joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140025dd0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x140025e04
movabs r10, 0x100000001b3
nop
movzx ecx, byte [rdx + r9]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x140025df0
ret

Function at 0x140026910
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14003f040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1400269e3
cmp byte [rcx + 0x71], 0
je 0x1400269e3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x1400269df
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400269a4
sub eax, 1
je 0x1400269a8
cmp eax, 2
jne 0x1400269df
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140031740
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x1400269d6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x1400269df
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14002698c
xor al, al
jmp 0x14002698c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140031740
add rsp, 0x60
pop rbx
ret

Function at 0x140026d00
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov dword [rcx + 4], edx
lea r9, [rcx + 8]
mov eax, 1
nop dword [rax]
mov r8d, edx
lea r9, [r9 + 4]
shr r8d, 0x1e
xor r8d, edx
imul edx, r8d, 0x6c078965
add edx, eax
inc rax
mov dword [r9 - 4], edx
cmp rax, 0x270
jb 0x140026d10
mov dword [rcx], 0x270
ret
Function at 0x140029e90
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x140029ef1
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x140029eb0
mov ecx, dword [r9]
jmp 0x140029fdb
cmp ecx, 0x4e0
jb 0x140029fdb
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
add r10, 4
mov edx, r11d
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x140029f10
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x140029f60
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x14002cce0
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov dword [rcx + 0x74], 0
mov rbx, rcx
mov edi, 0x7fffffff
movsx ecx, byte [rbx + 0x78]
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x14002cda5
lea r8d, [rcx - 0x30]
cmp r8d, 0xffffffff
je 0x14002cda5
mov r9d, dword [rbx + 0x74]
mov ecx, 0x7fffffff
sub ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp r9d, edx
jg 0x14002cdbe
lea eax, [r9 + r9*4]
dec edi
lea ecx, [r8 + rax*2]
mov rax, qword [rbx + 0x10]
mov dword [rbx + 0x74], ecx
mov rcx, qword [rbx]
cmp rcx, rax
je 0x14002cd95
cmp byte [rcx], 0x5c
jne 0x14002cd8e
lea rdx, [rcx + 1]
cmp rdx, rax
je 0x14002cd8e
mov r8d, dword [rbx + 0x80]
test r8b, 8
jne 0x14002cd7c
movzx eax, byte [rdx]
sub al, 0x28
cmp al, 1
jbe 0x14002cd8b
test r8b, 0x10
jne 0x14002cd8e
movzx eax, byte [rdx]
sub al, 0x7b
test al, 0xfd
jne 0x14002cd8e
mov rcx, rdx
lea rax, [rcx + 1]
mov qword [rbx], rax
mov rcx, rbx
call fcn.140029110
test edi, edi
jne 0x14002cd00
mov rbx, qword [rsp + 0x30]
cmp edi, 0x7fffffff
mov rsi, qword [rsp + 0x38]
setne al
add rsp, 0x20
pop rdi
ret
mov edx, esi
call fcn.140029100
int3

Function at 0x140031140
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x14003117a
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x14003117f
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1400311c8
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x140035760]
cmp byte [rcx + rax], 0
je 0x1400311c8
dec r8
sub rdx, 1
jne 0x1400311ae
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x140032528
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140032572
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140032572
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140032572
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140032572
cmp dword [rcx + 0x84], 0xe
jbe 0x140032572
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140032574
xor al, al
add rsp, 0x28
ret
Function at 0x140003840
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Convert ip address from string
Create tcp socket
Initialize winsock library
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov eax, 0x1200
call fcn.140006730
sub rsp, rax
mov rax, qword [0x14000a008]
xor rax, rsp
mov qword [rsp + 0x11f0], rax
mov rbx, r9
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x38], rcx
xor r14d, r14d
mov dword [rsp + 0x30], r14d
mov ecx, 0x202
lea rdx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_WSAStartup]
lea edx, [r14 + 1]
lea r8d, [r14 + 6]
mov r15d, 2
mov ecx, r15d
call qword [sym.imp.WS2_32.dll_socket]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x140003904
mov word [rsp + 0x40], r15w
mov ecx, 0x1f90
call qword [sym.imp.WS2_32.dll_htons]
mov word [rsp + 0x42], ax
cmp qword [rdi + 0x18], 0x10
jb 0x1400038d1
mov rdi, qword [rdi]
lea r8, [rsp + 0x44]
mov rdx, rdi
mov ecx, r15d
call qword [sym.imp.WS2_32.dll_inet_pton]
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x40]
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x140003911
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_closesocket]
mov rbp, 0xffffffffffffffff
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov rdx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x14000391e
mov rdx, qword [rbx]
xor r9d, r9d
mov r8d, dword [rbx + 0x10]
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x140003942
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov qword [rsi], r14
mov qword [rsi + 0x10], r14
mov qword [rsi + 0x18], send
mov byte [rsi], r14b
mov dword [rsp + 0x30], 1
xor r9d, r9d
mov r8d, 0xfff
lea rdx, [rsp + 0x1f0]
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x140003a2c
nop
mov eax, eax
cmp rax, 0x1000
jae 0x140003a65
mov byte [rsp + rax + 0x1f0], 0
lea rax, [rsp + 0x1f0]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400039a5
mov rcx, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x18]
mov rax, rdx
sub rax, rcx
cmp rbx, rax
ja 0x1400039f2
lea rax, [rcx + rbx]
mov qword [rsi + 0x10], rax
mov rax, rsi
cmp rdx, 0x10
jb 0x1400039d5
mov rax, qword [rsi]
lea rdi, [rax + rcx]
mov r8, rbx
lea rdx, [rsp + 0x1f0]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov byte [rdi + rbx], 0
jmp 0x140003a0a
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x1f0]
mov rdx, rbx
mov rcx, rsi
call fcn.1400052b0
xor r9d, r9d
mov r8d, 0xfff
lea rdx, [rsp + 0x1f0]
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
jg 0x140003980
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov rax, rsi
mov rcx, qword [rsp + 0x11f0]
xor rcx, rsp
call fcn.1400057c0
mov rbx, qword [rsp + 0x1240]
add rsp, 0x1200
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.1400058e8
int3
Function at 0x140006308
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140006352
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140006352
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140006352
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140006352
cmp dword [rcx + 0x84], 0xe
jbe 0x140006352
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140006354
xor al, al
add rsp, 0x28
ret
Function at 0x14002fe50
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 8
movups xmm0, xmmword [rcx]
xorps xmm4, xmm4
lea rax, [r8 + 0x10]
cmp edx, 0x100
je 0x14002ff90
cmp edx, 0xc0
je 0x14002ff10
cmp edx, 0x80
jne 0x140030050
mov edx, 9
movups xmmword [r8], xmm0
aeskeygenassist xmm1, xmm0, 1
call fcn.140030087
aeskeygenassist xmm1, xmm0, 2
call fcn.140030080
aeskeygenassist xmm1, xmm0, 4
call fcn.140030080
aeskeygenassist xmm1, xmm0, 8
call fcn.140030080
aeskeygenassist xmm1, xmm0, 0x10
call fcn.140030080
aeskeygenassist xmm1, xmm0, 0x20
call fcn.140030080
aeskeygenassist xmm1, xmm0, 0x40
call fcn.140030080
aeskeygenassist xmm1, xmm0, 0x80
call fcn.140030080
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.140030080
aeskeygenassist xmm1, xmm0, 0x36
call fcn.140030080
movups xmmword [rax], xmm0
mov dword [rax + 0x50], edx
xor eax, eax
jmp 0x140030057
movq xmm2, qword [rcx + 0x10]
mov edx, ntohl
movups xmmword [r8], xmm0
aeskeygenassist xmm1, xmm2, 1
call fcn.1400300a7
aeskeygenassist xmm1, xmm2, 2
call fcn.1400300e0
aeskeygenassist xmm1, xmm2, 4
call fcn.1400300a0
aeskeygenassist xmm1, xmm2, 8
call fcn.1400300e0
aeskeygenassist xmm1, xmm2, 0x10
call fcn.1400300a0
aeskeygenassist xmm1, xmm2, 0x20
call fcn.1400300e0
aeskeygenassist xmm1, xmm2, 0x40
call fcn.1400300a0
aeskeygenassist xmm1, xmm2, 0x80
call fcn.1400300e0
movups xmmword [rax], xmm0
mov dword [rax + 0x30], edx
xor rax, rax
jmp 0x140030057
movups xmm2, xmmword [rcx + 0x10]
mov edx, reloc.WS2_32.dll_listen
lea rax, [rax + 0x10]
movups xmmword [r8], xmm0
movups xmmword [r8 + 0x10], xmm2
aeskeygenassist xmm1, xmm2, 1
call fcn.140030107
aeskeygenassist xmm1, xmm0, 1
call fcn.140030120
aeskeygenassist xmm1, xmm2, 2
call fcn.140030100
aeskeygenassist xmm1, xmm0, 2
call fcn.140030120
aeskeygenassist xmm1, xmm2, 4
call fcn.140030100
aeskeygenassist xmm1, xmm0, 4
call fcn.140030120
aeskeygenassist xmm1, xmm2, 8
call fcn.140030100
aeskeygenassist xmm1, xmm0, 8
call fcn.140030120
aeskeygenassist xmm1, xmm2, 0x10
call fcn.140030100
aeskeygenassist xmm1, xmm0, 0x10
call fcn.140030120
aeskeygenassist xmm1, xmm2, 0x20
call fcn.140030100
aeskeygenassist xmm1, xmm0, 0x20
call fcn.140030120
aeskeygenassist xmm1, xmm2, 0x40
call fcn.140030100
movups xmmword [rax], xmm0
mov dword [rax + 0x10], edx
xor rax, rax
jmp 0x140030057
mov rax, 0xfffffffffffffffe
pxor xmm0, xmm0
pxor xmm1, xmm1
pxor xmm2, xmm2
pxor xmm3, xmm3
pxor xmm4, xmm4
pxor xmm5, xmm5
add rsp, 8
ret
Function at 0x140030140
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 8
movups xmm0, xmmword [rcx]
xorps xmm4, xmm4
lea rax, [r8 + 0x10]
cmp edx, 0x100
je 0x140030310
cmp edx, 0xc0
je 0x140030270
cmp edx, 0x80
jne 0x1400303e0
mov edx, 9
movdqa xmm5, xmmword [0x1403ae450]
mov r10d, 8
movdqa xmm4, xmmword [0x1403ae470]
movdqa xmm2, xmm0
movdqu xmmword [r8], xmm0
jmp 0x1400301a0
pshufb xmm0, xmm5
aesenclast xmm0, xmm4
pslld xmm4, 1
lea rax, [rax + 0x10]
movdqa xmm3, xmm2
pslldq xmm2, 4
pxor xmm3, xmm2
pslldq xmm2, 4
pxor xmm3, xmm2
pslldq xmm2, 4
pxor xmm2, xmm3
pxor xmm0, xmm2
movdqu xmmword [rax - 0x10], xmm0
movdqa xmm2, xmm0
dec r10d
jne 0x1400301a0
movdqa xmm4, xmmword [str.eeee]
pshufb xmm0, xmm5
aesenclast xmm0, xmm4
pslld xmm4, 1
movdqa xmm3, xmm2
pslldq xmm2, 4
pxor xmm3, xmm2
pslldq xmm2, 4
pxor xmm3, xmm2
pslldq xmm2, 4
pxor xmm2, xmm3
pxor xmm0, xmm2
movdqu xmmword [rax], xmm0
movdqa xmm2, xmm0
pshufb xmm0, xmm5
aesenclast xmm0, xmm4
movdqa xmm3, xmm2
pslldq xmm2, 4
pxor xmm3, xmm2
pslldq xmm2, 4
pxor xmm3, xmm2
pslldq xmm2, 4
pxor xmm2, xmm3
pxor xmm0, xmm2
movdqu xmmword [rax + 0x10], xmm0
mov dword [rax + 0x60], edx
xor eax, eax
jmp 0x1400303e7
movq xmm2, qword [rcx + 0x10]
mov edx, ntohl
movdqa xmm5, xmmword [0x1403ae460]
movdqa xmm4, xmmword [0x1403ae470]
mov r10d, 8
movdqu xmmword [r8], xmm0
jmp 0x1400302a0
movq qword [rax], xmm2
movdqa xmm1, xmm2
pshufb xmm2, xmm5
aesenclast xmm2, xmm4
pslld xmm4, 1
lea rax, [rax + 0x18]
movdqa xmm3, xmm0
pslldq xmm0, 4
pxor xmm3, xmm0
pslldq xmm0, 4
pxor xmm3, xmm0
pslldq xmm0, 4
pxor xmm0, xmm3
pshufd xmm3, xmm0, 0xff
pxor xmm3, xmm1
pslldq xmm1, 4
pxor xmm3, xmm1
pxor xmm0, xmm2
pxor xmm2, xmm3
movdqu xmmword [rax - 0x10], xmm0
dec r10d
jne 0x1400302a0
mov dword [rax + 0x20], edx
xor eax, eax
jmp 0x1400303e7
movups xmm2, xmmword [rcx + 0x10]
mov edx, reloc.WS2_32.dll_listen
lea rax, [rax + 0x10]
movdqa xmm5, xmmword [0x1403ae450]
movdqa xmm4, xmmword [0x1403ae470]
mov r10d, 7
movdqu xmmword [r8], xmm0
movdqa xmm1, xmm2
movdqu xmmword [r8 + 0x10], xmm2
jmp 0x140030350
pshufb xmm2, xmm5
aesenclast xmm2, xmm4
movdqa xmm3, xmm0
pslldq xmm0, 4
pxor xmm3, xmm0
pslldq xmm0, 4
pxor xmm3, xmm0
pslldq xmm0, 4
pxor xmm0, xmm3
pslld xmm4, 1
pxor xmm0, xmm2
movdqu xmmword [rax], xmm0
dec r10d
je 0x1400303d2
pshufd xmm2, xmm0, 0xff
pxor xmm3, xmm3
aesenclast xmm2, xmm3
movdqa xmm3, xmm1
pslldq xmm1, 4
pxor xmm3, xmm1
pslldq xmm1, 4
pxor xmm3, xmm1
pslldq xmm1, 4
pxor xmm1, xmm3
pxor xmm2, xmm1
movdqu xmmword [rax + 0x10], xmm2
lea rax, [rax + 0x20]
movdqa xmm1, xmm2
jmp 0x140030350
mov dword [rax + 0x10], edx
xor eax, eax
jmp 0x1400303e7
mov rax, 0xfffffffffffffffe
pxor xmm0, xmm0
pxor xmm1, xmm1
pxor xmm2, xmm2
pxor xmm3, xmm3
pxor xmm4, xmm4
pxor xmm5, xmm5
add rsp, 8
ret
Function at 0x1400d1d70
Capabilities:
Check mutex on windows

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov byte [rcx], 0
mov qword [rcx + 8], 0
lea r8, str.A946A6A9_917E_4949_B9BC_6BADA8C7FD63
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsi + 8], rax
test rax, rax
je 0x1400d1db0
mov rcx, rax
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
sete byte [rsi]
mov rax, rsi
add rsp, 0x20
pop rsi
ret

Function at 0x1400d3dc0
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov rbx, qword [rcx + 0x10]
cmp rbx, qword [rcx + 0x18]
je 0x1400d3e06
mov r15, rbx
test r15, r15
je 0x1400d3ee2
mov rax, qword [rdi]
mov qword [r15], rax
add qword [rsi + 0x10], 8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r12, qword [rsi]
mov r14, qword [rsi + 8]
mov rax, r14
sub rax, r12
jbe 0x1400d3e62
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
add rax, rcx
inc rax
sar rax, 1
mov r12, rax
neg r12
shl rax, 3
mov r15, r14
sub r15, rax
sub rbx, r14
je 0x1400d3e51
mov rcx, r15
mov rdx, r14
mov r8, rbx
call fcn.1402b6370
mov r14, qword [rsi + 8]
add r15, rbx
mov qword [rsi + 0x10], r15
lea rax, [r14 + r12*8]
mov qword [rsi + 8], rax
jmp 0x1400d3de2
mov rax, rbx
sub rax, r12
sar rax, 2
cmp rbx, r12
mov r13d, 1
cmovne r13, rax
mov rax, r13
shr rax, 0x3d
jne 0x1400d3efe
lea rcx, [r13*8]
call fcn.14027768c
mov rcx, r13
and rcx, 0xfffffffffffffffc
lea rcx, [rax + rcx*2]
mov rdx, rbx
mov r15, rcx
sub rdx, r14
je 0x1400d3ec4
lea r15, [rdx + rcx]
xor r8d, r8d
mov r9, rcx
add r9, r8
je 0x1400d3ee2
mov r10, qword [r14 + r8]
mov qword [r9], r10
add r8, 8
cmp rdx, r8
jne 0x1400d3eac
lea rdx, [rax + r13*8]
mov qword [rsi], rax
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], rdx
cmp rbx, r14
je 0x1400d3ee4
add rbx, 0xfffffffffffffff8
jne 0x1400d3ed7
ud2
test r12, r12
je 0x1400d3de2
mov rcx, r12
call fcn.1402776c8
mov r15, qword [rsi + 0x10]
jmp 0x1400d3de2
call fcn.1402b9a10
int3
Function at 0x1400d9a40
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x850
mov rax, qword [0x140430040]
xor rax, rsp
mov qword [rsp + 0x848], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x20]
mov qword [rsi + 0x10], rax
movaps xmm0, xmmword [0x1403d4b30]
movaps xmmword [rsi], xmm0
mov rcx, rsi
call fcn.1400d9b30
cmp byte [rsi + 0x17], 0
jns 0x1400d9a8c
mov rsi, qword [rsp + 0x20]
lea rdx, [0x1403df7e0]
mov rcx, rsi
call fcn.1402960b8
test rax, rax
je 0x1400d9b25
mov rdi, rax
xor esi, esi
lea rbx, [rsp + 0x40]
mov r8d, 0x800
mov rcx, rbx
xor edx, edx
call fcn.1402b6a10
mov edx, 1
mov r8d, 0x800
mov rcx, rbx
mov r9, rdi
call fcn.140298bf0
test rax, rax
je 0x1400d9ae5
lea rcx, [rsp + 0x40]
call fcn.1402972bc
mov esi, eax
mov rcx, rdi
call fcn.140297f14
cmp byte [rsp + 0x37], 0
jns 0x1400d9afe
mov rcx, qword [rsp + 0x20]
call fcn.1402776c8
mov rcx, qword [rsp + 0x848]
xor rcx, rsp
cmp rcx, qword [0x140430040]
je 0x1400d9b18
call fcn.140278ca0
int3
mov eax, esi
add rsp, 0x850
pop rbx
pop rdi
pop rsi
ret
xor esi, esi
jmp 0x1400d9aed
Function at 0x1400edb50
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x140430040]
xor rax, rsp
mov qword [rsp + 0x30], rax
xor eax, eax
mov qword [rcx], rax
mov r14, qword [rdx]
mov qword [rdx], rax
lea r15, [r14 + 1]
cmp r15, 2
jb 0x1400edb8e
call fcn.14021c380
cmp qword [rsi], r14
je 0x1400edbc1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x1400edc82
cmp r15, 2
jb 0x1400edbb9
mov qword [rsi], r14
call fcn.14021c380
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov qword [rsi + 8], 0xffffffffffffffff
lea r14, [rsi + 0x10]
xor eax, eax
mov qword [rsp + 0x28], rax
mov r15, qword [rdi]
mov qword [rdi], rax
cmp r15, 0xffffffffffffffff
je 0x1400edbea
test r15, r15
je 0x1400edc0e
call fcn.14021c380
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
lea rax, [r15 + 1]
cmp rax, 2
jb 0x1400edc06
mov qword [rsp + 0x28], r15
call fcn.14021c380
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rdx, [rsp + 0x28]
mov rcx, r14
call fcn.1402f0590
mov rax, qword [rbx]
inc rax
cmp rax, 2
jb 0x1400edc3b
call fcn.14021c380
mov rcx, qword [rbx]
call fcn.14020bb00
mov qword [rbx], 0
mov rax, qword [rdi]
inc rax
cmp rax, 2
jb 0x1400edc5b
call fcn.14021c380
mov rcx, qword [rdi]
call fcn.14020bb00
mov qword [rdi], 0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
cmp rcx, qword [0x140430040]
je 0x1400edc72
call fcn.140278ca0
int3
mov rax, rsi
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.14021c380
mov rcx, qword [rsi]
call fcn.14020bb00
mov qword [rsi], 0
jmp 0x1400edbab
Function at 0x1400fbea0
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x158
mov rax, qword [0x140430040]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov eax, dword [0x140442ca0]
mov ecx, dword [0x14043f8b8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400fbf07
lea rax, [0x140442c98]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
cmp rcx, qword [0x140430040]
je 0x1400fbefd
call fcn.140278ca0
int3
add rsp, 0x158
pop rdi
pop rsi
ret
lea rcx, [0x140442ca0]
call fcn.14027770c
cmp dword [0x140442ca0], 0xffffffff
jne 0x1400fbedc
lea rsi, [rsp + 0x38]
mov r8d, 0x118
mov rcx, rsi
xor edx, edx
call fcn.1402b6a10
mov dword [rsi - 4], 0x11c
lea rsi, [rsp + 0x34]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
lea rdi, [rsp + 0x30]
mov dword [rdi], 0
mov ecx, dword [rsi + 4]
mov edx, dword [rsi + 8]
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetProductInfo]
mov ecx, 0x88
call fcn.14027768c
mov rsi, rax
mov edi, dword [rdi]
mov eax, dword [0x140442ce8]
mov ecx, dword [0x14043f8b8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400fbfc7
lea r8, [0x140442cb8]
lea rdx, [rsp + 0x34]
mov rcx, rsi
mov r9d, edi
call fcn.1400fc0c0
mov qword [0x140442c98], rsi
lea rcx, [0x140442ca0]
call fcn.1402777c0
jmp 0x1400fbedc
lea rcx, [0x140442ce8]
call fcn.14027770c
cmp dword [0x140442ce8], 0xffffffff
jne 0x1400fbf98
xorps xmm0, xmm0
movups xmmword [0x140442cd8], xmm0
movups xmmword [0x140442cc8], xmm0
movups xmmword [0x140442cb8], xmm0
lea rcx, [0x140442cb8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rcx, [0x140442ce8]
call fcn.1402777c0
jmp 0x1400fbf98

Function at 0x1400fc010
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x28
mov eax, dword [0x140442ce8]
mov ecx, dword [0x14043f8b8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400fc04b
movzx eax, word [0x140442cb8]
cmp eax, 9
jne 0x1400fc093
mov eax, 1
add rsp, 0x28
ret
lea rcx, [0x140442ce8]
call fcn.14027770c
cmp dword [0x140442ce8], 0xffffffff
jne 0x1400fc035
xorps xmm0, xmm0
movups xmmword [0x140442cd8], xmm0
movups xmmword [0x140442cc8], xmm0
movups xmmword [0x140442cb8], xmm0
lea rcx, [0x140442cb8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rcx, [0x140442ce8]
call fcn.1402777c0
jmp 0x1400fc035
test eax, eax
je 0x1400fc046
cmp eax, 6
jne 0x1400fc0a3
mov eax, 2
jmp 0x1400fc046
cmp eax, 0xc
jne 0x1400fc0af
mov eax, 3
jmp 0x1400fc046
mov eax, 4
jmp 0x1400fc046

Function at 0x1400fd860
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x38
mov rcx, qword [rcx]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
sete al
add rsp, 0x38
ret