qword [rbp - 0x18]
mov qword [rbp - 0x40], rcx
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rdx
lea rcx, [rbp - 0x10]
lea rdx, [rbp - 0x40]
call fcn.140025a30
mov r14, qword [rbp - 0x10]
cmp r14, rbx
jne 0x140025b8d
lea rcx, [rbp - 8]
call fcn.140014c50
mov qword [rsi], rbx
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
mov rdi, qword [rbp - 8]
mov r15, qword [rbp]
mov rcx, rdi
call qword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140025bb0
mov qword [rsi], r14
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], r15
jmp 0x140025b80
mov qword [rsi], rbx
test r14, r14
je 0x140025b80
mov rcx, qword [0x140056ba0]
xor edx, edx
mov r8, rdi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
jmp qword [sym.imp.kernel32.dll_HeapFree]
Function at 0x140030334
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
test rax, rax
je 0x14003037e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14003037e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14003037e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14003037e
cmp dword [rcx + 0x84], 0xe
jbe 0x14003037e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140030380
xor al, al
add rsp, 0x28
ret

Function at 0x1400339ec
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140033a5b
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
test rax, rax
je 0x140033a5b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140033a5b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140033a5b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140033a5b
cmp dword [rcx + 0x84], 0xe
jbe 0x140033a5b
cmp dword [rcx + 0xf8], 0
je 0x140033a5b
mov ecx, ebx
call fcn.140033b18
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.1400338e8
nop
cmp dword [rbp + 0x20], 0
je 0x140033aa9
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140033ab4
int3
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x1400339ec

Function at 0x140033bfc
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400339ec
Function at 0x140036c60
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.kernel32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x140036c90
xor eax, eax
jmp 0x140036d53
mov rbp, rbx
cmp word [rax], si
je 0x140036cb5
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x140036c9c
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x140036c98
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.140036bb0
movsxd r14, eax
test eax, eax
jne 0x140036cf3
mov rcx, rbx
call qword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
jmp 0x140036c89
mov rcx, r14
call fcn.140037b14
mov rdi, rax
test rax, rax
jne 0x140036d0c
xor ecx, ecx
call fcn.140035240
jmp 0x140036ce8
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.140036bb0
test eax, eax
jne 0x140036d3d
mov rcx, rdi
call fcn.140035240
jmp 0x140036d47
xor ecx, ecx
call fcn.140035240
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x14003a21c
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.140035cb4
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x14003a2a6
cmp byte [rbp - 0x21], r15b
je 0x14003a2a1
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x14003a2dc
call fcn.140038334
test eax, eax
jne 0x14003a2c8
cmp byte [rbp - 0x21], r15b
je 0x14003a2c0
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x14003a2dc
cmp byte [rbp - 0x21], r15b
je 0x14003a2d9
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.140035290
test eax, eax
jne 0x14003a37c
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.140035cb4
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x14003a31b
cmp byte [rbp - 0x21], r15b
je 0x14003a350
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x14003a350
call fcn.140038334
test eax, eax
jne 0x14003a33c
cmp byte [rbp - 0x21], r15b
je 0x14003a335
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x14003a350
cmp byte [rbp - 0x21], r15b
je 0x14003a34d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.140035290
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x14003a37c
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.kernel32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x14003a37f
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x14003a38d
mov rcx, rdi
call fcn.140035240
cmp byte [rbp + 0x3f], r15b
je 0x14003a39c
mov rcx, qword [rbp + 0x27]
call fcn.140035240
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14003d2a0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14003d2c8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14003d2c8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140009f00
Capabilities:
Shutdown system

Disassembly:
sub rsp, 0x58
mov rax, qword [0x14005e0c0]
xor rax, rsp
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140009fba
lea r8, [rsp + 0x3c]
xor ecx, ecx
lea rdx, str.SeShutdownPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rcx, qword [rsp + 0x30]
test eax, eax
jne 0x140009f69
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400226b0
add rsp, 0x58
ret
xor eax, eax
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x38]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor edx, edx
mov dword [rsp + 0x44], 2
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x30]
test eax, eax
jne 0x140009f51
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0x80000000
mov ecx, 6
call qword [sym.imp.USER32.dll_ExitWindowsEx]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400226b0
add rsp, 0x58
ret

Function at 0x14000b1a0
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
xor esi, esi
mov dword [rsp + 0x30], esi
cmp qword [rcx + 0x18], 0xf
jbe 0x14000b1bf
mov rcx, qword [rcx]
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rsi
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [rcx + r8], sil
jne 0x14000b1e0
mov rdx, rcx
lea rcx, [rsp + 0x38]
call fcn.14001b320
nop
mov dword [rsp + 0x30], 1
lea r8, [rsp + 0x38]
cmp qword [rsp + 0x50], 0xf
cmova r8, qword [rsp + 0x38]
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
mov r9d, dword [rsp + 0x48]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rdi, eax
lea rcx, [rdi + 1]
mov eax, 2
mul rcx
cmovb rax, rbx
mov rcx, rax
call fcn.140022bf4
mov rbx, rax
lea r8, [rsp + 0x38]
cmp qword [rsp + 0x50], 0xf
cmova r8, qword [rsp + 0x38]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x48]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov word [rbx + rdi*2], si
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14000b293
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x14000b293
xor bl, bl
jmp 0x14000b295
mov bl, 1
mov rdx, qword [rsp + 0x50]
cmp rdx, 0xf
jbe 0x14000b2ce
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b2c9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b2e6
call fcn.1400226d0
test bl, bl
setne al
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
call fcn.140030640
int3
Function at 0x14000b2f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
cmp qword [rcx + 0x18], 0xf
jbe 0x14000b2fe
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14000b313
shr eax, 4
and al, 1
add rsp, 0x28
ret
xor al, al
add rsp, 0x28
ret
Function at 0x14000b740
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x14005e0c0]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rsi, rcx
mov qword [rsp + 0x28], rcx
xor r15d, r15d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov ebp, eax
xorps xmm0, xmm0
test eax, eax
jne 0x14000b7a7
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], r15
xor r8d, r8d
lea rdx, [0x14005644d]
mov rcx, rsi
call fcn.14001b320
jmp 0x14000b893
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r15
lea r14, [rbp*2]
test r14, r14
jne 0x14000b7c4
mov rdi, r15
jmp 0x14000b801
cmp r14, 0x1000
jb 0x14000b7f6
lea rcx, [r14 + 0x27]
cmp rcx, r14
jbe 0x14000b993
call fcn.140022978
test rax, rax
je 0x14000b98d
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14000b801
mov rcx, r14
call fcn.140022978
mov rdi, rax
mov qword [rsp + 0x50], rdi
lea rbx, [r14 + rdi]
mov qword [rsp + 0x60], rbx
mov r8, r14
xor edx, edx
mov rcx, rdi
call fcn.1400478a0
mov qword [rsp + 0x58], rbx
mov rdx, rdi
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x14000b8bd
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], r15
xor r8d, r8d
lea rdx, [0x14005644d]
mov rcx, rsi
call fcn.14001b320
nop
test rdi, rdi
je 0x14000b893
sub rbx, rdi
sar rbx, 1
add rbx, rbx
mov rax, rdi
cmp rbx, 0x1000
jb 0x14000b888
add rbx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b98d
mov rdx, rbx
mov rcx, rdi
call fcn.1400226d0
mov rax, rsi
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400226b0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.140016d10
nop
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 7
cmova rdx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
lea r8, [rdx + rax*2]
lea rdx, [rsp + 0x30]
cmova rdx, qword [rsp + 0x30]
mov rcx, rsi
call fcn.14001a740
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x14000b937
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b932
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b987
call fcn.1400226d0
movdqa xmm0, xmmword [0x1400568b0]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x30], r15w
test rdi, rdi
je 0x14000b893
sub rbx, rdi
sar rbx, 1
add rbx, rbx
mov rax, rdi
cmp rbx, 0x1000
jb 0x14000b888
add rbx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b98d
jmp 0x14000b888
call fcn.140030640
nop
call fcn.140030640
int3
call fcn.1400012a0
int3
Function at 0x14000cd30
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov eax, 0x13e0
call fcn.140023270
sub rsp, rax
mov rax, qword [0x14005e0c0]
xor rax, rsp
mov qword [rsp + 0x13d0], rax
mov r14, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rdx
xor r15d, r15d
mov dword [rsp + 0x20], r15d
call fcn.140021d30
mov edx, eax
mov dword [rsp + 0x13c4], 0xffffffff
mov dword [rsp + 0x44], eax
mov ecx, 1
nop
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [rsp + rcx*4 + 0x44], edx
inc rcx
cmp rcx, 0x270
jb 0x14000cd90
mov dword [rsp + 0x40], 0x270
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], r15
xor r8d, r8d
lea rdx, [0x14005644d]
mov rcx, rdi
call fcn.14001b320
mov dword [rsp + 0x20], 1
cmp qword [r14 + 0x18], 0xf
jbe 0x14000cdf1
mov rsi, qword [r14]
mov rcx, rsi
mov rdx, rsi
jmp 0x14000cdfa
mov rsi, r14
mov rcx, r14
mov rdx, r14
mov rbp, qword [r14 + 0x10]
add rbp, rcx
cmp rdx, rbp
je 0x14000cedc
nop word [rax + rax]
lea rcx, [rsp + 0x40]
call fcn.140020c60
mov ecx, eax
imul rbx, rcx, 0xff
test ebx, ebx
jne 0x14000ce48
nop word [rax + rax]
lea rcx, [rsp + 0x40]
call fcn.140020c60
mov ecx, eax
imul rbx, rcx, 0xff
cmp ebx, 1
jb 0x14000ce30
shr rbx, 0x20
inc bl
movzx r9d, bl
xor r9b, byte [rsi]
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x14000ce81
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0xf
jbe 0x14000ce76
mov rax, qword [rdi]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x14000ce91
xor r8d, r8d
mov edx, 1
mov rcx, rdi
call fcn.14001bcb0
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x14000cebc
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0xf
jbe 0x14000ceb2
mov rax, qword [rdi]
mov byte [rax + rcx], bl
mov byte [rax + rcx + 1], 0
jmp 0x14000ced0
movzx r9d, bl
xor r8d, r8d
mov edx, 1
mov rcx, rdi
call fcn.14001bcb0
inc rsi
cmp rsi, rbp
jne 0x14000ce10
mov rdx, qword [r14 + 0x18]
cmp rdx, 0xf
jbe 0x14000cf12
inc rdx
mov rcx, qword [r14]
cmp rdx, 0x1000
jb 0x14000cf0d
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000cf4c
mov rcx, r8
call fcn.1400226d0
mov qword [r14 + 0x10], r15
mov qword [r14 + 0x18], 0xf
mov byte [r14], 0
mov rax, rdi
mov rcx, qword [rsp + 0x13d0]
xor rcx, rsp
call fcn.1400226b0
mov rbx, qword [rsp + 0x1420]
add rsp, 0x13e0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.140030640
int3
Function at 0x14000ed90
Capabilities:
Get hostname

Disassembly:
push rbx
sub rsp, 0x80
mov rax, qword [0x14005e0c0]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x28], 0x10
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x50]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
je 0x14000ee4f
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.140016d10
nop
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 7
cmova rdx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
lea r8, [rdx + rax*2]
lea rdx, [rsp + 0x30]
cmova rdx, qword [rsp + 0x30]
mov rcx, rbx
call fcn.14001a740
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x14000ee77
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ee48
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ee90
call fcn.1400226d0
jmp 0x14000ee77
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0
xor r8d, r8d
lea rdx, [0x14005644d]
mov rcx, rbx
call fcn.14001b320
mov rax, rbx
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400226b0
add rsp, 0x80
pop rbx
ret
call fcn.140030640
int3