joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006de60
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x90
lea rbp, [rsp + 0x80]
vmovdqa xmmword [rbp], xmm6
and rsp, 0xffffffffffffffe0
mov r8, rdx
mov r9, qword [rcx + 0x220]
nop word cs:[rax + rax]
mov eax, dword [0x141dc7c98]
xor edx, edx
div dword [0x141dc7c9c]
and eax, 0x9e21367e
add eax, 0xef0b33cd
or eax, 0x2a2f15f3
cmp eax, 0x572c5c78
je 0x14006de90
cmp r9, 3
ja 0x14006dff0
mov r11d, 0x9057b319
lea r10, [rcx + 0x1e0]
nop dword [rax + rax]
mov eax, dword [0x141dc7ca0]
xor edx, edx
div dword [0x141dc7ca4]
imul eax, eax, 0xfaaef988
imul rax, r11
shr rax, 0x3f
cmp eax, 0x8755c352
ja 0x14006ded0
shl r9, 4
vmovdqu xmm0, xmmword [r8]
vmovdqu xmmword [r10 + r9], xmm0
mov rax, qword [rcx + 0x220]
nop dword [rax]
mov edx, dword [0x141dc7ca8]
add edx, dword [0x141dc7cac]
xor edx, 0x20d9287c
imul rdx, rdx, 0x41a3bcfb
shr rdx, 0x3e
or edx, 0xe5d47352
cmp edx, 0x11890269
jb 0x14006df10
cmp rax, 3
jae 0x14006df6e
mov edx, dword [0x141dc7cc8]
imul edx, dword [0x141dc7ccc]
inc rax
or edx, 0x28e19b81
and edx, 0x28e19b91
cmp edx, 0x6998e6ea
jbe 0x14006e0b3
jmp 0x14006e0df
mov qword [rcx + 0x220], 0
vmovdqa ymm0, ymmword [rcx + 0x1e0]
vmovdqa ymm1, ymmword [rcx + 0x200]
vpunpckhqdq ymm2, ymm0, ymm1
vpermq ymm2, ymm2, 0xd8
vpunpcklqdq ymm0, ymm0, ymm1
vpermq ymm0, ymm0, 0xd8
vpsrlq ymm1, ymm2, 0x28
vpbroadcastd ymm3, dword [0x1400ffca0]
vpor ymm1, ymm1, ymm3
vpsrlq ymm3, ymm0, 0x2e
vpsllq ymm2, ymm2, 0x12
vpor ymm3, ymm2, ymm3
vpsrlq ymm2, ymm0, 0x1a
mov eax, dword [0x141dc7cb8]
add eax, dword [0x141dc7cbc]
and eax, 0x47e0d8c8
imul eax, eax, 0xad05c6b2
vpblendd ymm2, ymm2, ymm3, 0xaa
vpsllq ymm3, ymm3, 0x1a
cmp eax, 0xc50b1e3e
jne 0x14006e02a
jmp 0x14006e079
ud2
mov eax, dword [0x141dc7cc0]
add eax, dword [0x141dc7cc4]
or eax, 0xd7fbffc7
mov edx, 0xd18afe1d
imul rdx, rax
vpbroadcastq ymm4, qword [0x1400ffca8]
shr rdx, 0x3f
vpand ymm5, ymm2, ymm4
vpblendd ymm6, ymm0, ymm3, 0xaa
vpand ymm4, ymm6, ymm4
vmovdqa ymmword [rsp + 0x20], ymm4
vmovdqa ymmword [rsp + 0x40], ymm5
vmovdqa ymmword [rsp + 0x60], ymm1
cmp edx, 0xabb3b2a4
jbe 0x14006e0a4
vpbroadcastq ymm4, qword [0x1400ffca8]
vpand ymm5, ymm2, ymm4
vpblendd ymm6, ymm0, ymm3, 0xaa
vpand ymm4, ymm6, ymm4
vmovdqa ymmword [rsp + 0x20], ymm4
vmovdqa ymmword [rsp + 0x40], ymm5
vmovdqa ymmword [rsp + 0x60], ymm1
jmp 0x14006e02a
lea rdx, [rsp + 0x20]
vzeroupper
call fcn.14006e100
jmp 0x14006e0e8
mov edx, dword [0x141dc7cd0]
xor edx, dword [0x141dc7cd4]
add edx, 0xf9768c79
imul rdx, rdx, 0x433abb0f
shr rdx, 0x3d
mov qword [rcx + 0x220], rax
cmp edx, 0x37d0f34e
jbe 0x14006e0e8
mov qword [rcx + 0x220], rax
jmp 0x14006e0b3
vmovaps xmm6, xmmword [rbp]
lea rsp, [rbp + 0x10]
pop rbp
ret
Function at 0x14006e6d0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rbx
push rax
mov rbp, rsp
and rsp, 0xffffffffffffffe0
mov rbx, rsp
mov eax, dword [0x141dc7cf8]
imul eax, dword [0x141dc7cfc]
add eax, 0x25935b21
xor eax, 0x67cad862
cmp eax, 0x836f6e09
jae 0x14006e720
mov eax, 0x60
call fcn.1400ed360
sub rsp, rax
mov rax, rsp
and rax, 0xffffffffffffffe0
mov rsp, rax
nop word cs:[rax + rax]
mov eax, dword [0x141dc7d00]
sub eax, dword [0x141dc7d04]
and eax, 0x18f8a8e4
imul r8d, eax, 0xdbcabea8
or r8d, 0xa668660c
mov eax, 0x60
call fcn.1400ed360
sub rsp, rax
mov rax, rsp
and rax, 0xffffffffffffffe0
mov rsp, rax
cmp r8d, 0x379a4e7e
jb 0x14006e720
nop
mov r8d, dword [0x141dc7d08]
xor r8d, dword [0x141dc7d0c]
xor r8d, 0x9c83986
add r8d, 0x3280adf6
xor r8d, 0x3f111def
cmp r8d, 0x7ed036d4
ja 0x14006e760
cmp byte [rcx + 0x228], 0
jne 0x14006e8e0
nop dword [rax]
mov r8d, dword [0x141dc7d20]
add r8d, dword [0x141dc7d24]
imul r8d, r8d, 0xe2beef1a
or r8d, 0xe0017308
imul r8d, r8d, 0x54219712
cmp r8d, 0x2e17c1e7
jb 0x14006e7a0
mov r8, qword [rcx + 0x220]
mov r9d, 0xc5a8c69f
nop dword [rax]
mov r10d, dword [0x141dc7d28]
imul r10d, dword [0x141dc7d2c]
add r10d, 0x70c59ae4
imul r10, r9
shr r10, 0x3f
add r10d, 0xb82dc791
cmp r10d, 0xa3ef971
jb 0x14006e7e0
test r8, r8
jne 0x14006e8be
vpbroadcastd ymm1, dword [0x1400ffca0]
vpbroadcastq ymm0, qword [0x1400ffca8]
nop dword [rax]
mov r8d, dword [0x141dc7d30]
sub r8d, dword [0x141dc7d34]
cmp r8d, 0x78e673c8
je 0x14006e830
vmovdqu ymm2, ymmword [rdx]
vmovdqu ymm3, ymmword [rdx + 0x20]
vpunpckhqdq ymm4, ymm2, ymm3
vpermq ymm4, ymm4, 0xd8
vpunpcklqdq ymm2, ymm2, ymm3
vpermq ymm2, ymm2, 0xd8
vpsrlq ymm3, ymm4, 0x28
vpor ymm1, ymm3, ymm1
vpsrlq ymm3, ymm2, 0x2e
vpsllq ymm4, ymm4, 0x12
vpor ymm3, ymm4, ymm3
vpsrlq ymm5, ymm2, 0x1a
vpblendd ymm4, ymm5, ymm4, 0xaa
vpand ymm4, ymm4, ymm0
vpsllq ymm3, ymm3, 0x1a
vpblendd ymm2, ymm2, ymm3, 0xaa
vpand ymm0, ymm2, ymm0
vmovdqa ymmword [rax], ymm0
vmovdqa ymmword [rax + 0x20], ymm4
vmovdqa ymmword [rax + 0x40], ymm1
sub rsp, 0x20
mov rdx, rax
vzeroupper
call fcn.14006e100
nop
lea rsp, [rbp + 8]
pop rbx
pop rbp
ret
ud2
xor eax, eax
test al, al
jne 0x14006e906
mov eax, dword [0x141dc7d10]
or eax, dword [0x141dc7d14]
imul eax, eax, 0x83fed570
add eax, 0xf5ed4870
ud2
ud2
Function at 0x14006e930
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r8, rdx
nop word cs:[rax + rax]
mov eax, dword [0x141dc7d40]
xor eax, dword [0x141dc7d44]
cmp eax, 0xf8cc1a44
je 0x14006e950
mov r9d, dword [rcx + 0x10]
mov eax, dword [rcx + 0x14]
mov qword [rsp + 0x20], rax
mov r14d, dword [rcx + 0x18]
mov eax, dword [rcx + 0x1c]
mov qword [rsp], rax
mov ebx, dword [rcx + 0x20]
mov ebp, dword [rcx + 0x28]
mov r13d, 0x3ffffff
nop word cs:[rax + rax]
mov eax, dword [0x141dc7d48]
xor edx, edx
div dword [0x141dc7d4c]
or eax, 0xfdf95fc7
add eax, 0xe96f7079
cmp eax, 0x23550c3
jb 0x14006e990
mov edx, dword [rcx + 0x34]
mov r12d, dword [r8 + 3]
mov r15d, dword [r8 + 6]
mov esi, dword [r8 + 0xc]
mov r11d, dword [r8 + 9]
shr r11d, 6
add r11d, dword [rcx + 0x30]
shr r15d, 4
and r15d, 0x3ffffff
add r15d, dword [rcx + 0x2c]
shr r12d, 2
and r12d, 0x3ffffff
and r13d, dword [r8]
add r12d, ebp
add r13d, dword [rcx + 0x24]
lea edi, [rbx + rbx*4]
lea r10d, [r14 + r14*4]
shr esi, 8
add edx, esi
add edx, 0x1000000
mov r8, r13
imul r8, r9
mov rsi, r12
imul rsi, rdi
add rsi, r8
mov qword [rsp + 8], r14
mov r14, r11
imul r14, r10
add r14, rsi
mov qword [rsp + 0x10], rbx
mov rax, qword [rsp]
lea ebp, [rax + rax*4]
mov r8, r15
imul r8, rbp
add r14, r8
mov rax, qword [rsp + 0x20]
lea r8d, [rax + rax*4]
imul r8, rdx
add r8, r14
mov rsi, r13
imul rsi, rax
mov r14, r12
imul r14, r9
add r14, rsi
mov rsi, r11
imul rsi, rbp
add rsi, r14
mov r14, r15
imul r14, rdi
add rsi, r14
imul r10, rdx
add r10, rsi
mov qword [rsp + 0x18], r10
mov rsi, r13
mov rbx, qword [rsp + 8]
imul rsi, rbx
mov r14, r12
imul r14, rax
add r14, rsi
mov rsi, r11
imul rsi, rdi
add rsi, r14
mov r14, r15
imul r14, r9
add rsi, r14
imul rbp, rdx
add rbp, rsi
mov rsi, r13
mov r10, qword [rsp]
imul rsi, r10
mov r14, r12
imul r14, rbx
add r14, rsi
mov rsi, r11
imul rsi, r9
add rsi, r14
mov r14, r15
imul r14, rax
add rsi, r14
imul rdi, rdx
add rdi, rsi
mov rsi, qword [rsp + 0x10]
imul rsi, r13
imul r12, r10
add r12, rsi
imul r15, rbx
imul r11, rax
add r11, r12
add r11, r15
imul rdx, r9
add rdx, r11
mov r9, r8
shr r9, 0x1a
and r8d, 0x3ffffff
mov r9d, r9d
add r9, qword [rsp + 0x18]
mov r10, r9
shr r10, 0x1a
and r9d, 0x3ffffff
mov r10d, r10d
add r10, rbp
mov r11, r10
shr r11, 0x1a
mov r11d, r11d
add r11, rdi
mov rax, r11
shr rax, 0x1a
mov eax, eax
add rax, rdx
mov rdx, rax
shr rdx, 0x1a
lea edx, [rdx + rdx*4]
add edx, r8d
mov r8d, edx
shr r8d, 0x1a
add r8d, r9d
and edx, 0x3ffffff
mov dword [rcx + 0x24], edx
mov dword [rcx + 0x28], r8d
and r10d, 0x3ffffff
mov dword [rcx + 0x2c], r10d
and r11d, 0x3ffffff
mov dword [rcx + 0x30], r11d
and eax, 0x3ffffff
mov dword [rcx + 0x34], eax
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140074ce0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rax, qword [rcx + 0x10]
mov rsi, rcx
nop
mov ecx, dword [0x141dc8ea8]
xor ecx, dword [0x141dc8eac]
xor ecx, 0xa0c9bafd
imul ecx, ecx, 0xca3ff41
add ecx, 0xb0869adb
cmp ecx, 0xfeb96e1a
jb 0x140074cf0
cmp eax, 1
jne 0x140074e8e
nop
mov eax, dword [0x141dc8eb0]
or eax, dword [0x141dc8eb4]
xor eax, 0x66d89000
or eax, 0x99256ffc
add eax, 0xc1012091
cmp eax, 0x79bf0cf
jb 0x140074d20
mov eax, dword [0x141dc8eb8]
mov ecx, dword [0x141dc8ebc]
add eax, ecx
add eax, 0xbc2b9152
xor eax, 0x2b8e1aea
cmp eax, 0x588b5d9b
ja 0x140074d72
mov rdi, qword [rsi + 0x18]
mov rax, qword [rsi + 0x20]
mov byte [rdi], 0
xor ecx, ecx
test cl, cl
je 0x140074d80
mov rax, qword [rsi + 0x18]
mov byte [rax], 0
jmp 0x140074d61
mov ecx, dword [0x141dc8ec0]
or ecx, dword [0x141dc8ec4]
imul ecx, ecx, 0x5b5e6c09
xor ecx, 0xfc4354df
imul ecx, ecx, 0xc2fb0aaa
cmp ecx, 0xe7549009
ja 0x140074d80
test rax, rax
je 0x140074e8e
mov eax, dword [0x141dc8ec8]
xor edx, edx
div dword [0x141dc8ecc]
imul eax, eax, 0x5986132b
add eax, 0x62fc80fb
or eax, 0xab44a339
cmp eax, 0x6b669386
je 0x140074df4
mov eax, dword [0x141dc8ed0]
imul eax, dword [0x141dc8ed4]
or eax, 0xce7856d6
mov rbx, qword [0x141dd7fe0]
cmp eax, 0x691d375
jne 0x140074dfd
mov rax, qword [0x141dd7fe0]
jmp 0x140074dd4
mov eax, dword [0x141dc8ed8]
xor eax, dword [0x141dc8edc]
imul eax, eax, 0xd745d8f0
add eax, 0x7c30af44
mov ecx, 0xd854e799
imul rcx, rax
shr rcx, 0x3e
cmp ecx, 0x678a61d6
ja 0x140074e5d
mov ebp, dword [0x141dc8ee0]
sub ebp, dword [0x141dc8ee4]
xor ebp, 0x52bd99a6
add ebp, 0xce941013
or ebp, 0xa280842b
mov rcx, rbx
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp ebp, 0xbcaa055c
jae 0x140074e70
mov rcx, rbx
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x140074e29
mov eax, dword [0x141dc8ee8]
add eax, dword [0x141dc8eec]
and eax, 0xd850fe9
imul eax, eax, 0x2cd1a267
cmp eax, 0x6db8c34e
je 0x140074e70
cmp rsi, 0xffffffffffffffff
je 0x140074f11
lock dec qword [rsi + 8]
jne 0x140074f11
mov eax, dword [0x141dc8ef0]
sub eax, dword [0x141dc8ef4]
add eax, 0x3c86e87e
xor eax, 0xc8442c86
mov ecx, 0xb16d0703
imul rcx, rax
shr rcx, 0x3f
cmp ecx, 0xd892c9ad
jbe 0x140074ed0
nop word cs:[rax + rax]
mov eax, dword [str._bdj_]
xor edx, edx
div dword [0x141dc8efc]
imul eax, eax, 0xa33daa8c
or eax, 0x573bedea
imul eax, eax, 0x53c4f536
cmp eax, 0xe146fc06
ja 0x140074ed0
mov rcx, qword [0x141dd7fe0]
xor edx, edx
mov r8, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_HeapFree]
nop
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x140077420
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
push rax
mov rbp, rsp
mov eax, dword [0x141dc9460]
xor edx, edx
div dword [0x141dc9464]
and eax, 0x300840
add eax, 0x58d1aa73
cmp eax, 0xd2c8be5
jae 0x140077490
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
mov eax, 0x60
call fcn.1400ed360
sub rsp, rax
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
mov eax, 0x60
call fcn.1400ed360
sub rsp, rax
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
xor r8d, r8d
nop word cs:[rax + rax]
Function at 0x140086dc0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
push rax
mov rbp, rsp
mov rsi, rdx
mov rdi, rcx
mov eax, dword [0x141dcb410]
invalid
add dword [rbx], esi
add eax, 0x1d44636
imul eax, eax, 0xb37c4659
or eax, 0x8274823
invalid
invalid
or byte [0x18e7fbce1], ah
cmp eax, 0x625a69e8
ja 0x140086e58

Function at 0x140087240
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
nop word [rax + rax]
mov eax, dword [0x141dcb4a0]
add eax, dword [0x141dcb4a4]
and eax, 0x25410f4a
xor eax, 0xca65d2f
imul eax, eax, 0xaae5ab48
cmp eax, 0x9b5b47eb
ja 0x140087250
mov eax, 0x87ea3207
mov edx, 0xc75493bf
nop dword [rax]
Function at 0x14008a0a0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
nop word [rax + rax]
mov eax, dword [0x141dcbac0]
xor eax, dword [0x141dcbac4]
or eax, 0xe4377829
imul eax, eax, 0x5515e13
cmp eax, 0x99fc2abe
je 0x14008a0b0
test dl, dl
je 0x14008a12d
mov eax, dword [0x141dcbae0]
or eax, dword [0x141dcbae4]
or eax, 0x3d4ccb77
add eax, 0xa54a554c
xor eax, 0x8647cf7d
cmp eax, 0x83d2efa7
jbe 0x14008a100
mov byte [rcx + 0x10], 1
nop dword [rax + rax]
mov eax, dword [0x141dcbae8]
or eax, dword [0x141dcbaec]
imul eax, eax, 0x5264f05c
xor eax, 0x5987d00c
imul rax, rax, 0x6667c6b9
shr rax, 0x3e
mov byte [rcx + 0x10], 1
cmp eax, 0x6f427354
jae 0x14008a100
mov eax, dword [0x141dcbac8]
xor edx, edx
div dword [0x141dcbacc]
lea rax, [rcx + 8]
nop
mov edx, dword [0x141dcbad0]
add edx, dword [0x141dcbad4]
xor edx, 0x20b11283
and edx, 0x21fbd283
xor edx, 0x572712ff
cmp edx, 0xb070c06f
ja 0x14008a140
lock dec qword [rax]
sete al
nop dword [rax]
mov edx, dword [0x141dcbad8]
or edx, dword [0x141dcbadc]
xor edx, 0x4500c04
and edx, 0x455a4c46
cmp edx, 0xca287fec
je 0x14008a170
test al, al
je 0x14008a24f
mov rsi, qword [rcx]
mov cl, 1
xchg byte [rsi + 0x30], cl
add rsi, 0x30
nop word cs:[rax + rax]
mov eax, dword [0x141dcbaf0]
xor edx, edx
div dword [0x141dcbaf4]
xor eax, 0xbad010c5
imul eax, eax, 0x7d9d0a20
xor eax, 0x7c149448
cmp eax, 0xd1d9a91d
ja 0x14008a1b0
cmp cl, 0xff
jne 0x14008a24f
mov eax, dword [0x141dcbaf8]
and eax, dword [0x141dcbafc]
imul eax, eax, 0xf63f7b32
xor eax, 0xf9bcd8e0
imul rax, rax, 0x2087353d
shr rax, 0x3c
cmp eax, 0x64049db6
jne 0x14008a20c
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WakeByAddressSingle]
mov rbx, qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WakeByAddressSingle]
nop word cs:[rax + rax]
mov eax, dword [0x141dcbb00]
xor edx, edx
div dword [0x141dcbb04]
mov edi, eax
add edi, 0x58deb45
and edi, 0xb1915f9f
add edi, 0xb11d85b9
mov rcx, rsi
call rbx
cmp edi, 0x6215b3db
jb 0x14008a220
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x14008a550
Capabilities:
Encode data using xor
Get system information on windows

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x18
lea rbp, [rsp + 0x10]
movaps xmmword [rbp - 0x10], xmm6
mov eax, dword [0x141dcbb58]
add eax, dword [0x141dcbb5c]
or eax, 0xee8f7de
add eax, 0x17ffa275
or eax, 0xc9651733
cmp eax, 0xd0882394
jae 0x14008a5af
mov eax, 0x30
call fcn.1400ed360
sub rsp, rax
mov rcx, rsp
xorps xmm0, xmm0
movups xmmword [rcx + 0x20], xmm0
movups xmmword [rcx + 0x10], xmm0
movups xmmword [rcx], xmm0
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
add rsp, 0x20
xorps xmm6, xmm6
mov rdi, qword [sym.imp.KERNEL32.dll_GetSystemInfo]
nop dword [rax]
mov eax, dword [0x141dcbb60]
and eax, dword [0x141dcbb64]
add eax, 0x5d31f05e
and eax, 0xabbcb8ab
imul ebx, eax, 0x94b45305
mov eax, 0x30
call fcn.1400ed360
sub rsp, rax
mov rsi, rsp
movups xmmword [rsi + 0x20], xmm6
movups xmmword [rsi + 0x10], xmm6
movups xmmword [rsi], xmm6
sub rsp, 0x20
mov rcx, rsi
call rdi
add rsp, 0x20
cmp ebx, 0x51e62f4f
ja 0x14008a5c0
mov ecx, dword [rsi + 0x20]
mov eax, dword [0x141dcbb68]
xor edx, edx
div dword [0x141dcbb6c]
lea r8, [0x141db6988]
nop word cs:[rax + rax]
mov r10d, dword [0x141dcbb70]
or r10d, dword [0x141dcbb74]
xor r10d, 0x174e6015
or r10d, 0x28b19042
xor r10d, 0x861dd235
xor eax, eax
test rcx, rcx
sete r9b
mov rdx, rcx
cmove rdx, r8
cmp r10d, 0xc6f64db4
ja 0x14008a630
mov al, r9b
movaps xmm6, xmmword [rbp - 0x10]
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop rbp
ret
Function at 0x14008c180
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r8, rdx
mov eax, dword [0x141dcbf18]
add eax, 0x1d3fd7f

Function at 0x14008d0b0
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
xor eax, eax
nop word cs:[rax + rax]

Function at 0x14008e1c0
Capabilities:
Encode data using base64
Encode data using xor
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
Function at 0x140091f50
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x70
mov rdi, rdx
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x60], 0
Function at 0x1400966d0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
push rax
mov rbp, rsp
mov eax, dword [0x141dcd528]
or eax, dword [0x141dcd52c]
mov rsi, rcx
or eax, 0x4423590e
and eax, 0x44235dcf
cmp eax, 0x63d557f1
jbe 0x140096710
mov eax, 0x20
call fcn.1400ed360
push rsi
insb byte [rdi], dx
add eax, 0xc4294800

Function at 0x140096a10
Capabilities:
Create directory
Encode data using base64
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x70
mov rsi, rdx
mov rdi, rcx
mov eax, dword [0x141dcd598]
or eax, dword [0x141dcd59c]
or eax, 0xc1aedd6e
add eax, 0xae6c17bc
xor eax, 0x37f248d7
cmp eax, 0xa6227191
jae 0x140096a52
lea rcx, [rsp + 0x28]
mov rdx, rdi
mov r8, rsi
call fcn.14008f360
movabs r14, 0x8000000000000000
lea rbx, [rsp + 0x28]
nop word cs:[rax + rax]
mov ebp, dword [0x141dcd5a0]
xor ebp, dword [0x141dcd5a4]
and ebp, 0x42fc4c4e
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call fcn.14008f360
cmp ebp, 0xae28ef87
je 0x140096a70
mov rax, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
cmp rax, r14
jne 0x140096ae0
nop word [rax + rax]
mov ecx, dword [0x141dcd5b0]
add ecx, dword [0x141dcd5b4]
shr ecx, 1
imul rcx, rcx, 0x478ef353
shr rcx, 0x3d
xor ecx, 0xb0c63d9b
cmp ecx, 0x772f8a8b
jb 0x140096ae0
nop word [rax + rax]

Function at 0x140099670
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x138
mov rsi, rdx
mov rdi, rcx
mov eax, dword [0x141dcdb60]
imul eax, dword [0x141dcdb64]

Function at 0x14009b080
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
push rax
mov rbp, rsp
mov r8, rdx
mov rdx, rcx
xor eax, eax
test al, al
jne 0x14009b0c8
invalid

Function at 0x14009b540
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
nop dword [rax + rax]

Function at 0x14009b8a0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov r14, r8
mov r15, rdx
Function at 0x14009e1e0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
push rax
mov rbp, rsp
mov rdi, rcx
mov eax, dword [0x141dce620]
xor eax, dword [0x141dce624]
imul eax, eax, 0x2e9e44ae
add eax, 0xf89d3ae7
or eax, 0xde4a7d01
cmp eax, 0xe289b0d6
jne 0x14009e230
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
Function at 0x1400af620
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov qword [rbp - 0x18], r8
mov rsi, rcx
mov eax, dword [0x141dd0160]
add eax, dword [0x141dd0164]
imul rcx, rax, 0x5d318679
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1d
xor eax, 0x61f870b3
add eax, 0x1b81d520
sbb dword [rbx], 0x9aeffa3d
invalid
jbe 0x1400af680
mov eax, 0x40
call fcn.1400ed360
sub rsp, rax
nop word [rax + rax]
mov eax, dword [0x141dd0168]
or eax, dword [0x141dd016c]
or eax, 0x45643b3e
imul ecx, eax, 0x7cfe1711
add ecx, 0x37a2d21b
mov eax, 0x40
call fcn.1400ed360
sub rsp, rax
mov r12, rsp
cmp ecx, 0x42338066
jb 0x1400af680
retf
mov eax, 0x40
call fcn.1400ed360
sub rsp, rax
mov qword [rbp], rsp
mov eax, 0x60
Function at 0x1400b1f80
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
nop word cs:[rax + rax]

Function at 0x1400b4a30
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
movaps xmmword [rsp + 0x50], xmm6
mov r15, rdx
mov rsi, rcx
mov eax, dword [0x141dd0c40]
and eax, dword [0x141dd0c44]
imul eax, eax, 0x7bd9613a
add eax, 0x18f2663c
and eax, 0xc6011b80
cmp eax, 0x6e9b7598
je 0x1400b4aa1
mov eax, dword [0x141dd0c48]
xor edx, edx
div dword [0x141dd0c4c]
and eax, 0xff2457d4
add eax, 0x2600c59b
imul rax, rax, 0x3388f9bf
shr rax, 0x39
mov qword [rsp + 0x38], 0
cmp eax, 0x68f2c4c0
jne 0x1400b4aac
mov qword [rsp + 0x38], 0
jmp 0x1400b4a6e
mov rbx, qword [r15 + 0x10]
mov rax, rbx
shr rax, 0x20
je 0x1400b4b10
nop dword [rax]
mov eax, dword [0x141dd0ce8]
sub eax, dword [0x141dd0cec]
xor eax, 0x20400008
and eax, 0x38ec1479
add eax, 0x4c3ee2d7
cmp eax, 0x440e688d
jb 0x1400b4ac0
mov eax, dword [0x141dd0cf0]
xor edx, edx
div dword [0x141dd0cf4]
and eax, 0x9881e210
imul eax, eax, 0x8bfe0266
or eax, 0x213bd57
cmp eax, 0x8f5a3d78
jbe 0x1400b5764
jmp 0x1400b5799
mov eax, dword [0x141dd0c50]
add eax, dword [0x141dd0c54]
xor eax, 0x10410288
or eax, 0x4e36ed01
imul eax, eax, 0xff65b3af
cmp eax, 0x2e25e4e3
jbe 0x1400b4b45
lea r9, [rsp + 0x38]
xor ecx, ecx
mov edx, ebx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
lea rdi, [rsp + 0x38]
mov r13, qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
nop word cs:[rax + rax]
mov eax, dword [0x141dd0c58]
add eax, dword [0x141dd0c5c]
imul ebp, eax, 0xee40945e
or ebp, 0x591ec724
add ebp, 0x60bc440
xor ecx, ecx
mov edx, ebx
xor r8d, r8d
mov r9, rdi
call r13
cmp ebp, 0xcc367fc6
ja 0x1400b4b60
mov r12, qword [rsp + 0x38]
nop dword [rax + rax]
mov eax, dword [0x141dd0c60]
or eax, dword [0x141dd0c64]
or eax, 0x2499002
xor eax, 0x419110
or eax, 0xddb66eed
cmp eax, 0xed464b68
je 0x1400b4ba0
test r12, r12
js 0x1400b4c69
nop dword [rax + rax]
mov eax, dword [0x141dd0c70]
imul eax, dword [0x141dd0c74]
imul rax, rax, 0x4877424d
shr rax, 0x3d
or eax, 0x491c5304
cmp eax, 0xc61e9afd
ja 0x1400b4bd0
nop word cs:[rax + rax]
mov eax, dword [0x141dd0c78]
or eax, dword [0x141dd0c7c]
imul rcx, rax, 0xed91bab
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1d
or eax, 0xa41462c0
and eax, 0xa41462c1
cmp eax, 0x8e411999
jb 0x1400b4c00
test r12, r12
je 0x1400b4c62
mov eax, dword [0x141dd0c80]
add eax, dword [0x141dd0c84]
imul rax, rax, 0x68ddb0ad
shr rax, 0x3e
or eax, 0xffd45c5a
cmp eax, 0xddddbf78
jae 0x1400b5663
jmp 0x1400b5694
mov edi, 1
jmp 0x1400b4ca3
mov eax, dword [0x141dd0c68]
and eax, dword [0x141dd0c6c]
and eax, 0xb479b0e6
imul rcx, rax, 0x2f2f517b
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1e
cmp eax, 0x319dfa04
je 0x1400b4c9d
ud2
ud2