joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003c950
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
mov edx, 6
call fcn.14003c020
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x14003c950
push rbp
push rdi
push r15
sub rsp, 0x50
mov rax, qword [0x1400af210]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rax, rdx
mov r15, rcx
lea rdx, [rsp + 0x20]
test rax, rax
jns 0x14003c988
not rax
mov byte [rsp + 0x20], 0x2d
inc rax
lea rdx, [rsp + 0x21]
mov rcx, rax
call fcn.140022080
xor edx, edx
lea rcx, [rsp + 0x20]
mov rbp, rax
lea rdi, [rsp + 0x20]
sub rbp, rcx
lea rcx, [rsp + 0x20]
cmp rcx, rax
cmova rbp, rdx
test rbp, rbp
je 0x14003ca2a
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], r14
lea r14, [rsp + 0x20]
neg r14
nop dword [rax]
mov rbx, qword [r15]
movzx esi, byte [rdi]
mov r8, qword [rbx + 0x18]
cmp r8, qword [rbx + 0x10]
jb 0x14003ca01
mov rcx, qword [rbx + 8]
cmp r8, rcx
je 0x14003ca01
mov r9, qword [rbx]
sub r8, rcx
mov edx, 1
call fcn.14005ba28
mov rax, qword [rbx + 8]
mov qword [rbx + 0x18], rax
mov rax, qword [rbx + 0x18]
inc rdi
mov byte [rax], sil
lea rax, [r14 + rdi]
inc qword [rbx + 0x18]
cmp rax, rbp
jne 0x14003c9d0
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x80]
mov al, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140052350
add rsp, 0x50
pop r15
pop rdi
pop rbp
ret

Function at 0x14003ca50
Capabilities:
Write file on windows

Disassembly:
push rbp
push rdi
push r15
sub rsp, 0x50
mov rax, qword [0x1400af210]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov eax, edx
mov r15, rcx
lea rdx, [rsp + 0x20]
test eax, eax
jns 0x14003ca84
not eax
mov byte [rsp + 0x20], 0x2d
inc eax
lea rdx, [rsp + 0x21]
mov ecx, eax
call fcn.140021e50
xor edx, edx
lea rcx, [rsp + 0x20]
mov rbp, rax
lea rdi, [rsp + 0x20]
sub rbp, rcx
lea rcx, [rsp + 0x20]
cmp rcx, rax
cmova rbp, rdx
test rbp, rbp
je 0x14003cb2a
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], r14
lea r14, [rsp + 0x20]
neg r14
nop dword [rax + rax]
mov rbx, qword [r15]
movzx esi, byte [rdi]
mov r8, qword [rbx + 0x18]
cmp r8, qword [rbx + 0x10]
jb 0x14003cb01
mov rcx, qword [rbx + 8]
cmp r8, rcx
je 0x14003cb01
mov r9, qword [rbx]
sub r8, rcx
mov edx, 1
call fcn.14005ba28
mov rax, qword [rbx + 8]
mov qword [rbx + 0x18], rax
mov rax, qword [rbx + 0x18]
inc rdi
mov byte [rax], sil
lea rax, [r14 + rdi]
inc qword [rbx + 0x18]
cmp rax, rbp
jne 0x14003cad0
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x80]
mov al, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140052350
add rsp, 0x50
pop r15
pop rdi
pop rbp
ret
Function at 0x14003cb50
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, qword [rcx]
mov rdi, rcx
mov r8, qword [rbx + 0x18]
cmp r8, qword [rbx + 0x10]
jb 0x14003cb8b
mov rcx, qword [rbx + 8]
cmp r8, rcx
je 0x14003cb8b
mov r9, qword [rbx]
sub r8, rcx
mov edx, 1
call fcn.14005ba28
mov rax, qword [rbx + 8]
mov qword [rbx + 0x18], rax
mov rax, qword [rbx + 0x18]
mov byte [rax], WSASetLastError
inc qword [rbx + 0x18]
mov rbx, qword [rdi]
mov r8, qword [rbx + 0x18]
cmp r8, qword [rbx + 0x10]
jb 0x14003cbc4
mov rcx, qword [rbx + 8]
cmp r8, rcx
je 0x14003cbc4
mov r9, qword [rbx]
sub r8, rcx
mov edx, 1
call fcn.14005ba28
mov rax, qword [rbx + 8]
mov qword [rbx + 0x18], rax
mov rax, qword [rbx + 0x18]
mov byte [rax], 0x75
inc qword [rbx + 0x18]
mov rbx, qword [rdi]
mov r8, qword [rbx + 0x18]
cmp r8, qword [rbx + 0x10]
jb 0x14003cbfd
mov rcx, qword [rbx + 8]
cmp r8, rcx
je 0x14003cbfd
mov r9, qword [rbx]
sub r8, rcx
mov edx, 1
call fcn.14005ba28
mov rax, qword [rbx + 8]
mov qword [rbx + 0x18], rax
mov rax, qword [rbx + 0x18]
mov byte [rax], 0x6c
inc qword [rbx + 0x18]
mov rbx, qword [rdi]
mov r8, qword [rbx + 0x18]
cmp r8, qword [rbx + 0x10]
jb 0x14003cc36
mov rcx, qword [rbx + 8]
cmp r8, rcx
je 0x14003cc36
mov r9, qword [rbx]
sub r8, rcx
mov edx, 1
call fcn.14005ba28
mov rax, qword [rbx + 8]
mov qword [rbx + 0x18], rax
mov rax, qword [rbx + 0x18]
mov byte [rax], 0x6c
mov al, 1
inc qword [rbx + 0x18]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14003cef0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
mov edx, 6
call fcn.14003c020
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x14003cef0
push rbp
push rdi
push r15
sub rsp, 0x50
mov rax, qword [0x1400af210]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rax, rdx
mov r15, rcx
mov rcx, rax
lea rdx, [rsp + 0x20]
call fcn.140022080
xor edx, edx
lea rcx, [rsp + 0x20]
mov rbp, rax
lea rdi, [rsp + 0x20]
sub rbp, rcx
lea rcx, [rsp + 0x20]
cmp rcx, rax
cmova rbp, rdx
test rbp, rbp
je 0x14003cfba
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], r14
lea r14, [rsp + 0x20]
neg r14
nop dword [rax + rax]
mov rbx, qword [r15]
movzx esi, byte [rdi]
mov r8, qword [rbx + 0x18]
cmp r8, qword [rbx + 0x10]
jb 0x14003cf91
mov rcx, qword [rbx + 8]
cmp r8, rcx
je 0x14003cf91
mov r9, qword [rbx]
sub r8, rcx
mov edx, 1
call fcn.14005ba28
mov rax, qword [rbx + 8]
mov qword [rbx + 0x18], rax
mov rax, qword [rbx + 0x18]
inc rdi
mov byte [rax], sil
lea rax, [r14 + rdi]
inc qword [rbx + 0x18]
cmp rax, rbp
jne 0x14003cf60
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x80]
mov al, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140052350
add rsp, 0x50
pop r15
pop rdi
pop rbp
ret

Function at 0x14003cfe0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rdi
push r15
sub rsp, 0x50
mov rax, qword [0x1400af210]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov eax, edx
mov r15, rcx
mov ecx, eax
lea rdx, [rsp + 0x20]
call fcn.140021e50
xor edx, edx
lea rcx, [rsp + 0x20]
mov rbp, rax
lea rdi, [rsp + 0x20]
sub rbp, rcx
lea rcx, [rsp + 0x20]
cmp rcx, rax
cmova rbp, rdx
test rbp, rbp
je 0x14003d0aa
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], r14
lea r14, [rsp + 0x20]
neg r14
nop word [rax + rax]
mov rbx, qword [r15]
movzx esi, byte [rdi]
mov r8, qword [rbx + 0x18]
cmp r8, qword [rbx + 0x10]
jb 0x14003d081
mov rcx, qword [rbx + 8]
cmp r8, rcx
je 0x14003d081
mov r9, qword [rbx]
sub r8, rcx
mov edx, 1
call fcn.14005ba28
mov rax, qword [rbx + 8]
mov qword [rbx + 0x18], rax
mov rax, qword [rbx + 0x18]
inc rdi
mov byte [rax], sil
lea rax, [r14 + rdi]
inc qword [rbx + 0x18]
cmp rax, rbp
jne 0x14003d050
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x80]
mov al, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140052350
add rsp, 0x50
pop r15
pop rdi
pop rbp
ret
Function at 0x14003d200
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x2150]
mov eax, 0x2250
call fcn.1400526c0
sub rsp, rax
mov rax, qword [0x1400af210]
xor rax, rsp
mov qword [rbp + 0x2140], rax
mov rbx, r8
mov rsi, rdx
call fcn.140002b30
xor r14d, r14d
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x28], r14
mov rcx, rax
xor r9d, r9d
mov dword [rsp + 0x20], 0x1a4
mov r8, rsi
call fcn.14000bf10
mov edi, eax
test eax, eax
jns 0x14003d297
mov ecx, eax
call fcn.1400023d0
lea ecx, [r14 + 2]
mov rbx, rax
call fcn.14005b248
mov rcx, rax
lea rdx, str.unable_to_open__s:__s_n
mov r9, rbx
mov r8, rsi
call fcn.140002270
xor al, al
jmp 0x14003d390
lea rcx, [rsp + 0x70]
call fcn.14000be10
lea rdx, [0x14008cf10]
mov ecx, edi
call fcn.1400662b0
lea rcx, [rbp + 0x140]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rcx
mov r9, rax
lea rcx, [rbp + 0x140]
mov qword [rsp + 0x40], 0x2000
mov qword [rsp + 0x50], rcx
mov edx, 1
lea rcx, [rbp + 0x140]
mov qword [rsp + 0x48], r14
mov r8d, 0x2000
mov qword [rsp + 0x58], r14
mov byte [rsp + 0x68], r14b
mov qword [rsp + 0x60], r14
call fcn.14005b720
mov rdx, qword [rsp + 0x38]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rdx
lea rcx, [rdx - 1]
add rcx, rax
mov qword [rsp + 0x48], rcx
cmp rax, qword [rsp + 0x40]
jae 0x14003d333
mov byte [rax + rdx], r14b
inc qword [rsp + 0x48]
mov byte [rsp + 0x68], 1
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.14003ad80
call fcn.140002b30
mov rcx, rax
lea rdx, [rsp + 0x70]
xor r9d, r9d
mov r8d, edi
call fcn.14000c050
lea rcx, [rsp + 0x70]
call fcn.14000be10
mov ecx, dword [rbx + 0x50]
test ecx, ecx
je 0x14003d388
call fcn.140026a80
mov r8d, dword [rbx + 0x58]
lea rcx, str._s:_d:__s_n
mov r9, rax
mov rdx, rsi
call fcn.1400397b0
xor al, al
jmp 0x14003d390
cmp word [rbx + 0xe], 3
sete al
mov rcx, qword [rbp + 0x2140]
xor rcx, rsp
call fcn.140052350
lea r11, [rsp + 0x2250]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret

Function at 0x140040670
Capabilities:
Create thread
Resume thread

Disassembly:
mov r8, rcx
add rcx, 0x28
jmp fcn.1400013a0

Function at 0x140042c00
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x40]
mov dword [0x1400b6bd0], eax
call fcn.140024020
add rsp, 0x58
ret
Function at 0x140042dd0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1a8
mov rax, qword [0x1400af210]
xor rax, rsp
mov qword [rsp + 0x190], rax
movsxd r13, r9d
mov r12d, edx
mov qword [rsp + 0x20], r8
mov r14, rcx
cmp r13d, 0xc8
jne 0x140042e13
lea ebp, [r13 - 0x40]
jmp 0x140042e1d
mov ebp, 0x64
sub ebp, r13d
add ebp, ebp
mov eax, ebp
lea rcx, [rsp + 0x30]
cdq
mov r8d, 0xc8
and edx, 7
add eax, edx
xor edx, edx
sar eax, 3
movsxd rdi, eax
call fcn.1400541f0
xor r15d, r15d
mov rsi, rdi
cmp r12d, ebp
jl 0x140042f34
movsxd rbx, ebp
nop
mov rax, r15
test edi, edi
jle 0x140042ee9
cmp edi, 4
jb 0x140042ee9
lea ecx, [rdi - 1]
movsxd rdx, ecx
lea r8, [rsp + 0x30]
lea rcx, [r14 + rdx*8]
lea r8, [r8 + rdx*8]
lea rdx, [rsp + 0x30]
cmp rdx, rcx
ja 0x140042e86
cmp r8, r14
jae 0x140042ee9
mov edx, edi
and edx, 0x80000003
jge 0x140042e97
dec edx
or edx, 0xfffffffc
inc edx
mov ecx, edi
sub ecx, edx
mov rdx, r14
movsxd r8, ecx
lea rcx, [rsp + 0x30]
sub rdx, rcx
nop dword [rax]
movdqu xmm0, xmmword [rsp + rax*8 + 0x30]
lea rcx, [rdx + rax*8]
movdqu xmm1, xmmword [rsp + rcx + 0x30]
pxor xmm1, xmm0
movdqu xmmword [rsp + rax*8 + 0x30], xmm1
movdqu xmm0, xmmword [rsp + rax*8 + 0x40]
movdqu xmm1, xmmword [rsp + rcx + 0x40]
pxor xmm1, xmm0
movdqu xmmword [rsp + rax*8 + 0x40], xmm1
add rax, 4
cmp rax, r8
jl 0x140042eb0
cmp rax, rsi
jge 0x140042f16
lea rcx, [rsp + 0x30]
mov r8, r14
sub r8, rcx
nop dword [rax]
lea rcx, [r8 + rax*8]
mov rdx, qword [rsp + rcx + 0x30]
xor qword [rsp + rax*8 + 0x30], rdx
inc rax
cmp rax, rsi
jl 0x140042f00
mov edx, 0x18
lea rcx, [rsp + 0x30]
call fcn.140043050
sub r12d, ebp
add r14, rbx
cmp r12d, ebp
jge 0x140042e50
movsxd rbx, r12d
lea rcx, [rsp + 0x100]
mov r8, rbx
mov rdx, r14
call fcn.140053cd0
mov eax, ebp
mov byte [rsp + rbx + 0x100], 1
inc r12d
lea rcx, [rsp + 0x100]
sub eax, r12d
xor edx, edx
movsxd r8, eax
movsxd rax, r12d
add rcx, rax
call fcn.1400541f0
lea eax, [rbp - 1]
movsxd rcx, eax
or byte [rsp + rcx + 0x100], 0x80
mov ecx, r15d
test edi, edi
jle 0x140042fe5
cmp edi, 4
jb 0x140042fe5
mov eax, edi
and eax, 0x80000003
jge 0x140042f9c
dec eax
or eax, 0xfffffffc
inc eax
sub edi, eax
movsxd rax, edi
movdqu xmm0, xmmword [rsp + r15*8 + 0x30]
add ecx, 4
movdqu xmm1, xmmword [rsp + r15*8 + 0x100]
pxor xmm1, xmm0
movdqu xmmword [rsp + r15*8 + 0x30], xmm1
movdqu xmm0, xmmword [rsp + r15*8 + 0x40]
movdqu xmm1, xmmword [rsp + r15*8 + 0x110]
pxor xmm1, xmm0
movdqu xmmword [rsp + r15*8 + 0x40], xmm1
add r15, 4
cmp r15, rax
jl 0x140042fa1
movsxd r8, ecx
cmp r8, rsi
jge 0x140043005
nop dword [rax]
mov rax, qword [rsp + r8*8 + 0x100]
xor qword [rsp + r8*8 + 0x30], rax
inc r8
cmp r8, rsi
jl 0x140042ff0
mov edx, 0x18
lea rcx, [rsp + 0x30]
call fcn.140043050
mov rcx, qword [rsp + 0x20]
lea rdx, [rsp + 0x30]
mov r8, r13
call fcn.140053cd0
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.140052350
add rsp, 0x1a8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140043ac0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x100
mov rax, qword [0x1400af210]
xor rax, rsp
mov qword [rbp + 0x47], rax
movups xmm0, xmmword [rcx]
mov rdi, rcx
xor r8d, r8d
movups xmm1, xmmword [rcx + 0x10]
lea rdx, [rbp - 0x39]
movups xmmword [rsp + 0x20], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rbp - 0x79], xmm1
movups xmm1, xmmword [rcx + 0x30]
lea rcx, [rsp + 0x20]
movups xmmword [rbp - 0x69], xmm0
movups xmmword [rbp - 0x59], xmm1
call fcn.140043c80
mov r8d, 1
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x39]
call fcn.140043c80
mov ebx, 2
lea rdx, [rbp - 0x39]
mov r8d, ebx
lea rcx, [rbp + 7]
call fcn.140043c80
lea r8d, [rbx + 1]
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x39]
call fcn.140043c80
lea r8d, [rbx + 2]
lea rdx, [rbp - 0x39]
lea rcx, [rbp + 7]
call fcn.140043c80
lea r8d, [rbx + 3]
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x39]
call fcn.140043c80
lea r8d, [rbx + 4]
lea rdx, [rbp - 0x39]
lea rcx, [rbp + 7]
call fcn.140043c80
lea r8d, [rbx + 5]
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x39]
call fcn.140043c80
lea r8d, [rbx + 6]
lea rdx, [rbp - 0x39]
lea rcx, [rbp + 7]
call fcn.140043c80
lea r8d, [rbx + 7]
lea rdx, [rsp + 0x20]
lea rcx, [rbp - 0x39]
call fcn.140043c80
xor r9d, r9d
lea rcx, [rbp - 0x4d]
lea rax, [rdi + 0x3c]
lea edx, [rbx + 0xe]
cmp rdi, rcx
ja 0x140043bd6
lea rcx, [rsp + 0x20]
cmp rax, rcx
jae 0x140043c22
lea r8, [rsp + 0x20]
mov r9d, edx
sub r8, rdi
lea rax, [rsp + 0x20]
sub rax, rdi
lea rcx, [rdi + 0x10]
nop dword [rax]
movdqu xmm0, xmmword [rcx - 0x10]
movdqu xmm1, xmmword [r8 + rcx - 0x10]
movdqu xmm2, xmmword [rax + rcx]
lea rcx, [rcx + 0x20]
pxor xmm1, xmm0
movdqu xmmword [rcx - 0x30], xmm1
movdqu xmm0, xmmword [rcx - 0x20]
pxor xmm2, xmm0
movdqu xmmword [rcx - 0x20], xmm2
sub rbx, 1
jne 0x140043bf0
movsxd rcx, r9d
cmp rcx, rdx
jge 0x140043c50
lea r8, [rsp + 0x20]
sub r8, rdi
lea rax, [rdi + rcx*4]
sub rdx, rcx
nop dword [rax]
mov ecx, dword [rax + r8]
xor dword [rax], ecx
lea rax, [rax + 4]
sub rdx, 1
jne 0x140043c40
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140052350
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140048d40
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
pshufd xmm0, xmmword [rcx], 0x55
mov r11, rsp
pshufd xmm1, xmmword [rcx], 0xff
lea rcx, str.cw
movd dword [rsp + 0x18], xmm0
movd dword [rsp + 0x10], xmm1
movzx eax, byte [r11 + 0x18]
movzx r8d, dl
movzx eax, byte [rax + rcx]
mov byte [rsp + 0x18], al
movzx eax, byte [r11 + 0x19]
movzx eax, byte [rax + rcx]
mov byte [rsp + 0x19], al
movzx eax, byte [r11 + 0x1a]
movzx eax, byte [rax + rcx]
mov byte [rsp + 0x1a], al
movzx eax, byte [r11 + 0x1b]
movzx eax, byte [rax + rcx]
mov byte [rsp + 0x1b], al
movzx eax, byte [r11 + 0x10]
movzx eax, byte [rax + rcx]
mov byte [rsp + 0x10], al
movzx eax, byte [r11 + 0x11]
movzx eax, byte [rax + rcx]
mov byte [rsp + 0x11], al
movzx eax, byte [r11 + 0x12]
movzx eax, byte [rax + rcx]
mov byte [rsp + 0x12], al
movzx eax, byte [r11 + 0x13]
movzx eax, byte [rax + rcx]
mov ecx, dword [rsp + 0x18]
mov byte [rsp + 0x13], al
mov eax, ecx
mov r9d, dword [r11 + 0x10]
mov edx, r9d
ror edx, 8
ror eax, 8
xor edx, r8d
xor eax, r8d
movd xmm0, ecx
movd xmm1, r9d
punpckldq xmm0, xmm1
movd xmm2, edx
movd xmm3, eax
punpckldq xmm3, xmm2
punpckldq xmm0, xmm3
ret
Function at 0x14005c9d4
Capabilities:
Delete directory

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x14005c9f4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14005c11c
or eax, 0xffffffff
jmp 0x14005c9f6
xor eax, eax
add rsp, 0x28
ret

Function at 0x140063cc0
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x140063a94
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140063a94
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140063a94
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140063a94
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140063a94
cmp dword [rcx + 0x84], 0xe
jbe 0x140063a94
cmp dword [rcx + 0xf8], esi
je 0x140063a94
mov ecx, r14d
call fcn.140063bdc
mov ecx, 2
call fcn.14005eef4
nop
cmp byte [0x1400b85a0], 0
jne 0x140063b5e
mov r15d, 1
mov eax, r15d
xchg dword [0x1400b8590], eax
test ebx, ebx
jne 0x140063b07
mov rdi, qword [0x1400af210]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x1400b8598]
cmp rcx, rax
je 0x140063afe
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [fcn.140003120]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x1400b86d8]
jmp 0x140063b13
cmp ebx, r15d
jne 0x140063b19
lea rcx, [0x1400b86f0]
call fcn.140064798
nop
test ebx, ebx
jne 0x140063b30
lea rdx, [0x1400767e8]
lea rcx, [0x1400767c0]
call fcn.140064a60
lea rdx, [0x1400767f8]
lea rcx, [0x1400767f0]
call fcn.140064a60
movzx eax, byte [0x1400b85a0]
test esi, esi
cmove eax, r15d
mov byte [0x1400b85a0], al
jmp 0x140063b5e
mov ecx, 2
call fcn.14005ef48
test esi, esi
jne 0x140063b75
mov ecx, r14d
call fcn.140063b90
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x140063a24
Function at 0x14006a2bc
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x14006a15c
call fcn.14005c18c
mov dword [rax], reloc.WS2_32.dll_shutdown
call fcn.140056b10
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x14006a144
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x14006a144
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x14006a18e
lock or dword [rax + 0x14], 0x10
jmp 0x14006a144
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x14006a1ab
mov rcx, qword [rbp + 0x10]
call fcn.14006bdec
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.140068168
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.14005cf2c
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x14006a202
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x14006a144
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x14006a26e
mov rcx, qword [rbp + 0x10]
call fcn.140068168
cmp eax, 0xffffffff
je 0x14006a255
mov rcx, qword [rbp + 0x10]
call fcn.140068168
cmp eax, 0xfffffffe
je 0x14006a255
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.140068168
movsxd rdi, eax
lea rsi, [0x1400b8750]
mov rcx, rbx
sar rdi, 6
call fcn.140068168
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x14006a25c
lea rax, [0x1400af780]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x14006a26e
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x14006a2a4
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x14006a2a0
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x14006a2a0
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x14006a147
jmp 0x14006a114
Function at 0xdf9870
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0xdf987d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0xdf988d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0xdf9875
lea eax, [rcx + 1]
jmp 0xdf989b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0xdf98ae
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0xdf9894
sub eax, 3
jb 0xdf98ce
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0xdf991d
sar eax, 1
movsxd rbp, eax
jb 0xdf9904
jmp 0xdf98dc
add ebx, ebx
jne 0xdf98da
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0xdf9904
inc ecx
add ebx, ebx
jne 0xdf98ea
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0xdf9904
call r11
adc ecx, ecx
add ebx, ebx
jne 0xdf98fd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0xdf98ec
add ecx, 2
jmp 0xdf9909
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.00df9832
jmp 0xdf987d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x415a00
mov dl, 0x32
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0xdf9969
cmp rsi, rcx
jae 0xdf9971
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0xdf9950
cmp al, 0x8f
ja 0xdf9950
cmp byte [rsi - 2], 0xf
je 0xdf9956
sub al, 0xe8
cmp al, 1
ja 0xdf993a
cmp rsi, rcx
jae 0xdf9971
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0xdf9940
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0xdf9971
lodsb al, byte [rsi]
jmp 0xdf9950
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x9ee000]
mov eax, dword [rdi]
or eax, eax
je 0xdf99ce
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x9f9000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0xdf997e
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0xdf99c8
mov qword [rbx], rax
add rbx, 8
jmp 0xdf999e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0xdf9a12
cmp al, 0xef
ja 0xdf99fa
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0xdf99da
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0xdf99e9
mov eax, dword [rdi]
add rdi, 4
jmp 0xdf99e9
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0xdf9a66
sub rsp, 0xffffffffffffff80
jmp 0x4685e0