joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401550e0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x10
mov r11, rcx
movaps xmmword [rsp], xmm6
movdqa xmm6, xmmword [rdx]
lea rdi, str.cw
pshufd xmm0, xmm6, 0x55
mov rbx, rdx
movd eax, xmm0
movdqa xmm5, xmmword [r11]
pshufd xmm0, xmm6, 0xff
mov r9d, eax
shr rax, 0x10
movzx r8d, al
mov eax, r9d
shr rax, 0x18
pslldq xmm5, 4
movdqa xmm4, xmm5
pslldq xmm5, 4
movzx r10d, byte [r8 + rdi]
movzx eax, byte [rax + rdi]
pxor xmm4, xmmword [r11]
shl eax, 8
or r10d, eax
mov eax, r9d
shr rax, 8
movzx ecx, al
shl r10d, 8
movzx eax, byte [rcx + rdi]
or r10d, eax
movzx eax, r9b
shl r10d, 8
movzx ecx, byte [rax + rdi]
or r10d, ecx
movd eax, xmm0
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movd xmm3, r10d
movzx r8d, byte [rcx + rdi]
movzx eax, byte [rax + rdi]
shl eax, 8
or r8d, eax
mov eax, edx
shr rax, 8
movzx ecx, al
shl r8d, 8
movzx eax, byte [rcx + rdi]
or r8d, eax
movzx eax, dl
shl r8d, 8
movzx ecx, byte [rax + rdi]
mov eax, r10d
or r8d, ecx
ror eax, 8
xor eax, 8
mov ecx, r8d
ror ecx, 8
xor ecx, 8
movd xmm0, r8d
movd xmm2, eax
punpckldq xmm3, xmm0
movdqa xmm0, xmm5
movd xmm1, ecx
pxor xmm0, xmm4
punpckldq xmm2, xmm1
punpckldq xmm3, xmm2
pslldq xmm5, 4
pxor xmm0, xmm5
pshufd xmm1, xmm3, 0xff
pxor xmm1, xmm0
pshufd xmm0, xmm1, 0x55
movd eax, xmm0
movdqa xmmword [r11], xmm1
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movzx r9d, byte [rcx + rdi]
movzx eax, byte [rax + rdi]
shl eax, 8
movdqa xmm5, xmm6
or r9d, eax
pshufd xmm0, xmm1, 0xff
shl r9d, 8
mov eax, edx
shr rax, 8
movzx ecx, al
pslldq xmm5, 4
movdqa xmm4, xmm5
pslldq xmm5, 4
pxor xmm4, xmm6
movaps xmm6, xmmword [rsp]
movzx eax, byte [rcx + rdi]
or r9d, eax
movzx eax, dl
shl r9d, 8
movzx ecx, byte [rax + rdi]
movd eax, xmm0
or r9d, ecx
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movd xmm3, r9d
movzx r8d, byte [rcx + rdi]
movzx eax, byte [rax + rdi]
shl eax, 8
or r8d, eax
mov eax, edx
shr rax, 8
movzx ecx, al
shl r8d, 8
movzx eax, byte [rcx + rdi]
or r8d, eax
movzx eax, dl
shl r8d, 8
movzx ecx, byte [rax + rdi]
or r8d, ecx
mov ecx, r9d
mov eax, r8d
ror eax, 8
ror ecx, 8
movd xmm0, r8d
punpckldq xmm3, xmm0
movdqa xmm0, xmm5
movd xmm1, eax
pxor xmm0, xmm4
movd xmm2, ecx
punpckldq xmm2, xmm1
punpckldq xmm3, xmm2
pslldq xmm5, 4
pshufd xmm1, xmm3, 0xaa
pxor xmm0, xmm5
pxor xmm1, xmm0
movdqa xmmword [rbx], xmm1
mov rbx, qword [rsp + 0x20]
add rsp, 0x10
pop rdi
ret
Function at 0x140155390
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x10
mov r11, rcx
movaps xmmword [rsp], xmm6
movdqa xmm6, xmmword [rdx]
lea rdi, str.cw
pshufd xmm0, xmm6, 0x55
mov rbx, rdx
movd eax, xmm0
movdqa xmm5, xmmword [r11]
pshufd xmm0, xmm6, 0xff
mov r9d, eax
shr rax, 0x10
movzx r8d, al
mov eax, r9d
shr rax, 0x18
pslldq xmm5, 4
movdqa xmm4, xmm5
pslldq xmm5, 4
movzx r10d, byte [r8 + rdi]
movzx eax, byte [rax + rdi]
pxor xmm4, xmmword [r11]
shl eax, 8
or r10d, eax
mov eax, r9d
shr rax, 8
movzx ecx, al
shl r10d, 8
movzx eax, byte [rcx + rdi]
or r10d, eax
movzx eax, r9b
shl r10d, 8
movzx ecx, byte [rax + rdi]
or r10d, ecx
movd eax, xmm0
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movd xmm3, r10d
movzx r8d, byte [rcx + rdi]
movzx eax, byte [rax + rdi]
shl eax, 8
or r8d, eax
mov eax, edx
shr rax, 8
movzx ecx, al
shl r8d, 8
movzx eax, byte [rcx + rdi]
or r8d, eax
movzx eax, dl
shl r8d, 8
movzx ecx, byte [rax + rdi]
mov eax, r10d
or r8d, ecx
ror eax, 8
xor eax, 4
mov ecx, r8d
ror ecx, 8
xor ecx, 4
movd xmm0, r8d
movd xmm2, eax
punpckldq xmm3, xmm0
movdqa xmm0, xmm5
movd xmm1, ecx
pxor xmm0, xmm4
punpckldq xmm2, xmm1
punpckldq xmm3, xmm2
pslldq xmm5, 4
pxor xmm0, xmm5
pshufd xmm1, xmm3, 0xff
pxor xmm1, xmm0
pshufd xmm0, xmm1, 0x55
movd eax, xmm0
movdqa xmmword [r11], xmm1
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movzx r9d, byte [rcx + rdi]
movzx eax, byte [rax + rdi]
shl eax, 8
movdqa xmm5, xmm6
or r9d, eax
pshufd xmm0, xmm1, 0xff
shl r9d, 8
mov eax, edx
shr rax, 8
movzx ecx, al
pslldq xmm5, 4
movdqa xmm4, xmm5
pslldq xmm5, 4
pxor xmm4, xmm6
movaps xmm6, xmmword [rsp]
movzx eax, byte [rcx + rdi]
or r9d, eax
movzx eax, dl
shl r9d, 8
movzx ecx, byte [rax + rdi]
movd eax, xmm0
or r9d, ecx
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movd xmm3, r9d
movzx r8d, byte [rcx + rdi]
movzx eax, byte [rax + rdi]
shl eax, 8
or r8d, eax
mov eax, edx
shr rax, 8
movzx ecx, al
shl r8d, 8
movzx eax, byte [rcx + rdi]
or r8d, eax
movzx eax, dl
shl r8d, 8
movzx ecx, byte [rax + rdi]
or r8d, ecx
mov ecx, r9d
mov eax, r8d
ror eax, 8
ror ecx, 8
movd xmm0, r8d
punpckldq xmm3, xmm0
movdqa xmm0, xmm5
movd xmm1, eax
pxor xmm0, xmm4
movd xmm2, ecx
punpckldq xmm2, xmm1
punpckldq xmm3, xmm2
pslldq xmm5, 4
pshufd xmm1, xmm3, 0xaa
pxor xmm0, xmm5
pxor xmm1, xmm0
movdqa xmmword [rbx], xmm1
mov rbx, qword [rsp + 0x20]
add rsp, 0x10
pop rdi
ret
Function at 0x140155640
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x10
mov r11, rcx
movaps xmmword [rsp], xmm6
movdqa xmm6, xmmword [rdx]
lea rdi, str.cw
pshufd xmm0, xmm6, 0x55
mov rbx, rdx
movd eax, xmm0
movdqa xmm5, xmmword [r11]
pshufd xmm0, xmm6, 0xff
mov r9d, eax
shr rax, 0x10
movzx r8d, al
mov eax, r9d
shr rax, 0x18
pslldq xmm5, 4
movdqa xmm4, xmm5
pslldq xmm5, 4
movzx r10d, byte [r8 + rdi]
movzx eax, byte [rax + rdi]
pxor xmm4, xmmword [r11]
shl eax, 8
or r10d, eax
mov eax, r9d
shr rax, 8
movzx ecx, al
shl r10d, 8
movzx eax, byte [rcx + rdi]
or r10d, eax
movzx eax, r9b
shl r10d, 8
movzx ecx, byte [rax + rdi]
or r10d, ecx
movd eax, xmm0
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movd xmm3, r10d
movzx r8d, byte [rcx + rdi]
movzx eax, byte [rax + rdi]
shl eax, 8
or r8d, eax
mov eax, edx
shr rax, 8
movzx ecx, al
shl r8d, 8
movzx eax, byte [rcx + rdi]
or r8d, eax
movzx eax, dl
shl r8d, 8
movzx ecx, byte [rax + rdi]
mov eax, r10d
or r8d, ecx
ror eax, 8
xor eax, 2
mov ecx, r8d
ror ecx, 8
xor ecx, 2
movd xmm0, r8d
movd xmm2, eax
punpckldq xmm3, xmm0
movdqa xmm0, xmm5
movd xmm1, ecx
pxor xmm0, xmm4
punpckldq xmm2, xmm1
punpckldq xmm3, xmm2
pslldq xmm5, 4
pxor xmm0, xmm5
pshufd xmm1, xmm3, 0xff
pxor xmm1, xmm0
pshufd xmm0, xmm1, 0x55
movd eax, xmm0
movdqa xmmword [r11], xmm1
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movzx r9d, byte [rcx + rdi]
movzx eax, byte [rax + rdi]
shl eax, 8
movdqa xmm5, xmm6
or r9d, eax
pshufd xmm0, xmm1, 0xff
shl r9d, 8
mov eax, edx
shr rax, 8
movzx ecx, al
pslldq xmm5, 4
movdqa xmm4, xmm5
pslldq xmm5, 4
pxor xmm4, xmm6
movaps xmm6, xmmword [rsp]
movzx eax, byte [rcx + rdi]
or r9d, eax
movzx eax, dl
shl r9d, 8
movzx ecx, byte [rax + rdi]
movd eax, xmm0
or r9d, ecx
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movd xmm3, r9d
movzx r8d, byte [rcx + rdi]
movzx eax, byte [rax + rdi]
shl eax, 8
or r8d, eax
mov eax, edx
shr rax, 8
movzx ecx, al
shl r8d, 8
movzx eax, byte [rcx + rdi]
or r8d, eax
movzx eax, dl
shl r8d, 8
movzx ecx, byte [rax + rdi]
or r8d, ecx
mov ecx, r9d
mov eax, r8d
ror eax, 8
ror ecx, 8
movd xmm0, r8d
punpckldq xmm3, xmm0
movdqa xmm0, xmm5
movd xmm1, eax
pxor xmm0, xmm4
movd xmm2, ecx
punpckldq xmm2, xmm1
punpckldq xmm3, xmm2
pslldq xmm5, 4
pshufd xmm1, xmm3, 0xaa
pxor xmm0, xmm5
pxor xmm1, xmm0
movdqa xmmword [rbx], xmm1
mov rbx, qword [rsp + 0x20]
add rsp, 0x10
pop rdi
ret
Function at 0x1401558f0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x10
mov r11, rcx
movaps xmmword [rsp], xmm6
movdqa xmm6, xmmword [rdx]
lea rdi, str.cw
pshufd xmm0, xmm6, 0x55
mov rbx, rdx
movd eax, xmm0
movdqa xmm5, xmmword [r11]
pshufd xmm0, xmm6, 0xff
mov r9d, eax
shr rax, 0x10
movzx r8d, al
mov eax, r9d
shr rax, 0x18
pslldq xmm5, 4
movdqa xmm4, xmm5
pslldq xmm5, 4
movzx r10d, byte [r8 + rdi]
movzx eax, byte [rax + rdi]
pxor xmm4, xmmword [r11]
shl eax, 8
or r10d, eax
mov eax, r9d
shr rax, 8
movzx ecx, al
shl r10d, 8
movzx eax, byte [rcx + rdi]
or r10d, eax
movzx eax, r9b
shl r10d, 8
movzx ecx, byte [rax + rdi]
or r10d, ecx
movd eax, xmm0
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movd xmm3, r10d
movzx r8d, byte [rcx + rdi]
movzx eax, byte [rax + rdi]
shl eax, 8
or r8d, eax
mov eax, edx
shr rax, 8
movzx ecx, al
shl r8d, 8
movzx eax, byte [rcx + rdi]
or r8d, eax
movzx eax, dl
shl r8d, 8
movzx ecx, byte [rax + rdi]
mov eax, r10d
or r8d, ecx
ror eax, 8
xor eax, 1
mov ecx, r8d
ror ecx, 8
xor ecx, 1
movd xmm0, r8d
movd xmm2, eax
punpckldq xmm3, xmm0
movdqa xmm0, xmm5
movd xmm1, ecx
pxor xmm0, xmm4
punpckldq xmm2, xmm1
punpckldq xmm3, xmm2
pslldq xmm5, 4
pxor xmm0, xmm5
pshufd xmm1, xmm3, 0xff
pxor xmm1, xmm0
pshufd xmm0, xmm1, 0x55
movd eax, xmm0
movdqa xmmword [r11], xmm1
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movzx r9d, byte [rcx + rdi]
movzx eax, byte [rax + rdi]
shl eax, 8
movdqa xmm5, xmm6
or r9d, eax
pshufd xmm0, xmm1, 0xff
shl r9d, 8
mov eax, edx
shr rax, 8
movzx ecx, al
pslldq xmm5, 4
movdqa xmm4, xmm5
pslldq xmm5, 4
pxor xmm4, xmm6
movaps xmm6, xmmword [rsp]
movzx eax, byte [rcx + rdi]
or r9d, eax
movzx eax, dl
shl r9d, 8
movzx ecx, byte [rax + rdi]
movd eax, xmm0
or r9d, ecx
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movd xmm3, r9d
movzx r8d, byte [rcx + rdi]
movzx eax, byte [rax + rdi]
shl eax, 8
or r8d, eax
mov eax, edx
shr rax, 8
movzx ecx, al
shl r8d, 8
movzx eax, byte [rcx + rdi]
or r8d, eax
movzx eax, dl
shl r8d, 8
movzx ecx, byte [rax + rdi]
or r8d, ecx
mov ecx, r9d
mov eax, r8d
ror eax, 8
ror ecx, 8
movd xmm0, r8d
punpckldq xmm3, xmm0
movdqa xmm0, xmm5
movd xmm1, eax
pxor xmm0, xmm4
movd xmm2, ecx
punpckldq xmm2, xmm1
punpckldq xmm3, xmm2
pslldq xmm5, 4
pshufd xmm1, xmm3, 0xaa
pxor xmm0, xmm5
pxor xmm1, xmm0
movdqa xmmword [rbx], xmm1
mov rbx, qword [rsp + 0x20]
add rsp, 0x10
pop rdi
ret
Function at 0x1401810d0
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rdx + 0x3f8]
lea r9, [rcx + 0x3f8]
mov r8d, 0x80
cmp rcx, rax
ja 0x1401810f1
cmp r9, rdx
jae 0x140181144
mov r9, rdx
lea rax, [rcx + 0x10]
sub r9, rcx
mov r10d, 0x20
mov r11d, r8d
nop dword [rax]
nop dword [rax + rax]
movdqu xmm0, xmmword [rax - 0x10]
movdqu xmm1, xmmword [r9 + rax - 0x10]
lea rax, [rax + 0x20]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x30], xmm1
movdqu xmm2, xmmword [r9 + rax - 0x20]
movdqu xmm0, xmmword [rax - 0x20]
pxor xmm2, xmm0
movdqu xmmword [rax - 0x20], xmm2
sub r10, 1
jne 0x140181110
movsxd r9, r11d
cmp r9, r8
jge 0x140181171
sub rdx, rcx
lea rax, [rcx + r9*8]
sub r8, r9
nop word [rax + rax]
mov rcx, qword [rax + rdx]
xor qword [rax], rcx
lea rax, [rax + 8]
sub r8, 1
jne 0x140181160
ret
Function at 0x140182710
Capabilities:
Hash data using sha512

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
test rcx, rcx
jne 0x140182740
or eax, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
xor edx, edx
mov r8d, 0xf0
call fcn.1400f62a0
movaps xmm0, xmmword [0x1401b4130]
movups xmmword [rbx], xmm0
movaps xmm1, xmmword [0x1401b4140]
movups xmmword [rbx + 0x10], xmm1
movaps xmm0, xmmword [0x1401b4150]
movups xmmword [rbx + 0x20], xmm0
movaps xmm1, xmmword [0x1401b4160]
movups xmmword [rbx + 0x30], xmm1
mov rax, qword [rdi]
xor qword [rbx], rax
mov rax, qword [rdi + 8]
xor qword [rbx + 8], rax
mov rax, qword [rdi + 0x10]
xor qword [rbx + 0x10], rax
mov rax, qword [rdi + 0x18]
xor qword [rbx + 0x18], rax
mov rax, qword [rdi + 0x20]
xor qword [rbx + 0x20], rax
mov rax, qword [rdi + 0x28]
xor qword [rbx + 0x28], rax
mov rax, qword [rdi + 0x30]
xor qword [rbx + 0x30], rax
mov rax, qword [rdi + 0x38]
xor qword [rbx + 0x38], rax
movzx eax, byte [rsi]
mov rsi, qword [rsp + 0x38]
mov dword [rbx + 0xe4], eax
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140183f30
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
push rbp
push rsi
push r14
push r15
mov rbp, rsp
sub rsp, 0x78
mov rax, qword [0x1401e7270]
xor rax, rsp
mov qword [rbp - 0x18], rax
mov r15, rcx
lea r9, [r8 + 1]
movabs rax, 0x5851f42d4c957f2d
movabs rcx, 0x810a978a59f5a1fc
imul r9, rax
xor r14d, r14d
mov rsi, rdx
mov rax, r9
mov qword [rbp - 0x58], r9
xor rax, rcx
movabs rcx, 0xa77099df38c2d846
mov qword [rbp - 0x50], rax
mov rax, r9
xor rax, rcx
movabs rcx, 0x8126b91cbf22495c
mov qword [rbp - 0x48], rax
mov rax, r9
xor rax, rcx
movabs rcx, 0x494d2597179f8a62
mov qword [rbp - 0x40], rax
mov rax, r9
xor rax, rcx
movabs rcx, 0x9237efb9ceaaec0c
mov qword [rbp - 0x38], rax
mov rax, r9
xor rax, rcx
movabs rcx, 0x2f2a56746ce62d78
mov qword [rbp - 0x30], rax
mov rax, r9
xor rax, rcx
mov qword [rbp - 0x28], rax
movabs rax, 0x84853bf7b62ce54e
xor r9, rax
cmp dword [reloc.WS2_32.dll_htonl], r14d
mov qword [rbp - 0x20], r9
jbe 0x1401840bd
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rdi
mov qword [r11 - 0x28], r12
nop
mov edi, dword [0x140225bc0]
shl edi, 0xa
shr edi, 6
dec edi
and rdi, r8
shl rdi, 6
add rdi, qword [r15]
prefetchnta byte [rdi]
mov eax, r14d
lea rdx, [r15 + 0x28]
imul rbx, rax, 0x1878
lea r8, [r15 + 0x187a8]
add rdx, rbx
lea rcx, [rbp - 0x58]
call fcn.140186570
mov rax, qword [rdi]
inc r14d
xor qword [rbp - 0x58], rax
mov rax, qword [rdi + 8]
xor qword [rbp - 0x50], rax
mov rax, qword [rdi + 0x10]
xor qword [rbp - 0x48], rax
mov rax, qword [rdi + 0x18]
xor qword [rbp - 0x40], rax
mov rax, qword [rdi + 0x20]
xor qword [rbp - 0x38], rax
mov rax, qword [rdi + 0x28]
xor qword [rbp - 0x30], rax
mov rax, qword [rdi + 0x30]
xor qword [rbp - 0x28], rax
mov rax, qword [rdi + 0x38]
xor qword [rbp - 0x20], rax
cmp r14d, dword [reloc.WS2_32.dll_htonl]
movsxd rax, dword [rbx + r15 + 0x183c]
mov r8, qword [rbp + rax*8 - 0x58]
jb 0x140184010
mov r12, qword [rsp + 0x70]
mov rdi, qword [rsp + 0xb8]
mov rbx, qword [rsp + 0xb0]
movaps xmm0, xmmword [rbp - 0x58]
movaps xmm1, xmmword [rbp - 0x48]
movups xmmword [rsi], xmm0
movaps xmm0, xmmword [rbp - 0x38]
movups xmmword [rsi + 0x10], xmm1
movaps xmm1, xmmword [rbp - 0x28]
movups xmmword [rsi + 0x20], xmm0
movups xmmword [rsi + 0x30], xmm1
mov rcx, qword [rbp - 0x18]
xor rcx, rsp
call fcn.1400d5050
add rsp, 0x78
pop r15
pop r14
pop rsi
pop rbp
ret

Function at 0x140186a70
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x58
mov edx, 0x10000
mov r9d, 0x40
mov r8d, 0x3000
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_VirtualAlloc]
test rax, rax
je 0x140186a97
add rsp, 0x58
ret
lea rax, vtable.std::exception.0
mov byte [rsp + 0x28], 1
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x38]
xor eax, eax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
lea rax, str.Failed_to_allocate_executable_memory
mov qword [rsp + 0x20], rax
call fcn.1400f5fd0
lea rax, vtable.std::runtime_error.0
lea rdx, [0x1401e4888]
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x30]
call fcn.1400f6584
int3
Function at 0x1400282a0
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x280
mov ebx, r9d
mov rsi, r8
mov edi, edx
mov r14, rcx
mov rax, qword [0x1401b1028]
xor rax, rsp
mov qword [rsp + 0x278], rax
lea rcx, str.shell32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x140183024]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400283c1
mov r15, rax
lea r9, [rsp + 0x68]
mov qword [r9], 0
mov rcx, r14
xor edx, edx
xor r8d, r8d
call qword [0x1401a3088]
test eax, eax
jns 0x14002845c
test bl, bl
je 0x14002845c
xor edi, edi
lea r9, [rsp + 0x68]
mov rcx, r14
mov edx, 0x8800
xor r8d, r8d
mov rax, r15
call qword [0x1401a3088]
test eax, eax
js 0x140028466
mov rdx, qword [rsp + 0x68]
lea rdi, [rsp + 0x40]
mov rcx, rdi
call fcn.140118b10
movzx eax, byte [rdi + 0x17]
test al, al
jns 0x140028365
mov rax, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x40]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rax
test rax, rax
js 0x140028497
je 0x140028383
test rdi, rdi
je 0x1400284aa
lea rdi, [rsp + 0x70]
lea rdx, [rsp + 0x58]
mov rcx, rdi
call fcn.1400be050
mov rcx, rsi
mov rdx, rdi
call fcn.1400be1f0
mov rcx, rdi
call fcn.1400be180
cmp byte [rsp + 0x57], 0
jns 0x1400283b9
mov rcx, qword [rsp + 0x40]
call fcn.1400e0828
mov dil, 1
jmp 0x140028466
lea r14, [rsp + 0x70]
mov r8d, 0x208
mov rcx, r14
mov dl, 0xaa
call fcn.1400e3e50
mov word [r14], 0
mov qword [rsp + 0x20], r14
xor ecx, ecx
mov edx, edi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jns 0x14002841b
cmp eax, 0x80070057
je 0x14002841b
test bl, bl
je 0x14002841b
or edi, 0xa000
mov qword [rsp + 0x20], r14
xor ecx, ecx
mov edx, edi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
setns dil
js 0x140028476
lea rbx, [rsp + 0x30]
mov qword [rbx], r14
mov rcx, r14
call fcn.1400ff904
mov qword [rbx + 8], rax
lea r14, [rsp + 0x40]
mov rcx, r14
mov rdx, rbx
call fcn.1400be050
mov rcx, rsi
mov rdx, r14
call fcn.1400be1f0
mov rcx, r14
call fcn.1400be180
jmp 0x140028476
test eax, eax
jns 0x140028341
xor edi, edi
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140028476
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rsp + 0x278]
xor rcx, rsp
call fcn.1400e1d10
mov eax, edi
add rsp, 0x280
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
lea rcx, [0x14018264d]
lea rdx, str....._third_partylibc_srcinclude_string_view:314:_assertion___len___static_cast_size_type__numeric_limits_difference_type_::max____failed:_string_view::string_view__CharT___size_t_:_length_does_not_fit_in_difference_type_n
call fcn.140119a40
lea rcx, [0x14018264d]
lea rdx, str....._third_partylibc_srcinclude_string_view:316:_assertion___len__0____s___nullptr_failed:_string_view::string_view__CharT___size_t_:_received_nullptr_n
call fcn.140119a40
int3
Function at 0x1400284c0
Capabilities:
Get common file path

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
lea rcx, section..rdata
mov edx, 0xd
mov r8, rsi
xor r9d, r9d
call fcn.1400282a0
test al, al
je 0x1400284eb
mov al, 1
add rsp, 0x20
pop rsi
ret
lea rcx, [0x140170010]
mov edx, 5
mov r8, rsi
mov r9b, 1
add rsp, 0x20
pop rsi
jmp fcn.1400282a0

Function at 0x140028510
Capabilities:
Get common file path

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
lea rcx, [0x140170020]
mov edx, 0x27
mov r8, rsi
xor r9d, r9d
call fcn.1400282a0
test al, al
je 0x14002853b
mov al, 1
add rsp, 0x20
pop rsi
ret
lea rcx, [0x140170010]
mov edx, 5
mov r8, rsi
mov r9b, 1
add rsp, 0x20
pop rsi
jmp fcn.1400282a0

Function at 0x140028560
Capabilities:
Get common file path

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
lea rcx, [0x140170040]
mov edx, 0xe
mov r8, rsi
xor r9d, r9d
call fcn.1400282a0
test al, al
je 0x14002858b
mov al, 1
add rsp, 0x20
pop rsi
ret
lea rcx, [0x140170010]
mov edx, 5
mov r8, rsi
mov r9b, 1
add rsp, 0x20
pop rsi
jmp fcn.1400282a0
Function at 0x14002e8d0
Capabilities:
Get session user name

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x240
mov rsi, rcx
mov rax, qword [0x1401b1028]
xor rax, rsp
mov qword [rsp + 0x238], rax
lea rdi, [rsp + 0x2c]
mov dword [rdi], 0x101
lea rbx, [rsp + 0x30]
mov r8d, 0x202
mov rcx, rbx
mov dl, 0xaa
call fcn.1400e3e50
mov rcx, rbx
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov edi, eax
test eax, eax
je 0x14002e92e
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.14003b010
test edi, edi
setne bl
mov rcx, qword [rsp + 0x238]
xor rcx, rsp
call fcn.1400e1d10
mov eax, ebx
add rsp, 0x240
pop rbx
pop rdi
pop rsi
ret

Function at 0x14002fe60
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov r12, qword [rcx + 0x10]
cmp r12, qword [rcx + 0x18]
je 0x14002fea6
mov r14, r12
test r14, r14
je 0x14002ffa8
mov rax, qword [rdi]
mov qword [r14], rax
add qword [rsi + 0x10], 8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r15, qword [rsi]
mov rbx, qword [rsi + 8]
mov rax, rbx
sub rax, r15
jbe 0x14002ff08
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
add rax, rcx
inc rax
sar rax, 1
mov r13, rax
neg r13
shl rax, 3
mov r14, rbx
sub r14, rax
mov r15, r12
sub r15, rbx
je 0x14002fef4
mov rcx, r14
mov rdx, rbx
mov r8, r15
call fcn.1400e37a0
mov r12, qword [rsi + 8]
add r14, r15
mov qword [rsi + 0x10], r14
lea rax, [r12 + r13*8]
mov qword [rsi + 8], rax
jmp 0x14002fe82
mov rax, r12
sub rax, r15
sar rax, 2
cmp r12, r15
mov r13d, 1
cmovne r13, rax
mov rax, r13
shr rax, 0x3d
jne 0x14002ffce
lea rcx, [r13*8]
call fcn.1400e07ec
mov rcx, r13
and rcx, 0xfffffffffffffffc
lea rcx, [rax + rcx*2]
mov rdx, r12
mov r14, rcx
sub rdx, rbx
je 0x14002ff6e
lea r14, [rdx + rcx]
xor r8d, r8d
mov r9, rcx
add r9, r8
je 0x14002ffa8
mov r10, qword [rbx + r8]
mov qword [r9], r10
add r8, 8
cmp rdx, r8
jne 0x14002ff56
lea rdx, [rax + r13*8]
mov qword [rsi], rax
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], r14
mov qword [rsi + 0x18], rdx
cmp r12, rbx
je 0x14002ff8e
add r12, 0xfffffffffffffff8
jne 0x14002ff81
jmp 0x14002ffbb
test r15, r15
je 0x14002fe82
mov rcx, r15
call fcn.1400e0828
mov r14, qword [rsi + 0x10]
jmp 0x14002fe82
lea rcx, [0x14018264d]
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h:40:_assertion___location___nullptr_failed:_null_pointer_given_to_construct_at_n
call fcn.140119a40
lea rcx, [0x14018264d]
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h:66:_assertion___loc___nullptr_failed:_null_pointer_given_to_destroy_at_n
call fcn.140119a40
call fcn.140118c10
int3
Function at 0x14002ffe0
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
cmp qword [rcx], rdx
je 0x14003003c
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rdi]
inc rax
cmp rax, 2
jb 0x14003001a
call fcn.1400bd760
mov rcx, qword [rdi]
call fcn.1400b1cc0
mov qword [rdi], 0
lea rax, [rsi + 1]
cmp rax, 2
jb 0x14003002c
mov qword [rdi], rsi
call fcn.1400bd760
mov ecx, ebx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_SetLastError]
nop
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret

Function at 0x140034b50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov rdi, r8
mov rsi, rdx
mov r15b, byte [rbp + 0x68]
test byte [r9 + 8], 1
jne 0x140034bad
mov dl, byte [rbp + 0x60]
movzx r8d, r15b
mov rax, qword [rcx]
mov rax, qword [rax + 0x30]
mov dword [rsp + 0x28], r8d
mov byte [rsp + 0x20], dl
mov rdx, rsi
mov r8, rdi
call qword [0x1401a3088]
mov rax, rsi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
lea rbx, [rbp - 0x20]
mov rcx, r9
mov rdx, rbx
call fcn.1400aec50
lea rdx, [0x1401c5a18]
mov rcx, rbx
call fcn.1400af870
mov r14, rax
mov rcx, qword [rbp - 0x20]
lea rax, [0x1401c5840]
cmp rcx, rax
je 0x140034bf9
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
test eax, eax
jne 0x140034bf9
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x1401a3088]
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rbx + 0x10], rax
movaps xmm0, xmmword [0x14017d9f0]
movaps xmmword [rbx], xmm0
mov rax, qword [r14]
xor r15b, 1
movzx ecx, r15b
mov rax, qword [rax + rcx*8 + 0x28]
mov rcx, r14
mov rdx, rbx
call qword [0x1401a3088]
movzx eax, byte [rbx + 0x17]
mov rdx, rax
test al, al
jns 0x140034c3c
mov rdx, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x20]
test rdx, rdx
je 0x140034cac
test al, al
cmovns rcx, rbx
mov r14, rcx
jmp 0x140034c8e
movzx edx, al
mov rax, qword [rdi]
mov rax, qword [rax + 0x60]
mov rcx, rdi
call qword [0x1401a3088]
cmp eax, 0xffffffff
jne 0x140034c6a
xor edi, edi
movzx eax, byte [rbp - 9]
mov rcx, qword [rbp - 0x20]
mov rdx, rbx
mov r8, rax
test al, al
jns 0x140034c83
mov r8, qword [rbp - 0x18]
mov rdx, rcx
add rdx, r8
inc r14
cmp r14, rdx
je 0x140034cac
test rdi, rdi
je 0x140034c68
mov al, byte [r14]
mov rcx, qword [rdi + 0x30]
cmp rcx, qword [rdi + 0x38]
je 0x140034c50
lea rdx, [rcx + 1]
mov qword [rdi + 0x30], rdx
mov byte [rcx], al
jmp 0x140034c6a
mov qword [rsi], rdi
test al, al
jns 0x140034b9d
call fcn.1400e0828
jmp 0x140034b9d